xmrig | cf6540341d1f63c06f727a4f29c17e7e3457c22d2da02cc526657c4b7d5c56c4

Analysis

max time kernel
34s
max time network
31s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
Size

2.3MB
MD5

04e878bfb78176799ff79519fb85ebf8
SHA1

a7dd3b0b3604003ea8adade75e8f58d333928988
SHA256

cf6540341d1f63c06f727a4f29c17e7e3457c22d2da02cc526657c4b7d5c56c4
SHA512

9689c4b0b70fa62763bd6c9a3ac31e4b0043436730073b4b497d3b53ff4a306a35a28290ebddd8584e3a6cb7093fc4821def81aa97ec54fb6d9675435ab1f52f
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aD2:NABp

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2588-94-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2616-155-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/3024-117-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2552-105-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2580-164-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/2716-143-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/2564-140-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3008	yAxHaab.exe
2588	rPFfgZV.exe
2552	Xvsqwol.exe
3024	ObGwcTT.exe
2564	QLHPqsg.exe
2716	QCIDfYn.exe
2616	lxmFxYe.exe
2580	AonzOcO.exe
2464	stwUbWK.exe
2952	roidlWl.exe
1644	MwOsVkb.exe
2468	xhiIXdb.exe
2500	lUNMQNU.exe
2524	IeWvitE.exe
1268	VLOWPMp.exe
2684	LxiSkGF.exe
1308	iMmSCot.exe
1812	VIjYQpq.exe
2680	EvcKndw.exe
2792	QFzrPAS.exe
2824	uyFAAaP.exe
3048	jwPWnuT.exe
1256	wNRcTjf.exe
2428	sMagely.exe
2100	GDDBXOL.exe
1324	LRVkhon.exe
2884	LfWtfym.exe
1612	OVIGwMm.exe
2764	nPWdXkm.exe
1760	ACzcXUv.exe
2784	cPbyJjQ.exe
2504	FtXSNgq.exe
1136	YlXWCQB.exe
1048	mJQggIj.exe
2404	kRzRTKp.exe
616	vQgNRte.exe
2084	Akloubs.exe
2040	vyhhaVL.exe
700	OUWJECe.exe
1904	HPmocfz.exe
1480	eiDcwum.exe
2896	fgGKvZg.exe
956	zmFJpMv.exe
1168	BBBRmdp.exe
2264	HsQTulE.exe
1604	lKOunua.exe
1684	AFYlFKv.exe
1616	LnMvcFn.exe
2252	rRkqnYw.exe
1600	zgrVYMd.exe
3056	XjChRug.exe
2740	xIKVdpJ.exe
2096	rViHapb.exe
2888	MxQsAlC.exe
1632	tlMsWCX.exe
772	odHMHMB.exe
1648	dqjUuDX.exe
2036	HgvdOSP.exe
1972	hxWolIO.exe
2880	FBlGJYl.exe
1088	CxaDeqi.exe
2248	OTMTwrQ.exe
584	TFZQQYB.exe
1688	cmNKvkb.exe

