xmrig | bf8e3740a18f0a7e0d01d42266751762711d7eb9d94a2931e890e616326c4f93

Analysis

max time kernel
18s
max time network
28s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
Size

1.9MB
MD5

03b641e11f1258f47b4a15d1b82c71f6
SHA1

ef92648f02cfce0ee025de5fc3a5e67b513f417f
SHA256

bf8e3740a18f0a7e0d01d42266751762711d7eb9d94a2931e890e616326c4f93
SHA512

1b8817e1ea68a3959bb1d7cf7320315e54461c7a417e9034d4f88636e76aacd1d4d8abdb968d17fac208ce9c30c167044dc92038d01f27e320d2a15692325298
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pON:NABW

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/3028-161-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2736-159-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2564-158-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2264-157-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/2580-175-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2504-173-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2660-171-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2440-169-0x000000013F970000-0x000000013FD62000-memory.dmp	xmrig
behavioral1/memory/2492-167-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/1860-165-0x0000000002D20000-0x0000000003112000-memory.dmp	xmrig
behavioral1/memory/2572-164-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2264	aImpTah.exe
2564	PwzMXvE.exe
2736	zBeJTwr.exe
3028	xxtVkIi.exe
2572	lCvLZVJ.exe
2492	tUbpfET.exe
2440	ziMmmUn.exe
2660	LIzOlnq.exe
2504	LWiOmwv.exe
2580	YxAaPKA.exe
2524	uezDByA.exe
2556	yreCcVK.exe
852	kRtqweH.exe
2728	SjTPNUT.exe
1764	aSlgigU.exe
1216	JqpcSNF.exe
1352	JMnEFJy.exe
2496	JAaSsKm.exe
2644	fMNafjY.exe
2484	xkpFTzY.exe
904	QuYnZzC.exe
2688	TLvwsgO.exe
764	UQZKDYC.exe
2820	jreeTSJ.exe
1772	exJEPgc.exe
2116	QLgXBWu.exe
1504	DdOjrCJ.exe
2384	xUNFyIV.exe
288	ZgshWxE.exe
1668	seBLJsU.exe
640	eitFznj.exe
1856	sggNynv.exe
1664	Uritypw.exe
1280	IqUeYah.exe
2072	nXLsuno.exe
2324	CIffQnb.exe
684	AzsACqK.exe
1820	geRRVYa.exe
752	vVPEgWN.exe
860	tIZmAkH.exe
1712	OUVioaw.exe
2252	VxWSMAL.exe
940	xANfYnQ.exe
1816	pksRAvk.exe
1976	owPhkEN.exe
1992	YjrCFzP.exe
880	nPxUpsC.exe
2388	wxPkEzB.exe
1980	tSbRzcD.exe
2488	jIHQlTU.exe
1520	TzbwlCx.exe
2700	zSkPfgX.exe
1508	GOWmjyp.exe
488	KYilWKu.exe
2404	ewQpCSu.exe
2376	zdOuHvf.exe
2952	qRaQXOH.exe
2756	dVHIWhA.exe
1604	ADFCLhd.exe
604	CNijMzD.exe
1920	zeuAcJf.exe
1400	GsdNxhF.exe
2196	uaeJNfb.exe
1892	aoXyvxu.exe

