xmrig | 59ceb3673aa72c575afdcfa1e8b5351eb581a78715d648bd4d3910dd6f57b20d

Analysis

max time kernel
21s
max time network
32s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
Size

2.2MB
MD5

02db635be6ac310fd7402b84d36a0a12
SHA1

c4491dbcdd8dfa216ebf35abcbc6e1e47811cc48
SHA256

59ceb3673aa72c575afdcfa1e8b5351eb581a78715d648bd4d3910dd6f57b20d
SHA512

6d18257dae56edaf6c3a78f71edf440acf4ea918b1aee677d0a75f024030f10866c8f385cf06ce06a00a86c7d9ee731b3d85ee2f522263ca320cfff693bbd91f
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfG:NABN

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2456-170-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2740-168-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2580-166-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2892-164-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/1720-162-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2932-160-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/1256-159-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2728-157-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/1448-9-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1448	SdKjTLJ.exe
2728	ChFmteO.exe
1256	VxOZPDn.exe
2932	dqrbXQS.exe
1720	nuEVqmG.exe
2892	ZgfAXYo.exe
2580	gKKKAME.exe
2740	gljAGuj.exe
2456	mfilWXN.exe
2516	mPyNFeH.exe
3020	GmiTbbh.exe
3068	UnIHhAf.exe
2860	yIpQeKg.exe
2872	ypxGLCN.exe
2904	oJqwAzu.exe
3040	HBdbejN.exe
3036	gMHlyjN.exe
1648	rViOiVi.exe
2668	COuHCpe.exe
2784	SLnAiJb.exe
2024	dPqiwjo.exe
2680	YclAmwy.exe
2828	ijcDvIm.exe
2000	WfHtxfx.exe
1672	oPeGgsJ.exe
2900	XUgARPa.exe
1816	yUPQeFl.exe
1928	DIwyuzA.exe
488	mKoQVhj.exe
2400	rEtTeHO.exe
2136	jlSbHmn.exe
448	XAmfgZv.exe
1724	epKBSav.exe
852	VtCOtao.exe
1880	HsgfmIm.exe
2040	vJoNYVe.exe
1656	vOiCBge.exe
960	yuzsECm.exe
876	UubseYJ.exe
1628	dTEICDS.exe
604	mIJYHPS.exe
2964	DcteQHO.exe
2936	XXdrXzw.exe
2252	EtCDpbM.exe
1300	cHyvfIA.exe
1000	MLQGFWw.exe
1972	bBIBilr.exe
2360	YeYmxte.exe
1764	OCMMGCm.exe
1020	rmZPenz.exe
2224	muDmzBy.exe
2056	feFAhAC.exe
1596	dqRFPSG.exe
2536	PliBPvx.exe
2800	ZQGEmbG.exe
2184	sxqWRbL.exe
2908	FLhvNZH.exe
2736	TGzXqrs.exe
2488	XnOhWQb.exe
1800	vRmbiTt.exe
2652	NhTDaCm.exe
2532	DaRjCLU.exe
3048	IPJuTpS.exe
2756	ZnOtcnb.exe

