xmrig | 74829f49822dd6abdc1991e97ce309cd7fe099d58a053d367d06e474f4ea7282

Analysis

max time kernel
20s
max time network
31s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
Size

1.9MB
MD5

040bbbd0626c742afa97da9ad7463c61
SHA1

dab0891105d499f5cf77635a23f70555dc09db2e
SHA256

74829f49822dd6abdc1991e97ce309cd7fe099d58a053d367d06e474f4ea7282
SHA512

d7af5d29d65fc1cb350b428d3c1053fb6518c3977bc48e5fb6fcc3d294697342d4c2178a08ae0cc95ff6d8fd43c235ff937f880374729e72925ffbdcbd68b947
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1B:NAB4

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/3060-100-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2340-98-0x000000013F220000-0x000000013F612000-memory.dmp	xmrig
behavioral1/memory/2200-97-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2680-35-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/2532-92-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/2780-91-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	xmrig
behavioral1/memory/2652-68-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/2684-67-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/2628-23-0x000000013FB20000-0x000000013FF12000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2628	nPCzaxZ.exe
3060	rlxUNbm.exe
2680	ujiqTPI.exe
2684	jSfZYGM.exe
2652	oojYhxq.exe
2780	IwbfXid.exe
2532	BiGPTfv.exe
2200	sCbyUZQ.exe
2340	QFyoOzB.exe
3004	ifQxIvw.exe
1640	NduyJGy.exe
1544	kPWfSaR.exe
2604	vPYWajY.exe
2824	zrqsFZV.exe
1320	QMPJLQM.exe
2068	eDpdeQr.exe
2512	OLBeVwD.exe
1984	hOXxtba.exe
572	rzqyMgm.exe
1744	xHSjaRL.exe
2504	SeKZRAx.exe
2832	qolkerG.exe
352	Lhdfnma.exe
2576	AePoqVl.exe
2552	BGIPwgh.exe
2704	zwQchgk.exe
2932	IiuDFxy.exe
3020	tCxYRLM.exe
1728	UxvNerv.exe
3044	xmZAymO.exe
1560	wYbzckG.exe
1876	IrxzSoY.exe
1240	ScAjnpf.exe
1960	EEjpvtr.exe
1924	yaXEBvR.exe
940	jpUfzDy.exe
1816	eFvHbDm.exe
1040	bveGGIG.exe
1684	dxdrIki.exe
964	gqYhNAM.exe
1044	UYrvMpw.exe
2112	sMyPnUD.exe
1060	aexxQHC.exe
2172	fcZeOeF.exe
2296	oOOpvXC.exe
1804	UZBlBgq.exe
1128	KTOXjHZ.exe
2440	qAtZAIv.exe
1708	CZUITVZ.exe
2760	VGAESFC.exe
2568	wFQXZvR.exe
2860	rtTQMtn.exe
2888	wURggfQ.exe
628	WAqElrd.exe
2108	gWLxEfp.exe
1812	TpzCAAz.exe
1780	wSgqOMJ.exe
796	gFGBgJt.exe
2712	RiTguTH.exe
3040	fgskyfo.exe
1328	aNsfixc.exe
2436	CiILHlG.exe
1608	tesLZPc.exe
2788	yKfMvdo.exe

