xmrig | ec366f9f46ab1d402baa621b7c63509f80fd79efc30b66505bd4d8a1cec4e35f

Analysis

max time kernel
133s
max time network
142s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
Size

1.8MB
MD5

0e49e4513023425096cd7b12abdf3d9e
SHA1

b20b6ec0ffc38daaa60b3375a6d973681e33f0b1
SHA256

ec366f9f46ab1d402baa621b7c63509f80fd79efc30b66505bd4d8a1cec4e35f
SHA512

fa157a357ac9ab6b59e73bbea6179e25099b8b9ded8d46c2eabbb27a944f87bb3c96a5d3ecec23a9b94820703719a1e5c841caf9be844e6e0ff61fc0c8a2a3d5
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFtI:Lz071uv4BPMkibTIA5I4TNrpDGgDQmKw

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 13 IoCs

miner

resource	yara_rule
behavioral1/memory/2052-30-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2716-28-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2636-27-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2176-23-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	xmrig
behavioral1/memory/1772-43-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/2512-56-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2460-55-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2948-89-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/1996-85-0x00000000035E0000-0x00000000039D2000-memory.dmp	xmrig
behavioral1/memory/2656-91-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2960-90-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	xmrig
behavioral1/memory/1996-83-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig
behavioral1/memory/2836-72-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1300	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2176	annLzLC.exe
2052	hEGlflZ.exe
2636	wlrnoel.exe
2716	mRAjHJV.exe
1772	Unknhzm.exe
2460	KpykCYT.exe
2512	BEcsMFA.exe
2080	ErBsAdP.exe
2836	IKuLNWh.exe
2948	lZvgRky.exe
2960	bNWGcyk.exe
2656	OyrXwpV.exe
2028	swXPRBK.exe
2188	RRUQFHp.exe
2508	jZyFxvq.exe
2660	ZQjmMfL.exe
2848	EqiCigb.exe
1600	GBEBYTO.exe
2072	pMENtiE.exe
2340	EikTMAp.exe
2552	LoTwCuW.exe
1704	GcjOkcK.exe
2024	FBsXiqg.exe
776	nPkMvhC.exe
1636	EqiMjoB.exe
2428	vbnelMp.exe
536	kosikVO.exe
304	rBHrVOa.exe
1112	rbpHaMO.exe
636	GsTClWU.exe
1528	rkWNLZY.exe
2420	zTdNvga.exe
1940	eVerpkl.exe
408	DNAycyE.exe
1568	Mfntnhy.exe
1992	UCiLHKK.exe
1796	ASjmHYf.exe
1356	iygdmQb.exe
1888	DcXkNUD.exe
1960	XdpeMxB.exe
3060	naNdyrj.exe
1884	fEywqIs.exe
2936	kwFtdtf.exe
2252	BQxEeBx.exe
1140	lWMlZOS.exe
1548	GSTmEwP.exe
1812	LGDPpJI.exe
1268	acmpMTc.exe
1520	BbYPpmE.exe
892	KzwRLZE.exe
2376	VBichDG.exe
2128	oCqysPK.exe
1612	ZaRAARY.exe
2224	qWXGTuR.exe
2592	SRjRJMd.exe
2756	oHaPXkL.exe
1984	myQBXrL.exe
2272	jCEJryD.exe
988	NzDalZy.exe
2472	TNWAKja.exe
2732	hnTEuII.exe
2856	ihSYANS.exe
2772	GrewoSD.exe
868	lXxWkUl.exe