Loads dropped DLL 64 IoCs

pid	Process
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1728-1-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/files/0x000c000000014b27-6.dat	upx
behavioral1/files/0x002e00000001508a-17.dat	upx
behavioral1/files/0x0008000000015be6-33.dat	upx
behavioral1/files/0x0007000000015ca6-37.dat	upx
behavioral1/files/0x000600000001661c-97.dat	upx
behavioral1/files/0x0006000000016c4a-112.dat	upx
behavioral1/files/0x0006000000016c6b-122.dat	upx
behavioral1/files/0x0006000000016d1e-147.dat	upx
behavioral1/files/0x0006000000016d90-182.dat	upx
behavioral1/files/0x0006000000016d7e-178.dat	upx
behavioral1/files/0x0006000000016d3a-174.dat	upx
behavioral1/memory/2456-170-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2740-168-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/2580-166-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/2892-164-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/1720-162-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2932-160-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/memory/1256-159-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/memory/2728-157-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/files/0x0006000000016d26-152.dat	upx
behavioral1/files/0x002e000000015653-142.dat	upx
behavioral1/files/0x0006000000016d0d-138.dat	upx
behavioral1/files/0x0006000000016ce4-132.dat	upx
behavioral1/files/0x0006000000016cb7-127.dat	upx
behavioral1/files/0x0006000000016c63-117.dat	upx
behavioral1/files/0x0006000000016a9a-107.dat	upx
behavioral1/files/0x0006000000016843-102.dat	upx
behavioral1/files/0x0006000000016572-92.dat	upx
behavioral1/files/0x00060000000164b2-87.dat	upx
behavioral1/files/0x000600000001630b-82.dat	upx
behavioral1/files/0x00060000000161e7-77.dat	upx
behavioral1/files/0x0006000000016117-72.dat	upx
behavioral1/files/0x0006000000015fe9-67.dat	upx
behavioral1/files/0x0006000000015eaf-57.dat	upx
behavioral1/files/0x0006000000015f6d-62.dat	upx
behavioral1/files/0x0006000000015e3a-52.dat	upx
behavioral1/files/0x0007000000015d9b-47.dat	upx
behavioral1/files/0x0009000000015cd5-43.dat	upx
behavioral1/files/0x0007000000004e76-27.dat	upx
behavioral1/files/0x000800000001566b-21.dat	upx
behavioral1/memory/1448-9-0x000000013F180000-0x000000013F572000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oiLJGXf.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\rWLxiKK.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\Bragrdq.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\zqBADis.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\GWuLdsi.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\xOthXOZ.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\LPKeSLC.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\UXRoGan.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\gEsJpZP.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\fXdLhOw.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\taTcmyO.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\fzMERQn.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\GyMpsVM.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\NLOtcbh.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\UVWghlV.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\nwLcoyS.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\AeAEiDC.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\gUHDLTV.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\ZHYrEKO.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\WGEeOqg.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\TscUQux.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\KpoSuoR.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\CauDKIB.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\kkxwiOv.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\QjvYwIu.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\MEAGCVG.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\FKooCeU.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\CZrTHex.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\EqNWhEf.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\fPkXCUM.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\YkZXEuM.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\ktESUYz.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\GhvckgP.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\fcYfMWM.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\IYXjcej.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\GhyMdsT.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\ZnOtcnb.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\xRiBkga.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\NrSzrMq.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\eKTFpBX.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\oPeGgsJ.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\AuVLEhL.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\jBAcBWF.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\IAhqNcD.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\TwOcMxr.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\RfDgtLc.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\ThPRFuu.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\DIwyuzA.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\sGOkfbY.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\VYWNehc.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\sQoGuaT.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\TVWoYOh.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\zsMTaif.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\dPqiwjo.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\ZkVFTUC.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\cRNbqDf.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\JiTHWcc.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\pxzOmCO.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\fIHfrJJ.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\YGiGTpK.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\mGrXmpj.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\NoGBteD.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\TSROiIT.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
File created	C:\Windows\System\DEwrfLy.exe	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1032	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
Token: SeDebugPrivilege	1032	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1032	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	29
PID 1728 wrote to memory of 1032	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	29
PID 1728 wrote to memory of 1032	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	29
PID 1728 wrote to memory of 1448	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	30
PID 1728 wrote to memory of 1448	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	30
PID 1728 wrote to memory of 1448	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	30
PID 1728 wrote to memory of 2728	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	31
PID 1728 wrote to memory of 2728	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	31
PID 1728 wrote to memory of 2728	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	31
PID 1728 wrote to memory of 1256	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	32
PID 1728 wrote to memory of 1256	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	32
PID 1728 wrote to memory of 1256	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	32
PID 1728 wrote to memory of 2932	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	33
PID 1728 wrote to memory of 2932	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	33
PID 1728 wrote to memory of 2932	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	33
PID 1728 wrote to memory of 1720	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	34
PID 1728 wrote to memory of 1720	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	34
PID 1728 wrote to memory of 1720	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	34
PID 1728 wrote to memory of 2892	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	35
PID 1728 wrote to memory of 2892	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	35
PID 1728 wrote to memory of 2892	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	35
PID 1728 wrote to memory of 2580	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	36
PID 1728 wrote to memory of 2580	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	36
PID 1728 wrote to memory of 2580	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	36
PID 1728 wrote to memory of 2740	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	37
PID 1728 wrote to memory of 2740	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	37
PID 1728 wrote to memory of 2740	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	37
PID 1728 wrote to memory of 2456	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	38
PID 1728 wrote to memory of 2456	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	38
PID 1728 wrote to memory of 2456	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	38
PID 1728 wrote to memory of 2516	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	39
PID 1728 wrote to memory of 2516	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	39
PID 1728 wrote to memory of 2516	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	39
PID 1728 wrote to memory of 3020	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	40
PID 1728 wrote to memory of 3020	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	40
PID 1728 wrote to memory of 3020	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	40
PID 1728 wrote to memory of 3068	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	41
PID 1728 wrote to memory of 3068	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	41
PID 1728 wrote to memory of 3068	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	41
PID 1728 wrote to memory of 2860	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	42
PID 1728 wrote to memory of 2860	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	42
PID 1728 wrote to memory of 2860	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	42
PID 1728 wrote to memory of 2872	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	43
PID 1728 wrote to memory of 2872	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	43
PID 1728 wrote to memory of 2872	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	43
PID 1728 wrote to memory of 2904	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	44
PID 1728 wrote to memory of 2904	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	44
PID 1728 wrote to memory of 2904	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	44
PID 1728 wrote to memory of 3040	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	45
PID 1728 wrote to memory of 3040	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	45
PID 1728 wrote to memory of 3040	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	45
PID 1728 wrote to memory of 3036	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	46
PID 1728 wrote to memory of 3036	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	46
PID 1728 wrote to memory of 3036	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	46
PID 1728 wrote to memory of 1648	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	47
PID 1728 wrote to memory of 1648	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	47
PID 1728 wrote to memory of 1648	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	47
PID 1728 wrote to memory of 2668	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	48
PID 1728 wrote to memory of 2668	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	48
PID 1728 wrote to memory of 2668	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	48
PID 1728 wrote to memory of 2784	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	49
PID 1728 wrote to memory of 2784	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	49
PID 1728 wrote to memory of 2784	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	49
PID 1728 wrote to memory of 2024	1728	02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02db635be6ac310fd7402b84d36a0a12_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1032
- C:\Windows\System\SdKjTLJ.exe
  C:\Windows\System\SdKjTLJ.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\ChFmteO.exe
  C:\Windows\System\ChFmteO.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\VxOZPDn.exe
  C:\Windows\System\VxOZPDn.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\dqrbXQS.exe
  C:\Windows\System\dqrbXQS.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\nuEVqmG.exe
  C:\Windows\System\nuEVqmG.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\ZgfAXYo.exe
  C:\Windows\System\ZgfAXYo.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\gKKKAME.exe
  C:\Windows\System\gKKKAME.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\gljAGuj.exe
  C:\Windows\System\gljAGuj.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\mfilWXN.exe
  C:\Windows\System\mfilWXN.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\mPyNFeH.exe
  C:\Windows\System\mPyNFeH.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\GmiTbbh.exe
  C:\Windows\System\GmiTbbh.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\UnIHhAf.exe
  C:\Windows\System\UnIHhAf.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\yIpQeKg.exe
  C:\Windows\System\yIpQeKg.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\ypxGLCN.exe
  C:\Windows\System\ypxGLCN.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\oJqwAzu.exe
  C:\Windows\System\oJqwAzu.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\HBdbejN.exe
  C:\Windows\System\HBdbejN.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\gMHlyjN.exe
  C:\Windows\System\gMHlyjN.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\rViOiVi.exe
  C:\Windows\System\rViOiVi.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\COuHCpe.exe
  C:\Windows\System\COuHCpe.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\SLnAiJb.exe
  C:\Windows\System\SLnAiJb.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\dPqiwjo.exe
  C:\Windows\System\dPqiwjo.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\YclAmwy.exe
  C:\Windows\System\YclAmwy.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\ijcDvIm.exe
  C:\Windows\System\ijcDvIm.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\WfHtxfx.exe
  C:\Windows\System\WfHtxfx.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\oPeGgsJ.exe
  C:\Windows\System\oPeGgsJ.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\XUgARPa.exe
  C:\Windows\System\XUgARPa.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\yUPQeFl.exe
  C:\Windows\System\yUPQeFl.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\DIwyuzA.exe
  C:\Windows\System\DIwyuzA.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\mKoQVhj.exe
  C:\Windows\System\mKoQVhj.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\rEtTeHO.exe
  C:\Windows\System\rEtTeHO.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\jlSbHmn.exe
  C:\Windows\System\jlSbHmn.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\XAmfgZv.exe
  C:\Windows\System\XAmfgZv.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\epKBSav.exe
  C:\Windows\System\epKBSav.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\VtCOtao.exe
  C:\Windows\System\VtCOtao.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\HsgfmIm.exe
  C:\Windows\System\HsgfmIm.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\vJoNYVe.exe
  C:\Windows\System\vJoNYVe.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\vOiCBge.exe
  C:\Windows\System\vOiCBge.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\yuzsECm.exe