Loads dropped DLL 64 IoCs

pid	Process
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00350000000141aa-5.dat	upx
behavioral1/files/0x00070000000144d6-39.dat	upx
behavioral1/files/0x0006000000015b37-65.dat	upx
behavioral1/files/0x0006000000015cc2-89.dat	upx
behavioral1/files/0x0006000000015cd8-105.dat	upx
behavioral1/files/0x0006000000016020-163.dat	upx
behavioral1/files/0x000600000001650f-182.dat	upx
behavioral1/files/0x0006000000016591-190.dat	upx
behavioral1/files/0x00080000000150aa-177.dat	upx
behavioral1/files/0x000600000001640f-173.dat	upx
behavioral1/files/0x0006000000016126-165.dat	upx
behavioral1/files/0x0006000000015fbb-157.dat	upx
behavioral1/files/0x000700000001448b-152.dat	upx
behavioral1/files/0x0006000000015d99-147.dat	upx
behavioral1/files/0x0006000000015d28-139.dat	upx
behavioral1/files/0x0006000000015d13-131.dat	upx
behavioral1/files/0x0008000000014317-125.dat	upx
behavioral1/files/0x0006000000015cf5-122.dat	upx
behavioral1/files/0x0006000000015ce1-113.dat	upx
behavioral1/memory/3060-100-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/memory/2340-98-0x000000013F220000-0x000000013F612000-memory.dmp	upx
behavioral1/memory/2200-97-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/files/0x0006000000015cca-96.dat	upx
behavioral1/files/0x0007000000015ca9-86.dat	upx
behavioral1/files/0x0006000000015c91-79.dat	upx
behavioral1/files/0x0006000000015b72-56.dat	upx
behavioral1/files/0x0006000000015a15-47.dat	upx
behavioral1/files/0x000600000001543a-41.dat	upx
behavioral1/memory/2680-35-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/files/0x0006000000016228-170.dat	upx
behavioral1/files/0x0006000000015f40-155.dat	upx
behavioral1/files/0x0006000000015d89-144.dat	upx
behavioral1/files/0x0006000000015d1e-137.dat	upx
behavioral1/files/0x0006000000015d02-130.dat	upx
behavioral1/files/0x0006000000015ced-119.dat	upx
behavioral1/memory/2532-92-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/memory/2780-91-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	upx
behavioral1/files/0x00130000000054a8-90.dat	upx
behavioral1/memory/2652-68-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/memory/2684-67-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/files/0x0006000000015bb5-66.dat	upx
behavioral1/files/0x00060000000155e8-64.dat	upx
behavioral1/files/0x000600000001523e-63.dat	upx
behavioral1/files/0x0007000000014430-38.dat	upx
behavioral1/memory/2460-9-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2628-23-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx
behavioral1/files/0x0008000000014254-15.dat	upx
behavioral1/files/0x000d000000012279-14.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kvqOToh.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\BtGoGRU.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\gotZZoR.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\jeRAXwu.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\dlPWwxx.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\TmCkykS.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\gFGBgJt.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\JfzkzAu.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\fHtzeOR.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\xuBZuWE.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\bZJkeEc.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\bveGGIG.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\GjpKQSK.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\nuOqmvE.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\uImjTJn.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\jfCqmpz.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\HqtJoAu.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\DmxwXnh.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\jBiDoic.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\mCOjJtI.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\qylVMJz.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\IHZDbbA.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\Uiztzfd.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\LvYWdai.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\zvTsWiG.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\tnmUcqR.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\uzoZYuB.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\xfmsqhg.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\HzJWbMR.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\qWcZRVQ.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\nAQenbq.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\UVsoCwj.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\PRiephL.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\jtJjROz.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\vxmLhqr.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\CuOpRCe.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\uQwYRxU.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\EGZJvTN.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\xHSjaRL.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\oOOpvXC.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\YHXhPCg.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\VHbBomJ.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\umwqupM.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\uwVkWVY.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\SSnRPBT.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\OLBeVwD.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\gqmKhCN.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\qBgbAbx.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\ESxAXtO.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\wtHxrPX.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\AAZBmrA.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\kOKVmMf.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\NhlueEB.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\gnNTPpy.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\sSchhES.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\IEnmxNZ.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\nCYNcLG.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\VArFUmh.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\kWqVKGg.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\zBbOiyo.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\fcZeOeF.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\SFgMaNy.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\KbMgxpF.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
File created	C:\Windows\System\uTPVyWn.exe	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2456	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
Token: SeDebugPrivilege	2456	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2456	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	29
PID 2460 wrote to memory of 2456	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	29
PID 2460 wrote to memory of 2456	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	29
PID 2460 wrote to memory of 3060	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	30
PID 2460 wrote to memory of 3060	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	30
PID 2460 wrote to memory of 3060	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	30
PID 2460 wrote to memory of 2628	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2628	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2628	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2680	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	32
PID 2460 wrote to memory of 2680	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	32
PID 2460 wrote to memory of 2680	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	32
PID 2460 wrote to memory of 2824	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	33
PID 2460 wrote to memory of 2824	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	33
PID 2460 wrote to memory of 2824	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	33
PID 2460 wrote to memory of 2684	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	34
PID 2460 wrote to memory of 2684	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	34
PID 2460 wrote to memory of 2684	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	34
PID 2460 wrote to memory of 1984	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	35
PID 2460 wrote to memory of 1984	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	35
PID 2460 wrote to memory of 1984	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	35
PID 2460 wrote to memory of 2652	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	36
PID 2460 wrote to memory of 2652	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	36
PID 2460 wrote to memory of 2652	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	36
PID 2460 wrote to memory of 2832	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	37
PID 2460 wrote to memory of 2832	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	37
PID 2460 wrote to memory of 2832	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	37
PID 2460 wrote to memory of 2780	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	38
PID 2460 wrote to memory of 2780	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	38
PID 2460 wrote to memory of 2780	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	38
PID 2460 wrote to memory of 2576	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	39
PID 2460 wrote to memory of 2576	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	39
PID 2460 wrote to memory of 2576	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	39
PID 2460 wrote to memory of 2532	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	40
PID 2460 wrote to memory of 2532	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	40
PID 2460 wrote to memory of 2532	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	40
PID 2460 wrote to memory of 2552	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	41
PID 2460 wrote to memory of 2552	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	41
PID 2460 wrote to memory of 2552	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	41
PID 2460 wrote to memory of 2200	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	42
PID 2460 wrote to memory of 2200	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	42
PID 2460 wrote to memory of 2200	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	42
PID 2460 wrote to memory of 2704	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	43
PID 2460 wrote to memory of 2704	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	43
PID 2460 wrote to memory of 2704	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	43
PID 2460 wrote to memory of 2340	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	44
PID 2460 wrote to memory of 2340	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	44
PID 2460 wrote to memory of 2340	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	44
PID 2460 wrote to memory of 2932	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	45
PID 2460 wrote to memory of 2932	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	45
PID 2460 wrote to memory of 2932	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	45
PID 2460 wrote to memory of 3004	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	46
PID 2460 wrote to memory of 3004	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	46
PID 2460 wrote to memory of 3004	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	46
PID 2460 wrote to memory of 3020	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	47
PID 2460 wrote to memory of 3020	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	47
PID 2460 wrote to memory of 3020	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	47
PID 2460 wrote to memory of 1640	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	48
PID 2460 wrote to memory of 1640	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	48
PID 2460 wrote to memory of 1640	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	48
PID 2460 wrote to memory of 1728	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	49
PID 2460 wrote to memory of 1728	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	49
PID 2460 wrote to memory of 1728	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	49
PID 2460 wrote to memory of 1544	2460	040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\040bbbd0626c742afa97da9ad7463c61_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2456
- C:\Windows\System\rlxUNbm.exe
  C:\Windows\System\rlxUNbm.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\nPCzaxZ.exe
  C:\Windows\System\nPCzaxZ.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\ujiqTPI.exe
  C:\Windows\System\ujiqTPI.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\zrqsFZV.exe
  C:\Windows\System\zrqsFZV.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\jSfZYGM.exe
  C:\Windows\System\jSfZYGM.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\hOXxtba.exe
  C:\Windows\System\hOXxtba.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\oojYhxq.exe
  C:\Windows\System\oojYhxq.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\qolkerG.exe
  C:\Windows\System\qolkerG.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\IwbfXid.exe
  C:\Windows\System\IwbfXid.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\AePoqVl.exe
  C:\Windows\System\AePoqVl.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\BiGPTfv.exe
  C:\Windows\System\BiGPTfv.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\BGIPwgh.exe
  C:\Windows\System\BGIPwgh.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\sCbyUZQ.exe
  C:\Windows\System\sCbyUZQ.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\zwQchgk.exe
  C:\Windows\System\zwQchgk.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\QFyoOzB.exe
  C:\Windows\System\QFyoOzB.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\IiuDFxy.exe
  C:\Windows\System\IiuDFxy.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\ifQxIvw.exe
  C:\Windows\System\ifQxIvw.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\tCxYRLM.exe
  C:\Windows\System\tCxYRLM.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\NduyJGy.exe
  C:\Windows\System\NduyJGy.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\UxvNerv.exe
  C:\Windows\System\UxvNerv.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\kPWfSaR.exe
  C:\Windows\System\kPWfSaR.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\xmZAymO.exe
  C:\Windows\System\xmZAymO.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\vPYWajY.exe
  C:\Windows\System\vPYWajY.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\wYbzckG.exe
  C:\Windows\System\wYbzckG.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\QMPJLQM.exe
  C:\Windows\System\QMPJLQM.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\ScAjnpf.exe
  C:\Windows\System\ScAjnpf.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\eDpdeQr.exe
  C:\Windows\System\eDpdeQr.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\EEjpvtr.exe
  C:\Windows\System\EEjpvtr.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\OLBeVwD.exe
  C:\Windows\System\OLBeVwD.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\yaXEBvR.exe
  C:\Windows\System\yaXEBvR.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\rzqyMgm.exe
  C:\Windows\System\rzqyMgm.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\jpUfzDy.exe
  C:\Windows\System\jpUfzDy.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\xHSjaRL.exe
  C:\Windows\System\xHSjaRL.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\eFvHbDm.exe
  C:\Windows\System\eFvHbDm.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\SeKZRAx.exe
  C:\Windows\System\SeKZRAx.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\bveGGIG.exe
  C:\Windows\System\bveGGIG.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\Lhdfnma.exe
  C:\Windows\System\Lhdfnma.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\dxdrIki.exe
  C:\Windows\System\dxdrIki.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\IrxzSoY.exe
  C:\Windows\System\IrxzSoY.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\UYrvMpw.exe
  C:\Windows\System\UYrvMpw.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\gqYhNAM.exe
  C:\Windows\System\gqYhNAM.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\sMyPnUD.exe
  C:\Windows\System\sMyPnUD.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\aexxQHC.exe
  C:\Windows\System\aexxQHC.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\KTOXjHZ.exe
  C:\Windows\System\KTOXjHZ.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\fcZeOeF.exe
  C:\Windows\System\fcZeOeF.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\lyjdvwe.exe
  C:\Windows\System\lyjdvwe.exe
  2⤵
  PID:2272
- C:\Windows\System\oOOpvXC.exe
  C:\Windows\System\oOOpvXC.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\cjsuXWA.exe
  C:\Windows\System\cjsuXWA.exe
  2⤵
  PID:792
- C:\Windows\System\UZBlBgq.exe
  C:\Windows\System\UZBlBgq.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\EbIeLPK.exe
  C:\Windows\System\EbIeLPK.exe
  2⤵
  PID:2992
- C:\Windows\System\qAtZAIv.exe
  C:\Windows\System\qAtZAIv.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\kikFhmX.exe
  C:\Windows\System\kikFhmX.exe
  2⤵
  PID:1588
- C:\Windows\System\CZUITVZ.exe
  C:\Windows\System\CZUITVZ.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\NZWcBzH.exe
  C:\Windows\System\NZWcBzH.exe
  2⤵
  PID:1956
- C:\Windows\System\VGAESFC.exe
  C:\Windows\System\VGAESFC.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\ZPjxKUE.exe
  C:\Windows\System\ZPjxKUE.exe
  2⤵
  PID:2160
- C:\Windows\System\wFQXZvR.exe
  C:\Windows\System\wFQXZvR.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\fDBstVW.exe
  C:\Windows\System\fDBstVW.exe
  2⤵
  PID:2548
- C:\Windows\System\rtTQMtn.exe
  C:\Windows\System\rtTQMtn.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\WgBUbaZ.exe
  C:\Windows\System\WgBUbaZ.exe
  2⤵
  PID:2900
- C:\Windows\System\wURggfQ.exe
  C:\Windows\System\wURggfQ.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\aJdnhXj.exe
  C:\Windows\System\aJdnhXj.exe
  2⤵
  PID:1880
- C:\Windows\System\WAqElrd.exe
  C:\Windows\System\WAqElrd.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\xcWMEuo.exe
  C:\Windows\System\xcWMEuo.exe
  2⤵
  PID:1276
- C:\Windows\System\gWLxEfp.exe
  C:\Windows\System\gWLxEfp.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\ymZtfbt.exe
  C:\Windows\System\ymZtfbt.exe
  2⤵
  PID:1508
- C:\Windows\System\TpzCAAz.exe
  C:\Windows\System\TpzCAAz.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\kVqHxaj.exe
  C:\Windows\System\kVqHxaj.exe
  2⤵
  PID:2264
- C:\Windows\System\wSgqOMJ.exe
  C:\Windows\System\wSgqOMJ.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\ZSLcIBe.exe
  C:\Windows\System\ZSLcIBe.exe
  2⤵
  PID:1992
- C:\Windows\System\gFGBgJt.exe
  C:\Windows\System\gFGBgJt.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\IpouKAV.exe