Loads dropped DLL 64 IoCs

pid	Process
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000014dae-13.dat	upx
behavioral1/files/0x0007000000014ba7-17.dat	upx
behavioral1/files/0x000b0000000144e0-16.dat	upx
behavioral1/memory/2052-30-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/files/0x0007000000014eb9-31.dat	upx
behavioral1/memory/2716-28-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/2636-27-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/2176-23-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx
behavioral1/memory/1996-9-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/files/0x003600000001480e-8.dat	upx
behavioral1/files/0x001800000000558a-44.dat	upx
behavioral1/memory/1772-43-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/files/0x00090000000153d9-51.dat	upx
behavioral1/memory/2512-56-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2460-55-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/files/0x0006000000015cce-65.dat	upx
behavioral1/files/0x0006000000015cf5-76.dat	upx
behavioral1/memory/2948-89-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2656-91-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/files/0x0006000000015d24-101.dat	upx
behavioral1/files/0x0006000000015d4c-111.dat	upx
behavioral1/files/0x0006000000015e6d-118.dat	upx
behavioral1/files/0x00060000000161b3-136.dat	upx
behavioral1/files/0x0006000000015f3c-140.dat	upx
behavioral1/files/0x0006000000016476-149.dat	upx
behavioral1/files/0x0006000000015e09-115.dat	upx
behavioral1/files/0x0006000000016a6f-174.dat	upx
behavioral1/files/0x0006000000016813-169.dat	upx
behavioral1/files/0x0006000000016c1d-188.dat	upx
behavioral1/files/0x0006000000016c42-184.dat	upx
behavioral1/files/0x000600000001654a-167.dat	upx
behavioral1/files/0x0006000000016c8c-189.dat	upx
behavioral1/files/0x00060000000162c9-165.dat	upx
behavioral1/files/0x00060000000160cc-163.dat	upx
behavioral1/files/0x0006000000016c3a-181.dat	upx
behavioral1/files/0x0006000000015d44-109.dat	upx
behavioral1/files/0x00060000000165f0-157.dat	upx
behavioral1/files/0x0006000000015fa7-130.dat	upx
behavioral1/files/0x00360000000149e1-100.dat	upx
behavioral1/memory/2960-90-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	upx
behavioral1/files/0x0006000000015d0c-95.dat	upx
behavioral1/files/0x0006000000015cd9-84.dat	upx
behavioral1/memory/1996-83-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/files/0x0006000000015ce3-80.dat	upx
behavioral1/memory/2836-72-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/files/0x0007000000015cbd-59.dat	upx
behavioral1/memory/2080-61-0x000000013F540000-0x000000013F932000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VLdbqBf.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\gdPcsIh.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\wLlLuYF.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\TZKDlDk.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\EdFTJZv.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\rFdEMQD.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\tlucDhR.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\BJdKoib.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\lXxWkUl.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\IHtWCBN.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\qQyVgVS.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\LkUIeuS.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\GifXlxO.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\CdjLpKI.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\XdmNJvl.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\AWqWFXy.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\UnQZBej.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\sDhluTX.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\RkCAIBr.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\acmpMTc.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\aDMKsxH.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\kewVRWj.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\vzXJSgB.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\deraBzS.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\gbccSIA.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\GRIQODq.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\SpadCjY.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\HGywnRr.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\wHtCFPr.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\NIvbXJh.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\HuFqazJ.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\BTwAqFQ.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\ZdbFxUl.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\EObYJio.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\WMSrPEz.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\BskbMDk.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\FgXmpYm.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\uCXcXCw.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\NqtBrTw.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\AMoyGxT.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\bGcBSTh.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\MDbmXPB.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\esYkvrQ.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\wXqimKu.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\uBIBOdV.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\EfpdPzl.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\sKoMkEx.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\bclnPkJ.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\ioNOEDC.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\qJUiNol.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\nUOACBQ.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\FlnnbjA.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\rtEDXuv.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\WvQKwvn.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\RwVhbYh.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\nyBgmwB.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\FNRMULK.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\iRvvyYw.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\szGvVIm.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\XvdBwHe.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\BjAypoI.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\BjeKUzZ.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\ZNoiPFe.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
File created	C:\Windows\System\kbnNJqv.exe	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1300	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
Token: SeDebugPrivilege	1300	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1300	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	29
PID 1996 wrote to memory of 1300	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	29
PID 1996 wrote to memory of 1300	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	29
PID 1996 wrote to memory of 2052	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	30
PID 1996 wrote to memory of 2052	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	30
PID 1996 wrote to memory of 2052	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	30
PID 1996 wrote to memory of 2176	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	31
PID 1996 wrote to memory of 2176	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	31
PID 1996 wrote to memory of 2176	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	31
PID 1996 wrote to memory of 2636	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	32
PID 1996 wrote to memory of 2636	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	32
PID 1996 wrote to memory of 2636	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	32
PID 1996 wrote to memory of 2716	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	33
PID 1996 wrote to memory of 2716	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	33
PID 1996 wrote to memory of 2716	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	33
PID 1996 wrote to memory of 1772	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	34
PID 1996 wrote to memory of 1772	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	34
PID 1996 wrote to memory of 1772	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	34
PID 1996 wrote to memory of 2460	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	35
PID 1996 wrote to memory of 2460	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	35
PID 1996 wrote to memory of 2460	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	35
PID 1996 wrote to memory of 2512	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	36
PID 1996 wrote to memory of 2512	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	36
PID 1996 wrote to memory of 2512	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	36
PID 1996 wrote to memory of 2080	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	37
PID 1996 wrote to memory of 2080	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	37
PID 1996 wrote to memory of 2080	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	37
PID 1996 wrote to memory of 2836	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	38
PID 1996 wrote to memory of 2836	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	38
PID 1996 wrote to memory of 2836	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	38
PID 1996 wrote to memory of 2960	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	39
PID 1996 wrote to memory of 2960	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	39
PID 1996 wrote to memory of 2960	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	39
PID 1996 wrote to memory of 2948	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	40
PID 1996 wrote to memory of 2948	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	40
PID 1996 wrote to memory of 2948	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	40
PID 1996 wrote to memory of 2656	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	41
PID 1996 wrote to memory of 2656	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	41
PID 1996 wrote to memory of 2656	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	41
PID 1996 wrote to memory of 2028	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	42
PID 1996 wrote to memory of 2028	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	42
PID 1996 wrote to memory of 2028	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	42
PID 1996 wrote to memory of 2188	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	43
PID 1996 wrote to memory of 2188	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	43
PID 1996 wrote to memory of 2188	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	43
PID 1996 wrote to memory of 2508	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	44
PID 1996 wrote to memory of 2508	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	44
PID 1996 wrote to memory of 2508	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	44
PID 1996 wrote to memory of 2660	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	45
PID 1996 wrote to memory of 2660	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	45
PID 1996 wrote to memory of 2660	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	45
PID 1996 wrote to memory of 2848	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	46
PID 1996 wrote to memory of 2848	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	46
PID 1996 wrote to memory of 2848	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	46
PID 1996 wrote to memory of 2340	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	47
PID 1996 wrote to memory of 2340	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	47
PID 1996 wrote to memory of 2340	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	47
PID 1996 wrote to memory of 1600	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	48
PID 1996 wrote to memory of 1600	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	48
PID 1996 wrote to memory of 1600	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	48
PID 1996 wrote to memory of 1704	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	49
PID 1996 wrote to memory of 1704	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	49
PID 1996 wrote to memory of 1704	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	49
PID 1996 wrote to memory of 2072	1996	0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0e49e4513023425096cd7b12abdf3d9e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1300
- C:\Windows\System\hEGlflZ.exe
  C:\Windows\System\hEGlflZ.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\annLzLC.exe
  C:\Windows\System\annLzLC.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\wlrnoel.exe
  C:\Windows\System\wlrnoel.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\mRAjHJV.exe
  C:\Windows\System\mRAjHJV.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\Unknhzm.exe
  C:\Windows\System\Unknhzm.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\KpykCYT.exe
  C:\Windows\System\KpykCYT.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\BEcsMFA.exe
  C:\Windows\System\BEcsMFA.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\ErBsAdP.exe
  C:\Windows\System\ErBsAdP.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\IKuLNWh.exe
  C:\Windows\System\IKuLNWh.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\bNWGcyk.exe
  C:\Windows\System\bNWGcyk.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\lZvgRky.exe
  C:\Windows\System\lZvgRky.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\OyrXwpV.exe
  C:\Windows\System\OyrXwpV.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\swXPRBK.exe
  C:\Windows\System\swXPRBK.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\RRUQFHp.exe
  C:\Windows\System\RRUQFHp.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\jZyFxvq.exe
  C:\Windows\System\jZyFxvq.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\ZQjmMfL.exe
  C:\Windows\System\ZQjmMfL.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\EqiCigb.exe
  C:\Windows\System\EqiCigb.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\EikTMAp.exe
  C:\Windows\System\EikTMAp.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\GBEBYTO.exe
  C:\Windows\System\GBEBYTO.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\GcjOkcK.exe
  C:\Windows\System\GcjOkcK.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\pMENtiE.exe
  C:\Windows\System\pMENtiE.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\EqiMjoB.exe
  C:\Windows\System\EqiMjoB.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\LoTwCuW.exe
  C:\Windows\System\LoTwCuW.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\vbnelMp.exe
  C:\Windows\System\vbnelMp.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\FBsXiqg.exe
  C:\Windows\System\FBsXiqg.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\kosikVO.exe
  C:\Windows\System\kosikVO.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\nPkMvhC.exe
  C:\Windows\System\nPkMvhC.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\rBHrVOa.exe
  C:\Windows\System\rBHrVOa.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\rbpHaMO.exe
  C:\Windows\System\rbpHaMO.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\rkWNLZY.exe
  C:\Windows\System\rkWNLZY.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\GsTClWU.exe
  C:\Windows\System\GsTClWU.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\DNAycyE.exe
  C:\Windows\System\DNAycyE.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\zTdNvga.exe
  C:\Windows\System\zTdNvga.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\UCiLHKK.exe
  C:\Windows\System\UCiLHKK.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\eVerpkl.exe