Loads dropped DLL 64 IoCs

pid	Process
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2344-0-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/files/0x0009000000016a29-3.dat	upx
behavioral1/memory/3008-8-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/files/0x0009000000016ca5-9.dat	upx
behavioral1/files/0x0008000000016cc6-25.dat	upx
behavioral1/files/0x000f000000005578-24.dat	upx
behavioral1/files/0x0009000000016d57-35.dat	upx
behavioral1/files/0x0007000000016e4a-45.dat	upx
behavioral1/files/0x0006000000017374-65.dat	upx
behavioral1/memory/2344-10-0x00000000030B0000-0x00000000034A2000-memory.dmp	upx
behavioral1/files/0x00060000000173f2-75.dat	upx
behavioral1/files/0x0007000000016d16-21.dat	upx
behavioral1/files/0x000a000000016d51-29.dat	upx
behavioral1/files/0x0007000000016fed-80.dat	upx
behavioral1/files/0x0006000000017407-83.dat	upx
behavioral1/files/0x000600000001737c-82.dat	upx
behavioral1/files/0x0006000000017371-81.dat	upx
behavioral1/files/0x0008000000016e24-79.dat	upx
behavioral1/memory/2588-94-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/files/0x00140000000185e9-109.dat	upx
behavioral1/files/0x0006000000018ba1-135.dat	upx
behavioral1/files/0x0005000000019159-142.dat	upx
behavioral1/files/0x00050000000191da-169.dat	upx
behavioral1/files/0x000500000001920d-174.dat	upx
behavioral1/files/0x00050000000191e7-166.dat	upx
behavioral1/memory/2616-155-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/files/0x00050000000191b0-154.dat	upx
behavioral1/files/0x0005000000018717-110.dat	upx
behavioral1/memory/3024-117-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/files/0x0006000000018bab-116.dat	upx
behavioral1/memory/2552-105-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/files/0x000500000001860c-132.dat	upx
behavioral1/files/0x0005000000019216-177.dat	upx
behavioral1/files/0x00050000000191ea-170.dat	upx
behavioral1/memory/2580-164-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/files/0x00050000000191dd-162.dat	upx
behavioral1/files/0x00050000000191c8-156.dat	upx
behavioral1/files/0x0005000000019185-145.dat	upx
behavioral1/files/0x0006000000019064-129.dat	upx
behavioral1/files/0x0006000000018fbf-123.dat	upx
behavioral1/files/0x000d0000000185f4-102.dat	upx
behavioral1/files/0x00060000000174a5-96.dat	upx
behavioral1/memory/2716-143-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/memory/2564-140-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/files/0x0006000000019052-138.dat	upx
behavioral1/files/0x0006000000018ed8-137.dat	upx
behavioral1/files/0x0006000000017422-93.dat	upx
behavioral1/files/0x000700000001735a-56.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BtEXRri.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\ZufWfxH.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\lnWGVcR.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\nVTfEpb.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\QCIDfYn.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\aIayPLp.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\HMCXumR.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\uToiJYb.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\eGLWuKw.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\tcOHoKx.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\GRbTbwM.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\zPTSOTp.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\FUNKKFF.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\UFdvxQE.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\pKlRJNB.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\zcyisNT.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\nbOTpow.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\kEwRZxY.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\aEnyWYx.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\tzCLBKp.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\odQzlLM.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\rwIsdJG.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\XzNVgzy.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\RtwEcBU.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\yIZljfn.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\zsxSota.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\AWwADwM.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\KaCaLKf.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\PUoNZeR.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\OngotGe.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\aiztWJv.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\qbnSTzH.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\IrwdQRI.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\iATqBQE.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\URsgeJK.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\lKOunua.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\lyLsBJN.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\knApXuw.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\gLNRpAl.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\CxaDeqi.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\AIepXxF.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\equgcEe.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\pJqFyzA.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\xnosmGU.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\yVvsEti.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\MwOsVkb.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\TIshmXy.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\lGnaDEm.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\wqhboXA.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\lkCIlez.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\udcTBwr.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\HqAmqdt.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\FBlGJYl.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\OcoreGX.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\abkkBDY.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\IDWnUpi.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\bIkWepF.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\gbJCQXm.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\gZOkRpr.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\sXwLhOC.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\hxWolIO.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\fCFqsZv.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\qYVPABc.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
File created	C:\Windows\System\hcPdJpI.exe	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2860	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeLockMemoryPrivilege	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2860	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	29
PID 2344 wrote to memory of 2860	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	29
PID 2344 wrote to memory of 2860	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	29
PID 2344 wrote to memory of 3008	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	30
PID 2344 wrote to memory of 3008	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	30
PID 2344 wrote to memory of 3008	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	30
PID 2344 wrote to memory of 3024	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	31
PID 2344 wrote to memory of 3024	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	31
PID 2344 wrote to memory of 3024	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	31
PID 2344 wrote to memory of 2588	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	32
PID 2344 wrote to memory of 2588	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	32
PID 2344 wrote to memory of 2588	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	32
PID 2344 wrote to memory of 2716	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	33
PID 2344 wrote to memory of 2716	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	33
PID 2344 wrote to memory of 2716	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	33
PID 2344 wrote to memory of 2552	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	34
PID 2344 wrote to memory of 2552	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	34
PID 2344 wrote to memory of 2552	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	34
PID 2344 wrote to memory of 2580	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	35
PID 2344 wrote to memory of 2580	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	35
PID 2344 wrote to memory of 2580	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	35
PID 2344 wrote to memory of 2564	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	36
PID 2344 wrote to memory of 2564	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	36
PID 2344 wrote to memory of 2564	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	36
PID 2344 wrote to memory of 2468	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	37
PID 2344 wrote to memory of 2468	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	37
PID 2344 wrote to memory of 2468	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	37
PID 2344 wrote to memory of 2616	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	38
PID 2344 wrote to memory of 2616	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	38
PID 2344 wrote to memory of 2616	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	38
PID 2344 wrote to memory of 2500	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	39
PID 2344 wrote to memory of 2500	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	39
PID 2344 wrote to memory of 2500	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	39
PID 2344 wrote to memory of 2464	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	40
PID 2344 wrote to memory of 2464	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	40
PID 2344 wrote to memory of 2464	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	40
PID 2344 wrote to memory of 2524	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	41
PID 2344 wrote to memory of 2524	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	41
PID 2344 wrote to memory of 2524	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	41
PID 2344 wrote to memory of 2952	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	42
PID 2344 wrote to memory of 2952	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	42
PID 2344 wrote to memory of 2952	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	42
PID 2344 wrote to memory of 1268	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	43
PID 2344 wrote to memory of 1268	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	43
PID 2344 wrote to memory of 1268	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	43
PID 2344 wrote to memory of 1644	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	44
PID 2344 wrote to memory of 1644	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	44
PID 2344 wrote to memory of 1644	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	44
PID 2344 wrote to memory of 2684	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	45
PID 2344 wrote to memory of 2684	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	45
PID 2344 wrote to memory of 2684	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	45
PID 2344 wrote to memory of 1308	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	46
PID 2344 wrote to memory of 1308	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	46
PID 2344 wrote to memory of 1308	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	46
PID 2344 wrote to memory of 2764	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	47
PID 2344 wrote to memory of 2764	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	47
PID 2344 wrote to memory of 2764	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	47
PID 2344 wrote to memory of 1812	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	48
PID 2344 wrote to memory of 1812	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	48
PID 2344 wrote to memory of 1812	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	48
PID 2344 wrote to memory of 1760	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	49
PID 2344 wrote to memory of 1760	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	49
PID 2344 wrote to memory of 1760	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	49
PID 2344 wrote to memory of 2680	2344	04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04e878bfb78176799ff79519fb85ebf8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\Windows\System\yAxHaab.exe
  C:\Windows\System\yAxHaab.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\ObGwcTT.exe
  C:\Windows\System\ObGwcTT.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\rPFfgZV.exe
  C:\Windows\System\rPFfgZV.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\QCIDfYn.exe
  C:\Windows\System\QCIDfYn.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\Xvsqwol.exe
  C:\Windows\System\Xvsqwol.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\AonzOcO.exe
  C:\Windows\System\AonzOcO.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\QLHPqsg.exe
  C:\Windows\System\QLHPqsg.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\xhiIXdb.exe
  C:\Windows\System\xhiIXdb.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\lxmFxYe.exe
  C:\Windows\System\lxmFxYe.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\lUNMQNU.exe
  C:\Windows\System\lUNMQNU.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\stwUbWK.exe
  C:\Windows\System\stwUbWK.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\IeWvitE.exe
  C:\Windows\System\IeWvitE.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\roidlWl.exe
  C:\Windows\System\roidlWl.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\VLOWPMp.exe
  C:\Windows\System\VLOWPMp.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\MwOsVkb.exe
  C:\Windows\System\MwOsVkb.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\LxiSkGF.exe
  C:\Windows\System\LxiSkGF.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\iMmSCot.exe
  C:\Windows\System\iMmSCot.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\nPWdXkm.exe
  C:\Windows\System\nPWdXkm.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\VIjYQpq.exe
  C:\Windows\System\VIjYQpq.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\ACzcXUv.exe
  C:\Windows\System\ACzcXUv.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\EvcKndw.exe
  C:\Windows\System\EvcKndw.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\cPbyJjQ.exe
  C:\Windows\System\cPbyJjQ.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\QFzrPAS.exe
  C:\Windows\System\QFzrPAS.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\YlXWCQB.exe
  C:\Windows\System\YlXWCQB.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\uyFAAaP.exe
  C:\Windows\System\uyFAAaP.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\mJQggIj.exe
  C:\Windows\System\mJQggIj.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\jwPWnuT.exe
  C:\Windows\System\jwPWnuT.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\kRzRTKp.exe
  C:\Windows\System\kRzRTKp.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\wNRcTjf.exe
  C:\Windows\System\wNRcTjf.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\vQgNRte.exe
  C:\Windows\System\vQgNRte.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\sMagely.exe
  C:\Windows\System\sMagely.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\vyhhaVL.exe
  C:\Windows\System\vyhhaVL.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\GDDBXOL.exe
  C:\Windows\System\GDDBXOL.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\OUWJECe.exe
  C:\Windows\System\OUWJECe.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\LRVkhon.exe
  C:\Windows\System\LRVkhon.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\HPmocfz.exe
  C:\Windows\System\HPmocfz.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\LfWtfym.exe
  C:\Windows\System\LfWtfym.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\eiDcwum.exe
  C:\Windows\System\eiDcwum.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\OVIGwMm.exe
  C:\Windows\System\OVIGwMm.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\zmFJpMv.exe
  C:\Windows\System\zmFJpMv.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\FtXSNgq.exe
  C:\Windows\System\FtXSNgq.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\BBBRmdp.exe
  C:\Windows\System\BBBRmdp.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\Akloubs.exe
  C:\Windows\System\Akloubs.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\HsQTulE.exe
  C:\Windows\System\HsQTulE.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\fgGKvZg.exe
  C:\Windows\System\fgGKvZg.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\lKOunua.exe
  C:\Windows\System\lKOunua.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\AFYlFKv.exe
  C:\Windows\System\AFYlFKv.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\LnMvcFn.exe
  C:\Windows\System\LnMvcFn.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\rRkqnYw.exe
  C:\Windows\System\rRkqnYw.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\tdMhxrm.exe
  C:\Windows\System\tdMhxrm.exe
  2⤵
  PID:2120
- C:\Windows\System\zgrVYMd.exe
  C:\Windows\System\zgrVYMd.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\ydOUiIC.exe
  C:\Windows\System\ydOUiIC.exe
  2⤵
  PID:1596
- C:\Windows\System\XjChRug.exe
  C:\Windows\System\XjChRug.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\ACTBwWz.exe
  C:\Windows\System\ACTBwWz.exe
  2⤵
  PID:2644
- C:\Windows\System\xIKVdpJ.exe
  C:\Windows\System\xIKVdpJ.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\nOhGNjy.exe
  C:\Windows\System\nOhGNjy.exe
  2⤵
  PID:2488
- C:\Windows\System\rViHapb.exe
  C:\Windows\System\rViHapb.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\whfLsGq.exe
  C:\Windows\System\whfLsGq.exe
  2⤵
  PID:2668
- C:\Windows\System\MxQsAlC.exe
  C:\Windows\System\MxQsAlC.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\sLqBAxR.exe
  C:\Windows\System\sLqBAxR.exe
  2⤵
  PID:2724
- C:\Windows\System\tlMsWCX.exe
  C:\Windows\System\tlMsWCX.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\GkvcMAZ.exe
  C:\Windows\System\GkvcMAZ.exe
  2⤵
  PID:1396
- C:\Windows\System\odHMHMB.exe
  C:\Windows\System\odHMHMB.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\NMflxLH.exe
  C:\Windows\System\NMflxLH.exe
  2⤵
  PID:1680
- C:\Windows\System\dqjUuDX.exe
  C:\Windows\System\dqjUuDX.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\SmgJYAw.exe
  C:\Windows\System\SmgJYAw.exe
  2⤵
  PID:1896
- C:\Windows\System\HgvdOSP.exe
  C:\Windows\System\HgvdOSP.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\WbuurkQ.exe
  C:\Windows\System\WbuurkQ.exe
  2⤵
  PID:780
- C:\Windows\System\hxWolIO.exe
  C:\Windows\System\hxWolIO.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\oIdCqug.exe
  C:\Windows\System\oIdCqug.exe
  2⤵
  PID:1708
- C:\Windows\System\FBlGJYl.exe
