xmrig | ea6d1fba6041c84c47059473beea90379e997a04b54ce90774de6ddc2d9d6ddb

Analysis

max time kernel
135s
max time network
145s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
Size

1.9MB
MD5

0c3b23d87b84c6c5eeffc35ce4285fea
SHA1

10d23932732c5f11130fc6bd42ff303f31cc6725
SHA256

ea6d1fba6041c84c47059473beea90379e997a04b54ce90774de6ddc2d9d6ddb
SHA512

9269638941259a8c02f8a831ff7c6a4c18d035631d30f74050d5bc6a48fea98f2dd89891605a296efce5f7544d9e1e04499888a5f3239dba17263d2fc2ea83b7
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1Z:NABc

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2644-37-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/2584-127-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2432-165-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/2320-156-0x000000013FD20000-0x0000000140112000-memory.dmp	xmrig
behavioral1/memory/2572-136-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2564-61-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/2204-22-0x000000013FF10000-0x0000000140302000-memory.dmp	xmrig
behavioral1/memory/2740-29-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/2496-24-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2592	nxFZcJk.exe
2204	YeGtDsM.exe
2496	aIXtKUr.exe
2740	TjwGcqm.exe
2644	pxNVAAA.exe
2564	IMcuPzm.exe
2584	FMErQxM.exe
2572	qCehedv.exe
2432	DQmzeHe.exe
2460	dfSnshX.exe
2836	WdUyfVt.exe
1064	MPNgLLx.exe
1932	UwKVrEc.exe
2468	XVaETxZ.exe
1508	vLnWTdy.exe
2368	KPTzCvv.exe
1436	EgtpDzf.exe
2724	BChPCrw.exe
1244	ejXjiDc.exe
392	DOnaTMY.exe
1044	noxtrqQ.exe
1912	mdkwwQo.exe
2684	orTnBnT.exe
3056	AytmBoJ.exe
2588	UqAjgOr.exe
1968	NTbBCJO.exe
960	BIlQgDW.exe
952	viQCzWh.exe
1528	kdtiOol.exe
2268	YgjUVTa.exe
984	xWjxvDR.exe
1452	BepHECv.exe
1988	iYnyhFj.exe
576	gNoGava.exe
552	EmzRMiZ.exe
1744	ASuHQex.exe
3004	BPjasNG.exe
3020	rADBEMM.exe
2104	UdPbelb.exe
616	zQYcbkw.exe
1752	ShAznBW.exe
2360	UslYJuI.exe
2792	jEEHaSq.exe
2212	ecCEiaV.exe
2512	hrdmfWJ.exe
2412	cumwyxV.exe
2576	AbEuhBd.exe
2480	NfPLHjx.exe
1832	QGVmZnE.exe
1312	BEfMycI.exe
820	BkXKiXC.exe
1380	vXAOVmx.exe
612	GFfjLsy.exe
2948	cWKkHjk.exe
1808	eomZFLx.exe
2908	cbosiCB.exe
2216	KOvhVep.exe
2904	haJNBXk.exe
3084	ewVlNXq.exe
3116	lKqyvqU.exe
3148	IzbyUvZ.exe
3180	EeBnQBD.exe
3212	oxiibtF.exe
3244	ARsoQQV.exe