  C:\Windows\System\eVerpkl.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\ASjmHYf.exe
  C:\Windows\System\ASjmHYf.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\Mfntnhy.exe
  C:\Windows\System\Mfntnhy.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\iygdmQb.exe
  C:\Windows\System\iygdmQb.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\DcXkNUD.exe
  C:\Windows\System\DcXkNUD.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\XdpeMxB.exe
  C:\Windows\System\XdpeMxB.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\naNdyrj.exe
  C:\Windows\System\naNdyrj.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\fEywqIs.exe
  C:\Windows\System\fEywqIs.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\kwFtdtf.exe
  C:\Windows\System\kwFtdtf.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\lWMlZOS.exe
  C:\Windows\System\lWMlZOS.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\BQxEeBx.exe
  C:\Windows\System\BQxEeBx.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\GSTmEwP.exe
  C:\Windows\System\GSTmEwP.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\LGDPpJI.exe
  C:\Windows\System\LGDPpJI.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\acmpMTc.exe
  C:\Windows\System\acmpMTc.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\BbYPpmE.exe
  C:\Windows\System\BbYPpmE.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\KzwRLZE.exe
  C:\Windows\System\KzwRLZE.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\VBichDG.exe
  C:\Windows\System\VBichDG.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\oCqysPK.exe
  C:\Windows\System\oCqysPK.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\ZaRAARY.exe
  C:\Windows\System\ZaRAARY.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\qWXGTuR.exe
  C:\Windows\System\qWXGTuR.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\SRjRJMd.exe
  C:\Windows\System\SRjRJMd.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\NzDalZy.exe
  C:\Windows\System\NzDalZy.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\oHaPXkL.exe
  C:\Windows\System\oHaPXkL.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\TNWAKja.exe
  C:\Windows\System\TNWAKja.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\myQBXrL.exe
  C:\Windows\System\myQBXrL.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\hnTEuII.exe
  C:\Windows\System\hnTEuII.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\jCEJryD.exe
  C:\Windows\System\jCEJryD.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\ihSYANS.exe
  C:\Windows\System\ihSYANS.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\GrewoSD.exe
  C:\Windows\System\GrewoSD.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\lXxWkUl.exe
  C:\Windows\System\lXxWkUl.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\wpvbaBF.exe
  C:\Windows\System\wpvbaBF.exe
  2⤵
  PID:2144
- C:\Windows\System\CmFImCq.exe
  C:\Windows\System\CmFImCq.exe
  2⤵
  PID:2892
- C:\Windows\System\bDVoKKU.exe
  C:\Windows\System\bDVoKKU.exe
  2⤵
  PID:1988
- C:\Windows\System\RbVlqxd.exe
  C:\Windows\System\RbVlqxd.exe
  2⤵
  PID:2000
- C:\Windows\System\acPPsLE.exe
  C:\Windows\System\acPPsLE.exe
  2⤵
  PID:2516
- C:\Windows\System\YdAYPRV.exe
  C:\Windows\System\YdAYPRV.exe
  2⤵
  PID:2920
- C:\Windows\System\nPzYdAf.exe
  C:\Windows\System\nPzYdAf.exe
  2⤵
  PID:2980
- C:\Windows\System\IytTGDQ.exe
  C:\Windows\System\IytTGDQ.exe
  2⤵
  PID:896
- C:\Windows\System\GfkZYyk.exe
  C:\Windows\System\GfkZYyk.exe
  2⤵
  PID:2544
- C:\Windows\System\TGfLCbV.exe
  C:\Windows\System\TGfLCbV.exe
  2⤵
  PID:1604
- C:\Windows\System\VjtpwOX.exe
  C:\Windows\System\VjtpwOX.exe
  2⤵
  PID:1820
- C:\Windows\System\WYjzgAF.exe
  C:\Windows\System\WYjzgAF.exe
  2⤵
  PID:1808
- C:\Windows\System\mWthPmu.exe
  C:\Windows\System\mWthPmu.exe
  2⤵
  PID:2148
- C:\Windows\System\gHemknp.exe
  C:\Windows\System\gHemknp.exe
  2⤵
  PID:1576
- C:\Windows\System\dnIlOrr.exe
  C:\Windows\System\dnIlOrr.exe
  2⤵
  PID:308
- C:\Windows\System\PzxmFBA.exe
  C:\Windows\System\PzxmFBA.exe
  2⤵
  PID:2292
- C:\Windows\System\KLinSbr.exe
  C:\Windows\System\KLinSbr.exe
  2⤵
  PID:1152
- C:\Windows\System\VPuBrFx.exe
  C:\Windows\System\VPuBrFx.exe
  2⤵
  PID:2396
- C:\Windows\System\swtxxif.exe
  C:\Windows\System\swtxxif.exe
  2⤵
  PID:1740
- C:\Windows\System\ClypSOI.exe
  C:\Windows\System\ClypSOI.exe
  2⤵
  PID:1976
- C:\Windows\System\abtBbmF.exe
  C:\Windows\System\abtBbmF.exe
  2⤵
  PID:1800
- C:\Windows\System\SCAfJsD.exe
  C:\Windows\System\SCAfJsD.exe
  2⤵
  PID:2308
- C:\Windows\System\hayTsdL.exe
  C:\Windows\System\hayTsdL.exe
  2⤵
  PID:928
- C:\Windows\System\ntbCAHm.exe
  C:\Windows\System\ntbCAHm.exe
  2⤵
  PID:2328
- C:\Windows\System\EXRXviM.exe
  C:\Windows\System\EXRXviM.exe
  2⤵
  PID:880
- C:\Windows\System\smaBHZI.exe
  C:\Windows\System\smaBHZI.exe
  2⤵
  PID:2944
- C:\Windows\System\UwzvNag.exe
  C:\Windows\System\UwzvNag.exe
  2⤵
  PID:908
- C:\Windows\System\rAXDTlD.exe
  C:\Windows\System\rAXDTlD.exe
  2⤵
  PID:2248
- C:\Windows\System\RtryxGq.exe
  C:\Windows\System\RtryxGq.exe
  2⤵
  PID:2648
- C:\Windows\System\zIbnAgx.exe
  C:\Windows\System\zIbnAgx.exe
  2⤵
  PID:2492
- C:\Windows\System\EKDMWpQ.exe
  C:\Windows\System\EKDMWpQ.exe
  2⤵
  PID:2480
- C:\Windows\System\VyNCEoE.exe
  C:\Windows\System\VyNCEoE.exe
  2⤵
  PID:1768
- C:\Windows\System\beCSyMf.exe
  C:\Windows\System\beCSyMf.exe
  2⤵
  PID:1668
- C:\Windows\System\QMaYlmI.exe
  C:\Windows\System\QMaYlmI.exe
  2⤵
  PID:2724
- C:\Windows\System\ozmtokW.exe
  C:\Windows\System\ozmtokW.exe
  2⤵
  PID:3052
- C:\Windows\System\prWndsR.exe
  C:\Windows\System\prWndsR.exe
  2⤵
  PID:2580
- C:\Windows\System\bStznkl.exe
  C:\Windows\System\bStznkl.exe
  2⤵
  PID:1008
- C:\Windows\System\dkfFCYW.exe
  C:\Windows\System\dkfFCYW.exe
  2⤵
  PID:2568
- C:\Windows\System\htpEqBC.exe
  C:\Windows\System\htpEqBC.exe
  2⤵
  PID:2424
- C:\Windows\System\uTbpqrw.exe
  C:\Windows\System\uTbpqrw.exe
  2⤵
  PID:1168
- C:\Windows\System\wLlLuYF.exe
  C:\Windows\System\wLlLuYF.exe
  2⤵
  PID:2824
- C:\Windows\System\PnzPeEJ.exe
  C:\Windows\System\PnzPeEJ.exe
  2⤵
  PID:1252
- C:\Windows\System\JPjIqad.exe
  C:\Windows\System\JPjIqad.exe
  2⤵
  PID:3028
- C:\Windows\System\YQeWaLu.exe
  C:\Windows\System\YQeWaLu.exe
  2⤵
  PID:1560
- C:\Windows\System\GvUThyf.exe
  C:\Windows\System\GvUThyf.exe
  2⤵
  PID:584
- C:\Windows\System\txzNYEq.exe
  C:\Windows\System\txzNYEq.exe
  2⤵
  PID:1040
- C:\Windows\System\byljtFS.exe
  C:\Windows\System\byljtFS.exe
  2⤵
  PID:2692
- C:\Windows\System\BZoguTx.exe
  C:\Windows\System\BZoguTx.exe
  2⤵
  PID:968
- C:\Windows\System\lTtmApu.exe
  C:\Windows\System\lTtmApu.exe
  2⤵
  PID:2448
- C:\Windows\System\pfgriiH.exe
  C:\Windows\System\pfgriiH.exe
  2⤵
  PID:2180
- C:\Windows\System\tcUxTXq.exe
  C:\Windows\System\tcUxTXq.exe
  2⤵
  PID:964
- C:\Windows\System\OianVsW.exe
  C:\Windows\System\OianVsW.exe
  2⤵
  PID:2276
- C:\Windows\System\AHiWUMm.exe
  C:\Windows\System\AHiWUMm.exe
  2⤵
  PID:2556
- C:\Windows\System\dstsnZp.exe
  C:\Windows\System\dstsnZp.exe
  2⤵
  PID:2992
- C:\Windows\System\AeMprtc.exe
  C:\Windows\System\AeMprtc.exe
  2⤵
  PID:2672
- C:\Windows\System\pkFaTVG.exe
  C:\Windows\System\pkFaTVG.exe
  2⤵
  PID:1524
- C:\Windows\System\mhFYcBa.exe
  C:\Windows\System\mhFYcBa.exe
  2⤵
  PID:2468
- C:\Windows\System\wvLxEaQ.exe
  C:\Windows\System\wvLxEaQ.exe
  2⤵
  PID:2608
- C:\Windows\System\fpmCPRq.exe
  C:\Windows\System\fpmCPRq.exe
  2⤵
  PID:1100
- C:\Windows\System\VyeBYNh.exe
  C:\Windows\System\VyeBYNh.exe
  2⤵
  PID:692
- C:\Windows\System\kPeRuNS.exe
  C:\Windows\System\kPeRuNS.exe
  2⤵
  PID:2988
- C:\Windows\System\CVGXVFR.exe
  C:\Windows\System\CVGXVFR.exe
  2⤵
  PID:2804
- C:\Windows\System\qonWMGI.exe
  C:\Windows\System\qonWMGI.exe
  2⤵
  PID:2524
- C:\Windows\System\cKyFDQS.exe
  C:\Windows\System\cKyFDQS.exe
  2⤵
  PID:1436
- C:\Windows\System\WewvwVo.exe
  C:\Windows\System\WewvwVo.exe
  2⤵
  PID:2268
- C:\Windows\System\sfyZEma.exe
  C:\Windows\System\sfyZEma.exe
  2⤵
  PID:1204
- C:\Windows\System\URKpxHz.exe
  C:\Windows\System\URKpxHz.exe
  2⤵
  PID:560
- C:\Windows\System\wnIZANM.exe
  C:\Windows\System\wnIZANM.exe
  2⤵
  PID:1308
- C:\Windows\System\eFUbOUH.exe
  C:\Windows\System\eFUbOUH.exe
  2⤵
  PID:1892
- C:\Windows\System\xmPfNhe.exe
  C:\Windows\System\xmPfNhe.exe
  2⤵
  PID:2120
- C:\Windows\System\wUDdvDS.exe
  C:\Windows\System\wUDdvDS.exe
  2⤵
  PID:1608
- C:\Windows\System\WoIFkpS.exe
  C:\Windows\System\WoIFkpS.exe
  2⤵
  PID:2600
- C:\Windows\System\PkNIgxi.exe
  C:\Windows\System\PkNIgxi.exe
  2⤵
  PID:320
- C:\Windows\System\cXuknWK.exe
  C:\Windows\System\cXuknWK.exe
  2⤵
  PID:2816
- C:\Windows\System\GjmWvBp.exe
  C:\Windows\System\GjmWvBp.exe
  2⤵
  PID:1096
- C:\Windows\System\EnXeCyY.exe
  C:\Windows\System\EnXeCyY.exe
  2⤵
  PID:2112
- C:\Windows\System\NwaMqsr.exe
  C:\Windows\System\NwaMqsr.exe
  2⤵
  PID:1004
- C:\Windows\System\aDMKsxH.exe
  C:\Windows\System\aDMKsxH.exe
  2⤵
  PID:1504
- C:\Windows\System\HyOYtDd.exe
  C:\Windows\System\HyOYtDd.exe
  2⤵
  PID:2912
- C:\Windows\System\AWqWFXy.exe
  C:\Windows\System\AWqWFXy.exe
  2⤵
  PID:848
- C:\Windows\System\lYrqwud.exe
  C:\Windows\System\lYrqwud.exe
  2⤵
  PID:2632
- C:\Windows\System\XziDrSt.exe
  C:\Windows\System\XziDrSt.exe
  2⤵
  PID:2060
- C:\Windows\System\nfDifih.exe
  C:\Windows\System\nfDifih.exe
  2⤵
  PID:2680
- C:\Windows\System\vnulCak.exe
  C:\Windows\System\vnulCak.exe
  2⤵
  PID:1952
- C:\Windows\System\SpadCjY.exe
  C:\Windows\System\SpadCjY.exe
  2⤵
  PID:1248
- C:\Windows\System\KTKsrLD.exe
  C:\Windows\System\KTKsrLD.exe
  2⤵
  PID:2104
- C:\Windows\System\vEqYfEl.exe
  C:\Windows\System\vEqYfEl.exe
  2⤵
  PID:1108
- C:\Windows\System\NqtBrTw.exe
  C:\Windows\System\NqtBrTw.exe
  2⤵
  PID:2668
- C:\Windows\System\aabqlRa.exe
  C:\Windows\System\aabqlRa.exe
  2⤵
  PID:1620
- C:\Windows\System\PmOIHaK.exe
  C:\Windows\System\PmOIHaK.exe
  2⤵
  PID:3012
- C:\Windows\System\jkBSKzH.exe
  C:\Windows\System\jkBSKzH.exe
  2⤵
  PID:768
- C:\Windows\System\jJbxCjC.exe
  C:\Windows\System\jJbxCjC.exe
  2⤵
  PID:2832
- C:\Windows\System\BhDOwNH.exe
  C:\Windows\System\BhDOwNH.exe
  2⤵
  PID:1544
- C:\Windows\System\TZKDlDk.exe
  C:\Windows\System\TZKDlDk.exe
  2⤵
  PID:2032
- C:\Windows\System\mNkamsW.exe
  C:\Windows\System\mNkamsW.exe
  2⤵
  PID:820
- C:\Windows\System\tnIuIDp.exe
  C:\Windows\System\tnIuIDp.exe
  2⤵
  PID:2768
- C:\Windows\System\PiwimgU.exe
  C:\Windows\System\PiwimgU.exe
  2⤵
  PID:2344
- C:\Windows\System\wdEBfnL.exe
  C:\Windows\System\wdEBfnL.exe
  2⤵
  PID:2688
- C:\Windows\System\AZJCGmw.exe
  C:\Windows\System\AZJCGmw.exe
  2⤵
  PID:2152
- C:\Windows\System\VSsWZjB.exe
  C:\Windows\System\VSsWZjB.exe
  2⤵
  PID:2776
- C:\Windows\System\IMKxgos.exe
  C:\Windows\System\IMKxgos.exe
  2⤵
  PID:3020
- C:\Windows\System\DfqSXQE.exe
  C:\Windows\System\DfqSXQE.exe
  2⤵
  PID:1284
- C:\Windows\System\qifjVGr.exe
  C:\Windows\System\qifjVGr.exe
  2⤵
  PID:1764
- C:\Windows\System\Hhnkjik.exe
  C:\Windows\System\Hhnkjik.exe
  2⤵
  PID:1644
- C:\Windows\System\pKBnXtm.exe
  C:\Windows\System\pKBnXtm.exe
  2⤵
  PID:592
- C:\Windows\System\xhhiFRT.exe
  C:\Windows\System\xhhiFRT.exe
  2⤵
  PID:1784
- C:\Windows\System\DxfPTrL.exe
  C:\Windows\System\DxfPTrL.exe
  2⤵
  PID:1092
- C:\Windows\System\rQdKBuo.exe
  C:\Windows\System\rQdKBuo.exe
  2⤵
  PID:2976
- C:\Windows\System\AgKKjlq.exe
  C:\Windows\System\AgKKjlq.exe
  2⤵
  PID:1936
- C:\Windows\System\nhAeVcg.exe
  C:\Windows\System\nhAeVcg.exe
  2⤵
  PID:2628
- C:\Windows\System\LXPtSxa.exe
  C:\Windows\System\LXPtSxa.exe
  2⤵
  PID:2444
- C:\Windows\System\uukOJVv.exe
  C:\Windows\System\uukOJVv.exe
  2⤵
  PID:1712
- C:\Windows\System\dLtMxjm.exe
  C:\Windows\System\dLtMxjm.exe
  2⤵
  PID:2280
- C:\Windows\System\WndFpBR.exe
  C:\Windows\System\WndFpBR.exe
  2⤵
  PID:2296
- C:\Windows\System\fSUZEYm.exe
  C:\Windows\System\fSUZEYm.exe
  2⤵
  PID:1444
- C:\Windows\System\teKbQMw.exe
  C:\Windows\System\teKbQMw.exe
  2⤵
  PID:2888
- C:\Windows\System\kfZAEIJ.exe
  C:\Windows\System\kfZAEIJ.exe
  2⤵
  PID:2304
- C:\Windows\System\IwkEBUy.exe
  C:\Windows\System\IwkEBUy.exe
  2⤵
  PID:3080
- C:\Windows\System\GBCnMpu.exe
  C:\Windows\System\GBCnMpu.exe
  2⤵
  PID:3096
- C:\Windows\System\OJZhaZC.exe
  C:\Windows\System\OJZhaZC.exe
  2⤵
  PID:3136
- C:\Windows\System\bJKYLVY.exe
  C:\Windows\System\bJKYLVY.exe
  2⤵
  PID:3152
- C:\Windows\System\kemzhdW.exe
  C:\Windows\System\kemzhdW.exe
  2⤵
  PID:3168
- C:\Windows\System\rTXwWJV.exe
  C:\Windows\System\rTXwWJV.exe
  2⤵
  PID:3184
- C:\Windows\System\ljMgQQE.exe
  C:\Windows\System\ljMgQQE.exe
  2⤵
  PID:3200
- C:\Windows\System\fbYVJZV.exe
  C:\Windows\System\fbYVJZV.exe
  2⤵
  PID:3216
- C:\Windows\System\hLDXMZA.exe
  C:\Windows\System\hLDXMZA.exe
  2⤵
  PID:3232
- C:\Windows\System\luUeugz.exe
  C:\Windows\System\luUeugz.exe
  2⤵
  PID:3248
- C:\Windows\System\oQFLxxf.exe
  C:\Windows\System\oQFLxxf.exe
  2⤵
  PID:3264
- C:\Windows\System\MJayDAe.exe
  C:\Windows\System\MJayDAe.exe
  2⤵
  PID:3284
- C:\Windows\System\koRmyQL.exe
  C:\Windows\System\koRmyQL.exe
  2⤵
  PID:3300
- C:\Windows\System\LeeTLNA.exe
  C:\Windows\System\LeeTLNA.exe
  2⤵
  PID:3316
- C:\Windows\System\ecPkWPt.exe
  C:\Windows\System\ecPkWPt.exe
  2⤵
  PID:3332
- C:\Windows\System\QgVTgqr.exe
  C:\Windows\System\QgVTgqr.exe
  2⤵
  PID:3348
- C:\Windows\System\VYTPxtR.exe
  C:\Windows\System\VYTPxtR.exe
  2⤵
  PID:3364
- C:\Windows\System\dqbtaFa.exe
  C:\Windows\System\dqbtaFa.exe
  2⤵
  PID:3380
- C:\Windows\System\xuKoJpw.exe
  C:\Windows\System\xuKoJpw.exe
  2⤵
  PID:3396
- C:\Windows\System\brAVPnC.exe
  C:\Windows\System\brAVPnC.exe
  2⤵
  PID:3412
- C:\Windows\System\ubcyYes.exe
  C:\Windows\System\ubcyYes.exe
  2⤵
  PID:3428
- C:\Windows\System\RPaLCJz.exe
  C:\Windows\System\RPaLCJz.exe
  2⤵
  PID:3444
- C:\Windows\System\znsTlbm.exe
  C:\Windows\System\znsTlbm.exe
  2⤵
  PID:3460
- C:\Windows\System\SCBbvzM.exe
  C:\Windows\System\SCBbvzM.exe
  2⤵
  PID:3476
- C:\Windows\System\sALxGzM.exe
  C:\Windows\System\sALxGzM.exe
  2⤵
  PID:3496
- C:\Windows\System\kewVRWj.exe
  C:\Windows\System\kewVRWj.exe
  2⤵
  PID:3512
- C:\Windows\System\ZciblHI.exe
  C:\Windows\System\ZciblHI.exe
  2⤵
  PID:3528
- C:\Windows\System\eIATvEf.exe
  C:\Windows\System\eIATvEf.exe
  2⤵
  PID:3544
- C:\Windows\System\PTtJOBL.exe
  C:\Windows\System\PTtJOBL.exe
  2⤵
  PID:3560
- C:\Windows\System\gFBCEoX.exe
  C:\Windows\System\gFBCEoX.exe
  2⤵
  PID:3576
- C:\Windows\System\HGywnRr.exe
  C:\Windows\System\HGywnRr.exe
  2⤵
  PID:3592
- C:\Windows\System\fPURkKP.exe
  C:\Windows\System\fPURkKP.exe
  2⤵
  PID:3608
- C:\Windows\System\vONvkRC.exe
  C:\Windows\System\vONvkRC.exe
  2⤵
  PID:3628
- C:\Windows\System\NDmIAKn.exe
  C:\Windows\System\NDmIAKn.exe
  2⤵
  PID:3644
- C:\Windows\System\hivxRIK.exe
  C:\Windows\System\hivxRIK.exe
  2⤵
  PID:3660
- C:\Windows\System\zWlXYyf.exe
  C:\Windows\System\zWlXYyf.exe
  2⤵
  PID:3676
- C:\Windows\System\nyBgmwB.exe
  C:\Windows\System\nyBgmwB.exe
  2⤵
  PID:3692
- C:\Windows\System\zEdCylH.exe
  C:\Windows\System\zEdCylH.exe
  2⤵
  PID:3708
- C:\Windows\System\aiJljIh.exe
  C:\Windows\System\aiJljIh.exe
  2⤵
  PID:3728
- C:\Windows\System\GROmvqE.exe
  C:\Windows\System\GROmvqE.exe
  2⤵
  PID:3848
- C:\Windows\System\KrlFdYN.exe
  C:\Windows\System\KrlFdYN.exe
  2⤵
  PID:3864
- C:\Windows\System\kFCxSOL.exe
  C:\Windows\System\kFCxSOL.exe
  2⤵
  PID:3880
- C:\Windows\System\OzbLUnf.exe
  C:\Windows\System\OzbLUnf.exe
  2⤵
  PID:3896
- C:\Windows\System\HfifIaH.exe
  C:\Windows\System\HfifIaH.exe
  2⤵
  PID:3912
- C:\Windows\System\nxZjpZO.exe
  C:\Windows\System\nxZjpZO.exe
  2⤵
  PID:3928
- C:\Windows\System\phCrkcK.exe
  C:\Windows\System\phCrkcK.exe
  2⤵
  PID:3944
- C:\Windows\System\NNMzLFE.exe
  C:\Windows\System\NNMzLFE.exe
  2⤵
  PID:3960
- C:\Windows\System\qdhYMYU.exe