  C:\Windows\System\FBlGJYl.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\DOIzsBw.exe
  C:\Windows\System\DOIzsBw.exe
  2⤵
  PID:1276
- C:\Windows\System\CxaDeqi.exe
  C:\Windows\System\CxaDeqi.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\ZdMXUnv.exe
  C:\Windows\System\ZdMXUnv.exe
  2⤵
  PID:908
- C:\Windows\System\OTMTwrQ.exe
  C:\Windows\System\OTMTwrQ.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\hNnDoOv.exe
  C:\Windows\System\hNnDoOv.exe
  2⤵
  PID:2768
- C:\Windows\System\TFZQQYB.exe
  C:\Windows\System\TFZQQYB.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\JUtNAmP.exe
  C:\Windows\System\JUtNAmP.exe
  2⤵
  PID:844
- C:\Windows\System\cmNKvkb.exe
  C:\Windows\System\cmNKvkb.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\qxJoxJU.exe
  C:\Windows\System\qxJoxJU.exe
  2⤵
  PID:2208
- C:\Windows\System\yaeJCsV.exe
  C:\Windows\System\yaeJCsV.exe
  2⤵
  PID:2636
- C:\Windows\System\cesWcDv.exe
  C:\Windows\System\cesWcDv.exe
  2⤵
  PID:1252
- C:\Windows\System\LLXtpiO.exe
  C:\Windows\System\LLXtpiO.exe
  2⤵
  PID:2276
- C:\Windows\System\clyzNdi.exe
  C:\Windows\System\clyzNdi.exe
  2⤵
  PID:1544
- C:\Windows\System\CWtgIpM.exe
  C:\Windows\System\CWtgIpM.exe
  2⤵
  PID:1576
- C:\Windows\System\wfoPiRu.exe
  C:\Windows\System\wfoPiRu.exe
  2⤵
  PID:2376
- C:\Windows\System\GQlJvsI.exe
  C:\Windows\System\GQlJvsI.exe
  2⤵
  PID:1892
- C:\Windows\System\eBKmEOR.exe
  C:\Windows\System\eBKmEOR.exe
  2⤵
  PID:2492
- C:\Windows\System\vXNiiAI.exe
  C:\Windows\System\vXNiiAI.exe
  2⤵
  PID:2156
- C:\Windows\System\caTFSkc.exe
  C:\Windows\System\caTFSkc.exe
  2⤵
  PID:1540
- C:\Windows\System\eGoLuBW.exe
  C:\Windows\System\eGoLuBW.exe
  2⤵
  PID:1332
- C:\Windows\System\RlIAiTk.exe
  C:\Windows\System\RlIAiTk.exe
  2⤵
  PID:2236
- C:\Windows\System\UxcPTXo.exe
  C:\Windows\System\UxcPTXo.exe
  2⤵
  PID:1692
- C:\Windows\System\kKzgSEZ.exe
  C:\Windows\System\kKzgSEZ.exe
  2⤵
  PID:1416
- C:\Windows\System\nxLYUci.exe
  C:\Windows\System\nxLYUci.exe
  2⤵
  PID:2836
- C:\Windows\System\xTmPAAh.exe
  C:\Windows\System\xTmPAAh.exe
  2⤵
  PID:664
- C:\Windows\System\PUoNZeR.exe
  C:\Windows\System\PUoNZeR.exe
  2⤵
  PID:2200
- C:\Windows\System\xfxNLwV.exe
  C:\Windows\System\xfxNLwV.exe
  2⤵
  PID:2340
- C:\Windows\System\CWodPWX.exe
  C:\Windows\System\CWodPWX.exe
  2⤵
  PID:3088
- C:\Windows\System\TnQOeLV.exe
  C:\Windows\System\TnQOeLV.exe
  2⤵
  PID:3104
- C:\Windows\System\qSgZnIQ.exe
  C:\Windows\System\qSgZnIQ.exe
  2⤵
  PID:3120
- C:\Windows\System\sxJarUx.exe
  C:\Windows\System\sxJarUx.exe
  2⤵
  PID:3136
- C:\Windows\System\jPUmYWO.exe
  C:\Windows\System\jPUmYWO.exe
  2⤵
  PID:3152
- C:\Windows\System\AeZoSxG.exe
  C:\Windows\System\AeZoSxG.exe
  2⤵
  PID:3168
- C:\Windows\System\ahhtHwu.exe
  C:\Windows\System\ahhtHwu.exe
  2⤵
  PID:3184
- C:\Windows\System\fkrGoqF.exe
  C:\Windows\System\fkrGoqF.exe
  2⤵
  PID:3204
- C:\Windows\System\nglFsTy.exe
  C:\Windows\System\nglFsTy.exe
  2⤵
  PID:3224
- C:\Windows\System\fjPUVob.exe
  C:\Windows\System\fjPUVob.exe
  2⤵
  PID:3240
- C:\Windows\System\asDxOAm.exe
  C:\Windows\System\asDxOAm.exe
  2⤵
  PID:3256
- C:\Windows\System\MLbeVen.exe
  C:\Windows\System\MLbeVen.exe
  2⤵
  PID:3272
- C:\Windows\System\lxqiORE.exe
  C:\Windows\System\lxqiORE.exe
  2⤵
  PID:3288
- C:\Windows\System\CBGvvmW.exe
  C:\Windows\System\CBGvvmW.exe
  2⤵
  PID:3304
- C:\Windows\System\JNkcWbt.exe
  C:\Windows\System\JNkcWbt.exe
  2⤵
  PID:3320
- C:\Windows\System\wXoipGd.exe
  C:\Windows\System\wXoipGd.exe
  2⤵
  PID:3336
- C:\Windows\System\MhAipiH.exe
  C:\Windows\System\MhAipiH.exe
  2⤵
  PID:3352
- C:\Windows\System\MbVuTpi.exe
  C:\Windows\System\MbVuTpi.exe
  2⤵
  PID:3368
- C:\Windows\System\psnYtEB.exe
  C:\Windows\System\psnYtEB.exe
  2⤵
  PID:3384
- C:\Windows\System\NJsBQDC.exe
  C:\Windows\System\NJsBQDC.exe
  2⤵
  PID:3400
- C:\Windows\System\brLUiCD.exe
  C:\Windows\System\brLUiCD.exe
  2⤵
  PID:3416
- C:\Windows\System\hZhmGBE.exe
  C:\Windows\System\hZhmGBE.exe
  2⤵
  PID:3432
- C:\Windows\System\UzUBdgz.exe
  C:\Windows\System\UzUBdgz.exe
  2⤵
  PID:3448
- C:\Windows\System\PHRmMRX.exe
  C:\Windows\System\PHRmMRX.exe
  2⤵
  PID:3464
- C:\Windows\System\ZRwwBbq.exe
  C:\Windows\System\ZRwwBbq.exe
  2⤵
  PID:3480
- C:\Windows\System\FDSiRTY.exe
  C:\Windows\System\FDSiRTY.exe
  2⤵
  PID:3496
- C:\Windows\System\oBBQqSq.exe
  C:\Windows\System\oBBQqSq.exe
  2⤵
  PID:3516
- C:\Windows\System\XuMUDwS.exe
  C:\Windows\System\XuMUDwS.exe
  2⤵
  PID:3532
- C:\Windows\System\BhhDgNq.exe
  C:\Windows\System\BhhDgNq.exe
  2⤵
  PID:3548
- C:\Windows\System\wrXddgd.exe
  C:\Windows\System\wrXddgd.exe
  2⤵
  PID:3564
- C:\Windows\System\gZozkzd.exe
  C:\Windows\System\gZozkzd.exe
  2⤵
  PID:3580
- C:\Windows\System\HdRKzbV.exe
  C:\Windows\System\HdRKzbV.exe
  2⤵
  PID:3596
- C:\Windows\System\kNIeENF.exe
  C:\Windows\System\kNIeENF.exe
  2⤵
  PID:3612
- C:\Windows\System\XaoglzU.exe
  C:\Windows\System\XaoglzU.exe
  2⤵
  PID:3628
- C:\Windows\System\pxjJHUU.exe
  C:\Windows\System\pxjJHUU.exe
  2⤵
  PID:3644
- C:\Windows\System\rFTvsot.exe
  C:\Windows\System\rFTvsot.exe
  2⤵
  PID:3660
- C:\Windows\System\OrMOdIx.exe
  C:\Windows\System\OrMOdIx.exe
  2⤵
  PID:3676
- C:\Windows\System\rGmCFjB.exe
  C:\Windows\System\rGmCFjB.exe
  2⤵
  PID:3692
- C:\Windows\System\xFWnkfF.exe
  C:\Windows\System\xFWnkfF.exe
  2⤵
  PID:3708
- C:\Windows\System\wldegmk.exe
  C:\Windows\System\wldegmk.exe
  2⤵
  PID:3724
- C:\Windows\System\mhfGEKX.exe
  C:\Windows\System\mhfGEKX.exe
  2⤵
  PID:3740
- C:\Windows\System\ggVtkmo.exe
  C:\Windows\System\ggVtkmo.exe
  2⤵
  PID:3756
- C:\Windows\System\kdzSoUa.exe
  C:\Windows\System\kdzSoUa.exe
  2⤵
  PID:3804
- C:\Windows\System\IWkmCgr.exe
  C:\Windows\System\IWkmCgr.exe
  2⤵
  PID:3824
- C:\Windows\System\LYUxyWO.exe
  C:\Windows\System\LYUxyWO.exe
  2⤵
  PID:3840
- C:\Windows\System\CXevfMM.exe
  C:\Windows\System\CXevfMM.exe
  2⤵
  PID:3856
- C:\Windows\System\VqfzQrn.exe
  C:\Windows\System\VqfzQrn.exe
  2⤵
  PID:3872
- C:\Windows\System\GvYAzPA.exe
  C:\Windows\System\GvYAzPA.exe
  2⤵
  PID:3888
- C:\Windows\System\bACVaQK.exe
  C:\Windows\System\bACVaQK.exe
  2⤵
  PID:3904
- C:\Windows\System\IeBNldb.exe
  C:\Windows\System\IeBNldb.exe
  2⤵
  PID:3920
- C:\Windows\System\xYgSmRd.exe
  C:\Windows\System\xYgSmRd.exe
  2⤵
  PID:3936
- C:\Windows\System\rgxbsJf.exe
  C:\Windows\System\rgxbsJf.exe
  2⤵
  PID:3952
- C:\Windows\System\jgkKpft.exe
  C:\Windows\System\jgkKpft.exe
  2⤵
  PID:3328
- C:\Windows\System\bLTCZYn.exe
  C:\Windows\System\bLTCZYn.exe
  2⤵
  PID:3392
- C:\Windows\System\EtFdiVM.exe
  C:\Windows\System\EtFdiVM.exe
  2⤵
  PID:3456
- C:\Windows\System\QtZGcRJ.exe
  C:\Windows\System\QtZGcRJ.exe
  2⤵
  PID:3524
- C:\Windows\System\MPwBsuy.exe
  C:\Windows\System\MPwBsuy.exe
  2⤵
  PID:3588
- C:\Windows\System\yamGkPu.exe
  C:\Windows\System\yamGkPu.exe
  2⤵
  PID:3652
- C:\Windows\System\aIayPLp.exe
  C:\Windows\System\aIayPLp.exe
  2⤵
  PID:3716
- C:\Windows\System\ExnoSZu.exe
  C:\Windows\System\ExnoSZu.exe
  2⤵
  PID:3812
- C:\Windows\System\CwhXQpQ.exe
  C:\Windows\System\CwhXQpQ.exe
  2⤵
  PID:3852
- C:\Windows\System\BXaSJbo.exe
  C:\Windows\System\BXaSJbo.exe
  2⤵
  PID:2104
- C:\Windows\System\wBHvKKg.exe
  C:\Windows\System\wBHvKKg.exe
  2⤵
  PID:2960
- C:\Windows\System\xRHqOPl.exe
  C:\Windows\System\xRHqOPl.exe
  2⤵
  PID:1368
- C:\Windows\System\uOXnBNb.exe
  C:\Windows\System\uOXnBNb.exe
  2⤵
  PID:1516
- C:\Windows\System\LsKzONV.exe
  C:\Windows\System\LsKzONV.exe
  2⤵
  PID:1672
- C:\Windows\System\TIshmXy.exe
  C:\Windows\System\TIshmXy.exe
  2⤵
  PID:1012
- C:\Windows\System\VtzmoNU.exe
  C:\Windows\System\VtzmoNU.exe
  2⤵
  PID:884
- C:\Windows\System\DexEZvK.exe
  C:\Windows\System\DexEZvK.exe
  2⤵
  PID:1656
- C:\Windows\System\nKMnmXV.exe
  C:\Windows\System\nKMnmXV.exe
  2⤵
  PID:1240
- C:\Windows\System\BuDWOmg.exe
  C:\Windows\System\BuDWOmg.exe
  2⤵
  PID:892
- C:\Windows\System\yNszmPW.exe
  C:\Windows\System\yNszmPW.exe
  2⤵
  PID:3148
- C:\Windows\System\HqDufch.exe
  C:\Windows\System\HqDufch.exe
  2⤵
  PID:2348
- C:\Windows\System\PEQbdpE.exe
  C:\Windows\System\PEQbdpE.exe
  2⤵
  PID:3488
- C:\Windows\System\CYmHRQy.exe
  C:\Windows\System\CYmHRQy.exe
  2⤵
  PID:2604
- C:\Windows\System\TKcBvFX.exe
  C:\Windows\System\TKcBvFX.exe
  2⤵
  PID:572
- C:\Windows\System\uOhoUjk.exe
  C:\Windows\System\uOhoUjk.exe
  2⤵
  PID:2508
- C:\Windows\System\LRTkLMJ.exe
  C:\Windows\System\LRTkLMJ.exe
  2⤵
  PID:3216
- C:\Windows\System\mDWVbeR.exe
  C:\Windows\System\mDWVbeR.exe
  2⤵
  PID:3280
- C:\Windows\System\FUdsQzF.exe
  C:\Windows\System\FUdsQzF.exe
  2⤵
  PID:3344
- C:\Windows\System\DWgbJca.exe
  C:\Windows\System\DWgbJca.exe
  2⤵
  PID:3408
- C:\Windows\System\lepHttJ.exe
  C:\Windows\System\lepHttJ.exe
  2⤵
  PID:3472
- C:\Windows\System\qcOcQDq.exe
  C:\Windows\System\qcOcQDq.exe
  2⤵
  PID:3512
- C:\Windows\System\etaQdDs.exe
  C:\Windows\System\etaQdDs.exe
  2⤵
  PID:3576
- C:\Windows\System\IsMucHr.exe
  C:\Windows\System\IsMucHr.exe
  2⤵
  PID:3640
- C:\Windows\System\EcwqoEM.exe
  C:\Windows\System\EcwqoEM.exe
  2⤵
  PID:3704
- C:\Windows\System\dZvCCLq.exe
  C:\Windows\System\dZvCCLq.exe
  2⤵
  PID:3768
- C:\Windows\System\YFfhQlJ.exe
  C:\Windows\System\YFfhQlJ.exe
  2⤵
  PID:3784
- C:\Windows\System\fzHbhfy.exe
  C:\Windows\System\fzHbhfy.exe
  2⤵
  PID:3800
- C:\Windows\System\aRGkbVF.exe
  C:\Windows\System\aRGkbVF.exe
  2⤵
  PID:3868
- C:\Windows\System\lfYHaPZ.exe
  C:\Windows\System\lfYHaPZ.exe
  2⤵
  PID:3932
- C:\Windows\System\XSuezLf.exe
  C:\Windows\System\XSuezLf.exe
  2⤵
  PID:3972
- C:\Windows\System\eWcsDqV.exe
  C:\Windows\System\eWcsDqV.exe
  2⤵
  PID:3988
- C:\Windows\System\QFvmEKE.exe
  C:\Windows\System\QFvmEKE.exe
  2⤵
  PID:4004
- C:\Windows\System\rVnwPqW.exe
  C:\Windows\System\rVnwPqW.exe
  2⤵
  PID:4020
- C:\Windows\System\fflDhfj.exe
  C:\Windows\System\fflDhfj.exe
  2⤵
  PID:4040
- C:\Windows\System\nkEIpxc.exe
  C:\Windows\System\nkEIpxc.exe
  2⤵
  PID:4056
- C:\Windows\System\JNGbAqy.exe
  C:\Windows\System\JNGbAqy.exe
  2⤵
  PID:4076
- C:\Windows\System\rBCrEFa.exe
  C:\Windows\System\rBCrEFa.exe
  2⤵
  PID:3020
- C:\Windows\System\uvyfIMt.exe
  C:\Windows\System\uvyfIMt.exe
  2⤵
  PID:2816
- C:\Windows\System\ezbBzWc.exe
  C:\Windows\System\ezbBzWc.exe
  2⤵
  PID:1116
- C:\Windows\System\EhGVVZX.exe
  C:\Windows\System\EhGVVZX.exe
  2⤵
  PID:1508
- C:\Windows\System\ZzTlIgP.exe
  C:\Windows\System\ZzTlIgP.exe
  2⤵
  PID:2868
- C:\Windows\System\YEiFEip.exe
  C:\Windows\System\YEiFEip.exe
  2⤵
  PID:2712
- C:\Windows\System\TBlWgpG.exe
  C:\Windows\System\TBlWgpG.exe
  2⤵
  PID:2904
- C:\Windows\System\UBvNRNQ.exe
  C:\Windows\System\UBvNRNQ.exe
  2⤵
  PID:3132
- C:\Windows\System\HFUBCUE.exe
  C:\Windows\System\HFUBCUE.exe
  2⤵
  PID:3196
- C:\Windows\System\eWseZxm.exe
  C:\Windows\System\eWseZxm.exe
  2⤵
  PID:3232
- C:\Windows\System\SQfDHIX.exe
  C:\Windows\System\SQfDHIX.exe
  2⤵
  PID:3300
- C:\Windows\System\YVDOUFI.exe
  C:\Windows\System\YVDOUFI.exe
  2⤵
  PID:2396
- C:\Windows\System\fCFqsZv.exe
  C:\Windows\System\fCFqsZv.exe
  2⤵
  PID:3688
- C:\Windows\System\lIDSncP.exe
  C:\Windows\System\lIDSncP.exe
  2⤵
  PID:3912
- C:\Windows\System\wUPaPbT.exe
  C:\Windows\System\wUPaPbT.exe
  2⤵
  PID:1100
- C:\Windows\System\XUlpzMr.exe
  C:\Windows\System\XUlpzMr.exe
  2⤵
  PID:1876
- C:\Windows\System\KeTIbTz.exe
  C:\Windows\System\KeTIbTz.exe
  2⤵
  PID:1180
- C:\Windows\System\WHPVcAq.exe
  C:\Windows\System\WHPVcAq.exe
  2⤵
  PID:268
- C:\Windows\System\VFvoAeR.exe
  C:\Windows\System\VFvoAeR.exe
  2⤵
  PID:2864
- C:\Windows\System\UhLWiAA.exe
  C:\Windows\System\UhLWiAA.exe
  2⤵
  PID:1072
- C:\Windows\System\AcOfUFO.exe
  C:\Windows\System\AcOfUFO.exe
  2⤵
  PID:2916
- C:\Windows\System\qkaPWor.exe
  C:\Windows\System\qkaPWor.exe
  2⤵
  PID:292
- C:\Windows\System\azeCnAL.exe
  C:\Windows\System\azeCnAL.exe
  2⤵
  PID:2840
- C:\Windows\System\qwpBKWf.exe
  C:\Windows\System\qwpBKWf.exe
  2⤵
  PID:1908
- C:\Windows\System\BqKmzJf.exe
  C:\Windows\System\BqKmzJf.exe
  2⤵
  PID:2160
- C:\Windows\System\vezXraV.exe
  C:\Windows\System\vezXraV.exe
  2⤵
  PID:3180
- C:\Windows\System\VEIjlCR.exe
  C:\Windows\System\VEIjlCR.exe
  2⤵
  PID:3444
- C:\Windows\System\erhpWYn.exe
  C:\Windows\System\erhpWYn.exe
  2⤵
  PID:1820
- C:\Windows\System\Zclrolf.exe
  C:\Windows\System\Zclrolf.exe
  2⤵
  PID:4028
- C:\Windows\System\nvUzEXt.exe
  C:\Windows\System\nvUzEXt.exe
  2⤵
  PID:3864
- C:\Windows\System\kpkxKht.exe
  C:\Windows\System\kpkxKht.exe
  2⤵
  PID:4000
- C:\Windows\System\mKJtwrN.exe
  C:\Windows\System\mKJtwrN.exe
  2⤵
  PID:4072
- C:\Windows\System\xiHRtfo.exe
  C:\Windows\System\xiHRtfo.exe
  2⤵
  PID:2936
- C:\Windows\System\yBipvRQ.exe
  C:\Windows\System\yBipvRQ.exe
  2⤵
  PID:3100
- C:\Windows\System\HajIzTU.exe
  C:\Windows\System\HajIzTU.exe
  2⤵
  PID:3428
- C:\Windows\System\PZdSiyF.exe
  C:\Windows\System\PZdSiyF.exe
  2⤵
  PID:3752
- C:\Windows\System\thimHct.exe
  C:\Windows\System\thimHct.exe
  2⤵
  PID:2440
- C:\Windows\System\fCzULKn.exe
  C:\Windows\System\fCzULKn.exe
  2⤵
  PID:2804
- C:\Windows\System\aQgEFuZ.exe
  C:\Windows\System\aQgEFuZ.exe
  2⤵
  PID:4112
- C:\Windows\System\OFoAMOH.exe
  C:\Windows\System\OFoAMOH.exe
  2⤵
  PID:4128
- C:\Windows\System\wzsOrcC.exe
  C:\Windows\System\wzsOrcC.exe
  2⤵
  PID:4200
- C:\Windows\System\GlXhEAN.exe
  C:\Windows\System\GlXhEAN.exe
  2⤵
  PID:4216
- C:\Windows\System\fkFNEcn.exe
  C:\Windows\System\fkFNEcn.exe
  2⤵
  PID:4232
- C:\Windows\System\uAytdrS.exe
  C:\Windows\System\uAytdrS.exe
  2⤵
  PID:4248
- C:\Windows\System\maYPdHj.exe
  C:\Windows\System\maYPdHj.exe
  2⤵
  PID:4264
- C:\Windows\System\zwCCMAy.exe
  C:\Windows\System\zwCCMAy.exe
  2⤵
  PID:4280
- C:\Windows\System\PavfqQG.exe
  C:\Windows\System\PavfqQG.exe
  2⤵
  PID:4296
- C:\Windows\System\SrpHCfy.exe
  C:\Windows\System\SrpHCfy.exe
  2⤵
  PID:4312
- C:\Windows\System\QTrMOok.exe
  C:\Windows\System\QTrMOok.exe
  2⤵
  PID:4328
- C:\Windows\System\HSghsOU.exe
  C:\Windows\System\HSghsOU.exe
  2⤵
  PID:4344
- C:\Windows\System\haRdkjm.exe
  C:\Windows\System\haRdkjm.exe
  2⤵
  PID:4360
- C:\Windows\System\JJxOlpI.exe
  C:\Windows\System\JJxOlpI.exe
  2⤵
  PID:4376
- C:\Windows\System\ZRupMho.exe
  C:\Windows\System\ZRupMho.exe
  2⤵
  PID:4392
- C:\Windows\System\ipDkrSH.exe
  C:\Windows\System\ipDkrSH.exe
  2⤵
  PID:4408
- C:\Windows\System\OZNuBrz.exe
  C:\Windows\System\OZNuBrz.exe
  2⤵
  PID:4424
- C:\Windows\System\eszRPpp.exe
  C:\Windows\System\eszRPpp.exe
  2⤵
  PID:4440
- C:\Windows\System\blBTZlN.exe
  C:\Windows\System\blBTZlN.exe
  2⤵
  PID:4456
- C:\Windows\System\SHleVli.exe
  C:\Windows\System\SHleVli.exe
  2⤵
  PID:4472
- C:\Windows\System\rBnQDas.exe
  C:\Windows\System\rBnQDas.exe
  2⤵
  PID:4488
- C:\Windows\System\DKBbzmo.exe
  C:\Windows\System\DKBbzmo.exe
  2⤵
  PID:4504
- C:\Windows\System\ySagoxW.exe
  C:\Windows\System\ySagoxW.exe
  2⤵
  PID:4520
- C:\Windows\System\HkvsvAq.exe
  C:\Windows\System\HkvsvAq.exe
  2⤵
  PID:4536
- C:\Windows\System\wvumnWE.exe
  C:\Windows\System\wvumnWE.exe
  2⤵
  PID:4552
- C:\Windows\System\yOKJsbL.exe
  C:\Windows\System\yOKJsbL.exe
  2⤵
  PID:4568
- C:\Windows\System\GPVpEkZ.exe
  C:\Windows\System\GPVpEkZ.exe
  2⤵
  PID:4584
- C:\Windows\System\FLJApML.exe
  C:\Windows\System\FLJApML.exe
  2⤵
  PID:4600
- C:\Windows\System\aEnyWYx.exe
  C:\Windows\System\aEnyWYx.exe
  2⤵
  PID:4616
- C:\Windows\System\IwhwhFJ.exe
  C:\Windows\System\IwhwhFJ.exe
  2⤵
  PID:4632
- C:\Windows\System\YyAVKfr.exe
  C:\Windows\System\YyAVKfr.exe
  2⤵
  PID:4648
- C:\Windows\System\CucQEvO.exe
  C:\Windows\System\CucQEvO.exe
  2⤵
  PID:4668
- C:\Windows\System\OYVtwKu.exe
  C:\Windows\System\OYVtwKu.exe
  2⤵
  PID:4684
- C:\Windows\System\rIfLgPv.exe
  C:\Windows\System\rIfLgPv.exe
  2⤵
  PID:4700
- C:\Windows\System\gTPDxJm.exe
  C:\Windows\System\gTPDxJm.exe
  2⤵
  PID:4716
- C:\Windows\System\NutjyNU.exe
  C:\Windows\System\NutjyNU.exe
  2⤵
  PID:4732
- C:\Windows\System\BJvritT.exe
  C:\Windows\System\BJvritT.exe
  2⤵
  PID:4748
- C:\Windows\System\cCyVseU.exe
  C:\Windows\System\cCyVseU.exe
  2⤵
  PID:4764
- C:\Windows\System\ObbQlGr.exe
  C:\Windows\System\ObbQlGr.exe
  2⤵
  PID:4780
- C:\Windows\System\akZsGrK.exe
  C:\Windows\System\akZsGrK.exe
  2⤵
  PID:4796
- C:\Windows\System\HgbznHF.exe
  C:\Windows\System\HgbznHF.exe
  2⤵
  PID:4812
- C:\Windows\System\yTNPWml.exe
  C:\Windows\System\yTNPWml.exe
  2⤵
  PID:4828
- C:\Windows\System\xuHGbGx.exe
  C:\Windows\System\xuHGbGx.exe
  2⤵
  PID:4844
- C:\Windows\System\BiRVyLs.exe
  C:\Windows\System\BiRVyLs.exe
  2⤵
  PID:4860
- C:\Windows\System\xXvldDr.exe
  C:\Windows\System\xXvldDr.exe
  2⤵
  PID:4876
- C:\Windows\System\UCFabln.exe
  C:\Windows\System\UCFabln.exe
  2⤵
  PID:4892
- C:\Windows\System\UEzzDJn.exe
  C:\Windows\System\UEzzDJn.exe
  2⤵
  PID:4908
- C:\Windows\System\tCFAfDO.exe
  C:\Windows\System\tCFAfDO.exe
  2⤵
  PID:4924
- C:\Windows\System\PiLcMPs.exe
  C:\Windows\System\PiLcMPs.exe
  2⤵
  PID:4940
- C:\Windows\System\WoULzsz.exe
  C:\Windows\System\WoULzsz.exe
  2⤵
  PID:4956
- C:\Windows\System\ePtWmcp.exe
  C:\Windows\System\ePtWmcp.exe
  2⤵
  PID:4972
- C:\Windows\System\LjQctNw.exe
  C:\Windows\System\LjQctNw.exe
  2⤵
  PID:4988
- C:\Windows\System\UZfuINl.exe
  C:\Windows\System\UZfuINl.exe
  2⤵
  PID:5004
- C:\Windows\System\VKnsyKX.exe
  C:\Windows\System\VKnsyKX.exe
  2⤵
  PID:5020
- C:\Windows\System\ZbpSrXs.exe
  C:\Windows\System\ZbpSrXs.exe
  2⤵
  PID:5036
- C:\Windows\System\LkoFOxG.exe
  C:\Windows\System\LkoFOxG.exe
  2⤵
  PID:5052
- C:\Windows\System\zvbqPLf.exe
  C:\Windows\System\zvbqPLf.exe
  2⤵
  PID:4120
- C:\Windows\System\kpImcdP.exe
  C:\Windows\System\kpImcdP.exe
  2⤵
  PID:1664
- C:\Windows\System\FiANfoM.exe
  C:\Windows\System\FiANfoM.exe
  2⤵
  PID:3296
- C:\Windows\System\LDGVDxk.exe
  C:\Windows\System\LDGVDxk.exe
  2⤵
  PID:4244
- C:\Windows\System\HwhKIyV.exe
  C:\Windows\System\HwhKIyV.exe
  2⤵
  PID:4340
- C:\Windows\System\JHlNyiu.exe
  C:\Windows\System\JHlNyiu.exe
  2⤵
  PID:4404
- C:\Windows\System\wQSjdFF.exe
  C:\Windows\System\wQSjdFF.exe
  2⤵
  PID:1912
- C:\Windows\System\JmZFhWN.exe
  C:\Windows\System\JmZFhWN.exe
  2⤵
  PID:2948
- C:\Windows\System\hxEWHSp.exe
  C:\Windows\System\hxEWHSp.exe
  2⤵
  PID:1468
- C:\Windows\System\tcOHoKx.exe
  C:\Windows\System\tcOHoKx.exe
  2⤵
  PID:1696
- C:\Windows\System\zlpxWWi.exe
  C:\Windows\System\zlpxWWi.exe
  2⤵
  PID:3624
- C:\Windows\System\AGSIqhG.exe
  C:\Windows\System\AGSIqhG.exe
  2⤵
  PID:4136
- C:\Windows\System\vzeMZRQ.exe
  C:\Windows\System\vzeMZRQ.exe
  2⤵
  PID:4144
- C:\Windows\System\KjIewbv.exe
  C:\Windows\System\KjIewbv.exe
  2⤵
  PID:3252
- C:\Windows\System\amewJgD.exe
  C:\Windows\System\amewJgD.exe
  2⤵
  PID:4480
- C:\Windows\System\PQVByzD.exe
  C:\Windows\System\PQVByzD.exe
  2⤵
  PID:1744
- C:\Windows\System\RposmNm.exe
  C:\Windows\System\RposmNm.exe
  2⤵
  PID:4900
- C:\Windows\System\nkxEnZd.exe
  C:\Windows\System\nkxEnZd.exe
  2⤵
  PID:4496
