xmrig | 0980540b73027658bc82e40ef9ae5eefe28242ff61719fbedccb6d64305ab73f

Analysis

max time kernel
148s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 21:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
Size

1.8MB
MD5

03a8bb4dfbb7a718f94df897656f83b5
SHA1

56d51486b76cba11baaf6504e384f843c7bc9afe
SHA256

0980540b73027658bc82e40ef9ae5eefe28242ff61719fbedccb6d64305ab73f
SHA512

2ee468efa7f9e813979bc580e3cd8b228bdd59259bfe058ef7e0627f2b4919da6b4df7ab555fc5fa94333c0808055d3f97f6e4d9f46b78b628e0696b8800e5cb
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlt:NAB8

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/memory/2656-188-0x00007FF7F85A0000-0x00007FF7F8992000-memory.dmp	xmrig
behavioral2/memory/1152-151-0x00007FF7E8B50000-0x00007FF7E8F42000-memory.dmp	xmrig
behavioral2/memory/3744-148-0x00007FF73EE30000-0x00007FF73F222000-memory.dmp	xmrig
behavioral2/memory/1928-122-0x00007FF7B8FC0000-0x00007FF7B93B2000-memory.dmp	xmrig
behavioral2/memory/2988-100-0x00007FF7D0AB0000-0x00007FF7D0EA2000-memory.dmp	xmrig
behavioral2/memory/4180-424-0x00007FF692E40000-0x00007FF693232000-memory.dmp	xmrig
behavioral2/memory/876-486-0x00007FF713340000-0x00007FF713732000-memory.dmp	xmrig
behavioral2/memory/2452-505-0x00007FF7A6850000-0x00007FF7A6C42000-memory.dmp	xmrig
behavioral2/memory/3924-523-0x00007FF6A7E20000-0x00007FF6A8212000-memory.dmp	xmrig
behavioral2/memory/4684-522-0x00007FF7319C0000-0x00007FF731DB2000-memory.dmp	xmrig
behavioral2/memory/4932-509-0x00007FF771350000-0x00007FF771742000-memory.dmp	xmrig
behavioral2/memory/4820-508-0x00007FF6C0640000-0x00007FF6C0A32000-memory.dmp	xmrig
behavioral2/memory/2940-377-0x00007FF6C4580000-0x00007FF6C4972000-memory.dmp	xmrig
behavioral2/memory/4148-359-0x00007FF7DA650000-0x00007FF7DAA42000-memory.dmp	xmrig
behavioral2/memory/4428-315-0x00007FF689360000-0x00007FF689752000-memory.dmp	xmrig
behavioral2/memory/5048-314-0x00007FF7CFFC0000-0x00007FF7D03B2000-memory.dmp	xmrig
behavioral2/memory/4900-295-0x00007FF60A610000-0x00007FF60AA02000-memory.dmp	xmrig
behavioral2/memory/2932-263-0x00007FF6CD270000-0x00007FF6CD662000-memory.dmp	xmrig
behavioral2/memory/448-227-0x00007FF694170000-0x00007FF694562000-memory.dmp	xmrig
behavioral2/memory/1948-210-0x00007FF6567F0000-0x00007FF656BE2000-memory.dmp	xmrig
behavioral2/memory/2792-21-0x00007FF733DD0000-0x00007FF7341C2000-memory.dmp	xmrig
behavioral2/memory/4932-5408-0x00007FF771350000-0x00007FF771742000-memory.dmp	xmrig
behavioral2/memory/2656-5473-0x00007FF7F85A0000-0x00007FF7F8992000-memory.dmp	xmrig
behavioral2/memory/2932-5497-0x00007FF6CD270000-0x00007FF6CD662000-memory.dmp	xmrig
behavioral2/memory/448-5494-0x00007FF694170000-0x00007FF694562000-memory.dmp	xmrig
behavioral2/memory/1948-5492-0x00007FF6567F0000-0x00007FF656BE2000-memory.dmp	xmrig
behavioral2/memory/4900-5487-0x00007FF60A610000-0x00007FF60AA02000-memory.dmp	xmrig
behavioral2/memory/4428-5509-0x00007FF689360000-0x00007FF689752000-memory.dmp	xmrig
behavioral2/memory/876-5531-0x00007FF713340000-0x00007FF713732000-memory.dmp	xmrig
behavioral2/memory/4180-5523-0x00007FF692E40000-0x00007FF693232000-memory.dmp	xmrig
behavioral2/memory/2940-5521-0x00007FF6C4580000-0x00007FF6C4972000-memory.dmp	xmrig
behavioral2/memory/4148-5515-0x00007FF7DA650000-0x00007FF7DAA42000-memory.dmp	xmrig
behavioral2/memory/4684-5544-0x00007FF7319C0000-0x00007FF731DB2000-memory.dmp	xmrig
behavioral2/memory/3924-5566-0x00007FF6A7E20000-0x00007FF6A8212000-memory.dmp	xmrig
behavioral2/memory/4820-5547-0x00007FF6C0640000-0x00007FF6C0A32000-memory.dmp	xmrig
behavioral2/memory/2452-5541-0x00007FF7A6850000-0x00007FF7A6C42000-memory.dmp	xmrig
behavioral2/memory/5048-5504-0x00007FF7CFFC0000-0x00007FF7D03B2000-memory.dmp	xmrig
behavioral2/memory/1152-5477-0x00007FF7E8B50000-0x00007FF7E8F42000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2792	VaiPpQl.exe
4932	YJqbwHV.exe
2988	bHysYRy.exe
1928	QcrQpLu.exe
3744	VUMYjyG.exe
1152	wFMqyQW.exe
2656	VTkpUpk.exe
1948	FGhXsWG.exe
448	fBkfFTa.exe
2932	auzldLU.exe
4900	kllleSh.exe
5048	XOimJib.exe
4428	DYoydsc.exe
4148	ZEGuHND.exe
2940	dVGHcsv.exe
4180	UDRIkIK.exe
876	Peznurd.exe
4684	qXLoZeX.exe
2452	lwhYFNM.exe
4820	AHXsIWQ.exe
3924	oBWfoKp.exe
4328	NCwaxrT.exe
3824	zPlyTjT.exe
4864	iDzGcCm.exe
4960	uKOiJmb.exe
3104	ObuSUSr.exe
772	XoaWPOD.exe
3256	gGaDRbm.exe
1432	OARqNJd.exe
4240	MQcUmhi.exe
264	TBTVRiJ.exe
4868	qfUXksK.exe
4552	nqJdknP.exe
8	lpQgskb.exe
4544	Lomewes.exe
2020	cubGikg.exe
1428	WwxqQSL.exe
4564	OGBGNFJ.exe
4568	yyvWvGA.exe
940	mOUMGtp.exe
4892	sYqAnPE.exe
800	pRgZEWu.exe
3844	TFuOATP.exe
4672	sKaZlZJ.exe
4548	rOTldQz.exe
4832	kEsfohr.exe
2364	LIyEhnE.exe
3704	nAEuCrj.exe
1248	bgaPqko.exe
3232	SmbNnsS.exe
2952	oMPtHZu.exe
3644	eAeYTen.exe
4280	WGPsAtr.exe
692	PrYXfXp.exe
3724	sQDsTJf.exe
5092	xPRLkcG.exe
4340	SZepkxn.exe
5044	mLiZbxM.exe
5076	hysSpLz.exe
4856	ULsnqqB.exe
212	qZmcnMF.exe
4780	oIkVQvQ.exe
628	MjKqGRX.exe
4936	AYVxsfE.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/852-0-0x00007FF6D2CB0000-0x00007FF6D30A2000-memory.dmp	upx
behavioral2/files/0x000c000000023b73-5.dat	upx
behavioral2/files/0x000a000000023b78-8.dat	upx
behavioral2/files/0x000a000000023b77-20.dat	upx
behavioral2/files/0x000a000000023b79-28.dat	upx
behavioral2/files/0x000a000000023b7f-44.dat	upx
behavioral2/files/0x000a000000023b8d-144.dat	upx
behavioral2/files/0x000a000000023b92-182.dat	upx
behavioral2/files/0x000a000000023b8f-192.dat	upx
behavioral2/files/0x000a000000023b9a-191.dat	upx
behavioral2/files/0x000b000000023b74-185.dat	upx
behavioral2/files/0x000a000000023b98-184.dat	upx
behavioral2/files/0x000a000000023b8e-177.dat	upx
behavioral2/files/0x000a000000023b8c-173.dat	upx
behavioral2/files/0x000a000000023b8a-167.dat	upx
behavioral2/files/0x000a000000023b8b-166.dat	upx
behavioral2/files/0x000a000000023b97-161.dat	upx
behavioral2/files/0x000a000000023b96-160.dat	upx
behavioral2/files/0x000a000000023b95-157.dat	upx
behavioral2/files/0x000a000000023b94-155.dat	upx
behavioral2/memory/2656-188-0x00007FF7F85A0000-0x00007FF7F8992000-memory.dmp	upx
behavioral2/memory/1152-151-0x00007FF7E8B50000-0x00007FF7E8F42000-memory.dmp	upx
behavioral2/memory/3744-148-0x00007FF73EE30000-0x00007FF73F222000-memory.dmp	upx
behavioral2/files/0x000a000000023b93-147.dat	upx
behavioral2/files/0x000a000000023b91-143.dat	upx
behavioral2/files/0x000a000000023b90-142.dat	upx
behavioral2/files/0x000a000000023b89-135.dat	upx
behavioral2/files/0x000a000000023b88-128.dat	upx
behavioral2/memory/1928-122-0x00007FF7B8FC0000-0x00007FF7B93B2000-memory.dmp	upx
behavioral2/files/0x000a000000023b86-114.dat	upx
behavioral2/files/0x000a000000023b85-108.dat	upx
behavioral2/files/0x000a000000023b84-105.dat	upx
behavioral2/files/0x000a000000023b87-127.dat	upx
behavioral2/memory/2988-100-0x00007FF7D0AB0000-0x00007FF7D0EA2000-memory.dmp	upx
behavioral2/files/0x000a000000023b82-90.dat	upx
behavioral2/files/0x000a000000023b81-88.dat	upx
behavioral2/files/0x000a000000023b83-102.dat	upx
behavioral2/files/0x000a000000023b7e-73.dat	upx
behavioral2/files/0x000a000000023b7d-69.dat	upx
behavioral2/files/0x000a000000023b80-62.dat	upx
behavioral2/files/0x000a000000023b7b-59.dat	upx
behavioral2/files/0x000a000000023b7c-55.dat	upx
behavioral2/memory/4180-424-0x00007FF692E40000-0x00007FF693232000-memory.dmp	upx
behavioral2/memory/876-486-0x00007FF713340000-0x00007FF713732000-memory.dmp	upx
behavioral2/memory/2452-505-0x00007FF7A6850000-0x00007FF7A6C42000-memory.dmp	upx
behavioral2/memory/3924-523-0x00007FF6A7E20000-0x00007FF6A8212000-memory.dmp	upx
behavioral2/memory/4684-522-0x00007FF7319C0000-0x00007FF731DB2000-memory.dmp	upx
behavioral2/memory/4932-509-0x00007FF771350000-0x00007FF771742000-memory.dmp	upx
behavioral2/memory/4820-508-0x00007FF6C0640000-0x00007FF6C0A32000-memory.dmp	upx
behavioral2/memory/2940-377-0x00007FF6C4580000-0x00007FF6C4972000-memory.dmp	upx
behavioral2/memory/4148-359-0x00007FF7DA650000-0x00007FF7DAA42000-memory.dmp	upx
behavioral2/memory/4428-315-0x00007FF689360000-0x00007FF689752000-memory.dmp	upx
behavioral2/memory/5048-314-0x00007FF7CFFC0000-0x00007FF7D03B2000-memory.dmp	upx
behavioral2/memory/4900-295-0x00007FF60A610000-0x00007FF60AA02000-memory.dmp	upx
behavioral2/memory/2932-263-0x00007FF6CD270000-0x00007FF6CD662000-memory.dmp	upx
behavioral2/memory/448-227-0x00007FF694170000-0x00007FF694562000-memory.dmp	upx
behavioral2/memory/1948-210-0x00007FF6567F0000-0x00007FF656BE2000-memory.dmp	upx
behavioral2/files/0x000a000000023b7a-39.dat	upx
behavioral2/memory/2792-21-0x00007FF733DD0000-0x00007FF7341C2000-memory.dmp	upx
behavioral2/memory/4932-5408-0x00007FF771350000-0x00007FF771742000-memory.dmp	upx
behavioral2/memory/2656-5473-0x00007FF7F85A0000-0x00007FF7F8992000-memory.dmp	upx
behavioral2/memory/2932-5497-0x00007FF6CD270000-0x00007FF6CD662000-memory.dmp	upx
behavioral2/memory/448-5494-0x00007FF694170000-0x00007FF694562000-memory.dmp	upx
behavioral2/memory/1948-5492-0x00007FF6567F0000-0x00007FF656BE2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MweWewg.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\wMKBaro.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\NmLZJYQ.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\jAjMNcC.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\GgXDQnq.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\JGINRWz.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\ShEbYbF.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\NcbjTOw.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\PIedtJx.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\FzNNwkL.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\MhvbWjL.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\AkGJxyS.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\LpEPZQZ.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\CVMPlqB.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\Oszjrwa.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\VQCakgB.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\CYszWIO.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\obbgETz.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\qXkfGVK.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\OCyVBKU.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\BDnNANZ.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\jwxUWFX.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\onrWvsb.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\SXgtXeZ.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\hISuLdB.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\BBkQFcF.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\EWqcDwk.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\SbBupVT.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\iLHYrIu.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\iGsqjLl.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\MzxuYgF.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\ZNaucqu.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\YcTgVnI.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\Vmalmqk.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\xDudzJD.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\oXXUruy.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\vSJaMUa.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\huZNtZa.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\FvICwQh.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\kNDBnds.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\QVlAYrk.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\ZYNPquK.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\LwatZkh.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\MijCALU.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\OXICYhY.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\VaEWcZj.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\OhVYqOz.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\xWVDGrb.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\JciAMcO.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\lYgCPUw.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\lJCfYQo.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\NCcoyqR.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\YzsvRoQ.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\pCVvcUe.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\gDdhsPB.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\tcLNIPf.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\YPOarBu.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\xXAAmVK.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\dkMeqAm.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\gfXeODo.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\AWVhyMR.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\FZjVJFZ.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\gCrniSr.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
File created	C:\Windows\System\JurQqqs.exe	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3672	powershell.exe
3672	powershell.exe
3672	powershell.exe
3672	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
Token: SeDebugPrivilege	3672	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 3672	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	85
PID 852 wrote to memory of 3672	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	85
PID 852 wrote to memory of 2792	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	86
PID 852 wrote to memory of 2792	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	86
PID 852 wrote to memory of 4932	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	87
PID 852 wrote to memory of 4932	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	87
PID 852 wrote to memory of 2988	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	88
PID 852 wrote to memory of 2988	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	88
PID 852 wrote to memory of 1928	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	89
PID 852 wrote to memory of 1928	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	89
PID 852 wrote to memory of 3744	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	90
PID 852 wrote to memory of 3744	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	90
PID 852 wrote to memory of 1152	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	91
PID 852 wrote to memory of 1152	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	91
PID 852 wrote to memory of 2656	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	92
PID 852 wrote to memory of 2656	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	92
PID 852 wrote to memory of 1948	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	93
PID 852 wrote to memory of 1948	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	93
PID 852 wrote to memory of 448	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	94
PID 852 wrote to memory of 448	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	94
PID 852 wrote to memory of 2932	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	95
PID 852 wrote to memory of 2932	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	95
PID 852 wrote to memory of 4900	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	96
PID 852 wrote to memory of 4900	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	96
PID 852 wrote to memory of 5048	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	97
PID 852 wrote to memory of 5048	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	97
PID 852 wrote to memory of 4428	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	98
PID 852 wrote to memory of 4428	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	98
PID 852 wrote to memory of 4148	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	99
PID 852 wrote to memory of 4148	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	99
PID 852 wrote to memory of 2940	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	100
PID 852 wrote to memory of 2940	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	100
PID 852 wrote to memory of 4180	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	101
PID 852 wrote to memory of 4180	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	101
PID 852 wrote to memory of 876	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	102
PID 852 wrote to memory of 876	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	102
PID 852 wrote to memory of 4684	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	103
PID 852 wrote to memory of 4684	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	103
PID 852 wrote to memory of 2452	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	104
PID 852 wrote to memory of 2452	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	104
PID 852 wrote to memory of 4820	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	105
PID 852 wrote to memory of 4820	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	105
PID 852 wrote to memory of 3924	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	106
PID 852 wrote to memory of 3924	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	106