  C:\Windows\System\IpouKAV.exe
  2⤵
  PID:2828
- C:\Windows\System\RiTguTH.exe
  C:\Windows\System\RiTguTH.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\KmmyLej.exe
  C:\Windows\System\KmmyLej.exe
  2⤵
  PID:2656
- C:\Windows\System\fgskyfo.exe
  C:\Windows\System\fgskyfo.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\iUTJKdQ.exe
  C:\Windows\System\iUTJKdQ.exe
  2⤵
  PID:1448
- C:\Windows\System\aNsfixc.exe
  C:\Windows\System\aNsfixc.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\KbsXXVm.exe
  C:\Windows\System\KbsXXVm.exe
  2⤵
  PID:2724
- C:\Windows\System\CiILHlG.exe
  C:\Windows\System\CiILHlG.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\OVEAwWX.exe
  C:\Windows\System\OVEAwWX.exe
  2⤵
  PID:1200
- C:\Windows\System\tesLZPc.exe
  C:\Windows\System\tesLZPc.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\GiKElYn.exe
  C:\Windows\System\GiKElYn.exe
  2⤵
  PID:2364
- C:\Windows\System\yKfMvdo.exe
  C:\Windows\System\yKfMvdo.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\EHDmcfh.exe
  C:\Windows\System\EHDmcfh.exe
  2⤵
  PID:1248
- C:\Windows\System\OUQfCKb.exe
  C:\Windows\System\OUQfCKb.exe
  2⤵
  PID:2392
- C:\Windows\System\jLusnhf.exe
  C:\Windows\System\jLusnhf.exe
  2⤵
  PID:2816
- C:\Windows\System\pTJdhYS.exe
  C:\Windows\System\pTJdhYS.exe
  2⤵
  PID:1872
- C:\Windows\System\UVsoCwj.exe
  C:\Windows\System\UVsoCwj.exe
  2⤵
  PID:2836
- C:\Windows\System\veJsdON.exe
  C:\Windows\System\veJsdON.exe
  2⤵
  PID:2180
- C:\Windows\System\MJSWMup.exe
  C:\Windows\System\MJSWMup.exe
  2⤵
  PID:2556
- C:\Windows\System\naamxps.exe
  C:\Windows\System\naamxps.exe
  2⤵
  PID:2852
- C:\Windows\System\RqgRxbw.exe
  C:\Windows\System\RqgRxbw.exe
  2⤵
  PID:2876
- C:\Windows\System\qvvaPqE.exe
  C:\Windows\System\qvvaPqE.exe
  2⤵
  PID:1944
- C:\Windows\System\flNUKyl.exe
  C:\Windows\System\flNUKyl.exe
  2⤵
  PID:844
- C:\Windows\System\GWtqEut.exe
  C:\Windows\System\GWtqEut.exe
  2⤵
  PID:1272
- C:\Windows\System\irDCdfD.exe
  C:\Windows\System\irDCdfD.exe
  2⤵
  PID:1120
- C:\Windows\System\kvdvHBz.exe
  C:\Windows\System\kvdvHBz.exe
  2⤵
  PID:3048
- C:\Windows\System\Hwftwxl.exe
  C:\Windows\System\Hwftwxl.exe
  2⤵
  PID:1828
- C:\Windows\System\JDpBVGJ.exe
  C:\Windows\System\JDpBVGJ.exe
  2⤵
  PID:1004
- C:\Windows\System\WsHwykB.exe
  C:\Windows\System\WsHwykB.exe
  2⤵
  PID:1340
- C:\Windows\System\JXmXPzg.exe
  C:\Windows\System\JXmXPzg.exe
  2⤵
  PID:2772
- C:\Windows\System\TrNOGOK.exe
  C:\Windows\System\TrNOGOK.exe
  2⤵
  PID:2420
- C:\Windows\System\opZFiVb.exe
  C:\Windows\System\opZFiVb.exe
  2⤵
  PID:1032
- C:\Windows\System\VArFUmh.exe
  C:\Windows\System\VArFUmh.exe
  2⤵
  PID:3084
- C:\Windows\System\IBiDpWZ.exe
  C:\Windows\System\IBiDpWZ.exe
  2⤵
  PID:3100
- C:\Windows\System\fBkQyDB.exe
  C:\Windows\System\fBkQyDB.exe
  2⤵
  PID:3116
- C:\Windows\System\JdnldxX.exe
  C:\Windows\System\JdnldxX.exe
  2⤵
  PID:3132
- C:\Windows\System\ztICWtn.exe
  C:\Windows\System\ztICWtn.exe
  2⤵
  PID:3148
- C:\Windows\System\LHIjVmX.exe
  C:\Windows\System\LHIjVmX.exe
  2⤵
  PID:3164
- C:\Windows\System\MGKRmjz.exe
  C:\Windows\System\MGKRmjz.exe
  2⤵
  PID:3180
- C:\Windows\System\zxkLjgJ.exe
  C:\Windows\System\zxkLjgJ.exe
  2⤵
  PID:3196
- C:\Windows\System\qDutUaM.exe
  C:\Windows\System\qDutUaM.exe
  2⤵
  PID:3212
- C:\Windows\System\orhKBII.exe
  C:\Windows\System\orhKBII.exe
  2⤵
  PID:3228
- C:\Windows\System\UXzfaRz.exe
  C:\Windows\System\UXzfaRz.exe
  2⤵
  PID:3244
- C:\Windows\System\idHHZLI.exe
  C:\Windows\System\idHHZLI.exe
  2⤵
  PID:3260
- C:\Windows\System\LvYWdai.exe
  C:\Windows\System\LvYWdai.exe
  2⤵
  PID:3276
- C:\Windows\System\ZrlJAHg.exe
  C:\Windows\System\ZrlJAHg.exe
  2⤵
  PID:3292
- C:\Windows\System\QFMfhdl.exe
  C:\Windows\System\QFMfhdl.exe
  2⤵
  PID:3308
- C:\Windows\System\rDPnWoL.exe
  C:\Windows\System\rDPnWoL.exe
  2⤵
  PID:3324
- C:\Windows\System\VopWJpE.exe
  C:\Windows\System\VopWJpE.exe
  2⤵
  PID:3340
- C:\Windows\System\jzBzgTJ.exe
  C:\Windows\System\jzBzgTJ.exe
  2⤵
  PID:3356
- C:\Windows\System\iCiNEFA.exe
  C:\Windows\System\iCiNEFA.exe
  2⤵
  PID:3372
- C:\Windows\System\iVXTQMg.exe
  C:\Windows\System\iVXTQMg.exe
  2⤵
  PID:3388
- C:\Windows\System\OqIpGSW.exe
  C:\Windows\System\OqIpGSW.exe
  2⤵
  PID:3404
- C:\Windows\System\HzVcJeU.exe
  C:\Windows\System\HzVcJeU.exe
  2⤵
  PID:3420
- C:\Windows\System\YcRkULH.exe
  C:\Windows\System\YcRkULH.exe
  2⤵
  PID:3436
- C:\Windows\System\zhRrHJZ.exe
  C:\Windows\System\zhRrHJZ.exe
  2⤵
  PID:3452
- C:\Windows\System\IwoBPZG.exe
  C:\Windows\System\IwoBPZG.exe
  2⤵
  PID:3468
- C:\Windows\System\VdSwkiS.exe
  C:\Windows\System\VdSwkiS.exe
  2⤵
  PID:3484
- C:\Windows\System\mNDvvWO.exe
  C:\Windows\System\mNDvvWO.exe
  2⤵
  PID:3500
- C:\Windows\System\pVrLxrR.exe
  C:\Windows\System\pVrLxrR.exe
  2⤵
  PID:3516
- C:\Windows\System\sgHQkGg.exe
  C:\Windows\System\sgHQkGg.exe
  2⤵
  PID:3532
- C:\Windows\System\XuHsQTT.exe
  C:\Windows\System\XuHsQTT.exe
  2⤵
  PID:3548
- C:\Windows\System\JqvOpaD.exe
  C:\Windows\System\JqvOpaD.exe
  2⤵
  PID:3564
- C:\Windows\System\zwlksEA.exe
  C:\Windows\System\zwlksEA.exe
  2⤵
  PID:3580
- C:\Windows\System\MdSchJR.exe
  C:\Windows\System\MdSchJR.exe
  2⤵
  PID:3596
- C:\Windows\System\WOLvGyg.exe
  C:\Windows\System\WOLvGyg.exe
  2⤵
  PID:3612
- C:\Windows\System\vdDBMIW.exe
  C:\Windows\System\vdDBMIW.exe
  2⤵
  PID:3628
- C:\Windows\System\fwVKAxP.exe
  C:\Windows\System\fwVKAxP.exe
  2⤵
  PID:3848
- C:\Windows\System\UTbKmVC.exe
  C:\Windows\System\UTbKmVC.exe
  2⤵
  PID:3880
- C:\Windows\System\yMYRRGQ.exe
  C:\Windows\System\yMYRRGQ.exe
  2⤵
  PID:3916
- C:\Windows\System\gnNTPpy.exe
  C:\Windows\System\gnNTPpy.exe
  2⤵
  PID:3956
- C:\Windows\System\zvTsWiG.exe
  C:\Windows\System\zvTsWiG.exe
  2⤵
  PID:3984
- C:\Windows\System\pOxpftY.exe
  C:\Windows\System\pOxpftY.exe
  2⤵
  PID:4024
- C:\Windows\System\nnQToff.exe
  C:\Windows\System\nnQToff.exe
  2⤵
  PID:4052
- C:\Windows\System\RCSNkma.exe
  C:\Windows\System\RCSNkma.exe
  2⤵
  PID:4080
- C:\Windows\System\BBepAFT.exe
  C:\Windows\System\BBepAFT.exe
  2⤵
  PID:2184
- C:\Windows\System\QKLKiGh.exe
  C:\Windows\System\QKLKiGh.exe
  2⤵
  PID:3144
- C:\Windows\System\DnYqCLe.exe
  C:\Windows\System\DnYqCLe.exe
  2⤵
  PID:3208
- C:\Windows\System\NSIWiDK.exe
  C:\Windows\System\NSIWiDK.exe
  2⤵
  PID:3272
- C:\Windows\System\PRiephL.exe
  C:\Windows\System\PRiephL.exe
  2⤵
  PID:3336
- C:\Windows\System\bKXBlRJ.exe
  C:\Windows\System\bKXBlRJ.exe
  2⤵
  PID:3396
- C:\Windows\System\DJzRhzJ.exe
  C:\Windows\System\DJzRhzJ.exe
  2⤵
  PID:2624
- C:\Windows\System\MtutcFj.exe
  C:\Windows\System\MtutcFj.exe
  2⤵
  PID:1696
- C:\Windows\System\bRqfzbR.exe
  C:\Windows\System\bRqfzbR.exe
  2⤵
  PID:1700
- C:\Windows\System\xMWTsZd.exe
  C:\Windows\System\xMWTsZd.exe
  2⤵
  PID:1316
- C:\Windows\System\IWNPUPL.exe
  C:\Windows\System\IWNPUPL.exe
  2⤵
  PID:2496
- C:\Windows\System\xsFGtUt.exe
  C:\Windows\System\xsFGtUt.exe
  2⤵
  PID:356
- C:\Windows\System\xdVMdYW.exe
  C:\Windows\System\xdVMdYW.exe
  2⤵
  PID:1408
- C:\Windows\System\XkMdxwC.exe
  C:\Windows\System\XkMdxwC.exe
  2⤵
  PID:2132
- C:\Windows\System\uUQFvcp.exe
  C:\Windows\System\uUQFvcp.exe
  2⤵
  PID:676
- C:\Windows\System\OanrAhk.exe
  C:\Windows\System\OanrAhk.exe
  2⤵
  PID:3844
- C:\Windows\System\jfCqmpz.exe
  C:\Windows\System\jfCqmpz.exe
  2⤵
  PID:3868
- C:\Windows\System\QlUYXYz.exe
  C:\Windows\System\QlUYXYz.exe
  2⤵
  PID:3924
- C:\Windows\System\tEdmagK.exe
  C:\Windows\System\tEdmagK.exe
  2⤵
  PID:3948
- C:\Windows\System\IOKqibR.exe
  C:\Windows\System\IOKqibR.exe
  2⤵
  PID:4000
- C:\Windows\System\rAPGnVY.exe
  C:\Windows\System\rAPGnVY.exe
  2⤵
  PID:1624
- C:\Windows\System\TEDrvps.exe
  C:\Windows\System\TEDrvps.exe
  2⤵
  PID:4012
- C:\Windows\System\pNtkWnx.exe
  C:\Windows\System\pNtkWnx.exe
  2⤵
  PID:4068
- C:\Windows\System\MxBuIMh.exe
  C:\Windows\System\MxBuIMh.exe
  2⤵
  PID:3080
- C:\Windows\System\yHfYdFC.exe
  C:\Windows\System\yHfYdFC.exe
  2⤵
  PID:3320
- C:\Windows\System\QdacGXc.exe
  C:\Windows\System\QdacGXc.exe
  2⤵
  PID:3448
- C:\Windows\System\NcVZnbm.exe
  C:\Windows\System\NcVZnbm.exe
  2⤵
  PID:3512
- C:\Windows\System\yiBTzFf.exe
  C:\Windows\System\yiBTzFf.exe
  2⤵
  PID:3576
- C:\Windows\System\yBPzwdO.exe
  C:\Windows\System\yBPzwdO.exe
  2⤵
  PID:3640
- C:\Windows\System\qOaAdHy.exe
  C:\Windows\System\qOaAdHy.exe
  2⤵
  PID:892
- C:\Windows\System\BrxNHUc.exe
  C:\Windows\System\BrxNHUc.exe
  2⤵
  PID:3368
- C:\Windows\System\FyMYxjs.exe
  C:\Windows\System\FyMYxjs.exe
  2⤵
  PID:3492
- C:\Windows\System\wgAEHHp.exe
  C:\Windows\System\wgAEHHp.exe
  2⤵
  PID:3528
- C:\Windows\System\JYccbwI.exe
  C:\Windows\System\JYccbwI.exe
  2⤵
  PID:2176
- C:\Windows\System\LgljKvL.exe
  C:\Windows\System\LgljKvL.exe
  2⤵
  PID:1784
- C:\Windows\System\QSqMzfG.exe
  C:\Windows\System\QSqMzfG.exe
  2⤵
  PID:2544
- C:\Windows\System\VtKBKWE.exe
  C:\Windows\System\VtKBKWE.exe
  2⤵
  PID:3416
- C:\Windows\System\GYqzjbw.exe
  C:\Windows\System\GYqzjbw.exe
  2⤵
  PID:2412
- C:\Windows\System\qqeJJWI.exe
  C:\Windows\System\qqeJJWI.exe
  2⤵
  PID:1760
- C:\Windows\System\OwuyCCe.exe
  C:\Windows\System\OwuyCCe.exe
  2⤵
  PID:2352
- C:\Windows\System\yxCbwoF.exe
  C:\Windows\System\yxCbwoF.exe
  2⤵
  PID:2156
- C:\Windows\System\SFgMaNy.exe
  C:\Windows\System\SFgMaNy.exe
  2⤵
  PID:1636
- C:\Windows\System\Uiztzfd.exe
  C:\Windows\System\Uiztzfd.exe
  2⤵
  PID:2636
- C:\Windows\System\JkTrULm.exe
  C:\Windows\System\JkTrULm.exe
  2⤵
  PID:2736
- C:\Windows\System\cTVIjmQ.exe
  C:\Windows\System\cTVIjmQ.exe
  2⤵
  PID:864
- C:\Windows\System\mLZiZFJ.exe
  C:\Windows\System\mLZiZFJ.exe
  2⤵
  PID:2996
- C:\Windows\System\RsuOipC.exe
  C:\Windows\System\RsuOipC.exe
  2⤵
  PID:3124
- C:\Windows\System\YHXhPCg.exe
  C:\Windows\System\YHXhPCg.exe
  2⤵
  PID:3192
- C:\Windows\System\VVCQNGJ.exe
  C:\Windows\System\VVCQNGJ.exe
  2⤵
  PID:3716
- C:\Windows\System\wEJvoyz.exe
  C:\Windows\System\wEJvoyz.exe
  2⤵
  PID:3732
- C:\Windows\System\oJSWOfi.exe
  C:\Windows\System\oJSWOfi.exe
  2⤵
  PID:3760
- C:\Windows\System\IztCfnk.exe
  C:\Windows\System\IztCfnk.exe
  2⤵
  PID:3776
- C:\Windows\System\qYcCqGg.exe
  C:\Windows\System\qYcCqGg.exe
  2⤵
  PID:3800
- C:\Windows\System\SIWCwQl.exe
  C:\Windows\System\SIWCwQl.exe
  2⤵
  PID:3816
- C:\Windows\System\imgdosz.exe
  C:\Windows\System\imgdosz.exe
  2⤵
  PID:3840
- C:\Windows\System\JCUZILR.exe
  C:\Windows\System\JCUZILR.exe
  2⤵
  PID:3900
- C:\Windows\System\xMRrCPh.exe
  C:\Windows\System\xMRrCPh.exe
  2⤵
  PID:3972
- C:\Windows\System\JfzkzAu.exe
  C:\Windows\System\JfzkzAu.exe
  2⤵
  PID:4036
- C:\Windows\System\LxKuLAJ.exe
  C:\Windows\System\LxKuLAJ.exe
  2⤵
  PID:4092
- C:\Windows\System\ComahNh.exe
  C:\Windows\System\ComahNh.exe
  2⤵
  PID:3204
- C:\Windows\System\gKykCSI.exe
  C:\Windows\System\gKykCSI.exe
  2⤵
  PID:904
- C:\Windows\System\anEeWlK.exe
  C:\Windows\System\anEeWlK.exe
  2⤵
  PID:112
- C:\Windows\System\xVxNlqg.exe
  C:\Windows\System\xVxNlqg.exe
  2⤵
  PID:2260
- C:\Windows\System\BkwarBS.exe
  C:\Windows\System\BkwarBS.exe
  2⤵
  PID:1864
- C:\Windows\System\KcNXBiH.exe
  C:\Windows\System\KcNXBiH.exe
  2⤵
  PID:1748
- C:\Windows\System\wqLEbcA.exe
  C:\Windows\System\wqLEbcA.exe
  2⤵
  PID:1656
- C:\Windows\System\BFHGRCe.exe
  C:\Windows\System\BFHGRCe.exe
  2⤵
  PID:2540
- C:\Windows\System\eZuPLYY.exe
  C:\Windows\System\eZuPLYY.exe
  2⤵
  PID:3860
- C:\Windows\System\NQoVCNq.exe
  C:\Windows\System\NQoVCNq.exe
  2⤵
  PID:4004
- C:\Windows\System\nuOqmvE.exe
  C:\Windows\System\nuOqmvE.exe
  2⤵
  PID:4076
- C:\Windows\System\WMLYaHf.exe
  C:\Windows\System\WMLYaHf.exe
  2⤵
  PID:3380
- C:\Windows\System\RFZZQdR.exe
  C:\Windows\System\RFZZQdR.exe
  2⤵
  PID:3648
- C:\Windows\System\cGcVNWz.exe
  C:\Windows\System\cGcVNWz.exe
  2⤵
  PID:1124
- C:\Windows\System\VcADZCU.exe
  C:\Windows\System\VcADZCU.exe
  2⤵
  PID:448
- C:\Windows\System\fgpvFsG.exe
  C:\Windows\System\fgpvFsG.exe
  2⤵
  PID:824
- C:\Windows\System\aZwqyFO.exe
  C:\Windows\System\aZwqyFO.exe
  2⤵
  PID:2492
- C:\Windows\System\ESxAXtO.exe
  C:\Windows\System\ESxAXtO.exe
  2⤵
  PID:1556
- C:\Windows\System\tIggyqo.exe
  C:\Windows\System\tIggyqo.exe
  2⤵
  PID:2940
- C:\Windows\System\sKYeABK.exe
  C:\Windows\System\sKYeABK.exe
  2⤵
  PID:2924
- C:\Windows\System\fjhZgxI.exe
  C:\Windows\System\fjhZgxI.exe
  2⤵
  PID:3940
- C:\Windows\System\mnuXiuU.exe
  C:\Windows\System\mnuXiuU.exe
  2⤵
  PID:3996
- C:\Windows\System\FQSGujA.exe
  C:\Windows\System\FQSGujA.exe
  2⤵
  PID:3316
- C:\Windows\System\rQeWavt.exe
  C:\Windows\System\rQeWavt.exe
  2⤵
  PID:3636
- C:\Windows\System\duDxTfD.exe
  C:\Windows\System\duDxTfD.exe
  2⤵
  PID:768
- C:\Windows\System\uwVkWVY.exe
  C:\Windows\System\uwVkWVY.exe
  2⤵
  PID:2072
- C:\Windows\System\sSchhES.exe
  C:\Windows\System\sSchhES.exe
  2⤵
  PID:2528
- C:\Windows\System\cmAKdbE.exe
  C:\Windows\System\cmAKdbE.exe
  2⤵
  PID:2012
- C:\Windows\System\fgsHuaI.exe
  C:\Windows\System\fgsHuaI.exe
  2⤵
  PID:3284
- C:\Windows\System\ckKYVbp.exe
  C:\Windows\System\ckKYVbp.exe
  2⤵
  PID:3660
- C:\Windows\System\duEXVbg.exe
  C:\Windows\System\duEXVbg.exe
  2⤵
  PID:3676
- C:\Windows\System\xNcWRyJ.exe
  C:\Windows\System\xNcWRyJ.exe
  2⤵
  PID:3692
- C:\Windows\System\oABWFyl.exe
  C:\Windows\System\oABWFyl.exe
  2⤵
  PID:3708
- C:\Windows\System\gqGSjlh.exe
  C:\Windows\System\gqGSjlh.exe
  2⤵
  PID:3768
- C:\Windows\System\wttrheo.exe
  C:\Windows\System\wttrheo.exe
  2⤵
  PID:3748
- C:\Windows\System\ZnqGmaX.exe
  C:\Windows\System\ZnqGmaX.exe
  2⤵
  PID:3784
- C:\Windows\System\IITNUry.exe
  C:\Windows\System\IITNUry.exe
  2⤵
  PID:3792
- C:\Windows\System\fKoaERT.exe
  C:\Windows\System\fKoaERT.exe
  2⤵
  PID:3824
- C:\Windows\System\SfVBuGM.exe
  C:\Windows\System\SfVBuGM.exe
  2⤵
  PID:4032
- C:\Windows\System\ZYzcjYT.exe
  C:\Windows\System\ZYzcjYT.exe
  2⤵
  PID:3836
- C:\Windows\System\zwZHjEl.exe
  C:\Windows\System\zwZHjEl.exe
  2⤵
  PID:1104
- C:\Windows\System\TZntZQm.exe
  C:\Windows\System\TZntZQm.exe
  2⤵
  PID:3364
- C:\Windows\System\tnmUcqR.exe
  C:\Windows\System\tnmUcqR.exe
  2⤵
  PID:1356
- C:\Windows\System\lPzBzvB.exe
  C:\Windows\System\lPzBzvB.exe
  2⤵
  PID:2472
- C:\Windows\System\ppcwoMR.exe
  C:\Windows\System\ppcwoMR.exe
  2⤵
  PID:2880
- C:\Windows\System\okImYOM.exe
  C:\Windows\System\okImYOM.exe
  2⤵
  PID:3668
- C:\Windows\System\qldKHEE.exe
  C:\Windows\System\qldKHEE.exe
  2⤵
  PID:3808
- C:\Windows\System\KspdsdS.exe
  C:\Windows\System\KspdsdS.exe
  2⤵
  PID:2280
- C:\Windows\System\GNVAtiL.exe
  C:\Windows\System\GNVAtiL.exe
  2⤵
  PID:3428
- C:\Windows\System\sGprRHB.exe
  C:\Windows\System\sGprRHB.exe
  2⤵
  PID:3560
- C:\Windows\System\RVEzMhY.exe
  C:\Windows\System\RVEzMhY.exe
  2⤵
  PID:1576
- C:\Windows\System\BpyZuSY.exe
  C:\Windows\System\BpyZuSY.exe
  2⤵
  PID:3796
- C:\Windows\System\YnKnCjK.exe
  C:\Windows\System\YnKnCjK.exe
  2⤵
  PID:1972
- C:\Windows\System\TIfQpDV.exe
  C:\Windows\System\TIfQpDV.exe
  2⤵
  PID:2808
- C:\Windows\System\YlnkBIl.exe
  C:\Windows\System\YlnkBIl.exe
  2⤵
  PID:4020
- C:\Windows\System\CbPjXId.exe
  C:\Windows\System\CbPjXId.exe
  2⤵
  PID:2240
- C:\Windows\System\nGGszOX.exe
  C:\Windows\System\nGGszOX.exe
  2⤵
  PID:3656
- C:\Windows\System\tERRyDY.exe
  C:\Windows\System\tERRyDY.exe
  2⤵
  PID:1772
- C:\Windows\System\pmdoCpq.exe
  C:\Windows\System\pmdoCpq.exe
  2⤵
  PID:3908
- C:\Windows\System\pMucQyd.exe
  C:\Windows\System\pMucQyd.exe
  2⤵
  PID:3964
- C:\Windows\System\YnCoTEJ.exe
  C:\Windows\System\YnCoTEJ.exe
  2⤵
  PID:2368
- C:\Windows\System\gyPtUXN.exe
  C:\Windows\System\gyPtUXN.exe
  2⤵
  PID:2372
- C:\Windows\System\BRwBLuZ.exe
  C:\Windows\System\BRwBLuZ.exe
  2⤵
  PID:3032
- C:\Windows\System\dZHEhjC.exe
  C:\Windows\System\dZHEhjC.exe
  2⤵
  PID:2864
- C:\Windows\System\oLhnLTn.exe
  C:\Windows\System\oLhnLTn.exe
  2⤵
  PID:2812
- C:\Windows\System\cxNhght.exe
  C:\Windows\System\cxNhght.exe
  2⤵
  PID:324
- C:\Windows\System\MbSrQqs.exe
  C:\Windows\System\MbSrQqs.exe
  2⤵
  PID:2732
- C:\Windows\System\XcOxzMY.exe
  C:\Windows\System\XcOxzMY.exe
  2⤵
  PID:2580
- C:\Windows\System\bWZrFdW.exe
  C:\Windows\System\bWZrFdW.exe
  2⤵
  PID:2444
- C:\Windows\System\kOKVmMf.exe
  C:\Windows\System\kOKVmMf.exe
  2⤵
  PID:3740
- C:\Windows\System\vElAZBi.exe
  C:\Windows\System\vElAZBi.exe
  2⤵
  PID:3092
- C:\Windows\System\wvFaoBa.exe
  C:\Windows\System\wvFaoBa.exe
  2⤵
  PID:3224
- C:\Windows\System\fCpVOdF.exe
  C:\Windows\System\fCpVOdF.exe
  2⤵
  PID:3876
- C:\Windows\System\boqaSsI.exe
  C:\Windows\System\boqaSsI.exe
  2⤵
  PID:1288
- C:\Windows\System\sJmoIPn.exe
  C:\Windows\System\sJmoIPn.exe
  2⤵
  PID:1304
- C:\Windows\System\wtudBWX.exe
  C:\Windows\System\wtudBWX.exe
  2⤵
  PID:2944
- C:\Windows\System\QoiIEFt.exe
  C:\Windows\System\QoiIEFt.exe
  2⤵
  PID:2764
- C:\Windows\System\entHihe.exe
  C:\Windows\System\entHihe.exe
  2⤵
  PID:3176
- C:\Windows\System\dJHJMCq.exe
  C:\Windows\System\dJHJMCq.exe
  2⤵
  PID:2336
- C:\Windows\System\YFjcWiR.exe
  C:\Windows\System\YFjcWiR.exe
  2⤵
  PID:3432
- C:\Windows\System\qylVMJz.exe
  C:\Windows\System\qylVMJz.exe
  2⤵
  PID:2084
- C:\Windows\System\WkGmbxl.exe
  C:\Windows\System\WkGmbxl.exe
  2⤵
  PID:3724
- C:\Windows\System\FgXjKKY.exe
  C:\Windows\System\FgXjKKY.exe
  2⤵
  PID:3572
- C:\Windows\System\OFZUCaC.exe
  C:\Windows\System\OFZUCaC.exe
  2⤵
  PID:3932
- C:\Windows\System\ajlvjHl.exe
  C:\Windows\System\ajlvjHl.exe
  2⤵
  PID:3704
- C:\Windows\System\meVYqXv.exe
  C:\Windows\System\meVYqXv.exe
  2⤵
  PID:1988
- C:\Windows\System\XTsuidj.exe
  C:\Windows\System\XTsuidj.exe
  2⤵
  PID:1224
- C:\Windows\System\CkDeZig.exe
  C:\Windows\System\CkDeZig.exe
  2⤵
  PID:1592
- C:\Windows\System\mnqieiA.exe
  C:\Windows\System\mnqieiA.exe
  2⤵
  PID:1332
- C:\Windows\System\wtHxrPX.exe
  C:\Windows\System\wtHxrPX.exe
  2⤵
  PID:1948
- C:\Windows\System\agZoDdO.exe
  C:\Windows\System\agZoDdO.exe
  2⤵
  PID:1156
- C:\Windows\System\oUIfFiJ.exe
  C:\Windows\System\oUIfFiJ.exe
  2⤵
  PID:1292
- C:\Windows\System\IjmUEBZ.exe
  C:\Windows\System\IjmUEBZ.exe
  2⤵
  PID:3832
- C:\Windows\System\MIMvgFJ.exe
  C:\Windows\System\MIMvgFJ.exe
  2⤵
  PID:3112
- C:\Windows\System\OAjddra.exe
  C:\Windows\System\OAjddra.exe
  2⤵
  PID:2036
- C:\Windows\System\rZfAvJV.exe
  C:\Windows\System\rZfAvJV.exe
  2⤵
  PID:4104
- C:\Windows\System\uzpMVuu.exe
  C:\Windows\System\uzpMVuu.exe
  2⤵
  PID:4120
- C:\Windows\System\GEuLgHc.exe
  C:\Windows\System\GEuLgHc.exe
  2⤵
  PID:4136
- C:\Windows\System\ruaWZhr.exe
  C:\Windows\System\ruaWZhr.exe
  2⤵
  PID:4152
- C:\Windows\System\ghwNvYw.exe
  C:\Windows\System\ghwNvYw.exe
  2⤵
  PID:4168
- C:\Windows\System\NhlueEB.exe
  C:\Windows\System\NhlueEB.exe
  2⤵
  PID:4184
- C:\Windows\System\YbGcEzO.exe
  C:\Windows\System\YbGcEzO.exe
  2⤵
  PID:4200
- C:\Windows\System\DbSAvXL.exe
  C:\Windows\System\DbSAvXL.exe
  2⤵
  PID:4216
- C:\Windows\System\yjQmIiI.exe