Loads dropped DLL 64 IoCs

pid	Process
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1860-0-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/files/0x0008000000013a85-26.dat	upx
behavioral1/files/0x00060000000145d4-43.dat	upx
behavioral1/files/0x0006000000014730-55.dat	upx
behavioral1/files/0x000600000001475f-67.dat	upx
behavioral1/files/0x000600000001523e-99.dat	upx
behavioral1/files/0x0006000000015b37-119.dat	upx
behavioral1/files/0x00090000000134f5-12.dat	upx
behavioral1/files/0x003100000001313a-25.dat	upx
behavioral1/files/0x00060000000150aa-147.dat	upx
behavioral1/files/0x0006000000014fac-145.dat	upx
behavioral1/files/0x0006000000015ca9-189.dat	upx
behavioral1/memory/3028-161-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/2736-159-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2564-158-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/memory/2264-157-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/files/0x0006000000015a15-154.dat	upx
behavioral1/files/0x000600000001543a-152.dat	upx
behavioral1/files/0x00130000000054a8-148.dat	upx
behavioral1/files/0x00060000000148af-136.dat	upx
behavioral1/files/0x000600000001474b-130.dat	upx
behavioral1/files/0x00060000000146a7-128.dat	upx
behavioral1/files/0x0006000000015b72-122.dat	upx
behavioral1/files/0x00060000000145c9-118.dat	upx
behavioral1/files/0x0007000000015c9b-178.dat	upx
behavioral1/files/0x000800000001451d-90.dat	upx
behavioral1/files/0x0006000000014c0b-77.dat	upx
behavioral1/memory/2580-175-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/files/0x0008000000013a65-63.dat	upx
behavioral1/files/0x0006000000014525-40.dat	upx
behavioral1/memory/2504-173-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2660-171-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/2440-169-0x000000013F970000-0x000000013FD62000-memory.dmp	upx
behavioral1/memory/2492-167-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2572-164-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/files/0x0006000000015bb5-140.dat	upx
behavioral1/files/0x0008000000013a15-24.dat	upx
behavioral1/files/0x000900000001344f-23.dat	upx
behavioral1/files/0x000700000001211e-22.dat	upx
behavioral1/files/0x00060000000155e8-110.dat	upx
behavioral1/files/0x0006000000015077-95.dat	upx
behavioral1/files/0x0006000000014d0f-86.dat	upx
behavioral1/files/0x0006000000014a29-85.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JtABduK.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\lqSblUT.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\Wnyubye.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\yicIgPd.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\WpUNjXI.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\xGWPLhL.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\sbPhwXy.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\LAUAXvA.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\EnHacmY.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\YVYRzmQ.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\BnZKnJH.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\QlPcIGd.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\BrOifmo.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\uvgMFNA.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\mZVGApz.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\oaOLdqN.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\ZEpbtIj.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\KcohcYP.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\RyZzwYs.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\hBhBcrp.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\LIHZdch.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\VNEJMYU.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\uELLboX.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\CknSOak.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\AqpXXWn.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\BavaBhX.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\IGLalVG.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\gpFkJMI.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\GyhedMI.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\leXjKSu.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\JWsfgaD.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\xcmKTVf.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\vQycxLS.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\IqUeYah.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\kvYYagD.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\GAZokWi.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\DLElNNL.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\luLNjgQ.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\ZSphnpG.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\JFYsnEO.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\zAaVlzi.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\zeuAcJf.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\arERuuJ.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\qLEjANT.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\CETQhUJ.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\YPceOAG.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\YIgmKCx.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\vglhtdi.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\jUJTvVL.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\CeAiRxj.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\dSCBrih.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\OynZiXZ.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\UOGnCXi.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\exJEPgc.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\fTOEyUG.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\LLJDddd.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\atSAFOX.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\jaugESp.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\gRXeXve.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\LwYFHkm.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\XXizxwV.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\JAiurio.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\eXfkrHX.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
File created	C:\Windows\System\OibWQGO.exe	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2636	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
Token: SeDebugPrivilege	2636	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2636	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	29
PID 1860 wrote to memory of 2636	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	29
PID 1860 wrote to memory of 2636	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	29
PID 1860 wrote to memory of 2264	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	30
PID 1860 wrote to memory of 2264	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	30
PID 1860 wrote to memory of 2264	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	30
PID 1860 wrote to memory of 3028	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	31
PID 1860 wrote to memory of 3028	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	31
PID 1860 wrote to memory of 3028	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	31
PID 1860 wrote to memory of 2564	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	32
PID 1860 wrote to memory of 2564	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	32
PID 1860 wrote to memory of 2564	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	32
PID 1860 wrote to memory of 2660	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	33
PID 1860 wrote to memory of 2660	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	33
PID 1860 wrote to memory of 2660	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	33
PID 1860 wrote to memory of 2736	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	34
PID 1860 wrote to memory of 2736	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	34
PID 1860 wrote to memory of 2736	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	34
PID 1860 wrote to memory of 2580	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	35
PID 1860 wrote to memory of 2580	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	35
PID 1860 wrote to memory of 2580	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	35
PID 1860 wrote to memory of 2572	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	36
PID 1860 wrote to memory of 2572	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	36
PID 1860 wrote to memory of 2572	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	36
PID 1860 wrote to memory of 2728	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	37
PID 1860 wrote to memory of 2728	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	37
PID 1860 wrote to memory of 2728	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	37
PID 1860 wrote to memory of 2492	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	38
PID 1860 wrote to memory of 2492	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	38
PID 1860 wrote to memory of 2492	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	38
PID 1860 wrote to memory of 2496	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	39
PID 1860 wrote to memory of 2496	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	39
PID 1860 wrote to memory of 2496	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	39
PID 1860 wrote to memory of 2440	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	40
PID 1860 wrote to memory of 2440	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	40
PID 1860 wrote to memory of 2440	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	40
PID 1860 wrote to memory of 2484	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	41
PID 1860 wrote to memory of 2484	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	41
PID 1860 wrote to memory of 2484	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	41
PID 1860 wrote to memory of 2504	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	42
PID 1860 wrote to memory of 2504	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	42
PID 1860 wrote to memory of 2504	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	42
PID 1860 wrote to memory of 904	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	43
PID 1860 wrote to memory of 904	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	43
PID 1860 wrote to memory of 904	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	43
PID 1860 wrote to memory of 2524	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	44
PID 1860 wrote to memory of 2524	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	44
PID 1860 wrote to memory of 2524	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	44
PID 1860 wrote to memory of 2688	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	45
PID 1860 wrote to memory of 2688	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	45
PID 1860 wrote to memory of 2688	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	45
PID 1860 wrote to memory of 2556	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	46
PID 1860 wrote to memory of 2556	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	46
PID 1860 wrote to memory of 2556	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	46
PID 1860 wrote to memory of 2820	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	47
PID 1860 wrote to memory of 2820	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	47
PID 1860 wrote to memory of 2820	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	47
PID 1860 wrote to memory of 852	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	48
PID 1860 wrote to memory of 852	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	48
PID 1860 wrote to memory of 852	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	48
PID 1860 wrote to memory of 1772	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	49
PID 1860 wrote to memory of 1772	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	49
PID 1860 wrote to memory of 1772	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	49
PID 1860 wrote to memory of 1764	1860	03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03b641e11f1258f47b4a15d1b82c71f6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\System\aImpTah.exe
  C:\Windows\System\aImpTah.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\xxtVkIi.exe
  C:\Windows\System\xxtVkIi.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\PwzMXvE.exe
  C:\Windows\System\PwzMXvE.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\LIzOlnq.exe
  C:\Windows\System\LIzOlnq.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\zBeJTwr.exe
  C:\Windows\System\zBeJTwr.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\YxAaPKA.exe
  C:\Windows\System\YxAaPKA.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\lCvLZVJ.exe
  C:\Windows\System\lCvLZVJ.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\SjTPNUT.exe
  C:\Windows\System\SjTPNUT.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\tUbpfET.exe
  C:\Windows\System\tUbpfET.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\JAaSsKm.exe
  C:\Windows\System\JAaSsKm.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\ziMmmUn.exe
  C:\Windows\System\ziMmmUn.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\xkpFTzY.exe
  C:\Windows\System\xkpFTzY.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\LWiOmwv.exe
  C:\Windows\System\LWiOmwv.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\QuYnZzC.exe
  C:\Windows\System\QuYnZzC.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\uezDByA.exe
  C:\Windows\System\uezDByA.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\TLvwsgO.exe
  C:\Windows\System\TLvwsgO.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\yreCcVK.exe
  C:\Windows\System\yreCcVK.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\jreeTSJ.exe
  C:\Windows\System\jreeTSJ.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\kRtqweH.exe
  C:\Windows\System\kRtqweH.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\exJEPgc.exe
  C:\Windows\System\exJEPgc.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\aSlgigU.exe
  C:\Windows\System\aSlgigU.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\QLgXBWu.exe
  C:\Windows\System\QLgXBWu.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\JqpcSNF.exe
  C:\Windows\System\JqpcSNF.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\DdOjrCJ.exe
  C:\Windows\System\DdOjrCJ.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\JMnEFJy.exe
  C:\Windows\System\JMnEFJy.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\xUNFyIV.exe
  C:\Windows\System\xUNFyIV.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\fMNafjY.exe
  C:\Windows\System\fMNafjY.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\seBLJsU.exe
  C:\Windows\System\seBLJsU.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\UQZKDYC.exe
  C:\Windows\System\UQZKDYC.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\eitFznj.exe
  C:\Windows\System\eitFznj.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\ZgshWxE.exe
  C:\Windows\System\ZgshWxE.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\sggNynv.exe
  C:\Windows\System\sggNynv.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\Uritypw.exe
  C:\Windows\System\Uritypw.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\nXLsuno.exe
  C:\Windows\System\nXLsuno.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\IqUeYah.exe
  C:\Windows\System\IqUeYah.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\geRRVYa.exe
  C:\Windows\System\geRRVYa.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\CIffQnb.exe
  C:\Windows\System\CIffQnb.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\vVPEgWN.exe
