xmrig | 786dda9eaf243e3ae6250f486a94b03ac398c664f4e46b43453e38711bee4716

Analysis

max time kernel
30s
max time network
32s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
Size

1.9MB
MD5

0b460da0df920caffe818c1bc5af4eab
SHA1

1d8ab2676e3539447e0e5c55ba92697cb91cfd33
SHA256

786dda9eaf243e3ae6250f486a94b03ac398c664f4e46b43453e38711bee4716
SHA512

33c63b9a6d996938ddda23af6fd5aa55e26479b9068f56eebca68c5ee8b6a93f00b6e6075bf78bb41413f28aef244ec47771aeefdd09967bfb8839303c0254f7
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4:NABX

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2744-177-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2552-183-0x000000013FC10000-0x0000000140002000-memory.dmp	xmrig
behavioral1/memory/2660-185-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/2632-188-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2848-104-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/2316-63-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig
behavioral1/memory/2788-190-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2556-186-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/1812-182-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2316	ARhqPve.exe
2848	lGtRvIL.exe
2744	aNDRDxb.exe
1812	TtAdMSU.exe
2552	LrYwkBl.exe
2660	pxhirjT.exe
2556	JMFpXJe.exe
2632	fVOMDit.exe
2788	RjnKiEV.exe
2672	XycZGmo.exe
2468	oAfcLiV.exe
2764	iWiJZCm.exe
2784	VYDFOYa.exe
1644	VTUFcfK.exe
2512	VwGHJiW.exe
2312	TQRlpmM.exe
1496	EhOnWWf.exe
1456	HgjuYmg.exe
2664	LTQaLlA.exe
2120	xZzgsrX.exe
1704	sIaIufe.exe
1096	vzaAIIU.exe
268	xzHRoIp.exe
1020	JkaCswg.exe
568	Vlonpvj.exe
2464	piHnhoB.exe
280	vUTYvfo.exe
1856	gudznpk.exe
1124	gFAbGCs.exe
976	soKXumD.exe
2492	iRtCyQW.exe
3024	fWhRUbJ.exe
572	YnShYEG.exe
1596	nUAsaAg.exe
1884	ZgjAOtN.exe
2384	UWmDFUv.exe
1852	yDAxodG.exe
1848	ednGDZn.exe
2888	dmlxqME.exe
3064	SxATWpl.exe
1932	lSlWUAG.exe
2016	dCMmOrm.exe
2396	qGhLCDj.exe
1424	DsYaiqj.exe
2816	QsGCdOA.exe
1404	nobUNwd.exe
2424	lBRyPZX.exe
604	lyjPcQi.exe
1308	jYZWphM.exe
2504	QqKWJnw.exe
2924	GoODYlr.exe
2956	JnNfkvA.exe
2616	cDNmnsr.exe
1684	ECrQziF.exe
2984	bIMpIxK.exe
2100	BGxnPBH.exe
748	eljxvtu.exe
1632	OtKUkVr.exe
1016	FlvKTjp.exe
1564	eRKYjmz.exe
1828	sKsZTHP.exe
1120	qUgDuXC.exe
2968	PnFrcws.exe
2548	ESAjaoi.exe