PID 852 wrote to memory of 4328	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	107
PID 852 wrote to memory of 4328	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	107
PID 852 wrote to memory of 3824	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	108
PID 852 wrote to memory of 3824	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	108
PID 852 wrote to memory of 4864	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	109
PID 852 wrote to memory of 4864	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	109
PID 852 wrote to memory of 4960	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	110
PID 852 wrote to memory of 4960	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	110
PID 852 wrote to memory of 3104	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	111
PID 852 wrote to memory of 3104	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	111
PID 852 wrote to memory of 772	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	112
PID 852 wrote to memory of 772	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	112
PID 852 wrote to memory of 3256	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	113
PID 852 wrote to memory of 3256	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	113
PID 852 wrote to memory of 1432	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	114
PID 852 wrote to memory of 1432	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	114
PID 852 wrote to memory of 4240	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	115
PID 852 wrote to memory of 4240	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	115
PID 852 wrote to memory of 264	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	116
PID 852 wrote to memory of 264	852	03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03a8bb4dfbb7a718f94df897656f83b5_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3672
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3672" "2084" "2028" "2088" "0" "0" "2092" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13280
- C:\Windows\System\VaiPpQl.exe
  C:\Windows\System\VaiPpQl.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\YJqbwHV.exe
  C:\Windows\System\YJqbwHV.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\bHysYRy.exe
  C:\Windows\System\bHysYRy.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\QcrQpLu.exe
  C:\Windows\System\QcrQpLu.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\VUMYjyG.exe
  C:\Windows\System\VUMYjyG.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\wFMqyQW.exe
  C:\Windows\System\wFMqyQW.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\VTkpUpk.exe
  C:\Windows\System\VTkpUpk.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\FGhXsWG.exe
  C:\Windows\System\FGhXsWG.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\fBkfFTa.exe
  C:\Windows\System\fBkfFTa.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\auzldLU.exe
  C:\Windows\System\auzldLU.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\kllleSh.exe
  C:\Windows\System\kllleSh.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\XOimJib.exe
  C:\Windows\System\XOimJib.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\DYoydsc.exe
  C:\Windows\System\DYoydsc.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\ZEGuHND.exe
  C:\Windows\System\ZEGuHND.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\dVGHcsv.exe
  C:\Windows\System\dVGHcsv.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\UDRIkIK.exe
  C:\Windows\System\UDRIkIK.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\Peznurd.exe
  C:\Windows\System\Peznurd.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\qXLoZeX.exe
  C:\Windows\System\qXLoZeX.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\lwhYFNM.exe
  C:\Windows\System\lwhYFNM.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\AHXsIWQ.exe
  C:\Windows\System\AHXsIWQ.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\oBWfoKp.exe
  C:\Windows\System\oBWfoKp.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\NCwaxrT.exe
  C:\Windows\System\NCwaxrT.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\zPlyTjT.exe
  C:\Windows\System\zPlyTjT.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\iDzGcCm.exe
  C:\Windows\System\iDzGcCm.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\uKOiJmb.exe
  C:\Windows\System\uKOiJmb.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\ObuSUSr.exe
  C:\Windows\System\ObuSUSr.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\XoaWPOD.exe
  C:\Windows\System\XoaWPOD.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\gGaDRbm.exe
  C:\Windows\System\gGaDRbm.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\OARqNJd.exe
  C:\Windows\System\OARqNJd.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\MQcUmhi.exe
  C:\Windows\System\MQcUmhi.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\TBTVRiJ.exe
  C:\Windows\System\TBTVRiJ.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\qfUXksK.exe
  C:\Windows\System\qfUXksK.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\nqJdknP.exe
  C:\Windows\System\nqJdknP.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\lpQgskb.exe
  C:\Windows\System\lpQgskb.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\Lomewes.exe
  C:\Windows\System\Lomewes.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\cubGikg.exe
  C:\Windows\System\cubGikg.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\kEsfohr.exe
  C:\Windows\System\kEsfohr.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\WwxqQSL.exe
  C:\Windows\System\WwxqQSL.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\OGBGNFJ.exe
  C:\Windows\System\OGBGNFJ.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\yyvWvGA.exe
  C:\Windows\System\yyvWvGA.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\mOUMGtp.exe
  C:\Windows\System\mOUMGtp.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\sYqAnPE.exe
  C:\Windows\System\sYqAnPE.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\pRgZEWu.exe
  C:\Windows\System\pRgZEWu.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\TFuOATP.exe
  C:\Windows\System\TFuOATP.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\sKaZlZJ.exe
  C:\Windows\System\sKaZlZJ.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\oMPtHZu.exe
  C:\Windows\System\oMPtHZu.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\rOTldQz.exe
  C:\Windows\System\rOTldQz.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\LIyEhnE.exe
  C:\Windows\System\LIyEhnE.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\nAEuCrj.exe
  C:\Windows\System\nAEuCrj.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\bgaPqko.exe
  C:\Windows\System\bgaPqko.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\SmbNnsS.exe
  C:\Windows\System\SmbNnsS.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\eAeYTen.exe
  C:\Windows\System\eAeYTen.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\WGPsAtr.exe
  C:\Windows\System\WGPsAtr.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\PrYXfXp.exe
  C:\Windows\System\PrYXfXp.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\sQDsTJf.exe
  C:\Windows\System\sQDsTJf.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\LZePcan.exe
  C:\Windows\System\LZePcan.exe
  2⤵
  PID:2152
- C:\Windows\System\xPRLkcG.exe
  C:\Windows\System\xPRLkcG.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\SZepkxn.exe
  C:\Windows\System\SZepkxn.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\mLiZbxM.exe
  C:\Windows\System\mLiZbxM.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\hysSpLz.exe
  C:\Windows\System\hysSpLz.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\ULsnqqB.exe
  C:\Windows\System\ULsnqqB.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\GWiMarg.exe
  C:\Windows\System\GWiMarg.exe
  2⤵
  PID:1612
- C:\Windows\System\qZmcnMF.exe
  C:\Windows\System\qZmcnMF.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\oIkVQvQ.exe
  C:\Windows\System\oIkVQvQ.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\MjKqGRX.exe
  C:\Windows\System\MjKqGRX.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\AYVxsfE.exe
  C:\Windows\System\AYVxsfE.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\dfNeYpg.exe
  C:\Windows\System\dfNeYpg.exe
  2⤵
  PID:444
- C:\Windows\System\cMJHehX.exe
  C:\Windows\System\cMJHehX.exe
  2⤵
  PID:1556
- C:\Windows\System\hGUkJJT.exe
  C:\Windows\System\hGUkJJT.exe
  2⤵
  PID:1044
- C:\Windows\System\aQgxQDW.exe
  C:\Windows\System\aQgxQDW.exe
  2⤵
  PID:4956
- C:\Windows\System\hZzpUow.exe
  C:\Windows\System\hZzpUow.exe
  2⤵
  PID:4796
- C:\Windows\System\QQKYrZm.exe
  C:\Windows\System\QQKYrZm.exe
  2⤵
  PID:2116
- C:\Windows\System\ztfGfzi.exe
  C:\Windows\System\ztfGfzi.exe
  2⤵
  PID:824
- C:\Windows\System\LfYYdtP.exe
  C:\Windows\System\LfYYdtP.exe
  2⤵
  PID:5124
- C:\Windows\System\UGUAtPt.exe
  C:\Windows\System\UGUAtPt.exe
  2⤵
  PID:5156
- C:\Windows\System\FIlkcRY.exe
  C:\Windows\System\FIlkcRY.exe
  2⤵
  PID:5176
- C:\Windows\System\biTyEbN.exe
  C:\Windows\System\biTyEbN.exe
  2⤵
  PID:5216
- C:\Windows\System\HZunApd.exe
  C:\Windows\System\HZunApd.exe
  2⤵
  PID:5244
- C:\Windows\System\rDvwGyb.exe
  C:\Windows\System\rDvwGyb.exe
  2⤵
  PID:5260
- C:\Windows\System\XdrnbFK.exe
  C:\Windows\System\XdrnbFK.exe
  2⤵
  PID:5276
- C:\Windows\System\HRluTll.exe
  C:\Windows\System\HRluTll.exe
  2⤵
  PID:5328
- C:\Windows\System\CmeBRKq.exe
  C:\Windows\System\CmeBRKq.exe
  2⤵
  PID:5352
- C:\Windows\System\wqBTvyk.exe
  C:\Windows\System\wqBTvyk.exe
  2⤵
  PID:5372
- C:\Windows\System\FLdxOGC.exe
  C:\Windows\System\FLdxOGC.exe
  2⤵
  PID:5420
- C:\Windows\System\jTwAZHU.exe
  C:\Windows\System\jTwAZHU.exe
  2⤵
  PID:5440
- C:\Windows\System\TvbYaXi.exe
  C:\Windows\System\TvbYaXi.exe
  2⤵
  PID:5460
- C:\Windows\System\EKAmHvq.exe
  C:\Windows\System\EKAmHvq.exe
  2⤵
  PID:5484
- C:\Windows\System\wKHSIkO.exe
  C:\Windows\System\wKHSIkO.exe
  2⤵
  PID:5544
- C:\Windows\System\egciUnT.exe
  C:\Windows\System\egciUnT.exe
  2⤵
  PID:5568
- C:\Windows\System\sCQFeIs.exe
  C:\Windows\System\sCQFeIs.exe
  2⤵
  PID:5596
- C:\Windows\System\YKNcXrA.exe
  C:\Windows\System\YKNcXrA.exe
  2⤵
  PID:5620
- C:\Windows\System\OPsStcA.exe
  C:\Windows\System\OPsStcA.exe
  2⤵
  PID:5652
- C:\Windows\System\vLTwsvm.exe
  C:\Windows\System\vLTwsvm.exe
  2⤵
  PID:5696
- C:\Windows\System\yYXuMjc.exe
  C:\Windows\System\yYXuMjc.exe
  2⤵
  PID:5736
- C:\Windows\System\ABDbrNU.exe
  C:\Windows\System\ABDbrNU.exe
  2⤵
  PID:5760
- C:\Windows\System\soxsGDl.exe
  C:\Windows\System\soxsGDl.exe
  2⤵
  PID:5784
- C:\Windows\System\YhEmTPZ.exe
  C:\Windows\System\YhEmTPZ.exe
  2⤵
  PID:5800
- C:\Windows\System\fnEpDlr.exe
  C:\Windows\System\fnEpDlr.exe
  2⤵
  PID:5844
- C:\Windows\System\SWWXXun.exe
  C:\Windows\System\SWWXXun.exe
  2⤵
  PID:5872
- C:\Windows\System\NEEXhxd.exe
  C:\Windows\System\NEEXhxd.exe
  2⤵
  PID:5904
- C:\Windows\System\DySxPqn.exe
  C:\Windows\System\DySxPqn.exe
  2⤵
  PID:5964
- C:\Windows\System\xIdTrcH.exe
  C:\Windows\System\xIdTrcH.exe
  2⤵
  PID:5992
- C:\Windows\System\ZrJCMMf.exe
  C:\Windows\System\ZrJCMMf.exe
  2⤵
  PID:6008
- C:\Windows\System\jcFqVxG.exe
  C:\Windows\System\jcFqVxG.exe
  2⤵
  PID:6076
- C:\Windows\System\tCUTItb.exe
  C:\Windows\System\tCUTItb.exe
  2⤵
  PID:848
- C:\Windows\System\RyOUgyG.exe
  C:\Windows\System\RyOUgyG.exe
  2⤵
  PID:3928
- C:\Windows\System\cWyknwF.exe
  C:\Windows\System\cWyknwF.exe
  2⤵
  PID:4744
- C:\Windows\System\InmwOCG.exe
  C:\Windows\System\InmwOCG.exe
  2⤵
  PID:1936
- C:\Windows\System\avdMDfI.exe
  C:\Windows\System\avdMDfI.exe
  2⤵
  PID:1744
- C:\Windows\System\JYHaIOO.exe
  C:\Windows\System\JYHaIOO.exe
  2⤵
  PID:2028
- C:\Windows\System\uezJpNX.exe
  C:\Windows\System\uezJpNX.exe
  2⤵
  PID:1584
- C:\Windows\System\yXXtlmU.exe
  C:\Windows\System\yXXtlmU.exe
  2⤵
  PID:3128
- C:\Windows\System\LMVLNEs.exe
  C:\Windows\System\LMVLNEs.exe
  2⤵
  PID:4284
- C:\Windows\System\xmZyZLI.exe
  C:\Windows\System\xmZyZLI.exe
  2⤵
  PID:2016
- C:\Windows\System\HPcfEEa.exe
  C:\Windows\System\HPcfEEa.exe
  2⤵
  PID:3812
- C:\Windows\System\hZkLXot.exe
  C:\Windows\System\hZkLXot.exe
  2⤵
  PID:5152
- C:\Windows\System\IYMTmkR.exe
  C:\Windows\System\IYMTmkR.exe
  2⤵
  PID:5172
- C:\Windows\System\mCyHmNM.exe
  C:\Windows\System\mCyHmNM.exe
  2⤵
  PID:3708
- C:\Windows\System\jvfZbhp.exe
  C:\Windows\System\jvfZbhp.exe
  2⤵
  PID:3892
- C:\Windows\System\UTKmmQE.exe
  C:\Windows\System\UTKmmQE.exe
  2⤵
  PID:5496
- C:\Windows\System\JZxTGFV.exe
  C:\Windows\System\JZxTGFV.exe
  2⤵
  PID:1196
- C:\Windows\System\MBKtycS.exe
  C:\Windows\System\MBKtycS.exe
  2⤵
  PID:1712
- C:\Windows\System\KSfdQDj.exe
  C:\Windows\System\KSfdQDj.exe
  2⤵
  PID:3020
- C:\Windows\System\bOwehkP.exe
  C:\Windows\System\bOwehkP.exe
  2⤵
  PID:5204
- C:\Windows\System\ScihoPA.exe
  C:\Windows\System\ScihoPA.exe
  2⤵
  PID:4024
- C:\Windows\System\wxCiUtY.exe
  C:\Windows\System\wxCiUtY.exe
  2⤵
  PID:5284
- C:\Windows\System\hyJgyNw.exe
  C:\Windows\System\hyJgyNw.exe
  2⤵
  PID:5336
- C:\Windows\System\RDvHTUv.exe
  C:\Windows\System\RDvHTUv.exe
  2⤵
  PID:5380
- C:\Windows\System\KrvhTkt.exe
  C:\Windows\System\KrvhTkt.exe
  2⤵
  PID:5448
- C:\Windows\System\AJhepnd.exe
  C:\Windows\System\AJhepnd.exe
  2⤵
  PID:5772
- C:\Windows\System\ukxexcc.exe
  C:\Windows\System\ukxexcc.exe
  2⤵
  PID:5552
- C:\Windows\System\VrNiqnd.exe
  C:\Windows\System\VrNiqnd.exe
  2⤵
  PID:5588
- C:\Windows\System\gBBqwYe.exe
  C:\Windows\System\gBBqwYe.exe
  2⤵
  PID:5632
- C:\Windows\System\DmHkdEb.exe
  C:\Windows\System\DmHkdEb.exe
  2⤵
  PID:2676
- C:\Windows\System\eRYJLTE.exe
  C:\Windows\System\eRYJLTE.exe
  2⤵
  PID:5676
- C:\Windows\System\XMrbcIW.exe
  C:\Windows\System\XMrbcIW.exe
  2⤵
  PID:5728
- C:\Windows\System\RYpJsnD.exe
  C:\Windows\System\RYpJsnD.exe
  2⤵
  PID:5472
- C:\Windows\System\LWjFLqZ.exe
  C:\Windows\System\LWjFLqZ.exe
  2⤵
  PID:6152
- C:\Windows\System\bZcRZTH.exe
  C:\Windows\System\bZcRZTH.exe
  2⤵
  PID:6188
- C:\Windows\System\sJbWuZe.exe
  C:\Windows\System\sJbWuZe.exe
  2⤵
  PID:6212
- C:\Windows\System\wWiAZNK.exe
  C:\Windows\System\wWiAZNK.exe
  2⤵
  PID:6228
- C:\Windows\System\fNUxtaj.exe
  C:\Windows\System\fNUxtaj.exe
  2⤵
  PID:6244
- C:\Windows\System\Hjfagyn.exe
  C:\Windows\System\Hjfagyn.exe
  2⤵
  PID:6268
- C:\Windows\System\JNnVwaF.exe
  C:\Windows\System\JNnVwaF.exe
  2⤵
  PID:6284
- C:\Windows\System\HTlJIQX.exe
  C:\Windows\System\HTlJIQX.exe
  2⤵
  PID:6300
- C:\Windows\System\hDdziRn.exe
  C:\Windows\System\hDdziRn.exe
  2⤵
  PID:6316
- C:\Windows\System\PpDDnKu.exe
  C:\Windows\System\PpDDnKu.exe
  2⤵
  PID:6336
- C:\Windows\System\wmWuZPx.exe
  C:\Windows\System\wmWuZPx.exe
  2⤵
  PID:6356
- C:\Windows\System\BRLoYci.exe
  C:\Windows\System\BRLoYci.exe
  2⤵
  PID:6380
- C:\Windows\System\nfdrLzu.exe
  C:\Windows\System\nfdrLzu.exe
  2⤵
  PID:6396
- C:\Windows\System\dKBXDMT.exe
  C:\Windows\System\dKBXDMT.exe
  2⤵
  PID:6428
- C:\Windows\System\TzEXMBF.exe
  C:\Windows\System\TzEXMBF.exe
  2⤵
  PID:6444
- C:\Windows\System\JWGOadT.exe
  C:\Windows\System\JWGOadT.exe
  2⤵
  PID:6464
- C:\Windows\System\xKiORpS.exe
  C:\Windows\System\xKiORpS.exe
  2⤵
  PID:6484
- C:\Windows\System\cClElnn.exe
  C:\Windows\System\cClElnn.exe
  2⤵
  PID:6720
- C:\Windows\System\SvqRFdV.exe
  C:\Windows\System\SvqRFdV.exe
  2⤵
  PID:6788
- C:\Windows\System\nfqNWAK.exe
  C:\Windows\System\nfqNWAK.exe
  2⤵
  PID:6804
- C:\Windows\System\nyVJCZu.exe
  C:\Windows\System\nyVJCZu.exe
  2⤵
  PID:6820
- C:\Windows\System\wcFIFYz.exe
  C:\Windows\System\wcFIFYz.exe
  2⤵
  PID:6836
- C:\Windows\System\ZjKjbKj.exe
  C:\Windows\System\ZjKjbKj.exe
  2⤵
  PID:6852
- C:\Windows\System\GjtvaMz.exe
  C:\Windows\System\GjtvaMz.exe
  2⤵
  PID:6868
- C:\Windows\System\UWwMPgi.exe
  C:\Windows\System\UWwMPgi.exe
  2⤵
  PID:6884
- C:\Windows\System\ZNqDrhU.exe
  C:\Windows\System\ZNqDrhU.exe
  2⤵
  PID:6900
- C:\Windows\System\nYkgTuP.exe
  C:\Windows\System\nYkgTuP.exe
  2⤵
  PID:6920
- C:\Windows\System\mqhMTaK.exe
  C:\Windows\System\mqhMTaK.exe
  2⤵
  PID:7064
- C:\Windows\System\ToPEmHk.exe
  C:\Windows\System\ToPEmHk.exe
  2⤵
  PID:7088
- C:\Windows\System\pnkOLQJ.exe
  C:\Windows\System\pnkOLQJ.exe
  2⤵
  PID:7104
- C:\Windows\System\baSAMaO.exe
  C:\Windows\System\baSAMaO.exe
  2⤵
  PID:7120
- C:\Windows\System\hsPPdCi.exe
  C:\Windows\System\hsPPdCi.exe
  2⤵
  PID:5792
- C:\Windows\System\VBqybRE.exe
  C:\Windows\System\VBqybRE.exe
  2⤵
  PID:5832
- C:\Windows\System\oVMqAyX.exe
  C:\Windows\System\oVMqAyX.exe
  2⤵
  PID:5860
- C:\Windows\System\qDxyJne.exe
  C:\Windows\System\qDxyJne.exe
  2⤵
  PID:5892
- C:\Windows\System\sNJVXVe.exe
  C:\Windows\System\sNJVXVe.exe
  2⤵
  PID:5256
- C:\Windows\System\MAnUVbq.exe
  C:\Windows\System\MAnUVbq.exe
  2⤵
  PID:6024
- C:\Windows\System\zcCMsbc.exe
  C:\Windows\System\zcCMsbc.exe
  2⤵
  PID:6088
- C:\Windows\System\JDxfDQD.exe
  C:\Windows\System\JDxfDQD.exe
  2⤵