  C:\Windows\System\yuzsECm.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\UubseYJ.exe
  C:\Windows\System\UubseYJ.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\dTEICDS.exe
  C:\Windows\System\dTEICDS.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\mIJYHPS.exe
  C:\Windows\System\mIJYHPS.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\XXdrXzw.exe
  C:\Windows\System\XXdrXzw.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\DcteQHO.exe
  C:\Windows\System\DcteQHO.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\EtCDpbM.exe
  C:\Windows\System\EtCDpbM.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\cHyvfIA.exe
  C:\Windows\System\cHyvfIA.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\MLQGFWw.exe
  C:\Windows\System\MLQGFWw.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\bBIBilr.exe
  C:\Windows\System\bBIBilr.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\YeYmxte.exe
  C:\Windows\System\YeYmxte.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\OCMMGCm.exe
  C:\Windows\System\OCMMGCm.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\rmZPenz.exe
  C:\Windows\System\rmZPenz.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\muDmzBy.exe
  C:\Windows\System\muDmzBy.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\feFAhAC.exe
  C:\Windows\System\feFAhAC.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\dqRFPSG.exe
  C:\Windows\System\dqRFPSG.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\PliBPvx.exe
  C:\Windows\System\PliBPvx.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\ZQGEmbG.exe
  C:\Windows\System\ZQGEmbG.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\sxqWRbL.exe
  C:\Windows\System\sxqWRbL.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\FLhvNZH.exe
  C:\Windows\System\FLhvNZH.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\TGzXqrs.exe
  C:\Windows\System\TGzXqrs.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\XnOhWQb.exe
  C:\Windows\System\XnOhWQb.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\vRmbiTt.exe
  C:\Windows\System\vRmbiTt.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\NhTDaCm.exe
  C:\Windows\System\NhTDaCm.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\DaRjCLU.exe
  C:\Windows\System\DaRjCLU.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\IPJuTpS.exe
  C:\Windows\System\IPJuTpS.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\ZnOtcnb.exe
  C:\Windows\System\ZnOtcnb.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\vyhxUOo.exe
  C:\Windows\System\vyhxUOo.exe
  2⤵
  PID:2672
- C:\Windows\System\qrggmoF.exe
  C:\Windows\System\qrggmoF.exe
  2⤵
  PID:2412
- C:\Windows\System\oCPDTvu.exe
  C:\Windows\System\oCPDTvu.exe
  2⤵
  PID:1964
- C:\Windows\System\hinaNwP.exe
  C:\Windows\System\hinaNwP.exe
  2⤵
  PID:2852
- C:\Windows\System\dPcplAU.exe
  C:\Windows\System\dPcplAU.exe
  2⤵
  PID:1660
- C:\Windows\System\sGOkfbY.exe
  C:\Windows\System\sGOkfbY.exe
  2⤵
  PID:1520
- C:\Windows\System\djpvyxG.exe
  C:\Windows\System\djpvyxG.exe
  2⤵
  PID:540
- C:\Windows\System\MEAGCVG.exe
  C:\Windows\System\MEAGCVG.exe
  2⤵
  PID:420
- C:\Windows\System\VnAQpxx.exe
  C:\Windows\System\VnAQpxx.exe
  2⤵
  PID:1552
- C:\Windows\System\ArqYLIJ.exe
  C:\Windows\System\ArqYLIJ.exe
  2⤵
  PID:964
- C:\Windows\System\vXhHLUp.exe
  C:\Windows\System\vXhHLUp.exe
  2⤵
  PID:300
- C:\Windows\System\bBKEokx.exe
  C:\Windows\System\bBKEokx.exe
  2⤵
  PID:564
- C:\Windows\System\gEsJpZP.exe
  C:\Windows\System\gEsJpZP.exe
  2⤵
  PID:1056
- C:\Windows\System\zzTyEWd.exe
  C:\Windows\System\zzTyEWd.exe
  2⤵
  PID:2500
- C:\Windows\System\JQTUmsf.exe
  C:\Windows\System\JQTUmsf.exe
  2⤵
  PID:3064
- C:\Windows\System\GbVFsGj.exe
  C:\Windows\System\GbVFsGj.exe
  2⤵
  PID:2984
- C:\Windows\System\ePyUABi.exe
  C:\Windows\System\ePyUABi.exe
  2⤵
  PID:2420
- C:\Windows\System\rWLxiKK.exe
  C:\Windows\System\rWLxiKK.exe
  2⤵
  PID:2868
- C:\Windows\System\IMgXPKw.exe
  C:\Windows\System\IMgXPKw.exe
  2⤵
  PID:1052
- C:\Windows\System\KAQhGiV.exe
  C:\Windows\System\KAQhGiV.exe
  2⤵
  PID:2264
- C:\Windows\System\ejvZdAq.exe
  C:\Windows\System\ejvZdAq.exe
  2⤵
  PID:1304
- C:\Windows\System\FKooCeU.exe
  C:\Windows\System\FKooCeU.exe
  2⤵
  PID:1540
- C:\Windows\System\JzxNyls.exe
  C:\Windows\System\JzxNyls.exe
  2⤵
  PID:2876
- C:\Windows\System\iRrHnqE.exe
  C:\Windows\System\iRrHnqE.exe
  2⤵
  PID:1636
- C:\Windows\System\yblqxaR.exe
  C:\Windows\System\yblqxaR.exe
  2⤵
  PID:1808
- C:\Windows\System\SQvdHRO.exe
  C:\Windows\System\SQvdHRO.exe
  2⤵
  PID:2220
- C:\Windows\System\sxEOiTf.exe
  C:\Windows\System\sxEOiTf.exe
  2⤵
  PID:2088
- C:\Windows\System\QtkgXuJ.exe
  C:\Windows\System\QtkgXuJ.exe
  2⤵
  PID:1760
- C:\Windows\System\xxhlyon.exe
  C:\Windows\System\xxhlyon.exe
  2⤵
  PID:2524
- C:\Windows\System\LCwIgzq.exe
  C:\Windows\System\LCwIgzq.exe
  2⤵
  PID:2996
- C:\Windows\System\KDnHNub.exe
  C:\Windows\System\KDnHNub.exe
  2⤵
  PID:1604
- C:\Windows\System\tUjNgLx.exe
  C:\Windows\System\tUjNgLx.exe
  2⤵
  PID:2100
- C:\Windows\System\gBLBKVm.exe
  C:\Windows\System\gBLBKVm.exe
  2⤵
  PID:2748
- C:\Windows\System\PfzKykb.exe
  C:\Windows\System\PfzKykb.exe
  2⤵
  PID:2308
- C:\Windows\System\ZKwnhMx.exe
  C:\Windows\System\ZKwnhMx.exe
  2⤵
  PID:2440
- C:\Windows\System\xBdOlVq.exe
  C:\Windows\System\xBdOlVq.exe
  2⤵
  PID:1716
- C:\Windows\System\lWaOhGa.exe
  C:\Windows\System\lWaOhGa.exe
  2⤵
  PID:3032
- C:\Windows\System\vgdiCxc.exe
  C:\Windows\System\vgdiCxc.exe
  2⤵
  PID:2548
- C:\Windows\System\pAmIkLo.exe
  C:\Windows\System\pAmIkLo.exe
  2⤵
  PID:2856
- C:\Windows\System\baQIpLk.exe
  C:\Windows\System\baQIpLk.exe
  2⤵
  PID:2124
- C:\Windows\System\FuYvTuD.exe
  C:\Windows\System\FuYvTuD.exe
  2⤵
  PID:2028
- C:\Windows\System\NZOvnNj.exe
  C:\Windows\System\NZOvnNj.exe
  2⤵
  PID:1100
- C:\Windows\System\prQrCoI.exe
  C:\Windows\System\prQrCoI.exe
  2⤵
  PID:1684
- C:\Windows\System\mgVgBJC.exe
  C:\Windows\System\mgVgBJC.exe
  2⤵
  PID:1712
- C:\Windows\System\YcwrVkP.exe
  C:\Windows\System\YcwrVkP.exe
  2⤵
  PID:2792
- C:\Windows\System\VqOdyEQ.exe
  C:\Windows\System\VqOdyEQ.exe
  2⤵
  PID:2700
- C:\Windows\System\KHvTPjX.exe
  C:\Windows\System\KHvTPjX.exe
  2⤵
  PID:2464
- C:\Windows\System\zedcNza.exe
  C:\Windows\System\zedcNza.exe
  2⤵
  PID:1584
- C:\Windows\System\uMgEqJf.exe
  C:\Windows\System\uMgEqJf.exe
  2⤵
  PID:2356
- C:\Windows\System\GzZECKI.exe
  C:\Windows\System\GzZECKI.exe
  2⤵
  PID:1044
- C:\Windows\System\GNUlfnI.exe
  C:\Windows\System\GNUlfnI.exe
  2⤵
  PID:472
- C:\Windows\System\AuVLEhL.exe
  C:\Windows\System\AuVLEhL.exe
  2⤵
  PID:2148
- C:\Windows\System\SAoxxGO.exe
  C:\Windows\System\SAoxxGO.exe
  2⤵
  PID:2168
- C:\Windows\System\mGrXmpj.exe
  C:\Windows\System\mGrXmpj.exe
  2⤵
  PID:1984
- C:\Windows\System\IhzyqSg.exe
  C:\Windows\System\IhzyqSg.exe
  2⤵
  PID:2408
- C:\Windows\System\mAlrHLq.exe
  C:\Windows\System\mAlrHLq.exe
  2⤵
  PID:1688
- C:\Windows\System\rocTKIg.exe
  C:\Windows\System\rocTKIg.exe
  2⤵
  PID:2228
- C:\Windows\System\TAPIuVa.exe
  C:\Windows\System\TAPIuVa.exe
  2⤵
  PID:2716
- C:\Windows\System\xCVLMhU.exe
  C:\Windows\System\xCVLMhU.exe
  2⤵
  PID:2796
- C:\Windows\System\wMBxXlj.exe
  C:\Windows\System\wMBxXlj.exe
  2⤵
  PID:2928
- C:\Windows\System\WRcTvPG.exe
  C:\Windows\System\WRcTvPG.exe
  2⤵
  PID:2768
- C:\Windows\System\LlIPFto.exe
  C:\Windows\System\LlIPFto.exe
  2⤵
  PID:2888
- C:\Windows\System\dUArXZt.exe
  C:\Windows\System\dUArXZt.exe
  2⤵
  PID:1968
- C:\Windows\System\zJdzVwX.exe
  C:\Windows\System\zJdzVwX.exe
  2⤵
  PID:288
- C:\Windows\System\nxkLqWB.exe
  C:\Windows\System\nxkLqWB.exe
  2⤵
  PID:1284
- C:\Windows\System\LJZcHQV.exe
  C:\Windows\System\LJZcHQV.exe
  2⤵
  PID:2708
- C:\Windows\System\cvfGGNA.exe
  C:\Windows\System\cvfGGNA.exe
  2⤵
  PID:1756
- C:\Windows\System\xRiBkga.exe
  C:\Windows\System\xRiBkga.exe
  2⤵
  PID:2712
- C:\Windows\System\UNiOrZO.exe
  C:\Windows\System\UNiOrZO.exe
  2⤵
  PID:3084
- C:\Windows\System\zwqXcqm.exe
  C:\Windows\System\zwqXcqm.exe
  2⤵
  PID:3104
- C:\Windows\System\QWdcNiG.exe
  C:\Windows\System\QWdcNiG.exe
  2⤵
  PID:3120
- C:\Windows\System\EcsVNyA.exe
  C:\Windows\System\EcsVNyA.exe
  2⤵
  PID:3148
- C:\Windows\System\bfXvBvo.exe
  C:\Windows\System\bfXvBvo.exe
  2⤵
  PID:3164
- C:\Windows\System\TfghVdD.exe
  C:\Windows\System\TfghVdD.exe
  2⤵
  PID:3180
- C:\Windows\System\ZkVFTUC.exe
  C:\Windows\System\ZkVFTUC.exe
  2⤵
  PID:3196
- C:\Windows\System\txxpFok.exe
  C:\Windows\System\txxpFok.exe
  2⤵
  PID:3212
- C:\Windows\System\kJezaXm.exe
  C:\Windows\System\kJezaXm.exe
  2⤵
  PID:3228
- C:\Windows\System\wQpJNqL.exe
  C:\Windows\System\wQpJNqL.exe
  2⤵
  PID:3244
- C:\Windows\System\RJYXtKC.exe
  C:\Windows\System\RJYXtKC.exe
  2⤵
  PID:3260
- C:\Windows\System\asHoFwi.exe
  C:\Windows\System\asHoFwi.exe
  2⤵
  PID:3276
- C:\Windows\System\gRkuGoq.exe
  C:\Windows\System\gRkuGoq.exe
  2⤵
  PID:3292
- C:\Windows\System\NoGBteD.exe
  C:\Windows\System\NoGBteD.exe
  2⤵
  PID:3308
- C:\Windows\System\iesYWNe.exe
  C:\Windows\System\iesYWNe.exe
  2⤵
  PID:3324
- C:\Windows\System\JPOybTc.exe
  C:\Windows\System\JPOybTc.exe
  2⤵
  PID:3340
- C:\Windows\System\UTXBcjU.exe
  C:\Windows\System\UTXBcjU.exe
  2⤵
  PID:3356
- C:\Windows\System\NunPfEN.exe
  C:\Windows\System\NunPfEN.exe
  2⤵
  PID:3372
- C:\Windows\System\MqleKrD.exe
  C:\Windows\System\MqleKrD.exe
  2⤵
  PID:3388
- C:\Windows\System\mENaojY.exe
  C:\Windows\System\mENaojY.exe
  2⤵
  PID:3404
- C:\Windows\System\TSROiIT.exe
  C:\Windows\System\TSROiIT.exe
  2⤵
  PID:3420
- C:\Windows\System\aZYXBKl.exe
  C:\Windows\System\aZYXBKl.exe
  2⤵
  PID:3456
- C:\Windows\System\TiYtpLG.exe
  C:\Windows\System\TiYtpLG.exe
  2⤵
  PID:3472
- C:\Windows\System\ppfWEXc.exe
  C:\Windows\System\ppfWEXc.exe
  2⤵
  PID:3488
- C:\Windows\System\gBxnjGa.exe
  C:\Windows\System\gBxnjGa.exe
  2⤵
  PID:3504
- C:\Windows\System\iCnwnYH.exe
  C:\Windows\System\iCnwnYH.exe
  2⤵
  PID:3520
- C:\Windows\System\NGIWpjg.exe
  C:\Windows\System\NGIWpjg.exe
  2⤵
  PID:3536
- C:\Windows\System\YYvvXbY.exe
  C:\Windows\System\YYvvXbY.exe
  2⤵
  PID:3552
- C:\Windows\System\GPYJOxi.exe
  C:\Windows\System\GPYJOxi.exe
  2⤵
  PID:3568
- C:\Windows\System\fBPNWub.exe
  C:\Windows\System\fBPNWub.exe
  2⤵
  PID:3584
- C:\Windows\System\kjLJYTA.exe
  C:\Windows\System\kjLJYTA.exe
  2⤵
  PID:3608
- C:\Windows\System\WLnDiZE.exe
  C:\Windows\System\WLnDiZE.exe
  2⤵
  PID:3624
- C:\Windows\System\hSlkJGW.exe
  C:\Windows\System\hSlkJGW.exe
  2⤵
  PID:3640
- C:\Windows\System\UVWghlV.exe
  C:\Windows\System\UVWghlV.exe
  2⤵
  PID:3656
- C:\Windows\System\UYFhUHd.exe
  C:\Windows\System\UYFhUHd.exe
  2⤵
  PID:3672
- C:\Windows\System\SjvSUib.exe
  C:\Windows\System\SjvSUib.exe
  2⤵
  PID:3688
- C:\Windows\System\ryOKzLH.exe
  C:\Windows\System\ryOKzLH.exe
  2⤵
  PID:3704
- C:\Windows\System\tMYMWBb.exe
  C:\Windows\System\tMYMWBb.exe
  2⤵
  PID:3720
- C:\Windows\System\zvadUrf.exe
  C:\Windows\System\zvadUrf.exe
  2⤵
  PID:3736
- C:\Windows\System\DmQRuPT.exe
  C:\Windows\System\DmQRuPT.exe
  2⤵
  PID:3788
- C:\Windows\System\ilJwGEp.exe
  C:\Windows\System\ilJwGEp.exe
  2⤵
  PID:3804
- C:\Windows\System\gogdlbf.exe
  C:\Windows\System\gogdlbf.exe
  2⤵
  PID:3824
- C:\Windows\System\UfOAkJx.exe
  C:\Windows\System\UfOAkJx.exe
  2⤵
  PID:3840
- C:\Windows\System\IOAEwIC.exe
  C:\Windows\System\IOAEwIC.exe
  2⤵
  PID:3856
- C:\Windows\System\BqJIrUm.exe
  C:\Windows\System\BqJIrUm.exe
  2⤵
  PID:3872
- C:\Windows\System\NNffEWI.exe
  C:\Windows\System\NNffEWI.exe
  2⤵
  PID:3892
- C:\Windows\System\UUsJeom.exe
  C:\Windows\System\UUsJeom.exe
  2⤵
  PID:3908
- C:\Windows\System\hEQpISJ.exe
  C:\Windows\System\hEQpISJ.exe
  2⤵
  PID:3924
- C:\Windows\System\JCcWysv.exe
  C:\Windows\System\JCcWysv.exe
  2⤵
  PID:3940
- C:\Windows\System\kVEclAi.exe
  C:\Windows\System\kVEclAi.exe
  2⤵
  PID:3956
- C:\Windows\System\CZrTHex.exe
  C:\Windows\System\CZrTHex.exe
  2⤵
  PID:3972
- C:\Windows\System\ePndoqq.exe
  C:\Windows\System\ePndoqq.exe
  2⤵
  PID:4056
- C:\Windows\System\LpoCwVL.exe
  C:\Windows\System\LpoCwVL.exe
  2⤵
  PID:4072
- C:\Windows\System\fXdLhOw.exe
  C:\Windows\System\fXdLhOw.exe
  2⤵
  PID:4088
- C:\Windows\System\dmmnlht.exe
  C:\Windows\System\dmmnlht.exe
  2⤵
  PID:2384
- C:\Windows\System\cRNbqDf.exe
  C:\Windows\System\cRNbqDf.exe
  2⤵
  PID:2448
- C:\Windows\System\kWPFadx.exe
  C:\Windows\System\kWPFadx.exe
  2⤵
  PID:1992
- C:\Windows\System\tHLbwQq.exe
  C:\Windows\System\tHLbwQq.exe
  2⤵
  PID:1948
- C:\Windows\System\JXHIVPF.exe
  C:\Windows\System\JXHIVPF.exe
  2⤵
  PID:2268
- C:\Windows\System\nPBWycH.exe
  C:\Windows\System\nPBWycH.exe
  2⤵
  PID:2260
- C:\Windows\System\iLDZSCN.exe
  C:\Windows\System\iLDZSCN.exe
  2⤵
  PID:3132
- C:\Windows\System\ZoTJiyk.exe
  C:\Windows\System\ZoTJiyk.exe
  2⤵
  PID:2476
- C:\Windows\System\SKNnEtc.exe
  C:\Windows\System\SKNnEtc.exe
  2⤵
  PID:3052
- C:\Windows\System\UCSDwVb.exe
  C:\Windows\System\UCSDwVb.exe
  2⤵
  PID:3156
- C:\Windows\System\EUKUQwJ.exe
  C:\Windows\System\EUKUQwJ.exe
  2⤵
  PID:3076
- C:\Windows\System\tAhfame.exe
  C:\Windows\System\tAhfame.exe
  2⤵
  PID:1664
- C:\Windows\System\bIcodos.exe
  C:\Windows\System\bIcodos.exe
  2⤵
  PID:3012
- C:\Windows\System\OBONuLP.exe
  C:\Windows\System\OBONuLP.exe
  2⤵
  PID:2340
- C:\Windows\System\VYWNehc.exe
  C:\Windows\System\VYWNehc.exe
  2⤵
  PID:1612
- C:\Windows\System\DITjigU.exe
  C:\Windows\System\DITjigU.exe
  2⤵
  PID:796
- C:\Windows\System\HiTodDb.exe
  C:\Windows\System\HiTodDb.exe
  2⤵
  PID:3204
- C:\Windows\System\VQkCyQC.exe
  C:\Windows\System\VQkCyQC.exe
  2⤵
  PID:3220
- C:\Windows\System\wjpjHXt.exe
  C:\Windows\System\wjpjHXt.exe
  2⤵
  PID:3268
- C:\Windows\System\rrHAQvT.exe
  C:\Windows\System\rrHAQvT.exe
  2⤵
  PID:3284
- C:\Windows\System\ZNdeNwb.exe
  C:\Windows\System\ZNdeNwb.exe
  2⤵
  PID:3336
- C:\Windows\System\frTphwc.exe
  C:\Windows\System\frTphwc.exe
  2⤵
  PID:3364
- C:\Windows\System\JiTHWcc.exe
  C:\Windows\System\JiTHWcc.exe
  2⤵
  PID:3380
- C:\Windows\System\XWAKwYY.exe
  C:\Windows\System\XWAKwYY.exe
  2⤵
  PID:3412
- C:\Windows\System\GKLcdkY.exe
  C:\Windows\System\GKLcdkY.exe
  2⤵
  PID:3448
- C:\Windows\System\QdQiKpO.exe
  C:\Windows\System\QdQiKpO.exe
  2⤵
  PID:3432
- C:\Windows\System\fsoXflu.exe
  C:\Windows\System\fsoXflu.exe
  2⤵
  PID:2560
- C:\Windows\System\JFPSFrv.exe
  C:\Windows\System\JFPSFrv.exe
  2⤵
  PID:1752
- C:\Windows\System\ODpXMZB.exe
  C:\Windows\System\ODpXMZB.exe
  2⤵
  PID:3544
- C:\Windows\System\gQZDVXc.exe
  C:\Windows\System\gQZDVXc.exe
  2⤵
  PID:3616
- C:\Windows\System\zUdNtLD.exe
  C:\Windows\System\zUdNtLD.exe
  2⤵
  PID:3680
- C:\Windows\System\ruDuhuN.exe
  C:\Windows\System\ruDuhuN.exe
  2⤵
  PID:2832
- C:\Windows\System\fpmewSl.exe
  C:\Windows\System\fpmewSl.exe
  2⤵
  PID:2336
- C:\Windows\System\UvLIXnJ.exe
  C:\Windows\System\UvLIXnJ.exe
  2⤵
  PID:3532
- C:\Windows\System\taTcmyO.exe
  C:\Windows\System\taTcmyO.exe
  2⤵
  PID:3632
- C:\Windows\System\wMmIDVO.exe
  C:\Windows\System\wMmIDVO.exe
  2⤵
  PID:3728
- C:\Windows\System\OBdxZBg.exe
  C:\Windows\System\OBdxZBg.exe
  2⤵
  PID:3596
- C:\Windows\System\gkAgVai.exe
  C:\Windows\System\gkAgVai.exe
  2⤵
  PID:1108
- C:\Windows\System\msdkIad.exe
  C:\Windows\System\msdkIad.exe
  2⤵
  PID:3816
- C:\Windows\System\nVxZtCi.exe
  C:\Windows\System\nVxZtCi.exe
  2⤵
  PID:3852
- C:\Windows\System\QaURFVz.exe
  C:\Windows\System\QaURFVz.exe
  2⤵
  PID:3948
- C:\Windows\System\SnETRqw.exe
  C:\Windows\System\SnETRqw.exe
  2⤵
  PID:3800
- C:\Windows\System\NrSzrMq.exe
  C:\Windows\System\NrSzrMq.exe
  2⤵
  PID:3868
- C:\Windows\System\fczRaVQ.exe
  C:\Windows\System\fczRaVQ.exe
  2⤵
  PID:900
- C:\Windows\System\zbNBMfw.exe
  C:\Windows\System\zbNBMfw.exe
  2⤵
  PID:2444