Loads dropped DLL 64 IoCs

pid	Process
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2320-0-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/files/0x000b000000015d0f-6.dat	upx
behavioral1/files/0x00070000000165ae-20.dat	upx
behavioral1/files/0x000800000001650c-10.dat	upx
behavioral1/memory/2592-16-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2644-37-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/files/0x0008000000016be2-47.dat	upx
behavioral1/files/0x0008000000016c04-65.dat	upx
behavioral1/files/0x0006000000016cc6-97.dat	upx
behavioral1/files/0x0006000000017371-116.dat	upx
behavioral1/files/0x0006000000017407-162.dat	upx
behavioral1/files/0x0006000000016ca5-169.dat	upx
behavioral1/files/0x0006000000016d3e-187.dat	upx
behavioral1/files/0x00140000000185e9-149.dat	upx
behavioral1/files/0x0006000000017422-143.dat	upx
behavioral1/files/0x00060000000173f2-137.dat	upx
behavioral1/files/0x0006000000016fed-131.dat	upx
behavioral1/files/0x0006000000016e24-130.dat	upx
behavioral1/files/0x0006000000016d51-129.dat	upx
behavioral1/memory/2584-127-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/files/0x0006000000017374-119.dat	upx
behavioral1/files/0x000600000001735a-113.dat	upx
behavioral1/files/0x0006000000016e4a-106.dat	upx
behavioral1/files/0x0007000000016c51-102.dat	upx
behavioral1/files/0x0006000000016d1a-99.dat	upx
behavioral1/files/0x0006000000016d57-98.dat	upx
behavioral1/files/0x0006000000016d16-82.dat	upx
behavioral1/files/0x0006000000018ba1-188.dat	upx
behavioral1/files/0x0006000000016cbe-74.dat	upx
behavioral1/files/0x000500000001860c-170.dat	upx
behavioral1/files/0x0005000000018717-182.dat	upx
behavioral1/memory/2432-165-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/files/0x000d0000000185f4-164.dat	upx
behavioral1/files/0x00060000000174a5-163.dat	upx
behavioral1/files/0x000600000001737c-161.dat	upx
behavioral1/memory/2572-136-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/files/0x0006000000016cb6-96.dat	upx
behavioral1/files/0x0007000000016c7c-94.dat	upx
behavioral1/memory/2564-61-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/files/0x000f000000005578-73.dat	upx
behavioral1/files/0x0009000000016a29-58.dat	upx
behavioral1/memory/2204-22-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/memory/2740-29-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/memory/2496-24-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/files/0x000a0000000167d5-33.dat	upx
behavioral1/files/0x0009000000016176-11.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IGmreSq.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\oJCbMQV.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\XivRnWl.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\zQYcbkw.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\xuJoYdQ.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\grljEPK.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\cygsDNt.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\rbZNnje.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\slEcCpR.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\ymNKcFk.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\UhsTWVR.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\YYltzgR.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\MzFGSCX.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\tqrWoYR.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\pQALJBR.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\DOnaTMY.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\lKqyvqU.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\dVgpRAh.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\LWrZqpY.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\CKPTTUo.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\KcVbpbt.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\oIGNKIA.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\AsSvqPc.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\sZRrMXi.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\HdRdBje.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\VCIRTFm.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\dDmOpur.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\lZffUyC.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\TDNDKdb.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\ZVHMQxo.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\cmRjrZN.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\BNBQzLx.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\VRCxdoB.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\pKwrvBd.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\dzmYtKO.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\dgBXkxo.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\UCmOcct.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\lBkuTsX.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\GFfjLsy.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\dumrTpb.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\JqeqkuO.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\loVokRs.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\JhYfGLT.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\aCEflID.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\bVRPjnn.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\lFgDAOP.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\uoWHoBE.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\IBJZGqF.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\RYgRdUN.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\BhfgAdq.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\uyQMEnN.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\unFzBNO.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\gcrLjiJ.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\qmOiRsH.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\tvCXJfZ.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\xGEZOZJ.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\fPkSNcM.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\IbsDuEM.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\YIuUnEA.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\oPjhXVW.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\FkOQNZz.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\PmBnJne.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\qWUqGIZ.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
File created	C:\Windows\System\vEwThJR.exe	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2864	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
Token: SeDebugPrivilege	2864	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2864	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	29
PID 2320 wrote to memory of 2864	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	29
PID 2320 wrote to memory of 2864	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	29
PID 2320 wrote to memory of 2592	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	30
PID 2320 wrote to memory of 2592	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	30
PID 2320 wrote to memory of 2592	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	30
PID 2320 wrote to memory of 2204	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2204	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2204	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2740	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	32
PID 2320 wrote to memory of 2740	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	32
PID 2320 wrote to memory of 2740	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	32
PID 2320 wrote to memory of 2496	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	33
PID 2320 wrote to memory of 2496	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	33
PID 2320 wrote to memory of 2496	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	33
PID 2320 wrote to memory of 2644	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	34
PID 2320 wrote to memory of 2644	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	34
PID 2320 wrote to memory of 2644	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	34
PID 2320 wrote to memory of 2584	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	35
PID 2320 wrote to memory of 2584	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	35
PID 2320 wrote to memory of 2584	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	35
PID 2320 wrote to memory of 2564	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	36
PID 2320 wrote to memory of 2564	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	36
PID 2320 wrote to memory of 2564	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	36
PID 2320 wrote to memory of 2432	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	37
PID 2320 wrote to memory of 2432	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	37
PID 2320 wrote to memory of 2432	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	37
PID 2320 wrote to memory of 2572	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	38
PID 2320 wrote to memory of 2572	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	38
PID 2320 wrote to memory of 2572	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	38
PID 2320 wrote to memory of 2468	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	39
PID 2320 wrote to memory of 2468	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	39
PID 2320 wrote to memory of 2468	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	39
PID 2320 wrote to memory of 2460	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	40
PID 2320 wrote to memory of 2460	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	40
PID 2320 wrote to memory of 2460	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	40
PID 2320 wrote to memory of 2684	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	41
PID 2320 wrote to memory of 2684	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	41
PID 2320 wrote to memory of 2684	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	41
PID 2320 wrote to memory of 2836	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	42
PID 2320 wrote to memory of 2836	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	42
PID 2320 wrote to memory of 2836	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	42
PID 2320 wrote to memory of 3056	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	43
PID 2320 wrote to memory of 3056	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	43
PID 2320 wrote to memory of 3056	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	43
PID 2320 wrote to memory of 1064	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	44
PID 2320 wrote to memory of 1064	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	44
PID 2320 wrote to memory of 1064	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	44
PID 2320 wrote to memory of 1968	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	45
PID 2320 wrote to memory of 1968	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	45
PID 2320 wrote to memory of 1968	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	45
PID 2320 wrote to memory of 1932	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	46
PID 2320 wrote to memory of 1932	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	46
PID 2320 wrote to memory of 1932	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	46
PID 2320 wrote to memory of 960	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	47
PID 2320 wrote to memory of 960	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	47
PID 2320 wrote to memory of 960	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	47
PID 2320 wrote to memory of 1508	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	48
PID 2320 wrote to memory of 1508	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	48
PID 2320 wrote to memory of 1508	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	48
PID 2320 wrote to memory of 952	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	49
PID 2320 wrote to memory of 952	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	49
PID 2320 wrote to memory of 952	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	49
PID 2320 wrote to memory of 2368	2320	0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c3b23d87b84c6c5eeffc35ce4285fea_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\System\nxFZcJk.exe
  C:\Windows\System\nxFZcJk.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\YeGtDsM.exe
  C:\Windows\System\YeGtDsM.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\TjwGcqm.exe
  C:\Windows\System\TjwGcqm.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\aIXtKUr.exe
  C:\Windows\System\aIXtKUr.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\pxNVAAA.exe
  C:\Windows\System\pxNVAAA.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\FMErQxM.exe
  C:\Windows\System\FMErQxM.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\IMcuPzm.exe
  C:\Windows\System\IMcuPzm.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\DQmzeHe.exe
  C:\Windows\System\DQmzeHe.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\qCehedv.exe
  C:\Windows\System\qCehedv.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\XVaETxZ.exe
  C:\Windows\System\XVaETxZ.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\dfSnshX.exe
  C:\Windows\System\dfSnshX.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\orTnBnT.exe
  C:\Windows\System\orTnBnT.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\WdUyfVt.exe
  C:\Windows\System\WdUyfVt.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\AytmBoJ.exe
  C:\Windows\System\AytmBoJ.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\MPNgLLx.exe
  C:\Windows\System\MPNgLLx.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\NTbBCJO.exe
  C:\Windows\System\NTbBCJO.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\UwKVrEc.exe
  C:\Windows\System\UwKVrEc.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\BIlQgDW.exe
  C:\Windows\System\BIlQgDW.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\vLnWTdy.exe
  C:\Windows\System\vLnWTdy.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\viQCzWh.exe
  C:\Windows\System\viQCzWh.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\KPTzCvv.exe
  C:\Windows\System\KPTzCvv.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\kdtiOol.exe
  C:\Windows\System\kdtiOol.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\EgtpDzf.exe
  C:\Windows\System\EgtpDzf.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\YgjUVTa.exe
  C:\Windows\System\YgjUVTa.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\BChPCrw.exe
  C:\Windows\System\BChPCrw.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\BepHECv.exe
  C:\Windows\System\BepHECv.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\ejXjiDc.exe
  C:\Windows\System\ejXjiDc.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\iYnyhFj.exe
  C:\Windows\System\iYnyhFj.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\DOnaTMY.exe
  C:\Windows\System\DOnaTMY.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\gNoGava.exe
  C:\Windows\System\gNoGava.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\noxtrqQ.exe
  C:\Windows\System\noxtrqQ.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\ASuHQex.exe
  C:\Windows\System\ASuHQex.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\mdkwwQo.exe
  C:\Windows\System\mdkwwQo.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\JnnKgeF.exe
  C:\Windows\System\JnnKgeF.exe
  2⤵
  PID:340
- C:\Windows\System\UqAjgOr.exe
  C:\Windows\System\UqAjgOr.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\wBddvkw.exe
  C:\Windows\System\wBddvkw.exe
  2⤵
  PID:1936
- C:\Windows\System\xWjxvDR.exe
  C:\Windows\System\xWjxvDR.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\jHufZCA.exe