  PID:6140
- C:\Windows\System\oQZADJS.exe
  C:\Windows\System\oQZADJS.exe
  2⤵
  PID:5072
- C:\Windows\System\GdcMRGO.exe
  C:\Windows\System\GdcMRGO.exe
  2⤵
  PID:2304
- C:\Windows\System\QgifXky.exe
  C:\Windows\System\QgifXky.exe
  2⤵
  PID:6344
- C:\Windows\System\ImsibLw.exe
  C:\Windows\System\ImsibLw.exe
  2⤵
  PID:6296
- C:\Windows\System\lfNwmuC.exe
  C:\Windows\System\lfNwmuC.exe
  2⤵
  PID:6252
- C:\Windows\System\frTABEt.exe
  C:\Windows\System\frTABEt.exe
  2⤵
  PID:6204
- C:\Windows\System\bKOeHCr.exe
  C:\Windows\System\bKOeHCr.exe
  2⤵
  PID:6172
- C:\Windows\System\YKnCKQc.exe
  C:\Windows\System\YKnCKQc.exe
  2⤵
  PID:5492
- C:\Windows\System\mfEnsnA.exe
  C:\Windows\System\mfEnsnA.exe
  2⤵
  PID:5660
- C:\Windows\System\BFPzfqA.exe
  C:\Windows\System\BFPzfqA.exe
  2⤵
  PID:2720
- C:\Windows\System\GeWueNy.exe
  C:\Windows\System\GeWueNy.exe
  2⤵
  PID:5532
- C:\Windows\System\BqiRMev.exe
  C:\Windows\System\BqiRMev.exe
  2⤵
  PID:5360
- C:\Windows\System\AXtocsJ.exe
  C:\Windows\System\AXtocsJ.exe
  2⤵
  PID:6672
- C:\Windows\System\znlNyIB.exe
  C:\Windows\System\znlNyIB.exe
  2⤵
  PID:6712
- C:\Windows\System\ReXgeHc.exe
  C:\Windows\System\ReXgeHc.exe
  2⤵
  PID:6744
- C:\Windows\System\navHwMk.exe
  C:\Windows\System\navHwMk.exe
  2⤵
  PID:1488
- C:\Windows\System\hnshrMU.exe
  C:\Windows\System\hnshrMU.exe
  2⤵
  PID:5780
- C:\Windows\System\bGtcYry.exe
  C:\Windows\System\bGtcYry.exe
  2⤵
  PID:5252
- C:\Windows\System\LuqwtrD.exe
  C:\Windows\System\LuqwtrD.exe
  2⤵
  PID:7292
- C:\Windows\System\UOIZSvT.exe
  C:\Windows\System\UOIZSvT.exe
  2⤵
  PID:7312
- C:\Windows\System\HOmfRhc.exe
  C:\Windows\System\HOmfRhc.exe
  2⤵
  PID:7328
- C:\Windows\System\BrhbKxg.exe
  C:\Windows\System\BrhbKxg.exe
  2⤵
  PID:7344
- C:\Windows\System\ZsBdBgU.exe
  C:\Windows\System\ZsBdBgU.exe
  2⤵
  PID:7364
- C:\Windows\System\xGpcuFn.exe
  C:\Windows\System\xGpcuFn.exe
  2⤵
  PID:7380
- C:\Windows\System\xORMZdU.exe
  C:\Windows\System\xORMZdU.exe
  2⤵
  PID:7400
- C:\Windows\System\XNxRHCS.exe
  C:\Windows\System\XNxRHCS.exe
  2⤵
  PID:7420
- C:\Windows\System\ycRMzSk.exe
  C:\Windows\System\ycRMzSk.exe
  2⤵
  PID:7440
- C:\Windows\System\VajFBiE.exe
  C:\Windows\System\VajFBiE.exe
  2⤵
  PID:7460
- C:\Windows\System\cbKYkPt.exe
  C:\Windows\System\cbKYkPt.exe
  2⤵
  PID:7484
- C:\Windows\System\ogcbFFp.exe
  C:\Windows\System\ogcbFFp.exe
  2⤵
  PID:7512
- C:\Windows\System\ccZIhqc.exe
  C:\Windows\System\ccZIhqc.exe
  2⤵
  PID:7528
- C:\Windows\System\ElbwOSX.exe
  C:\Windows\System\ElbwOSX.exe
  2⤵
  PID:7552
- C:\Windows\System\OAQRIkJ.exe
  C:\Windows\System\OAQRIkJ.exe
  2⤵
  PID:7576
- C:\Windows\System\gxsYhHT.exe
  C:\Windows\System\gxsYhHT.exe
  2⤵
  PID:7596
- C:\Windows\System\aFNSFhS.exe
  C:\Windows\System\aFNSFhS.exe
  2⤵
  PID:7620
- C:\Windows\System\NcZomVg.exe
  C:\Windows\System\NcZomVg.exe
  2⤵
  PID:7644
- C:\Windows\System\itmOsLf.exe
  C:\Windows\System\itmOsLf.exe
  2⤵
  PID:7664
- C:\Windows\System\wSZuAtf.exe
  C:\Windows\System\wSZuAtf.exe
  2⤵
  PID:7684
- C:\Windows\System\hcBkDOj.exe
  C:\Windows\System\hcBkDOj.exe
  2⤵
  PID:7708
- C:\Windows\System\twFTjdW.exe
  C:\Windows\System\twFTjdW.exe
  2⤵
  PID:7728
- C:\Windows\System\JXCSYMZ.exe
  C:\Windows\System\JXCSYMZ.exe
  2⤵
  PID:7752
- C:\Windows\System\uvVgexc.exe
  C:\Windows\System\uvVgexc.exe
  2⤵
  PID:7776
- C:\Windows\System\wSqTsqJ.exe
  C:\Windows\System\wSqTsqJ.exe
  2⤵
  PID:7800
- C:\Windows\System\ASiVEDz.exe
  C:\Windows\System\ASiVEDz.exe
  2⤵
  PID:7872
- C:\Windows\System\nElHsMN.exe
  C:\Windows\System\nElHsMN.exe
  2⤵
  PID:7888
- C:\Windows\System\BIdXfdl.exe
  C:\Windows\System\BIdXfdl.exe
  2⤵
  PID:7904
- C:\Windows\System\weuiapf.exe
  C:\Windows\System\weuiapf.exe
  2⤵
  PID:7928
- C:\Windows\System\WTQssDH.exe
  C:\Windows\System\WTQssDH.exe
  2⤵
  PID:7956
- C:\Windows\System\GQolkHD.exe
  C:\Windows\System\GQolkHD.exe
  2⤵
  PID:7972
- C:\Windows\System\JGcFgLs.exe
  C:\Windows\System\JGcFgLs.exe
  2⤵
  PID:8000
- C:\Windows\System\wiLolnZ.exe
  C:\Windows\System\wiLolnZ.exe
  2⤵
  PID:8016
- C:\Windows\System\LwatZkh.exe
  C:\Windows\System\LwatZkh.exe
  2⤵
  PID:8040
- C:\Windows\System\dXRyNFX.exe
  C:\Windows\System\dXRyNFX.exe
  2⤵
  PID:8064
- C:\Windows\System\RjAJAbq.exe
  C:\Windows\System\RjAJAbq.exe
  2⤵
  PID:8080
- C:\Windows\System\fqiyexA.exe
  C:\Windows\System\fqiyexA.exe
  2⤵
  PID:8104
- C:\Windows\System\zapsBPt.exe
  C:\Windows\System\zapsBPt.exe
  2⤵
  PID:8124
- C:\Windows\System\ACRyyZF.exe
  C:\Windows\System\ACRyyZF.exe
  2⤵
  PID:8152
- C:\Windows\System\NVvGMHg.exe
  C:\Windows\System\NVvGMHg.exe
  2⤵
  PID:8176
- C:\Windows\System\qlLmrvP.exe
  C:\Windows\System\qlLmrvP.exe
  2⤵
  PID:6848
- C:\Windows\System\KvfNzEz.exe
  C:\Windows\System\KvfNzEz.exe
  2⤵
  PID:6876
- C:\Windows\System\SUeoAee.exe
  C:\Windows\System\SUeoAee.exe
  2⤵
  PID:6928
- C:\Windows\System\sKlahSD.exe
  C:\Windows\System\sKlahSD.exe
  2⤵
  PID:7096
- C:\Windows\System\hqgIbOV.exe
  C:\Windows\System\hqgIbOV.exe
  2⤵
  PID:7136
- C:\Windows\System\bwrQCuI.exe
  C:\Windows\System\bwrQCuI.exe
  2⤵
  PID:7152
- C:\Windows\System\UfTeJwE.exe
  C:\Windows\System\UfTeJwE.exe
  2⤵
  PID:2540
- C:\Windows\System\DyUAnrH.exe
  C:\Windows\System\DyUAnrH.exe
  2⤵
  PID:5816
- C:\Windows\System\tfUBMvI.exe
  C:\Windows\System\tfUBMvI.exe
  2⤵
  PID:3720
- C:\Windows\System\qReqvUA.exe
  C:\Windows\System\qReqvUA.exe
  2⤵
  PID:6348
- C:\Windows\System\bnnnPHq.exe
  C:\Windows\System\bnnnPHq.exe
  2⤵
  PID:5748
- C:\Windows\System\JcmNLwt.exe
  C:\Windows\System\JcmNLwt.exe
  2⤵
  PID:5580
- C:\Windows\System\ugTfCdu.exe
  C:\Windows\System\ugTfCdu.exe
  2⤵
  PID:5316
- C:\Windows\System\suVVLkH.exe
  C:\Windows\System\suVVLkH.exe
  2⤵
  PID:6728
- C:\Windows\System\xHRPyLT.exe
  C:\Windows\System\xHRPyLT.exe
  2⤵
  PID:6496
- C:\Windows\System\NyEPdwt.exe
  C:\Windows\System\NyEPdwt.exe
  2⤵
  PID:5888
- C:\Windows\System\iTNKGtn.exe
  C:\Windows\System\iTNKGtn.exe
  2⤵
  PID:7520
- C:\Windows\System\VpcdblL.exe
  C:\Windows\System\VpcdblL.exe
  2⤵
  PID:7612
- C:\Windows\System\WiFiyHp.exe
  C:\Windows\System\WiFiyHp.exe
  2⤵
  PID:7748
- C:\Windows\System\gxaoncC.exe
  C:\Windows\System\gxaoncC.exe
  2⤵
  PID:3436
- C:\Windows\System\rubopTM.exe
  C:\Windows\System\rubopTM.exe
  2⤵
  PID:7760
- C:\Windows\System\YCfSzPQ.exe
  C:\Windows\System\YCfSzPQ.exe
  2⤵
  PID:8200
- C:\Windows\System\FtXkfZT.exe
  C:\Windows\System\FtXkfZT.exe
  2⤵
  PID:8244
- C:\Windows\System\GFSIAFk.exe
  C:\Windows\System\GFSIAFk.exe
  2⤵
  PID:8260
- C:\Windows\System\PJjBuxF.exe
  C:\Windows\System\PJjBuxF.exe
  2⤵
  PID:8276
- C:\Windows\System\BXNYugS.exe
  C:\Windows\System\BXNYugS.exe
  2⤵
  PID:8292
- C:\Windows\System\FXEhEKM.exe
  C:\Windows\System\FXEhEKM.exe
  2⤵
  PID:8308
- C:\Windows\System\AolOaLK.exe
  C:\Windows\System\AolOaLK.exe
  2⤵
  PID:8324
- C:\Windows\System\GrLpsRl.exe
  C:\Windows\System\GrLpsRl.exe
  2⤵
  PID:8352
- C:\Windows\System\XoUXJNQ.exe
  C:\Windows\System\XoUXJNQ.exe
  2⤵
  PID:8368
- C:\Windows\System\GfEkSEG.exe
  C:\Windows\System\GfEkSEG.exe
  2⤵
  PID:8392
- C:\Windows\System\DOlWAGt.exe
  C:\Windows\System\DOlWAGt.exe
  2⤵
  PID:8412
- C:\Windows\System\ZImdyko.exe
  C:\Windows\System\ZImdyko.exe
  2⤵
  PID:8432
- C:\Windows\System\UZGDKNj.exe
  C:\Windows\System\UZGDKNj.exe
  2⤵
  PID:8452
- C:\Windows\System\HpfCgLS.exe
  C:\Windows\System\HpfCgLS.exe
  2⤵
  PID:8476
- C:\Windows\System\YqThFMp.exe
  C:\Windows\System\YqThFMp.exe
  2⤵
  PID:8496
- C:\Windows\System\rHOuGky.exe
  C:\Windows\System\rHOuGky.exe
  2⤵
  PID:8516
- C:\Windows\System\uLPqPdQ.exe
  C:\Windows\System\uLPqPdQ.exe
  2⤵
  PID:8540
- C:\Windows\System\GIiEryP.exe
  C:\Windows\System\GIiEryP.exe
  2⤵
  PID:8560
- C:\Windows\System\rAQbmQx.exe
  C:\Windows\System\rAQbmQx.exe
  2⤵
  PID:8584
- C:\Windows\System\lqnHkEq.exe
  C:\Windows\System\lqnHkEq.exe
  2⤵
  PID:8604
- C:\Windows\System\vRLBAoQ.exe
  C:\Windows\System\vRLBAoQ.exe
  2⤵
  PID:8636
- C:\Windows\System\fuuXqNm.exe
  C:\Windows\System\fuuXqNm.exe
  2⤵
  PID:8652
- C:\Windows\System\PlcRgME.exe
  C:\Windows\System\PlcRgME.exe
  2⤵
  PID:8676
- C:\Windows\System\uBzNCFV.exe
  C:\Windows\System\uBzNCFV.exe
  2⤵
  PID:8700
- C:\Windows\System\quDlzwm.exe
  C:\Windows\System\quDlzwm.exe
  2⤵
  PID:8720
- C:\Windows\System\SDVLlcL.exe
  C:\Windows\System\SDVLlcL.exe
  2⤵
  PID:8740
- C:\Windows\System\DEslxAU.exe
  C:\Windows\System\DEslxAU.exe
  2⤵
  PID:8760
- C:\Windows\System\QYfXFAx.exe
  C:\Windows\System\QYfXFAx.exe
  2⤵
  PID:8780
- C:\Windows\System\vlsIWjS.exe
  C:\Windows\System\vlsIWjS.exe
  2⤵
  PID:8808
- C:\Windows\System\OiFIlvm.exe
  C:\Windows\System\OiFIlvm.exe
  2⤵
  PID:8824
- C:\Windows\System\wFQSEFo.exe
  C:\Windows\System\wFQSEFo.exe
  2⤵
  PID:8860
- C:\Windows\System\nndczzw.exe
  C:\Windows\System\nndczzw.exe
  2⤵
  PID:8876
- C:\Windows\System\bsXrYMe.exe
  C:\Windows\System\bsXrYMe.exe
  2⤵
  PID:8900
- C:\Windows\System\TUbKNKi.exe
  C:\Windows\System\TUbKNKi.exe
  2⤵
  PID:8916
- C:\Windows\System\OMmBoRE.exe
  C:\Windows\System\OMmBoRE.exe
  2⤵
  PID:8944
- C:\Windows\System\mvpAZEU.exe
  C:\Windows\System\mvpAZEU.exe
  2⤵
  PID:8968
- C:\Windows\System\BHGLOLd.exe
  C:\Windows\System\BHGLOLd.exe
  2⤵
  PID:8992
- C:\Windows\System\jNJtMXb.exe
  C:\Windows\System\jNJtMXb.exe
  2⤵
  PID:9008
- C:\Windows\System\GdDOGwk.exe
  C:\Windows\System\GdDOGwk.exe
  2⤵
  PID:9032
- C:\Windows\System\iESqMUs.exe
  C:\Windows\System\iESqMUs.exe
  2⤵
  PID:9048
- C:\Windows\System\znMCrTD.exe
  C:\Windows\System\znMCrTD.exe
  2⤵
  PID:9076
- C:\Windows\System\AeaRCwd.exe
  C:\Windows\System\AeaRCwd.exe
  2⤵
  PID:9096
- C:\Windows\System\UrlxCUe.exe
  C:\Windows\System\UrlxCUe.exe
  2⤵
  PID:9116
- C:\Windows\System\luOMHru.exe
  C:\Windows\System\luOMHru.exe
  2⤵
  PID:9136
- C:\Windows\System\zqXkcLE.exe
  C:\Windows\System\zqXkcLE.exe
  2⤵
  PID:9160
- C:\Windows\System\ndDpnKt.exe
  C:\Windows\System\ndDpnKt.exe
  2⤵
  PID:9180
- C:\Windows\System\GYVHBip.exe
  C:\Windows\System\GYVHBip.exe
  2⤵
  PID:9208
- C:\Windows\System\trUcyrj.exe
  C:\Windows\System\trUcyrj.exe
  2⤵
  PID:7320
- C:\Windows\System\QueXrCY.exe
  C:\Windows\System\QueXrCY.exe
  2⤵
  PID:7356
- C:\Windows\System\JowbjkH.exe
  C:\Windows\System\JowbjkH.exe
  2⤵
  PID:7396
- C:\Windows\System\UYdanoH.exe
  C:\Windows\System\UYdanoH.exe
  2⤵
  PID:7432
- C:\Windows\System\dfeNCJs.exe
  C:\Windows\System\dfeNCJs.exe
  2⤵
  PID:7480
- C:\Windows\System\EEoFeWt.exe
  C:\Windows\System\EEoFeWt.exe
  2⤵
  PID:8088
- C:\Windows\System\godwmft.exe
  C:\Windows\System\godwmft.exe
  2⤵
  PID:8164
- C:\Windows\System\xEwSNZz.exe
  C:\Windows\System\xEwSNZz.exe
  2⤵
  PID:7676
- C:\Windows\System\CMWcFYC.exe
  C:\Windows\System\CMWcFYC.exe
  2⤵
  PID:7724
- C:\Windows\System\wrjSCbw.exe
  C:\Windows\System\wrjSCbw.exe
  2⤵
  PID:7764
- C:\Windows\System\JaNIHgr.exe
  C:\Windows\System\JaNIHgr.exe
  2⤵
  PID:6132
- C:\Windows\System\uhqNQJE.exe
  C:\Windows\System\uhqNQJE.exe
  2⤵
  PID:6352
- C:\Windows\System\StEXoln.exe
  C:\Windows\System\StEXoln.exe
  2⤵
  PID:7828
- C:\Windows\System\rGAUhJN.exe
  C:\Windows\System\rGAUhJN.exe
  2⤵
  PID:7844
- C:\Windows\System\PfJdhiY.exe
  C:\Windows\System\PfJdhiY.exe
  2⤵
  PID:7864
- C:\Windows\System\ONvTsRY.exe
  C:\Windows\System\ONvTsRY.exe
  2⤵
  PID:7896
- C:\Windows\System\mceDbHx.exe
  C:\Windows\System\mceDbHx.exe
  2⤵
  PID:7936
- C:\Windows\System\lYgCzSf.exe
  C:\Windows\System\lYgCzSf.exe
  2⤵
  PID:7968
- C:\Windows\System\wrQcubj.exe
  C:\Windows\System\wrQcubj.exe
  2⤵
  PID:8024
- C:\Windows\System\NVsbOOe.exe
  C:\Windows\System\NVsbOOe.exe
  2⤵
  PID:8076
- C:\Windows\System\kptcwlF.exe
  C:\Windows\System\kptcwlF.exe
  2⤵
  PID:8140
- C:\Windows\System\TAdgBuO.exe
  C:\Windows\System\TAdgBuO.exe
  2⤵
  PID:6896
- C:\Windows\System\vOHugyk.exe
  C:\Windows\System\vOHugyk.exe
  2⤵
  PID:8424
- C:\Windows\System\SXDRaXB.exe
  C:\Windows\System\SXDRaXB.exe
  2⤵
  PID:8664
- C:\Windows\System\UFhNisH.exe
  C:\Windows\System\UFhNisH.exe
  2⤵
  PID:8696
- C:\Windows\System\ArYlHBP.exe
  C:\Windows\System\ArYlHBP.exe
  2⤵
  PID:8732
- C:\Windows\System\xHubGQA.exe
  C:\Windows\System\xHubGQA.exe
  2⤵
  PID:5808
- C:\Windows\System\iItmHoP.exe
  C:\Windows\System\iItmHoP.exe
  2⤵
  PID:6256
- C:\Windows\System\XmoYzym.exe
  C:\Windows\System\XmoYzym.exe
  2⤵
  PID:6308
- C:\Windows\System\EAESsoS.exe
  C:\Windows\System\EAESsoS.exe
  2⤵
  PID:3424
- C:\Windows\System\ykQWNGH.exe
  C:\Windows\System\ykQWNGH.exe
  2⤵
  PID:6160
- C:\Windows\System\cbpqFVt.exe
  C:\Windows\System\cbpqFVt.exe
  2⤵
  PID:7392
- C:\Windows\System\oJGgLLY.exe
  C:\Windows\System\oJGgLLY.exe
  2⤵
  PID:9228
- C:\Windows\System\zCIuwPr.exe
  C:\Windows\System\zCIuwPr.exe
  2⤵
  PID:9252
- C:\Windows\System\csyknAD.exe
  C:\Windows\System\csyknAD.exe
  2⤵
  PID:9272
- C:\Windows\System\ycJcpMe.exe
  C:\Windows\System\ycJcpMe.exe
  2⤵
  PID:9292
- C:\Windows\System\fpiqlhY.exe
  C:\Windows\System\fpiqlhY.exe
  2⤵
  PID:9312
- C:\Windows\System\XxceJkN.exe
  C:\Windows\System\XxceJkN.exe
  2⤵
  PID:9340
- C:\Windows\System\YQfhODI.exe
  C:\Windows\System\YQfhODI.exe
  2⤵
  PID:9380
- C:\Windows\System\USRMkEe.exe
  C:\Windows\System\USRMkEe.exe
  2⤵
  PID:9400
- C:\Windows\System\pmUbwNL.exe
  C:\Windows\System\pmUbwNL.exe
  2⤵
  PID:9428
- C:\Windows\System\oGBMZLB.exe
  C:\Windows\System\oGBMZLB.exe
  2⤵
  PID:9448
- C:\Windows\System\lyeTGGd.exe
  C:\Windows\System\lyeTGGd.exe
  2⤵
  PID:9464
- C:\Windows\System\PYAwaeC.exe
  C:\Windows\System\PYAwaeC.exe
  2⤵
  PID:9484
- C:\Windows\System\fvJWflo.exe
  C:\Windows\System\fvJWflo.exe
  2⤵
  PID:9508
- C:\Windows\System\HCKsBbu.exe
  C:\Windows\System\HCKsBbu.exe
  2⤵
  PID:9532
- C:\Windows\System\BFRzTpK.exe
  C:\Windows\System\BFRzTpK.exe
  2⤵
  PID:9564
- C:\Windows\System\xJatpTw.exe
  C:\Windows\System\xJatpTw.exe
  2⤵
  PID:9580
- C:\Windows\System\LHwCfOV.exe
  C:\Windows\System\LHwCfOV.exe
  2⤵
  PID:9596
- C:\Windows\System\EKiFxkU.exe
  C:\Windows\System\EKiFxkU.exe
  2⤵
  PID:9612
- C:\Windows\System\Czocezb.exe
  C:\Windows\System\Czocezb.exe
  2⤵
  PID:9628
- C:\Windows\System\mqcKwiC.exe
  C:\Windows\System\mqcKwiC.exe
  2⤵
  PID:9644
- C:\Windows\System\EKjlzYp.exe
  C:\Windows\System\EKjlzYp.exe
  2⤵
  PID:9668
- C:\Windows\System\wxyUzsx.exe
  C:\Windows\System\wxyUzsx.exe
  2⤵
  PID:9688
- C:\Windows\System\BMunihi.exe
  C:\Windows\System\BMunihi.exe
  2⤵
  PID:9712
- C:\Windows\System\MeRLwKH.exe
  C:\Windows\System\MeRLwKH.exe
  2⤵
  PID:9732
- C:\Windows\System\fVdCpXw.exe
  C:\Windows\System\fVdCpXw.exe
  2⤵
  PID:9752
- C:\Windows\System\mNMPouj.exe
  C:\Windows\System\mNMPouj.exe
  2⤵
  PID:9776
- C:\Windows\System\JappuBC.exe
  C:\Windows\System\JappuBC.exe
  2⤵
  PID:9792
- C:\Windows\System\HZTNeoE.exe
  C:\Windows\System\HZTNeoE.exe
  2⤵
  PID:9808
- C:\Windows\System\bsCsFuA.exe
  C:\Windows\System\bsCsFuA.exe
  2⤵
  PID:9832
- C:\Windows\System\yRKaVfx.exe
  C:\Windows\System\yRKaVfx.exe
  2⤵
  PID:9852
- C:\Windows\System\gmYxvhj.exe
  C:\Windows\System\gmYxvhj.exe
  2⤵
  PID:9880
- C:\Windows\System\aoIVkHT.exe
  C:\Windows\System\aoIVkHT.exe
  2⤵
  PID:9904
- C:\Windows\System\TyPEwoR.exe
  C:\Windows\System\TyPEwoR.exe
  2⤵
  PID:9920
- C:\Windows\System\uWKkOKy.exe
  C:\Windows\System\uWKkOKy.exe
  2⤵
  PID:9952
- C:\Windows\System\jxAJkxS.exe
  C:\Windows\System\jxAJkxS.exe
  2⤵
  PID:9976
- C:\Windows\System\EyWOccG.exe
  C:\Windows\System\EyWOccG.exe
  2⤵
  PID:10000
- C:\Windows\System\NkabGaM.exe
  C:\Windows\System\NkabGaM.exe
  2⤵
  PID:10020
- C:\Windows\System\NeUVpYa.exe
  C:\Windows\System\NeUVpYa.exe
  2⤵
  PID:10040
- C:\Windows\System\tXkcPSy.exe
  C:\Windows\System\tXkcPSy.exe
  2⤵
  PID:10064
- C:\Windows\System\TTlIPUp.exe
  C:\Windows\System\TTlIPUp.exe
  2⤵
  PID:10088
- C:\Windows\System\HJZFQNO.exe
  C:\Windows\System\HJZFQNO.exe
  2⤵
  PID:10108
- C:\Windows\System\bRSNDIs.exe
  C:\Windows\System\bRSNDIs.exe
  2⤵
  PID:10132
- C:\Windows\System\TdcwMSo.exe
  C:\Windows\System\TdcwMSo.exe
  2⤵
  PID:10156
- C:\Windows\System\GpkhlxS.exe
  C:\Windows\System\GpkhlxS.exe
  2⤵
  PID:10176
- C:\Windows\System\RZpPHwR.exe
  C:\Windows\System\RZpPHwR.exe
  2⤵
  PID:10200
- C:\Windows\System\HDGYISO.exe
  C:\Windows\System\HDGYISO.exe
  2⤵
  PID:10220
- C:\Windows\System\YVSPaoB.exe
  C:\Windows\System\YVSPaoB.exe
  2⤵
  PID:7496
- C:\Windows\System\ydVmYAm.exe
  C:\Windows\System\ydVmYAm.exe
  2⤵
  PID:6740
- C:\Windows\System\juPcudr.exe
  C:\Windows\System\juPcudr.exe
  2⤵
  PID:7992
- C:\Windows\System\JGqktfM.exe
  C:\Windows\System\JGqktfM.exe
  2⤵
  PID:8816
- C:\Windows\System\EgkgtCY.exe
  C:\Windows\System\EgkgtCY.exe
  2⤵
  PID:2100
- C:\Windows\System\XmWjOnK.exe
  C:\Windows\System\XmWjOnK.exe
  2⤵
  PID:6376
- C:\Windows\System\rSEocdU.exe
  C:\Windows\System\rSEocdU.exe
  2⤵
  PID:6708
- C:\Windows\System\LbMPoNC.exe
  C:\Windows\System\LbMPoNC.exe
  2⤵
  PID:9004
- C:\Windows\System\kBahOpZ.exe
  C:\Windows\System\kBahOpZ.exe