- C:\Windows\System\awUCxQl.exe
  C:\Windows\System\awUCxQl.exe
  2⤵
  PID:2612
- C:\Windows\System\cpZgFgI.exe
  C:\Windows\System\cpZgFgI.exe
  2⤵
  PID:4064
- C:\Windows\System\lIVDUXb.exe
  C:\Windows\System\lIVDUXb.exe
  2⤵
  PID:1676
- C:\Windows\System\yzJpAdm.exe
  C:\Windows\System\yzJpAdm.exe
  2⤵
  PID:2064
- C:\Windows\System\wGfxAax.exe
  C:\Windows\System\wGfxAax.exe
  2⤵
  PID:2720
- C:\Windows\System\lDfKCVg.exe
  C:\Windows\System\lDfKCVg.exe
  2⤵
  PID:3988
- C:\Windows\System\rkGroXU.exe
  C:\Windows\System\rkGroXU.exe
  2⤵
  PID:4004
- C:\Windows\System\dKRcnEh.exe
  C:\Windows\System\dKRcnEh.exe
  2⤵
  PID:4032
- C:\Windows\System\dnhuSgL.exe
  C:\Windows\System\dnhuSgL.exe
  2⤵
  PID:4044
- C:\Windows\System\TFKHGgb.exe
  C:\Windows\System\TFKHGgb.exe
  2⤵
  PID:2572
- C:\Windows\System\eDoTmSJ.exe
  C:\Windows\System\eDoTmSJ.exe
  2⤵
  PID:1832
- C:\Windows\System\qIRrQkA.exe
  C:\Windows\System\qIRrQkA.exe
  2⤵
  PID:2312
- C:\Windows\System\decMRhy.exe
  C:\Windows\System\decMRhy.exe
  2⤵
  PID:2968
- C:\Windows\System\xCftfWX.exe
  C:\Windows\System\xCftfWX.exe
  2⤵
  PID:320
- C:\Windows\System\RTaNqHA.exe
  C:\Windows\System\RTaNqHA.exe
  2⤵
  PID:3112
- C:\Windows\System\fQIYVTQ.exe
  C:\Windows\System\fQIYVTQ.exe
  2⤵
  PID:1204
- C:\Windows\System\yHeFMri.exe
  C:\Windows\System\yHeFMri.exe
  2⤵
  PID:3256
- C:\Windows\System\HsMtHSI.exe
  C:\Windows\System\HsMtHSI.exe
  2⤵
  PID:3160
- C:\Windows\System\Bragrdq.exe
  C:\Windows\System\Bragrdq.exe
  2⤵
  PID:3136
- C:\Windows\System\BGVtdrC.exe
  C:\Windows\System\BGVtdrC.exe
  2⤵
  PID:3224
- C:\Windows\System\HxhAdrS.exe
  C:\Windows\System\HxhAdrS.exe
  2⤵
  PID:3368
- C:\Windows\System\bTEUlPd.exe
  C:\Windows\System\bTEUlPd.exe
  2⤵
  PID:2648
- C:\Windows\System\jnHndQH.exe
  C:\Windows\System\jnHndQH.exe
  2⤵
  PID:3452
- C:\Windows\System\sRiMkhY.exe
  C:\Windows\System\sRiMkhY.exe
  2⤵
  PID:1836
- C:\Windows\System\YKQcBuo.exe
  C:\Windows\System\YKQcBuo.exe
  2⤵
  PID:3712
- C:\Windows\System\wTyWKTW.exe
  C:\Windows\System\wTyWKTW.exe
  2⤵
  PID:1168
- C:\Windows\System\lrEIxkk.exe
  C:\Windows\System\lrEIxkk.exe
  2⤵
  PID:3516
- C:\Windows\System\IAhqNcD.exe
  C:\Windows\System\IAhqNcD.exe
  2⤵
  PID:3748
- C:\Windows\System\lSStpef.exe
  C:\Windows\System\lSStpef.exe
  2⤵
  PID:3604
- C:\Windows\System\NMosYaX.exe
  C:\Windows\System\NMosYaX.exe
  2⤵
  PID:712
- C:\Windows\System\yqxVdGk.exe
  C:\Windows\System\yqxVdGk.exe
  2⤵
  PID:3796
- C:\Windows\System\dgQvKHR.exe
  C:\Windows\System\dgQvKHR.exe
  2⤵
  PID:1956
- C:\Windows\System\ZGlTfhm.exe
  C:\Windows\System\ZGlTfhm.exe
  2⤵
  PID:2620
- C:\Windows\System\JxIDAZL.exe
  C:\Windows\System\JxIDAZL.exe
  2⤵
  PID:1148
- C:\Windows\System\wmFzauW.exe
  C:\Windows\System\wmFzauW.exe
  2⤵
  PID:4000
- C:\Windows\System\LRcFXYM.exe
  C:\Windows\System\LRcFXYM.exe
  2⤵
  PID:3468
- C:\Windows\System\mlzOFKZ.exe
  C:\Windows\System\mlzOFKZ.exe
  2⤵
  PID:3100
- C:\Windows\System\JhLZzuo.exe
  C:\Windows\System\JhLZzuo.exe
  2⤵
  PID:3056
- C:\Windows\System\GddyEVl.exe
  C:\Windows\System\GddyEVl.exe
  2⤵
  PID:2760
- C:\Windows\System\IfaUCHv.exe
  C:\Windows\System\IfaUCHv.exe
  2⤵
  PID:3484
- C:\Windows\System\xOqsVLH.exe
  C:\Windows\System\xOqsVLH.exe
  2⤵
  PID:2080
- C:\Windows\System\sdOgzUZ.exe
  C:\Windows\System\sdOgzUZ.exe
  2⤵
  PID:1248
- C:\Windows\System\TwvOZhM.exe
  C:\Windows\System\TwvOZhM.exe
  2⤵
  PID:3252
- C:\Windows\System\HmPdfsq.exe
  C:\Windows\System\HmPdfsq.exe
  2⤵
  PID:3916
- C:\Windows\System\GGOGeAS.exe
  C:\Windows\System\GGOGeAS.exe
  2⤵
  PID:2468
- C:\Windows\System\vaImpql.exe
  C:\Windows\System\vaImpql.exe
  2⤵
  PID:1576
- C:\Windows\System\cSCtMPI.exe
  C:\Windows\System\cSCtMPI.exe
  2⤵
  PID:4016
- C:\Windows\System\nXigOAd.exe
  C:\Windows\System\nXigOAd.exe
  2⤵
  PID:3096
- C:\Windows\System\fsIiNug.exe
  C:\Windows\System\fsIiNug.exe
  2⤵
  PID:3500
- C:\Windows\System\TscUQux.exe
  C:\Windows\System\TscUQux.exe
  2⤵
  PID:1500
- C:\Windows\System\OJpUVdt.exe
  C:\Windows\System\OJpUVdt.exe
  2⤵
  PID:2068
- C:\Windows\System\cDywtoY.exe
  C:\Windows\System\cDywtoY.exe
  2⤵
  PID:1872
- C:\Windows\System\TlIdHhU.exe
  C:\Windows\System\TlIdHhU.exe
  2⤵
  PID:4084
- C:\Windows\System\aEgGJZj.exe
  C:\Windows\System\aEgGJZj.exe
  2⤵
  PID:336
- C:\Windows\System\quZPQvg.exe
  C:\Windows\System\quZPQvg.exe
  2⤵
  PID:3384
- C:\Windows\System\euzfqPm.exe
  C:\Windows\System\euzfqPm.exe
  2⤵
  PID:4112
- C:\Windows\System\KpoSuoR.exe
  C:\Windows\System\KpoSuoR.exe
  2⤵
  PID:4128
- C:\Windows\System\mcuXLvh.exe
  C:\Windows\System\mcuXLvh.exe
  2⤵
  PID:4144
- C:\Windows\System\Rodnfkm.exe
  C:\Windows\System\Rodnfkm.exe
  2⤵
  PID:4160
- C:\Windows\System\pxzOmCO.exe
  C:\Windows\System\pxzOmCO.exe
  2⤵
  PID:4176
- C:\Windows\System\GWuLdsi.exe
  C:\Windows\System\GWuLdsi.exe
  2⤵
  PID:4192
- C:\Windows\System\rZuQZar.exe
  C:\Windows\System\rZuQZar.exe
  2⤵
  PID:4208
- C:\Windows\System\xOthXOZ.exe
  C:\Windows\System\xOthXOZ.exe
  2⤵
  PID:4224
- C:\Windows\System\wBcciMi.exe
  C:\Windows\System\wBcciMi.exe
  2⤵
  PID:4240
- C:\Windows\System\MxuXBYE.exe
  C:\Windows\System\MxuXBYE.exe
  2⤵
  PID:4256
- C:\Windows\System\EDsKIhM.exe
  C:\Windows\System\EDsKIhM.exe
  2⤵
  PID:4272
- C:\Windows\System\rUQEaon.exe
  C:\Windows\System\rUQEaon.exe
  2⤵
  PID:4288
- C:\Windows\System\fIHfrJJ.exe
  C:\Windows\System\fIHfrJJ.exe
  2⤵
  PID:4304
- C:\Windows\System\rtuRkea.exe
  C:\Windows\System\rtuRkea.exe
  2⤵
  PID:4320
- C:\Windows\System\dCcHhmc.exe
  C:\Windows\System\dCcHhmc.exe
  2⤵
  PID:4360
- C:\Windows\System\mjhecPH.exe
  C:\Windows\System\mjhecPH.exe
  2⤵
  PID:4392
- C:\Windows\System\RwdhCXo.exe
  C:\Windows\System\RwdhCXo.exe
  2⤵
  PID:4500
- C:\Windows\System\EohaHyr.exe
  C:\Windows\System\EohaHyr.exe
  2⤵
  PID:4516
- C:\Windows\System\IkgqVMy.exe
  C:\Windows\System\IkgqVMy.exe
  2⤵
  PID:4536
- C:\Windows\System\ZyCOcYe.exe
  C:\Windows\System\ZyCOcYe.exe
  2⤵
  PID:4552
- C:\Windows\System\pExHyqG.exe
  C:\Windows\System\pExHyqG.exe
  2⤵
  PID:4568
- C:\Windows\System\dKAZnjl.exe
  C:\Windows\System\dKAZnjl.exe
  2⤵
  PID:4592
- C:\Windows\System\qFQlOCL.exe
  C:\Windows\System\qFQlOCL.exe
  2⤵
  PID:4612
- C:\Windows\System\VscCQTH.exe
  C:\Windows\System\VscCQTH.exe
  2⤵
  PID:4632
- C:\Windows\System\oREEMwR.exe
  C:\Windows\System\oREEMwR.exe
  2⤵
  PID:4648
- C:\Windows\System\Ywvifri.exe
  C:\Windows\System\Ywvifri.exe
  2⤵
  PID:4664
- C:\Windows\System\GhvckgP.exe
  C:\Windows\System\GhvckgP.exe
  2⤵
  PID:4680
- C:\Windows\System\wLkiIXI.exe
  C:\Windows\System\wLkiIXI.exe
  2⤵
  PID:4696
- C:\Windows\System\TwOcMxr.exe
  C:\Windows\System\TwOcMxr.exe
  2⤵
  PID:4716
- C:\Windows\System\pbKdqqS.exe
  C:\Windows\System\pbKdqqS.exe
  2⤵
  PID:4732
- C:\Windows\System\XsjdQDW.exe
  C:\Windows\System\XsjdQDW.exe
  2⤵
  PID:4748
- C:\Windows\System\suSCGou.exe
  C:\Windows\System\suSCGou.exe
  2⤵
  PID:4764
- C:\Windows\System\yhmBEPd.exe
  C:\Windows\System\yhmBEPd.exe
  2⤵
  PID:4780
- C:\Windows\System\eilXMXB.exe
  C:\Windows\System\eilXMXB.exe
  2⤵
  PID:4796
- C:\Windows\System\RDpjEVm.exe
  C:\Windows\System\RDpjEVm.exe
  2⤵
  PID:4812
- C:\Windows\System\JYTtrwU.exe
  C:\Windows\System\JYTtrwU.exe
  2⤵
  PID:4828
- C:\Windows\System\EUPCpeu.exe
  C:\Windows\System\EUPCpeu.exe
  2⤵
  PID:4844
- C:\Windows\System\uFqbAwE.exe
  C:\Windows\System\uFqbAwE.exe
  2⤵
  PID:4864
- C:\Windows\System\fAIqjvB.exe
  C:\Windows\System\fAIqjvB.exe
  2⤵
  PID:4880
- C:\Windows\System\CEgEdTk.exe
  C:\Windows\System\CEgEdTk.exe
  2⤵
  PID:4900
- C:\Windows\System\jLjjJTD.exe
  C:\Windows\System\jLjjJTD.exe
  2⤵
  PID:4916
- C:\Windows\System\gUHDLTV.exe
  C:\Windows\System\gUHDLTV.exe
  2⤵
  PID:4932
- C:\Windows\System\lsHJQBQ.exe
  C:\Windows\System\lsHJQBQ.exe
  2⤵
  PID:4948
- C:\Windows\System\qVNtdml.exe
  C:\Windows\System\qVNtdml.exe
  2⤵
  PID:4964
- C:\Windows\System\osCIcsN.exe
  C:\Windows\System\osCIcsN.exe
  2⤵
  PID:4980
- C:\Windows\System\RtimdDD.exe
  C:\Windows\System\RtimdDD.exe
  2⤵
  PID:5000
- C:\Windows\System\EELwWED.exe
  C:\Windows\System\EELwWED.exe
  2⤵
  PID:5016
- C:\Windows\System\PNgJBkB.exe
  C:\Windows\System\PNgJBkB.exe
  2⤵
  PID:5032
- C:\Windows\System\KAMikXE.exe
  C:\Windows\System\KAMikXE.exe
  2⤵
  PID:5048
- C:\Windows\System\kemEUxZ.exe
  C:\Windows\System\kemEUxZ.exe
  2⤵
  PID:5068
- C:\Windows\System\rzyBlsf.exe
  C:\Windows\System\rzyBlsf.exe
  2⤵
  PID:5084
- C:\Windows\System\IANnaUl.exe
  C:\Windows\System\IANnaUl.exe
  2⤵
  PID:5100
- C:\Windows\System\BeqjkYJ.exe
  C:\Windows\System\BeqjkYJ.exe
  2⤵
  PID:5116
- C:\Windows\System\WBjqyLv.exe
  C:\Windows\System\WBjqyLv.exe
  2⤵
  PID:2960
- C:\Windows\System\RciIatD.exe
  C:\Windows\System\RciIatD.exe
  2⤵
  PID:3864
- C:\Windows\System\uyGQZbO.exe
  C:\Windows\System\uyGQZbO.exe
  2⤵
  PID:608
- C:\Windows\System\DCrsmLT.exe
  C:\Windows\System\DCrsmLT.exe
  2⤵
  PID:500
- C:\Windows\System\fpsmjjs.exe
  C:\Windows\System\fpsmjjs.exe
  2⤵
  PID:4152
- C:\Windows\System\BHsSpKa.exe
  C:\Windows\System\BHsSpKa.exe
  2⤵
  PID:4216
- C:\Windows\System\ZHYrEKO.exe
  C:\Windows\System\ZHYrEKO.exe
  2⤵
  PID:4284
- C:\Windows\System\KnMoKlX.exe
  C:\Windows\System\KnMoKlX.exe
  2⤵
  PID:4372
- C:\Windows\System\xMoaIHq.exe
  C:\Windows\System\xMoaIHq.exe
  2⤵
  PID:4388
- C:\Windows\System\ZmuRumr.exe
  C:\Windows\System\ZmuRumr.exe
  2⤵
  PID:304
- C:\Windows\System\qGlSDaw.exe
  C:\Windows\System\qGlSDaw.exe
  2⤵
  PID:3752
- C:\Windows\System\WiARBGO.exe
  C:\Windows\System\WiARBGO.exe
  2⤵
  PID:1884
- C:\Windows\System\UHSuvkb.exe
  C:\Windows\System\UHSuvkb.exe
  2⤵
  PID:4168
- C:\Windows\System\hvPGsto.exe
  C:\Windows\System\hvPGsto.exe
  2⤵
  PID:4232
- C:\Windows\System\UNbGJdq.exe
  C:\Windows\System\UNbGJdq.exe
  2⤵
  PID:4296
- C:\Windows\System\PBJRmRe.exe
  C:\Windows\System\PBJRmRe.exe
  2⤵
  PID:4336
- C:\Windows\System\sQoGuaT.exe
  C:\Windows\System\sQoGuaT.exe
  2⤵
  PID:4352
- C:\Windows\System\BHvySyn.exe
  C:\Windows\System\BHvySyn.exe
  2⤵
  PID:4408
- C:\Windows\System\nXDlSDN.exe
  C:\Windows\System\nXDlSDN.exe
  2⤵
  PID:4424
- C:\Windows\System\xJMjJyB.exe
  C:\Windows\System\xJMjJyB.exe
  2⤵
  PID:3576
- C:\Windows\System\iXbhZHT.exe
  C:\Windows\System\iXbhZHT.exe
  2⤵
  PID:4440
- C:\Windows\System\YwvjEPS.exe
  C:\Windows\System\YwvjEPS.exe
  2⤵
  PID:3768
- C:\Windows\System\WFlSeUL.exe
  C:\Windows\System\WFlSeUL.exe
  2⤵
  PID:4464
- C:\Windows\System\gJvqBok.exe
  C:\Windows\System\gJvqBok.exe
  2⤵
  PID:4480
- C:\Windows\System\SSBVEep.exe
  C:\Windows\System\SSBVEep.exe
  2⤵
  PID:4492
- C:\Windows\System\aJfZgxH.exe
  C:\Windows\System\aJfZgxH.exe
  2⤵
  PID:4532
- C:\Windows\System\PJToegV.exe
  C:\Windows\System\PJToegV.exe
  2⤵
  PID:4608
- C:\Windows\System\xMolLzE.exe
  C:\Windows\System\xMolLzE.exe
  2⤵
  PID:4676
- C:\Windows\System\YSGbjTo.exe
  C:\Windows\System\YSGbjTo.exe
  2⤵
  PID:4588
- C:\Windows\System\pdNxqhX.exe
  C:\Windows\System\pdNxqhX.exe
  2⤵
  PID:4656
- C:\Windows\System\kaHpUZf.exe
  C:\Windows\System\kaHpUZf.exe
  2⤵
  PID:4512
- C:\Windows\System\GlDYqmB.exe
  C:\Windows\System\GlDYqmB.exe
  2⤵
  PID:4544
- C:\Windows\System\DEwrfLy.exe
  C:\Windows\System\DEwrfLy.exe
  2⤵
  PID:4760
- C:\Windows\System\UyeDxRE.exe
  C:\Windows\System\UyeDxRE.exe
  2⤵
  PID:4644
- C:\Windows\System\BfJSbHx.exe
  C:\Windows\System\BfJSbHx.exe
  2⤵
  PID:4860
- C:\Windows\System\nBBEMGI.exe
  C:\Windows\System\nBBEMGI.exe
  2⤵
  PID:4924
- C:\Windows\System\aVPhVGG.exe
  C:\Windows\System\aVPhVGG.exe
  2⤵
  PID:4996
- C:\Windows\System\clnvVOd.exe
  C:\Windows\System\clnvVOd.exe
  2⤵
  PID:5064
- C:\Windows\System\JkFKQfG.exe
  C:\Windows\System\JkFKQfG.exe
  2⤵
  PID:4772
- C:\Windows\System\qNpNKQo.exe
  C:\Windows\System\qNpNKQo.exe
  2⤵
  PID:4872
- C:\Windows\System\PYauDTs.exe
  C:\Windows\System\PYauDTs.exe
  2⤵
  PID:4708
- C:\Windows\System\pPMbZmi.exe
  C:\Windows\System\pPMbZmi.exe
  2⤵
  PID:5008
- C:\Windows\System\wDNhNRe.exe
  C:\Windows\System\wDNhNRe.exe
  2⤵
  PID:4840
- C:\Windows\System\HoRMNWk.exe
  C:\Windows\System\HoRMNWk.exe
  2⤵
  PID:5092
- C:\Windows\System\RSsDGOB.exe
  C:\Windows\System\RSsDGOB.exe
  2⤵
  PID:4280
- C:\Windows\System\tYQsvPc.exe
  C:\Windows\System\tYQsvPc.exe
  2⤵
  PID:4124
- C:\Windows\System\fcYfMWM.exe
  C:\Windows\System\fcYfMWM.exe
  2⤵
  PID:4384
- C:\Windows\System\BIjrhOp.exe
  C:\Windows\System\BIjrhOp.exe
  2⤵
  PID:4140
- C:\Windows\System\LOOkEjn.exe
  C:\Windows\System\LOOkEjn.exe
  2⤵
  PID:4200
- C:\Windows\System\mIiteCQ.exe
  C:\Windows\System\mIiteCQ.exe
  2⤵
  PID:4268
- C:\Windows\System\RMoWaRC.exe
  C:\Windows\System\RMoWaRC.exe
  2⤵
  PID:4420
- C:\Windows\System\rczmUXI.exe
  C:\Windows\System\rczmUXI.exe
  2⤵
  PID:4456
- C:\Windows\System\FDrhCrw.exe
  C:\Windows\System\FDrhCrw.exe
  2⤵
  PID:4604
- C:\Windows\System\IiOCtZW.exe
  C:\Windows\System\IiOCtZW.exe
  2⤵
  PID:5112
- C:\Windows\System\iMvkXtD.exe
  C:\Windows\System\iMvkXtD.exe
  2⤵
  PID:4692
- C:\Windows\System\nwLcoyS.exe
  C:\Windows\System\nwLcoyS.exe
  2⤵
  PID:4852
- C:\Windows\System\vAqSmOz.exe
  C:\Windows\System\vAqSmOz.exe
  2⤵
  PID:4368
- C:\Windows\System\AkBJYlb.exe
  C:\Windows\System\AkBJYlb.exe
  2⤵
  PID:3836
- C:\Windows\System\sYSqnXn.exe
  C:\Windows\System\sYSqnXn.exe
  2⤵
  PID:4896
- C:\Windows\System\nEZcQns.exe
  C:\Windows\System\nEZcQns.exe
  2⤵
  PID:4820
- C:\Windows\System\watiJxM.exe
  C:\Windows\System\watiJxM.exe
  2⤵
  PID:4672
- C:\Windows\System\lHdWEiD.exe
  C:\Windows\System\lHdWEiD.exe
  2⤵
  PID:4476
- C:\Windows\System\JksNmjS.exe
  C:\Windows\System\JksNmjS.exe
  2⤵
  PID:4436
- C:\Windows\System\IYXjcej.exe
  C:\Windows\System\IYXjcej.exe
  2⤵
  PID:4988
- C:\Windows\System\qjOlEPf.exe
  C:\Windows\System\qjOlEPf.exe
  2⤵
  PID:4912
- C:\Windows\System\LPKeSLC.exe
  C:\Windows\System\LPKeSLC.exe
  2⤵
  PID:3664
- C:\Windows\System\rAOGGAz.exe
  C:\Windows\System\rAOGGAz.exe
  2⤵
  PID:3060
- C:\Windows\System\eTcEffv.exe
  C:\Windows\System\eTcEffv.exe
  2⤵
  PID:4600
- C:\Windows\System\RfDgtLc.exe
  C:\Windows\System\RfDgtLc.exe
  2⤵
  PID:4960
- C:\Windows\System\LMxVnXg.exe
  C:\Windows\System\LMxVnXg.exe
  2⤵
  PID:4624
- C:\Windows\System\uGGLaiK.exe
  C:\Windows\System\uGGLaiK.exe
  2⤵
  PID:5132
- C:\Windows\System\aXdaqka.exe
  C:\Windows\System\aXdaqka.exe
  2⤵
  PID:5148
- C:\Windows\System\CnEKzZF.exe
  C:\Windows\System\CnEKzZF.exe
  2⤵
  PID:5164
- C:\Windows\System\ZwWLnKn.exe
  C:\Windows\System\ZwWLnKn.exe
  2⤵
  PID:5180
- C:\Windows\System\ikwZGpS.exe
  C:\Windows\System\ikwZGpS.exe
  2⤵
  PID:5196
- C:\Windows\System\JYWDgtE.exe
  C:\Windows\System\JYWDgtE.exe
  2⤵
  PID:5212
- C:\Windows\System\gKSHabu.exe
  C:\Windows\System\gKSHabu.exe
  2⤵
  PID:5228
- C:\Windows\System\acspFId.exe
  C:\Windows\System\acspFId.exe
  2⤵
  PID:5244
- C:\Windows\System\MWDHBtu.exe
  C:\Windows\System\MWDHBtu.exe
  2⤵
  PID:5260
- C:\Windows\System\uVEVBqt.exe
  C:\Windows\System\uVEVBqt.exe
  2⤵
  PID:5276
- C:\Windows\System\ixftARB.exe
  C:\Windows\System\ixftARB.exe
  2⤵
  PID:5292
- C:\Windows\System\FCmfqcY.exe
  C:\Windows\System\FCmfqcY.exe
  2⤵
  PID:5308
- C:\Windows\System\IyplCBm.exe
  C:\Windows\System\IyplCBm.exe
  2⤵
  PID:5324
- C:\Windows\System\BkgapEn.exe
  C:\Windows\System\BkgapEn.exe
  2⤵
  PID:5344
- C:\Windows\System\CKHaUMS.exe
  C:\Windows\System\CKHaUMS.exe
  2⤵
  PID:5360
- C:\Windows\System\azOlZue.exe
  C:\Windows\System\azOlZue.exe
  2⤵
  PID:5380
- C:\Windows\System\WGEeOqg.exe
  C:\Windows\System\WGEeOqg.exe
  2⤵
  PID:5396
- C:\Windows\System\jsATfGb.exe
  C:\Windows\System\jsATfGb.exe
  2⤵
  PID:5412
- C:\Windows\System\AeAEiDC.exe
  C:\Windows\System\AeAEiDC.exe
  2⤵
  PID:5428
- C:\Windows\System\QBwYdbS.exe
  C:\Windows\System\QBwYdbS.exe
  2⤵
  PID:5444