  C:\Windows\System\qdhYMYU.exe
  2⤵
  PID:3976
- C:\Windows\System\qQKGerV.exe
  C:\Windows\System\qQKGerV.exe
  2⤵
  PID:3992
- C:\Windows\System\aRxgepX.exe
  C:\Windows\System\aRxgepX.exe
  2⤵
  PID:4008
- C:\Windows\System\ZOOqYzt.exe
  C:\Windows\System\ZOOqYzt.exe
  2⤵
  PID:4024
- C:\Windows\System\tRRqqEO.exe
  C:\Windows\System\tRRqqEO.exe
  2⤵
  PID:4040
- C:\Windows\System\ITLOssF.exe
  C:\Windows\System\ITLOssF.exe
  2⤵
  PID:4056
- C:\Windows\System\fiuysOJ.exe
  C:\Windows\System\fiuysOJ.exe
  2⤵
  PID:4076
- C:\Windows\System\lcwYZtF.exe
  C:\Windows\System\lcwYZtF.exe
  2⤵
  PID:1532
- C:\Windows\System\stzdwdZ.exe
  C:\Windows\System\stzdwdZ.exe
  2⤵
  PID:3088
- C:\Windows\System\dnNCQLQ.exe
  C:\Windows\System\dnNCQLQ.exe
  2⤵
  PID:3148
- C:\Windows\System\fKigyfs.exe
  C:\Windows\System\fKigyfs.exe
  2⤵
  PID:2484
- C:\Windows\System\RtXdWzG.exe
  C:\Windows\System\RtXdWzG.exe
  2⤵
  PID:3212
- C:\Windows\System\hZbQzkk.exe
  C:\Windows\System\hZbQzkk.exe
  2⤵
  PID:3280
- C:\Windows\System\NmubIUJ.exe
  C:\Windows\System\NmubIUJ.exe
  2⤵
  PID:3108
- C:\Windows\System\vbCmFmi.exe
  C:\Windows\System\vbCmFmi.exe
  2⤵
  PID:3120
- C:\Windows\System\nYOhEfM.exe
  C:\Windows\System\nYOhEfM.exe
  2⤵
  PID:3404
- C:\Windows\System\uSHWAtV.exe
  C:\Windows\System\uSHWAtV.exe
  2⤵
  PID:3508
- C:\Windows\System\SlHGEOr.exe
  C:\Windows\System\SlHGEOr.exe
  2⤵
  PID:3128
- C:\Windows\System\EdFTJZv.exe
  C:\Windows\System\EdFTJZv.exe
  2⤵
  PID:3132
- C:\Windows\System\QsvRsTW.exe
  C:\Windows\System\QsvRsTW.exe
  2⤵
  PID:3228
- C:\Windows\System\JtWSgdU.exe
  C:\Windows\System\JtWSgdU.exe
  2⤵
  PID:3296
- C:\Windows\System\UzMgaKe.exe
  C:\Windows\System\UzMgaKe.exe
  2⤵
  PID:3360
- C:\Windows\System\wgnNgOh.exe
  C:\Windows\System\wgnNgOh.exe
  2⤵
  PID:3424
- C:\Windows\System\ENcNGTR.exe
  C:\Windows\System\ENcNGTR.exe
  2⤵
  PID:3488
- C:\Windows\System\zrMFXKo.exe
  C:\Windows\System\zrMFXKo.exe
  2⤵
  PID:3552
- C:\Windows\System\sWobgEE.exe
  C:\Windows\System\sWobgEE.exe
  2⤵
  PID:3652
- C:\Windows\System\RkalWpq.exe
  C:\Windows\System\RkalWpq.exe
  2⤵
  PID:3716
- C:\Windows\System\WOqWnsx.exe
  C:\Windows\System\WOqWnsx.exe
  2⤵
  PID:3636
- C:\Windows\System\FdVacWe.exe
  C:\Windows\System\FdVacWe.exe
  2⤵
  PID:3904
- C:\Windows\System\dsTnkXJ.exe
  C:\Windows\System\dsTnkXJ.exe
  2⤵
  PID:4000
- C:\Windows\System\fiwYJwc.exe
  C:\Windows\System\fiwYJwc.exe
  2⤵
  PID:3784
- C:\Windows\System\AmvoPRx.exe
  C:\Windows\System\AmvoPRx.exe
  2⤵
  PID:3800
- C:\Windows\System\jjfPKeY.exe
  C:\Windows\System\jjfPKeY.exe
  2⤵
  PID:3820
- C:\Windows\System\JDjavvv.exe
  C:\Windows\System\JDjavvv.exe
  2⤵
  PID:2972
- C:\Windows\System\RaEPnGi.exe
  C:\Windows\System\RaEPnGi.exe
  2⤵
  PID:3312
- C:\Windows\System\OqSvyye.exe
  C:\Windows\System\OqSvyye.exe
  2⤵
  PID:3260
- C:\Windows\System\vzXJSgB.exe
  C:\Windows\System\vzXJSgB.exe
  2⤵
  PID:3684
- C:\Windows\System\CSJLRXO.exe
  C:\Windows\System\CSJLRXO.exe
  2⤵
  PID:3908
- C:\Windows\System\ORIBRie.exe
  C:\Windows\System\ORIBRie.exe
  2⤵
  PID:3748
- C:\Windows\System\BAZNGEW.exe
  C:\Windows\System\BAZNGEW.exe
  2⤵
  PID:4072
- C:\Windows\System\deraBzS.exe
  C:\Windows\System\deraBzS.exe
  2⤵
  PID:4092
- C:\Windows\System\CujlKDM.exe
  C:\Windows\System\CujlKDM.exe
  2⤵
  PID:4048
- C:\Windows\System\ujLPfwH.exe
  C:\Windows\System\ujLPfwH.exe
  2⤵
  PID:3144
- C:\Windows\System\ZBMAVwn.exe
  C:\Windows\System\ZBMAVwn.exe
  2⤵
  PID:3104
- C:\Windows\System\cIaSVJT.exe
  C:\Windows\System\cIaSVJT.exe
  2⤵
  PID:3196
- C:\Windows\System\xWrjsdU.exe
  C:\Windows\System\xWrjsdU.exe
  2⤵
  PID:3484
- C:\Windows\System\XJJvoSa.exe
  C:\Windows\System\XJJvoSa.exe
  2⤵
  PID:3624
- C:\Windows\System\DqvJKsZ.exe
  C:\Windows\System\DqvJKsZ.exe
  2⤵
  PID:3888
- C:\Windows\System\CHeFhZq.exe
  C:\Windows\System\CHeFhZq.exe
  2⤵
  PID:3772
- C:\Windows\System\DFYYOOM.exe
  C:\Windows\System\DFYYOOM.exe
  2⤵
  PID:3956
- C:\Windows\System\HILhnaH.exe
  C:\Windows\System\HILhnaH.exe
  2⤵
  PID:3292
- C:\Windows\System\fZmtOiN.exe
  C:\Windows\System\fZmtOiN.exe
  2⤵
  PID:3736
- C:\Windows\System\wHtCFPr.exe
  C:\Windows\System\wHtCFPr.exe
  2⤵
  PID:3760
- C:\Windows\System\YwqTxfl.exe
  C:\Windows\System\YwqTxfl.exe
  2⤵
  PID:3824
- C:\Windows\System\JeEVXIX.exe
  C:\Windows\System\JeEVXIX.exe
  2⤵
  PID:3836
- C:\Windows\System\dpCEtIR.exe
  C:\Windows\System\dpCEtIR.exe
  2⤵
  PID:3600
- C:\Windows\System\KIXKFTC.exe
  C:\Windows\System\KIXKFTC.exe
  2⤵
  PID:3808
- C:\Windows\System\gSRpKkh.exe
  C:\Windows\System\gSRpKkh.exe
  2⤵
  PID:4100
- C:\Windows\System\BXRmxTD.exe
  C:\Windows\System\BXRmxTD.exe
  2⤵
  PID:4116
- C:\Windows\System\ZZQsMcl.exe
  C:\Windows\System\ZZQsMcl.exe
  2⤵
  PID:4132
- C:\Windows\System\eyBXUYI.exe
  C:\Windows\System\eyBXUYI.exe
  2⤵
  PID:4152
- C:\Windows\System\zkoYfMe.exe
  C:\Windows\System\zkoYfMe.exe
  2⤵
  PID:4168
- C:\Windows\System\sBxZxsl.exe
  C:\Windows\System\sBxZxsl.exe
  2⤵
  PID:4208
- C:\Windows\System\FOgOCHJ.exe
  C:\Windows\System\FOgOCHJ.exe
  2⤵
  PID:4272
- C:\Windows\System\qdTCPaF.exe
  C:\Windows\System\qdTCPaF.exe
  2⤵
  PID:4288
- C:\Windows\System\EVfrvlM.exe
  C:\Windows\System\EVfrvlM.exe
  2⤵
  PID:4308
- C:\Windows\System\bBJnTMG.exe
  C:\Windows\System\bBJnTMG.exe
  2⤵
  PID:4324
- C:\Windows\System\tOLlloS.exe
  C:\Windows\System\tOLlloS.exe
  2⤵
  PID:4340
- C:\Windows\System\FlnnbjA.exe
  C:\Windows\System\FlnnbjA.exe
  2⤵
  PID:4356
- C:\Windows\System\BjHqLPE.exe
  C:\Windows\System\BjHqLPE.exe
  2⤵
  PID:4372
- C:\Windows\System\QicaIFx.exe
  C:\Windows\System\QicaIFx.exe
  2⤵
  PID:4388
- C:\Windows\System\DScwXjl.exe
  C:\Windows\System\DScwXjl.exe
  2⤵
  PID:4404
- C:\Windows\System\eZmoNdl.exe
  C:\Windows\System\eZmoNdl.exe
  2⤵
  PID:4420
- C:\Windows\System\vVbIkqf.exe
  C:\Windows\System\vVbIkqf.exe
  2⤵
  PID:4436
- C:\Windows\System\FdNOLRe.exe
  C:\Windows\System\FdNOLRe.exe
  2⤵
  PID:4452
- C:\Windows\System\tkZTkWR.exe
  C:\Windows\System\tkZTkWR.exe
  2⤵
  PID:4468
- C:\Windows\System\EUVfntq.exe
  C:\Windows\System\EUVfntq.exe
  2⤵
  PID:4492
- C:\Windows\System\GEhuCsN.exe
  C:\Windows\System\GEhuCsN.exe
  2⤵
  PID:4508
- C:\Windows\System\AMoyGxT.exe
  C:\Windows\System\AMoyGxT.exe
  2⤵
  PID:4524
- C:\Windows\System\cGvMOxL.exe
  C:\Windows\System\cGvMOxL.exe
  2⤵
  PID:4540
- C:\Windows\System\qDINsXc.exe
  C:\Windows\System\qDINsXc.exe
  2⤵
  PID:4556
- C:\Windows\System\EfSaVXe.exe
  C:\Windows\System\EfSaVXe.exe
  2⤵
  PID:4572
- C:\Windows\System\lGAtNzT.exe
  C:\Windows\System\lGAtNzT.exe
  2⤵
  PID:4588
- C:\Windows\System\UnQZBej.exe
  C:\Windows\System\UnQZBej.exe
  2⤵
  PID:4604
- C:\Windows\System\ufsfGPD.exe
  C:\Windows\System\ufsfGPD.exe
  2⤵
  PID:4620
- C:\Windows\System\vXFSDgW.exe
  C:\Windows\System\vXFSDgW.exe
  2⤵
  PID:4636
- C:\Windows\System\TIxiyIF.exe
  C:\Windows\System\TIxiyIF.exe
  2⤵
  PID:4720
- C:\Windows\System\foMFdVd.exe
  C:\Windows\System\foMFdVd.exe
  2⤵
  PID:4824
- C:\Windows\System\ZdbFxUl.exe
  C:\Windows\System\ZdbFxUl.exe
  2⤵
  PID:4880
- C:\Windows\System\TNrAeKY.exe
  C:\Windows\System\TNrAeKY.exe
  2⤵
  PID:4904
- C:\Windows\System\kotBbSH.exe
  C:\Windows\System\kotBbSH.exe
  2⤵
  PID:4920
- C:\Windows\System\imzhokL.exe
  C:\Windows\System\imzhokL.exe
  2⤵
  PID:4940
- C:\Windows\System\bGcBSTh.exe
  C:\Windows\System\bGcBSTh.exe
  2⤵
  PID:4956
- C:\Windows\System\wjotRSX.exe
  C:\Windows\System\wjotRSX.exe
  2⤵
  PID:4972
- C:\Windows\System\xdhOSgy.exe
  C:\Windows\System\xdhOSgy.exe
  2⤵
  PID:4988
- C:\Windows\System\BdTOdOU.exe
  C:\Windows\System\BdTOdOU.exe
  2⤵
  PID:5004
- C:\Windows\System\QQBoniJ.exe
  C:\Windows\System\QQBoniJ.exe
  2⤵
  PID:5020
- C:\Windows\System\tfgLilo.exe
  C:\Windows\System\tfgLilo.exe
  2⤵
  PID:5036
- C:\Windows\System\qSazeuM.exe
  C:\Windows\System\qSazeuM.exe
  2⤵
  PID:5052
- C:\Windows\System\NCdKGIq.exe
  C:\Windows\System\NCdKGIq.exe
  2⤵
  PID:5068
- C:\Windows\System\TQmfIpC.exe
  C:\Windows\System\TQmfIpC.exe
  2⤵
  PID:5084
- C:\Windows\System\sssRqtF.exe
  C:\Windows\System\sssRqtF.exe
  2⤵
  PID:5100
- C:\Windows\System\MLVmDgy.exe
  C:\Windows\System\MLVmDgy.exe
  2⤵
  PID:5116
- C:\Windows\System\TfketzN.exe
  C:\Windows\System\TfketzN.exe
  2⤵
  PID:3276
- C:\Windows\System\llbJGQQ.exe
  C:\Windows\System\llbJGQQ.exe
  2⤵
  PID:4088
- C:\Windows\System\olHAfvu.exe
  C:\Windows\System\olHAfvu.exe
  2⤵
  PID:3704
- C:\Windows\System\iRHkHCN.exe
  C:\Windows\System\iRHkHCN.exe
  2⤵
  PID:4144
- C:\Windows\System\aZVUceX.exe
  C:\Windows\System\aZVUceX.exe
  2⤵
  PID:3160
- C:\Windows\System\hlEvbVh.exe
  C:\Windows\System\hlEvbVh.exe
  2⤵
  PID:3440
- C:\Windows\System\QjLmSiD.exe
  C:\Windows\System\QjLmSiD.exe
  2⤵
  PID:4180
- C:\Windows\System\rlbwNmm.exe
  C:\Windows\System\rlbwNmm.exe
  2⤵
  PID:4200
- C:\Windows\System\mkkIfOe.exe
  C:\Windows\System\mkkIfOe.exe
  2⤵
  PID:4224
- C:\Windows\System\OzyJjOj.exe
  C:\Windows\System\OzyJjOj.exe
  2⤵
  PID:4416
- C:\Windows\System\mFlTOXY.exe
  C:\Windows\System\mFlTOXY.exe
  2⤵
  PID:4480
- C:\Windows\System\PhRoTGK.exe
  C:\Windows\System\PhRoTGK.exe
  2⤵
  PID:4520
- C:\Windows\System\yfFloxJ.exe
  C:\Windows\System\yfFloxJ.exe
  2⤵
  PID:4296
- C:\Windows\System\VlkLYAV.exe
  C:\Windows\System\VlkLYAV.exe
  2⤵
  PID:3952
- C:\Windows\System\weKvrgd.exe
  C:\Windows\System\weKvrgd.exe
  2⤵
  PID:4364
- C:\Windows\System\ZoelbdY.exe
  C:\Windows\System\ZoelbdY.exe
  2⤵
  PID:4428
- C:\Windows\System\IclYpUF.exe
  C:\Windows\System\IclYpUF.exe
  2⤵
  PID:4504
- C:\Windows\System\KWPKnyp.exe
  C:\Windows\System\KWPKnyp.exe
  2⤵
  PID:3816
- C:\Windows\System\PjlzwwU.exe
  C:\Windows\System\PjlzwwU.exe
  2⤵
  PID:2456
- C:\Windows\System\RFAqFnV.exe
  C:\Windows\System\RFAqFnV.exe
  2⤵
  PID:3780
- C:\Windows\System\xDDQDeo.exe
  C:\Windows\System\xDDQDeo.exe
  2⤵
  PID:3436
- C:\Windows\System\VWlRNNc.exe
  C:\Windows\System\VWlRNNc.exe
  2⤵
  PID:4648
- C:\Windows\System\orexcdL.exe
  C:\Windows\System\orexcdL.exe
  2⤵
  PID:4656
- C:\Windows\System\NIvbXJh.exe
  C:\Windows\System\NIvbXJh.exe
  2⤵
  PID:4632
- C:\Windows\System\MnsMLvR.exe
  C:\Windows\System\MnsMLvR.exe
  2⤵
  PID:4596
- C:\Windows\System\wUoMSRn.exe
  C:\Windows\System\wUoMSRn.exe
  2⤵
  PID:4676
- C:\Windows\System\RAobJmK.exe
  C:\Windows\System\RAobJmK.exe
  2⤵
  PID:4696
- C:\Windows\System\GuIjvRL.exe
  C:\Windows\System\GuIjvRL.exe
  2⤵
  PID:4752
- C:\Windows\System\KlzEhnf.exe
  C:\Windows\System\KlzEhnf.exe
  2⤵
  PID:4780
- C:\Windows\System\xXRthdc.exe
  C:\Windows\System\xXRthdc.exe
  2⤵
  PID:1708
- C:\Windows\System\kPJFJcr.exe
  C:\Windows\System\kPJFJcr.exe
  2⤵
  PID:4836
- C:\Windows\System\zhMZYSF.exe
  C:\Windows\System\zhMZYSF.exe
  2⤵
  PID:4848
- C:\Windows\System\kdEuaUf.exe
  C:\Windows\System\kdEuaUf.exe
  2⤵
  PID:4864
- C:\Windows\System\FTkrSvS.exe
  C:\Windows\System\FTkrSvS.exe
  2⤵
  PID:4892
- C:\Windows\System\wVqjGHg.exe
  C:\Windows\System\wVqjGHg.exe
  2⤵
  PID:4900
- C:\Windows\System\wqiChqm.exe
  C:\Windows\System\wqiChqm.exe
  2⤵
  PID:4968
- C:\Windows\System\jihCFzt.exe
  C:\Windows\System\jihCFzt.exe
  2⤵
  PID:5060
- C:\Windows\System\nkQPxYd.exe
  C:\Windows\System\nkQPxYd.exe
  2⤵
  PID:5096
- C:\Windows\System\IuXAUuu.exe
  C:\Windows\System\IuXAUuu.exe
  2⤵
  PID:4916
- C:\Windows\System\LHnrGJR.exe
  C:\Windows\System\LHnrGJR.exe
  2⤵
  PID:4984
- C:\Windows\System\VWFXZGB.exe
  C:\Windows\System\VWFXZGB.exe
  2⤵
  PID:5076
- C:\Windows\System\LwPzfSt.exe
  C:\Windows\System\LwPzfSt.exe
  2⤵
  PID:4188
- C:\Windows\System\GGPoYTr.exe
  C:\Windows\System\GGPoYTr.exe
  2⤵
  PID:3796
- C:\Windows\System\eEgSOdl.exe
  C:\Windows\System\eEgSOdl.exe
  2⤵
  PID:3876
- C:\Windows\System\uBIBOdV.exe
  C:\Windows\System\uBIBOdV.exe
  2⤵
  PID:3376
- C:\Windows\System\WaeFZBk.exe
  C:\Windows\System\WaeFZBk.exe
  2⤵
  PID:4192
- C:\Windows\System\PiMYvfa.exe
  C:\Windows\System\PiMYvfa.exe
  2⤵
  PID:4196
- C:\Windows\System\krakwDG.exe
  C:\Windows\System\krakwDG.exe
  2⤵
  PID:4280
- C:\Windows\System\NJwKGNc.exe
  C:\Windows\System\NJwKGNc.exe
  2⤵
  PID:2700
- C:\Windows\System\RrohTfa.exe
  C:\Windows\System\RrohTfa.exe
  2⤵
  PID:4488
- C:\Windows\System\dehbpzu.exe
  C:\Windows\System\dehbpzu.exe
  2⤵
  PID:4304
- C:\Windows\System\OVIgWhu.exe
  C:\Windows\System\OVIgWhu.exe
  2⤵
  PID:4400
- C:\Windows\System\nmazBkj.exe
  C:\Windows\System\nmazBkj.exe
  2⤵
  PID:3620
- C:\Windows\System\bcgCvAm.exe
  C:\Windows\System\bcgCvAm.exe
  2⤵
  PID:3272
- C:\Windows\System\YxTyWDi.exe
  C:\Windows\System\YxTyWDi.exe
  2⤵
  PID:4536
- C:\Windows\System\kwhkPSw.exe
  C:\Windows\System\kwhkPSw.exe
  2⤵
  PID:4628
- C:\Windows\System\WlcbBCV.exe
  C:\Windows\System\WlcbBCV.exe
  2⤵
  PID:4684
- C:\Windows\System\rFdEMQD.exe
  C:\Windows\System\rFdEMQD.exe
  2⤵
  PID:4692
- C:\Windows\System\YQSpnOr.exe
  C:\Windows\System\YQSpnOr.exe
  2⤵
  PID:4552
- C:\Windows\System\ZDAhSRZ.exe
  C:\Windows\System\ZDAhSRZ.exe
  2⤵
  PID:4796
- C:\Windows\System\BgyBize.exe
  C:\Windows\System\BgyBize.exe
  2⤵
  PID:4732
- C:\Windows\System\vaKPTYe.exe
  C:\Windows\System\vaKPTYe.exe
  2⤵
  PID:4744
- C:\Windows\System\fZmHmwZ.exe
  C:\Windows\System\fZmHmwZ.exe
  2⤵
  PID:4792
- C:\Windows\System\QsNswgi.exe
  C:\Windows\System\QsNswgi.exe
  2⤵
  PID:3844
- C:\Windows\System\sOqhRia.exe
  C:\Windows\System\sOqhRia.exe
  2⤵
  PID:4820
- C:\Windows\System\zAGlTbH.exe
  C:\Windows\System\zAGlTbH.exe
  2⤵
  PID:4936
- C:\Windows\System\NBgBWST.exe
  C:\Windows\System\NBgBWST.exe
  2⤵
  PID:4860
- C:\Windows\System\LVozEif.exe
  C:\Windows\System\LVozEif.exe
  2⤵
  PID:4844
- C:\Windows\System\lhBFLpH.exe
  C:\Windows\System\lhBFLpH.exe
  2⤵
  PID:5064
- C:\Windows\System\KoraAcq.exe
  C:\Windows\System\KoraAcq.exe
  2⤵
  PID:5028
- C:\Windows\System\FguMYsi.exe
  C:\Windows\System\FguMYsi.exe
  2⤵
  PID:4108
- C:\Windows\System\RxchVnO.exe
  C:\Windows\System\RxchVnO.exe
  2⤵
  PID:3024
- C:\Windows\System\xeGRxCZ.exe
  C:\Windows\System\xeGRxCZ.exe
  2⤵
  PID:3468
- C:\Windows\System\IxIusQA.exe
  C:\Windows\System\IxIusQA.exe
  2⤵
  PID:3076
- C:\Windows\System\mXxVvar.exe
  C:\Windows\System\mXxVvar.exe
  2⤵
  PID:4432
- C:\Windows\System\wQTOdlX.exe
  C:\Windows\System\wQTOdlX.exe
  2⤵
  PID:4748
- C:\Windows\System\KxCVtux.exe
  C:\Windows\System\KxCVtux.exe
  2⤵
  PID:4768
- C:\Windows\System\lxNjNfl.exe
  C:\Windows\System\lxNjNfl.exe
  2⤵
  PID:4568
- C:\Windows\System\QLwjFdC.exe
  C:\Windows\System\QLwjFdC.exe
  2⤵
  PID:4708
- C:\Windows\System\WNaIurV.exe
  C:\Windows\System\WNaIurV.exe
  2⤵
  PID:4704
- C:\Windows\System\mFgfrqT.exe
  C:\Windows\System\mFgfrqT.exe
  2⤵
  PID:4020
- C:\Windows\System\ZEWzlCQ.exe
  C:\Windows\System\ZEWzlCQ.exe
  2⤵
  PID:4380
- C:\Windows\System\ZAyMRva.exe
  C:\Windows\System\ZAyMRva.exe
  2⤵
  PID:4348
- C:\Windows\System\GVznzSS.exe
  C:\Windows\System\GVznzSS.exe
  2⤵
  PID:4464
- C:\Windows\System\PdlJOmX.exe
  C:\Windows\System\PdlJOmX.exe
  2⤵
  PID:4160
- C:\Windows\System\oaxBsFT.exe
  C:\Windows\System\oaxBsFT.exe
  2⤵
  PID:4776
- C:\Windows\System\wEjHwag.exe
  C:\Windows\System\wEjHwag.exe
  2⤵
  PID:4176
- C:\Windows\System\rhEhvHh.exe
  C:\Windows\System\rhEhvHh.exe
  2⤵
  PID:4816
- C:\Windows\System\LyysSzQ.exe
  C:\Windows\System\LyysSzQ.exe
  2⤵
  PID:4948
- C:\Windows\System\vPvHtRJ.exe
  C:\Windows\System\vPvHtRJ.exe
  2⤵
  PID:2372
- C:\Windows\System\mgWNkjr.exe
  C:\Windows\System\mgWNkjr.exe
  2⤵
  PID:3700
- C:\Windows\System\ycxDMCr.exe
  C:\Windows\System\ycxDMCr.exe
  2⤵
  PID:5128
- C:\Windows\System\tzaAVeC.exe
  C:\Windows\System\tzaAVeC.exe
  2⤵
  PID:5144
- C:\Windows\System\EOfeRqk.exe
  C:\Windows\System\EOfeRqk.exe
  2⤵
  PID:5164
- C:\Windows\System\oOyhrSn.exe
  C:\Windows\System\oOyhrSn.exe
  2⤵
  PID:5180
- C:\Windows\System\AIjJkEp.exe
  C:\Windows\System\AIjJkEp.exe
  2⤵
  PID:5196