Loads dropped DLL 64 IoCs

pid	Process
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2340-5-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/files/0x0009000000014390-13.dat	upx
behavioral1/files/0x0006000000015cf6-111.dat	upx
behavioral1/files/0x00060000000155f3-46.dat	upx
behavioral1/memory/2744-177-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/memory/2552-183-0x000000013FC10000-0x0000000140002000-memory.dmp	upx
behavioral1/memory/2660-185-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/memory/2632-188-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/files/0x00060000000160af-178.dat	upx
behavioral1/files/0x0006000000015f01-148.dat	upx
behavioral1/files/0x0006000000015d98-142.dat	upx
behavioral1/files/0x0007000000015d27-135.dat	upx
behavioral1/files/0x0006000000015d1a-129.dat	upx
behavioral1/files/0x0006000000015cfe-119.dat	upx
behavioral1/files/0x0006000000015cee-108.dat	upx
behavioral1/memory/2848-104-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/files/0x0006000000015cb6-100.dat	upx
behavioral1/files/0x0006000000015c83-90.dat	upx
behavioral1/files/0x0006000000015c6b-84.dat	upx
behavioral1/files/0x0006000000015c3d-78.dat	upx
behavioral1/files/0x0006000000015616-73.dat	upx
behavioral1/files/0x00060000000155f7-72.dat	upx
behavioral1/files/0x00070000000155ed-71.dat	upx
behavioral1/files/0x0006000000015626-69.dat	upx
behavioral1/memory/2316-63-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/files/0x0006000000015605-58.dat	upx
behavioral1/files/0x0009000000014de9-57.dat	upx
behavioral1/files/0x0007000000015018-35.dat	upx
behavioral1/memory/2788-190-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/2556-186-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/memory/1812-182-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/files/0x0006000000016176-181.dat	upx
behavioral1/files/0x0006000000015f7a-165.dat	upx
behavioral1/files/0x0006000000015df1-164.dat	upx
behavioral1/files/0x0006000000015d31-163.dat	upx
behavioral1/files/0x000f000000005578-162.dat	upx
behavioral1/files/0x0006000000015d07-161.dat	upx
behavioral1/files/0x0006000000015cce-118.dat	upx
behavioral1/files/0x0006000000015c9f-117.dat	upx
behavioral1/files/0x0006000000015c78-116.dat	upx
behavioral1/files/0x0006000000015c52-115.dat	upx
behavioral1/files/0x0006000000015b6f-113.dat	upx
behavioral1/files/0x00070000000149f5-40.dat	upx
behavioral1/files/0x00080000000147ea-39.dat	upx
behavioral1/files/0x0007000000014abe-50.dat	upx
behavioral1/files/0x0007000000014ef8-45.dat	upx
behavioral1/files/0x000a000000014af6-44.dat	upx
behavioral1/files/0x0007000000014825-38.dat	upx
behavioral1/files/0x00090000000146a2-9.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fKLSEXU.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\RtaKnYj.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\xDZWnpo.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\RvQqiEY.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\JXSgnqL.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\biGPsLH.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\nieVGxg.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\UFSeqJv.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\LUvNflM.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\XUXYeuR.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\SJQLgKH.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\lbcNvqT.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\hkQRygx.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\gChYoVq.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\JXaqfxd.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\cMsQULP.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\WHnsKxB.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\MCJDPeB.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\NgrSXUx.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\FOWZiLo.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\RIRsmkJ.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\LQQtnYi.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\ddhRTAN.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\fwSfWHg.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\KWXWNgw.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\DjWuHut.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\wGHSbyR.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\DAOQRDZ.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\OyoBHRf.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\ZnrGLoj.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\GyQJGWY.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\cCNIBVx.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\thteGbm.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\heqOmRK.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\wCaZYtN.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\BXFcFdG.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\JdWhQWy.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\gNoXqDO.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\OBJQdow.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\qdrhSRL.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\VGjqaLi.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\UQtYAHh.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\cIdYfiC.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\nuqqvnL.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\sIaIufe.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\OSoQCte.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\GoODYlr.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\npVNwrj.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\QvfkivT.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\AwPAGzZ.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\lSlWUAG.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\FlvKTjp.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\xXAvZcn.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\dHkPiCk.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\JAAPtxG.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\jKQWaLy.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\zmcInVN.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\fcdOjzt.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\yLiNThw.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\myBFlUi.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\pQbntVm.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\dDooqtC.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\LRnxwKc.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
File created	C:\Windows\System\jRDbDWa.exe	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1672	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
Token: SeDebugPrivilege	1672	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 1672	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	29
PID 2340 wrote to memory of 1672	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	29
PID 2340 wrote to memory of 1672	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	29
PID 2340 wrote to memory of 2848	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	30
PID 2340 wrote to memory of 2848	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	30
PID 2340 wrote to memory of 2848	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	30
PID 2340 wrote to memory of 2316	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	31
PID 2340 wrote to memory of 2316	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	31
PID 2340 wrote to memory of 2316	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	31
PID 2340 wrote to memory of 1812	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	32
PID 2340 wrote to memory of 1812	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	32
PID 2340 wrote to memory of 1812	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	32
PID 2340 wrote to memory of 2744	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	33
PID 2340 wrote to memory of 2744	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	33
PID 2340 wrote to memory of 2744	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	33
PID 2340 wrote to memory of 2552	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	34
PID 2340 wrote to memory of 2552	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	34
PID 2340 wrote to memory of 2552	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	34
PID 2340 wrote to memory of 2632	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	35
PID 2340 wrote to memory of 2632	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	35
PID 2340 wrote to memory of 2632	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	35
PID 2340 wrote to memory of 2660	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	36
PID 2340 wrote to memory of 2660	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	36
PID 2340 wrote to memory of 2660	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	36
PID 2340 wrote to memory of 2788	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	37
PID 2340 wrote to memory of 2788	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	37
PID 2340 wrote to memory of 2788	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	37
PID 2340 wrote to memory of 2556	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	38
PID 2340 wrote to memory of 2556	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	38
PID 2340 wrote to memory of 2556	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	38
PID 2340 wrote to memory of 2784	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	39
PID 2340 wrote to memory of 2784	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	39
PID 2340 wrote to memory of 2784	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	39
PID 2340 wrote to memory of 2672	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	40
PID 2340 wrote to memory of 2672	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	40
PID 2340 wrote to memory of 2672	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	40
PID 2340 wrote to memory of 2664	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	41
PID 2340 wrote to memory of 2664	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	41
PID 2340 wrote to memory of 2664	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	41
PID 2340 wrote to memory of 2468	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	42
PID 2340 wrote to memory of 2468	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	42
PID 2340 wrote to memory of 2468	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	42
PID 2340 wrote to memory of 2464	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	43
PID 2340 wrote to memory of 2464	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	43
PID 2340 wrote to memory of 2464	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	43
PID 2340 wrote to memory of 2764	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	44
PID 2340 wrote to memory of 2764	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	44
PID 2340 wrote to memory of 2764	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	44
PID 2340 wrote to memory of 1856	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	45
PID 2340 wrote to memory of 1856	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	45
PID 2340 wrote to memory of 1856	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	45
PID 2340 wrote to memory of 1644	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	46
PID 2340 wrote to memory of 1644	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	46
PID 2340 wrote to memory of 1644	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	46
PID 2340 wrote to memory of 2492	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	47
PID 2340 wrote to memory of 2492	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	47
PID 2340 wrote to memory of 2492	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	47
PID 2340 wrote to memory of 2512	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	48
PID 2340 wrote to memory of 2512	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	48
PID 2340 wrote to memory of 2512	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	48
PID 2340 wrote to memory of 1884	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	49
PID 2340 wrote to memory of 1884	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	49
PID 2340 wrote to memory of 1884	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	49
PID 2340 wrote to memory of 2312	2340	0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b460da0df920caffe818c1bc5af4eab_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\System\lGtRvIL.exe
  C:\Windows\System\lGtRvIL.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\ARhqPve.exe
  C:\Windows\System\ARhqPve.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\TtAdMSU.exe
  C:\Windows\System\TtAdMSU.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\aNDRDxb.exe
  C:\Windows\System\aNDRDxb.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\LrYwkBl.exe
  C:\Windows\System\LrYwkBl.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\fVOMDit.exe
  C:\Windows\System\fVOMDit.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\pxhirjT.exe
  C:\Windows\System\pxhirjT.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\RjnKiEV.exe
  C:\Windows\System\RjnKiEV.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\JMFpXJe.exe
  C:\Windows\System\JMFpXJe.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\VYDFOYa.exe
  C:\Windows\System\VYDFOYa.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\XycZGmo.exe
  C:\Windows\System\XycZGmo.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\LTQaLlA.exe
  C:\Windows\System\LTQaLlA.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\oAfcLiV.exe
  C:\Windows\System\oAfcLiV.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\piHnhoB.exe
  C:\Windows\System\piHnhoB.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\iWiJZCm.exe
  C:\Windows\System\iWiJZCm.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\gudznpk.exe
  C:\Windows\System\gudznpk.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\VTUFcfK.exe
  C:\Windows\System\VTUFcfK.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\iRtCyQW.exe
  C:\Windows\System\iRtCyQW.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\VwGHJiW.exe
  C:\Windows\System\VwGHJiW.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\ZgjAOtN.exe
  C:\Windows\System\ZgjAOtN.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\TQRlpmM.exe
  C:\Windows\System\TQRlpmM.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\UWmDFUv.exe
  C:\Windows\System\UWmDFUv.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\EhOnWWf.exe
  C:\Windows\System\EhOnWWf.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\yDAxodG.exe
  C:\Windows\System\yDAxodG.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\HgjuYmg.exe
  C:\Windows\System\HgjuYmg.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\ednGDZn.exe
  C:\Windows\System\ednGDZn.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\xZzgsrX.exe
  C:\Windows\System\xZzgsrX.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\SxATWpl.exe
  C:\Windows\System\SxATWpl.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\sIaIufe.exe
  C:\Windows\System\sIaIufe.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\lSlWUAG.exe
  C:\Windows\System\lSlWUAG.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\vzaAIIU.exe
  C:\Windows\System\vzaAIIU.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\dCMmOrm.exe
  C:\Windows\System\dCMmOrm.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\xzHRoIp.exe
  C:\Windows\System\xzHRoIp.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\qGhLCDj.exe
  C:\Windows\System\qGhLCDj.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\JkaCswg.exe
  C:\Windows\System\JkaCswg.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\DsYaiqj.exe
  C:\Windows\System\DsYaiqj.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\Vlonpvj.exe
  C:\Windows\System\Vlonpvj.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\QsGCdOA.exe
  C:\Windows\System\QsGCdOA.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\vUTYvfo.exe
  C:\Windows\System\vUTYvfo.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\nobUNwd.exe
  C:\Windows\System\nobUNwd.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\gFAbGCs.exe
  C:\Windows\System\gFAbGCs.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\lyjPcQi.exe
  C:\Windows\System\lyjPcQi.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\soKXumD.exe
  C:\Windows\System\soKXumD.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\jYZWphM.exe
  C:\Windows\System\jYZWphM.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\fWhRUbJ.exe
  C:\Windows\System\fWhRUbJ.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\QqKWJnw.exe
  C:\Windows\System\QqKWJnw.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\YnShYEG.exe
  C:\Windows\System\YnShYEG.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\GoODYlr.exe
  C:\Windows\System\GoODYlr.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\nUAsaAg.exe
  C:\Windows\System\nUAsaAg.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\JnNfkvA.exe
  C:\Windows\System\JnNfkvA.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\dmlxqME.exe
  C:\Windows\System\dmlxqME.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\cDNmnsr.exe
  C:\Windows\System\cDNmnsr.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\lBRyPZX.exe
  C:\Windows\System\lBRyPZX.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\bIMpIxK.exe
  C:\Windows\System\bIMpIxK.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\ECrQziF.exe
  C:\Windows\System\ECrQziF.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\BGxnPBH.exe
  C:\Windows\System\BGxnPBH.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\eljxvtu.exe
  C:\Windows\System\eljxvtu.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\OtKUkVr.exe
  C:\Windows\System\OtKUkVr.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\FlvKTjp.exe
  C:\Windows\System\FlvKTjp.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\eRKYjmz.exe
  C:\Windows\System\eRKYjmz.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\sKsZTHP.exe
  C:\Windows\System\sKsZTHP.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\qUgDuXC.exe
  C:\Windows\System\qUgDuXC.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\PnFrcws.exe
  C:\Windows\System\PnFrcws.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\ESAjaoi.exe
  C:\Windows\System\ESAjaoi.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\OgndTAM.exe
  C:\Windows\System\OgndTAM.exe
  2⤵
  PID:2684
- C:\Windows\System\TbGJNnn.exe
  C:\Windows\System\TbGJNnn.exe
  2⤵
  PID:2388
- C:\Windows\System\KLWzxxT.exe
  C:\Windows\System\KLWzxxT.exe
  2⤵
  PID:1660
- C:\Windows\System\UapMsOk.exe
  C:\Windows\System\UapMsOk.exe
  2⤵
  PID:2440
- C:\Windows\System\lRRjnxo.exe
  C:\Windows\System\lRRjnxo.exe
  2⤵
  PID:940