- C:\Windows\System\HJLkVVu.exe
  C:\Windows\System\HJLkVVu.exe
  2⤵
  PID:4532
- C:\Windows\System\TIfAtQH.exe
  C:\Windows\System\TIfAtQH.exe
  2⤵
  PID:4624
- C:\Windows\System\OcoreGX.exe
  C:\Windows\System\OcoreGX.exe
  2⤵
  PID:4984
- C:\Windows\System\ficuZKl.exe
  C:\Windows\System\ficuZKl.exe
  2⤵
  PID:4696
- C:\Windows\System\dmiakhw.exe
  C:\Windows\System\dmiakhw.exe
  2⤵
  PID:4788
- C:\Windows\System\upOgyAK.exe
  C:\Windows\System\upOgyAK.exe
  2⤵
  PID:4888
- C:\Windows\System\kaNmNBJ.exe
  C:\Windows\System\kaNmNBJ.exe
  2⤵
  PID:2780
- C:\Windows\System\qYVPABc.exe
  C:\Windows\System\qYVPABc.exe
  2⤵
  PID:4224
- C:\Windows\System\TSmHUMm.exe
  C:\Windows\System\TSmHUMm.exe
  2⤵
  PID:1264
- C:\Windows\System\ZFgwkuP.exe
  C:\Windows\System\ZFgwkuP.exe
  2⤵
  PID:4964
- C:\Windows\System\fhihxWl.exe
  C:\Windows\System\fhihxWl.exe
  2⤵
  PID:5028
- C:\Windows\System\CaWUBCM.exe
  C:\Windows\System\CaWUBCM.exe
  2⤵
  PID:4484
- C:\Windows\System\YUelGeU.exe
  C:\Windows\System\YUelGeU.exe
  2⤵
  PID:1196
- C:\Windows\System\OFDNBuK.exe
  C:\Windows\System\OFDNBuK.exe
  2⤵
  PID:2540
- C:\Windows\System\GRbTbwM.exe
  C:\Windows\System\GRbTbwM.exe
  2⤵
  PID:1916
- C:\Windows\System\akulaQu.exe
  C:\Windows\System\akulaQu.exe
  2⤵
  PID:704
- C:\Windows\System\TlhTRPE.exe
  C:\Windows\System\TlhTRPE.exe
  2⤵
  PID:5084
- C:\Windows\System\jTRgcXP.exe
  C:\Windows\System\jTRgcXP.exe
  2⤵
  PID:2756
- C:\Windows\System\RmXNwNG.exe
  C:\Windows\System\RmXNwNG.exe
  2⤵
  PID:3504
- C:\Windows\System\gNikxuY.exe
  C:\Windows\System\gNikxuY.exe
  2⤵
  PID:3928
- C:\Windows\System\bOqfFCK.exe
  C:\Windows\System\bOqfFCK.exe
  2⤵
  PID:3144
- C:\Windows\System\RYKgbmE.exe
  C:\Windows\System\RYKgbmE.exe
  2⤵
  PID:4048
- C:\Windows\System\XzMtYQr.exe
  C:\Windows\System\XzMtYQr.exe
  2⤵
  PID:5108
- C:\Windows\System\qzeENtF.exe
  C:\Windows\System\qzeENtF.exe
  2⤵
  PID:2168
- C:\Windows\System\CYdirkZ.exe
  C:\Windows\System\CYdirkZ.exe
  2⤵
  PID:1172
- C:\Windows\System\vTKjNkE.exe
  C:\Windows\System\vTKjNkE.exe
  2⤵
  PID:3780
- C:\Windows\System\XzEZmle.exe
  C:\Windows\System\XzEZmle.exe
  2⤵
  PID:3556
- C:\Windows\System\lyLsBJN.exe
  C:\Windows\System\lyLsBJN.exe
  2⤵
  PID:3684
- C:\Windows\System\gWGccCV.exe
  C:\Windows\System\gWGccCV.exe
  2⤵
  PID:2432
- C:\Windows\System\tzCLBKp.exe
  C:\Windows\System\tzCLBKp.exe
  2⤵
  PID:4276
- C:\Windows\System\gWeAeEk.exe
  C:\Windows\System\gWeAeEk.exe
  2⤵
  PID:2924
- C:\Windows\System\oraMqgG.exe
  C:\Windows\System\oraMqgG.exe
  2⤵
  PID:1188
- C:\Windows\System\RifkXmP.exe
  C:\Windows\System\RifkXmP.exe
  2⤵
  PID:4152
- C:\Windows\System\XvBLtJM.exe
  C:\Windows\System\XvBLtJM.exe
  2⤵
  PID:1260
- C:\Windows\System\WaUjMIn.exe
  C:\Windows\System\WaUjMIn.exe
  2⤵
  PID:3380
- C:\Windows\System\VXKCMbS.exe
  C:\Windows\System\VXKCMbS.exe
  2⤵
  PID:4176
- C:\Windows\System\oaSVALK.exe
  C:\Windows\System\oaSVALK.exe
  2⤵
  PID:2736
- C:\Windows\System\GobiAcd.exe
  C:\Windows\System\GobiAcd.exe
  2⤵
  PID:4292
- C:\Windows\System\RIzRiEq.exe
  C:\Windows\System\RIzRiEq.exe
  2⤵
  PID:4228
- C:\Windows\System\qwELdtt.exe
  C:\Windows\System\qwELdtt.exe
  2⤵
  PID:4384
- C:\Windows\System\VwXmJHc.exe
  C:\Windows\System\VwXmJHc.exe
  2⤵
  PID:4608
- C:\Windows\System\SKxLtcd.exe
  C:\Windows\System\SKxLtcd.exe
  2⤵
  PID:4516
- C:\Windows\System\SHTqlgb.exe
  C:\Windows\System\SHTqlgb.exe
  2⤵
  PID:4708
- C:\Windows\System\mXzDyJL.exe
  C:\Windows\System\mXzDyJL.exe
  2⤵
  PID:4776
- C:\Windows\System\JwByMsX.exe
  C:\Windows\System\JwByMsX.exe
  2⤵
  PID:4868
- C:\Windows\System\QnauAjk.exe
  C:\Windows\System\QnauAjk.exe
  2⤵
  PID:4432
- C:\Windows\System\shxskFV.exe
  C:\Windows\System\shxskFV.exe
  2⤵
  PID:1700
- C:\Windows\System\jylxtZb.exe
  C:\Windows\System\jylxtZb.exe
  2⤵
  PID:2460
- C:\Windows\System\jJEFRez.exe
  C:\Windows\System\jJEFRez.exe
  2⤵
  PID:4852
- C:\Windows\System\jqaYEri.exe
  C:\Windows\System\jqaYEri.exe
  2⤵
  PID:4820
- C:\Windows\System\eyTGqQA.exe
  C:\Windows\System\eyTGqQA.exe
  2⤵
  PID:5048
- C:\Windows\System\FncUFYj.exe
  C:\Windows\System\FncUFYj.exe
  2⤵
  PID:2452
- C:\Windows\System\yNaipdD.exe
  C:\Windows\System\yNaipdD.exe
  2⤵
  PID:4612
- C:\Windows\System\uNOTdDg.exe
  C:\Windows\System\uNOTdDg.exe
  2⤵
  PID:2472
- C:\Windows\System\vBqfkqW.exe
  C:\Windows\System\vBqfkqW.exe
  2⤵
  PID:5076
- C:\Windows\System\wYQAhlK.exe
  C:\Windows\System\wYQAhlK.exe
  2⤵
  PID:5072
- C:\Windows\System\ceAIXyL.exe
  C:\Windows\System\ceAIXyL.exe
  2⤵
  PID:3248
- C:\Windows\System\CgRgdae.exe
  C:\Windows\System\CgRgdae.exe
  2⤵
  PID:3736
- C:\Windows\System\nUbqwMo.exe
  C:\Windows\System\nUbqwMo.exe
  2⤵
  PID:3116
- C:\Windows\System\EQVfKUo.exe
  C:\Windows\System\EQVfKUo.exe
  2⤵
  PID:3360
- C:\Windows\System\STlnrMb.exe
  C:\Windows\System\STlnrMb.exe
  2⤵
  PID:5104
- C:\Windows\System\paXTFXt.exe
  C:\Windows\System\paXTFXt.exe
  2⤵
  PID:3212
- C:\Windows\System\kvIZNLL.exe
  C:\Windows\System\kvIZNLL.exe
  2⤵
  PID:1976
- C:\Windows\System\XPfbbWk.exe
  C:\Windows\System\XPfbbWk.exe
  2⤵
  PID:2020
- C:\Windows\System\wmmYvoJ.exe
  C:\Windows\System\wmmYvoJ.exe
  2⤵
  PID:4036
- C:\Windows\System\AIepXxF.exe
  C:\Windows\System\AIepXxF.exe
  2⤵
  PID:4212
- C:\Windows\System\SUPGqsn.exe
  C:\Windows\System\SUPGqsn.exe
  2⤵
  PID:4240
- C:\Windows\System\DVbXqZW.exe
  C:\Windows\System\DVbXqZW.exe
  2⤵
  PID:4304
- C:\Windows\System\BwqpiRj.exe
  C:\Windows\System\BwqpiRj.exe
  2⤵
  PID:3996
- C:\Windows\System\czXDBrC.exe
  C:\Windows\System\czXDBrC.exe
  2⤵
  PID:4104
- C:\Windows\System\mRQugAj.exe
  C:\Windows\System\mRQugAj.exe
  2⤵
  PID:2820
- C:\Windows\System\aJzgzsh.exe
  C:\Windows\System\aJzgzsh.exe
  2⤵
  PID:4168
- C:\Windows\System\VWMrrFP.exe
  C:\Windows\System\VWMrrFP.exe
  2⤵
  PID:4188
- C:\Windows\System\wNIcpLb.exe
  C:\Windows\System\wNIcpLb.exe
  2⤵
  PID:4256
- C:\Windows\System\zNmRkMU.exe
  C:\Windows\System\zNmRkMU.exe
  2⤵
  PID:4352
- C:\Windows\System\clxpPwQ.exe
  C:\Windows\System\clxpPwQ.exe
  2⤵
  PID:4420
- C:\Windows\System\JHiICPp.exe
  C:\Windows\System\JHiICPp.exe
  2⤵
  PID:4680
- C:\Windows\System\ykLzzFt.exe
  C:\Windows\System\ykLzzFt.exe
  2⤵
  PID:4744
- C:\Windows\System\ianhITt.exe
  C:\Windows\System\ianhITt.exe
  2⤵
  PID:4436
- C:\Windows\System\GrCKucw.exe
  C:\Windows\System\GrCKucw.exe
  2⤵
  PID:2728
- C:\Windows\System\VyVhhQF.exe
  C:\Windows\System\VyVhhQF.exe
  2⤵
  PID:5044
- C:\Windows\System\JpqxQdv.exe
  C:\Windows\System\JpqxQdv.exe
  2⤵
  PID:4760
- C:\Windows\System\NRpzPdA.exe
  C:\Windows\System\NRpzPdA.exe
  2⤵
  PID:2620
- C:\Windows\System\PmOnoYL.exe
  C:\Windows\System\PmOnoYL.exe
  2⤵
  PID:4996
- C:\Windows\System\NANoCDY.exe
  C:\Windows\System\NANoCDY.exe
  2⤵
  PID:2872
- C:\Windows\System\WQaDFVj.exe
  C:\Windows\System\WQaDFVj.exe
  2⤵
  PID:2364
- C:\Windows\System\pEexPXI.exe
  C:\Windows\System\pEexPXI.exe
  2⤵
  PID:240
- C:\Windows\System\sLrifFt.exe
  C:\Windows\System\sLrifFt.exe
  2⤵
  PID:4092
- C:\Windows\System\GhVpofx.exe
  C:\Windows\System\GhVpofx.exe
  2⤵
  PID:3164
- C:\Windows\System\tSUEyOv.exe
  C:\Windows\System\tSUEyOv.exe
  2⤵
  PID:3200
- C:\Windows\System\NOiNoQD.exe
  C:\Windows\System\NOiNoQD.exe
  2⤵
  PID:5132
- C:\Windows\System\oNHbAFf.exe
  C:\Windows\System\oNHbAFf.exe
  2⤵
  PID:5148
- C:\Windows\System\NSxSIVJ.exe
  C:\Windows\System\NSxSIVJ.exe
  2⤵
  PID:5168
- C:\Windows\System\iJlNPyN.exe
  C:\Windows\System\iJlNPyN.exe
  2⤵
  PID:5184
- C:\Windows\System\WAPBGPf.exe
  C:\Windows\System\WAPBGPf.exe
  2⤵
  PID:5208
- C:\Windows\System\ScwiJdy.exe
  C:\Windows\System\ScwiJdy.exe
  2⤵
  PID:5224
- C:\Windows\System\zBNifrf.exe
  C:\Windows\System\zBNifrf.exe
  2⤵
  PID:5240
- C:\Windows\System\BBAvmtj.exe
  C:\Windows\System\BBAvmtj.exe
  2⤵
  PID:5256
- C:\Windows\System\SmVwAvH.exe
  C:\Windows\System\SmVwAvH.exe
  2⤵
  PID:5272
- C:\Windows\System\MWargzC.exe
  C:\Windows\System\MWargzC.exe
  2⤵
  PID:5288
- C:\Windows\System\fwQxuYB.exe
  C:\Windows\System\fwQxuYB.exe
  2⤵
  PID:5304
- C:\Windows\System\ocIcxuB.exe
  C:\Windows\System\ocIcxuB.exe
  2⤵
  PID:5324
- C:\Windows\System\tKdfjtQ.exe
  C:\Windows\System\tKdfjtQ.exe
  2⤵
  PID:5340
- C:\Windows\System\pKlRJNB.exe
  C:\Windows\System\pKlRJNB.exe
  2⤵
  PID:5356
- C:\Windows\System\CLnaTEE.exe
  C:\Windows\System\CLnaTEE.exe
  2⤵
  PID:5372
- C:\Windows\System\IavBfys.exe
  C:\Windows\System\IavBfys.exe
  2⤵
  PID:5388
- C:\Windows\System\knApXuw.exe
  C:\Windows\System\knApXuw.exe
  2⤵
  PID:5404
- C:\Windows\System\osKamJs.exe
  C:\Windows\System\osKamJs.exe
  2⤵
  PID:5424
- C:\Windows\System\taFtLwG.exe
  C:\Windows\System\taFtLwG.exe
  2⤵
  PID:5440
- C:\Windows\System\XWbXNri.exe
  C:\Windows\System\XWbXNri.exe
  2⤵
  PID:5456
- C:\Windows\System\bRaaUlI.exe
  C:\Windows\System\bRaaUlI.exe
  2⤵
  PID:5472
- C:\Windows\System\RriOboH.exe
  C:\Windows\System\RriOboH.exe
  2⤵
  PID:5488
- C:\Windows\System\qojVXlQ.exe
  C:\Windows\System\qojVXlQ.exe
  2⤵
  PID:5504
- C:\Windows\System\vjnhUxq.exe
  C:\Windows\System\vjnhUxq.exe
  2⤵
  PID:5520
- C:\Windows\System\VyjoaKO.exe
  C:\Windows\System\VyjoaKO.exe
  2⤵
  PID:5536
- C:\Windows\System\SfJAsSF.exe
  C:\Windows\System\SfJAsSF.exe
  2⤵
  PID:5552
- C:\Windows\System\sPPQPUI.exe
  C:\Windows\System\sPPQPUI.exe
  2⤵
  PID:5668
- C:\Windows\System\vDFtWNT.exe
  C:\Windows\System\vDFtWNT.exe
  2⤵
  PID:5708
- C:\Windows\System\aATRNIs.exe
  C:\Windows\System\aATRNIs.exe
  2⤵
  PID:5724
- C:\Windows\System\SJvgArJ.exe
  C:\Windows\System\SJvgArJ.exe
  2⤵
  PID:5748
- C:\Windows\System\DuaLZKZ.exe
  C:\Windows\System\DuaLZKZ.exe
  2⤵
  PID:5764
- C:\Windows\System\ffyrymU.exe
  C:\Windows\System\ffyrymU.exe
  2⤵
  PID:5780
- C:\Windows\System\vdtdVHK.exe
  C:\Windows\System\vdtdVHK.exe
  2⤵
  PID:5796
- C:\Windows\System\YdlogPe.exe
  C:\Windows\System\YdlogPe.exe
  2⤵
  PID:5812
- C:\Windows\System\KNVgKKg.exe
  C:\Windows\System\KNVgKKg.exe
  2⤵
  PID:5828
- C:\Windows\System\sMTZvgz.exe
  C:\Windows\System\sMTZvgz.exe
  2⤵
  PID:5844
- C:\Windows\System\RdqSAmI.exe
  C:\Windows\System\RdqSAmI.exe
  2⤵
  PID:5864
- C:\Windows\System\rnBVIvw.exe
  C:\Windows\System\rnBVIvw.exe
  2⤵
  PID:5880
- C:\Windows\System\XOnxYvV.exe
  C:\Windows\System\XOnxYvV.exe
  2⤵
  PID:5904
- C:\Windows\System\zoqwGGl.exe
  C:\Windows\System\zoqwGGl.exe
  2⤵
  PID:5920
- C:\Windows\System\udyQDxS.exe
  C:\Windows\System\udyQDxS.exe
  2⤵
  PID:5936
- C:\Windows\System\AUgTGtw.exe
  C:\Windows\System\AUgTGtw.exe
  2⤵
  PID:5976
- C:\Windows\System\ArQeVQs.exe
  C:\Windows\System\ArQeVQs.exe
  2⤵
  PID:5992
- C:\Windows\System\XVHDjUK.exe
  C:\Windows\System\XVHDjUK.exe
  2⤵
  PID:6008
- C:\Windows\System\nIGinIR.exe
  C:\Windows\System\nIGinIR.exe
  2⤵
  PID:6024
- C:\Windows\System\BTyDLdt.exe
  C:\Windows\System\BTyDLdt.exe
  2⤵
  PID:6040
- C:\Windows\System\URKHRmJ.exe
  C:\Windows\System\URKHRmJ.exe
  2⤵
  PID:6056
- C:\Windows\System\qREmouG.exe
  C:\Windows\System\qREmouG.exe
  2⤵
  PID:6072
- C:\Windows\System\TLbjRZS.exe
  C:\Windows\System\TLbjRZS.exe
  2⤵
  PID:6088
- C:\Windows\System\bEkvQuW.exe
  C:\Windows\System\bEkvQuW.exe
  2⤵
  PID:6104
- C:\Windows\System\DMnagyV.exe
  C:\Windows\System\DMnagyV.exe
  2⤵
  PID:6120
- C:\Windows\System\kKZYsdy.exe
  C:\Windows\System\kKZYsdy.exe
  2⤵
  PID:6136
- C:\Windows\System\PaZMEfr.exe
  C:\Windows\System\PaZMEfr.exe
  2⤵
  PID:4448
- C:\Windows\System\GbbaIDs.exe
  C:\Windows\System\GbbaIDs.exe
  2⤵
  PID:4808
- C:\Windows\System\BHbgwuB.exe
  C:\Windows\System\BHbgwuB.exe
  2⤵
  PID:5016
- C:\Windows\System\HQLNWup.exe
  C:\Windows\System\HQLNWup.exe
  2⤵
  PID:5060
- C:\Windows\System\blqKDYd.exe
  C:\Windows\System\blqKDYd.exe
  2⤵
  PID:3572
- C:\Windows\System\rBhTLDP.exe
  C:\Windows\System\rBhTLDP.exe
  2⤵
  PID:5128
- C:\Windows\System\DKUbFAA.exe
  C:\Windows\System\DKUbFAA.exe
  2⤵
  PID:5192
- C:\Windows\System\tkMjoyi.exe
  C:\Windows\System\tkMjoyi.exe
  2⤵
  PID:3508
- C:\Windows\System\tlqxuIq.exe
  C:\Windows\System\tlqxuIq.exe
  2⤵
  PID:2456
- C:\Windows\System\mVcOXtb.exe
  C:\Windows\System\mVcOXtb.exe
  2⤵
  PID:5300
- C:\Windows\System\URgohcd.exe
  C:\Windows\System\URgohcd.exe
  2⤵
  PID:5068
- C:\Windows\System\CVfYUos.exe
  C:\Windows\System\CVfYUos.exe
  2⤵
  PID:5348
- C:\Windows\System\KeUYTmv.exe
  C:\Windows\System\KeUYTmv.exe
  2⤵
  PID:1676
- C:\Windows\System\MDOyIqS.exe
  C:\Windows\System\MDOyIqS.exe
  2⤵
  PID:1192
- C:\Windows\System\LytqyUk.exe
  C:\Windows\System\LytqyUk.exe
  2⤵
  PID:4372
- C:\Windows\System\giKgdAS.exe
  C:\Windows\System\giKgdAS.exe
  2⤵
  PID:3636
- C:\Windows\System\ulTytfi.exe
  C:\Windows\System\ulTytfi.exe
  2⤵
  PID:4740
- C:\Windows\System\sHqDJwE.exe
  C:\Windows\System\sHqDJwE.exe
  2⤵
  PID:4824
- C:\Windows\System\zniIDVP.exe
  C:\Windows\System\zniIDVP.exe
  2⤵
  PID:2172
- C:\Windows\System\OYhNQpU.exe
  C:\Windows\System\OYhNQpU.exe
  2⤵
  PID:5140
- C:\Windows\System\ZwjLKCQ.exe
  C:\Windows\System\ZwjLKCQ.exe
  2⤵
  PID:5216
- C:\Windows\System\csEYPjO.exe
  C:\Windows\System\csEYPjO.exe
  2⤵
  PID:5280
- C:\Windows\System\CMorqNJ.exe
  C:\Windows\System\CMorqNJ.exe
  2⤵
  PID:5416
- C:\Windows\System\gPLpJZe.exe
  C:\Windows\System\gPLpJZe.exe
  2⤵
  PID:5368
- C:\Windows\System\iCyxgvX.exe
  C:\Windows\System\iCyxgvX.exe
  2⤵
  PID:5432
- C:\Windows\System\gBWhWIV.exe
  C:\Windows\System\gBWhWIV.exe
  2⤵
  PID:5512
- C:\Windows\System\XSiGlCA.exe
  C:\Windows\System\XSiGlCA.exe
  2⤵
  PID:5484
- C:\Windows\System\CHOQHDy.exe
  C:\Windows\System\CHOQHDy.exe
  2⤵
  PID:5500
- C:\Windows\System\pndaPzT.exe
  C:\Windows\System\pndaPzT.exe
  2⤵
  PID:5544
- C:\Windows\System\ksHOmbC.exe
  C:\Windows\System\ksHOmbC.exe
  2⤵
  PID:5572
- C:\Windows\System\clbFcji.exe
  C:\Windows\System\clbFcji.exe
  2⤵
  PID:5592
- C:\Windows\System\fceRuUp.exe
  C:\Windows\System\fceRuUp.exe
  2⤵
  PID:5608
- C:\Windows\System\XhKtgqM.exe
  C:\Windows\System\XhKtgqM.exe
  2⤵
  PID:5612
- C:\Windows\System\GGPFcTd.exe
  C:\Windows\System\GGPFcTd.exe
  2⤵
  PID:5636
- C:\Windows\System\HWQVgaZ.exe
  C:\Windows\System\HWQVgaZ.exe
  2⤵
  PID:5656
- C:\Windows\System\GoNbpqu.exe
  C:\Windows\System\GoNbpqu.exe
  2⤵
  PID:5644
- C:\Windows\System\rrDsvqj.exe
  C:\Windows\System\rrDsvqj.exe
  2⤵
  PID:5700
- C:\Windows\System\NPFHzyj.exe
  C:\Windows\System\NPFHzyj.exe
  2⤵
  PID:5720
- C:\Windows\System\GedALfn.exe
  C:\Windows\System\GedALfn.exe
  2⤵
  PID:5792
- C:\Windows\System\XsnPCMK.exe
  C:\Windows\System\XsnPCMK.exe
  2⤵
  PID:5860
- C:\Windows\System\Xfzfinm.exe
  C:\Windows\System\Xfzfinm.exe
  2⤵
  PID:5900
- C:\Windows\System\wfStFUT.exe
  C:\Windows\System\wfStFUT.exe
  2⤵
  PID:5824
- C:\Windows\System\wNayiPX.exe
  C:\Windows\System\wNayiPX.exe
  2⤵
  PID:5964
- C:\Windows\System\EgHQRcx.exe
  C:\Windows\System\EgHQRcx.exe
  2⤵
  PID:5732
- C:\Windows\System\GcfqnBA.exe
  C:\Windows\System\GcfqnBA.exe
  2⤵
  PID:5772
- C:\Windows\System\BxPOJqt.exe
  C:\Windows\System\BxPOJqt.exe
  2⤵
  PID:5836
- C:\Windows\System\pdiUDYZ.exe
  C:\Windows\System\pdiUDYZ.exe
  2⤵
  PID:5876
- C:\Windows\System\hlqERGu.exe
  C:\Windows\System\hlqERGu.exe
  2⤵
  PID:6020
- C:\Windows\System\ohbYzOW.exe
  C:\Windows\System\ohbYzOW.exe
  2⤵
  PID:6084
- C:\Windows\System\KcAMnSw.exe
  C:\Windows\System\KcAMnSw.exe
  2⤵
  PID:6116
- C:\Windows\System\vWLRqYx.exe
  C:\Windows\System\vWLRqYx.exe
  2⤵
  PID:4192
- C:\Windows\System\LaHeYhM.exe
  C:\Windows\System\LaHeYhM.exe
  2⤵
  PID:6068
- C:\Windows\System\JnOwpWr.exe
  C:\Windows\System\JnOwpWr.exe
  2⤵
  PID:5112
- C:\Windows\System\vubQJSb.exe
  C:\Windows\System\vubQJSb.exe
  2⤵
  PID:5164
- C:\Windows\System\STRBpSY.exe
  C:\Windows\System\STRBpSY.exe
  2⤵
  PID:1472
- C:\Windows\System\EmNTNNT.exe
  C:\Windows\System\EmNTNNT.exe
  2⤵
  PID:2656
- C:\Windows\System\RbiGZNR.exe
  C:\Windows\System\RbiGZNR.exe
  2⤵
  PID:4576
- C:\Windows\System\zfdAhaQ.exe
  C:\Windows\System\zfdAhaQ.exe
  2⤵
  PID:4676
- C:\Windows\System\dzmnPVc.exe
  C:\Windows\System\dzmnPVc.exe
  2⤵
  PID:4640
- C:\Windows\System\grhSUZo.exe
  C:\Windows\System\grhSUZo.exe
  2⤵
  PID:5180
- C:\Windows\System\yyBvAqj.exe
  C:\Windows\System\yyBvAqj.exe
  2⤵
  PID:2116
- C:\Windows\System\jOkcqWQ.exe
  C:\Windows\System\jOkcqWQ.exe
  2⤵
  PID:5204
- C:\Windows\System\sWRazlH.exe
  C:\Windows\System\sWRazlH.exe
  2⤵
  PID:4564
- C:\Windows\System\PQNignD.exe
  C:\Windows\System\PQNignD.exe
  2⤵
  PID:5412
- C:\Windows\System\CxJOsRR.exe
  C:\Windows\System\CxJOsRR.exe
  2⤵
  PID:5248
- C:\Windows\System\eoxdrxU.exe
  C:\Windows\System\eoxdrxU.exe
  2⤵
  PID:5516
- C:\Windows\System\jWEuPhP.exe
  C:\Windows\System\jWEuPhP.exe
  2⤵
  PID:5620
- C:\Windows\System\gURHavV.exe
  C:\Windows\System\gURHavV.exe
  2⤵
  PID:5696
- C:\Windows\System\CfVDhSR.exe
  C:\Windows\System\CfVDhSR.exe
  2⤵
  PID:5896
- C:\Windows\System\oEeWRrU.exe
  C:\Windows\System\oEeWRrU.exe
  2⤵
  PID:5364
- C:\Windows\System\Jiortsb.exe
  C:\Windows\System\Jiortsb.exe
  2⤵
  PID:6052
- C:\Windows\System\xDBPtYi.exe
  C:\Windows\System\xDBPtYi.exe
  2⤵
  PID:5624
- C:\Windows\System\PBRRsZk.exe
  C:\Windows\System\PBRRsZk.exe
  2⤵
  PID:5532
- C:\Windows\System\gLNRpAl.exe
  C:\Windows\System\gLNRpAl.exe
  2⤵
  PID:5684
- C:\Windows\System\HMCXumR.exe
  C:\Windows\System\HMCXumR.exe
  2⤵
  PID:5932
- C:\Windows\System\XSuOzMl.exe
  C:\Windows\System\XSuOzMl.exe
  2⤵
  PID:5480
- C:\Windows\System\vbqooDN.exe
  C:\Windows\System\vbqooDN.exe
  2⤵
  PID:5808
- C:\Windows\System\aZjqjUN.exe
  C:\Windows\System\aZjqjUN.exe
  2⤵
  PID:5236
- C:\Windows\System\kguhmxW.exe
  C:\Windows\System\kguhmxW.exe
  2⤵
  PID:6004
- C:\Windows\System\oDbCTjT.exe
  C:\Windows\System\oDbCTjT.exe
  2⤵
  PID:4932
- C:\Windows\System\MJZDzLL.exe
  C:\Windows\System\MJZDzLL.exe
  2⤵
  PID:4164
- C:\Windows\System\BeVJWPB.exe
  C:\Windows\System\BeVJWPB.exe
  2⤵
  PID:5548
- C:\Windows\System\csxjeMb.exe
  C:\Windows\System\csxjeMb.exe
  2⤵
  PID:1488
- C:\Windows\System\EIWiEdF.exe
  C:\Windows\System\EIWiEdF.exe
  2⤵
  PID:5628
- C:\Windows\System\FzxchkB.exe
  C:\Windows\System\FzxchkB.exe
  2⤵
  PID:6100
- C:\Windows\System\KudwLtv.exe
  C:\Windows\System\KudwLtv.exe
  2⤵
  PID:6064
- C:\Windows\System\JVYzLRB.exe
  C:\Windows\System\JVYzLRB.exe
  2⤵
  PID:5380
- C:\Windows\System\eSxDdhb.exe
  C:\Windows\System\eSxDdhb.exe
  2⤵
  PID:5268
- C:\Windows\System\hKlPkLz.exe
  C:\Windows\System\hKlPkLz.exe
  2⤵
  PID:5804
- C:\Windows\System\ntIHJnL.exe
  C:\Windows\System\ntIHJnL.exe
  2⤵
  PID:6036
- C:\Windows\System\zLfGDiZ.exe
  C:\Windows\System\zLfGDiZ.exe
  2⤵
  PID:6080
- C:\Windows\System\MNtNUMz.exe
  C:\Windows\System\MNtNUMz.exe
  2⤵
  PID:5676
- C:\Windows\System\WNXBQnt.exe
  C:\Windows\System\WNXBQnt.exe
  2⤵
  PID:6112
- C:\Windows\System\hcPdJpI.exe
  C:\Windows\System\hcPdJpI.exe
  2⤵
  PID:5840
- C:\Windows\System\HBtsKNO.exe
  C:\Windows\System\HBtsKNO.exe
  2⤵
  PID:5956
- C:\Windows\System\uCQiLOt.exe
  C:\Windows\System\uCQiLOt.exe
  2⤵
  PID:448
- C:\Windows\System\BsMzLcR.exe