- C:\Windows\System\JRlWPVE.exe
  C:\Windows\System\JRlWPVE.exe
  2⤵
  PID:5212
- C:\Windows\System\iOgerKn.exe
  C:\Windows\System\iOgerKn.exe
  2⤵
  PID:5232
- C:\Windows\System\NyVpaLo.exe
  C:\Windows\System\NyVpaLo.exe
  2⤵
  PID:5248
- C:\Windows\System\CEGAZCI.exe
  C:\Windows\System\CEGAZCI.exe
  2⤵
  PID:5264
- C:\Windows\System\vLIBVom.exe
  C:\Windows\System\vLIBVom.exe
  2⤵
  PID:5280
- C:\Windows\System\NZfdMDg.exe
  C:\Windows\System\NZfdMDg.exe
  2⤵
  PID:5296
- C:\Windows\System\fmDvaZT.exe
  C:\Windows\System\fmDvaZT.exe
  2⤵
  PID:5312
- C:\Windows\System\QCqEZDA.exe
  C:\Windows\System\QCqEZDA.exe
  2⤵
  PID:5328
- C:\Windows\System\mTgLuGF.exe
  C:\Windows\System\mTgLuGF.exe
  2⤵
  PID:5344
- C:\Windows\System\GZBeVbO.exe
  C:\Windows\System\GZBeVbO.exe
  2⤵
  PID:5360
- C:\Windows\System\LWgNkqr.exe
  C:\Windows\System\LWgNkqr.exe
  2⤵
  PID:5376
- C:\Windows\System\CQdgQlV.exe
  C:\Windows\System\CQdgQlV.exe
  2⤵
  PID:5392
- C:\Windows\System\KaHmzug.exe
  C:\Windows\System\KaHmzug.exe
  2⤵
  PID:5408
- C:\Windows\System\yGVlCes.exe
  C:\Windows\System\yGVlCes.exe
  2⤵
  PID:5424
- C:\Windows\System\EVCtHfL.exe
  C:\Windows\System\EVCtHfL.exe
  2⤵
  PID:5440
- C:\Windows\System\mJeuefA.exe
  C:\Windows\System\mJeuefA.exe
  2⤵
  PID:5456
- C:\Windows\System\DaKmwRS.exe
  C:\Windows\System\DaKmwRS.exe
  2⤵
  PID:5472
- C:\Windows\System\ukMGljz.exe
  C:\Windows\System\ukMGljz.exe
  2⤵
  PID:5488
- C:\Windows\System\jsZVybf.exe
  C:\Windows\System\jsZVybf.exe
  2⤵
  PID:5504
- C:\Windows\System\koIgjAp.exe
  C:\Windows\System\koIgjAp.exe
  2⤵
  PID:5520
- C:\Windows\System\ygzWVem.exe
  C:\Windows\System\ygzWVem.exe
  2⤵
  PID:5536
- C:\Windows\System\UMYJgPb.exe
  C:\Windows\System\UMYJgPb.exe
  2⤵
  PID:5552
- C:\Windows\System\bGtIDdm.exe
  C:\Windows\System\bGtIDdm.exe
  2⤵
  PID:5568
- C:\Windows\System\xRHaMhm.exe
  C:\Windows\System\xRHaMhm.exe
  2⤵
  PID:5584
- C:\Windows\System\bGumHVl.exe
  C:\Windows\System\bGumHVl.exe
  2⤵
  PID:5600
- C:\Windows\System\XJHdJCd.exe
  C:\Windows\System\XJHdJCd.exe
  2⤵
  PID:5616
- C:\Windows\System\PvoadWV.exe
  C:\Windows\System\PvoadWV.exe
  2⤵
  PID:5632
- C:\Windows\System\xavRlcc.exe
  C:\Windows\System\xavRlcc.exe
  2⤵
  PID:5648
- C:\Windows\System\TCHoeIO.exe
  C:\Windows\System\TCHoeIO.exe
  2⤵
  PID:5664
- C:\Windows\System\mNnwnXt.exe
  C:\Windows\System\mNnwnXt.exe
  2⤵
  PID:5680
- C:\Windows\System\tFmdWNB.exe
  C:\Windows\System\tFmdWNB.exe
  2⤵
  PID:5696
- C:\Windows\System\SMDdGUn.exe
  C:\Windows\System\SMDdGUn.exe
  2⤵
  PID:5712
- C:\Windows\System\dHGfXAq.exe
  C:\Windows\System\dHGfXAq.exe
  2⤵
  PID:5728
- C:\Windows\System\HdIoDmn.exe
  C:\Windows\System\HdIoDmn.exe
  2⤵
  PID:5744
- C:\Windows\System\mXBACIG.exe
  C:\Windows\System\mXBACIG.exe
  2⤵
  PID:5764
- C:\Windows\System\bBphnuf.exe
  C:\Windows\System\bBphnuf.exe
  2⤵
  PID:5780
- C:\Windows\System\tfrqdJY.exe
  C:\Windows\System\tfrqdJY.exe
  2⤵
  PID:5800
- C:\Windows\System\mTPIuSO.exe
  C:\Windows\System\mTPIuSO.exe
  2⤵
  PID:5816
- C:\Windows\System\vcUPZYC.exe
  C:\Windows\System\vcUPZYC.exe
  2⤵
  PID:5832
- C:\Windows\System\MfoKohv.exe
  C:\Windows\System\MfoKohv.exe
  2⤵
  PID:5848
- C:\Windows\System\kaxMVWu.exe
  C:\Windows\System\kaxMVWu.exe
  2⤵
  PID:5864
- C:\Windows\System\MjSTsrB.exe
  C:\Windows\System\MjSTsrB.exe
  2⤵
  PID:5944
- C:\Windows\System\RGnkeZt.exe
  C:\Windows\System\RGnkeZt.exe
  2⤵
  PID:5960
- C:\Windows\System\ooOmkAT.exe
  C:\Windows\System\ooOmkAT.exe
  2⤵
  PID:5976
- C:\Windows\System\xJCmdLm.exe
  C:\Windows\System\xJCmdLm.exe
  2⤵
  PID:5992
- C:\Windows\System\tlucDhR.exe
  C:\Windows\System\tlucDhR.exe
  2⤵
  PID:6008
- C:\Windows\System\rbGvjQX.exe
  C:\Windows\System\rbGvjQX.exe
  2⤵
  PID:6024
- C:\Windows\System\plloKVb.exe
  C:\Windows\System\plloKVb.exe
  2⤵
  PID:6040
- C:\Windows\System\UzDwmsc.exe
  C:\Windows\System\UzDwmsc.exe
  2⤵
  PID:6056
- C:\Windows\System\hMPnGHI.exe
  C:\Windows\System\hMPnGHI.exe
  2⤵
  PID:6072
- C:\Windows\System\afoOLcu.exe
  C:\Windows\System\afoOLcu.exe
  2⤵
  PID:6092
- C:\Windows\System\yyYXuUu.exe
  C:\Windows\System\yyYXuUu.exe
  2⤵
  PID:6108
- C:\Windows\System\vdOisqH.exe
  C:\Windows\System\vdOisqH.exe
  2⤵
  PID:6124
- C:\Windows\System\SQCbIYZ.exe
  C:\Windows\System\SQCbIYZ.exe
  2⤵
  PID:6140
- C:\Windows\System\VFiRBdm.exe
  C:\Windows\System\VFiRBdm.exe
  2⤵
  PID:4740
- C:\Windows\System\DaIPYeu.exe
  C:\Windows\System\DaIPYeu.exe
  2⤵
  PID:3456
- C:\Windows\System\qGcVeZl.exe
  C:\Windows\System\qGcVeZl.exe
  2⤵
  PID:4412
- C:\Windows\System\QoFqQrX.exe
  C:\Windows\System\QoFqQrX.exe
  2⤵
  PID:4500
- C:\Windows\System\HxshqWe.exe
  C:\Windows\System\HxshqWe.exe
  2⤵
  PID:4664
- C:\Windows\System\RTGUHCK.exe
  C:\Windows\System\RTGUHCK.exe
  2⤵
  PID:5152
- C:\Windows\System\ulMrRjs.exe
  C:\Windows\System\ulMrRjs.exe
  2⤵
  PID:5220
- C:\Windows\System\nxmBOaq.exe
  C:\Windows\System\nxmBOaq.exe
  2⤵
  PID:5260
- C:\Windows\System\eEytJtM.exe
  C:\Windows\System\eEytJtM.exe
  2⤵
  PID:5324
- C:\Windows\System\yxdpjvT.exe
  C:\Windows\System\yxdpjvT.exe
  2⤵
  PID:4124
- C:\Windows\System\yLTACoD.exe
  C:\Windows\System\yLTACoD.exe
  2⤵
  PID:5420
- C:\Windows\System\MDbmXPB.exe
  C:\Windows\System\MDbmXPB.exe
  2⤵
  PID:5484
- C:\Windows\System\ugtRTzT.exe
  C:\Windows\System\ugtRTzT.exe
  2⤵
  PID:4448
- C:\Windows\System\QLEYzZq.exe
  C:\Windows\System\QLEYzZq.exe
  2⤵
  PID:5160
- C:\Windows\System\QjRwenj.exe
  C:\Windows\System\QjRwenj.exe
  2⤵
  PID:5112
- C:\Windows\System\TjriNhd.exe
  C:\Windows\System\TjriNhd.exe
  2⤵
  PID:5276
- C:\Windows\System\ZSytHtB.exe
  C:\Windows\System\ZSytHtB.exe
  2⤵
  PID:5136
- C:\Windows\System\WkHNFVj.exe
  C:\Windows\System\WkHNFVj.exe
  2⤵
  PID:5244
- C:\Windows\System\PKjZtak.exe
  C:\Windows\System\PKjZtak.exe
  2⤵
  PID:5624
- C:\Windows\System\KUmNEwY.exe
  C:\Windows\System\KUmNEwY.exe
  2⤵
  PID:5628
- C:\Windows\System\szGvVIm.exe
  C:\Windows\System\szGvVIm.exe
  2⤵
  PID:5708
- C:\Windows\System\SwKlxxZ.exe
  C:\Windows\System\SwKlxxZ.exe
  2⤵
  PID:5772
- C:\Windows\System\XKQaYdr.exe
  C:\Windows\System\XKQaYdr.exe
  2⤵
  PID:1540
- C:\Windows\System\mPMUJCL.exe
  C:\Windows\System\mPMUJCL.exe
  2⤵
  PID:5840
- C:\Windows\System\wHHICAp.exe
  C:\Windows\System\wHHICAp.exe
  2⤵
  PID:5892
- C:\Windows\System\tbsLvhD.exe
  C:\Windows\System\tbsLvhD.exe
  2⤵
  PID:5908
- C:\Windows\System\FNkQkZC.exe
  C:\Windows\System\FNkQkZC.exe
  2⤵
  PID:5924
- C:\Windows\System\JozuOtF.exe
  C:\Windows\System\JozuOtF.exe
  2⤵
  PID:5760
- C:\Windows\System\ochsxuK.exe
  C:\Windows\System\ochsxuK.exe
  2⤵
  PID:5796
- C:\Windows\System\OvNnJuG.exe
  C:\Windows\System\OvNnJuG.exe
  2⤵
  PID:5860
- C:\Windows\System\jOPqJxX.exe
  C:\Windows\System\jOPqJxX.exe
  2⤵
  PID:5952
- C:\Windows\System\EUFisql.exe
  C:\Windows\System\EUFisql.exe
  2⤵
  PID:6052
- C:\Windows\System\OiqinEO.exe
  C:\Windows\System\OiqinEO.exe
  2⤵
  PID:3572
- C:\Windows\System\sKoMkEx.exe
  C:\Windows\System\sKoMkEx.exe
  2⤵
  PID:5192
- C:\Windows\System\kJAumzQ.exe
  C:\Windows\System\kJAumzQ.exe
  2⤵
  PID:5512
- C:\Windows\System\lMZCFik.exe
  C:\Windows\System\lMZCFik.exe
  2⤵
  PID:5956
- C:\Windows\System\KSnRKZy.exe
  C:\Windows\System\KSnRKZy.exe
  2⤵
  PID:5548
- C:\Windows\System\DqWTURK.exe
  C:\Windows\System\DqWTURK.exe
  2⤵
  PID:5612
- C:\Windows\System\LvxURpc.exe
  C:\Windows\System\LvxURpc.exe
  2⤵
  PID:6000
- C:\Windows\System\xWRBygW.exe
  C:\Windows\System\xWRBygW.exe
  2⤵
  PID:6064
- C:\Windows\System\vxCLViu.exe
  C:\Windows\System\vxCLViu.exe
  2⤵
  PID:6132
- C:\Windows\System\NvUnHeg.exe
  C:\Windows\System\NvUnHeg.exe
  2⤵
  PID:3972
- C:\Windows\System\ppembNF.exe
  C:\Windows\System\ppembNF.exe
  2⤵
  PID:4928
- C:\Windows\System\waMLXDn.exe
  C:\Windows\System\waMLXDn.exe
  2⤵
  PID:5452
- C:\Windows\System\OdTxdpA.exe
  C:\Windows\System\OdTxdpA.exe
  2⤵
  PID:5336
- C:\Windows\System\WTzYYUR.exe
  C:\Windows\System\WTzYYUR.exe
  2⤵
  PID:4384
- C:\Windows\System\fpsffyy.exe
  C:\Windows\System\fpsffyy.exe
  2⤵
  PID:5436
- C:\Windows\System\iAHzqns.exe
  C:\Windows\System\iAHzqns.exe
  2⤵
  PID:5468
- C:\Windows\System\YrEeyga.exe
  C:\Windows\System\YrEeyga.exe
  2⤵
  PID:5812
- C:\Windows\System\NkTDrAY.exe
  C:\Windows\System\NkTDrAY.exe
  2⤵
  PID:5388
- C:\Windows\System\ijNJudH.exe
  C:\Windows\System\ijNJudH.exe
  2⤵
  PID:5704
- C:\Windows\System\hcenMXj.exe
  C:\Windows\System\hcenMXj.exe
  2⤵
  PID:5608
- C:\Windows\System\HuFqazJ.exe
  C:\Windows\System\HuFqazJ.exe
  2⤵
  PID:6100
- C:\Windows\System\ktCftVC.exe
  C:\Windows\System\ktCftVC.exe
  2⤵
  PID:4856
- C:\Windows\System\NVoOuiH.exe
  C:\Windows\System\NVoOuiH.exe
  2⤵
  PID:5876
- C:\Windows\System\pTLESLT.exe
  C:\Windows\System\pTLESLT.exe
  2⤵
  PID:5372
- C:\Windows\System\TfZHwwx.exe
  C:\Windows\System\TfZHwwx.exe
  2⤵
  PID:5532
- C:\Windows\System\ysTchlC.exe
  C:\Windows\System\ysTchlC.exe
  2⤵
  PID:5872
- C:\Windows\System\CKzajIH.exe
  C:\Windows\System\CKzajIH.exe
  2⤵
  PID:5932
- C:\Windows\System\nTPwftE.exe
  C:\Windows\System\nTPwftE.exe
  2⤵
  PID:5856
- C:\Windows\System\MPmHqNV.exe
  C:\Windows\System\MPmHqNV.exe
  2⤵
  PID:6116
- C:\Windows\System\BsQNHeM.exe
  C:\Windows\System\BsQNHeM.exe
  2⤵
  PID:6088
- C:\Windows\System\JYeQOEQ.exe
  C:\Windows\System\JYeQOEQ.exe
  2⤵
  PID:6036
- C:\Windows\System\wDPnSGl.exe
  C:\Windows\System\wDPnSGl.exe
  2⤵
  PID:5352
- C:\Windows\System\rtAzhkA.exe
  C:\Windows\System\rtAzhkA.exe
  2⤵
  PID:5592
- C:\Windows\System\gHOpMLo.exe
  C:\Windows\System\gHOpMLo.exe
  2⤵
  PID:5124
- C:\Windows\System\gXKhYjx.exe
  C:\Windows\System\gXKhYjx.exe
  2⤵
  PID:5660
- C:\Windows\System\rxuZmlb.exe
  C:\Windows\System\rxuZmlb.exe
  2⤵
  PID:6120
- C:\Windows\System\kPXbhls.exe
  C:\Windows\System\kPXbhls.exe
  2⤵
  PID:5916
- C:\Windows\System\UfUvMBv.exe
  C:\Windows\System\UfUvMBv.exe
  2⤵
  PID:4300
- C:\Windows\System\EdciIdU.exe
  C:\Windows\System\EdciIdU.exe
  2⤵
  PID:5884
- C:\Windows\System\OqCylNe.exe
  C:\Windows\System\OqCylNe.exe
  2⤵
  PID:5564
- C:\Windows\System\VlRBypJ.exe
  C:\Windows\System\VlRBypJ.exe
  2⤵
  PID:5368
- C:\Windows\System\yaxJurw.exe
  C:\Windows\System\yaxJurw.exe
  2⤵
  PID:1836
- C:\Windows\System\LByMGPh.exe
  C:\Windows\System\LByMGPh.exe
  2⤵
  PID:5172
- C:\Windows\System\ArFpPoA.exe
  C:\Windows\System\ArFpPoA.exe
  2⤵
  PID:5740
- C:\Windows\System\qLhESCR.exe
  C:\Windows\System\qLhESCR.exe
  2⤵
  PID:6152
- C:\Windows\System\ePaHKvB.exe
  C:\Windows\System\ePaHKvB.exe
  2⤵
  PID:6168
- C:\Windows\System\HSZgxnR.exe
  C:\Windows\System\HSZgxnR.exe
  2⤵
  PID:6184
- C:\Windows\System\pmAUAmh.exe
  C:\Windows\System\pmAUAmh.exe
  2⤵
  PID:6200
- C:\Windows\System\swfkIqc.exe
  C:\Windows\System\swfkIqc.exe
  2⤵
  PID:6216
- C:\Windows\System\CYDuAha.exe
  C:\Windows\System\CYDuAha.exe
  2⤵
  PID:6232
- C:\Windows\System\DtSFJxC.exe
  C:\Windows\System\DtSFJxC.exe
  2⤵
  PID:6248
- C:\Windows\System\oCZviTO.exe
  C:\Windows\System\oCZviTO.exe
  2⤵
  PID:6264
- C:\Windows\System\QVQIhNg.exe
  C:\Windows\System\QVQIhNg.exe
  2⤵
  PID:6284
- C:\Windows\System\mWIELUa.exe
  C:\Windows\System\mWIELUa.exe
  2⤵
  PID:6300
- C:\Windows\System\aZzicga.exe
  C:\Windows\System\aZzicga.exe
  2⤵
  PID:6316
- C:\Windows\System\iVopqpM.exe
  C:\Windows\System\iVopqpM.exe
  2⤵
  PID:6336
- C:\Windows\System\BjOaVuI.exe
  C:\Windows\System\BjOaVuI.exe
  2⤵
  PID:6352
- C:\Windows\System\HHZBzjG.exe
  C:\Windows\System\HHZBzjG.exe
  2⤵
  PID:6368
- C:\Windows\System\iQmoCDg.exe
  C:\Windows\System\iQmoCDg.exe
  2⤵
  PID:6384
- C:\Windows\System\SHYvijg.exe
  C:\Windows\System\SHYvijg.exe
  2⤵
  PID:6404
- C:\Windows\System\xcByFpF.exe
  C:\Windows\System\xcByFpF.exe
  2⤵
  PID:6424
- C:\Windows\System\PDeoJLV.exe
  C:\Windows\System\PDeoJLV.exe
  2⤵
  PID:6440
- C:\Windows\System\NnyddhA.exe
  C:\Windows\System\NnyddhA.exe
  2⤵
  PID:6464
- C:\Windows\System\XyXhEDX.exe
  C:\Windows\System\XyXhEDX.exe
  2⤵
  PID:6480
- C:\Windows\System\wGVYyoe.exe
  C:\Windows\System\wGVYyoe.exe
  2⤵
  PID:6608
- C:\Windows\System\QBPmQtN.exe
  C:\Windows\System\QBPmQtN.exe
  2⤵
  PID:6628
- C:\Windows\System\IgrxuVp.exe
  C:\Windows\System\IgrxuVp.exe
  2⤵
  PID:6644
- C:\Windows\System\oPEqRjj.exe
  C:\Windows\System\oPEqRjj.exe
  2⤵
  PID:6660
- C:\Windows\System\AHSzrTh.exe
  C:\Windows\System\AHSzrTh.exe
  2⤵
  PID:6676
- C:\Windows\System\GmmoRmW.exe
  C:\Windows\System\GmmoRmW.exe
  2⤵
  PID:6692
- C:\Windows\System\wTnvIYa.exe
  C:\Windows\System\wTnvIYa.exe
  2⤵
  PID:6708
- C:\Windows\System\TTnDipG.exe
  C:\Windows\System\TTnDipG.exe
  2⤵
  PID:6728
- C:\Windows\System\sfvZsdE.exe
  C:\Windows\System\sfvZsdE.exe
  2⤵
  PID:6744
- C:\Windows\System\lqYFrcD.exe
  C:\Windows\System\lqYFrcD.exe
  2⤵
  PID:6764
- C:\Windows\System\OsLXUJe.exe
  C:\Windows\System\OsLXUJe.exe
  2⤵
  PID:6780
- C:\Windows\System\vibPmps.exe
  C:\Windows\System\vibPmps.exe
  2⤵
  PID:6800
- C:\Windows\System\qZWskZR.exe
  C:\Windows\System\qZWskZR.exe
  2⤵
  PID:6820
- C:\Windows\System\iZtJKKy.exe
  C:\Windows\System\iZtJKKy.exe
  2⤵
  PID:6844
- C:\Windows\System\fJDlFhA.exe
  C:\Windows\System\fJDlFhA.exe
  2⤵
  PID:6864
- C:\Windows\System\FOcdPMB.exe
  C:\Windows\System\FOcdPMB.exe
  2⤵
  PID:6880
- C:\Windows\System\lVbxvdv.exe
  C:\Windows\System\lVbxvdv.exe
  2⤵
  PID:6896
- C:\Windows\System\MpkQqsO.exe
  C:\Windows\System\MpkQqsO.exe
  2⤵
  PID:6912
- C:\Windows\System\golFtMi.exe
  C:\Windows\System\golFtMi.exe
  2⤵
  PID:6928
- C:\Windows\System\AAowgUG.exe
  C:\Windows\System\AAowgUG.exe
  2⤵
  PID:6944
- C:\Windows\System\hrDqhoP.exe
  C:\Windows\System\hrDqhoP.exe
  2⤵
  PID:6960
- C:\Windows\System\szeXQVf.exe
  C:\Windows\System\szeXQVf.exe
  2⤵
  PID:6976
- C:\Windows\System\iARbWix.exe
  C:\Windows\System\iARbWix.exe
  2⤵
  PID:6992
- C:\Windows\System\EZemkjP.exe
  C:\Windows\System\EZemkjP.exe
  2⤵
  PID:7008
- C:\Windows\System\xlALRRs.exe
  C:\Windows\System\xlALRRs.exe
  2⤵
  PID:7024
- C:\Windows\System\kGHMrqt.exe
  C:\Windows\System\kGHMrqt.exe
  2⤵
  PID:7040
- C:\Windows\System\jzojJsB.exe
  C:\Windows\System\jzojJsB.exe
  2⤵
  PID:7056
- C:\Windows\System\SKiUDIV.exe
  C:\Windows\System\SKiUDIV.exe
  2⤵
  PID:7076
- C:\Windows\System\hTVazti.exe
  C:\Windows\System\hTVazti.exe
  2⤵
  PID:7092
- C:\Windows\System\gXOxOCp.exe
  C:\Windows\System\gXOxOCp.exe
  2⤵
  PID:7108
- C:\Windows\System\wfUtrqG.exe
  C:\Windows\System\wfUtrqG.exe
  2⤵
  PID:7124
- C:\Windows\System\yHhFajb.exe
  C:\Windows\System\yHhFajb.exe
  2⤵
  PID:7140
- C:\Windows\System\nQAJAto.exe
  C:\Windows\System\nQAJAto.exe
  2⤵
  PID:7156
- C:\Windows\System\rWjTYoy.exe
  C:\Windows\System\rWjTYoy.exe
  2⤵
  PID:5904
- C:\Windows\System\KdJzwMc.exe
  C:\Windows\System\KdJzwMc.exe
  2⤵
  PID:6196
- C:\Windows\System\XZRvLRC.exe
  C:\Windows\System\XZRvLRC.exe
  2⤵
  PID:6292
- C:\Windows\System\EObYJio.exe
  C:\Windows\System\EObYJio.exe
  2⤵
  PID:6256
- C:\Windows\System\GMSFGHD.exe
  C:\Windows\System\GMSFGHD.exe
  2⤵
  PID:6392
- C:\Windows\System\UlaerIY.exe
  C:\Windows\System\UlaerIY.exe
  2⤵
  PID:6432
- C:\Windows\System\YYHWGkC.exe
  C:\Windows\System\YYHWGkC.exe
  2⤵
  PID:5528
- C:\Windows\System\GVaZvCr.exe
  C:\Windows\System\GVaZvCr.exe
  2⤵
  PID:6508
- C:\Windows\System\PCUZIVL.exe
  C:\Windows\System\PCUZIVL.exe
  2⤵
  PID:5000
- C:\Windows\System\fRlPsAS.exe
  C:\Windows\System\fRlPsAS.exe
  2⤵
  PID:5544
- C:\Windows\System\WSxhmCT.exe
  C:\Windows\System\WSxhmCT.exe
  2⤵
  PID:6148
- C:\Windows\System\CDqYbEh.exe
  C:\Windows\System\CDqYbEh.exe
  2⤵
  PID:6212
- C:\Windows\System\bFgnEVg.exe
  C:\Windows\System\bFgnEVg.exe
  2⤵
  PID:6276
- C:\Windows\System\nEkbNcb.exe
  C:\Windows\System\nEkbNcb.exe
  2⤵
  PID:6344
- C:\Windows\System\eHllQuT.exe
  C:\Windows\System\eHllQuT.exe
  2⤵
  PID:6412
- C:\Windows\System\MyPXAQD.exe
  C:\Windows\System\MyPXAQD.exe