  C:\Windows\System\jHufZCA.exe
  2⤵
  PID:1868
- C:\Windows\System\EmzRMiZ.exe
  C:\Windows\System\EmzRMiZ.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\vGCFeyZ.exe
  C:\Windows\System\vGCFeyZ.exe
  2⤵
  PID:768
- C:\Windows\System\BPjasNG.exe
  C:\Windows\System\BPjasNG.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\BqCowJL.exe
  C:\Windows\System\BqCowJL.exe
  2⤵
  PID:1720
- C:\Windows\System\rADBEMM.exe
  C:\Windows\System\rADBEMM.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\LRlQwcV.exe
  C:\Windows\System\LRlQwcV.exe
  2⤵
  PID:1552
- C:\Windows\System\UdPbelb.exe
  C:\Windows\System\UdPbelb.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\ZmCbiNB.exe
  C:\Windows\System\ZmCbiNB.exe
  2⤵
  PID:2028
- C:\Windows\System\zQYcbkw.exe
  C:\Windows\System\zQYcbkw.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\DDFWXcW.exe
  C:\Windows\System\DDFWXcW.exe
  2⤵
  PID:2708
- C:\Windows\System\ShAznBW.exe
  C:\Windows\System\ShAznBW.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\tijepJO.exe
  C:\Windows\System\tijepJO.exe
  2⤵
  PID:2928
- C:\Windows\System\UslYJuI.exe
  C:\Windows\System\UslYJuI.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\qmOiRsH.exe
  C:\Windows\System\qmOiRsH.exe
  2⤵
  PID:2924
- C:\Windows\System\jEEHaSq.exe
  C:\Windows\System\jEEHaSq.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\eGiNXay.exe
  C:\Windows\System\eGiNXay.exe
  2⤵
  PID:1584
- C:\Windows\System\ecCEiaV.exe
  C:\Windows\System\ecCEiaV.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\UzcylfV.exe
  C:\Windows\System\UzcylfV.exe
  2⤵
  PID:2184
- C:\Windows\System\hrdmfWJ.exe
  C:\Windows\System\hrdmfWJ.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\aXSFdFx.exe
  C:\Windows\System\aXSFdFx.exe
  2⤵
  PID:2772
- C:\Windows\System\cumwyxV.exe
  C:\Windows\System\cumwyxV.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\VCIRTFm.exe
  C:\Windows\System\VCIRTFm.exe
  2⤵
  PID:2520
- C:\Windows\System\AbEuhBd.exe
  C:\Windows\System\AbEuhBd.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\Xmurpdj.exe
  C:\Windows\System\Xmurpdj.exe
  2⤵
  PID:2680
- C:\Windows\System\NfPLHjx.exe
  C:\Windows\System\NfPLHjx.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\zKjDONn.exe
  C:\Windows\System\zKjDONn.exe
  2⤵
  PID:1924
- C:\Windows\System\QGVmZnE.exe
  C:\Windows\System\QGVmZnE.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\KKHAeCV.exe
  C:\Windows\System\KKHAeCV.exe
  2⤵
  PID:2152
- C:\Windows\System\BEfMycI.exe
  C:\Windows\System\BEfMycI.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\GeNYkqs.exe
  C:\Windows\System\GeNYkqs.exe
  2⤵
  PID:824
- C:\Windows\System\BkXKiXC.exe
  C:\Windows\System\BkXKiXC.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\JfupDmH.exe
  C:\Windows\System\JfupDmH.exe
  2⤵
  PID:1104
- C:\Windows\System\vXAOVmx.exe
  C:\Windows\System\vXAOVmx.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\uckKpUH.exe
  C:\Windows\System\uckKpUH.exe
  2⤵
  PID:2408
- C:\Windows\System\GFfjLsy.exe
  C:\Windows\System\GFfjLsy.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\knKGyQf.exe
  C:\Windows\System\knKGyQf.exe
  2⤵
  PID:1748
- C:\Windows\System\cWKkHjk.exe
  C:\Windows\System\cWKkHjk.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\hPIrJrR.exe
  C:\Windows\System\hPIrJrR.exe
  2⤵
  PID:2932
- C:\Windows\System\eomZFLx.exe
  C:\Windows\System\eomZFLx.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\bSLMTGP.exe
  C:\Windows\System\bSLMTGP.exe
  2⤵
  PID:2748
- C:\Windows\System\cbosiCB.exe
  C:\Windows\System\cbosiCB.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\DCLopls.exe
  C:\Windows\System\DCLopls.exe
  2⤵
  PID:2984
- C:\Windows\System\KOvhVep.exe
  C:\Windows\System\KOvhVep.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\YUfOFnI.exe
  C:\Windows\System\YUfOFnI.exe
  2⤵
  PID:2420
- C:\Windows\System\haJNBXk.exe
  C:\Windows\System\haJNBXk.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\arNXWLA.exe
  C:\Windows\System\arNXWLA.exe
  2⤵
  PID:2608
- C:\Windows\System\ewVlNXq.exe
  C:\Windows\System\ewVlNXq.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\ZNfIvBl.exe
  C:\Windows\System\ZNfIvBl.exe
  2⤵
  PID:3100
- C:\Windows\System\lKqyvqU.exe
  C:\Windows\System\lKqyvqU.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\pUJyKXE.exe
  C:\Windows\System\pUJyKXE.exe
  2⤵
  PID:3132
- C:\Windows\System\IzbyUvZ.exe
  C:\Windows\System\IzbyUvZ.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\QNLsmQf.exe
  C:\Windows\System\QNLsmQf.exe
  2⤵
  PID:3164
- C:\Windows\System\EeBnQBD.exe
  C:\Windows\System\EeBnQBD.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\RqFbPeq.exe
  C:\Windows\System\RqFbPeq.exe
  2⤵
  PID:3196
- C:\Windows\System\oxiibtF.exe
  C:\Windows\System\oxiibtF.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\dHPRntW.exe
  C:\Windows\System\dHPRntW.exe
  2⤵
  PID:3228
- C:\Windows\System\ARsoQQV.exe
  C:\Windows\System\ARsoQQV.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\rwKnEjQ.exe
  C:\Windows\System\rwKnEjQ.exe
  2⤵
  PID:3260
- C:\Windows\System\LSeyGkH.exe
  C:\Windows\System\LSeyGkH.exe
  2⤵
  PID:3276
- C:\Windows\System\vcLLdqW.exe
  C:\Windows\System\vcLLdqW.exe
  2⤵
  PID:3292
- C:\Windows\System\bxfbgyN.exe
  C:\Windows\System\bxfbgyN.exe
  2⤵
  PID:3308
- C:\Windows\System\ogqWHUA.exe
  C:\Windows\System\ogqWHUA.exe
  2⤵
  PID:3324
- C:\Windows\System\fkaHUuK.exe
  C:\Windows\System\fkaHUuK.exe
  2⤵
  PID:3340
- C:\Windows\System\PKyKmNz.exe
  C:\Windows\System\PKyKmNz.exe
  2⤵
  PID:3356
- C:\Windows\System\NcgoJoh.exe
  C:\Windows\System\NcgoJoh.exe
  2⤵
  PID:3372
- C:\Windows\System\YgzWnJv.exe
  C:\Windows\System\YgzWnJv.exe
  2⤵
  PID:3388
- C:\Windows\System\oZETzwX.exe
  C:\Windows\System\oZETzwX.exe
  2⤵
  PID:3404
- C:\Windows\System\EwjLbho.exe
  C:\Windows\System\EwjLbho.exe
  2⤵
  PID:3420
- C:\Windows\System\RdwGzyz.exe
  C:\Windows\System\RdwGzyz.exe
  2⤵
  PID:3436
- C:\Windows\System\WMWwWYk.exe
  C:\Windows\System\WMWwWYk.exe
  2⤵
  PID:3452
- C:\Windows\System\YBowaqc.exe
  C:\Windows\System\YBowaqc.exe
  2⤵
  PID:3468
- C:\Windows\System\ZIYhXCg.exe
  C:\Windows\System\ZIYhXCg.exe
  2⤵
  PID:3484
- C:\Windows\System\XIJNYkA.exe
  C:\Windows\System\XIJNYkA.exe
  2⤵
  PID:3500
- C:\Windows\System\piytNMv.exe
  C:\Windows\System\piytNMv.exe
  2⤵
  PID:3516
- C:\Windows\System\cweMylC.exe
  C:\Windows\System\cweMylC.exe
  2⤵
  PID:3532
- C:\Windows\System\VbMxkQA.exe
  C:\Windows\System\VbMxkQA.exe
  2⤵
  PID:3548
- C:\Windows\System\bsWcdfl.exe
  C:\Windows\System\bsWcdfl.exe
  2⤵
  PID:3564
- C:\Windows\System\tUZggqy.exe
  C:\Windows\System\tUZggqy.exe
  2⤵
  PID:3580
- C:\Windows\System\uJXGhbj.exe
  C:\Windows\System\uJXGhbj.exe
  2⤵
  PID:3596
- C:\Windows\System\fKObhsZ.exe
  C:\Windows\System\fKObhsZ.exe
  2⤵
  PID:3612
- C:\Windows\System\JAvnRZX.exe
  C:\Windows\System\JAvnRZX.exe
  2⤵
  PID:3628
- C:\Windows\System\icVmsRE.exe
  C:\Windows\System\icVmsRE.exe
  2⤵
  PID:3644
- C:\Windows\System\NDzPlKP.exe
  C:\Windows\System\NDzPlKP.exe
  2⤵
  PID:3660
- C:\Windows\System\wRmnDno.exe
  C:\Windows\System\wRmnDno.exe
  2⤵
  PID:3676
- C:\Windows\System\hxdoRDS.exe
  C:\Windows\System\hxdoRDS.exe
  2⤵
  PID:3692
- C:\Windows\System\aTudcaj.exe
  C:\Windows\System\aTudcaj.exe
  2⤵
  PID:3708
- C:\Windows\System\OTSJTUD.exe
  C:\Windows\System\OTSJTUD.exe
  2⤵
  PID:3724
- C:\Windows\System\BjFlcTr.exe
  C:\Windows\System\BjFlcTr.exe
  2⤵
  PID:3740
- C:\Windows\System\KcVbpbt.exe
  C:\Windows\System\KcVbpbt.exe
  2⤵
  PID:3756
- C:\Windows\System\pIbYtmg.exe
  C:\Windows\System\pIbYtmg.exe
  2⤵
  PID:3772
- C:\Windows\System\pfaVDkG.exe
  C:\Windows\System\pfaVDkG.exe
  2⤵
  PID:3788
- C:\Windows\System\UpfsRUG.exe
  C:\Windows\System\UpfsRUG.exe
  2⤵
  PID:3804
- C:\Windows\System\eUtzIGm.exe
  C:\Windows\System\eUtzIGm.exe
  2⤵
  PID:3824
- C:\Windows\System\WitqdRw.exe
  C:\Windows\System\WitqdRw.exe
  2⤵
  PID:3840
- C:\Windows\System\VeIMnml.exe
  C:\Windows\System\VeIMnml.exe
  2⤵
  PID:3856
- C:\Windows\System\RuRmFqB.exe
  C:\Windows\System\RuRmFqB.exe
  2⤵
  PID:3872
- C:\Windows\System\iUlUIUT.exe
  C:\Windows\System\iUlUIUT.exe
  2⤵
  PID:3888
- C:\Windows\System\IwcKwSO.exe
  C:\Windows\System\IwcKwSO.exe
  2⤵
  PID:3904
- C:\Windows\System\OidvYvM.exe
  C:\Windows\System\OidvYvM.exe
  2⤵
  PID:3920
- C:\Windows\System\CItdNvW.exe
  C:\Windows\System\CItdNvW.exe
  2⤵
  PID:3936
- C:\Windows\System\NvFxbGZ.exe
  C:\Windows\System\NvFxbGZ.exe
  2⤵
  PID:3952
- C:\Windows\System\xMeSvnV.exe
  C:\Windows\System\xMeSvnV.exe
  2⤵
  PID:3968
- C:\Windows\System\GyrwLOG.exe
  C:\Windows\System\GyrwLOG.exe
  2⤵
  PID:3984
- C:\Windows\System\Vvdxfuj.exe
  C:\Windows\System\Vvdxfuj.exe
  2⤵
  PID:4004
- C:\Windows\System\ksXafLQ.exe
  C:\Windows\System\ksXafLQ.exe
  2⤵
  PID:4020
- C:\Windows\System\QZeAnOX.exe
  C:\Windows\System\QZeAnOX.exe
  2⤵
  PID:4036
- C:\Windows\System\UxDEBkc.exe
  C:\Windows\System\UxDEBkc.exe
  2⤵
  PID:4052
- C:\Windows\System\wbLfioT.exe
  C:\Windows\System\wbLfioT.exe
  2⤵
  PID:4068
- C:\Windows\System\AohPHWB.exe
  C:\Windows\System\AohPHWB.exe
  2⤵
  PID:4084
- C:\Windows\System\xKSuGiW.exe
  C:\Windows\System\xKSuGiW.exe
  2⤵
  PID:1632
- C:\Windows\System\bhKgzsd.exe
  C:\Windows\System\bhKgzsd.exe
  2⤵
  PID:3096
- C:\Windows\System\KuuDpdX.exe
  C:\Windows\System\KuuDpdX.exe
  2⤵
  PID:3156
- C:\Windows\System\iZgQBAD.exe
  C:\Windows\System\iZgQBAD.exe
  2⤵
  PID:3224
- C:\Windows\System\UjtHnMI.exe
  C:\Windows\System\UjtHnMI.exe
  2⤵
  PID:3288
- C:\Windows\System\imiOsnU.exe
  C:\Windows\System\imiOsnU.exe
  2⤵
  PID:2176
- C:\Windows\System\oSYhkzg.exe
  C:\Windows\System\oSYhkzg.exe
  2⤵
  PID:3384
- C:\Windows\System\IwZTrzu.exe
  C:\Windows\System\IwZTrzu.exe
  2⤵
  PID:3444
- C:\Windows\System\QSvODmQ.exe
  C:\Windows\System\QSvODmQ.exe
  2⤵
  PID:3508
- C:\Windows\System\uzrPLSb.exe
  C:\Windows\System\uzrPLSb.exe
  2⤵
  PID:3544
- C:\Windows\System\dDmOpur.exe
  C:\Windows\System\dDmOpur.exe
  2⤵
  PID:3608
- C:\Windows\System\BAsRCZo.exe
  C:\Windows\System\BAsRCZo.exe
  2⤵
  PID:3668
- C:\Windows\System\YtkYbdX.exe
  C:\Windows\System\YtkYbdX.exe
  2⤵
  PID:2300
- C:\Windows\System\DZRytXd.exe
  C:\Windows\System\DZRytXd.exe
  2⤵
  PID:1928
- C:\Windows\System\ixvNKwT.exe
  C:\Windows\System\ixvNKwT.exe
  2⤵
  PID:3800
- C:\Windows\System\EiEkEUU.exe
  C:\Windows\System\EiEkEUU.exe
  2⤵
  PID:1424
- C:\Windows\System\YUDVgUn.exe
  C:\Windows\System\YUDVgUn.exe
  2⤵
  PID:1656
- C:\Windows\System\XRBZGvb.exe
  C:\Windows\System\XRBZGvb.exe
  2⤵
  PID:1612
- C:\Windows\System\DDDjsWQ.exe
  C:\Windows\System\DDDjsWQ.exe
  2⤵
  PID:812
- C:\Windows\System\tLReTlo.exe
  C:\Windows\System\tLReTlo.exe
  2⤵
  PID:560
- C:\Windows\System\SAuMQOq.exe
  C:\Windows\System\SAuMQOq.exe
  2⤵
  PID:4108
- C:\Windows\System\qEGOrvm.exe
  C:\Windows\System\qEGOrvm.exe
  2⤵
  PID:4124
- C:\Windows\System\VwIVlFp.exe
  C:\Windows\System\VwIVlFp.exe
  2⤵
  PID:4140
- C:\Windows\System\BSYPWaf.exe
  C:\Windows\System\BSYPWaf.exe
  2⤵
  PID:4156
- C:\Windows\System\YAAuSXx.exe
  C:\Windows\System\YAAuSXx.exe
  2⤵
  PID:4172
- C:\Windows\System\dVgpRAh.exe
  C:\Windows\System\dVgpRAh.exe
  2⤵
  PID:4188
- C:\Windows\System\tEykxiy.exe
  C:\Windows\System\tEykxiy.exe
  2⤵
  PID:4204
- C:\Windows\System\LijzOzJ.exe
  C:\Windows\System\LijzOzJ.exe
  2⤵
  PID:4220
- C:\Windows\System\EfyxvCM.exe
  C:\Windows\System\EfyxvCM.exe
  2⤵
  PID:4236
- C:\Windows\System\CIdjeLw.exe
  C:\Windows\System\CIdjeLw.exe
  2⤵
  PID:4252
- C:\Windows\System\ecgBrED.exe
  C:\Windows\System\ecgBrED.exe
  2⤵
  PID:4268
- C:\Windows\System\DYOZUQr.exe
  C:\Windows\System\DYOZUQr.exe
  2⤵
  PID:4284
- C:\Windows\System\wTZtFEk.exe
  C:\Windows\System\wTZtFEk.exe
  2⤵
  PID:4300
- C:\Windows\System\CNVgPoQ.exe
  C:\Windows\System\CNVgPoQ.exe
  2⤵
  PID:4504
- C:\Windows\System\rMDwUaP.exe
  C:\Windows\System\rMDwUaP.exe
  2⤵
  PID:4520
- C:\Windows\System\vKuVSrI.exe
  C:\Windows\System\vKuVSrI.exe
  2⤵
  PID:4536
- C:\Windows\System\CRFRrgE.exe
  C:\Windows\System\CRFRrgE.exe
  2⤵
  PID:4552
- C:\Windows\System\JkCnsWX.exe
  C:\Windows\System\JkCnsWX.exe
  2⤵
  PID:4568
- C:\Windows\System\UKMMoOf.exe
  C:\Windows\System\UKMMoOf.exe
  2⤵
  PID:4584
- C:\Windows\System\HqCQGeI.exe
  C:\Windows\System\HqCQGeI.exe
  2⤵
  PID:4600
- C:\Windows\System\PiBXrFu.exe
  C:\Windows\System\PiBXrFu.exe
  2⤵
  PID:4616
- C:\Windows\System\hPmAtkd.exe
  C:\Windows\System\hPmAtkd.exe
  2⤵
  PID:4632
- C:\Windows\System\DFVhNQG.exe
  C:\Windows\System\DFVhNQG.exe
  2⤵
  PID:4648
- C:\Windows\System\fHfeEGj.exe
  C:\Windows\System\fHfeEGj.exe
  2⤵
  PID:4664
- C:\Windows\System\pwXJkBa.exe
  C:\Windows\System\pwXJkBa.exe
  2⤵
  PID:4680
- C:\Windows\System\FLvBPRD.exe
  C:\Windows\System\FLvBPRD.exe
  2⤵
  PID:4696
- C:\Windows\System\pYaHUIs.exe
  C:\Windows\System\pYaHUIs.exe
  2⤵
  PID:4712
- C:\Windows\System\TrGKZad.exe
  C:\Windows\System\TrGKZad.exe
  2⤵
  PID:4728
- C:\Windows\System\KqxGfOC.exe
  C:\Windows\System\KqxGfOC.exe
  2⤵
  PID:4744
- C:\Windows\System\APQWcnQ.exe
  C:\Windows\System\APQWcnQ.exe
  2⤵
  PID:4760
- C:\Windows\System\gfwQvRO.exe
  C:\Windows\System\gfwQvRO.exe
  2⤵
  PID:4776
- C:\Windows\System\gOyByoD.exe
  C:\Windows\System\gOyByoD.exe
  2⤵
  PID:4792
- C:\Windows\System\PyyJDCl.exe
  C:\Windows\System\PyyJDCl.exe
  2⤵
  PID:4808
- C:\Windows\System\SzPZoqE.exe
  C:\Windows\System\SzPZoqE.exe
  2⤵
  PID:4824
- C:\Windows\System\SoHTTQp.exe
  C:\Windows\System\SoHTTQp.exe
  2⤵
  PID:4840
- C:\Windows\System\oUWatGz.exe
  C:\Windows\System\oUWatGz.exe
  2⤵
  PID:4856
- C:\Windows\System\GbwTalL.exe
  C:\Windows\System\GbwTalL.exe
  2⤵
  PID:4872
- C:\Windows\System\JDKPpWU.exe
  C:\Windows\System\JDKPpWU.exe
  2⤵
  PID:4888
- C:\Windows\System\LFILQOJ.exe
  C:\Windows\System\LFILQOJ.exe
  2⤵
  PID:4904
- C:\Windows\System\gSTWSjt.exe
  C:\Windows\System\gSTWSjt.exe
  2⤵
  PID:4920
- C:\Windows\System\aKTghQH.exe
  C:\Windows\System\aKTghQH.exe
  2⤵
  PID:4936
- C:\Windows\System\tRlUusu.exe
  C:\Windows\System\tRlUusu.exe
  2⤵
  PID:4952
- C:\Windows\System\CFzhjCy.exe
  C:\Windows\System\CFzhjCy.exe
  2⤵
  PID:4968
- C:\Windows\System\NtUKxao.exe
  C:\Windows\System\NtUKxao.exe
  2⤵
  PID:4984
- C:\Windows\System\ECsrjFP.exe
  C:\Windows\System\ECsrjFP.exe
  2⤵
  PID:5000
- C:\Windows\System\CBdbdDk.exe
  C:\Windows\System\CBdbdDk.exe
  2⤵
  PID:5016
- C:\Windows\System\HwZdGDN.exe
  C:\Windows\System\HwZdGDN.exe
  2⤵
  PID:5032
- C:\Windows\System\ylXlRaF.exe
  C:\Windows\System\ylXlRaF.exe
  2⤵
  PID:5048
- C:\Windows\System\YhRRQCU.exe
  C:\Windows\System\YhRRQCU.exe
  2⤵
  PID:5064
- C:\Windows\System\PuBpuaW.exe
  C:\Windows\System\PuBpuaW.exe
  2⤵
  PID:5080
- C:\Windows\System\ejjvBDt.exe
  C:\Windows\System\ejjvBDt.exe
  2⤵
  PID:5096
- C:\Windows\System\lFgDAOP.exe
  C:\Windows\System\lFgDAOP.exe
  2⤵
  PID:5112
- C:\Windows\System\KnbQAZI.exe
  C:\Windows\System\KnbQAZI.exe
  2⤵
  PID:1204
- C:\Windows\System\mELkutF.exe
  C:\Windows\System\mELkutF.exe
  2⤵
  PID:2816
- C:\Windows\System\ILWGorr.exe
  C:\Windows\System\ILWGorr.exe
  2⤵
  PID:2232
- C:\Windows\System\FDclPpy.exe
  C:\Windows\System\FDclPpy.exe
  2⤵
  PID:1248
- C:\Windows\System\GhBFlIH.exe
  C:\Windows\System\GhBFlIH.exe
  2⤵
  PID:2972
- C:\Windows\System\slEcCpR.exe
  C:\Windows\System\slEcCpR.exe
  2⤵
  PID:2200
- C:\Windows\System\UltPeCW.exe
  C:\Windows\System\UltPeCW.exe
  2⤵
  PID:1640
- C:\Windows\System\TfwVsKX.exe
  C:\Windows\System\TfwVsKX.exe
  2⤵
  PID:2440
- C:\Windows\System\jNBpTyU.exe
  C:\Windows\System\jNBpTyU.exe
  2⤵
  PID:1500
- C:\Windows\System\oGhbjUN.exe
  C:\Windows\System\oGhbjUN.exe
  2⤵
  PID:2384
- C:\Windows\System\mYwHrPI.exe
  C:\Windows\System\mYwHrPI.exe
  2⤵
  PID:2040
- C:\Windows\System\hUKNTBZ.exe