  C:\Windows\System\yjQmIiI.exe
  2⤵
  PID:4232
- C:\Windows\System\OLAkIvP.exe
  C:\Windows\System\OLAkIvP.exe
  2⤵
  PID:4248
- C:\Windows\System\IlzvJwg.exe
  C:\Windows\System\IlzvJwg.exe
  2⤵
  PID:4264
- C:\Windows\System\hyYWhyy.exe
  C:\Windows\System\hyYWhyy.exe
  2⤵
  PID:4280
- C:\Windows\System\HcNfTMt.exe
  C:\Windows\System\HcNfTMt.exe
  2⤵
  PID:4296
- C:\Windows\System\UZIBRwM.exe
  C:\Windows\System\UZIBRwM.exe
  2⤵
  PID:4312
- C:\Windows\System\HWEunUX.exe
  C:\Windows\System\HWEunUX.exe
  2⤵
  PID:4328
- C:\Windows\System\RDGtDxJ.exe
  C:\Windows\System\RDGtDxJ.exe
  2⤵
  PID:4348
- C:\Windows\System\GRNqwsk.exe
  C:\Windows\System\GRNqwsk.exe
  2⤵
  PID:4364
- C:\Windows\System\mAkUYoO.exe
  C:\Windows\System\mAkUYoO.exe
  2⤵
  PID:4380
- C:\Windows\System\sPiAoed.exe
  C:\Windows\System\sPiAoed.exe
  2⤵
  PID:4396
- C:\Windows\System\Weawhro.exe
  C:\Windows\System\Weawhro.exe
  2⤵
  PID:4412
- C:\Windows\System\UrLDkOd.exe
  C:\Windows\System\UrLDkOd.exe
  2⤵
  PID:4428
- C:\Windows\System\ZDMdlRR.exe
  C:\Windows\System\ZDMdlRR.exe
  2⤵
  PID:4444
- C:\Windows\System\DXTdQRq.exe
  C:\Windows\System\DXTdQRq.exe
  2⤵
  PID:4460
- C:\Windows\System\jzBUtui.exe
  C:\Windows\System\jzBUtui.exe
  2⤵
  PID:4476
- C:\Windows\System\OsCZziU.exe
  C:\Windows\System\OsCZziU.exe
  2⤵
  PID:4492
- C:\Windows\System\OGRUZZd.exe
  C:\Windows\System\OGRUZZd.exe
  2⤵
  PID:4508
- C:\Windows\System\DSqfYHq.exe
  C:\Windows\System\DSqfYHq.exe
  2⤵
  PID:4524
- C:\Windows\System\yUrrgCk.exe
  C:\Windows\System\yUrrgCk.exe
  2⤵
  PID:4540
- C:\Windows\System\tWQiNiO.exe
  C:\Windows\System\tWQiNiO.exe
  2⤵
  PID:4556
- C:\Windows\System\VvITnOK.exe
  C:\Windows\System\VvITnOK.exe
  2⤵
  PID:4572
- C:\Windows\System\dckbFkJ.exe
  C:\Windows\System\dckbFkJ.exe
  2⤵
  PID:4588
- C:\Windows\System\eoiEPXj.exe
  C:\Windows\System\eoiEPXj.exe
  2⤵
  PID:4604
- C:\Windows\System\ilntLHM.exe
  C:\Windows\System\ilntLHM.exe
  2⤵
  PID:4620
- C:\Windows\System\FyzmENL.exe
  C:\Windows\System\FyzmENL.exe
  2⤵
  PID:4636
- C:\Windows\System\EGZJvTN.exe
  C:\Windows\System\EGZJvTN.exe
  2⤵
  PID:4652
- C:\Windows\System\lezsaQb.exe
  C:\Windows\System\lezsaQb.exe
  2⤵
  PID:4668
- C:\Windows\System\ZAYPCmH.exe
  C:\Windows\System\ZAYPCmH.exe
  2⤵
  PID:4684
- C:\Windows\System\LaEUnzP.exe
  C:\Windows\System\LaEUnzP.exe
  2⤵
  PID:4700
- C:\Windows\System\IHZDbbA.exe
  C:\Windows\System\IHZDbbA.exe
  2⤵
  PID:4716
- C:\Windows\System\CuOpRCe.exe
  C:\Windows\System\CuOpRCe.exe
  2⤵
  PID:4732
- C:\Windows\System\WURqXSv.exe
  C:\Windows\System\WURqXSv.exe
  2⤵
  PID:4748
- C:\Windows\System\vsJOKAA.exe
  C:\Windows\System\vsJOKAA.exe
  2⤵
  PID:4764
- C:\Windows\System\ohRlWNl.exe
  C:\Windows\System\ohRlWNl.exe
  2⤵
  PID:4780
- C:\Windows\System\nrWhpPf.exe
  C:\Windows\System\nrWhpPf.exe
  2⤵
  PID:4796
- C:\Windows\System\urnYmVy.exe
  C:\Windows\System\urnYmVy.exe
  2⤵
  PID:4812
- C:\Windows\System\lGWHHTQ.exe
  C:\Windows\System\lGWHHTQ.exe
  2⤵
  PID:4828
- C:\Windows\System\DmxwXnh.exe
  C:\Windows\System\DmxwXnh.exe
  2⤵
  PID:4844
- C:\Windows\System\oPTmsZy.exe
  C:\Windows\System\oPTmsZy.exe
  2⤵
  PID:4860
- C:\Windows\System\bWBsaxC.exe
  C:\Windows\System\bWBsaxC.exe
  2⤵
  PID:4876
- C:\Windows\System\yhWRgZK.exe
  C:\Windows\System\yhWRgZK.exe
  2⤵
  PID:4892
- C:\Windows\System\EXHOVse.exe
  C:\Windows\System\EXHOVse.exe
  2⤵
  PID:4908
- C:\Windows\System\XrRnSSo.exe
  C:\Windows\System\XrRnSSo.exe
  2⤵
  PID:4924
- C:\Windows\System\kWqVKGg.exe
  C:\Windows\System\kWqVKGg.exe
  2⤵
  PID:4940
- C:\Windows\System\uHAZKiS.exe
  C:\Windows\System\uHAZKiS.exe
  2⤵
  PID:4956
- C:\Windows\System\hTKVFpe.exe
  C:\Windows\System\hTKVFpe.exe
  2⤵
  PID:4972
- C:\Windows\System\AMDtsSh.exe
  C:\Windows\System\AMDtsSh.exe
  2⤵
  PID:4988
- C:\Windows\System\OqFqPrB.exe
  C:\Windows\System\OqFqPrB.exe
  2⤵
  PID:5004
- C:\Windows\System\rdotuoj.exe
  C:\Windows\System\rdotuoj.exe
  2⤵
  PID:5020
- C:\Windows\System\invgNhc.exe
  C:\Windows\System\invgNhc.exe
  2⤵
  PID:5036
- C:\Windows\System\hNcGhLm.exe
  C:\Windows\System\hNcGhLm.exe
  2⤵
  PID:5052
- C:\Windows\System\HzJWbMR.exe
  C:\Windows\System\HzJWbMR.exe
  2⤵
  PID:5068
- C:\Windows\System\VRfWNBe.exe
  C:\Windows\System\VRfWNBe.exe
  2⤵
  PID:5084
- C:\Windows\System\WjojPsJ.exe
  C:\Windows\System\WjojPsJ.exe
  2⤵
  PID:5100
- C:\Windows\System\uTPVyWn.exe
  C:\Windows\System\uTPVyWn.exe
  2⤵
  PID:5116
- C:\Windows\System\mdfhMuF.exe
  C:\Windows\System\mdfhMuF.exe
  2⤵
  PID:3688
- C:\Windows\System\bfLIKFO.exe
  C:\Windows\System\bfLIKFO.exe
  2⤵
  PID:988
- C:\Windows\System\wvLdOFF.exe
  C:\Windows\System\wvLdOFF.exe
  2⤵
  PID:2024
- C:\Windows\System\sCaJdGi.exe
  C:\Windows\System\sCaJdGi.exe
  2⤵
  PID:4196
- C:\Windows\System\YXfCFRU.exe
  C:\Windows\System\YXfCFRU.exe
  2⤵
  PID:4260
- C:\Windows\System\IVevwiA.exe
  C:\Windows\System\IVevwiA.exe
  2⤵
  PID:4324
- C:\Windows\System\TcnGZzd.exe
  C:\Windows\System\TcnGZzd.exe
  2⤵
  PID:4392
- C:\Windows\System\AAZBmrA.exe
  C:\Windows\System\AAZBmrA.exe
  2⤵
  PID:4456
- C:\Windows\System\klEkRxl.exe
  C:\Windows\System\klEkRxl.exe
  2⤵
  PID:4144
- C:\Windows\System\YUMUneo.exe
  C:\Windows\System\YUMUneo.exe
  2⤵
  PID:4208
- C:\Windows\System\dfpEuIj.exe
  C:\Windows\System\dfpEuIj.exe
  2⤵
  PID:4276
- C:\Windows\System\vPQbODQ.exe
  C:\Windows\System\vPQbODQ.exe
  2⤵
  PID:4344
- C:\Windows\System\FHQDxwM.exe
  C:\Windows\System\FHQDxwM.exe
  2⤵
  PID:4408
- C:\Windows\System\OlYbOsJ.exe
  C:\Windows\System\OlYbOsJ.exe
  2⤵
  PID:4472
- C:\Windows\System\EzTOmkm.exe
  C:\Windows\System\EzTOmkm.exe
  2⤵
  PID:4536
- C:\Windows\System\cJgfYul.exe
  C:\Windows\System\cJgfYul.exe
  2⤵
  PID:4520
- C:\Windows\System\zUbHcUn.exe
  C:\Windows\System\zUbHcUn.exe
  2⤵
  PID:4596
- C:\Windows\System\CPjlxVU.exe
  C:\Windows\System\CPjlxVU.exe
  2⤵
  PID:4580
- C:\Windows\System\YswwURw.exe
  C:\Windows\System\YswwURw.exe
  2⤵
  PID:4664
- C:\Windows\System\gmDCTyd.exe
  C:\Windows\System\gmDCTyd.exe
  2⤵
  PID:4632
- C:\Windows\System\AmVbmKt.exe
  C:\Windows\System\AmVbmKt.exe
  2⤵
  PID:4696
- C:\Windows\System\caxjgEY.exe
  C:\Windows\System\caxjgEY.exe
  2⤵
  PID:4820
- C:\Windows\System\IMJqjQz.exe
  C:\Windows\System\IMJqjQz.exe
  2⤵
  PID:5060
- C:\Windows\System\JaRVuHZ.exe
  C:\Windows\System\JaRVuHZ.exe
  2⤵
  PID:1808
- C:\Windows\System\LQQbQJZ.exe
  C:\Windows\System\LQQbQJZ.exe
  2⤵
  PID:4360
- C:\Windows\System\sqEOYbJ.exe
  C:\Windows\System\sqEOYbJ.exe
  2⤵
  PID:4180
- C:\Windows\System\BdTDfmS.exe
  C:\Windows\System\BdTDfmS.exe
  2⤵
  PID:4680
- C:\Windows\System\wobGWYK.exe
  C:\Windows\System\wobGWYK.exe
  2⤵
  PID:4676
- C:\Windows\System\DSbWkmB.exe
  C:\Windows\System\DSbWkmB.exe
  2⤵
  PID:4808
- C:\Windows\System\IrgbSAH.exe
  C:\Windows\System\IrgbSAH.exe
  2⤵
  PID:4900
- C:\Windows\System\PlEFiua.exe
  C:\Windows\System\PlEFiua.exe
  2⤵
  PID:4888
- C:\Windows\System\GHgtWMH.exe
  C:\Windows\System\GHgtWMH.exe
  2⤵
  PID:4984
- C:\Windows\System\jUBDIIP.exe
  C:\Windows\System\jUBDIIP.exe
  2⤵
  PID:4044
- C:\Windows\System\aPHXiGm.exe
  C:\Windows\System\aPHXiGm.exe
  2⤵
  PID:4128
- C:\Windows\System\TMaHcJf.exe
  C:\Windows\System\TMaHcJf.exe
  2⤵
  PID:5112
- C:\Windows\System\SIXxbfv.exe
  C:\Windows\System\SIXxbfv.exe
  2⤵
  PID:5080
- C:\Windows\System\qqznwGU.exe
  C:\Windows\System\qqznwGU.exe
  2⤵
  PID:3160
- C:\Windows\System\waqGplx.exe
  C:\Windows\System\waqGplx.exe
  2⤵
  PID:4452
- C:\Windows\System\ZvnVjYO.exe
  C:\Windows\System\ZvnVjYO.exe
  2⤵
  PID:4244
- C:\Windows\System\hiBGmVZ.exe
  C:\Windows\System\hiBGmVZ.exe
  2⤵
  PID:4340
- C:\Windows\System\BsUexvt.exe
  C:\Windows\System\BsUexvt.exe
  2⤵
  PID:2040
- C:\Windows\System\ILFQDju.exe
  C:\Windows\System\ILFQDju.exe
  2⤵
  PID:5132
- C:\Windows\System\lzhzpTQ.exe
  C:\Windows\System\lzhzpTQ.exe
  2⤵
  PID:5148
- C:\Windows\System\IcsnNFv.exe
  C:\Windows\System\IcsnNFv.exe
  2⤵
  PID:5164
- C:\Windows\System\QvgRceA.exe
  C:\Windows\System\QvgRceA.exe
  2⤵
  PID:5180
- C:\Windows\System\fHtzeOR.exe
  C:\Windows\System\fHtzeOR.exe
  2⤵
  PID:5196
- C:\Windows\System\dlPWwxx.exe
  C:\Windows\System\dlPWwxx.exe
  2⤵
  PID:5212
- C:\Windows\System\buTQKbR.exe
  C:\Windows\System\buTQKbR.exe
  2⤵
  PID:5228
- C:\Windows\System\zBltOmb.exe
  C:\Windows\System\zBltOmb.exe
  2⤵
  PID:5244
- C:\Windows\System\ShbgmAv.exe
  C:\Windows\System\ShbgmAv.exe
  2⤵
  PID:5260
- C:\Windows\System\hXhldCm.exe
  C:\Windows\System\hXhldCm.exe
  2⤵
  PID:5276
- C:\Windows\System\yBNGhMh.exe
  C:\Windows\System\yBNGhMh.exe
  2⤵
  PID:5292
- C:\Windows\System\NXsksWd.exe
  C:\Windows\System\NXsksWd.exe
  2⤵
  PID:5308
- C:\Windows\System\jBiDoic.exe
  C:\Windows\System\jBiDoic.exe
  2⤵
  PID:5324
- C:\Windows\System\YIKGkhu.exe
  C:\Windows\System\YIKGkhu.exe
  2⤵
  PID:5340
- C:\Windows\System\Aivtwrq.exe
  C:\Windows\System\Aivtwrq.exe
  2⤵
  PID:5356
- C:\Windows\System\IEnmxNZ.exe
  C:\Windows\System\IEnmxNZ.exe
  2⤵
  PID:5372
- C:\Windows\System\zBgSgBk.exe
  C:\Windows\System\zBgSgBk.exe
  2⤵
  PID:5388
- C:\Windows\System\gHTltqM.exe
  C:\Windows\System\gHTltqM.exe
  2⤵
  PID:5404
- C:\Windows\System\mlZxniu.exe
  C:\Windows\System\mlZxniu.exe
  2⤵
  PID:5420
- C:\Windows\System\uImjTJn.exe
  C:\Windows\System\uImjTJn.exe
  2⤵
  PID:5436
- C:\Windows\System\lxSnlPP.exe
  C:\Windows\System\lxSnlPP.exe
  2⤵
  PID:5452
- C:\Windows\System\NyLviti.exe
  C:\Windows\System\NyLviti.exe
  2⤵
  PID:5468
- C:\Windows\System\dsYHVAL.exe
  C:\Windows\System\dsYHVAL.exe
  2⤵
  PID:5484
- C:\Windows\System\HrLbVEq.exe
  C:\Windows\System\HrLbVEq.exe
  2⤵
  PID:5500
- C:\Windows\System\vZUqhYM.exe
  C:\Windows\System\vZUqhYM.exe
  2⤵
  PID:5516
- C:\Windows\System\BsgGCGU.exe
  C:\Windows\System\BsgGCGU.exe
  2⤵
  PID:5532
- C:\Windows\System\HqtJoAu.exe
  C:\Windows\System\HqtJoAu.exe
  2⤵
  PID:5548
- C:\Windows\System\bDWSCdT.exe
  C:\Windows\System\bDWSCdT.exe
  2⤵
  PID:5564
- C:\Windows\System\UlpQtZY.exe
  C:\Windows\System\UlpQtZY.exe
  2⤵
  PID:5580
- C:\Windows\System\vMaAdQR.exe
  C:\Windows\System\vMaAdQR.exe
  2⤵
  PID:5596
- C:\Windows\System\wHzwCSt.exe
  C:\Windows\System\wHzwCSt.exe
  2⤵
  PID:5612
- C:\Windows\System\MXiSRtn.exe
  C:\Windows\System\MXiSRtn.exe
  2⤵
  PID:5628
- C:\Windows\System\aupuvof.exe
  C:\Windows\System\aupuvof.exe
  2⤵
  PID:5644
- C:\Windows\System\KenuOeC.exe
  C:\Windows\System\KenuOeC.exe
  2⤵
  PID:5660
- C:\Windows\System\zogBCpr.exe
  C:\Windows\System\zogBCpr.exe
  2⤵
  PID:5676
- C:\Windows\System\zvLCwbN.exe
  C:\Windows\System\zvLCwbN.exe
  2⤵
  PID:5692
- C:\Windows\System\ZLiUbKp.exe
  C:\Windows\System\ZLiUbKp.exe
  2⤵
  PID:5708
- C:\Windows\System\jEBiVhy.exe
  C:\Windows\System\jEBiVhy.exe
  2⤵
  PID:5724
- C:\Windows\System\DJXeWdX.exe
  C:\Windows\System\DJXeWdX.exe
  2⤵
  PID:5740
- C:\Windows\System\OkBUoVK.exe
  C:\Windows\System\OkBUoVK.exe
  2⤵
  PID:5756
- C:\Windows\System\akPhEBx.exe
  C:\Windows\System\akPhEBx.exe
  2⤵
  PID:5772
- C:\Windows\System\PbyhmDl.exe
  C:\Windows\System\PbyhmDl.exe
  2⤵
  PID:5788
- C:\Windows\System\IiWDImS.exe
  C:\Windows\System\IiWDImS.exe
  2⤵
  PID:5804
- C:\Windows\System\SSnRPBT.exe
  C:\Windows\System\SSnRPBT.exe
  2⤵
  PID:5820
- C:\Windows\System\UYUtalg.exe
  C:\Windows\System\UYUtalg.exe
  2⤵
  PID:5836
- C:\Windows\System\eEfQCQd.exe
  C:\Windows\System\eEfQCQd.exe
  2⤵
  PID:5852
- C:\Windows\System\cfdtEur.exe
  C:\Windows\System\cfdtEur.exe
  2⤵
  PID:5868
- C:\Windows\System\GjpKQSK.exe
  C:\Windows\System\GjpKQSK.exe
  2⤵
  PID:5884
- C:\Windows\System\SMcyJjE.exe
  C:\Windows\System\SMcyJjE.exe
  2⤵
  PID:5900
- C:\Windows\System\DRpRTtF.exe
  C:\Windows\System\DRpRTtF.exe
  2⤵
  PID:5916
- C:\Windows\System\czKkjEt.exe
  C:\Windows\System\czKkjEt.exe
  2⤵
  PID:5932
- C:\Windows\System\aLugFxT.exe
  C:\Windows\System\aLugFxT.exe
  2⤵
  PID:5948
- C:\Windows\System\YBaeIYh.exe
  C:\Windows\System\YBaeIYh.exe
  2⤵
  PID:5964
- C:\Windows\System\YxSvjpz.exe
  C:\Windows\System\YxSvjpz.exe
  2⤵
  PID:5980
- C:\Windows\System\RULIGfK.exe
  C:\Windows\System\RULIGfK.exe
  2⤵
  PID:5996
- C:\Windows\System\LuKZsWG.exe
  C:\Windows\System\LuKZsWG.exe
  2⤵
  PID:6012
- C:\Windows\System\zBbOiyo.exe
  C:\Windows\System\zBbOiyo.exe
  2⤵
  PID:6028
- C:\Windows\System\fjUnbpY.exe
  C:\Windows\System\fjUnbpY.exe
  2⤵
  PID:6044
- C:\Windows\System\qFBrMsz.exe
  C:\Windows\System\qFBrMsz.exe
  2⤵
  PID:6060
- C:\Windows\System\eomuPGA.exe
  C:\Windows\System\eomuPGA.exe
  2⤵
  PID:6076
- C:\Windows\System\vhnvqBv.exe
  C:\Windows\System\vhnvqBv.exe
  2⤵
  PID:6092
- C:\Windows\System\sGggeZY.exe
  C:\Windows\System\sGggeZY.exe
  2⤵
  PID:6108
- C:\Windows\System\bjYgVAr.exe
  C:\Windows\System\bjYgVAr.exe
  2⤵
  PID:6124
- C:\Windows\System\NDtSreb.exe
  C:\Windows\System\NDtSreb.exe
  2⤵
  PID:6140
- C:\Windows\System\fnuFHQb.exe
  C:\Windows\System\fnuFHQb.exe
  2⤵
  PID:4692
- C:\Windows\System\lbymBnO.exe
  C:\Windows\System\lbymBnO.exe
  2⤵
  PID:4852
- C:\Windows\System\eoQlaUc.exe
  C:\Windows\System\eoQlaUc.exe
  2⤵
  PID:4920
- C:\Windows\System\FTidoDd.exe
  C:\Windows\System\FTidoDd.exe
  2⤵
  PID:5000
- C:\Windows\System\DTajcKq.exe
  C:\Windows\System\DTajcKq.exe
  2⤵
  PID:4192
- C:\Windows\System\QroUZcO.exe
  C:\Windows\System\QroUZcO.exe
  2⤵
  PID:4240
- C:\Windows\System\xGQJxcr.exe
  C:\Windows\System\xGQJxcr.exe
  2⤵
  PID:4548
- C:\Windows\System\dQvGaoA.exe
  C:\Windows\System\dQvGaoA.exe
  2⤵
  PID:5144
- C:\Windows\System\uCCBBBn.exe
  C:\Windows\System\uCCBBBn.exe
  2⤵
  PID:5208
- C:\Windows\System\ekUZOfk.exe
  C:\Windows\System\ekUZOfk.exe
  2⤵
  PID:5272
- C:\Windows\System\vSfpUia.exe
  C:\Windows\System\vSfpUia.exe
  2⤵
  PID:4788
- C:\Windows\System\FaixnMp.exe
  C:\Windows\System\FaixnMp.exe
  2⤵
  PID:4856
- C:\Windows\System\KniiyTO.exe
  C:\Windows\System\KniiyTO.exe
  2⤵
  PID:5096
- C:\Windows\System\mAkDTaG.exe
  C:\Windows\System\mAkDTaG.exe
  2⤵
  PID:4388
- C:\Windows\System\wpPkWuB.exe
  C:\Windows\System\wpPkWuB.exe
  2⤵
  PID:2608
- C:\Windows\System\EhDqvUT.exe
  C:\Windows\System\EhDqvUT.exe
  2⤵
  PID:4648
- C:\Windows\System\KNkxoxJ.exe
  C:\Windows\System\KNkxoxJ.exe
  2⤵
  PID:5156
- C:\Windows\System\JkfgaOb.exe
  C:\Windows\System\JkfgaOb.exe
  2⤵
  PID:5220
- C:\Windows\System\lwFsgek.exe
  C:\Windows\System\lwFsgek.exe
  2⤵
  PID:5284
- C:\Windows\System\QZQOtOR.exe
  C:\Windows\System\QZQOtOR.exe
  2⤵
  PID:5300
- C:\Windows\System\GlwhmpC.exe
  C:\Windows\System\GlwhmpC.exe
  2⤵
  PID:5364
- C:\Windows\System\aoxDIKY.exe
  C:\Windows\System\aoxDIKY.exe
  2⤵
  PID:5428
- C:\Windows\System\VNZIahh.exe
  C:\Windows\System\VNZIahh.exe
  2⤵
  PID:5492
- C:\Windows\System\ZAVpOrI.exe
  C:\Windows\System\ZAVpOrI.exe
  2⤵
  PID:5348
- C:\Windows\System\ITvLehh.exe
  C:\Windows\System\ITvLehh.exe
  2⤵
  PID:5416
- C:\Windows\System\elOhPSO.exe
  C:\Windows\System\elOhPSO.exe
  2⤵
  PID:5480
- C:\Windows\System\ndeQvfz.exe
  C:\Windows\System\ndeQvfz.exe
  2⤵
  PID:5540
- C:\Windows\System\dAhLfwI.exe
  C:\Windows\System\dAhLfwI.exe
  2⤵
  PID:5604
- C:\Windows\System\NXTyilx.exe
  C:\Windows\System\NXTyilx.exe
  2⤵
  PID:5592
- C:\Windows\System\hzovYmZ.exe
  C:\Windows\System\hzovYmZ.exe
  2⤵
  PID:5652
- C:\Windows\System\hqfpwgP.exe
  C:\Windows\System\hqfpwgP.exe
  2⤵
  PID:5716
- C:\Windows\System\VHbBomJ.exe
  C:\Windows\System\VHbBomJ.exe
  2⤵
  PID:5780
- C:\Windows\System\cYSuhml.exe
  C:\Windows\System\cYSuhml.exe
  2⤵
  PID:5636
- C:\Windows\System\KWdXncj.exe
  C:\Windows\System\KWdXncj.exe
  2⤵
  PID:5668
- C:\Windows\System\MQFbKUn.exe
  C:\Windows\System\MQFbKUn.exe
  2⤵
  PID:5764
- C:\Windows\System\cLTKNNp.exe
  C:\Windows\System\cLTKNNp.exe
  2⤵
  PID:5828
- C:\Windows\System\BJOiPIz.exe
  C:\Windows\System\BJOiPIz.exe
  2⤵
  PID:5876
- C:\Windows\System\YPVODbr.exe
  C:\Windows\System\YPVODbr.exe
  2⤵
  PID:5880
- C:\Windows\System\dqacqkI.exe
  C:\Windows\System\dqacqkI.exe
  2⤵
  PID:5924
- C:\Windows\System\nCYNcLG.exe
  C:\Windows\System\nCYNcLG.exe
  2⤵
  PID:5976
- C:\Windows\System\pBrHAwV.exe
  C:\Windows\System\pBrHAwV.exe
  2⤵
  PID:6040
- C:\Windows\System\ivlRCEZ.exe
  C:\Windows\System\ivlRCEZ.exe
  2⤵
  PID:5960
- C:\Windows\System\OscxNQT.exe
  C:\Windows\System\OscxNQT.exe
  2⤵
  PID:6020
- C:\Windows\System\pzqNpTE.exe
  C:\Windows\System\pzqNpTE.exe
  2⤵
  PID:6084
- C:\Windows\System\mSJkkKh.exe
  C:\Windows\System\mSJkkKh.exe
  2⤵
  PID:4776
- C:\Windows\System\LgGdxSA.exe
  C:\Windows\System\LgGdxSA.exe
  2⤵
  PID:6100
- C:\Windows\System\WdNLAtA.exe
  C:\Windows\System\WdNLAtA.exe
  2⤵
  PID:4760
- C:\Windows\System\LhUIjoX.exe
  C:\Windows\System\LhUIjoX.exe
  2⤵
  PID:4376
- C:\Windows\System\njYIcfy.exe
  C:\Windows\System\njYIcfy.exe
  2⤵
  PID:5240
- C:\Windows\System\gOIdiyH.exe
  C:\Windows\System\gOIdiyH.exe
  2⤵
  PID:4932
- C:\Windows\System\yeMTUEh.exe
  C:\Windows\System\yeMTUEh.exe
  2⤵
  PID:4484
- C:\Windows\System\QtiQzLQ.exe
  C:\Windows\System\QtiQzLQ.exe
  2⤵
  PID:5256
- C:\Windows\System\ueXGqpQ.exe
  C:\Windows\System\ueXGqpQ.exe
  2⤵
  PID:4612
- C:\Windows\System\lhvVPBN.exe
  C:\Windows\System\lhvVPBN.exe
  2⤵
  PID:5332
- C:\Windows\System\QOiiXaQ.exe
  C:\Windows\System\QOiiXaQ.exe
  2⤵
  PID:5128
- C:\Windows\System\wjBXJeC.exe
  C:\Windows\System\wjBXJeC.exe
  2⤵
  PID:5460
- C:\Windows\System\bIQkUxA.exe
  C:\Windows\System\bIQkUxA.exe
  2⤵
  PID:5528
- C:\Windows\System\lnyZXZP.exe
  C:\Windows\System\lnyZXZP.exe
  2⤵
  PID:5352
- C:\Windows\System\HZphFxU.exe
  C:\Windows\System\HZphFxU.exe
  2⤵
  PID:5588
- C:\Windows\System\LPqGnUL.exe
  C:\Windows\System\LPqGnUL.exe
  2⤵
  PID:5576
- C:\Windows\System\zDiAjiW.exe
  C:\Windows\System\zDiAjiW.exe
  2⤵
  PID:5752
- C:\Windows\System\JBTOGQi.exe
  C:\Windows\System\JBTOGQi.exe
  2⤵
  PID:5816
- C:\Windows\System\hJYgyab.exe
  C:\Windows\System\hJYgyab.exe
  2⤵
  PID:5796
- C:\Windows\System\HRNipOW.exe
  C:\Windows\System\HRNipOW.exe
  2⤵
  PID:5944
- C:\Windows\System\vVgkfdO.exe
  C:\Windows\System\vVgkfdO.exe
  2⤵
  PID:6052
- C:\Windows\System\JTPIXay.exe
  C:\Windows\System\JTPIXay.exe
  2⤵
  PID:6008
- C:\Windows\System\awrbdXm.exe
  C:\Windows\System\awrbdXm.exe
  2⤵
  PID:5896
- C:\Windows\System\uAYHqTM.exe
  C:\Windows\System\uAYHqTM.exe
  2⤵
  PID:5992
- C:\Windows\System\cuWayUM.exe
  C:\Windows\System\cuWayUM.exe
  2⤵
  PID:4552
- C:\Windows\System\ZYnLxVT.exe
  C:\Windows\System\ZYnLxVT.exe
  2⤵
  PID:5044
- C:\Windows\System\XbqEeVb.exe
  C:\Windows\System\XbqEeVb.exe
  2⤵
  PID:4516
- C:\Windows\System\FOAHdCG.exe
  C:\Windows\System\FOAHdCG.exe
  2⤵
  PID:5380
- C:\Windows\System\hpMQGSe.exe
  C:\Windows\System\hpMQGSe.exe
  2⤵
  PID:5176
- C:\Windows\System\TPbokwR.exe
  C:\Windows\System\TPbokwR.exe
  2⤵
  PID:5400
- C:\Windows\System\xuBZuWE.exe
  C:\Windows\System\xuBZuWE.exe
  2⤵
  PID:5684
- C:\Windows\System\ZWNgwxr.exe
  C:\Windows\System\ZWNgwxr.exe
  2⤵
  PID:5732
- C:\Windows\System\jwlsMNV.exe
  C:\Windows\System\jwlsMNV.exe
  2⤵
  PID:6072
- C:\Windows\System\ZMRtNcv.exe
  C:\Windows\System\ZMRtNcv.exe