- C:\Windows\System\bFylllM.exe
  C:\Windows\System\bFylllM.exe
  2⤵
  PID:5464
- C:\Windows\System\fzMERQn.exe
  C:\Windows\System\fzMERQn.exe
  2⤵
  PID:5484
- C:\Windows\System\NtiOqDt.exe
  C:\Windows\System\NtiOqDt.exe
  2⤵
  PID:5504
- C:\Windows\System\ZJCvnHj.exe
  C:\Windows\System\ZJCvnHj.exe
  2⤵
  PID:5524
- C:\Windows\System\UuJbPho.exe
  C:\Windows\System\UuJbPho.exe
  2⤵
  PID:5540
- C:\Windows\System\DOqHiqv.exe
  C:\Windows\System\DOqHiqv.exe
  2⤵
  PID:5556
- C:\Windows\System\cdEAzLl.exe
  C:\Windows\System\cdEAzLl.exe
  2⤵
  PID:5576
- C:\Windows\System\TbTGnOR.exe
  C:\Windows\System\TbTGnOR.exe
  2⤵
  PID:5596
- C:\Windows\System\jJTyLJx.exe
  C:\Windows\System\jJTyLJx.exe
  2⤵
  PID:5688
- C:\Windows\System\WPmARAJ.exe
  C:\Windows\System\WPmARAJ.exe
  2⤵
  PID:5704
- C:\Windows\System\SnEefju.exe
  C:\Windows\System\SnEefju.exe
  2⤵
  PID:5720
- C:\Windows\System\iMYVcBY.exe
  C:\Windows\System\iMYVcBY.exe
  2⤵
  PID:5736
- C:\Windows\System\SKnbouY.exe
  C:\Windows\System\SKnbouY.exe
  2⤵
  PID:5752
- C:\Windows\System\OkCbsjl.exe
  C:\Windows\System\OkCbsjl.exe
  2⤵
  PID:5768
- C:\Windows\System\jIWuGoJ.exe
  C:\Windows\System\jIWuGoJ.exe
  2⤵
  PID:5784
- C:\Windows\System\XOEjVbO.exe
  C:\Windows\System\XOEjVbO.exe
  2⤵
  PID:5800
- C:\Windows\System\nnFftfB.exe
  C:\Windows\System\nnFftfB.exe
  2⤵
  PID:5816
- C:\Windows\System\jBNsfqO.exe
  C:\Windows\System\jBNsfqO.exe
  2⤵
  PID:5832
- C:\Windows\System\JbtZzZS.exe
  C:\Windows\System\JbtZzZS.exe
  2⤵
  PID:5848
- C:\Windows\System\kJvIDis.exe
  C:\Windows\System\kJvIDis.exe
  2⤵
  PID:5864
- C:\Windows\System\BuDXwTA.exe
  C:\Windows\System\BuDXwTA.exe
  2⤵
  PID:5880
- C:\Windows\System\zZGzjFZ.exe
  C:\Windows\System\zZGzjFZ.exe
  2⤵
  PID:5896
- C:\Windows\System\GpuNkSt.exe
  C:\Windows\System\GpuNkSt.exe
  2⤵
  PID:5912
- C:\Windows\System\uenyLMD.exe
  C:\Windows\System\uenyLMD.exe
  2⤵
  PID:5928
- C:\Windows\System\LSEgdXP.exe
  C:\Windows\System\LSEgdXP.exe
  2⤵
  PID:5944
- C:\Windows\System\KsjwFju.exe
  C:\Windows\System\KsjwFju.exe
  2⤵
  PID:5960
- C:\Windows\System\cmVAhuf.exe
  C:\Windows\System\cmVAhuf.exe
  2⤵
  PID:5976
- C:\Windows\System\CqWzKeH.exe
  C:\Windows\System\CqWzKeH.exe
  2⤵
  PID:5992
- C:\Windows\System\uIIhULh.exe
  C:\Windows\System\uIIhULh.exe
  2⤵
  PID:6008
- C:\Windows\System\GFOSXvD.exe
  C:\Windows\System\GFOSXvD.exe
  2⤵
  PID:6024
- C:\Windows\System\cdVlsdG.exe
  C:\Windows\System\cdVlsdG.exe
  2⤵
  PID:6040
- C:\Windows\System\MMBTBsm.exe
  C:\Windows\System\MMBTBsm.exe
  2⤵
  PID:6056
- C:\Windows\System\wxFkaWY.exe
  C:\Windows\System\wxFkaWY.exe
  2⤵
  PID:6072
- C:\Windows\System\nOHJEMe.exe
  C:\Windows\System\nOHJEMe.exe
  2⤵
  PID:6088
- C:\Windows\System\iDtiSYH.exe
  C:\Windows\System\iDtiSYH.exe
  2⤵
  PID:6104
- C:\Windows\System\SeZOAEe.exe
  C:\Windows\System\SeZOAEe.exe
  2⤵
  PID:6120
- C:\Windows\System\UUKJAXD.exe
  C:\Windows\System\UUKJAXD.exe
  2⤵
  PID:6136
- C:\Windows\System\YdKFDmh.exe
  C:\Windows\System\YdKFDmh.exe
  2⤵
  PID:4908
- C:\Windows\System\pfwMTTG.exe
  C:\Windows\System\pfwMTTG.exe
  2⤵
  PID:4992
- C:\Windows\System\fPkXCUM.exe
  C:\Windows\System\fPkXCUM.exe
  2⤵
  PID:5160
- C:\Windows\System\ziCnVRK.exe
  C:\Windows\System\ziCnVRK.exe
  2⤵
  PID:5224
- C:\Windows\System\AnFoBER.exe
  C:\Windows\System\AnFoBER.exe
  2⤵
  PID:1264
- C:\Windows\System\bNDbCFk.exe
  C:\Windows\System\bNDbCFk.exe
  2⤵
  PID:5352
- C:\Windows\System\QYlqqMp.exe
  C:\Windows\System\QYlqqMp.exe
  2⤵
  PID:4836
- C:\Windows\System\UithTgW.exe
  C:\Windows\System\UithTgW.exe
  2⤵
  PID:4976
- C:\Windows\System\uofhBOh.exe
  C:\Windows\System\uofhBOh.exe
  2⤵
  PID:4120
- C:\Windows\System\OoZOWdT.exe
  C:\Windows\System\OoZOWdT.exe
  2⤵
  PID:3128
- C:\Windows\System\GQpJLJw.exe
  C:\Windows\System\GQpJLJw.exe
  2⤵
  PID:4264
- C:\Windows\System\RaojbRe.exe
  C:\Windows\System\RaojbRe.exe
  2⤵
  PID:5440
- C:\Windows\System\bpnUhBM.exe
  C:\Windows\System\bpnUhBM.exe
  2⤵
  PID:5300
- C:\Windows\System\xxoaVcJ.exe
  C:\Windows\System\xxoaVcJ.exe
  2⤵
  PID:5636
- C:\Windows\System\nDmXLLc.exe
  C:\Windows\System\nDmXLLc.exe
  2⤵
  PID:5744
- C:\Windows\System\eMtepIi.exe
  C:\Windows\System\eMtepIi.exe
  2⤵
  PID:5700
- C:\Windows\System\bGZbvnx.exe
  C:\Windows\System\bGZbvnx.exe
  2⤵
  PID:5808
- C:\Windows\System\LAxgIBe.exe
  C:\Windows\System\LAxgIBe.exe
  2⤵
  PID:5792
- C:\Windows\System\misMxGo.exe
  C:\Windows\System\misMxGo.exe
  2⤵
  PID:5760
- C:\Windows\System\wkzJfQR.exe
  C:\Windows\System\wkzJfQR.exe
  2⤵
  PID:5828
- C:\Windows\System\YSkJijf.exe
  C:\Windows\System\YSkJijf.exe
  2⤵
  PID:5936
- C:\Windows\System\KiozVUK.exe
  C:\Windows\System\KiozVUK.exe
  2⤵
  PID:5952
- C:\Windows\System\wBRFcCo.exe
  C:\Windows\System\wBRFcCo.exe
  2⤵
  PID:6004
- C:\Windows\System\bQmLBHk.exe
  C:\Windows\System\bQmLBHk.exe
  2⤵
  PID:5988
- C:\Windows\System\XnwiQyS.exe
  C:\Windows\System\XnwiQyS.exe
  2⤵
  PID:6052
- C:\Windows\System\ldkDMkt.exe
  C:\Windows\System\ldkDMkt.exe
  2⤵
  PID:6016
- C:\Windows\System\kJjauHa.exe
  C:\Windows\System\kJjauHa.exe
  2⤵
  PID:5080
- C:\Windows\System\boUGEry.exe
  C:\Windows\System\boUGEry.exe
  2⤵
  PID:5156
- C:\Windows\System\RhknwxQ.exe
  C:\Windows\System\RhknwxQ.exe
  2⤵
  PID:5284
- C:\Windows\System\vEvyFFa.exe
  C:\Windows\System\vEvyFFa.exe
  2⤵
  PID:4804
- C:\Windows\System\PXUNutc.exe
  C:\Windows\System\PXUNutc.exe
  2⤵
  PID:5456
- C:\Windows\System\WbaSqXd.exe
  C:\Windows\System\WbaSqXd.exe
  2⤵
  PID:4460
- C:\Windows\System\KJUMVsS.exe
  C:\Windows\System\KJUMVsS.exe
  2⤵
  PID:1316
- C:\Windows\System\Zlkspka.exe
  C:\Windows\System\Zlkspka.exe
  2⤵
  PID:4316
- C:\Windows\System\TVWoYOh.exe
  C:\Windows\System\TVWoYOh.exe
  2⤵
  PID:5336
- C:\Windows\System\NKttgmn.exe
  C:\Windows\System\NKttgmn.exe
  2⤵
  PID:5060
- C:\Windows\System\YBTLwHQ.exe
  C:\Windows\System\YBTLwHQ.exe
  2⤵
  PID:2596
- C:\Windows\System\zikwbCy.exe
  C:\Windows\System\zikwbCy.exe
  2⤵
  PID:1288
- C:\Windows\System\qiganNq.exe
  C:\Windows\System\qiganNq.exe
  2⤵
  PID:4756
- C:\Windows\System\MgMCqAH.exe
  C:\Windows\System\MgMCqAH.exe
  2⤵
  PID:3820
- C:\Windows\System\nnqjMoq.exe
  C:\Windows\System\nnqjMoq.exe
  2⤵
  PID:5552
- C:\Windows\System\nGXuSNM.exe
  C:\Windows\System\nGXuSNM.exe
  2⤵
  PID:5140
- C:\Windows\System\fiRVJDX.exe
  C:\Windows\System\fiRVJDX.exe
  2⤵
  PID:5204
- C:\Windows\System\aBJtalS.exe
  C:\Windows\System\aBJtalS.exe
  2⤵
  PID:5372
- C:\Windows\System\bixPfGB.exe
  C:\Windows\System\bixPfGB.exe
  2⤵
  PID:5304
- C:\Windows\System\KoEdTlT.exe
  C:\Windows\System\KoEdTlT.exe
  2⤵
  PID:5624
- C:\Windows\System\HAvsYdC.exe
  C:\Windows\System\HAvsYdC.exe
  2⤵
  PID:6036
- C:\Windows\System\pMBUnDE.exe
  C:\Windows\System\pMBUnDE.exe
  2⤵
  PID:5492
- C:\Windows\System\KmakhDI.exe
  C:\Windows\System\KmakhDI.exe
  2⤵
  PID:5076
- C:\Windows\System\MgmyOit.exe
  C:\Windows\System\MgmyOit.exe
  2⤵
  PID:5712
- C:\Windows\System\cYeZoRR.exe
  C:\Windows\System\cYeZoRR.exe
  2⤵
  PID:5840
- C:\Windows\System\tDMBouZ.exe
  C:\Windows\System\tDMBouZ.exe
  2⤵
  PID:4728
- C:\Windows\System\VHHjioj.exe
  C:\Windows\System\VHHjioj.exe
  2⤵
  PID:5520
- C:\Windows\System\HVmUGnu.exe
  C:\Windows\System\HVmUGnu.exe
  2⤵
  PID:6132
- C:\Windows\System\LehTtAX.exe
  C:\Windows\System\LehTtAX.exe
  2⤵
  PID:5728
- C:\Windows\System\EwyfgzE.exe
  C:\Windows\System\EwyfgzE.exe
  2⤵
  PID:5256
- C:\Windows\System\WKPddPV.exe
  C:\Windows\System\WKPddPV.exe
  2⤵
  PID:5876
- C:\Windows\System\ZdNLjBK.exe
  C:\Windows\System\ZdNLjBK.exe
  2⤵
  PID:6000
- C:\Windows\System\SJPPpFK.exe
  C:\Windows\System\SJPPpFK.exe
  2⤵
  PID:588
- C:\Windows\System\fGctbbS.exe
  C:\Windows\System\fGctbbS.exe
  2⤵
  PID:4452
- C:\Windows\System\yTdmmqp.exe
  C:\Windows\System\yTdmmqp.exe
  2⤵
  PID:5732
- C:\Windows\System\hogzipi.exe
  C:\Windows\System\hogzipi.exe
  2⤵
  PID:6112
- C:\Windows\System\ngcWheG.exe
  C:\Windows\System\ngcWheG.exe
  2⤵
  PID:5616
- C:\Windows\System\NZWjWLN.exe
  C:\Windows\System\NZWjWLN.exe
  2⤵
  PID:5044
- C:\Windows\System\NsbcWms.exe
  C:\Windows\System\NsbcWms.exe
  2⤵
  PID:5220
- C:\Windows\System\YGiGTpK.exe
  C:\Windows\System\YGiGTpK.exe
  2⤵
  PID:4744
- C:\Windows\System\cngtcnn.exe
  C:\Windows\System\cngtcnn.exe
  2⤵
  PID:5628
- C:\Windows\System\GhyMdsT.exe
  C:\Windows\System\GhyMdsT.exe
  2⤵
  PID:5796
- C:\Windows\System\hlaTgOS.exe
  C:\Windows\System\hlaTgOS.exe
  2⤵
  PID:5844
- C:\Windows\System\nsKkKSI.exe
  C:\Windows\System\nsKkKSI.exe
  2⤵
  PID:5984
- C:\Windows\System\UXRoGan.exe
  C:\Windows\System\UXRoGan.exe
  2⤵
  PID:5656
- C:\Windows\System\rnrZPhL.exe
  C:\Windows\System\rnrZPhL.exe
  2⤵
  PID:5476
- C:\Windows\System\MRzWLKR.exe
  C:\Windows\System\MRzWLKR.exe
  2⤵
  PID:5604
- C:\Windows\System\OHpujhj.exe
  C:\Windows\System\OHpujhj.exe
  2⤵
  PID:5780
- C:\Windows\System\gMmCGus.exe
  C:\Windows\System\gMmCGus.exe
  2⤵
  PID:5592
- C:\Windows\System\GyMpsVM.exe
  C:\Windows\System\GyMpsVM.exe
  2⤵
  PID:6116
- C:\Windows\System\gQNxLab.exe
  C:\Windows\System\gQNxLab.exe
  2⤵
  PID:5176
- C:\Windows\System\vhpyTwk.exe
  C:\Windows\System\vhpyTwk.exe
  2⤵
  PID:5672
- C:\Windows\System\zWbwzWa.exe
  C:\Windows\System\zWbwzWa.exe
  2⤵
  PID:5956
- C:\Windows\System\gOOishm.exe
  C:\Windows\System\gOOishm.exe
  2⤵
  PID:5940
- C:\Windows\System\YkZXEuM.exe
  C:\Windows\System\YkZXEuM.exe
  2⤵
  PID:5660
- C:\Windows\System\faTCsdl.exe
  C:\Windows\System\faTCsdl.exe
  2⤵
  PID:5548
- C:\Windows\System\kqUgrCd.exe
  C:\Windows\System\kqUgrCd.exe
  2⤵
  PID:5676
- C:\Windows\System\PMZohzb.exe
  C:\Windows\System\PMZohzb.exe
  2⤵
  PID:5500
- C:\Windows\System\SqcXlfB.exe
  C:\Windows\System\SqcXlfB.exe
  2⤵
  PID:5920
- C:\Windows\System\oCrfSXR.exe
  C:\Windows\System\oCrfSXR.exe
  2⤵
  PID:5368
- C:\Windows\System\UFFOjyk.exe
  C:\Windows\System\UFFOjyk.exe
  2⤵
  PID:6156
- C:\Windows\System\NbNjTXM.exe
  C:\Windows\System\NbNjTXM.exe
  2⤵
  PID:6172
- C:\Windows\System\IaqWoFS.exe
  C:\Windows\System\IaqWoFS.exe
  2⤵
  PID:6188
- C:\Windows\System\tKwCsGb.exe
  C:\Windows\System\tKwCsGb.exe
  2⤵
  PID:6204
- C:\Windows\System\caAVmSB.exe
  C:\Windows\System\caAVmSB.exe
  2⤵
  PID:6220
- C:\Windows\System\tiTzZGN.exe
  C:\Windows\System\tiTzZGN.exe
  2⤵
  PID:6236
- C:\Windows\System\ONzCBLb.exe
  C:\Windows\System\ONzCBLb.exe
  2⤵
  PID:6252
- C:\Windows\System\aIfkCaL.exe
  C:\Windows\System\aIfkCaL.exe
  2⤵
  PID:6268
- C:\Windows\System\JQlPaow.exe
  C:\Windows\System\JQlPaow.exe
  2⤵
  PID:6284
- C:\Windows\System\lYlGHzO.exe
  C:\Windows\System\lYlGHzO.exe
  2⤵
  PID:6300
- C:\Windows\System\OfUmDIR.exe
  C:\Windows\System\OfUmDIR.exe
  2⤵
  PID:6316
- C:\Windows\System\Bvxxjdt.exe
  C:\Windows\System\Bvxxjdt.exe
  2⤵
  PID:6332
- C:\Windows\System\YPMqwEu.exe
  C:\Windows\System\YPMqwEu.exe
  2⤵
  PID:6348
- C:\Windows\System\mtjEPVL.exe
  C:\Windows\System\mtjEPVL.exe
  2⤵
  PID:6364
- C:\Windows\System\ZEgWzHe.exe
  C:\Windows\System\ZEgWzHe.exe
  2⤵
  PID:6380
- C:\Windows\System\ptKAjBS.exe
  C:\Windows\System\ptKAjBS.exe
  2⤵
  PID:6396
- C:\Windows\System\qmgfAdp.exe
  C:\Windows\System\qmgfAdp.exe
  2⤵
  PID:6412
- C:\Windows\System\UfjmsYi.exe
  C:\Windows\System\UfjmsYi.exe
  2⤵
  PID:6428
- C:\Windows\System\yGEFUQA.exe
  C:\Windows\System\yGEFUQA.exe
  2⤵
  PID:6444
- C:\Windows\System\qzEdTLJ.exe
  C:\Windows\System\qzEdTLJ.exe
  2⤵
  PID:6460
- C:\Windows\System\zqBADis.exe
  C:\Windows\System\zqBADis.exe
  2⤵
  PID:6476
- C:\Windows\System\DvJvlXN.exe
  C:\Windows\System\DvJvlXN.exe
  2⤵
  PID:6492
- C:\Windows\System\JhVJTzW.exe
  C:\Windows\System\JhVJTzW.exe
  2⤵
  PID:6508
- C:\Windows\System\NOKGHBg.exe
  C:\Windows\System\NOKGHBg.exe
  2⤵
  PID:6524
- C:\Windows\System\lNbLCOq.exe
  C:\Windows\System\lNbLCOq.exe
  2⤵
  PID:6540
- C:\Windows\System\uuoTyhB.exe
  C:\Windows\System\uuoTyhB.exe
  2⤵
  PID:6556
- C:\Windows\System\mgNyBzQ.exe
  C:\Windows\System\mgNyBzQ.exe
  2⤵
  PID:6572
- C:\Windows\System\exbylCz.exe
  C:\Windows\System\exbylCz.exe
  2⤵
  PID:6588
- C:\Windows\System\XmWxHMY.exe
  C:\Windows\System\XmWxHMY.exe
  2⤵
  PID:6604
- C:\Windows\System\dHsaNqy.exe
  C:\Windows\System\dHsaNqy.exe
  2⤵
  PID:6620
- C:\Windows\System\ThPRFuu.exe
  C:\Windows\System\ThPRFuu.exe
  2⤵
  PID:6636
- C:\Windows\System\bKMbeDO.exe
  C:\Windows\System\bKMbeDO.exe
  2⤵
  PID:6652
- C:\Windows\System\EPQYxDc.exe
  C:\Windows\System\EPQYxDc.exe
  2⤵
  PID:6668
- C:\Windows\System\XJCXIOe.exe
  C:\Windows\System\XJCXIOe.exe
  2⤵
  PID:6684
- C:\Windows\System\YPGOLdS.exe
  C:\Windows\System\YPGOLdS.exe
  2⤵
  PID:6700
- C:\Windows\System\wEtyIBE.exe
  C:\Windows\System\wEtyIBE.exe
  2⤵
  PID:6716
- C:\Windows\System\BCnJlZB.exe
  C:\Windows\System\BCnJlZB.exe
  2⤵
  PID:6732
- C:\Windows\System\xFnGoAn.exe
  C:\Windows\System\xFnGoAn.exe
  2⤵
  PID:6748
- C:\Windows\System\EDTLVIz.exe
  C:\Windows\System\EDTLVIz.exe
  2⤵
  PID:6764
- C:\Windows\System\kXRZRqN.exe
  C:\Windows\System\kXRZRqN.exe
  2⤵
  PID:6780
- C:\Windows\System\CMAxgOF.exe
  C:\Windows\System\CMAxgOF.exe
  2⤵
  PID:6796
- C:\Windows\System\GfozwxW.exe
  C:\Windows\System\GfozwxW.exe
  2⤵
  PID:6812
- C:\Windows\System\MjSdPgT.exe
  C:\Windows\System\MjSdPgT.exe
  2⤵
  PID:6828
- C:\Windows\System\RUxUpWw.exe
  C:\Windows\System\RUxUpWw.exe
  2⤵
  PID:6844
- C:\Windows\System\tHuIGZK.exe
  C:\Windows\System\tHuIGZK.exe
  2⤵
  PID:6860
- C:\Windows\System\wsalWyu.exe
  C:\Windows\System\wsalWyu.exe
  2⤵
  PID:6876
- C:\Windows\System\yezJQok.exe
  C:\Windows\System\yezJQok.exe
  2⤵
  PID:6892
- C:\Windows\System\fIXjyiZ.exe
  C:\Windows\System\fIXjyiZ.exe
  2⤵
  PID:6908
- C:\Windows\System\bNeJAhk.exe
  C:\Windows\System\bNeJAhk.exe
  2⤵
  PID:6924
- C:\Windows\System\nwvaWFD.exe
  C:\Windows\System\nwvaWFD.exe
  2⤵
  PID:6940
- C:\Windows\System\nXSEgBQ.exe
  C:\Windows\System\nXSEgBQ.exe
  2⤵
  PID:6956
- C:\Windows\System\oiyNUBh.exe
  C:\Windows\System\oiyNUBh.exe
  2⤵
  PID:6972
- C:\Windows\System\gwQIoyV.exe
  C:\Windows\System\gwQIoyV.exe
  2⤵
  PID:6988
- C:\Windows\System\HosTLXw.exe
  C:\Windows\System\HosTLXw.exe
  2⤵
  PID:7004
- C:\Windows\System\oiLJGXf.exe
  C:\Windows\System\oiLJGXf.exe
  2⤵
  PID:7136
- C:\Windows\System\itTVEfw.exe
  C:\Windows\System\itTVEfw.exe
  2⤵
  PID:7152
- C:\Windows\System\PPpaQTh.exe
  C:\Windows\System\PPpaQTh.exe
  2⤵
  PID:6080
- C:\Windows\System\ABssGMn.exe
  C:\Windows\System\ABssGMn.exe
  2⤵
  PID:5028
- C:\Windows\System\riXtgXQ.exe
  C:\Windows\System\riXtgXQ.exe
  2⤵
  PID:6228
- C:\Windows\System\KKCwROC.exe
  C:\Windows\System\KKCwROC.exe
  2⤵
  PID:6148
- C:\Windows\System\TLJVNUa.exe
  C:\Windows\System\TLJVNUa.exe
  2⤵
  PID:6328
- C:\Windows\System\hzzLcTf.exe
  C:\Windows\System\hzzLcTf.exe
  2⤵
  PID:6356
- C:\Windows\System\ncpYsXd.exe
  C:\Windows\System\ncpYsXd.exe
  2⤵
  PID:6420
- C:\Windows\System\feEwmgN.exe
  C:\Windows\System\feEwmgN.exe
  2⤵
  PID:6456
- C:\Windows\System\QEEaMLu.exe
  C:\Windows\System\QEEaMLu.exe
  2⤵
  PID:6184
- C:\Windows\System\lOTbUpJ.exe
  C:\Windows\System\lOTbUpJ.exe
  2⤵
  PID:6244
- C:\Windows\System\WOnwrHq.exe
  C:\Windows\System\WOnwrHq.exe
  2⤵
  PID:6436
- C:\Windows\System\cGvgJZy.exe
  C:\Windows\System\cGvgJZy.exe
  2⤵
  PID:6488
- C:\Windows\System\OUgpRYF.exe
  C:\Windows\System\OUgpRYF.exe
  2⤵
  PID:6340
- C:\Windows\System\PmSsrRT.exe
  C:\Windows\System\PmSsrRT.exe
  2⤵
  PID:6548
- C:\Windows\System\BQbgeRs.exe
  C:\Windows\System\BQbgeRs.exe
  2⤵
  PID:6532
- C:\Windows\System\LgxXnpV.exe
  C:\Windows\System\LgxXnpV.exe
  2⤵
  PID:6616
- C:\Windows\System\CYnsDwO.exe
  C:\Windows\System\CYnsDwO.exe
  2⤵
  PID:6504
- C:\Windows\System\USSJQDs.exe
  C:\Windows\System\USSJQDs.exe
  2⤵
  PID:6660
- C:\Windows\System\vLDesfH.exe
  C:\Windows\System\vLDesfH.exe
  2⤵
  PID:6740