  C:\Windows\System\hUKNTBZ.exe
  2⤵
  PID:1544
- C:\Windows\System\GAUORZR.exe
  C:\Windows\System\GAUORZR.exe
  2⤵
  PID:3108
- C:\Windows\System\LosAewb.exe
  C:\Windows\System\LosAewb.exe
  2⤵
  PID:3172
- C:\Windows\System\oYDbvie.exe
  C:\Windows\System\oYDbvie.exe
  2⤵
  PID:3236
- C:\Windows\System\nyKllqP.exe
  C:\Windows\System\nyKllqP.exe
  2⤵
  PID:3332
- C:\Windows\System\WNylodp.exe
  C:\Windows\System\WNylodp.exe
  2⤵
  PID:3396
- C:\Windows\System\BwrqVSb.exe
  C:\Windows\System\BwrqVSb.exe
  2⤵
  PID:3556
- C:\Windows\System\VohGpdN.exe
  C:\Windows\System\VohGpdN.exe
  2⤵
  PID:2092
- C:\Windows\System\KktQJVu.exe
  C:\Windows\System\KktQJVu.exe
  2⤵
  PID:3864
- C:\Windows\System\xMMRRAG.exe
  C:\Windows\System\xMMRRAG.exe
  2⤵
  PID:3928
- C:\Windows\System\TlNNMFV.exe
  C:\Windows\System\TlNNMFV.exe
  2⤵
  PID:3992
- C:\Windows\System\cLjQRIS.exe
  C:\Windows\System\cLjQRIS.exe
  2⤵
  PID:4032
- C:\Windows\System\xSNicTq.exe
  C:\Windows\System\xSNicTq.exe
  2⤵
  PID:1112
- C:\Windows\System\erZjDcg.exe
  C:\Windows\System\erZjDcg.exe
  2⤵
  PID:3284
- C:\Windows\System\IgSvBTi.exe
  C:\Windows\System\IgSvBTi.exe
  2⤵
  PID:3480
- C:\Windows\System\gGJzpuI.exe
  C:\Windows\System\gGJzpuI.exe
  2⤵
  PID:1488
- C:\Windows\System\hMsZZoj.exe
  C:\Windows\System\hMsZZoj.exe
  2⤵
  PID:2848
- C:\Windows\System\HgoJBsE.exe
  C:\Windows\System\HgoJBsE.exe
  2⤵
  PID:4100
- C:\Windows\System\kHiVUEv.exe
  C:\Windows\System\kHiVUEv.exe
  2⤵
  PID:4164
- C:\Windows\System\RWdFJTr.exe
  C:\Windows\System\RWdFJTr.exe
  2⤵
  PID:4228
- C:\Windows\System\XbGVoSa.exe
  C:\Windows\System\XbGVoSa.exe
  2⤵
  PID:4296
- C:\Windows\System\DZxUvMj.exe
  C:\Windows\System\DZxUvMj.exe
  2⤵
  PID:4576
- C:\Windows\System\iVFrmxA.exe
  C:\Windows\System\iVFrmxA.exe
  2⤵
  PID:4800
- C:\Windows\System\YIuUnEA.exe
  C:\Windows\System\YIuUnEA.exe
  2⤵
  PID:3748
- C:\Windows\System\vztaJbc.exe
  C:\Windows\System\vztaJbc.exe
  2⤵
  PID:3812
- C:\Windows\System\aMtyLQo.exe
  C:\Windows\System\aMtyLQo.exe
  2⤵
  PID:656
- C:\Windows\System\urZoNof.exe
  C:\Windows\System\urZoNof.exe
  2⤵
  PID:3848
- C:\Windows\System\bpHnGpf.exe
  C:\Windows\System\bpHnGpf.exe
  2⤵
  PID:3916
- C:\Windows\System\HeVZvHt.exe
  C:\Windows\System\HeVZvHt.exe
  2⤵
  PID:4836
- C:\Windows\System\BsJUjeS.exe
  C:\Windows\System\BsJUjeS.exe
  2⤵
  PID:4896
- C:\Windows\System\UXKclWx.exe
  C:\Windows\System\UXKclWx.exe
  2⤵
  PID:4044
- C:\Windows\System\ANzQYDJ.exe
  C:\Windows\System\ANzQYDJ.exe
  2⤵
  PID:1088
- C:\Windows\System\ehIPIgS.exe
  C:\Windows\System\ehIPIgS.exe
  2⤵
  PID:2700
- C:\Windows\System\ozExxKA.exe
  C:\Windows\System\ozExxKA.exe
  2⤵
  PID:4964
- C:\Windows\System\xCFKJzT.exe
  C:\Windows\System\xCFKJzT.exe
  2⤵
  PID:4992
- C:\Windows\System\jTXmdGF.exe
  C:\Windows\System\jTXmdGF.exe
  2⤵
  PID:5056
- C:\Windows\System\ULdLgnK.exe
  C:\Windows\System\ULdLgnK.exe
  2⤵
  PID:3188
- C:\Windows\System\COjCiGd.exe
  C:\Windows\System\COjCiGd.exe
  2⤵
  PID:3320
- C:\Windows\System\FvPWOoy.exe
  C:\Windows\System\FvPWOoy.exe
  2⤵
  PID:2996
- C:\Windows\System\gpbcHlG.exe
  C:\Windows\System\gpbcHlG.exe
  2⤵
  PID:1960
- C:\Windows\System\TFsAKzV.exe
  C:\Windows\System\TFsAKzV.exe
  2⤵
  PID:2516
- C:\Windows\System\hDPwnLT.exe
  C:\Windows\System\hDPwnLT.exe
  2⤵
  PID:2356
- C:\Windows\System\qbXupvS.exe
  C:\Windows\System\qbXupvS.exe
  2⤵
  PID:1780
- C:\Windows\System\pKwrvBd.exe
  C:\Windows\System\pKwrvBd.exe
  2⤵
  PID:1772
- C:\Windows\System\khqGmnC.exe
  C:\Windows\System\khqGmnC.exe
  2⤵
  PID:3204
- C:\Windows\System\GTzrOri.exe
  C:\Windows\System\GTzrOri.exe
  2⤵
  PID:3432
- C:\Windows\System\HwrGDWp.exe
  C:\Windows\System\HwrGDWp.exe
  2⤵
  PID:3884
- C:\Windows\System\vHxlkxA.exe
  C:\Windows\System\vHxlkxA.exe
  2⤵
  PID:4048
- C:\Windows\System\GeCxmHt.exe
  C:\Windows\System\GeCxmHt.exe
  2⤵
  PID:3348
- C:\Windows\System\vaXvcYt.exe
  C:\Windows\System\vaXvcYt.exe
  2⤵
  PID:2668
- C:\Windows\System\gnFOKgy.exe
  C:\Windows\System\gnFOKgy.exe
  2⤵
  PID:3496
- C:\Windows\System\KvBgKoT.exe
  C:\Windows\System\KvBgKoT.exe
  2⤵
  PID:2424
- C:\Windows\System\fNBcqfz.exe
  C:\Windows\System\fNBcqfz.exe
  2⤵
  PID:3588
- C:\Windows\System\IsbXfHj.exe
  C:\Windows\System\IsbXfHj.exe
  2⤵
  PID:4120
- C:\Windows\System\gkVShhQ.exe
  C:\Windows\System\gkVShhQ.exe
  2⤵
  PID:4184
- C:\Windows\System\EJLLeiG.exe
  C:\Windows\System\EJLLeiG.exe
  2⤵
  PID:4248
- C:\Windows\System\tQRmEkX.exe
  C:\Windows\System\tQRmEkX.exe
  2⤵
  PID:4312
- C:\Windows\System\KRQKwhc.exe
  C:\Windows\System\KRQKwhc.exe
  2⤵
  PID:4328
- C:\Windows\System\nhdcUiE.exe
  C:\Windows\System\nhdcUiE.exe
  2⤵
  PID:4356
- C:\Windows\System\uYZoKOk.exe
  C:\Windows\System\uYZoKOk.exe
  2⤵
  PID:4428
- C:\Windows\System\fnGKPJb.exe
  C:\Windows\System\fnGKPJb.exe
  2⤵
  PID:4412
- C:\Windows\System\rzsgfgY.exe
  C:\Windows\System\rzsgfgY.exe
  2⤵
  PID:4396
- C:\Windows\System\DRlNrvL.exe
  C:\Windows\System\DRlNrvL.exe
  2⤵
  PID:4380
- C:\Windows\System\dzmYtKO.exe
  C:\Windows\System\dzmYtKO.exe
  2⤵
  PID:4364
- C:\Windows\System\dhpvNRJ.exe
  C:\Windows\System\dhpvNRJ.exe
  2⤵
  PID:4432
- C:\Windows\System\QbBnBMt.exe
  C:\Windows\System\QbBnBMt.exe
  2⤵
  PID:4456
- C:\Windows\System\AxjfKpb.exe
  C:\Windows\System\AxjfKpb.exe
  2⤵
  PID:4472
- C:\Windows\System\MKsClEp.exe
  C:\Windows\System\MKsClEp.exe
  2⤵
  PID:4488
- C:\Windows\System\qCLinAk.exe
  C:\Windows\System\qCLinAk.exe
  2⤵
  PID:4560
- C:\Windows\System\gvCLACH.exe
  C:\Windows\System\gvCLACH.exe
  2⤵
  PID:4596
- C:\Windows\System\etoIHTV.exe
  C:\Windows\System\etoIHTV.exe
  2⤵
  PID:4688
- C:\Windows\System\MCFWXUc.exe
  C:\Windows\System\MCFWXUc.exe
  2⤵
  PID:4752
- C:\Windows\System\ZsQAeuF.exe
  C:\Windows\System\ZsQAeuF.exe
  2⤵
  PID:4788
- C:\Windows\System\TNKdKUp.exe
  C:\Windows\System\TNKdKUp.exe
  2⤵
  PID:4880
- C:\Windows\System\QbdocGN.exe
  C:\Windows\System\QbdocGN.exe
  2⤵
  PID:4944
- C:\Windows\System\VuAUzqi.exe
  C:\Windows\System\VuAUzqi.exe
  2⤵
  PID:5008
- C:\Windows\System\VwaYfeV.exe
  C:\Windows\System\VwaYfeV.exe
  2⤵
  PID:5072
- C:\Windows\System\ApKjLoK.exe
  C:\Windows\System\ApKjLoK.exe
  2⤵
  PID:856
- C:\Windows\System\bbdWjPN.exe
  C:\Windows\System\bbdWjPN.exe
  2⤵
  PID:888
- C:\Windows\System\MqTgExP.exe
  C:\Windows\System\MqTgExP.exe
  2⤵
  PID:1800
- C:\Windows\System\vEwThJR.exe
  C:\Windows\System\vEwThJR.exe
  2⤵
  PID:3080
- C:\Windows\System\ezFpXSd.exe
  C:\Windows\System\ezFpXSd.exe
  2⤵
  PID:2280
- C:\Windows\System\DuiBriA.exe
  C:\Windows\System\DuiBriA.exe
  2⤵
  PID:2620
- C:\Windows\System\rpAjGxz.exe
  C:\Windows\System\rpAjGxz.exe
  2⤵
  PID:3836
- C:\Windows\System\trVdNnd.exe
  C:\Windows\System\trVdNnd.exe
  2⤵
  PID:3964
- C:\Windows\System\jhhitqb.exe
  C:\Windows\System\jhhitqb.exe
  2⤵
  PID:2336
- C:\Windows\System\AjbHTQz.exe
  C:\Windows\System\AjbHTQz.exe
  2⤵
  PID:3700
- C:\Windows\System\WgTEDzc.exe
  C:\Windows\System\WgTEDzc.exe
  2⤵
  PID:1824
- C:\Windows\System\PQBdMoU.exe
  C:\Windows\System\PQBdMoU.exe
  2⤵
  PID:3768
- C:\Windows\System\pjqztNb.exe
  C:\Windows\System\pjqztNb.exe
  2⤵
  PID:4512
- C:\Windows\System\hwrlsDN.exe
  C:\Windows\System\hwrlsDN.exe
  2⤵
  PID:4260
- C:\Windows\System\OqjDgHi.exe
  C:\Windows\System\OqjDgHi.exe
  2⤵
  PID:2560
- C:\Windows\System\oPjhXVW.exe
  C:\Windows\System\oPjhXVW.exe
  2⤵
  PID:300
- C:\Windows\System\gTCscZq.exe
  C:\Windows\System\gTCscZq.exe
  2⤵
  PID:2196
- C:\Windows\System\SerSddZ.exe
  C:\Windows\System\SerSddZ.exe
  2⤵
  PID:4708
- C:\Windows\System\KUoDigz.exe
  C:\Windows\System\KUoDigz.exe
  2⤵
  PID:3820
- C:\Windows\System\HRHwtTr.exe
  C:\Windows\System\HRHwtTr.exe
  2⤵
  PID:3880
- C:\Windows\System\aEPVPUU.exe
  C:\Windows\System\aEPVPUU.exe
  2⤵
  PID:4868
- C:\Windows\System\gypAYTw.exe
  C:\Windows\System\gypAYTw.exe
  2⤵
  PID:3092
- C:\Windows\System\ulWUbpV.exe
  C:\Windows\System\ulWUbpV.exe
  2⤵
  PID:872
- C:\Windows\System\CagtKGh.exe
  C:\Windows\System\CagtKGh.exe
  2⤵
  PID:2484
- C:\Windows\System\tvCXJfZ.exe
  C:\Windows\System\tvCXJfZ.exe
  2⤵
  PID:320
- C:\Windows\System\nyQCOyw.exe
  C:\Windows\System\nyQCOyw.exe
  2⤵
  PID:5088
- C:\Windows\System\lZffUyC.exe
  C:\Windows\System\lZffUyC.exe
  2⤵
  PID:2556
- C:\Windows\System\VpOkAxj.exe
  C:\Windows\System\VpOkAxj.exe
  2⤵
  PID:4644
- C:\Windows\System\LGNksjk.exe
  C:\Windows\System\LGNksjk.exe
  2⤵
  PID:1492
- C:\Windows\System\DdBzmCN.exe
  C:\Windows\System\DdBzmCN.exe
  2⤵
  PID:1692
- C:\Windows\System\irJxmeq.exe
  C:\Windows\System\irJxmeq.exe
  2⤵
  PID:1920
- C:\Windows\System\EArNmhi.exe
  C:\Windows\System\EArNmhi.exe
  2⤵
  PID:4932
- C:\Windows\System\sRCAztc.exe
  C:\Windows\System\sRCAztc.exe
  2⤵
  PID:1760
- C:\Windows\System\NyXxUXG.exe
  C:\Windows\System\NyXxUXG.exe
  2⤵
  PID:3068
- C:\Windows\System\inmPrSv.exe
  C:\Windows\System\inmPrSv.exe
  2⤵
  PID:2088
- C:\Windows\System\JEWeteM.exe
  C:\Windows\System\JEWeteM.exe
  2⤵
  PID:2552
- C:\Windows\System\SrTUQlK.exe
  C:\Windows\System\SrTUQlK.exe
  2⤵
  PID:3980
- C:\Windows\System\BxpVXxV.exe
  C:\Windows\System\BxpVXxV.exe
  2⤵
  PID:2372
- C:\Windows\System\QeKOOWe.exe
  C:\Windows\System\QeKOOWe.exe
  2⤵
  PID:2392
- C:\Windows\System\gNhweBx.exe
  C:\Windows\System\gNhweBx.exe
  2⤵
  PID:4344
- C:\Windows\System\WbPRsIo.exe
  C:\Windows\System\WbPRsIo.exe
  2⤵
  PID:4244
- C:\Windows\System\fLfTjSg.exe
  C:\Windows\System\fLfTjSg.exe
  2⤵
  PID:2124
- C:\Windows\System\TnULJBI.exe
  C:\Windows\System\TnULJBI.exe
  2⤵
  PID:4452
- C:\Windows\System\RFjKcrm.exe
  C:\Windows\System\RFjKcrm.exe
  2⤵
  PID:4180
- C:\Windows\System\kTOzyeR.exe
  C:\Windows\System\kTOzyeR.exe
  2⤵
  PID:1576
- C:\Windows\System\HnZOUHu.exe
  C:\Windows\System\HnZOUHu.exe
  2⤵
  PID:3192
- C:\Windows\System\HWcGOSU.exe
  C:\Windows\System\HWcGOSU.exe
  2⤵
  PID:4440
- C:\Windows\System\NSjUxqM.exe
  C:\Windows\System\NSjUxqM.exe
  2⤵
  PID:4308
- C:\Windows\System\JnIBFtr.exe
  C:\Windows\System\JnIBFtr.exe
  2⤵
  PID:4436
- C:\Windows\System\kgXvAXG.exe
  C:\Windows\System\kgXvAXG.exe
  2⤵
  PID:4528
- C:\Windows\System\IOpUwhD.exe
  C:\Windows\System\IOpUwhD.exe
  2⤵
  PID:4724
- C:\Windows\System\ILkaMgI.exe
  C:\Windows\System\ILkaMgI.exe
  2⤵
  PID:4852
- C:\Windows\System\DxsRpQa.exe
  C:\Windows\System\DxsRpQa.exe
  2⤵
  PID:5108
- C:\Windows\System\lzndnxC.exe
  C:\Windows\System\lzndnxC.exe
  2⤵
  PID:3304
- C:\Windows\System\WUttaMT.exe
  C:\Windows\System\WUttaMT.exe
  2⤵
  PID:2416
- C:\Windows\System\mwnwVLe.exe
  C:\Windows\System\mwnwVLe.exe
  2⤵
  PID:4028
- C:\Windows\System\tehglaN.exe
  C:\Windows\System\tehglaN.exe
  2⤵
  PID:2672
- C:\Windows\System\IKEJiEg.exe
  C:\Windows\System\IKEJiEg.exe
  2⤵
  PID:5040
- C:\Windows\System\rZWwCJV.exe
  C:\Windows\System\rZWwCJV.exe
  2⤵
  PID:3140
- C:\Windows\System\cpoZNCT.exe
  C:\Windows\System\cpoZNCT.exe
  2⤵
  PID:2508
- C:\Windows\System\rwlBDFU.exe
  C:\Windows\System\rwlBDFU.exe
  2⤵
  PID:4196
- C:\Windows\System\QiOKCir.exe
  C:\Windows\System\QiOKCir.exe
  2⤵
  PID:4292
- C:\Windows\System\PkIMpRX.exe
  C:\Windows\System\PkIMpRX.exe
  2⤵
  PID:5028
- C:\Windows\System\KxBZNTx.exe
  C:\Windows\System\KxBZNTx.exe
  2⤵
  PID:4132
- C:\Windows\System\OToeZak.exe
  C:\Windows\System\OToeZak.exe
  2⤵
  PID:1696
- C:\Windows\System\ownpsgg.exe
  C:\Windows\System\ownpsgg.exe
  2⤵
  PID:4580
- C:\Windows\System\zbqXswJ.exe
  C:\Windows\System\zbqXswJ.exe
  2⤵
  PID:4640
- C:\Windows\System\UFcgGIF.exe
  C:\Windows\System\UFcgGIF.exe
  2⤵
  PID:4080
- C:\Windows\System\fttNFgr.exe
  C:\Windows\System\fttNFgr.exe
  2⤵
  PID:2808
- C:\Windows\System\KTDvHHp.exe
  C:\Windows\System\KTDvHHp.exe
  2⤵
  PID:892
- C:\Windows\System\oIGNKIA.exe
  C:\Windows\System\oIGNKIA.exe
  2⤵
  PID:4740
- C:\Windows\System\YiiWqdt.exe
  C:\Windows\System\YiiWqdt.exe
  2⤵
  PID:2780
- C:\Windows\System\KneTZjS.exe
  C:\Windows\System\KneTZjS.exe
  2⤵
  PID:2656
- C:\Windows\System\coomHXT.exe
  C:\Windows\System\coomHXT.exe
  2⤵
  PID:3540
- C:\Windows\System\KeoHJhv.exe
  C:\Windows\System\KeoHJhv.exe
  2⤵
  PID:1600
- C:\Windows\System\KSBSEcn.exe
  C:\Windows\System\KSBSEcn.exe
  2⤵
  PID:4372
- C:\Windows\System\aFRkfvm.exe
  C:\Windows\System\aFRkfvm.exe
  2⤵
  PID:3364
- C:\Windows\System\xzPtxRS.exe
  C:\Windows\System\xzPtxRS.exe
  2⤵
  PID:4216
- C:\Windows\System\EBxLVeC.exe
  C:\Windows\System\EBxLVeC.exe
  2⤵
  PID:4492
- C:\Windows\System\qoHAgcP.exe
  C:\Windows\System\qoHAgcP.exe
  2⤵
  PID:2404
- C:\Windows\System\TrISjEQ.exe
  C:\Windows\System\TrISjEQ.exe
  2⤵
  PID:4468
- C:\Windows\System\FkOQNZz.exe
  C:\Windows\System\FkOQNZz.exe
  2⤵
  PID:4848
- C:\Windows\System\tsVTmdr.exe
  C:\Windows\System\tsVTmdr.exe
  2⤵
  PID:4912
- C:\Windows\System\oyGrHyT.exe
  C:\Windows\System\oyGrHyT.exe
  2⤵
  PID:3960
- C:\Windows\System\mLKZxLZ.exe
  C:\Windows\System\mLKZxLZ.exe
  2⤵
  PID:4416
- C:\Windows\System\nLVlIPU.exe
  C:\Windows\System\nLVlIPU.exe
  2⤵
  PID:4980
- C:\Windows\System\XqMXQtH.exe
  C:\Windows\System\XqMXQtH.exe
  2⤵
  PID:108
- C:\Windows\System\ecZKrBR.exe
  C:\Windows\System\ecZKrBR.exe
  2⤵
  PID:4200
- C:\Windows\System\lxPOhCb.exe
  C:\Windows\System\lxPOhCb.exe
  2⤵
  PID:4544
- C:\Windows\System\OxnhLiQ.exe
  C:\Windows\System\OxnhLiQ.exe
  2⤵
  PID:4704
- C:\Windows\System\KTowKPN.exe
  C:\Windows\System\KTowKPN.exe
  2⤵
  PID:2944
- C:\Windows\System\sXQiwfw.exe
  C:\Windows\System\sXQiwfw.exe
  2⤵
  PID:1152
- C:\Windows\System\ixKxswS.exe
  C:\Windows\System\ixKxswS.exe
  2⤵
  PID:2072
- C:\Windows\System\bNByoLn.exe
  C:\Windows\System\bNByoLn.exe
  2⤵
  PID:2060
- C:\Windows\System\tyYTanP.exe
  C:\Windows\System\tyYTanP.exe
  2⤵
  PID:4324
- C:\Windows\System\ePKsrJm.exe
  C:\Windows\System\ePKsrJm.exe
  2⤵
  PID:1688
- C:\Windows\System\NoCYdJN.exe
  C:\Windows\System\NoCYdJN.exe
  2⤵
  PID:2100
- C:\Windows\System\IjqcNgz.exe
  C:\Windows\System\IjqcNgz.exe
  2⤵
  PID:4660
- C:\Windows\System\mRLPUeU.exe
  C:\Windows\System\mRLPUeU.exe
  2⤵
  PID:1516
- C:\Windows\System\QjShJZW.exe
  C:\Windows\System\QjShJZW.exe
  2⤵
  PID:1976
- C:\Windows\System\gqimLSE.exe
  C:\Windows\System\gqimLSE.exe
  2⤵
  PID:852
- C:\Windows\System\ygKbyiL.exe
  C:\Windows\System\ygKbyiL.exe
  2⤵
  PID:4736
- C:\Windows\System\DQJQWRZ.exe
  C:\Windows\System\DQJQWRZ.exe
  2⤵
  PID:4592
- C:\Windows\System\OYolHAn.exe
  C:\Windows\System\OYolHAn.exe
  2⤵
  PID:5128
- C:\Windows\System\DzFgytV.exe
  C:\Windows\System\DzFgytV.exe
  2⤵
  PID:5144
- C:\Windows\System\npiwtEd.exe
  C:\Windows\System\npiwtEd.exe
  2⤵
  PID:5160
- C:\Windows\System\dHSENjo.exe
  C:\Windows\System\dHSENjo.exe
  2⤵
  PID:5176
- C:\Windows\System\wIhkdsr.exe
  C:\Windows\System\wIhkdsr.exe
  2⤵
  PID:5192
- C:\Windows\System\DVrBAlP.exe
  C:\Windows\System\DVrBAlP.exe
  2⤵
  PID:5208
- C:\Windows\System\GabOeGW.exe
  C:\Windows\System\GabOeGW.exe
  2⤵
  PID:5224
- C:\Windows\System\hzGMZQQ.exe
  C:\Windows\System\hzGMZQQ.exe
  2⤵
  PID:5240
- C:\Windows\System\EJXFnoh.exe
  C:\Windows\System\EJXFnoh.exe
  2⤵
  PID:5256
- C:\Windows\System\gHkVlBo.exe
  C:\Windows\System\gHkVlBo.exe
  2⤵
  PID:5272
- C:\Windows\System\miwRrMW.exe
  C:\Windows\System\miwRrMW.exe
  2⤵
  PID:5288
- C:\Windows\System\yjwdkvP.exe
  C:\Windows\System\yjwdkvP.exe
  2⤵
  PID:5304
- C:\Windows\System\rbfwVNp.exe
  C:\Windows\System\rbfwVNp.exe
  2⤵
  PID:5320
- C:\Windows\System\rCafwuL.exe
  C:\Windows\System\rCafwuL.exe
  2⤵
  PID:5336
- C:\Windows\System\NHLFeAr.exe
  C:\Windows\System\NHLFeAr.exe
  2⤵
  PID:5352
- C:\Windows\System\OpLMXRb.exe
  C:\Windows\System\OpLMXRb.exe
  2⤵
  PID:5368
- C:\Windows\System\BldVWXk.exe
  C:\Windows\System\BldVWXk.exe
  2⤵
  PID:5384
- C:\Windows\System\XmGSAtw.exe
  C:\Windows\System\XmGSAtw.exe
  2⤵
  PID:5400
- C:\Windows\System\ACCeAqH.exe