  C:\Windows\System\vVPEgWN.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\AzsACqK.exe
  C:\Windows\System\AzsACqK.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\tIZmAkH.exe
  C:\Windows\System\tIZmAkH.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\OUVioaw.exe
  C:\Windows\System\OUVioaw.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\VxWSMAL.exe
  C:\Windows\System\VxWSMAL.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\xANfYnQ.exe
  C:\Windows\System\xANfYnQ.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\pksRAvk.exe
  C:\Windows\System\pksRAvk.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\owPhkEN.exe
  C:\Windows\System\owPhkEN.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\YjrCFzP.exe
  C:\Windows\System\YjrCFzP.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\nPxUpsC.exe
  C:\Windows\System\nPxUpsC.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\RkzfRtw.exe
  C:\Windows\System\RkzfRtw.exe
  2⤵
  PID:1428
- C:\Windows\System\wxPkEzB.exe
  C:\Windows\System\wxPkEzB.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\HEvhmDB.exe
  C:\Windows\System\HEvhmDB.exe
  2⤵
  PID:2128
- C:\Windows\System\tSbRzcD.exe
  C:\Windows\System\tSbRzcD.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\XXizxwV.exe
  C:\Windows\System\XXizxwV.exe
  2⤵
  PID:2656
- C:\Windows\System\jIHQlTU.exe
  C:\Windows\System\jIHQlTU.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\LmUfutj.exe
  C:\Windows\System\LmUfutj.exe
  2⤵
  PID:2472
- C:\Windows\System\TzbwlCx.exe
  C:\Windows\System\TzbwlCx.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\XwEaDov.exe
  C:\Windows\System\XwEaDov.exe
  2⤵
  PID:2928
- C:\Windows\System\zSkPfgX.exe
  C:\Windows\System\zSkPfgX.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\GCVjACy.exe
  C:\Windows\System\GCVjACy.exe
  2⤵
  PID:1588
- C:\Windows\System\GOWmjyp.exe
  C:\Windows\System\GOWmjyp.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\EFLcvNt.exe
  C:\Windows\System\EFLcvNt.exe
  2⤵
  PID:1360
- C:\Windows\System\KYilWKu.exe
  C:\Windows\System\KYilWKu.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\FLUQlxK.exe
  C:\Windows\System\FLUQlxK.exe
  2⤵
  PID:2420
- C:\Windows\System\ewQpCSu.exe
  C:\Windows\System\ewQpCSu.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\QcWHxxt.exe
  C:\Windows\System\QcWHxxt.exe
  2⤵
  PID:1228
- C:\Windows\System\zdOuHvf.exe
  C:\Windows\System\zdOuHvf.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\wnRAzPo.exe
  C:\Windows\System\wnRAzPo.exe
  2⤵
  PID:2576
- C:\Windows\System\qRaQXOH.exe
  C:\Windows\System\qRaQXOH.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\aEUjDeT.exe
  C:\Windows\System\aEUjDeT.exe
  2⤵
  PID:2512
- C:\Windows\System\dVHIWhA.exe
  C:\Windows\System\dVHIWhA.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\cppHiNv.exe
  C:\Windows\System\cppHiNv.exe
  2⤵
  PID:1500
- C:\Windows\System\ADFCLhd.exe
  C:\Windows\System\ADFCLhd.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\lRDnbPC.exe
  C:\Windows\System\lRDnbPC.exe
  2⤵
  PID:3024
- C:\Windows\System\CNijMzD.exe
  C:\Windows\System\CNijMzD.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\IdMczTg.exe
  C:\Windows\System\IdMczTg.exe
  2⤵
  PID:1204
- C:\Windows\System\zeuAcJf.exe
  C:\Windows\System\zeuAcJf.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\JcnzCZU.exe
  C:\Windows\System\JcnzCZU.exe
  2⤵
  PID:1708
- C:\Windows\System\GsdNxhF.exe
  C:\Windows\System\GsdNxhF.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\PFQUTJO.exe
  C:\Windows\System\PFQUTJO.exe
  2⤵
  PID:1692
- C:\Windows\System\uaeJNfb.exe
  C:\Windows\System\uaeJNfb.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\elgUGMZ.exe
  C:\Windows\System\elgUGMZ.exe
  2⤵
  PID:1824
- C:\Windows\System\aoXyvxu.exe
  C:\Windows\System\aoXyvxu.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\uIMTyzV.exe
  C:\Windows\System\uIMTyzV.exe
  2⤵
  PID:748
- C:\Windows\System\nHcvCQr.exe
  C:\Windows\System\nHcvCQr.exe
  2⤵
  PID:376
- C:\Windows\System\kwVKqMJ.exe
  C:\Windows\System\kwVKqMJ.exe
  2⤵
  PID:552
- C:\Windows\System\qVfbPVT.exe
  C:\Windows\System\qVfbPVT.exe
  2⤵
  PID:3020
- C:\Windows\System\qgnXPVX.exe
  C:\Windows\System\qgnXPVX.exe
  2⤵
  PID:992
- C:\Windows\System\nVyzbtw.exe
  C:\Windows\System\nVyzbtw.exe
  2⤵
  PID:1944
- C:\Windows\System\NWcVQfP.exe
  C:\Windows\System\NWcVQfP.exe
  2⤵
  PID:2904
- C:\Windows\System\JPdDJQl.exe
  C:\Windows\System\JPdDJQl.exe
  2⤵
  PID:1608
- C:\Windows\System\kGGhqcP.exe
  C:\Windows\System\kGGhqcP.exe
  2⤵
  PID:2316
- C:\Windows\System\jIuvynY.exe
  C:\Windows\System\jIuvynY.exe
  2⤵
  PID:2620
- C:\Windows\System\ngqxUyn.exe
  C:\Windows\System\ngqxUyn.exe
  2⤵
  PID:1532
- C:\Windows\System\zlSnyDW.exe
  C:\Windows\System\zlSnyDW.exe
  2⤵
  PID:2968
- C:\Windows\System\UjLLcxW.exe
  C:\Windows\System\UjLLcxW.exe
  2⤵
  PID:1056
- C:\Windows\System\oFFeMVe.exe
  C:\Windows\System\oFFeMVe.exe
  2⤵
  PID:2532
- C:\Windows\System\tNDJGDc.exe
  C:\Windows\System\tNDJGDc.exe
  2⤵
  PID:1784
- C:\Windows\System\AbftKWo.exe
  C:\Windows\System\AbftKWo.exe
  2⤵
  PID:2036
- C:\Windows\System\KBpdyHh.exe
  C:\Windows\System\KBpdyHh.exe
  2⤵
  PID:1728
- C:\Windows\System\asBPtCv.exe
  C:\Windows\System\asBPtCv.exe
  2⤵
  PID:1704
- C:\Windows\System\VSvvKjJ.exe
  C:\Windows\System\VSvvKjJ.exe
  2⤵
  PID:1436
- C:\Windows\System\WMYodvt.exe
  C:\Windows\System\WMYodvt.exe
  2⤵
  PID:1244
- C:\Windows\System\yhJJyfy.exe
  C:\Windows\System\yhJJyfy.exe
  2⤵
  PID:952
- C:\Windows\System\XStlFYH.exe
  C:\Windows\System\XStlFYH.exe
  2⤵
  PID:804
- C:\Windows\System\QTnTClO.exe
  C:\Windows\System\QTnTClO.exe
  2⤵
  PID:580
- C:\Windows\System\wXIjKQM.exe
  C:\Windows\System\wXIjKQM.exe
  2⤵
  PID:1960
- C:\Windows\System\eVwzWdL.exe
  C:\Windows\System\eVwzWdL.exe
  2⤵
  PID:1496
- C:\Windows\System\DODBqbC.exe
  C:\Windows\System\DODBqbC.exe
  2⤵
  PID:1752
- C:\Windows\System\hCNZhUw.exe
  C:\Windows\System\hCNZhUw.exe
  2⤵
  PID:3080
- C:\Windows\System\TfgaRzy.exe
  C:\Windows\System\TfgaRzy.exe
  2⤵
  PID:3096
- C:\Windows\System\wcKlVfb.exe
  C:\Windows\System\wcKlVfb.exe
  2⤵
  PID:3112
- C:\Windows\System\uuuKIuc.exe
  C:\Windows\System\uuuKIuc.exe
  2⤵
  PID:3128
- C:\Windows\System\pGIOhsN.exe
  C:\Windows\System\pGIOhsN.exe
  2⤵
  PID:3144
- C:\Windows\System\vqagGvv.exe
  C:\Windows\System\vqagGvv.exe
  2⤵
  PID:3160
- C:\Windows\System\hhEDRBF.exe
  C:\Windows\System\hhEDRBF.exe
  2⤵
  PID:3176
- C:\Windows\System\ohUGKsm.exe
  C:\Windows\System\ohUGKsm.exe
  2⤵
  PID:3192
- C:\Windows\System\luLNjgQ.exe
  C:\Windows\System\luLNjgQ.exe
  2⤵
  PID:3208
- C:\Windows\System\dJVrFIY.exe
  C:\Windows\System\dJVrFIY.exe
  2⤵
  PID:3224
- C:\Windows\System\UDMjQdD.exe
  C:\Windows\System\UDMjQdD.exe
  2⤵
  PID:3240
- C:\Windows\System\tsbZEod.exe
  C:\Windows\System\tsbZEod.exe
  2⤵
  PID:3256
- C:\Windows\System\JCZkUnl.exe
  C:\Windows\System\JCZkUnl.exe
  2⤵
  PID:3272
- C:\Windows\System\MKifNKr.exe
  C:\Windows\System\MKifNKr.exe
  2⤵
  PID:3288
- C:\Windows\System\bTmHOiJ.exe
  C:\Windows\System\bTmHOiJ.exe
  2⤵
  PID:3304
- C:\Windows\System\ktUWdti.exe
  C:\Windows\System\ktUWdti.exe
  2⤵
  PID:3320
- C:\Windows\System\gYOQQSQ.exe
  C:\Windows\System\gYOQQSQ.exe
  2⤵
  PID:3336
- C:\Windows\System\ITSYaHC.exe
  C:\Windows\System\ITSYaHC.exe
  2⤵
  PID:3352
- C:\Windows\System\oaOLdqN.exe
  C:\Windows\System\oaOLdqN.exe
  2⤵
  PID:3368
- C:\Windows\System\zBaaNDW.exe
  C:\Windows\System\zBaaNDW.exe
  2⤵
  PID:3384
- C:\Windows\System\fYozwBg.exe
  C:\Windows\System\fYozwBg.exe
  2⤵
  PID:3400
- C:\Windows\System\edQPjQi.exe
  C:\Windows\System\edQPjQi.exe
  2⤵
  PID:3416
- C:\Windows\System\PCiaToE.exe
  C:\Windows\System\PCiaToE.exe
  2⤵
  PID:3432
- C:\Windows\System\sERTRME.exe
  C:\Windows\System\sERTRME.exe
  2⤵
  PID:3448
- C:\Windows\System\CQTpQvM.exe
  C:\Windows\System\CQTpQvM.exe
  2⤵
  PID:3464
- C:\Windows\System\kvYYagD.exe
  C:\Windows\System\kvYYagD.exe
  2⤵
  PID:3480
- C:\Windows\System\lYRYceu.exe
  C:\Windows\System\lYRYceu.exe
  2⤵
  PID:3496
- C:\Windows\System\QIBRQlh.exe
  C:\Windows\System\QIBRQlh.exe
  2⤵
  PID:3512
- C:\Windows\System\gMbueKF.exe
  C:\Windows\System\gMbueKF.exe
  2⤵
  PID:3528
- C:\Windows\System\VNEJMYU.exe
  C:\Windows\System\VNEJMYU.exe
  2⤵
  PID:3544
- C:\Windows\System\rgzwRok.exe
  C:\Windows\System\rgzwRok.exe
  2⤵
  PID:3560
- C:\Windows\System\vglhtdi.exe
  C:\Windows\System\vglhtdi.exe
  2⤵
  PID:3576
- C:\Windows\System\ujnFtMI.exe
  C:\Windows\System\ujnFtMI.exe
  2⤵
  PID:3592
- C:\Windows\System\BkgfGWZ.exe
  C:\Windows\System\BkgfGWZ.exe
  2⤵
  PID:3608
- C:\Windows\System\PwauxsS.exe
  C:\Windows\System\PwauxsS.exe
  2⤵
  PID:3624
- C:\Windows\System\oFIvQJE.exe
  C:\Windows\System\oFIvQJE.exe
  2⤵
  PID:3640
- C:\Windows\System\oNSqBGf.exe
  C:\Windows\System\oNSqBGf.exe
  2⤵
  PID:3656
- C:\Windows\System\DNQKetD.exe
  C:\Windows\System\DNQKetD.exe
  2⤵
  PID:3672
- C:\Windows\System\XqTuayd.exe
  C:\Windows\System\XqTuayd.exe
  2⤵
  PID:3688
- C:\Windows\System\arERuuJ.exe
  C:\Windows\System\arERuuJ.exe
  2⤵
  PID:3704
- C:\Windows\System\hKQEsBa.exe
  C:\Windows\System\hKQEsBa.exe
  2⤵
  PID:3720
- C:\Windows\System\yRCMqRY.exe
  C:\Windows\System\yRCMqRY.exe
  2⤵
  PID:3736
- C:\Windows\System\GkQHERt.exe
  C:\Windows\System\GkQHERt.exe
  2⤵
  PID:3752
- C:\Windows\System\GMlSEKU.exe
  C:\Windows\System\GMlSEKU.exe
  2⤵
  PID:3768
- C:\Windows\System\rAyMbHI.exe
  C:\Windows\System\rAyMbHI.exe
  2⤵
  PID:3784
- C:\Windows\System\QlWZxZp.exe
  C:\Windows\System\QlWZxZp.exe
  2⤵
  PID:3800
- C:\Windows\System\DETQQHL.exe
  C:\Windows\System\DETQQHL.exe
  2⤵
  PID:3816
- C:\Windows\System\LuMijxf.exe
  C:\Windows\System\LuMijxf.exe
  2⤵
  PID:3832
- C:\Windows\System\oFRzuhb.exe
  C:\Windows\System\oFRzuhb.exe
  2⤵
  PID:3848
- C:\Windows\System\VEsSjOx.exe
  C:\Windows\System\VEsSjOx.exe
  2⤵
  PID:3864
- C:\Windows\System\kgUsOAV.exe
  C:\Windows\System\kgUsOAV.exe
  2⤵
  PID:3880
- C:\Windows\System\wksYfKM.exe
  C:\Windows\System\wksYfKM.exe
  2⤵
  PID:3896
- C:\Windows\System\xQiEDqU.exe
  C:\Windows\System\xQiEDqU.exe
  2⤵
  PID:3912
- C:\Windows\System\VzrWmUl.exe
  C:\Windows\System\VzrWmUl.exe
  2⤵
  PID:3928
- C:\Windows\System\dsQjjuR.exe
  C:\Windows\System\dsQjjuR.exe
  2⤵
  PID:3944
- C:\Windows\System\wTmXUas.exe
  C:\Windows\System\wTmXUas.exe
  2⤵
  PID:3960
- C:\Windows\System\AtUIjog.exe
  C:\Windows\System\AtUIjog.exe
  2⤵
  PID:3976
- C:\Windows\System\GAZokWi.exe
  C:\Windows\System\GAZokWi.exe
  2⤵
  PID:3992
- C:\Windows\System\SgFGoIU.exe
  C:\Windows\System\SgFGoIU.exe
  2⤵
  PID:4008
- C:\Windows\System\YVZWUsw.exe
  C:\Windows\System\YVZWUsw.exe
  2⤵
  PID:4024
- C:\Windows\System\LqauKdz.exe
  C:\Windows\System\LqauKdz.exe
  2⤵
  PID:4040
- C:\Windows\System\YVuPEvl.exe
  C:\Windows\System\YVuPEvl.exe
  2⤵
  PID:4056
- C:\Windows\System\nmjayEZ.exe
  C:\Windows\System\nmjayEZ.exe
  2⤵
  PID:4072
- C:\Windows\System\IKSxRWm.exe
  C:\Windows\System\IKSxRWm.exe
  2⤵
  PID:4088
- C:\Windows\System\sWhmyVJ.exe
  C:\Windows\System\sWhmyVJ.exe
  2⤵
  PID:2000
- C:\Windows\System\GHaBLWG.exe
  C:\Windows\System\GHaBLWG.exe
  2⤵
  PID:2444
- C:\Windows\System\xYnhEJQ.exe
  C:\Windows\System\xYnhEJQ.exe
  2⤵
  PID:3076
- C:\Windows\System\GJNsoQj.exe
  C:\Windows\System\GJNsoQj.exe
  2⤵
  PID:3140
- C:\Windows\System\iEGzzKQ.exe
  C:\Windows\System\iEGzzKQ.exe
  2⤵
  PID:1916
- C:\Windows\System\PeUsVUm.exe
  C:\Windows\System\PeUsVUm.exe
  2⤵
  PID:3236
- C:\Windows\System\OAxXuKo.exe
  C:\Windows\System\OAxXuKo.exe
  2⤵
  PID:3268
- C:\Windows\System\vdiuiXj.exe
  C:\Windows\System\vdiuiXj.exe
  2⤵
  PID:3332
- C:\Windows\System\cEUoxyj.exe
  C:\Windows\System\cEUoxyj.exe
  2⤵
  PID:3396
- C:\Windows\System\jssricz.exe
  C:\Windows\System\jssricz.exe
  2⤵
  PID:3456
- C:\Windows\System\PiSXJVT.exe
  C:\Windows\System\PiSXJVT.exe
  2⤵
  PID:3520
- C:\Windows\System\VAZKHcN.exe
  C:\Windows\System\VAZKHcN.exe
  2⤵
  PID:3584
- C:\Windows\System\jpZVfcF.exe
  C:\Windows\System\jpZVfcF.exe
  2⤵
  PID:3648
- C:\Windows\System\TWyDmaz.exe
  C:\Windows\System\TWyDmaz.exe
  2⤵
  PID:3712
- C:\Windows\System\sMIAjIv.exe
  C:\Windows\System\sMIAjIv.exe
  2⤵
  PID:3748
- C:\Windows\System\RJaUELa.exe
  C:\Windows\System\RJaUELa.exe
  2⤵
  PID:3812
- C:\Windows\System\imxhoww.exe
  C:\Windows\System\imxhoww.exe
  2⤵
  PID:3872
- C:\Windows\System\VCycrzI.exe
  C:\Windows\System\VCycrzI.exe
  2⤵
  PID:3936
- C:\Windows\System\IwaykYd.exe
  C:\Windows\System\IwaykYd.exe
  2⤵
  PID:4000
- C:\Windows\System\uELLboX.exe
  C:\Windows\System\uELLboX.exe
  2⤵
  PID:4064
- C:\Windows\System\pZzdMkJ.exe
  C:\Windows\System\pZzdMkJ.exe
  2⤵
  PID:2464
- C:\Windows\System\WApkamt.exe
  C:\Windows\System\WApkamt.exe
  2⤵
  PID:308
- C:\Windows\System\BavaBhX.exe
  C:\Windows\System\BavaBhX.exe
  2⤵
  PID:3488
- C:\Windows\System\evhsBNo.exe
  C:\Windows\System\evhsBNo.exe
  2⤵
  PID:2452
- C:\Windows\System\ryxqpcm.exe
  C:\Windows\System\ryxqpcm.exe
  2⤵
  PID:1432
- C:\Windows\System\hWunYvm.exe
  C:\Windows\System\hWunYvm.exe
  2⤵
  PID:1016
- C:\Windows\System\AjXxeUy.exe
  C:\Windows\System\AjXxeUy.exe
  2⤵
  PID:2172
- C:\Windows\System\pIlIhrC.exe
  C:\Windows\System\pIlIhrC.exe
  2⤵
  PID:2068
- C:\Windows\System\OsICrvS.exe
  C:\Windows\System\OsICrvS.exe
  2⤵
  PID:2244
- C:\Windows\System\RlVLvGZ.exe
  C:\Windows\System\RlVLvGZ.exe
  2⤵
  PID:3620
- C:\Windows\System\ybWOLLM.exe
  C:\Windows\System\ybWOLLM.exe
  2⤵
  PID:2136
- C:\Windows\System\jqYkaAP.exe
  C:\Windows\System\jqYkaAP.exe
  2⤵
  PID:1008
- C:\Windows\System\ZRyzrUR.exe
  C:\Windows\System\ZRyzrUR.exe
  2⤵
  PID:4100
- C:\Windows\System\UtdHFeQ.exe
  C:\Windows\System\UtdHFeQ.exe
  2⤵
  PID:4120
- C:\Windows\System\VNffiYv.exe
  C:\Windows\System\VNffiYv.exe
  2⤵
  PID:4136
- C:\Windows\System\IXFqHIN.exe
  C:\Windows\System\IXFqHIN.exe
  2⤵
  PID:4152
- C:\Windows\System\GyhedMI.exe
  C:\Windows\System\GyhedMI.exe
  2⤵
  PID:4168
- C:\Windows\System\yROCgjF.exe
  C:\Windows\System\yROCgjF.exe
  2⤵
  PID:4184
- C:\Windows\System\xGWPLhL.exe
  C:\Windows\System\xGWPLhL.exe
  2⤵
  PID:4200
- C:\Windows\System\IAcRbzR.exe
  C:\Windows\System\IAcRbzR.exe
  2⤵
  PID:4216
- C:\Windows\System\nXKrNMM.exe
  C:\Windows\System\nXKrNMM.exe
  2⤵
  PID:4232
- C:\Windows\System\GulLexI.exe
  C:\Windows\System\GulLexI.exe
  2⤵
  PID:4248
- C:\Windows\System\bHQfdir.exe
  C:\Windows\System\bHQfdir.exe
  2⤵
  PID:4264
- C:\Windows\System\nljdJMw.exe
  C:\Windows\System\nljdJMw.exe
  2⤵
  PID:4280
- C:\Windows\System\BrOifmo.exe
  C:\Windows\System\BrOifmo.exe
  2⤵
  PID:4296
- C:\Windows\System\niVPFXh.exe
  C:\Windows\System\niVPFXh.exe
  2⤵
  PID:4312
- C:\Windows\System\FotBjdq.exe
  C:\Windows\System\FotBjdq.exe
  2⤵
  PID:4328
- C:\Windows\System\WAuIFLg.exe
  C:\Windows\System\WAuIFLg.exe
  2⤵
  PID:4344
- C:\Windows\System\PtilpCT.exe
  C:\Windows\System\PtilpCT.exe
  2⤵
  PID:4360
- C:\Windows\System\ykPENAz.exe
  C:\Windows\System\ykPENAz.exe
  2⤵
  PID:4376
- C:\Windows\System\tzTivdG.exe
  C:\Windows\System\tzTivdG.exe
  2⤵
  PID:4392
- C:\Windows\System\eTDdpZo.exe
  C:\Windows\System\eTDdpZo.exe
  2⤵
  PID:4408
- C:\Windows\System\FvtBSBW.exe
  C:\Windows\System\FvtBSBW.exe
  2⤵
  PID:4424
- C:\Windows\System\RxJUlbr.exe
  C:\Windows\System\RxJUlbr.exe
  2⤵
  PID:4440
- C:\Windows\System\PFsYeJg.exe
  C:\Windows\System\PFsYeJg.exe
  2⤵
  PID:4456
- C:\Windows\System\JfkxtcL.exe
  C:\Windows\System\JfkxtcL.exe
  2⤵
  PID:4472
- C:\Windows\System\EnHacmY.exe
  C:\Windows\System\EnHacmY.exe
  2⤵
  PID:4488
- C:\Windows\System\qlDuBAO.exe
  C:\Windows\System\qlDuBAO.exe
  2⤵
  PID:4504
- C:\Windows\System\YGVriKS.exe
  C:\Windows\System\YGVriKS.exe
  2⤵
  PID:4524
- C:\Windows\System\DqELbkZ.exe
  C:\Windows\System\DqELbkZ.exe