  2⤵
  PID:8288
- C:\Windows\System\RytQRoE.exe
  C:\Windows\System\RytQRoE.exe
  2⤵
  PID:8332
- C:\Windows\System\ERttzwC.exe
  C:\Windows\System\ERttzwC.exe
  2⤵
  PID:8360
- C:\Windows\System\BsEoSHA.exe
  C:\Windows\System\BsEoSHA.exe
  2⤵
  PID:5064
- C:\Windows\System\RDCzWhP.exe
  C:\Windows\System\RDCzWhP.exe
  2⤵
  PID:7304
- C:\Windows\System\FrhPoKA.exe
  C:\Windows\System\FrhPoKA.exe
  2⤵
  PID:8536
- C:\Windows\System\JJOVSKD.exe
  C:\Windows\System\JJOVSKD.exe
  2⤵
  PID:6784
- C:\Windows\System\mFUJJQG.exe
  C:\Windows\System\mFUJJQG.exe
  2⤵
  PID:7860
- C:\Windows\System\domlZBl.exe
  C:\Windows\System\domlZBl.exe
  2⤵
  PID:8032
- C:\Windows\System\joSJIKt.exe
  C:\Windows\System\joSJIKt.exe
  2⤵
  PID:8832
- C:\Windows\System\qPMGTGH.exe
  C:\Windows\System\qPMGTGH.exe
  2⤵
  PID:9480
- C:\Windows\System\wGCskIB.exe
  C:\Windows\System\wGCskIB.exe
  2⤵
  PID:8868
- C:\Windows\System\naJYOXW.exe
  C:\Windows\System\naJYOXW.exe
  2⤵
  PID:8896
- C:\Windows\System\AyHbFLW.exe
  C:\Windows\System\AyHbFLW.exe
  2⤵
  PID:8952
- C:\Windows\System\AkiEoms.exe
  C:\Windows\System\AkiEoms.exe
  2⤵
  PID:1040
- C:\Windows\System\gxroqSG.exe
  C:\Windows\System\gxroqSG.exe
  2⤵
  PID:4644
- C:\Windows\System\RvYZXTA.exe
  C:\Windows\System\RvYZXTA.exe
  2⤵
  PID:10244
- C:\Windows\System\OmpUbBU.exe
  C:\Windows\System\OmpUbBU.exe
  2⤵
  PID:10260
- C:\Windows\System\JJEkbed.exe
  C:\Windows\System\JJEkbed.exe
  2⤵
  PID:10276
- C:\Windows\System\lHgPgsi.exe
  C:\Windows\System\lHgPgsi.exe
  2⤵
  PID:10292
- C:\Windows\System\qceAfck.exe
  C:\Windows\System\qceAfck.exe
  2⤵
  PID:10308
- C:\Windows\System\TUtVEkL.exe
  C:\Windows\System\TUtVEkL.exe
  2⤵
  PID:10328
- C:\Windows\System\SDAzPJl.exe
  C:\Windows\System\SDAzPJl.exe
  2⤵
  PID:10348
- C:\Windows\System\mXtwCFi.exe
  C:\Windows\System\mXtwCFi.exe
  2⤵
  PID:10368
- C:\Windows\System\QOjkzux.exe
  C:\Windows\System\QOjkzux.exe
  2⤵
  PID:10388
- C:\Windows\System\MwKEtSp.exe
  C:\Windows\System\MwKEtSp.exe
  2⤵
  PID:10412
- C:\Windows\System\lGoYHCX.exe
  C:\Windows\System\lGoYHCX.exe
  2⤵
  PID:10436
- C:\Windows\System\ANOEMTx.exe
  C:\Windows\System\ANOEMTx.exe
  2⤵
  PID:10452
- C:\Windows\System\jRzyndM.exe
  C:\Windows\System\jRzyndM.exe
  2⤵
  PID:10476
- C:\Windows\System\GSCCbGA.exe
  C:\Windows\System\GSCCbGA.exe
  2⤵
  PID:10500
- C:\Windows\System\eumNekp.exe
  C:\Windows\System\eumNekp.exe
  2⤵
  PID:10528
- C:\Windows\System\NeEGcWt.exe
  C:\Windows\System\NeEGcWt.exe
  2⤵
  PID:10544
- C:\Windows\System\aZkfERf.exe
  C:\Windows\System\aZkfERf.exe
  2⤵
  PID:10568
- C:\Windows\System\wuuVWpb.exe
  C:\Windows\System\wuuVWpb.exe
  2⤵
  PID:10588
- C:\Windows\System\SpGrDkN.exe
  C:\Windows\System\SpGrDkN.exe
  2⤵
  PID:10604
- C:\Windows\System\xMsphoq.exe
  C:\Windows\System\xMsphoq.exe
  2⤵
  PID:10624
- C:\Windows\System\UZiEGSr.exe
  C:\Windows\System\UZiEGSr.exe
  2⤵
  PID:10644
- C:\Windows\System\WZmMbDg.exe
  C:\Windows\System\WZmMbDg.exe
  2⤵
  PID:10672
- C:\Windows\System\FLXPZwk.exe
  C:\Windows\System\FLXPZwk.exe
  2⤵
  PID:10692
- C:\Windows\System\PqbZuUI.exe
  C:\Windows\System\PqbZuUI.exe
  2⤵
  PID:10716
- C:\Windows\System\hBTaVbP.exe
  C:\Windows\System\hBTaVbP.exe
  2⤵
  PID:10732
- C:\Windows\System\fguEkaO.exe
  C:\Windows\System\fguEkaO.exe
  2⤵
  PID:10756
- C:\Windows\System\SRsImSA.exe
  C:\Windows\System\SRsImSA.exe
  2⤵
  PID:10772
- C:\Windows\System\zSKnORL.exe
  C:\Windows\System\zSKnORL.exe
  2⤵
  PID:10796
- C:\Windows\System\zaCrVPf.exe
  C:\Windows\System\zaCrVPf.exe
  2⤵
  PID:10820
- C:\Windows\System\YqUgzWP.exe
  C:\Windows\System\YqUgzWP.exe
  2⤵
  PID:10844
- C:\Windows\System\UCiAvyd.exe
  C:\Windows\System\UCiAvyd.exe
  2⤵
  PID:10860
- C:\Windows\System\nXusHkX.exe
  C:\Windows\System\nXusHkX.exe
  2⤵
  PID:10876
- C:\Windows\System\VPwRJUy.exe
  C:\Windows\System\VPwRJUy.exe
  2⤵
  PID:10904
- C:\Windows\System\WphlobA.exe
  C:\Windows\System\WphlobA.exe
  2⤵
  PID:10928
- C:\Windows\System\iEenCzj.exe
  C:\Windows\System\iEenCzj.exe
  2⤵
  PID:10948
- C:\Windows\System\xodqFlX.exe
  C:\Windows\System\xodqFlX.exe
  2⤵
  PID:10972
- C:\Windows\System\iLJZkxW.exe
  C:\Windows\System\iLJZkxW.exe
  2⤵
  PID:10992
- C:\Windows\System\VRTbwkb.exe
  C:\Windows\System\VRTbwkb.exe
  2⤵
  PID:11024
- C:\Windows\System\jpuZYJC.exe
  C:\Windows\System\jpuZYJC.exe
  2⤵
  PID:11040
- C:\Windows\System\wLfYFZh.exe
  C:\Windows\System\wLfYFZh.exe
  2⤵
  PID:11060
- C:\Windows\System\EQDjxhl.exe
  C:\Windows\System\EQDjxhl.exe
  2⤵
  PID:11088
- C:\Windows\System\sbTxkfp.exe
  C:\Windows\System\sbTxkfp.exe
  2⤵
  PID:11108
- C:\Windows\System\NLzwYPh.exe
  C:\Windows\System\NLzwYPh.exe
  2⤵
  PID:11128
- C:\Windows\System\dCMhlsj.exe
  C:\Windows\System\dCMhlsj.exe
  2⤵
  PID:11148
- C:\Windows\System\hcHQEjZ.exe
  C:\Windows\System\hcHQEjZ.exe
  2⤵
  PID:11172
- C:\Windows\System\IIBSTqk.exe
  C:\Windows\System\IIBSTqk.exe
  2⤵
  PID:11196
- C:\Windows\System\zBXDKwN.exe
  C:\Windows\System\zBXDKwN.exe
  2⤵
  PID:11216
- C:\Windows\System\FaBzqNS.exe
  C:\Windows\System\FaBzqNS.exe
  2⤵
  PID:11260
- C:\Windows\System\aOKKxLO.exe
  C:\Windows\System\aOKKxLO.exe
  2⤵
  PID:9064
- C:\Windows\System\FIhMtSQ.exe
  C:\Windows\System\FIhMtSQ.exe
  2⤵
  PID:9092
- C:\Windows\System\plsqcxR.exe
  C:\Windows\System\plsqcxR.exe
  2⤵
  PID:9132
- C:\Windows\System\idkOmBZ.exe
  C:\Windows\System\idkOmBZ.exe
  2⤵
  PID:9172
- C:\Windows\System\HBJCdwb.exe
  C:\Windows\System\HBJCdwb.exe
  2⤵
  PID:244
- C:\Windows\System\jfrbCLT.exe
  C:\Windows\System\jfrbCLT.exe
  2⤵
  PID:9984
- C:\Windows\System\TIxZOeH.exe
  C:\Windows\System\TIxZOeH.exe
  2⤵
  PID:10036
- C:\Windows\System\WanUBGD.exe
  C:\Windows\System\WanUBGD.exe
  2⤵
  PID:10116
- C:\Windows\System\nRpFWqb.exe
  C:\Windows\System\nRpFWqb.exe
  2⤵
  PID:9284
- C:\Windows\System\PPhrLtW.exe
  C:\Windows\System\PPhrLtW.exe
  2⤵
  PID:7628
- C:\Windows\System\WvZEnzO.exe
  C:\Windows\System\WvZEnzO.exe
  2⤵
  PID:9376
- C:\Windows\System\lfFkRdp.exe
  C:\Windows\System\lfFkRdp.exe
  2⤵
  PID:8116
- C:\Windows\System\UQGokoX.exe
  C:\Windows\System\UQGokoX.exe
  2⤵
  PID:7720
- C:\Windows\System\BQNgCGE.exe
  C:\Windows\System\BQNgCGE.exe
  2⤵
  PID:9608
- C:\Windows\System\CZyDsWD.exe
  C:\Windows\System\CZyDsWD.exe
  2⤵
  PID:9652
- C:\Windows\System\fbhKmUM.exe
  C:\Windows\System\fbhKmUM.exe
  2⤵
  PID:8716
- C:\Windows\System\VrCMufH.exe
  C:\Windows\System\VrCMufH.exe
  2⤵
  PID:11280
- C:\Windows\System\KiEXePP.exe
  C:\Windows\System\KiEXePP.exe
  2⤵
  PID:11296
- C:\Windows\System\LwSFNUd.exe
  C:\Windows\System\LwSFNUd.exe
  2⤵
  PID:11328
- C:\Windows\System\VlcPhpG.exe
  C:\Windows\System\VlcPhpG.exe
  2⤵
  PID:11356
- C:\Windows\System\sBtQvYE.exe
  C:\Windows\System\sBtQvYE.exe
  2⤵
  PID:11388
- C:\Windows\System\OhXZfAf.exe
  C:\Windows\System\OhXZfAf.exe
  2⤵
  PID:11404
- C:\Windows\System\IEzWJNa.exe
  C:\Windows\System\IEzWJNa.exe
  2⤵
  PID:11420
- C:\Windows\System\qSgYIMb.exe
  C:\Windows\System\qSgYIMb.exe
  2⤵
  PID:11436
- C:\Windows\System\OfEjIjy.exe
  C:\Windows\System\OfEjIjy.exe
  2⤵
  PID:11452
- C:\Windows\System\ZSxEJCm.exe
  C:\Windows\System\ZSxEJCm.exe
  2⤵
  PID:11468
- C:\Windows\System\gcMaLIa.exe
  C:\Windows\System\gcMaLIa.exe
  2⤵
  PID:11484
- C:\Windows\System\UhfqtFk.exe
  C:\Windows\System\UhfqtFk.exe
  2⤵
  PID:11508
- C:\Windows\System\SbpIEAV.exe
  C:\Windows\System\SbpIEAV.exe
  2⤵
  PID:11532
- C:\Windows\System\aieUHlY.exe
  C:\Windows\System\aieUHlY.exe
  2⤵
  PID:11560
- C:\Windows\System\LnaTyug.exe
  C:\Windows\System\LnaTyug.exe
  2⤵
  PID:11628
- C:\Windows\System\LmQAwQS.exe
  C:\Windows\System\LmQAwQS.exe
  2⤵
  PID:11648
- C:\Windows\System\TiKJpRT.exe
  C:\Windows\System\TiKJpRT.exe
  2⤵
  PID:11668
- C:\Windows\System\FWNmXCr.exe
  C:\Windows\System\FWNmXCr.exe
  2⤵
  PID:11692
- C:\Windows\System\SdyPgtu.exe
  C:\Windows\System\SdyPgtu.exe
  2⤵
  PID:11712
- C:\Windows\System\fcxqhuw.exe
  C:\Windows\System\fcxqhuw.exe
  2⤵
  PID:11732
- C:\Windows\System\FbCQNVl.exe
  C:\Windows\System\FbCQNVl.exe
  2⤵
  PID:11748
- C:\Windows\System\cZqJadW.exe
  C:\Windows\System\cZqJadW.exe
  2⤵
  PID:11764
- C:\Windows\System\CkwjiBn.exe
  C:\Windows\System\CkwjiBn.exe
  2⤵
  PID:11780
- C:\Windows\System\hiwszej.exe
  C:\Windows\System\hiwszej.exe
  2⤵
  PID:11796
- C:\Windows\System\hFCapEm.exe
  C:\Windows\System\hFCapEm.exe
  2⤵
  PID:11816
- C:\Windows\System\CPmGyBW.exe
  C:\Windows\System\CPmGyBW.exe
  2⤵
  PID:11836
- C:\Windows\System\TEUNMyw.exe
  C:\Windows\System\TEUNMyw.exe
  2⤵
  PID:11852
- C:\Windows\System\zsLYgjz.exe
  C:\Windows\System\zsLYgjz.exe
  2⤵
  PID:11872
- C:\Windows\System\NRHRlaX.exe
  C:\Windows\System\NRHRlaX.exe
  2⤵
  PID:11892
- C:\Windows\System\MTisrAC.exe
  C:\Windows\System\MTisrAC.exe
  2⤵
  PID:11916
- C:\Windows\System\cBPyaRK.exe
  C:\Windows\System\cBPyaRK.exe
  2⤵
  PID:11944
- C:\Windows\System\fzUAxxR.exe
  C:\Windows\System\fzUAxxR.exe
  2⤵
  PID:11960
- C:\Windows\System\dvsNMZM.exe
  C:\Windows\System\dvsNMZM.exe
  2⤵
  PID:11980
- C:\Windows\System\HaPrJAD.exe
  C:\Windows\System\HaPrJAD.exe
  2⤵
  PID:11996
- C:\Windows\System\HGmwAKh.exe
  C:\Windows\System\HGmwAKh.exe
  2⤵
  PID:12020
- C:\Windows\System\kRtFJdc.exe
  C:\Windows\System\kRtFJdc.exe
  2⤵
  PID:12040
- C:\Windows\System\gspWspg.exe
  C:\Windows\System\gspWspg.exe
  2⤵
  PID:12060
- C:\Windows\System\sDnfRuW.exe
  C:\Windows\System\sDnfRuW.exe
  2⤵
  PID:12080
- C:\Windows\System\WHDNSOx.exe
  C:\Windows\System\WHDNSOx.exe
  2⤵
  PID:12108
- C:\Windows\System\HTzIrQU.exe
  C:\Windows\System\HTzIrQU.exe
  2⤵
  PID:12132
- C:\Windows\System\xISJRZP.exe
  C:\Windows\System\xISJRZP.exe
  2⤵
  PID:12152
- C:\Windows\System\fZzQIUZ.exe
  C:\Windows\System\fZzQIUZ.exe
  2⤵
  PID:12172
- C:\Windows\System\qnmAtjw.exe
  C:\Windows\System\qnmAtjw.exe
  2⤵
  PID:12196
- C:\Windows\System\QXrAKHG.exe
  C:\Windows\System\QXrAKHG.exe
  2⤵
  PID:12216
- C:\Windows\System\cfZMmwb.exe
  C:\Windows\System\cfZMmwb.exe
  2⤵
  PID:12240
- C:\Windows\System\SIEbWhe.exe
  C:\Windows\System\SIEbWhe.exe
  2⤵
  PID:12264
- C:\Windows\System\WQbYOqm.exe
  C:\Windows\System\WQbYOqm.exe
  2⤵
  PID:12284
- C:\Windows\System\MUlPwHM.exe
  C:\Windows\System\MUlPwHM.exe
  2⤵
  PID:1440
- C:\Windows\System\nIGtKMd.exe
  C:\Windows\System\nIGtKMd.exe
  2⤵
  PID:3660
- C:\Windows\System\jlknfNM.exe
  C:\Windows\System\jlknfNM.exe
  2⤵
  PID:8776
- C:\Windows\System\sAJOtIE.exe
  C:\Windows\System\sAJOtIE.exe
  2⤵
  PID:8444
- C:\Windows\System\mEZKVqg.exe
  C:\Windows\System\mEZKVqg.exe
  2⤵
  PID:10728
- C:\Windows\System\DfSSwDj.exe
  C:\Windows\System\DfSSwDj.exe
  2⤵
  PID:10788
- C:\Windows\System\xYQpufh.exe
  C:\Windows\System\xYQpufh.exe
  2⤵
  PID:10868
- C:\Windows\System\sdJuoFN.exe
  C:\Windows\System\sdJuoFN.exe
  2⤵
  PID:10212
- C:\Windows\System\POpnWFw.exe
  C:\Windows\System\POpnWFw.exe
  2⤵
  PID:10988
- C:\Windows\System\lowsAjz.exe
  C:\Windows\System\lowsAjz.exe
  2⤵
  PID:11208
- C:\Windows\System\kuDhRhc.exe
  C:\Windows\System\kuDhRhc.exe
  2⤵
  PID:8428
- C:\Windows\System\wHwCiKa.exe
  C:\Windows\System\wHwCiKa.exe
  2⤵
  PID:9476
- C:\Windows\System\yFczvUw.exe
  C:\Windows\System\yFczvUw.exe
  2⤵
  PID:9524
- C:\Windows\System\WNiYnms.exe
  C:\Windows\System\WNiYnms.exe
  2⤵
  PID:9572
- C:\Windows\System\vofQyPd.exe
  C:\Windows\System\vofQyPd.exe
  2⤵
  PID:1304
- C:\Windows\System\aPrFOBR.exe
  C:\Windows\System\aPrFOBR.exe
  2⤵
  PID:8556
- C:\Windows\System\LNWsOsn.exe
  C:\Windows\System\LNWsOsn.exe
  2⤵
  PID:11276
- C:\Windows\System\NQVQHCh.exe
  C:\Windows\System\NQVQHCh.exe
  2⤵
  PID:7816
- C:\Windows\System\EtxjBGX.exe
  C:\Windows\System\EtxjBGX.exe
  2⤵
  PID:11384
- C:\Windows\System\CWvvfQQ.exe
  C:\Windows\System\CWvvfQQ.exe
  2⤵
  PID:12304
- C:\Windows\System\RcJVoQd.exe
  C:\Windows\System\RcJVoQd.exe
  2⤵
  PID:12320
- C:\Windows\System\sSmZnAx.exe
  C:\Windows\System\sSmZnAx.exe
  2⤵
  PID:12336
- C:\Windows\System\ZMNmpIu.exe
  C:\Windows\System\ZMNmpIu.exe
  2⤵
  PID:12352
- C:\Windows\System\PqnnIfJ.exe
  C:\Windows\System\PqnnIfJ.exe
  2⤵
  PID:12368
- C:\Windows\System\HlVQZwo.exe
  C:\Windows\System\HlVQZwo.exe
  2⤵
  PID:12384
- C:\Windows\System\AiPsjqy.exe
  C:\Windows\System\AiPsjqy.exe
  2⤵
  PID:12400
- C:\Windows\System\jMibULM.exe
  C:\Windows\System\jMibULM.exe
  2⤵
  PID:12420
- C:\Windows\System\ZOaNWKh.exe
  C:\Windows\System\ZOaNWKh.exe
  2⤵
  PID:12440
- C:\Windows\System\XvkWbiJ.exe
  C:\Windows\System\XvkWbiJ.exe
  2⤵
  PID:12460
- C:\Windows\System\KnWuMMY.exe
  C:\Windows\System\KnWuMMY.exe
  2⤵
  PID:12484
- C:\Windows\System\NkBUZHi.exe
  C:\Windows\System\NkBUZHi.exe
  2⤵
  PID:12500
- C:\Windows\System\XpyHxwS.exe
  C:\Windows\System\XpyHxwS.exe
  2⤵
  PID:12524
- C:\Windows\System\DizdAoM.exe
  C:\Windows\System\DizdAoM.exe
  2⤵
  PID:12564
- C:\Windows\System\gVMRGrJ.exe
  C:\Windows\System\gVMRGrJ.exe
  2⤵
  PID:12580
- C:\Windows\System\sMLMjzQ.exe
  C:\Windows\System\sMLMjzQ.exe
  2⤵
  PID:12596
- C:\Windows\System\wogUoYk.exe
  C:\Windows\System\wogUoYk.exe
  2⤵
  PID:12612
- C:\Windows\System\BFatuqA.exe
  C:\Windows\System\BFatuqA.exe
  2⤵
  PID:12636
- C:\Windows\System\YsJwsRo.exe
  C:\Windows\System\YsJwsRo.exe
  2⤵
  PID:12656
- C:\Windows\System\yDGIDHX.exe
  C:\Windows\System\yDGIDHX.exe
  2⤵
  PID:12676
- C:\Windows\System\DZGSUZx.exe
  C:\Windows\System\DZGSUZx.exe
  2⤵
  PID:12700
- C:\Windows\System\xqivLKa.exe
  C:\Windows\System\xqivLKa.exe
  2⤵
  PID:12720
- C:\Windows\System\VehwDwv.exe
  C:\Windows\System\VehwDwv.exe
  2⤵
  PID:12740
- C:\Windows\System\qKZoNRG.exe
  C:\Windows\System\qKZoNRG.exe
  2⤵
  PID:12764
- C:\Windows\System\pRPZlfs.exe
  C:\Windows\System\pRPZlfs.exe
  2⤵
  PID:12780
- C:\Windows\System\IGcTjwd.exe
  C:\Windows\System\IGcTjwd.exe
  2⤵
  PID:12804
- C:\Windows\System\IbCHNvV.exe
  C:\Windows\System\IbCHNvV.exe
  2⤵
  PID:12828
- C:\Windows\System\juRfyKY.exe
  C:\Windows\System\juRfyKY.exe
  2⤵
  PID:12848
- C:\Windows\System\yuQvvYF.exe
  C:\Windows\System\yuQvvYF.exe
  2⤵
  PID:12872
- C:\Windows\System\saEsPwg.exe
  C:\Windows\System\saEsPwg.exe
  2⤵
  PID:12888
- C:\Windows\System\UtJvSil.exe
  C:\Windows\System\UtJvSil.exe
  2⤵
  PID:12912
- C:\Windows\System\hSnQaSL.exe
  C:\Windows\System\hSnQaSL.exe
  2⤵
  PID:12936
- C:\Windows\System\tXsudmv.exe
  C:\Windows\System\tXsudmv.exe
  2⤵
  PID:12952
- C:\Windows\System\quKKuBY.exe
  C:\Windows\System\quKKuBY.exe
  2⤵
  PID:12968
- C:\Windows\System\WUHHUWj.exe
  C:\Windows\System\WUHHUWj.exe
  2⤵
  PID:12988
- C:\Windows\System\XSnmLnQ.exe
  C:\Windows\System\XSnmLnQ.exe
  2⤵
  PID:13008
- C:\Windows\System\PCBPCaP.exe
  C:\Windows\System\PCBPCaP.exe
  2⤵
  PID:13036
- C:\Windows\System\HNeosFw.exe
  C:\Windows\System\HNeosFw.exe
  2⤵
  PID:13060
- C:\Windows\System\EBcarQw.exe
  C:\Windows\System\EBcarQw.exe
  2⤵
  PID:13080
- C:\Windows\System\UKOcvJl.exe
  C:\Windows\System\UKOcvJl.exe
  2⤵
  PID:13100
- C:\Windows\System\XmbZuIY.exe
  C:\Windows\System\XmbZuIY.exe
  2⤵
  PID:13124
- C:\Windows\System\ERWhRiT.exe
  C:\Windows\System\ERWhRiT.exe
  2⤵
  PID:13144
- C:\Windows\System\ppBYsPO.exe
  C:\Windows\System\ppBYsPO.exe
  2⤵
  PID:13160
- C:\Windows\System\HkViLPy.exe
  C:\Windows\System\HkViLPy.exe
  2⤵
  PID:13180
- C:\Windows\System\EtrLvYo.exe
  C:\Windows\System\EtrLvYo.exe
  2⤵
  PID:13200
- C:\Windows\System\VJkbWNi.exe
  C:\Windows\System\VJkbWNi.exe
  2⤵
  PID:13220
- C:\Windows\System\jwMidwf.exe
  C:\Windows\System\jwMidwf.exe
  2⤵
  PID:13252
- C:\Windows\System\DxpLOVZ.exe
  C:\Windows\System\DxpLOVZ.exe
  2⤵
  PID:13268
- C:\Windows\System\lHZTRbp.exe
  C:\Windows\System\lHZTRbp.exe
  2⤵
  PID:13288
- C:\Windows\System\CkjjImJ.exe
  C:\Windows\System\CkjjImJ.exe
  2⤵
  PID:13308
- C:\Windows\System\kYzmfgo.exe
  C:\Windows\System\kYzmfgo.exe
  2⤵
  PID:9760
- C:\Windows\System\LKnNYiV.exe
  C:\Windows\System\LKnNYiV.exe
  2⤵
  PID:9472
- C:\Windows\System\fKOZxJr.exe
  C:\Windows\System\fKOZxJr.exe
  2⤵
  PID:4372
- C:\Windows\System\hQqgKsZ.exe
  C:\Windows\System\hQqgKsZ.exe
  2⤵
  PID:8408
- C:\Windows\System\XOcogoB.exe
  C:\Windows\System\XOcogoB.exe
  2⤵
  PID:9544
- C:\Windows\System\fGuRjNZ.exe
  C:\Windows\System\fGuRjNZ.exe
  2⤵
  PID:11340
- C:\Windows\System\LswAjny.exe
  C:\Windows\System\LswAjny.exe
  2⤵
  PID:12296
- C:\Windows\System\BreJNzL.exe
  C:\Windows\System\BreJNzL.exe
  2⤵
  PID:12328
- C:\Windows\System\NjeKSrX.exe
  C:\Windows\System\NjeKSrX.exe
  2⤵
  PID:12364
- C:\Windows\System\zEDceAe.exe
  C:\Windows\System\zEDceAe.exe
  2⤵
  PID:12412
- C:\Windows\System\XWPsaNO.exe
  C:\Windows\System\XWPsaNO.exe
  2⤵
  PID:3680
- C:\Windows\System\WuuPZpG.exe
  C:\Windows\System\WuuPZpG.exe
  2⤵
  PID:13092
- C:\Windows\System\iLpyTZH.exe
  C:\Windows\System\iLpyTZH.exe
  2⤵
  PID:4352
- C:\Windows\System\QBLupkn.exe
  C:\Windows\System\QBLupkn.exe
  2⤵
  PID:8384
- C:\Windows\System\nQoTsym.exe
  C:\Windows\System\nQoTsym.exe
  2⤵
  PID:12204
- C:\Windows\System\HeObqgY.exe