  C:\Windows\System\ACCeAqH.exe
  2⤵
  PID:5416
- C:\Windows\System\ZhXovSB.exe
  C:\Windows\System\ZhXovSB.exe
  2⤵
  PID:5432
- C:\Windows\System\GrZQFdL.exe
  C:\Windows\System\GrZQFdL.exe
  2⤵
  PID:5448
- C:\Windows\System\diIGMKo.exe
  C:\Windows\System\diIGMKo.exe
  2⤵
  PID:5464
- C:\Windows\System\ECwKpBk.exe
  C:\Windows\System\ECwKpBk.exe
  2⤵
  PID:5480
- C:\Windows\System\qJGQadI.exe
  C:\Windows\System\qJGQadI.exe
  2⤵
  PID:5496
- C:\Windows\System\NVsuzJW.exe
  C:\Windows\System\NVsuzJW.exe
  2⤵
  PID:5516
- C:\Windows\System\PPirIcX.exe
  C:\Windows\System\PPirIcX.exe
  2⤵
  PID:5532
- C:\Windows\System\rhPRBuU.exe
  C:\Windows\System\rhPRBuU.exe
  2⤵
  PID:5548
- C:\Windows\System\uNNsKaJ.exe
  C:\Windows\System\uNNsKaJ.exe
  2⤵
  PID:5564
- C:\Windows\System\hrpSmLA.exe
  C:\Windows\System\hrpSmLA.exe
  2⤵
  PID:5580
- C:\Windows\System\taThukd.exe
  C:\Windows\System\taThukd.exe
  2⤵
  PID:5596
- C:\Windows\System\cYAskSM.exe
  C:\Windows\System\cYAskSM.exe
  2⤵
  PID:5612
- C:\Windows\System\CKunqjy.exe
  C:\Windows\System\CKunqjy.exe
  2⤵
  PID:5628
- C:\Windows\System\dUCeOwG.exe
  C:\Windows\System\dUCeOwG.exe
  2⤵
  PID:5644
- C:\Windows\System\NNEiWXU.exe
  C:\Windows\System\NNEiWXU.exe
  2⤵
  PID:5660
- C:\Windows\System\BPryDUE.exe
  C:\Windows\System\BPryDUE.exe
  2⤵
  PID:5676
- C:\Windows\System\PUzHRGA.exe
  C:\Windows\System\PUzHRGA.exe
  2⤵
  PID:5692
- C:\Windows\System\ZyJBmfc.exe
  C:\Windows\System\ZyJBmfc.exe
  2⤵
  PID:5708
- C:\Windows\System\UqvdofO.exe
  C:\Windows\System\UqvdofO.exe
  2⤵
  PID:5724
- C:\Windows\System\EOCOvyq.exe
  C:\Windows\System\EOCOvyq.exe
  2⤵
  PID:5740
- C:\Windows\System\HorziDm.exe
  C:\Windows\System\HorziDm.exe
  2⤵
  PID:5756
- C:\Windows\System\uoWHoBE.exe
  C:\Windows\System\uoWHoBE.exe
  2⤵
  PID:5772
- C:\Windows\System\lcnawyk.exe
  C:\Windows\System\lcnawyk.exe
  2⤵
  PID:5788
- C:\Windows\System\KKIetDx.exe
  C:\Windows\System\KKIetDx.exe
  2⤵
  PID:5804
- C:\Windows\System\nGqKHca.exe
  C:\Windows\System\nGqKHca.exe
  2⤵
  PID:5820
- C:\Windows\System\xsGQDHu.exe
  C:\Windows\System\xsGQDHu.exe
  2⤵
  PID:5836
- C:\Windows\System\HiHZCvG.exe
  C:\Windows\System\HiHZCvG.exe
  2⤵
  PID:5852
- C:\Windows\System\FpZsaJT.exe
  C:\Windows\System\FpZsaJT.exe
  2⤵
  PID:5868
- C:\Windows\System\KfIOYWA.exe
  C:\Windows\System\KfIOYWA.exe
  2⤵
  PID:5884
- C:\Windows\System\vtMYlCq.exe
  C:\Windows\System\vtMYlCq.exe
  2⤵
  PID:5900
- C:\Windows\System\voDXeNk.exe
  C:\Windows\System\voDXeNk.exe
  2⤵
  PID:5916
- C:\Windows\System\HHdxOLf.exe
  C:\Windows\System\HHdxOLf.exe
  2⤵
  PID:5932
- C:\Windows\System\ytisuUy.exe
  C:\Windows\System\ytisuUy.exe
  2⤵
  PID:5948
- C:\Windows\System\ySuHpcw.exe
  C:\Windows\System\ySuHpcw.exe
  2⤵
  PID:5964
- C:\Windows\System\afqNBrg.exe
  C:\Windows\System\afqNBrg.exe
  2⤵
  PID:5980
- C:\Windows\System\jignAAX.exe
  C:\Windows\System\jignAAX.exe
  2⤵
  PID:5996
- C:\Windows\System\tduhFCY.exe
  C:\Windows\System\tduhFCY.exe
  2⤵
  PID:6012
- C:\Windows\System\qYrgLdf.exe
  C:\Windows\System\qYrgLdf.exe
  2⤵
  PID:6028
- C:\Windows\System\mcnKBYE.exe
  C:\Windows\System\mcnKBYE.exe
  2⤵
  PID:6044
- C:\Windows\System\yLsPaza.exe
  C:\Windows\System\yLsPaza.exe
  2⤵
  PID:6060
- C:\Windows\System\xrcNvWY.exe
  C:\Windows\System\xrcNvWY.exe
  2⤵
  PID:6076
- C:\Windows\System\HQLvQPW.exe
  C:\Windows\System\HQLvQPW.exe
  2⤵
  PID:6092
- C:\Windows\System\HtcRKwC.exe
  C:\Windows\System\HtcRKwC.exe
  2⤵
  PID:6108
- C:\Windows\System\WwsyCdT.exe
  C:\Windows\System\WwsyCdT.exe
  2⤵
  PID:6124
- C:\Windows\System\IVTyOeF.exe
  C:\Windows\System\IVTyOeF.exe
  2⤵
  PID:6140
- C:\Windows\System\BBtqjTt.exe
  C:\Windows\System\BBtqjTt.exe
  2⤵
  PID:5156
- C:\Windows\System\EhvqWcL.exe
  C:\Windows\System\EhvqWcL.exe
  2⤵
  PID:5220
- C:\Windows\System\qikuLTm.exe
  C:\Windows\System\qikuLTm.exe
  2⤵
  PID:5284
- C:\Windows\System\fwNcTcH.exe
  C:\Windows\System\fwNcTcH.exe
  2⤵
  PID:5344
- C:\Windows\System\TIMgvBA.exe
  C:\Windows\System\TIMgvBA.exe
  2⤵
  PID:5376
- C:\Windows\System\wmySRpt.exe
  C:\Windows\System\wmySRpt.exe
  2⤵
  PID:5412
- C:\Windows\System\hKJAJNN.exe
  C:\Windows\System\hKJAJNN.exe
  2⤵
  PID:5440
- C:\Windows\System\BYzzETZ.exe
  C:\Windows\System\BYzzETZ.exe
  2⤵
  PID:4152
- C:\Windows\System\VaFXNXL.exe
  C:\Windows\System\VaFXNXL.exe
  2⤵
  PID:5136
- C:\Windows\System\aRsCzoE.exe
  C:\Windows\System\aRsCzoE.exe
  2⤵
  PID:5200
- C:\Windows\System\SLPfLyf.exe
  C:\Windows\System\SLPfLyf.exe
  2⤵
  PID:4784
- C:\Windows\System\YhQhKoR.exe
  C:\Windows\System\YhQhKoR.exe
  2⤵
  PID:5236
- C:\Windows\System\ykbMcSF.exe
  C:\Windows\System\ykbMcSF.exe
  2⤵
  PID:5300
- C:\Windows\System\mDaKvcs.exe
  C:\Windows\System\mDaKvcs.exe
  2⤵
  PID:1572
- C:\Windows\System\FXcDzGj.exe
  C:\Windows\System\FXcDzGj.exe
  2⤵
  PID:4496
- C:\Windows\System\nxVqgyT.exe
  C:\Windows\System\nxVqgyT.exe
  2⤵
  PID:3976
- C:\Windows\System\dumrTpb.exe
  C:\Windows\System\dumrTpb.exe
  2⤵
  PID:5364
- C:\Windows\System\vcbiQnT.exe
  C:\Windows\System\vcbiQnT.exe
  2⤵
  PID:5460
- C:\Windows\System\qKToCJU.exe
  C:\Windows\System\qKToCJU.exe
  2⤵
  PID:5508
- C:\Windows\System\TDNDKdb.exe
  C:\Windows\System\TDNDKdb.exe
  2⤵
  PID:5488
- C:\Windows\System\cemuvAm.exe
  C:\Windows\System\cemuvAm.exe
  2⤵
  PID:5560
- C:\Windows\System\ZQBmIRJ.exe
  C:\Windows\System\ZQBmIRJ.exe
  2⤵
  PID:5640
- C:\Windows\System\kQaEOQb.exe
  C:\Windows\System\kQaEOQb.exe
  2⤵
  PID:5620
- C:\Windows\System\rpndbuG.exe
  C:\Windows\System\rpndbuG.exe
  2⤵
  PID:5668
- C:\Windows\System\JcRgJAP.exe
  C:\Windows\System\JcRgJAP.exe
  2⤵
  PID:5688
- C:\Windows\System\MUpyFpC.exe
  C:\Windows\System\MUpyFpC.exe
  2⤵
  PID:5672
- C:\Windows\System\LpiQduc.exe
  C:\Windows\System\LpiQduc.exe
  2⤵
  PID:5752
- C:\Windows\System\FsFLeSA.exe
  C:\Windows\System\FsFLeSA.exe
  2⤵
  PID:5844
- C:\Windows\System\uGqffMm.exe
  C:\Windows\System\uGqffMm.exe
  2⤵
  PID:5908
- C:\Windows\System\NCRJXhc.exe
  C:\Windows\System\NCRJXhc.exe
  2⤵
  PID:5972
- C:\Windows\System\qneaPJF.exe
  C:\Windows\System\qneaPJF.exe
  2⤵
  PID:6036
- C:\Windows\System\ZatdNhw.exe
  C:\Windows\System\ZatdNhw.exe
  2⤵
  PID:5864
- C:\Windows\System\neBHmNa.exe
  C:\Windows\System\neBHmNa.exe
  2⤵
  PID:5796
- C:\Windows\System\bRaOFGg.exe
  C:\Windows\System\bRaOFGg.exe
  2⤵
  PID:5892
- C:\Windows\System\xGEZOZJ.exe
  C:\Windows\System\xGEZOZJ.exe
  2⤵
  PID:6084
- C:\Windows\System\TwdWark.exe
  C:\Windows\System\TwdWark.exe
  2⤵
  PID:6024
- C:\Windows\System\QOSylmP.exe
  C:\Windows\System\QOSylmP.exe
  2⤵
  PID:6116
- C:\Windows\System\LDsXpLD.exe
  C:\Windows\System\LDsXpLD.exe
  2⤵
  PID:5252
- C:\Windows\System\CHbRbqU.exe
  C:\Windows\System\CHbRbqU.exe
  2⤵
  PID:6040
- C:\Windows\System\PayHDMf.exe
  C:\Windows\System\PayHDMf.exe
  2⤵
  PID:6072
- C:\Windows\System\UrQDoiP.exe
  C:\Windows\System\UrQDoiP.exe
  2⤵
  PID:5168
- C:\Windows\System\aaKJKCb.exe
  C:\Windows\System\aaKJKCb.exe
  2⤵
  PID:4404
- C:\Windows\System\xuJoYdQ.exe
  C:\Windows\System\xuJoYdQ.exe
  2⤵
  PID:6136
- C:\Windows\System\BotHifA.exe
  C:\Windows\System\BotHifA.exe
  2⤵
  PID:5232
- C:\Windows\System\FTfLcnf.exe
  C:\Windows\System\FTfLcnf.exe
  2⤵
  PID:5572
- C:\Windows\System\vEPBDgc.exe
  C:\Windows\System\vEPBDgc.exe
  2⤵
  PID:4916
- C:\Windows\System\bAmtNTM.exe
  C:\Windows\System\bAmtNTM.exe
  2⤵
  PID:6148
- C:\Windows\System\WqLtZhP.exe
  C:\Windows\System\WqLtZhP.exe
  2⤵
  PID:6164
- C:\Windows\System\mtiaCEP.exe
  C:\Windows\System\mtiaCEP.exe
  2⤵
  PID:6180
- C:\Windows\System\SwlTVjI.exe
  C:\Windows\System\SwlTVjI.exe
  2⤵
  PID:6196
- C:\Windows\System\OnlIaFw.exe
  C:\Windows\System\OnlIaFw.exe
  2⤵
  PID:6212
- C:\Windows\System\yxYZXLK.exe
  C:\Windows\System\yxYZXLK.exe
  2⤵
  PID:6228
- C:\Windows\System\LNuBAke.exe
  C:\Windows\System\LNuBAke.exe
  2⤵
  PID:6244
- C:\Windows\System\sQYRZGb.exe
  C:\Windows\System\sQYRZGb.exe
  2⤵
  PID:6260
- C:\Windows\System\KMRSVEm.exe
  C:\Windows\System\KMRSVEm.exe
  2⤵
  PID:6276
- C:\Windows\System\vCunrej.exe
  C:\Windows\System\vCunrej.exe
  2⤵
  PID:6292
- C:\Windows\System\PRUbWXF.exe
  C:\Windows\System\PRUbWXF.exe
  2⤵
  PID:6308
- C:\Windows\System\DCMyDfO.exe
  C:\Windows\System\DCMyDfO.exe
  2⤵
  PID:6324
- C:\Windows\System\ZOtXWnU.exe
  C:\Windows\System\ZOtXWnU.exe
  2⤵
  PID:6340
- C:\Windows\System\HXrqDMW.exe
  C:\Windows\System\HXrqDMW.exe
  2⤵
  PID:6356
- C:\Windows\System\ptpOTNl.exe
  C:\Windows\System\ptpOTNl.exe
  2⤵
  PID:6372
- C:\Windows\System\PmBnJne.exe
  C:\Windows\System\PmBnJne.exe
  2⤵
  PID:6388
- C:\Windows\System\hBmwEcq.exe
  C:\Windows\System\hBmwEcq.exe
  2⤵
  PID:6404
- C:\Windows\System\ONfYxEO.exe
  C:\Windows\System\ONfYxEO.exe
  2⤵
  PID:6420
- C:\Windows\System\WGFPTNp.exe
  C:\Windows\System\WGFPTNp.exe
  2⤵
  PID:6436
- C:\Windows\System\QztGUvx.exe
  C:\Windows\System\QztGUvx.exe
  2⤵
  PID:6452
- C:\Windows\System\mbdMRrf.exe
  C:\Windows\System\mbdMRrf.exe
  2⤵
  PID:6468
- C:\Windows\System\lSASDgg.exe
  C:\Windows\System\lSASDgg.exe
  2⤵
  PID:6484
- C:\Windows\System\hlkSLZL.exe
  C:\Windows\System\hlkSLZL.exe
  2⤵
  PID:6500
- C:\Windows\System\SxcEuJg.exe
  C:\Windows\System\SxcEuJg.exe
  2⤵
  PID:6516
- C:\Windows\System\fskdiGj.exe
  C:\Windows\System\fskdiGj.exe
  2⤵
  PID:6532
- C:\Windows\System\ajmZXPe.exe
  C:\Windows\System\ajmZXPe.exe
  2⤵
  PID:6548
- C:\Windows\System\AXaIDzW.exe
  C:\Windows\System\AXaIDzW.exe
  2⤵
  PID:6564
- C:\Windows\System\PXKuibq.exe
  C:\Windows\System\PXKuibq.exe
  2⤵
  PID:6580
- C:\Windows\System\bbFymlA.exe
  C:\Windows\System\bbFymlA.exe
  2⤵
  PID:6596
- C:\Windows\System\NEQfigK.exe
  C:\Windows\System\NEQfigK.exe
  2⤵
  PID:6612
- C:\Windows\System\wmkeceI.exe
  C:\Windows\System\wmkeceI.exe
  2⤵
  PID:6628
- C:\Windows\System\qONcJAL.exe
  C:\Windows\System\qONcJAL.exe
  2⤵
  PID:6644
- C:\Windows\System\hJFjloO.exe
  C:\Windows\System\hJFjloO.exe
  2⤵
  PID:6660
- C:\Windows\System\qkFaAZY.exe
  C:\Windows\System\qkFaAZY.exe
  2⤵
  PID:6676
- C:\Windows\System\qxulkjS.exe
  C:\Windows\System\qxulkjS.exe
  2⤵
  PID:6692
- C:\Windows\System\zXNVahs.exe
  C:\Windows\System\zXNVahs.exe
  2⤵
  PID:6708
- C:\Windows\System\uIaGvCg.exe
  C:\Windows\System\uIaGvCg.exe
  2⤵
  PID:6724
- C:\Windows\System\JBbjeQp.exe
  C:\Windows\System\JBbjeQp.exe
  2⤵
  PID:6740
- C:\Windows\System\VrnZXZY.exe
  C:\Windows\System\VrnZXZY.exe
  2⤵
  PID:6756
- C:\Windows\System\VEUzEVC.exe
  C:\Windows\System\VEUzEVC.exe
  2⤵
  PID:6772
- C:\Windows\System\fCBUIxq.exe
  C:\Windows\System\fCBUIxq.exe
  2⤵
  PID:6788
- C:\Windows\System\GtftXhZ.exe
  C:\Windows\System\GtftXhZ.exe
  2⤵
  PID:6804
- C:\Windows\System\ffICzNN.exe
  C:\Windows\System\ffICzNN.exe
  2⤵
  PID:6820
- C:\Windows\System\QKMHclv.exe
  C:\Windows\System\QKMHclv.exe
  2⤵
  PID:6836
- C:\Windows\System\hskDtGi.exe
  C:\Windows\System\hskDtGi.exe
  2⤵
  PID:6852
- C:\Windows\System\HwytnyC.exe
  C:\Windows\System\HwytnyC.exe
  2⤵
  PID:6868
- C:\Windows\System\KeclJhO.exe
  C:\Windows\System\KeclJhO.exe
  2⤵
  PID:6884
- C:\Windows\System\KNgaYHL.exe
  C:\Windows\System\KNgaYHL.exe
  2⤵
  PID:6900
- C:\Windows\System\grljEPK.exe
  C:\Windows\System\grljEPK.exe
  2⤵
  PID:6916
- C:\Windows\System\eOPvoXj.exe
  C:\Windows\System\eOPvoXj.exe
  2⤵
  PID:6932
- C:\Windows\System\DquYeno.exe
  C:\Windows\System\DquYeno.exe
  2⤵
  PID:6948
- C:\Windows\System\eOxxNkn.exe
  C:\Windows\System\eOxxNkn.exe
  2⤵
  PID:6964
- C:\Windows\System\pMAJmgL.exe
  C:\Windows\System\pMAJmgL.exe
  2⤵
  PID:6980
- C:\Windows\System\mIpboWn.exe
  C:\Windows\System\mIpboWn.exe
  2⤵
  PID:6996
- C:\Windows\System\Swsxura.exe
  C:\Windows\System\Swsxura.exe
  2⤵
  PID:7012
- C:\Windows\System\VWDYygM.exe
  C:\Windows\System\VWDYygM.exe
  2⤵
  PID:7028
- C:\Windows\System\MNUzFdZ.exe
  C:\Windows\System\MNUzFdZ.exe
  2⤵
  PID:7044
- C:\Windows\System\hfFwXrJ.exe
  C:\Windows\System\hfFwXrJ.exe
  2⤵
  PID:7060
- C:\Windows\System\gJEDbUa.exe
  C:\Windows\System\gJEDbUa.exe
  2⤵
  PID:7076
- C:\Windows\System\IBJZGqF.exe
  C:\Windows\System\IBJZGqF.exe
  2⤵
  PID:7092
- C:\Windows\System\RmkvnFT.exe
  C:\Windows\System\RmkvnFT.exe
  2⤵
  PID:7108
- C:\Windows\System\GEHuvBw.exe
  C:\Windows\System\GEHuvBw.exe
  2⤵
  PID:7124
- C:\Windows\System\VwMYDTH.exe
  C:\Windows\System\VwMYDTH.exe
  2⤵
  PID:7140
- C:\Windows\System\XNxWLnb.exe
  C:\Windows\System\XNxWLnb.exe
  2⤵
  PID:7156
- C:\Windows\System\UcgAHAc.exe
  C:\Windows\System\UcgAHAc.exe
  2⤵
  PID:4608
- C:\Windows\System\jpUEtYW.exe
  C:\Windows\System\jpUEtYW.exe
  2⤵
  PID:5576
- C:\Windows\System\SsbQiPQ.exe
  C:\Windows\System\SsbQiPQ.exe
  2⤵
  PID:5704
- C:\Windows\System\kRboeoi.exe
  C:\Windows\System\kRboeoi.exe
  2⤵
  PID:6004
- C:\Windows\System\uzwkJcV.exe
  C:\Windows\System\uzwkJcV.exe
  2⤵
  PID:5928
- C:\Windows\System\VGaNeNk.exe
  C:\Windows\System\VGaNeNk.exe
  2⤵
  PID:5280
- C:\Windows\System\xWuacPT.exe
  C:\Windows\System\xWuacPT.exe
  2⤵
  PID:5188
- C:\Windows\System\kkpSwTG.exe
  C:\Windows\System\kkpSwTG.exe
  2⤵
  PID:5360
- C:\Windows\System\KfGjdzr.exe
  C:\Windows\System\KfGjdzr.exe
  2⤵
  PID:5296
- C:\Windows\System\zPFCifl.exe
  C:\Windows\System\zPFCifl.exe
  2⤵
  PID:5328
- C:\Windows\System\ihHLOqT.exe
  C:\Windows\System\ihHLOqT.exe
  2⤵
  PID:5784
- C:\Windows\System\TMCgGpC.exe
  C:\Windows\System\TMCgGpC.exe
  2⤵
  PID:6300
- C:\Windows\System\mdMCios.exe
  C:\Windows\System\mdMCios.exe
  2⤵
  PID:5172
- C:\Windows\System\REuUdNj.exe
  C:\Windows\System\REuUdNj.exe
  2⤵
  PID:6272
- C:\Windows\System\XEPYldz.exe
  C:\Windows\System\XEPYldz.exe
  2⤵
  PID:5720
- C:\Windows\System\ZjEFrUh.exe
  C:\Windows\System\ZjEFrUh.exe
  2⤵
  PID:6396
- C:\Windows\System\dgBXkxo.exe
  C:\Windows\System\dgBXkxo.exe
  2⤵
  PID:6460
- C:\Windows\System\yhyaoiz.exe
  C:\Windows\System\yhyaoiz.exe
  2⤵
  PID:5944
- C:\Windows\System\hGfAmTp.exe
  C:\Windows\System\hGfAmTp.exe
  2⤵
  PID:6160
- C:\Windows\System\cygsDNt.exe
  C:\Windows\System\cygsDNt.exe
  2⤵
  PID:2220
- C:\Windows\System\zfhhyBu.exe
  C:\Windows\System\zfhhyBu.exe
  2⤵
  PID:5124
- C:\Windows\System\aSgadfU.exe
  C:\Windows\System\aSgadfU.exe
  2⤵
  PID:5860
- C:\Windows\System\fPkSNcM.exe
  C:\Windows\System\fPkSNcM.exe
  2⤵
  PID:5828
- C:\Windows\System\noZFCDg.exe
  C:\Windows\System\noZFCDg.exe
  2⤵
  PID:6252
- C:\Windows\System\tWToBLP.exe
  C:\Windows\System\tWToBLP.exe
  2⤵
  PID:6528
- C:\Windows\System\derLRUQ.exe
  C:\Windows\System\derLRUQ.exe
  2⤵
  PID:6352
- C:\Windows\System\UCmOcct.exe
  C:\Windows\System\UCmOcct.exe
  2⤵
  PID:6592
- C:\Windows\System\IbsDuEM.exe
  C:\Windows\System\IbsDuEM.exe
  2⤵
  PID:6380
- C:\Windows\System\mLWYBtl.exe
  C:\Windows\System\mLWYBtl.exe
  2⤵
  PID:6656
- C:\Windows\System\aUOHwIO.exe
  C:\Windows\System\aUOHwIO.exe
  2⤵
  PID:6476
- C:\Windows\System\idOHCxp.exe
  C:\Windows\System\idOHCxp.exe
  2⤵
  PID:6748
- C:\Windows\System\fxLqIte.exe
  C:\Windows\System\fxLqIte.exe
  2⤵
  PID:6784
- C:\Windows\System\MwHRtoz.exe
  C:\Windows\System\MwHRtoz.exe
  2⤵
  PID:6572
- C:\Windows\System\OSQtcFh.exe
  C:\Windows\System\OSQtcFh.exe
  2⤵
  PID:6844
- C:\Windows\System\WQgbwOS.exe
  C:\Windows\System\WQgbwOS.exe
  2⤵
  PID:6540
- C:\Windows\System\LWrZqpY.exe
  C:\Windows\System\LWrZqpY.exe
  2⤵
  PID:6908
- C:\Windows\System\TlFswIC.exe
  C:\Windows\System\TlFswIC.exe
  2⤵
  PID:6608
- C:\Windows\System\CluaEuE.exe
  C:\Windows\System\CluaEuE.exe
  2⤵
  PID:6940
- C:\Windows\System\mElzASI.exe
  C:\Windows\System\mElzASI.exe
  2⤵
  PID:6976
- C:\Windows\System\ckfvDXU.exe
  C:\Windows\System\ckfvDXU.exe
  2⤵
  PID:7004
- C:\Windows\System\quEWsOy.exe
  C:\Windows\System\quEWsOy.exe
  2⤵
  PID:6796
- C:\Windows\System\CnBFbEc.exe
  C:\Windows\System\CnBFbEc.exe
  2⤵
  PID:6736
- C:\Windows\System\rUvsYaX.exe
  C:\Windows\System\rUvsYaX.exe