- C:\Windows\System\YUtBTfv.exe
  C:\Windows\System\YUtBTfv.exe
  2⤵
  PID:6696
- C:\Windows\System\XWbvfBX.exe
  C:\Windows\System\XWbvfBX.exe
  2⤵
  PID:6808
- C:\Windows\System\CauDKIB.exe
  C:\Windows\System\CauDKIB.exe
  2⤵
  PID:6872
- C:\Windows\System\NLOtcbh.exe
  C:\Windows\System\NLOtcbh.exe
  2⤵
  PID:6936
- C:\Windows\System\RBamWWX.exe
  C:\Windows\System\RBamWWX.exe
  2⤵
  PID:6728
- C:\Windows\System\kkxwiOv.exe
  C:\Windows\System\kkxwiOv.exe
  2⤵
  PID:6888
- C:\Windows\System\BeEtpjk.exe
  C:\Windows\System\BeEtpjk.exe
  2⤵
  PID:6820
- C:\Windows\System\hDjgHmu.exe
  C:\Windows\System\hDjgHmu.exe
  2⤵
  PID:6824
- C:\Windows\System\YvYAyKo.exe
  C:\Windows\System\YvYAyKo.exe
  2⤵
  PID:6996
- C:\Windows\System\ZTzhdjQ.exe
  C:\Windows\System\ZTzhdjQ.exe
  2⤵
  PID:7148
- C:\Windows\System\EWRhgbj.exe
  C:\Windows\System\EWRhgbj.exe
  2⤵
  PID:7044
- C:\Windows\System\DmtAtxu.exe
  C:\Windows\System\DmtAtxu.exe
  2⤵
  PID:7076
- C:\Windows\System\VFZRZza.exe
  C:\Windows\System\VFZRZza.exe
  2⤵
  PID:7024
- C:\Windows\System\dVvHdmF.exe
  C:\Windows\System\dVvHdmF.exe
  2⤵
  PID:7032
- C:\Windows\System\caGMPGh.exe
  C:\Windows\System\caGMPGh.exe
  2⤵
  PID:6216
- C:\Windows\System\frmKZCw.exe
  C:\Windows\System\frmKZCw.exe
  2⤵
  PID:6404
- C:\Windows\System\OhHGdIT.exe
  C:\Windows\System\OhHGdIT.exe
  2⤵
  PID:6516
- C:\Windows\System\uFBbKeT.exe
  C:\Windows\System\uFBbKeT.exe
  2⤵
  PID:7068
- C:\Windows\System\xVNXaul.exe
  C:\Windows\System\xVNXaul.exe
  2⤵
  PID:6200
- C:\Windows\System\fBQylNb.exe
  C:\Windows\System\fBQylNb.exe
  2⤵
  PID:7096
- C:\Windows\System\RrxLSit.exe
  C:\Windows\System\RrxLSit.exe
  2⤵
  PID:7120
- C:\Windows\System\zsMTaif.exe
  C:\Windows\System\zsMTaif.exe
  2⤵
  PID:6324
- C:\Windows\System\fbBEyAV.exe
  C:\Windows\System\fbBEyAV.exe
  2⤵
  PID:7164
- C:\Windows\System\bGoRjak.exe
  C:\Windows\System\bGoRjak.exe
  2⤵
  PID:6296
- C:\Windows\System\jBAcBWF.exe
  C:\Windows\System\jBAcBWF.exe
  2⤵
  PID:6392
- C:\Windows\System\ZwRUPEd.exe
  C:\Windows\System\ZwRUPEd.exe
  2⤵
  PID:6312
- C:\Windows\System\jOKmXNa.exe
  C:\Windows\System\jOKmXNa.exe
  2⤵
  PID:6632
- C:\Windows\System\ixlfULI.exe
  C:\Windows\System\ixlfULI.exe
  2⤵
  PID:6968
- C:\Windows\System\RJcmkAF.exe
  C:\Windows\System\RJcmkAF.exe
  2⤵
  PID:6980
- C:\Windows\System\pLMovaS.exe
  C:\Windows\System\pLMovaS.exe
  2⤵
  PID:6708
- C:\Windows\System\UqgEIhn.exe
  C:\Windows\System\UqgEIhn.exe
  2⤵
  PID:6264
- C:\Windows\System\QjvYwIu.exe
  C:\Windows\System\QjvYwIu.exe
  2⤵
  PID:6596
- C:\Windows\System\BYHeXlx.exe
  C:\Windows\System\BYHeXlx.exe
  2⤵
  PID:6932
- C:\Windows\System\MRiiCVJ.exe
  C:\Windows\System\MRiiCVJ.exe
  2⤵
  PID:6984
- C:\Windows\System\GtqKIOQ.exe
  C:\Windows\System\GtqKIOQ.exe
  2⤵
  PID:7064
- C:\Windows\System\JWAkhud.exe
  C:\Windows\System\JWAkhud.exe
  2⤵
  PID:7108
- C:\Windows\System\RAynQYh.exe
  C:\Windows\System\RAynQYh.exe
  2⤵
  PID:7160
- C:\Windows\System\RFWyWQD.exe
  C:\Windows\System\RFWyWQD.exe
  2⤵
  PID:6280
- C:\Windows\System\wmiNZjI.exe
  C:\Windows\System\wmiNZjI.exe
  2⤵
  PID:6916
- C:\Windows\System\vdvcUSs.exe
  C:\Windows\System\vdvcUSs.exe
  2⤵
  PID:7020
- C:\Windows\System\FnjIXqZ.exe
  C:\Windows\System\FnjIXqZ.exe
  2⤵
  PID:6164
- C:\Windows\System\IlRwWkO.exe
  C:\Windows\System\IlRwWkO.exe
  2⤵
  PID:5316
- C:\Windows\System\gVUEjcu.exe
  C:\Windows\System\gVUEjcu.exe
  2⤵
  PID:6644
- C:\Windows\System\LvxNWhu.exe
  C:\Windows\System\LvxNWhu.exe
  2⤵
  PID:6568
- C:\Windows\System\mqUUsIz.exe
  C:\Windows\System\mqUUsIz.exe
  2⤵
  PID:7184
- C:\Windows\System\NaHOqAG.exe
  C:\Windows\System\NaHOqAG.exe
  2⤵
  PID:7200
- C:\Windows\System\MpVLLvv.exe
  C:\Windows\System\MpVLLvv.exe
  2⤵
  PID:7216
- C:\Windows\System\rVKMkDc.exe
  C:\Windows\System\rVKMkDc.exe
  2⤵
  PID:7232
- C:\Windows\System\oBYmULN.exe
  C:\Windows\System\oBYmULN.exe
  2⤵
  PID:7248
- C:\Windows\System\UJVEVtI.exe
  C:\Windows\System\UJVEVtI.exe
  2⤵
  PID:7264
- C:\Windows\System\ydNtIvp.exe
  C:\Windows\System\ydNtIvp.exe
  2⤵
  PID:7280
- C:\Windows\System\EqNWhEf.exe
  C:\Windows\System\EqNWhEf.exe
  2⤵
  PID:7296
- C:\Windows\System\PggbKcg.exe
  C:\Windows\System\PggbKcg.exe
  2⤵
  PID:7312
- C:\Windows\System\vyAFBYr.exe
  C:\Windows\System\vyAFBYr.exe
  2⤵
  PID:7328
- C:\Windows\System\lyOmcia.exe
  C:\Windows\System\lyOmcia.exe
  2⤵
  PID:7348
- C:\Windows\System\xbxYdLZ.exe
  C:\Windows\System\xbxYdLZ.exe
  2⤵
  PID:7364
- C:\Windows\System\StbqvIQ.exe
  C:\Windows\System\StbqvIQ.exe
  2⤵
  PID:7380
- C:\Windows\System\ImRzjYt.exe
  C:\Windows\System\ImRzjYt.exe
  2⤵
  PID:7396
- C:\Windows\System\ghaMjZv.exe
  C:\Windows\System\ghaMjZv.exe
  2⤵
  PID:7412
- C:\Windows\System\ktESUYz.exe
  C:\Windows\System\ktESUYz.exe
  2⤵
  PID:7432
- C:\Windows\System\UWZNfDO.exe
  C:\Windows\System\UWZNfDO.exe
  2⤵
  PID:7452
- C:\Windows\System\SuRZdsy.exe
  C:\Windows\System\SuRZdsy.exe
  2⤵
  PID:7468
- C:\Windows\System\ZVZIQBR.exe
  C:\Windows\System\ZVZIQBR.exe
  2⤵
  PID:7484
- C:\Windows\System\pLfXcte.exe
  C:\Windows\System\pLfXcte.exe
  2⤵
  PID:7500
- C:\Windows\System\igSMUiO.exe
  C:\Windows\System\igSMUiO.exe
  2⤵
  PID:7516
- C:\Windows\System\COgxJJA.exe
  C:\Windows\System\COgxJJA.exe
  2⤵
  PID:7532
- C:\Windows\System\pDMRbEq.exe
  C:\Windows\System\pDMRbEq.exe
  2⤵
  PID:7548
- C:\Windows\System\sAXfKoX.exe
  C:\Windows\System\sAXfKoX.exe
  2⤵
  PID:7564
- C:\Windows\System\ZZkZoxE.exe
  C:\Windows\System\ZZkZoxE.exe
  2⤵
  PID:7580
- C:\Windows\System\WNiZpPL.exe
  C:\Windows\System\WNiZpPL.exe
  2⤵
  PID:7596
- C:\Windows\System\eKTFpBX.exe
  C:\Windows\System\eKTFpBX.exe
  2⤵
  PID:7620
- C:\Windows\System\FfxZcPH.exe
  C:\Windows\System\FfxZcPH.exe
  2⤵
  PID:7636
- C:\Windows\System\RFtjtSl.exe
  C:\Windows\System\RFtjtSl.exe
  2⤵
  PID:7652
- C:\Windows\System\sYvMinV.exe
  C:\Windows\System\sYvMinV.exe
  2⤵
  PID:7668
- C:\Windows\System\ThxSkbC.exe
  C:\Windows\System\ThxSkbC.exe
  2⤵
  PID:7684
- C:\Windows\System\YGpuPHY.exe
  C:\Windows\System\YGpuPHY.exe
  2⤵
  PID:7700
- C:\Windows\System\JITGPED.exe
  C:\Windows\System\JITGPED.exe
  2⤵
  PID:7716
- C:\Windows\System\FkyZZkV.exe
  C:\Windows\System\FkyZZkV.exe
  2⤵
  PID:7732
- C:\Windows\System\LSGeoaW.exe
  C:\Windows\System\LSGeoaW.exe
  2⤵
  PID:7748
- C:\Windows\System\SOFUAfE.exe
  C:\Windows\System\SOFUAfE.exe
  2⤵
  PID:7764
- C:\Windows\System\SjYJWBh.exe
  C:\Windows\System\SjYJWBh.exe
  2⤵
  PID:7780
- C:\Windows\System\jxabcCL.exe
  C:\Windows\System\jxabcCL.exe
  2⤵
  PID:7796
- C:\Windows\System\wGpTNHa.exe
  C:\Windows\System\wGpTNHa.exe
  2⤵
  PID:7812
- C:\Windows\System\rTszyAn.exe
  C:\Windows\System\rTszyAn.exe
  2⤵
  PID:7828
- C:\Windows\System\rYTEBnd.exe
  C:\Windows\System\rYTEBnd.exe
  2⤵
  PID:7844
- C:\Windows\System\RSgjhVd.exe
  C:\Windows\System\RSgjhVd.exe
  2⤵
  PID:7864
- C:\Windows\System\ENiMIgM.exe
  C:\Windows\System\ENiMIgM.exe
  2⤵
  PID:7880
- C:\Windows\System\HlbZHOS.exe
  C:\Windows\System\HlbZHOS.exe
  2⤵
  PID:7896
- C:\Windows\System\hFoZwcv.exe
  C:\Windows\System\hFoZwcv.exe
  2⤵
  PID:7912
- C:\Windows\System\fPiptip.exe
  C:\Windows\System\fPiptip.exe
  2⤵
  PID:7928
- C:\Windows\System\natSznr.exe
  C:\Windows\System\natSznr.exe
  2⤵
  PID:7944
- C:\Windows\System\qljXhSi.exe
  C:\Windows\System\qljXhSi.exe
  2⤵
  PID:7960
- C:\Windows\System\DlRQhmQ.exe
  C:\Windows\System\DlRQhmQ.exe
  2⤵
  PID:7976
- C:\Windows\System\aoQXsqp.exe
  C:\Windows\System\aoQXsqp.exe
  2⤵
  PID:7992
- C:\Windows\System\MBanjJl.exe
  C:\Windows\System\MBanjJl.exe
  2⤵
  PID:8008
- C:\Windows\System\wvnQYHN.exe
  C:\Windows\System\wvnQYHN.exe
  2⤵
  PID:8024
- C:\Windows\System\pfuXfHI.exe
  C:\Windows\System\pfuXfHI.exe
  2⤵
  PID:8040
- C:\Windows\System\ZTVdGxt.exe
  C:\Windows\System\ZTVdGxt.exe
  2⤵
  PID:8056
- C:\Windows\System\iVHaLin.exe
  C:\Windows\System\iVHaLin.exe
  2⤵
  PID:8072
- C:\Windows\System\MUeeHFf.exe
  C:\Windows\System\MUeeHFf.exe
  2⤵
  PID:8088
- C:\Windows\System\EFPVuxm.exe
  C:\Windows\System\EFPVuxm.exe
  2⤵
  PID:8104
- C:\Windows\System\mzTGesk.exe
  C:\Windows\System\mzTGesk.exe
  2⤵
  PID:8120
- C:\Windows\System\jUCKKIZ.exe
  C:\Windows\System\jUCKKIZ.exe
  2⤵
  PID:8136
- C:\Windows\System\klKCMzQ.exe
  C:\Windows\System\klKCMzQ.exe
  2⤵
  PID:8152
- C:\Windows\System\eacuLMT.exe
  C:\Windows\System\eacuLMT.exe
  2⤵
  PID:8168
- C:\Windows\System\WPcRSaH.exe
  C:\Windows\System\WPcRSaH.exe
  2⤵
  PID:8184
- C:\Windows\System\nxARwbj.exe
  C:\Windows\System\nxARwbj.exe
  2⤵
  PID:7208
- C:\Windows\System\tjUhUwH.exe
  C:\Windows\System\tjUhUwH.exe
  2⤵
  PID:6580
- C:\Windows\System\PsauDoC.exe
  C:\Windows\System\PsauDoC.exe
  2⤵
  PID:7052
- C:\Windows\System\awFHMSK.exe
  C:\Windows\System\awFHMSK.exe
  2⤵
  PID:6196
- C:\Windows\System\utYMbkg.exe
  C:\Windows\System\utYMbkg.exe
  2⤵
  PID:6760
- C:\Windows\System\YJEwOSE.exe
  C:\Windows\System\YJEwOSE.exe
  2⤵
  PID:7224
- C:\Windows\System\VKTzEaa.exe
  C:\Windows\System\VKTzEaa.exe
  2⤵
  PID:7080
- C:\Windows\System\FzfERZl.exe
  C:\Windows\System\FzfERZl.exe
  2⤵
  PID:7196
- C:\Windows\System\XtgzaZJ.exe
  C:\Windows\System\XtgzaZJ.exe
  2⤵
  PID:7272
- C:\Windows\System\PuRXuxX.exe
  C:\Windows\System\PuRXuxX.exe
  2⤵
  PID:7336
- C:\Windows\System\FpSfwTo.exe
  C:\Windows\System\FpSfwTo.exe
  2⤵
  PID:7404
- C:\Windows\System\dCwIECB.exe
  C:\Windows\System\dCwIECB.exe
  2⤵
  PID:7440
- C:\Windows\System\rzAWbyn.exe
  C:\Windows\System\rzAWbyn.exe
  2⤵
  PID:7324
- C:\Windows\System\GUxNeqh.exe
  C:\Windows\System\GUxNeqh.exe
  2⤵
  PID:7420
- C:\Windows\System\UyrHmUL.exe
  C:\Windows\System\UyrHmUL.exe
  2⤵
  PID:7508
- C:\Windows\System\oVBLcvR.exe
  C:\Windows\System\oVBLcvR.exe
  2⤵
  PID:7572
- C:\Windows\System\smhcbRV.exe
  C:\Windows\System\smhcbRV.exe
  2⤵
  PID:7476
- C:\Windows\System\bpgwcck.exe
  C:\Windows\System\bpgwcck.exe
  2⤵
  PID:7644
- C:\Windows\System\fjQUaYn.exe
  C:\Windows\System\fjQUaYn.exe
  2⤵
  PID:7496
- C:\Windows\System\lnrZANY.exe
  C:\Windows\System\lnrZANY.exe
  2⤵
  PID:7524
- C:\Windows\System\vFXGvRf.exe
  C:\Windows\System\vFXGvRf.exe
  2⤵
  PID:7588
- C:\Windows\System\tECGPae.exe
  C:\Windows\System\tECGPae.exe
  2⤵
  PID:7664
- C:\Windows\System\XmXHGNg.exe
  C:\Windows\System\XmXHGNg.exe
  2⤵
  PID:7740
- C:\Windows\System\XisBqwq.exe
  C:\Windows\System\XisBqwq.exe
  2⤵
  PID:7728
- C:\Windows\System\jiDnIQk.exe
  C:\Windows\System\jiDnIQk.exe
  2⤵
  PID:7760
- C:\Windows\System\qzBdtqX.exe
  C:\Windows\System\qzBdtqX.exe
  2⤵
  PID:7788
- C:\Windows\System\qacpxMY.exe
  C:\Windows\System\qacpxMY.exe
  2⤵
  PID:7904
- C:\Windows\System\XNCFJKB.exe
  C:\Windows\System\XNCFJKB.exe
  2⤵
  PID:7940
- C:\Windows\System\FfhacVa.exe
  C:\Windows\System\FfhacVa.exe
  2⤵
  PID:7920
- C:\Windows\System\vJZTFeJ.exe
  C:\Windows\System\vJZTFeJ.exe
  2⤵
  PID:7892
- C:\Windows\System\NqWVlOg.exe
  C:\Windows\System\NqWVlOg.exe
  2⤵
  PID:8004
- C:\Windows\System\YahsqJa.exe
  C:\Windows\System\YahsqJa.exe
  2⤵
  PID:7988
- C:\Windows\System\SqJiCkw.exe
  C:\Windows\System\SqJiCkw.exe
  2⤵
  PID:8068
- C:\Windows\System\kNJzTyX.exe
  C:\Windows\System\kNJzTyX.exe
  2⤵
  PID:8128
- C:\Windows\System\bgiUQrV.exe
  C:\Windows\System\bgiUQrV.exe
  2⤵
  PID:8116
- C:\Windows\System\AaXEfuU.exe
  C:\Windows\System\AaXEfuU.exe
  2⤵
  PID:8160
- C:\Windows\System\oWQGoYy.exe
  C:\Windows\System\oWQGoYy.exe
  2⤵
  PID:7180
- C:\Windows\System\BSqAGks.exe
  C:\Windows\System\BSqAGks.exe
  2⤵
  PID:7124
- C:\Windows\System\hchgVwx.exe
  C:\Windows\System\hchgVwx.exe
  2⤵
  PID:6372
- C:\Windows\System\RKVsCJe.exe
  C:\Windows\System\RKVsCJe.exe
  2⤵
  PID:5664
- C:\Windows\System\KaeLFwF.exe
  C:\Windows\System\KaeLFwF.exe
  2⤵
  PID:7376
- C:\Windows\System\CNtIxDY.exe
  C:\Windows\System\CNtIxDY.exe
  2⤵
  PID:7612
- C:\Windows\System\rTkgXPJ.exe
  C:\Windows\System\rTkgXPJ.exe
  2⤵
  PID:7556
- C:\Windows\System\LYEeMCE.exe
  C:\Windows\System\LYEeMCE.exe
  2⤵
  PID:7696
- C:\Windows\System\WkBBtDL.exe
  C:\Windows\System\WkBBtDL.exe
  2⤵
  PID:7808
- C:\Windows\System\TBZHaAc.exe
  C:\Windows\System\TBZHaAc.exe
  2⤵
  PID:7876
- C:\Windows\System\WPgLPik.exe
  C:\Windows\System\WPgLPik.exe
  2⤵
  PID:7924
- C:\Windows\System\FyJcqKl.exe
  C:\Windows\System\FyJcqKl.exe
  2⤵
  PID:7308
- C:\Windows\System\btkVYWK.exe
  C:\Windows\System\btkVYWK.exe
  2⤵
  PID:7544
- C:\Windows\System\SlaOMKy.exe
  C:\Windows\System\SlaOMKy.exe
  2⤵
  PID:8016
- C:\Windows\System\KxwkayE.exe
  C:\Windows\System\KxwkayE.exe
  2⤵
  PID:7628
- C:\Windows\System\DQYhOTO.exe
  C:\Windows\System\DQYhOTO.exe
  2⤵
  PID:7392
- C:\Windows\System\YcfjOLD.exe
  C:\Windows\System\YcfjOLD.exe
  2⤵
  PID:7952
- C:\Windows\System\qssODJY.exe
  C:\Windows\System\qssODJY.exe
  2⤵
  PID:8036
- C:\Windows\System\TJVQXfc.exe
  C:\Windows\System\TJVQXfc.exe
  2⤵
  PID:8144
- C:\Windows\System\eJGVBas.exe
  C:\Windows\System\eJGVBas.exe
  2⤵
  PID:6308
- C:\Windows\System\SfTKTCN.exe
  C:\Windows\System\SfTKTCN.exe
  2⤵
  PID:7344
- C:\Windows\System\OFLIHVw.exe
  C:\Windows\System\OFLIHVw.exe
  2⤵
  PID:7444
- C:\Windows\System\EuXNuxf.exe
  C:\Windows\System\EuXNuxf.exe
  2⤵
  PID:7660
- C:\Windows\System\TEMuGcv.exe
  C:\Windows\System\TEMuGcv.exe
  2⤵
  PID:8000
- C:\Windows\System\aPMMDDG.exe
  C:\Windows\System\aPMMDDG.exe
  2⤵
  PID:8020
- C:\Windows\System\aADtaqA.exe
  C:\Windows\System\aADtaqA.exe
  2⤵
  PID:8052
- C:\Windows\System\SgNkMzT.exe
  C:\Windows\System\SgNkMzT.exe
  2⤵
  PID:7680
- C:\Windows\System\IuOkSFE.exe
  C:\Windows\System\IuOkSFE.exe
  2⤵
  PID:7388
- C:\Windows\System\tbNRGKN.exe
  C:\Windows\System\tbNRGKN.exe
  2⤵
  PID:8208
- C:\Windows\System\ftOQqDK.exe
  C:\Windows\System\ftOQqDK.exe
  2⤵
  PID:8224
- C:\Windows\System\WuHFBjG.exe
  C:\Windows\System\WuHFBjG.exe
  2⤵
  PID:8240
- C:\Windows\System\jhjXpQk.exe
  C:\Windows\System\jhjXpQk.exe
  2⤵
  PID:8256
- C:\Windows\System\dOVbWDB.exe
  C:\Windows\System\dOVbWDB.exe
  2⤵
  PID:8272
- C:\Windows\System\eJcXYEM.exe
  C:\Windows\System\eJcXYEM.exe
  2⤵
  PID:8288
- C:\Windows\System\uXGoRgJ.exe
  C:\Windows\System\uXGoRgJ.exe
  2⤵
  PID:8304
- C:\Windows\System\cuoSDre.exe
  C:\Windows\System\cuoSDre.exe
  2⤵
  PID:8320
- C:\Windows\System\iUepIin.exe
  C:\Windows\System\iUepIin.exe
  2⤵
  PID:8336
- C:\Windows\System\uAiTpPF.exe
  C:\Windows\System\uAiTpPF.exe
  2⤵
  PID:8352
- C:\Windows\System\XUuJxQU.exe
  C:\Windows\System\XUuJxQU.exe
  2⤵
  PID:8368
- C:\Windows\System\LFcfEUS.exe
  C:\Windows\System\LFcfEUS.exe
  2⤵
  PID:8384
- C:\Windows\System\OcIkWQc.exe
  C:\Windows\System\OcIkWQc.exe
  2⤵
  PID:8400
- C:\Windows\System\jmoHuEZ.exe
  C:\Windows\System\jmoHuEZ.exe
  2⤵
  PID:8416
- C:\Windows\System\wuTcvBp.exe
  C:\Windows\System\wuTcvBp.exe
  2⤵
  PID:8432
- C:\Windows\System\NFCApMR.exe
  C:\Windows\System\NFCApMR.exe
  2⤵
  PID:8448
- C:\Windows\System\faUzkOV.exe
  C:\Windows\System\faUzkOV.exe
  2⤵
  PID:8464
- C:\Windows\System\IsstVcY.exe
  C:\Windows\System\IsstVcY.exe
  2⤵
  PID:8480
- C:\Windows\System\mOQwkrp.exe
  C:\Windows\System\mOQwkrp.exe
  2⤵
  PID:8496
- C:\Windows\System\oqFJcms.exe
  C:\Windows\System\oqFJcms.exe
  2⤵
  PID:8512
- C:\Windows\System\GBKdlpZ.exe
  C:\Windows\System\GBKdlpZ.exe
  2⤵
  PID:8528
- C:\Windows\System\ldSriRh.exe
  C:\Windows\System\ldSriRh.exe
  2⤵
  PID:8544
- C:\Windows\System\jbcixVQ.exe
  C:\Windows\System\jbcixVQ.exe
  2⤵
  PID:8560
- C:\Windows\System\dzKivFD.exe
  C:\Windows\System\dzKivFD.exe
  2⤵
  PID:8576
- C:\Windows\System\ELdBDRV.exe
  C:\Windows\System\ELdBDRV.exe
  2⤵
  PID:8592
- C:\Windows\System\zKCipEB.exe
  C:\Windows\System\zKCipEB.exe
  2⤵
  PID:8608
- C:\Windows\System\FUispkJ.exe
  C:\Windows\System\FUispkJ.exe
  2⤵
  PID:8624
- C:\Windows\System\bIDBWQy.exe
  C:\Windows\System\bIDBWQy.exe
  2⤵
  PID:8640