  2⤵
  PID:4540
- C:\Windows\System\NDFEDko.exe
  C:\Windows\System\NDFEDko.exe
  2⤵
  PID:4556
- C:\Windows\System\lqSblUT.exe
  C:\Windows\System\lqSblUT.exe
  2⤵
  PID:4572
- C:\Windows\System\UkGocvN.exe
  C:\Windows\System\UkGocvN.exe
  2⤵
  PID:4588
- C:\Windows\System\mjirZlJ.exe
  C:\Windows\System\mjirZlJ.exe
  2⤵
  PID:4604
- C:\Windows\System\sqfyiwS.exe
  C:\Windows\System\sqfyiwS.exe
  2⤵
  PID:5104
- C:\Windows\System\YsgyOPs.exe
  C:\Windows\System\YsgyOPs.exe
  2⤵
  PID:1680
- C:\Windows\System\gTncLLt.exe
  C:\Windows\System\gTncLLt.exe
  2⤵
  PID:4164
- C:\Windows\System\VWLbrYG.exe
  C:\Windows\System\VWLbrYG.exe
  2⤵
  PID:4228
- C:\Windows\System\iEtPLMa.exe
  C:\Windows\System\iEtPLMa.exe
  2⤵
  PID:4320
- C:\Windows\System\FiAQnea.exe
  C:\Windows\System\FiAQnea.exe
  2⤵
  PID:4384
- C:\Windows\System\LUyxdeV.exe
  C:\Windows\System\LUyxdeV.exe
  2⤵
  PID:2640
- C:\Windows\System\qLEjANT.exe
  C:\Windows\System\qLEjANT.exe
  2⤵
  PID:4420
- C:\Windows\System\BFTmKic.exe
  C:\Windows\System\BFTmKic.exe
  2⤵
  PID:2816
- C:\Windows\System\cjfRxzw.exe
  C:\Windows\System\cjfRxzw.exe
  2⤵
  PID:4520
- C:\Windows\System\zJvfNLT.exe
  C:\Windows\System\zJvfNLT.exe
  2⤵
  PID:4584
- C:\Windows\System\fTOEyUG.exe
  C:\Windows\System\fTOEyUG.exe
  2⤵
  PID:4632
- C:\Windows\System\YxjQUdU.exe
  C:\Windows\System\YxjQUdU.exe
  2⤵
  PID:4648
- C:\Windows\System\UYAkwuY.exe
  C:\Windows\System\UYAkwuY.exe
  2⤵
  PID:4664
- C:\Windows\System\UGPIkaP.exe
  C:\Windows\System\UGPIkaP.exe
  2⤵
  PID:4684
- C:\Windows\System\qLpNptw.exe
  C:\Windows\System\qLpNptw.exe
  2⤵
  PID:4700
- C:\Windows\System\iYWVMvY.exe
  C:\Windows\System\iYWVMvY.exe
  2⤵
  PID:4716
- C:\Windows\System\XnTqfPN.exe
  C:\Windows\System\XnTqfPN.exe
  2⤵
  PID:4732
- C:\Windows\System\qBgujfC.exe
  C:\Windows\System\qBgujfC.exe
  2⤵
  PID:4748
- C:\Windows\System\bqrBhjZ.exe
  C:\Windows\System\bqrBhjZ.exe
  2⤵
  PID:4764
- C:\Windows\System\rTrReSM.exe
  C:\Windows\System\rTrReSM.exe
  2⤵
  PID:4780
- C:\Windows\System\wXxNNWZ.exe
  C:\Windows\System\wXxNNWZ.exe
  2⤵
  PID:4800
- C:\Windows\System\LLJDddd.exe
  C:\Windows\System\LLJDddd.exe
  2⤵
  PID:4816
- C:\Windows\System\jUJTvVL.exe
  C:\Windows\System\jUJTvVL.exe
  2⤵
  PID:4832
- C:\Windows\System\XgCYpSY.exe
  C:\Windows\System\XgCYpSY.exe
  2⤵
  PID:4848
- C:\Windows\System\LOVgnVL.exe
  C:\Windows\System\LOVgnVL.exe
  2⤵
  PID:4864
- C:\Windows\System\lwEPADr.exe
  C:\Windows\System\lwEPADr.exe
  2⤵
  PID:4884
- C:\Windows\System\QbiHKqI.exe
  C:\Windows\System\QbiHKqI.exe
  2⤵
  PID:4900
- C:\Windows\System\UyCYpct.exe
  C:\Windows\System\UyCYpct.exe
  2⤵
  PID:4920
- C:\Windows\System\XzcmGNP.exe
  C:\Windows\System\XzcmGNP.exe
  2⤵
  PID:4936
- C:\Windows\System\MENrAaG.exe
  C:\Windows\System\MENrAaG.exe
  2⤵
  PID:4952
- C:\Windows\System\FqEJOSH.exe
  C:\Windows\System\FqEJOSH.exe
  2⤵
  PID:4968
- C:\Windows\System\CeAiRxj.exe
  C:\Windows\System\CeAiRxj.exe
  2⤵
  PID:4984
- C:\Windows\System\GeBtKBJ.exe
  C:\Windows\System\GeBtKBJ.exe
  2⤵
  PID:4996
- C:\Windows\System\dSCBrih.exe
  C:\Windows\System\dSCBrih.exe
  2⤵
  PID:5012
- C:\Windows\System\JYAoygX.exe
  C:\Windows\System\JYAoygX.exe
  2⤵
  PID:5032
- C:\Windows\System\oxcxXVL.exe
  C:\Windows\System\oxcxXVL.exe
  2⤵
  PID:1040
- C:\Windows\System\KIUeqKr.exe
  C:\Windows\System\KIUeqKr.exe
  2⤵
  PID:5052
- C:\Windows\System\WuuaGyH.exe
  C:\Windows\System\WuuaGyH.exe
  2⤵
  PID:5068
- C:\Windows\System\nScQaCI.exe
  C:\Windows\System\nScQaCI.exe
  2⤵
  PID:5080
- C:\Windows\System\rciyjUi.exe
  C:\Windows\System\rciyjUi.exe
  2⤵
  PID:2208
- C:\Windows\System\SEEBoMy.exe
  C:\Windows\System\SEEBoMy.exe
  2⤵
  PID:1864
- C:\Windows\System\KhufJgi.exe
  C:\Windows\System\KhufJgi.exe
  2⤵
  PID:1676
- C:\Windows\System\OynZiXZ.exe
  C:\Windows\System\OynZiXZ.exe
  2⤵
  PID:3088
- C:\Windows\System\mEiGQxu.exe
  C:\Windows\System\mEiGQxu.exe
  2⤵
  PID:5092
- C:\Windows\System\BWnmkTC.exe
  C:\Windows\System\BWnmkTC.exe
  2⤵
  PID:4480
- C:\Windows\System\kZIzoTc.exe
  C:\Windows\System\kZIzoTc.exe
  2⤵
  PID:4416
- C:\Windows\System\ZEpbtIj.exe
  C:\Windows\System\ZEpbtIj.exe
  2⤵
  PID:3216
- C:\Windows\System\LQvYzzw.exe
  C:\Windows\System\LQvYzzw.exe
  2⤵
  PID:5132
- C:\Windows\System\ruSjNMb.exe
  C:\Windows\System\ruSjNMb.exe
  2⤵
  PID:5152
- C:\Windows\System\gahPnKm.exe
  C:\Windows\System\gahPnKm.exe
  2⤵
  PID:5168
- C:\Windows\System\uRAnesv.exe
  C:\Windows\System\uRAnesv.exe
  2⤵
  PID:5184
- C:\Windows\System\xbVgbev.exe
  C:\Windows\System\xbVgbev.exe
  2⤵
  PID:5200
- C:\Windows\System\xDGhcTh.exe
  C:\Windows\System\xDGhcTh.exe
  2⤵
  PID:5216
- C:\Windows\System\hfQzzmx.exe
  C:\Windows\System\hfQzzmx.exe
  2⤵
  PID:5232
- C:\Windows\System\OAbdbOp.exe
  C:\Windows\System\OAbdbOp.exe
  2⤵
  PID:5248
- C:\Windows\System\uoBcMFZ.exe
  C:\Windows\System\uoBcMFZ.exe
  2⤵
  PID:5268
- C:\Windows\System\JAiurio.exe
  C:\Windows\System\JAiurio.exe
  2⤵
  PID:5284
- C:\Windows\System\DvXwrmh.exe
  C:\Windows\System\DvXwrmh.exe
  2⤵
  PID:5300
- C:\Windows\System\LbVVldA.exe
  C:\Windows\System\LbVVldA.exe
  2⤵
  PID:5316
- C:\Windows\System\PVJDfae.exe
  C:\Windows\System\PVJDfae.exe
  2⤵
  PID:5332
- C:\Windows\System\MZYIidt.exe
  C:\Windows\System\MZYIidt.exe
  2⤵
  PID:5348
- C:\Windows\System\kDuLveI.exe
  C:\Windows\System\kDuLveI.exe
  2⤵
  PID:5364
- C:\Windows\System\ylyvcjW.exe
  C:\Windows\System\ylyvcjW.exe
  2⤵
  PID:5384
- C:\Windows\System\JdofqAA.exe
  C:\Windows\System\JdofqAA.exe
  2⤵
  PID:5400
- C:\Windows\System\qbMNwsV.exe
  C:\Windows\System\qbMNwsV.exe
  2⤵
  PID:5416
- C:\Windows\System\sqmoJnT.exe
  C:\Windows\System\sqmoJnT.exe
  2⤵
  PID:5432
- C:\Windows\System\NrcmNdq.exe
  C:\Windows\System\NrcmNdq.exe
  2⤵
  PID:5448
- C:\Windows\System\hpMUwIP.exe
  C:\Windows\System\hpMUwIP.exe
  2⤵
  PID:5464
- C:\Windows\System\ksDVVaL.exe
  C:\Windows\System\ksDVVaL.exe
  2⤵
  PID:5480
- C:\Windows\System\kNpiRtt.exe
  C:\Windows\System\kNpiRtt.exe
  2⤵
  PID:5500
- C:\Windows\System\ElfTICl.exe
  C:\Windows\System\ElfTICl.exe
  2⤵
  PID:5516
- C:\Windows\System\YVYRzmQ.exe
  C:\Windows\System\YVYRzmQ.exe
  2⤵
  PID:5532
- C:\Windows\System\CknSOak.exe
  C:\Windows\System\CknSOak.exe
  2⤵
  PID:5548
- C:\Windows\System\lbjcViF.exe
  C:\Windows\System\lbjcViF.exe
  2⤵
  PID:5564
- C:\Windows\System\fCixQmL.exe
  C:\Windows\System\fCixQmL.exe
  2⤵
  PID:5580
- C:\Windows\System\ZSphnpG.exe
  C:\Windows\System\ZSphnpG.exe
  2⤵
  PID:5600
- C:\Windows\System\aSScdoN.exe
  C:\Windows\System\aSScdoN.exe
  2⤵
  PID:5620
- C:\Windows\System\UluSAXy.exe
  C:\Windows\System\UluSAXy.exe
  2⤵
  PID:5732
- C:\Windows\System\jZoTEtF.exe
  C:\Windows\System\jZoTEtF.exe
  2⤵
  PID:5748
- C:\Windows\System\qZxqADp.exe
  C:\Windows\System\qZxqADp.exe
  2⤵
  PID:5764
- C:\Windows\System\kpEPDJM.exe
  C:\Windows\System\kpEPDJM.exe
  2⤵
  PID:5788
- C:\Windows\System\yhZZdTj.exe
  C:\Windows\System\yhZZdTj.exe
  2⤵
  PID:5884
- C:\Windows\System\GHxLuUT.exe
  C:\Windows\System\GHxLuUT.exe
  2⤵
  PID:5900
- C:\Windows\System\kCEDpfe.exe
  C:\Windows\System\kCEDpfe.exe
  2⤵
  PID:5916
- C:\Windows\System\AMISMuK.exe
  C:\Windows\System\AMISMuK.exe
  2⤵
  PID:5932
- C:\Windows\System\lZMnrQa.exe
  C:\Windows\System\lZMnrQa.exe
  2⤵
  PID:5956
- C:\Windows\System\ICGQWgw.exe
  C:\Windows\System\ICGQWgw.exe
  2⤵
  PID:5976
- C:\Windows\System\YwdqluL.exe
  C:\Windows\System\YwdqluL.exe
  2⤵
  PID:6000
- C:\Windows\System\ILMbJyW.exe
  C:\Windows\System\ILMbJyW.exe
  2⤵
  PID:6016
- C:\Windows\System\rVfkFnJ.exe
  C:\Windows\System\rVfkFnJ.exe
  2⤵
  PID:6032
- C:\Windows\System\dtXfqOX.exe
  C:\Windows\System\dtXfqOX.exe
  2⤵
  PID:6048
- C:\Windows\System\GkYtpoP.exe
  C:\Windows\System\GkYtpoP.exe
  2⤵
  PID:6064
- C:\Windows\System\LhWINRl.exe
  C:\Windows\System\LhWINRl.exe
  2⤵
  PID:6080
- C:\Windows\System\WVmFmLy.exe
  C:\Windows\System\WVmFmLy.exe
  2⤵
  PID:6096
- C:\Windows\System\AOIwrbG.exe
  C:\Windows\System\AOIwrbG.exe
  2⤵
  PID:6112
- C:\Windows\System\kiwRzYR.exe
  C:\Windows\System\kiwRzYR.exe
  2⤵
  PID:6128
- C:\Windows\System\IZjhIDq.exe
  C:\Windows\System\IZjhIDq.exe
  2⤵
  PID:3248
- C:\Windows\System\imMGnoP.exe
  C:\Windows\System\imMGnoP.exe
  2⤵
  PID:3316
- C:\Windows\System\ssqPUax.exe
  C:\Windows\System\ssqPUax.exe
  2⤵
  PID:3380
- C:\Windows\System\RALNfxF.exe
  C:\Windows\System\RALNfxF.exe
  2⤵
  PID:3472
- C:\Windows\System\laUzzOm.exe
  C:\Windows\System\laUzzOm.exe
  2⤵
  PID:3572
- C:\Windows\System\GcDQPva.exe
  C:\Windows\System\GcDQPva.exe
  2⤵
  PID:5100
- C:\Windows\System\QpCwedu.exe
  C:\Windows\System\QpCwedu.exe
  2⤵
  PID:3668
- C:\Windows\System\AzFFUUO.exe
  C:\Windows\System\AzFFUUO.exe
  2⤵
  PID:4948
- C:\Windows\System\dcJxcFA.exe
  C:\Windows\System\dcJxcFA.exe
  2⤵
  PID:3728
- C:\Windows\System\rjfsFvm.exe
  C:\Windows\System\rjfsFvm.exe
  2⤵
  PID:3792
- C:\Windows\System\iKeYSQL.exe
  C:\Windows\System\iKeYSQL.exe
  2⤵
  PID:5060
- C:\Windows\System\qyuoEKr.exe
  C:\Windows\System\qyuoEKr.exe
  2⤵
  PID:1568
- C:\Windows\System\EJQkSjE.exe
  C:\Windows\System\EJQkSjE.exe
  2⤵
  PID:3924
- C:\Windows\System\lnoNqDc.exe
  C:\Windows\System\lnoNqDc.exe
  2⤵
  PID:4080
- C:\Windows\System\ARdpKoO.exe
  C:\Windows\System\ARdpKoO.exe
  2⤵
  PID:3108
- C:\Windows\System\lOenYSh.exe
  C:\Windows\System\lOenYSh.exe
  2⤵
  PID:3328
- C:\Windows\System\wgFFSYl.exe
  C:\Windows\System\wgFFSYl.exe
  2⤵
  PID:4712
- C:\Windows\System\tPKRARo.exe
  C:\Windows\System\tPKRARo.exe
  2⤵
  PID:4776
- C:\Windows\System\jOXUIFE.exe
  C:\Windows\System\jOXUIFE.exe
  2⤵
  PID:4872
- C:\Windows\System\wtSZlTW.exe
  C:\Windows\System\wtSZlTW.exe
  2⤵
  PID:5008
- C:\Windows\System\oYWuWIs.exe
  C:\Windows\System\oYWuWIs.exe
  2⤵
  PID:5128
- C:\Windows\System\DORwxTg.exe
  C:\Windows\System\DORwxTg.exe
  2⤵
  PID:5224
- C:\Windows\System\rmTzDOR.exe
  C:\Windows\System\rmTzDOR.exe
  2⤵
  PID:5392
- C:\Windows\System\ulSaMVe.exe
  C:\Windows\System\ulSaMVe.exe
  2⤵
  PID:5644
- C:\Windows\System\UUGwDuR.exe
  C:\Windows\System\UUGwDuR.exe
  2⤵
  PID:5676
- C:\Windows\System\NLwyYuh.exe
  C:\Windows\System\NLwyYuh.exe
  2⤵
  PID:5700
- C:\Windows\System\QykiXQu.exe
  C:\Windows\System\QykiXQu.exe
  2⤵
  PID:5720
- C:\Windows\System\RUWJrIM.exe
  C:\Windows\System\RUWJrIM.exe
  2⤵
  PID:3556
- C:\Windows\System\gtyAjMc.exe
  C:\Windows\System\gtyAjMc.exe
  2⤵
  PID:3808
- C:\Windows\System\sbPhwXy.exe
  C:\Windows\System\sbPhwXy.exe
  2⤵
  PID:4036
- C:\Windows\System\DBjVYrG.exe
  C:\Windows\System\DBjVYrG.exe
  2⤵
  PID:984
- C:\Windows\System\wXMTlNr.exe
  C:\Windows\System\wXMTlNr.exe
  2⤵
  PID:2720
- C:\Windows\System\UOfaHrU.exe
  C:\Windows\System\UOfaHrU.exe
  2⤵
  PID:4240
- C:\Windows\System\GPvkUwl.exe
  C:\Windows\System\GPvkUwl.exe
  2⤵
  PID:2844
- C:\Windows\System\eXfkrHX.exe
  C:\Windows\System\eXfkrHX.exe
  2⤵
  PID:2544
- C:\Windows\System\YSsMWzi.exe
  C:\Windows\System\YSsMWzi.exe
  2⤵
  PID:1120
- C:\Windows\System\JOMVOyI.exe
  C:\Windows\System\JOMVOyI.exe
  2⤵
  PID:4464
- C:\Windows\System\lXMpKkD.exe
  C:\Windows\System\lXMpKkD.exe
  2⤵
  PID:1900
- C:\Windows\System\FFzpNLL.exe
  C:\Windows\System\FFzpNLL.exe
  2⤵
  PID:4052
- C:\Windows\System\sosgMPi.exe
  C:\Windows\System\sosgMPi.exe
  2⤵
  PID:3200
- C:\Windows\System\fyUlEDm.exe
  C:\Windows\System\fyUlEDm.exe
  2⤵
  PID:4108
- C:\Windows\System\EUhkpFX.exe
  C:\Windows\System\EUhkpFX.exe
  2⤵
  PID:4176
- C:\Windows\System\kbQCylR.exe
  C:\Windows\System\kbQCylR.exe
  2⤵
  PID:4336
- C:\Windows\System\tYQYzQa.exe
  C:\Windows\System\tYQYzQa.exe
  2⤵
  PID:5776
- C:\Windows\System\iDGZhLr.exe
  C:\Windows\System\iDGZhLr.exe
  2⤵
  PID:4532
- C:\Windows\System\YeyKpjD.exe
  C:\Windows\System\YeyKpjD.exe
  2⤵
  PID:5812
- C:\Windows\System\TgAkYBR.exe
  C:\Windows\System\TgAkYBR.exe
  2⤵
  PID:1936
- C:\Windows\System\FscGwIf.exe
  C:\Windows\System\FscGwIf.exe
  2⤵
  PID:1528
- C:\Windows\System\MDuaaue.exe
  C:\Windows\System\MDuaaue.exe
  2⤵
  PID:2584
- C:\Windows\System\AUJlvEN.exe
  C:\Windows\System\AUJlvEN.exe
  2⤵
  PID:2624
- C:\Windows\System\ecGwnFC.exe
  C:\Windows\System\ecGwnFC.exe
  2⤵
  PID:1620
- C:\Windows\System\FaNbKbb.exe
  C:\Windows\System\FaNbKbb.exe
  2⤵
  PID:2768
- C:\Windows\System\pEdIGUz.exe
  C:\Windows\System\pEdIGUz.exe
  2⤵
  PID:1424
- C:\Windows\System\GJrGWCp.exe
  C:\Windows\System\GJrGWCp.exe
  2⤵
  PID:1988
- C:\Windows\System\MRYDrCg.exe
  C:\Windows\System\MRYDrCg.exe
  2⤵
  PID:2872
- C:\Windows\System\CgvcRqT.exe
  C:\Windows\System\CgvcRqT.exe
  2⤵
  PID:1468
- C:\Windows\System\BFshfKM.exe
  C:\Windows\System\BFshfKM.exe
  2⤵
  PID:2540
- C:\Windows\System\vVpaioL.exe
  C:\Windows\System\vVpaioL.exe
  2⤵
  PID:5860
- C:\Windows\System\UOGnCXi.exe
  C:\Windows\System\UOGnCXi.exe
  2⤵
  PID:4224
- C:\Windows\System\fsjHGaQ.exe
  C:\Windows\System\fsjHGaQ.exe
  2⤵
  PID:2056
- C:\Windows\System\sRDngSY.exe
  C:\Windows\System\sRDngSY.exe
  2⤵
  PID:4628
- C:\Windows\System\oMbOtwl.exe
  C:\Windows\System\oMbOtwl.exe
  2⤵
  PID:4696
- C:\Windows\System\uIJeiAz.exe
  C:\Windows\System\uIJeiAz.exe
  2⤵
  PID:4760
- C:\Windows\System\QSrrwnk.exe
  C:\Windows\System\QSrrwnk.exe
  2⤵
  PID:5544
- C:\Windows\System\RyZzwYs.exe
  C:\Windows\System\RyZzwYs.exe
  2⤵
  PID:5476
- C:\Windows\System\JFYsnEO.exe
  C:\Windows\System\JFYsnEO.exe
  2⤵
  PID:5412
- C:\Windows\System\QfrKaok.exe
  C:\Windows\System\QfrKaok.exe
  2⤵
  PID:5372
- C:\Windows\System\CETQhUJ.exe
  C:\Windows\System\CETQhUJ.exe
  2⤵
  PID:5308
- C:\Windows\System\MkbrtvF.exe
  C:\Windows\System\MkbrtvF.exe
  2⤵
  PID:5240
- C:\Windows\System\rTUMeTo.exe
  C:\Windows\System\rTUMeTo.exe
  2⤵
  PID:5176
- C:\Windows\System\exYbJfT.exe
  C:\Windows\System\exYbJfT.exe
  2⤵
  PID:3188
- C:\Windows\System\jaugESp.exe
  C:\Windows\System\jaugESp.exe
  2⤵
  PID:2888
- C:\Windows\System\PYRahWb.exe
  C:\Windows\System\PYRahWb.exe
  2⤵
  PID:1412
- C:\Windows\System\VbflRUS.exe
  C:\Windows\System\VbflRUS.exe
  2⤵
  PID:4612
- C:\Windows\System\ExwQpBl.exe
  C:\Windows\System\ExwQpBl.exe
  2⤵
  PID:5024
- C:\Windows\System\OYjwNLW.exe
  C:\Windows\System\OYjwNLW.exe
  2⤵
  PID:4964
- C:\Windows\System\RgbHNUe.exe
  C:\Windows\System\RgbHNUe.exe
  2⤵
  PID:4896
- C:\Windows\System\nSoYSHz.exe
  C:\Windows\System\nSoYSHz.exe
  2⤵
  PID:4828
- C:\Windows\System\OTRddHT.exe
  C:\Windows\System\OTRddHT.exe
  2⤵
  PID:4788
- C:\Windows\System\Ijjdqiv.exe
  C:\Windows\System\Ijjdqiv.exe
  2⤵
  PID:5948
- C:\Windows\System\QLBplTb.exe
  C:\Windows\System\QLBplTb.exe
  2⤵
  PID:6028
- C:\Windows\System\HABDghW.exe
  C:\Windows\System\HABDghW.exe
  2⤵
  PID:6120
- C:\Windows\System\WSNqxPV.exe
  C:\Windows\System\WSNqxPV.exe
  2⤵
  PID:3312
- C:\Windows\System\fcQMNHA.exe
  C:\Windows\System\fcQMNHA.exe
  2⤵
  PID:3636
- C:\Windows\System\ggIoMGE.exe
  C:\Windows\System\ggIoMGE.exe
  2⤵
  PID:5892
- C:\Windows\System\omqHhnH.exe
  C:\Windows\System\omqHhnH.exe
  2⤵
  PID:3764
- C:\Windows\System\LuDgFOI.exe
  C:\Windows\System\LuDgFOI.exe
  2⤵
  PID:5084
- C:\Windows\System\nkdUnaY.exe
  C:\Windows\System\nkdUnaY.exe
  2⤵
  PID:2876
- C:\Windows\System\LsiQVmw.exe
  C:\Windows\System\LsiQVmw.exe
  2⤵
  PID:824
- C:\Windows\System\fDLPRIx.exe
  C:\Windows\System\fDLPRIx.exe
  2⤵
  PID:6108
- C:\Windows\System\TtPMZEm.exe
  C:\Windows\System\TtPMZEm.exe
  2⤵
  PID:3536
- C:\Windows\System\OQLliAg.exe
  C:\Windows\System\OQLliAg.exe
  2⤵
  PID:3664
- C:\Windows\System\aPadLnz.exe
  C:\Windows\System\aPadLnz.exe
  2⤵
  PID:5036
- C:\Windows\System\XZwMCjX.exe
  C:\Windows\System\XZwMCjX.exe
  2⤵
  PID:1004
- C:\Windows\System\LJQlRft.exe
  C:\Windows\System\LJQlRft.exe
  2⤵
  PID:4160
- C:\Windows\System\dMqkUPG.exe
  C:\Windows\System\dMqkUPG.exe
  2⤵
  PID:4580
- C:\Windows\System\tfgZDSq.exe
  C:\Windows\System\tfgZDSq.exe