  2⤵
  PID:5624
- C:\Windows\System\wpwtdRr.exe
  C:\Windows\System\wpwtdRr.exe
  2⤵
  PID:1692
- C:\Windows\System\etijFwI.exe
  C:\Windows\System\etijFwI.exe
  2⤵
  PID:5252
- C:\Windows\System\CvBDRdT.exe
  C:\Windows\System\CvBDRdT.exe
  2⤵
  PID:5192
- C:\Windows\System\eNYpBRk.exe
  C:\Windows\System\eNYpBRk.exe
  2⤵
  PID:5848
- C:\Windows\System\qCofNXe.exe
  C:\Windows\System\qCofNXe.exe
  2⤵
  PID:5316
- C:\Windows\System\WYiDQFA.exe
  C:\Windows\System\WYiDQFA.exe
  2⤵
  PID:5988
- C:\Windows\System\xYpDeMg.exe
  C:\Windows\System\xYpDeMg.exe
  2⤵
  PID:5640
- C:\Windows\System\ZUlLKdW.exe
  C:\Windows\System\ZUlLKdW.exe
  2⤵
  PID:5892
- C:\Windows\System\QgzeZNa.exe
  C:\Windows\System\QgzeZNa.exe
  2⤵
  PID:6120
- C:\Windows\System\tBWXqHG.exe
  C:\Windows\System\tBWXqHG.exe
  2⤵
  PID:5748
- C:\Windows\System\AjmdIOc.exe
  C:\Windows\System\AjmdIOc.exe
  2⤵
  PID:6160
- C:\Windows\System\fskWOOj.exe
  C:\Windows\System\fskWOOj.exe
  2⤵
  PID:6176
- C:\Windows\System\pnWcpXY.exe
  C:\Windows\System\pnWcpXY.exe
  2⤵
  PID:6192
- C:\Windows\System\nqKTnuE.exe
  C:\Windows\System\nqKTnuE.exe
  2⤵
  PID:6208
- C:\Windows\System\ZRAvfni.exe
  C:\Windows\System\ZRAvfni.exe
  2⤵
  PID:6224
- C:\Windows\System\sAxZTlz.exe
  C:\Windows\System\sAxZTlz.exe
  2⤵
  PID:6240
- C:\Windows\System\oSPYzdR.exe
  C:\Windows\System\oSPYzdR.exe
  2⤵
  PID:6256
- C:\Windows\System\ULaHgpI.exe
  C:\Windows\System\ULaHgpI.exe
  2⤵
  PID:6272
- C:\Windows\System\lMMrpmq.exe
  C:\Windows\System\lMMrpmq.exe
  2⤵
  PID:6288
- C:\Windows\System\KblhZdL.exe
  C:\Windows\System\KblhZdL.exe
  2⤵
  PID:6304
- C:\Windows\System\vnmByNH.exe
  C:\Windows\System\vnmByNH.exe
  2⤵
  PID:6320
- C:\Windows\System\NZYRbDv.exe
  C:\Windows\System\NZYRbDv.exe
  2⤵
  PID:6336
- C:\Windows\System\cWGELsx.exe
  C:\Windows\System\cWGELsx.exe
  2⤵
  PID:6352
- C:\Windows\System\CqMSNmJ.exe
  C:\Windows\System\CqMSNmJ.exe
  2⤵
  PID:6368
- C:\Windows\System\HrqUAqT.exe
  C:\Windows\System\HrqUAqT.exe
  2⤵
  PID:6384
- C:\Windows\System\hDDGjKq.exe
  C:\Windows\System\hDDGjKq.exe
  2⤵
  PID:6400
- C:\Windows\System\woNHZLb.exe
  C:\Windows\System\woNHZLb.exe
  2⤵
  PID:6416
- C:\Windows\System\JwVickz.exe
  C:\Windows\System\JwVickz.exe
  2⤵
  PID:6432
- C:\Windows\System\pGBfJCG.exe
  C:\Windows\System\pGBfJCG.exe
  2⤵
  PID:6448
- C:\Windows\System\fhlnxcf.exe
  C:\Windows\System\fhlnxcf.exe
  2⤵
  PID:6464
- C:\Windows\System\CGOqyxb.exe
  C:\Windows\System\CGOqyxb.exe
  2⤵
  PID:6480
- C:\Windows\System\ZXJfbQP.exe
  C:\Windows\System\ZXJfbQP.exe
  2⤵
  PID:6496
- C:\Windows\System\HbqTOgL.exe
  C:\Windows\System\HbqTOgL.exe
  2⤵
  PID:6512
- C:\Windows\System\ZrHifeO.exe
  C:\Windows\System\ZrHifeO.exe
  2⤵
  PID:6528
- C:\Windows\System\pLVhgiW.exe
  C:\Windows\System\pLVhgiW.exe
  2⤵
  PID:6544
- C:\Windows\System\AxoHObg.exe
  C:\Windows\System\AxoHObg.exe
  2⤵
  PID:6560
- C:\Windows\System\hsoeFSZ.exe
  C:\Windows\System\hsoeFSZ.exe
  2⤵
  PID:6576
- C:\Windows\System\mVzGnIz.exe
  C:\Windows\System\mVzGnIz.exe
  2⤵
  PID:6592
- C:\Windows\System\CHLWsvn.exe
  C:\Windows\System\CHLWsvn.exe
  2⤵
  PID:6608
- C:\Windows\System\FzazGWM.exe
  C:\Windows\System\FzazGWM.exe
  2⤵
  PID:6624
- C:\Windows\System\bmqxmzc.exe
  C:\Windows\System\bmqxmzc.exe
  2⤵
  PID:6640
- C:\Windows\System\HPLhNqD.exe
  C:\Windows\System\HPLhNqD.exe
  2⤵
  PID:6656
- C:\Windows\System\rIxzbbn.exe
  C:\Windows\System\rIxzbbn.exe
  2⤵
  PID:6672
- C:\Windows\System\gotZZoR.exe
  C:\Windows\System\gotZZoR.exe
  2⤵
  PID:6688
- C:\Windows\System\mBkCtEW.exe
  C:\Windows\System\mBkCtEW.exe
  2⤵
  PID:6704
- C:\Windows\System\fwnliCs.exe
  C:\Windows\System\fwnliCs.exe
  2⤵
  PID:6720
- C:\Windows\System\xgQezEB.exe
  C:\Windows\System\xgQezEB.exe
  2⤵
  PID:6736
- C:\Windows\System\PShgZrK.exe
  C:\Windows\System\PShgZrK.exe
  2⤵
  PID:6752
- C:\Windows\System\mQIScfi.exe
  C:\Windows\System\mQIScfi.exe
  2⤵
  PID:6768
- C:\Windows\System\HGwvybp.exe
  C:\Windows\System\HGwvybp.exe
  2⤵
  PID:6784
- C:\Windows\System\CjyNOhY.exe
  C:\Windows\System\CjyNOhY.exe
  2⤵
  PID:6800
- C:\Windows\System\RdUPKlV.exe
  C:\Windows\System\RdUPKlV.exe
  2⤵
  PID:6816
- C:\Windows\System\cGpZRFE.exe
  C:\Windows\System\cGpZRFE.exe
  2⤵
  PID:6832
- C:\Windows\System\bHHOlOi.exe
  C:\Windows\System\bHHOlOi.exe
  2⤵
  PID:6848
- C:\Windows\System\PstOsOu.exe
  C:\Windows\System\PstOsOu.exe
  2⤵
  PID:6864
- C:\Windows\System\IcGVUWt.exe
  C:\Windows\System\IcGVUWt.exe
  2⤵
  PID:6880
- C:\Windows\System\pGoFdQq.exe
  C:\Windows\System\pGoFdQq.exe
  2⤵
  PID:6896
- C:\Windows\System\uzoZYuB.exe
  C:\Windows\System\uzoZYuB.exe
  2⤵
  PID:6912
- C:\Windows\System\UcUZJKA.exe
  C:\Windows\System\UcUZJKA.exe
  2⤵
  PID:6928
- C:\Windows\System\PqHgJTl.exe
  C:\Windows\System\PqHgJTl.exe
  2⤵
  PID:6944
- C:\Windows\System\yhZBxTX.exe
  C:\Windows\System\yhZBxTX.exe
  2⤵
  PID:6960
- C:\Windows\System\RbpODyU.exe
  C:\Windows\System\RbpODyU.exe
  2⤵
  PID:6976
- C:\Windows\System\ysjfioh.exe
  C:\Windows\System\ysjfioh.exe
  2⤵
  PID:6992
- C:\Windows\System\uGNmrDE.exe
  C:\Windows\System\uGNmrDE.exe
  2⤵
  PID:7008
- C:\Windows\System\DrRIpeb.exe
  C:\Windows\System\DrRIpeb.exe
  2⤵
  PID:7024
- C:\Windows\System\hgTXeCj.exe
  C:\Windows\System\hgTXeCj.exe
  2⤵
  PID:7040
- C:\Windows\System\RJyWYIV.exe
  C:\Windows\System\RJyWYIV.exe
  2⤵
  PID:7056
- C:\Windows\System\LgOcOvQ.exe
  C:\Windows\System\LgOcOvQ.exe
  2⤵
  PID:7076
- C:\Windows\System\AHuqhZk.exe
  C:\Windows\System\AHuqhZk.exe
  2⤵
  PID:7092
- C:\Windows\System\PMtqkQH.exe
  C:\Windows\System\PMtqkQH.exe
  2⤵
  PID:7108
- C:\Windows\System\qWcZRVQ.exe
  C:\Windows\System\qWcZRVQ.exe
  2⤵
  PID:7124
- C:\Windows\System\ZkfQwpp.exe
  C:\Windows\System\ZkfQwpp.exe
  2⤵
  PID:7140
- C:\Windows\System\WYBSlxK.exe
  C:\Windows\System\WYBSlxK.exe
  2⤵
  PID:7156
- C:\Windows\System\itBaREF.exe
  C:\Windows\System\itBaREF.exe
  2⤵
  PID:4164
- C:\Windows\System\bvOqEqj.exe
  C:\Windows\System\bvOqEqj.exe
  2⤵
  PID:5956
- C:\Windows\System\fsnKvYy.exe
  C:\Windows\System\fsnKvYy.exe
  2⤵
  PID:5512
- C:\Windows\System\xYJQQIO.exe
  C:\Windows\System\xYJQQIO.exe
  2⤵
  PID:6268
- C:\Windows\System\ZtSlAwK.exe
  C:\Windows\System\ZtSlAwK.exe
  2⤵
  PID:6188
- C:\Windows\System\uCjpXZI.exe
  C:\Windows\System\uCjpXZI.exe
  2⤵
  PID:6252
- C:\Windows\System\qKUEqOM.exe
  C:\Windows\System\qKUEqOM.exe
  2⤵
  PID:6360
- C:\Windows\System\YcbmoaN.exe
  C:\Windows\System\YcbmoaN.exe
  2⤵
  PID:6284
- C:\Windows\System\gysuDIs.exe
  C:\Windows\System\gysuDIs.exe
  2⤵
  PID:6344
- C:\Windows\System\aBynaNx.exe
  C:\Windows\System\aBynaNx.exe
  2⤵
  PID:6408
- C:\Windows\System\BFdKhlS.exe
  C:\Windows\System\BFdKhlS.exe
  2⤵
  PID:6460
- C:\Windows\System\jtJjROz.exe
  C:\Windows\System\jtJjROz.exe
  2⤵
  PID:6520
- C:\Windows\System\ZEpizzU.exe
  C:\Windows\System\ZEpizzU.exe
  2⤵
  PID:6440
- C:\Windows\System\rlbOSVL.exe
  C:\Windows\System\rlbOSVL.exe
  2⤵
  PID:6508
- C:\Windows\System\xPtLmCT.exe
  C:\Windows\System\xPtLmCT.exe
  2⤵
  PID:6572
- C:\Windows\System\FCbqMPh.exe
  C:\Windows\System\FCbqMPh.exe
  2⤵
  PID:6600
- C:\Windows\System\SQYTJLz.exe
  C:\Windows\System\SQYTJLz.exe
  2⤵
  PID:6648
- C:\Windows\System\nsCNVEo.exe
  C:\Windows\System\nsCNVEo.exe
  2⤵
  PID:6632
- C:\Windows\System\zqZePrY.exe
  C:\Windows\System\zqZePrY.exe
  2⤵
  PID:6696
- C:\Windows\System\KbMgxpF.exe
  C:\Windows\System\KbMgxpF.exe
  2⤵
  PID:6892
- C:\Windows\System\BJhgzIB.exe
  C:\Windows\System\BJhgzIB.exe
  2⤵
  PID:6908
- C:\Windows\System\jyNNHlp.exe
  C:\Windows\System\jyNNHlp.exe
  2⤵
  PID:6984
- C:\Windows\System\wpqcIQn.exe
  C:\Windows\System\wpqcIQn.exe
  2⤵
  PID:2984
- C:\Windows\System\kLURKps.exe
  C:\Windows\System\kLURKps.exe
  2⤵
  PID:7048
- C:\Windows\System\pfrxSeR.exe
  C:\Windows\System\pfrxSeR.exe
  2⤵
  PID:7052
- C:\Windows\System\FhzzSFJ.exe
  C:\Windows\System\FhzzSFJ.exe
  2⤵
  PID:7088
- C:\Windows\System\VscjffH.exe
  C:\Windows\System\VscjffH.exe
  2⤵
  PID:7132
- C:\Windows\System\SZrNlpW.exe
  C:\Windows\System\SZrNlpW.exe
  2⤵
  PID:7148
- C:\Windows\System\zRIzswA.exe
  C:\Windows\System\zRIzswA.exe
  2⤵
  PID:6232
- C:\Windows\System\HSGquWP.exe
  C:\Windows\System\HSGquWP.exe
  2⤵
  PID:6328
- C:\Windows\System\yRwtmxT.exe
  C:\Windows\System\yRwtmxT.exe
  2⤵
  PID:6152
- C:\Windows\System\iKrXjsH.exe
  C:\Windows\System\iKrXjsH.exe
  2⤵
  PID:6380
- C:\Windows\System\PmYEcYE.exe
  C:\Windows\System\PmYEcYE.exe
  2⤵
  PID:6396
- C:\Windows\System\mxzVnhM.exe
  C:\Windows\System\mxzVnhM.exe
  2⤵
  PID:6476
- C:\Windows\System\yjoAQqW.exe
  C:\Windows\System\yjoAQqW.exe
  2⤵
  PID:6680
- C:\Windows\System\OHmgRko.exe
  C:\Windows\System\OHmgRko.exe
  2⤵
  PID:6552
- C:\Windows\System\mCkqSnw.exe
  C:\Windows\System\mCkqSnw.exe
  2⤵
  PID:6620
- C:\Windows\System\RVZYPjp.exe
  C:\Windows\System\RVZYPjp.exe
  2⤵
  PID:6748
- C:\Windows\System\zjOnTkG.exe
  C:\Windows\System\zjOnTkG.exe
  2⤵
  PID:6668
- C:\Windows\System\UsRHkjn.exe
  C:\Windows\System\UsRHkjn.exe
  2⤵
  PID:6840
- C:\Windows\System\sXpzzxF.exe
  C:\Windows\System\sXpzzxF.exe
  2⤵
  PID:6824
- C:\Windows\System\IHlgCUJ.exe
  C:\Windows\System\IHlgCUJ.exe
  2⤵
  PID:6860
- C:\Windows\System\MIGpnCz.exe
  C:\Windows\System\MIGpnCz.exe
  2⤵
  PID:7016
- C:\Windows\System\XgiXgnP.exe
  C:\Windows\System\XgiXgnP.exe
  2⤵
  PID:7120
- C:\Windows\System\TmCkykS.exe
  C:\Windows\System\TmCkykS.exe
  2⤵
  PID:6204
- C:\Windows\System\gqmKhCN.exe
  C:\Windows\System\gqmKhCN.exe
  2⤵
  PID:6940
- C:\Windows\System\JLeXjNT.exe
  C:\Windows\System\JLeXjNT.exe
  2⤵
  PID:7072
- C:\Windows\System\GNPcFzz.exe
  C:\Windows\System\GNPcFzz.exe
  2⤵
  PID:6216
- C:\Windows\System\lXiKTHM.exe
  C:\Windows\System\lXiKTHM.exe
  2⤵
  PID:6316
- C:\Windows\System\uQwYRxU.exe
  C:\Windows\System\uQwYRxU.exe
  2⤵
  PID:6556
- C:\Windows\System\jzozbOb.exe
  C:\Windows\System\jzozbOb.exe
  2⤵
  PID:7004
- C:\Windows\System\TjbxmhK.exe
  C:\Windows\System\TjbxmhK.exe
  2⤵
  PID:7032
- C:\Windows\System\RJeRDpg.exe
  C:\Windows\System\RJeRDpg.exe
  2⤵
  PID:7164
- C:\Windows\System\yfLGrAp.exe
  C:\Windows\System\yfLGrAp.exe
  2⤵
  PID:6972
- C:\Windows\System\kXfMgHH.exe
  C:\Windows\System\kXfMgHH.exe
  2⤵
  PID:6412
- C:\Windows\System\OlrpzPu.exe
  C:\Windows\System\OlrpzPu.exe
  2⤵
  PID:6904
- C:\Windows\System\myXICES.exe
  C:\Windows\System\myXICES.exe
  2⤵
  PID:6700
- C:\Windows\System\nBUwdRF.exe
  C:\Windows\System\nBUwdRF.exe
  2⤵
  PID:6876
- C:\Windows\System\zUsNhNa.exe
  C:\Windows\System\zUsNhNa.exe
  2⤵
  PID:7176
- C:\Windows\System\zEuFdJP.exe
  C:\Windows\System\zEuFdJP.exe
  2⤵
  PID:7196
- C:\Windows\System\lFRLGKg.exe
  C:\Windows\System\lFRLGKg.exe
  2⤵
  PID:7212
- C:\Windows\System\AvqblXQ.exe
  C:\Windows\System\AvqblXQ.exe
  2⤵
  PID:7228
- C:\Windows\System\bnNQViV.exe
  C:\Windows\System\bnNQViV.exe
  2⤵
  PID:7244
- C:\Windows\System\RQARSfw.exe
  C:\Windows\System\RQARSfw.exe
  2⤵
  PID:7260
- C:\Windows\System\uzTYZLA.exe
  C:\Windows\System\uzTYZLA.exe
  2⤵
  PID:7276
- C:\Windows\System\DFKwtZn.exe
  C:\Windows\System\DFKwtZn.exe
  2⤵
  PID:7292
- C:\Windows\System\XZjrNJw.exe
  C:\Windows\System\XZjrNJw.exe
  2⤵
  PID:7308
- C:\Windows\System\SkKUdbk.exe
  C:\Windows\System\SkKUdbk.exe
  2⤵
  PID:7324
- C:\Windows\System\qespfQg.exe
  C:\Windows\System\qespfQg.exe
  2⤵
  PID:7340
- C:\Windows\System\cRZPTdS.exe
  C:\Windows\System\cRZPTdS.exe
  2⤵
  PID:7356
- C:\Windows\System\gSCyEHv.exe
  C:\Windows\System\gSCyEHv.exe
  2⤵
  PID:7372
- C:\Windows\System\GrFGbtk.exe
  C:\Windows\System\GrFGbtk.exe
  2⤵
  PID:7388
- C:\Windows\System\TgRUpps.exe
  C:\Windows\System\TgRUpps.exe
  2⤵
  PID:7404
- C:\Windows\System\mbdCJor.exe
  C:\Windows\System\mbdCJor.exe
  2⤵
  PID:7420
- C:\Windows\System\sINRbsb.exe
  C:\Windows\System\sINRbsb.exe
  2⤵
  PID:7436
- C:\Windows\System\luHRQdR.exe
  C:\Windows\System\luHRQdR.exe
  2⤵
  PID:7544
- C:\Windows\System\JxrZBzo.exe
  C:\Windows\System\JxrZBzo.exe
  2⤵
  PID:7564
- C:\Windows\System\dcQotTv.exe
  C:\Windows\System\dcQotTv.exe
  2⤵
  PID:7580
- C:\Windows\System\iUdjPfp.exe
  C:\Windows\System\iUdjPfp.exe
  2⤵
  PID:7604
- C:\Windows\System\OvoeRcW.exe
  C:\Windows\System\OvoeRcW.exe
  2⤵
  PID:7620
- C:\Windows\System\jvYFMYB.exe
  C:\Windows\System\jvYFMYB.exe
  2⤵
  PID:7636
- C:\Windows\System\pBJhCVf.exe
  C:\Windows\System\pBJhCVf.exe
  2⤵
  PID:7652
- C:\Windows\System\FxKcEtE.exe
  C:\Windows\System\FxKcEtE.exe
  2⤵
  PID:7668
- C:\Windows\System\hamiBik.exe
  C:\Windows\System\hamiBik.exe
  2⤵
  PID:7688
- C:\Windows\System\qOaaiLW.exe
  C:\Windows\System\qOaaiLW.exe
  2⤵
  PID:7708
- C:\Windows\System\GwmYkiX.exe
  C:\Windows\System\GwmYkiX.exe
  2⤵
  PID:7724
- C:\Windows\System\lmNKeAb.exe
  C:\Windows\System\lmNKeAb.exe
  2⤵
  PID:7740
- C:\Windows\System\hwPtHpp.exe
  C:\Windows\System\hwPtHpp.exe
  2⤵
  PID:7760
- C:\Windows\System\vfOEkXc.exe
  C:\Windows\System\vfOEkXc.exe
  2⤵
  PID:7776
- C:\Windows\System\GnlwJCa.exe
  C:\Windows\System\GnlwJCa.exe
  2⤵
  PID:7792
- C:\Windows\System\hBgaaml.exe
  C:\Windows\System\hBgaaml.exe
  2⤵
  PID:7808
- C:\Windows\System\YhYUdpD.exe
  C:\Windows\System\YhYUdpD.exe
  2⤵
  PID:7824
- C:\Windows\System\UfiJzIR.exe
  C:\Windows\System\UfiJzIR.exe
  2⤵
  PID:7840
- C:\Windows\System\aZXSPLv.exe
  C:\Windows\System\aZXSPLv.exe
  2⤵
  PID:7856
- C:\Windows\System\YZNElIr.exe
  C:\Windows\System\YZNElIr.exe
  2⤵
  PID:7872
- C:\Windows\System\EzQWSIw.exe
  C:\Windows\System\EzQWSIw.exe
  2⤵
  PID:7888
- C:\Windows\System\hFbOPvm.exe
  C:\Windows\System\hFbOPvm.exe
  2⤵
  PID:7908
- C:\Windows\System\xfmsqhg.exe
  C:\Windows\System\xfmsqhg.exe
  2⤵
  PID:7924
- C:\Windows\System\XasgFvh.exe
  C:\Windows\System\XasgFvh.exe
  2⤵
  PID:7940
- C:\Windows\System\EdXCIhb.exe
  C:\Windows\System\EdXCIhb.exe
  2⤵
  PID:7956
- C:\Windows\System\ZtqZnXu.exe
  C:\Windows\System\ZtqZnXu.exe
  2⤵
  PID:7972
- C:\Windows\System\nAQenbq.exe
  C:\Windows\System\nAQenbq.exe
  2⤵
  PID:7988
- C:\Windows\System\Zididef.exe
  C:\Windows\System\Zididef.exe
  2⤵
  PID:8004
- C:\Windows\System\wFvCJOb.exe
  C:\Windows\System\wFvCJOb.exe
  2⤵
  PID:8024
- C:\Windows\System\jeRAXwu.exe
  C:\Windows\System\jeRAXwu.exe
  2⤵
  PID:8040
- C:\Windows\System\Pvctcas.exe
  C:\Windows\System\Pvctcas.exe
  2⤵
  PID:8056
- C:\Windows\System\jLVhibU.exe
  C:\Windows\System\jLVhibU.exe
  2⤵
  PID:8080
- C:\Windows\System\gNVVnCD.exe
  C:\Windows\System\gNVVnCD.exe
  2⤵
  PID:8100
- C:\Windows\System\vzuIEdd.exe
  C:\Windows\System\vzuIEdd.exe
  2⤵
  PID:8116
- C:\Windows\System\OGybCmZ.exe
  C:\Windows\System\OGybCmZ.exe
  2⤵
  PID:8132
- C:\Windows\System\XKuSWlC.exe
  C:\Windows\System\XKuSWlC.exe
  2⤵
  PID:8148
- C:\Windows\System\raSJfRD.exe
  C:\Windows\System\raSJfRD.exe
  2⤵
  PID:8164
- C:\Windows\System\ZOLbdyU.exe
  C:\Windows\System\ZOLbdyU.exe
  2⤵
  PID:8180
- C:\Windows\System\gGpRfgC.exe
  C:\Windows\System\gGpRfgC.exe
  2⤵
  PID:6456
- C:\Windows\System\bZJkeEc.exe
  C:\Windows\System\bZJkeEc.exe
  2⤵
  PID:7136
- C:\Windows\System\zVExAoC.exe
  C:\Windows\System\zVExAoC.exe
  2⤵
  PID:6172
- C:\Windows\System\IcrDFUG.exe
  C:\Windows\System\IcrDFUG.exe
  2⤵
  PID:6364
- C:\Windows\System\MVWxbCW.exe
  C:\Windows\System\MVWxbCW.exe
  2⤵
  PID:7000
- C:\Windows\System\oQkCNcl.exe
  C:\Windows\System\oQkCNcl.exe
  2⤵
  PID:7188
- C:\Windows\System\VRCwLnk.exe
  C:\Windows\System\VRCwLnk.exe
  2⤵
  PID:7240
- C:\Windows\System\YXiETMe.exe
  C:\Windows\System\YXiETMe.exe
  2⤵
  PID:7300
- C:\Windows\System\VWDMfKU.exe
  C:\Windows\System\VWDMfKU.exe
  2⤵
  PID:7336
- C:\Windows\System\yqbthtj.exe
  C:\Windows\System\yqbthtj.exe
  2⤵
  PID:7396
- C:\Windows\System\VXhgxdr.exe
  C:\Windows\System\VXhgxdr.exe
  2⤵
  PID:7444
- C:\Windows\System\hLBXKDb.exe
  C:\Windows\System\hLBXKDb.exe
  2⤵
  PID:7256
- C:\Windows\System\rEmNnKB.exe
  C:\Windows\System\rEmNnKB.exe
  2⤵
  PID:7380
- C:\Windows\System\uuVFSIJ.exe
  C:\Windows\System\uuVFSIJ.exe
  2⤵
  PID:7448
- C:\Windows\System\eefWOtA.exe
  C:\Windows\System\eefWOtA.exe
  2⤵
  PID:7464
- C:\Windows\System\bxsKoGA.exe
  C:\Windows\System\bxsKoGA.exe
  2⤵
  PID:7484
- C:\Windows\System\SsXZFrT.exe
  C:\Windows\System\SsXZFrT.exe
  2⤵
  PID:7496
- C:\Windows\System\jfHjFyp.exe
  C:\Windows\System\jfHjFyp.exe
  2⤵
  PID:7512
- C:\Windows\System\AjCELyf.exe
  C:\Windows\System\AjCELyf.exe
  2⤵
  PID:7532
- C:\Windows\System\DzWvPwr.exe
  C:\Windows\System\DzWvPwr.exe
  2⤵
  PID:7552
- C:\Windows\System\gcOpHKR.exe
  C:\Windows\System\gcOpHKR.exe
  2⤵
  PID:7628
- C:\Windows\System\VdPdONW.exe
  C:\Windows\System\VdPdONW.exe
  2⤵
  PID:7696
- C:\Windows\System\pLLDzIl.exe
  C:\Windows\System\pLLDzIl.exe
  2⤵
  PID:7736
- C:\Windows\System\qBgbAbx.exe
  C:\Windows\System\qBgbAbx.exe
  2⤵
  PID:7804
- C:\Windows\System\WDFmqqn.exe
  C:\Windows\System\WDFmqqn.exe
  2⤵
  PID:6844
- C:\Windows\System\jJCyzWG.exe
  C:\Windows\System\jJCyzWG.exe
  2⤵
  PID:7680
- C:\Windows\System\hfDrbdn.exe
  C:\Windows\System\hfDrbdn.exe
  2⤵
  PID:7816
- C:\Windows\System\pWpKwim.exe
  C:\Windows\System\pWpKwim.exe
  2⤵
  PID:7684
- C:\Windows\System\wfTOAqT.exe
  C:\Windows\System\wfTOAqT.exe
  2⤵
  PID:7756
- C:\Windows\System\NkUcUGt.exe
  C:\Windows\System\NkUcUGt.exe
  2⤵
  PID:7864
- C:\Windows\System\DciwQfu.exe
  C:\Windows\System\DciwQfu.exe
  2⤵
  PID:7904
- C:\Windows\System\yOaambT.exe
  C:\Windows\System\yOaambT.exe
  2⤵
  PID:7968
- C:\Windows\System\fzIbUJJ.exe
  C:\Windows\System\fzIbUJJ.exe
  2⤵
  PID:8036
- C:\Windows\System\qZUEiTC.exe
  C:\Windows\System\qZUEiTC.exe
  2⤵
  PID:7920
- C:\Windows\System\ZRiAAYV.exe
  C:\Windows\System\ZRiAAYV.exe
  2⤵
  PID:7852
- C:\Windows\System\HnLLqlq.exe
  C:\Windows\System\HnLLqlq.exe
  2⤵
  PID:7980
- C:\Windows\System\PSCLJIe.exe
  C:\Windows\System\PSCLJIe.exe
  2⤵
  PID:8088
- C:\Windows\System\UeXYzqJ.exe
  C:\Windows\System\UeXYzqJ.exe
  2⤵
  PID:8096
- C:\Windows\System\mCOjJtI.exe
  C:\Windows\System\mCOjJtI.exe
  2⤵
  PID:8144
- C:\Windows\System\umwqupM.exe
  C:\Windows\System\umwqupM.exe
  2⤵
  PID:7172
- C:\Windows\System\KPgbuaa.exe
  C:\Windows\System\KPgbuaa.exe
  2⤵
  PID:6280
- C:\Windows\System\kvqOToh.exe
  C:\Windows\System\kvqOToh.exe
  2⤵
  PID:7220
- C:\Windows\System\kUQYBGu.exe
  C:\Windows\System\kUQYBGu.exe
  2⤵
  PID:7320
- C:\Windows\System\RFlSkqg.exe
  C:\Windows\System\RFlSkqg.exe
  2⤵
  PID:7472
- C:\Windows\System\THjPLox.exe
  C:\Windows\System\THjPLox.exe
  2⤵
  PID:7508
- C:\Windows\System\VVomPND.exe
  C:\Windows\System\VVomPND.exe
  2⤵
  PID:6856
- C:\Windows\System\FuSICME.exe
  C:\Windows\System\FuSICME.exe
  2⤵
  PID:7288
- C:\Windows\System\VaVxWzk.exe
  C:\Windows\System\VaVxWzk.exe
  2⤵
  PID:7612
- C:\Windows\System\kjlamFr.exe
  C:\Windows\System\kjlamFr.exe
  2⤵
  PID:7528
- C:\Windows\System\Zrhbcjz.exe
  C:\Windows\System\Zrhbcjz.exe
  2⤵
  PID:6888
- C:\Windows\System\fmucEby.exe
  C:\Windows\System\fmucEby.exe
  2⤵
  PID:7208
- C:\Windows\System\oZkmaST.exe
  C:\Windows\System\oZkmaST.exe