- C:\Windows\System\GyQJGWY.exe
  C:\Windows\System\GyQJGWY.exe
  2⤵
  PID:1620
- C:\Windows\System\dCyawSy.exe
  C:\Windows\System\dCyawSy.exe
  2⤵
  PID:2600
- C:\Windows\System\SQnFjLO.exe
  C:\Windows\System\SQnFjLO.exe
  2⤵
  PID:2088
- C:\Windows\System\tztUdUN.exe
  C:\Windows\System\tztUdUN.exe
  2⤵
  PID:868
- C:\Windows\System\BVeINty.exe
  C:\Windows\System\BVeINty.exe
  2⤵
  PID:832
- C:\Windows\System\CVHVjIH.exe
  C:\Windows\System\CVHVjIH.exe
  2⤵
  PID:756
- C:\Windows\System\fKLSEXU.exe
  C:\Windows\System\fKLSEXU.exe
  2⤵
  PID:2932
- C:\Windows\System\dKNPmsf.exe
  C:\Windows\System\dKNPmsf.exe
  2⤵
  PID:2012
- C:\Windows\System\JPRnJvR.exe
  C:\Windows\System\JPRnJvR.exe
  2⤵
  PID:3032
- C:\Windows\System\dCHLFpd.exe
  C:\Windows\System\dCHLFpd.exe
  2⤵
  PID:2532
- C:\Windows\System\oaNBiBT.exe
  C:\Windows\System\oaNBiBT.exe
  2⤵
  PID:2580
- C:\Windows\System\oGxOFMV.exe
  C:\Windows\System\oGxOFMV.exe
  2⤵
  PID:2460
- C:\Windows\System\crkHSAT.exe
  C:\Windows\System\crkHSAT.exe
  2⤵
  PID:1628
- C:\Windows\System\atTCvlA.exe
  C:\Windows\System\atTCvlA.exe
  2⤵
  PID:1984
- C:\Windows\System\SbzDggb.exe
  C:\Windows\System\SbzDggb.exe
  2⤵
  PID:2208
- C:\Windows\System\TivdemP.exe
  C:\Windows\System\TivdemP.exe
  2⤵
  PID:2892
- C:\Windows\System\kDnmoZg.exe
  C:\Windows\System\kDnmoZg.exe
  2⤵
  PID:2996
- C:\Windows\System\aroubCV.exe
  C:\Windows\System\aroubCV.exe
  2⤵
  PID:1688
- C:\Windows\System\zNCJPiD.exe
  C:\Windows\System\zNCJPiD.exe
  2⤵
  PID:2560
- C:\Windows\System\xoUrDLL.exe
  C:\Windows\System\xoUrDLL.exe
  2⤵
  PID:936
- C:\Windows\System\zIVnBEB.exe
  C:\Windows\System\zIVnBEB.exe
  2⤵
  PID:2712
- C:\Windows\System\iumGRLE.exe
  C:\Windows\System\iumGRLE.exe
  2⤵
  PID:2412
- C:\Windows\System\wNszcYL.exe
  C:\Windows\System\wNszcYL.exe
  2⤵
  PID:2688
- C:\Windows\System\FCKhDKh.exe
  C:\Windows\System\FCKhDKh.exe
  2⤵
  PID:1160
- C:\Windows\System\rMsQZUt.exe
  C:\Windows\System\rMsQZUt.exe
  2⤵
  PID:2304
- C:\Windows\System\snuvfjZ.exe
  C:\Windows\System\snuvfjZ.exe
  2⤵
  PID:2884
- C:\Windows\System\RuJIiws.exe
  C:\Windows\System\RuJIiws.exe
  2⤵
  PID:2376
- C:\Windows\System\ksORSPv.exe
  C:\Windows\System\ksORSPv.exe
  2⤵
  PID:1800
- C:\Windows\System\yUwoKnH.exe
  C:\Windows\System\yUwoKnH.exe
  2⤵
  PID:1420
- C:\Windows\System\RKSKzrK.exe
  C:\Windows\System\RKSKzrK.exe
  2⤵
  PID:1748
- C:\Windows\System\JfrDcqK.exe
  C:\Windows\System\JfrDcqK.exe
  2⤵
  PID:1476
- C:\Windows\System\OJBupij.exe
  C:\Windows\System\OJBupij.exe
  2⤵
  PID:1116
- C:\Windows\System\IvUlVuV.exe
  C:\Windows\System\IvUlVuV.exe
  2⤵
  PID:1352
- C:\Windows\System\tmjXSfX.exe
  C:\Windows\System\tmjXSfX.exe
  2⤵
  PID:2868
- C:\Windows\System\GNJswEJ.exe
  C:\Windows\System\GNJswEJ.exe
  2⤵
  PID:448
- C:\Windows\System\DYyOcrY.exe
  C:\Windows\System\DYyOcrY.exe
  2⤵
  PID:1648
- C:\Windows\System\NFHSkzo.exe
  C:\Windows\System\NFHSkzo.exe
  2⤵
  PID:2444
- C:\Windows\System\XhNrUCT.exe
  C:\Windows\System\XhNrUCT.exe
  2⤵
  PID:2260
- C:\Windows\System\VrrKqXY.exe
  C:\Windows\System\VrrKqXY.exe
  2⤵
  PID:1612
- C:\Windows\System\ybGKBRB.exe
  C:\Windows\System\ybGKBRB.exe
  2⤵
  PID:2804
- C:\Windows\System\HrnVAXd.exe
  C:\Windows\System\HrnVAXd.exe
  2⤵
  PID:2000
- C:\Windows\System\AisXWbX.exe
  C:\Windows\System\AisXWbX.exe
  2⤵
  PID:924
- C:\Windows\System\OlOFjfz.exe
  C:\Windows\System\OlOFjfz.exe
  2⤵
  PID:2136
- C:\Windows\System\eQfOYgM.exe
  C:\Windows\System\eQfOYgM.exe
  2⤵
  PID:1112
- C:\Windows\System\dRuCzAo.exe
  C:\Windows\System\dRuCzAo.exe
  2⤵
  PID:2564
- C:\Windows\System\rqVpWHV.exe
  C:\Windows\System\rqVpWHV.exe
  2⤵
  PID:2676
- C:\Windows\System\uIlmWHe.exe
  C:\Windows\System\uIlmWHe.exe
  2⤵
  PID:2960
- C:\Windows\System\pUHKMgf.exe
  C:\Windows\System\pUHKMgf.exe
  2⤵
  PID:2524
- C:\Windows\System\gXOtJaB.exe
  C:\Windows\System\gXOtJaB.exe
  2⤵
  PID:2856
- C:\Windows\System\kpodbLi.exe
  C:\Windows\System\kpodbLi.exe
  2⤵
  PID:3028
- C:\Windows\System\Yvlhgif.exe
  C:\Windows\System\Yvlhgif.exe
  2⤵
  PID:1860
- C:\Windows\System\zmultnE.exe
  C:\Windows\System\zmultnE.exe
  2⤵
  PID:3084
- C:\Windows\System\SapOavm.exe
  C:\Windows\System\SapOavm.exe
  2⤵
  PID:3100
- C:\Windows\System\WnmslxT.exe
  C:\Windows\System\WnmslxT.exe
  2⤵
  PID:3116
- C:\Windows\System\TtlyFyW.exe
  C:\Windows\System\TtlyFyW.exe
  2⤵
  PID:3132
- C:\Windows\System\fkfcbzw.exe
  C:\Windows\System\fkfcbzw.exe
  2⤵
  PID:3152
- C:\Windows\System\PmlRSsh.exe
  C:\Windows\System\PmlRSsh.exe
  2⤵
  PID:3168
- C:\Windows\System\cmyXRjf.exe
  C:\Windows\System\cmyXRjf.exe
  2⤵
  PID:3184
- C:\Windows\System\TjtFXrN.exe
  C:\Windows\System\TjtFXrN.exe
  2⤵
  PID:3200
- C:\Windows\System\ZOYWDyE.exe
  C:\Windows\System\ZOYWDyE.exe
  2⤵
  PID:3216
- C:\Windows\System\QMHUVbC.exe
  C:\Windows\System\QMHUVbC.exe
  2⤵
  PID:3240
- C:\Windows\System\voLlnRV.exe
  C:\Windows\System\voLlnRV.exe
  2⤵
  PID:3256
- C:\Windows\System\rzlWXBy.exe
  C:\Windows\System\rzlWXBy.exe
  2⤵
  PID:3272
- C:\Windows\System\ZSyekCp.exe
  C:\Windows\System\ZSyekCp.exe
  2⤵
  PID:3288
- C:\Windows\System\WfTQQFD.exe
  C:\Windows\System\WfTQQFD.exe
  2⤵
  PID:3304
- C:\Windows\System\VcpUDao.exe
  C:\Windows\System\VcpUDao.exe
  2⤵
  PID:3320
- C:\Windows\System\iEjfxnR.exe
  C:\Windows\System\iEjfxnR.exe
  2⤵
  PID:3336
- C:\Windows\System\emHdnKp.exe
  C:\Windows\System\emHdnKp.exe
  2⤵
  PID:3352
- C:\Windows\System\QVGeFex.exe
  C:\Windows\System\QVGeFex.exe
  2⤵
  PID:3368
- C:\Windows\System\JDfcyzs.exe
  C:\Windows\System\JDfcyzs.exe
  2⤵
  PID:3384
- C:\Windows\System\rxIJpmg.exe
  C:\Windows\System\rxIJpmg.exe
  2⤵
  PID:3400
- C:\Windows\System\aroWmzX.exe
  C:\Windows\System\aroWmzX.exe
  2⤵
  PID:3416
- C:\Windows\System\bAlMAvq.exe
  C:\Windows\System\bAlMAvq.exe
  2⤵
  PID:3436
- C:\Windows\System\qeNCAns.exe
  C:\Windows\System\qeNCAns.exe
  2⤵
  PID:3452
- C:\Windows\System\wkxiymf.exe
  C:\Windows\System\wkxiymf.exe
  2⤵
  PID:3468
- C:\Windows\System\EoZhcXP.exe
  C:\Windows\System\EoZhcXP.exe
  2⤵
  PID:3484
- C:\Windows\System\WdHobiX.exe
  C:\Windows\System\WdHobiX.exe
  2⤵
  PID:3500
- C:\Windows\System\pVVEhLg.exe
  C:\Windows\System\pVVEhLg.exe
  2⤵
  PID:3520
- C:\Windows\System\IOMgNuR.exe
  C:\Windows\System\IOMgNuR.exe
  2⤵
  PID:3536
- C:\Windows\System\GjpJUXk.exe
  C:\Windows\System\GjpJUXk.exe
  2⤵
  PID:3552
- C:\Windows\System\hASrOkt.exe
  C:\Windows\System\hASrOkt.exe
  2⤵
  PID:3568
- C:\Windows\System\EyTSvYi.exe
  C:\Windows\System\EyTSvYi.exe
  2⤵
  PID:3652
- C:\Windows\System\nZAVHbr.exe
  C:\Windows\System\nZAVHbr.exe
  2⤵
  PID:3668
- C:\Windows\System\YVKnyqh.exe
  C:\Windows\System\YVKnyqh.exe
  2⤵
  PID:3684
- C:\Windows\System\biUJMYi.exe
  C:\Windows\System\biUJMYi.exe
  2⤵
  PID:3700
- C:\Windows\System\VRMcfwm.exe
  C:\Windows\System\VRMcfwm.exe
  2⤵
  PID:3716
- C:\Windows\System\TZZPxpi.exe
  C:\Windows\System\TZZPxpi.exe
  2⤵
  PID:3732
- C:\Windows\System\iAPuWqh.exe
  C:\Windows\System\iAPuWqh.exe
  2⤵
  PID:3748
- C:\Windows\System\PmUMUOZ.exe
  C:\Windows\System\PmUMUOZ.exe
  2⤵
  PID:3764
- C:\Windows\System\yEMsyCH.exe
  C:\Windows\System\yEMsyCH.exe
  2⤵
  PID:3780
- C:\Windows\System\bciWMZE.exe
  C:\Windows\System\bciWMZE.exe
  2⤵
  PID:3796
- C:\Windows\System\bFUonZm.exe
  C:\Windows\System\bFUonZm.exe
  2⤵
  PID:3812
- C:\Windows\System\NobZQfk.exe
  C:\Windows\System\NobZQfk.exe
  2⤵
  PID:3828
- C:\Windows\System\QSZiAbL.exe
  C:\Windows\System\QSZiAbL.exe
  2⤵
  PID:3844
- C:\Windows\System\FGsNBIG.exe
  C:\Windows\System\FGsNBIG.exe
  2⤵
  PID:3860
- C:\Windows\System\CLLJqJC.exe
  C:\Windows\System\CLLJqJC.exe
  2⤵
  PID:3876
- C:\Windows\System\ISJpxsi.exe
  C:\Windows\System\ISJpxsi.exe
  2⤵
  PID:3892
- C:\Windows\System\MANYpwW.exe
  C:\Windows\System\MANYpwW.exe
  2⤵
  PID:3908
- C:\Windows\System\kQfYJhv.exe
  C:\Windows\System\kQfYJhv.exe
  2⤵
  PID:3924
- C:\Windows\System\KUDZRaf.exe
  C:\Windows\System\KUDZRaf.exe
  2⤵
  PID:3940
- C:\Windows\System\wivUEPT.exe
  C:\Windows\System\wivUEPT.exe
  2⤵
  PID:3956
- C:\Windows\System\JvJCTDd.exe
  C:\Windows\System\JvJCTDd.exe
  2⤵
  PID:3972
- C:\Windows\System\ZibDykw.exe
  C:\Windows\System\ZibDykw.exe
  2⤵
  PID:3988
- C:\Windows\System\wHqjktA.exe
  C:\Windows\System\wHqjktA.exe
  2⤵
  PID:4004
- C:\Windows\System\bRahbNu.exe
  C:\Windows\System\bRahbNu.exe
  2⤵
  PID:4020
- C:\Windows\System\VZnrOAA.exe
  C:\Windows\System\VZnrOAA.exe
  2⤵
  PID:4036
- C:\Windows\System\CpmlcCU.exe
  C:\Windows\System\CpmlcCU.exe
  2⤵
  PID:4052
- C:\Windows\System\nqwqZfx.exe
  C:\Windows\System\nqwqZfx.exe
  2⤵
  PID:4068
- C:\Windows\System\DWTtPmb.exe
  C:\Windows\System\DWTtPmb.exe
  2⤵
  PID:4084
- C:\Windows\System\IdUFvWQ.exe
  C:\Windows\System\IdUFvWQ.exe
  2⤵
  PID:2572
- C:\Windows\System\cdoYxMO.exe
  C:\Windows\System\cdoYxMO.exe
  2⤵
  PID:2648
- C:\Windows\System\LupyGYJ.exe
  C:\Windows\System\LupyGYJ.exe
  2⤵
  PID:3096
- C:\Windows\System\KXyekos.exe
  C:\Windows\System\KXyekos.exe
  2⤵
  PID:3160
- C:\Windows\System\REuQreY.exe
  C:\Windows\System\REuQreY.exe
  2⤵
  PID:3228
- C:\Windows\System\afpiXAG.exe
  C:\Windows\System\afpiXAG.exe
  2⤵
  PID:3268
- C:\Windows\System\YHTLfYH.exe
  C:\Windows\System\YHTLfYH.exe
  2⤵
  PID:528
- C:\Windows\System\CsDjGVM.exe
  C:\Windows\System\CsDjGVM.exe
  2⤵
  PID:2700
- C:\Windows\System\dMdSXEO.exe
  C:\Windows\System\dMdSXEO.exe
  2⤵
  PID:1868
- C:\Windows\System\AOlKWxJ.exe
  C:\Windows\System\AOlKWxJ.exe
  2⤵
  PID:1260
- C:\Windows\System\ZBZTgzX.exe
  C:\Windows\System\ZBZTgzX.exe
  2⤵
  PID:3112
- C:\Windows\System\qwdbVIJ.exe
  C:\Windows\System\qwdbVIJ.exe
  2⤵
  PID:3176
- C:\Windows\System\rZJBGEH.exe
  C:\Windows\System\rZJBGEH.exe
  2⤵
  PID:2748
- C:\Windows\System\dvzflya.exe
  C:\Windows\System\dvzflya.exe
  2⤵
  PID:3296
- C:\Windows\System\ZamZijp.exe
  C:\Windows\System\ZamZijp.exe
  2⤵
  PID:3328
- C:\Windows\System\xXAvZcn.exe
  C:\Windows\System\xXAvZcn.exe
  2⤵
  PID:3428
- C:\Windows\System\EwBnvRU.exe
  C:\Windows\System\EwBnvRU.exe
  2⤵
  PID:3492
- C:\Windows\System\DlLZmbv.exe
  C:\Windows\System\DlLZmbv.exe
  2⤵
  PID:3532
- C:\Windows\System\hibsBsZ.exe
  C:\Windows\System\hibsBsZ.exe
  2⤵
  PID:3664
- C:\Windows\System\jxdVtuu.exe
  C:\Windows\System\jxdVtuu.exe
  2⤵
  PID:2420
- C:\Windows\System\miiHFlv.exe
  C:\Windows\System\miiHFlv.exe
  2⤵
  PID:3408
- C:\Windows\System\WOLwwgq.exe
  C:\Windows\System\WOLwwgq.exe
  2⤵
  PID:3756
- C:\Windows\System\ICPjgCk.exe
  C:\Windows\System\ICPjgCk.exe
  2⤵
  PID:3820
- C:\Windows\System\bgKUekC.exe
  C:\Windows\System\bgKUekC.exe
  2⤵
  PID:3480
- C:\Windows\System\nvvrWaT.exe
  C:\Windows\System\nvvrWaT.exe
  2⤵
  PID:3544
- C:\Windows\System\FeHlJVU.exe
  C:\Windows\System\FeHlJVU.exe
  2⤵
  PID:3580
- C:\Windows\System\CiqZvmR.exe
  C:\Windows\System\CiqZvmR.exe
  2⤵
  PID:3920
- C:\Windows\System\VqvTivL.exe
  C:\Windows\System\VqvTivL.exe
  2⤵
  PID:2576
- C:\Windows\System\fwSfWHg.exe
  C:\Windows\System\fwSfWHg.exe
  2⤵
  PID:4012
- C:\Windows\System\fdtTYIq.exe
  C:\Windows\System\fdtTYIq.exe
  2⤵
  PID:3628
- C:\Windows\System\xovZnRe.exe
  C:\Windows\System\xovZnRe.exe
  2⤵
  PID:4048
- C:\Windows\System\ixuAqsM.exe
  C:\Windows\System\ixuAqsM.exe
  2⤵
  PID:496
- C:\Windows\System\ETzxVXW.exe
  C:\Windows\System\ETzxVXW.exe
  2⤵
  PID:3264
- C:\Windows\System\jWcmybS.exe
  C:\Windows\System\jWcmybS.exe
  2⤵
  PID:3676
- C:\Windows\System\FGTcLFf.exe
  C:\Windows\System\FGTcLFf.exe
  2⤵
  PID:3312
- C:\Windows\System\MentjKu.exe
  C:\Windows\System\MentjKu.exe
  2⤵
  PID:3772
- C:\Windows\System\UaNcGhE.exe
  C:\Windows\System\UaNcGhE.exe
  2⤵
  PID:3808
- C:\Windows\System\LxeBERZ.exe
  C:\Windows\System\LxeBERZ.exe
  2⤵
  PID:3868
- C:\Windows\System\sCawHIk.exe
  C:\Windows\System\sCawHIk.exe
  2⤵
  PID:3900
- C:\Windows\System\KWXWNgw.exe
  C:\Windows\System\KWXWNgw.exe
  2⤵
  PID:4112
- C:\Windows\System\ELLKWJr.exe
  C:\Windows\System\ELLKWJr.exe
  2⤵
  PID:4128
- C:\Windows\System\HXZmmVh.exe
  C:\Windows\System\HXZmmVh.exe
  2⤵
  PID:4144
- C:\Windows\System\lwXCZTA.exe
  C:\Windows\System\lwXCZTA.exe
  2⤵
  PID:4160
- C:\Windows\System\MZDeTIt.exe
  C:\Windows\System\MZDeTIt.exe
  2⤵
  PID:4176
- C:\Windows\System\BBQysvs.exe
  C:\Windows\System\BBQysvs.exe
  2⤵
  PID:4192
- C:\Windows\System\NwPMSvm.exe
  C:\Windows\System\NwPMSvm.exe
  2⤵
  PID:4208
- C:\Windows\System\vqnswtB.exe
  C:\Windows\System\vqnswtB.exe
  2⤵
  PID:4224
- C:\Windows\System\PSGxfYt.exe
  C:\Windows\System\PSGxfYt.exe
  2⤵
  PID:4240
- C:\Windows\System\DphtKcl.exe
  C:\Windows\System\DphtKcl.exe
  2⤵
  PID:4256
- C:\Windows\System\teYdlVK.exe
  C:\Windows\System\teYdlVK.exe
  2⤵
  PID:4272
- C:\Windows\System\JAAPtxG.exe
  C:\Windows\System\JAAPtxG.exe
  2⤵
  PID:4288
- C:\Windows\System\GDbqgln.exe
  C:\Windows\System\GDbqgln.exe
  2⤵
  PID:4304
- C:\Windows\System\wfdKblY.exe
  C:\Windows\System\wfdKblY.exe
  2⤵
  PID:4320
- C:\Windows\System\xmRnyCf.exe
  C:\Windows\System\xmRnyCf.exe
  2⤵
  PID:4336
- C:\Windows\System\HZOTqrb.exe
  C:\Windows\System\HZOTqrb.exe
  2⤵
  PID:4352
- C:\Windows\System\VGjqaLi.exe
  C:\Windows\System\VGjqaLi.exe
  2⤵
  PID:4368
- C:\Windows\System\nJVssQt.exe
  C:\Windows\System\nJVssQt.exe
  2⤵
  PID:4384
- C:\Windows\System\xzBeFQc.exe
  C:\Windows\System\xzBeFQc.exe
  2⤵
  PID:4400
- C:\Windows\System\WFHXHgd.exe
  C:\Windows\System\WFHXHgd.exe
  2⤵
  PID:4416
- C:\Windows\System\sLrHEyv.exe
  C:\Windows\System\sLrHEyv.exe
  2⤵
  PID:4432
- C:\Windows\System\MgFZycO.exe
  C:\Windows\System\MgFZycO.exe
  2⤵
  PID:4448
- C:\Windows\System\QfiaWCg.exe
  C:\Windows\System\QfiaWCg.exe
  2⤵
  PID:4464
- C:\Windows\System\sjPfSgu.exe
  C:\Windows\System\sjPfSgu.exe
  2⤵
  PID:4480
- C:\Windows\System\hCQvccI.exe
  C:\Windows\System\hCQvccI.exe
  2⤵
  PID:4496
- C:\Windows\System\JvcISSW.exe
  C:\Windows\System\JvcISSW.exe
  2⤵
  PID:4512
- C:\Windows\System\QgBbPgW.exe
  C:\Windows\System\QgBbPgW.exe
  2⤵
  PID:4528
- C:\Windows\System\BHYRmAB.exe
  C:\Windows\System\BHYRmAB.exe
  2⤵
  PID:4544
- C:\Windows\System\lbcNvqT.exe
  C:\Windows\System\lbcNvqT.exe
  2⤵
  PID:4560
- C:\Windows\System\EszxWNm.exe
  C:\Windows\System\EszxWNm.exe
  2⤵
  PID:4576
- C:\Windows\System\TqRsXKz.exe
  C:\Windows\System\TqRsXKz.exe
  2⤵
  PID:4592
- C:\Windows\System\rcjbofa.exe
  C:\Windows\System\rcjbofa.exe
  2⤵
  PID:4608
- C:\Windows\System\xSGwXzb.exe
  C:\Windows\System\xSGwXzb.exe
  2⤵
  PID:4624
- C:\Windows\System\jLcUvMI.exe
  C:\Windows\System\jLcUvMI.exe
  2⤵
  PID:4640
- C:\Windows\System\nAwXmfU.exe
  C:\Windows\System\nAwXmfU.exe
  2⤵
  PID:4656
- C:\Windows\System\ekkFBYJ.exe
  C:\Windows\System\ekkFBYJ.exe
  2⤵
  PID:4672
- C:\Windows\System\RgyoHKF.exe
  C:\Windows\System\RgyoHKF.exe
  2⤵
  PID:4688
- C:\Windows\System\SZSIVhe.exe
  C:\Windows\System\SZSIVhe.exe
  2⤵
  PID:4704
- C:\Windows\System\WxUZQCd.exe
  C:\Windows\System\WxUZQCd.exe
  2⤵
  PID:4720
- C:\Windows\System\eSfSJTe.exe
  C:\Windows\System\eSfSJTe.exe
  2⤵
  PID:4736
- C:\Windows\System\xlhFaZa.exe
  C:\Windows\System\xlhFaZa.exe
  2⤵
  PID:4752
- C:\Windows\System\QiWYPie.exe
  C:\Windows\System\QiWYPie.exe
  2⤵
  PID:4768
- C:\Windows\System\YXLVTrx.exe
  C:\Windows\System\YXLVTrx.exe
  2⤵
  PID:4784
- C:\Windows\System\AwRWMWC.exe
  C:\Windows\System\AwRWMWC.exe
  2⤵
  PID:4800
- C:\Windows\System\hQJDOiN.exe
  C:\Windows\System\hQJDOiN.exe
  2⤵
  PID:4816
- C:\Windows\System\txBgrXi.exe
  C:\Windows\System\txBgrXi.exe
  2⤵
  PID:4832
- C:\Windows\System\NXvpsFp.exe
  C:\Windows\System\NXvpsFp.exe
  2⤵
  PID:4848
- C:\Windows\System\DvxMAZY.exe
  C:\Windows\System\DvxMAZY.exe
  2⤵
  PID:4864
- C:\Windows\System\EtiuIHp.exe
  C:\Windows\System\EtiuIHp.exe
  2⤵
  PID:4880
- C:\Windows\System\hqzemBR.exe
  C:\Windows\System\hqzemBR.exe
  2⤵
  PID:4896
- C:\Windows\System\sGZGfqc.exe
  C:\Windows\System\sGZGfqc.exe
  2⤵
  PID:4912
- C:\Windows\System\NIZPdvh.exe
  C:\Windows\System\NIZPdvh.exe
  2⤵
  PID:4928
- C:\Windows\System\hUnYHJE.exe
  C:\Windows\System\hUnYHJE.exe
  2⤵
  PID:4944
- C:\Windows\System\iqEhbOn.exe
  C:\Windows\System\iqEhbOn.exe
  2⤵
  PID:4960
- C:\Windows\System\lNGvyKb.exe
  C:\Windows\System\lNGvyKb.exe
  2⤵
  PID:4976
- C:\Windows\System\PULXFhJ.exe
  C:\Windows\System\PULXFhJ.exe
  2⤵
  PID:4992
- C:\Windows\System\WoxAamI.exe
  C:\Windows\System\WoxAamI.exe
  2⤵
  PID:5008
- C:\Windows\System\aYImKPS.exe
  C:\Windows\System\aYImKPS.exe
  2⤵
  PID:5024
- C:\Windows\System\bymCZSY.exe
  C:\Windows\System\bymCZSY.exe
  2⤵
  PID:5040
- C:\Windows\System\KQuzXgk.exe
  C:\Windows\System\KQuzXgk.exe
  2⤵
  PID:5056
- C:\Windows\System\vlmkvHA.exe
  C:\Windows\System\vlmkvHA.exe
  2⤵
  PID:5072
- C:\Windows\System\dyNjZVy.exe
  C:\Windows\System\dyNjZVy.exe
  2⤵
  PID:5088
- C:\Windows\System\lyEgKXM.exe
  C:\Windows\System\lyEgKXM.exe
  2⤵
  PID:5104
- C:\Windows\System\yUReIkL.exe
  C:\Windows\System\yUReIkL.exe
  2⤵
  PID:2112
- C:\Windows\System\lRGCidJ.exe
  C:\Windows\System\lRGCidJ.exe
  2⤵
  PID:3076
- C:\Windows\System\ODygGbK.exe
  C:\Windows\System\ODygGbK.exe
  2⤵
  PID:3968
- C:\Windows\System\chzSFEU.exe
  C:\Windows\System\chzSFEU.exe
  2⤵
  PID:4032
- C:\Windows\System\QisWtIw.exe
  C:\Windows\System\QisWtIw.exe
  2⤵
  PID:3604
- C:\Windows\System\CNYBFTC.exe
  C:\Windows\System\CNYBFTC.exe
  2⤵
  PID:3620
- C:\Windows\System\lnGitim.exe
  C:\Windows\System\lnGitim.exe
  2⤵
  PID:3092
- C:\Windows\System\JsxVqxb.exe
  C:\Windows\System\JsxVqxb.exe
  2⤵
  PID:2776
- C:\Windows\System\AlZtQRA.exe
  C:\Windows\System\AlZtQRA.exe
  2⤵
  PID:3680
- C:\Windows\System\hgBBrCb.exe
  C:\Windows\System\hgBBrCb.exe
  2⤵
  PID:3332
- C:\Windows\System\BXFcFdG.exe
  C:\Windows\System\BXFcFdG.exe
  2⤵
  PID:3564
- C:\Windows\System\nvxactW.exe
  C:\Windows\System\nvxactW.exe
  2⤵
  PID:944
- C:\Windows\System\UEStkKJ.exe
  C:\Windows\System\UEStkKJ.exe
  2⤵
  PID:3284
- C:\Windows\System\hkQRygx.exe
  C:\Windows\System\hkQRygx.exe
  2⤵
  PID:3444
- C:\Windows\System\JarZAEf.exe
  C:\Windows\System\JarZAEf.exe
  2⤵
  PID:3576
- C:\Windows\System\GyvWpfl.exe
  C:\Windows\System\GyvWpfl.exe
  2⤵
  PID:2772
- C:\Windows\System\xibyFML.exe
  C:\Windows\System\xibyFML.exe
  2⤵
  PID:3648
- C:\Windows\System\OIHIxgC.exe
  C:\Windows\System\OIHIxgC.exe
  2⤵
  PID:3380
- C:\Windows\System\gFtbhKP.exe
  C:\Windows\System\gFtbhKP.exe
  2⤵
  PID:3148
- C:\Windows\System\SMGSfHs.exe
  C:\Windows\System\SMGSfHs.exe
  2⤵
  PID:4200
- C:\Windows\System\OLQjUFd.exe
  C:\Windows\System\OLQjUFd.exe
  2⤵
  PID:4268
- C:\Windows\System\fKSvRpQ.exe
  C:\Windows\System\fKSvRpQ.exe
  2⤵
  PID:4332
- C:\Windows\System\PUVMluL.exe
  C:\Windows\System\PUVMluL.exe
  2⤵
  PID:3508
- C:\Windows\System\NYLWZzC.exe
  C:\Windows\System\NYLWZzC.exe
  2⤵
  PID:3984
- C:\Windows\System\jOMaZQH.exe
  C:\Windows\System\jOMaZQH.exe
  2⤵
  PID:3236
- C:\Windows\System\XkpRanC.exe
  C:\Windows\System\XkpRanC.exe
  2⤵
  PID:4760
- C:\Windows\System\cPQLBGx.exe
  C:\Windows\System\cPQLBGx.exe
  2⤵
  PID:5080
- C:\Windows\System\hOkEkia.exe
  C:\Windows\System\hOkEkia.exe