  2⤵
  PID:4744
- C:\Windows\System\aAjUtiF.exe
  C:\Windows\System\aAjUtiF.exe
  2⤵
  PID:4880
- C:\Windows\System\RJRvRug.exe
  C:\Windows\System\RJRvRug.exe
  2⤵
  PID:5192
- C:\Windows\System\PBZBrSI.exe
  C:\Windows\System\PBZBrSI.exe
  2⤵
  PID:4812
- C:\Windows\System\bPstTsO.exe
  C:\Windows\System\bPstTsO.exe
  2⤵
  PID:1648
- C:\Windows\System\JSvleRc.exe
  C:\Windows\System\JSvleRc.exe
  2⤵
  PID:4292
- C:\Windows\System\KOTUEOO.exe
  C:\Windows\System\KOTUEOO.exe
  2⤵
  PID:1720
- C:\Windows\System\NSHPUOg.exe
  C:\Windows\System\NSHPUOg.exe
  2⤵
  PID:2224
- C:\Windows\System\jhJFILT.exe
  C:\Windows\System\jhJFILT.exe
  2⤵
  PID:1724
- C:\Windows\System\uQONVup.exe
  C:\Windows\System\uQONVup.exe
  2⤵
  PID:5492
- C:\Windows\System\uUdkURc.exe
  C:\Windows\System\uUdkURc.exe
  2⤵
  PID:5528
- C:\Windows\System\hrfBtzt.exe
  C:\Windows\System\hrfBtzt.exe
  2⤵
  PID:5560
- C:\Windows\System\cXoWRfx.exe
  C:\Windows\System\cXoWRfx.exe
  2⤵
  PID:5636
- C:\Windows\System\bsqFUmf.exe
  C:\Windows\System\bsqFUmf.exe
  2⤵
  PID:5660
- C:\Windows\System\zFsTuHf.exe
  C:\Windows\System\zFsTuHf.exe
  2⤵
  PID:5684
- C:\Windows\System\pzBTviS.exe
  C:\Windows\System\pzBTviS.exe
  2⤵
  PID:3552
- C:\Windows\System\IfoHyfP.exe
  C:\Windows\System\IfoHyfP.exe
  2⤵
  PID:3780
- C:\Windows\System\zvstRjH.exe
  C:\Windows\System\zvstRjH.exe
  2⤵
  PID:3392
- C:\Windows\System\zcKWMLJ.exe
  C:\Windows\System\zcKWMLJ.exe
  2⤵
  PID:4272
- C:\Windows\System\azftVGu.exe
  C:\Windows\System\azftVGu.exe
  2⤵
  PID:4564
- C:\Windows\System\AwYdcXR.exe
  C:\Windows\System\AwYdcXR.exe
  2⤵
  PID:4148
- C:\Windows\System\PJeefQj.exe
  C:\Windows\System\PJeefQj.exe
  2⤵
  PID:5744
- C:\Windows\System\wNSpNLa.exe
  C:\Windows\System\wNSpNLa.exe
  2⤵
  PID:4432
- C:\Windows\System\mvDOocn.exe
  C:\Windows\System\mvDOocn.exe
  2⤵
  PID:4500
- C:\Windows\System\htMMoZJ.exe
  C:\Windows\System\htMMoZJ.exe
  2⤵
  PID:5800
- C:\Windows\System\xImjGmh.exe
  C:\Windows\System\xImjGmh.exe
  2⤵
  PID:1208
- C:\Windows\System\IGLalVG.exe
  C:\Windows\System\IGLalVG.exe
  2⤵
  PID:1600
- C:\Windows\System\owvUVIQ.exe
  C:\Windows\System\owvUVIQ.exe
  2⤵
  PID:2004
- C:\Windows\System\PJOSaQM.exe
  C:\Windows\System\PJOSaQM.exe
  2⤵
  PID:2152
- C:\Windows\System\tQkZuAr.exe
  C:\Windows\System\tQkZuAr.exe
  2⤵
  PID:1144
- C:\Windows\System\MTXBGXv.exe
  C:\Windows\System\MTXBGXv.exe
  2⤵
  PID:2296
- C:\Windows\System\GNlGlUs.exe
  C:\Windows\System\GNlGlUs.exe
  2⤵
  PID:2140
- C:\Windows\System\SrIYtFq.exe
  C:\Windows\System\SrIYtFq.exe
  2⤵
  PID:2648
- C:\Windows\System\BDkOjkt.exe
  C:\Windows\System\BDkOjkt.exe
  2⤵
  PID:2824
- C:\Windows\System\WCqNwIk.exe
  C:\Windows\System\WCqNwIk.exe
  2⤵
  PID:2216
- C:\Windows\System\PuwBgCs.exe
  C:\Windows\System\PuwBgCs.exe
  2⤵
  PID:572
- C:\Windows\System\qkAItZR.exe
  C:\Windows\System\qkAItZR.exe
  2⤵
  PID:2884
- C:\Windows\System\mjexWCw.exe
  C:\Windows\System\mjexWCw.exe
  2⤵
  PID:5868
- C:\Windows\System\PjWUcUy.exe
  C:\Windows\System\PjWUcUy.exe
  2⤵
  PID:1996
- C:\Windows\System\vIvrsRq.exe
  C:\Windows\System\vIvrsRq.exe
  2⤵
  PID:5872
- C:\Windows\System\OibWQGO.exe
  C:\Windows\System\OibWQGO.exe
  2⤵
  PID:5112
- C:\Windows\System\ZPxFkRX.exe
  C:\Windows\System\ZPxFkRX.exe
  2⤵
  PID:5440
- C:\Windows\System\jToYlAA.exe
  C:\Windows\System\jToYlAA.exe
  2⤵
  PID:5340
- C:\Windows\System\OUdXjzp.exe
  C:\Windows\System\OUdXjzp.exe
  2⤵
  PID:4988
- C:\Windows\System\blBifrN.exe
  C:\Windows\System\blBifrN.exe
  2⤵
  PID:6060
- C:\Windows\System\cmVNHVs.exe
  C:\Windows\System\cmVNHVs.exe
  2⤵
  PID:3632
- C:\Windows\System\fuuvuCz.exe
  C:\Windows\System\fuuvuCz.exe
  2⤵
  PID:5928
- C:\Windows\System\hMbAePy.exe
  C:\Windows\System\hMbAePy.exe
  2⤵
  PID:3568
- C:\Windows\System\kMGTiej.exe
  C:\Windows\System\kMGTiej.exe
  2⤵
  PID:1644
- C:\Windows\System\LMjpDyc.exe
  C:\Windows\System\LMjpDyc.exe
  2⤵
  PID:6104
- C:\Windows\System\atSAFOX.exe
  C:\Windows\System\atSAFOX.exe
  2⤵
  PID:4728
- C:\Windows\System\KvGSDGJ.exe
  C:\Windows\System\KvGSDGJ.exe
  2⤵
  PID:5380
- C:\Windows\System\CjBhqaY.exe
  C:\Windows\System\CjBhqaY.exe
  2⤵
  PID:5276
- C:\Windows\System\xrMFrVQ.exe
  C:\Windows\System\xrMFrVQ.exe
  2⤵
  PID:1340
- C:\Windows\System\LKnmYZe.exe
  C:\Windows\System\LKnmYZe.exe
  2⤵
  PID:3892
- C:\Windows\System\uTueuYH.exe
  C:\Windows\System\uTueuYH.exe
  2⤵
  PID:4708
- C:\Windows\System\dquTEFi.exe
  C:\Windows\System\dquTEFi.exe
  2⤵
  PID:4792
- C:\Windows\System\wNtVdPa.exe
  C:\Windows\System\wNtVdPa.exe
  2⤵
  PID:3280
- C:\Windows\System\YPceOAG.exe
  C:\Windows\System\YPceOAG.exe
  2⤵
  PID:3760
- C:\Windows\System\nxJSmwn.exe
  C:\Windows\System\nxJSmwn.exe
  2⤵
  PID:5260
- C:\Windows\System\yQESzMP.exe
  C:\Windows\System\yQESzMP.exe
  2⤵
  PID:6140
- C:\Windows\System\abaWSPK.exe
  C:\Windows\System\abaWSPK.exe
  2⤵
  PID:3376
- C:\Windows\System\yaGQkeG.exe
  C:\Windows\System\yaGQkeG.exe
  2⤵
  PID:5728
- C:\Windows\System\gsLlnea.exe
  C:\Windows\System\gsLlnea.exe
  2⤵
  PID:3048
- C:\Windows\System\OJRjRsL.exe
  C:\Windows\System\OJRjRsL.exe
  2⤵
  PID:5296
- C:\Windows\System\HTiIfuE.exe
  C:\Windows\System\HTiIfuE.exe
  2⤵
  PID:1812
- C:\Windows\System\Wnyubye.exe
  C:\Windows\System\Wnyubye.exe
  2⤵
  PID:5524
- C:\Windows\System\mFaVpUU.exe
  C:\Windows\System\mFaVpUU.exe
  2⤵
  PID:5664
- C:\Windows\System\gzTyMag.exe
  C:\Windows\System\gzTyMag.exe
  2⤵
  PID:292
- C:\Windows\System\wfUYfiU.exe
  C:\Windows\System\wfUYfiU.exe
  2⤵
  PID:4372
- C:\Windows\System\PAkipdV.exe
  C:\Windows\System\PAkipdV.exe
  2⤵
  PID:5772
- C:\Windows\System\ZnlOIVv.exe
  C:\Windows\System\ZnlOIVv.exe
  2⤵
  PID:5588
- C:\Windows\System\bRzEmHz.exe
  C:\Windows\System\bRzEmHz.exe
  2⤵
  PID:5696
- C:\Windows\System\AgGmEZo.exe
  C:\Windows\System\AgGmEZo.exe
  2⤵
  PID:4600
- C:\Windows\System\DDFmJKH.exe
  C:\Windows\System\DDFmJKH.exe
  2⤵
  PID:2880
- C:\Windows\System\VgvVQcC.exe
  C:\Windows\System\VgvVQcC.exe
  2⤵
  PID:5940
- C:\Windows\System\rSqvFcd.exe
  C:\Windows\System\rSqvFcd.exe
  2⤵
  PID:4212
- C:\Windows\System\mzvtAMe.exe
  C:\Windows\System\mzvtAMe.exe
  2⤵
  PID:1196
- C:\Windows\System\jPeUeho.exe
  C:\Windows\System\jPeUeho.exe
  2⤵
  PID:1716
- C:\Windows\System\XNAstKZ.exe
  C:\Windows\System\XNAstKZ.exe
  2⤵
  PID:1172
- C:\Windows\System\gRXeXve.exe
  C:\Windows\System\gRXeXve.exe
  2⤵
  PID:4660
- C:\Windows\System\jExhKCG.exe
  C:\Windows\System\jExhKCG.exe
  2⤵
  PID:1700
- C:\Windows\System\yicIgPd.exe
  C:\Windows\System\yicIgPd.exe
  2⤵
  PID:6072
- C:\Windows\System\aBlmRRo.exe
  C:\Windows\System\aBlmRRo.exe
  2⤵
  PID:5144
- C:\Windows\System\VrTnGrA.exe
  C:\Windows\System\VrTnGrA.exe
  2⤵
  PID:4932
- C:\Windows\System\kHrYFQD.exe
  C:\Windows\System\kHrYFQD.exe
  2⤵
  PID:3348
- C:\Windows\System\IShopwr.exe
  C:\Windows\System\IShopwr.exe
  2⤵
  PID:5140
- C:\Windows\System\gJCcnPU.exe
  C:\Windows\System\gJCcnPU.exe
  2⤵
  PID:5672
- C:\Windows\System\JlhRSgs.exe
  C:\Windows\System\JlhRSgs.exe
  2⤵
  PID:2800
- C:\Windows\System\YmBZimV.exe
  C:\Windows\System\YmBZimV.exe
  2⤵
  PID:3860
- C:\Windows\System\NGjKEBW.exe
  C:\Windows\System\NGjKEBW.exe
  2⤵
  PID:5972
- C:\Windows\System\leXjKSu.exe
  C:\Windows\System\leXjKSu.exe
  2⤵
  PID:3604
- C:\Windows\System\AcUBzbI.exe
  C:\Windows\System\AcUBzbI.exe
  2⤵
  PID:5376
- C:\Windows\System\qxKaxnn.exe
  C:\Windows\System\qxKaxnn.exe
  2⤵
  PID:6024
- C:\Windows\System\efNacOq.exe
  C:\Windows\System\efNacOq.exe
  2⤵
  PID:4552
- C:\Windows\System\FOVtOmg.exe
  C:\Windows\System\FOVtOmg.exe
  2⤵
  PID:3684
- C:\Windows\System\jRPeAUx.exe
  C:\Windows\System\jRPeAUx.exe
  2⤵
  PID:5656
- C:\Windows\System\UwBMiiS.exe
  C:\Windows\System\UwBMiiS.exe
  2⤵
  PID:3508
- C:\Windows\System\uvgMFNA.exe
  C:\Windows\System\uvgMFNA.exe
  2⤵
  PID:2892
- C:\Windows\System\vkaYdHW.exe
  C:\Windows\System\vkaYdHW.exe
  2⤵
  PID:1552
- C:\Windows\System\ZckUSsi.exe
  C:\Windows\System\ZckUSsi.exe
  2⤵
  PID:300
- C:\Windows\System\KcohcYP.exe
  C:\Windows\System\KcohcYP.exe
  2⤵
  PID:2812
- C:\Windows\System\QBNnOFv.exe
  C:\Windows\System\QBNnOFv.exe
  2⤵
  PID:5508
- C:\Windows\System\mZVGApz.exe
  C:\Windows\System\mZVGApz.exe
  2⤵
  PID:5356
- C:\Windows\System\DQtEolf.exe
  C:\Windows\System\DQtEolf.exe
  2⤵
  PID:5924
- C:\Windows\System\nSiuvcB.exe
  C:\Windows\System\nSiuvcB.exe
  2⤵
  PID:1356
- C:\Windows\System\IoLzQvU.exe
  C:\Windows\System\IoLzQvU.exe
  2⤵
  PID:1632
- C:\Windows\System\mlHXruR.exe
  C:\Windows\System\mlHXruR.exe
  2⤵
  PID:5576
- C:\Windows\System\jCWBsbU.exe
  C:\Windows\System\jCWBsbU.exe
  2⤵
  PID:2260
- C:\Windows\System\ZYucffI.exe
  C:\Windows\System\ZYucffI.exe
  2⤵
  PID:5164
- C:\Windows\System\tPDvRfx.exe
  C:\Windows\System\tPDvRfx.exe
  2⤵
  PID:5708
- C:\Windows\System\YbmDPxp.exe
  C:\Windows\System\YbmDPxp.exe
  2⤵
  PID:3988
- C:\Windows\System\oqYHNXt.exe
  C:\Windows\System\oqYHNXt.exe
  2⤵
  PID:2956
- C:\Windows\System\AbXfmgU.exe
  C:\Windows\System\AbXfmgU.exe
  2⤵
  PID:2476
- C:\Windows\System\wnqaRut.exe
  C:\Windows\System\wnqaRut.exe
  2⤵
  PID:2300
- C:\Windows\System\kIspSwk.exe
  C:\Windows\System\kIspSwk.exe
  2⤵
  PID:3156
- C:\Windows\System\ZalrDSV.exe
  C:\Windows\System\ZalrDSV.exe
  2⤵
  PID:5460
- C:\Windows\System\JZvUSzY.exe
  C:\Windows\System\JZvUSzY.exe
  2⤵
  PID:5944
- C:\Windows\System\vsRrZbC.exe
  C:\Windows\System\vsRrZbC.exe
  2⤵
  PID:1572
- C:\Windows\System\nkXgpce.exe
  C:\Windows\System\nkXgpce.exe
  2⤵
  PID:624
- C:\Windows\System\bFsnVrj.exe
  C:\Windows\System\bFsnVrj.exe
  2⤵
  PID:1652
- C:\Windows\System\iPhPhrw.exe
  C:\Windows\System\iPhPhrw.exe
  2⤵
  PID:6164
- C:\Windows\System\HkHbPaP.exe
  C:\Windows\System\HkHbPaP.exe
  2⤵
  PID:6180
- C:\Windows\System\PfYGjqc.exe
  C:\Windows\System\PfYGjqc.exe
  2⤵
  PID:6196
- C:\Windows\System\TlhTnOs.exe
  C:\Windows\System\TlhTnOs.exe
  2⤵
  PID:6212
- C:\Windows\System\ZbZSgZM.exe
  C:\Windows\System\ZbZSgZM.exe
  2⤵
  PID:6228
- C:\Windows\System\elRRhRK.exe
  C:\Windows\System\elRRhRK.exe
  2⤵
  PID:6248
- C:\Windows\System\YfmimWe.exe
  C:\Windows\System\YfmimWe.exe
  2⤵
  PID:6264
- C:\Windows\System\aYSKtNC.exe
  C:\Windows\System\aYSKtNC.exe
  2⤵
  PID:6280
- C:\Windows\System\aaTsYON.exe
  C:\Windows\System\aaTsYON.exe
  2⤵
  PID:6300
- C:\Windows\System\hBhBcrp.exe
  C:\Windows\System\hBhBcrp.exe
  2⤵
  PID:6316
- C:\Windows\System\sLAHsVb.exe
  C:\Windows\System\sLAHsVb.exe
  2⤵
  PID:6332
- C:\Windows\System\JWsfgaD.exe
  C:\Windows\System\JWsfgaD.exe
  2⤵
  PID:6348
- C:\Windows\System\YIwZJeS.exe
  C:\Windows\System\YIwZJeS.exe
  2⤵
  PID:6364
- C:\Windows\System\kzqGjLe.exe
  C:\Windows\System\kzqGjLe.exe
  2⤵
  PID:6380
- C:\Windows\System\KApGgiC.exe
  C:\Windows\System\KApGgiC.exe
  2⤵
  PID:6396
- C:\Windows\System\bDVKpmR.exe
  C:\Windows\System\bDVKpmR.exe
  2⤵
  PID:6412
- C:\Windows\System\hegfboo.exe
  C:\Windows\System\hegfboo.exe
  2⤵
  PID:6428
- C:\Windows\System\JKvUhUD.exe
  C:\Windows\System\JKvUhUD.exe
  2⤵
  PID:6444
- C:\Windows\System\wRUKtcG.exe
  C:\Windows\System\wRUKtcG.exe
  2⤵
  PID:6464
- C:\Windows\System\IIlctGI.exe
  C:\Windows\System\IIlctGI.exe
  2⤵
  PID:6480
- C:\Windows\System\kmpDSCr.exe
  C:\Windows\System\kmpDSCr.exe
  2⤵
  PID:6496
- C:\Windows\System\iObLHOs.exe
  C:\Windows\System\iObLHOs.exe
  2⤵
  PID:6512
- C:\Windows\System\zWWFUvM.exe
  C:\Windows\System\zWWFUvM.exe
  2⤵
  PID:6528
- C:\Windows\System\PvjDqyw.exe
  C:\Windows\System\PvjDqyw.exe
  2⤵
  PID:6548
- C:\Windows\System\KhRFHDW.exe
  C:\Windows\System\KhRFHDW.exe
  2⤵
  PID:6564
- C:\Windows\System\XwIPgfm.exe
  C:\Windows\System\XwIPgfm.exe
  2⤵
  PID:6580
- C:\Windows\System\SVgMbPZ.exe
  C:\Windows\System\SVgMbPZ.exe
  2⤵
  PID:6596
- C:\Windows\System\fBgJbYL.exe
  C:\Windows\System\fBgJbYL.exe
  2⤵
  PID:6612
- C:\Windows\System\kCItlDK.exe
  C:\Windows\System\kCItlDK.exe
  2⤵
  PID:6628
- C:\Windows\System\gEJiXXH.exe
  C:\Windows\System\gEJiXXH.exe
  2⤵
  PID:6644
- C:\Windows\System\jTYaJXd.exe
  C:\Windows\System\jTYaJXd.exe
  2⤵
  PID:6660
- C:\Windows\System\xPrpiZe.exe
  C:\Windows\System\xPrpiZe.exe
  2⤵
  PID:6676
- C:\Windows\System\lrXTWWt.exe
  C:\Windows\System\lrXTWWt.exe
  2⤵
  PID:6692
- C:\Windows\System\xcmKTVf.exe
  C:\Windows\System\xcmKTVf.exe
  2⤵
  PID:6708
- C:\Windows\System\xJIolGD.exe
  C:\Windows\System\xJIolGD.exe
  2⤵
  PID:6724
- C:\Windows\System\SiIQJUB.exe
  C:\Windows\System\SiIQJUB.exe
  2⤵
  PID:6740
- C:\Windows\System\msFViJq.exe
  C:\Windows\System\msFViJq.exe
  2⤵
  PID:6756
- C:\Windows\System\DMoeADb.exe
  C:\Windows\System\DMoeADb.exe
  2⤵
  PID:6772
- C:\Windows\System\enckmAR.exe
  C:\Windows\System\enckmAR.exe
  2⤵
  PID:6788
- C:\Windows\System\EZTXJDU.exe
  C:\Windows\System\EZTXJDU.exe
  2⤵
  PID:6804
- C:\Windows\System\jFOGNtq.exe
  C:\Windows\System\jFOGNtq.exe
  2⤵
  PID:6820
- C:\Windows\System\TQIzajJ.exe
  C:\Windows\System\TQIzajJ.exe
  2⤵
  PID:6836
- C:\Windows\System\LwYFHkm.exe
  C:\Windows\System\LwYFHkm.exe
  2⤵
  PID:6852
- C:\Windows\System\BamFqNv.exe
  C:\Windows\System\BamFqNv.exe
  2⤵
  PID:6868
- C:\Windows\System\xukvTGd.exe
  C:\Windows\System\xukvTGd.exe
  2⤵
  PID:6884
- C:\Windows\System\gpFkJMI.exe
  C:\Windows\System\gpFkJMI.exe
  2⤵
  PID:6900
- C:\Windows\System\pVLZTjI.exe
  C:\Windows\System\pVLZTjI.exe
  2⤵
  PID:6916
- C:\Windows\System\tQoICsq.exe
  C:\Windows\System\tQoICsq.exe
  2⤵
  PID:6932
- C:\Windows\System\eUhfqwr.exe
  C:\Windows\System\eUhfqwr.exe
  2⤵
  PID:6948
- C:\Windows\System\bxhHqEc.exe
  C:\Windows\System\bxhHqEc.exe
  2⤵
  PID:6964
- C:\Windows\System\lwWaJwx.exe
  C:\Windows\System\lwWaJwx.exe
  2⤵
  PID:6980
- C:\Windows\System\ZGVUaPp.exe
  C:\Windows\System\ZGVUaPp.exe
  2⤵
  PID:6996
- C:\Windows\System\tWAOYQf.exe
  C:\Windows\System\tWAOYQf.exe
  2⤵
  PID:7012
- C:\Windows\System\KIJdhDG.exe
  C:\Windows\System\KIJdhDG.exe
  2⤵
  PID:7028
- C:\Windows\System\IyUaPcd.exe
  C:\Windows\System\IyUaPcd.exe
  2⤵
  PID:7044
- C:\Windows\System\zAaVlzi.exe
  C:\Windows\System\zAaVlzi.exe
  2⤵
  PID:7060
- C:\Windows\System\fVOVpbY.exe
  C:\Windows\System\fVOVpbY.exe
  2⤵
  PID:7076
- C:\Windows\System\ENcxxXE.exe
  C:\Windows\System\ENcxxXE.exe
  2⤵
  PID:7092
- C:\Windows\System\WaQvbpW.exe
  C:\Windows\System\WaQvbpW.exe
  2⤵
  PID:7108
- C:\Windows\System\yTblQYy.exe
  C:\Windows\System\yTblQYy.exe
  2⤵
  PID:7124
- C:\Windows\System\ZhGWzQW.exe
  C:\Windows\System\ZhGWzQW.exe
  2⤵
  PID:7140
- C:\Windows\System\WDXxTMd.exe
  C:\Windows\System\WDXxTMd.exe
  2⤵
  PID:7156
- C:\Windows\System\RtCezEe.exe
  C:\Windows\System\RtCezEe.exe
  2⤵
  PID:4144
- C:\Windows\System\EauajkG.exe
  C:\Windows\System\EauajkG.exe
  2⤵
  PID:6172
- C:\Windows\System\FDEBUYy.exe
  C:\Windows\System\FDEBUYy.exe
  2⤵
  PID:5048
- C:\Windows\System\XERZbZU.exe
  C:\Windows\System\XERZbZU.exe
  2⤵
  PID:272
- C:\Windows\System\fDXsGcE.exe
  C:\Windows\System\fDXsGcE.exe
  2⤵
  PID:6208
- C:\Windows\System\ukpQOhZ.exe
  C:\Windows\System\ukpQOhZ.exe
  2⤵
  PID:6272
- C:\Windows\System\LAUAXvA.exe
  C:\Windows\System\LAUAXvA.exe
  2⤵
  PID:6340
- C:\Windows\System\VlsjbKV.exe
  C:\Windows\System\VlsjbKV.exe
  2⤵
  PID:5820
- C:\Windows\System\dGAbsQE.exe
  C:\Windows\System\dGAbsQE.exe
  2⤵
  PID:6152
- C:\Windows\System\DslcDVo.exe
  C:\Windows\System\DslcDVo.exe
  2⤵
  PID:6192
- C:\Windows\System\vQycxLS.exe
  C:\Windows\System\vQycxLS.exe
  2⤵
  PID:6436
- C:\Windows\System\NFexAmY.exe
  C:\Windows\System\NFexAmY.exe
  2⤵
  PID:6440
- C:\Windows\System\ChmHJww.exe
  C:\Windows\System\ChmHJww.exe
  2⤵
  PID:6504
- C:\Windows\System\tUsokTO.exe
  C:\Windows\System\tUsokTO.exe
  2⤵
  PID:6420
- C:\Windows\System\PXGUSMb.exe
  C:\Windows\System\PXGUSMb.exe
  2⤵
  PID:6356
- C:\Windows\System\QfQtfQF.exe
  C:\Windows\System\QfQtfQF.exe
  2⤵