  2⤵
  PID:7676
- C:\Windows\System\NPWcnFI.exe
  C:\Windows\System\NPWcnFI.exe
  2⤵
  PID:7704
- C:\Windows\System\kpbRfBw.exe
  C:\Windows\System\kpbRfBw.exe
  2⤵
  PID:7492
- C:\Windows\System\tDNnIge.exe
  C:\Windows\System\tDNnIge.exe
  2⤵
  PID:7596
- C:\Windows\System\sFMJfhb.exe
  C:\Windows\System\sFMJfhb.exe
  2⤵
  PID:7752
- C:\Windows\System\NhEgLPF.exe
  C:\Windows\System\NhEgLPF.exe
  2⤵
  PID:8000
- C:\Windows\System\tAZLKfj.exe
  C:\Windows\System\tAZLKfj.exe
  2⤵
  PID:7884
- C:\Windows\System\vxmLhqr.exe
  C:\Windows\System\vxmLhqr.exe
  2⤵
  PID:8156
- C:\Windows\System\PBrSQhf.exe
  C:\Windows\System\PBrSQhf.exe
  2⤵
  PID:8112
- C:\Windows\System\GGALbId.exe
  C:\Windows\System\GGALbId.exe
  2⤵
  PID:8160
- C:\Windows\System\ibnIRKB.exe
  C:\Windows\System\ibnIRKB.exe
  2⤵
  PID:7556
- C:\Windows\System\AEiIuey.exe
  C:\Windows\System\AEiIuey.exe
  2⤵
  PID:7504
- C:\Windows\System\nYTdOlx.exe
  C:\Windows\System\nYTdOlx.exe
  2⤵
  PID:7616
- C:\Windows\System\BtGoGRU.exe
  C:\Windows\System\BtGoGRU.exe
  2⤵
  PID:7836
- C:\Windows\System\qYvHLVQ.exe
  C:\Windows\System\qYvHLVQ.exe
  2⤵
  PID:7648
- C:\Windows\System\AVYFNxT.exe
  C:\Windows\System\AVYFNxT.exe
  2⤵
  PID:7352
- C:\Windows\System\XkoWtqa.exe
  C:\Windows\System\XkoWtqa.exe
  2⤵
  PID:8068
- C:\Windows\System\jXzMoBw.exe
  C:\Windows\System\jXzMoBw.exe
  2⤵
  PID:6220
- C:\Windows\System\mbLYqOl.exe
  C:\Windows\System\mbLYqOl.exe
  2⤵
  PID:6812
- C:\Windows\System\HJupNyY.exe
  C:\Windows\System\HJupNyY.exe
  2⤵
  PID:7848
- C:\Windows\System\EAzpzUW.exe
  C:\Windows\System\EAzpzUW.exe
  2⤵
  PID:8128
- C:\Windows\System\zcqFzGx.exe
  C:\Windows\System\zcqFzGx.exe
  2⤵
  PID:7432
- C:\Windows\System\qUTaqxj.exe
  C:\Windows\System\qUTaqxj.exe
  2⤵
  PID:8208
- C:\Windows\System\AqScIbf.exe
  C:\Windows\System\AqScIbf.exe
  2⤵
  PID:8600
- C:\Windows\System\SOyJwve.exe
  C:\Windows\System\SOyJwve.exe
  2⤵
  PID:8616
- C:\Windows\System\BHhDCWK.exe
  C:\Windows\System\BHhDCWK.exe
  2⤵
  PID:8632
- C:\Windows\System\HDjxyHh.exe
  C:\Windows\System\HDjxyHh.exe
  2⤵
  PID:8696
- C:\Windows\System\khABjJY.exe
  C:\Windows\System\khABjJY.exe
  2⤵
  PID:8828
- C:\Windows\System\BKLxOTh.exe
  C:\Windows\System\BKLxOTh.exe
  2⤵
  PID:8880
- C:\Windows\System\kgkUxkp.exe
  C:\Windows\System\kgkUxkp.exe
  2⤵
  PID:8936
- C:\Windows\System\aWwkLis.exe
  C:\Windows\System\aWwkLis.exe
  2⤵
  PID:8964
- C:\Windows\System\txIsIPv.exe
  C:\Windows\System\txIsIPv.exe
  2⤵
  PID:8980
- C:\Windows\System\oKtXFCC.exe
  C:\Windows\System\oKtXFCC.exe
  2⤵
  PID:8996
- C:\Windows\System\mvFnGgt.exe
  C:\Windows\System\mvFnGgt.exe
  2⤵
  PID:9012
- C:\Windows\System\zreocJN.exe
  C:\Windows\System\zreocJN.exe
  2⤵
  PID:9028
- C:\Windows\System\rAVHtat.exe
  C:\Windows\System\rAVHtat.exe
  2⤵
  PID:9044
- C:\Windows\System\kxWWxyz.exe
  C:\Windows\System\kxWWxyz.exe
  2⤵
  PID:9064
- C:\Windows\System\ObdkgeG.exe
  C:\Windows\System\ObdkgeG.exe
  2⤵
  PID:9088
- C:\Windows\System\BeoFkwZ.exe
  C:\Windows\System\BeoFkwZ.exe
  2⤵
  PID:9104
- C:\Windows\System\aCGuBaB.exe
  C:\Windows\System\aCGuBaB.exe
  2⤵
  PID:9120
- C:\Windows\System\AIghVnX.exe
  C:\Windows\System\AIghVnX.exe
  2⤵
  PID:9136
- C:\Windows\System\NEBZXnT.exe
  C:\Windows\System\NEBZXnT.exe
  2⤵
  PID:9152
- C:\Windows\System\mnNkwZp.exe
  C:\Windows\System\mnNkwZp.exe
  2⤵
  PID:7476
- C:\Windows\System\veURodE.exe
  C:\Windows\System\veURodE.exe
  2⤵
  PID:1584
- C:\Windows\System\zcHkfHm.exe
  C:\Windows\System\zcHkfHm.exe
  2⤵
  PID:8200
- C:\Windows\System\ceQkIsy.exe
  C:\Windows\System\ceQkIsy.exe
  2⤵
  PID:8016
- C:\Windows\System\rvWWyPT.exe
  C:\Windows\System\rvWWyPT.exe
  2⤵
  PID:8216
- C:\Windows\System\jARHzrJ.exe
  C:\Windows\System\jARHzrJ.exe
  2⤵
  PID:8020
- C:\Windows\System\TCZVlzA.exe
  C:\Windows\System\TCZVlzA.exe
  2⤵
  PID:8240
- C:\Windows\System\ZTRuBHu.exe
  C:\Windows\System\ZTRuBHu.exe
  2⤵
  PID:8260
- C:\Windows\System\xJYunZq.exe
  C:\Windows\System\xJYunZq.exe
  2⤵
  PID:8276
- C:\Windows\System\qWdTSLd.exe
  C:\Windows\System\qWdTSLd.exe
  2⤵
  PID:8292
- C:\Windows\System\jIZNQBN.exe
  C:\Windows\System\jIZNQBN.exe
  2⤵
  PID:8308
- C:\Windows\System\dbEUxGZ.exe
  C:\Windows\System\dbEUxGZ.exe
  2⤵
  PID:8324
- C:\Windows\System\HFghOdg.exe
  C:\Windows\System\HFghOdg.exe
  2⤵
  PID:8340
- C:\Windows\System\mmTngIk.exe
  C:\Windows\System\mmTngIk.exe
  2⤵
  PID:8356
- C:\Windows\System\JxcQWMN.exe
  C:\Windows\System\JxcQWMN.exe
  2⤵
  PID:8444
- C:\Windows\System\lQxPgfS.exe
  C:\Windows\System\lQxPgfS.exe
  2⤵
  PID:8460
- C:\Windows\System\nkyZyPM.exe
  C:\Windows\System\nkyZyPM.exe
  2⤵
  PID:8476
- C:\Windows\System\mlAYwiv.exe
  C:\Windows\System\mlAYwiv.exe
  2⤵
  PID:8552
- C:\Windows\System\OfiXFgT.exe
  C:\Windows\System\OfiXFgT.exe
  2⤵
  PID:8556
- C:\Windows\System\aPpuLIk.exe
  C:\Windows\System\aPpuLIk.exe
  2⤵
  PID:8592
- C:\Windows\System\WgODJKw.exe
  C:\Windows\System\WgODJKw.exe
  2⤵
  PID:8536
- C:\Windows\System\pewbSeq.exe
  C:\Windows\System\pewbSeq.exe
  2⤵
  PID:8560
- C:\Windows\System\vqnBzcf.exe
  C:\Windows\System\vqnBzcf.exe
  2⤵
  PID:8576
- C:\Windows\System\aYymOne.exe
  C:\Windows\System\aYymOne.exe
  2⤵
  PID:8596
- C:\Windows\System\dLsUFJm.exe
  C:\Windows\System\dLsUFJm.exe
  2⤵
  PID:8608
- C:\Windows\System\RvwJhiL.exe
  C:\Windows\System\RvwJhiL.exe
  2⤵
  PID:8664
- C:\Windows\System\aPVqPWZ.exe
  C:\Windows\System\aPVqPWZ.exe
  2⤵
  PID:8848
- C:\Windows\System\eMdeksG.exe
  C:\Windows\System\eMdeksG.exe
  2⤵
  PID:8864
- C:\Windows\System\HjpXouM.exe
  C:\Windows\System\HjpXouM.exe
  2⤵
  PID:8944
- C:\Windows\System\HcPOLsg.exe
  C:\Windows\System\HcPOLsg.exe
  2⤵
  PID:8960
- C:\Windows\System\mURnONX.exe
  C:\Windows\System\mURnONX.exe
  2⤵
  PID:9052
- C:\Windows\System\wZpXPza.exe
  C:\Windows\System\wZpXPza.exe
  2⤵
  PID:9100
- C:\Windows\System\HUIzrQi.exe
  C:\Windows\System\HUIzrQi.exe
  2⤵
  PID:9168
- C:\Windows\System\oLzGsqf.exe
  C:\Windows\System\oLzGsqf.exe
  2⤵
  PID:9184
- C:\Windows\System\TRdLYdW.exe
  C:\Windows\System\TRdLYdW.exe
  2⤵
  PID:8760
- C:\Windows\System\fgkSPmM.exe
  C:\Windows\System\fgkSPmM.exe
  2⤵
  PID:9008
- C:\Windows\System\NcNNyhG.exe
  C:\Windows\System\NcNNyhG.exe
  2⤵
  PID:8812
- C:\Windows\System\qdupGao.exe
  C:\Windows\System\qdupGao.exe
  2⤵
  PID:8708
- C:\Windows\System\hZykWzS.exe
  C:\Windows\System\hZykWzS.exe
  2⤵
  PID:8724
- C:\Windows\System\cDrXQYa.exe
  C:\Windows\System\cDrXQYa.exe
  2⤵
  PID:8744
- C:\Windows\System\Nauymmx.exe
  C:\Windows\System\Nauymmx.exe
  2⤵
  PID:8768
- C:\Windows\System\xzmdwUn.exe
  C:\Windows\System\xzmdwUn.exe
  2⤵
  PID:8788
- C:\Windows\System\yzrWaWU.exe
  C:\Windows\System\yzrWaWU.exe
  2⤵
  PID:8816
- C:\Windows\System\McOlwGV.exe
  C:\Windows\System\McOlwGV.exe
  2⤵
  PID:8904
- C:\Windows\System\FPbuFgd.exe
  C:\Windows\System\FPbuFgd.exe
  2⤵
  PID:8920
- C:\Windows\System\AoiHvyA.exe
  C:\Windows\System\AoiHvyA.exe
  2⤵
  PID:8972
- C:\Windows\System\eOodTuf.exe
  C:\Windows\System\eOodTuf.exe
  2⤵
  PID:9040
- C:\Windows\System\AeTqAfo.exe
  C:\Windows\System\AeTqAfo.exe
  2⤵
  PID:7400
- C:\Windows\System\OLMyacf.exe
  C:\Windows\System\OLMyacf.exe
  2⤵
  PID:7720
- C:\Windows\System\BmgmtJC.exe
  C:\Windows\System\BmgmtJC.exe
  2⤵
  PID:7416
- C:\Windows\System\RrpMBMr.exe
  C:\Windows\System\RrpMBMr.exe
  2⤵
  PID:8300
- C:\Windows\System\epmpAUd.exe
  C:\Windows\System\epmpAUd.exe
  2⤵
  PID:8252
- C:\Windows\System\gemAKlS.exe
  C:\Windows\System\gemAKlS.exe
  2⤵
  PID:8288
- C:\Windows\System\zPVAEYD.exe
  C:\Windows\System\zPVAEYD.exe
  2⤵
  PID:8372
- C:\Windows\System\sFclUcb.exe
  C:\Windows\System\sFclUcb.exe
  2⤵
  PID:8388
- C:\Windows\System\egDZFPB.exe
  C:\Windows\System\egDZFPB.exe
  2⤵
  PID:8404
- C:\Windows\System\yRAXpWN.exe
  C:\Windows\System\yRAXpWN.exe
  2⤵
  PID:8420
- C:\Windows\System\lScJkvH.exe
  C:\Windows\System\lScJkvH.exe
  2⤵
  PID:8488
- C:\Windows\System\zVaZfqJ.exe
  C:\Windows\System\zVaZfqJ.exe
  2⤵
  PID:8436
- C:\Windows\System\pkmhAGc.exe
  C:\Windows\System\pkmhAGc.exe
  2⤵
  PID:8548
- C:\Windows\System\nhTGSMi.exe
  C:\Windows\System\nhTGSMi.exe
  2⤵
  PID:8568
- C:\Windows\System\NdAAvcc.exe
  C:\Windows\System\NdAAvcc.exe
  2⤵
  PID:8668
- C:\Windows\System\nEIDrob.exe
  C:\Windows\System\nEIDrob.exe
  2⤵
  PID:8684
- C:\Windows\System\fYBHxQs.exe
  C:\Windows\System\fYBHxQs.exe
  2⤵
  PID:8468
- C:\Windows\System\YhNlwCR.exe
  C:\Windows\System\YhNlwCR.exe
  2⤵
  PID:8876
- C:\Windows\System\rubzSTM.exe
  C:\Windows\System\rubzSTM.exe
  2⤵
  PID:8644
- C:\Windows\System\ahWGUIh.exe
  C:\Windows\System\ahWGUIh.exe
  2⤵
  PID:8704
- C:\Windows\System\tzAGCKZ.exe
  C:\Windows\System\tzAGCKZ.exe
  2⤵
  PID:8720
- C:\Windows\System\AikDIzq.exe
  C:\Windows\System\AikDIzq.exe
  2⤵
  PID:8808
- C:\Windows\System\KNjBhHX.exe
  C:\Windows\System\KNjBhHX.exe
  2⤵
  PID:9036
- C:\Windows\System\XSAONjY.exe
  C:\Windows\System\XSAONjY.exe
  2⤵
  PID:8588
- C:\Windows\System\RLuuYwP.exe
  C:\Windows\System\RLuuYwP.exe
  2⤵
  PID:8516
- C:\Windows\System\HfoIjJt.exe
  C:\Windows\System\HfoIjJt.exe
  2⤵
  PID:8648
- C:\Windows\System\lWmafpp.exe
  C:\Windows\System\lWmafpp.exe
  2⤵
  PID:8952
- C:\Windows\System\NxAApVS.exe
  C:\Windows\System\NxAApVS.exe
  2⤵
  PID:9076
- C:\Windows\System\ZNETZFS.exe
  C:\Windows\System\ZNETZFS.exe
  2⤵
  PID:9148
- C:\Windows\System\qtquWBG.exe
  C:\Windows\System\qtquWBG.exe
  2⤵
  PID:9164
- C:\Windows\System\SoszKMY.exe
  C:\Windows\System\SoszKMY.exe
  2⤵
  PID:8072
- C:\Windows\System\FmAtKFW.exe
  C:\Windows\System\FmAtKFW.exe
  2⤵
  PID:8224
- C:\Windows\System\ZUGEnrt.exe
  C:\Windows\System\ZUGEnrt.exe
  2⤵
  PID:8272
- C:\Windows\System\ySXMXuC.exe
  C:\Windows\System\ySXMXuC.exe
  2⤵
  PID:8352
- C:\Windows\System\TqIevvI.exe
  C:\Windows\System\TqIevvI.exe
  2⤵
  PID:8452
- C:\Windows\System\NCJKzrT.exe
  C:\Windows\System\NCJKzrT.exe
  2⤵
  PID:8384
- C:\Windows\System\ghJETFA.exe
  C:\Windows\System\ghJETFA.exe
  2⤵
  PID:8584
- C:\Windows\System\aLkSjJP.exe
  C:\Windows\System\aLkSjJP.exe
  2⤵
  PID:9020
- C:\Windows\System\zdUthOX.exe
  C:\Windows\System\zdUthOX.exe
  2⤵
  PID:8532
- C:\Windows\System\doLLVaN.exe
  C:\Windows\System\doLLVaN.exe
  2⤵
  PID:8484
- C:\Windows\System\UJFsUDs.exe
  C:\Windows\System\UJFsUDs.exe
  2⤵
  PID:9192
- C:\Windows\System\TILfOTs.exe
  C:\Windows\System\TILfOTs.exe
  2⤵
  PID:8892
- C:\Windows\System\coTLLej.exe
  C:\Windows\System\coTLLej.exe
  2⤵
  PID:8772
- C:\Windows\System\qTZzSRg.exe
  C:\Windows\System\qTZzSRg.exe
  2⤵
  PID:7964
- C:\Windows\System\zoOxHnZ.exe
  C:\Windows\System\zoOxHnZ.exe
  2⤵
  PID:8320
- C:\Windows\System\VKlKLos.exe
  C:\Windows\System\VKlKLos.exe
  2⤵
  PID:8652
- C:\Windows\System\FSKFJTG.exe
  C:\Windows\System\FSKFJTG.exe
  2⤵
  PID:8872
- C:\Windows\System\JEPlZrC.exe
  C:\Windows\System\JEPlZrC.exe
  2⤵
  PID:8656
- C:\Windows\System\TXZsjDz.exe
  C:\Windows\System\TXZsjDz.exe
  2⤵
  PID:8780
- C:\Windows\System\eYzSJvn.exe
  C:\Windows\System\eYzSJvn.exe
  2⤵
  PID:8860
- C:\Windows\System\sHolihT.exe
  C:\Windows\System\sHolihT.exe
  2⤵
  PID:9144
- C:\Windows\System\QOSEFXg.exe
  C:\Windows\System\QOSEFXg.exe
  2⤵
  PID:8400
- C:\Windows\System\QhTpGBi.exe
  C:\Windows\System\QhTpGBi.exe
  2⤵
  PID:8528
- C:\Windows\System\jZgILQT.exe
  C:\Windows\System\jZgILQT.exe
  2⤵
  PID:8928
- C:\Windows\System\OkfOKRG.exe
  C:\Windows\System\OkfOKRG.exe
  2⤵
  PID:8856
- C:\Windows\System\zIdUNrA.exe
  C:\Windows\System\zIdUNrA.exe
  2⤵
  PID:8412
- C:\Windows\System\HbKKrJN.exe
  C:\Windows\System\HbKKrJN.exe
  2⤵
  PID:8380
- C:\Windows\System\aIioyqy.exe
  C:\Windows\System\aIioyqy.exe
  2⤵
  PID:9116
- C:\Windows\System\POOqpeB.exe
  C:\Windows\System\POOqpeB.exe
  2⤵
  PID:8896
- C:\Windows\System\xmxLBFF.exe
  C:\Windows\System\xmxLBFF.exe
  2⤵
  PID:9220
- C:\Windows\System\eYqgzIA.exe
  C:\Windows\System\eYqgzIA.exe
  2⤵
  PID:9240
- C:\Windows\System\okMwehu.exe
  C:\Windows\System\okMwehu.exe
  2⤵
  PID:9256
- C:\Windows\System\ydlXJei.exe
  C:\Windows\System\ydlXJei.exe
  2⤵
  PID:9272
- C:\Windows\System\aoiagAC.exe
  C:\Windows\System\aoiagAC.exe
  2⤵
  PID:9288
- C:\Windows\System\AcDgSVr.exe
  C:\Windows\System\AcDgSVr.exe
  2⤵
  PID:9304
- C:\Windows\System\qPkDuhF.exe
  C:\Windows\System\qPkDuhF.exe
  2⤵
  PID:9320
- C:\Windows\System\qfWptAq.exe
  C:\Windows\System\qfWptAq.exe
  2⤵
  PID:9336
- C:\Windows\System\zGOPXzt.exe
  C:\Windows\System\zGOPXzt.exe
  2⤵
  PID:9352
- C:\Windows\System\snpUIMk.exe
  C:\Windows\System\snpUIMk.exe
  2⤵
  PID:9368
- C:\Windows\System\rMIuLfO.exe
  C:\Windows\System\rMIuLfO.exe
  2⤵
  PID:9388
- C:\Windows\System\vTJVcHw.exe
  C:\Windows\System\vTJVcHw.exe
  2⤵
  PID:9404
- C:\Windows\System\EaAiqFC.exe
  C:\Windows\System\EaAiqFC.exe
  2⤵
  PID:9420
- C:\Windows\System\nAToXvG.exe
  C:\Windows\System\nAToXvG.exe
  2⤵
  PID:9436
- C:\Windows\System\MyInmge.exe
  C:\Windows\System\MyInmge.exe
  2⤵
  PID:9452
- C:\Windows\System\mxElFLV.exe
  C:\Windows\System\mxElFLV.exe
  2⤵
  PID:9468
- C:\Windows\System\HzlcAbA.exe
  C:\Windows\System\HzlcAbA.exe
  2⤵
  PID:9484
- C:\Windows\System\kHYYKlw.exe
  C:\Windows\System\kHYYKlw.exe
  2⤵
  PID:9500
- C:\Windows\System\Ndaqjop.exe
  C:\Windows\System\Ndaqjop.exe
  2⤵
  PID:9516
- C:\Windows\System\mDInAfs.exe
  C:\Windows\System\mDInAfs.exe
  2⤵
  PID:9532
- C:\Windows\System\ihcyjBl.exe
  C:\Windows\System\ihcyjBl.exe
  2⤵
  PID:9548
- C:\Windows\System\XYsuKPm.exe
  C:\Windows\System\XYsuKPm.exe
  2⤵
  PID:9564
- C:\Windows\System\zjrOAQm.exe
  C:\Windows\System\zjrOAQm.exe
  2⤵
  PID:9580
- C:\Windows\System\DeDwdow.exe
  C:\Windows\System\DeDwdow.exe
  2⤵
  PID:9596
- C:\Windows\System\CNtrFme.exe
  C:\Windows\System\CNtrFme.exe
  2⤵
  PID:9612
- C:\Windows\System\ioVbtXD.exe
  C:\Windows\System\ioVbtXD.exe
  2⤵
  PID:9628
- C:\Windows\System\spQxzKM.exe
  C:\Windows\System\spQxzKM.exe
  2⤵
  PID:9644
- C:\Windows\System\DFfrbIh.exe
  C:\Windows\System\DFfrbIh.exe
  2⤵
  PID:9660
- C:\Windows\System\jLDRWbQ.exe
  C:\Windows\System\jLDRWbQ.exe
  2⤵
  PID:9676
- C:\Windows\System\qaeZkBI.exe
  C:\Windows\System\qaeZkBI.exe
  2⤵
  PID:9692
- C:\Windows\System\yJyWPes.exe
  C:\Windows\System\yJyWPes.exe
  2⤵
  PID:9708
- C:\Windows\System\NYXLvaE.exe
  C:\Windows\System\NYXLvaE.exe
  2⤵
  PID:9728
- C:\Windows\System\hpGjyCI.exe
  C:\Windows\System\hpGjyCI.exe
  2⤵
  PID:9744
- C:\Windows\System\jcVkzjG.exe
  C:\Windows\System\jcVkzjG.exe
  2⤵
  PID:9760
- C:\Windows\System\FnptvpC.exe
  C:\Windows\System\FnptvpC.exe
  2⤵
  PID:9776
- C:\Windows\System\rAcXFUn.exe
  C:\Windows\System\rAcXFUn.exe
  2⤵
  PID:9796
- C:\Windows\System\EENccds.exe
  C:\Windows\System\EENccds.exe
  2⤵
  PID:9812
- C:\Windows\System\KACUXrI.exe
  C:\Windows\System\KACUXrI.exe
  2⤵
  PID:9828
- C:\Windows\System\vXCTFKo.exe
  C:\Windows\System\vXCTFKo.exe
  2⤵
  PID:9844
- C:\Windows\System\gAnKgQU.exe
  C:\Windows\System\gAnKgQU.exe
  2⤵
  PID:9860
- C:\Windows\System\GhPNkCb.exe
  C:\Windows\System\GhPNkCb.exe
  2⤵
  PID:9876
- C:\Windows\System\yYmFDuX.exe
  C:\Windows\System\yYmFDuX.exe
  2⤵
  PID:9892
- C:\Windows\System\qTvLOGN.exe
  C:\Windows\System\qTvLOGN.exe
  2⤵
  PID:9924
- C:\Windows\System\oXTzjcQ.exe
  C:\Windows\System\oXTzjcQ.exe
  2⤵
  PID:9940
- C:\Windows\System\rAwmNGC.exe
  C:\Windows\System\rAwmNGC.exe
  2⤵
  PID:9956
- C:\Windows\System\EVjDqIQ.exe
  C:\Windows\System\EVjDqIQ.exe
  2⤵
  PID:9972
- C:\Windows\System\TlQKOhP.exe
  C:\Windows\System\TlQKOhP.exe
  2⤵
  PID:9988
- C:\Windows\System\HSnybKJ.exe
  C:\Windows\System\HSnybKJ.exe
  2⤵
  PID:10004
- C:\Windows\System\bTHINFX.exe
  C:\Windows\System\bTHINFX.exe
  2⤵
  PID:10020
- C:\Windows\System\AxQbruf.exe
  C:\Windows\System\AxQbruf.exe
  2⤵
  PID:10040
- C:\Windows\System\rSXGwhv.exe
  C:\Windows\System\rSXGwhv.exe
  2⤵
  PID:10056
- C:\Windows\System\ULHLKyw.exe
  C:\Windows\System\ULHLKyw.exe
  2⤵
  PID:10072
- C:\Windows\System\napWaBX.exe
  C:\Windows\System\napWaBX.exe
  2⤵
  PID:10092
- C:\Windows\System\ogjQest.exe
  C:\Windows\System\ogjQest.exe
  2⤵
  PID:10108
- C:\Windows\System\HHBFibQ.exe
  C:\Windows\System\HHBFibQ.exe
  2⤵
  PID:10128
- C:\Windows\System\HYOXbzO.exe
  C:\Windows\System\HYOXbzO.exe
  2⤵
  PID:10144
- C:\Windows\System\beGyBRG.exe
  C:\Windows\System\beGyBRG.exe
  2⤵
  PID:10160
- C:\Windows\System\IoePGYb.exe
  C:\Windows\System\IoePGYb.exe
  2⤵
  PID:10180
- C:\Windows\System\hjAVZPT.exe
  C:\Windows\System\hjAVZPT.exe
  2⤵
  PID:10196
- C:\Windows\System\kavOWIw.exe
  C:\Windows\System\kavOWIw.exe
  2⤵
  PID:10212
- C:\Windows\System\loBeBro.exe
  C:\Windows\System\loBeBro.exe
  2⤵
  PID:10228
- C:\Windows\System\jxHeync.exe
  C:\Windows\System\jxHeync.exe
  2⤵
  PID:8804
- C:\Windows\System\sRyGSkH.exe
  C:\Windows\System\sRyGSkH.exe
  2⤵
  PID:8236
- C:\Windows\System\kGbePiV.exe
  C:\Windows\System\kGbePiV.exe
  2⤵
  PID:8800
- C:\Windows\System\SgaBwFk.exe
  C:\Windows\System\SgaBwFk.exe
  2⤵
  PID:9268
- C:\Windows\System\mVnsMtR.exe
  C:\Windows\System\mVnsMtR.exe
  2⤵
  PID:9296
- C:\Windows\System\qSSoZWd.exe
  C:\Windows\System\qSSoZWd.exe
  2⤵
  PID:9248
- C:\Windows\System\mRmGYzs.exe
  C:\Windows\System\mRmGYzs.exe
  2⤵
  PID:9380
- C:\Windows\System\ZWlKaqU.exe
  C:\Windows\System\ZWlKaqU.exe
  2⤵
  PID:9444
- C:\Windows\System\aUWPvFi.exe
  C:\Windows\System\aUWPvFi.exe
  2⤵
  PID:9508
- C:\Windows\System\YyvwRQE.exe
  C:\Windows\System\YyvwRQE.exe
  2⤵
  PID:9572
- C:\Windows\System\KRgiDGC.exe
  C:\Windows\System\KRgiDGC.exe
  2⤵
  PID:9636
- C:\Windows\System\SANSAnP.exe
  C:\Windows\System\SANSAnP.exe
  2⤵
  PID:9004
- C:\Windows\System\xSJFheO.exe
  C:\Windows\System\xSJFheO.exe
  2⤵
  PID:9328
- C:\Windows\System\JOPaBce.exe
  C:\Windows\System\JOPaBce.exe
  2⤵
  PID:9740
- C:\Windows\System\QTLJkzu.exe
  C:\Windows\System\QTLJkzu.exe
  2⤵
  PID:9524
- C:\Windows\System\sINUgNd.exe
  C:\Windows\System\sINUgNd.exe
  2⤵
  PID:9432
- C:\Windows\System\hoyGRkw.exe
  C:\Windows\System\hoyGRkw.exe
  2⤵
  PID:9804
- C:\Windows\System\DKTGzfM.exe
  C:\Windows\System\DKTGzfM.exe
  2⤵
  PID:9756
- C:\Windows\System\zhZYEWU.exe
  C:\Windows\System\zhZYEWU.exe
  2⤵
  PID:9836
- C:\Windows\System\OxnzlaX.exe
  C:\Windows\System\OxnzlaX.exe
  2⤵
  PID:8916
- C:\Windows\System\TrCYdAP.exe
  C:\Windows\System\TrCYdAP.exe
  2⤵
  PID:9792
- C:\Windows\System\CSpPALj.exe
  C:\Windows\System\CSpPALj.exe
  2⤵
  PID:9824
- C:\Windows\System\wbLSRUE.exe
  C:\Windows\System\wbLSRUE.exe
  2⤵
  PID:9888
- C:\Windows\System\UXFIhgW.exe
  C:\Windows\System\UXFIhgW.exe
  2⤵
  PID:9908
- C:\Windows\System\NWhwkOR.exe
  C:\Windows\System\NWhwkOR.exe
  2⤵
  PID:9964
- C:\Windows\System\FjELriY.exe
  C:\Windows\System\FjELriY.exe
  2⤵
  PID:10032
- C:\Windows\System\SkHLrUN.exe
  C:\Windows\System\SkHLrUN.exe
  2⤵
  PID:9980
- C:\Windows\System\IYNRlNi.exe
  C:\Windows\System\IYNRlNi.exe
  2⤵
  PID:10048
- C:\Windows\System\yDeSvHM.exe
  C:\Windows\System\yDeSvHM.exe
  2⤵
  PID:10052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BiGPTfv.exe