  2⤵
  PID:4168
- C:\Windows\System\qyOrOhz.exe
  C:\Windows\System\qyOrOhz.exe
  2⤵
  PID:1944
- C:\Windows\System\ZQZixSj.exe
  C:\Windows\System\ZQZixSj.exe
  2⤵
  PID:584
- C:\Windows\System\PNSjvVg.exe
  C:\Windows\System\PNSjvVg.exe
  2⤵
  PID:3932
- C:\Windows\System\vrBZkhC.exe
  C:\Windows\System\vrBZkhC.exe
  2⤵
  PID:1940
- C:\Windows\System\YSlhNNE.exe
  C:\Windows\System\YSlhNNE.exe
  2⤵
  PID:4380
- C:\Windows\System\SihFpXR.exe
  C:\Windows\System\SihFpXR.exe
  2⤵
  PID:4444
- C:\Windows\System\RNzlwsE.exe
  C:\Windows\System\RNzlwsE.exe
  2⤵
  PID:2704
- C:\Windows\System\zKNOFrb.exe
  C:\Windows\System\zKNOFrb.exe
  2⤵
  PID:1784
- C:\Windows\System\aKvbgmN.exe
  C:\Windows\System\aKvbgmN.exe
  2⤵
  PID:4248
- C:\Windows\System\CQimVnO.exe
  C:\Windows\System\CQimVnO.exe
  2⤵
  PID:4600
- C:\Windows\System\jVJYbki.exe
  C:\Windows\System\jVJYbki.exe
  2⤵
  PID:4280
- C:\Windows\System\mFByAfX.exe
  C:\Windows\System\mFByAfX.exe
  2⤵
  PID:4520
- C:\Windows\System\nyaRqGz.exe
  C:\Windows\System\nyaRqGz.exe
  2⤵
  PID:4360
- C:\Windows\System\IuWytvD.exe
  C:\Windows\System\IuWytvD.exe
  2⤵
  PID:4396
- C:\Windows\System\wTQVFUa.exe
  C:\Windows\System\wTQVFUa.exe
  2⤵
  PID:4232
- C:\Windows\System\yqGwwLL.exe
  C:\Windows\System\yqGwwLL.exe
  2⤵
  PID:4588
- C:\Windows\System\pljzUxm.exe
  C:\Windows\System\pljzUxm.exe
  2⤵
  PID:3108
- C:\Windows\System\dzSnptR.exe
  C:\Windows\System\dzSnptR.exe
  2⤵
  PID:3056
- C:\Windows\System\EBCajUt.exe
  C:\Windows\System\EBCajUt.exe
  2⤵
  PID:4664
- C:\Windows\System\rTrClnL.exe
  C:\Windows\System\rTrClnL.exe
  2⤵
  PID:1540
- C:\Windows\System\rJZJTnQ.exe
  C:\Windows\System\rJZJTnQ.exe
  2⤵
  PID:4284
- C:\Windows\System\BZincjn.exe
  C:\Windows\System\BZincjn.exe
  2⤵
  PID:4732
- C:\Windows\System\ZHncIKg.exe
  C:\Windows\System\ZHncIKg.exe
  2⤵
  PID:4716
- C:\Windows\System\UAAppaQ.exe
  C:\Windows\System\UAAppaQ.exe
  2⤵
  PID:2116
- C:\Windows\System\XlIJonP.exe
  C:\Windows\System\XlIJonP.exe
  2⤵
  PID:4840
- C:\Windows\System\enpDvSx.exe
  C:\Windows\System\enpDvSx.exe
  2⤵
  PID:5096
- C:\Windows\System\GolhPUD.exe
  C:\Windows\System\GolhPUD.exe
  2⤵
  PID:3696
- C:\Windows\System\SgeTGBO.exe
  C:\Windows\System\SgeTGBO.exe
  2⤵
  PID:4908
- C:\Windows\System\WxafOwZ.exe
  C:\Windows\System\WxafOwZ.exe
  2⤵
  PID:5084
- C:\Windows\System\kppcaRm.exe
  C:\Windows\System\kppcaRm.exe
  2⤵
  PID:3460
- C:\Windows\System\XESzwkp.exe
  C:\Windows\System\XESzwkp.exe
  2⤵
  PID:3980
- C:\Windows\System\JkeMIsu.exe
  C:\Windows\System\JkeMIsu.exe
  2⤵
  PID:4172
- C:\Windows\System\npVNwrj.exe
  C:\Windows\System\npVNwrj.exe
  2⤵
  PID:4748
- C:\Windows\System\IMoejKl.exe
  C:\Windows\System\IMoejKl.exe
  2⤵
  PID:4604
- C:\Windows\System\SbOIWDg.exe
  C:\Windows\System\SbOIWDg.exe
  2⤵
  PID:5068
- C:\Windows\System\nDDSOPu.exe
  C:\Windows\System\nDDSOPu.exe
  2⤵
  PID:4844
- C:\Windows\System\ovCjrAi.exe
  C:\Windows\System\ovCjrAi.exe
  2⤵
  PID:4968
- C:\Windows\System\ieNzhrs.exe
  C:\Windows\System\ieNzhrs.exe
  2⤵
  PID:4972
- C:\Windows\System\XiFZLSj.exe
  C:\Windows\System\XiFZLSj.exe
  2⤵
  PID:3964
- C:\Windows\System\mPLfsKM.exe
  C:\Windows\System\mPLfsKM.exe
  2⤵
  PID:3448
- C:\Windows\System\JftyHuT.exe
  C:\Windows\System\JftyHuT.exe
  2⤵
  PID:5048
- C:\Windows\System\xJuiOqi.exe
  C:\Windows\System\xJuiOqi.exe
  2⤵
  PID:4652
- C:\Windows\System\WCbXttD.exe
  C:\Windows\System\WCbXttD.exe
  2⤵
  PID:2472
- C:\Windows\System\xOWyjYd.exe
  C:\Windows\System\xOWyjYd.exe
  2⤵
  PID:4136
- C:\Windows\System\jndsTer.exe
  C:\Windows\System\jndsTer.exe
  2⤵
  PID:3164
- C:\Windows\System\ZIVIQIn.exe
  C:\Windows\System\ZIVIQIn.exe
  2⤵
  PID:4184
- C:\Windows\System\JXRzZrN.exe
  C:\Windows\System\JXRzZrN.exe
  2⤵
  PID:1216
- C:\Windows\System\pAFZjke.exe
  C:\Windows\System\pAFZjke.exe
  2⤵
  PID:2344
- C:\Windows\System\pSXiIze.exe
  C:\Windows\System\pSXiIze.exe
  2⤵
  PID:1844
- C:\Windows\System\VNLCbqa.exe
  C:\Windows\System\VNLCbqa.exe
  2⤵
  PID:2280
- C:\Windows\System\rqjDYqS.exe
  C:\Windows\System\rqjDYqS.exe
  2⤵
  PID:4440
- C:\Windows\System\JdWhQWy.exe
  C:\Windows\System\JdWhQWy.exe
  2⤵
  PID:4060
- C:\Windows\System\bgjuUiz.exe
  C:\Windows\System\bgjuUiz.exe
  2⤵
  PID:4828
- C:\Windows\System\HqvhpKQ.exe
  C:\Windows\System\HqvhpKQ.exe
  2⤵
  PID:948
- C:\Windows\System\MkZZUxA.exe
  C:\Windows\System\MkZZUxA.exe
  2⤵
  PID:2204
- C:\Windows\System\huostcI.exe
  C:\Windows\System\huostcI.exe
  2⤵
  PID:5020
- C:\Windows\System\ynlbCGO.exe
  C:\Windows\System\ynlbCGO.exe
  2⤵
  PID:4860
- C:\Windows\System\uBModLt.exe
  C:\Windows\System\uBModLt.exe
  2⤵
  PID:1720
- C:\Windows\System\ElWZeXx.exe
  C:\Windows\System\ElWZeXx.exe
  2⤵
  PID:4364
- C:\Windows\System\aQLqhwu.exe
  C:\Windows\System\aQLqhwu.exe
  2⤵
  PID:1240
- C:\Windows\System\bJvvUGt.exe
  C:\Windows\System\bJvvUGt.exe
  2⤵
  PID:2640
- C:\Windows\System\rpjiCKv.exe
  C:\Windows\System\rpjiCKv.exe
  2⤵
  PID:2244
- C:\Windows\System\jKQWaLy.exe
  C:\Windows\System\jKQWaLy.exe
  2⤵
  PID:2904
- C:\Windows\System\zKxqAnS.exe
  C:\Windows\System\zKxqAnS.exe
  2⤵
  PID:4700
- C:\Windows\System\HgdKUGo.exe
  C:\Windows\System\HgdKUGo.exe
  2⤵
  PID:4476
- C:\Windows\System\OKfEmcC.exe
  C:\Windows\System\OKfEmcC.exe
  2⤵
  PID:5100
- C:\Windows\System\bmbngxG.exe
  C:\Windows\System\bmbngxG.exe
  2⤵
  PID:3080
- C:\Windows\System\CDdZCoX.exe
  C:\Windows\System\CDdZCoX.exe
  2⤵
  PID:3424
- C:\Windows\System\phdwkhn.exe
  C:\Windows\System\phdwkhn.exe
  2⤵
  PID:2980
- C:\Windows\System\rBgRAKh.exe
  C:\Windows\System\rBgRAKh.exe
  2⤵
  PID:2944
- C:\Windows\System\eFiuBNO.exe
  C:\Windows\System\eFiuBNO.exe
  2⤵
  PID:2880
- C:\Windows\System\ohMCPJe.exe
  C:\Windows\System\ohMCPJe.exe
  2⤵
  PID:3464
- C:\Windows\System\irikQsj.exe
  C:\Windows\System\irikQsj.exe
  2⤵
  PID:2604
- C:\Windows\System\LQUpRLu.exe
  C:\Windows\System\LQUpRLu.exe
  2⤵
  PID:4460
- C:\Windows\System\hOnfxde.exe
  C:\Windows\System\hOnfxde.exe
  2⤵
  PID:4316
- C:\Windows\System\yxjeqUi.exe
  C:\Windows\System\yxjeqUi.exe
  2⤵
  PID:4684
- C:\Windows\System\LUqxGnx.exe
  C:\Windows\System\LUqxGnx.exe
  2⤵
  PID:3616
- C:\Windows\System\KJEgYaH.exe
  C:\Windows\System\KJEgYaH.exe
  2⤵
  PID:4568
- C:\Windows\System\OfuqjKQ.exe
  C:\Windows\System\OfuqjKQ.exe
  2⤵
  PID:4904
- C:\Windows\System\ZKSnEIN.exe
  C:\Windows\System\ZKSnEIN.exe
  2⤵
  PID:4808
- C:\Windows\System\WZcVpwo.exe
  C:\Windows\System\WZcVpwo.exe
  2⤵
  PID:3744
- C:\Windows\System\hrCxEKQ.exe
  C:\Windows\System\hrCxEKQ.exe
  2⤵
  PID:4524
- C:\Windows\System\RWGTTjY.exe
  C:\Windows\System\RWGTTjY.exe
  2⤵
  PID:2496
- C:\Windows\System\EZbyfiy.exe
  C:\Windows\System\EZbyfiy.exe
  2⤵
  PID:5052
- C:\Windows\System\hnExdzU.exe
  C:\Windows\System\hnExdzU.exe
  2⤵
  PID:3888
- C:\Windows\System\AzqAovu.exe
  C:\Windows\System\AzqAovu.exe
  2⤵
  PID:4220
- C:\Windows\System\onXeYHq.exe
  C:\Windows\System\onXeYHq.exe
  2⤵
  PID:3208
- C:\Windows\System\VCuqqgV.exe
  C:\Windows\System\VCuqqgV.exe
  2⤵
  PID:4044
- C:\Windows\System\kUDetBU.exe
  C:\Windows\System\kUDetBU.exe
  2⤵
  PID:1208
- C:\Windows\System\gHiHWdH.exe
  C:\Windows\System\gHiHWdH.exe
  2⤵
  PID:4536
- C:\Windows\System\ffsLiQL.exe
  C:\Windows\System\ffsLiQL.exe
  2⤵
  PID:4472
- C:\Windows\System\GcTXGQz.exe
  C:\Windows\System\GcTXGQz.exe
  2⤵
  PID:1636
- C:\Windows\System\yCGBjKo.exe
  C:\Windows\System\yCGBjKo.exe
  2⤵
  PID:4392
- C:\Windows\System\eJsXgxy.exe
  C:\Windows\System\eJsXgxy.exe
  2⤵
  PID:4236
- C:\Windows\System\zmcInVN.exe
  C:\Windows\System\zmcInVN.exe
  2⤵
  PID:4120
- C:\Windows\System\DBgTdYQ.exe
  C:\Windows\System\DBgTdYQ.exe
  2⤵
  PID:4312
- C:\Windows\System\qoAQWXN.exe
  C:\Windows\System\qoAQWXN.exe
  2⤵
  PID:4216
- C:\Windows\System\KMDtxUf.exe
  C:\Windows\System\KMDtxUf.exe
  2⤵
  PID:1296
- C:\Windows\System\dlSnfYe.exe
  C:\Windows\System\dlSnfYe.exe
  2⤵
  PID:880
- C:\Windows\System\kiZZKGi.exe
  C:\Windows\System\kiZZKGi.exe
  2⤵
  PID:4876
- C:\Windows\System\ISJQWNN.exe
  C:\Windows\System\ISJQWNN.exe
  2⤵
  PID:5124
- C:\Windows\System\aWsXcNR.exe
  C:\Windows\System\aWsXcNR.exe
  2⤵
  PID:5140
- C:\Windows\System\IMdJidK.exe
  C:\Windows\System\IMdJidK.exe
  2⤵
  PID:5156
- C:\Windows\System\eeZCuGT.exe
  C:\Windows\System\eeZCuGT.exe
  2⤵
  PID:5172
- C:\Windows\System\KratVYU.exe
  C:\Windows\System\KratVYU.exe
  2⤵
  PID:5188
- C:\Windows\System\ZuvAaji.exe
  C:\Windows\System\ZuvAaji.exe
  2⤵
  PID:5204
- C:\Windows\System\YdxuMel.exe
  C:\Windows\System\YdxuMel.exe
  2⤵
  PID:5220
- C:\Windows\System\EeojNIO.exe
  C:\Windows\System\EeojNIO.exe
  2⤵
  PID:5236
- C:\Windows\System\nPDtVXD.exe
  C:\Windows\System\nPDtVXD.exe
  2⤵
  PID:5252
- C:\Windows\System\ZPQEWvG.exe
  C:\Windows\System\ZPQEWvG.exe
  2⤵
  PID:5276
- C:\Windows\System\pWNVbde.exe
  C:\Windows\System\pWNVbde.exe
  2⤵
  PID:5292
- C:\Windows\System\pGuykxC.exe
  C:\Windows\System\pGuykxC.exe
  2⤵
  PID:5308
- C:\Windows\System\qPFnWpF.exe
  C:\Windows\System\qPFnWpF.exe
  2⤵
  PID:5328
- C:\Windows\System\irIAQPo.exe
  C:\Windows\System\irIAQPo.exe
  2⤵
  PID:5344
- C:\Windows\System\mjeWQfZ.exe
  C:\Windows\System\mjeWQfZ.exe
  2⤵
  PID:5360
- C:\Windows\System\UPErtNQ.exe
  C:\Windows\System\UPErtNQ.exe
  2⤵
  PID:5376
- C:\Windows\System\bmQRRIz.exe
  C:\Windows\System\bmQRRIz.exe
  2⤵
  PID:5392
- C:\Windows\System\GtnqyYl.exe
  C:\Windows\System\GtnqyYl.exe
  2⤵
  PID:5408
- C:\Windows\System\rBFGUgu.exe
  C:\Windows\System\rBFGUgu.exe
  2⤵
  PID:5424
- C:\Windows\System\lQxgOHB.exe
  C:\Windows\System\lQxgOHB.exe
  2⤵
  PID:5440
- C:\Windows\System\sNGCZMd.exe
  C:\Windows\System\sNGCZMd.exe
  2⤵
  PID:5456
- C:\Windows\System\jFrHcYD.exe
  C:\Windows\System\jFrHcYD.exe
  2⤵
  PID:5472
- C:\Windows\System\JXSgnqL.exe
  C:\Windows\System\JXSgnqL.exe
  2⤵
  PID:5488
- C:\Windows\System\KKUNuKc.exe
  C:\Windows\System\KKUNuKc.exe
  2⤵
  PID:5504
- C:\Windows\System\sBdNKHi.exe
  C:\Windows\System\sBdNKHi.exe
  2⤵
  PID:5520
- C:\Windows\System\esgDiCK.exe
  C:\Windows\System\esgDiCK.exe
  2⤵
  PID:5536
- C:\Windows\System\sEQkHda.exe
  C:\Windows\System\sEQkHda.exe
  2⤵
  PID:5552
- C:\Windows\System\qekSXvy.exe
  C:\Windows\System\qekSXvy.exe
  2⤵
  PID:5572
- C:\Windows\System\eBszXom.exe
  C:\Windows\System\eBszXom.exe
  2⤵
  PID:5640
- C:\Windows\System\gYIsKCi.exe
  C:\Windows\System\gYIsKCi.exe
  2⤵
  PID:5656
- C:\Windows\System\FQmwxDY.exe
  C:\Windows\System\FQmwxDY.exe
  2⤵
  PID:5672
- C:\Windows\System\gFipppm.exe
  C:\Windows\System\gFipppm.exe
  2⤵
  PID:5688
- C:\Windows\System\ndyYKgn.exe
  C:\Windows\System\ndyYKgn.exe
  2⤵
  PID:5704
- C:\Windows\System\PaMcJLf.exe
  C:\Windows\System\PaMcJLf.exe
  2⤵
  PID:5720
- C:\Windows\System\lkxSdWW.exe
  C:\Windows\System\lkxSdWW.exe
  2⤵
  PID:5736
- C:\Windows\System\uchoFbC.exe
  C:\Windows\System\uchoFbC.exe
  2⤵
  PID:5752
- C:\Windows\System\AyhBqfH.exe
  C:\Windows\System\AyhBqfH.exe
  2⤵
  PID:5768
- C:\Windows\System\GtovdJe.exe
  C:\Windows\System\GtovdJe.exe
  2⤵
  PID:5784
- C:\Windows\System\kQqbeia.exe
  C:\Windows\System\kQqbeia.exe
  2⤵
  PID:5892
- C:\Windows\System\ArNvIWE.exe
  C:\Windows\System\ArNvIWE.exe
  2⤵
  PID:5920
- C:\Windows\System\PJJqSey.exe
  C:\Windows\System\PJJqSey.exe
  2⤵
  PID:5940
- C:\Windows\System\TzVJhhE.exe
  C:\Windows\System\TzVJhhE.exe
  2⤵
  PID:5960
- C:\Windows\System\PdgKPJQ.exe
  C:\Windows\System\PdgKPJQ.exe
  2⤵
  PID:5980
- C:\Windows\System\qqJFvdg.exe
  C:\Windows\System\qqJFvdg.exe
  2⤵
  PID:5996
- C:\Windows\System\yLiNThw.exe
  C:\Windows\System\yLiNThw.exe
  2⤵
  PID:6012
- C:\Windows\System\vPswiOA.exe
  C:\Windows\System\vPswiOA.exe
  2⤵
  PID:6028
- C:\Windows\System\jfPlGVL.exe
  C:\Windows\System\jfPlGVL.exe
  2⤵
  PID:6044
- C:\Windows\System\EKoTbNA.exe
  C:\Windows\System\EKoTbNA.exe
  2⤵
  PID:6060
- C:\Windows\System\rdwGmaw.exe
  C:\Windows\System\rdwGmaw.exe
  2⤵
  PID:6076
- C:\Windows\System\jMuBaPk.exe
  C:\Windows\System\jMuBaPk.exe
  2⤵
  PID:6096
- C:\Windows\System\HuMXYkd.exe
  C:\Windows\System\HuMXYkd.exe
  2⤵
  PID:6112
- C:\Windows\System\EkZJvhl.exe
  C:\Windows\System\EkZJvhl.exe
  2⤵
  PID:6128
- C:\Windows\System\kSGnmva.exe
  C:\Windows\System\kSGnmva.exe
  2⤵
  PID:3592
- C:\Windows\System\DTYMFPw.exe
  C:\Windows\System\DTYMFPw.exe
  2⤵
  PID:1796
- C:\Windows\System\uTRbVPn.exe
  C:\Windows\System\uTRbVPn.exe
  2⤵
  PID:5484
- C:\Windows\System\FknqgJC.exe
  C:\Windows\System\FknqgJC.exe
  2⤵
  PID:5544
- C:\Windows\System\wwAASef.exe
  C:\Windows\System\wwAASef.exe
  2⤵
  PID:5372
- C:\Windows\System\jUcSzOA.exe
  C:\Windows\System\jUcSzOA.exe
  2⤵
  PID:5436
- C:\Windows\System\GbmgrTg.exe
  C:\Windows\System\GbmgrTg.exe
  2⤵
  PID:5500
- C:\Windows\System\bMQECQj.exe
  C:\Windows\System\bMQECQj.exe
  2⤵
  PID:5568
- C:\Windows\System\FOWZiLo.exe
  C:\Windows\System\FOWZiLo.exe
  2⤵
  PID:5588
- C:\Windows\System\VNtxnNw.exe
  C:\Windows\System\VNtxnNw.exe
  2⤵
  PID:5604
- C:\Windows\System\WTYbSvY.exe
  C:\Windows\System\WTYbSvY.exe
  2⤵
  PID:5620
- C:\Windows\System\kAgLIbt.exe
  C:\Windows\System\kAgLIbt.exe
  2⤵
  PID:5636
- C:\Windows\System\ZiqwYag.exe
  C:\Windows\System\ZiqwYag.exe
  2⤵
  PID:5728
- C:\Windows\System\qNjCREI.exe
  C:\Windows\System\qNjCREI.exe
  2⤵
  PID:5764
- C:\Windows\System\fdkelVT.exe
  C:\Windows\System\fdkelVT.exe
  2⤵
  PID:5684
- C:\Windows\System\CqdDrAj.exe
  C:\Windows\System\CqdDrAj.exe
  2⤵
  PID:5748
- C:\Windows\System\ySrkFMf.exe
  C:\Windows\System\ySrkFMf.exe
  2⤵
  PID:5800
- C:\Windows\System\GDfAOqT.exe
  C:\Windows\System\GDfAOqT.exe
  2⤵
  PID:5816
- C:\Windows\System\IxmTOBv.exe
  C:\Windows\System\IxmTOBv.exe
  2⤵
  PID:5832
- C:\Windows\System\CmaXYgQ.exe
  C:\Windows\System\CmaXYgQ.exe
  2⤵
  PID:5848
- C:\Windows\System\LLrkueK.exe
  C:\Windows\System\LLrkueK.exe
  2⤵
  PID:5864
- C:\Windows\System\gQAKFze.exe
  C:\Windows\System\gQAKFze.exe
  2⤵
  PID:5884
- C:\Windows\System\ITFztIN.exe
  C:\Windows\System\ITFztIN.exe
  2⤵
  PID:5908
- C:\Windows\System\aFyoxdW.exe
  C:\Windows\System\aFyoxdW.exe
  2⤵
  PID:5928
- C:\Windows\System\VeTkRHq.exe
  C:\Windows\System\VeTkRHq.exe
  2⤵
  PID:5988
- C:\Windows\System\kOHofqy.exe
  C:\Windows\System\kOHofqy.exe
  2⤵
  PID:5952
- C:\Windows\System\TkurSCB.exe
  C:\Windows\System\TkurSCB.exe
  2⤵
  PID:6088
- C:\Windows\System\dXHxjMR.exe
  C:\Windows\System\dXHxjMR.exe
  2⤵
  PID:6140
- C:\Windows\System\lhAZGAT.exe
  C:\Windows\System\lhAZGAT.exe
  2⤵
  PID:6072
- C:\Windows\System\gwvWYrv.exe
  C:\Windows\System\gwvWYrv.exe
  2⤵
  PID:6008
- C:\Windows\System\RZeQYQf.exe
  C:\Windows\System\RZeQYQf.exe
  2⤵
  PID:5968
- C:\Windows\System\ifPVlOV.exe
  C:\Windows\System\ifPVlOV.exe
  2⤵
  PID:5180
- C:\Windows\System\OqfZRCP.exe
  C:\Windows\System\OqfZRCP.exe
  2⤵
  PID:5248
- C:\Windows\System\AtxzyjU.exe
  C:\Windows\System\AtxzyjU.exe
  2⤵
  PID:5232
- C:\Windows\System\khtsTVt.exe
  C:\Windows\System\khtsTVt.exe
  2⤵
  PID:4988
- C:\Windows\System\hHdsBIw.exe
  C:\Windows\System\hHdsBIw.exe
  2⤵
  PID:4376
- C:\Windows\System\yZAVTfU.exe
  C:\Windows\System\yZAVTfU.exe
  2⤵
  PID:5132
- C:\Windows\System\JyGgszD.exe
  C:\Windows\System\JyGgszD.exe
  2⤵
  PID:5480
- C:\Windows\System\NEAuGnk.exe
  C:\Windows\System\NEAuGnk.exe
  2⤵
  PID:5260
- C:\Windows\System\OTxAOOe.exe
  C:\Windows\System\OTxAOOe.exe
  2⤵
  PID:5284
- C:\Windows\System\MAPdXzP.exe
  C:\Windows\System\MAPdXzP.exe
  2⤵
  PID:5304
- C:\Windows\System\wDmNlSO.exe
  C:\Windows\System\wDmNlSO.exe
  2⤵
  PID:5384
- C:\Windows\System\fOPPwQq.exe
  C:\Windows\System\fOPPwQq.exe
  2⤵
  PID:5744
- C:\Windows\System\yOyxxJv.exe
  C:\Windows\System\yOyxxJv.exe
  2⤵
  PID:5836
- C:\Windows\System\rVLPICW.exe
  C:\Windows\System\rVLPICW.exe
  2⤵
  PID:5904
- C:\Windows\System\uSbguor.exe
  C:\Windows\System\uSbguor.exe
  2⤵
  PID:5368
- C:\Windows\System\gGNbpUk.exe
  C:\Windows\System\gGNbpUk.exe
  2⤵
  PID:5580
- C:\Windows\System\VgcgFrF.exe
  C:\Windows\System\VgcgFrF.exe
  2⤵
  PID:5616
- C:\Windows\System\iTEKsGh.exe
  C:\Windows\System\iTEKsGh.exe
  2⤵
  PID:5652
- C:\Windows\System\qHCGACT.exe
  C:\Windows\System\qHCGACT.exe
  2⤵
  PID:5824
- C:\Windows\System\IaMsygm.exe
  C:\Windows\System\IaMsygm.exe
  2⤵
  PID:5272
- C:\Windows\System\evLLgNE.exe
  C:\Windows\System\evLLgNE.exe
  2⤵
  PID:5628
- C:\Windows\System\IIimlxc.exe
  C:\Windows\System\IIimlxc.exe
  2⤵
  PID:6036
- C:\Windows\System\LUvNflM.exe
  C:\Windows\System\LUvNflM.exe
  2⤵
  PID:5148
- C:\Windows\System\QazuEMO.exe
  C:\Windows\System\QazuEMO.exe
  2⤵
  PID:5228
- C:\Windows\System\rzegpAi.exe
  C:\Windows\System\rzegpAi.exe
  2⤵
  PID:4872
- C:\Windows\System\agACqJO.exe
  C:\Windows\System\agACqJO.exe
  2⤵
  PID:5404
- C:\Windows\System\ioplnBM.exe
  C:\Windows\System\ioplnBM.exe
  2⤵
  PID:5804
- C:\Windows\System\yonwEdq.exe
  C:\Windows\System\yonwEdq.exe
  2⤵
  PID:4300
- C:\Windows\System\PeoWnVg.exe
  C:\Windows\System\PeoWnVg.exe
  2⤵
  PID:5196
- C:\Windows\System\HtvtWno.exe
  C:\Windows\System\HtvtWno.exe
  2⤵
  PID:5420
- C:\Windows\System\BgXpdZD.exe
  C:\Windows\System\BgXpdZD.exe
  2⤵
  PID:5268
- C:\Windows\System\pvwclvT.exe
  C:\Windows\System\pvwclvT.exe
  2⤵
  PID:5216
- C:\Windows\System\LXrlOBq.exe
  C:\Windows\System\LXrlOBq.exe
  2⤵
  PID:5136
- C:\Windows\System\LWFwFln.exe
  C:\Windows\System\LWFwFln.exe
  2⤵
  PID:5856
- C:\Windows\System\LUpwOEO.exe
  C:\Windows\System\LUpwOEO.exe
  2⤵
  PID:5352
- C:\Windows\System\JUUrLkH.exe
  C:\Windows\System\JUUrLkH.exe
  2⤵
  PID:6056
- C:\Windows\System\IekxjdL.exe
  C:\Windows\System\IekxjdL.exe
  2⤵
  PID:5264
- C:\Windows\System\mHNEkdH.exe
  C:\Windows\System\mHNEkdH.exe
  2⤵
  PID:4456
- C:\Windows\System\zdLxzHo.exe
  C:\Windows\System\zdLxzHo.exe
  2⤵
  PID:5452
- C:\Windows\System\lqdAEtR.exe
  C:\Windows\System\lqdAEtR.exe
  2⤵
  PID:5792
- C:\Windows\System\kzLSmBZ.exe
  C:\Windows\System\kzLSmBZ.exe
  2⤵
  PID:5796
- C:\Windows\System\bXarSQa.exe
  C:\Windows\System\bXarSQa.exe
  2⤵
  PID:5152
- C:\Windows\System\ZuJwsQW.exe
  C:\Windows\System\ZuJwsQW.exe
  2⤵
  PID:5700
- C:\Windows\System\nmdVNZm.exe
  C:\Windows\System\nmdVNZm.exe
  2⤵
  PID:5448
- C:\Windows\System\jIyEDsV.exe
  C:\Windows\System\jIyEDsV.exe
  2⤵
  PID:5548
- C:\Windows\System\fSplCBk.exe
  C:\Windows\System\fSplCBk.exe
  2⤵
  PID:5936
- C:\Windows\System\ZqTBHzJ.exe
  C:\Windows\System\ZqTBHzJ.exe
  2⤵
  PID:6152
- C:\Windows\System\yUUOGhe.exe
  C:\Windows\System\yUUOGhe.exe
  2⤵
  PID:6168
- C:\Windows\System\smPqPKC.exe
  C:\Windows\System\smPqPKC.exe
  2⤵
  PID:6184
- C:\Windows\System\urdfKHE.exe
  C:\Windows\System\urdfKHE.exe
  2⤵
  PID:6200
- C:\Windows\System\JZMeoJX.exe
  C:\Windows\System\JZMeoJX.exe
  2⤵
  PID:6216
- C:\Windows\System\cekpgHx.exe
  C:\Windows\System\cekpgHx.exe
  2⤵
  PID:6232
- C:\Windows\System\DjIiYJN.exe
  C:\Windows\System\DjIiYJN.exe
  2⤵
  PID:6248
- C:\Windows\System\ZYRIiLa.exe
  C:\Windows\System\ZYRIiLa.exe
  2⤵
  PID:6264
- C:\Windows\System\pUrZaXZ.exe
  C:\Windows\System\pUrZaXZ.exe
  2⤵
  PID:6280