  PID:6424
- C:\Windows\System\oDLVDga.exe
  C:\Windows\System\oDLVDga.exe
  2⤵
  PID:6540
- C:\Windows\System\SFxhCIm.exe
  C:\Windows\System\SFxhCIm.exe
  2⤵
  PID:6576
- C:\Windows\System\LYJIVsE.exe
  C:\Windows\System\LYJIVsE.exe
  2⤵
  PID:6608
- C:\Windows\System\gcUOyPP.exe
  C:\Windows\System\gcUOyPP.exe
  2⤵
  PID:6624
- C:\Windows\System\vkBKcYt.exe
  C:\Windows\System\vkBKcYt.exe
  2⤵
  PID:6700
- C:\Windows\System\imwdsyx.exe
  C:\Windows\System\imwdsyx.exe
  2⤵
  PID:6652
- C:\Windows\System\XUfgaqL.exe
  C:\Windows\System\XUfgaqL.exe
  2⤵
  PID:6764
- C:\Windows\System\hKioqCS.exe
  C:\Windows\System\hKioqCS.exe
  2⤵
  PID:6720
- C:\Windows\System\sXTGxEt.exe
  C:\Windows\System\sXTGxEt.exe
  2⤵
  PID:6832
- C:\Windows\System\ziwibMZ.exe
  C:\Windows\System\ziwibMZ.exe
  2⤵
  PID:6896
- C:\Windows\System\GEXeoNS.exe
  C:\Windows\System\GEXeoNS.exe
  2⤵
  PID:6812
- C:\Windows\System\mpsJUpH.exe
  C:\Windows\System\mpsJUpH.exe
  2⤵
  PID:7004
- C:\Windows\System\WpUNjXI.exe
  C:\Windows\System\WpUNjXI.exe
  2⤵
  PID:7040
- C:\Windows\System\HGXjbOT.exe
  C:\Windows\System\HGXjbOT.exe
  2⤵
  PID:6780
- C:\Windows\System\Yylznej.exe
  C:\Windows\System\Yylznej.exe
  2⤵
  PID:6848
- C:\Windows\System\voRaiaJ.exe
  C:\Windows\System\voRaiaJ.exe
  2⤵
  PID:7052
- C:\Windows\System\wrMdLoT.exe
  C:\Windows\System\wrMdLoT.exe
  2⤵
  PID:7116
- C:\Windows\System\AqpXXWn.exe
  C:\Windows\System\AqpXXWn.exe
  2⤵
  PID:2448
- C:\Windows\System\LIHZdch.exe
  C:\Windows\System\LIHZdch.exe
  2⤵
  PID:6972
- C:\Windows\System\eCkWxnN.exe
  C:\Windows\System\eCkWxnN.exe
  2⤵
  PID:7136
- C:\Windows\System\ZJpPFFK.exe
  C:\Windows\System\ZJpPFFK.exe
  2⤵
  PID:7164
- C:\Windows\System\eHrrmuf.exe
  C:\Windows\System\eHrrmuf.exe
  2⤵
  PID:6240
- C:\Windows\System\eLRmkiI.exe
  C:\Windows\System\eLRmkiI.exe
  2⤵
  PID:3184
- C:\Windows\System\fvAUhkT.exe
  C:\Windows\System\fvAUhkT.exe
  2⤵
  PID:6312
- C:\Windows\System\ZHBHiYG.exe
  C:\Windows\System\ZHBHiYG.exe
  2⤵
  PID:6188
- C:\Windows\System\XtwVHVR.exe
  C:\Windows\System\XtwVHVR.exe
  2⤵
  PID:6324
- C:\Windows\System\xoNtPNE.exe
  C:\Windows\System\xoNtPNE.exe
  2⤵
  PID:6408
- C:\Windows\System\egzePiy.exe
  C:\Windows\System\egzePiy.exe
  2⤵
  PID:6488
- C:\Windows\System\bJTcjft.exe
  C:\Windows\System\bJTcjft.exe
  2⤵
  PID:4616
- C:\Windows\System\YIgmKCx.exe
  C:\Windows\System\YIgmKCx.exe
  2⤵
  PID:6388
- C:\Windows\System\QlPcIGd.exe
  C:\Windows\System\QlPcIGd.exe
  2⤵
  PID:6704
- C:\Windows\System\EhNwZnD.exe
  C:\Windows\System\EhNwZnD.exe
  2⤵
  PID:6716
- C:\Windows\System\TADlKNr.exe
  C:\Windows\System\TADlKNr.exe
  2⤵
  PID:6976
- C:\Windows\System\CBPfGdx.exe
  C:\Windows\System\CBPfGdx.exe
  2⤵
  PID:6960
- C:\Windows\System\LdXIgBd.exe
  C:\Windows\System\LdXIgBd.exe
  2⤵
  PID:6828
- C:\Windows\System\zEhDgyp.exe
  C:\Windows\System\zEhDgyp.exe
  2⤵
  PID:6492
- C:\Windows\System\obqWpBr.exe
  C:\Windows\System\obqWpBr.exe
  2⤵
  PID:7024
- C:\Windows\System\cZTbmBh.exe
  C:\Windows\System\cZTbmBh.exe
  2⤵
  PID:6956
- C:\Windows\System\xOrOics.exe
  C:\Windows\System\xOrOics.exe
  2⤵
  PID:6816
- C:\Windows\System\OTElaTJ.exe
  C:\Windows\System\OTElaTJ.exe
  2⤵
  PID:7084
- C:\Windows\System\yIsKjYm.exe
  C:\Windows\System\yIsKjYm.exe
  2⤵
  PID:6944
- C:\Windows\System\yIVJeXa.exe
  C:\Windows\System\yIVJeXa.exe
  2⤵
  PID:1444
- C:\Windows\System\QuQTXfk.exe
  C:\Windows\System\QuQTXfk.exe
  2⤵
  PID:6260
- C:\Windows\System\htZPQlg.exe
  C:\Windows\System\htZPQlg.exe
  2⤵
  PID:2228
- C:\Windows\System\HqYilBT.exe
  C:\Windows\System\HqYilBT.exe
  2⤵
  PID:6560
- C:\Windows\System\BkMPdXA.exe
  C:\Windows\System\BkMPdXA.exe
  2⤵
  PID:6524
- C:\Windows\System\hxSVFFv.exe
  C:\Windows\System\hxSVFFv.exe
  2⤵
  PID:6404
- C:\Windows\System\BnZKnJH.exe
  C:\Windows\System\BnZKnJH.exe
  2⤵
  PID:7068
- C:\Windows\System\JtABduK.exe
  C:\Windows\System\JtABduK.exe
  2⤵
  PID:1776
- C:\Windows\System\NzwPsMM.exe
  C:\Windows\System\NzwPsMM.exe
  2⤵
  PID:6892
- C:\Windows\System\mbabHuZ.exe
  C:\Windows\System\mbabHuZ.exe
  2⤵
  PID:6880
- C:\Windows\System\pbqoQqa.exe
  C:\Windows\System\pbqoQqa.exe
  2⤵
  PID:2008
- C:\Windows\System\jHvFHdT.exe
  C:\Windows\System\jHvFHdT.exe
  2⤵
  PID:6620
- C:\Windows\System\DLElNNL.exe
  C:\Windows\System\DLElNNL.exe
  2⤵
  PID:6376
- C:\Windows\System\BVMRQMj.exe
  C:\Windows\System\BVMRQMj.exe
  2⤵
  PID:7088
- C:\Windows\System\Liwgjym.exe
  C:\Windows\System\Liwgjym.exe
  2⤵
  PID:4912
- C:\Windows\System\hkFNZuR.exe
  C:\Windows\System\hkFNZuR.exe
  2⤵
  PID:6748
- C:\Windows\System\WZYcmVo.exe
  C:\Windows\System\WZYcmVo.exe
  2⤵
  PID:6392
- C:\Windows\System\ZZlcxSg.exe
  C:\Windows\System\ZZlcxSg.exe
  2⤵
  PID:7104
- C:\Windows\System\vwzQFtY.exe
  C:\Windows\System\vwzQFtY.exe
  2⤵
  PID:7172
- C:\Windows\System\zlNWcYl.exe
  C:\Windows\System\zlNWcYl.exe
  2⤵
  PID:7188
- C:\Windows\System\SpmNHBn.exe
  C:\Windows\System\SpmNHBn.exe
  2⤵
  PID:7204
- C:\Windows\System\JTgNbij.exe
  C:\Windows\System\JTgNbij.exe
  2⤵
  PID:7220
- C:\Windows\System\sYutAgk.exe
  C:\Windows\System\sYutAgk.exe
  2⤵
  PID:7236
- C:\Windows\System\tGJVaXv.exe
  C:\Windows\System\tGJVaXv.exe
  2⤵
  PID:7252
- C:\Windows\System\RBoiFIe.exe
  C:\Windows\System\RBoiFIe.exe
  2⤵
  PID:7268
- C:\Windows\System\uIopHeh.exe
  C:\Windows\System\uIopHeh.exe
  2⤵
  PID:7284
- C:\Windows\System\VZLcGgY.exe
  C:\Windows\System\VZLcGgY.exe
  2⤵
  PID:7300
- C:\Windows\System\mwvAQrq.exe
  C:\Windows\System\mwvAQrq.exe
  2⤵
  PID:7316
- C:\Windows\System\KyFeeiu.exe
  C:\Windows\System\KyFeeiu.exe
  2⤵
  PID:7332
- C:\Windows\System\ceCrPKG.exe
  C:\Windows\System\ceCrPKG.exe
  2⤵
  PID:7348
- C:\Windows\System\bvlYmir.exe
  C:\Windows\System\bvlYmir.exe
  2⤵
  PID:7364
- C:\Windows\System\uKiIDnS.exe
  C:\Windows\System\uKiIDnS.exe
  2⤵
  PID:7380
- C:\Windows\System\NXdnSNY.exe
  C:\Windows\System\NXdnSNY.exe
  2⤵
  PID:7396
- C:\Windows\System\DvkCsTr.exe
  C:\Windows\System\DvkCsTr.exe
  2⤵
  PID:7412
- C:\Windows\System\GtWfPgt.exe
  C:\Windows\System\GtWfPgt.exe
  2⤵
  PID:7428
- C:\Windows\System\lbwDobm.exe
  C:\Windows\System\lbwDobm.exe
  2⤵
  PID:7444
- C:\Windows\System\ECtloCf.exe
  C:\Windows\System\ECtloCf.exe
  2⤵
  PID:7460
- C:\Windows\System\DjkcOwI.exe
  C:\Windows\System\DjkcOwI.exe
  2⤵
  PID:7476
- C:\Windows\System\dwyjXQu.exe
  C:\Windows\System\dwyjXQu.exe
  2⤵
  PID:7492
- C:\Windows\System\HLfjlau.exe
  C:\Windows\System\HLfjlau.exe
  2⤵
  PID:7508
- C:\Windows\System\feEzaSe.exe
  C:\Windows\System\feEzaSe.exe
  2⤵
  PID:7524
- C:\Windows\System\LXKDEKy.exe
  C:\Windows\System\LXKDEKy.exe
  2⤵
  PID:7540
- C:\Windows\System\wLwKvGn.exe
  C:\Windows\System\wLwKvGn.exe
  2⤵
  PID:7556
- C:\Windows\System\YaPtawM.exe
  C:\Windows\System\YaPtawM.exe
  2⤵
  PID:7572
- C:\Windows\System\zvpOaMV.exe
  C:\Windows\System\zvpOaMV.exe
  2⤵
  PID:7588
- C:\Windows\System\SLZZLjw.exe
  C:\Windows\System\SLZZLjw.exe
  2⤵
  PID:7604
- C:\Windows\System\ceoEEUa.exe
  C:\Windows\System\ceoEEUa.exe
  2⤵
  PID:7620
- C:\Windows\System\VexTFKM.exe
  C:\Windows\System\VexTFKM.exe
  2⤵
  PID:7636
- C:\Windows\System\TTBWjip.exe
  C:\Windows\System\TTBWjip.exe
  2⤵
  PID:7652
- C:\Windows\System\YrfXJCG.exe
  C:\Windows\System\YrfXJCG.exe
  2⤵
  PID:7668
- C:\Windows\System\frVqveo.exe
  C:\Windows\System\frVqveo.exe
  2⤵
  PID:7684
- C:\Windows\System\uTiNFuX.exe
  C:\Windows\System\uTiNFuX.exe
  2⤵
  PID:7700
- C:\Windows\System\PJTLpJk.exe
  C:\Windows\System\PJTLpJk.exe
  2⤵
  PID:7716
- C:\Windows\System\CdsuDuA.exe
  C:\Windows\System\CdsuDuA.exe
  2⤵
  PID:7732
- C:\Windows\System\bPWdwEM.exe
  C:\Windows\System\bPWdwEM.exe
  2⤵
  PID:7748
- C:\Windows\System\WChwxJu.exe
  C:\Windows\System\WChwxJu.exe
  2⤵
  PID:7764
- C:\Windows\System\rIfnvSB.exe
  C:\Windows\System\rIfnvSB.exe
  2⤵
  PID:7780
- C:\Windows\System\tJsdKjt.exe
  C:\Windows\System\tJsdKjt.exe
  2⤵
  PID:7796
- C:\Windows\System\VfvgaRS.exe
  C:\Windows\System\VfvgaRS.exe
  2⤵
  PID:7812
- C:\Windows\System\ezShCtf.exe
  C:\Windows\System\ezShCtf.exe
  2⤵
  PID:7828
- C:\Windows\System\RTnOTED.exe
  C:\Windows\System\RTnOTED.exe
  2⤵
  PID:7844
- C:\Windows\System\ljiLizg.exe
  C:\Windows\System\ljiLizg.exe
  2⤵
  PID:7860
- C:\Windows\System\HeoAdiT.exe
  C:\Windows\System\HeoAdiT.exe
  2⤵
  PID:7876
- C:\Windows\System\BBHVmhb.exe
  C:\Windows\System\BBHVmhb.exe
  2⤵
  PID:7892
- C:\Windows\System\otUYCxl.exe
  C:\Windows\System\otUYCxl.exe
  2⤵
  PID:7908
- C:\Windows\System\vPImlVR.exe
  C:\Windows\System\vPImlVR.exe
  2⤵
  PID:7924
- C:\Windows\System\AZwGPpM.exe
  C:\Windows\System\AZwGPpM.exe
  2⤵
  PID:7940
- C:\Windows\System\oykENVy.exe
  C:\Windows\System\oykENVy.exe
  2⤵
  PID:7956
- C:\Windows\System\VXfZdLj.exe
  C:\Windows\System\VXfZdLj.exe
  2⤵
  PID:7972
- C:\Windows\System\IjPTBwW.exe
  C:\Windows\System\IjPTBwW.exe
  2⤵
  PID:7988
- C:\Windows\System\jMIFNEf.exe
  C:\Windows\System\jMIFNEf.exe
  2⤵
  PID:8004
- C:\Windows\System\fkYUztr.exe
  C:\Windows\System\fkYUztr.exe
  2⤵
  PID:8020
- C:\Windows\System\atrixvR.exe
  C:\Windows\System\atrixvR.exe
  2⤵
  PID:8036
- C:\Windows\System\dafheld.exe
  C:\Windows\System\dafheld.exe
  2⤵
  PID:8052
- C:\Windows\System\opJqnPo.exe
  C:\Windows\System\opJqnPo.exe
  2⤵
  PID:8068
- C:\Windows\System\yJzTWdo.exe
  C:\Windows\System\yJzTWdo.exe
  2⤵
  PID:8084
- C:\Windows\System\NtBznPp.exe
  C:\Windows\System\NtBznPp.exe
  2⤵
  PID:8100
- C:\Windows\System\GNkDqIN.exe
  C:\Windows\System\GNkDqIN.exe
  2⤵
  PID:8116
- C:\Windows\System\NkIbpiK.exe
  C:\Windows\System\NkIbpiK.exe
  2⤵
  PID:8132
- C:\Windows\System\JQVafak.exe
  C:\Windows\System\JQVafak.exe
  2⤵
  PID:8148
- C:\Windows\System\CfbSunr.exe
  C:\Windows\System\CfbSunr.exe
  2⤵
  PID:8164
- C:\Windows\System\NJelxGS.exe
  C:\Windows\System\NJelxGS.exe
  2⤵
  PID:8180
- C:\Windows\System\mPWcxqs.exe
  C:\Windows\System\mPWcxqs.exe
  2⤵
  PID:7196
- C:\Windows\System\ANpmdSs.exe
  C:\Windows\System\ANpmdSs.exe
  2⤵
  PID:7232
- C:\Windows\System\kOzmusE.exe
  C:\Windows\System\kOzmusE.exe
  2⤵
  PID:7184
- C:\Windows\System\vEzhnvF.exe
  C:\Windows\System\vEzhnvF.exe
  2⤵
  PID:7212
- C:\Windows\System\nmeXAPY.exe
  C:\Windows\System\nmeXAPY.exe
  2⤵
  PID:7276
- C:\Windows\System\nkVcQfI.exe
  C:\Windows\System\nkVcQfI.exe
  2⤵
  PID:7324
- C:\Windows\System\EOJRVRw.exe
  C:\Windows\System\EOJRVRw.exe
  2⤵
  PID:7388
- C:\Windows\System\zkaexwn.exe
  C:\Windows\System\zkaexwn.exe
  2⤵
  PID:7344
- C:\Windows\System\YlhGNZe.exe
  C:\Windows\System\YlhGNZe.exe
  2⤵
  PID:7488
- C:\Windows\System\UlSLqhi.exe
  C:\Windows\System\UlSLqhi.exe
  2⤵
  PID:7376
- C:\Windows\System\Uetcdkg.exe
  C:\Windows\System\Uetcdkg.exe
  2⤵
  PID:7584
- C:\Windows\System\eBqwCZL.exe
  C:\Windows\System\eBqwCZL.exe
  2⤵
  PID:7644
- C:\Windows\System\tZgpAky.exe
  C:\Windows\System\tZgpAky.exe
  2⤵
  PID:7404
- C:\Windows\System\vYQBkvb.exe
  C:\Windows\System\vYQBkvb.exe
  2⤵
  PID:7708
- C:\Windows\System\bMqHiZp.exe
  C:\Windows\System\bMqHiZp.exe
  2⤵
  PID:7536
- C:\Windows\System\adUXknI.exe
  C:\Windows\System\adUXknI.exe
  2⤵
  PID:7564
- C:\Windows\System\MNbmCYE.exe
  C:\Windows\System\MNbmCYE.exe
  2⤵
  PID:7660
- C:\Windows\System\UyNMfyr.exe
  C:\Windows\System\UyNMfyr.exe
  2⤵
  PID:7568
- C:\Windows\System\EFCrEKw.exe
  C:\Windows\System\EFCrEKw.exe
  2⤵
  PID:7600
- C:\Windows\System\jJvjzdS.exe
  C:\Windows\System\jJvjzdS.exe
  2⤵
  PID:7760
- C:\Windows\System\wKQLNtK.exe
  C:\Windows\System\wKQLNtK.exe
  2⤵
  PID:7804
- C:\Windows\System\nVNynOp.exe
  C:\Windows\System\nVNynOp.exe
  2⤵
  PID:7868
- C:\Windows\System\VbPxKUw.exe
  C:\Windows\System\VbPxKUw.exe
  2⤵
  PID:7932
- C:\Windows\System\pSAuiKI.exe
  C:\Windows\System\pSAuiKI.exe
  2⤵
  PID:7852
- C:\Windows\System\EnfTseW.exe
  C:\Windows\System\EnfTseW.exe
  2⤵
  PID:7820
- C:\Windows\System\jYKouts.exe
  C:\Windows\System\jYKouts.exe
  2⤵
  PID:7952
- C:\Windows\System\OvCyGII.exe
  C:\Windows\System\OvCyGII.exe
  2⤵
  PID:8028
- C:\Windows\System\htRaxSz.exe
  C:\Windows\System\htRaxSz.exe
  2⤵
  PID:8092
- C:\Windows\System\grxWYDf.exe
  C:\Windows\System\grxWYDf.exe
  2⤵
  PID:8156
- C:\Windows\System\bVseVwn.exe
  C:\Windows\System\bVseVwn.exe
  2⤵
  PID:8188
- C:\Windows\System\aWzNIyX.exe
  C:\Windows\System\aWzNIyX.exe
  2⤵
  PID:7980
- C:\Windows\System\EdjOPEc.exe
  C:\Windows\System\EdjOPEc.exe
  2⤵
  PID:7244
- C:\Windows\System\pxpZDPD.exe
  C:\Windows\System\pxpZDPD.exe
  2⤵
  PID:8108
- C:\Windows\System\taCUYAX.exe
  C:\Windows\System\taCUYAX.exe
  2⤵
  PID:7356
- C:\Windows\System\ZNOAIBf.exe
  C:\Windows\System\ZNOAIBf.exe
  2⤵
  PID:8140
- C:\Windows\System\sLBaPYd.exe
  C:\Windows\System\sLBaPYd.exe
  2⤵
  PID:7296
- C:\Windows\System\LKwwMFg.exe
  C:\Windows\System\LKwwMFg.exe
  2⤵
  PID:7424
- C:\Windows\System\HYbYfdV.exe
  C:\Windows\System\HYbYfdV.exe
  2⤵
  PID:7372
- C:\Windows\System\vfcWCNt.exe
  C:\Windows\System\vfcWCNt.exe
  2⤵
  PID:7580
- C:\Windows\System\hJLbPuF.exe
  C:\Windows\System\hJLbPuF.exe
  2⤵
  PID:7440
- C:\Windows\System\BQZUctM.exe
  C:\Windows\System\BQZUctM.exe
  2⤵
  PID:7740
- C:\Windows\System\gdLioNP.exe
  C:\Windows\System\gdLioNP.exe
  2⤵
  PID:7728
- C:\Windows\System\LAmOjsJ.exe
  C:\Windows\System\LAmOjsJ.exe
  2⤵
  PID:7792
- C:\Windows\System\EdOnUOz.exe
  C:\Windows\System\EdOnUOz.exe
  2⤵
  PID:7836
- C:\Windows\System\rPwQSQU.exe
  C:\Windows\System\rPwQSQU.exe
  2⤵
  PID:7840
- C:\Windows\System\atUlBAJ.exe
  C:\Windows\System\atUlBAJ.exe
  2⤵
  PID:7996
- C:\Windows\System\irMUSza.exe
  C:\Windows\System\irMUSza.exe
  2⤵
  PID:7884
- C:\Windows\System\bablbnH.exe
  C:\Windows\System\bablbnH.exe
  2⤵
  PID:7984
- C:\Windows\System\NUGAWBh.exe
  C:\Windows\System\NUGAWBh.exe
  2⤵
  PID:8044
- C:\Windows\System\lrhsnvs.exe
  C:\Windows\System\lrhsnvs.exe
  2⤵
  PID:7312
- C:\Windows\System\HuRzFEO.exe
  C:\Windows\System\HuRzFEO.exe
  2⤵
  PID:7180
- C:\Windows\System\LuwfPqk.exe
  C:\Windows\System\LuwfPqk.exe
  2⤵
  PID:7692
- C:\Windows\System\uusyQji.exe
  C:\Windows\System\uusyQji.exe
  2⤵
  PID:7632
- C:\Windows\System\CmjSwxB.exe
  C:\Windows\System\CmjSwxB.exe
  2⤵
  PID:7520
- C:\Windows\System\eBXPdGk.exe
  C:\Windows\System\eBXPdGk.exe
  2⤵
  PID:7904
- C:\Windows\System\mtKwUmd.exe
  C:\Windows\System\mtKwUmd.exe
  2⤵
  PID:7552
- C:\Windows\System\RfzkXVk.exe
  C:\Windows\System\RfzkXVk.exe
  2⤵
  PID:7532
- C:\Windows\System\dsMwqsE.exe
  C:\Windows\System\dsMwqsE.exe
  2⤵
  PID:8012
- C:\Windows\System\pWggNJs.exe
  C:\Windows\System\pWggNJs.exe
  2⤵
  PID:7504
- C:\Windows\System\jlJvqHV.exe
  C:\Windows\System\jlJvqHV.exe
  2⤵
  PID:7616
- C:\Windows\System\rfScsZo.exe
  C:\Windows\System\rfScsZo.exe
  2⤵
  PID:8080
- C:\Windows\System\kYnErzf.exe
  C:\Windows\System\kYnErzf.exe
  2⤵
  PID:8196
- C:\Windows\System\BLvqtFd.exe
  C:\Windows\System\BLvqtFd.exe
  2⤵
  PID:8212
- C:\Windows\System\ulhWwXh.exe
  C:\Windows\System\ulhWwXh.exe
  2⤵
  PID:8228
- C:\Windows\System\LkDTUkZ.exe
  C:\Windows\System\LkDTUkZ.exe
  2⤵
  PID:8244
- C:\Windows\System\VfGEnXJ.exe
  C:\Windows\System\VfGEnXJ.exe
  2⤵
  PID:8260
- C:\Windows\System\VGnjNhR.exe
  C:\Windows\System\VGnjNhR.exe
  2⤵
  PID:8276
- C:\Windows\System\FGWSQQm.exe
  C:\Windows\System\FGWSQQm.exe
  2⤵
  PID:8292
- C:\Windows\System\uiKEsms.exe
  C:\Windows\System\uiKEsms.exe
  2⤵
  PID:8308
- C:\Windows\System\ihjoqci.exe
  C:\Windows\System\ihjoqci.exe
  2⤵
  PID:8324
- C:\Windows\System\SDenbMx.exe
  C:\Windows\System\SDenbMx.exe
  2⤵
  PID:8340
- C:\Windows\System\SvbjCEB.exe
  C:\Windows\System\SvbjCEB.exe
  2⤵
  PID:8356
- C:\Windows\System\YUCFNMw.exe
  C:\Windows\System\YUCFNMw.exe
  2⤵
  PID:8372
- C:\Windows\System\irZJxOl.exe
  C:\Windows\System\irZJxOl.exe
  2⤵
  PID:8388
- C:\Windows\System\bRjVXSK.exe
  C:\Windows\System\bRjVXSK.exe
  2⤵