  C:\Windows\System\HeObqgY.exe
  2⤵
  PID:12212
- C:\Windows\System\iGFDoEu.exe
  C:\Windows\System\iGFDoEu.exe
  2⤵
  PID:1528
- C:\Windows\System\pOvnyWk.exe
  C:\Windows\System\pOvnyWk.exe
  2⤵
  PID:10080
- C:\Windows\System\eEecORI.exe
  C:\Windows\System\eEecORI.exe
  2⤵
  PID:11156
- C:\Windows\System\cqiirmT.exe
  C:\Windows\System\cqiirmT.exe
  2⤵
  PID:11116
- C:\Windows\System\dJhWSre.exe
  C:\Windows\System\dJhWSre.exe
  2⤵
  PID:10340
- C:\Windows\System\zUdYYdN.exe
  C:\Windows\System\zUdYYdN.exe
  2⤵
  PID:8792
- C:\Windows\System\zurmBNC.exe
  C:\Windows\System\zurmBNC.exe
  2⤵
  PID:8964
- C:\Windows\System\XpjmgRq.exe
  C:\Windows\System\XpjmgRq.exe
  2⤵
  PID:8300
- C:\Windows\System\pNXqARu.exe
  C:\Windows\System\pNXqARu.exe
  2⤵
  PID:11036
- C:\Windows\System\WSBsfdt.exe
  C:\Windows\System\WSBsfdt.exe
  2⤵
  PID:1084
- C:\Windows\System\XiWiTGE.exe
  C:\Windows\System\XiWiTGE.exe
  2⤵
  PID:9392
- C:\Windows\System\AZUXrDA.exe
  C:\Windows\System\AZUXrDA.exe
  2⤵
  PID:12468
- C:\Windows\System\DATpOYS.exe
  C:\Windows\System\DATpOYS.exe
  2⤵
  PID:13264
- C:\Windows\System\FCoiESt.exe
  C:\Windows\System\FCoiESt.exe
  2⤵
  PID:9840
- C:\Windows\System\HRPCRCn.exe
  C:\Windows\System\HRPCRCn.exe
  2⤵
  PID:5812
- C:\Windows\System\JOMZbat.exe
  C:\Windows\System\JOMZbat.exe
  2⤵
  PID:9500
- C:\Windows\System\DsJZCVy.exe
  C:\Windows\System\DsJZCVy.exe
  2⤵
  PID:8984
- C:\Windows\System\YXckSrB.exe
  C:\Windows\System\YXckSrB.exe
  2⤵
  PID:12508
- C:\Windows\System\xHCCfzQ.exe
  C:\Windows\System\xHCCfzQ.exe
  2⤵
  PID:10668
- C:\Windows\System\kBQVEId.exe
  C:\Windows\System\kBQVEId.exe
  2⤵
  PID:11644
- C:\Windows\System\fOsUIhG.exe
  C:\Windows\System\fOsUIhG.exe
  2⤵
  PID:12772
- C:\Windows\System\EzvQooa.exe
  C:\Windows\System\EzvQooa.exe
  2⤵
  PID:13232
- C:\Windows\System\vqwEEYt.exe
  C:\Windows\System\vqwEEYt.exe
  2⤵
  PID:11164
- C:\Windows\System\jdrBGPV.exe
  C:\Windows\System\jdrBGPV.exe
  2⤵
  PID:1912
- C:\Windows\System\QFToZmQ.exe
  C:\Windows\System\QFToZmQ.exe
  2⤵
  PID:10380
- C:\Windows\System\yJfhQeE.exe
  C:\Windows\System\yJfhQeE.exe
  2⤵
  PID:3224
- C:\Windows\System\kyrWTpe.exe
  C:\Windows\System\kyrWTpe.exe
  2⤵
  PID:11904
- C:\Windows\System\WgvokGI.exe
  C:\Windows\System\WgvokGI.exe
  2⤵
  PID:13304
- C:\Windows\System\ddHyTlb.exe
  C:\Windows\System\ddHyTlb.exe
  2⤵
  PID:9684
- C:\Windows\System\dgTlYFc.exe
  C:\Windows\System\dgTlYFc.exe
  2⤵
  PID:8796
- C:\Windows\System\djWrgNK.exe
  C:\Windows\System\djWrgNK.exe
  2⤵
  PID:12816
- C:\Windows\System\IdCkcPs.exe
  C:\Windows\System\IdCkcPs.exe
  2⤵
  PID:10468
- C:\Windows\System\kgRwZZy.exe
  C:\Windows\System\kgRwZZy.exe
  2⤵
  PID:11320
- C:\Windows\System\tNuVmua.exe
  C:\Windows\System\tNuVmua.exe
  2⤵
  PID:12436
- C:\Windows\System\jgwNmYd.exe
  C:\Windows\System\jgwNmYd.exe
  2⤵
  PID:12796
- C:\Windows\System\bTbrxwI.exe
  C:\Windows\System\bTbrxwI.exe
  2⤵
  PID:13156
- C:\Windows\System\CeqMBZJ.exe
  C:\Windows\System\CeqMBZJ.exe
  2⤵
  PID:11680
- C:\Windows\System\kuzajUD.exe
  C:\Windows\System\kuzajUD.exe
  2⤵
  PID:13188
- C:\Windows\System\KwjJNXa.exe
  C:\Windows\System\KwjJNXa.exe
  2⤵
  PID:10104
- C:\Windows\System\xnwrlda.exe
  C:\Windows\System\xnwrlda.exe
  2⤵
  PID:10832
- C:\Windows\System\GsdkFVu.exe
  C:\Windows\System\GsdkFVu.exe
  2⤵
  PID:8684
- C:\Windows\System\GevmSVK.exe
  C:\Windows\System\GevmSVK.exe
  2⤵
  PID:11012
- C:\Windows\System\Gtaipbl.exe
  C:\Windows\System\Gtaipbl.exe
  2⤵
  PID:1732
- C:\Windows\System\iggTOYf.exe
  C:\Windows\System\iggTOYf.exe
  2⤵
  PID:12688
- C:\Windows\System\XNlgLiK.exe
  C:\Windows\System\XNlgLiK.exe
  2⤵
  PID:4652
- C:\Windows\System\EQHhPGb.exe
  C:\Windows\System\EQHhPGb.exe
  2⤵
  PID:7964
- C:\Windows\System\gfmAoRR.exe
  C:\Windows\System\gfmAoRR.exe
  2⤵
  PID:5912
- C:\Windows\System\WCfgWJv.exe
  C:\Windows\System\WCfgWJv.exe
  2⤵
  PID:10888
- C:\Windows\System\aNVtRHL.exe
  C:\Windows\System\aNVtRHL.exe
  2⤵
  PID:10556
- C:\Windows\System\JzJLKBE.exe
  C:\Windows\System\JzJLKBE.exe
  2⤵
  PID:13352
- C:\Windows\System\LVaaWNF.exe
  C:\Windows\System\LVaaWNF.exe
  2⤵
  PID:13368
- C:\Windows\System\xZNuYqf.exe
  C:\Windows\System\xZNuYqf.exe
  2⤵
  PID:13388
- C:\Windows\System\tLSqbXQ.exe
  C:\Windows\System\tLSqbXQ.exe
  2⤵
  PID:13416
- C:\Windows\System\fnNREIf.exe
  C:\Windows\System\fnNREIf.exe
  2⤵
  PID:13556
- C:\Windows\System\ykgXlbJ.exe
  C:\Windows\System\ykgXlbJ.exe
  2⤵
  PID:13588
- C:\Windows\System\CaOSEHP.exe
  C:\Windows\System\CaOSEHP.exe
  2⤵
  PID:13708
- C:\Windows\System\TmbiwHg.exe
  C:\Windows\System\TmbiwHg.exe
  2⤵
  PID:13796
- C:\Windows\System\HZXjUkw.exe
  C:\Windows\System\HZXjUkw.exe
  2⤵
  PID:13824
- C:\Windows\System\pAqkRLQ.exe
  C:\Windows\System\pAqkRLQ.exe
  2⤵
  PID:13908
- C:\Windows\System\fDCthAt.exe
  C:\Windows\System\fDCthAt.exe
  2⤵
  PID:13964
- C:\Windows\System\ymgMIYE.exe
  C:\Windows\System\ymgMIYE.exe
  2⤵
  PID:14032
- C:\Windows\System\mIYXtfE.exe
  C:\Windows\System\mIYXtfE.exe
  2⤵
  PID:14068
- C:\Windows\System\ELUNLbY.exe
  C:\Windows\System\ELUNLbY.exe
  2⤵
  PID:14088
- C:\Windows\System\fjLExMW.exe
  C:\Windows\System\fjLExMW.exe
  2⤵
  PID:14296
- C:\Windows\System\tZDADfE.exe
  C:\Windows\System\tZDADfE.exe
  2⤵
  PID:12480
- C:\Windows\System\UwOvjcZ.exe
  C:\Windows\System\UwOvjcZ.exe
  2⤵
  PID:12980
- C:\Windows\System\clsfsdf.exe
  C:\Windows\System\clsfsdf.exe
  2⤵
  PID:7656
- C:\Windows\System\SrkIWeZ.exe
  C:\Windows\System\SrkIWeZ.exe
  2⤵
  PID:11364
- C:\Windows\System\MGxfUHQ.exe
  C:\Windows\System\MGxfUHQ.exe
  2⤵
  PID:13528
- C:\Windows\System\xYqJeMN.exe
  C:\Windows\System\xYqJeMN.exe
  2⤵
  PID:13544
- C:\Windows\System\CdiuXnX.exe
  C:\Windows\System\CdiuXnX.exe
  2⤵
  PID:13696
- C:\Windows\System\tuWewop.exe
  C:\Windows\System\tuWewop.exe
  2⤵
  PID:13752
- C:\Windows\System\MvTVzHr.exe
  C:\Windows\System\MvTVzHr.exe
  2⤵
  PID:13772
- C:\Windows\System\gSHraVy.exe
  C:\Windows\System\gSHraVy.exe
  2⤵
  PID:13668
- C:\Windows\System\jGKlWLj.exe
  C:\Windows\System\jGKlWLj.exe
  2⤵
  PID:13956
- C:\Windows\System\dQbVvOI.exe
  C:\Windows\System\dQbVvOI.exe
  2⤵
  PID:14124
- C:\Windows\System\XwlSsRY.exe
  C:\Windows\System\XwlSsRY.exe
  2⤵
  PID:14104
- C:\Windows\System\tNbpGhk.exe
  C:\Windows\System\tNbpGhk.exe
  2⤵
  PID:14132
- C:\Windows\System\YQQtyDn.exe
  C:\Windows\System\YQQtyDn.exe
  2⤵
  PID:13680
- C:\Windows\System\fQcVcaD.exe
  C:\Windows\System\fQcVcaD.exe
  2⤵
  PID:14168
- C:\Windows\System\WPZIbfu.exe
  C:\Windows\System\WPZIbfu.exe
  2⤵
  PID:14332
- C:\Windows\System\UgYDsoX.exe
  C:\Windows\System\UgYDsoX.exe
  2⤵
  PID:14236
- C:\Windows\System\VILBykb.exe
  C:\Windows\System\VILBykb.exe
  2⤵
  PID:13052
- C:\Windows\System\pDPWfan.exe
  C:\Windows\System\pDPWfan.exe
  2⤵
  PID:13432
- C:\Windows\System\HHuXiGe.exe
  C:\Windows\System\HHuXiGe.exe
  2⤵
  PID:4504
- C:\Windows\System\paVrhcW.exe
  C:\Windows\System\paVrhcW.exe
  2⤵
  PID:4100
- C:\Windows\System\HBIrdOP.exe
  C:\Windows\System\HBIrdOP.exe
  2⤵
  PID:13344
- C:\Windows\System\fJghtUN.exe
  C:\Windows\System\fJghtUN.exe
  2⤵
  PID:6760
- C:\Windows\System\vOGVmJC.exe
  C:\Windows\System\vOGVmJC.exe
  2⤵
  PID:13472
- C:\Windows\System\ESjUIKU.exe
  C:\Windows\System\ESjUIKU.exe
  2⤵
  PID:5324
- C:\Windows\System\uWzpoBY.exe
  C:\Windows\System\uWzpoBY.exe
  2⤵
  PID:2944
- C:\Windows\System\epDYWEo.exe
  C:\Windows\System\epDYWEo.exe
  2⤵
  PID:13408
- C:\Windows\System\yaQnnMY.exe
  C:\Windows\System\yaQnnMY.exe
  2⤵
  PID:4656
- C:\Windows\System\LJDOfWs.exe
  C:\Windows\System\LJDOfWs.exe
  2⤵
  PID:14008
- C:\Windows\System\AeCrdwa.exe
  C:\Windows\System\AeCrdwa.exe
  2⤵
  PID:13960
- C:\Windows\System\ihAEOdI.exe
  C:\Windows\System\ihAEOdI.exe
  2⤵
  PID:13980
- C:\Windows\System\VpvQHQR.exe
  C:\Windows\System\VpvQHQR.exe
  2⤵
  PID:3400
- C:\Windows\System\BEEiSxs.exe
  C:\Windows\System\BEEiSxs.exe
  2⤵
  PID:13928
- C:\Windows\System\JCxKnbY.exe
  C:\Windows\System\JCxKnbY.exe
  2⤵
  PID:14208
- C:\Windows\System\HhbBwnb.exe
  C:\Windows\System\HhbBwnb.exe
  2⤵
  PID:4032
- C:\Windows\System\wiQMzFY.exe
  C:\Windows\System\wiQMzFY.exe
  2⤵
  PID:4004
- C:\Windows\System\JRyGGsr.exe
  C:\Windows\System\JRyGGsr.exe
  2⤵
  PID:2084
- C:\Windows\System\vDgDSXP.exe
  C:\Windows\System\vDgDSXP.exe
  2⤵
  PID:14172
- C:\Windows\System\UrUTBJC.exe
  C:\Windows\System\UrUTBJC.exe
  2⤵
  PID:14120
- C:\Windows\System\gyfnTTG.exe
  C:\Windows\System\gyfnTTG.exe
  2⤵
  PID:11004
- C:\Windows\System\ILVwEaO.exe
  C:\Windows\System\ILVwEaO.exe
  2⤵
  PID:2456
- C:\Windows\System\mxtXNAB.exe
  C:\Windows\System\mxtXNAB.exe
  2⤵
  PID:10916
- C:\Windows\System\cnJrwPM.exe
  C:\Windows\System\cnJrwPM.exe
  2⤵
  PID:1452
- C:\Windows\System\yGkjCHl.exe
  C:\Windows\System\yGkjCHl.exe
  2⤵
  PID:2744
- C:\Windows\System\lKblyrE.exe
  C:\Windows\System\lKblyrE.exe
  2⤵
  PID:13868
- C:\Windows\System\FMLmDxa.exe
  C:\Windows\System\FMLmDxa.exe
  2⤵
  PID:7184
- C:\Windows\System\xfUrgrI.exe
  C:\Windows\System\xfUrgrI.exe
  2⤵
  PID:4028
- C:\Windows\System\gMCNSOO.exe
  C:\Windows\System\gMCNSOO.exe
  2⤵
  PID:2668
- C:\Windows\System\njiWctL.exe
  C:\Windows\System\njiWctL.exe
  2⤵
  PID:4392
- C:\Windows\System\KtHiuiZ.exe
  C:\Windows\System\KtHiuiZ.exe
  2⤵
  PID:13576
- C:\Windows\System\JFuuMNQ.exe
  C:\Windows\System\JFuuMNQ.exe
  2⤵
  PID:5520
- C:\Windows\System\tdtXQTk.exe
  C:\Windows\System\tdtXQTk.exe
  2⤵
  PID:4292
- C:\Windows\System\IVHAvoI.exe
  C:\Windows\System\IVHAvoI.exe
  2⤵
  PID:5056
- C:\Windows\System\GTocPym.exe
  C:\Windows\System\GTocPym.exe
  2⤵
  PID:1012
- C:\Windows\System\LBfJfzZ.exe
  C:\Windows\System\LBfJfzZ.exe
  2⤵
  PID:1348
- C:\Windows\System\rmmbmll.exe
  C:\Windows\System\rmmbmll.exe
  2⤵
  PID:2056
- C:\Windows\System\EuFXNgQ.exe
  C:\Windows\System\EuFXNgQ.exe
  2⤵
  PID:3160
- C:\Windows\System\vUDxLYA.exe
  C:\Windows\System\vUDxLYA.exe
  2⤵
  PID:13776
- C:\Windows\System\dWAVAOi.exe
  C:\Windows\System\dWAVAOi.exe
  2⤵
  PID:12168
- C:\Windows\System\qLjGoLj.exe
  C:\Windows\System\qLjGoLj.exe
  2⤵
  PID:2644
- C:\Windows\System\LejfsKB.exe
  C:\Windows\System\LejfsKB.exe
  2⤵
  PID:14024
- C:\Windows\System\dLkiQny.exe
  C:\Windows\System\dLkiQny.exe
  2⤵
  PID:10900
- C:\Windows\System\aibohgx.exe
  C:\Windows\System\aibohgx.exe
  2⤵
  PID:14060
- C:\Windows\System\hvHKaIW.exe
  C:\Windows\System\hvHKaIW.exe
  2⤵
  PID:8224
- C:\Windows\System\ZiMiVYM.exe
  C:\Windows\System\ZiMiVYM.exe
  2⤵
  PID:4420
- C:\Windows\System\eoeiIiE.exe
  C:\Windows\System\eoeiIiE.exe
  2⤵
  PID:7176
- C:\Windows\System\cBKNybp.exe
  C:\Windows\System\cBKNybp.exe
  2⤵
  PID:10780
- C:\Windows\System\ypLAQle.exe
  C:\Windows\System\ypLAQle.exe
  2⤵
  PID:532
- C:\Windows\System\tiOqZOk.exe
  C:\Windows\System\tiOqZOk.exe
  2⤵
  PID:1264
- C:\Windows\System\kEYjiEj.exe
  C:\Windows\System\kEYjiEj.exe
  2⤵
  PID:4164
- C:\Windows\System\FfuUwXX.exe
  C:\Windows\System\FfuUwXX.exe
  2⤵
  PID:2264
- C:\Windows\System\sIiFqKD.exe
  C:\Windows\System\sIiFqKD.exe
  2⤵
  PID:2964
- C:\Windows\System\ZTewdji.exe
  C:\Windows\System\ZTewdji.exe
  2⤵
  PID:13608
- C:\Windows\System\ssBFslc.exe
  C:\Windows\System\ssBFslc.exe
  2⤵
  PID:2888
- C:\Windows\System\qAtafGi.exe
  C:\Windows\System\qAtafGi.exe
  2⤵
  PID:14220
- C:\Windows\System\mvTBkHi.exe
  C:\Windows\System\mvTBkHi.exe
  2⤵
  PID:2516
- C:\Windows\System\aAxYrcI.exe
  C:\Windows\System\aAxYrcI.exe
  2⤵
  PID:4208
- C:\Windows\System\ixFIezP.exe
  C:\Windows\System\ixFIezP.exe
  2⤵
  PID:5200
- C:\Windows\System\LfkxjrO.exe
  C:\Windows\System\LfkxjrO.exe
  2⤵
  PID:12924
- C:\Windows\System\ASmGLCt.exe
  C:\Windows\System\ASmGLCt.exe
  2⤵
  PID:932
- C:\Windows\System\yzxlkfQ.exe
  C:\Windows\System\yzxlkfQ.exe
  2⤵
  PID:5320
- C:\Windows\System\LwGNBln.exe
  C:\Windows\System\LwGNBln.exe
  2⤵
  PID:5512
- C:\Windows\System\UBnkrlw.exe
  C:\Windows\System\UBnkrlw.exe
  2⤵
  PID:512
- C:\Windows\System\KFAKzFe.exe
  C:\Windows\System\KFAKzFe.exe
  2⤵
  PID:5668
- C:\Windows\System\FJuKaHS.exe
  C:\Windows\System\FJuKaHS.exe
  2⤵
  PID:5436
- C:\Windows\System\CnxWFoV.exe
  C:\Windows\System\CnxWFoV.exe
  2⤵
  PID:1200
- C:\Windows\System\TqTiRKC.exe
  C:\Windows\System\TqTiRKC.exe
  2⤵
  PID:13792
- C:\Windows\System\OCtOHGR.exe
  C:\Windows\System\OCtOHGR.exe
  2⤵
  PID:1180
- C:\Windows\System\EXtADdI.exe
  C:\Windows\System\EXtADdI.exe
  2⤵
  PID:10356
- C:\Windows\System\tswwYAk.exe
  C:\Windows\System\tswwYAk.exe
  2⤵
  PID:13208
- C:\Windows\System\XzbeIIP.exe
  C:\Windows\System\XzbeIIP.exe
  2⤵
  PID:384
- C:\Windows\System\iUPztcX.exe
  C:\Windows\System\iUPztcX.exe
  2⤵
  PID:4972
- C:\Windows\System\HDduQNq.exe
  C:\Windows\System\HDduQNq.exe
  2⤵
  PID:6100
- C:\Windows\System\FXyMriC.exe
  C:\Windows\System\FXyMriC.exe
  2⤵
  PID:6048
- C:\Windows\System\xXuLmls.exe
  C:\Windows\System\xXuLmls.exe
  2⤵
  PID:5644
- C:\Windows\System\fcYFIQy.exe
  C:\Windows\System\fcYFIQy.exe
  2⤵
  PID:13760
- C:\Windows\System\tVnvnNO.exe
  C:\Windows\System\tVnvnNO.exe
  2⤵
  PID:3300
- C:\Windows\System\qfbCmrz.exe
  C:\Windows\System\qfbCmrz.exe
  2⤵
  PID:6032
- C:\Windows\System\VdxhASf.exe
  C:\Windows\System\VdxhASf.exe
  2⤵
  PID:5504
- C:\Windows\System\JoYyWWa.exe
  C:\Windows\System\JoYyWWa.exe
  2⤵
  PID:5040
- C:\Windows\System\MjYWKFz.exe
  C:\Windows\System\MjYWKFz.exe
  2⤵
  PID:3968
- C:\Windows\System\dRkQKae.exe
  C:\Windows\System\dRkQKae.exe
  2⤵
  PID:2640
- C:\Windows\System\pdJiGMZ.exe
  C:\Windows\System\pdJiGMZ.exe
  2⤵
  PID:5032
- C:\Windows\System\MrBgbgD.exe
  C:\Windows\System\MrBgbgD.exe
  2⤵
  PID:6028
- C:\Windows\System\SYIATUf.exe
  C:\Windows\System\SYIATUf.exe
  2⤵
  PID:6016
- C:\Windows\System\foeRboY.exe
  C:\Windows\System\foeRboY.exe
  2⤵
  PID:4224
- C:\Windows\System\RaJabyP.exe
  C:\Windows\System\RaJabyP.exe
  2⤵
  PID:6508
- C:\Windows\System\SlcPVbQ.exe
  C:\Windows\System\SlcPVbQ.exe
  2⤵
  PID:4232
- C:\Windows\System\JIeQKdM.exe
  C:\Windows\System\JIeQKdM.exe
  2⤵
  PID:6592
- C:\Windows\System\KEBEXBy.exe
  C:\Windows\System\KEBEXBy.exe
  2⤵
  PID:6520
- C:\Windows\System\saMmkjI.exe
  C:\Windows\System\saMmkjI.exe
  2⤵
  PID:716
- C:\Windows\System\bFtcDqx.exe
  C:\Windows\System\bFtcDqx.exe
  2⤵
  PID:4596
- C:\Windows\System\vxmTePQ.exe
  C:\Windows\System\vxmTePQ.exe
  2⤵
  PID:3288
- C:\Windows\System\wmgQYaj.exe
  C:\Windows\System\wmgQYaj.exe
  2⤵
  PID:6704
- C:\Windows\System\FhtcwtT.exe
  C:\Windows\System\FhtcwtT.exe
  2⤵
  PID:13692
- C:\Windows\System\nROICfg.exe
  C:\Windows\System\nROICfg.exe
  2⤵
  PID:6564
- C:\Windows\System\srWPSOw.exe
  C:\Windows\System\srWPSOw.exe
  2⤵
  PID:14084
- C:\Windows\System\alQyGSl.exe
  C:\Windows\System\alQyGSl.exe
  2⤵
  PID:2244
- C:\Windows\System\NlTcdmK.exe
  C:\Windows\System\NlTcdmK.exe
  2⤵
  PID:12996
- C:\Windows\System\DkPVBCM.exe
  C:\Windows\System\DkPVBCM.exe
  2⤵
  PID:10268
- C:\Windows\System\gzzcwYR.exe
  C:\Windows\System\gzzcwYR.exe
  2⤵
  PID:6176
- C:\Windows\System\sGLBejg.exe
  C:\Windows\System\sGLBejg.exe
  2⤵
  PID:13676
- C:\Windows\System\nGOXAof.exe
  C:\Windows\System\nGOXAof.exe
  2⤵
  PID:3612
- C:\Windows\System\tDyFrwV.exe
  C:\Windows\System\tDyFrwV.exe
  2⤵
  PID:4008
- C:\Windows\System\BiAHNkm.exe
  C:\Windows\System\BiAHNkm.exe
  2⤵
  PID:6108
- C:\Windows\System\imErMlg.exe
  C:\Windows\System\imErMlg.exe
  2⤵
  PID:6020
- C:\Windows\System\DzqMblH.exe
  C:\Windows\System\DzqMblH.exe
  2⤵
  PID:4664
- C:\Windows\System\OiVXLWR.exe
  C:\Windows\System\OiVXLWR.exe
  2⤵
  PID:6936
- C:\Windows\System\mPGiBLl.exe
  C:\Windows\System\mPGiBLl.exe
  2⤵
  PID:2844
- C:\Windows\System\UTIpMXX.exe
  C:\Windows\System\UTIpMXX.exe
  2⤵
  PID:6424
- C:\Windows\System\sUtNyLm.exe
  C:\Windows\System\sUtNyLm.exe
  2⤵
  PID:3684
- C:\Windows\System\snISnJs.exe
  C:\Windows\System\snISnJs.exe
  2⤵
  PID:5920
- C:\Windows\System\humnjzU.exe
  C:\Windows\System\humnjzU.exe
  2⤵
  PID:7036
- C:\Windows\System\WPaNbDR.exe
  C:\Windows\System\WPaNbDR.exe
  2⤵
  PID:2532
- C:\Windows\System\fPHUlfJ.exe
  C:\Windows\System\fPHUlfJ.exe
  2⤵
  PID:14056
- C:\Windows\System\QpDrrPj.exe
  C:\Windows\System\QpDrrPj.exe
  2⤵
  PID:7008
- C:\Windows\System\EIhMVEZ.exe
  C:\Windows\System\EIhMVEZ.exe
  2⤵
  PID:6456
- C:\Windows\System\LvjtTPz.exe
  C:\Windows\System\LvjtTPz.exe
  2⤵
  PID:6324
- C:\Windows\System\rbPasKj.exe
  C:\Windows\System\rbPasKj.exe
  2⤵
  PID:6600
- C:\Windows\System\AeFtCbG.exe
  C:\Windows\System\AeFtCbG.exe
  2⤵
  PID:7040
- C:\Windows\System\VdmXrkq.exe
  C:\Windows\System\VdmXrkq.exe
  2⤵
  PID:6668
- C:\Windows\System\DhZWAtQ.exe
  C:\Windows\System\DhZWAtQ.exe
  2⤵
  PID:13400
- C:\Windows\System\UdSYfIm.exe
  C:\Windows\System\UdSYfIm.exe
  2⤵
  PID:5528
- C:\Windows\System\aMUPGnL.exe
  C:\Windows\System\aMUPGnL.exe
  2⤵
  PID:5704
- C:\Windows\System\HmBOSqR.exe
  C:\Windows\System\HmBOSqR.exe
  2⤵
  PID:7012
- C:\Windows\System\FzUqapf.exe
  C:\Windows\System\FzUqapf.exe
  2⤵
  PID:5616