- C:\Windows\System\eflphUb.exe
  C:\Windows\System\eflphUb.exe
  2⤵
  PID:6296
- C:\Windows\System\cMsQULP.exe
  C:\Windows\System\cMsQULP.exe
  2⤵
  PID:6312
- C:\Windows\System\UQtYAHh.exe
  C:\Windows\System\UQtYAHh.exe
  2⤵
  PID:6328
- C:\Windows\System\saBySMr.exe
  C:\Windows\System\saBySMr.exe
  2⤵
  PID:6344
- C:\Windows\System\Qmdpgjo.exe
  C:\Windows\System\Qmdpgjo.exe
  2⤵
  PID:6364
- C:\Windows\System\auJSKxc.exe
  C:\Windows\System\auJSKxc.exe
  2⤵
  PID:6380
- C:\Windows\System\TZJOWPk.exe
  C:\Windows\System\TZJOWPk.exe
  2⤵
  PID:6396
- C:\Windows\System\eRYuzzw.exe
  C:\Windows\System\eRYuzzw.exe
  2⤵
  PID:6412
- C:\Windows\System\KYSEexi.exe
  C:\Windows\System\KYSEexi.exe
  2⤵
  PID:6428
- C:\Windows\System\EmIkQHe.exe
  C:\Windows\System\EmIkQHe.exe
  2⤵
  PID:6444
- C:\Windows\System\nuFDqtq.exe
  C:\Windows\System\nuFDqtq.exe
  2⤵
  PID:6460
- C:\Windows\System\nntdLxq.exe
  C:\Windows\System\nntdLxq.exe
  2⤵
  PID:6476
- C:\Windows\System\IktWDJX.exe
  C:\Windows\System\IktWDJX.exe
  2⤵
  PID:6492
- C:\Windows\System\biGPsLH.exe
  C:\Windows\System\biGPsLH.exe
  2⤵
  PID:6508
- C:\Windows\System\lGamvhh.exe
  C:\Windows\System\lGamvhh.exe
  2⤵
  PID:6524
- C:\Windows\System\OSoQCte.exe
  C:\Windows\System\OSoQCte.exe
  2⤵
  PID:6540
- C:\Windows\System\xCwoWWz.exe
  C:\Windows\System\xCwoWWz.exe
  2⤵
  PID:6556
- C:\Windows\System\UkZfbfT.exe
  C:\Windows\System\UkZfbfT.exe
  2⤵
  PID:6572
- C:\Windows\System\eGWqYip.exe
  C:\Windows\System\eGWqYip.exe
  2⤵
  PID:6588
- C:\Windows\System\JPTQPwy.exe
  C:\Windows\System\JPTQPwy.exe
  2⤵
  PID:6604
- C:\Windows\System\bBmgWfZ.exe
  C:\Windows\System\bBmgWfZ.exe
  2⤵
  PID:6620
- C:\Windows\System\vxfwanC.exe
  C:\Windows\System\vxfwanC.exe
  2⤵
  PID:6636
- C:\Windows\System\XiFDxad.exe
  C:\Windows\System\XiFDxad.exe
  2⤵
  PID:6652
- C:\Windows\System\ZhWHBCl.exe
  C:\Windows\System\ZhWHBCl.exe
  2⤵
  PID:6668
- C:\Windows\System\Kqkayzd.exe
  C:\Windows\System\Kqkayzd.exe
  2⤵
  PID:6684
- C:\Windows\System\pVWhhtV.exe
  C:\Windows\System\pVWhhtV.exe
  2⤵
  PID:6700
- C:\Windows\System\ekUaAyl.exe
  C:\Windows\System\ekUaAyl.exe
  2⤵
  PID:6716
- C:\Windows\System\zJfamqo.exe
  C:\Windows\System\zJfamqo.exe
  2⤵
  PID:6736
- C:\Windows\System\VxLfZmC.exe
  C:\Windows\System\VxLfZmC.exe
  2⤵
  PID:6752
- C:\Windows\System\XSJyZgC.exe
  C:\Windows\System\XSJyZgC.exe
  2⤵
  PID:6768
- C:\Windows\System\DjWuHut.exe
  C:\Windows\System\DjWuHut.exe
  2⤵
  PID:6784
- C:\Windows\System\znRdeiJ.exe
  C:\Windows\System\znRdeiJ.exe
  2⤵
  PID:6800
- C:\Windows\System\IRdlngP.exe
  C:\Windows\System\IRdlngP.exe
  2⤵
  PID:6816
- C:\Windows\System\msoNiGw.exe
  C:\Windows\System\msoNiGw.exe
  2⤵
  PID:6832
- C:\Windows\System\wHyyLXO.exe
  C:\Windows\System\wHyyLXO.exe
  2⤵
  PID:6848
- C:\Windows\System\KWDXbCU.exe
  C:\Windows\System\KWDXbCU.exe
  2⤵
  PID:6864
- C:\Windows\System\myBFlUi.exe
  C:\Windows\System\myBFlUi.exe
  2⤵
  PID:6884
- C:\Windows\System\GERVZCe.exe
  C:\Windows\System\GERVZCe.exe
  2⤵
  PID:6900
- C:\Windows\System\ERnVKHt.exe
  C:\Windows\System\ERnVKHt.exe
  2⤵
  PID:6916
- C:\Windows\System\mqzFIex.exe
  C:\Windows\System\mqzFIex.exe
  2⤵
  PID:6932
- C:\Windows\System\yvJRkmb.exe
  C:\Windows\System\yvJRkmb.exe
  2⤵
  PID:6948
- C:\Windows\System\UTzbkPO.exe
  C:\Windows\System\UTzbkPO.exe
  2⤵
  PID:6964
- C:\Windows\System\GlxwtJW.exe
  C:\Windows\System\GlxwtJW.exe
  2⤵
  PID:6980
- C:\Windows\System\smUVrTE.exe
  C:\Windows\System\smUVrTE.exe
  2⤵
  PID:6996
- C:\Windows\System\RtaKnYj.exe
  C:\Windows\System\RtaKnYj.exe
  2⤵
  PID:7012
- C:\Windows\System\ZfRPXbf.exe
  C:\Windows\System\ZfRPXbf.exe
  2⤵
  PID:7028
- C:\Windows\System\OaYLiTX.exe
  C:\Windows\System\OaYLiTX.exe
  2⤵
  PID:7044
- C:\Windows\System\mdvTNFS.exe
  C:\Windows\System\mdvTNFS.exe
  2⤵
  PID:7060
- C:\Windows\System\iUvDzNQ.exe
  C:\Windows\System\iUvDzNQ.exe
  2⤵
  PID:7076
- C:\Windows\System\ezHfhSL.exe
  C:\Windows\System\ezHfhSL.exe
  2⤵
  PID:7092
- C:\Windows\System\gChYoVq.exe
  C:\Windows\System\gChYoVq.exe
  2⤵
  PID:7108
- C:\Windows\System\ucikHyo.exe
  C:\Windows\System\ucikHyo.exe
  2⤵
  PID:7124
- C:\Windows\System\dZDAPax.exe
  C:\Windows\System\dZDAPax.exe
  2⤵
  PID:7140
- C:\Windows\System\pzFNvWX.exe
  C:\Windows\System\pzFNvWX.exe
  2⤵
  PID:7156
- C:\Windows\System\mHOcaXf.exe
  C:\Windows\System\mHOcaXf.exe
  2⤵
  PID:5876
- C:\Windows\System\HKWUbDc.exe
  C:\Windows\System\HKWUbDc.exe
  2⤵
  PID:6160
- C:\Windows\System\LRnxwKc.exe
  C:\Windows\System\LRnxwKc.exe
  2⤵
  PID:6212
- C:\Windows\System\jXQOWWK.exe
  C:\Windows\System\jXQOWWK.exe
  2⤵
  PID:6228
- C:\Windows\System\MCelgIz.exe
  C:\Windows\System\MCelgIz.exe
  2⤵
  PID:6024
- C:\Windows\System\VMbhNGs.exe
  C:\Windows\System\VMbhNGs.exe
  2⤵
  PID:6256
- C:\Windows\System\evhVssr.exe
  C:\Windows\System\evhVssr.exe
  2⤵
  PID:6176
- C:\Windows\System\YAGCtSQ.exe
  C:\Windows\System\YAGCtSQ.exe
  2⤵
  PID:6272
- C:\Windows\System\MVNZmsq.exe
  C:\Windows\System\MVNZmsq.exe
  2⤵
  PID:6292
- C:\Windows\System\GSrLPUO.exe
  C:\Windows\System\GSrLPUO.exe
  2⤵
  PID:6308
- C:\Windows\System\IGySGRe.exe
  C:\Windows\System\IGySGRe.exe
  2⤵
  PID:6340
- C:\Windows\System\UsAKLoX.exe
  C:\Windows\System\UsAKLoX.exe
  2⤵
  PID:6388
- C:\Windows\System\CxEEdKC.exe
  C:\Windows\System\CxEEdKC.exe
  2⤵
  PID:6376
- C:\Windows\System\ACsxfIV.exe
  C:\Windows\System\ACsxfIV.exe
  2⤵
  PID:6440
- C:\Windows\System\rNuNtkb.exe
  C:\Windows\System\rNuNtkb.exe
  2⤵
  PID:6488
- C:\Windows\System\mkAfSFZ.exe
  C:\Windows\System\mkAfSFZ.exe
  2⤵
  PID:6552
- C:\Windows\System\yRFlZME.exe
  C:\Windows\System\yRFlZME.exe
  2⤵
  PID:6616
- C:\Windows\System\ygkSYrv.exe
  C:\Windows\System\ygkSYrv.exe
  2⤵
  PID:6468
- C:\Windows\System\zBDZKGv.exe
  C:\Windows\System\zBDZKGv.exe
  2⤵
  PID:6712
- C:\Windows\System\XvLQGyb.exe
  C:\Windows\System\XvLQGyb.exe
  2⤵
  PID:6696
- C:\Windows\System\rQKFEEs.exe
  C:\Windows\System\rQKFEEs.exe
  2⤵
  PID:6664
- C:\Windows\System\nlzFPyw.exe
  C:\Windows\System\nlzFPyw.exe
  2⤵
  PID:6568
- C:\Windows\System\NLbNldV.exe
  C:\Windows\System\NLbNldV.exe
  2⤵
  PID:6728
- C:\Windows\System\AcXxdbf.exe
  C:\Windows\System\AcXxdbf.exe
  2⤵
  PID:6776
- C:\Windows\System\NDWBiOz.exe
  C:\Windows\System\NDWBiOz.exe
  2⤵
  PID:6840
- C:\Windows\System\jqhESDI.exe
  C:\Windows\System\jqhESDI.exe
  2⤵
  PID:6908
- C:\Windows\System\sQVtPeR.exe
  C:\Windows\System\sQVtPeR.exe
  2⤵
  PID:6972
- C:\Windows\System\OWGwQqL.exe
  C:\Windows\System\OWGwQqL.exe
  2⤵
  PID:6796
- C:\Windows\System\TOhXKGS.exe
  C:\Windows\System\TOhXKGS.exe
  2⤵
  PID:7072
- C:\Windows\System\qnWtNJO.exe
  C:\Windows\System\qnWtNJO.exe
  2⤵
  PID:7132
- C:\Windows\System\UJXSoRb.exe
  C:\Windows\System\UJXSoRb.exe
  2⤵
  PID:6892
- C:\Windows\System\eUEnthA.exe
  C:\Windows\System\eUEnthA.exe
  2⤵
  PID:6760
- C:\Windows\System\FLtsZxl.exe
  C:\Windows\System\FLtsZxl.exe
  2⤵
  PID:7024
- C:\Windows\System\GySppQa.exe
  C:\Windows\System\GySppQa.exe
  2⤵
  PID:6828
- C:\Windows\System\EVQOsuv.exe
  C:\Windows\System\EVQOsuv.exe
  2⤵
  PID:5300
- C:\Windows\System\iaZQPWt.exe
  C:\Windows\System\iaZQPWt.exe
  2⤵
  PID:6928
- C:\Windows\System\eHnWcnv.exe
  C:\Windows\System\eHnWcnv.exe
  2⤵
  PID:7116
- C:\Windows\System\pklkXsM.exe
  C:\Windows\System\pklkXsM.exe
  2⤵
  PID:6260
- C:\Windows\System\cIdYfiC.exe
  C:\Windows\System\cIdYfiC.exe
  2⤵
  PID:6196
- C:\Windows\System\HEXNGAK.exe
  C:\Windows\System\HEXNGAK.exe
  2⤵
  PID:6420
- C:\Windows\System\aXTVkZP.exe
  C:\Windows\System\aXTVkZP.exe
  2⤵
  PID:6324
- C:\Windows\System\htvlmjd.exe
  C:\Windows\System\htvlmjd.exe
  2⤵
  PID:5168
- C:\Windows\System\WHnsKxB.exe
  C:\Windows\System\WHnsKxB.exe
  2⤵
  PID:6360
- C:\Windows\System\OLZHfyD.exe
  C:\Windows\System\OLZHfyD.exe
  2⤵
  PID:6520
- C:\Windows\System\BGNOwZt.exe
  C:\Windows\System\BGNOwZt.exe
  2⤵
  PID:6548
- C:\Windows\System\nIgAOGc.exe
  C:\Windows\System\nIgAOGc.exe
  2⤵
  PID:6600
- C:\Windows\System\nVtQaWJ.exe
  C:\Windows\System\nVtQaWJ.exe
  2⤵
  PID:6940
- C:\Windows\System\LdCIkvK.exe
  C:\Windows\System\LdCIkvK.exe
  2⤵
  PID:7040
- C:\Windows\System\mFarsul.exe
  C:\Windows\System\mFarsul.exe
  2⤵
  PID:6648
- C:\Windows\System\mnkxphB.exe
  C:\Windows\System\mnkxphB.exe
  2⤵
  PID:6628
- C:\Windows\System\qGmJclx.exe
  C:\Windows\System\qGmJclx.exe
  2⤵
  PID:6792
- C:\Windows\System\xkhmOkb.exe
  C:\Windows\System\xkhmOkb.exe
  2⤵
  PID:6536
- C:\Windows\System\jbEoeYy.exe
  C:\Windows\System\jbEoeYy.exe
  2⤵
  PID:6164
- C:\Windows\System\vIdDDdZ.exe
  C:\Windows\System\vIdDDdZ.exe
  2⤵
  PID:2300
- C:\Windows\System\DixWDzX.exe
  C:\Windows\System\DixWDzX.exe
  2⤵
  PID:7084
- C:\Windows\System\yLPpsxo.exe
  C:\Windows\System\yLPpsxo.exe
  2⤵
  PID:7088
- C:\Windows\System\bSlrzLK.exe
  C:\Windows\System\bSlrzLK.exe
  2⤵
  PID:6356
- C:\Windows\System\lcXALjz.exe
  C:\Windows\System\lcXALjz.exe
  2⤵
  PID:6408
- C:\Windows\System\HZJyiER.exe
  C:\Windows\System\HZJyiER.exe
  2⤵
  PID:6812
- C:\Windows\System\JriUndO.exe
  C:\Windows\System\JriUndO.exe
  2⤵
  PID:6632
- C:\Windows\System\trgkaYf.exe
  C:\Windows\System\trgkaYf.exe
  2⤵
  PID:5356
- C:\Windows\System\xbeJTmO.exe
  C:\Windows\System\xbeJTmO.exe
  2⤵
  PID:6992
- C:\Windows\System\JNjioBr.exe
  C:\Windows\System\JNjioBr.exe
  2⤵
  PID:7056
- C:\Windows\System\aYoKIMg.exe
  C:\Windows\System\aYoKIMg.exe
  2⤵
  PID:6472
- C:\Windows\System\HRxcZzH.exe
  C:\Windows\System\HRxcZzH.exe
  2⤵
  PID:7176
- C:\Windows\System\HBWKbUu.exe
  C:\Windows\System\HBWKbUu.exe
  2⤵
  PID:7192
- C:\Windows\System\YtHMfkD.exe
  C:\Windows\System\YtHMfkD.exe
  2⤵
  PID:7208
- C:\Windows\System\vRWstwm.exe
  C:\Windows\System\vRWstwm.exe
  2⤵
  PID:7224
- C:\Windows\System\VJIrTBx.exe
  C:\Windows\System\VJIrTBx.exe
  2⤵
  PID:7240
- C:\Windows\System\BvdyuNJ.exe
  C:\Windows\System\BvdyuNJ.exe
  2⤵
  PID:7256
- C:\Windows\System\FBAzUny.exe
  C:\Windows\System\FBAzUny.exe
  2⤵
  PID:7272
- C:\Windows\System\znwlUxt.exe
  C:\Windows\System\znwlUxt.exe
  2⤵
  PID:7288
- C:\Windows\System\kLDhEnV.exe
  C:\Windows\System\kLDhEnV.exe
  2⤵
  PID:7304
- C:\Windows\System\XUXYeuR.exe
  C:\Windows\System\XUXYeuR.exe
  2⤵
  PID:7320
- C:\Windows\System\gfOvHeI.exe
  C:\Windows\System\gfOvHeI.exe
  2⤵
  PID:7336
- C:\Windows\System\YsqdNcQ.exe
  C:\Windows\System\YsqdNcQ.exe
  2⤵
  PID:7352
- C:\Windows\System\jZeXPLa.exe
  C:\Windows\System\jZeXPLa.exe
  2⤵
  PID:7368
- C:\Windows\System\yaqSgHU.exe
  C:\Windows\System\yaqSgHU.exe
  2⤵
  PID:7384
- C:\Windows\System\foVOsff.exe
  C:\Windows\System\foVOsff.exe
  2⤵
  PID:7400
- C:\Windows\System\BQbssDU.exe
  C:\Windows\System\BQbssDU.exe
  2⤵
  PID:7416
- C:\Windows\System\rWvSHcp.exe
  C:\Windows\System\rWvSHcp.exe
  2⤵
  PID:7432
- C:\Windows\System\qDpZJYo.exe
  C:\Windows\System\qDpZJYo.exe
  2⤵
  PID:7448
- C:\Windows\System\WFoFGYK.exe
  C:\Windows\System\WFoFGYK.exe
  2⤵
  PID:7464
- C:\Windows\System\brgDfQA.exe
  C:\Windows\System\brgDfQA.exe
  2⤵
  PID:7480
- C:\Windows\System\uBUnEZw.exe
  C:\Windows\System\uBUnEZw.exe
  2⤵
  PID:7496
- C:\Windows\System\QjbyrZN.exe
  C:\Windows\System\QjbyrZN.exe
  2⤵
  PID:7520
- C:\Windows\System\HnsOfDE.exe
  C:\Windows\System\HnsOfDE.exe
  2⤵
  PID:7536
- C:\Windows\System\gNoXqDO.exe
  C:\Windows\System\gNoXqDO.exe
  2⤵
  PID:7552
- C:\Windows\System\XqkOgGl.exe
  C:\Windows\System\XqkOgGl.exe
  2⤵
  PID:7568
- C:\Windows\System\rbzYrNH.exe
  C:\Windows\System\rbzYrNH.exe
  2⤵
  PID:7584
- C:\Windows\System\qUliJqF.exe
  C:\Windows\System\qUliJqF.exe
  2⤵
  PID:7600
- C:\Windows\System\aBKPcIs.exe
  C:\Windows\System\aBKPcIs.exe
  2⤵
  PID:7616
- C:\Windows\System\fZhztKt.exe
  C:\Windows\System\fZhztKt.exe
  2⤵
  PID:7632
- C:\Windows\System\pQbntVm.exe
  C:\Windows\System\pQbntVm.exe
  2⤵
  PID:7648
- C:\Windows\System\uZnyMGm.exe
  C:\Windows\System\uZnyMGm.exe
  2⤵
  PID:7664
- C:\Windows\System\NURSITk.exe
  C:\Windows\System\NURSITk.exe
  2⤵
  PID:7680
- C:\Windows\System\opTzkXA.exe
  C:\Windows\System\opTzkXA.exe
  2⤵
  PID:7696
- C:\Windows\System\HOGEpfA.exe
  C:\Windows\System\HOGEpfA.exe
  2⤵
  PID:7712
- C:\Windows\System\ETAFgik.exe
  C:\Windows\System\ETAFgik.exe
  2⤵
  PID:7728
- C:\Windows\System\ZUfhNCp.exe
  C:\Windows\System\ZUfhNCp.exe
  2⤵
  PID:7744
- C:\Windows\System\JwHumpY.exe
  C:\Windows\System\JwHumpY.exe
  2⤵
  PID:7760
- C:\Windows\System\dYGYHtF.exe
  C:\Windows\System\dYGYHtF.exe
  2⤵
  PID:7776
- C:\Windows\System\jwFmQBD.exe
  C:\Windows\System\jwFmQBD.exe
  2⤵
  PID:7792
- C:\Windows\System\OBJQdow.exe
  C:\Windows\System\OBJQdow.exe
  2⤵
  PID:7808
- C:\Windows\System\DfatAXl.exe
  C:\Windows\System\DfatAXl.exe
  2⤵
  PID:7824
- C:\Windows\System\DSBMvln.exe
  C:\Windows\System\DSBMvln.exe
  2⤵
  PID:7840
- C:\Windows\System\wcOTCGS.exe
  C:\Windows\System\wcOTCGS.exe
  2⤵
  PID:7856
- C:\Windows\System\mFhPSNm.exe
  C:\Windows\System\mFhPSNm.exe
  2⤵
  PID:7872
- C:\Windows\System\OCLFXwR.exe
  C:\Windows\System\OCLFXwR.exe
  2⤵
  PID:7888
- C:\Windows\System\dPOJhMk.exe
  C:\Windows\System\dPOJhMk.exe
  2⤵
  PID:7904
- C:\Windows\System\RpDgpOd.exe
  C:\Windows\System\RpDgpOd.exe
  2⤵
  PID:7920
- C:\Windows\System\AxjHDBg.exe
  C:\Windows\System\AxjHDBg.exe
  2⤵
  PID:7936
- C:\Windows\System\RiXPiry.exe
  C:\Windows\System\RiXPiry.exe
  2⤵
  PID:7952
- C:\Windows\System\KztwfwP.exe
  C:\Windows\System\KztwfwP.exe
  2⤵
  PID:7972
- C:\Windows\System\BzGNwVJ.exe
  C:\Windows\System\BzGNwVJ.exe
  2⤵
  PID:7988
- C:\Windows\System\oVlTOTk.exe
  C:\Windows\System\oVlTOTk.exe
  2⤵
  PID:8004
- C:\Windows\System\YzIDsNB.exe
  C:\Windows\System\YzIDsNB.exe
  2⤵
  PID:8020
- C:\Windows\System\KDAHWqD.exe
  C:\Windows\System\KDAHWqD.exe
  2⤵
  PID:8036
- C:\Windows\System\ytHcukc.exe
  C:\Windows\System\ytHcukc.exe
  2⤵
  PID:8052
- C:\Windows\System\CVkznXU.exe
  C:\Windows\System\CVkznXU.exe
  2⤵
  PID:8068
- C:\Windows\System\JOIgfqS.exe
  C:\Windows\System\JOIgfqS.exe
  2⤵
  PID:8084
- C:\Windows\System\mRvCGWh.exe
  C:\Windows\System\mRvCGWh.exe
  2⤵
  PID:8100
- C:\Windows\System\GUEhLdw.exe
  C:\Windows\System\GUEhLdw.exe
  2⤵
  PID:8116
- C:\Windows\System\BsWoxyF.exe
  C:\Windows\System\BsWoxyF.exe
  2⤵
  PID:8132
- C:\Windows\System\gkfgiuz.exe
  C:\Windows\System\gkfgiuz.exe
  2⤵
  PID:8148
- C:\Windows\System\cCNIBVx.exe
  C:\Windows\System\cCNIBVx.exe
  2⤵
  PID:8164
- C:\Windows\System\ZuyEInu.exe
  C:\Windows\System\ZuyEInu.exe
  2⤵
  PID:8184
- C:\Windows\System\rUbrabD.exe
  C:\Windows\System\rUbrabD.exe
  2⤵
  PID:7200
- C:\Windows\System\ATPaMmG.exe
  C:\Windows\System\ATPaMmG.exe
  2⤵
  PID:7268
- C:\Windows\System\wCaZYtN.exe
  C:\Windows\System\wCaZYtN.exe
  2⤵
  PID:7332
- C:\Windows\System\IgfTHep.exe
  C:\Windows\System\IgfTHep.exe
  2⤵
  PID:7396
- C:\Windows\System\MLHzeFS.exe
  C:\Windows\System\MLHzeFS.exe
  2⤵
  PID:7456
- C:\Windows\System\eSJAoWE.exe
  C:\Windows\System\eSJAoWE.exe
  2⤵
  PID:7460
- C:\Windows\System\vfoBiHG.exe
  C:\Windows\System\vfoBiHG.exe
  2⤵
  PID:6860
- C:\Windows\System\xDZWnpo.exe
  C:\Windows\System\xDZWnpo.exe
  2⤵
  PID:7408
- C:\Windows\System\qxaHnbl.exe
  C:\Windows\System\qxaHnbl.exe
  2⤵
  PID:7148
- C:\Windows\System\GuAmWkB.exe
  C:\Windows\System\GuAmWkB.exe
  2⤵
  PID:7164
- C:\Windows\System\yzPyisu.exe
  C:\Windows\System\yzPyisu.exe
  2⤵
  PID:7184
- C:\Windows\System\QvfkivT.exe
  C:\Windows\System\QvfkivT.exe
  2⤵
  PID:7252
- C:\Windows\System\xhWiSOd.exe
  C:\Windows\System\xhWiSOd.exe
  2⤵
  PID:7344
- C:\Windows\System\zzcSqMn.exe
  C:\Windows\System\zzcSqMn.exe
  2⤵
  PID:7444
- C:\Windows\System\lHlxkZS.exe
  C:\Windows\System\lHlxkZS.exe
  2⤵
  PID:7476
- C:\Windows\System\PgKyzMr.exe
  C:\Windows\System\PgKyzMr.exe
  2⤵
  PID:7532
- C:\Windows\System\XPKVmJh.exe
  C:\Windows\System\XPKVmJh.exe
  2⤵
  PID:7576
- C:\Windows\System\pXjMhDh.exe
  C:\Windows\System\pXjMhDh.exe
  2⤵
  PID:7624
- C:\Windows\System\djKAkFf.exe
  C:\Windows\System\djKAkFf.exe
  2⤵
  PID:7688
- C:\Windows\System\RYBhXmP.exe
  C:\Windows\System\RYBhXmP.exe
  2⤵
  PID:7756
- C:\Windows\System\YJgajZd.exe
  C:\Windows\System\YJgajZd.exe
  2⤵
  PID:7788
- C:\Windows\System\hhFowZG.exe
  C:\Windows\System\hhFowZG.exe
  2⤵
  PID:7612
- C:\Windows\System\CqZFdTL.exe
  C:\Windows\System\CqZFdTL.exe
  2⤵
  PID:7736
- C:\Windows\System\XgmNjvy.exe
  C:\Windows\System\XgmNjvy.exe
  2⤵
  PID:7820
- C:\Windows\System\TBRNpgf.exe
  C:\Windows\System\TBRNpgf.exe
  2⤵
  PID:7836
- C:\Windows\System\pwkkKwD.exe
  C:\Windows\System\pwkkKwD.exe
  2⤵
  PID:7884
- C:\Windows\System\esyLpdt.exe
  C:\Windows\System\esyLpdt.exe
  2⤵
  PID:7896
- C:\Windows\System\TOyaMGA.exe
  C:\Windows\System\TOyaMGA.exe
  2⤵
  PID:7868
- C:\Windows\System\LkLjqpJ.exe
  C:\Windows\System\LkLjqpJ.exe
  2⤵
  PID:7960
- C:\Windows\System\JXYXmcW.exe
  C:\Windows\System\JXYXmcW.exe
  2⤵
  PID:8012
- C:\Windows\System\tdyjVbq.exe
  C:\Windows\System\tdyjVbq.exe
  2⤵
  PID:8028
- C:\Windows\System\lGhwoRE.exe
  C:\Windows\System\lGhwoRE.exe
  2⤵
  PID:8076
- C:\Windows\System\DAOQRDZ.exe
  C:\Windows\System\DAOQRDZ.exe
  2⤵
  PID:7508
- C:\Windows\System\wwUASjk.exe
  C:\Windows\System\wwUASjk.exe
  2⤵
  PID:8112
- C:\Windows\System\aBCJLvd.exe
  C:\Windows\System\aBCJLvd.exe
  2⤵
  PID:8176
- C:\Windows\System\Xzkfgzm.exe
  C:\Windows\System\Xzkfgzm.exe
  2⤵
  PID:7364
- C:\Windows\System\kPjraFp.exe
  C:\Windows\System\kPjraFp.exe
  2⤵
  PID:7488
- C:\Windows\System\HNPFlfm.exe
  C:\Windows\System\HNPFlfm.exe
  2⤵
  PID:7172
- C:\Windows\System\JItVOon.exe
  C:\Windows\System\JItVOon.exe
  2⤵
  PID:6240
- C:\Windows\System\khcqlaz.exe
  C:\Windows\System\khcqlaz.exe
  2⤵
  PID:2792
- C:\Windows\System\MkbjmBA.exe
  C:\Windows\System\MkbjmBA.exe
  2⤵
  PID:6876
- C:\Windows\System\hQYzzwX.exe
  C:\Windows\System\hQYzzwX.exe
  2⤵
  PID:7052
- C:\Windows\System\QNjQBTY.exe
  C:\Windows\System\QNjQBTY.exe
  2⤵
  PID:7440
- C:\Windows\System\KXpVIYM.exe
  C:\Windows\System\KXpVIYM.exe
  2⤵
  PID:7316
- C:\Windows\System\BxmptaV.exe
  C:\Windows\System\BxmptaV.exe
  2⤵
  PID:7724
- C:\Windows\System\euGYOfA.exe
  C:\Windows\System\euGYOfA.exe
  2⤵
  PID:7504
- C:\Windows\System\QXfdaRV.exe
  C:\Windows\System\QXfdaRV.exe
  2⤵
  PID:7608
- C:\Windows\System\tBzyAhB.exe
  C:\Windows\System\tBzyAhB.exe
  2⤵
  PID:7852
- C:\Windows\System\ArkhgPA.exe
  C:\Windows\System\ArkhgPA.exe
  2⤵
  PID:7804
- C:\Windows\System\FoOQrHH.exe
  C:\Windows\System\FoOQrHH.exe
  2⤵
  PID:7916
- C:\Windows\System\oddfzQn.exe
  C:\Windows\System\oddfzQn.exe
  2⤵
  PID:7964
- C:\Windows\System\jnvYaSf.exe
  C:\Windows\System\jnvYaSf.exe
  2⤵
  PID:8096
- C:\Windows\System\obwZiaJ.exe
  C:\Windows\System\obwZiaJ.exe
  2⤵
  PID:8156
- C:\Windows\System\gCYmnaX.exe
  C:\Windows\System\gCYmnaX.exe
  2⤵
  PID:7300
- C:\Windows\System\XupVABO.exe
  C:\Windows\System\XupVABO.exe
  2⤵
  PID:7004
- C:\Windows\System\iAiLtsE.exe
  C:\Windows\System\iAiLtsE.exe
  2⤵
  PID:7492
- C:\Windows\System\NdVkumu.exe
  C:\Windows\System\NdVkumu.exe
  2⤵
  PID:7544
- C:\Windows\System\EMdjyYm.exe