- C:\Windows\System\pFEhGDp.exe
  C:\Windows\System\pFEhGDp.exe
  2⤵
  PID:8656
- C:\Windows\System\GTbLSUf.exe
  C:\Windows\System\GTbLSUf.exe
  2⤵
  PID:8672
- C:\Windows\System\ddEXbet.exe
  C:\Windows\System\ddEXbet.exe
  2⤵
  PID:8688
- C:\Windows\System\idVuVaA.exe
  C:\Windows\System\idVuVaA.exe
  2⤵
  PID:8704
- C:\Windows\System\QyyedZT.exe
  C:\Windows\System\QyyedZT.exe
  2⤵
  PID:8720
- C:\Windows\System\biWQEWl.exe
  C:\Windows\System\biWQEWl.exe
  2⤵
  PID:8736
- C:\Windows\System\iBwkTJW.exe
  C:\Windows\System\iBwkTJW.exe
  2⤵
  PID:8752
- C:\Windows\System\iSLWCEV.exe
  C:\Windows\System\iSLWCEV.exe
  2⤵
  PID:8768
- C:\Windows\System\lvUAulb.exe
  C:\Windows\System\lvUAulb.exe
  2⤵
  PID:8784
- C:\Windows\System\yOZJoSp.exe
  C:\Windows\System\yOZJoSp.exe
  2⤵
  PID:8800
- C:\Windows\System\jPSPMjv.exe
  C:\Windows\System\jPSPMjv.exe
  2⤵
  PID:8816
- C:\Windows\System\wrPmqHZ.exe
  C:\Windows\System\wrPmqHZ.exe
  2⤵
  PID:8832
- C:\Windows\System\XYmSaPS.exe
  C:\Windows\System\XYmSaPS.exe
  2⤵
  PID:8848
- C:\Windows\System\lNpcAIX.exe
  C:\Windows\System\lNpcAIX.exe
  2⤵
  PID:8864
- C:\Windows\System\AOXIUOt.exe
  C:\Windows\System\AOXIUOt.exe
  2⤵
  PID:8880
- C:\Windows\System\kEjNFKy.exe
  C:\Windows\System\kEjNFKy.exe
  2⤵
  PID:8896
- C:\Windows\System\OziPNgG.exe
  C:\Windows\System\OziPNgG.exe
  2⤵
  PID:8912
- C:\Windows\System\eFcusBy.exe
  C:\Windows\System\eFcusBy.exe
  2⤵
  PID:8928
- C:\Windows\System\qgpAQtb.exe
  C:\Windows\System\qgpAQtb.exe
  2⤵
  PID:8944
- C:\Windows\System\VKhMVFJ.exe
  C:\Windows\System\VKhMVFJ.exe
  2⤵
  PID:8960
- C:\Windows\System\mCgwOWf.exe
  C:\Windows\System\mCgwOWf.exe
  2⤵
  PID:8976
- C:\Windows\System\BPApzrV.exe
  C:\Windows\System\BPApzrV.exe
  2⤵
  PID:8992
- C:\Windows\System\zKWxtUL.exe
  C:\Windows\System\zKWxtUL.exe
  2⤵
  PID:9008
- C:\Windows\System\brYzIZW.exe
  C:\Windows\System\brYzIZW.exe
  2⤵
  PID:9024
- C:\Windows\System\SJZhvXt.exe
  C:\Windows\System\SJZhvXt.exe
  2⤵
  PID:9040
- C:\Windows\System\ROkNhlX.exe
  C:\Windows\System\ROkNhlX.exe
  2⤵
  PID:9056
- C:\Windows\System\VJkldbT.exe
  C:\Windows\System\VJkldbT.exe
  2⤵
  PID:9076
- C:\Windows\System\UZMnjzz.exe
  C:\Windows\System\UZMnjzz.exe
  2⤵
  PID:9092
- C:\Windows\System\xAcFBEB.exe
  C:\Windows\System\xAcFBEB.exe
  2⤵
  PID:9108
- C:\Windows\System\zVVxwyr.exe
  C:\Windows\System\zVVxwyr.exe
  2⤵
  PID:9124
- C:\Windows\System\BswqyLI.exe
  C:\Windows\System\BswqyLI.exe
  2⤵
  PID:9140
- C:\Windows\System\akBBoZM.exe
  C:\Windows\System\akBBoZM.exe
  2⤵
  PID:9156
- C:\Windows\System\TjlkfBz.exe
  C:\Windows\System\TjlkfBz.exe
  2⤵
  PID:9172
- C:\Windows\System\yRyOUPo.exe
  C:\Windows\System\yRyOUPo.exe
  2⤵
  PID:9188
- C:\Windows\System\VxyquCS.exe
  C:\Windows\System\VxyquCS.exe
  2⤵
  PID:9204
- C:\Windows\System\UFFhcAh.exe
  C:\Windows\System\UFFhcAh.exe
  2⤵
  PID:8204
- C:\Windows\System\zUBZmhi.exe
  C:\Windows\System\zUBZmhi.exe
  2⤵
  PID:8268
- C:\Windows\System\TZhzuXn.exe
  C:\Windows\System\TZhzuXn.exe
  2⤵
  PID:8332
- C:\Windows\System\FxymrYC.exe
  C:\Windows\System\FxymrYC.exe
  2⤵
  PID:7560
- C:\Windows\System\vEFjurj.exe
  C:\Windows\System\vEFjurj.exe
  2⤵
  PID:7756
- C:\Windows\System\FHcvUiO.exe
  C:\Windows\System\FHcvUiO.exe
  2⤵
  PID:8364
- C:\Windows\System\xRbitcp.exe
  C:\Windows\System\xRbitcp.exe
  2⤵
  PID:8216
- C:\Windows\System\ptNlfoX.exe
  C:\Windows\System\ptNlfoX.exe
  2⤵
  PID:7860
- C:\Windows\System\nxGNZUA.exe
  C:\Windows\System\nxGNZUA.exe
  2⤵
  PID:8524
- C:\Windows\System\duFKoBL.exe
  C:\Windows\System\duFKoBL.exe
  2⤵
  PID:8428
- C:\Windows\System\PuTDpea.exe
  C:\Windows\System\PuTDpea.exe
  2⤵
  PID:8552
- C:\Windows\System\WjslqQI.exe
  C:\Windows\System\WjslqQI.exe
  2⤵
  PID:8588
- C:\Windows\System\vKQWtgJ.exe
  C:\Windows\System\vKQWtgJ.exe
  2⤵
  PID:8652
- C:\Windows\System\KuCDrBR.exe
  C:\Windows\System\KuCDrBR.exe
  2⤵
  PID:8316
- C:\Windows\System\iVtMmAR.exe
  C:\Windows\System\iVtMmAR.exe
  2⤵
  PID:8348
- C:\Windows\System\oooJoCV.exe
  C:\Windows\System\oooJoCV.exe
  2⤵
  PID:8744
- C:\Windows\System\TdqnIgm.exe
  C:\Windows\System\TdqnIgm.exe
  2⤵
  PID:8472
- C:\Windows\System\qJEyjoT.exe
  C:\Windows\System\qJEyjoT.exe
  2⤵
  PID:8252
- C:\Windows\System\wBVeaFF.exe
  C:\Windows\System\wBVeaFF.exe
  2⤵
  PID:8408
- C:\Windows\System\TxWGhFX.exe
  C:\Windows\System\TxWGhFX.exe
  2⤵
  PID:8504
- C:\Windows\System\pIMxugO.exe
  C:\Windows\System\pIMxugO.exe
  2⤵
  PID:8540
- C:\Windows\System\zhUKWyP.exe
  C:\Windows\System\zhUKWyP.exe
  2⤵
  PID:8600
- C:\Windows\System\KHBJUXY.exe
  C:\Windows\System\KHBJUXY.exe
  2⤵
  PID:8664
- C:\Windows\System\uKdwqCq.exe
  C:\Windows\System\uKdwqCq.exe
  2⤵
  PID:8732
- C:\Windows\System\MtiBmcB.exe
  C:\Windows\System\MtiBmcB.exe
  2⤵
  PID:8872
- C:\Windows\System\RQcifHk.exe
  C:\Windows\System\RQcifHk.exe
  2⤵
  PID:8796
- C:\Windows\System\kzkzqLV.exe
  C:\Windows\System\kzkzqLV.exe
  2⤵
  PID:8824
- C:\Windows\System\VObwFwG.exe
  C:\Windows\System\VObwFwG.exe
  2⤵
  PID:9000
- C:\Windows\System\qdUUhsA.exe
  C:\Windows\System\qdUUhsA.exe
  2⤵
  PID:9036
- C:\Windows\System\PamykpU.exe
  C:\Windows\System\PamykpU.exe
  2⤵
  PID:8924
- C:\Windows\System\CWYVhBV.exe
  C:\Windows\System\CWYVhBV.exe
  2⤵
  PID:8956
- C:\Windows\System\DjZVukx.exe
  C:\Windows\System\DjZVukx.exe
  2⤵
  PID:9048
- C:\Windows\System\oggRLaF.exe
  C:\Windows\System\oggRLaF.exe
  2⤵
  PID:9104
- C:\Windows\System\lMKWFzB.exe
  C:\Windows\System\lMKWFzB.exe
  2⤵
  PID:9120
- C:\Windows\System\RyyleeR.exe
  C:\Windows\System\RyyleeR.exe
  2⤵
  PID:9148
- C:\Windows\System\Cycuilw.exe
  C:\Windows\System\Cycuilw.exe
  2⤵
  PID:8236
- C:\Windows\System\QdjDFbw.exe
  C:\Windows\System\QdjDFbw.exe
  2⤵
  PID:9180
- C:\Windows\System\chqXghQ.exe
  C:\Windows\System\chqXghQ.exe
  2⤵
  PID:8328
- C:\Windows\System\kjKLEQt.exe
  C:\Windows\System\kjKLEQt.exe
  2⤵
  PID:7708
- C:\Windows\System\QJvFVXw.exe
  C:\Windows\System\QJvFVXw.exe
  2⤵
  PID:7360
- C:\Windows\System\ddqXVTN.exe
  C:\Windows\System\ddqXVTN.exe
  2⤵
  PID:8556
- C:\Windows\System\rNzlVxZ.exe
  C:\Windows\System\rNzlVxZ.exe
  2⤵
  PID:8712
- C:\Windows\System\ufaoJBN.exe
  C:\Windows\System\ufaoJBN.exe
  2⤵
  PID:8812
- C:\Windows\System\GZAzMvB.exe
  C:\Windows\System\GZAzMvB.exe
  2⤵
  PID:8572
- C:\Windows\System\kPYraEe.exe
  C:\Windows\System\kPYraEe.exe
  2⤵
  PID:8488
- C:\Windows\System\OHdvUpV.exe
  C:\Windows\System\OHdvUpV.exe
  2⤵
  PID:8492
- C:\Windows\System\NeWslAw.exe
  C:\Windows\System\NeWslAw.exe
  2⤵
  PID:8648
- C:\Windows\System\xAFIeck.exe
  C:\Windows\System\xAFIeck.exe
  2⤵
  PID:8380
- C:\Windows\System\NPMGhGm.exe
  C:\Windows\System\NPMGhGm.exe
  2⤵
  PID:8908
- C:\Windows\System\XqPLxiO.exe
  C:\Windows\System\XqPLxiO.exe
  2⤵
  PID:8844
- C:\Windows\System\DPDUXcR.exe
  C:\Windows\System\DPDUXcR.exe
  2⤵
  PID:7320
- C:\Windows\System\cPVgoRP.exe
  C:\Windows\System\cPVgoRP.exe
  2⤵
  PID:8764
- C:\Windows\System\GZMgxLn.exe
  C:\Windows\System\GZMgxLn.exe
  2⤵
  PID:7424
- C:\Windows\System\RKiIQOj.exe
  C:\Windows\System\RKiIQOj.exe
  2⤵
  PID:9016
- C:\Windows\System\hQuzqwH.exe
  C:\Windows\System\hQuzqwH.exe
  2⤵
  PID:9200
- C:\Windows\System\aErlssI.exe
  C:\Windows\System\aErlssI.exe
  2⤵
  PID:7984
- C:\Windows\System\ooZnYuf.exe
  C:\Windows\System\ooZnYuf.exe
  2⤵
  PID:8476
- C:\Windows\System\jfRgrii.exe
  C:\Windows\System\jfRgrii.exe
  2⤵
  PID:7192
- C:\Windows\System\HDXyVfI.exe
  C:\Windows\System\HDXyVfI.exe
  2⤵
  PID:9164
- C:\Windows\System\zDIRJwh.exe
  C:\Windows\System\zDIRJwh.exe
  2⤵
  PID:8396
- C:\Windows\System\pvOtLfA.exe
  C:\Windows\System\pvOtLfA.exe
  2⤵
  PID:8972
- C:\Windows\System\lHrauyg.exe
  C:\Windows\System\lHrauyg.exe
  2⤵
  PID:9020
- C:\Windows\System\KaLNtvk.exe
  C:\Windows\System\KaLNtvk.exe
  2⤵
  PID:8892
- C:\Windows\System\ngwMGlK.exe
  C:\Windows\System\ngwMGlK.exe
  2⤵
  PID:8568
- C:\Windows\System\lgaTmlv.exe
  C:\Windows\System\lgaTmlv.exe
  2⤵
  PID:8376
- C:\Windows\System\HMqlSFp.exe
  C:\Windows\System\HMqlSFp.exe
  2⤵
  PID:8636
- C:\Windows\System\TRrqKTO.exe
  C:\Windows\System\TRrqKTO.exe
  2⤵
  PID:8920
- C:\Windows\System\ykTgXQa.exe
  C:\Windows\System\ykTgXQa.exe
  2⤵
  PID:9196
- C:\Windows\System\ZzcikWl.exe
  C:\Windows\System\ZzcikWl.exe
  2⤵
  PID:8728
- C:\Windows\System\CJBRGuz.exe
  C:\Windows\System\CJBRGuz.exe
  2⤵
  PID:8048
- C:\Windows\System\CfTgJCh.exe
  C:\Windows\System\CfTgJCh.exe
  2⤵
  PID:9136
- C:\Windows\System\gjkZiEK.exe
  C:\Windows\System\gjkZiEK.exe
  2⤵
  PID:8748
- C:\Windows\System\gJSjakl.exe
  C:\Windows\System\gJSjakl.exe
  2⤵
  PID:8808
- C:\Windows\System\qSoXlsZ.exe
  C:\Windows\System\qSoXlsZ.exe
  2⤵
  PID:7176
- C:\Windows\System\odALGlV.exe
  C:\Windows\System\odALGlV.exe
  2⤵
  PID:9232
- C:\Windows\System\LbciCSo.exe
  C:\Windows\System\LbciCSo.exe
  2⤵
  PID:9248
- C:\Windows\System\euEQAwa.exe
  C:\Windows\System\euEQAwa.exe
  2⤵
  PID:9264
- C:\Windows\System\HoKggUS.exe
  C:\Windows\System\HoKggUS.exe
  2⤵
  PID:9280
- C:\Windows\System\WUsKAXJ.exe
  C:\Windows\System\WUsKAXJ.exe
  2⤵
  PID:9296
- C:\Windows\System\LdUlfwb.exe
  C:\Windows\System\LdUlfwb.exe
  2⤵
  PID:9312
- C:\Windows\System\XGcEDfK.exe
  C:\Windows\System\XGcEDfK.exe
  2⤵
  PID:9328
- C:\Windows\System\jmTMTSQ.exe
  C:\Windows\System\jmTMTSQ.exe
  2⤵
  PID:9352
- C:\Windows\System\AhmPRvt.exe
  C:\Windows\System\AhmPRvt.exe
  2⤵
  PID:9368
- C:\Windows\System\NQnaOlR.exe
  C:\Windows\System\NQnaOlR.exe
  2⤵
  PID:9384
- C:\Windows\System\qBmUcHr.exe
  C:\Windows\System\qBmUcHr.exe
  2⤵
  PID:9400
- C:\Windows\System\sOLMWLx.exe
  C:\Windows\System\sOLMWLx.exe
  2⤵
  PID:9416
- C:\Windows\System\VFGVoLc.exe
  C:\Windows\System\VFGVoLc.exe
  2⤵
  PID:9440
- C:\Windows\System\hJeqDvS.exe
  C:\Windows\System\hJeqDvS.exe
  2⤵
  PID:9456
- C:\Windows\System\wXMOxLe.exe
  C:\Windows\System\wXMOxLe.exe
  2⤵
  PID:9472
- C:\Windows\System\sbXDoJt.exe
  C:\Windows\System\sbXDoJt.exe
  2⤵
  PID:9488
- C:\Windows\System\caGsxSD.exe
  C:\Windows\System\caGsxSD.exe
  2⤵
  PID:9504
- C:\Windows\System\Kxmqbyk.exe
  C:\Windows\System\Kxmqbyk.exe
  2⤵
  PID:9520
- C:\Windows\System\wdpLwUw.exe
  C:\Windows\System\wdpLwUw.exe
  2⤵
  PID:9536
- C:\Windows\System\dJmsMZQ.exe
  C:\Windows\System\dJmsMZQ.exe
  2⤵
  PID:9552
- C:\Windows\System\bpOkXxs.exe
  C:\Windows\System\bpOkXxs.exe
  2⤵
  PID:9584
- C:\Windows\System\pYOGqGC.exe
  C:\Windows\System\pYOGqGC.exe
  2⤵
  PID:9600
- C:\Windows\System\sMoaBou.exe
  C:\Windows\System\sMoaBou.exe
  2⤵
  PID:9616
- C:\Windows\System\ZJnKSZl.exe
  C:\Windows\System\ZJnKSZl.exe
  2⤵
  PID:9632
- C:\Windows\System\iNHCiHo.exe
  C:\Windows\System\iNHCiHo.exe
  2⤵
  PID:9648
- C:\Windows\System\EwextJi.exe
  C:\Windows\System\EwextJi.exe
  2⤵
  PID:9664
- C:\Windows\System\ImXYGvB.exe
  C:\Windows\System\ImXYGvB.exe
  2⤵
  PID:9680
- C:\Windows\System\cgCwafZ.exe
  C:\Windows\System\cgCwafZ.exe
  2⤵
  PID:9696
- C:\Windows\System\XppsggO.exe
  C:\Windows\System\XppsggO.exe
  2⤵
  PID:9712
- C:\Windows\System\oeUrjjf.exe
  C:\Windows\System\oeUrjjf.exe
  2⤵
  PID:9728
- C:\Windows\System\qzLNAqV.exe
  C:\Windows\System\qzLNAqV.exe
  2⤵
  PID:9744
- C:\Windows\System\yRcMYxP.exe
  C:\Windows\System\yRcMYxP.exe
  2⤵
  PID:9760
- C:\Windows\System\iovYGKd.exe
  C:\Windows\System\iovYGKd.exe
  2⤵
  PID:9776
- C:\Windows\System\VlnLPWJ.exe
  C:\Windows\System\VlnLPWJ.exe
  2⤵
  PID:9792
- C:\Windows\System\rEYNVGU.exe
  C:\Windows\System\rEYNVGU.exe
  2⤵
  PID:9808
- C:\Windows\System\IICNDjh.exe
  C:\Windows\System\IICNDjh.exe
  2⤵
  PID:9824
- C:\Windows\System\xbGexHm.exe
  C:\Windows\System\xbGexHm.exe
  2⤵
  PID:9840
- C:\Windows\System\QLZgpMz.exe
  C:\Windows\System\QLZgpMz.exe
  2⤵
  PID:9856
- C:\Windows\System\nUNFXWC.exe
  C:\Windows\System\nUNFXWC.exe
  2⤵
  PID:9872
- C:\Windows\System\MlPGhqI.exe
  C:\Windows\System\MlPGhqI.exe
  2⤵
  PID:9888
- C:\Windows\System\IHNyFOk.exe
  C:\Windows\System\IHNyFOk.exe
  2⤵
  PID:9904
- C:\Windows\System\qJrMiNP.exe
  C:\Windows\System\qJrMiNP.exe
  2⤵
  PID:9920
- C:\Windows\System\MtNpeam.exe
  C:\Windows\System\MtNpeam.exe
  2⤵
  PID:9936
- C:\Windows\System\VvhWMMh.exe
  C:\Windows\System\VvhWMMh.exe
  2⤵
  PID:9952
- C:\Windows\System\CfZReOu.exe
  C:\Windows\System\CfZReOu.exe
  2⤵
  PID:9968
- C:\Windows\System\yZqZUSj.exe
  C:\Windows\System\yZqZUSj.exe
  2⤵
  PID:9984
- C:\Windows\System\xdkItjb.exe
  C:\Windows\System\xdkItjb.exe
  2⤵
  PID:10000
- C:\Windows\System\UhazboK.exe
  C:\Windows\System\UhazboK.exe
  2⤵
  PID:10016
- C:\Windows\System\KYdesJs.exe
  C:\Windows\System\KYdesJs.exe
  2⤵
  PID:10032
- C:\Windows\System\bmZGjvy.exe
  C:\Windows\System\bmZGjvy.exe
  2⤵
  PID:10048
- C:\Windows\System\ToHnjtF.exe
  C:\Windows\System\ToHnjtF.exe
  2⤵
  PID:10064
- C:\Windows\System\LwkZchu.exe
  C:\Windows\System\LwkZchu.exe
  2⤵
  PID:10080
- C:\Windows\System\gwLlQyc.exe
  C:\Windows\System\gwLlQyc.exe
  2⤵
  PID:10096
- C:\Windows\System\EWVpWFR.exe
  C:\Windows\System\EWVpWFR.exe
  2⤵
  PID:10112
- C:\Windows\System\jtSPfJw.exe
  C:\Windows\System\jtSPfJw.exe
  2⤵
  PID:10128
- C:\Windows\System\HyGEMSW.exe
  C:\Windows\System\HyGEMSW.exe
  2⤵
  PID:10144
- C:\Windows\System\aTiQkUL.exe
  C:\Windows\System\aTiQkUL.exe
  2⤵
  PID:10160
- C:\Windows\System\kwOUjnK.exe
  C:\Windows\System\kwOUjnK.exe
  2⤵
  PID:10176
- C:\Windows\System\frupcqd.exe
  C:\Windows\System\frupcqd.exe
  2⤵
  PID:10192
- C:\Windows\System\IEwRrOE.exe
  C:\Windows\System\IEwRrOE.exe
  2⤵
  PID:10208
- C:\Windows\System\jtpbwoa.exe
  C:\Windows\System\jtpbwoa.exe
  2⤵
  PID:10224
- C:\Windows\System\qvrRqIY.exe
  C:\Windows\System\qvrRqIY.exe
  2⤵
  PID:8632
- C:\Windows\System\KGdlqqj.exe
  C:\Windows\System\KGdlqqj.exe
  2⤵
  PID:9308
- C:\Windows\System\rVzIbUu.exe
  C:\Windows\System\rVzIbUu.exe
  2⤵
  PID:9336
- C:\Windows\System\cgJTstp.exe
  C:\Windows\System\cgJTstp.exe
  2⤵
  PID:9348
- C:\Windows\System\dPWNczg.exe
  C:\Windows\System\dPWNczg.exe
  2⤵
  PID:9320
- C:\Windows\System\lJsmrQx.exe
  C:\Windows\System\lJsmrQx.exe
  2⤵
  PID:9288
- C:\Windows\System\RHteImA.exe
  C:\Windows\System\RHteImA.exe
  2⤵
  PID:9408
- C:\Windows\System\fwxZWMy.exe
  C:\Windows\System\fwxZWMy.exe
  2⤵
  PID:9396
- C:\Windows\System\VZtFGmj.exe
  C:\Windows\System\VZtFGmj.exe
  2⤵
  PID:9448
- C:\Windows\System\vQYGwoz.exe
  C:\Windows\System\vQYGwoz.exe
  2⤵
  PID:9516
- C:\Windows\System\wOTDABe.exe
  C:\Windows\System\wOTDABe.exe
  2⤵
  PID:9496
- C:\Windows\System\WUSTCVD.exe
  C:\Windows\System\WUSTCVD.exe
  2⤵
  PID:9532
- C:\Windows\System\oNmvBdv.exe
  C:\Windows\System\oNmvBdv.exe
  2⤵
  PID:9576
- C:\Windows\System\yMMrEaK.exe
  C:\Windows\System\yMMrEaK.exe
  2⤵
  PID:9624
- C:\Windows\System\DMxUCqb.exe
  C:\Windows\System\DMxUCqb.exe
  2⤵
  PID:9692
- C:\Windows\System\xoBbcmH.exe
  C:\Windows\System\xoBbcmH.exe
  2⤵
  PID:9756
- C:\Windows\System\OdLMKMw.exe
  C:\Windows\System\OdLMKMw.exe
  2⤵
  PID:9848
- C:\Windows\System\RyoIjbc.exe
  C:\Windows\System\RyoIjbc.exe
  2⤵
  PID:9912
- C:\Windows\System\XUiXWAo.exe
  C:\Windows\System\XUiXWAo.exe
  2⤵
  PID:9976
- C:\Windows\System\ekEsYGj.exe
  C:\Windows\System\ekEsYGj.exe
  2⤵
  PID:9676
- C:\Windows\System\TROllrZ.exe
  C:\Windows\System\TROllrZ.exe
  2⤵
  PID:9768
- C:\Windows\System\ljHmpcH.exe
  C:\Windows\System\ljHmpcH.exe
  2⤵
  PID:10040
- C:\Windows\System\IYjwcgL.exe
  C:\Windows\System\IYjwcgL.exe
  2⤵
  PID:9640
- C:\Windows\System\pFyJpPq.exe
  C:\Windows\System\pFyJpPq.exe
  2⤵
  PID:10072
- C:\Windows\System\VjQzPkK.exe
  C:\Windows\System\VjQzPkK.exe
  2⤵
  PID:10024
- C:\Windows\System\EZjtFtY.exe
  C:\Windows\System\EZjtFtY.exe
  2⤵
  PID:9864
- C:\Windows\System\tosdEYj.exe
  C:\Windows\System\tosdEYj.exe
  2⤵
  PID:9932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\COuHCpe.exe