- C:\Windows\System\OwlIAEy.exe
  C:\Windows\System\OwlIAEy.exe
  2⤵
  PID:13644
- C:\Windows\System\fCZzWxf.exe
  C:\Windows\System\fCZzWxf.exe
  2⤵
  PID:13808
- C:\Windows\System\GuNiTnD.exe
  C:\Windows\System\GuNiTnD.exe
  2⤵
  PID:4628
- C:\Windows\System\zvEbeAG.exe
  C:\Windows\System\zvEbeAG.exe
  2⤵
  PID:5148
- C:\Windows\System\QxhvrGb.exe
  C:\Windows\System\QxhvrGb.exe
  2⤵
  PID:7236
- C:\Windows\System\fTeqMwH.exe
  C:\Windows\System\fTeqMwH.exe
  2⤵
  PID:1516
- C:\Windows\System\GdSDFRe.exe
  C:\Windows\System\GdSDFRe.exe
  2⤵
  PID:7216
- C:\Windows\System\ylJYiYJ.exe
  C:\Windows\System\ylJYiYJ.exe
  2⤵
  PID:2300
- C:\Windows\System\MVsyfsl.exe
  C:\Windows\System\MVsyfsl.exe
  2⤵
  PID:7504
- C:\Windows\System\riWEgkH.exe
  C:\Windows\System\riWEgkH.exe
  2⤵
  PID:7072
- C:\Windows\System\qhsCfrl.exe
  C:\Windows\System\qhsCfrl.exe
  2⤵
  PID:232
- C:\Windows\System\nkJrFtE.exe
  C:\Windows\System\nkJrFtE.exe
  2⤵
  PID:1460
- C:\Windows\System\eKdjsiI.exe
  C:\Windows\System\eKdjsiI.exe
  2⤵
  PID:8092
- C:\Windows\System\cSgIoOo.exe
  C:\Windows\System\cSgIoOo.exe
  2⤵
  PID:5364
- C:\Windows\System\plQLCxi.exe
  C:\Windows\System\plQLCxi.exe
  2⤵
  PID:7640
- C:\Windows\System\czHZskb.exe
  C:\Windows\System\czHZskb.exe
  2⤵
  PID:7284
- C:\Windows\System\RRzTFmf.exe
  C:\Windows\System\RRzTFmf.exe
  2⤵
  PID:7280
- C:\Windows\System\hBcJQfP.exe
  C:\Windows\System\hBcJQfP.exe
  2⤵
  PID:7252
- C:\Windows\System\zohXgoU.exe
  C:\Windows\System\zohXgoU.exe
  2⤵
  PID:7116
- C:\Windows\System\mYaFKiM.exe
  C:\Windows\System\mYaFKiM.exe
  2⤵
  PID:6984
- C:\Windows\System\XTqiQRg.exe
  C:\Windows\System\XTqiQRg.exe
  2⤵
  PID:13332
- C:\Windows\System\lOvTyxk.exe
  C:\Windows\System\lOvTyxk.exe
  2⤵
  PID:6540
- C:\Windows\System\iKREdZY.exe
  C:\Windows\System\iKREdZY.exe
  2⤵
  PID:7568
- C:\Windows\System\yNIRjcA.exe
  C:\Windows\System\yNIRjcA.exe
  2⤵
  PID:6220
- C:\Windows\System\VtvdHcD.exe
  C:\Windows\System\VtvdHcD.exe
  2⤵
  PID:5392
- C:\Windows\System\slCmXNG.exe
  C:\Windows\System\slCmXNG.exe
  2⤵
  PID:5724
- C:\Windows\System\poCBlmV.exe
  C:\Windows\System\poCBlmV.exe
  2⤵
  PID:5708
- C:\Windows\System\zqiqTfM.exe
  C:\Windows\System\zqiqTfM.exe
  2⤵
  PID:7768
- C:\Windows\System\TYkDCUr.exe
  C:\Windows\System\TYkDCUr.exe
  2⤵
  PID:8136
- C:\Windows\System\UXvwSIj.exe
  C:\Windows\System\UXvwSIj.exe
  2⤵
  PID:6004
- C:\Windows\System\XUyfXDZ.exe
  C:\Windows\System\XUyfXDZ.exe
  2⤵
  PID:13348
- C:\Windows\System\bdDyPOa.exe
  C:\Windows\System\bdDyPOa.exe
  2⤵
  PID:6988
- C:\Windows\System\oWYRjAL.exe
  C:\Windows\System\oWYRjAL.exe
  2⤵
  PID:7632
- C:\Windows\System\xeyPgfE.exe
  C:\Windows\System\xeyPgfE.exe
  2⤵
  PID:1720
- C:\Windows\System\vKmuXsn.exe
  C:\Windows\System\vKmuXsn.exe
  2⤵
  PID:5396
- C:\Windows\System\hhCtrAq.exe
  C:\Windows\System\hhCtrAq.exe
  2⤵
  PID:7132
- C:\Windows\System\yuloIsQ.exe
  C:\Windows\System\yuloIsQ.exe
  2⤵
  PID:7004
- C:\Windows\System\xbhpkcs.exe
  C:\Windows\System\xbhpkcs.exe
  2⤵
  PID:3976
- C:\Windows\System\LopVwEO.exe
  C:\Windows\System\LopVwEO.exe
  2⤵
  PID:8464
- C:\Windows\System\bwosYZa.exe
  C:\Windows\System\bwosYZa.exe
  2⤵
  PID:8036
- C:\Windows\System\rTOWLRV.exe
  C:\Windows\System\rTOWLRV.exe
  2⤵
  PID:3996
- C:\Windows\System\VLpkHmG.exe
  C:\Windows\System\VLpkHmG.exe
  2⤵
  PID:5976
- C:\Windows\System\Nvtayic.exe
  C:\Windows\System\Nvtayic.exe
  2⤵
  PID:14144
- C:\Windows\System\YspTkbN.exe
  C:\Windows\System\YspTkbN.exe
  2⤵
  PID:14204
- C:\Windows\System\yOrODrC.exe
  C:\Windows\System\yOrODrC.exe
  2⤵
  PID:8956
- C:\Windows\System\axEBHBD.exe
  C:\Windows\System\axEBHBD.exe
  2⤵
  PID:12316
- C:\Windows\System\VTGxaIx.exe
  C:\Windows\System\VTGxaIx.exe
  2⤵
  PID:8848
- C:\Windows\System\LyeCqlL.exe
  C:\Windows\System\LyeCqlL.exe
  2⤵
  PID:6688
- C:\Windows\System\kGYbJOc.exe
  C:\Windows\System\kGYbJOc.exe
  2⤵
  PID:9060
- C:\Windows\System\OcqLQuQ.exe
  C:\Windows\System\OcqLQuQ.exe
  2⤵
  PID:7716
- C:\Windows\System\wtbreVe.exe
  C:\Windows\System\wtbreVe.exe
  2⤵
  PID:7508
- C:\Windows\System\tPLNzRv.exe
  C:\Windows\System\tPLNzRv.exe
  2⤵
  PID:7388
- C:\Windows\System\oBwwfjd.exe
  C:\Windows\System\oBwwfjd.exe
  2⤵
  PID:8844
- C:\Windows\System\ZqaXsbH.exe
  C:\Windows\System\ZqaXsbH.exe
  2⤵
  PID:9192
- C:\Windows\System\JUvCodw.exe
  C:\Windows\System\JUvCodw.exe
  2⤵
  PID:6148
- C:\Windows\System\eNNBzhk.exe
  C:\Windows\System\eNNBzhk.exe
  2⤵
  PID:6940
- C:\Windows\System\qdfbQkk.exe
  C:\Windows\System\qdfbQkk.exe
  2⤵
  PID:9676
- C:\Windows\System\ZvDbZns.exe
  C:\Windows\System\ZvDbZns.exe
  2⤵
  PID:7112
- C:\Windows\System\XpwBhCq.exe
  C:\Windows\System\XpwBhCq.exe
  2⤵
  PID:11992
- C:\Windows\System\pxnFKGQ.exe
  C:\Windows\System\pxnFKGQ.exe
  2⤵
  PID:12252
- C:\Windows\System\QCbbPRf.exe
  C:\Windows\System\QCbbPRf.exe
  2⤵
  PID:5196
- C:\Windows\System\KCpDVhy.exe
  C:\Windows\System\KCpDVhy.exe
  2⤵
  PID:3172
- C:\Windows\System\WVMAiLi.exe
  C:\Windows\System\WVMAiLi.exe
  2⤵
  PID:9260
- C:\Windows\System\CVyuMJp.exe
  C:\Windows\System\CVyuMJp.exe
  2⤵
  PID:12188
- C:\Windows\System\dotCIro.exe
  C:\Windows\System\dotCIro.exe
  2⤵
  PID:8240
- C:\Windows\System\WNLQiBO.exe
  C:\Windows\System\WNLQiBO.exe
  2⤵
  PID:13584
- C:\Windows\System\hTNNprj.exe
  C:\Windows\System\hTNNprj.exe
  2⤵
  PID:9552
- C:\Windows\System\YEFZPYf.exe
  C:\Windows\System\YEFZPYf.exe
  2⤵
  PID:7376
- C:\Windows\System\QDzDjKW.exe
  C:\Windows\System\QDzDjKW.exe
  2⤵
  PID:13856
- C:\Windows\System\qFlHpZp.exe
  C:\Windows\System\qFlHpZp.exe
  2⤵
  PID:9348
- C:\Windows\System\SkBkalF.exe
  C:\Windows\System\SkBkalF.exe
  2⤵
  PID:7792
- C:\Windows\System\pQiKtMD.exe
  C:\Windows\System\pQiKtMD.exe
  2⤵
  PID:4896
- C:\Windows\System\TXzUWCD.exe
  C:\Windows\System\TXzUWCD.exe
  2⤵
  PID:9964
- C:\Windows\System\XQmHElZ.exe
  C:\Windows\System\XQmHElZ.exe
  2⤵
  PID:14324
- C:\Windows\System\UtHOfFG.exe
  C:\Windows\System\UtHOfFG.exe
  2⤵
  PID:10120
- C:\Windows\System\yAvAiiX.exe
  C:\Windows\System\yAvAiiX.exe
  2⤵
  PID:9200
- C:\Windows\System\njMYeJS.exe
  C:\Windows\System\njMYeJS.exe
  2⤵
  PID:1456
- C:\Windows\System\aWNubXR.exe
  C:\Windows\System\aWNubXR.exe
  2⤵
  PID:13672
- C:\Windows\System\xGfIzYO.exe
  C:\Windows\System\xGfIzYO.exe
  2⤵
  PID:14012
- C:\Windows\System\heGkQuC.exe
  C:\Windows\System\heGkQuC.exe
  2⤵
  PID:8212
- C:\Windows\System\SZuVxNf.exe
  C:\Windows\System\SZuVxNf.exe
  2⤵
  PID:4344
- C:\Windows\System\kFLUXsv.exe
  C:\Windows\System\kFLUXsv.exe
  2⤵
  PID:8756
- C:\Windows\System\iclzbxf.exe
  C:\Windows\System\iclzbxf.exe
  2⤵
  PID:7220
- C:\Windows\System\IItoBJu.exe
  C:\Windows\System\IItoBJu.exe
  2⤵
  PID:11192
- C:\Windows\System\YKXtTUx.exe
  C:\Windows\System\YKXtTUx.exe
  2⤵
  PID:8600
- C:\Windows\System\jlwfoYS.exe
  C:\Windows\System\jlwfoYS.exe
  2⤵
  PID:10008
- C:\Windows\System\LibbGxt.exe
  C:\Windows\System\LibbGxt.exe
  2⤵
  PID:10892
- C:\Windows\System\gIONbon.exe
  C:\Windows\System\gIONbon.exe
  2⤵
  PID:8304
- C:\Windows\System\mgSBHPo.exe
  C:\Windows\System\mgSBHPo.exe
  2⤵
  PID:9728
- C:\Windows\System\BksBDUh.exe
  C:\Windows\System\BksBDUh.exe
  2⤵
  PID:11544
- C:\Windows\System\tTlxJwp.exe
  C:\Windows\System\tTlxJwp.exe
  2⤵
  PID:11352
- C:\Windows\System\NpZqOnf.exe
  C:\Windows\System\NpZqOnf.exe
  2⤵
  PID:8788
- C:\Windows\System\FQLMRFD.exe
  C:\Windows\System\FQLMRFD.exe
  2⤵
  PID:11516
- C:\Windows\System\eqjWXkm.exe
  C:\Windows\System\eqjWXkm.exe
  2⤵
  PID:11584
- C:\Windows\System\kUQVbRH.exe
  C:\Windows\System\kUQVbRH.exe
  2⤵
  PID:9436
- C:\Windows\System\GOnhLfP.exe
  C:\Windows\System\GOnhLfP.exe
  2⤵
  PID:9248
- C:\Windows\System\gRdHxtL.exe
  C:\Windows\System\gRdHxtL.exe
  2⤵
  PID:11348
- C:\Windows\System\CEhKTEK.exe
  C:\Windows\System\CEhKTEK.exe
  2⤵
  PID:11600
- C:\Windows\System\yISuqTI.exe
  C:\Windows\System\yISuqTI.exe
  2⤵
  PID:8420
- C:\Windows\System\pmPKTBL.exe
  C:\Windows\System\pmPKTBL.exe
  2⤵
  PID:5856
- C:\Windows\System\llXwEat.exe
  C:\Windows\System\llXwEat.exe
  2⤵
  PID:9396
- C:\Windows\System\cfxjqsA.exe
  C:\Windows\System\cfxjqsA.exe
  2⤵
  PID:11256
- C:\Windows\System\HaFLCfj.exe
  C:\Windows\System\HaFLCfj.exe
  2⤵
  PID:11252
- C:\Windows\System\aRdPQMd.exe
  C:\Windows\System\aRdPQMd.exe
  2⤵
  PID:11932
- C:\Windows\System\FqMbNsz.exe
  C:\Windows\System\FqMbNsz.exe
  2⤵
  PID:7056
- C:\Windows\System\ZtgkgJd.exe
  C:\Windows\System\ZtgkgJd.exe
  2⤵
  PID:8472
- C:\Windows\System\dnDUNVs.exe
  C:\Windows\System\dnDUNVs.exe
  2⤵
  PID:9960
- C:\Windows\System\sbUVfcO.exe
  C:\Windows\System\sbUVfcO.exe
  2⤵
  PID:11604
- C:\Windows\System\wDsxxJL.exe
  C:\Windows\System\wDsxxJL.exe
  2⤵
  PID:6992
- C:\Windows\System\uxoCJPk.exe
  C:\Windows\System\uxoCJPk.exe
  2⤵
  PID:11368
- C:\Windows\System\wIcIDMa.exe
  C:\Windows\System\wIcIDMa.exe
  2⤵
  PID:5408
- C:\Windows\System\VIwrwLw.exe
  C:\Windows\System\VIwrwLw.exe
  2⤵
  PID:740
- C:\Windows\System\mdBauEu.exe
  C:\Windows\System\mdBauEu.exe
  2⤵
  PID:7084
- C:\Windows\System\PnksBsf.exe
  C:\Windows\System\PnksBsf.exe
  2⤵
  PID:10400
- C:\Windows\System\JSIfycn.exe
  C:\Windows\System\JSIfycn.exe
  2⤵
  PID:8576
- C:\Windows\System\OzOnSNF.exe
  C:\Windows\System\OzOnSNF.exe
  2⤵
  PID:11008
- C:\Windows\System\duNzagP.exe
  C:\Windows\System\duNzagP.exe
  2⤵
  PID:11312
- C:\Windows\System\EMkgHZD.exe
  C:\Windows\System\EMkgHZD.exe
  2⤵
  PID:8448
- C:\Windows\System\OarpvsP.exe
  C:\Windows\System\OarpvsP.exe
  2⤵
  PID:11372
- C:\Windows\System\wlLpjnP.exe
  C:\Windows\System\wlLpjnP.exe
  2⤵
  PID:11160
- C:\Windows\System\iNKarFp.exe
  C:\Windows\System\iNKarFp.exe
  2⤵
  PID:7852
- C:\Windows\System\SYdyBkZ.exe
  C:\Windows\System\SYdyBkZ.exe
  2⤵
  PID:14440
- C:\Windows\System\ITZTYUN.exe
  C:\Windows\System\ITZTYUN.exe
  2⤵
  PID:14468
- C:\Windows\System\nOAiveZ.exe
  C:\Windows\System\nOAiveZ.exe
  2⤵
  PID:14504
- C:\Windows\System\QeElVeD.exe
  C:\Windows\System\QeElVeD.exe
  2⤵
  PID:14532
- C:\Windows\System\HRIrOrt.exe
  C:\Windows\System\HRIrOrt.exe
  2⤵
  PID:14632
- C:\Windows\System\JJtlGOH.exe
  C:\Windows\System\JJtlGOH.exe
  2⤵
  PID:14648
- C:\Windows\System\TNLKfTi.exe
  C:\Windows\System\TNLKfTi.exe
  2⤵
  PID:14684
- C:\Windows\System\ipMpErS.exe
  C:\Windows\System\ipMpErS.exe
  2⤵
  PID:14716
- C:\Windows\System\hnhJAun.exe
  C:\Windows\System\hnhJAun.exe
  2⤵
  PID:14740
- C:\Windows\System\MWxgJIZ.exe
  C:\Windows\System\MWxgJIZ.exe
  2⤵
  PID:14784
- C:\Windows\System\blQRbmd.exe
  C:\Windows\System\blQRbmd.exe
  2⤵
  PID:14820
- C:\Windows\System\jAtrjjo.exe
  C:\Windows\System\jAtrjjo.exe
  2⤵
  PID:14848
- C:\Windows\System\xXZaMQb.exe
  C:\Windows\System\xXZaMQb.exe
  2⤵
  PID:14880
- C:\Windows\System\HkqTnOB.exe
  C:\Windows\System\HkqTnOB.exe
  2⤵
  PID:14920
- C:\Windows\System\DyTRpdE.exe
  C:\Windows\System\DyTRpdE.exe
  2⤵
  PID:14952
- C:\Windows\System\nhIMsDR.exe
  C:\Windows\System\nhIMsDR.exe
  2⤵
  PID:14984
- C:\Windows\System\qMVziqV.exe
  C:\Windows\System\qMVziqV.exe
  2⤵
  PID:15012
- C:\Windows\System\JYrekYB.exe
  C:\Windows\System\JYrekYB.exe
  2⤵
  PID:15044
- C:\Windows\System\uVPWLuC.exe
  C:\Windows\System\uVPWLuC.exe
  2⤵
  PID:15072
- C:\Windows\System\KgoMmYO.exe
  C:\Windows\System\KgoMmYO.exe
  2⤵
  PID:15092
- C:\Windows\System\ZOoNxWP.exe
  C:\Windows\System\ZOoNxWP.exe
  2⤵
  PID:15128
- C:\Windows\System\rTNfrZj.exe
  C:\Windows\System\rTNfrZj.exe
  2⤵
  PID:15156
- C:\Windows\System\lvSmusq.exe
  C:\Windows\System\lvSmusq.exe
  2⤵
  PID:15188
- C:\Windows\System\ECYSUSj.exe
  C:\Windows\System\ECYSUSj.exe
  2⤵
  PID:15228
- C:\Windows\System\WInWWOd.exe
  C:\Windows\System\WInWWOd.exe
  2⤵
  PID:15252
- C:\Windows\System\nDmvkWF.exe
  C:\Windows\System\nDmvkWF.exe
  2⤵
  PID:15272
- C:\Windows\System\TELkcPY.exe
  C:\Windows\System\TELkcPY.exe
  2⤵
  PID:15296
- C:\Windows\System\IhcUaPU.exe
  C:\Windows\System\IhcUaPU.exe
  2⤵
  PID:15328
- C:\Windows\System\euiOxmU.exe
  C:\Windows\System\euiOxmU.exe
  2⤵
  PID:15352
- C:\Windows\System\BmUzizK.exe
  C:\Windows\System\BmUzizK.exe
  2⤵
  PID:11608
- C:\Windows\System\ZWcooKj.exe
  C:\Windows\System\ZWcooKj.exe
  2⤵
  PID:11344
- C:\Windows\System\kXvXmWN.exe
  C:\Windows\System\kXvXmWN.exe
  2⤵
  PID:12544
- C:\Windows\System\xCmLUHT.exe
  C:\Windows\System\xCmLUHT.exe
  2⤵
  PID:14344
- C:\Windows\System\EtZQaGS.exe
  C:\Windows\System\EtZQaGS.exe
  2⤵
  PID:12124
- C:\Windows\System\AcjoMya.exe
  C:\Windows\System\AcjoMya.exe
  2⤵
  PID:14376
- C:\Windows\System\SPLcWPa.exe
  C:\Windows\System\SPLcWPa.exe
  2⤵
  PID:11072
- C:\Windows\System\VpRqwbR.exe
  C:\Windows\System\VpRqwbR.exe
  2⤵
  PID:14364
- C:\Windows\System\moPcCeE.exe
  C:\Windows\System\moPcCeE.exe
  2⤵
  PID:8160
- C:\Windows\System\QqfjVYy.exe
  C:\Windows\System\QqfjVYy.exe
  2⤵
  PID:10632
- C:\Windows\System\tcpTllb.exe
  C:\Windows\System\tcpTllb.exe
  2⤵
  PID:14624
- C:\Windows\System\qVRpjdn.exe
  C:\Windows\System\qVRpjdn.exe
  2⤵
  PID:14668
- C:\Windows\System\pceciyz.exe
  C:\Windows\System\pceciyz.exe
  2⤵
  PID:1852
- C:\Windows\System\yEBxvIA.exe
  C:\Windows\System\yEBxvIA.exe
  2⤵
  PID:14464
- C:\Windows\System\YzSElWL.exe
  C:\Windows\System\YzSElWL.exe
  2⤵
  PID:14796
- C:\Windows\System\dILjbOY.exe
  C:\Windows\System\dILjbOY.exe
  2⤵
  PID:14844
- C:\Windows\System\VsYyYsN.exe
  C:\Windows\System\VsYyYsN.exe
  2⤵
  PID:12448
- C:\Windows\System\sceFRfb.exe
  C:\Windows\System\sceFRfb.exe
  2⤵
  PID:14900
- C:\Windows\System\flExPaN.exe
  C:\Windows\System\flExPaN.exe
  2⤵
  PID:15060
- C:\Windows\System\PfYjWca.exe
  C:\Windows\System\PfYjWca.exe
  2⤵
  PID:15108
- C:\Windows\System\MVYdBgG.exe
  C:\Windows\System\MVYdBgG.exe
  2⤵
  PID:14964
- C:\Windows\System\gfwsxUX.exe
  C:\Windows\System\gfwsxUX.exe
  2⤵
  PID:14972
- C:\Windows\System\NiOfzcy.exe
  C:\Windows\System\NiOfzcy.exe
  2⤵
  PID:14932
- C:\Windows\System\QFyEHMa.exe
  C:\Windows\System\QFyEHMa.exe
  2⤵
  PID:9040
- C:\Windows\System\oKwGjnS.exe
  C:\Windows\System\oKwGjnS.exe
  2⤵
  PID:14436
- C:\Windows\System\XRNWghU.exe
  C:\Windows\System\XRNWghU.exe
  2⤵
  PID:11496
- C:\Windows\System\woUsXtU.exe
  C:\Windows\System\woUsXtU.exe
  2⤵
  PID:12824
- C:\Windows\System\WFtsfmc.exe
  C:\Windows\System\WFtsfmc.exe
  2⤵
  PID:14460
- C:\Windows\System\uKNDfDK.exe
  C:\Windows\System\uKNDfDK.exe
  2⤵
  PID:14380
- C:\Windows\System\fUCWkYv.exe
  C:\Windows\System\fUCWkYv.exe
  2⤵
  PID:12232
- C:\Windows\System\JqDOThr.exe
  C:\Windows\System\JqDOThr.exe
  2⤵
  PID:14664
- C:\Windows\System\gvDPuav.exe
  C:\Windows\System\gvDPuav.exe
  2⤵
  PID:14408
- C:\Windows\System\hMgeMWT.exe
  C:\Windows\System\hMgeMWT.exe
  2⤵
  PID:10460
- C:\Windows\System\MZZwSrt.exe
  C:\Windows\System\MZZwSrt.exe
  2⤵
  PID:7880
- C:\Windows\System\SlnfKxC.exe
  C:\Windows\System\SlnfKxC.exe
  2⤵
  PID:14836
- C:\Windows\System\JDIkGyY.exe
  C:\Windows\System\JDIkGyY.exe
  2⤵
  PID:12512
- C:\Windows\System\dIbZQCl.exe
  C:\Windows\System\dIbZQCl.exe
  2⤵
  PID:14628
- C:\Windows\System\TsOtSYP.exe
  C:\Windows\System\TsOtSYP.exe
  2⤵
  PID:9444
- C:\Windows\System\LsifARg.exe
  C:\Windows\System\LsifARg.exe
  2⤵
  PID:9700
- C:\Windows\System\JhJeCDn.exe
  C:\Windows\System\JhJeCDn.exe
  2⤵
  PID:15116
- C:\Windows\System\mZzfdhd.exe
  C:\Windows\System\mZzfdhd.exe
  2⤵
  PID:12664
- C:\Windows\System\KphqSEk.exe
  C:\Windows\System\KphqSEk.exe
  2⤵
  PID:15224
- C:\Windows\System\IuZBuzt.exe
  C:\Windows\System\IuZBuzt.exe
  2⤵
  PID:12860
- C:\Windows\System\yYyVDTu.exe
  C:\Windows\System\yYyVDTu.exe
  2⤵
  PID:15084
- C:\Windows\System\lLxXlxu.exe
  C:\Windows\System\lLxXlxu.exe
  2⤵
  PID:12028
- C:\Windows\System\XrVKqrq.exe
  C:\Windows\System\XrVKqrq.exe
  2⤵
  PID:15152
- C:\Windows\System\NvADFNz.exe
  C:\Windows\System\NvADFNz.exe
  2⤵
  PID:11828
- C:\Windows\System\KGVevqJ.exe
  C:\Windows\System\KGVevqJ.exe
  2⤵
  PID:15028
- C:\Windows\System\VpOYaLc.exe
  C:\Windows\System\VpOYaLc.exe
  2⤵
  PID:9864
- C:\Windows\System\hzwLiez.exe
  C:\Windows\System\hzwLiez.exe
  2⤵
  PID:11868
- C:\Windows\System\wEHVtTj.exe
  C:\Windows\System\wEHVtTj.exe
  2⤵
  PID:14704
- C:\Windows\System\sGxKYcj.exe
  C:\Windows\System\sGxKYcj.exe
  2⤵
  PID:14760
- C:\Windows\System\hmTOCEq.exe
  C:\Windows\System\hmTOCEq.exe
  2⤵
  PID:11464
- C:\Windows\System\PHZymhZ.exe
  C:\Windows\System\PHZymhZ.exe
  2⤵
  PID:15104
- C:\Windows\System\cnDwTDA.exe
  C:\Windows\System\cnDwTDA.exe
  2⤵
  PID:12552
- C:\Windows\System\SOCCXUt.exe
  C:\Windows\System\SOCCXUt.exe
  2⤵
  PID:12856
- C:\Windows\System\OpQDTZr.exe
  C:\Windows\System\OpQDTZr.exe
  2⤵
  PID:11288
- C:\Windows\System\kjGwwjF.exe
  C:\Windows\System\kjGwwjF.exe
  2⤵
  PID:4692
- C:\Windows\System\TvRkKCI.exe
  C:\Windows\System\TvRkKCI.exe
  2⤵
  PID:11664
- C:\Windows\System\kNDBnds.exe
  C:\Windows\System\kNDBnds.exe
  2⤵
  PID:11480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qvaagjyn.ddw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AHXsIWQ.exe