  C:\Windows\System\EMdjyYm.exe
  2⤵
  PID:8172
- C:\Windows\System\jRDbDWa.exe
  C:\Windows\System\jRDbDWa.exe
  2⤵
  PID:7784
- C:\Windows\System\lKnvVSF.exe
  C:\Windows\System\lKnvVSF.exe
  2⤵
  PID:7672
- C:\Windows\System\yVdNlqg.exe
  C:\Windows\System\yVdNlqg.exe
  2⤵
  PID:7928
- C:\Windows\System\LrngLOe.exe
  C:\Windows\System\LrngLOe.exe
  2⤵
  PID:7948
- C:\Windows\System\NNZNWTX.exe
  C:\Windows\System\NNZNWTX.exe
  2⤵
  PID:7204
- C:\Windows\System\njDZAYx.exe
  C:\Windows\System\njDZAYx.exe
  2⤵
  PID:7264
- C:\Windows\System\KLyDWCn.exe
  C:\Windows\System\KLyDWCn.exe
  2⤵
  PID:8060
- C:\Windows\System\WKDuRbS.exe
  C:\Windows\System\WKDuRbS.exe
  2⤵
  PID:7864
- C:\Windows\System\nuqqvnL.exe
  C:\Windows\System\nuqqvnL.exe
  2⤵
  PID:7248
- C:\Windows\System\XWDpQRZ.exe
  C:\Windows\System\XWDpQRZ.exe
  2⤵
  PID:7596
- C:\Windows\System\eeakfxC.exe
  C:\Windows\System\eeakfxC.exe
  2⤵
  PID:8204
- C:\Windows\System\ZJfxppu.exe
  C:\Windows\System\ZJfxppu.exe
  2⤵
  PID:8220
- C:\Windows\System\mICVJoD.exe
  C:\Windows\System\mICVJoD.exe
  2⤵
  PID:8236
- C:\Windows\System\eyQTFGX.exe
  C:\Windows\System\eyQTFGX.exe
  2⤵
  PID:8252
- C:\Windows\System\cNFGMbC.exe
  C:\Windows\System\cNFGMbC.exe
  2⤵
  PID:8268
- C:\Windows\System\sJLsPwF.exe
  C:\Windows\System\sJLsPwF.exe
  2⤵
  PID:8284
- C:\Windows\System\wCfeLnp.exe
  C:\Windows\System\wCfeLnp.exe
  2⤵
  PID:8300
- C:\Windows\System\OmAYOpd.exe
  C:\Windows\System\OmAYOpd.exe
  2⤵
  PID:8316
- C:\Windows\System\AnoMCDW.exe
  C:\Windows\System\AnoMCDW.exe
  2⤵
  PID:8336
- C:\Windows\System\evPZPBr.exe
  C:\Windows\System\evPZPBr.exe
  2⤵
  PID:8352
- C:\Windows\System\oVzRjVg.exe
  C:\Windows\System\oVzRjVg.exe
  2⤵
  PID:8368
- C:\Windows\System\NstmykH.exe
  C:\Windows\System\NstmykH.exe
  2⤵
  PID:8384
- C:\Windows\System\RIRsmkJ.exe
  C:\Windows\System\RIRsmkJ.exe
  2⤵
  PID:8400
- C:\Windows\System\HVNVJEm.exe
  C:\Windows\System\HVNVJEm.exe
  2⤵
  PID:8416
- C:\Windows\System\zXHzMUo.exe
  C:\Windows\System\zXHzMUo.exe
  2⤵
  PID:8432
- C:\Windows\System\LBaUixy.exe
  C:\Windows\System\LBaUixy.exe
  2⤵
  PID:8448
- C:\Windows\System\fPJcjxG.exe
  C:\Windows\System\fPJcjxG.exe
  2⤵
  PID:8464
- C:\Windows\System\qzrFWbi.exe
  C:\Windows\System\qzrFWbi.exe
  2⤵
  PID:8480
- C:\Windows\System\BmlefnO.exe
  C:\Windows\System\BmlefnO.exe
  2⤵
  PID:8496
- C:\Windows\System\DBbprrl.exe
  C:\Windows\System\DBbprrl.exe
  2⤵
  PID:8512
- C:\Windows\System\KLDGlGK.exe
  C:\Windows\System\KLDGlGK.exe
  2⤵
  PID:8528
- C:\Windows\System\RsCUKxJ.exe
  C:\Windows\System\RsCUKxJ.exe
  2⤵
  PID:8544
- C:\Windows\System\sjUlYRZ.exe
  C:\Windows\System\sjUlYRZ.exe
  2⤵
  PID:8568
- C:\Windows\System\QMLelUs.exe
  C:\Windows\System\QMLelUs.exe
  2⤵
  PID:8584
- C:\Windows\System\ZMbJodm.exe
  C:\Windows\System\ZMbJodm.exe
  2⤵
  PID:8600
- C:\Windows\System\sDUfbth.exe
  C:\Windows\System\sDUfbth.exe
  2⤵
  PID:8616
- C:\Windows\System\mLAJwlz.exe
  C:\Windows\System\mLAJwlz.exe
  2⤵
  PID:8632
- C:\Windows\System\SIQbnrr.exe
  C:\Windows\System\SIQbnrr.exe
  2⤵
  PID:8648
- C:\Windows\System\wGHSbyR.exe
  C:\Windows\System\wGHSbyR.exe
  2⤵
  PID:8664
- C:\Windows\System\FfXPDaE.exe
  C:\Windows\System\FfXPDaE.exe
  2⤵
  PID:8680
- C:\Windows\System\JiuPWDX.exe
  C:\Windows\System\JiuPWDX.exe
  2⤵
  PID:8696
- C:\Windows\System\ieoaGwv.exe
  C:\Windows\System\ieoaGwv.exe
  2⤵
  PID:8712
- C:\Windows\System\RWliDut.exe
  C:\Windows\System\RWliDut.exe
  2⤵
  PID:8728
- C:\Windows\System\swPodNr.exe
  C:\Windows\System\swPodNr.exe
  2⤵
  PID:8744
- C:\Windows\System\nNlkhPE.exe
  C:\Windows\System\nNlkhPE.exe
  2⤵
  PID:8760
- C:\Windows\System\JDYUsWw.exe
  C:\Windows\System\JDYUsWw.exe
  2⤵
  PID:8776
- C:\Windows\System\BpiRnLa.exe
  C:\Windows\System\BpiRnLa.exe
  2⤵
  PID:8792
- C:\Windows\System\QawqpMx.exe
  C:\Windows\System\QawqpMx.exe
  2⤵
  PID:8808
- C:\Windows\System\zDBGdeS.exe
  C:\Windows\System\zDBGdeS.exe
  2⤵
  PID:8824
- C:\Windows\System\WJEvefh.exe
  C:\Windows\System\WJEvefh.exe
  2⤵
  PID:8840
- C:\Windows\System\cdNwXLI.exe
  C:\Windows\System\cdNwXLI.exe
  2⤵
  PID:8856
- C:\Windows\System\xvAqnnI.exe
  C:\Windows\System\xvAqnnI.exe
  2⤵
  PID:8872
- C:\Windows\System\JXaqfxd.exe
  C:\Windows\System\JXaqfxd.exe
  2⤵
  PID:8888
- C:\Windows\System\liBqpzZ.exe
  C:\Windows\System\liBqpzZ.exe
  2⤵
  PID:8904
- C:\Windows\System\zENvnqb.exe
  C:\Windows\System\zENvnqb.exe
  2⤵
  PID:8920
- C:\Windows\System\rrIrfdU.exe
  C:\Windows\System\rrIrfdU.exe
  2⤵
  PID:8936
- C:\Windows\System\eGvNbQR.exe
  C:\Windows\System\eGvNbQR.exe
  2⤵
  PID:8952
- C:\Windows\System\MtFAlnc.exe
  C:\Windows\System\MtFAlnc.exe
  2⤵
  PID:8968
- C:\Windows\System\JZcediz.exe
  C:\Windows\System\JZcediz.exe
  2⤵
  PID:8984
- C:\Windows\System\LQQtnYi.exe
  C:\Windows\System\LQQtnYi.exe
  2⤵
  PID:9000
- C:\Windows\System\xeFwBKk.exe
  C:\Windows\System\xeFwBKk.exe
  2⤵
  PID:9016
- C:\Windows\System\TrkBafh.exe
  C:\Windows\System\TrkBafh.exe
  2⤵
  PID:9032
- C:\Windows\System\TJnxrCm.exe
  C:\Windows\System\TJnxrCm.exe
  2⤵
  PID:9064
- C:\Windows\System\glEokQi.exe
  C:\Windows\System\glEokQi.exe
  2⤵
  PID:9080
- C:\Windows\System\yLPPJuR.exe
  C:\Windows\System\yLPPJuR.exe
  2⤵
  PID:9096
- C:\Windows\System\TLSVEoI.exe
  C:\Windows\System\TLSVEoI.exe
  2⤵
  PID:9116
- C:\Windows\System\VoeXpRr.exe
  C:\Windows\System\VoeXpRr.exe
  2⤵
  PID:9132
- C:\Windows\System\kkbMNqO.exe
  C:\Windows\System\kkbMNqO.exe
  2⤵
  PID:9148
- C:\Windows\System\eybnCMO.exe
  C:\Windows\System\eybnCMO.exe
  2⤵
  PID:9164
- C:\Windows\System\SJFzSzE.exe
  C:\Windows\System\SJFzSzE.exe
  2⤵
  PID:9180
- C:\Windows\System\thteGbm.exe
  C:\Windows\System\thteGbm.exe
  2⤵
  PID:9196
- C:\Windows\System\KKkTOkS.exe
  C:\Windows\System\KKkTOkS.exe
  2⤵
  PID:9212
- C:\Windows\System\hlWvKSP.exe
  C:\Windows\System\hlWvKSP.exe
  2⤵
  PID:7772
- C:\Windows\System\VubgKEC.exe
  C:\Windows\System\VubgKEC.exe
  2⤵
  PID:8244
- C:\Windows\System\Smraufa.exe
  C:\Windows\System\Smraufa.exe
  2⤵
  PID:7020
- C:\Windows\System\APBKocS.exe
  C:\Windows\System\APBKocS.exe
  2⤵
  PID:8276
- C:\Windows\System\GpeXTcQ.exe
  C:\Windows\System\GpeXTcQ.exe
  2⤵
  PID:8308
- C:\Windows\System\heqOmRK.exe
  C:\Windows\System\heqOmRK.exe
  2⤵
  PID:8292
- C:\Windows\System\AwPAGzZ.exe
  C:\Windows\System\AwPAGzZ.exe
  2⤵
  PID:8348
- C:\Windows\System\ctnMDzm.exe
  C:\Windows\System\ctnMDzm.exe
  2⤵
  PID:8380
- C:\Windows\System\CvgvZaK.exe
  C:\Windows\System\CvgvZaK.exe
  2⤵
  PID:8444
- C:\Windows\System\gPtYkch.exe
  C:\Windows\System\gPtYkch.exe
  2⤵
  PID:8396
- C:\Windows\System\gKJguGX.exe
  C:\Windows\System\gKJguGX.exe
  2⤵
  PID:8460
- C:\Windows\System\deyTIYt.exe
  C:\Windows\System\deyTIYt.exe
  2⤵
  PID:8492
- C:\Windows\System\hcnrZMv.exe
  C:\Windows\System\hcnrZMv.exe
  2⤵
  PID:8540
- C:\Windows\System\Fhzdfrz.exe
  C:\Windows\System\Fhzdfrz.exe
  2⤵
  PID:8552
- C:\Windows\System\BUEoHvm.exe
  C:\Windows\System\BUEoHvm.exe
  2⤵
  PID:8608
- C:\Windows\System\foealkn.exe
  C:\Windows\System\foealkn.exe
  2⤵
  PID:8672
- C:\Windows\System\YNsVNuH.exe
  C:\Windows\System\YNsVNuH.exe
  2⤵
  PID:8708
- C:\Windows\System\QFjvtdY.exe
  C:\Windows\System\QFjvtdY.exe
  2⤵
  PID:8592
- C:\Windows\System\uBVTBXv.exe
  C:\Windows\System\uBVTBXv.exe
  2⤵
  PID:8752
- C:\Windows\System\rYdWFhh.exe
  C:\Windows\System\rYdWFhh.exe
  2⤵
  PID:8692
- C:\Windows\System\qGIIYKM.exe
  C:\Windows\System\qGIIYKM.exe
  2⤵
  PID:8720
- C:\Windows\System\VrSTiFo.exe
  C:\Windows\System\VrSTiFo.exe
  2⤵
  PID:8756
- C:\Windows\System\vzAXeMD.exe
  C:\Windows\System\vzAXeMD.exe
  2⤵
  PID:8864
- C:\Windows\System\GMiaCIz.exe
  C:\Windows\System\GMiaCIz.exe
  2⤵
  PID:8868
- C:\Windows\System\VZCQNZn.exe
  C:\Windows\System\VZCQNZn.exe
  2⤵
  PID:8900
- C:\Windows\System\vDQGSeO.exe
  C:\Windows\System\vDQGSeO.exe
  2⤵
  PID:8960
- C:\Windows\System\IYBECDr.exe
  C:\Windows\System\IYBECDr.exe
  2⤵
  PID:8992
- C:\Windows\System\BiYCiEP.exe
  C:\Windows\System\BiYCiEP.exe
  2⤵
  PID:8948
- C:\Windows\System\NWjgWkX.exe
  C:\Windows\System\NWjgWkX.exe
  2⤵
  PID:9008
- C:\Windows\System\bOWolzC.exe
  C:\Windows\System\bOWolzC.exe
  2⤵
  PID:9052
- C:\Windows\System\tLMISrP.exe
  C:\Windows\System\tLMISrP.exe
  2⤵
  PID:9104
- C:\Windows\System\PfIPfUw.exe
  C:\Windows\System\PfIPfUw.exe
  2⤵
  PID:9172
- C:\Windows\System\niOoDoo.exe
  C:\Windows\System\niOoDoo.exe
  2⤵
  PID:8212
- C:\Windows\System\szMLxCi.exe
  C:\Windows\System\szMLxCi.exe
  2⤵
  PID:8248
- C:\Windows\System\biBIuup.exe
  C:\Windows\System\biBIuup.exe
  2⤵
  PID:8408
- C:\Windows\System\ZJfuGEi.exe
  C:\Windows\System\ZJfuGEi.exe
  2⤵
  PID:8504
- C:\Windows\System\hHUpXHV.exe
  C:\Windows\System\hHUpXHV.exe
  2⤵
  PID:8644
- C:\Windows\System\MxKzXId.exe
  C:\Windows\System\MxKzXId.exe
  2⤵
  PID:8660
- C:\Windows\System\tyMCNBD.exe
  C:\Windows\System\tyMCNBD.exe
  2⤵
  PID:8848
- C:\Windows\System\IURzLyD.exe
  C:\Windows\System\IURzLyD.exe
  2⤵
  PID:8932
- C:\Windows\System\yDrkaiC.exe
  C:\Windows\System\yDrkaiC.exe
  2⤵
  PID:9044
- C:\Windows\System\NRXlqqY.exe
  C:\Windows\System\NRXlqqY.exe
  2⤵
  PID:9160
- C:\Windows\System\AFnlkpP.exe
  C:\Windows\System\AFnlkpP.exe
  2⤵
  PID:8392
- C:\Windows\System\Hkzcpzz.exe
  C:\Windows\System\Hkzcpzz.exe
  2⤵
  PID:8740
- C:\Windows\System\WwzAera.exe
  C:\Windows\System\WwzAera.exe
  2⤵
  PID:8228
- C:\Windows\System\fHSvqTx.exe
  C:\Windows\System\fHSvqTx.exe
  2⤵
  PID:7380
- C:\Windows\System\ZvjAGWr.exe
  C:\Windows\System\ZvjAGWr.exe
  2⤵
  PID:9144
- C:\Windows\System\NSfHunx.exe
  C:\Windows\System\NSfHunx.exe
  2⤵
  PID:8424
- C:\Windows\System\ulMXVxq.exe
  C:\Windows\System\ulMXVxq.exe
  2⤵
  PID:8576
- C:\Windows\System\dyyOxtO.exe
  C:\Windows\System\dyyOxtO.exe
  2⤵
  PID:8624
- C:\Windows\System\DMzXfGk.exe
  C:\Windows\System\DMzXfGk.exe
  2⤵
  PID:8524
- C:\Windows\System\dwkPweT.exe
  C:\Windows\System\dwkPweT.exe
  2⤵
  PID:7640
- C:\Windows\System\QfeSaPm.exe
  C:\Windows\System\QfeSaPm.exe
  2⤵
  PID:8944
- C:\Windows\System\ZfoPaIy.exe
  C:\Windows\System\ZfoPaIy.exe
  2⤵
  PID:9072
- C:\Windows\System\QTEKIzw.exe
  C:\Windows\System\QTEKIzw.exe
  2⤵
  PID:8328
- C:\Windows\System\SYRWFWj.exe
  C:\Windows\System\SYRWFWj.exe
  2⤵
  PID:8832
- C:\Windows\System\xcQPQnm.exe
  C:\Windows\System\xcQPQnm.exe
  2⤵
  PID:9192
- C:\Windows\System\wmFioaW.exe
  C:\Windows\System\wmFioaW.exe
  2⤵
  PID:8376
- C:\Windows\System\smFsbTq.exe
  C:\Windows\System\smFsbTq.exe
  2⤵
  PID:7472
- C:\Windows\System\FhWnhrk.exe
  C:\Windows\System\FhWnhrk.exe
  2⤵
  PID:6708
- C:\Windows\System\dHkPiCk.exe
  C:\Windows\System\dHkPiCk.exe
  2⤵
  PID:8976
- C:\Windows\System\OTamMhf.exe
  C:\Windows\System\OTamMhf.exe
  2⤵
  PID:9028
- C:\Windows\System\XdROEfs.exe
  C:\Windows\System\XdROEfs.exe
  2⤵
  PID:8768
- C:\Windows\System\DCISqiW.exe
  C:\Windows\System\DCISqiW.exe
  2⤵
  PID:8704
- C:\Windows\System\jGWMblh.exe
  C:\Windows\System\jGWMblh.exe
  2⤵
  PID:9228
- C:\Windows\System\qdrhSRL.exe
  C:\Windows\System\qdrhSRL.exe
  2⤵
  PID:9244
- C:\Windows\System\OmSnJkX.exe
  C:\Windows\System\OmSnJkX.exe
  2⤵
  PID:9260
- C:\Windows\System\KULKnzH.exe
  C:\Windows\System\KULKnzH.exe
  2⤵
  PID:9276
- C:\Windows\System\bLAOgWu.exe
  C:\Windows\System\bLAOgWu.exe
  2⤵
  PID:9296
- C:\Windows\System\IqpmWXw.exe
  C:\Windows\System\IqpmWXw.exe
  2⤵
  PID:9312
- C:\Windows\System\cOSRpbz.exe
  C:\Windows\System\cOSRpbz.exe
  2⤵
  PID:9328
- C:\Windows\System\caiuOAS.exe
  C:\Windows\System\caiuOAS.exe
  2⤵
  PID:9344
- C:\Windows\System\GrITwWm.exe
  C:\Windows\System\GrITwWm.exe
  2⤵
  PID:9360
- C:\Windows\System\hPSzWgj.exe
  C:\Windows\System\hPSzWgj.exe
  2⤵
  PID:9376
- C:\Windows\System\hUDSMQM.exe
  C:\Windows\System\hUDSMQM.exe
  2⤵
  PID:9392
- C:\Windows\System\SEMJHmI.exe
  C:\Windows\System\SEMJHmI.exe
  2⤵
  PID:9408
- C:\Windows\System\ETJCuuN.exe
  C:\Windows\System\ETJCuuN.exe
  2⤵
  PID:9424
- C:\Windows\System\tvmtjVD.exe
  C:\Windows\System\tvmtjVD.exe
  2⤵
  PID:9440
- C:\Windows\System\VrwTYTe.exe
  C:\Windows\System\VrwTYTe.exe
  2⤵
  PID:9456
- C:\Windows\System\AHIpPiQ.exe
  C:\Windows\System\AHIpPiQ.exe
  2⤵
  PID:9472
- C:\Windows\System\MCJDPeB.exe
  C:\Windows\System\MCJDPeB.exe
  2⤵
  PID:9488
- C:\Windows\System\wXsSKlX.exe
  C:\Windows\System\wXsSKlX.exe
  2⤵
  PID:9504
- C:\Windows\System\bNyXvLV.exe
  C:\Windows\System\bNyXvLV.exe
  2⤵
  PID:9520
- C:\Windows\System\OjXOVQx.exe
  C:\Windows\System\OjXOVQx.exe
  2⤵
  PID:9536
- C:\Windows\System\LfUQIAS.exe
  C:\Windows\System\LfUQIAS.exe
  2⤵
  PID:9552
- C:\Windows\System\zFPWwVj.exe
  C:\Windows\System\zFPWwVj.exe
  2⤵
  PID:9568
- C:\Windows\System\YLiLRLi.exe
  C:\Windows\System\YLiLRLi.exe
  2⤵
  PID:9584
- C:\Windows\System\cpBVxWa.exe
  C:\Windows\System\cpBVxWa.exe
  2⤵
  PID:9600
- C:\Windows\System\GVlKOGD.exe
  C:\Windows\System\GVlKOGD.exe
  2⤵
  PID:9616
- C:\Windows\System\emFxJUv.exe
  C:\Windows\System\emFxJUv.exe
  2⤵
  PID:9632
- C:\Windows\System\YdJdmEs.exe
  C:\Windows\System\YdJdmEs.exe
  2⤵
  PID:9648
- C:\Windows\System\FwfJOvi.exe
  C:\Windows\System\FwfJOvi.exe
  2⤵
  PID:9664
- C:\Windows\System\cVJdvSA.exe
  C:\Windows\System\cVJdvSA.exe
  2⤵
  PID:9680
- C:\Windows\System\SNyqqre.exe
  C:\Windows\System\SNyqqre.exe
  2⤵
  PID:9696
- C:\Windows\System\YGilScr.exe
  C:\Windows\System\YGilScr.exe
  2⤵
  PID:9716
- C:\Windows\System\KcukXwM.exe
  C:\Windows\System\KcukXwM.exe
  2⤵
  PID:9732
- C:\Windows\System\MIuJUVD.exe
  C:\Windows\System\MIuJUVD.exe
  2⤵
  PID:9748
- C:\Windows\System\NLFhxEX.exe
  C:\Windows\System\NLFhxEX.exe
  2⤵
  PID:9764
- C:\Windows\System\OyPjccy.exe
  C:\Windows\System\OyPjccy.exe
  2⤵
  PID:9780
- C:\Windows\System\ERrEIoH.exe
  C:\Windows\System\ERrEIoH.exe
  2⤵
  PID:9796
- C:\Windows\System\JFNjvXW.exe
  C:\Windows\System\JFNjvXW.exe
  2⤵
  PID:9812
- C:\Windows\System\wvHAICd.exe
  C:\Windows\System\wvHAICd.exe
  2⤵
  PID:9828
- C:\Windows\System\pJzQpcO.exe
  C:\Windows\System\pJzQpcO.exe
  2⤵
  PID:9844
- C:\Windows\System\xTFSLTe.exe
  C:\Windows\System\xTFSLTe.exe
  2⤵
  PID:9860
- C:\Windows\System\JeCGnKR.exe
  C:\Windows\System\JeCGnKR.exe
  2⤵
  PID:9876
- C:\Windows\System\cEOWrWx.exe
  C:\Windows\System\cEOWrWx.exe
  2⤵
  PID:9908
- C:\Windows\System\NTTLoTm.exe
  C:\Windows\System\NTTLoTm.exe
  2⤵
  PID:9924
- C:\Windows\System\kXyeURY.exe
  C:\Windows\System\kXyeURY.exe
  2⤵
  PID:9940
- C:\Windows\System\JNmshUu.exe
  C:\Windows\System\JNmshUu.exe
  2⤵
  PID:9956
- C:\Windows\System\qBweKFx.exe
  C:\Windows\System\qBweKFx.exe
  2⤵
  PID:9972
- C:\Windows\System\GFEpqSq.exe
  C:\Windows\System\GFEpqSq.exe
  2⤵
  PID:9988
- C:\Windows\System\JRQxoKG.exe
  C:\Windows\System\JRQxoKG.exe
  2⤵
  PID:10004
- C:\Windows\System\erlBPXs.exe
  C:\Windows\System\erlBPXs.exe
  2⤵
  PID:10020
- C:\Windows\System\sSXRPof.exe
  C:\Windows\System\sSXRPof.exe
  2⤵
  PID:10036
- C:\Windows\System\aAbboES.exe
  C:\Windows\System\aAbboES.exe
  2⤵
  PID:10052
- C:\Windows\System\OyoBHRf.exe
  C:\Windows\System\OyoBHRf.exe
  2⤵
  PID:10068
- C:\Windows\System\gciUNqZ.exe
  C:\Windows\System\gciUNqZ.exe
  2⤵
  PID:10084
- C:\Windows\System\AEqYmET.exe
  C:\Windows\System\AEqYmET.exe
  2⤵
  PID:10100
- C:\Windows\System\cbeazcw.exe
  C:\Windows\System\cbeazcw.exe
  2⤵
  PID:10116
- C:\Windows\System\QnlKaED.exe
  C:\Windows\System\QnlKaED.exe
  2⤵
  PID:10132
- C:\Windows\System\HUUvcEV.exe
  C:\Windows\System\HUUvcEV.exe
  2⤵
  PID:10148
- C:\Windows\System\pMozNFy.exe
  C:\Windows\System\pMozNFy.exe
  2⤵
  PID:10164
- C:\Windows\System\daiqJnN.exe
  C:\Windows\System\daiqJnN.exe
  2⤵
  PID:10180
- C:\Windows\System\RjiJFYB.exe
  C:\Windows\System\RjiJFYB.exe
  2⤵
  PID:10196
- C:\Windows\System\pUGBoIP.exe
  C:\Windows\System\pUGBoIP.exe
  2⤵
  PID:10212
- C:\Windows\System\jblgopa.exe
  C:\Windows\System\jblgopa.exe
  2⤵
  PID:10228
- C:\Windows\System\snYdKxv.exe
  C:\Windows\System\snYdKxv.exe
  2⤵
  PID:8312
- C:\Windows\System\pnyOxUq.exe
  C:\Windows\System\pnyOxUq.exe
  2⤵
  PID:9272
- C:\Windows\System\fxKRBtl.exe
  C:\Windows\System\fxKRBtl.exe
  2⤵
  PID:9340
- C:\Windows\System\beIzPtx.exe
  C:\Windows\System\beIzPtx.exe
  2⤵
  PID:9404
- C:\Windows\System\YznBPQL.exe
  C:\Windows\System\YznBPQL.exe
  2⤵
  PID:9468
- C:\Windows\System\PsRWUTP.exe
  C:\Windows\System\PsRWUTP.exe
  2⤵
  PID:8032
- C:\Windows\System\SJQLgKH.exe
  C:\Windows\System\SJQLgKH.exe
  2⤵
  PID:9560
- C:\Windows\System\kvjnOwj.exe
  C:\Windows\System\kvjnOwj.exe
  2⤵
  PID:9592
- C:\Windows\System\jycGNtz.exe
  C:\Windows\System\jycGNtz.exe
  2⤵
  PID:9448
- C:\Windows\System\KnbiAIm.exe
  C:\Windows\System\KnbiAIm.exe
  2⤵
  PID:9628
- C:\Windows\System\GZlTczH.exe
  C:\Windows\System\GZlTczH.exe
  2⤵
  PID:8928
- C:\Windows\System\lhfGxsb.exe
  C:\Windows\System\lhfGxsb.exe
  2⤵
  PID:7644
- C:\Windows\System\nIQJaxJ.exe
  C:\Windows\System\nIQJaxJ.exe
  2⤵
  PID:9324
- C:\Windows\System\DRPjaqW.exe
  C:\Windows\System\DRPjaqW.exe
  2⤵
  PID:9352
- C:\Windows\System\jzRrXCk.exe
  C:\Windows\System\jzRrXCk.exe
  2⤵
  PID:9420
- C:\Windows\System\yhorjxv.exe
  C:\Windows\System\yhorjxv.exe
  2⤵
  PID:9640
- C:\Windows\System\UAjaLYz.exe
  C:\Windows\System\UAjaLYz.exe
  2⤵
  PID:9688
- C:\Windows\System\vngOljy.exe
  C:\Windows\System\vngOljy.exe
  2⤵
  PID:9756
- C:\Windows\System\wFHQmeA.exe
  C:\Windows\System\wFHQmeA.exe
  2⤵
  PID:9676
- C:\Windows\System\LMGoUWp.exe
  C:\Windows\System\LMGoUWp.exe
  2⤵
  PID:9708
- C:\Windows\System\Jlaqozi.exe
  C:\Windows\System\Jlaqozi.exe
  2⤵
  PID:9776
- C:\Windows\System\VhSyCDM.exe
  C:\Windows\System\VhSyCDM.exe
  2⤵
  PID:9824
- C:\Windows\System\WVHyrEV.exe
  C:\Windows\System\WVHyrEV.exe
  2⤵
  PID:9840
- C:\Windows\System\HkqPtEa.exe
  C:\Windows\System\HkqPtEa.exe
  2⤵
  PID:9872
- C:\Windows\System\cwwzoyj.exe
  C:\Windows\System\cwwzoyj.exe
  2⤵
  PID:9896
- C:\Windows\System\HqtKHDY.exe
  C:\Windows\System\HqtKHDY.exe
  2⤵
  PID:9936
- C:\Windows\System\BovbVAh.exe
  C:\Windows\System\BovbVAh.exe
  2⤵
  PID:9996
- C:\Windows\System\MnCAcUG.exe
  C:\Windows\System\MnCAcUG.exe
  2⤵
  PID:10060
- C:\Windows\System\hbgkZHx.exe
  C:\Windows\System\hbgkZHx.exe
  2⤵
  PID:10160
- C:\Windows\System\cofcfOU.exe
  C:\Windows\System\cofcfOU.exe
  2⤵
  PID:10192
- C:\Windows\System\VZInrzx.exe
  C:\Windows\System\VZInrzx.exe
  2⤵
  PID:9980
- C:\Windows\System\ZQIKKoN.exe
  C:\Windows\System\ZQIKKoN.exe
  2⤵
  PID:9372
- C:\Windows\System\XobhHmC.exe
  C:\Windows\System\XobhHmC.exe
  2⤵
  PID:9564
- C:\Windows\System\bxsodTg.exe
  C:\Windows\System\bxsodTg.exe
  2⤵
  PID:9624
- C:\Windows\System\AJHdqkk.exe
  C:\Windows\System\AJHdqkk.exe
  2⤵
  PID:10208
- C:\Windows\System\gOxmKHj.exe
  C:\Windows\System\gOxmKHj.exe
  2⤵
  PID:10172
- C:\Windows\System\OPzImdz.exe
  C:\Windows\System\OPzImdz.exe
  2⤵
  PID:1552
- C:\Windows\System\HUXqLNK.exe
  C:\Windows\System\HUXqLNK.exe
  2⤵
  PID:9452
- C:\Windows\System\SExjDpw.exe
  C:\Windows\System\SExjDpw.exe
  2⤵
  PID:9464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ARhqPve.exe