  2⤵
  PID:6828
- C:\Windows\System\YNseoxL.exe
  C:\Windows\System\YNseoxL.exe
  2⤵
  PID:6928
- C:\Windows\System\MSwfpwH.exe
  C:\Windows\System\MSwfpwH.exe
  2⤵
  PID:7132
- C:\Windows\System\BWLoCNy.exe
  C:\Windows\System\BWLoCNy.exe
  2⤵
  PID:5332
- C:\Windows\System\xraKapt.exe
  C:\Windows\System\xraKapt.exe
  2⤵
  PID:7020
- C:\Windows\System\ZIvigGP.exe
  C:\Windows\System\ZIvigGP.exe
  2⤵
  PID:7084
- C:\Windows\System\lgotXNA.exe
  C:\Windows\System\lgotXNA.exe
  2⤵
  PID:5652
- C:\Windows\System\tJsFbaq.exe
  C:\Windows\System\tJsFbaq.exe
  2⤵
  PID:5216
- C:\Windows\System\FqaNVNq.exe
  C:\Windows\System\FqaNVNq.exe
  2⤵
  PID:7120
- C:\Windows\System\rMUfvtU.exe
  C:\Windows\System\rMUfvtU.exe
  2⤵
  PID:6236
- C:\Windows\System\sSDlIke.exe
  C:\Windows\System\sSDlIke.exe
  2⤵
  PID:5504
- C:\Windows\System\ymNKcFk.exe
  C:\Windows\System\ymNKcFk.exe
  2⤵
  PID:5988
- C:\Windows\System\QbuGhwL.exe
  C:\Windows\System\QbuGhwL.exe
  2⤵
  PID:6176
- C:\Windows\System\QdhSefy.exe
  C:\Windows\System\QdhSefy.exe
  2⤵
  PID:5592
- C:\Windows\System\OwFXBYE.exe
  C:\Windows\System\OwFXBYE.exe
  2⤵
  PID:448
- C:\Windows\System\drWsDfz.exe
  C:\Windows\System\drWsDfz.exe
  2⤵
  PID:5408
- C:\Windows\System\hObnuIB.exe
  C:\Windows\System\hObnuIB.exe
  2⤵
  PID:6492
- C:\Windows\System\VyJQLlC.exe
  C:\Windows\System\VyJQLlC.exe
  2⤵
  PID:5544
- C:\Windows\System\Xlaqeyj.exe
  C:\Windows\System\Xlaqeyj.exe
  2⤵
  PID:6284
- C:\Windows\System\LMbrBtr.exe
  C:\Windows\System\LMbrBtr.exe
  2⤵
  PID:6412
- C:\Windows\System\lRpjUVm.exe
  C:\Windows\System\lRpjUVm.exe
  2⤵
  PID:1096
- C:\Windows\System\WlCyfGC.exe
  C:\Windows\System\WlCyfGC.exe
  2⤵
  PID:6700
- C:\Windows\System\RVXliEH.exe
  C:\Windows\System\RVXliEH.exe
  2⤵
  PID:6848
- C:\Windows\System\qXUrplR.exe
  C:\Windows\System\qXUrplR.exe
  2⤵
  PID:6716
- C:\Windows\System\IazCKLr.exe
  C:\Windows\System\IazCKLr.exe
  2⤵
  PID:6876
- C:\Windows\System\CLdExAP.exe
  C:\Windows\System\CLdExAP.exe
  2⤵
  PID:6972
- C:\Windows\System\AuxYwcn.exe
  C:\Windows\System\AuxYwcn.exe
  2⤵
  PID:6896
- C:\Windows\System\wgumHrh.exe
  C:\Windows\System\wgumHrh.exe
  2⤵
  PID:6732
- C:\Windows\System\FUOxaCD.exe
  C:\Windows\System\FUOxaCD.exe
  2⤵
  PID:7036
- C:\Windows\System\RIxzItC.exe
  C:\Windows\System\RIxzItC.exe
  2⤵
  PID:7100
- C:\Windows\System\UDwWJFv.exe
  C:\Windows\System\UDwWJFv.exe
  2⤵
  PID:6988
- C:\Windows\System\IbzUvlp.exe
  C:\Windows\System\IbzUvlp.exe
  2⤵
  PID:2720
- C:\Windows\System\HEsPNKF.exe
  C:\Windows\System\HEsPNKF.exe
  2⤵
  PID:5424
- C:\Windows\System\TEkgjtF.exe
  C:\Windows\System\TEkgjtF.exe
  2⤵
  PID:5816
- C:\Windows\System\kHJKVyU.exe
  C:\Windows\System\kHJKVyU.exe
  2⤵
  PID:6480
- C:\Windows\System\DapFZij.exe
  C:\Windows\System\DapFZij.exe
  2⤵
  PID:6444
- C:\Windows\System\NouAQUz.exe
  C:\Windows\System\NouAQUz.exe
  2⤵
  PID:2292
- C:\Windows\System\lzpsJGi.exe
  C:\Windows\System\lzpsJGi.exe
  2⤵
  PID:6960
- C:\Windows\System\AchdJag.exe
  C:\Windows\System\AchdJag.exe
  2⤵
  PID:5476
- C:\Windows\System\oAAcOCh.exe
  C:\Windows\System\oAAcOCh.exe
  2⤵
  PID:5956
- C:\Windows\System\mZcpaeB.exe
  C:\Windows\System\mZcpaeB.exe
  2⤵
  PID:7180
- C:\Windows\System\EbExMGo.exe
  C:\Windows\System\EbExMGo.exe
  2⤵
  PID:7196
- C:\Windows\System\TVjbSLZ.exe
  C:\Windows\System\TVjbSLZ.exe
  2⤵
  PID:7212
- C:\Windows\System\wCAAMpT.exe
  C:\Windows\System\wCAAMpT.exe
  2⤵
  PID:7228
- C:\Windows\System\hGARJGF.exe
  C:\Windows\System\hGARJGF.exe
  2⤵
  PID:7244
- C:\Windows\System\EiMLCqQ.exe
  C:\Windows\System\EiMLCqQ.exe
  2⤵
  PID:7260
- C:\Windows\System\zqTsJzC.exe
  C:\Windows\System\zqTsJzC.exe
  2⤵
  PID:7276
- C:\Windows\System\OvgyWKv.exe
  C:\Windows\System\OvgyWKv.exe
  2⤵
  PID:7292
- C:\Windows\System\SRYQtCl.exe
  C:\Windows\System\SRYQtCl.exe
  2⤵
  PID:7308
- C:\Windows\System\ZcGLNlP.exe
  C:\Windows\System\ZcGLNlP.exe
  2⤵
  PID:7324
- C:\Windows\System\DRdDPTD.exe
  C:\Windows\System\DRdDPTD.exe
  2⤵
  PID:7340
- C:\Windows\System\LxvJvSU.exe
  C:\Windows\System\LxvJvSU.exe
  2⤵
  PID:7356
- C:\Windows\System\TpQhhDZ.exe
  C:\Windows\System\TpQhhDZ.exe
  2⤵
  PID:7372
- C:\Windows\System\PvbRKbp.exe
  C:\Windows\System\PvbRKbp.exe
  2⤵
  PID:7388
- C:\Windows\System\vYSFHHH.exe
  C:\Windows\System\vYSFHHH.exe
  2⤵
  PID:7404
- C:\Windows\System\oEtcDfX.exe
  C:\Windows\System\oEtcDfX.exe
  2⤵
  PID:7420
- C:\Windows\System\SWUtEjz.exe
  C:\Windows\System\SWUtEjz.exe
  2⤵
  PID:7436
- C:\Windows\System\DbOErlG.exe
  C:\Windows\System\DbOErlG.exe
  2⤵
  PID:7452
- C:\Windows\System\ZGimsCs.exe
  C:\Windows\System\ZGimsCs.exe
  2⤵
  PID:7468
- C:\Windows\System\jRuCTLb.exe
  C:\Windows\System\jRuCTLb.exe
  2⤵
  PID:7484
- C:\Windows\System\jncXDiL.exe
  C:\Windows\System\jncXDiL.exe
  2⤵
  PID:7500
- C:\Windows\System\ADQIyZO.exe
  C:\Windows\System\ADQIyZO.exe
  2⤵
  PID:7516
- C:\Windows\System\NzoGplW.exe
  C:\Windows\System\NzoGplW.exe
  2⤵
  PID:7532
- C:\Windows\System\wceyDZA.exe
  C:\Windows\System\wceyDZA.exe
  2⤵
  PID:7548
- C:\Windows\System\ghntgoO.exe
  C:\Windows\System\ghntgoO.exe
  2⤵
  PID:7564
- C:\Windows\System\AhZXhnJ.exe
  C:\Windows\System\AhZXhnJ.exe
  2⤵
  PID:7580
- C:\Windows\System\hvznYqi.exe
  C:\Windows\System\hvznYqi.exe
  2⤵
  PID:7596
- C:\Windows\System\HcJCmAd.exe
  C:\Windows\System\HcJCmAd.exe
  2⤵
  PID:7612
- C:\Windows\System\FqiJbAK.exe
  C:\Windows\System\FqiJbAK.exe
  2⤵
  PID:7692
- C:\Windows\System\CZszwOs.exe
  C:\Windows\System\CZszwOs.exe
  2⤵
  PID:7756
- C:\Windows\System\puwWHVO.exe
  C:\Windows\System\puwWHVO.exe
  2⤵
  PID:7972
- C:\Windows\System\qHXQVbz.exe
  C:\Windows\System\qHXQVbz.exe
  2⤵
  PID:8024
- C:\Windows\System\cNkzwhB.exe
  C:\Windows\System\cNkzwhB.exe
  2⤵
  PID:8096
- C:\Windows\System\RDsmXaY.exe
  C:\Windows\System\RDsmXaY.exe
  2⤵
  PID:8116
- C:\Windows\System\UOhhHVJ.exe
  C:\Windows\System\UOhhHVJ.exe
  2⤵
  PID:8132
- C:\Windows\System\AlKnCXA.exe
  C:\Windows\System\AlKnCXA.exe
  2⤵
  PID:8180
- C:\Windows\System\umhCJbu.exe
  C:\Windows\System\umhCJbu.exe
  2⤵
  PID:7176
- C:\Windows\System\MmWweqB.exe
  C:\Windows\System\MmWweqB.exe
  2⤵
  PID:7272
- C:\Windows\System\IArRStC.exe
  C:\Windows\System\IArRStC.exe
  2⤵
  PID:7368
- C:\Windows\System\rbZNnje.exe
  C:\Windows\System\rbZNnje.exe
  2⤵
  PID:5768
- C:\Windows\System\gHgbhZt.exe
  C:\Windows\System\gHgbhZt.exe
  2⤵
  PID:7464
- C:\Windows\System\GziZLDV.exe
  C:\Windows\System\GziZLDV.exe
  2⤵
  PID:6368
- C:\Windows\System\DHfgUEP.exe
  C:\Windows\System\DHfgUEP.exe
  2⤵
  PID:7380
- C:\Windows\System\PWPOZFJ.exe
  C:\Windows\System\PWPOZFJ.exe
  2⤵
  PID:7444
- C:\Windows\System\IoUdybT.exe
  C:\Windows\System\IoUdybT.exe
  2⤵
  PID:6208
- C:\Windows\System\KpabDTi.exe
  C:\Windows\System\KpabDTi.exe
  2⤵
  PID:6604
- C:\Windows\System\iIWwOfQ.exe
  C:\Windows\System\iIWwOfQ.exe
  2⤵
  PID:7056
- C:\Windows\System\LAvDgPS.exe
  C:\Windows\System\LAvDgPS.exe
  2⤵
  PID:6624
- C:\Windows\System\gEpoawK.exe
  C:\Windows\System\gEpoawK.exe
  2⤵
  PID:7104
- C:\Windows\System\jLwGlUP.exe
  C:\Windows\System\jLwGlUP.exe
  2⤵
  PID:7604
- C:\Windows\System\HQVkiCJ.exe
  C:\Windows\System\HQVkiCJ.exe
  2⤵
  PID:7384
- C:\Windows\System\HgeWpXR.exe
  C:\Windows\System\HgeWpXR.exe
  2⤵
  PID:7540
- C:\Windows\System\CjbWeDp.exe
  C:\Windows\System\CjbWeDp.exe
  2⤵
  PID:7608
- C:\Windows\System\MiPMuIP.exe
  C:\Windows\System\MiPMuIP.exe
  2⤵
  PID:7640
- C:\Windows\System\jFyDgiq.exe
  C:\Windows\System\jFyDgiq.exe
  2⤵
  PID:7660
- C:\Windows\System\zKjnlot.exe
  C:\Windows\System\zKjnlot.exe
  2⤵
  PID:7664
- C:\Windows\System\JCcHjLt.exe
  C:\Windows\System\JCcHjLt.exe
  2⤵
  PID:7688
- C:\Windows\System\jFjjGxf.exe
  C:\Windows\System\jFjjGxf.exe
  2⤵
  PID:7728
- C:\Windows\System\QHJiEJp.exe
  C:\Windows\System\QHJiEJp.exe
  2⤵
  PID:7736
- C:\Windows\System\lVyQKWZ.exe
  C:\Windows\System\lVyQKWZ.exe
  2⤵
  PID:7712
- C:\Windows\System\CViSAnq.exe
  C:\Windows\System\CViSAnq.exe
  2⤵
  PID:7776
- C:\Windows\System\HCamTlT.exe
  C:\Windows\System\HCamTlT.exe
  2⤵
  PID:7792
- C:\Windows\System\iYhtEWb.exe
  C:\Windows\System\iYhtEWb.exe
  2⤵
  PID:7808
- C:\Windows\System\flgvFrf.exe
  C:\Windows\System\flgvFrf.exe
  2⤵
  PID:7820
- C:\Windows\System\kMYGcPa.exe
  C:\Windows\System\kMYGcPa.exe
  2⤵
  PID:7848
- C:\Windows\System\flgjDKd.exe
  C:\Windows\System\flgjDKd.exe
  2⤵
  PID:7868
- C:\Windows\System\nfAdDbs.exe
  C:\Windows\System\nfAdDbs.exe
  2⤵
  PID:7840
- C:\Windows\System\cPlYAHc.exe
  C:\Windows\System\cPlYAHc.exe
  2⤵
  PID:7884
- C:\Windows\System\enKhWHE.exe
  C:\Windows\System\enKhWHE.exe
  2⤵
  PID:7768
- C:\Windows\System\UIiBSPd.exe
  C:\Windows\System\UIiBSPd.exe
  2⤵
  PID:7916
- C:\Windows\System\UyXbnWH.exe
  C:\Windows\System\UyXbnWH.exe
  2⤵
  PID:7944
- C:\Windows\System\ocbpoSC.exe
  C:\Windows\System\ocbpoSC.exe
  2⤵
  PID:7952
- C:\Windows\System\OPxmFVy.exe
  C:\Windows\System\OPxmFVy.exe
  2⤵
  PID:7980
- C:\Windows\System\uuqBZpC.exe
  C:\Windows\System\uuqBZpC.exe
  2⤵
  PID:7996
- C:\Windows\System\lvDixNm.exe
  C:\Windows\System\lvDixNm.exe
  2⤵
  PID:8016
- C:\Windows\System\cvOtHUZ.exe
  C:\Windows\System\cvOtHUZ.exe
  2⤵
  PID:8004
- C:\Windows\System\kOSCadL.exe
  C:\Windows\System\kOSCadL.exe
  2⤵
  PID:8112
- C:\Windows\System\ILOvPOF.exe
  C:\Windows\System\ILOvPOF.exe
  2⤵
  PID:8140
- C:\Windows\System\pdBLCmR.exe
  C:\Windows\System\pdBLCmR.exe
  2⤵
  PID:8156
- C:\Windows\System\kcJguNe.exe
  C:\Windows\System\kcJguNe.exe
  2⤵
  PID:8176
- C:\Windows\System\Nzccchw.exe
  C:\Windows\System\Nzccchw.exe
  2⤵
  PID:8088
- C:\Windows\System\idJZWUj.exe
  C:\Windows\System\idJZWUj.exe
  2⤵
  PID:8056
- C:\Windows\System\RyNIxCz.exe
  C:\Windows\System\RyNIxCz.exe
  2⤵
  PID:8124
- C:\Windows\System\YjyNAjM.exe
  C:\Windows\System\YjyNAjM.exe
  2⤵
  PID:8068
- C:\Windows\System\TGohwZx.exe
  C:\Windows\System\TGohwZx.exe
  2⤵
  PID:7304
- C:\Windows\System\ulnRpVZ.exe
  C:\Windows\System\ulnRpVZ.exe
  2⤵
  PID:7364
- C:\Windows\System\rhJptYU.exe
  C:\Windows\System\rhJptYU.exe
  2⤵
  PID:7088
- C:\Windows\System\IVSvGes.exe
  C:\Windows\System\IVSvGes.exe
  2⤵
  PID:7524
- C:\Windows\System\bEzgVwe.exe
  C:\Windows\System\bEzgVwe.exe
  2⤵
  PID:7588
- C:\Windows\System\YnfTdZu.exe
  C:\Windows\System\YnfTdZu.exe
  2⤵
  PID:6588
- C:\Windows\System\gfsTjiN.exe
  C:\Windows\System\gfsTjiN.exe
  2⤵
  PID:7592
- C:\Windows\System\AAEOAtS.exe
  C:\Windows\System\AAEOAtS.exe
  2⤵
  PID:6768
- C:\Windows\System\MRZmHWS.exe
  C:\Windows\System\MRZmHWS.exe
  2⤵
  PID:6104
- C:\Windows\System\MyjLrEK.exe
  C:\Windows\System\MyjLrEK.exe
  2⤵
  PID:7476
- C:\Windows\System\qOJVgIy.exe
  C:\Windows\System\qOJVgIy.exe
  2⤵
  PID:6224
- C:\Windows\System\QRIWHYf.exe
  C:\Windows\System\QRIWHYf.exe
  2⤵
  PID:6432
- C:\Windows\System\dehoOyB.exe
  C:\Windows\System\dehoOyB.exe
  2⤵
  PID:6880
- C:\Windows\System\eXFTgOu.exe
  C:\Windows\System\eXFTgOu.exe
  2⤵
  PID:7348
- C:\Windows\System\WNZRRbB.exe
  C:\Windows\System\WNZRRbB.exe
  2⤵
  PID:7652
- C:\Windows\System\HJfvKMv.exe
  C:\Windows\System\HJfvKMv.exe
  2⤵
  PID:7892
- C:\Windows\System\PzBfvGY.exe
  C:\Windows\System\PzBfvGY.exe
  2⤵
  PID:7732
- C:\Windows\System\TnxuufA.exe
  C:\Windows\System\TnxuufA.exe
  2⤵
  PID:7676
- C:\Windows\System\VtqkEmH.exe
  C:\Windows\System\VtqkEmH.exe
  2⤵
  PID:7772
- C:\Windows\System\qJUWehK.exe
  C:\Windows\System\qJUWehK.exe
  2⤵
  PID:7748
- C:\Windows\System\QysfHDS.exe
  C:\Windows\System\QysfHDS.exe
  2⤵
  PID:7860
- C:\Windows\System\yycTLRe.exe
  C:\Windows\System\yycTLRe.exe
  2⤵
  PID:7836
- C:\Windows\System\AsSvqPc.exe
  C:\Windows\System\AsSvqPc.exe
  2⤵
  PID:7904
- C:\Windows\System\UhsTWVR.exe
  C:\Windows\System\UhsTWVR.exe
  2⤵
  PID:7896
- C:\Windows\System\XsXYyYX.exe
  C:\Windows\System\XsXYyYX.exe
  2⤵
  PID:8020
- C:\Windows\System\IzITmgz.exe
  C:\Windows\System\IzITmgz.exe
  2⤵
  PID:7940
- C:\Windows\System\ePhqYFr.exe
  C:\Windows\System\ePhqYFr.exe
  2⤵
  PID:8040
- C:\Windows\System\eQgqLlv.exe
  C:\Windows\System\eQgqLlv.exe
  2⤵
  PID:8000
- C:\Windows\System\pQGXJuB.exe
  C:\Windows\System\pQGXJuB.exe
  2⤵
  PID:8188
- C:\Windows\System\YbQWiCh.exe
  C:\Windows\System\YbQWiCh.exe
  2⤵
  PID:8044
- C:\Windows\System\ECAAwIs.exe
  C:\Windows\System\ECAAwIs.exe
  2⤵
  PID:7172
- C:\Windows\System\icKUxbf.exe
  C:\Windows\System\icKUxbf.exe
  2⤵
  PID:7268
- C:\Windows\System\evtFbcK.exe
  C:\Windows\System\evtFbcK.exe
  2⤵
  PID:7284
- C:\Windows\System\RYgRdUN.exe
  C:\Windows\System\RYgRdUN.exe
  2⤵
  PID:7400
- C:\Windows\System\NjhHUvX.exe
  C:\Windows\System\NjhHUvX.exe
  2⤵
  PID:7480
- C:\Windows\System\LJaiWYi.exe
  C:\Windows\System\LJaiWYi.exe
  2⤵
  PID:7188
- C:\Windows\System\szTHxJR.exe
  C:\Windows\System\szTHxJR.exe
  2⤵
  PID:6320
- C:\Windows\System\mTHvaEj.exe
  C:\Windows\System\mTHvaEj.exe
  2⤵
  PID:7224
- C:\Windows\System\pDgCTmK.exe
  C:\Windows\System\pDgCTmK.exe
  2⤵
  PID:7636
- C:\Windows\System\qZzApZG.exe
  C:\Windows\System\qZzApZG.exe
  2⤵
  PID:7800
- C:\Windows\System\bXmqjNv.exe
  C:\Windows\System\bXmqjNv.exe
  2⤵
  PID:7928
- C:\Windows\System\acIxIIE.exe
  C:\Windows\System\acIxIIE.exe
  2⤵
  PID:8064
- C:\Windows\System\AyGTIxY.exe
  C:\Windows\System\AyGTIxY.exe
  2⤵
  PID:8012
- C:\Windows\System\QCLhORe.exe
  C:\Windows\System\QCLhORe.exe
  2⤵
  PID:5880
- C:\Windows\System\PBbgnwM.exe
  C:\Windows\System\PBbgnwM.exe
  2⤵
  PID:7816
- C:\Windows\System\SQxbvJZ.exe
  C:\Windows\System\SQxbvJZ.exe
  2⤵
  PID:8152
- C:\Windows\System\mkPsKEk.exe
  C:\Windows\System\mkPsKEk.exe
  2⤵
  PID:8052
- C:\Windows\System\smTTzbk.exe
  C:\Windows\System\smTTzbk.exe
  2⤵
  PID:6448
- C:\Windows\System\jskwJQt.exe
  C:\Windows\System\jskwJQt.exe
  2⤵
  PID:7684
- C:\Windows\System\NMrHxce.exe
  C:\Windows\System\NMrHxce.exe
  2⤵
  PID:7680
- C:\Windows\System\VQsUusX.exe
  C:\Windows\System\VQsUusX.exe
  2⤵
  PID:8036
- C:\Windows\System\kkccBGi.exe
  C:\Windows\System\kkccBGi.exe
  2⤵
  PID:7968
- C:\Windows\System\XUEIVav.exe
  C:\Windows\System\XUEIVav.exe
  2⤵
  PID:7724
- C:\Windows\System\iWxNCTD.exe
  C:\Windows\System\iWxNCTD.exe
  2⤵
  PID:7704
- C:\Windows\System\VzYBHJq.exe
  C:\Windows\System\VzYBHJq.exe
  2⤵
  PID:7560
- C:\Windows\System\InNwdIV.exe
  C:\Windows\System\InNwdIV.exe
  2⤵
  PID:7812
- C:\Windows\System\dVSsFhQ.exe
  C:\Windows\System\dVSsFhQ.exe
  2⤵
  PID:2800
- C:\Windows\System\GfMeoSi.exe
  C:\Windows\System\GfMeoSi.exe
  2⤵
  PID:7992
- C:\Windows\System\AbhITUK.exe
  C:\Windows\System\AbhITUK.exe
  2⤵
  PID:7252
- C:\Windows\System\hUwnlgF.exe
  C:\Windows\System\hUwnlgF.exe
  2⤵
  PID:7880
- C:\Windows\System\pbKuzIS.exe
  C:\Windows\System\pbKuzIS.exe
  2⤵
  PID:8364
- C:\Windows\System\dUSUqyy.exe
  C:\Windows\System\dUSUqyy.exe
  2⤵
  PID:8392
- C:\Windows\System\PQLesje.exe
  C:\Windows\System\PQLesje.exe
  2⤵
  PID:8408
- C:\Windows\System\EeTGbzP.exe
  C:\Windows\System\EeTGbzP.exe
  2⤵
  PID:8432
- C:\Windows\System\TjYVmbd.exe
  C:\Windows\System\TjYVmbd.exe
  2⤵
  PID:8448
- C:\Windows\System\GOVCzZB.exe
  C:\Windows\System\GOVCzZB.exe
  2⤵
  PID:8488
- C:\Windows\System\NsOJWad.exe
  C:\Windows\System\NsOJWad.exe
  2⤵
  PID:8504
- C:\Windows\System\ltcctNh.exe
  C:\Windows\System\ltcctNh.exe
  2⤵
  PID:8532
- C:\Windows\System\IThqQVu.exe
  C:\Windows\System\IThqQVu.exe
  2⤵
  PID:8548
- C:\Windows\System\vphYGNC.exe
  C:\Windows\System\vphYGNC.exe
  2⤵
  PID:8568
- C:\Windows\System\cvFHRbI.exe
  C:\Windows\System\cvFHRbI.exe
  2⤵
  PID:8588
- C:\Windows\System\BhfgAdq.exe
  C:\Windows\System\BhfgAdq.exe
  2⤵
  PID:8608
- C:\Windows\System\GGSFIzt.exe
  C:\Windows\System\GGSFIzt.exe
  2⤵
  PID:8624
- C:\Windows\System\MmlcWuQ.exe
  C:\Windows\System\MmlcWuQ.exe
  2⤵
  PID:8640
- C:\Windows\System\aCOOYfd.exe
  C:\Windows\System\aCOOYfd.exe
  2⤵