  PID:8404
- C:\Windows\System\jaOfPKf.exe
  C:\Windows\System\jaOfPKf.exe
  2⤵
  PID:8420
- C:\Windows\System\HNBxght.exe
  C:\Windows\System\HNBxght.exe
  2⤵
  PID:8436
- C:\Windows\System\peZzNUJ.exe
  C:\Windows\System\peZzNUJ.exe
  2⤵
  PID:8452
- C:\Windows\System\RXBczIS.exe
  C:\Windows\System\RXBczIS.exe
  2⤵
  PID:8468
- C:\Windows\System\nyWjfZq.exe
  C:\Windows\System\nyWjfZq.exe
  2⤵
  PID:8484
- C:\Windows\System\DfawABz.exe
  C:\Windows\System\DfawABz.exe
  2⤵
  PID:8500
- C:\Windows\System\vOmfoIW.exe
  C:\Windows\System\vOmfoIW.exe
  2⤵
  PID:8516
- C:\Windows\System\oDVtbEW.exe
  C:\Windows\System\oDVtbEW.exe
  2⤵
  PID:8532
- C:\Windows\System\BkKkZJo.exe
  C:\Windows\System\BkKkZJo.exe
  2⤵
  PID:8548
- C:\Windows\System\RBmGRJk.exe
  C:\Windows\System\RBmGRJk.exe
  2⤵
  PID:8564
- C:\Windows\System\hDRNgqp.exe
  C:\Windows\System\hDRNgqp.exe
  2⤵
  PID:8580
- C:\Windows\System\QhvlcCo.exe
  C:\Windows\System\QhvlcCo.exe
  2⤵
  PID:8596
- C:\Windows\System\kvYEAPX.exe
  C:\Windows\System\kvYEAPX.exe
  2⤵
  PID:8612
- C:\Windows\System\iKYrurq.exe
  C:\Windows\System\iKYrurq.exe
  2⤵
  PID:8628
- C:\Windows\System\KslizeE.exe
  C:\Windows\System\KslizeE.exe
  2⤵
  PID:8644
- C:\Windows\System\jVdFutj.exe
  C:\Windows\System\jVdFutj.exe
  2⤵
  PID:8660
- C:\Windows\System\AMDmkxB.exe
  C:\Windows\System\AMDmkxB.exe
  2⤵
  PID:8676
- C:\Windows\System\TMCqGei.exe
  C:\Windows\System\TMCqGei.exe
  2⤵
  PID:8692
- C:\Windows\System\uWtGTfS.exe
  C:\Windows\System\uWtGTfS.exe
  2⤵
  PID:8708
- C:\Windows\System\JWRqPVM.exe
  C:\Windows\System\JWRqPVM.exe
  2⤵
  PID:8724
- C:\Windows\System\iFqlIcE.exe
  C:\Windows\System\iFqlIcE.exe
  2⤵
  PID:8740
- C:\Windows\System\MuQJCFC.exe
  C:\Windows\System\MuQJCFC.exe
  2⤵
  PID:8756
- C:\Windows\System\jjDWJgG.exe
  C:\Windows\System\jjDWJgG.exe
  2⤵
  PID:8772
- C:\Windows\System\AozCSJS.exe
  C:\Windows\System\AozCSJS.exe
  2⤵
  PID:8788
- C:\Windows\System\KxuVlmS.exe
  C:\Windows\System\KxuVlmS.exe
  2⤵
  PID:8804
- C:\Windows\System\FayqFtr.exe
  C:\Windows\System\FayqFtr.exe
  2⤵
  PID:8820
- C:\Windows\System\NkqINnF.exe
  C:\Windows\System\NkqINnF.exe
  2⤵
  PID:8836
- C:\Windows\System\XvtqDYX.exe
  C:\Windows\System\XvtqDYX.exe
  2⤵
  PID:8852
- C:\Windows\System\XvBwYWl.exe
  C:\Windows\System\XvBwYWl.exe
  2⤵
  PID:8868
- C:\Windows\System\ultQZyb.exe
  C:\Windows\System\ultQZyb.exe
  2⤵
  PID:8884
- C:\Windows\System\SUgdJjE.exe
  C:\Windows\System\SUgdJjE.exe
  2⤵
  PID:8900
- C:\Windows\System\XYUlLmr.exe
  C:\Windows\System\XYUlLmr.exe
  2⤵
  PID:8916
- C:\Windows\System\LsGRjrY.exe
  C:\Windows\System\LsGRjrY.exe
  2⤵
  PID:8932
- C:\Windows\System\SpwfJdQ.exe
  C:\Windows\System\SpwfJdQ.exe
  2⤵
  PID:8948
- C:\Windows\System\RYEMwQU.exe
  C:\Windows\System\RYEMwQU.exe
  2⤵
  PID:8964
- C:\Windows\System\gzxTRki.exe
  C:\Windows\System\gzxTRki.exe
  2⤵
  PID:8980
- C:\Windows\System\ohJXUHC.exe
  C:\Windows\System\ohJXUHC.exe
  2⤵
  PID:8996
- C:\Windows\System\XSmfwXO.exe
  C:\Windows\System\XSmfwXO.exe
  2⤵
  PID:9012
- C:\Windows\System\pCfaOZU.exe
  C:\Windows\System\pCfaOZU.exe
  2⤵
  PID:9028
- C:\Windows\System\vkqtAau.exe
  C:\Windows\System\vkqtAau.exe
  2⤵
  PID:9048
- C:\Windows\System\ZNGVugx.exe
  C:\Windows\System\ZNGVugx.exe
  2⤵
  PID:9064
- C:\Windows\System\niZxVoz.exe
  C:\Windows\System\niZxVoz.exe
  2⤵
  PID:9080
- C:\Windows\System\ukUxZWL.exe
  C:\Windows\System\ukUxZWL.exe
  2⤵
  PID:9100
- C:\Windows\System\meUOize.exe
  C:\Windows\System\meUOize.exe
  2⤵
  PID:9116
- C:\Windows\System\wmjOWzG.exe
  C:\Windows\System\wmjOWzG.exe
  2⤵
  PID:9132
- C:\Windows\System\UokLKxM.exe
  C:\Windows\System\UokLKxM.exe
  2⤵
  PID:9148
- C:\Windows\System\TgeOQrX.exe
  C:\Windows\System\TgeOQrX.exe
  2⤵
  PID:9164
- C:\Windows\System\TSbevFw.exe
  C:\Windows\System\TSbevFw.exe
  2⤵
  PID:9180
- C:\Windows\System\wuDewRI.exe
  C:\Windows\System\wuDewRI.exe
  2⤵
  PID:9196
- C:\Windows\System\JrvrpSB.exe
  C:\Windows\System\JrvrpSB.exe
  2⤵
  PID:9212
- C:\Windows\System\QjPRwti.exe
  C:\Windows\System\QjPRwti.exe
  2⤵
  PID:8240
- C:\Windows\System\rwAYtpK.exe
  C:\Windows\System\rwAYtpK.exe
  2⤵
  PID:8304
- C:\Windows\System\dbgGcdh.exe
  C:\Windows\System\dbgGcdh.exe
  2⤵
  PID:7888
- C:\Windows\System\RBMrPzz.exe
  C:\Windows\System\RBMrPzz.exe
  2⤵
  PID:8124
- C:\Windows\System\FGKpiAh.exe
  C:\Windows\System\FGKpiAh.exe
  2⤵
  PID:8284
- C:\Windows\System\PwFpDOD.exe
  C:\Windows\System\PwFpDOD.exe
  2⤵
  PID:7788
- C:\Windows\System\TNaWfHV.exe
  C:\Windows\System\TNaWfHV.exe
  2⤵
  PID:8316
- C:\Windows\System\dzerjji.exe
  C:\Windows\System\dzerjji.exe
  2⤵
  PID:8368
- C:\Windows\System\bhUMAGE.exe
  C:\Windows\System\bhUMAGE.exe
  2⤵
  PID:8400
- C:\Windows\System\UOTbiWg.exe
  C:\Windows\System\UOTbiWg.exe
  2⤵
  PID:8464
- C:\Windows\System\zFGpjxY.exe
  C:\Windows\System\zFGpjxY.exe
  2⤵
  PID:8496
- C:\Windows\System\azZXgwv.exe
  C:\Windows\System\azZXgwv.exe
  2⤵
  PID:8560
- C:\Windows\System\zqduPWO.exe
  C:\Windows\System\zqduPWO.exe
  2⤵
  PID:8624
- C:\Windows\System\YOgPgyB.exe
  C:\Windows\System\YOgPgyB.exe
  2⤵
  PID:8444
- C:\Windows\System\THrkZHi.exe
  C:\Windows\System\THrkZHi.exe
  2⤵
  PID:8576
- C:\Windows\System\sJaLRul.exe
  C:\Windows\System\sJaLRul.exe
  2⤵
  PID:8480
- C:\Windows\System\wzEchuM.exe
  C:\Windows\System\wzEchuM.exe
  2⤵
  PID:8636
- C:\Windows\System\jDsoDfx.exe
  C:\Windows\System\jDsoDfx.exe
  2⤵
  PID:8688
- C:\Windows\System\OSPYuDx.exe
  C:\Windows\System\OSPYuDx.exe
  2⤵
  PID:8748
- C:\Windows\System\opkPePP.exe
  C:\Windows\System\opkPePP.exe
  2⤵
  PID:8732
- C:\Windows\System\RbIkqOE.exe
  C:\Windows\System\RbIkqOE.exe
  2⤵
  PID:8784
- C:\Windows\System\XFDcvPk.exe
  C:\Windows\System\XFDcvPk.exe
  2⤵
  PID:8816
- C:\Windows\System\sJebhAc.exe
  C:\Windows\System\sJebhAc.exe
  2⤵
  PID:8876
- C:\Windows\System\rFJGzYt.exe
  C:\Windows\System\rFJGzYt.exe
  2⤵
  PID:8832
- C:\Windows\System\tgIQIga.exe
  C:\Windows\System\tgIQIga.exe
  2⤵
  PID:8896
- C:\Windows\System\tkYbUID.exe
  C:\Windows\System\tkYbUID.exe
  2⤵
  PID:8928
- C:\Windows\System\BczLiCa.exe
  C:\Windows\System\BczLiCa.exe
  2⤵
  PID:8976
- C:\Windows\System\WUcMetu.exe
  C:\Windows\System\WUcMetu.exe
  2⤵
  PID:8960
- C:\Windows\System\EQhZRuZ.exe
  C:\Windows\System\EQhZRuZ.exe
  2⤵
  PID:9076
- C:\Windows\System\ZLOtSfn.exe
  C:\Windows\System\ZLOtSfn.exe
  2⤵
  PID:9112
- C:\Windows\System\DwNDsTB.exe
  C:\Windows\System\DwNDsTB.exe
  2⤵
  PID:9172
- C:\Windows\System\fHZYmXN.exe
  C:\Windows\System\fHZYmXN.exe
  2⤵
  PID:8272
- C:\Windows\System\PbReyAu.exe
  C:\Windows\System\PbReyAu.exe
  2⤵
  PID:9156
- C:\Windows\System\ArYmErY.exe
  C:\Windows\System\ArYmErY.exe
  2⤵
  PID:9092
- C:\Windows\System\utbXlAA.exe
  C:\Windows\System\utbXlAA.exe
  2⤵
  PID:9160
- C:\Windows\System\KWSZNpm.exe
  C:\Windows\System\KWSZNpm.exe
  2⤵
  PID:8336
- C:\Windows\System\xcICDML.exe
  C:\Windows\System\xcICDML.exe
  2⤵
  PID:8176
- C:\Windows\System\VGjzknT.exe
  C:\Windows\System\VGjzknT.exe
  2⤵
  PID:8432
- C:\Windows\System\nRBJNTA.exe
  C:\Windows\System\nRBJNTA.exe
  2⤵
  PID:8396
- C:\Windows\System\AndeIkR.exe
  C:\Windows\System\AndeIkR.exe
  2⤵
  PID:8656
- C:\Windows\System\dMJQjWi.exe
  C:\Windows\System\dMJQjWi.exe
  2⤵
  PID:8492
- C:\Windows\System\vdLVheI.exe
  C:\Windows\System\vdLVheI.exe
  2⤵
  PID:8448
- C:\Windows\System\ChaGZMq.exe
  C:\Windows\System\ChaGZMq.exe
  2⤵
  PID:8704
- C:\Windows\System\VVnpxpC.exe
  C:\Windows\System\VVnpxpC.exe
  2⤵
  PID:8908
- C:\Windows\System\rTyujhx.exe
  C:\Windows\System\rTyujhx.exe
  2⤵
  PID:8944
- C:\Windows\System\BboFCoy.exe
  C:\Windows\System\BboFCoy.exe
  2⤵
  PID:9108
- C:\Windows\System\VETCQMI.exe
  C:\Windows\System\VETCQMI.exe
  2⤵
  PID:6160
- C:\Windows\System\ZgZkVVK.exe
  C:\Windows\System\ZgZkVVK.exe
  2⤵
  PID:8864
- C:\Windows\System\GGGcmAP.exe
  C:\Windows\System\GGGcmAP.exe
  2⤵
  PID:9176
- C:\Windows\System\qjCEBUY.exe
  C:\Windows\System\qjCEBUY.exe
  2⤵
  PID:9088
- C:\Windows\System\jLhSNkh.exe
  C:\Windows\System\jLhSNkh.exe
  2⤵
  PID:8332
- C:\Windows\System\jXmGKSN.exe
  C:\Windows\System\jXmGKSN.exe
  2⤵
  PID:8364
- C:\Windows\System\RGqeTir.exe
  C:\Windows\System\RGqeTir.exe
  2⤵
  PID:8800
- C:\Windows\System\YxhUTpf.exe
  C:\Windows\System\YxhUTpf.exe
  2⤵
  PID:8556
- C:\Windows\System\AacJvNd.exe
  C:\Windows\System\AacJvNd.exe
  2⤵
  PID:8608
- C:\Windows\System\ZqOrUBA.exe
  C:\Windows\System\ZqOrUBA.exe
  2⤵
  PID:8668
- C:\Windows\System\FMgUFwu.exe
  C:\Windows\System\FMgUFwu.exe
  2⤵
  PID:8992
- C:\Windows\System\avpHcoe.exe
  C:\Windows\System\avpHcoe.exe
  2⤵
  PID:8780
- C:\Windows\System\HCgdwKn.exe
  C:\Windows\System\HCgdwKn.exe
  2⤵
  PID:9020
- C:\Windows\System\UXjZkGs.exe
  C:\Windows\System\UXjZkGs.exe
  2⤵
  PID:9192
- C:\Windows\System\NVQTjYk.exe
  C:\Windows\System\NVQTjYk.exe
  2⤵
  PID:8572
- C:\Windows\System\SFXLwRV.exe
  C:\Windows\System\SFXLwRV.exe
  2⤵
  PID:9036
- C:\Windows\System\UwlDkOt.exe
  C:\Windows\System\UwlDkOt.exe
  2⤵
  PID:8476
- C:\Windows\System\WcSBwPZ.exe
  C:\Windows\System\WcSBwPZ.exe
  2⤵
  PID:8892
- C:\Windows\System\WxivgsH.exe
  C:\Windows\System\WxivgsH.exe
  2⤵
  PID:9224
- C:\Windows\System\GtdAqRE.exe
  C:\Windows\System\GtdAqRE.exe
  2⤵
  PID:9240
- C:\Windows\System\aBNrmIF.exe
  C:\Windows\System\aBNrmIF.exe
  2⤵
  PID:9256
- C:\Windows\System\yNfHiXB.exe
  C:\Windows\System\yNfHiXB.exe
  2⤵
  PID:9272
- C:\Windows\System\ZGAkQjc.exe
  C:\Windows\System\ZGAkQjc.exe
  2⤵
  PID:9288
- C:\Windows\System\mmOCVdG.exe
  C:\Windows\System\mmOCVdG.exe
  2⤵
  PID:9304
- C:\Windows\System\spHonSv.exe
  C:\Windows\System\spHonSv.exe
  2⤵
  PID:9320
- C:\Windows\System\zszwXIH.exe
  C:\Windows\System\zszwXIH.exe
  2⤵
  PID:9336
- C:\Windows\System\aoUsVKn.exe
  C:\Windows\System\aoUsVKn.exe
  2⤵
  PID:9352
- C:\Windows\System\JGxVzMm.exe
  C:\Windows\System\JGxVzMm.exe
  2⤵
  PID:9368
- C:\Windows\System\VKYrffc.exe
  C:\Windows\System\VKYrffc.exe
  2⤵
  PID:9384
- C:\Windows\System\aMDmuhz.exe
  C:\Windows\System\aMDmuhz.exe
  2⤵
  PID:9400
- C:\Windows\System\gHtgZJm.exe
  C:\Windows\System\gHtgZJm.exe
  2⤵
  PID:9416
- C:\Windows\System\GbLttTo.exe
  C:\Windows\System\GbLttTo.exe
  2⤵
  PID:9432
- C:\Windows\System\sikLBwX.exe
  C:\Windows\System\sikLBwX.exe
  2⤵
  PID:9448
- C:\Windows\System\RTLSsap.exe
  C:\Windows\System\RTLSsap.exe
  2⤵
  PID:9468
- C:\Windows\System\BzKKBqn.exe
  C:\Windows\System\BzKKBqn.exe
  2⤵
  PID:9484
- C:\Windows\System\sIjWYkL.exe
  C:\Windows\System\sIjWYkL.exe
  2⤵
  PID:9500
- C:\Windows\System\umXJVSs.exe
  C:\Windows\System\umXJVSs.exe
  2⤵
  PID:9516
- C:\Windows\System\DpgyAWv.exe
  C:\Windows\System\DpgyAWv.exe
  2⤵
  PID:9532
- C:\Windows\System\LdjwFSM.exe
  C:\Windows\System\LdjwFSM.exe
  2⤵
  PID:9548
- C:\Windows\System\jhMSuqX.exe
  C:\Windows\System\jhMSuqX.exe
  2⤵
  PID:9564
- C:\Windows\System\uePMfyz.exe
  C:\Windows\System\uePMfyz.exe
  2⤵
  PID:9580
- C:\Windows\System\YKsAfLQ.exe
  C:\Windows\System\YKsAfLQ.exe
  2⤵
  PID:9596
- C:\Windows\System\CcaboHT.exe
  C:\Windows\System\CcaboHT.exe
  2⤵
  PID:9612
- C:\Windows\System\nUmnKQN.exe
  C:\Windows\System\nUmnKQN.exe
  2⤵
  PID:9628
- C:\Windows\System\LUBtAxV.exe
  C:\Windows\System\LUBtAxV.exe
  2⤵
  PID:9644
- C:\Windows\System\rxfEfke.exe
  C:\Windows\System\rxfEfke.exe
  2⤵
  PID:9660
- C:\Windows\System\SqqPpVW.exe
  C:\Windows\System\SqqPpVW.exe
  2⤵
  PID:9676
- C:\Windows\System\BQyRlHI.exe
  C:\Windows\System\BQyRlHI.exe
  2⤵
  PID:9692
- C:\Windows\System\JovnGoM.exe
  C:\Windows\System\JovnGoM.exe
  2⤵
  PID:9708
- C:\Windows\System\qDnNnYu.exe
  C:\Windows\System\qDnNnYu.exe
  2⤵
  PID:9724
- C:\Windows\System\uirFwNr.exe
  C:\Windows\System\uirFwNr.exe
  2⤵
  PID:9740
- C:\Windows\System\mdsfrAq.exe
  C:\Windows\System\mdsfrAq.exe
  2⤵
  PID:9756
- C:\Windows\System\QojiKOk.exe
  C:\Windows\System\QojiKOk.exe
  2⤵
  PID:9772
- C:\Windows\System\NqWdkFL.exe
  C:\Windows\System\NqWdkFL.exe
  2⤵
  PID:9788
- C:\Windows\System\jnSLXEf.exe
  C:\Windows\System\jnSLXEf.exe
  2⤵
  PID:9804
- C:\Windows\System\nUZhKDg.exe
  C:\Windows\System\nUZhKDg.exe
  2⤵
  PID:9820
- C:\Windows\System\kOIQOXa.exe
  C:\Windows\System\kOIQOXa.exe
  2⤵
  PID:9836
- C:\Windows\System\meFYZmV.exe
  C:\Windows\System\meFYZmV.exe
  2⤵
  PID:9852
- C:\Windows\System\ujaYAmc.exe
  C:\Windows\System\ujaYAmc.exe
  2⤵
  PID:9868
- C:\Windows\System\CLWGpXf.exe
  C:\Windows\System\CLWGpXf.exe
  2⤵
  PID:9884
- C:\Windows\System\DiZoVSU.exe
  C:\Windows\System\DiZoVSU.exe
  2⤵
  PID:9900
- C:\Windows\System\aQVKWge.exe
  C:\Windows\System\aQVKWge.exe
  2⤵
  PID:9916
- C:\Windows\System\YkNOCSs.exe
  C:\Windows\System\YkNOCSs.exe
  2⤵
  PID:9932
- C:\Windows\System\EGfpRwK.exe
  C:\Windows\System\EGfpRwK.exe
  2⤵
  PID:9948
- C:\Windows\System\TpZUHTG.exe
  C:\Windows\System\TpZUHTG.exe
  2⤵
  PID:9964
- C:\Windows\System\EdzXDcG.exe
  C:\Windows\System\EdzXDcG.exe
  2⤵
  PID:9984
- C:\Windows\System\kAwYIuK.exe
  C:\Windows\System\kAwYIuK.exe
  2⤵
  PID:10000
- C:\Windows\System\bNQLznZ.exe
  C:\Windows\System\bNQLznZ.exe
  2⤵
  PID:10016
- C:\Windows\System\MDwhSqc.exe
  C:\Windows\System\MDwhSqc.exe
  2⤵
  PID:10032
- C:\Windows\System\kDnZQCH.exe
  C:\Windows\System\kDnZQCH.exe
  2⤵
  PID:10048
- C:\Windows\System\hLRhluZ.exe
  C:\Windows\System\hLRhluZ.exe
  2⤵
  PID:10068
- C:\Windows\System\HtrGyyE.exe
  C:\Windows\System\HtrGyyE.exe
  2⤵
  PID:10084
- C:\Windows\System\hNnAKkf.exe
  C:\Windows\System\hNnAKkf.exe
  2⤵
  PID:10100
- C:\Windows\System\mEHqktC.exe
  C:\Windows\System\mEHqktC.exe
  2⤵
  PID:10120
- C:\Windows\System\hYTrxni.exe
  C:\Windows\System\hYTrxni.exe
  2⤵
  PID:10136
- C:\Windows\System\BuijsQB.exe
  C:\Windows\System\BuijsQB.exe
  2⤵
  PID:10152
- C:\Windows\System\xmLgNKZ.exe
  C:\Windows\System\xmLgNKZ.exe
  2⤵
  PID:10172
- C:\Windows\System\iWpESPx.exe
  C:\Windows\System\iWpESPx.exe
  2⤵
  PID:10188
- C:\Windows\System\vjHOAlY.exe
  C:\Windows\System\vjHOAlY.exe
  2⤵
  PID:10204
- C:\Windows\System\KzjBpve.exe
  C:\Windows\System\KzjBpve.exe
  2⤵
  PID:10220
- C:\Windows\System\QMUFdnN.exe
  C:\Windows\System\QMUFdnN.exe
  2⤵
  PID:10236
- C:\Windows\System\SjFQsrr.exe
  C:\Windows\System\SjFQsrr.exe
  2⤵
  PID:7308
- C:\Windows\System\hGYtwYb.exe
  C:\Windows\System\hGYtwYb.exe
  2⤵
  PID:9124
- C:\Windows\System\wMvzNoW.exe
  C:\Windows\System\wMvzNoW.exe
  2⤵
  PID:9264
- C:\Windows\System\UlwwNcC.exe
  C:\Windows\System\UlwwNcC.exe
  2⤵
  PID:9220
- C:\Windows\System\vIgblQo.exe
  C:\Windows\System\vIgblQo.exe
  2⤵
  PID:9300
- C:\Windows\System\EjmhPOl.exe
  C:\Windows\System\EjmhPOl.exe
  2⤵
  PID:9332
- C:\Windows\System\LzisfxZ.exe
  C:\Windows\System\LzisfxZ.exe
  2⤵
  PID:9344
- C:\Windows\System\QXUzBbw.exe
  C:\Windows\System\QXUzBbw.exe
  2⤵
  PID:9396
- C:\Windows\System\RzFLoHi.exe
  C:\Windows\System\RzFLoHi.exe
  2⤵
  PID:9428
- C:\Windows\System\GfbIiur.exe
  C:\Windows\System\GfbIiur.exe
  2⤵
  PID:9496
- C:\Windows\System\WQgBakv.exe
  C:\Windows\System\WQgBakv.exe
  2⤵
  PID:9476
- C:\Windows\System\ZXtEwWg.exe
  C:\Windows\System\ZXtEwWg.exe
  2⤵
  PID:9540
- C:\Windows\System\bVUdwDL.exe
  C:\Windows\System\bVUdwDL.exe
  2⤵
  PID:9588
- C:\Windows\System\VIuMWLk.exe
  C:\Windows\System\VIuMWLk.exe
  2⤵
  PID:9572
- C:\Windows\System\ybCuulg.exe
  C:\Windows\System\ybCuulg.exe
  2⤵
  PID:9656
- C:\Windows\System\sqGEevv.exe
  C:\Windows\System\sqGEevv.exe
  2⤵
  PID:9636
- C:\Windows\System\aWpYZpj.exe
  C:\Windows\System\aWpYZpj.exe
  2⤵
  PID:9672
- C:\Windows\System\UuTghqg.exe
  C:\Windows\System\UuTghqg.exe
  2⤵
  PID:9704
- C:\Windows\System\hWriiZP.exe
  C:\Windows\System\hWriiZP.exe
  2⤵
  PID:9752
- C:\Windows\System\fwtWPTM.exe
  C:\Windows\System\fwtWPTM.exe
  2⤵
  PID:9816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DdOjrCJ.exe