Filesize
1.9MB

MD5
ebbcbb6f3e578057a99691d3a8f3b683

SHA1
0f95543c0d96aa0aed76fb1fe759e904f884b544

SHA256
ee9a4069526afa8c3f0e7f5d1ab8ed6b015b0f83f538a0c3875c88d18665f2ec

SHA512
277ab63fa02b6eae134481f371d8b2ac482889dd0df0824b211002d7a3334c84e1cb275b273074b293eec0582b8508c52504ca5fef0071c4f04b9196b9fa733e

Download Submit
C:\Windows\system\EhOnWWf.exe

Filesize
1.9MB

MD5
59a4a8a3375a64f50976d1637ad05467

SHA1
843e2691caca5bce2d11067939ac19d2ca609409

SHA256
32a6448620e55b0f4e890efa068a59d9092771651e20acd62f98ca9219549704

SHA512
d669160dc7f130824cdff00cf1fa1fbca4417bf0f0e500df8727d177b203ec2f7763d16873c0af0fbb44e474d4707e2c1c945f96aa4b31383bf8d863cf15a93b

Download Submit
C:\Windows\system\HgjuYmg.exe

Filesize
1.9MB

MD5
dbca6fba0660754f4d0bfc44f156e76e

SHA1
c5cc11e09e71a63af20c1637046d76374fb980e1

SHA256
5819b2a916d8fe20b8d49abbafc35e4e8517cba842e5e4fef52227345236740a

SHA512
3a6ff46f74241f16fe02fe7848ce732c503b28db01f79ecd7af3580d9cf0613286f910ed44b66917afb2096272b6b9026bab8c5421d5ee6b58897d01431c1ea2

Download Submit
C:\Windows\system\JMFpXJe.exe

Filesize
1.9MB

MD5
19ae126a213e11ff2a03d2e580643c46

SHA1
418d6e353d295877600d5ea7eac4442505da5ac9

SHA256
9e85adc689390d105bbaef8951ed7c519d64eea07bd9ba64d4a599a8dd89b09f

SHA512
75ec6037f8033acf43e1401b45dd6f1a1b97071143d23a423911bec3be6cd8fb69203dfe478f803a6c0e80b52c59ed3ff35cf8e544ad0ee7e7d2020ed78d2a71