Filesize
1.9MB

MD5
0d395df9082eb46e20ac3f19a7d2e3a8

SHA1
42d41c4dddc77eca74e90b2a77999b94313d22b5

SHA256
c006691adffeda132af6a16a9b17ff010a3986bbd086fff1a1dbfc432a6474da

SHA512
a52242aabc86a3b39dab83c590efe133da3a8e3e89f93478a0f2059befe43901882f46ecf31274a06bfd99e02df367b0094d6215db8a16a4d0d24384fb1afcdd

Download Submit
C:\Windows\system\IwbfXid.exe

Filesize
1.9MB

MD5
d8afebbfa5d112b065656413a1796e88

SHA1
45dc2a732fc4767078dd5b2d8fcb21d2cd508dee

SHA256
978229514d29367b518e77a9023f218862e37e583c0d24acc7d5f046fbe334ad

SHA512
eb6881e9f4ed55ca68fd24d287c10b24c7fe23d9e5684287d54d001c7f284e6cbfca365cc9f8a386261fac012107e4d06d99c339522a5baf68a768af81c43f70

Download Submit
C:\Windows\system\Lhdfnma.exe

Filesize
1.9MB

MD5
d5ff158b0f5a7329685cdae4b47e2c77

SHA1
0eb5201a990c067da577546b4cb321ef9b7ac2e8

SHA256
77193e68e6c98d1d71a0e83fcbf8c4b9e7c28e0acabdf5b828d789fe0af0fe3d

SHA512
0ef25b1875ff06cadd76cf82e666e988bcbc70e9dac1f653ac2c6faca1262a2346951b6f5373dbe044ba830d17cd0f78a38d123f3fa95ce8fd1c74fd6c642131