  C:\Windows\System\BsMzLcR.exe
  2⤵
  PID:1016
- C:\Windows\System\MyxWqNB.exe
  C:\Windows\System\MyxWqNB.exe
  2⤵
  PID:5448
- C:\Windows\System\uToiJYb.exe
  C:\Windows\System\uToiJYb.exe
  2⤵
  PID:5892
- C:\Windows\System\VevgbNX.exe
  C:\Windows\System\VevgbNX.exe
  2⤵
  PID:5988
- C:\Windows\System\ipsHWmW.exe
  C:\Windows\System\ipsHWmW.exe
  2⤵
  PID:5872
- C:\Windows\System\BtEXRri.exe
  C:\Windows\System\BtEXRri.exe
  2⤵
  PID:5688
- C:\Windows\System\UiDloYt.exe
  C:\Windows\System\UiDloYt.exe
  2⤵
  PID:6096
- C:\Windows\System\UAjEiFT.exe
  C:\Windows\System\UAjEiFT.exe
  2⤵
  PID:5856
- C:\Windows\System\xUlBCLF.exe
  C:\Windows\System\xUlBCLF.exe
  2⤵
  PID:6156
- C:\Windows\System\JueZrEs.exe
  C:\Windows\System\JueZrEs.exe
  2⤵
  PID:6172
- C:\Windows\System\KkpNPCT.exe
  C:\Windows\System\KkpNPCT.exe
  2⤵
  PID:6188
- C:\Windows\System\txcXyuU.exe
  C:\Windows\System\txcXyuU.exe
  2⤵
  PID:6204
- C:\Windows\System\tgqiHiP.exe
  C:\Windows\System\tgqiHiP.exe
  2⤵
  PID:6220
- C:\Windows\System\YEvDmrB.exe
  C:\Windows\System\YEvDmrB.exe
  2⤵
  PID:6252
- C:\Windows\System\HNnduyY.exe
  C:\Windows\System\HNnduyY.exe
  2⤵
  PID:6272
- C:\Windows\System\TVczapm.exe
  C:\Windows\System\TVczapm.exe
  2⤵
  PID:6288
- C:\Windows\System\YpfNhzt.exe
  C:\Windows\System\YpfNhzt.exe
  2⤵
  PID:6304
- C:\Windows\System\lGnaDEm.exe
  C:\Windows\System\lGnaDEm.exe
  2⤵
  PID:6324
- C:\Windows\System\tNOKLCW.exe
  C:\Windows\System\tNOKLCW.exe
  2⤵
  PID:6340
- C:\Windows\System\RcRFrMG.exe
  C:\Windows\System\RcRFrMG.exe
  2⤵
  PID:6356
- C:\Windows\System\wWPWmdP.exe
  C:\Windows\System\wWPWmdP.exe
  2⤵
  PID:6376
- C:\Windows\System\AjiVwcm.exe
  C:\Windows\System\AjiVwcm.exe
  2⤵
  PID:6392
- C:\Windows\System\tRgKEoz.exe
  C:\Windows\System\tRgKEoz.exe
  2⤵
  PID:6408
- C:\Windows\System\eKvnzwp.exe
  C:\Windows\System\eKvnzwp.exe
  2⤵
  PID:6424
- C:\Windows\System\JIRCfHJ.exe
  C:\Windows\System\JIRCfHJ.exe
  2⤵
  PID:6444
- C:\Windows\System\CTpEJih.exe
  C:\Windows\System\CTpEJih.exe
  2⤵
  PID:6460
- C:\Windows\System\XodflFL.exe
  C:\Windows\System\XodflFL.exe
  2⤵
  PID:6476
- C:\Windows\System\iNHRWbw.exe
  C:\Windows\System\iNHRWbw.exe
  2⤵
  PID:6492
- C:\Windows\System\lePhUaj.exe
  C:\Windows\System\lePhUaj.exe
  2⤵
  PID:6508
- C:\Windows\System\qmktKnq.exe
  C:\Windows\System\qmktKnq.exe
  2⤵
  PID:6604
- C:\Windows\System\MkXMAPc.exe
  C:\Windows\System\MkXMAPc.exe
  2⤵
  PID:6620
- C:\Windows\System\EhVPpJN.exe
  C:\Windows\System\EhVPpJN.exe
  2⤵
  PID:6636
- C:\Windows\System\jkRMvYE.exe
  C:\Windows\System\jkRMvYE.exe
  2⤵
  PID:6652
- C:\Windows\System\VODtkep.exe
  C:\Windows\System\VODtkep.exe
  2⤵
  PID:6668
- C:\Windows\System\vYrZydJ.exe
  C:\Windows\System\vYrZydJ.exe
  2⤵
  PID:6684
- C:\Windows\System\tZXXzyk.exe
  C:\Windows\System\tZXXzyk.exe
  2⤵
  PID:6700
- C:\Windows\System\odQzlLM.exe
  C:\Windows\System\odQzlLM.exe
  2⤵
  PID:6720
- C:\Windows\System\PWSWztO.exe
  C:\Windows\System\PWSWztO.exe
  2⤵
  PID:6736
- C:\Windows\System\uGFKbfA.exe
  C:\Windows\System\uGFKbfA.exe
  2⤵
  PID:6752
- C:\Windows\System\TNZjLbH.exe
  C:\Windows\System\TNZjLbH.exe
  2⤵
  PID:6768
- C:\Windows\System\esCtKvX.exe
  C:\Windows\System\esCtKvX.exe
  2⤵
  PID:6784
- C:\Windows\System\BvAyItg.exe
  C:\Windows\System\BvAyItg.exe
  2⤵
  PID:6800
- C:\Windows\System\ICDjrhD.exe
  C:\Windows\System\ICDjrhD.exe
  2⤵
  PID:6820
- C:\Windows\System\bcWKxMP.exe
  C:\Windows\System\bcWKxMP.exe
  2⤵
  PID:6848
- C:\Windows\System\AOyPfQu.exe
  C:\Windows\System\AOyPfQu.exe
  2⤵
  PID:6864
- C:\Windows\System\mRjOqzJ.exe
  C:\Windows\System\mRjOqzJ.exe
  2⤵
  PID:6884
- C:\Windows\System\gzXdXqj.exe
  C:\Windows\System\gzXdXqj.exe
  2⤵
  PID:6900
- C:\Windows\System\ViBpYWR.exe
  C:\Windows\System\ViBpYWR.exe
  2⤵
  PID:6916
- C:\Windows\System\HkCBdxo.exe
  C:\Windows\System\HkCBdxo.exe
  2⤵
  PID:6932
- C:\Windows\System\qbxCVlM.exe
  C:\Windows\System\qbxCVlM.exe
  2⤵
  PID:6952
- C:\Windows\System\joXRAdk.exe
  C:\Windows\System\joXRAdk.exe
  2⤵
  PID:6968
- C:\Windows\System\wKjoCLk.exe
  C:\Windows\System\wKjoCLk.exe
  2⤵
  PID:6984
- C:\Windows\System\omwzTJQ.exe
  C:\Windows\System\omwzTJQ.exe
  2⤵
  PID:7000
- C:\Windows\System\SKhtWrA.exe
  C:\Windows\System\SKhtWrA.exe
  2⤵
  PID:7016
- C:\Windows\System\DHJSHzX.exe
  C:\Windows\System\DHJSHzX.exe
  2⤵
  PID:7032
- C:\Windows\System\pUGlASB.exe
  C:\Windows\System\pUGlASB.exe
  2⤵
  PID:7048
- C:\Windows\System\VBbBwwb.exe
  C:\Windows\System\VBbBwwb.exe
  2⤵
  PID:7064
- C:\Windows\System\JCqniZP.exe
  C:\Windows\System\JCqniZP.exe
  2⤵
  PID:7088
- C:\Windows\System\UsDedWC.exe
  C:\Windows\System\UsDedWC.exe
  2⤵
  PID:7104
- C:\Windows\System\yIZljfn.exe
  C:\Windows\System\yIZljfn.exe
  2⤵
  PID:7120
- C:\Windows\System\izViHem.exe
  C:\Windows\System\izViHem.exe
  2⤵
  PID:7136
- C:\Windows\System\MCKJXBP.exe
  C:\Windows\System\MCKJXBP.exe
  2⤵
  PID:7152
- C:\Windows\System\VnLldLc.exe
  C:\Windows\System\VnLldLc.exe
  2⤵
  PID:6148
- C:\Windows\System\FaYQHpp.exe
  C:\Windows\System\FaYQHpp.exe
  2⤵
  PID:6212
- C:\Windows\System\VaQBOni.exe
  C:\Windows\System\VaQBOni.exe
  2⤵
  PID:5568
- C:\Windows\System\AnspFlo.exe
  C:\Windows\System\AnspFlo.exe
  2⤵
  PID:6164
- C:\Windows\System\GPbCeup.exe
  C:\Windows\System\GPbCeup.exe
  2⤵
  PID:6228
- C:\Windows\System\ACyIrQE.exe
  C:\Windows\System\ACyIrQE.exe
  2⤵
  PID:6232
- C:\Windows\System\vMNoWFc.exe
  C:\Windows\System\vMNoWFc.exe
  2⤵
  PID:6248
- C:\Windows\System\nSpjXlq.exe
  C:\Windows\System\nSpjXlq.exe
  2⤵
  PID:6368
- C:\Windows\System\pTutmdi.exe
  C:\Windows\System\pTutmdi.exe
  2⤵
  PID:6404
- C:\Windows\System\WkLvNyM.exe
  C:\Windows\System\WkLvNyM.exe
  2⤵
  PID:6468
- C:\Windows\System\tBpbqsQ.exe
  C:\Windows\System\tBpbqsQ.exe
  2⤵
  PID:6280
- C:\Windows\System\iSiLLQb.exe
  C:\Windows\System\iSiLLQb.exe
  2⤵
  PID:6320
- C:\Windows\System\tijxHFO.exe
  C:\Windows\System\tijxHFO.exe
  2⤵
  PID:6388
- C:\Windows\System\tLSsAYG.exe
  C:\Windows\System\tLSsAYG.exe
  2⤵
  PID:6452
- C:\Windows\System\YlCIwqq.exe
  C:\Windows\System\YlCIwqq.exe
  2⤵
  PID:6520
- C:\Windows\System\wCfJCZh.exe
  C:\Windows\System\wCfJCZh.exe
  2⤵
  PID:6544
- C:\Windows\System\qvQIaWG.exe
  C:\Windows\System\qvQIaWG.exe
  2⤵
  PID:6552
- C:\Windows\System\EAshTCi.exe
  C:\Windows\System\EAshTCi.exe
  2⤵
  PID:6568
- C:\Windows\System\GAiarFQ.exe
  C:\Windows\System\GAiarFQ.exe
  2⤵
  PID:6584
- C:\Windows\System\YZrepOn.exe
  C:\Windows\System\YZrepOn.exe
  2⤵
  PID:5692
- C:\Windows\System\ZufWfxH.exe
  C:\Windows\System\ZufWfxH.exe
  2⤵
  PID:6660
- C:\Windows\System\gYCXXKe.exe
  C:\Windows\System\gYCXXKe.exe
  2⤵
  PID:6696
- C:\Windows\System\zTtyksR.exe
  C:\Windows\System\zTtyksR.exe
  2⤵
  PID:6732
- C:\Windows\System\bnXqnXK.exe
  C:\Windows\System\bnXqnXK.exe
  2⤵
  PID:6680
- C:\Windows\System\XXHqkIg.exe
  C:\Windows\System\XXHqkIg.exe
  2⤵
  PID:6748
- C:\Windows\System\GqGfIor.exe
  C:\Windows\System\GqGfIor.exe
  2⤵
  PID:6812
- C:\Windows\System\KEqGZal.exe
  C:\Windows\System\KEqGZal.exe
  2⤵
  PID:6896
- C:\Windows\System\UpyZjSl.exe
  C:\Windows\System\UpyZjSl.exe
  2⤵
  PID:6924
- C:\Windows\System\vIWMCuf.exe
  C:\Windows\System\vIWMCuf.exe
  2⤵
  PID:6992
- C:\Windows\System\LJxOaYz.exe
  C:\Windows\System\LJxOaYz.exe
  2⤵
  PID:7056
- C:\Windows\System\bIaBCoF.exe
  C:\Windows\System\bIaBCoF.exe
  2⤵
  PID:7040
- C:\Windows\System\ZSBfzJi.exe
  C:\Windows\System\ZSBfzJi.exe
  2⤵
  PID:6828
- C:\Windows\System\YkCYeQX.exe
  C:\Windows\System\YkCYeQX.exe
  2⤵
  PID:6844
- C:\Windows\System\GZPFJFs.exe
  C:\Windows\System\GZPFJFs.exe
  2⤵
  PID:6944
- C:\Windows\System\lpTTSzz.exe
  C:\Windows\System\lpTTSzz.exe
  2⤵
  PID:6880
- C:\Windows\System\feqTKKe.exe
  C:\Windows\System\feqTKKe.exe
  2⤵
  PID:7100
- C:\Windows\System\wqhboXA.exe
  C:\Windows\System\wqhboXA.exe
  2⤵
  PID:7080
- C:\Windows\System\pjaNmJa.exe
  C:\Windows\System\pjaNmJa.exe
  2⤵
  PID:4416
- C:\Windows\System\VVbBSwZ.exe
  C:\Windows\System\VVbBSwZ.exe
  2⤵
  PID:6296
- C:\Windows\System\AbFOBzM.exe
  C:\Windows\System\AbFOBzM.exe
  2⤵
  PID:5616
- C:\Windows\System\DMaPWNE.exe
  C:\Windows\System\DMaPWNE.exe
  2⤵
  PID:6400
- C:\Windows\System\GSofArw.exe
  C:\Windows\System\GSofArw.exe
  2⤵
  PID:6240
- C:\Windows\System\vyuZkPz.exe
  C:\Windows\System\vyuZkPz.exe
  2⤵
  PID:6264
- C:\Windows\System\ucCNRCr.exe
  C:\Windows\System\ucCNRCr.exe
  2⤵
  PID:6352
- C:\Windows\System\KHeGbRZ.exe
  C:\Windows\System\KHeGbRZ.exe
  2⤵
  PID:6548
- C:\Windows\System\HjGoMOV.exe
  C:\Windows\System\HjGoMOV.exe
  2⤵
  PID:6580
- C:\Windows\System\gBCQfYa.exe
  C:\Windows\System\gBCQfYa.exe
  2⤵
  PID:6728
- C:\Windows\System\bVGxMUJ.exe
  C:\Windows\System\bVGxMUJ.exe
  2⤵
  PID:6644
- C:\Windows\System\AvRrSqa.exe
  C:\Windows\System\AvRrSqa.exe
  2⤵
  PID:6592
- C:\Windows\System\MtPMxPc.exe
  C:\Windows\System\MtPMxPc.exe
  2⤵
  PID:6632
- C:\Windows\System\bzOiXwR.exe
  C:\Windows\System\bzOiXwR.exe
  2⤵
  PID:6796
- C:\Windows\System\DhFdiWS.exe
  C:\Windows\System\DhFdiWS.exe
  2⤵
  PID:6960
- C:\Windows\System\bLMInqe.exe
  C:\Windows\System\bLMInqe.exe
  2⤵
  PID:6676
- C:\Windows\System\VUSxqQd.exe
  C:\Windows\System\VUSxqQd.exe
  2⤵
  PID:6836
- C:\Windows\System\OngotGe.exe
  C:\Windows\System\OngotGe.exe
  2⤵
  PID:7012
- C:\Windows\System\fqrGgrT.exe
  C:\Windows\System\fqrGgrT.exe
  2⤵
  PID:7132
- C:\Windows\System\tqyagdM.exe
  C:\Windows\System\tqyagdM.exe
  2⤵
  PID:6184
- C:\Windows\System\SQhAnlb.exe
  C:\Windows\System\SQhAnlb.exe
  2⤵
  PID:6484
- C:\Windows\System\oPokLqk.exe
  C:\Windows\System\oPokLqk.exe
  2⤵
  PID:6760
- C:\Windows\System\zsxSota.exe
  C:\Windows\System\zsxSota.exe
  2⤵
  PID:6764
- C:\Windows\System\fAmnarY.exe
  C:\Windows\System\fAmnarY.exe
  2⤵
  PID:6372
- C:\Windows\System\PoinnZR.exe
  C:\Windows\System\PoinnZR.exe
  2⤵
  PID:6560
- C:\Windows\System\PrsVUpi.exe
  C:\Windows\System\PrsVUpi.exe
  2⤵
  PID:7148
- C:\Windows\System\dPDdOhG.exe
  C:\Windows\System\dPDdOhG.exe
  2⤵
  PID:6528
- C:\Windows\System\DBykXLl.exe
  C:\Windows\System\DBykXLl.exe
  2⤵
  PID:6892
- C:\Windows\System\vpUSqxC.exe
  C:\Windows\System\vpUSqxC.exe
  2⤵
  PID:7184
- C:\Windows\System\abkkBDY.exe
  C:\Windows\System\abkkBDY.exe
  2⤵
  PID:7200
- C:\Windows\System\VJDvWxa.exe
  C:\Windows\System\VJDvWxa.exe
  2⤵
  PID:7216
- C:\Windows\System\kyEbCmg.exe
  C:\Windows\System\kyEbCmg.exe
  2⤵
  PID:7232
- C:\Windows\System\qLBRxnD.exe
  C:\Windows\System\qLBRxnD.exe
  2⤵
  PID:7248
- C:\Windows\System\FQfWQLo.exe
  C:\Windows\System\FQfWQLo.exe
  2⤵
  PID:7264
- C:\Windows\System\PrRfhkq.exe
  C:\Windows\System\PrRfhkq.exe
  2⤵
  PID:7280
- C:\Windows\System\uNNIzlK.exe
  C:\Windows\System\uNNIzlK.exe
  2⤵
  PID:7296
- C:\Windows\System\bCwxYVt.exe
  C:\Windows\System\bCwxYVt.exe
  2⤵
  PID:7312
- C:\Windows\System\rABSFCU.exe
  C:\Windows\System\rABSFCU.exe
  2⤵
  PID:7328
- C:\Windows\System\rQAPxmV.exe
  C:\Windows\System\rQAPxmV.exe
  2⤵
  PID:7344
- C:\Windows\System\ziLkPGS.exe
  C:\Windows\System\ziLkPGS.exe
  2⤵
  PID:7360
- C:\Windows\System\ZDFbQUz.exe
  C:\Windows\System\ZDFbQUz.exe
  2⤵
  PID:7376
- C:\Windows\System\SnuHrlT.exe
  C:\Windows\System\SnuHrlT.exe
  2⤵
  PID:7392
- C:\Windows\System\KPlzvQl.exe
  C:\Windows\System\KPlzvQl.exe
  2⤵
  PID:7412
- C:\Windows\System\UZPGrRm.exe
  C:\Windows\System\UZPGrRm.exe
  2⤵
  PID:7428
- C:\Windows\System\xmbkoPr.exe
  C:\Windows\System\xmbkoPr.exe
  2⤵
  PID:7448
- C:\Windows\System\eRiYddg.exe
  C:\Windows\System\eRiYddg.exe
  2⤵
  PID:7464
- C:\Windows\System\LhDgZDy.exe
  C:\Windows\System\LhDgZDy.exe
  2⤵
  PID:7480
- C:\Windows\System\mXPznpZ.exe
  C:\Windows\System\mXPznpZ.exe
  2⤵
  PID:7500
- C:\Windows\System\mpxLVGR.exe
  C:\Windows\System\mpxLVGR.exe
  2⤵
  PID:7516
- C:\Windows\System\BQDFbKu.exe
  C:\Windows\System\BQDFbKu.exe
  2⤵
  PID:7532
- C:\Windows\System\PXujhLT.exe
  C:\Windows\System\PXujhLT.exe
  2⤵
  PID:7548
- C:\Windows\System\YDafaTY.exe
  C:\Windows\System\YDafaTY.exe
  2⤵
  PID:7564
- C:\Windows\System\McdfdtW.exe
  C:\Windows\System\McdfdtW.exe
  2⤵
  PID:7584
- C:\Windows\System\hsSKWza.exe
  C:\Windows\System\hsSKWza.exe
  2⤵
  PID:7604
- C:\Windows\System\FDbdiUj.exe
  C:\Windows\System\FDbdiUj.exe
  2⤵
  PID:7620
- C:\Windows\System\FMqcnQr.exe
  C:\Windows\System\FMqcnQr.exe
  2⤵
  PID:7640
- C:\Windows\System\AWwADwM.exe
  C:\Windows\System\AWwADwM.exe
  2⤵
  PID:7656
- C:\Windows\System\BqNfhuF.exe
  C:\Windows\System\BqNfhuF.exe
  2⤵
  PID:7672
- C:\Windows\System\zNqNLgV.exe
  C:\Windows\System\zNqNLgV.exe
  2⤵
  PID:7688
- C:\Windows\System\QNFyact.exe
  C:\Windows\System\QNFyact.exe
  2⤵
  PID:7708
- C:\Windows\System\mMffMGP.exe
  C:\Windows\System\mMffMGP.exe
  2⤵
  PID:7724
- C:\Windows\System\hufdYoX.exe
  C:\Windows\System\hufdYoX.exe
  2⤵
  PID:7740
- C:\Windows\System\uLmIumh.exe
  C:\Windows\System\uLmIumh.exe
  2⤵
  PID:7756
- C:\Windows\System\mOBKvhr.exe
  C:\Windows\System\mOBKvhr.exe
  2⤵
  PID:7772
- C:\Windows\System\KaCaLKf.exe
  C:\Windows\System\KaCaLKf.exe
  2⤵
  PID:7788
- C:\Windows\System\aCTRpLd.exe
  C:\Windows\System\aCTRpLd.exe
  2⤵
  PID:7812
- C:\Windows\System\bDieuHq.exe
  C:\Windows\System\bDieuHq.exe
  2⤵
  PID:7832
- C:\Windows\System\wfYWLTr.exe
  C:\Windows\System\wfYWLTr.exe
  2⤵
  PID:7848
- C:\Windows\System\gGJPVwa.exe
  C:\Windows\System\gGJPVwa.exe
  2⤵
  PID:7864
- C:\Windows\System\pspltkg.exe
  C:\Windows\System\pspltkg.exe
  2⤵
  PID:7880
- C:\Windows\System\aauKgLI.exe
  C:\Windows\System\aauKgLI.exe
  2⤵
  PID:7896
- C:\Windows\System\qbnSTzH.exe
  C:\Windows\System\qbnSTzH.exe
  2⤵
  PID:7912
- C:\Windows\System\XvjpskF.exe
  C:\Windows\System\XvjpskF.exe
  2⤵
  PID:7928
- C:\Windows\System\wCKzFyc.exe
  C:\Windows\System\wCKzFyc.exe
  2⤵
  PID:7944
- C:\Windows\System\SMvhyVK.exe
  C:\Windows\System\SMvhyVK.exe
  2⤵
  PID:7960
- C:\Windows\System\MpwEiRQ.exe
  C:\Windows\System\MpwEiRQ.exe
  2⤵
  PID:7980
- C:\Windows\System\kfjTFhr.exe
  C:\Windows\System\kfjTFhr.exe
  2⤵
  PID:8000
- C:\Windows\System\OoUYlcX.exe
  C:\Windows\System\OoUYlcX.exe
  2⤵
  PID:8016
- C:\Windows\System\zLKOMTP.exe
  C:\Windows\System\zLKOMTP.exe
  2⤵
  PID:8032
- C:\Windows\System\ViLzddR.exe
  C:\Windows\System\ViLzddR.exe
  2⤵
  PID:8048
- C:\Windows\System\lodIDlR.exe
  C:\Windows\System\lodIDlR.exe
  2⤵
  PID:8064
- C:\Windows\System\URkguBe.exe
  C:\Windows\System\URkguBe.exe
  2⤵
  PID:8080
- C:\Windows\System\mxozqki.exe
  C:\Windows\System\mxozqki.exe
  2⤵
  PID:8096
- C:\Windows\System\qGkdWSD.exe
  C:\Windows\System\qGkdWSD.exe
  2⤵
  PID:8112
- C:\Windows\System\woPmeou.exe
  C:\Windows\System\woPmeou.exe
  2⤵
  PID:8132
- C:\Windows\System\bIkWepF.exe
  C:\Windows\System\bIkWepF.exe
  2⤵
  PID:8148
- C:\Windows\System\wPxaUFY.exe
  C:\Windows\System\wPxaUFY.exe
  2⤵
  PID:8164
- C:\Windows\System\ILbsGyv.exe
  C:\Windows\System\ILbsGyv.exe
  2⤵
  PID:8180
- C:\Windows\System\PKrHFrN.exe
  C:\Windows\System\PKrHFrN.exe
  2⤵
  PID:6912
- C:\Windows\System\LYoTaGg.exe
  C:\Windows\System\LYoTaGg.exe
  2⤵
  PID:6196
- C:\Windows\System\rQTovLb.exe
  C:\Windows\System\rQTovLb.exe
  2⤵
  PID:6576
- C:\Windows\System\pJqFyzA.exe
  C:\Windows\System\pJqFyzA.exe
  2⤵
  PID:6532
- C:\Windows\System\qARUSzn.exe
  C:\Windows\System\qARUSzn.exe
  2⤵
  PID:6872
- C:\Windows\System\IDWnUpi.exe
  C:\Windows\System\IDWnUpi.exe
  2⤵
  PID:6964
- C:\Windows\System\dgfiBoa.exe
  C:\Windows\System\dgfiBoa.exe
  2⤵
  PID:7228
- C:\Windows\System\fMcQiHQ.exe
  C:\Windows\System\fMcQiHQ.exe
  2⤵
  PID:7180
- C:\Windows\System\YoJYoYR.exe
  C:\Windows\System\YoJYoYR.exe
  2⤵
  PID:7244
- C:\Windows\System\qJhvskH.exe
  C:\Windows\System\qJhvskH.exe
  2⤵
  PID:7320
- C:\Windows\System\YHHbiEv.exe
  C:\Windows\System\YHHbiEv.exe
  2⤵
  PID:7356
- C:\Windows\System\OltoInD.exe
  C:\Windows\System\OltoInD.exe
  2⤵
  PID:6816
- C:\Windows\System\BYBXHZU.exe
  C:\Windows\System\BYBXHZU.exe
  2⤵
  PID:7460
- C:\Windows\System\ifHIIdV.exe
  C:\Windows\System\ifHIIdV.exe
  2⤵
  PID:7404
- C:\Windows\System\jmVRwgR.exe
  C:\Windows\System\jmVRwgR.exe
  2⤵
  PID:7524
- C:\Windows\System\FKawOgz.exe
  C:\Windows\System\FKawOgz.exe
  2⤵
  PID:7652
- C:\Windows\System\RAwtBrC.exe
  C:\Windows\System\RAwtBrC.exe
  2⤵
  PID:7720
- C:\Windows\System\cOvRMLC.exe
  C:\Windows\System\cOvRMLC.exe
  2⤵
  PID:7668
- C:\Windows\System\KfBJaYT.exe
  C:\Windows\System\KfBJaYT.exe
  2⤵
  PID:7736
- C:\Windows\System\JVCWbYh.exe
  C:\Windows\System\JVCWbYh.exe
  2⤵
  PID:7800
- C:\Windows\System\dLkTQmx.exe
  C:\Windows\System\dLkTQmx.exe
  2⤵
  PID:7840
- C:\Windows\System\LWyiaSA.exe
  C:\Windows\System\LWyiaSA.exe
  2⤵
  PID:7828
- C:\Windows\System\xnosmGU.exe
  C:\Windows\System\xnosmGU.exe
  2⤵
  PID:7904
- C:\Windows\System\lnioTeM.exe
  C:\Windows\System\lnioTeM.exe
  2⤵
  PID:7888
- C:\Windows\System\orchhOm.exe
  C:\Windows\System\orchhOm.exe
  2⤵
  PID:7968
- C:\Windows\System\XzNVgzy.exe
  C:\Windows\System\XzNVgzy.exe
  2⤵
  PID:8012
- C:\Windows\System\glcAflw.exe
  C:\Windows\System\glcAflw.exe
  2⤵
  PID:8076
- C:\Windows\System\SgbHtuD.exe
  C:\Windows\System\SgbHtuD.exe
  2⤵
  PID:8144
- C:\Windows\System\TRqfSTp.exe
  C:\Windows\System\TRqfSTp.exe
  2⤵
  PID:6980
- C:\Windows\System\yiRXzsw.exe
  C:\Windows\System\yiRXzsw.exe
  2⤵
  PID:6436
- C:\Windows\System\bPdSeZB.exe
  C:\Windows\System\bPdSeZB.exe
  2⤵
  PID:7996
- C:\Windows\System\gGNhLXE.exe
  C:\Windows\System\gGNhLXE.exe
  2⤵
  PID:8092
- C:\Windows\System\BgzZVjo.exe
  C:\Windows\System\BgzZVjo.exe
  2⤵
  PID:7952
- C:\Windows\System\zNdQerJ.exe
  C:\Windows\System\zNdQerJ.exe
  2⤵
  PID:8128
- C:\Windows\System\qjtjHNO.exe
  C:\Windows\System\qjtjHNO.exe
  2⤵
  PID:7008
- C:\Windows\System\gbJCQXm.exe
  C:\Windows\System\gbJCQXm.exe
  2⤵
  PID:7196
- C:\Windows\System\syOVTwK.exe
  C:\Windows\System\syOVTwK.exe
  2⤵
  PID:7176
- C:\Windows\System\jyvsLmc.exe
  C:\Windows\System\jyvsLmc.exe
  2⤵
  PID:7388
- C:\Windows\System\zcyisNT.exe
  C:\Windows\System\zcyisNT.exe
  2⤵
  PID:7240
- C:\Windows\System\qGZtogX.exe
  C:\Windows\System\qGZtogX.exe
  2⤵
  PID:7400
- C:\Windows\System\xiyIFba.exe
  C:\Windows\System\xiyIFba.exe
  2⤵
  PID:7340
- C:\Windows\System\fPUfyuj.exe
  C:\Windows\System\fPUfyuj.exe
  2⤵
  PID:7544
- C:\Windows\System\TuWaTsy.exe
  C:\Windows\System\TuWaTsy.exe
  2⤵
  PID:7436
- C:\Windows\System\wTusKXI.exe
  C:\Windows\System\wTusKXI.exe
  2⤵
  PID:7476
- C:\Windows\System\aVsYhXd.exe
  C:\Windows\System\aVsYhXd.exe
  2⤵
  PID:7572
- C:\Windows\System\xQaWSmh.exe
  C:\Windows\System\xQaWSmh.exe
  2⤵
  PID:7648
- C:\Windows\System\fduNUOg.exe
  C:\Windows\System\fduNUOg.exe
  2⤵
  PID:7664
- C:\Windows\System\crAmuRf.exe
  C:\Windows\System\crAmuRf.exe
  2⤵
  PID:7704
- C:\Windows\System\PctviFH.exe
  C:\Windows\System\PctviFH.exe
  2⤵
  PID:7820
- C:\Windows\System\UAbEdol.exe
  C:\Windows\System\UAbEdol.exe
  2⤵
  PID:7892
- C:\Windows\System\fNjhgkM.exe
  C:\Windows\System\fNjhgkM.exe
  2⤵
  PID:7876
- C:\Windows\System\DHXjEnY.exe
  C:\Windows\System\DHXjEnY.exe