Download Submit
C:\Windows\system\JkaCswg.exe

Filesize
1.9MB

MD5
fa2c7449da91b4c56f145e036b1a5d9b

SHA1
81936275d89c64daee2c237d85caae6ca87094e5

SHA256
afdfcbdf7ee291acd79fec3f6581fadbb2f86bcde2c4ba6c91f97c52de3413a6

SHA512
597b5006a001d2dd288537160f5697c1914908cb0dd217c07f76a8942f064f3b5c806e97295408f886fd62f67629e5905b684e3af0c9c92980a32c0af16ac33c

Download Submit
C:\Windows\system\LrYwkBl.exe

Filesize
1.9MB

MD5
f3f9a0444e018a0e6e901ec423883125

SHA1
b61ce4b06401c569ca5411713004bed2c58d06d5

SHA256
1889c76319a7059813f90859599a1c2c6160985c27c04c8b95273a2d5a0b4dc9

SHA512
377529efb4a31dfaaa01f258877b42b90069561e383d40f40bfcae0f6de42bc10991552be3755510956d7c74e081c2fe9334f71a7cb63951b4d1ff83f5f8323c

Download Submit
C:\Windows\system\RjnKiEV.exe

Filesize
1.9MB

MD5
2b2dc009f56213d671841cc6d23a2deb

SHA1
864fd0bdc180b33e0e4e4029b7b2e9a0e1f98ea8

SHA256
214e111101c02e2a95e8329f257cf0d78882f73a79aa1bb415d54550f77415e5

SHA512
93c5ae3afeec13aab84106d4e63e3b4833c9b8e83411995f318d1d02e8f03be32fbcded3e53649feebcd7a91841957d8b45b977761f233b2848e786f4fc6a33e

Download Submit
C:\Windows\system\TQRlpmM.exe

Filesize
1.9MB

MD5
746a455121e9a8b52e57b21a13ffffc1

SHA1
9a42d9b9854c362e9ccc22a634a3dcb3cb7e8e62

SHA256
91cf131d3d48149695d37fe0d189eed29c0756753886c5cc93f30012e011e96b

SHA512
bbb48837fa99c100920adbf0b8fd4e605467e45b2df75e0ddd015dca6c14ca5be619421783a99cdea626c6e931c128e4dbe54fb6a4ed058bbc55c4e4aa96d3e1

Download Submit
C:\Windows\system\TtAdMSU.exe

Filesize
1.9MB

MD5
dc2c2d63f8a8f739ed484e131255693a

SHA1
7a95fb0f719dbeec5256a9ed170261163198863f

SHA256
d0122f82e56af515bfd557bb1b21f1aadae06ad5b0a4f636705d7a109b1b0caf

SHA512
8ca43c072f5ba5882ab37a40cdd0471e6b4234760a4d26db32db1308d4ec31e596baebc741c58e6b623fe0476a748975c382160de4ac4ba045df6c48ca0a1857

Download Submit
C:\Windows\system\VTUFcfK.exe

Filesize
1.9MB

MD5
82bc823a9dbe74890110a76e2d019f2e

SHA1
c0264884be66e73d3d39da4d94e56048e9d0be19

SHA256
b5cfa134eb447cfb6c56125262d50120b6fbbcd3046d970146f3be83a8fb0ede

SHA512
726bdf645ef524fe77c6f645407bd801a67a40ee22c0b301a8afe4dc05f8229eb61b503b74a4d162bc72aadc2d8aad82c753cee57e97a15ee3fedd39977e1556

Download Submit
C:\Windows\system\Vlonpvj.exe

Filesize
1.9MB

MD5
88c36278342e12ff4ccd876ead1b024f

SHA1
4422a3bfb8ad62c29b4dfd9493108e3c1eacf9e8

SHA256
93cf9681a995a2322ce6a179adb1d83ea3648a1e2a21c55011cc164c0ae85ed7

SHA512
706d7c67a520437cd11c220dbe2048826222c7d16f461253c646c75158706d7a8c9715c9ada9744e270e3235dc9b3fcd7434c5f46082449ae3b7050f16888ab4

Download Submit
C:\Windows\system\VwGHJiW.exe

Filesize
1.9MB

MD5
c172114d0a7d9baba516717d08bcfab8

SHA1
77e5032d2ac4f50f7be7e3ccbc808e482c80ab1d

SHA256
2631f717e827909eea7837696b1787200429cb352851a09f47a647a379febf84

SHA512
9dd879049b782eb150f88ce76bf71fdd6479eaa5b5def902596134e26234e3c460deacd14a3c168dabd1746ce7fb007f1d5aa01ce812b49a04ec8cc926f5b078

Download Submit
C:\Windows\system\XycZGmo.exe

Filesize
1.9MB

MD5
bf43f99869fa466774f695ecb3773576

SHA1
6538079ce41f07f77d676efd2ae262e9fbd075ff

SHA256
ab41b50e0f4d485ab260e870686910b33eff1fe445e6aa21e3a47042ab1d7bdb

SHA512
6e33ed6b895bc03e0e01e9be7800ff057504477359def7f095bdb0b273f5274c49014a0620602248c75ab289dddcf73f0c4fd80a2f3b179808661950bd7b3dd6

Download Submit
C:\Windows\system\aNDRDxb.exe

Filesize
1.9MB

MD5
267616043d7e86d15ff2208fc56a63c7

SHA1
39f8d3e6bbf9fe80744e78eca2469fb71e246226

SHA256
d435dd4850da17d06d00fa6b828575231f2f34fe6f727560ece26a9f8b5f9a35

SHA512
e31985436a80f6f2f6688182da7115a220b8c5cfbc172cc2812b887ddc5d8bbe8375b3fd4ae1ce486f708fc129bda791e1e0a94c20f2bb93e1c2bb0d906d3534

Download Submit
C:\Windows\system\fVOMDit.exe

Filesize
1.9MB

MD5
9127a879e5a9f6f3216f605f511e51bd

SHA1
9ddc384106ead75a9c41f6baaceb41bccda386a2

SHA256
ff488dbcbcebe81fe34e429f0773669114669d5c68a932e0575c6d7e0ea80dc6

SHA512
b178af8dd63c940877552070875ddd17d279e64c76140dd7eeb4bd05d9cf1bb01c0759d353fd5385244e50de304babee29ca560075d0c467ca73e77dd544f642

Download Submit
C:\Windows\system\iWiJZCm.exe

Filesize
1.9MB

MD5
a1cfcc4ce6a2da673c495027c4c51c02

SHA1
a6304056f45a31ac47d8023eba51ba5de7d3e1d5

SHA256
b57b794f79cfeb5c9306b1a4e9dcdebb894632290c9d821d9fe7d665c9dff322

SHA512
1945aad3614ae992e9c12400a2573ac816ef38d2435387daf6afefdff3389511bf4a9c5d746fbf9d16375992efb119a3dac4b111e109ef9d87e6e0ce9a763b58

Download Submit
C:\Windows\system\lGtRvIL.exe

Filesize
1.9MB

MD5
619d28ba66deea5bae9806bbd610a757

SHA1
e322ea603bf4a1eeec38f58b64c54a6d0729c0ff

SHA256
f69a2a4ce49acf9be264fa20907552e8006766f16209c04df557122977fad332

SHA512
a629dfa5008d64627744de8f46a9ca619e43c14f95db16089e1626bae5f8bc82cdeef3e62136c4d9d1cecf48ff84a298558e18a18f1f59cfe90a9d8839103afe

Download Submit
C:\Windows\system\oAfcLiV.exe

Filesize
1.9MB

MD5
180b2f4450060e53642a7fc17a4651fb

SHA1
adea43876d3c937053b69542f3f6978c4a5162ad

SHA256
125cb198ab22c78bb89fb5d5a122697f7c9122c813c22b503d84a62b195e1cba

SHA512
15ab4dfde85e2af9b6ded41b0fae0f98562944c5a3a3c866ec23e57116554e450518bd6fa9491b7443b2d3a2ca4903426eb7743ec06506ed0fa3f6bc9d18e015

Download Submit
C:\Windows\system\pxhirjT.exe

Filesize
1.9MB

MD5
f89907b53d958d0f7ac8ce7535ee899b

SHA1
24f597dd731de1824419ce8101fc485324bf77c9

SHA256
0210dc73afdaecbad6bb1bd5c5bcc6bf1b42c37bce51228b6cb6dd45d55c824a

SHA512
ef0aa921e21818747172499bbbf2dd23e2f0071f2df7d5be38ade504b70a75d357f887068421bf922f2146be34e0dc2fe1f537862e26e6aee516646b639427ad

Download Submit
C:\Windows\system\sIaIufe.exe

Filesize
1.9MB

MD5
05d09deee03f595386f1f0fb04b9dff9

SHA1
59214621e3695e15e7f40527802d614f16495021

SHA256
126df56bfddda55b0f53a16928a187f5ccdaecee2b865cdc860f35b6f408b140

SHA512
309c191a7cbf48671e4f11b1da46cfb7c0bf21dac4d1c515ae4eb09b5079f41618415a6df368bced4e881a5370d5ca24aa06cd74925381dd5143cf3f1b987a86

Download Submit
C:\Windows\system\vzaAIIU.exe

Filesize
1.9MB

MD5
4a2eababec0681bd25632c6646a1bdde

SHA1
5974ad43cdaeddffd579f198ba360cc824c5bce2

SHA256
5da86472a126259cb9005da1f2b90043d3c9fec37a2c2a0b9074acaccdcdb01e

SHA512
6d378fb0a7138fd03fd74b8f1c72cafdd7e5f00e5ecfffbc17ea31739c445818a1be20077e0284fdc51d629b02a6d6c21eb4653e82fb63062606cb839c918ed1

Download Submit
C:\Windows\system\xzHRoIp.exe

Filesize
1.9MB

MD5
5400ff7f47c097a381a27a8bdca918fd

SHA1
b8f4d5988bc9c21e2b0ac816e7c1efa4fa7795c4

SHA256
e100b5bf824f813889cca805b92083e6348ecbb5eb8482a7aef1973ac62f1f63

SHA512
fe7b97b1baa6724a30d9a1c4fdc18ab83b49f7f463f20ff4a41ba3f2999c4e02c0cb28c93d3058d3757489183c39b2150582ca2eeaf50949a832c9a9454aaa77

Download Submit
\Windows\system\DsYaiqj.exe

Filesize
1.9MB

MD5
e282bdd819e38ae4deb44982e65ba9d6

SHA1
6f4be3e82325c9ecd32fb829685e17f9e90a7d3e

SHA256
5ad19b3b09123e431062c2e68057818659334457d85f797df81d77c8a9fced8f

SHA512
d6baec21def4f5fdf5980ba8f0029c4df061fa7ddeb2e5f59687ae1b2acb7a14ae66104151c5b63690d8ff8bc11d99c5b2940ea64de7f7978f19cc1f10974185

Download Submit
\Windows\system\LTQaLlA.exe

Filesize
1.9MB

MD5
e1fcebcdb756621761db58771a269abd

SHA1
b21c2b2d9ae4c2c836d260a4c40d8d87a32b8a65

SHA256
4d9084cdc598f88e96245458101bd77334cb39fa4d1bdaacd4aa2e8a09fe5d8f

SHA512
dc2f9c6852a5338a27a1e821c2b5baabfca373185fdb15f634f02dd8d13fb0814b46c7afbde7821683b7d23b983bb72f9fd34fca2f0ed77606eadbffa35287aa

Download Submit
\Windows\system\QsGCdOA.exe

Filesize
1.9MB

MD5
080108bb9dff6459e710a1d77b3acbe6

SHA1
44cd867ba01f37ae517ac5ea026f211ebcdfd7d6

SHA256
545e82b09c88f015b2da77d1303a0a5b97db4eeeccaf6b594fbf97c9e2111ba3

SHA512
73f51b987f5115ef6b899fc99a30a8b31d65d1362315fc9e18526019e3e436120da9c749890e8f93297cf2272afa7f7000250e5f34058b3239a261124952636e

Download Submit
\Windows\system\SxATWpl.exe

Filesize
1.9MB

MD5
b1938362c56785af21ddd919264114e3

SHA1
0268742906bd7402955a0e7038b346f4c89fb8df

SHA256
4a2e87990a31a054ce640c718df4a10e52e711c19f3d4d4bb959a14c6d74b196

SHA512
3eb9740258a72dd28cc2c77573032ab2cbaa75435348b9d34b86dbc6a86ae80f4c28fb3829ca8d08907e0086c3164982ea140c1cc69154222094e67937ecc35b

Download Submit
\Windows\system\UWmDFUv.exe

Filesize
1.9MB

MD5
689d3bea433ca89097aa5b2ef710875d

SHA1
2ad21f6dd8708374d19d7ddf3ee08c8b537c1b9f

SHA256
e75cce8f6eb02d5aa2f56840671739152cd5001dbb34ec6991e6e3fe57e6fe7a

SHA512
dd9f93b0054b53b8e01fc9f8ee85d21363549cd28591f9270167988877f54d4e13fd33bd52f61f955c17ee175968f9c4ca880582af4eab2f2fddb8afdbcdcec4

Download Submit
\Windows\system\VYDFOYa.exe

Filesize
1.9MB

MD5
92a4596b1ee8cab95ce615b21f8203fc

SHA1
696b434af7023db6679081f040ac4994b39729fe

SHA256
c91b093cc69c085c78d5f86ee98fb5c875894e78ebc85d9c0a7f1da0edb356f3

SHA512
f6c80221201daf5db19daf85c6b2d3a1633a19e1dbb530f967f6d339b43f217fe59990d03f266885db751172620d85aedccf1fd81cc1cea4bd0dd1056193a28d

Download Submit
\Windows\system\ZgjAOtN.exe

Filesize
1.9MB

MD5
031c279b035c7657c805020a6e6916c6

SHA1
8a64b192307880245c1857bef13e04edcafc55be

SHA256
481c92c88be61eaa2db5fb773b6773f7db9b9a7d1f02e3db2237d75ccded7cc2

SHA512
d49f4e9a4dc1007c3dae6487f04df6d29532e193c2d84d53137136fabf17db617104d6783fbf0842d1d2be580dfaf2bb9fc739e38f93c533a533997c9c0e57f5

Download Submit
\Windows\system\dCMmOrm.exe

Filesize
1.9MB

MD5
a5aa93d5fff30cbe6470a21527d94bb6

SHA1
eb7e96e370198ce7da24198a8b0687c3eff73b9e

SHA256
43727ea28fd2629404969bec4364a2c2f2c22826e78b3c56450d1774d9962288

SHA512
b283f3763839e635408b700e2199c7d9b07f8ce6892a21c4603594f9fd2d01ed55e31c5ab5207b10ab0ae2d8a499e878699ed55644334970ccaaf153c5b6093d

Download Submit
\Windows\system\ednGDZn.exe

Filesize
1.9MB

MD5
b83f584db70002e209f4c68a6588703e

SHA1
2f4c110c4b72f73f89492c5e6ad34ab2a9c00383

SHA256
7926d68de4a408f3114cb94e15a882f7f570d899dfa7854e7e9a804042bdc12d

SHA512
8da86d6c423029bffaa3c2886172c31b531fcafc9cc128d5691ac58540a56702e8fad665416e3ed8a3fbc2ddb155c9564a0027f29eb2a4b3805a6728cc5eeb1a

Download Submit
\Windows\system\gudznpk.exe

Filesize
1.9MB

MD5
e914ae1ac83a16da4a34249a3fff8ec6

SHA1
ef7c966ba05ca41fe2007d5b8210080c5698208f

SHA256
ac38b0ac7136f721dfbe25da5553792d98683cae9ab0372f844e4f4816eb0039

SHA512
9fa0ea07d5f9a98e2b622939e2e7d8902f41def39c109fb676b8abb4dd109040a7027e47974aa1a9538992751bae1e175c0a875a4e93e86197a9c58cccd1b64b

Download Submit
\Windows\system\iRtCyQW.exe

Filesize
1.9MB

MD5
8a326a53f45a987049c4469e42d45106

SHA1
3e2a6a1718adc69084645f3ff78eceff650b2bfc

SHA256
797b1f0c6045148f2489472b0465a0798676806c16c78a84eb7d570725cb49f8

SHA512
7dc4187b59a6eff00fc92882ddeab5151340459410fbc7841f5df97ff5f697d7b31421577c13706226ced3dcba26d3797d8ff8dcd41b97929c41f699ee533779

Download Submit
\Windows\system\lSlWUAG.exe

Filesize
1.9MB

MD5
5fc995605c20a3446d58c77630eef44d

SHA1
84544627bed58d41d9acf8f403be3204d0c05958

SHA256
178b4c42b4ad984cb860487c2a87382767a8e258de79c8d1804c89969c4e89a5

SHA512
87a4ebe661ec2c2e4f61e660630dcf292d58bc3204dd281dc768cb31e3556bb2796026ba77d46df7dd3747362ebe9a479c8ef76c6146aa58bf1e09930c7b065f

Download Submit
\Windows\system\piHnhoB.exe

Filesize
1.9MB

MD5
9697bc9ab01069872431c3e64f83c382

SHA1
c5907f2a8b5ce421922d9caade09130ca5fae9b3

SHA256
c192a1057963e90f12ff310360373c85158e6f4a9b55cdb4a034f801687a13ea

SHA512
d25f16e0d0fe7412771d0f830f17d6143639cbd1994ee3f2971a97321eb1b2c71d63dd9f46decd35f3576e26b071a3bcdd5ab552fbb33e00c04e990c5d42adfd

Download Submit
\Windows\system\qGhLCDj.exe

Filesize
1.9MB

MD5
fa234b10ca3a1c4d968832105a01d82e

SHA1
bc913bcc539f678ed3657115633c38d59c349b00

SHA256
5b615dd521fae9a08050130dcd3bfae6a2322d098f3e50a14c098b47ee479171

SHA512
e5b05aa9a86d7d99e7eae1635413dbb23987f1a75ea1bf2f6902f29175104a2fcfe35471797cf3a93bd71ab8ae663638e49ca245414cfbdc12154b7d56c4c01c

Download Submit
\Windows\system\vUTYvfo.exe

Filesize
1.9MB

MD5
4094a319aa2b8de373149756fe02696c

SHA1
932be363720662385b4cedee356961c7716fe371

SHA256
5435480431f305ea75bfaaa71c34d656e6bb17f99f1c7f4396dd48ea0d9fc842

SHA512
d2b95160b9e2de5b31c08a35e2f8671efa66173fd3ad9edff0e8e874d1a265b61470a66ca5b3869a45722c40920d44dbec95f31d07d289889dcd2629832daf97

Download Submit
\Windows\system\xZzgsrX.exe

Filesize
1.9MB

MD5
27f5405e8fc4108057a56f89065756df

SHA1
488c114010c07bbd307629bfb8e014096de51f6c

SHA256
4692af124c5e5d858e0ada6a7d8e246f76a527891ffc4e0f98d37dc8e2c7ae14

SHA512
2a2972fe54c9d411ba1f4038b33bc2969938e39b13226c7ccd80a1967bea80e03bb8e03c8a529d88366349bbe97ce7f2116230a8728b467e6b81c9464bd0ea88

Download Submit
\Windows\system\yDAxodG.exe

Filesize
1.9MB

MD5
f7ee7e6bf493931ec543ae6339c51ddd

SHA1
67b4fb14a834b3dd7534cf5e24204ed396e5611e

SHA256
ea80650837acaa22664d1f995f2350a60b07e3eaa2dc736ec81b8326b4484d26

SHA512
58af7b600cb6a927ec970d3cac6828f65bad700f4e28ef7828aa832e9f009b4b5b8ca8089a4ef62b7d14fa411215caf61bcdd48f6466cdca211967724add28cf

Download Submit
memory/1672-170-0x00000000022B0000-0x00000000022B8000-memory.dmp

Filesize
32KB

Download
memory/1672-169-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/1812-182-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2316-63-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2340-67-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2340-166-0x0000000002E90000-0x0000000003282000-memory.dmp

Filesize
3.9MB

Download
memory/2340-5-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2340-187-0x0000000002E90000-0x0000000003282000-memory.dmp

Filesize
3.9MB

Download
memory/2340-189-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2340-31-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2340-159-0x0000000002E90000-0x0000000003282000-memory.dmp

Filesize
3.9MB

Download
memory/2340-191-0x0000000002E90000-0x0000000003282000-memory.dmp

Filesize
3.9MB

Download
memory/2340-192-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2340-193-0x0000000002E90000-0x0000000003282000-memory.dmp

Filesize
3.9MB

Download
memory/2340-194-0x0000000002E90000-0x0000000003282000-memory.dmp

Filesize
3.9MB

Download
memory/2340-184-0x0000000002E90000-0x0000000003282000-memory.dmp

Filesize
3.9MB

Download
memory/2340-0-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/2340-167-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2552-183-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/2556-186-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2632-188-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2660-185-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-177-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2788-190-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2848-104-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download