  2⤵
  PID:6452
- C:\Windows\System\rghQCJj.exe
  C:\Windows\System\rghQCJj.exe
  2⤵
  PID:6496
- C:\Windows\System\uZrUHqi.exe
  C:\Windows\System\uZrUHqi.exe
  2⤵
  PID:6516
- C:\Windows\System\oInibjS.exe
  C:\Windows\System\oInibjS.exe
  2⤵
  PID:6532
- C:\Windows\System\wNjXSqY.exe
  C:\Windows\System\wNjXSqY.exe
  2⤵
  PID:6548
- C:\Windows\System\FsTRSGD.exe
  C:\Windows\System\FsTRSGD.exe
  2⤵
  PID:6560
- C:\Windows\System\WMSrPEz.exe
  C:\Windows\System\WMSrPEz.exe
  2⤵
  PID:6576
- C:\Windows\System\BskbMDk.exe
  C:\Windows\System\BskbMDk.exe
  2⤵
  PID:6592
- C:\Windows\System\jHUUUeb.exe
  C:\Windows\System\jHUUUeb.exe
  2⤵
  PID:6624
- C:\Windows\System\OXIDUTB.exe
  C:\Windows\System\OXIDUTB.exe
  2⤵
  PID:6700
- C:\Windows\System\fJZmNIO.exe
  C:\Windows\System\fJZmNIO.exe
  2⤵
  PID:6736
- C:\Windows\System\AFEMzvT.exe
  C:\Windows\System\AFEMzvT.exe
  2⤵
  PID:6656
- C:\Windows\System\yVqmjvF.exe
  C:\Windows\System\yVqmjvF.exe
  2⤵
  PID:6716
- C:\Windows\System\opcHWLr.exe
  C:\Windows\System\opcHWLr.exe
  2⤵
  PID:6836
- C:\Windows\System\tnPcVjB.exe
  C:\Windows\System\tnPcVjB.exe
  2⤵
  PID:6840
- C:\Windows\System\PIOKzoL.exe
  C:\Windows\System\PIOKzoL.exe
  2⤵
  PID:6776
- C:\Windows\System\jEDmGqQ.exe
  C:\Windows\System\jEDmGqQ.exe
  2⤵
  PID:6856
- C:\Windows\System\SsRAnTC.exe
  C:\Windows\System\SsRAnTC.exe
  2⤵
  PID:6892
- C:\Windows\System\TdmuNxp.exe
  C:\Windows\System\TdmuNxp.exe
  2⤵
  PID:6920
- C:\Windows\System\ZUnQYlY.exe
  C:\Windows\System\ZUnQYlY.exe
  2⤵
  PID:6972
- C:\Windows\System\etyaXAv.exe
  C:\Windows\System\etyaXAv.exe
  2⤵
  PID:7064
- C:\Windows\System\QMvWsSu.exe
  C:\Windows\System\QMvWsSu.exe
  2⤵
  PID:7100
- C:\Windows\System\DKTXzHk.exe
  C:\Windows\System\DKTXzHk.exe
  2⤵
  PID:7164
- C:\Windows\System\taeLvVN.exe
  C:\Windows\System\taeLvVN.exe
  2⤵
  PID:5808
- C:\Windows\System\hpcvide.exe
  C:\Windows\System\hpcvide.exe
  2⤵
  PID:6968
- C:\Windows\System\MLiDXUx.exe
  C:\Windows\System\MLiDXUx.exe
  2⤵
  PID:6364
- C:\Windows\System\RwoLzcO.exe
  C:\Windows\System\RwoLzcO.exe
  2⤵
  PID:4952
- C:\Windows\System\oxljikW.exe
  C:\Windows\System\oxljikW.exe
  2⤵
  PID:7120
- C:\Windows\System\WduiWxg.exe
  C:\Windows\System\WduiWxg.exe
  2⤵
  PID:6324
- C:\Windows\System\sZoFifW.exe
  C:\Windows\System\sZoFifW.exe
  2⤵
  PID:7088
- C:\Windows\System\EBNuiEv.exe
  C:\Windows\System\EBNuiEv.exe
  2⤵
  PID:6164
- C:\Windows\System\EpOReDN.exe
  C:\Windows\System\EpOReDN.exe
  2⤵
  PID:6208
- C:\Windows\System\NnpkbMM.exe
  C:\Windows\System\NnpkbMM.exe
  2⤵
  PID:5176
- C:\Windows\System\UYfBAdR.exe
  C:\Windows\System\UYfBAdR.exe
  2⤵
  PID:6312
- C:\Windows\System\mvROStL.exe
  C:\Windows\System\mvROStL.exe
  2⤵
  PID:6556
- C:\Windows\System\EfpdPzl.exe
  C:\Windows\System\EfpdPzl.exe
  2⤵
  PID:6528
- C:\Windows\System\rBaIBEd.exe
  C:\Windows\System\rBaIBEd.exe
  2⤵
  PID:6788
- C:\Windows\System\TOPRwNz.exe
  C:\Windows\System\TOPRwNz.exe
  2⤵
  PID:6760
- C:\Windows\System\BWZvxfs.exe
  C:\Windows\System\BWZvxfs.exe
  2⤵
  PID:6888
- C:\Windows\System\fVIGyzD.exe
  C:\Windows\System\fVIGyzD.exe
  2⤵
  PID:6952
- C:\Windows\System\AmxIFbk.exe
  C:\Windows\System\AmxIFbk.exe
  2⤵
  PID:6572
- C:\Windows\System\EjugtJp.exe
  C:\Windows\System\EjugtJp.exe
  2⤵
  PID:6620
- C:\Windows\System\zIyaSXi.exe
  C:\Windows\System\zIyaSXi.exe
  2⤵
  PID:6904
- C:\Windows\System\PgjFgYb.exe
  C:\Windows\System\PgjFgYb.exe
  2⤵
  PID:6812
- C:\Windows\System\lJFPiUS.exe
  C:\Windows\System\lJFPiUS.exe
  2⤵
  PID:7016
- C:\Windows\System\vXETeOg.exe
  C:\Windows\System\vXETeOg.exe
  2⤵
  PID:6908
- C:\Windows\System\YQJexao.exe
  C:\Windows\System\YQJexao.exe
  2⤵
  PID:7136
- C:\Windows\System\zBABDXl.exe
  C:\Windows\System\zBABDXl.exe
  2⤵
  PID:7152
- C:\Windows\System\xKsPjrX.exe
  C:\Windows\System\xKsPjrX.exe
  2⤵
  PID:6380
- C:\Windows\System\EMSWzPB.exe
  C:\Windows\System\EMSWzPB.exe
  2⤵
  PID:6328
- C:\Windows\System\fcJTxMZ.exe
  C:\Windows\System\fcJTxMZ.exe
  2⤵
  PID:6756
- C:\Windows\System\xkvvoNn.exe
  C:\Windows\System\xkvvoNn.exe
  2⤵
  PID:6832
- C:\Windows\System\IzHuIPX.exe
  C:\Windows\System\IzHuIPX.exe
  2⤵
  PID:6816
- C:\Windows\System\cPFgdRy.exe
  C:\Windows\System\cPFgdRy.exe
  2⤵
  PID:7032
- C:\Windows\System\WMoKtBJ.exe
  C:\Windows\System\WMoKtBJ.exe
  2⤵
  PID:7172
- C:\Windows\System\mDMzIVg.exe
  C:\Windows\System\mDMzIVg.exe
  2⤵
  PID:7188
- C:\Windows\System\twRyfEG.exe
  C:\Windows\System\twRyfEG.exe
  2⤵
  PID:7204
- C:\Windows\System\nppJiDK.exe
  C:\Windows\System\nppJiDK.exe
  2⤵
  PID:7220
- C:\Windows\System\mRQooVJ.exe
  C:\Windows\System\mRQooVJ.exe
  2⤵
  PID:7240
- C:\Windows\System\VlMJpmD.exe
  C:\Windows\System\VlMJpmD.exe
  2⤵
  PID:7256
- C:\Windows\System\VgUSppD.exe
  C:\Windows\System\VgUSppD.exe
  2⤵
  PID:7272
- C:\Windows\System\jzAqShp.exe
  C:\Windows\System\jzAqShp.exe
  2⤵
  PID:7288
- C:\Windows\System\BJdKoib.exe
  C:\Windows\System\BJdKoib.exe
  2⤵
  PID:7304
- C:\Windows\System\TYXQqZQ.exe
  C:\Windows\System\TYXQqZQ.exe
  2⤵
  PID:7320
- C:\Windows\System\ffKicnP.exe
  C:\Windows\System\ffKicnP.exe
  2⤵
  PID:7336
- C:\Windows\System\XoChcLs.exe
  C:\Windows\System\XoChcLs.exe
  2⤵
  PID:7352
- C:\Windows\System\WXEtHTl.exe
  C:\Windows\System\WXEtHTl.exe
  2⤵
  PID:7368
- C:\Windows\System\FZLxcQF.exe
  C:\Windows\System\FZLxcQF.exe
  2⤵
  PID:7384
- C:\Windows\System\AmewVVn.exe
  C:\Windows\System\AmewVVn.exe
  2⤵
  PID:7400
- C:\Windows\System\UYyIzDW.exe
  C:\Windows\System\UYyIzDW.exe
  2⤵
  PID:7416
- C:\Windows\System\ARfQjuo.exe
  C:\Windows\System\ARfQjuo.exe
  2⤵
  PID:7432
- C:\Windows\System\LBCsHYT.exe
  C:\Windows\System\LBCsHYT.exe
  2⤵
  PID:7448
- C:\Windows\System\PqoGenr.exe
  C:\Windows\System\PqoGenr.exe
  2⤵
  PID:7464
- C:\Windows\System\GCWWkcx.exe
  C:\Windows\System\GCWWkcx.exe
  2⤵
  PID:7480
- C:\Windows\System\IHtWCBN.exe
  C:\Windows\System\IHtWCBN.exe
  2⤵
  PID:7504
- C:\Windows\System\TWDpuEX.exe
  C:\Windows\System\TWDpuEX.exe
  2⤵
  PID:7520
- C:\Windows\System\esYkvrQ.exe
  C:\Windows\System\esYkvrQ.exe
  2⤵
  PID:7536
- C:\Windows\System\tEOklWg.exe
  C:\Windows\System\tEOklWg.exe
  2⤵
  PID:7552
- C:\Windows\System\OufwIls.exe
  C:\Windows\System\OufwIls.exe
  2⤵
  PID:7572
- C:\Windows\System\BwxKzIJ.exe
  C:\Windows\System\BwxKzIJ.exe
  2⤵
  PID:7588
- C:\Windows\System\LKrwRUO.exe
  C:\Windows\System\LKrwRUO.exe
  2⤵
  PID:7604
- C:\Windows\System\eqajSiz.exe
  C:\Windows\System\eqajSiz.exe
  2⤵
  PID:7620
- C:\Windows\System\mfmShFc.exe
  C:\Windows\System\mfmShFc.exe
  2⤵
  PID:7636
- C:\Windows\System\wkYhHtA.exe
  C:\Windows\System\wkYhHtA.exe
  2⤵
  PID:7652
- C:\Windows\System\gwLMoEP.exe
  C:\Windows\System\gwLMoEP.exe
  2⤵
  PID:7668
- C:\Windows\System\GrQzNhL.exe
  C:\Windows\System\GrQzNhL.exe
  2⤵
  PID:7684
- C:\Windows\System\DxlfZED.exe
  C:\Windows\System\DxlfZED.exe
  2⤵
  PID:7704
- C:\Windows\System\KBVuKEW.exe
  C:\Windows\System\KBVuKEW.exe
  2⤵
  PID:7720
- C:\Windows\System\FKvaJpV.exe
  C:\Windows\System\FKvaJpV.exe
  2⤵
  PID:7736
- C:\Windows\System\YcDWblN.exe
  C:\Windows\System\YcDWblN.exe
  2⤵
  PID:7752
- C:\Windows\System\ZJCxvyB.exe
  C:\Windows\System\ZJCxvyB.exe
  2⤵
  PID:7768
- C:\Windows\System\aLVfIYE.exe
  C:\Windows\System\aLVfIYE.exe
  2⤵
  PID:7784
- C:\Windows\System\djKhRzu.exe
  C:\Windows\System\djKhRzu.exe
  2⤵
  PID:7800
- C:\Windows\System\fCEisTl.exe
  C:\Windows\System\fCEisTl.exe
  2⤵
  PID:7816
- C:\Windows\System\TsmUzhq.exe
  C:\Windows\System\TsmUzhq.exe
  2⤵
  PID:7832
- C:\Windows\System\rtEDXuv.exe
  C:\Windows\System\rtEDXuv.exe
  2⤵
  PID:7848
- C:\Windows\System\CLxfjYD.exe
  C:\Windows\System\CLxfjYD.exe
  2⤵
  PID:7864
- C:\Windows\System\eLiDigY.exe
  C:\Windows\System\eLiDigY.exe
  2⤵
  PID:7880
- C:\Windows\System\bfeiUZL.exe
  C:\Windows\System\bfeiUZL.exe
  2⤵
  PID:7896
- C:\Windows\System\GRJbSyd.exe
  C:\Windows\System\GRJbSyd.exe
  2⤵
  PID:7912
- C:\Windows\System\tYCcWPJ.exe
  C:\Windows\System\tYCcWPJ.exe
  2⤵
  PID:7928
- C:\Windows\System\xSweiIt.exe
  C:\Windows\System\xSweiIt.exe
  2⤵
  PID:7944
- C:\Windows\System\aDDgcxD.exe
  C:\Windows\System\aDDgcxD.exe
  2⤵
  PID:7960
- C:\Windows\System\mOUTjKs.exe
  C:\Windows\System\mOUTjKs.exe
  2⤵
  PID:7976
- C:\Windows\System\VvFslmg.exe
  C:\Windows\System\VvFslmg.exe
  2⤵
  PID:7992
- C:\Windows\System\NLzEnYm.exe
  C:\Windows\System\NLzEnYm.exe
  2⤵
  PID:8008
- C:\Windows\System\oikkPth.exe
  C:\Windows\System\oikkPth.exe
  2⤵
  PID:8024
- C:\Windows\System\ddvqDeZ.exe
  C:\Windows\System\ddvqDeZ.exe
  2⤵
  PID:8060
- C:\Windows\System\BpBiCXx.exe
  C:\Windows\System\BpBiCXx.exe
  2⤵
  PID:8076
- C:\Windows\System\dIHDYty.exe
  C:\Windows\System\dIHDYty.exe
  2⤵
  PID:8092
- C:\Windows\System\WZYMhzK.exe
  C:\Windows\System\WZYMhzK.exe
  2⤵
  PID:8108
- C:\Windows\System\LvLECvR.exe
  C:\Windows\System\LvLECvR.exe
  2⤵
  PID:8124
- C:\Windows\System\ZbhReWM.exe
  C:\Windows\System\ZbhReWM.exe
  2⤵
  PID:8140
- C:\Windows\System\SOUQeeQ.exe
  C:\Windows\System\SOUQeeQ.exe
  2⤵
  PID:8156
- C:\Windows\System\IAKOMEN.exe
  C:\Windows\System\IAKOMEN.exe
  2⤵
  PID:8172
- C:\Windows\System\xyPCNTE.exe
  C:\Windows\System\xyPCNTE.exe
  2⤵
  PID:8188
- C:\Windows\System\HYIzjTl.exe
  C:\Windows\System\HYIzjTl.exe
  2⤵
  PID:7036
- C:\Windows\System\SaNuXRj.exe
  C:\Windows\System\SaNuXRj.exe
  2⤵
  PID:7072
- C:\Windows\System\ldjOPmO.exe
  C:\Windows\System\ldjOPmO.exe
  2⤵
  PID:5828
- C:\Windows\System\bwdTEmM.exe
  C:\Windows\System\bwdTEmM.exe
  2⤵
  PID:5404
- C:\Windows\System\RGsuPgh.exe
  C:\Windows\System\RGsuPgh.exe
  2⤵
  PID:7196
- C:\Windows\System\XvdBwHe.exe
  C:\Windows\System\XvdBwHe.exe
  2⤵
  PID:6940
- C:\Windows\System\FfMSNNP.exe
  C:\Windows\System\FfMSNNP.exe
  2⤵
  PID:7020
- C:\Windows\System\KDhFgnU.exe
  C:\Windows\System\KDhFgnU.exe
  2⤵
  PID:6600
- C:\Windows\System\QGWrZBR.exe
  C:\Windows\System\QGWrZBR.exe
  2⤵
  PID:7200
- C:\Windows\System\YrcPyZt.exe
  C:\Windows\System\YrcPyZt.exe
  2⤵
  PID:7296
- C:\Windows\System\FuVqzdm.exe
  C:\Windows\System\FuVqzdm.exe
  2⤵
  PID:7248
- C:\Windows\System\ADVhhfE.exe
  C:\Windows\System\ADVhhfE.exe
  2⤵
  PID:7312
- C:\Windows\System\WvQKwvn.exe
  C:\Windows\System\WvQKwvn.exe
  2⤵
  PID:7376
- C:\Windows\System\LeCrSOB.exe
  C:\Windows\System\LeCrSOB.exe
  2⤵
  PID:7408
- C:\Windows\System\FpdHMrq.exe
  C:\Windows\System\FpdHMrq.exe
  2⤵
  PID:7444
- C:\Windows\System\Qkydtqy.exe
  C:\Windows\System\Qkydtqy.exe
  2⤵
  PID:7424
- C:\Windows\System\TrKHZkY.exe
  C:\Windows\System\TrKHZkY.exe
  2⤵
  PID:7460
- C:\Windows\System\TxJhKvs.exe
  C:\Windows\System\TxJhKvs.exe
  2⤵
  PID:7512
- C:\Windows\System\oqCFucp.exe
  C:\Windows\System\oqCFucp.exe
  2⤵
  PID:7580
- C:\Windows\System\ayjTpNg.exe
  C:\Windows\System\ayjTpNg.exe
  2⤵
  PID:7584
- C:\Windows\System\ttvRkYb.exe
  C:\Windows\System\ttvRkYb.exe
  2⤵
  PID:7648
- C:\Windows\System\IUzgfCG.exe
  C:\Windows\System\IUzgfCG.exe
  2⤵
  PID:7716
- C:\Windows\System\wSOYRsc.exe
  C:\Windows\System\wSOYRsc.exe
  2⤵
  PID:7560
- C:\Windows\System\dzkCGqg.exe
  C:\Windows\System\dzkCGqg.exe
  2⤵
  PID:7728
- C:\Windows\System\ejrEIDu.exe
  C:\Windows\System\ejrEIDu.exe
  2⤵
  PID:7632
- C:\Windows\System\VLdbqBf.exe
  C:\Windows\System\VLdbqBf.exe
  2⤵
  PID:7696
- C:\Windows\System\xkGTOpj.exe
  C:\Windows\System\xkGTOpj.exe
  2⤵
  PID:7776
- C:\Windows\System\clQbZPj.exe
  C:\Windows\System\clQbZPj.exe
  2⤵
  PID:7808
- C:\Windows\System\ZryOrIx.exe
  C:\Windows\System\ZryOrIx.exe
  2⤵
  PID:7844
- C:\Windows\System\bzFpJvA.exe
  C:\Windows\System\bzFpJvA.exe
  2⤵
  PID:7908
- C:\Windows\System\pSbjOsd.exe
  C:\Windows\System\pSbjOsd.exe
  2⤵
  PID:7860
- C:\Windows\System\AAgCuVe.exe
  C:\Windows\System\AAgCuVe.exe
  2⤵
  PID:7892
- C:\Windows\System\ZkYrWQG.exe
  C:\Windows\System\ZkYrWQG.exe
  2⤵
  PID:7952
- C:\Windows\System\fEKWzrE.exe
  C:\Windows\System\fEKWzrE.exe
  2⤵
  PID:8004
- C:\Windows\System\NKOGzyf.exe
  C:\Windows\System\NKOGzyf.exe
  2⤵
  PID:8036
- C:\Windows\System\sCdmjye.exe
  C:\Windows\System\sCdmjye.exe
  2⤵
  PID:8048
- C:\Windows\System\KWkcyjF.exe
  C:\Windows\System\KWkcyjF.exe
  2⤵
  PID:8084
- C:\Windows\System\dIeEHEN.exe
  C:\Windows\System\dIeEHEN.exe
  2⤵
  PID:8072
- C:\Windows\System\kvUFtEO.exe
  C:\Windows\System\kvUFtEO.exe
  2⤵
  PID:8152
- C:\Windows\System\eoEPvBr.exe
  C:\Windows\System\eoEPvBr.exe
  2⤵
  PID:8184
- C:\Windows\System\AGmrJxb.exe
  C:\Windows\System\AGmrJxb.exe
  2⤵
  PID:6400
- C:\Windows\System\xsEyHeO.exe
  C:\Windows\System\xsEyHeO.exe
  2⤵
  PID:6772
- C:\Windows\System\nmRpYDi.exe
  C:\Windows\System\nmRpYDi.exe
  2⤵
  PID:6308
- C:\Windows\System\qibDlcE.exe
  C:\Windows\System\qibDlcE.exe
  2⤵
  PID:7284
- C:\Windows\System\IvLePpt.exe
  C:\Windows\System\IvLePpt.exe
  2⤵
  PID:7428
- C:\Windows\System\eNnEgPU.exe
  C:\Windows\System\eNnEgPU.exe
  2⤵
  PID:7528
- C:\Windows\System\LxwooNS.exe
  C:\Windows\System\LxwooNS.exe
  2⤵
  PID:6636
- C:\Windows\System\GPrIRTy.exe
  C:\Windows\System\GPrIRTy.exe
  2⤵
  PID:7332
- C:\Windows\System\mIjuhlQ.exe
  C:\Windows\System\mIjuhlQ.exe
  2⤵
  PID:7392
- C:\Windows\System\QAuAOpC.exe
  C:\Windows\System\QAuAOpC.exe
  2⤵
  PID:7544
- C:\Windows\System\lLQpLYD.exe
  C:\Windows\System\lLQpLYD.exe
  2⤵
  PID:7712
- C:\Windows\System\oUoIRwF.exe
  C:\Windows\System\oUoIRwF.exe
  2⤵
  PID:6272
- C:\Windows\System\YjfFNuI.exe
  C:\Windows\System\YjfFNuI.exe
  2⤵
  PID:7596
- C:\Windows\System\QTrRcwz.exe
  C:\Windows\System\QTrRcwz.exe
  2⤵
  PID:7792
- C:\Windows\System\QuOznCv.exe
  C:\Windows\System\QuOznCv.exe
  2⤵
  PID:7824
- C:\Windows\System\ppmHPYo.exe
  C:\Windows\System\ppmHPYo.exe
  2⤵
  PID:8040
- C:\Windows\System\FVKXUwq.exe
  C:\Windows\System\FVKXUwq.exe
  2⤵
  PID:7940
- C:\Windows\System\nCCpgLX.exe
  C:\Windows\System\nCCpgLX.exe
  2⤵
  PID:8032
- C:\Windows\System\uRaeGJV.exe
  C:\Windows\System\uRaeGJV.exe
  2⤵
  PID:8120
- C:\Windows\System\sPzUjCv.exe
  C:\Windows\System\sPzUjCv.exe
  2⤵
  PID:6224
- C:\Windows\System\akWHFCF.exe
  C:\Windows\System\akWHFCF.exe
  2⤵
  PID:7236
- C:\Windows\System\ueJbwPo.exe
  C:\Windows\System\ueJbwPo.exe
  2⤵
  PID:7268
- C:\Windows\System\tWbekyP.exe
  C:\Windows\System\tWbekyP.exe
  2⤵
  PID:7476
- C:\Windows\System\ivmxOOS.exe
  C:\Windows\System\ivmxOOS.exe
  2⤵
  PID:7264
- C:\Windows\System\ufiVJGh.exe
  C:\Windows\System\ufiVJGh.exe
  2⤵
  PID:7344
- C:\Windows\System\TrtaSdD.exe
  C:\Windows\System\TrtaSdD.exe
  2⤵
  PID:7760
- C:\Windows\System\qSidFUY.exe
  C:\Windows\System\qSidFUY.exe
  2⤵
  PID:7692
- C:\Windows\System\sBIsiyz.exe
  C:\Windows\System\sBIsiyz.exe
  2⤵
  PID:7904
- C:\Windows\System\bclnPkJ.exe
  C:\Windows\System\bclnPkJ.exe
  2⤵
  PID:7840
- C:\Windows\System\KFQmxsm.exe
  C:\Windows\System\KFQmxsm.exe
  2⤵
  PID:8168
- C:\Windows\System\MChTwsP.exe
  C:\Windows\System\MChTwsP.exe
  2⤵
  PID:8136
- C:\Windows\System\hXNJyUB.exe
  C:\Windows\System\hXNJyUB.exe
  2⤵
  PID:7748
- C:\Windows\System\fqpSKcA.exe
  C:\Windows\System\fqpSKcA.exe
  2⤵
  PID:7664
- C:\Windows\System\EfwxMDD.exe
  C:\Windows\System\EfwxMDD.exe
  2⤵
  PID:6740
- C:\Windows\System\mZYChiL.exe
  C:\Windows\System\mZYChiL.exe
  2⤵
  PID:8000
- C:\Windows\System\kvQUihy.exe
  C:\Windows\System\kvQUihy.exe
  2⤵
  PID:7496
- C:\Windows\System\EqgJbxJ.exe
  C:\Windows\System\EqgJbxJ.exe
  2⤵
  PID:7876
- C:\Windows\System\SXgMwqv.exe
  C:\Windows\System\SXgMwqv.exe
  2⤵
  PID:7680
- C:\Windows\System\XpTImGe.exe
  C:\Windows\System\XpTImGe.exe
  2⤵
  PID:6668
- C:\Windows\System\EHgwGhy.exe
  C:\Windows\System\EHgwGhy.exe
  2⤵
  PID:8204
- C:\Windows\System\uCXcXCw.exe
  C:\Windows\System\uCXcXCw.exe
  2⤵
  PID:8220
- C:\Windows\System\hXexeqY.exe
  C:\Windows\System\hXexeqY.exe
  2⤵
  PID:8236
- C:\Windows\System\VOsZEsL.exe
  C:\Windows\System\VOsZEsL.exe
  2⤵
  PID:8252
- C:\Windows\System\spOIIsg.exe