  2⤵
  PID:8108
- C:\Windows\System\vAOiBNv.exe
  C:\Windows\System\vAOiBNv.exe
  2⤵
  PID:6628
- C:\Windows\System\iVhSCla.exe
  C:\Windows\System\iVhSCla.exe
  2⤵
  PID:7988
- C:\Windows\System\brbpZWe.exe
  C:\Windows\System\brbpZWe.exe
  2⤵
  PID:6780
- C:\Windows\System\NPNqehY.exe
  C:\Windows\System\NPNqehY.exe
  2⤵
  PID:7212
- C:\Windows\System\MYMxpcU.exe
  C:\Windows\System\MYMxpcU.exe
  2⤵
  PID:7560
- C:\Windows\System\ONJJEzl.exe
  C:\Windows\System\ONJJEzl.exe
  2⤵
  PID:7956
- C:\Windows\System\WXXAYaN.exe
  C:\Windows\System\WXXAYaN.exe
  2⤵
  PID:7424
- C:\Windows\System\zPTSOTp.exe
  C:\Windows\System\zPTSOTp.exe
  2⤵
  PID:7444
- C:\Windows\System\ZXjUcFG.exe
  C:\Windows\System\ZXjUcFG.exe
  2⤵
  PID:7636
- C:\Windows\System\pYhdZVD.exe
  C:\Windows\System\pYhdZVD.exe
  2⤵
  PID:7716
- C:\Windows\System\BMVhtsx.exe
  C:\Windows\System\BMVhtsx.exe
  2⤵
  PID:7540
- C:\Windows\System\uNnYjGv.exe
  C:\Windows\System\uNnYjGv.exe
  2⤵
  PID:8008
- C:\Windows\System\gwdVscJ.exe
  C:\Windows\System\gwdVscJ.exe
  2⤵
  PID:7924
- C:\Windows\System\eKcGyTA.exe
  C:\Windows\System\eKcGyTA.exe
  2⤵
  PID:6316
- C:\Windows\System\DrxAlCD.exe
  C:\Windows\System\DrxAlCD.exe
  2⤵
  PID:8124
- C:\Windows\System\utCpauO.exe
  C:\Windows\System\utCpauO.exe
  2⤵
  PID:8200
- C:\Windows\System\WuqGNRd.exe
  C:\Windows\System\WuqGNRd.exe
  2⤵
  PID:8220
- C:\Windows\System\RimqmnZ.exe
  C:\Windows\System\RimqmnZ.exe
  2⤵
  PID:8236
- C:\Windows\System\tYIwiKF.exe
  C:\Windows\System\tYIwiKF.exe
  2⤵
  PID:8252
- C:\Windows\System\gdTtNtE.exe
  C:\Windows\System\gdTtNtE.exe
  2⤵
  PID:8268
- C:\Windows\System\lnWGVcR.exe
  C:\Windows\System\lnWGVcR.exe
  2⤵
  PID:8284
- C:\Windows\System\ToUyGpN.exe
  C:\Windows\System\ToUyGpN.exe
  2⤵
  PID:8304
- C:\Windows\System\DlMnGFB.exe
  C:\Windows\System\DlMnGFB.exe
  2⤵
  PID:8320
- C:\Windows\System\eFuywFA.exe
  C:\Windows\System\eFuywFA.exe
  2⤵
  PID:8336
- C:\Windows\System\cNIVdii.exe
  C:\Windows\System\cNIVdii.exe
  2⤵
  PID:8352
- C:\Windows\System\rxwHjlm.exe
  C:\Windows\System\rxwHjlm.exe
  2⤵
  PID:8372
- C:\Windows\System\XaUVJBg.exe
  C:\Windows\System\XaUVJBg.exe
  2⤵
  PID:8388
- C:\Windows\System\SZkHyDF.exe
  C:\Windows\System\SZkHyDF.exe
  2⤵
  PID:8404
- C:\Windows\System\QdwgkeA.exe
  C:\Windows\System\QdwgkeA.exe
  2⤵
  PID:8424
- C:\Windows\System\ROcZaRt.exe
  C:\Windows\System\ROcZaRt.exe
  2⤵
  PID:8440
- C:\Windows\System\PHsXeBh.exe
  C:\Windows\System\PHsXeBh.exe
  2⤵
  PID:8456
- C:\Windows\System\euNccFv.exe
  C:\Windows\System\euNccFv.exe
  2⤵
  PID:8472
- C:\Windows\System\iQcDUmr.exe
  C:\Windows\System\iQcDUmr.exe
  2⤵
  PID:8556
- C:\Windows\System\COkEbHJ.exe
  C:\Windows\System\COkEbHJ.exe
  2⤵
  PID:8576
- C:\Windows\System\CJmGlhp.exe
  C:\Windows\System\CJmGlhp.exe
  2⤵
  PID:8596
- C:\Windows\System\Jeblygk.exe
  C:\Windows\System\Jeblygk.exe
  2⤵
  PID:8612
- C:\Windows\System\FKsFLmK.exe
  C:\Windows\System\FKsFLmK.exe
  2⤵
  PID:8628
- C:\Windows\System\pDVMTvY.exe
  C:\Windows\System\pDVMTvY.exe
  2⤵
  PID:8644
- C:\Windows\System\sfthNLh.exe
  C:\Windows\System\sfthNLh.exe
  2⤵
  PID:8740
- C:\Windows\System\jVEleck.exe
  C:\Windows\System\jVEleck.exe
  2⤵
  PID:8760
- C:\Windows\System\gyaMyGl.exe
  C:\Windows\System\gyaMyGl.exe
  2⤵
  PID:8776
- C:\Windows\System\MUqYArD.exe
  C:\Windows\System\MUqYArD.exe
  2⤵
  PID:8792
- C:\Windows\System\PUQmhaE.exe
  C:\Windows\System\PUQmhaE.exe
  2⤵
  PID:8808
- C:\Windows\System\loqWsbW.exe
  C:\Windows\System\loqWsbW.exe
  2⤵
  PID:8824
- C:\Windows\System\xLHouxn.exe
  C:\Windows\System\xLHouxn.exe
  2⤵
  PID:8844
- C:\Windows\System\sOmONYG.exe
  C:\Windows\System\sOmONYG.exe
  2⤵
  PID:8860
- C:\Windows\System\HEvFWav.exe
  C:\Windows\System\HEvFWav.exe
  2⤵
  PID:8876
- C:\Windows\System\vTuZTSh.exe
  C:\Windows\System\vTuZTSh.exe
  2⤵
  PID:8892
- C:\Windows\System\gjcrmDn.exe
  C:\Windows\System\gjcrmDn.exe
  2⤵
  PID:8908
- C:\Windows\System\GNcDURt.exe
  C:\Windows\System\GNcDURt.exe
  2⤵
  PID:8924
- C:\Windows\System\NrbzbKP.exe
  C:\Windows\System\NrbzbKP.exe
  2⤵
  PID:8940
- C:\Windows\System\gZOkRpr.exe
  C:\Windows\System\gZOkRpr.exe
  2⤵
  PID:8956
- C:\Windows\System\lQjRNPz.exe
  C:\Windows\System\lQjRNPz.exe
  2⤵
  PID:8972
- C:\Windows\System\EmuvwYs.exe
  C:\Windows\System\EmuvwYs.exe
  2⤵
  PID:8988
- C:\Windows\System\wdsbctG.exe
  C:\Windows\System\wdsbctG.exe
  2⤵
  PID:9004
- C:\Windows\System\wsRzeDo.exe
  C:\Windows\System\wsRzeDo.exe
  2⤵
  PID:9020
- C:\Windows\System\DXzEdSE.exe
  C:\Windows\System\DXzEdSE.exe
  2⤵
  PID:9036
- C:\Windows\System\fXinSMa.exe
  C:\Windows\System\fXinSMa.exe
  2⤵
  PID:9052
- C:\Windows\System\KhPelgq.exe
  C:\Windows\System\KhPelgq.exe
  2⤵
  PID:9068
- C:\Windows\System\jtShFNW.exe
  C:\Windows\System\jtShFNW.exe
  2⤵
  PID:9084
- C:\Windows\System\SjvASNh.exe
  C:\Windows\System\SjvASNh.exe
  2⤵
  PID:9100
- C:\Windows\System\judjOxJ.exe
  C:\Windows\System\judjOxJ.exe
  2⤵
  PID:9116
- C:\Windows\System\hKNdpnS.exe
  C:\Windows\System\hKNdpnS.exe
  2⤵
  PID:9132
- C:\Windows\System\ybTYgoP.exe
  C:\Windows\System\ybTYgoP.exe
  2⤵
  PID:9148
- C:\Windows\System\ywXddNo.exe
  C:\Windows\System\ywXddNo.exe
  2⤵
  PID:9164
- C:\Windows\System\LkwMvYu.exe
  C:\Windows\System\LkwMvYu.exe
  2⤵
  PID:9180
- C:\Windows\System\iRJaCVw.exe
  C:\Windows\System\iRJaCVw.exe
  2⤵
  PID:9200
- C:\Windows\System\WYtBLOo.exe
  C:\Windows\System\WYtBLOo.exe
  2⤵
  PID:7384
- C:\Windows\System\nWEwtft.exe
  C:\Windows\System\nWEwtft.exe
  2⤵
  PID:7276
- C:\Windows\System\bNzVjJP.exe
  C:\Windows\System\bNzVjJP.exe
  2⤵
  PID:7824
- C:\Windows\System\FUNKKFF.exe
  C:\Windows\System\FUNKKFF.exe
  2⤵
  PID:8188
- C:\Windows\System\kmOxsWd.exe
  C:\Windows\System\kmOxsWd.exe
  2⤵
  PID:8244
- C:\Windows\System\adGXGSC.exe
  C:\Windows\System\adGXGSC.exe
  2⤵
  PID:6564
- C:\Windows\System\Ezezgue.exe
  C:\Windows\System\Ezezgue.exe
  2⤵
  PID:8292
- C:\Windows\System\ihiSJiI.exe
  C:\Windows\System\ihiSJiI.exe
  2⤵
  PID:8332
- C:\Windows\System\pTGdaKj.exe
  C:\Windows\System\pTGdaKj.exe
  2⤵
  PID:8432
- C:\Windows\System\AAzFSQe.exe
  C:\Windows\System\AAzFSQe.exe
  2⤵
  PID:8448
- C:\Windows\System\RpRcomz.exe
  C:\Windows\System\RpRcomz.exe
  2⤵
  PID:8464
- C:\Windows\System\NGuluaN.exe
  C:\Windows\System\NGuluaN.exe
  2⤵
  PID:8492
- C:\Windows\System\jzPmQAb.exe
  C:\Windows\System\jzPmQAb.exe
  2⤵
  PID:8508
- C:\Windows\System\IOZNftY.exe
  C:\Windows\System\IOZNftY.exe
  2⤵
  PID:8524
- C:\Windows\System\jlVVLvV.exe
  C:\Windows\System\jlVVLvV.exe
  2⤵
  PID:8540
- C:\Windows\System\chhQYoL.exe
  C:\Windows\System\chhQYoL.exe
  2⤵
  PID:8564
- C:\Windows\System\TSMysol.exe
  C:\Windows\System\TSMysol.exe
  2⤵
  PID:8620
- C:\Windows\System\LXrRYAs.exe
  C:\Windows\System\LXrRYAs.exe
  2⤵
  PID:8592
- C:\Windows\System\THgrJsh.exe
  C:\Windows\System\THgrJsh.exe
  2⤵
  PID:8608
- C:\Windows\System\bfkongr.exe
  C:\Windows\System\bfkongr.exe
  2⤵
  PID:8668
- C:\Windows\System\BbfrdGj.exe
  C:\Windows\System\BbfrdGj.exe
  2⤵
  PID:8680
- C:\Windows\System\RdhAXYa.exe
  C:\Windows\System\RdhAXYa.exe
  2⤵
  PID:8692
- C:\Windows\System\lKrWVLo.exe
  C:\Windows\System\lKrWVLo.exe
  2⤵
  PID:8716
- C:\Windows\System\DPbkUJS.exe
  C:\Windows\System\DPbkUJS.exe
  2⤵
  PID:8736
- C:\Windows\System\ojQPoTH.exe
  C:\Windows\System\ojQPoTH.exe
  2⤵
  PID:8816
- C:\Windows\System\DgxyBjp.exe
  C:\Windows\System\DgxyBjp.exe
  2⤵
  PID:8888
- C:\Windows\System\WwuvuJe.exe
  C:\Windows\System\WwuvuJe.exe
  2⤵
  PID:8952
- C:\Windows\System\KhulxzT.exe
  C:\Windows\System\KhulxzT.exe
  2⤵
  PID:8840
- C:\Windows\System\jgVAyWf.exe
  C:\Windows\System\jgVAyWf.exe
  2⤵
  PID:8772
- C:\Windows\System\obDmYLC.exe
  C:\Windows\System\obDmYLC.exe
  2⤵
  PID:8868
- C:\Windows\System\iOVCkmT.exe
  C:\Windows\System\iOVCkmT.exe
  2⤵
  PID:9112
- C:\Windows\System\Qxsahzw.exe
  C:\Windows\System\Qxsahzw.exe
  2⤵
  PID:9144
- C:\Windows\System\rYzGBYU.exe
  C:\Windows\System\rYzGBYU.exe
  2⤵
  PID:9208
- C:\Windows\System\ajdvegh.exe
  C:\Windows\System\ajdvegh.exe
  2⤵
  PID:8216
- C:\Windows\System\OjlEIGN.exe
  C:\Windows\System\OjlEIGN.exe
  2⤵
  PID:8344
- C:\Windows\System\tfAyajI.exe
  C:\Windows\System\tfAyajI.exe
  2⤵
  PID:9160
- C:\Windows\System\XoJtYRc.exe
  C:\Windows\System\XoJtYRc.exe
  2⤵
  PID:6860
- C:\Windows\System\ryEFNSq.exe
  C:\Windows\System\ryEFNSq.exe
  2⤵
  PID:7632
- C:\Windows\System\oJmQkjW.exe
  C:\Windows\System\oJmQkjW.exe
  2⤵
  PID:7732
- C:\Windows\System\kqXoZiz.exe
  C:\Windows\System\kqXoZiz.exe
  2⤵
  PID:8140
- C:\Windows\System\fRGTXQo.exe
  C:\Windows\System\fRGTXQo.exe
  2⤵
  PID:8260
- C:\Windows\System\gXsVYnw.exe
  C:\Windows\System\gXsVYnw.exe
  2⤵
  PID:8552
- C:\Windows\System\FYPDeLX.exe
  C:\Windows\System\FYPDeLX.exe
  2⤵
  PID:8584
- C:\Windows\System\xVkvVdF.exe
  C:\Windows\System\xVkvVdF.exe
  2⤵
  PID:8696
- C:\Windows\System\qXzNITH.exe
  C:\Windows\System\qXzNITH.exe
  2⤵
  PID:8728
- C:\Windows\System\ZTYydrw.exe
  C:\Windows\System\ZTYydrw.exe
  2⤵
  PID:8968
- C:\Windows\System\LjFaqFb.exe
  C:\Windows\System\LjFaqFb.exe
  2⤵
  PID:8768
- C:\Windows\System\KPBeYbe.exe
  C:\Windows\System\KPBeYbe.exe
  2⤵
  PID:8784
- C:\Windows\System\UzjDyXc.exe
  C:\Windows\System\UzjDyXc.exe
  2⤵
  PID:8684
- C:\Windows\System\oChDjeI.exe
  C:\Windows\System\oChDjeI.exe
  2⤵
  PID:8836
- C:\Windows\System\IrwdQRI.exe
  C:\Windows\System\IrwdQRI.exe
  2⤵
  PID:8856
- C:\Windows\System\UupfEYy.exe
  C:\Windows\System\UupfEYy.exe
  2⤵
  PID:9016
- C:\Windows\System\PKBhodq.exe
  C:\Windows\System\PKBhodq.exe
  2⤵
  PID:9032
- C:\Windows\System\xJEZNLg.exe
  C:\Windows\System\xJEZNLg.exe
  2⤵
  PID:9028
- C:\Windows\System\emlXLhE.exe
  C:\Windows\System\emlXLhE.exe
  2⤵
  PID:9128
- C:\Windows\System\ibwSFKz.exe
  C:\Windows\System\ibwSFKz.exe
  2⤵
  PID:9172
- C:\Windows\System\cPsJgRb.exe
  C:\Windows\System\cPsJgRb.exe
  2⤵
  PID:9176
- C:\Windows\System\QKeiYcd.exe
  C:\Windows\System\QKeiYcd.exe
  2⤵
  PID:8504
- C:\Windows\System\qKEQNBH.exe
  C:\Windows\System\qKEQNBH.exe
  2⤵
  PID:8328
- C:\Windows\System\hvCVuMp.exe
  C:\Windows\System\hvCVuMp.exe
  2⤵
  PID:8788
- C:\Windows\System\ZzcjuIw.exe
  C:\Windows\System\ZzcjuIw.exe
  2⤵
  PID:8664
- C:\Windows\System\AHHRouh.exe
  C:\Windows\System\AHHRouh.exe
  2⤵
  PID:8904
- C:\Windows\System\PXvqjnq.exe
  C:\Windows\System\PXvqjnq.exe
  2⤵
  PID:8548
- C:\Windows\System\yTEeJmh.exe
  C:\Windows\System\yTEeJmh.exe
  2⤵
  PID:8588
- C:\Windows\System\hwsYUQs.exe
  C:\Windows\System\hwsYUQs.exe
  2⤵
  PID:9080
- C:\Windows\System\allNHZl.exe
  C:\Windows\System\allNHZl.exe
  2⤵
  PID:8196
- C:\Windows\System\QmNepmj.exe
  C:\Windows\System\QmNepmj.exe
  2⤵
  PID:9192
- C:\Windows\System\ARyDLpC.exe
  C:\Windows\System\ARyDLpC.exe
  2⤵
  PID:9196
- C:\Windows\System\YJKunUA.exe
  C:\Windows\System\YJKunUA.exe
  2⤵
  PID:8368
- C:\Windows\System\afDpERT.exe
  C:\Windows\System\afDpERT.exe
  2⤵
  PID:7752
- C:\Windows\System\tRVyeQy.exe
  C:\Windows\System\tRVyeQy.exe
  2⤵
  PID:8400
- C:\Windows\System\eEfkVwZ.exe
  C:\Windows\System\eEfkVwZ.exe
  2⤵
  PID:8396
- C:\Windows\System\jzrmGEL.exe
  C:\Windows\System\jzrmGEL.exe
  2⤵
  PID:8436
- C:\Windows\System\vdKrUzj.exe
  C:\Windows\System\vdKrUzj.exe
  2⤵
  PID:8712
- C:\Windows\System\YKfsDFJ.exe
  C:\Windows\System\YKfsDFJ.exe
  2⤵
  PID:7372
- C:\Windows\System\sEyBbnX.exe
  C:\Windows\System\sEyBbnX.exe
  2⤵
  PID:8884
- C:\Windows\System\TSRacla.exe
  C:\Windows\System\TSRacla.exe
  2⤵
  PID:9064
- C:\Windows\System\AmjviGf.exe
  C:\Windows\System\AmjviGf.exe
  2⤵
  PID:7992
- C:\Windows\System\iSLwMsZ.exe
  C:\Windows\System\iSLwMsZ.exe
  2⤵
  PID:9092
- C:\Windows\System\nkbSrID.exe
  C:\Windows\System\nkbSrID.exe
  2⤵
  PID:8900
- C:\Windows\System\LtTLDZS.exe
  C:\Windows\System\LtTLDZS.exe
  2⤵
  PID:8536
- C:\Windows\System\LhVnkie.exe
  C:\Windows\System\LhVnkie.exe
  2⤵
  PID:8996
- C:\Windows\System\jcBvRug.exe
  C:\Windows\System\jcBvRug.exe
  2⤵
  PID:8708
- C:\Windows\System\OoOUDbK.exe
  C:\Windows\System\OoOUDbK.exe
  2⤵
  PID:9236
- C:\Windows\System\tCFVoLV.exe
  C:\Windows\System\tCFVoLV.exe
  2⤵
  PID:9252
- C:\Windows\System\cwKjwPi.exe
  C:\Windows\System\cwKjwPi.exe
  2⤵
  PID:9268
- C:\Windows\System\ZPJoLqX.exe
  C:\Windows\System\ZPJoLqX.exe
  2⤵
  PID:9288
- C:\Windows\System\iFfEwAe.exe
  C:\Windows\System\iFfEwAe.exe
  2⤵
  PID:9304
- C:\Windows\System\wsXnDAq.exe
  C:\Windows\System\wsXnDAq.exe
  2⤵
  PID:9320
- C:\Windows\System\KpCNbkg.exe
  C:\Windows\System\KpCNbkg.exe
  2⤵
  PID:9336
- C:\Windows\System\jqNQYtl.exe
  C:\Windows\System\jqNQYtl.exe
  2⤵
  PID:9352
- C:\Windows\System\vjmbUPG.exe
  C:\Windows\System\vjmbUPG.exe
  2⤵
  PID:9368
- C:\Windows\System\fUieWeO.exe
  C:\Windows\System\fUieWeO.exe
  2⤵
  PID:9384
- C:\Windows\System\VSMdvBN.exe
  C:\Windows\System\VSMdvBN.exe
  2⤵
  PID:9400
- C:\Windows\System\EQNQIWi.exe
  C:\Windows\System\EQNQIWi.exe
  2⤵
  PID:9416
- C:\Windows\System\AOjdXlK.exe
  C:\Windows\System\AOjdXlK.exe
  2⤵
  PID:9436
- C:\Windows\System\TCRfsdU.exe
  C:\Windows\System\TCRfsdU.exe
  2⤵
  PID:9452
- C:\Windows\System\DoKnipW.exe
  C:\Windows\System\DoKnipW.exe
  2⤵
  PID:9480
- C:\Windows\System\zRpDSwp.exe
  C:\Windows\System\zRpDSwp.exe
  2⤵
  PID:9500
- C:\Windows\System\vviAnUH.exe
  C:\Windows\System\vviAnUH.exe
  2⤵
  PID:9516
- C:\Windows\System\nVTfEpb.exe
  C:\Windows\System\nVTfEpb.exe
  2⤵
  PID:9532
- C:\Windows\System\LtlVlMr.exe
  C:\Windows\System\LtlVlMr.exe
  2⤵
  PID:9552
- C:\Windows\System\ahAVokh.exe
  C:\Windows\System\ahAVokh.exe
  2⤵
  PID:9568
- C:\Windows\System\AaPsuhc.exe
  C:\Windows\System\AaPsuhc.exe
  2⤵
  PID:9584
- C:\Windows\System\AFkELvr.exe
  C:\Windows\System\AFkELvr.exe
  2⤵
  PID:9600
- C:\Windows\System\QsixQDA.exe
  C:\Windows\System\QsixQDA.exe
  2⤵
  PID:9616
- C:\Windows\System\uLlugRS.exe
  C:\Windows\System\uLlugRS.exe
  2⤵
  PID:9632
- C:\Windows\System\RYjBUdP.exe
  C:\Windows\System\RYjBUdP.exe
  2⤵
  PID:9656
- C:\Windows\System\Yhdsjkw.exe
  C:\Windows\System\Yhdsjkw.exe
  2⤵
  PID:9672
- C:\Windows\System\PzzAjUl.exe
  C:\Windows\System\PzzAjUl.exe
  2⤵
  PID:9688
- C:\Windows\System\pMcNHPy.exe
  C:\Windows\System\pMcNHPy.exe
  2⤵
  PID:9704
- C:\Windows\System\nkrvKjb.exe
  C:\Windows\System\nkrvKjb.exe
  2⤵
  PID:9720
- C:\Windows\System\ZYuTDSK.exe
  C:\Windows\System\ZYuTDSK.exe
  2⤵
  PID:9740
- C:\Windows\System\maDUeYX.exe
  C:\Windows\System\maDUeYX.exe
  2⤵
  PID:9840
- C:\Windows\System\EQrVtpW.exe
  C:\Windows\System\EQrVtpW.exe
  2⤵
  PID:9864
- C:\Windows\System\BjpEsxf.exe
  C:\Windows\System\BjpEsxf.exe
  2⤵
  PID:9880
- C:\Windows\System\qWNgYDf.exe
  C:\Windows\System\qWNgYDf.exe
  2⤵
  PID:9896
- C:\Windows\System\geHWEoA.exe
  C:\Windows\System\geHWEoA.exe
  2⤵
  PID:9916
- C:\Windows\System\TIqQySj.exe
  C:\Windows\System\TIqQySj.exe
  2⤵
  PID:9932
- C:\Windows\System\xpyLumT.exe
  C:\Windows\System\xpyLumT.exe
  2⤵
  PID:9952
- C:\Windows\System\DQQdKPE.exe
  C:\Windows\System\DQQdKPE.exe
  2⤵
  PID:9968
- C:\Windows\System\XrqDTbH.exe
  C:\Windows\System\XrqDTbH.exe
  2⤵
  PID:9984
- C:\Windows\System\QkfTpIo.exe
  C:\Windows\System\QkfTpIo.exe
  2⤵
  PID:10000
- C:\Windows\System\emSiWCU.exe
  C:\Windows\System\emSiWCU.exe
  2⤵
  PID:10020
- C:\Windows\System\ThtIRQZ.exe
  C:\Windows\System\ThtIRQZ.exe
  2⤵
  PID:10036
- C:\Windows\System\rNyILNK.exe
  C:\Windows\System\rNyILNK.exe
  2⤵
  PID:10052
- C:\Windows\System\vVfozEa.exe
  C:\Windows\System\vVfozEa.exe
  2⤵
  PID:10068
- C:\Windows\System\IKDTaDs.exe
  C:\Windows\System\IKDTaDs.exe
  2⤵
  PID:10084
- C:\Windows\System\tzaUNTF.exe
  C:\Windows\System\tzaUNTF.exe
  2⤵
  PID:10104
- C:\Windows\System\NlaRruM.exe
  C:\Windows\System\NlaRruM.exe
  2⤵
  PID:10120
- C:\Windows\System\ZlgGnWm.exe
  C:\Windows\System\ZlgGnWm.exe
  2⤵
  PID:10140
- C:\Windows\System\aAtJoXX.exe
  C:\Windows\System\aAtJoXX.exe
  2⤵
  PID:10156
- C:\Windows\System\UmCxAGC.exe
  C:\Windows\System\UmCxAGC.exe
  2⤵
  PID:10172
- C:\Windows\System\rjskdBZ.exe
  C:\Windows\System\rjskdBZ.exe
  2⤵
  PID:10192
- C:\Windows\System\jvDtXMK.exe
  C:\Windows\System\jvDtXMK.exe
  2⤵
  PID:10208
- C:\Windows\System\yMaBQIG.exe
  C:\Windows\System\yMaBQIG.exe
  2⤵
  PID:10224
- C:\Windows\System\WLTfZkV.exe
  C:\Windows\System\WLTfZkV.exe
  2⤵
  PID:9048
- C:\Windows\System\yTKfBlq.exe
  C:\Windows\System\yTKfBlq.exe
  2⤵
  PID:8732
- C:\Windows\System\GvZpAXe.exe
  C:\Windows\System\GvZpAXe.exe
  2⤵
  PID:9284
- C:\Windows\System\phtFPlt.exe
  C:\Windows\System\phtFPlt.exe
  2⤵
  PID:9348
- C:\Windows\System\DSTDeFs.exe
  C:\Windows\System\DSTDeFs.exe
  2⤵
  PID:9296
- C:\Windows\System\Ktvesjz.exe
  C:\Windows\System\Ktvesjz.exe
  2⤵
  PID:9220
- C:\Windows\System\sXwLhOC.exe
  C:\Windows\System\sXwLhOC.exe
  2⤵
  PID:9444
- C:\Windows\System\KEBSlwK.exe
  C:\Windows\System\KEBSlwK.exe
  2⤵
  PID:9232
- C:\Windows\System\lEOhaSc.exe
  C:\Windows\System\lEOhaSc.exe
  2⤵
  PID:9364
- C:\Windows\System\MLgDWAO.exe
  C:\Windows\System\MLgDWAO.exe
  2⤵
  PID:9428
- C:\Windows\System\equgcEe.exe
  C:\Windows\System\equgcEe.exe
  2⤵
  PID:9492
- C:\Windows\System\hxHhCke.exe
  C:\Windows\System\hxHhCke.exe
  2⤵
  PID:9524
- C:\Windows\System\MmYaYOi.exe
  C:\Windows\System\MmYaYOi.exe
  2⤵
  PID:9592
- C:\Windows\System\NyZZNPX.exe
  C:\Windows\System\NyZZNPX.exe
  2⤵
  PID:9664
- C:\Windows\System\TyVflxi.exe
  C:\Windows\System\TyVflxi.exe
  2⤵
  PID:9640
- C:\Windows\System\hIHniOl.exe
  C:\Windows\System\hIHniOl.exe
  2⤵
  PID:9540
- C:\Windows\System\NlUYBmB.exe
  C:\Windows\System\NlUYBmB.exe
  2⤵
  PID:9648
- C:\Windows\System\AqwXXgy.exe
  C:\Windows\System\AqwXXgy.exe
  2⤵
  PID:9696
- C:\Windows\System\nCUmzQv.exe
  C:\Windows\System\nCUmzQv.exe
  2⤵
  PID:9716
- C:\Windows\System\JAtpKXi.exe
  C:\Windows\System\JAtpKXi.exe
  2⤵
  PID:9756
- C:\Windows\System\wUEaEdM.exe
  C:\Windows\System\wUEaEdM.exe
  2⤵
  PID:9772
- C:\Windows\System\nooJuIt.exe
  C:\Windows\System\nooJuIt.exe
  2⤵
  PID:9788
- C:\Windows\System\wNfqUwN.exe
  C:\Windows\System\wNfqUwN.exe
  2⤵
  PID:9804
- C:\Windows\System\dkDtPZX.exe
  C:\Windows\System\dkDtPZX.exe
  2⤵
  PID:9820
- C:\Windows\System\wamhayB.exe
  C:\Windows\System\wamhayB.exe
  2⤵
  PID:10096
- C:\Windows\System\TLHBpCC.exe
  C:\Windows\System\TLHBpCC.exe
  2⤵
  PID:10100
- C:\Windows\System\zFmQlWn.exe
  C:\Windows\System\zFmQlWn.exe
  2⤵
  PID:10012
- C:\Windows\System\reXqkGi.exe
  C:\Windows\System\reXqkGi.exe
  2⤵
  PID:9832
- C:\Windows\System\bWOHKgk.exe
  C:\Windows\System\bWOHKgk.exe
  2⤵
  PID:9944
- C:\Windows\System\RzkukuN.exe
  C:\Windows\System\RzkukuN.exe
  2⤵
  PID:10048
- C:\Windows\System\NUWeQey.exe
  C:\Windows\System\NUWeQey.exe
  2⤵
  PID:10164
- C:\Windows\System\EmzuBjv.exe
  C:\Windows\System\EmzuBjv.exe
  2⤵
  PID:10204
- C:\Windows\System\BwpRteP.exe
  C:\Windows\System\BwpRteP.exe
  2⤵
  PID:9276
- C:\Windows\System\jHQyFLu.exe
  C:\Windows\System\jHQyFLu.exe
  2⤵
  PID:9264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EvcKndw.exe