Filesize
2.2MB

MD5
e791c32b7e74974fc76ef6c381802764

SHA1
73c6d1dc0f004847fb1dced6318d47153463f627

SHA256
9c2acf385636d0fab38011a4e003492b75abb9f2c2b5ae2619d774141895dba1

SHA512
d3bec5aca6ada51346d31736698f099ff3bbc8f2190107dbe72d6a861143abc8b5ed05d2997cb273e273b99c13a813e872782d959269e3103b4bc258e1d3650f

Download Submit
C:\Windows\system\ChFmteO.exe

Filesize
2.2MB

MD5
2e9642929b7395087c17c81033cc927e

SHA1
e236ab174aa7253e7cca5e0a8e0b0b345f6ebf5b

SHA256
9ce4fa5931c2df1f12e7cd438de29bea5a2ab2c6999ef3fa45a0b10b25a3fdd9

SHA512
59c1013117813d723610d97ec63a3fff65a380bf122dfcb3489010730ea8c7f3bf483a80ab4727d249e8634bf940f8813decb33eb34cffe4889e77e05bc0ae40

Download Submit
C:\Windows\system\DIwyuzA.exe

Filesize
2.2MB

MD5
c2d771541e7bd921554998d0fdd0ae49

SHA1
2a9acc77034b18fe5bcecaf6cfbd7fae0122903c

SHA256
394cd73453daef7b37dc751961e2c6ba981869a6e812ded939b9fce046e5b014

SHA512
0d458ed551b4af85d7197d75db54d643d4108b0ae06b61707febaf3f34edd54bee634bae73022b5d974f9685da2a89197814710264fb14ebba363bb03d3c5ae9

Download Submit
C:\Windows\system\GmiTbbh.exe

Filesize
2.2MB

MD5
c5641577427d7d30c8d4ce5181f03af2

SHA1
a8bfc0dc1a06fe8d8f51d8e19db7e2b18ce014b2

SHA256
64914568e2b1724e42f5a8d71e08915e138bfe91eb52d4cd1bfff5ae180c2f5e

SHA512
ac4f65a9f8f80e3ab45f46f766a3ad15f2b5f36e9b343022179418b8af61a7ffd758ccc0f4a80a0ffbaeff2db10acbbf21fe081f00247335c544e3858558eb96

Download Submit
C:\Windows\system\HBdbejN.exe

Filesize
2.2MB

MD5
a4a7b631c56e42236133fffc08e624d4

SHA1
ce241c7a422597a9abd8a21f6a7654f3a4690181

SHA256
85b7882c8e25eff008c85dce651e96ee62746e29d05532b9e27eedc74d6f55cd

SHA512
36401a87e5967cf540a63fc4a0cd1ce9bceca01e13f5793430d5f40488dfc0677b1b0581058c41dab7d839b7618f711e084f3b4fcbb4ad32654b46d74cb89911

Download Submit
C:\Windows\system\SLnAiJb.exe

Filesize
2.2MB

MD5
34c479e9745515fcb372095c638df37f

SHA1
b34ad90730155fdbd54096e8058f04cd54d03dfe

SHA256
ff928a401bcde8a03be9aec08ec36e3f1b2073d88faa5c19c8965fb38d719f0c

SHA512
a02da31a8b8a9dae64fe8001c6a9bf273de95a437f8e3294ee5861b22a68032237034f293e8a2365b7e45b4889f8f60ff178d4c8f00b2d1703789e3de78af55c

Download Submit
C:\Windows\system\SdKjTLJ.exe

Filesize
2.2MB

MD5
9f615f1384c9e99d74170aaadb84fd4c

SHA1
b43bacd213707f59a509f1f1c17091a244be36a6

SHA256
9235d64c92a52e7924361cd6f5b6280acb57f97f53851239074f25ab980c1293

SHA512
749b39f2bd532fb94f39451a7ce28553e8d7c2ca7999d60c7dcc099c9041ceb007768ba1647bcf6b2f6dddee0d4b5b352e4031d738e80b1b490823ed8bcb93ee

Download Submit
C:\Windows\system\UnIHhAf.exe

Filesize
2.2MB

MD5
5ff56edf5fd1bf615b2b093d62f4cd92

SHA1
78fbbe770a563904e25d41c72d49e26e475edf8a

SHA256
152bee7baa5783c5ab58af15473762dd137c8dec8bc76e7b1aa2ce1dbc349f15

SHA512
a250ee12fdb1e94a29e7eabe1efd1a93de80c7ea851410ccad8ddea7a9ea45117777915a0b98e1cab1743f161a236bc6faa18557b58da59a6bd875df17c8adc0

Download Submit
C:\Windows\system\VxOZPDn.exe

Filesize
2.2MB

MD5
3eec4626839d6636cca541cc07c96f40

SHA1
51e4664dc4008b992389447303360927dfdee543

SHA256
f8258bf8b8974f537c2aedce72d3e8044d84f5629aa4716ac8377ba81fd60019

SHA512
6f9f583c892f292a4fe0c5fb51505dbcc821d60ae6a292988ad4c5e96b4f8d0e9cd01032df84fa7bdb04bb0fa94a6ca8cedac5cfe2b1ebc0648c95b601bdc8e0

Download Submit
C:\Windows\system\WfHtxfx.exe

Filesize
2.2MB

MD5
4ff1ff560a5d2a95a8bd24259812f87a

SHA1
432436f031dfb17a508d7225a13bc2c79c1090d3

SHA256
06628d5cd726191586475fee42a867ddc7422d796be3769f3821244ff4e9b49c

SHA512
beef12b791140118df847ebf49b5b0a419e7e7845b99c6357cdb6364c36b10126b9f300b5846c2240f7d0e7b9adf2e9a2859c294b87b6e99543dde74ef116b46

Download Submit
C:\Windows\system\XAmfgZv.exe

Filesize
2.2MB

MD5
06636993280684d3253999aae2015425

SHA1
aa99ee724099006875135edba298148474492327

SHA256
170d2549483cbb8340c5d4524ed046a2cc4e359d7546cbf67ebed1f01aa47385

SHA512
117171fd9cfb513c0ed40080702d5e09e66826354d3a82e6909b6e04028b6198a172301b8875a562cd0bb0d8f5eca3a523528ea12998a3d9c2aa4e901bf14577

Download Submit
C:\Windows\system\XUgARPa.exe

Filesize
2.2MB

MD5
eab73e6c26b219a680ba7c69200e3873

SHA1
6ca56b9ba500abe62a4b91f4202772b8e5d362c1

SHA256
ae6d72d5f9841db9ef26c8b3c9d341a29f9db0d4991c9fce40dbcb779849cf76

SHA512
547399922d0f420ab00992759bea0bc8be46ea97f5864ba0f1b58d65807402c535ead1929078be5d26b88a3af08e71cae9e578525dfe3a4cc1512442dcf4360c

Download Submit
C:\Windows\system\YclAmwy.exe

Filesize
2.2MB

MD5
7d118b210bd73981aefd0751f5bbcf85

SHA1
df2d8fecd93d3cbf939d13dc51b5ff262b240283

SHA256
ad41e9f8caa138a7f4a9aa6ef72150d61a50c3988428bf1625cdacc7ca37b9a8

SHA512
7c01d04a33adf5ca0cf20e6dc8c4e4ff3fd48bc6d85a180aefb5cd694e983f72b5cc029aebbd5749b5f27b663c3a5d1cb7cab5f45b010514fd29364282a6ef39

Download Submit
C:\Windows\system\ZgfAXYo.exe

Filesize
2.2MB

MD5
4d4aa361d7be468318eb593a0848a77d

SHA1
062253a6e02ca45630337f5c702b61b2797df3ed

SHA256
4ca7e4eb26a5cc9f886f4b1e53675bc1843d753291bcf53ed88dc69f92c26d59

SHA512
dd67dc7af5884098bd1c9630d1b8e3e2d89ba5327b96ec3bd8cd5bc6838352cf520f856e470c1aa35c0a169d6dc8030eabdb326cbaf601a8b9210954aa3a84fa

Download Submit
C:\Windows\system\dPqiwjo.exe

Filesize
2.2MB

MD5
e0a7e43994a5872900ea913a759f5610

SHA1
37629ff135070a33d438d4700b72d42f3e6fa4da

SHA256
70bec6953a1a2e544b7424490650f54e3326c4a8428a173a3bc34548706eaf32

SHA512
04800c7500fba7084d4e22b6faafb1cbcb4b4573f4b71b26539d189e6fe4d2db8308ba0f67fc987ef39bdedccd1daec3e70bf925c28be0fe8ed146ba1e46a04e

Download Submit
C:\Windows\system\dqrbXQS.exe

Filesize
2.2MB

MD5
4c112d86d260707941e7bf2508fd2cf2

SHA1
d2dc840154afa7eda804245cbe56ab5d79ed4f0c

SHA256
4f53c9d6f2d367c715ac6762de17c8c41e2ca6d1ab4e9f4af63f0bfd54cf4a3a

SHA512
12c15cdb504561efa0beb09e78d2c7681087d3ab0d428279a62418ca3ea905bdc57d1e37fef1d9fb207c963a19d1acf7556135eb91f87165524e306250a3e3b7

Download Submit
C:\Windows\system\gKKKAME.exe

Filesize
2.2MB

MD5
32c340454ddfd77c816f6a046e9cab4b

SHA1
b08b0f5604e01c8f8361ae11d399ed193a78d2b1

SHA256
6572cc9bd3cb62b9cce0821d760306ba4af81ea92f2c38cc0213f4aef47f7e4d

SHA512
d2cab249aa3e4c3e65c488cd3dcedf149752ae85fe5bb2fb1e80575e4d7f83fbd9e558d0d67d2cb0090aa59c986b8e807e4f18acc70cd638b848dfb1f2ddff46

Download Submit
C:\Windows\system\gMHlyjN.exe

Filesize
2.2MB

MD5
6bf25aecbb89c2254c8d0d15bb6aa7e5

SHA1
19ceafe0eea4f2b76acb8d922c7d6b638cc54e70

SHA256
53528d8538d89257fe3bcc0a0a5427fe87c3e2f718491fe229ee123cd269520f

SHA512
25cf0f1fa2b87fc2d7bb0a1e5c06fa7f2d23fb2a4a2241560db1ae0c142d268f2cc9bb1c3a4ecb44c26df01bf6d1fa38d0298418659b6044202252dab37d442e

Download Submit
C:\Windows\system\gljAGuj.exe

Filesize
2.2MB

MD5
a09b4cba4c9408aa80aace49fb1d6512

SHA1
03b42b8ec93ae40d77f9327995e2330c844974bc

SHA256
02fd340fc5ab33cd71789705f2f327dcc5975ff53a03e883402f0ea0c4e6684d

SHA512
a6d4eda63c1d0f1c77de2bbefce4e5d4f10243990aa81316993f6d3da4c5c13b778ebf31f0dc99a89bfb68e7614e14236acab445bfd6bbf326c2aa6f827ef06e

Download Submit
C:\Windows\system\ijcDvIm.exe

Filesize
2.2MB

MD5
1b69cbd882ba44ec94bcbab440b84c3c

SHA1
eee167c54aa9b371ba38e323bd1da11a47dfa46b

SHA256
ab519ac63406644978fef2f7df85ec3f06d9bba55d21af3d56fad587e997f3ed

SHA512
6622bc2f9b8adc18db6e23bf6d79c2a4a641cfc0aad8013511f3d6ec8379e4c0de8b0a42daffd79a1f13209338d1434aec251e3e3ef2955a21f1d646ea194964

Download Submit
C:\Windows\system\jlSbHmn.exe

Filesize
2.2MB

MD5
e119abb15a770733df1956bb97f0c561

SHA1
99e3aab7a51622ca45fe016917f1e2f5b4764adb

SHA256
1867f923e91107e9b594a97f99967485e4cd142792b1818ccf317f3de520d85c

SHA512
c1a7f1e19d2aaee03be3db7ce2c9641fe74ad316dab1baebf9d2bf6ac699b7b6bb4786dc83390d985db670aec314cb4a3a3f66db881cd515bc75b90d84f8dcb6

Download Submit
C:\Windows\system\mKoQVhj.exe

Filesize
2.2MB

MD5
a744fdea355a677e252dd22bb96cadbf

SHA1
6382bb8fabeea7992aa77c1186e7c7d06feaa5e3

SHA256
9930d9b0dfe566f8e09ad54741d926c31654c39baf53ddd021a6a5daf0e2ebb0

SHA512
d13279c595d3716e8de732355023324fd14db9fdd9e05904e8fff4f7f06fd54944bdd1646130ecc0f6f18fda554bb598b379f46397551e815f08bd49a6b31367

Download Submit
C:\Windows\system\mPyNFeH.exe

Filesize
2.2MB

MD5
a0243607e2647102175ff5d2c02e1caa

SHA1
d07e8d876ea61c79a180c566f67be52c07cb2219

SHA256
b4ed804df71774dac6a25f763c57cca85963ae563a4f8d4be58750306b5a4298

SHA512
a13a6927f3e6d96c5b652b288e67d5aee745412670026f0be2abcf77392f646f65d87062171c1069edf9ab4aae834bb883e165f5738100653bf6b9371190285b

Download Submit
C:\Windows\system\mfilWXN.exe

Filesize
2.2MB

MD5
20d4f4df8b91f8b3a34c3c0de47d272a

SHA1
519ed81120876da8a56b455bab75c20af5722855

SHA256
2441b2882a7ff00ae3f8cb9b63c76ec95dad507864c1a47e6bafa4c74149053b

SHA512
b703dc115e8cc2589c8212e16d4090e4cdfc53d22efe28364dfae1995311580e4087e8576d3885fb29571f7d2be6533c9cdf844fd7898b87daafe87b157f8982

Download Submit
C:\Windows\system\nuEVqmG.exe

Filesize
2.2MB

MD5
cd8bdb22c2172387871f22def0dae809

SHA1
87eb8936be3665744deb29dcc53fe335bf0074cd

SHA256
8f0387079f3c2ceb0a20a7f20fbca3d5663c40432bb38c4bef6bf432a22f7512

SHA512
f6a7b605583e74c06044366571fc45e7ad4699ba85b731cd3142138df3723ed11875a1c66e0199825f48f94f93d5323b554a083a3c2b6ebb9a34e3fd925a8770

Download Submit
C:\Windows\system\oJqwAzu.exe

Filesize
2.2MB

MD5
6cb291646a8c43183189404144800b9e

SHA1
4bf7125ae51e86d587bb9bfb7747199006b2b426

SHA256
eb780fd02b9b8952cb266aa22c91cdbbade0ea17e1864ff0f3bf0f7da04da4a2

SHA512
8662b3f61ca96e3d10332facb182c426230a3cc3098b679f74dc91bd7a7076fd6e688de5866ecf2ec1b9389141b6fcca206cdea4366fe4539ebe822f7a2ee530

Download Submit
C:\Windows\system\oPeGgsJ.exe

Filesize
2.2MB

MD5
8f84868d78dec67a4b970655cb2e9d9c

SHA1
81c73aa1440efe0edecdbb46b3264b3c7e3dce2f

SHA256
f15e2d3403a0fdd6df2aff849e64b7d68d345474ba00d1780dcba61b9142e2c1

SHA512
27a38ec52dd318ae188dc39f3c68daf94c97a2bc265b4df9bc962f941547b60cf32432c16af87386562d3728665dc83c281e45de211bcf2abf6afd6565584bf3

Download Submit
C:\Windows\system\rEtTeHO.exe

Filesize
2.2MB

MD5
f02b65cda3bf3a18e3214c526b0bef69

SHA1
4afa782cd6f27b4d4373d3ebc4af5c33e7f61d76

SHA256
3d8c50bc33ed132051a87c59352853a0554e13de966f87b40bc171a276e19709

SHA512
7dff366caad468caa28ba60c001011964534d77b39cc358eddcb1112b781d00d31bc40ffa084264bc5773148136826a6c6a510ca24f2d520b274b4911f3ec4ff

Download Submit
C:\Windows\system\rViOiVi.exe

Filesize
2.2MB

MD5
9b22e8120e4c394b8818d688f474b66b

SHA1
1ba2505c686092f6b9e52a27c4b5fc2f21c6df92

SHA256
bbe498d3dfe202a373be2bb8967534ac41f9ba34f4279294ba9169c55a14e4a3

SHA512
dc7a7266df76cbdaa0070b591e1a7f14248bbddba84fc41dc807575d80751d9628b57341483239b870a8fe8cfb778b1ce81df92b6c2ad8d3c013f1637cdfe281

Download Submit
C:\Windows\system\yIpQeKg.exe

Filesize
2.2MB

MD5
cc5c4d06ddbf7fcca4210991befb0708

SHA1
5e7fdc5426e4a0fa529d8006f5999027c9d6b270

SHA256
7636b932430f9b318f0af54e389167bc8a79413199bd7a7469acf8c6e580e944

SHA512
d2ff03efe21e2fd0a4a3bd97f2bde709771bfa53e615e523af35e402d215aa67f493cd2f2b7fe88164c04d209c29c4bf9b4a5ceac677873bda3903d85323ec01

Download Submit
C:\Windows\system\yUPQeFl.exe

Filesize
2.2MB

MD5
e28fc9a96bb705e196ba39c11d894a46

SHA1
ebe38fc8d4fa484d0de7eb51dd53027f80293d8d

SHA256
9df597ddb7d857dae375d1804f2e9552ca024df7b0136f75b0ad42c332581963

SHA512
96633b866e1ad4e235a1bd02e072fb18fe434d2b7d54094fe68e1eee5c41e003022ffef931eec9c7260150aa93a9b08ea06600d1a82f5998f021ac07b4a1ee90

Download Submit
C:\Windows\system\ypxGLCN.exe

Filesize
2.2MB

MD5
1470952d280c553c7841fdf79e564b65

SHA1
fe9890e50d3f62d8165c16a8aebd826c1b92b6c5

SHA256
fcb50cbc39e5f255d9b500fe440bbef6850cf03fafcce84ae84672c14152c900

SHA512
dbb440ff2b6ff8a3d2aa36a5f6080d211f28551f0fc4f0cdcf666e4e0db6ebf77473e694d7c65567c9c47902e6e373f78fba083edf481ba3db40f2c4757152c8

Download Submit
memory/1032-1293-0x000007FEF5C80000-0x000007FEF661D000-memory.dmp

Filesize
9.6MB

Download
memory/1032-156-0x0000000002CB0000-0x0000000002D30000-memory.dmp

Filesize
512KB

Download
memory/1032-155-0x000007FEF5C80000-0x000007FEF661D000-memory.dmp

Filesize
9.6MB

Download
memory/1032-211-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/1032-215-0x0000000001F70000-0x0000000001F78000-memory.dmp

Filesize
32KB

Download
memory/1256-159-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/1448-9-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/1720-162-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/1728-161-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/1728-1-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-8-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/1728-167-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/1728-165-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/1728-169-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-23-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/1728-171-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/1728-0-0x0000000000580000-0x0000000000590000-memory.dmp

Filesize
64KB

Download
memory/1728-158-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/1728-163-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2456-170-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-166-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2728-157-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2740-168-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2892-164-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2932-160-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download