  C:\Windows\System\spOIIsg.exe
  2⤵
  PID:8268
- C:\Windows\System\IKFMJTU.exe
  C:\Windows\System\IKFMJTU.exe
  2⤵
  PID:8284
- C:\Windows\System\ElvaeRU.exe
  C:\Windows\System\ElvaeRU.exe
  2⤵
  PID:8300
- C:\Windows\System\wGDxVXZ.exe
  C:\Windows\System\wGDxVXZ.exe
  2⤵
  PID:8316
- C:\Windows\System\UisnxZB.exe
  C:\Windows\System\UisnxZB.exe
  2⤵
  PID:8332
- C:\Windows\System\WkaKDqP.exe
  C:\Windows\System\WkaKDqP.exe
  2⤵
  PID:8348
- C:\Windows\System\NsVFROd.exe
  C:\Windows\System\NsVFROd.exe
  2⤵
  PID:8364
- C:\Windows\System\GifXlxO.exe
  C:\Windows\System\GifXlxO.exe
  2⤵
  PID:8380
- C:\Windows\System\mXVvceO.exe
  C:\Windows\System\mXVvceO.exe
  2⤵
  PID:8396
- C:\Windows\System\BTwAqFQ.exe
  C:\Windows\System\BTwAqFQ.exe
  2⤵
  PID:8412
- C:\Windows\System\pzPYcgb.exe
  C:\Windows\System\pzPYcgb.exe
  2⤵
  PID:8428
- C:\Windows\System\kOAixKt.exe
  C:\Windows\System\kOAixKt.exe
  2⤵
  PID:8444
- C:\Windows\System\GzGLFOE.exe
  C:\Windows\System\GzGLFOE.exe
  2⤵
  PID:8460
- C:\Windows\System\WBKlTGg.exe
  C:\Windows\System\WBKlTGg.exe
  2⤵
  PID:8476
- C:\Windows\System\VVhqLob.exe
  C:\Windows\System\VVhqLob.exe
  2⤵
  PID:8492
- C:\Windows\System\dLuahtH.exe
  C:\Windows\System\dLuahtH.exe
  2⤵
  PID:8508
- C:\Windows\System\JYVBVUw.exe
  C:\Windows\System\JYVBVUw.exe
  2⤵
  PID:8524
- C:\Windows\System\VRxHozR.exe
  C:\Windows\System\VRxHozR.exe
  2⤵
  PID:8540
- C:\Windows\System\pCAmijm.exe
  C:\Windows\System\pCAmijm.exe
  2⤵
  PID:8556
- C:\Windows\System\LHUONAG.exe
  C:\Windows\System\LHUONAG.exe
  2⤵
  PID:8572
- C:\Windows\System\DIVrZou.exe
  C:\Windows\System\DIVrZou.exe
  2⤵
  PID:8588
- C:\Windows\System\KSzXQWS.exe
  C:\Windows\System\KSzXQWS.exe
  2⤵
  PID:8604
- C:\Windows\System\XTdELgp.exe
  C:\Windows\System\XTdELgp.exe
  2⤵
  PID:8620
- C:\Windows\System\JLPnUKb.exe
  C:\Windows\System\JLPnUKb.exe
  2⤵
  PID:8636
- C:\Windows\System\QRGNZRg.exe
  C:\Windows\System\QRGNZRg.exe
  2⤵
  PID:8652
- C:\Windows\System\RNNCCHN.exe
  C:\Windows\System\RNNCCHN.exe
  2⤵
  PID:8668
- C:\Windows\System\LqemhAo.exe
  C:\Windows\System\LqemhAo.exe
  2⤵
  PID:8684
- C:\Windows\System\sbncaQX.exe
  C:\Windows\System\sbncaQX.exe
  2⤵
  PID:8700
- C:\Windows\System\fXoBfxX.exe
  C:\Windows\System\fXoBfxX.exe
  2⤵
  PID:8716
- C:\Windows\System\Omcqyat.exe
  C:\Windows\System\Omcqyat.exe
  2⤵
  PID:8732
- C:\Windows\System\yfRcLaK.exe
  C:\Windows\System\yfRcLaK.exe
  2⤵
  PID:8748
- C:\Windows\System\dyrehZz.exe
  C:\Windows\System\dyrehZz.exe
  2⤵
  PID:8764
- C:\Windows\System\JQpGRxw.exe
  C:\Windows\System\JQpGRxw.exe
  2⤵
  PID:8780
- C:\Windows\System\kCoVVzu.exe
  C:\Windows\System\kCoVVzu.exe
  2⤵
  PID:8796
- C:\Windows\System\FVyRFCJ.exe
  C:\Windows\System\FVyRFCJ.exe
  2⤵
  PID:8812
- C:\Windows\System\PDaVovH.exe
  C:\Windows\System\PDaVovH.exe
  2⤵
  PID:8828
- C:\Windows\System\DEXcCEw.exe
  C:\Windows\System\DEXcCEw.exe
  2⤵
  PID:8844
- C:\Windows\System\QmzWYFG.exe
  C:\Windows\System\QmzWYFG.exe
  2⤵
  PID:8860
- C:\Windows\System\tKmmlsO.exe
  C:\Windows\System\tKmmlsO.exe
  2⤵
  PID:8876
- C:\Windows\System\EcmLKJp.exe
  C:\Windows\System\EcmLKJp.exe
  2⤵
  PID:8892
- C:\Windows\System\AnoDVrY.exe
  C:\Windows\System\AnoDVrY.exe
  2⤵
  PID:8908
- C:\Windows\System\UPtSjPu.exe
  C:\Windows\System\UPtSjPu.exe
  2⤵
  PID:8924
- C:\Windows\System\UKESrBp.exe
  C:\Windows\System\UKESrBp.exe
  2⤵
  PID:8940
- C:\Windows\System\pVgIqbA.exe
  C:\Windows\System\pVgIqbA.exe
  2⤵
  PID:8956
- C:\Windows\System\pPkpeaE.exe
  C:\Windows\System\pPkpeaE.exe
  2⤵
  PID:8972
- C:\Windows\System\QbAiIog.exe
  C:\Windows\System\QbAiIog.exe
  2⤵
  PID:8988
- C:\Windows\System\IRiQGrB.exe
  C:\Windows\System\IRiQGrB.exe
  2⤵
  PID:9004
- C:\Windows\System\tXzWCYP.exe
  C:\Windows\System\tXzWCYP.exe
  2⤵
  PID:9020
- C:\Windows\System\FUOIVNV.exe
  C:\Windows\System\FUOIVNV.exe
  2⤵
  PID:9036
- C:\Windows\System\bpwYyyJ.exe
  C:\Windows\System\bpwYyyJ.exe
  2⤵
  PID:9052
- C:\Windows\System\SdxaqNT.exe
  C:\Windows\System\SdxaqNT.exe
  2⤵
  PID:9068
- C:\Windows\System\vunaQiW.exe
  C:\Windows\System\vunaQiW.exe
  2⤵
  PID:9084
- C:\Windows\System\dnMZwfD.exe
  C:\Windows\System\dnMZwfD.exe
  2⤵
  PID:9100
- C:\Windows\System\ZbNmVyT.exe
  C:\Windows\System\ZbNmVyT.exe
  2⤵
  PID:9116
- C:\Windows\System\npZmoJM.exe
  C:\Windows\System\npZmoJM.exe
  2⤵
  PID:9132
- C:\Windows\System\tEhNHDY.exe
  C:\Windows\System\tEhNHDY.exe
  2⤵
  PID:9152
- C:\Windows\System\MIsepZD.exe
  C:\Windows\System\MIsepZD.exe
  2⤵
  PID:9168
- C:\Windows\System\vRqVSTm.exe
  C:\Windows\System\vRqVSTm.exe
  2⤵
  PID:9184
- C:\Windows\System\CsxGJIu.exe
  C:\Windows\System\CsxGJIu.exe
  2⤵
  PID:9200
- C:\Windows\System\lKuLLZV.exe
  C:\Windows\System\lKuLLZV.exe
  2⤵
  PID:8196
- C:\Windows\System\mRAUulY.exe
  C:\Windows\System\mRAUulY.exe
  2⤵
  PID:8216
- C:\Windows\System\cyYnari.exe
  C:\Windows\System\cyYnari.exe
  2⤵
  PID:8260
- C:\Windows\System\zGDKgpb.exe
  C:\Windows\System\zGDKgpb.exe
  2⤵
  PID:8324
- C:\Windows\System\wFVTOJm.exe
  C:\Windows\System\wFVTOJm.exe
  2⤵
  PID:8276
- C:\Windows\System\FNRMULK.exe
  C:\Windows\System\FNRMULK.exe
  2⤵
  PID:8360
- C:\Windows\System\BmZSXzB.exe
  C:\Windows\System\BmZSXzB.exe
  2⤵
  PID:8420
- C:\Windows\System\uFlVdtq.exe
  C:\Windows\System\uFlVdtq.exe
  2⤵
  PID:8372
- C:\Windows\System\TXMzPdh.exe
  C:\Windows\System\TXMzPdh.exe
  2⤵
  PID:8516
- C:\Windows\System\IBuUsxv.exe
  C:\Windows\System\IBuUsxv.exe
  2⤵
  PID:8408
- C:\Windows\System\VitekYS.exe
  C:\Windows\System\VitekYS.exe
  2⤵
  PID:8500
- C:\Windows\System\wKWEczi.exe
  C:\Windows\System\wKWEczi.exe
  2⤵
  PID:8548
- C:\Windows\System\gGLryLy.exe
  C:\Windows\System\gGLryLy.exe
  2⤵
  PID:8612
- C:\Windows\System\UehhZnx.exe
  C:\Windows\System\UehhZnx.exe
  2⤵
  PID:8564
- C:\Windows\System\XqwrkXw.exe
  C:\Windows\System\XqwrkXw.exe
  2⤵
  PID:8712
- C:\Windows\System\irMTSnW.exe
  C:\Windows\System\irMTSnW.exe
  2⤵
  PID:8776
- C:\Windows\System\eryUqzf.exe
  C:\Windows\System\eryUqzf.exe
  2⤵
  PID:8840
- C:\Windows\System\GEPNDhr.exe
  C:\Windows\System\GEPNDhr.exe
  2⤵
  PID:8904
- C:\Windows\System\qLRRlAE.exe
  C:\Windows\System\qLRRlAE.exe
  2⤵
  PID:8964
- C:\Windows\System\pzUGwIB.exe
  C:\Windows\System\pzUGwIB.exe
  2⤵
  PID:8968
- C:\Windows\System\KWpLKJY.exe
  C:\Windows\System\KWpLKJY.exe
  2⤵
  PID:8728
- C:\Windows\System\VTLWBQh.exe
  C:\Windows\System\VTLWBQh.exe
  2⤵
  PID:8948
- C:\Windows\System\VnICZrZ.exe
  C:\Windows\System\VnICZrZ.exe
  2⤵
  PID:8792
- C:\Windows\System\NMNxdHz.exe
  C:\Windows\System\NMNxdHz.exe
  2⤵
  PID:8884
- C:\Windows\System\hzPbSUg.exe
  C:\Windows\System\hzPbSUg.exe
  2⤵
  PID:8824
- C:\Windows\System\ukRHGHK.exe
  C:\Windows\System\ukRHGHK.exe
  2⤵
  PID:9028
- C:\Windows\System\QXlprZI.exe
  C:\Windows\System\QXlprZI.exe
  2⤵
  PID:9576
- C:\Windows\System\AUqIaSn.exe
  C:\Windows\System\AUqIaSn.exe
  2⤵
  PID:9600
- C:\Windows\System\dgvtEaw.exe
  C:\Windows\System\dgvtEaw.exe
  2⤵
  PID:9644
- C:\Windows\System\NsuKqNy.exe
  C:\Windows\System\NsuKqNy.exe
  2⤵
  PID:9660
- C:\Windows\System\fzxxlqd.exe
  C:\Windows\System\fzxxlqd.exe
  2⤵
  PID:9676
- C:\Windows\System\Gupoeat.exe
  C:\Windows\System\Gupoeat.exe
  2⤵
  PID:9704
- C:\Windows\System\UWWSxRz.exe
  C:\Windows\System\UWWSxRz.exe
  2⤵
  PID:9720
- C:\Windows\System\SfcThbN.exe
  C:\Windows\System\SfcThbN.exe
  2⤵
  PID:9736
- C:\Windows\System\LEJQsfd.exe
  C:\Windows\System\LEJQsfd.exe
  2⤵
  PID:9756
- C:\Windows\System\faYzOmo.exe
  C:\Windows\System\faYzOmo.exe
  2⤵
  PID:9772
- C:\Windows\System\ORpjXmE.exe
  C:\Windows\System\ORpjXmE.exe
  2⤵
  PID:9788
- C:\Windows\System\vQemqla.exe
  C:\Windows\System\vQemqla.exe
  2⤵
  PID:9812
- C:\Windows\System\GUfKEmP.exe
  C:\Windows\System\GUfKEmP.exe
  2⤵
  PID:9828
- C:\Windows\System\jDXWCZf.exe
  C:\Windows\System\jDXWCZf.exe
  2⤵
  PID:9844
- C:\Windows\System\ipmErKu.exe
  C:\Windows\System\ipmErKu.exe
  2⤵
  PID:9860
- C:\Windows\System\nmuiogA.exe
  C:\Windows\System\nmuiogA.exe
  2⤵
  PID:9876
- C:\Windows\System\TxpLBgo.exe
  C:\Windows\System\TxpLBgo.exe
  2⤵
  PID:9896
- C:\Windows\System\eajcsgo.exe
  C:\Windows\System\eajcsgo.exe
  2⤵
  PID:9916
- C:\Windows\System\zuChilW.exe
  C:\Windows\System\zuChilW.exe
  2⤵
  PID:9932
- C:\Windows\System\npBEdYI.exe
  C:\Windows\System\npBEdYI.exe
  2⤵
  PID:9948
- C:\Windows\System\tSiskKg.exe
  C:\Windows\System\tSiskKg.exe
  2⤵
  PID:9964
- C:\Windows\System\vpukYIG.exe
  C:\Windows\System\vpukYIG.exe
  2⤵
  PID:10000
- C:\Windows\System\lwvxOsw.exe
  C:\Windows\System\lwvxOsw.exe
  2⤵
  PID:10016
- C:\Windows\System\ZXIIWTD.exe
  C:\Windows\System\ZXIIWTD.exe
  2⤵
  PID:10036
- C:\Windows\System\jbPJJKW.exe
  C:\Windows\System\jbPJJKW.exe
  2⤵
  PID:10052
- C:\Windows\System\wArkxJy.exe
  C:\Windows\System\wArkxJy.exe
  2⤵
  PID:10072
- C:\Windows\System\JmrOvJC.exe
  C:\Windows\System\JmrOvJC.exe
  2⤵
  PID:10088
- C:\Windows\System\JjWGKnZ.exe
  C:\Windows\System\JjWGKnZ.exe
  2⤵
  PID:10108
- C:\Windows\System\IInNJFG.exe
  C:\Windows\System\IInNJFG.exe
  2⤵
  PID:10124
- C:\Windows\System\bgFbacd.exe
  C:\Windows\System\bgFbacd.exe
  2⤵
  PID:10140
- C:\Windows\System\tDRfyjw.exe
  C:\Windows\System\tDRfyjw.exe
  2⤵
  PID:10160
- C:\Windows\System\XmWxdLx.exe
  C:\Windows\System\XmWxdLx.exe
  2⤵
  PID:10176
- C:\Windows\System\TUJVOss.exe
  C:\Windows\System\TUJVOss.exe
  2⤵
  PID:10192
- C:\Windows\System\mYfKlug.exe
  C:\Windows\System\mYfKlug.exe
  2⤵
  PID:10208
- C:\Windows\System\taxBBCx.exe
  C:\Windows\System\taxBBCx.exe
  2⤵
  PID:10232
- C:\Windows\System\giQlZxm.exe
  C:\Windows\System\giQlZxm.exe
  2⤵
  PID:9048
- C:\Windows\System\EioopPl.exe
  C:\Windows\System\EioopPl.exe
  2⤵
  PID:9124
- C:\Windows\System\HvJgeiS.exe
  C:\Windows\System\HvJgeiS.exe
  2⤵
  PID:9112
- C:\Windows\System\DgaEBaq.exe
  C:\Windows\System\DgaEBaq.exe
  2⤵
  PID:9164
- C:\Windows\System\CfTDtbO.exe
  C:\Windows\System\CfTDtbO.exe
  2⤵
  PID:8404
- C:\Windows\System\ubCBLvA.exe
  C:\Windows\System\ubCBLvA.exe
  2⤵
  PID:8676
- C:\Windows\System\cDQaond.exe
  C:\Windows\System\cDQaond.exe
  2⤵
  PID:9340
- C:\Windows\System\MvYUwjO.exe
  C:\Windows\System\MvYUwjO.exe
  2⤵
  PID:9180
- C:\Windows\System\aOVZfZr.exe
  C:\Windows\System\aOVZfZr.exe
  2⤵
  PID:8248
- C:\Windows\System\MSElnko.exe
  C:\Windows\System\MSElnko.exe
  2⤵
  PID:8456
- C:\Windows\System\NsRwzCF.exe
  C:\Windows\System\NsRwzCF.exe
  2⤵
  PID:8532
- C:\Windows\System\CKWcnqz.exe
  C:\Windows\System\CKWcnqz.exe
  2⤵
  PID:8596
- C:\Windows\System\KTHFCeC.exe
  C:\Windows\System\KTHFCeC.exe
  2⤵
  PID:8708
- C:\Windows\System\kpORitc.exe
  C:\Windows\System\kpORitc.exe
  2⤵
  PID:8472
- C:\Windows\System\rqOCiLB.exe
  C:\Windows\System\rqOCiLB.exe
  2⤵
  PID:8600
- C:\Windows\System\AyiDgSP.exe
  C:\Windows\System\AyiDgSP.exe
  2⤵
  PID:8856
- C:\Windows\System\BXHVAna.exe
  C:\Windows\System\BXHVAna.exe
  2⤵
  PID:8932
- C:\Windows\System\GIPmhGo.exe
  C:\Windows\System\GIPmhGo.exe
  2⤵
  PID:8628
- C:\Windows\System\MtDifCh.exe
  C:\Windows\System\MtDifCh.exe
  2⤵
  PID:9220
- C:\Windows\System\cRhIxLc.exe
  C:\Windows\System\cRhIxLc.exe
  2⤵
  PID:9236
- C:\Windows\System\HBjawFS.exe
  C:\Windows\System\HBjawFS.exe
  2⤵
  PID:9252
- C:\Windows\System\uLITotP.exe
  C:\Windows\System\uLITotP.exe
  2⤵
  PID:9268
- C:\Windows\System\GDkHzPZ.exe
  C:\Windows\System\GDkHzPZ.exe
  2⤵
  PID:9288
- C:\Windows\System\lxebCjC.exe
  C:\Windows\System\lxebCjC.exe
  2⤵
  PID:9392
- C:\Windows\System\tUhdbwd.exe
  C:\Windows\System\tUhdbwd.exe
  2⤵
  PID:9320
- C:\Windows\System\UIlxKoz.exe
  C:\Windows\System\UIlxKoz.exe
  2⤵
  PID:9336
- C:\Windows\System\wpgITZJ.exe
  C:\Windows\System\wpgITZJ.exe
  2⤵
  PID:9368
- C:\Windows\System\HRYNRvS.exe
  C:\Windows\System\HRYNRvS.exe
  2⤵
  PID:9396
- C:\Windows\System\vnIscUn.exe
  C:\Windows\System\vnIscUn.exe
  2⤵
  PID:9456
- C:\Windows\System\yaMBVkw.exe
  C:\Windows\System\yaMBVkw.exe
  2⤵
  PID:9472
- C:\Windows\System\lpQmCCc.exe
  C:\Windows\System\lpQmCCc.exe
  2⤵
  PID:9488
- C:\Windows\System\mfLXXrm.exe
  C:\Windows\System\mfLXXrm.exe
  2⤵
  PID:9504
- C:\Windows\System\fFXoVsP.exe
  C:\Windows\System\fFXoVsP.exe
  2⤵
  PID:9520
- C:\Windows\System\SInZbKu.exe
  C:\Windows\System\SInZbKu.exe
  2⤵
  PID:9536
- C:\Windows\System\aZdGvMT.exe
  C:\Windows\System\aZdGvMT.exe
  2⤵
  PID:9552
- C:\Windows\System\wXqimKu.exe
  C:\Windows\System\wXqimKu.exe
  2⤵
  PID:9568
- C:\Windows\System\zVSUnXc.exe
  C:\Windows\System\zVSUnXc.exe
  2⤵
  PID:9588
- C:\Windows\System\DIoRwnX.exe
  C:\Windows\System\DIoRwnX.exe
  2⤵
  PID:9684
- C:\Windows\System\RnYAeVt.exe
  C:\Windows\System\RnYAeVt.exe
  2⤵
  PID:9764
- C:\Windows\System\uKeoFNy.exe
  C:\Windows\System\uKeoFNy.exe
  2⤵
  PID:9840
- C:\Windows\System\IpEVxtu.exe
  C:\Windows\System\IpEVxtu.exe
  2⤵
  PID:9768
- C:\Windows\System\FRGvGma.exe
  C:\Windows\System\FRGvGma.exe
  2⤵
  PID:9940
- C:\Windows\System\XETjuoe.exe
  C:\Windows\System\XETjuoe.exe
  2⤵
  PID:9980
- C:\Windows\System\lHKefVg.exe
  C:\Windows\System\lHKefVg.exe
  2⤵
  PID:9668
- C:\Windows\System\MchXmCZ.exe
  C:\Windows\System\MchXmCZ.exe
  2⤵
  PID:9616
- C:\Windows\System\CIkTkTx.exe
  C:\Windows\System\CIkTkTx.exe
  2⤵
  PID:9632
- C:\Windows\System\XAoBUrt.exe
  C:\Windows\System\XAoBUrt.exe
  2⤵
  PID:9716
- C:\Windows\System\YvfHNmX.exe
  C:\Windows\System\YvfHNmX.exe
  2⤵
  PID:9752
- C:\Windows\System\ekzbbYf.exe
  C:\Windows\System\ekzbbYf.exe
  2⤵
  PID:9852
- C:\Windows\System\zcbvSVj.exe
  C:\Windows\System\zcbvSVj.exe
  2⤵
  PID:9892
- C:\Windows\System\sXisKwc.exe
  C:\Windows\System\sXisKwc.exe
  2⤵
  PID:9960
- C:\Windows\System\JZeIHce.exe
  C:\Windows\System\JZeIHce.exe
  2⤵
  PID:10032
- C:\Windows\System\nxTwRFf.exe
  C:\Windows\System\nxTwRFf.exe
  2⤵
  PID:10200
- C:\Windows\System\QlfSPiW.exe
  C:\Windows\System\QlfSPiW.exe
  2⤵
  PID:9080
- C:\Windows\System\NsFWQCi.exe
  C:\Windows\System\NsFWQCi.exe
  2⤵
  PID:9292
- C:\Windows\System\ioNOEDC.exe
  C:\Windows\System\ioNOEDC.exe
  2⤵
  PID:8212
- C:\Windows\System\xgayIIc.exe
  C:\Windows\System\xgayIIc.exe
  2⤵
  PID:8468
- C:\Windows\System\bDjyzZI.exe
  C:\Windows\System\bDjyzZI.exe
  2⤵
  PID:8916
- C:\Windows\System\PHMMiUj.exe
  C:\Windows\System\PHMMiUj.exe
  2⤵
  PID:9012
- C:\Windows\System\bJcLSLh.exe
  C:\Windows\System\bJcLSLh.exe
  2⤵
  PID:9284
- C:\Windows\System\KwmauAM.exe
  C:\Windows\System\KwmauAM.exe
  2⤵
  PID:9360
- C:\Windows\System\RvKqEUk.exe
  C:\Windows\System\RvKqEUk.exe
  2⤵
  PID:10012
- C:\Windows\System\hsmrUee.exe
  C:\Windows\System\hsmrUee.exe
  2⤵
  PID:10044
- C:\Windows\System\YjMmOWs.exe
  C:\Windows\System\YjMmOWs.exe
  2⤵
  PID:10148
- C:\Windows\System\LNRjPws.exe
  C:\Windows\System\LNRjPws.exe
  2⤵
  PID:10216
- C:\Windows\System\iCskTkY.exe
  C:\Windows\System\iCskTkY.exe
  2⤵
  PID:9076
- C:\Windows\System\fCzKKdq.exe
  C:\Windows\System\fCzKKdq.exe
  2⤵
  PID:8568
- C:\Windows\System\ZzawRri.exe
  C:\Windows\System\ZzawRri.exe
  2⤵
  PID:8296
- C:\Windows\System\gzRPhhR.exe
  C:\Windows\System\gzRPhhR.exe
  2⤵
  PID:8648
- C:\Windows\System\QWtNqmA.exe
  C:\Windows\System\QWtNqmA.exe
  2⤵
  PID:8788
- C:\Windows\System\hIbQZfZ.exe
  C:\Windows\System\hIbQZfZ.exe
  2⤵
  PID:9232
- C:\Windows\System\qwvVGmG.exe
  C:\Windows\System\qwvVGmG.exe
  2⤵
  PID:9380
- C:\Windows\System\LQZxLOn.exe
  C:\Windows\System\LQZxLOn.exe
  2⤵
  PID:9388
- C:\Windows\System\IMlgMym.exe
  C:\Windows\System\IMlgMym.exe
  2⤵
  PID:9424
- C:\Windows\System\BjAypoI.exe
  C:\Windows\System\BjAypoI.exe
  2⤵
  PID:9444
- C:\Windows\System\xBxXUyA.exe
  C:\Windows\System\xBxXUyA.exe
  2⤵
  PID:9480
- C:\Windows\System\eMXTgNl.exe
  C:\Windows\System\eMXTgNl.exe
  2⤵
  PID:9544
- C:\Windows\System\mpnBdSM.exe
  C:\Windows\System\mpnBdSM.exe
  2⤵
  PID:9692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BEcsMFA.exe