Download Submit
C:\Windows\system\OLBeVwD.exe

Filesize
1.9MB

MD5
7e48eafb217f58a13ae442faea288c6e

SHA1
3c25820750a0f608e6f39b2a29c7f45195859a7d

SHA256
8d51afe977558be728c243a07239ff06dd99f5bb057e947138a28363e1ddf31b

SHA512
528eadb10814292957a3c45e0e0852704ed475e0af48d837a1b51cce98f446f2bdae84b9dffc6bdf25ad9762977f19b48dc7b5304ca0b0448b7936b3cfd705ec

Download Submit
C:\Windows\system\QFyoOzB.exe

Filesize
1.9MB

MD5
60fdd9d912ab7c54d94e9e27536d5c4c

SHA1
5111220ab9080b2dad82b4b8e2dc91075fd090d2

SHA256
fe2107eece7cade352f0de65c748cac835286d10e58e464e0df9eb376f52554b

SHA512
230fdb34cab13d081fd51d007e81d495800dc53fa57117ed3c3f324de6b08cc6d96d35506c7fb0f9a51b700569e774b093dca322a902d713da14cf33bc1bd607

Download Submit
C:\Windows\system\QMPJLQM.exe

Filesize
1.9MB

MD5
05c42446be4c24d67a7240e6c9230d44

SHA1
a0ca34c7b56bf03093f96134fc56395f2544f124

SHA256
94a2ab3c906ef5f7685a1adb912e07ebfb1bc485ab9489becf560555618ac4a0

SHA512
88230434864fdefd0b786965374f74cf0bba1e2c0cf900be63a47249f096708bd130dbec2eb9643bae147b77597a259afd3e9f41af6e7bf971572063e1fcff7a

Download Submit
C:\Windows\system\SeKZRAx.exe

Filesize
1.9MB

MD5
d3bced065773ed8062978130e74f4f8f

SHA1
5ad53c0c551460818bddcd1042c63fab3207b860

SHA256
4d311bb9946e4ceba13ac4c097f5ac8a07ec663904e7cbaef5389e06983b9e5d

SHA512
00aa2de9e48a88b234cb25d2bc6da78e9725b16b3ea3a78bb2091907e2d50020e64dc579311a42b1fd617f6ba7ad3a589272e1c9c2589b8f78a622dade46d6db

Download Submit
C:\Windows\system\eDpdeQr.exe

Filesize
1.9MB

MD5
ca948936c1da9a6bd3799c6e34bcf3d9

SHA1
c72d2e0fcc06583adbb952af1871fb0440427972

SHA256
30753e0967ec4e8ffd570519d5f702c0eaf565b33cd2d3e19b79670441dcf8d5

SHA512
c79a37e562b61c9033d727a7fc234d94b71102fc663a1673ca99dce7d10c779e067b817a5fce5a4a27966f2ffcb0634269cfbab0c2e5cceafc3a3eeda96ad40d

Download Submit
C:\Windows\system\hOXxtba.exe

Filesize
1.9MB

MD5
360e543d3be92dcd5fb5b5614873b65e

SHA1
220167be41378d1684321998e367980e205965db

SHA256
ca92a804993005f820de3825b71f3ab836f0cc5757ec366f28c9c3869b806f35

SHA512
16ffa52d67db6e141b58ebee7447a347f5b200c4c94c0dd42ca23c6205f1076b55ac411c30c5a14fac13bb49b48d12d922a152c20b65e79d5703e74c213c839e

Download Submit
C:\Windows\system\ifQxIvw.exe

Filesize
1.9MB

MD5
c355d2fdfa45798e552b0c919852ee25

SHA1
31332debf3597c9356b353f29005daf27eff1083

SHA256
aef66313e6265cd57f9b84ac5f8bf4d88d3195aa886db8f46e90f75df67df97c

SHA512
392ebf6bf1be54696aedb0852b2febdec8c74d9e6cc3f90738550717d20cb027595b2030305cdd9946b8c0002efc2c9249c795ecc285eaacd37f68cc025a52e6

Download Submit
C:\Windows\system\jSfZYGM.exe

Filesize
1.9MB

MD5
1f457aa3b3d60ff1cf740a3c8e3883f7

SHA1
d2da34aeef4ea3eaaa19d464a1e8d5948a06a5d8

SHA256
f45f40bdac8f29829c399fb992cfa60dcf6d96dc34bf8639c4011234196cd04b

SHA512
c69282d326520e59327e2c71f67eba21d7d724ec81b26337baa661d3ec13f9cdbdbdd843c3b2c26984d140406b7325dc93fd9203632956ff6adb92f05edaa90f

Download Submit
C:\Windows\system\oojYhxq.exe

Filesize
1.9MB

MD5
bf481cbf786f563e7216c2fec4b7e762

SHA1
cb91366d45abdb16ebe08f12d89321c6d18856a2

SHA256
471121a9fc68de858feea9919e7c296dd5d482b97112bc0c6062b322393344f8

SHA512
0c418272459fef81c02e04a03405abe862f63fb57b8c7927bdc794edb0ab1e2dc591ca77fb1624a56c9fb194a44e3dd182945a962868b938b89c4bd62703dbd7

Download Submit
C:\Windows\system\qolkerG.exe

Filesize
1.9MB

MD5
1c359beb3eec81f8fe59773c8df66fbe

SHA1
b459a256d30ab88ad32afbb550611c2649da532e

SHA256
d6c68753a20a0ad542ab648af762f72f70bded54899c15d231d9ed655f3647fe

SHA512
098b7946a491bb4fff33ab974e7c04a0d7015e88159219321dfa8ea2a7352316464609a585fcf3c9fdfdfc7f81ed280c38acdf65aa5df618410c2fcc486a790d

Download Submit
C:\Windows\system\rlxUNbm.exe

Filesize
1.9MB

MD5
8596f2f5b0d72d65f91b45d3a5ca8871

SHA1
c2fbba9c395c879956e3aa64adc1983800aa13ad

SHA256
a67a3c675df0e6c9726f84bee675b93410fa5b077a8763d82e175cdd8c0711df

SHA512
899ba28744000ed307b1d32fe8d6d0b90373143d6577d605254b10358a1ad6a3117c1ff99b58084d89f2a48296cd157c4613c787809dfbe94e8243d096cd6907

Download Submit
C:\Windows\system\rzqyMgm.exe

Filesize
1.9MB

MD5
53dc2f6ff89be292ab92e9c5bc22807c

SHA1
e04c8abec771b16ddc9d844afca92d226e341872

SHA256
43046624a2505d4876d4d5096cb5e682fea5cf019203bf35e2b9a4d2e0525890

SHA512
ceb88467550fd9d7a8c7003d85b018b251b9208288a17aba9cdc550497d0d985d336ea525260c15b5c7040a9617127be8ebbb6713a2e81c1d345a80bf4d7981b

Download Submit
C:\Windows\system\sCbyUZQ.exe

Filesize
1.9MB

MD5
9601071f4a3d25ece81307586eec6b4c

SHA1
e6eac0fe533803ed8f6e65b4d0fcd73991822e41

SHA256
bab7cec9a224a0cdc857d4f203ff587af0088bd8c54a69ad27f5b56d8dc86f9b

SHA512
e830abf552746ae97d351df741023f7b905789dc21cfcd5eea45de24e1795a03a5d7fa4faf93060562a504035ed8751c9449f99ad5369799679d659b9b2ab5e2

Download Submit
C:\Windows\system\ujiqTPI.exe

Filesize
1.9MB

MD5
7b70f4f306617e64bbf49230781c80f1

SHA1
070bd00bc7585a9ccee46cf835cac20b7695e7ee

SHA256
a367ac0771445777d59bdc33c56efb25ab866764b711fd423474108dbb7ea071

SHA512
1f613ce59d8048d9f9fc7b321ce950e9511d42c1b39dfc5a4bb68ad385b0b54665856b86ed5b6d5430b2b09c1303e55f4df25c4855791c3a946d5d0dea53d5de

Download Submit
C:\Windows\system\vPYWajY.exe

Filesize
1.9MB

MD5
7880cd39fb7c9849f553211521152a5d

SHA1
84c20584a8ae4790020a986f1085e1e6fe4087d1

SHA256
6c3a0aa7a114aabeb61fbb47b176f2dfc87b653d34468eeda4045e2f5afc74b8

SHA512
1823d667b8682f241bcc5b422908063119a2123c2deaddc49a796fb5ace6f529e55e5cd15a02688a26ebccbfee523ae644d2c522ca1695b9cb899b13ee897257

Download Submit
C:\Windows\system\xHSjaRL.exe

Filesize
1.9MB

MD5
573594905b7272b73c38884de4ccc6e1

SHA1
420648e5cb1295d622647036e5762c4f19339506

SHA256
99d15d9942d0d69ddec65a8270fda51adc7a03189a58cb2cc10136c750601842

SHA512
660aea2e934b89f1b6dd3021205023283d0b5fb6e3527713d4d27944400110ce129e447bedfddd08fceed942183bd72583576854887f46a567f4188a13746765

Download Submit
C:\Windows\system\zrqsFZV.exe

Filesize
1.9MB

MD5
b836673bc9d66932b175a6999920eb3f

SHA1
56efa35865a5a57b458f9d4aa37b1d4008baafc6

SHA256
f7a15d8fd5cf5683df555e58f87675415df06db015dcd91d6ed3a44e503f33be

SHA512
fbf6e21859749b3377151714bd70b7c579e8ae15c0bfb975878a5133d98a2c3f2163426960ef06b28ba0972713d26759229f56be1b281e00b46cd4e4cb7071b8

Download Submit
\Windows\system\AePoqVl.exe

Filesize
1.9MB

MD5
a7f445ebe5a1343d1f78af638bd5105e

SHA1
8cf6f4dacf10a2f23aa2c6e2f299af461c0d95f1

SHA256
abef3763c85fbbb08ac5175b62865ea29b46f1c26d7167bcab803120c9066e0b

SHA512
6d2edc2ad265a6f076017d7928f95178b352bfc523b0535fdeaa05d3f511624413a8d1aff6cf7cbc7ed796c92c6e8bc2c90b7b9fd00fdba1f4847d9e9884a719

Download Submit
\Windows\system\BGIPwgh.exe

Filesize
1.9MB

MD5
c8b3b092715a488778f39ca2933d6957

SHA1
68c5333c3d4c0653dce3212632effd00ce776759

SHA256
0f9c632df1eb43d1489b01a99e919bd09c10a98305dffc3d254e7cd114c212cf

SHA512
a1ccb72ed189431cef3d2a589ba6ecb16d9e3d6298e14c22d393e5c43d9461572cd59f61e51121ac5a2e36ff326f2c76f099c51f13dbacfcb475fa031bd8bb42

Download Submit
\Windows\system\EEjpvtr.exe

Filesize
1.9MB

MD5
b9bfbbb5647db7f3227ca77bc4ee46fd

SHA1
26b13162be37b9560b2162142d78695521966c7f

SHA256
f351669a05dcccd7da63ad96b8ecdfeba678ae38164c26a69a70fc63bb3fb126

SHA512
506d58aea21a192756b5131d6cc83a80e6a7a0c6603effb7803f3f25aed75da5d44a1eb7d9bfcc2aec35a143cec5c6176e9724f25373a527f6514daf5b9ecf46

Download Submit
\Windows\system\IiuDFxy.exe

Filesize
1.9MB

MD5
fa318b8da05da107702f6caccf76b8be

SHA1
0e5e303d238e4cce397e2effdaa7a624dec6d9da

SHA256
6ceba5d178dd3d826231228c3f81d18809b6a2452fb473f0c2c47753d1707696

SHA512
e3e814849a5cec06b26b9a39bb341e7fdb47e8726f02c9a81a9d54ddc45f03088b35c5dd2fbea5199d9b9985637ffa2cfc0662882d4a1cee3b9d64c30a715c81

Download Submit
\Windows\system\NduyJGy.exe

Filesize
1.9MB

MD5
49eced3b5c4d9d46d85df6e6a32e9665

SHA1
82e1ea1f17b9ed416a4036a805b4b7dbb9214f2c

SHA256
e361747268dae8bafd2f04c4c24d1b4769b733780e458904d9acbee145ad2b5a

SHA512
e5091708692f0b98f0cb13c3b906504a931514a0e217e7d3fd9a0baa7ef89f45b98343d0b3f212784f21890960298c4361deda07deac03d5f988572449b39362

Download Submit
\Windows\system\ScAjnpf.exe

Filesize
1.9MB

MD5
93f510d4352813d68aa5f23f6726a1a6

SHA1
af791d927883678fb0b42390afb14ac478a2257b

SHA256
6b9d829808fe0f7f0fa17c03162e8521d3a922eccedca72afa8c1fb4cacf29b3

SHA512
a3fe55d1a2f8c15691ae26107c12e252de219cdb3de5c53b16c679bd747c96bd497eb6b0dff5a449a69f68431e5a3abc4cd3b5ce80b5af1def1413b79ee818e9

Download Submit
\Windows\system\UxvNerv.exe

Filesize
1.9MB

MD5
1ec351ce194de00c42dcca6f686bb24d

SHA1
463c737884c9444991e613f5d2c014c673814962

SHA256
c5e0016cd3908016a42e750eb8bb38aad9e6787e4dad90374d6945d500bb56c7

SHA512
5e76b1f30f84dbc2a0de24ca4607b243ded00a48a6c3ef37c7aad6a62295bd04cbb41357d0daabafb22740373c3b814fccab1933fc0dfd124416d7928969676a

Download Submit
\Windows\system\bveGGIG.exe

Filesize
1.9MB

MD5
0aa262b7e05075fe6f2a7a89dcbe055f

SHA1
0607e7f3eb198876ba25cbb054c13acf7602009e

SHA256
2a01b0790743c9a44a4b432728d2f9cb32ed2a24fa5ca9d510e49b34d89f06b4

SHA512
19cbc59f462f2d70015aaca0c189376df59eda2fd8397f94ea91b1bdc7e8cf26d850120a576020cf758a655f2b110c69b0b63b70c66d79a2f1cb72f3008a9677

Download Submit
\Windows\system\dxdrIki.exe

Filesize
1.9MB

MD5
99b2f9816bb834e1653af3a2c79a869f

SHA1
602e3843aeef2a2ec65a481b98efcf8baf2d7905

SHA256
0a15c3c1d9faad9b0eca3407f52e1367f177fb448d28c4cfab1b437d58e8bafb

SHA512
9976198276eb198fd0750131350d361879e1b88a00464bda297ac32d0b980fe4b3117442588214b82b543b11d6ecd75cc94a3afa38db9933ec39b8b422736167

Download Submit
\Windows\system\eFvHbDm.exe

Filesize
1.9MB

MD5
6e1da59263cf39579d0788ae50e92cf0

SHA1
16871583ba96a503c9e52694bd0602fc57152276

SHA256
0c54dc3d217d7336b5c1f957d0b98ef6a936631725a37bc30207129c013f014f

SHA512
f1640d73338025e2418b69bba2e39cf6999f5a87c5a8b51bf543ec048bb4293970d6a87ae6c526ead917ec8800bb52134d178fdcfe8625a5096fb8341b788791

Download Submit
\Windows\system\jpUfzDy.exe

Filesize
1.9MB

MD5
c4b86df752de27ab1fe737a3e6760c07

SHA1
b0fff7da3ef4270fd7f3a20b5be78c2407ee67d1

SHA256
9f6348001627706a5b72293886f3af30c4b93d5a2f2a03f062f841c4ffd0ffba

SHA512
def0ff649d7410391abe43093645611f3a67f5b3bb0d89ee5e9f1869b561904b4ca58ccf2cfc6b0c622a52931d3c540769cdf21635448a8a5a814cf330ede0e6

Download Submit
\Windows\system\kPWfSaR.exe

Filesize
1.9MB

MD5
62bb36018415ff26166e4d3429955f1d

SHA1
7a9f946df36f56dac58525a67be2fefa58713c57

SHA256
470e38bf62c8797f75255a1d8e2b616b4262ea91039cc349c6647d5a372b6df3

SHA512
ca84ada04d155bf3aa087902f4777e9061a71d0f331cfd0b5e07e24eccab9d32caf6abb377b7941a1881db79d9a641511de73756d8fa1cd54c9d547b2052553c

Download Submit
\Windows\system\nPCzaxZ.exe

Filesize
1.9MB

MD5
f939d2ae0a6fb611690b31ddf03e63f3

SHA1
378b36c807ea972631d5e09ec323bfb9566e3175

SHA256
0fe010e95942456dc67a17ea3e9e8f1ebadf9f2084ee4048f4f1237542eeb771

SHA512
40ee175e2d1955a364d4ce5884d00ffef48abe6c96644a86f8ca3f79b51bf0365e597e429b9c94335cffeec676f1cdcc619e52faa90ce1264c1e168086cf887e

Download Submit
\Windows\system\tCxYRLM.exe

Filesize
1.9MB

MD5
292a2de75d76ee818faf1314d88c989f

SHA1
a3844535f7afeeb067e0fb65346abca48ce67309

SHA256
121c5c009045b599eb10f00fd29dd4637a19e81049c98306b6892384bfa96546

SHA512
89440dbfec25114650c814e3ff2d936c897cc7e87caf36b75e2ef101b196d40aaf3ad500612488e1774f3f9c5f67c7b1eba7d5551d3bc76d48f8e8eb6e20eda1

Download Submit
\Windows\system\wYbzckG.exe

Filesize
1.9MB

MD5
24c7a89f92d3a15714c00e0dd7dbb2a2

SHA1
39bb14559d2e1fde62cb1766da8bfffbddea46ef

SHA256
9deed2d8c229484b0073cec188c3f6f2ec8f0fe28e0772a22294417304a88fe7

SHA512
ebcb5e1cb8f8961449fdeef87fb77e058a10ca9a8ae4945203c8819cce0453c0aef44927509488306581ee4d1fe495604cf93b0b2e994cd7bdd18eb779a3a592

Download Submit
\Windows\system\xmZAymO.exe

Filesize
1.9MB

MD5
833c1199e3f5df111cb3ec41deba24dd

SHA1
21b9979f758c7f91b58f97edb9d4c268e6074f94

SHA256
a705b0e5000929ffc4b34086ec30c4c47919aae831c0e43be0fd5b4bbbc6a2a4

SHA512
85ee099b9470c12b08ee320b683ef6b7c4857f568f2364f40d6635ba0775ebd1246b5de2078d2c0c8efdd6f9e15b5de555bb6e5ac3cc388a689da29b35d475aa

Download Submit
\Windows\system\yaXEBvR.exe

Filesize
1.9MB

MD5
bc079a0071a87983a1b8ea0c395ec1c1

SHA1
6b749d8e0fa5ba4362d9a63bcae5d47baed470c0

SHA256
7a4486bc627572157b7095b159038b95b47d7ff1119ccc7b7c0159b77cab7df4

SHA512
f8e5188189f1429dd0120660530933fe96fd25f89b53310449d14a608f7aa057c0b5b8e342f1bd84070a6e0beb854cc3a6dd55ed24218a78e3347101e8376922

Download Submit
\Windows\system\zwQchgk.exe

Filesize
1.9MB

MD5
b856dbe1bf305ce8ec4564e203dd8fcb

SHA1
fd649d92b6b9466ec626099df06dc96b9a64fa86

SHA256
76b6d01274097caf3bf3f9cb3f40f6ac6ea08f1135d43e7cbe3bbc62a10cb065

SHA512
55403f1f524c0b41cab35908c2166a518bcc8e83b7168f613601caa1688a72a17c55a57fac00df85e3f532c53f2f527bf3ddf8e7dc2011b180cdd1cfb010c271

Download Submit
memory/2200-97-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2340-98-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2456-234-0x0000000001F30000-0x0000000001F38000-memory.dmp

Filesize
32KB

Download
memory/2456-233-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/2460-80-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-16-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2460-107-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-106-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2460-78-0x0000000003040000-0x0000000003432000-memory.dmp

Filesize
3.9MB

Download
memory/2460-102-0x0000000003040000-0x0000000003432000-memory.dmp

Filesize
3.9MB

Download
memory/2460-101-0x000000013FC30000-0x0000000140022000-memory.dmp

Filesize
3.9MB

Download
memory/2460-77-0x0000000003040000-0x0000000003432000-memory.dmp

Filesize
3.9MB

Download
memory/2460-108-0x0000000003640000-0x0000000003A32000-memory.dmp

Filesize
3.9MB

Download
memory/2460-9-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-50-0x0000000003040000-0x0000000003432000-memory.dmp

Filesize
3.9MB

Download
memory/2460-58-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2460-0-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2460-99-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-92-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2628-23-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2652-68-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2680-35-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2684-67-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2780-91-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/3060-100-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download