Filesize
2.3MB

MD5
8128b2aac970d96151a8f1bfc31fb545

SHA1
9c05ee53f13576274106118f553e5ce4459d44a1

SHA256
b85f05134970ec27b6361194ba04d672a9b36d390094eb89b3739dfb9beb8440

SHA512
4ff8e0715c815e71e5439aa2943bd8b9592769a14430601c7c0db2f81cbf2f860fabb59128314eca63f22b0efe5679db6e65971367c4c6bf115ac9adfa10a441

Download Submit
C:\Windows\system\GDDBXOL.exe

Filesize
2.3MB

MD5
0277f0957a96fa837d314faa872fea8a

SHA1
f71c2b2ab318c1ee79ff7117ac2e3879fab3d5ed

SHA256
b461ac35cb5cb05cddaa12be499388e72de260637dfd52db808d2a3ca10cb6ef

SHA512
52ad1bc80c6e230a781344c1aa75b298bda3dff748f7faea59812e181e4b86f8bf12554a3c7a6ed804a2658ac2fc936f99a6d37031dd2e2af2f4052b4465018a

Download Submit
C:\Windows\system\IeWvitE.exe

Filesize
2.3MB

MD5
df7540757af1e7535e7c5548b1c61946

SHA1
53858002173d3404f3498f455532d912c369a11a

SHA256
d1702dacfa8b6b125e8dcf37de72241406bb66b7663c4b94f312c284f568c17e

SHA512
7eaedba85c262adb3c7234156e4580f3cea04a1a9682ae27650e2ad7fb739688f7f6f2e06d9bdf5167753961459df0a256efa03ccb2b1d983d19dbcd8e6ceade