  PID:8656
- C:\Windows\System\sVNVZjB.exe
  C:\Windows\System\sVNVZjB.exe
  2⤵
  PID:8676
- C:\Windows\System\bHtBtUB.exe
  C:\Windows\System\bHtBtUB.exe
  2⤵
  PID:8692
- C:\Windows\System\LVmLncc.exe
  C:\Windows\System\LVmLncc.exe
  2⤵
  PID:8716
- C:\Windows\System\lQwBDfa.exe
  C:\Windows\System\lQwBDfa.exe
  2⤵
  PID:8816
- C:\Windows\System\BydkDks.exe
  C:\Windows\System\BydkDks.exe
  2⤵
  PID:8876
- C:\Windows\System\EVJPnYx.exe
  C:\Windows\System\EVJPnYx.exe
  2⤵
  PID:8892
- C:\Windows\System\XPHgJZo.exe
  C:\Windows\System\XPHgJZo.exe
  2⤵
  PID:8908
- C:\Windows\System\pTOfMVz.exe
  C:\Windows\System\pTOfMVz.exe
  2⤵
  PID:8924
- C:\Windows\System\yuQzpdC.exe
  C:\Windows\System\yuQzpdC.exe
  2⤵
  PID:8944
- C:\Windows\System\eVvrJSX.exe
  C:\Windows\System\eVvrJSX.exe
  2⤵
  PID:8984
- C:\Windows\System\mOKBWRH.exe
  C:\Windows\System\mOKBWRH.exe
  2⤵
  PID:9016
- C:\Windows\System\qIcavTG.exe
  C:\Windows\System\qIcavTG.exe
  2⤵
  PID:9032
- C:\Windows\System\PZRTtnQ.exe
  C:\Windows\System\PZRTtnQ.exe
  2⤵
  PID:9048
- C:\Windows\System\OZCuroh.exe
  C:\Windows\System\OZCuroh.exe
  2⤵
  PID:9064
- C:\Windows\System\PZNMxTI.exe
  C:\Windows\System\PZNMxTI.exe
  2⤵
  PID:7576
- C:\Windows\System\ScGyQXi.exe
  C:\Windows\System\ScGyQXi.exe
  2⤵
  PID:8208
- C:\Windows\System\yvwyZVY.exe
  C:\Windows\System\yvwyZVY.exe
  2⤵
  PID:8220
- C:\Windows\System\cEFdgaW.exe
  C:\Windows\System\cEFdgaW.exe
  2⤵
  PID:8276
- C:\Windows\System\RZlsiAK.exe
  C:\Windows\System\RZlsiAK.exe
  2⤵
  PID:8260
- C:\Windows\System\fmiROUo.exe
  C:\Windows\System\fmiROUo.exe
  2⤵
  PID:8344
- C:\Windows\System\wJfkHmo.exe
  C:\Windows\System\wJfkHmo.exe
  2⤵
  PID:8376
- C:\Windows\System\WlQamTq.exe
  C:\Windows\System\WlQamTq.exe
  2⤵
  PID:8400
- C:\Windows\System\PMLyjhb.exe
  C:\Windows\System\PMLyjhb.exe
  2⤵
  PID:8428
- C:\Windows\System\ezxEmef.exe
  C:\Windows\System\ezxEmef.exe
  2⤵
  PID:8480
- C:\Windows\System\lGYxTVj.exe
  C:\Windows\System\lGYxTVj.exe
  2⤵
  PID:8528
- C:\Windows\System\CEQXDYt.exe
  C:\Windows\System\CEQXDYt.exe
  2⤵
  PID:8596
- C:\Windows\System\NyXmAbe.exe
  C:\Windows\System\NyXmAbe.exe
  2⤵
  PID:8616
- C:\Windows\System\NeCOdPY.exe
  C:\Windows\System\NeCOdPY.exe
  2⤵
  PID:8544
- C:\Windows\System\nDcDSnZ.exe
  C:\Windows\System\nDcDSnZ.exe
  2⤵
  PID:8652
- C:\Windows\System\TGugHqL.exe
  C:\Windows\System\TGugHqL.exe
  2⤵
  PID:8824
- C:\Windows\System\vmCEheD.exe
  C:\Windows\System\vmCEheD.exe
  2⤵
  PID:9076
- C:\Windows\System\iVTbCPM.exe
  C:\Windows\System\iVTbCPM.exe
  2⤵
  PID:9100
- C:\Windows\System\CGNAANi.exe
  C:\Windows\System\CGNAANi.exe
  2⤵
  PID:9116
- C:\Windows\System\VZEhkzm.exe
  C:\Windows\System\VZEhkzm.exe
  2⤵
  PID:9132
- C:\Windows\System\onDasPT.exe
  C:\Windows\System\onDasPT.exe
  2⤵
  PID:9156
- C:\Windows\System\WAJCypN.exe
  C:\Windows\System\WAJCypN.exe
  2⤵
  PID:9176
- C:\Windows\System\QGSTDTT.exe
  C:\Windows\System\QGSTDTT.exe
  2⤵
  PID:8920
- C:\Windows\System\IvuINPp.exe
  C:\Windows\System\IvuINPp.exe
  2⤵
  PID:8972
- C:\Windows\System\oXSBhWk.exe
  C:\Windows\System\oXSBhWk.exe
  2⤵
  PID:9056
- C:\Windows\System\WbqzrNy.exe
  C:\Windows\System\WbqzrNy.exe
  2⤵
  PID:8228
- C:\Windows\System\BHkDtUH.exe
  C:\Windows\System\BHkDtUH.exe
  2⤵
  PID:8420
- C:\Windows\System\NUyjdjM.exe
  C:\Windows\System\NUyjdjM.exe
  2⤵
  PID:8440
- C:\Windows\System\KiGHhVW.exe
  C:\Windows\System\KiGHhVW.exe
  2⤵
  PID:8204
- C:\Windows\System\HXnYsCe.exe
  C:\Windows\System\HXnYsCe.exe
  2⤵
  PID:8308
- C:\Windows\System\DMUMFof.exe
  C:\Windows\System\DMUMFof.exe
  2⤵
  PID:8268
- C:\Windows\System\dgphVtA.exe
  C:\Windows\System\dgphVtA.exe
  2⤵
  PID:8468
- C:\Windows\System\yjcJNng.exe
  C:\Windows\System\yjcJNng.exe
  2⤵
  PID:8688
- C:\Windows\System\xqGPOZG.exe
  C:\Windows\System\xqGPOZG.exe
  2⤵
  PID:8600
- C:\Windows\System\cmRjrZN.exe
  C:\Windows\System\cmRjrZN.exe
  2⤵
  PID:8832
- C:\Windows\System\Xbigagh.exe
  C:\Windows\System\Xbigagh.exe
  2⤵
  PID:8804
- C:\Windows\System\TUyNxzZ.exe
  C:\Windows\System\TUyNxzZ.exe
  2⤵
  PID:8748
- C:\Windows\System\jKUoYqu.exe
  C:\Windows\System\jKUoYqu.exe
  2⤵
  PID:8784
- C:\Windows\System\guMJAFd.exe
  C:\Windows\System\guMJAFd.exe
  2⤵
  PID:8668
- C:\Windows\System\iBtHRoM.exe
  C:\Windows\System\iBtHRoM.exe
  2⤵
  PID:8296
- C:\Windows\System\LyyfRfV.exe
  C:\Windows\System\LyyfRfV.exe
  2⤵
  PID:8844
- C:\Windows\System\CoEIMzU.exe
  C:\Windows\System\CoEIMzU.exe
  2⤵
  PID:8852
- C:\Windows\System\sAxxnRL.exe
  C:\Windows\System\sAxxnRL.exe
  2⤵
  PID:8732
- C:\Windows\System\utqcIbX.exe
  C:\Windows\System\utqcIbX.exe
  2⤵
  PID:8360
- C:\Windows\System\ZVHMQxo.exe
  C:\Windows\System\ZVHMQxo.exe
  2⤵
  PID:9044
- C:\Windows\System\ydXfrdd.exe
  C:\Windows\System\ydXfrdd.exe
  2⤵
  PID:8936
- C:\Windows\System\OvrYVVR.exe
  C:\Windows\System\OvrYVVR.exe
  2⤵
  PID:9108
- C:\Windows\System\dQXyHoa.exe
  C:\Windows\System\dQXyHoa.exe
  2⤵
  PID:9152
- C:\Windows\System\CZGNxCO.exe
  C:\Windows\System\CZGNxCO.exe
  2⤵
  PID:9196
- C:\Windows\System\mcPpdpG.exe
  C:\Windows\System\mcPpdpG.exe
  2⤵
  PID:8976
- C:\Windows\System\JhYfGLT.exe
  C:\Windows\System\JhYfGLT.exe
  2⤵
  PID:9096
- C:\Windows\System\oPvrawR.exe
  C:\Windows\System\oPvrawR.exe
  2⤵
  PID:9092
- C:\Windows\System\TPQNLeM.exe
  C:\Windows\System\TPQNLeM.exe
  2⤵
  PID:9168
- C:\Windows\System\aChyonT.exe
  C:\Windows\System\aChyonT.exe
  2⤵
  PID:9024
- C:\Windows\System\nwwYObo.exe
  C:\Windows\System\nwwYObo.exe
  2⤵
  PID:8372
- C:\Windows\System\QRmgwZx.exe
  C:\Windows\System\QRmgwZx.exe
  2⤵
  PID:9012
- C:\Windows\System\sqzaQoc.exe
  C:\Windows\System\sqzaQoc.exe
  2⤵
  PID:9144
- C:\Windows\System\anmTWkE.exe
  C:\Windows\System\anmTWkE.exe
  2⤵
  PID:9208
- C:\Windows\System\crEIPdD.exe
  C:\Windows\System\crEIPdD.exe
  2⤵
  PID:8524
- C:\Windows\System\JWFjqSm.exe
  C:\Windows\System\JWFjqSm.exe
  2⤵
  PID:8792
- C:\Windows\System\VXRIKFK.exe
  C:\Windows\System\VXRIKFK.exe
  2⤵
  PID:8744
- C:\Windows\System\rQQpEtV.exe
  C:\Windows\System\rQQpEtV.exe
  2⤵
  PID:8888
- C:\Windows\System\nCzsiQZ.exe
  C:\Windows\System\nCzsiQZ.exe
  2⤵
  PID:8500
- C:\Windows\System\QDLyWHm.exe
  C:\Windows\System\QDLyWHm.exe
  2⤵
  PID:8416
- C:\Windows\System\EJspgzu.exe
  C:\Windows\System\EJspgzu.exe
  2⤵
  PID:7924
- C:\Windows\System\pqjTlzX.exe
  C:\Windows\System\pqjTlzX.exe
  2⤵
  PID:9008
- C:\Windows\System\wtDaXzu.exe
  C:\Windows\System\wtDaXzu.exe
  2⤵
  PID:8236
- C:\Windows\System\xfnQzOz.exe
  C:\Windows\System\xfnQzOz.exe
  2⤵
  PID:8940
- C:\Windows\System\tkeQLEu.exe
  C:\Windows\System\tkeQLEu.exe
  2⤵
  PID:8636
- C:\Windows\System\ftqVzdI.exe
  C:\Windows\System\ftqVzdI.exe
  2⤵
  PID:8996
- C:\Windows\System\FYViecL.exe
  C:\Windows\System\FYViecL.exe
  2⤵
  PID:8604
- C:\Windows\System\NrDtHiU.exe
  C:\Windows\System\NrDtHiU.exe
  2⤵
  PID:9192
- C:\Windows\System\bEhLNvN.exe
  C:\Windows\System\bEhLNvN.exe
  2⤵
  PID:8760
- C:\Windows\System\IkBspxq.exe
  C:\Windows\System\IkBspxq.exe
  2⤵
  PID:8808
- C:\Windows\System\ZScEDwh.exe
  C:\Windows\System\ZScEDwh.exe
  2⤵
  PID:8256
- C:\Windows\System\pbdMMJu.exe
  C:\Windows\System\pbdMMJu.exe
  2⤵
  PID:7240
- C:\Windows\System\HqkGXIU.exe
  C:\Windows\System\HqkGXIU.exe
  2⤵
  PID:8248
- C:\Windows\System\pImaHCL.exe
  C:\Windows\System\pImaHCL.exe
  2⤵
  PID:6812
- C:\Windows\System\XVqVggX.exe
  C:\Windows\System\XVqVggX.exe
  2⤵
  PID:8956
- C:\Windows\System\HjskoxC.exe
  C:\Windows\System\HjskoxC.exe
  2⤵
  PID:8752
- C:\Windows\System\VWmPBYa.exe
  C:\Windows\System\VWmPBYa.exe
  2⤵
  PID:9004
- C:\Windows\System\ABGlGUv.exe
  C:\Windows\System\ABGlGUv.exe
  2⤵
  PID:8380
- C:\Windows\System\jppbRRu.exe
  C:\Windows\System\jppbRRu.exe
  2⤵
  PID:8632
- C:\Windows\System\opjPybC.exe
  C:\Windows\System\opjPybC.exe
  2⤵
  PID:9000
- C:\Windows\System\XllDwxc.exe
  C:\Windows\System\XllDwxc.exe
  2⤵
  PID:8312
- C:\Windows\System\sgyoFky.exe
  C:\Windows\System\sgyoFky.exe
  2⤵
  PID:8916
- C:\Windows\System\EjwesaI.exe
  C:\Windows\System\EjwesaI.exe
  2⤵
  PID:9228
- C:\Windows\System\MLxfreM.exe
  C:\Windows\System\MLxfreM.exe
  2⤵
  PID:9244
- C:\Windows\System\IiwzfmD.exe
  C:\Windows\System\IiwzfmD.exe
  2⤵
  PID:9260
- C:\Windows\System\arZxSSH.exe
  C:\Windows\System\arZxSSH.exe
  2⤵
  PID:9276
- C:\Windows\System\cuzievM.exe
  C:\Windows\System\cuzievM.exe
  2⤵
  PID:9292
- C:\Windows\System\mjThUmr.exe
  C:\Windows\System\mjThUmr.exe
  2⤵
  PID:9308
- C:\Windows\System\NzXHCGM.exe
  C:\Windows\System\NzXHCGM.exe
  2⤵
  PID:9324
- C:\Windows\System\aCEflID.exe
  C:\Windows\System\aCEflID.exe
  2⤵
  PID:9340
- C:\Windows\System\bVRPjnn.exe
  C:\Windows\System\bVRPjnn.exe
  2⤵
  PID:9356
- C:\Windows\System\BNKAfMm.exe
  C:\Windows\System\BNKAfMm.exe
  2⤵
  PID:9372
- C:\Windows\System\UxfUhWK.exe
  C:\Windows\System\UxfUhWK.exe
  2⤵
  PID:9412
- C:\Windows\System\jfjfGdo.exe
  C:\Windows\System\jfjfGdo.exe
  2⤵
  PID:9428
- C:\Windows\System\tYpjZXV.exe
  C:\Windows\System\tYpjZXV.exe
  2⤵
  PID:9444
- C:\Windows\System\WxqDoxo.exe
  C:\Windows\System\WxqDoxo.exe
  2⤵
  PID:9460
- C:\Windows\System\VGYQwfh.exe
  C:\Windows\System\VGYQwfh.exe
  2⤵
  PID:9476
- C:\Windows\System\gbrLDhy.exe
  C:\Windows\System\gbrLDhy.exe
  2⤵
  PID:9492
- C:\Windows\System\nDiipTq.exe
  C:\Windows\System\nDiipTq.exe
  2⤵
  PID:9508
- C:\Windows\System\qceYnVl.exe
  C:\Windows\System\qceYnVl.exe
  2⤵
  PID:9524
- C:\Windows\System\RGxRDKG.exe
  C:\Windows\System\RGxRDKG.exe
  2⤵
  PID:9544
- C:\Windows\System\jNnJQXK.exe
  C:\Windows\System\jNnJQXK.exe
  2⤵
  PID:9572
- C:\Windows\System\FOgapWh.exe
  C:\Windows\System\FOgapWh.exe
  2⤵
  PID:9588
- C:\Windows\System\KqFSXyQ.exe
  C:\Windows\System\KqFSXyQ.exe
  2⤵
  PID:9604
- C:\Windows\System\DqKJccN.exe
  C:\Windows\System\DqKJccN.exe
  2⤵
  PID:9620
- C:\Windows\System\unFzBNO.exe
  C:\Windows\System\unFzBNO.exe
  2⤵
  PID:9688
- C:\Windows\System\qWXOUAD.exe
  C:\Windows\System\qWXOUAD.exe
  2⤵
  PID:9716
- C:\Windows\System\ybFCXPS.exe
  C:\Windows\System\ybFCXPS.exe
  2⤵
  PID:9764
- C:\Windows\System\FTOanfl.exe
  C:\Windows\System\FTOanfl.exe
  2⤵
  PID:9792
- C:\Windows\System\dKSrLqW.exe
  C:\Windows\System\dKSrLqW.exe
  2⤵
  PID:9860
- C:\Windows\System\QPNKTsh.exe
  C:\Windows\System\QPNKTsh.exe
  2⤵
  PID:9876
- C:\Windows\System\JzIlIgv.exe
  C:\Windows\System\JzIlIgv.exe
  2⤵
  PID:9896
- C:\Windows\System\njTUyvG.exe
  C:\Windows\System\njTUyvG.exe
  2⤵
  PID:9916
- C:\Windows\System\AzVCVdE.exe
  C:\Windows\System\AzVCVdE.exe
  2⤵
  PID:10012
- C:\Windows\System\kkXBeua.exe
  C:\Windows\System\kkXBeua.exe
  2⤵
  PID:9940
- C:\Windows\System\EZUcCtP.exe
  C:\Windows\System\EZUcCtP.exe
  2⤵
  PID:9964
- C:\Windows\System\rASpmcF.exe
  C:\Windows\System\rASpmcF.exe
  2⤵
  PID:9988
- C:\Windows\System\KbTdWSt.exe
  C:\Windows\System\KbTdWSt.exe
  2⤵
  PID:10008
- C:\Windows\System\czehZaJ.exe
  C:\Windows\System\czehZaJ.exe
  2⤵
  PID:9936
- C:\Windows\System\bfxgLnI.exe
  C:\Windows\System\bfxgLnI.exe
  2⤵
  PID:10168
- C:\Windows\System\stwhPXT.exe
  C:\Windows\System\stwhPXT.exe
  2⤵
  PID:10152
- C:\Windows\System\pWLRRTc.exe
  C:\Windows\System\pWLRRTc.exe
  2⤵
  PID:10136
- C:\Windows\System\ydiIYtV.exe
  C:\Windows\System\ydiIYtV.exe
  2⤵
  PID:10068
- C:\Windows\System\qOknDmW.exe
  C:\Windows\System\qOknDmW.exe
  2⤵
  PID:10180
- C:\Windows\System\yNzeyow.exe
  C:\Windows\System\yNzeyow.exe
  2⤵
  PID:10084
- C:\Windows\System\pZwTAPn.exe
  C:\Windows\System\pZwTAPn.exe
  2⤵
  PID:10176
- C:\Windows\System\DTUudNZ.exe
  C:\Windows\System\DTUudNZ.exe
  2⤵
  PID:10236
- C:\Windows\System\rZvjZUI.exe
  C:\Windows\System\rZvjZUI.exe
  2⤵
  PID:8788
- C:\Windows\System\xfcSFsQ.exe
  C:\Windows\System\xfcSFsQ.exe
  2⤵
  PID:10216
- C:\Windows\System\pkYVUrR.exe
  C:\Windows\System\pkYVUrR.exe
  2⤵
  PID:9420
- C:\Windows\System\TMAqTVx.exe
  C:\Windows\System\TMAqTVx.exe
  2⤵
  PID:9472
- C:\Windows\System\gjqbREI.exe
  C:\Windows\System\gjqbREI.exe
  2⤵
  PID:9452
- C:\Windows\System\JjigmHA.exe
  C:\Windows\System\JjigmHA.exe
  2⤵
  PID:9520
- C:\Windows\System\syamWXf.exe
  C:\Windows\System\syamWXf.exe
  2⤵
  PID:9568
- C:\Windows\System\CKPTTUo.exe
  C:\Windows\System\CKPTTUo.exe
  2⤵
  PID:9536
- C:\Windows\System\pOXUROY.exe
  C:\Windows\System\pOXUROY.exe
  2⤵
  PID:9824
- C:\Windows\System\tbWBwoY.exe
  C:\Windows\System\tbWBwoY.exe
  2⤵
  PID:9836
- C:\Windows\System\gSdKBaK.exe
  C:\Windows\System\gSdKBaK.exe
  2⤵
  PID:9888
- C:\Windows\System\zptYTog.exe
  C:\Windows\System\zptYTog.exe
  2⤵
  PID:9960
- C:\Windows\System\TMKLzFz.exe
  C:\Windows\System\TMKLzFz.exe
  2⤵
  PID:9984
- C:\Windows\System\JyFWZXN.exe
  C:\Windows\System\JyFWZXN.exe
  2⤵
  PID:9712
- C:\Windows\System\pvMOfJk.exe
  C:\Windows\System\pvMOfJk.exe
  2⤵
  PID:9784
- C:\Windows\System\IHYSFDb.exe
  C:\Windows\System\IHYSFDb.exe
  2⤵
  PID:9904
- C:\Windows\System\YYltzgR.exe
  C:\Windows\System\YYltzgR.exe
  2⤵
  PID:9956
- C:\Windows\System\sXcdpRI.exe
  C:\Windows\System\sXcdpRI.exe
  2⤵
  PID:9976
- C:\Windows\System\nyhPkNk.exe
  C:\Windows\System\nyhPkNk.exe
  2⤵
  PID:10020
- C:\Windows\System\PEcfHTY.exe
  C:\Windows\System\PEcfHTY.exe
  2⤵
  PID:10044
- C:\Windows\System\krFAefB.exe
  C:\Windows\System\krFAefB.exe
  2⤵
  PID:10056
- C:\Windows\System\yowKNjD.exe
  C:\Windows\System\yowKNjD.exe
  2⤵
  PID:10196
- C:\Windows\System\qgAQexv.exe
  C:\Windows\System\qgAQexv.exe
  2⤵
  PID:8580
- C:\Windows\System\ZPFxxPt.exe
  C:\Windows\System\ZPFxxPt.exe
  2⤵
  PID:10228
- C:\Windows\System\oiKwbqK.exe
  C:\Windows\System\oiKwbqK.exe
  2⤵
  PID:10104
- C:\Windows\System\QapZBrJ.exe
  C:\Windows\System\QapZBrJ.exe
  2⤵
  PID:10124
- C:\Windows\System\HIduFPQ.exe
  C:\Windows\System\HIduFPQ.exe
  2⤵
  PID:10208
- C:\Windows\System\RsOwCxL.exe
  C:\Windows\System\RsOwCxL.exe
  2⤵
  PID:8384
- C:\Windows\System\dLfpjtX.exe
  C:\Windows\System\dLfpjtX.exe
  2⤵
  PID:9336
- C:\Windows\System\LmQfZJl.exe
  C:\Windows\System\LmQfZJl.exe
  2⤵
  PID:9288
- C:\Windows\System\UIBaAAB.exe
  C:\Windows\System\UIBaAAB.exe
  2⤵
  PID:8776
- C:\Windows\System\bRMbrtK.exe
  C:\Windows\System\bRMbrtK.exe
  2⤵
  PID:9388
- C:\Windows\System\vTYSWHA.exe
  C:\Windows\System\vTYSWHA.exe
  2⤵
  PID:8292
- C:\Windows\System\DEyuuTt.exe
  C:\Windows\System\DEyuuTt.exe
  2⤵
  PID:8900
- C:\Windows\System\vPJhWBA.exe
  C:\Windows\System\vPJhWBA.exe
  2⤵
  PID:9560
- C:\Windows\System\HdRdBje.exe
  C:\Windows\System\HdRdBje.exe
  2⤵
  PID:9440
- C:\Windows\System\IgsaqIJ.exe
  C:\Windows\System\IgsaqIJ.exe
  2⤵
  PID:7788
- C:\Windows\System\iwzSkKg.exe
  C:\Windows\System\iwzSkKg.exe
  2⤵
  PID:9532
- C:\Windows\System\gsawCvu.exe
  C:\Windows\System\gsawCvu.exe
  2⤵
  PID:9632
- C:\Windows\System\TLSDXkY.exe
  C:\Windows\System\TLSDXkY.exe
  2⤵
  PID:9684
- C:\Windows\System\PaXFKaC.exe
  C:\Windows\System\PaXFKaC.exe
  2⤵
  PID:9664
- C:\Windows\System\lQyxeeN.exe
  C:\Windows\System\lQyxeeN.exe
  2⤵
  PID:9748
- C:\Windows\System\nElrnVD.exe
  C:\Windows\System\nElrnVD.exe
  2⤵
  PID:9808
- C:\Windows\System\uWMKRNL.exe
  C:\Windows\System\uWMKRNL.exe
  2⤵
  PID:9820
- C:\Windows\System\UzTDpWJ.exe
  C:\Windows\System\UzTDpWJ.exe
  2⤵
  PID:9856
- C:\Windows\System\hYYXBdZ.exe
  C:\Windows\System\hYYXBdZ.exe
  2⤵
  PID:9760
- C:\Windows\System\ouVWHOZ.exe
  C:\Windows\System\ouVWHOZ.exe
  2⤵
  PID:9912
- C:\Windows\System\kFdJgWt.exe
  C:\Windows\System\kFdJgWt.exe
  2⤵
  PID:9980
- C:\Windows\System\hJIyxpJ.exe
  C:\Windows\System\hJIyxpJ.exe
  2⤵
  PID:10096
- C:\Windows\System\HoCiVPz.exe
  C:\Windows\System\HoCiVPz.exe
  2⤵
  PID:10128
- C:\Windows\System\MDsTKAD.exe
  C:\Windows\System\MDsTKAD.exe
  2⤵
  PID:10028
- C:\Windows\System\xAjhYDI.exe
  C:\Windows\System\xAjhYDI.exe
  2⤵
  PID:9408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BIlQgDW.exe