Filesize
1.8MB

MD5
a64e20243bd956928c9844e5bca99358

SHA1
112e00e77247f0fc4813f70518183f92211ddae8

SHA256
db608864b232540a6bbc5c41cc5dad8eec5f66aca6c25a21cfef5681274f8743

SHA512
f5039a51883d9fb9a5186d567f220880b268b2b38a8b09a37d9e6b918fec7b5805b3ef9e2ab4875b83c785241c44480cf1bd96938c2234b78836c93bfa797916

Download Submit
C:\Windows\System\DYoydsc.exe

Filesize
1.8MB

MD5
c2241804988fe02b1a2c4df71468c876

SHA1
2d6cbcaeec0c5829da5d50be6f61216682e2b623

SHA256
40dce33f5f25a5faa7a57171ce4357cd2ff0b7912c02aa50f8d5b232ab7a1857

SHA512
32d4ce6ae9a8382d1babb9cfb62af7f949cdeb787d47b0f7c3f4498bfb0e2690e429271ad53bbf697d763048a674fe225892e3a98d3a4a288444d639e83a0c64

Download Submit
C:\Windows\System\FGhXsWG.exe

Filesize
1.8MB

MD5
59e73ee65dfe9a7c83b1a8d759fea6f0

SHA1
d6d72a27a2353790a0300b4481e01ddefeeae653

SHA256
2907b50c798ab705cb7ffd48610711e4bef2bad84e72315e9adc62a7565e80ed

SHA512
493c3421ef08042491a01802c1bc9bd14a11866a7dbcb117b1f83ae579c957b2e6fec28323f2b7ff0591dec1b0fb055d7317295ee8c8965c2d457f1603227626

Download Submit
C:\Windows\System\Lomewes.exe

Filesize
1.9MB

MD5
c23bafaab4c11aaf0032260009dfff8b

SHA1
554eff157488fd495129f0d279e4a4f902076bf0

SHA256
a470a9121bda61d2762c8caeda804b82d9ecc46d8439e760725bfdb79bc82e99

SHA512
e028ff97f448fe30ec7bc2a209e7358ca5070ad98e6e0c074721a8fb32a98492b24d1decc475b1dc06bd890fe8c5e7dcaf6d8fb9315ea3c8ddbf3efe4d7f7593

Download Submit
C:\Windows\System\MQcUmhi.exe

Filesize
1.9MB

MD5
a858d70c0219b01c32ba81dad210f9c9

SHA1
686aabe088342652b9c8c04aed65d572130dd985

SHA256
0b56f236a9bc1ebef79f7cb7ff6970a259329c9cf266985d37a5a541ffae772f

SHA512
7a946aaec4bd4e8c26d47ee8fe00cc719841dedd78d7e43bf68241db77476e90babc715db3bc687c644548dd4cbb43e369af12856e7bfcdfe471d0b9121a9ef6

Download Submit
C:\Windows\System\NCwaxrT.exe

Filesize
1.8MB

MD5
113e855e364528687e041add2f848e5c

SHA1
435832a53b70752f4f720d6448a976cfe89e9be5

SHA256
a2a5ce872fbb199456f1940ac9f765497aa12d864f8fa86352bdeb7a70bfaa50

SHA512
0a6591457bd0e7184c48e758612014fcea31d7b31a6304a6f04a9ff260e9b61f51164d124277c5cadb21a68a21ff4fe2d98c7a286ff92c61bb0be6de341c807c

Download Submit
C:\Windows\System\OARqNJd.exe

Filesize
1.9MB

MD5
35e7a152505b23e42cfe2d57333658ff

SHA1
40c3da8915b198cb6ab16649e87571fe4cfd0ed2

SHA256
31e260a050d4dd33b516a042950795cf84a2471a1c2a1d47f5eb1dabf4c2d0a6

SHA512
25c8aad307317a8addbc7af13f5c850c9836ccbf2e22b6811cf957558697330b3b489afa529bb0bc9768d01fcbf1f7f7fafe737a930ea248d9a2993261d4b800

Download Submit
C:\Windows\System\ObuSUSr.exe

Filesize
1.9MB

MD5
eb9091688279f92137f0f249c0fd3deb

SHA1
b6c265ebbefd28120bf2eb4350d408c7d6146166

SHA256
00c60c25521c95a480bce056385576ae36dfd983878d775c1cd83822296defe4

SHA512
dfe934e628d88516d8cc2b70fd502b3db1c58294efa6d49ef72728da75ff0b4493badfc75388e6de4cf978e5f2f049226557fe29ca4757805070a0a64c6979b4

Download Submit
C:\Windows\System\Peznurd.exe

Filesize
1.8MB

MD5
b463b269b163acb182a128e3b6aa9082

SHA1
2272f218680fe827252322508604ebf93754ca0c

SHA256
4aa5d6e39ab6190d1fa27081b396ac44df0ef770f6975807bc7df12439ce86c0

SHA512
93f28564ad4fb71ab39117e590340562c73b6cab2ad6213681c76a021cdf7f772f26bbb4b81e63fbfec89616f26850fcd27e72defb0c07d4a5153dda1c7aa5a4