Download Submit
C:\Windows\system\LxiSkGF.exe

Filesize
2.3MB

MD5
3339e8b401acffbee6f6bfee86229724

SHA1
4815f2cb6da6bb4e9ef63794458ec095236a734d

SHA256
966f0a37500b9ca1a18fe633b18f8e5b18dd8ed96b077cf06e7f6b477058c54f

SHA512
7db2b32fdba031e15828106e9630b26a1cdc3f6a94ea76f04c8fbf9379b5245fa0fa72f27073770bea18b746acdf88f9c3727bb68201ef58433ce95987043c5f

Download Submit
C:\Windows\system\MwOsVkb.exe

Filesize
2.3MB

MD5
54a9acb3669feb8e7b3e297543f81d85

SHA1
9cb3f0237a1f2a8b4ef4df47430ceae8ed96a965

SHA256
8a73f2537284766a9a09e926beb921011a985e2464c9c10860464cbbfe47fd64

SHA512
16e5de222ab11a19fb78d05736a6554ebac559d2f786108d6aae8b4c7e4d233fd3ed0bb896577b75950dc5d9df95337c3e29454902fdf0f92328283267000b40

Download Submit
C:\Windows\system\QFzrPAS.exe

Filesize
2.3MB

MD5
d1e64084288ebaf7152ca29be37b399d

SHA1
47e4c6a515dda2f2fed8729007d5ccd90a2ade72

SHA256
2eab2bb462c9fa121f3f5a73c3393e6f680a3db3dcb43de9b9f22888941b17f3

SHA512
aaf6c9a521305ae04f2bd03fcec45a2a28de592076f105d44d7b553398069f2b5c99762caadcbd9d2f9b05ce9333e39a41fe8d4d1a3ffaf4c07053a3c26a03f7

Download Submit
C:\Windows\system\VIjYQpq.exe

Filesize
2.3MB

MD5
9c8e3256f28bee21e7cfb7358dcdccff

SHA1
3bd49fd032e4afbfd960f601f3274f5a5b71a431

SHA256
f876ed4b29253ff35b61a22d8e8f44ab450d243c91b5014bbaecd705d4a24c2b

SHA512
b04d7c99bb26a124778f7c8537145b2c6fc12181b22d544cc8cd92283008266ef713f7acdcc4aabdd846159b5b9bbf66cc66b95d7df2d845544ab047b344368f

Download Submit
C:\Windows\system\VLOWPMp.exe

Filesize
2.3MB

MD5
27d526394952a8f780d20833f9b9597d

SHA1
a91f35988293a30722f5f734209af981a66ab2a5

SHA256
28c9d8db8b0caf20b236bf1207e4a4d4dc3283b013defafb25a439eed23d978d

SHA512
9c1047c2b64195f735c24c938d57c204a1b541c3f6a419d51396d7d7fb1960dbdfc24acff74a750a15b0d30a7d0a8459a817a51a5c67fe9397016f8d77736b7e

Download Submit
C:\Windows\system\iMmSCot.exe

Filesize
2.3MB

MD5
17e08d7c4a863fb3992faeff2de778f0

SHA1
e202b7d37ffa110cabaa8608e19cce9218948a83

SHA256
0a8f471079b2df5011366b3ec713aadd7dfdb137974f9a5d16b2700c70ff6723

SHA512
c8245a3855464ce0ce7c56b32005193c2aa22cfed101abed5db111e32c89ffb7b99c84fdb76fe2737e967b1edb5110e407e4e4ff8246413970e66d90f28ad2c7

Download Submit
C:\Windows\system\jwPWnuT.exe

Filesize
2.3MB

MD5
bfd51c1509ca51a29300e85ab72bf9e1

SHA1
5467ebe2bd4b329daca585db0a1321037d9051ea

SHA256
57287bd63f93ffd79aa6aae01b1a37a3db73e8c7359c9aa94070f30182c91030

SHA512
347ad4d53a7e879a316ed796799f39a9cfa2adc26c89467e4062c4689e6be90413c71ad6be5c1e377d7dcc4e3ffd0552bf08f5fe0769d58718e5414e414c4d1e

Download Submit
C:\Windows\system\lUNMQNU.exe

Filesize
2.3MB

MD5
c102419610a82829b75cd4bc7a0fa6e5

SHA1
7a394fa925a209bd3cc954d38032332e8147d92e

SHA256
e20eecec3c8ea6e0937ca4ddadad049cea006833c28ad37ffb0cc909f3bcf856

SHA512
1c1575a42fae6a4094b83df9f98196a7a921eec4a4cc48cfda40b57166db35d532706fbe4b1fe85c28b13686a046269a88aee91a166f48a832656b7ee2cc7650

Download Submit
C:\Windows\system\rPFfgZV.exe

Filesize
2.3MB

MD5
a06bced4a3840606d37301d145734898

SHA1
f7c2baf94fb7c780a92e6273bf337c8d899f27d9

SHA256
40163b0a66035ec907a774937ed1982f98720c4b38d0ab694a46cd042328f4d0

SHA512
7efa63b940c7a5dd8f30e82bcd98b29a1867f1e0bbf64020e7b5cee8ed37bd04816b348a49b6eb833c466c7f917f746c2c81777fb2406e22396ad96707dcfe15

Download Submit
C:\Windows\system\roidlWl.exe

Filesize
2.3MB

MD5
b7f5d10291e7ae844116171f9e7674e8

SHA1
0475552ad59c4bace5f014d459811caf3dcc0e79

SHA256
89f6728f8ef88efd3b6c00c29615e7a1a973672924aeb44e0bf24c31adf6b708

SHA512
eb457ae6eebcba96aca7733c04f3edafb50eb7de7c6739600be9f1d5f2ea9500002b96611edaecdfd6e3cd03838296104c191287f8ebcf24a423548af9e61345

Download Submit
C:\Windows\system\sMagely.exe

Filesize
2.3MB

MD5
213a9793c980479d0cef24edce2f74b0

SHA1
41f83ca224b393c545649aa631ed99ccd2006bf5

SHA256
ecfee9e88e72227ab3d185b45c74f10de44539ad0e4cf54912a1539439822c2d

SHA512
5f76dba2877c3f276a2f5a1643cabecf72e40b63f8fb486609f6f5fd3325d83eeda7739337c231207a2cc752e3d8d4ebe8c9b3ae0b9ebf0e72a8010e6cf69927

Download Submit
C:\Windows\system\stwUbWK.exe

Filesize
2.3MB

MD5
b0c0f51bd9d536d5fcb90dd1eeb82ca8

SHA1
b9f92ad7277e003fc4208bb0b3c64a31fb4c86ea

SHA256
7c0eb00a7e7c7b62c7fe2050f5c0732d9edea2f605e0187819508c0b8a5fd140

SHA512
e27ce959eda22a2ca6d8ee1b138cfcc89bae3783705d135e188d8223caae2eb229791ce69598500db6504f4f76d5973d0c374f1570e1b5b3886701e96316d94d

Download Submit
C:\Windows\system\uyFAAaP.exe

Filesize
2.3MB

MD5
409691bad18695c5526350ff45934b13

SHA1
3c1c906ab5d54d9c2b39ee9424e0442c3e324c6d

SHA256
c1cc00fe9060cda22fa127ddb2442fdb523faac6c79c1a1520a6801806d4a3b2

SHA512
305230917b06ee763417942a13b2ec1d6a3781c37b0316dbbac5fcb474af3acafe9018d3c680188475411a4ee8d88e17d69053685e2e3b490caf8d8bc21d7f17

Download Submit
C:\Windows\system\wNRcTjf.exe

Filesize
2.3MB

MD5
76dc4313b44a6fa834358d423c704c52

SHA1
28de27b884ab81695c3edc4980908ade4f6f7e69

SHA256
be295a5f2025abbb22104fbbb60c9636e726d2715e36ee0fe5c922b45b0f22ce

SHA512
2a7588a474f602d2e23227b05b50a31a0c78cf3205f21917a8c2bc471aacce6de0a9f7ec094ba84b6671a5a41095cbb994cea367a9adf6d6804213a0f317da4b

Download Submit
C:\Windows\system\xhiIXdb.exe

Filesize
2.3MB

MD5
bf19b60af4e234e8afd71ff7176346b7

SHA1
333c93c3d31fac10f9fc04a27047a4555a7bed8c

SHA256
91a85f19f1f921f2387a352996b6b5be7809e410d797614cffad37f01ba945af

SHA512
3fdc401699c6bb571dfe597defe6f579597533eec4bd65b8036aadc14145d9148095167996d1ebc1e8e301ea1b3980f8fdb5721443eb5986c6f3b0d4df3beead

Download Submit
\Windows\system\ACzcXUv.exe

Filesize
2.3MB

MD5
278cf110369d700f08a7a80fdbb58a43

SHA1
be24e579a5a0e47c0028695967e6be7797af5383

SHA256
420cb59509c2f842a2e0ff274c37adc7e2edde58df72a04a152464d943f4c380

SHA512
6934282419631b7ee4497cc71a0497855305b7e54247fd754ceb48f70871a7d4bc7721d963fe0c252251ca6dd736cad687d0fa28c1c8da653052e70b98b47c5f

Download Submit
\Windows\system\AonzOcO.exe

Filesize
2.3MB

MD5
e513548c9d762bceaef10dc3994b7dd2

SHA1
d4acbf38b0ab94abbd00ed8c576023dabd869ebc

SHA256
af98969c35d7370c09469c2daf2bcc17d9e5f9f82d3ce2d5e14914b36a29cc1f

SHA512
56e58c3b64fe684a888e0952ea119bb1a7f152c28b9f432e59618e205bfdd52429f0bfb35771faf48bb5747250524ba580d6261152da27e010aacbc00e4ec94a

Download Submit
\Windows\system\HPmocfz.exe

Filesize
2.3MB

MD5
deacd21689ac9d86a56635f08f52e27e

SHA1
8b53c80a5706890d4a515fe3ceaedb7ec1fc8573

SHA256
e0f64489760230c715ef96f0dd0d1ea8902aaa7a2b8b135b015144692798fa58

SHA512
4140b96db2acfa63f569655973bf8830afda599128862128dd3ffacecf57ab3cdc1d6d8b50d36a10c3578931f6b61759f909c9598f04fb7cffaa5374ca8ec70c

Download Submit
\Windows\system\LRVkhon.exe

Filesize
2.3MB

MD5
1e1dd399c4cf794447717768353b6bb1

SHA1
a055895b08b2f85934896c1dda4a6c3c4066ee62

SHA256
7a24d7025878f2ab86e0e201a490556c2b2e758bc66962e75fe3fd9520e008e5

SHA512
56acb4ae516817ad74f94949295eca5628154962f41d810191b38ea9270362120a24b781a8961efa951a657382c427b9d9d71644e32ae75b248646cfbd4eff0e

Download Submit
\Windows\system\LfWtfym.exe

Filesize
2.3MB

MD5
2e2fa7ae6c2c4cb52bac5ebd51458fb3

SHA1
c82ee46aded39c1ef5ae471dc64afbedd6d46ed0

SHA256
6763aeed5e4f216803b3fb75d68d5c52b541eeb2ded2b313981ad93688a9fac2

SHA512
e56086cd3dbe3d01ce3f84113b53b49df5610beea07ec0c6740625cb5d80378ca489b5dd574511fbc228f53490e830491193203c5dc1755271bf582eda3b01b8

Download Submit
\Windows\system\OUWJECe.exe

Filesize
2.3MB

MD5
76f6b51a068ad287ec33f85aec0850c4

SHA1
3ec0672981df91fd49f3d9a8b6fcc2b69c48a974

SHA256
7337609f907ed65ac6f38a63d72f4af3516473c0a46d86ea26ac231043b624c0

SHA512
6168c0778d95924d0aecbb0429b2e6740106cb0f4140a60a1f3d6f0e29700872c936b5389b303290d1d5098b854986ccb381f7b4a1bca2f8b6c3e4b7110ae3e9

Download Submit
\Windows\system\ObGwcTT.exe

Filesize
2.3MB

MD5
bbe1b881105f8db9b669b273537453c1

SHA1
fb6a07c106d3eff842ac930ee5a95a58bbf5bccf

SHA256
ef79d5f11f9899a73df600e1559995f3306476a351d8590d908b398468b202c5

SHA512
c765e64db07dd891a3324153066b6148077ef30792515c90a0333b694cad7b1b0516500104460adfe971981da80652a57b1c9018adeeb0be1430a8a6765afa6e

Download Submit
\Windows\system\QCIDfYn.exe

Filesize
2.3MB

MD5
c663a41f2a386c3e3e8ba2c658471202

SHA1
8a43c60449079b26448353739ebfaccd527c1071

SHA256
ee1abc369e6a3ab439248fe8c7f0aeb48ba13ae0a7cf2229da189fb61c6093a3

SHA512
1bf1083787d7e207d1127563a149dc709188a6c2cb75d3af53be0fda4df2d72002c874defefc686c4450b72c650f0f81615f5f3f6a8cfbd66a14514ba76af086

Download Submit
\Windows\system\QLHPqsg.exe

Filesize
2.3MB

MD5
1e57602aa042dbbe6782b840cdc617d0

SHA1
5ec9bd24de8617284bf00ae27353ceccf6efc5ca

SHA256
f53856c2b60d3f92a408fb90a53e5c81438d1701a8024790a5ee7b6ce185df30

SHA512
1207b8db99451bddfbf5dd4c7a9c5f56181b108d6e821b70304625e6e9fe77db8d65ac57fe950cc8942fc6b6222f89c72daf07067723d2bde01582006d7fc9f5

Download Submit
\Windows\system\Xvsqwol.exe

Filesize
2.3MB

MD5
eeae0379186f98d755c6ca06df030893

SHA1
3df31465ed28723033ecc675f960613fb45c9848

SHA256
812f779102c6aea38715f5340fff23044103753bf4cdeb66cad30637dcd46386

SHA512
28e97b0e4539bf78a5e054e3a26bb02821ca573a0c35d2e1f12da46338125773b85b42e279d8f54cb4369070927ec31eae9706bd50fc72e35fe486b70b126715

Download Submit
\Windows\system\YlXWCQB.exe

Filesize
2.3MB

MD5
013b58f319004413bdaec1e5c7158ed6

SHA1
b5166dc002a9e3bcbd5bf4e1374757cd19e18fe8

SHA256
43702d3d585e0be668e532ab1df49d4641720e5ba84a81a2ee51ce8167bd1b22

SHA512
2e804074be6c7963d0270ecbafcadfa0d51cc0ae14c08a9bb1a90d0b759924dabef56ef4942127f7ab0486a4b8c492bec6c1be601bc39801547c3b1ba3e99044

Download Submit
\Windows\system\cPbyJjQ.exe

Filesize
2.3MB

MD5
b61167a103762299c5adf67f6e728dcb

SHA1
d6c0ad5f29d7180b66e0431f55adf0b86b38a25f

SHA256
39773e5d197a61ca92cfad76536b48fee62ae2618e9a004c9c293a6a6c5319d0

SHA512
82cfc576a17a5defb69d249263e2f3036cfdf02cf8afda42ed038f3f171e1e3bdd4a43223cdd17bbeb934b6cf493cacf00272d8833a3f3c527c1fa6545e4f248

Download Submit
\Windows\system\eiDcwum.exe

Filesize
2.3MB

MD5
a01b549b43776da90e76e982eca8d152

SHA1
58b5477ca736e8d504d0f02eaa95be74462cea02

SHA256
355da6ec717ca2d9da14b71800847ab436b5c53f95cbac67646f6b55b52a1eab

SHA512
a685cd3b2bb15a1f803b916b6d2b4402c6b4d966d59984a73469b30da25a40e79a81a2b28c199d1de46cc25adef92f31fd82be70658b9a93aac0a17548482805

Download Submit
\Windows\system\kRzRTKp.exe

Filesize
2.3MB

MD5
218dce10b9017630d5a91713c1930bdc

SHA1
575d3ab525a9790d3556f518fcbe87c8098b43c9

SHA256
2880da4ac641828ceba38327b1285f46556206cf822d09c5f8fd4973a2eb2a68

SHA512
7277ca4c42f869cc131f870f7834df4dcff7194ef362330f4171f4251a2a51374c747325bedb0f3ea990bc770d1ca9590400cd62b7b9dfcd2f8fdfcc4f20ba51

Download Submit
\Windows\system\lxmFxYe.exe

Filesize
2.3MB

MD5
63147326a5864949d18a914b14cb70b1

SHA1
d816617e5e954022fb25a3f14856b80698cf8bf3

SHA256
f3b98d49bec523e015a7df491a4b11f24775b1e1457282268aa17dc63537c03b

SHA512
d910b23cd9767d424e8fefd6f80c49ba2c8b3099b65b8231a8619dc3dae77230e2ea579b160ab9c864ec6cb1647704220b988d61815344bdd3ec03e0d1e02331

Download Submit
\Windows\system\mJQggIj.exe

Filesize
2.3MB

MD5
65926a6d3d2d97a3d91986beac2fc16f

SHA1
299f563cd5ac4068200a81226a9547a95bdc48fb

SHA256
45d85ee13f894fd4a029448c29db551b0d75b8ffb5f1ed6e7e6e750b440e1adb

SHA512
24a6ee139f9de6900fb5a3bd9ab4a1eb33f4538364d8ba83d2730acf81fea8c1829147449fdb1546c05e62e828daf38cd77e02a5e9e8a5d6d5d101f9cc35555b

Download Submit
\Windows\system\nPWdXkm.exe

Filesize
2.3MB

MD5
dfc392ad17181d41adb7d637def34cc7

SHA1
1b1dd47f13304f9fa3fdf970a6b943748e7cc91e

SHA256
29a184352b636124cef3aed1516c528530a8b604c9215abdc5d0f5ba2cdcd404

SHA512
b0c3a5301bb909be380bce3009a56f09bfdabd31b5dfc4f83d735d3769e0284a26254e71d59deee06ced65be6ae4fcc0b08159a862b0807e0069fa7a817d2c7b

Download Submit
\Windows\system\vQgNRte.exe

Filesize
2.3MB

MD5
14b2d26726d053124cf4a67976e3b634

SHA1
df9f47edd8e3b5767d1572807d5a0bbd8dc08295

SHA256
8418a3b92c45083cc564fd5207ff4fcc1420acb98be13c588d6d0fae3356dfec

SHA512
cd2de1d060959611847c6196d1714a785137362b84f85c9707a3b0b919debc1d92098e2fed83854bbe96920887de73245be5d0835ae7ec084ae4eb3d2c7170ca

Download Submit
\Windows\system\vyhhaVL.exe

Filesize
2.3MB

MD5
9d1522689b7e0d28759e8c351dac4204

SHA1
22c8597ef41a7a3e938fa6ed2af4aeabc15edb1b

SHA256
ce51ec5a2eb4e22c0a1bcf3e8c4fb468443e97188277c8a9cfe04236fe16f717

SHA512
fcff30cfce467f263504fd33eddf9fb6f82709863acf1493b4c0f770ee80867f0297458432e24b0dbc63818ca79034c91cbba234d7044199f0acd3d747cbbeef

Download Submit
\Windows\system\yAxHaab.exe

Filesize
2.3MB

MD5
5656d418fcd2213c98ce3d72a9742be0

SHA1
29fd918c35a4c7a8f3cd30efbf8d373d554a694e

SHA256
9df0e64fea9e0b21f974d308e791b9a1bc81cd2e73ce1a2a2a791cf6df8fa3f2

SHA512
18de35e3f8b1316da91fdfdef921e21632332168ff5ade68e583cf718239adec51900196dfdc7c06d73b758838b72dc763955650d369c9f63032bab3ed452fab

Download Submit
memory/2344-144-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2344-141-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2344-146-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2344-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2344-0-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2344-180-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2344-7-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2344-139-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2344-10-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2344-90-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-105-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2564-140-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2580-164-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-94-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2616-155-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2716-143-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2860-88-0x0000000002CD0000-0x0000000002D50000-memory.dmp

Filesize
512KB

Download
memory/2860-87-0x000007FEF5730000-0x000007FEF60CD000-memory.dmp

Filesize
9.6MB

Download
memory/2860-86-0x000007FEF5730000-0x000007FEF60CD000-memory.dmp

Filesize
9.6MB

Download
memory/2860-85-0x0000000002330000-0x0000000002338000-memory.dmp

Filesize
32KB

Download
memory/2860-84-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2860-20-0x0000000002CD0000-0x0000000002D50000-memory.dmp

Filesize
512KB

Download
memory/2860-1079-0x000007FEF5730000-0x000007FEF60CD000-memory.dmp

Filesize
9.6MB

Download
memory/3008-8-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/3024-117-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download