Filesize
1.9MB

MD5
9ff34776d932f61854123f0b6854eb58

SHA1
359bab37bd5948aeed25fd6922865e170f40a305

SHA256
9d705366c558acd07af2cd51eff9c844da977ce34e4157c54ae30dc987719bdd

SHA512
2acf5a39c05f07afc4b1db1162f822a647b1b909b7a37692c6073d3c67c5890af5cf697fece3230318c01e3c40a2fc1c2b0d2c3298c4ec98e93cbd1e875b93c8

Download Submit
C:\Windows\system\DOnaTMY.exe

Filesize
1.9MB

MD5
ee67d31035dc9f195ad023272bd556bc

SHA1
881f2a82143959640a31344d7876db6815d88000

SHA256
16d5625a0f488f7c3b81f005e63af12d9a220433c655c80f6d49b1184b7bc7c8

SHA512
772b1978e31c0386477c6d7e3b023b2048832435636ba4c0888f7a7f435ab76a4dd68516db64ce77eb9cd249e623d9db55a9e64f10f25eba5384fa23f88c634a

Download Submit
C:\Windows\system\DQmzeHe.exe

Filesize
1.9MB

MD5
733bc28de120050de86abfb49d5e957c

SHA1
638cd9117bee79856010d30bd2a0403bc14d1250

SHA256
5cd024c77b0ff9b492a3b45647fe74cfd98e23062369893d152e0cbe7c53c7bc

SHA512
cdba1df0330a3fcb035833b93cc7733ea4372cb1be61188c65b4b0ad3b7a5fe5ce74aa9fd5a2a6b8b9eb453eddef621329dde40ea74a356eef9258fb2a2cf62d

Download Submit
C:\Windows\system\EgtpDzf.exe

Filesize
1.9MB

MD5
faeeba14c845c5e8cc164c69ba9e2ecb

SHA1
70e598eb5178c56d901bf9ff361f43b41285127d

SHA256
ec75d96b34e50309fcbaa91037fd76bc14b5aeec547f6f8721e503517f0a5ef8

SHA512
20fcd0c51e46fe22fde85af05b5430e5330dc592025e5b9a3cb023ddf035550ad5460988a8ecacbc6f82010876e795b3998c6be4a9b8a952643d11b90adafd4a

Download Submit
C:\Windows\system\FMErQxM.exe

Filesize
1.9MB

MD5
1bf1c22ea52f422f21851f0da596107f

SHA1
7958bd9a45f431a35acbc64fc1ddc133e9145c83

SHA256
d900cfaa0f00e7e0fe9402847c18a40396c62d038566ead428053da8315927e0

SHA512
fe34f1747ca828fdcc81cc3baf73ba621dd8df691ef315e8d57816743b06721533cc06638b7034ea0ea4bc5a13fb63bed067ec8fcbb049d6af164d7c35631f9b

Download Submit
C:\Windows\system\IMcuPzm.exe

Filesize
1.9MB

MD5
b12f9c8d11db192d379fb8b6c165bf15

SHA1
9b3d6ba4a3dfd288f0dbba331c75e4f39860b16c

SHA256
739082de454aef9327daee6731de218ee2d77f925e3b7b0c97b84f182e092776

SHA512
829fae4a2cca79c9cf0838d9d2d7ba52fc9e35a54d4b1fcde6e86860c3e942be3f94b503b2a88663f2a1fbd07cc800f4fb94c734e3b78a213d6bda3b0575ceb0

Download Submit
C:\Windows\system\KPTzCvv.exe

Filesize
1.9MB

MD5
da8aef1a0b6655a6759c8528d6d9f859

SHA1
17d7087dfa4f3d48de4dcbf685c831697dd794fc

SHA256
e7c0bc7f14b63f27faf5cf234a76259a612431767e2da27ce4e53869b64f6112

SHA512
c083df054601e6992c6ab8ed3e3d21c02f472274952f988fa4f21c310f58810a9f97f05f596d365f6c8fc2ea73373cc2fff735cc5faa6d758c18e3ea8bbe17fe

Download Submit
C:\Windows\system\MPNgLLx.exe

Filesize
1.9MB

MD5
9dcd2c586f70a3ffe18b595e0a6bda35

SHA1
67ea3b13b97ce971a3d35061d9a0126e3d946602

SHA256
5ac8f7fb8b3260f9ec67bd9e3ac23c571d62302381dbbafd12acd049123e9f0b

SHA512
136fa5e36fe5e9b3ef81a24db7f03faabf8c49ff21c22800d2d3cdb99457949a20dba5588e620ab4501efd4db7991e68b062b4cc57dc2c9e4396b42fbc20b217

Download Submit
C:\Windows\system\UqAjgOr.exe

Filesize
1.9MB

MD5
5f259e0cf3454d72c6bb04258ec0f8c6

SHA1
f0177bb7540f5b0a1743de7605c73be199fbc469

SHA256
f37af35ad60dfe9202354a8e24a83793c5318c660d7009efff72201232a52a27

SHA512
d9c527e40d69bfe7835875ca216f04dcbf367f11a32e40d08e31977e721f92152d483cc710be696e221af9f2d7fe641834856573d1f521af229f9b8717fcc505

Download Submit
C:\Windows\system\UwKVrEc.exe

Filesize
1.9MB

MD5
6c840226b0a919c6c6cb4ff16035f0e1

SHA1
d11b5be0b70f0270d6d36ceb814468137f7c736a

SHA256
195d639942644c6590ddc35f69fbd43d264bb17e17f629e5495e1d271bcd00ea

SHA512
601940b9578d6f9af3f50f8c16e803b2db2d63947f561a8f6ad9b40d8efb0492db731fabebdd272849ebb21046e6216ac92f81d915acdafe3349e38f2b9def84

Download Submit
C:\Windows\system\WdUyfVt.exe

Filesize
1.9MB

MD5
74b694c5069a65af574d7ff861590345

SHA1
a8a99bda6e5141220aeaeb2717df147212a3521a

SHA256
ef66306d9579e0c7e9d2a216a0a92ceb48904b8a484998109cdff9b24c73f49f

SHA512
2a4fc45009e49986b0b1128a708601945e855f3ffd9a83821eda2429a6425e4a725d8a19e2bb63e290a148734e1587a3a01b7f130a15b43a448def771cd5f2e2

Download Submit
C:\Windows\system\XVaETxZ.exe

Filesize
1.9MB

MD5
8122a356419c677ba16a64c944d39a10

SHA1
c1519ccf6f5291abd893481330ecc9abfce8c77e

SHA256
2bcf90f1aef53173591f54a3786db23b0e553d32c16832fc82cbd0e2368e5674

SHA512
082bb23eba4ea1fc2d0cf902a7d2ffbe5f9ab321a3af73570b7b4129416954be18d731c34e78fa8ca1d7e66e3cf74e8fb6d745dfdb47dcfcc6dd2a599da15eb1

Download Submit
C:\Windows\system\YeGtDsM.exe

Filesize
1.9MB

MD5
419440cbe174ebddfc961935fece857c

SHA1
aae8915ba07f8756a088b55268ef3ceeeec950f2

SHA256
92fb0604cfe6f7a7acad07c6fd28b99a207e0837f85b067e8069345eb4eb60bf

SHA512
c341972e5e60213eec7bea440238abee40ffed24a0ac5c7345d6a7600e55ef7cccaa90af411121ca1868a7418620bab2556c9cb843b1080c0c76b5487c82c472

Download Submit
C:\Windows\system\aIXtKUr.exe

Filesize
1.9MB

MD5
a321c89f0783b4ed156775e763861d9e

SHA1
bbcf505916430e28851738abe499998c31d3b23a

SHA256
5b289a63f7b9b5aeaa108f5eb05bd328881112a2391989e2ec86ad03164d9304

SHA512
3a6733785c84b262f1e6e2c6d0d34fe3dc3318751fe97e6b3d2145a3ef1ba90f45ef95932af348b2e065e714c7a186bebf9f1d1be9fb06e4d71bd52ffed2af3a

Download Submit
C:\Windows\system\dfSnshX.exe

Filesize
1.9MB

MD5
1a8ebff875c81cc01b5d4533f4fb4c0e

SHA1
34d9f0ba51dcf9377748aa23e01e9f36a509bee4

SHA256
dd15e9e86641b0adc87016a7ebfbbb46016505e6263f4e9b182e2547565d82c1

SHA512
a40b1f7a6fe8ee803d72fbe8078d3006c60216cfd4c4fec057c64eba18cf3a208601c442c89971510ea6289c2abba4db36670b4b313d28dfcebcc6de8e739db4

Download Submit
C:\Windows\system\ejXjiDc.exe

Filesize
1.9MB

MD5
e3b5b37dee4291d76e136fdd63c93034

SHA1
ca9dbd79575d8ef4cf83d8d325be7ab25348af29

SHA256
abb2ec6cb2abf8ba6a0a25a022ffc8ca2fd8cfaf15b6ac5a598f820be0068c7e

SHA512
3e715e86fd90c547782df6aa5ec5b26b33a659025c3a3ae2176897a93e2409b7a8d3dc4b5201b9c2b4c32359235eb6acf10ddc45045cdb455d3ccb64a1b68c89

Download Submit
C:\Windows\system\mdkwwQo.exe

Filesize
1.9MB

MD5
0600c8d4c28dab2be8c32607b07dc9da

SHA1
7a78497defb52f4d241c089e0eba65a7c5548f40

SHA256
fcfa33781cac3119af1238c9d10ab9142a153d3a29f6e8887147b2fdac6ae1ae

SHA512
d5abd57af2a38e335a55763f7596e94c34fd3b2ab37d8885e8be4b9d2e7a98aecccde9818884e7fdaac20964310316bec2c24e9049b4ab5ae40751c7be4b2622

Download Submit
C:\Windows\system\noxtrqQ.exe

Filesize
1.9MB

MD5
11d96d6666a09c2ff607a18215e7c563

SHA1
97d923a6bd4ce12658562555f691ca04d45ad595

SHA256
a1aaed0ec15c59ce995263733a7a15d8d14d783e863d4e4a463d4b4adacd549e

SHA512
63ad76dd213f3f52038e2ba16e6eb39978e066607b49f6b74d437c6d1bf129652246e99709958c0dd51c17c9840de61013c583f8eee4144a4905cedcf53b3601

Download Submit
C:\Windows\system\nxFZcJk.exe

Filesize
1.9MB

MD5
172a91318e402b683a193907d2ad58d8

SHA1
591579c8905dabffca874d9bdf627c5c8e20a433

SHA256
09a1e25c8e5a3ab9808de9959a8a34fa426fbc701341e0f0f934e86d8abc1b3f

SHA512
9b6ae50e209f2bb110f2c40b3041b9dfadb0ac1c0c07d66553f3471f9bb1d639acb4c5155b5e5b6a4420f270c7754c687ab67588728333a84413c0f6af07b20a

Download Submit
C:\Windows\system\orTnBnT.exe

Filesize
1.9MB

MD5
0d96231dba45105621ab3cc4707329f3

SHA1
ca02b6baa6a6b47290fc5c5df0cf81b5516f31d2

SHA256
15784595071bf298bfe770b20fe00c09024f265f4343ed0e72efc5351446ff88

SHA512
0b3c66e5e337a3eb67d172775649d713635d97111d4b0dedc948c74324281c61b5da1bd65016c8bed70fe9fe5e5a524e652a7992ded957a319f96fd9b380faa4

Download Submit
C:\Windows\system\pxNVAAA.exe

Filesize
1.9MB

MD5
dc979b74b3e2b694842f3c769f815a99

SHA1
c30d0f7e98192d95dc54e85ea98263add20133b0

SHA256
d7c03d29a406b457dc36d09afea3ae3dedbafe0262abcbb7566f13af6263a3e9

SHA512
ca6a8779b6376d61d32ce42f13542a2de67161fed9684366b289ac23e6013d3a6dd228c28a8f1b07c36e714c47bd87d0163ae05913daf37b59310bfa5e499f27

Download Submit
C:\Windows\system\qCehedv.exe

Filesize
1.9MB

MD5
09a8709b0bd56b51ca25b11619d3536e

SHA1
575559d737bd498f46512587bf8dcab82ec9ea02

SHA256
e2be9485b90c29657386e884055cff3d32ad2228e370b4b5fc63dc62a0e803ba

SHA512
8eeb54a002673aad53eb4e20448c03f3e6dab44807fc0b8deded9bf00caf1e6cc2211182c2ac6c90c8d51d98989d5f0044c9199be0ce759c753da92354250b6e

Download Submit
C:\Windows\system\vLnWTdy.exe

Filesize
1.9MB

MD5
549c5eacf948844e43f8131800d30e19

SHA1
dc7377b89e613fbf4f247c2e16c1bb49d1f4e8b2

SHA256
d5f4bb258c4c3918f674fa9be7a75eb5d32ba0a6e8e9d3860339dc88f856f2a2

SHA512
7120442635a14d0faa49cf26f6ae0780c52d4c8f55b140cb701e3632c221373d3ad1f406977ace8d023e80bb0e116fde2aa94fa1f3b97cebe582aa472e89a63b

Download Submit
\Windows\system\ASuHQex.exe

Filesize
1.9MB

MD5
beaa9ff1513295dd44956d8639d9c664

SHA1
dd67ada1242436507727e225bb5ba70241b3c035

SHA256
5b0fee4b345f8de21be2da0a7dc5d1ecf3045675758245153c7e838a16d14a0f

SHA512
4627f01e2d7b3ed2470ae8845e25af6438fac6d778ded8a587c2970315ccbe81454adc3aeec2167fa7ac2f7d9de29d936914a845d48f696221dc00fdbc9b6439

Download Submit
\Windows\system\AytmBoJ.exe

Filesize
1.9MB

MD5
f3afb5c0d4a153ef3ef9b00bc6fe732b

SHA1
5c217b4d3b56c9981e6a489abdef6bd7545dfbb7

SHA256
338a2cd756671f61dfbf6df3117574bbab834e9c98f95edcdf0b3abe14d75c7f

SHA512
d14092f90d898fc47503405c2f51450b76f63dfb4f8d4cab27aefc67e3dc4a5a2605e8bf676e7a6ebd97228a3a38afa7dbf11e4b89afa030fec591fc7a1f08a7

Download Submit
\Windows\system\BChPCrw.exe

Filesize
1.9MB

MD5
fc063a3ea89d94672d7077ccc3954bcb

SHA1
e8c56d4e2012a1f1ce792012395bcf1a0f17b0de

SHA256
3a9a03e7e7f87da662511ed3cb15810068643c6f1fa136acc99ddcbc564564a4

SHA512
6e028f525579d79a34982a97967706972e5ec41ff70cd79c04d54446042adcf645481a557e17d19ffafeaceb45643a28ee9f3b7cf9911bf51289cda3f844a598

Download Submit
\Windows\system\BepHECv.exe

Filesize
1.9MB

MD5
9a2fde45ef548e62d3839356b3eaf49b

SHA1
e13a6846672e1f47518f2e91d1c5ca691011d888

SHA256
4a533906fcc852be3ca063b8f6542c8948203933bfed0e81db33f0805d45fd50

SHA512
8907de3aa821ed840d13abfb9d00cd548af2e4f78786e6d44263b88e837bd5ef662afe90f4e93a831f3eeef67916bb396f201a248216747cde5a13cc086a6efa

Download Submit
\Windows\system\JnnKgeF.exe

Filesize
1.9MB

MD5
4bd9bbcd86e41d6f052471f498a4a976

SHA1
a26a3e3445eb27ef85e3f0506dcade9026f5210e

SHA256
291d211344d91778b4d881329ae9a41a03b414d00a6b948e669fccbac8e6cc04

SHA512
388eb2975459e22a7c06a80e045c440b981d7b47728d1df2853a793be1e709eaa637dda3155740aabf04679d9448d3821cc90e0a7e1dc1a6e9b0cd778b0870d8

Download Submit
\Windows\system\NTbBCJO.exe

Filesize
1.9MB

MD5
482c4f9cf499e8e93c2ed5870cceba92

SHA1
ff576300d6722a3fa15e3ea32e2b33196f6e6b2e

SHA256
fa794bf11c9f0d0dd450cf24342b7d9e5bd029bf18839069595608b4ebd47da5

SHA512
a67832adf6167072a1e2b252331946c4f396ac304cbd84c6aa6e7f750cb83d786f29cc424e5256957af0f43f32aeea35ab0716f085bc8a9cb3fc5f82a74400f6

Download Submit
\Windows\system\TjwGcqm.exe

Filesize
1.9MB

MD5
caee48f0678535f3d6efee24a6b8f0b9

SHA1
2bc87bef6b27c09794900d9ddce534e893fd5acc

SHA256
0864ab2b4bb49796337c34f151135ce1bb4052219330aaf01afaf83478530dd5

SHA512
845c0108a052ccb5e3c3ece1ca632b47273650fd634e1bc211eb121017d072ce5522e225ed6fc017fb2eec801169fe6e30b3cff74be7167e8e3f1ff3ae089ae0

Download Submit
\Windows\system\YgjUVTa.exe

Filesize
1.9MB

MD5
13fc64a97e156fb00e71add8b080a92e

SHA1
67757dce17df238ee72883dd5585b753eb7de357

SHA256
940046a6c36067e49e02a86978f5676988ebd5a754035ad929581e53d6e89fc0

SHA512
2aa820ee2b83910c5348706d477dd9ceeb08cc6b459a8364fcf29c3b619d32345b3f894c5c8f2267660affbb9622091f04689d2a4acd68c448bc460557fe944f

Download Submit
\Windows\system\gNoGava.exe

Filesize
1.9MB

MD5
e16c54e9705b8a4af2eefa4cd59feda0

SHA1
5f301f333fa035d5bf055404f93116da9cf93526

SHA256
279628b150520781829031763a4c36996bc0b3b707fb340ccb61930384652183

SHA512
5d98c61cf6c357e82281777658762724a77c402f1a605b21ba85d821233daedd11ce23f2e5b4c64e613a4b6e6b716676569e426dfe539e24888c88d14cb0d0ca

Download Submit
\Windows\system\iYnyhFj.exe

Filesize
1.9MB

MD5
15c11ff20dbd93c4363f163188631ea6

SHA1
f4a8ac759d4828f674637eeca09d202a6b501ca2

SHA256
3ee45e3201920a6680a4c07173b54972ca88c5007c663fd9b15e495f9f350e24

SHA512
c29ca4345dcfdfc5a8569d71ccf843a923ce6bfb89c0079566fec9a4528bbbe29961ef3dd3755bf4ab0e467441cea8f6ebc9fd3aae23eb9996ecdd073147fef8

Download Submit
\Windows\system\kdtiOol.exe

Filesize
1.9MB

MD5
5578f1f40e392a115098e30738c71196

SHA1
c821093d1a4c36af8e824370e70f8b8aa044bee6

SHA256
665238ac834d7e43fadf1439331c05ceedfc8e7afed67312c184848d68da191d

SHA512
622964bb08e878f6e67d044250adee0547c30137102723cb64aee0bfb2481303bb1e61551078cb1b6566c33c09d1b091a460da8a588891fd891448c66b82311c

Download Submit
\Windows\system\viQCzWh.exe

Filesize
1.9MB

MD5
e442adc7a9cc84028fb8386cce4e1a84

SHA1
98935a3de1c5e9df852f46b817086405d3a6fb68

SHA256
00282d55fe2f07cfc7e66f5b185873439cba8f236897789c71d026c3c950698c

SHA512
ea9ae8f04c6f00fff2b4334353357c5718a4ac21f1284f3dc4599792d4d1675211cfeb889c706f79a9ae695cf5ab8015e0fb40457e4f88c640ce2c17fac7d037

Download Submit
\Windows\system\wBddvkw.exe

Filesize
1.9MB

MD5
9baa71972820c510960633017d657647

SHA1
38ac9a129e3a248d1bb24797637ef5716ff2a0dc

SHA256
e5d23e07f5815d29cf4f19abccd21c7bbc5713eec29c9614172ade2d8ff4f9f4

SHA512
6b32d5ea2f05146dae406a617991b67e4eb905509ff4ad9b52810f4cdea4016c3531018729dbfd3df155df10d0adb453daed68d5510633e14513a5ab9365e6eb

Download Submit
memory/2204-22-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2320-35-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2320-168-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2320-0-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2320-28-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2320-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2320-160-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2320-156-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2320-69-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2320-12-0x0000000002950000-0x0000000002D42000-memory.dmp

Filesize
3.9MB

Download
memory/2320-91-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2320-167-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2320-51-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2320-166-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2320-25-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2432-165-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2496-24-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2564-61-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2572-136-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2584-127-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2592-16-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2644-37-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2740-29-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2864-112-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2864-128-0x0000000001E30000-0x0000000001E38000-memory.dmp

Filesize
32KB

Download