Download Submit
C:\Windows\System\QcrQpLu.exe

Filesize
1.8MB

MD5
a585e2fe35109a38ecf4432afd1d5442

SHA1
c9d97b94e7296f922e772fd065a8d6bc3022a476

SHA256
7e922372426bfcb8b83b4af4f3ea72bcc777b6c947259b84de4f8752cc07eb36

SHA512
894cab00a2c49eb6b90f1412c1823ab7bd8e049e56875460a27ee9af3292cc33ab6d73f20436f1b716216bcfe450d0ccc363b66046f24fec3790b922e0d13363

Download Submit
C:\Windows\System\TBTVRiJ.exe

Filesize
1.9MB

MD5
112d18e4f6daf524768027f1a1ecb9b8

SHA1
6a1bfb916c97d3f3a2e64a11c3f6861f411345c5

SHA256
ad5ecc1026edf849e0710bb65ecbfe581e94ba24300e36a3dfb2ef95bc4cc8f3

SHA512
35f33388fb541a7f8a630e71db09c15e537a501e01a46d26558c6cb638f0549003a5a649c9850561e8a4d8bd91b537c32aa0589da8d5a37898c68dd24dfbb312

Download Submit
C:\Windows\System\UDRIkIK.exe

Filesize
1.8MB

MD5
8a9de72faf8725e5a6dfd50b3ff7ff11

SHA1
ac34d18fa64a47765a975b91121e63781e3e732a

SHA256
9b1a156d3ba3b0930c4f633fc1ed76caa651cd1277abcd78eb7dd1676c5a75b4

SHA512
327d69c73f602c8a3e80f79443517df3d77ba4cba629950d6e28cdc4e37a60f108328387d6066fb726620d9a1a4ef93639462e60b12aa3c27e17e4895992441b

Download Submit
C:\Windows\System\VTkpUpk.exe

Filesize
1.8MB

MD5
162eaf1ce2b3f0ffd704962b53ebe95c

SHA1
a5f3d15d6b82ecd3895086f23c27c11e9f47debb

SHA256
22549a3b48bbf6ae3ace3891ecf2d086968b988b6d5be6b46f4767d810a00057

SHA512
72132ebae707b6021b1d4f257af1bc788ee1d82a052a505cc08e3429e1bcbdc59a2ec6ba33fe4a1f248fa05fec31033fcb0013855ebf576fe35179d55987529a

Download Submit
C:\Windows\System\VUMYjyG.exe

Filesize
1.8MB

MD5
73864db840b8caaa35f081731560edd3

SHA1
0ea5bb1d5b716b88aeb855ce1b7656e8207553ed

SHA256
e6a39440c883663f2266f2925e83dd8199d47c40c97e16e6804720deeb45cd1b

SHA512
7dfbcd8fe05bbb35515e009a1a553a9380a8496ba96be44de940e076c15fb2f3c5ddb6068790c9e41fdd86bac5f805be1c9d5d2b2c3f163f0de0c75bc882b34a

Download Submit
C:\Windows\System\VaiPpQl.exe

Filesize
1.8MB

MD5
e515e26eccfe016e40ad63af55e33cbe

SHA1
8f4ef1e0f988238ed45e7bb5c1e7318eaec73a38

SHA256
ee653df50e58172494118fe798366ff96d635554a42dec6161ddd28f0f1cde88

SHA512
d0eb3f098aa5c4e071de55cbf8b3c63d4137b194fa8d39e3505c22de968ad736946b6f797a3be36d6761e31aca484456199065a6f828652e4caa102ee3c5788c

Download Submit
C:\Windows\System\WwxqQSL.exe

Filesize
1.9MB

MD5
c8e50620d8232f42168009717db7aad4

SHA1
006f6f6825c3dc99fff66b052ab7845a1007af07

SHA256
f75ac26fb8f181bbbd92684aaed634d0d6ac5881beb345d2a67f67b76a12ee0a

SHA512
80ddff7947f47cba1a6be5e230949b7869ea4f5be42ad915620cd0c778bfb3cf6c42ecb1ad5ad19492ded5717c9e2f54cef4d08994188aff924c12344bfc8dc5

Download Submit
C:\Windows\System\XOimJib.exe

Filesize
1.8MB

MD5
ea80a98ed90a1ee66c885d74ce09c191

SHA1
58f12c1a1f563ce6d8e47eeb2a37da9223a39d50

SHA256
e24d7fc877015d941be0dc6f3384323c8adeec7f393588d01d6f2a3992dd5b39

SHA512
fa5866aea274569c561d18bb459621ce3938127a505335346056fb6bdb557ed99380d0cebcd96824cc8941149761eb95c7b33697b1bc2f8b182613ed6605a421

Download Submit
C:\Windows\System\XoaWPOD.exe

Filesize
1.9MB

MD5
7f529c47d97eb465a43d8af223b10e1d

SHA1
f2d9f56bef20f81e0091797ad6da6d5771eca502

SHA256
ca206dd483a29fec83b751f6c2376105058ce713af3400b41208a628f50ce117

SHA512
35af248983da3508cd88c46703b69ff88090516de3d4dad34419caea9011dafe907bc9be47102e5b1aa97cc9e81ca023c963bcab9adc71bf2206a1855aa25877

Download Submit
C:\Windows\System\YJqbwHV.exe

Filesize
1.8MB

MD5
1033745bf4ee2588efc6632c9fad1be2

SHA1
742fece02bdadf0bb261f6e51225a61e1cab2f45

SHA256
1d40631314dff5aec5f6eed0d12657a7a3e663fa2cb6f66f43d3cd48e7141be3

SHA512
26cf89bd58bdcb623e086db8923ab2c17e0a61e3542e4107279ba012e6bb975fa1d5fcc80fb68ae7c23192b5291c63dbe941f581507eb406a616925505800419

Download Submit
C:\Windows\System\YixxAjU.exe

Filesize
8B

MD5
3277aa72bb7d7f1eb1043502fbd1c406

SHA1
8712dca2f3fbc82bf0cbbeecdc5d6a26c87f443c

SHA256
e94b62f30c9ce8b0b5cea14d4367a52fe08005d1bd56ca932a1fd7fc15c61bc9

SHA512
9fb0369549dba8937fb796cbc4ade6bacf540f10f98e02675f1b04c615cbb49e396cdbd25cd29de56c7bfb889c8464199939a84fa31434a75c020caeb4f9f503

Download Submit
C:\Windows\System\ZEGuHND.exe

Filesize
1.8MB

MD5
7df73b7b9629235b319f0170572d175d

SHA1
8249d9302a1fceb5b525fb7387bf3adc6ccf4ed1

SHA256
8dc8a027eed3a796cbde668e36f11f95f500ee1250a97170a6a4772d8d31bc0c

SHA512
6dff9daf54899728756bb68803ccf12986bcf60cd77f5256c59ee1a840b292a128844be3db6a04295a4f106fad4102013f11b5983c0ef6b291bf43ea5c9f1965

Download Submit
C:\Windows\System\auzldLU.exe

Filesize
1.8MB

MD5
5eb170cef9a8feaac3ba6db796e73e3d

SHA1
00966d41718098d6cf1144fe247871a2de169597

SHA256
8794cfaf1b43a45a7cd12c99d253d977d3925bb18b43932d9869b082936f5557

SHA512
fb8d87137745765f77910db967fc76b8e1148a11d65973e9ec352a81000062821f0737a7451411dd7f9645aeb800bf06a78e602ce94f5738f54d0baad81cd383

Download Submit
C:\Windows\System\bHysYRy.exe

Filesize
1.8MB

MD5
a289fb7aceeba50b21451183394da24b

SHA1
2667cadaf4ba52e4209ee687d717e4c79c56e693

SHA256
1da7e605a15d4504204410c06192e43093967cf7d9769558f8c677be8daf7015

SHA512
1d49683839140d2876308c23df1a75813d0e89863d6d589cb01948e0b4ccd24f80d7d418dd5319b1d22649e7779011fb8c4e767be52f1e1f50d7903c2da72254

Download Submit
C:\Windows\System\cubGikg.exe

Filesize
1.9MB

MD5
7443069a44c8c8c38b23ab7c01a36148

SHA1
db249e4ac5e391622c023a6dd44981edcd209d0f

SHA256
4aa4c7b44125ff5715c87d1c4809fb0715889555bb0e639805153625645b605c

SHA512
9893340f701f1953fed4a663c96d8f06923856190ae7b3ca3a53e4f0fe983e8792112502a6f2fe63fd13f65c924fe29aa2a57286bf1ce0e4c5075160595bb3be

Download Submit
C:\Windows\System\dVGHcsv.exe

Filesize
1.8MB

MD5
06bd1278922c879d4327b7d636c2d86d

SHA1
59c7cfff0ec5801968c066bd087e5c72309d63b0

SHA256
d9d78479a6dd530d1fa1cf2fd578c97da1a2adc403c92dd46a47fbfa012b15f4

SHA512
463a7942e39a0e05812fece7a52cd56f9deaba242a798f2c45fb69cf4a320d6845b1d1861d898c107647d636c6e8973d52d3c5a7d1088d3ccba7d5beb3dffe4c

Download Submit
C:\Windows\System\fBkfFTa.exe

Filesize
1.8MB

MD5
df213382ac615cbf3b7ff057438aa2b9

SHA1
b439ba14cc3d653947834236091a3fed20f045ff

SHA256
6219595959602a8abc0d64bc4fe7856c8e5bf4e87abff7cc901dbf2f4cfceaf8

SHA512
74fddab330de6e8c48f463d01dfd8505053c12a9442a7f809236638ae0cf741af9b0f976279bf730c0af1beb59f7942bea1580f5187fae2087d57daa8188dffe

Download Submit
C:\Windows\System\gGaDRbm.exe

Filesize
1.9MB

MD5
dbdfc35c263a8bdf9cc3f05f7a6a850c

SHA1
bdd42bb37c9fd370c4e5135fb383df0029c875a3

SHA256
d8cb8631de9cde7d1fc016473d93f6ef20846b12a3ac62619383fba92f4388be

SHA512
f866c5e23497f80ef0a7203c5ca898daf68af70bf85c66358c27dbb670c06cf3c801f36e694858e7c2bfd75b059341be8d50bb125f0c992bdfae9d9d4c0af76a

Download Submit
C:\Windows\System\iDzGcCm.exe

Filesize
1.9MB

MD5
a93d4e7b5908a4805a8422e79b458080

SHA1
2234b6e5aa8719e2295d1aa696dbd59b30e80386

SHA256
4e420622ce1f5bad743e9afb002e9fa59ae4f1375eb1e547d11f8b481ab85a3c

SHA512
5377f3cd20d943cf05aca788cc182a1c0193e540e89559d105174bf727873035703dec2c42d38c7ee5bdf520f849a394f2c4ca437186c0715b9b1e9ffb7c7125

Download Submit
C:\Windows\System\kllleSh.exe

Filesize
1.8MB

MD5
d0c779c9716532815e29aa96b114c2c0

SHA1
000ba7499faf7747bf46b343b4cfd7eb07b87687

SHA256
f1b1535eef651427977605478e151ca1d4b0fd38659b8dab3a63b48b9a23c0ab

SHA512
03cae58f1f9c4105ef648d098cd6f81c8dc6f9c6bad83f197b5687698843ea9e30418a9b43cdb237547182d719ca52ec53ebb8e86415908c60241a0f6b2bf950

Download Submit
C:\Windows\System\lpQgskb.exe

Filesize
1.9MB

MD5
5f3d06d37237cab18be62bd698d866eb

SHA1
4ede5bcad90a7cba5e9d2af50b80743085a7f68c

SHA256
91285056dc9afa52dc3ec947fdbabe1fb43cacf74b623da4c91167fffc41bce4

SHA512
f8fba27a867ac2350ee89296b5051cbbcc337ca4be27c58fa448a0ab1f5db462836cd55ed6279343120cc7ea0854477f5b3cc4104ba83cbbfeaa1527310b93b5

Download Submit
C:\Windows\System\lwhYFNM.exe

Filesize
1.8MB

MD5
31cbbd4e238a15a139113bcc02ebcceb

SHA1
d24f41a9c8344808d20c1727533a0d1a6022133c

SHA256
a7cb84f9a0b0f3e7b2916274489a4837d365ef862a9614b822bf78976e4cfa94

SHA512
09c81bc0f5fc83912cfc382406bf552cbf27b04a06af7ec7944aa18b39ba80c38ce4e900c8711783eba61f05d10e3f29a728ca8b649c2f08b6af12e3d71707c5

Download Submit
C:\Windows\System\nqJdknP.exe

Filesize
1.9MB

MD5
aee58e3e89c8cc50f5fdf651350bfd08

SHA1
17a80154a1fb2f63471034855991bbe25f51a809

SHA256
0b8647c3f0b8c19ae97f55610135f1dd7043b90b9c7361ae8e53b29eeebd4585

SHA512
61efb223864c57e77494b00b97c3cc4bb076ce645c3e369527066c17186e98a50f135e6378f694c2113a41554e50211ade22ac7c7fc0ff787576bee10020c2ab

Download Submit
C:\Windows\System\oBWfoKp.exe

Filesize
1.8MB

MD5
bce10478f1b6f7d7b416b23e7bea18f3

SHA1
952a0a5cef7d017182870a2e4e267e413cdcd5d6

SHA256
bd8e1ca7852b1251b2bf1c2c3ddd06a70d04a834172b010ee3687cbfff12b504

SHA512
a2ab86599fd2b5f6185ae98ebec4b093d319aee78337c4db3c90bdddcf87d73771762942fe576b156e382a5fd37ee5cab92fee7f50cd0fb7686f853048e64859

Download Submit
C:\Windows\System\qXLoZeX.exe

Filesize
1.8MB

MD5
a3bed386baa85301569e62386f18818b

SHA1
9a50a49e9c4bff70aa784cb332e23324f94c5987

SHA256
ae7c889973619e5d036e8cfb3181ba81eb898032a140236322b10124fb6ede23

SHA512
87aee19239a586e50feb162a2d032161ca540a25b4d4c5debabc93d4a5220545eb5a7898f7dd6d7213eba815bebc6aba0e8e60c8ceb6605ba118d70dc2fa22e3

Download Submit
C:\Windows\System\qfUXksK.exe

Filesize
1.9MB

MD5
6b690088b5e8f36118d74464f75579a8

SHA1
7ab28c3c82cb5e768d55b3d1534e848025718ef6

SHA256
eacc4ec83e2b8f58f98036e28f10ba0fe822e88ff590dd87e441d7d9ee466a6c

SHA512
c9513677ea6d9cfdadd5349b4cc020ff56b417a49899098a1a30356e8b3101fdcc8f29f4b789bf9832afd90036955e7ddd9e38b5e38877a2a1a3d1cfde18de37

Download Submit
C:\Windows\System\uKOiJmb.exe

Filesize
1.9MB

MD5
d8653ac35277596c36835147444bafc6

SHA1
d100da26c57fed16215faa298f26c301e6964a73

SHA256
1c5440b58a84502bb2fca5bdffe1b4f434d3764f6ef6a4f4530d00182c0e1363

SHA512
fe3d0fac65206ad3778c31cf6d5b4d9f7dbacf6343d069d69aea4335e2709521c19bcc3098398e6056dc1d14c66609aa8abb3ce0fbc713d13d982c6712461188

Download Submit
C:\Windows\System\wFMqyQW.exe

Filesize
1.8MB

MD5
2dc2399ee424e977ba98cf7128540c5b

SHA1
1fbddd8a4793b26b1496001923f4fd07cfbb1bfb

SHA256
9da9b3e79c06a30a2ab198da42c19df66498d6ffec84f89322497e62f7ca369f

SHA512
aeb39d8fcf15050cbfe508159985b6a1b35d3c03e6f1d22b46cc2ac8f03290f0b19c95e13f6641bbd38d0b458bbd14031d3636162f447e939163eb80c9c10542

Download Submit
C:\Windows\System\zPlyTjT.exe

Filesize
1.8MB

MD5
6fc26ea3041786062781a61fe90ae8da

SHA1
f85104933345a5c716f9d1c1adca331ee19fd735

SHA256
5f12c9fe6e8ee47ebdcc94f6fbc0880a0c0e6e97e7264a5997edfd7fade1637a

SHA512
efc2585e1cc95fb23d7ee1d5262d215c81b83b6f83c48a1fd0dd95c1fbbed469da0d8bcaf52f05258fbe4dced46b1eab460cd92c16a48ddf8064b0870a8cb802

Download Submit
memory/448-5494-0x00007FF694170000-0x00007FF694562000-memory.dmp

Filesize
3.9MB

Download
memory/448-227-0x00007FF694170000-0x00007FF694562000-memory.dmp

Filesize
3.9MB

Download
memory/852-1-0x000001F8DD400000-0x000001F8DD410000-memory.dmp

Filesize
64KB

Download
memory/852-0-0x00007FF6D2CB0000-0x00007FF6D30A2000-memory.dmp

Filesize
3.9MB

Download
memory/876-486-0x00007FF713340000-0x00007FF713732000-memory.dmp

Filesize
3.9MB

Download
memory/876-5531-0x00007FF713340000-0x00007FF713732000-memory.dmp

Filesize
3.9MB

Download
memory/1152-151-0x00007FF7E8B50000-0x00007FF7E8F42000-memory.dmp

Filesize
3.9MB

Download
memory/1152-5477-0x00007FF7E8B50000-0x00007FF7E8F42000-memory.dmp

Filesize
3.9MB

Download
memory/1928-122-0x00007FF7B8FC0000-0x00007FF7B93B2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-210-0x00007FF6567F0000-0x00007FF656BE2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-5492-0x00007FF6567F0000-0x00007FF656BE2000-memory.dmp

Filesize
3.9MB

Download
memory/2452-5541-0x00007FF7A6850000-0x00007FF7A6C42000-memory.dmp

Filesize
3.9MB

Download
memory/2452-505-0x00007FF7A6850000-0x00007FF7A6C42000-memory.dmp

Filesize
3.9MB

Download
memory/2656-5473-0x00007FF7F85A0000-0x00007FF7F8992000-memory.dmp

Filesize
3.9MB

Download
memory/2656-188-0x00007FF7F85A0000-0x00007FF7F8992000-memory.dmp

Filesize
3.9MB

Download
memory/2792-21-0x00007FF733DD0000-0x00007FF7341C2000-memory.dmp

Filesize
3.9MB

Download
memory/2932-5497-0x00007FF6CD270000-0x00007FF6CD662000-memory.dmp

Filesize
3.9MB

Download
memory/2932-263-0x00007FF6CD270000-0x00007FF6CD662000-memory.dmp

Filesize
3.9MB

Download
memory/2940-377-0x00007FF6C4580000-0x00007FF6C4972000-memory.dmp

Filesize
3.9MB

Download
memory/2940-5521-0x00007FF6C4580000-0x00007FF6C4972000-memory.dmp

Filesize
3.9MB

Download
memory/2988-100-0x00007FF7D0AB0000-0x00007FF7D0EA2000-memory.dmp

Filesize
3.9MB

Download
memory/3672-510-0x00000236236D0000-0x00000236236E0000-memory.dmp

Filesize
64KB

Download
memory/3672-83-0x00007FFAED7D0000-0x00007FFAEE291000-memory.dmp

Filesize
10.8MB

Download
memory/3672-84-0x00000236236D0000-0x00000236236E0000-memory.dmp

Filesize
64KB

Download
memory/3672-2528-0x00007FFAED7D0000-0x00007FFAEE291000-memory.dmp

Filesize
10.8MB

Download
memory/3672-266-0x000002363C800000-0x000002363C822000-memory.dmp

Filesize
136KB

Download
memory/3744-148-0x00007FF73EE30000-0x00007FF73F222000-memory.dmp

Filesize
3.9MB

Download
memory/3924-523-0x00007FF6A7E20000-0x00007FF6A8212000-memory.dmp

Filesize
3.9MB

Download
memory/3924-5566-0x00007FF6A7E20000-0x00007FF6A8212000-memory.dmp

Filesize
3.9MB

Download
memory/4148-359-0x00007FF7DA650000-0x00007FF7DAA42000-memory.dmp

Filesize
3.9MB

Download
memory/4148-5515-0x00007FF7DA650000-0x00007FF7DAA42000-memory.dmp

Filesize
3.9MB

Download
memory/4180-424-0x00007FF692E40000-0x00007FF693232000-memory.dmp

Filesize
3.9MB

Download
memory/4180-5523-0x00007FF692E40000-0x00007FF693232000-memory.dmp

Filesize
3.9MB

Download
memory/4428-315-0x00007FF689360000-0x00007FF689752000-memory.dmp

Filesize
3.9MB

Download
memory/4428-5509-0x00007FF689360000-0x00007FF689752000-memory.dmp

Filesize
3.9MB

Download
memory/4684-522-0x00007FF7319C0000-0x00007FF731DB2000-memory.dmp

Filesize
3.9MB

Download
memory/4684-5544-0x00007FF7319C0000-0x00007FF731DB2000-memory.dmp

Filesize
3.9MB

Download
memory/4820-508-0x00007FF6C0640000-0x00007FF6C0A32000-memory.dmp

Filesize
3.9MB

Download
memory/4820-5547-0x00007FF6C0640000-0x00007FF6C0A32000-memory.dmp

Filesize
3.9MB

Download
memory/4900-5487-0x00007FF60A610000-0x00007FF60AA02000-memory.dmp

Filesize
3.9MB

Download
memory/4900-295-0x00007FF60A610000-0x00007FF60AA02000-memory.dmp

Filesize
3.9MB

Download
memory/4932-509-0x00007FF771350000-0x00007FF771742000-memory.dmp

Filesize
3.9MB

Download
memory/4932-5408-0x00007FF771350000-0x00007FF771742000-memory.dmp

Filesize
3.9MB

Download
memory/5048-314-0x00007FF7CFFC0000-0x00007FF7D03B2000-memory.dmp

Filesize
3.9MB

Download
memory/5048-5504-0x00007FF7CFFC0000-0x00007FF7D03B2000-memory.dmp

Filesize
3.9MB

Download