Filesize
1.8MB

MD5
36d693a8d03c9eed93673c4b86fb4463

SHA1
425bdb3152c47615959809704dd6481c0a11622a

SHA256
dc108cb5216d573f5a41d713f87a51a727dd72295d8c1b3e484d4855aeaeb492

SHA512
212eb9b30ac9c28ae35722ca608da2120f39ef23093d63970555c4c5cbd798b6b09cca121951bf0d25f1a9cb3f96e38e1027c6f54435b9d019cab555df268c3c

Download Submit
C:\Windows\system\EqiMjoB.exe

Filesize
1.8MB

MD5
abb814039e62e517d258bdff3fb721d5

SHA1
f588d1878d9b822dbf07e7ffaee666bdf9d2ab11

SHA256
0c82c053eaaf1085d7a811381352c24a7bc43e69b5890de63629d0f133a7a4a9

SHA512
9ffb6f8e334d6dad31f58fc3f983fabf951921dc7e8ca542dbd965a0b0473a3c1b8e0e1175f4633e6532322cfb8b3a00bb7866e87dcb1be8a1540530e52d80d1

Download Submit
C:\Windows\system\ErBsAdP.exe

Filesize
1.8MB

MD5
e4384fd615c6ae9b9a11a011ca6ee3ea

SHA1
56cad8a7e00aa40ab3179d03819536bf9a9b4968

SHA256
1dd3b5e6e064a18e1ea7018b6c645f7484497830269b08ee792273f266f2fea8

SHA512
b1de6ea750c7d62aafb34cd633444692303cfc3b93d3d67795d86945ec9e6ab3fa97cb5957e49c5f39505a02bed70a4076b809de6daf1f805e0f576225ad46ec

Download Submit
C:\Windows\system\FBsXiqg.exe

Filesize
1.8MB

MD5
c23b7cbfc98a5c576060d7f12fc50ccf

SHA1
1c697701ec43b045025c7658bf7df1fecd0ed135

SHA256
3e4ec6c7cfee3bf96e55e553ca395acd71e9d24498973baf506d5c22b29a2ef8

SHA512
79ab5b4029d6ab7c5f5cba2d798da789852007605817c563004fc0909ce253a152cdb21cd841cd76699841c3b57444d48eb4c5e5e3acb3014d2deee324733cb7

Download Submit
C:\Windows\system\GcjOkcK.exe

Filesize
1.8MB

MD5
3cce85a6308b7589ec16daf55bd86242

SHA1
9eca598eb6be8b36e4fbfb5c638046fe0fe4af63

SHA256
343c5d38c7230ed2bb20b55796b42315110343edb0a6b15d0485e58a2ed989da

SHA512
2e4a18a3e8c80f4cd74267f7328152848a87acb44a8f7e9f29e5524d5808ddda6a7bf62f975bff98e0cdf3e3cfbae4f02ce795f835486ef76c2b48f9ddb3915c

Download Submit
C:\Windows\system\GsTClWU.exe

Filesize
1.8MB

MD5
1b95eedb285891976bf2ae007626fc70

SHA1
c7bfea1caefd53b610192ee9526c50335e06681c

SHA256
196504309c3049f0da6e2333f8365d9f95b98024bb407b0f34c3a4ec9a71ba6a

SHA512
e50b5c2896387b817f5c543c5a52d6ea6739039a097c44b7d75023db9bd10a073ff14cf20be21f1aa3f7e29056c157d3fb200000bf8daf5cafe3896306e9a21c

Download Submit
C:\Windows\system\IKuLNWh.exe

Filesize
1.8MB

MD5
81de490143aad999e9c8eee5c17dbb80

SHA1
ac54215d0af7d551e7b2c6126f77a199020df73a

SHA256
9aaf5fb505ab4a80cd64c87bd34684c85a90408031d057b934f6aeac35794f0c

SHA512
f42792c755bcce6f4b807bd1606507a7d8836125070cbbda9dbfc3f46f6905ac9b92e0d01b1d9b1f59655ac959bae98f3727c7d5343e06daf5b2d07354635a15

Download Submit
C:\Windows\system\RRUQFHp.exe

Filesize
1.8MB

MD5
79993751b6879d5802280281f23b504f

SHA1
2317edc94aeb21f63a8db7c9e88d714bf6578de2

SHA256
a5f9ccff5da7e430a55b672a66b4fce7334e1057e8f830f68d0ec723838b444a

SHA512
0fc72fe9ecd09e6299c07b92feb1a5cc3ae1f5acfb3c2f9ee8de46519a6b7b3305446261b213d307ce21a27883ac88543fe03691c041a1ef66cbd23a0e671b11

Download Submit
C:\Windows\system\ZQjmMfL.exe

Filesize
1.8MB

MD5
afaa91ff7a0dff82006734d521a18559

SHA1
4b0e25991a002fdfdd2702b6bf2067d58c5a7347

SHA256
63fe9d88239fab0f42685816f012aa6b9f5f0cb47b7d0481bd6d31f031a4088b

SHA512
82d8d6fb1d4e0354dba42e0195e88a1af6cf9e3b7a123149ea498a6bfb5f2ccfbf239e748a76f35338cea53d79316cfe7996633a0a5d71db81e6c21b746bf26c

Download Submit
C:\Windows\system\annLzLC.exe

Filesize
1.8MB

MD5
0e3973f8e686a8529bff148bcdba8d37

SHA1
30f9826fd82d2e467443489213580718ed311c88

SHA256
c0c00fe2022361a822b1f209ac3b7e492fd826187f1abe78bb603b24e0cc1638

SHA512
5a2d2b9fac5b636baf6f5c83157dba898d91a0939c69a77e1b2fecce31dcc84ba2d700e1e311f71293a0b4d5b6de67e752542e5d255a789396b378a5502b79fd

Download Submit
C:\Windows\system\bNWGcyk.exe

Filesize
1.8MB

MD5
fccb7b40e51cc246c1cef90f92f9fe1d

SHA1
67c7a8794746cb26f2d6bc1996d33436c6936458

SHA256
924151cf19d7857dc8e4545d1ea6f6539af48d558d4e5779c384ac697f912511

SHA512
7793e7ce5f971c13bf6873112cfdd9ac421680ff5cf562d81e69cab1c89c0fd37ab9dd01f1985cbd1d521df370132c5356311259cbbac3726ecaf57efd260ec3

Download Submit
C:\Windows\system\hEGlflZ.exe

Filesize
1.8MB

MD5
b03ac40289d8e487d3cc181109eb7223

SHA1
b258021a5e82711fa1106b52f67744e77c820be3

SHA256
3cc63946b2b4d38a8ed727e8b941c0bbe856b7a692e6f412ad31c4722f0b5aa9

SHA512
fd853ee63956fcdca2dbec4441939037b222d77ce5f2b831568175f393a537ab8ca60ca673491235f03c8eed2265e608bed3c06a2d1fc4174e5f9899d382f851

Download Submit
C:\Windows\system\kosikVO.exe

Filesize
1.8MB

MD5
f8324ac0b411cd6ac7c63d475569583f

SHA1
e5a2d8eba43a3aec211d61601781e42c52006267

SHA256
2d6dc2d1c98f0398804597a1b0823347f9706ebde5d3aa5917c53ae8685e3b0b

SHA512
5d29afee98956f8a5a197b73a1dd69436eb0d45c674146ca2788d8a08c21c9bf49cb58997500a15fe19c579c923be3cc96a7e4dd31b7a57ddd42e2b674aae26c

Download Submit
C:\Windows\system\lZvgRky.exe

Filesize
1.8MB

MD5
523646f0ec0519b8f7dbca9d79472865

SHA1
43b65471b5d3b8364ade36c5f6b086419a1f98e6

SHA256
8428b90137e49253df006291a1d4a8b2952663b60923a0fb5a4f0c64a776f055

SHA512
0a83e39e9c2433ba0030ed921252434acef6a0ce20469384dc25da5db726d327ce37066cb64da3dc3083f71886ce0883519753146b0c30163783ae3a41fa35cf

Download Submit
C:\Windows\system\nPkMvhC.exe

Filesize
1.8MB

MD5
06df1d97a9fd66460d79af0ca7e9b393

SHA1
7202992649963154bff4c22323305fdb91e18700

SHA256
66bb269e7cf02172847024075b1b315c19a177813665c5189544bf34b51d2ea3

SHA512
8e38a4da64a59b09433f096208a59f85f2daf3677d41f7563147e30017452eaf2bbca22af65ea241ca8cec8bea80f7c2b9827bd98fccfcca49199b8b17629448

Download Submit
C:\Windows\system\pMENtiE.exe

Filesize
1.8MB

MD5
703e7322e0774ee4806c283e653831f7

SHA1
6886523e04c6b0a53331eb9f777ebe03d465f541

SHA256
99c02598f77c99b84c82edf8e5309268e1730960c672906a22795ede0d563c6b

SHA512
417b695148c6222ad97ff615c198ccec9a427bf1f31ad0d7216c6bab4b7c350bfb88c170978df8e1fcb45a3b5144acdee4d0520ace43c3955894f8af1bd0832c

Download Submit
C:\Windows\system\rBHrVOa.exe

Filesize
1.8MB

MD5
b99a592caa175702ee13903a844248eb

SHA1
e05564045991d77c6a5272ebd9d9822c0103797e

SHA256
41d2c45b03a293e6aa4c2d7088224c96c1127eaa742ce73678be1dd124d85efe

SHA512
8603de0726680a8a2cf36c23656339295f40d7af5ac4b8bf8af749a126d2dcf2a7a145b204dbef7d5c07e2535f2bdfd46d83307f576eac9c7b98b4ea7db60f66

Download Submit
C:\Windows\system\rbpHaMO.exe

Filesize
1.8MB

MD5
098f45b9a3d6d132d337141c4b1b172f

SHA1
4d94849cae81803471c8ffb569568641b67f15f5

SHA256
84f49e5e0e87b89c02d7b793a6002f4da8b1a5ad95196b0955193c65031bbc94

SHA512
6a58a0c4b651898e02076bd7979b0b75835c1f09eaa843d3be9ddc05c249bc63c26c2363bb3ba60450348946af2d6fb01fb8f9ece1c990a7546dbbc4279a3b85

Download Submit
C:\Windows\system\rkWNLZY.exe

Filesize
1.8MB

MD5
ab4a0258e61f63b0103abb2848d28f30

SHA1
465c23279b617889c9cc41e04639bec011390260

SHA256
ab01da64a5c1b1aa2387a70898ede74978fd14b24e9f7f42db36ff6bd06882fd

SHA512
77f9eb4f5f9a93fa2690e88738d97b78740aa07e7d27f3e8f6c795fe1537161f543b6c8e692f5a24bc2b5c93e67fa3781a8a1b4f567c9cd68c1cfbd1dbab6fae

Download Submit
C:\Windows\system\swXPRBK.exe

Filesize
1.8MB

MD5
f07efc843a6a315a004aa4d72ed08dd8

SHA1
37cd0eaad557bedc8edb27fa57bf6037d416ee39

SHA256
0bf2e79acc2b7cba823ed5e07f3a0b4e5a089aa46d1dc492e0ca1785f2696e2e

SHA512
1038e4963bca7b47af641e0829e71302ed6adec75456d20e02ca3a2fd9ae4b1cd9ed2befd35b101225dddda2eaa96237705b4e23cd5ffac8ee8c45a3d7dbc7c2

Download Submit
C:\Windows\system\vbnelMp.exe

Filesize
1.8MB

MD5
244670e353bcd0cc0de7090e744c0ddb

SHA1
87b90c657d3dc76039cd1c8ac68181b021f544cc

SHA256
d54167ddd77a444d47a17b8b5141497873f16dc76e0d253ceed38b17f9ce2665

SHA512
8da5b80d4fe49dfb6b3391f1f075c77d6cf0a980aaa8775ca089863cf8bb67519f78b1eff238931b95ee12137b20c1843813efcfb80bb6dffa16eb313b847795

Download Submit
C:\Windows\system\wlrnoel.exe

Filesize
1.8MB

MD5
49e59de0b79fc17fe40d6aa4ea0bfc39

SHA1
b41d3e3b041e18e41478fcea9c61d58a1f04dbc7

SHA256
9ef0d11e1ccc7718c45e861e178148be947e1636788de38ef46edb82d05c1397

SHA512
a1126fa3d2a72e30f0470e3e5a3a91e5f4c455ba7f23b9ba9115dbb904648ae9a0a8d33e0d5f78a0b26099fee65929833387ad252e0dfd155df7431c86ad008d

Download Submit
\Windows\system\DNAycyE.exe

Filesize
1.8MB

MD5
fec725bfbc6c216dc0c23b681ddd52da

SHA1
d8c0c7602af699b76eb5f99be6ea2d8654fdbf76

SHA256
3a5a1f20926dbe6441844862e18bf21424730c79869388f4008463b4ceaca996

SHA512
3e1111ec14ce4b704f95ed9e6e0042fe8ffd049af49b18bf12c9e8c5eba06ebfed97104380b6de35ded177c45d217d7057b4886ece6a90cb9363ebbb7382373f

Download Submit
\Windows\system\EikTMAp.exe

Filesize
1.8MB

MD5
7c816c1cc74d5eb659a633ea91ca5cd7

SHA1
667d77a9dbfbc5163dbf04aa1d8327be601aedbc

SHA256
ff6d96d03613935001f98e4cb55435c6260552ff8a2ff2e2a4097a3bdf0976d4

SHA512
22f97c710c812443f681748e02d1b6b29a6cfa97eb412c0c56a0b0e94669cd5a8889f06cdecd24a10b0b9fc8b1ab48ae1b204304d1c7780d6a709e0ed1bdcad1

Download Submit
\Windows\system\EqiCigb.exe

Filesize
1.8MB

MD5
e64adb18db8039b2ac0e8997b3eb6b92

SHA1
e4ac3d0fbb0ce14814300d958078c218ba930ae1

SHA256
7deae7c87973e4e0f54da2d27c6e954ef1e4d6219b2bb2248ce47463d0535eae

SHA512
e4ac824b0d8c86d661c4e621d3a6e60c9f8fadd16aaed29262d33c1fc2f97669afb13a00a9abba37c834af5c0b2189e307a25557ea3fbf0c872f5ea4aef40774

Download Submit
\Windows\system\GBEBYTO.exe

Filesize
1.8MB

MD5
6faaa2787642bdd53b6f91ce8221ad91

SHA1
725189caa8af428d1ed373c478d29cd3b5f818af

SHA256
be7c8bd7f04f35ca0ac7be8cb5ffefea392a704165cf83e3633765ccf1891e20

SHA512
a1ec1f54ac12aa5a816b7a80dd446ef163bcd4d57d614d7042d79ce68310c24b05ecf4f069ef0087a9f65dbeed79a427d4fee23d09189c3432b84e3668f4ade0

Download Submit
\Windows\system\KpykCYT.exe

Filesize
1.8MB

MD5
5cd1acda42b5f1fbc0bc9cf2e97b78ec

SHA1
3b32c3a4e8195d9a5053f6bba9d84f275fff52d5

SHA256
899e5257481db3a4ad75ab186978bcdfff89b748430fc996c5118fa93c475f36

SHA512
86277f67634a6f88d75a401ad158ccd8f61dc956b33ffa86e0f4460d1e41609f8c6d92ea3e6be868e55ed6224333ef4ade295cd371ac36f4e3c0fce9fc97659c

Download Submit
\Windows\system\LoTwCuW.exe

Filesize
1.8MB

MD5
90a0201c7d6836c18c8cacedbffd846a

SHA1
1ef9e7fd94905f429765aaf78c38d4d39a86b20a

SHA256
880e33503d119bdeb6de07dad9382c89b7a95e55b9ad08154e5c0097f273b81f

SHA512
627cfa140730448b9d9e3c8292c9051503d7dd14d2103152a23edf943a8a77ca6ce30bbbd2667866c66767d73d0244385c8e8a06ab6673ff45b8307ea4d5a18a

Download Submit
\Windows\system\OyrXwpV.exe

Filesize
1.8MB

MD5
47e2910edb0d2f2218741ccb636a4fd7

SHA1
3fdc449bf2b145ed58062f144e86fa15415bee6e

SHA256
ff0e68f4540108009940a606430c8ed650a1f16deab1013cd4ea9fc346cf1e3a

SHA512
f1dfc626fd3281b9bee30fbeb64963c700dd5b496b6ea4502347ba189b4f110be53c17c9c1892c0656697c758ab1a6d573a9d55d79e681839c218690a7bb4167

Download Submit
\Windows\system\Unknhzm.exe

Filesize
1.8MB

MD5
2e74abb392d5652bbfd320785a8faac3

SHA1
01947e03e2c982689b65f730bd8e15cc39449634

SHA256
be394aed63bad7cd4bce4d47f99fa210c3378fffbe664b1f36d7bf710ecef769

SHA512
c5b24d35a6ef31012c83c7381bbf57114928c14362931d74880d225078c832a81ffd862ffbb4c6bcb997fb45dd1e4ba29a712b34f0c87f3be16fbad4f5ea24a2

Download Submit
\Windows\system\jZyFxvq.exe

Filesize
1.8MB

MD5
ae2e9c2446bf6cbc711a2afc6dc8c898

SHA1
07044294017276920340f0a0c7a634ce9730ccbb

SHA256
c0f6ad443b21dbd9c79a889e05fe4b645e489e3b288be9513d1750dfd046b844

SHA512
43b3747d2cf239f1552a130ef90e2e797b411581346def68ab1f10f209564368c3373cd768327261da3054302657c1650810d010da323eb33eecde73d4a54a6d

Download Submit
\Windows\system\mRAjHJV.exe

Filesize
1.8MB

MD5
5c8f5be4f0f4e991af11d08fbddac967

SHA1
510b0012d3b241dadd26cd4a3585748ccffc73f1

SHA256
e82d85969a2fdc15e27a9f92128ab33e569e260fd2f4b2bbf34507824f3a3cb2

SHA512
be318dcca10b773b384112beadbf963c829f4373e65c3a25166435281eb34669a5df8c06186e4aeaab2bda39191803d6e35f7fe2bcafa8a7d5e18b9fedd829f1

Download Submit
\Windows\system\zTdNvga.exe

Filesize
1.8MB

MD5
c069d3cfaa4db6544360d63ae9f0d21d

SHA1
283b1268a227dfa28efba4ad28071decefe9a2d2

SHA256
be7a1be223b5686777a9e2885aaa662181af270a34517e5eff7b681c83e7123f

SHA512
c104e703e142faa70d0898470c7601b1ad25bfaec7df04f89684a3d91438a0d6d31496732c46e7470dbb503c0914eb5cbc173ffca990cc1999760ccd721d8ea8

Download Submit
memory/1300-38-0x0000000002040000-0x0000000002048000-memory.dmp

Filesize
32KB

Download
memory/1300-37-0x000000001B770000-0x000000001BA52000-memory.dmp

Filesize
2.9MB

Download
memory/1772-43-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/1996-1387-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-9-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/1996-79-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-54-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-68-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-83-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/1996-81-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/1996-85-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-22-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/1996-25-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/1996-26-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-29-0x0000000002E60000-0x0000000003252000-memory.dmp

Filesize
3.9MB

Download
memory/1996-36-0x0000000002E60000-0x0000000003252000-memory.dmp

Filesize
3.9MB

Download
memory/2052-30-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2080-61-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2176-23-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-55-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2512-56-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2636-27-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2656-91-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2716-28-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-72-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2948-89-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2960-90-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download