Filesize
1.9MB

MD5
a04f1e716a2daa4b66086609037481c9

SHA1
90315d59811b84acaa938e4e2810bf60230b20e4

SHA256
7984c646cbe133dddf45cd9620566e603692a650611b245ef53850b41e13edc2

SHA512
da139faab3b068f5af54e1ff46058d683fa4286c03d3e84a04fdacf7ffd169d6d3ee86665d63b485f1252f3c3fd66be961dd88045aa4a83dbe40bce7b8cc869f

Download Submit
C:\Windows\system\JAaSsKm.exe

Filesize
1.9MB

MD5
c24bc95098b497a3516c46c85f8e9b2a

SHA1
d9609c8e49aa3c109512eed79658864a3305603b

SHA256
7ef51b1e0cce5f1d1fa8eb496b888165f407c7c92ced10c3748b4452938644bc

SHA512
88887525806d516e2e30595410032739ecf19c771eecdf8e765e1e748d4fbcd52d9743d012bfaf8a23dd303f8be024aaeb6f31df460ff59f1c6f0459f5c83d15

Download Submit
C:\Windows\system\JMnEFJy.exe

Filesize
1.9MB

MD5
ddb6915586aabe3cdb78dd0ac4882e8d

SHA1
9cb20a2f24513e175265dd9cba00a3d15d4b19c2

SHA256
dd0012dccc98294d89363b4512744b2cf9f3fa2790fab0e6240774ab5b9a8665

SHA512
554e6cd6e035c23aa28358f0511e175c240ce2fb4681e8f58f924f5112c7dc1bd8520c1a326e3b37c1af03d7fb91f54f305ca42174e02825282fa5c9e5e32a20

Download Submit
C:\Windows\system\PwzMXvE.exe

Filesize
1.9MB

MD5
c6f30ab2f486f8d643658027aace4cad

SHA1
c43750677cd566362d3af4ac26d0a8a40618c24c

SHA256
69602a92cda7186b402969441942c562bb1cc5ab6a0fc449922628642b41c160

SHA512
f6b45dc2978a3f5ef7242963104cae9ca5df4b19eb7216176b87b73cfbff5cbd3589c15e408bba726f941e24c40b102ac84911bca16cadc5d8431ab1343ae6ea

Download Submit
C:\Windows\system\QLgXBWu.exe

Filesize
1.9MB

MD5
62189022b6c3ac16c99b2508c2899e40

SHA1
4c8e379c6ad9bf1ed99ccd1ae2f4f55671eb97c3

SHA256
c4fa8cd9e4f26c920c776d89989ef1578afb98621ec5d6ceda648472fd0a4e18

SHA512
ebf5078d05c3e5bd42da1598dfb8ee9a22e94edde221702114eb5dbfc479efb7600d9732f111a525616fecfce27568ad1aab8e1e12dda5f968a0202f66a221a5

Download Submit
C:\Windows\system\QuYnZzC.exe

Filesize
1.9MB

MD5
17941351dea9cafae4405db68281c8ac

SHA1
b50b51c84499657bc268eca26cbac6aa5bf706b7

SHA256
8b8ca8fb77c05a07b1f0bfb54141a267e1260ec766a1e70d95bee002790b9b5a

SHA512
f4d783fe59ccbc4216c37af4a27513a2db3acb0ec35a9b6890094ce6c18e3ac3b47f29b554e86e6f15ac62f5cd8a90e0714f7dacd43b9595a41dabd9c67f6792

Download Submit
C:\Windows\system\SjTPNUT.exe

Filesize
1.9MB

MD5
32bd0a30d7da3a94f52e24329dc81981

SHA1
80198b4455ccad989c900f9f2025c46c7d695f9b

SHA256
18a6b2e11309cee329e46b85cb47021f4b729e1e235f18e862a2d99dab7c0a13

SHA512
37113f3b51a81c9d9aa2014fd98cda737131e1dd14165842bfcbf7b5e4632b676cc2f8416a10bb0c6ba8e1fbd686ddbb044e4fe035e9edabef02b4fabd9b1874

Download Submit
C:\Windows\system\TLvwsgO.exe

Filesize
1.9MB

MD5
2efb807710a32eedb4d80e45eb854c14

SHA1
e577e198ac1f4587b574991a3fa021b1d77d6562

SHA256
ea61962b8d4ceb75a118d1e2bd94d9ee2d10b0b003855bbc92cfea1e01835bb7

SHA512
9ab8477815994ed2fcedc4caf0c25e065af5c4dca57116c39ed58e606cb33fa1194cb9c9a97c12ce69f9c38680ea4f8766968751a4f44e86917bb085a300b4ab

Download Submit
C:\Windows\system\UQZKDYC.exe

Filesize
1.9MB

MD5
6468e06642cc9bf8c5920dd8ae34ce86

SHA1
cc586eea97be547026e77e547e8fa44aa5980d6f

SHA256
2369f7e626c0626c302d6d4f2041a617ed2236f299bd4230803263c8a288dc0b

SHA512
5a8d2fe62ee57378ce0834f71ec5776eeb73b2018f49511ce05aff29912d755b4cba2eeb52593659e5da5c19528c41f2913d4975a416f0467601a257febcea7f

Download Submit
C:\Windows\system\YxAaPKA.exe

Filesize
1.9MB

MD5
714feb359cf45e64ba5162a208b69021

SHA1
fc2aa3edf803b383910af74dd2b21f379a402155

SHA256
900b22b94d60255a2b7420bd0f62b74b500dfc8419394a3c268c250f4606543b

SHA512
d3318b007b66090ba573978d799ed5009268e8a68d38a36e1e773678380ab7757c51797c7bb8b4acb269ffa6fa0b3a83f72e226804140786f208c823e5ba0d38

Download Submit
C:\Windows\system\ZgshWxE.exe

Filesize
1.9MB

MD5
f17f66e6832d13b40e2f8dfa316524c1

SHA1
b42319312735fbe9e85ae9e23e8140c76a4125f6

SHA256
f80ad7365b3f92a482ee423d04d9cb77adde8f97c48f99fade024922ea0892b2

SHA512
18db309cea48f9bd524a5ae5f734a90f966d0ca97d1ee28770acac55c994859e6326e7eb85bc3211a997bfacaa4d4abe8087f552be93b47b5cf7f9b9727b36c7

Download Submit
C:\Windows\system\aImpTah.exe

Filesize
1.9MB

MD5
af2cdaabbbc59ce0fdbb99a552f58a39

SHA1
f1cbd5c6ed5a35e74b0442212061ba00569e9633

SHA256
650407757bbf65f06473f0d6fe5cea44cadbcf7b6d4228e5bbdf89638f0e298a

SHA512
2eee213303f3a565aa9d06373dfc908185ed197e2f6483dbce0f0cf5fd004deed79df40b6ecc09ddd418b8d94840589d189e2e37407834fa8aa07dc35879cb0c

Download Submit
C:\Windows\system\aSlgigU.exe

Filesize
1.9MB

MD5
48c22597604bac842b731dce69f6956c

SHA1
73f79ad8c434892a7e015e2d1ac7beae77a0a701

SHA256
8a9144af888e20f6462739e7d1fbe2acce001b3e988248871a41bd2a7780f551

SHA512
974f3cb97a62f24e0aa22b4058dace2140eb1735e83511560037cba0dec213eaee4decb1a738f4eec07012ca531e45787c169e87d4699d152d25c75bd989e677

Download Submit
C:\Windows\system\exJEPgc.exe

Filesize
1.9MB

MD5
53f5d95319e3eac0632913e3adc8d481

SHA1
bd9d395243cb1be32bfe5912a560e15395912aa7

SHA256
adda2f15d5650e0cc4b408186eb405c15b0955c23e4bc67f29311b562cd2f288

SHA512
a2ae3b585bdd4452c30b696d1197fcd6991b782233af0c0e591cb0d736ce1322b302dc2b9a745b6f6ea2ecab618a22b501060de123035d897dc2cc6d6f2e9189

Download Submit
C:\Windows\system\kRtqweH.exe

Filesize
1.9MB

MD5
5c1c68bd083521fbee1a602048b55bdf

SHA1
24c87b4e392736ca02bb0cb72d8abf16fb8d93b9

SHA256
406999c9525186cb99cff4c8f975c39abbca505d0c62afc4ee96e46e8edaeea4

SHA512
906dbc8ba8969b693dd619b986b143b9e8570e00bc39e49c055ade2a78c40bca29911ba58afad75790abbba46f28b9fb95bf609498d65d9a9055bc54293be13a

Download Submit
C:\Windows\system\sggNynv.exe

Filesize
1.9MB

MD5
922ebc414fb39f40fcea0560316aed83

SHA1
8dcc96eb233216b998febc192db30da5c5349693

SHA256
2624ba60456f5b63e8b5fd9982ee7b0788003b66460c750520c7524c80cb869d

SHA512
0fcd35816d50a7b3a68dc52c7519e203d0db0c38d22e4daa57dcc1a176d125a042bd4b8dac9cbde6263cab740b06a3b9ad1dbfc9dc7459848906b5cb3770689a

Download Submit
C:\Windows\system\tUbpfET.exe

Filesize
1.9MB

MD5
1b25e8672edd87ddff961a5303f0fe99

SHA1
accc853cb8d47e16c5fb0748fa81e4e7b5b8f7fb

SHA256
775a044a80883ae3af21536ef2c5d2f025f56f5907d8994331081bd91d0df301

SHA512
4718080657592090a360f0e34d8227280c2d5e4e37b5f1f11213d66dce1d3557dfbd43847e39b50d45f7f867fe16b3150f5a5efb24a8c18e543a5f3ddda12e69

Download Submit
C:\Windows\system\uezDByA.exe

Filesize
1.9MB

MD5
ec16812a7ae57980bb0b1d54c89c123f

SHA1
a765c77b89f1115a4be8f4815cb71d114a5ade8e

SHA256
4a62328edf0ece6ff2a848ef273f45162778b1a12d5256a3f4371e7604177872

SHA512
83f96e63526c8ac2ce8e11670bff8d60dc99b8ea4bdf0f8f547a47960c05882939d0fb54370e74ad4904a7e62fdb3709a636286ac24e22f991ff79a3dd15e02e

Download Submit
C:\Windows\system\xUNFyIV.exe

Filesize
1.9MB

MD5
25f4075bf8f6c723aabf6d6d3d2cb4d1

SHA1
3c2e7636fbf5a69a5653a5ce6e0a19dd70c77adf

SHA256
d947610ea2987843ce9992aadf3ded8fe207dac49d8baac54a527ce30c860705

SHA512
61eca4a540f76583e7a3f3dcac39501de6f29a1a9c6b38cf80188f7476494a95e718ccadf5d00a4797740e93c39c12004a1e44703066760f24cc041b127e5ddc

Download Submit
C:\Windows\system\xkpFTzY.exe

Filesize
1.9MB

MD5
772bebed0710242da213c5c5f96d0ae7

SHA1
174bcf1d5215b7a20fc7bef627ac9fd38dc7627d

SHA256
488d23f6a6a7180a09f5218b71e488b302394d24eb9774323b6251ff2edf1b02

SHA512
91a57ca85d5068ace997805c569b076ee086fdcc6865ce3c12ea8b176d00acd029d8f7696966dad0540c4cf0bd9301dcc91dceee91366017ca809850311711f2

Download Submit
C:\Windows\system\xxtVkIi.exe

Filesize
1.9MB

MD5
d49d01bb1352f058d7d383742b1e4af2

SHA1
3e5b72eacc41ae5f789942dc20f9162271d6456e

SHA256
91f2bc3abcfef7381f06b7ca891a7cd7aa5e4aa738b49b41a4392616d8860600

SHA512
3a87b3dfd7aee7c12ca8f52dc7ece9ef447b12ebb7b814916f9a87b75ff8bd8b8cbb8ebedb4e33452f963c8267f34b8d1b4dfb616e5a17c89a5f759558b4d241

Download Submit
C:\Windows\system\yreCcVK.exe

Filesize
1.9MB

MD5
7e4c5f2ff005aaf91c5b5bf0844c15dc

SHA1
c4ec9aa5b36aa9368f8602dd7de872ccfeeb9dcc

SHA256
7518f558e7d7eebd1a79768a18f9c102c2cf97cfde6ba1bc09be2a9ae8f50ec5

SHA512
e60cfaea95fbb149c4a5877c5c1e0fcc553a8b9453f581a38d898e26ae4cba8d1056d3683900ee3ec9908da64a96f7ed47369a70954545893ce313b518c21667

Download Submit
C:\Windows\system\zBeJTwr.exe

Filesize
1.9MB

MD5
a502ab6e1e4c973504d903bf7b3cb8ce

SHA1
e12bb2959b1fb4c7d76c9e4a1a0009aec0593f4b

SHA256
04317beda69ed431d55d905967959f6bbc3eee8e6ceddbc83e8b0a733ddb86f7

SHA512
7afd670e6d3a1b226b2c9493d3310889f95e2de0fca4e724a9449fec6949b4cba96e4a87363281d4614bd866f72141904c2a9730ccb212c727b967f789e2310b

Download Submit
C:\Windows\system\ziMmmUn.exe

Filesize
1.9MB

MD5
832e1c423f18a0eb87cad3576fdcf325

SHA1
1821b821132c5f2810a58334d3bd28e4f5218911

SHA256
6757579eb8de76e6247588cfef174a4796e284f20d68f6f100d97bf3f9ce8243

SHA512
ac869be69514bd85359142719be12b6d1ecbfdd6e14a326ea94a98ccce22f004e73f1c9a2c4b7fdecf1e49ab96dfa86695bf42c6e970fa3e7966dadb2d64916d

Download Submit
\Windows\system\JqpcSNF.exe

Filesize
1.9MB

MD5
14e7aa48b3dfd586a1e4e9c39a36f88c

SHA1
ba10d639bb68da9218d18d1ae3d9919af299f9bd

SHA256
48b988a91b6491030fddb359860959789e6d537ec878cc60a7d5f5a6f03b0d9f

SHA512
491672efe54a9a0cbbc879f8119f5374a83b72f4a085ac3cf28b280427d27f57efc015fe7f4985fb8d6153357164e0255ab4d4845a8a21603e0701b7d432ddb9

Download Submit
\Windows\system\LIzOlnq.exe

Filesize
1.9MB

MD5
5a06f28d27ece9aaca2640f522d5fadc

SHA1
f837d48d1a6fb9647dff6d99ef39e0a65702a7c6

SHA256
59a5b329602048d57cb7890923ec9e1c25c867a94ddb92c82c448d36235fed47

SHA512
9649a527f61699e01317bbf8c0d49690c2bfbbb79bca1e578b45faa8468f8579f3801f47031e36e7f28a10b8f2e9b1a5f97e205e0b72a49752a6f807b885ecc8

Download Submit
\Windows\system\LWiOmwv.exe

Filesize
1.9MB

MD5
91c3a86e32495dcea3c5ef3f6f3cb431

SHA1
7c1b51a628e1d52004a47184ddbc92fac01e5dd0

SHA256
46bfc137f225d6d846ddc18c1f7d10df0450e749ce8e3e6902ff624ea223dd12

SHA512
6fbf752468873a7e14c97c8e0314cacdfddb972e3910627ccfdd2291e692796c517ed50b752dcbf1cd39cbc9aba08570de75a1802a11b348edee936f37c99142

Download Submit
\Windows\system\eitFznj.exe

Filesize
1.9MB

MD5
9ad15cc63ceee6232b23aa93dfbcd6da

SHA1
1bec56ccbf7c3f2e6c0f040f91424a810075e981

SHA256
ceaf27521b9f338a7007e28af6bb164fbf5a7d35fd7d09f8f0812f61a47fd390

SHA512
dbe9ae05bfe9a9ab3732b77676936d0644bd81099d0a9a21bb9ddd0e5e9bc2fe389ea5a4d09b96da50ece55cbc5a688fb27e80e4fbedafe3107aaf706ea1a5f3

Download Submit
\Windows\system\fMNafjY.exe

Filesize
1.9MB

MD5
bfe1172bffd18378261f738d403ca25f

SHA1
287f3d941cddc3d2215d79a869916fdae9f9d167

SHA256
76691277d81fbbd5c3e6e9bebe608ef78363538db16aec9acb5a310e0e3248ce

SHA512
bb9d36c407b22e5bc4eb43731440c1d0b220c73d8a0024d93ad780873121d0aa73fa06fb6da79d6445933c793a5d4cf2af22ecec9a140f84334c105af7108d10

Download Submit
\Windows\system\jreeTSJ.exe

Filesize
1.9MB

MD5
6ed9e9f5947b682658ab74107ae58f04

SHA1
c9f3b56e393b1b467d14dfa02e7818365a9dcb5a

SHA256
3cd60fd2a1858ade380e07e1f6bb757551eace32307409422834aebde1839974

SHA512
f51aa081da154d43739646f186c76065e528ee625f8c84379c4a141d1313107aa3666f2ac0155fed4b4111ba5054487a366eb4efa293412d6731c1252b8eff53

Download Submit
\Windows\system\lCvLZVJ.exe

Filesize
1.9MB

MD5
899ea6dbb7f42d3faaf5d8b171a995e1

SHA1
53de3cef7b408a1f62d69cd73cc3c8a28eb2e5ff

SHA256
8d45eeee210845e58c90f22d349131bc9faf898c9732709f8c7ca145fb97c581

SHA512
bc97a7d1bc322167602adb56655e695bbb0dfd210975f697c6a7c7ae9a39f7eeb1b6cde30fa3f7319115cc1ac594879d8b877535c8de14ae7f873783e2b01cb0

Download Submit
\Windows\system\seBLJsU.exe

Filesize
1.9MB

MD5
cbb601855ceaedab368c7b4dcdec2ee9

SHA1
52f8d9b3934e077976e16e85274318a614ba34aa

SHA256
8c9b16ec8528f20c123bceb1d7c6d0dfd95407ead3156e9d09fdcf905ee8d4f2

SHA512
8ad61d35c3465b1537575362f46351a354e5cdd3ffb4b8a8e9e9e2f33b3f9e3131df14020edf7d1b7905056f30bd3050d0f110e3061570fcd776fa147f18fced

Download Submit
memory/1860-155-0x00000000027D0000-0x0000000002BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1860-174-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/1860-176-0x00000000027D0000-0x0000000002BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1860-165-0x0000000002D20000-0x0000000003112000-memory.dmp

Filesize
3.9MB

Download
memory/1860-79-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/1860-160-0x0000000002D20000-0x0000000003112000-memory.dmp

Filesize
3.9MB

Download
memory/1860-162-0x0000000002D20000-0x0000000003112000-memory.dmp

Filesize
3.9MB

Download
memory/1860-82-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/1860-18-0x00000000027D0000-0x0000000002BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1860-156-0x00000000027D0000-0x0000000002BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1860-172-0x0000000002D20000-0x0000000003112000-memory.dmp

Filesize
3.9MB

Download
memory/1860-168-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/1860-170-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/1860-0-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/1860-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1860-166-0x0000000002D20000-0x0000000003112000-memory.dmp

Filesize
3.9MB

Download
memory/2264-157-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2440-169-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2492-167-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2504-173-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2564-158-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-164-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2580-175-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2636-230-0x000000001B530000-0x000000001B812000-memory.dmp

Filesize
2.9MB

Download
memory/2636-231-0x0000000002890000-0x0000000002898000-memory.dmp

Filesize
32KB

Download
memory/2660-171-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2736-159-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/3028-161-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download