xmrig | e197bdabdf4b7a4b3aae7763dae87b4d5a835bb45dd3ace7e03fd50c51002d94

Analysis

max time kernel
46s
max time network
38s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
Size

2.2MB
MD5

08be58b43d5253fdc67a1334f5b98f59
SHA1

1e166a225441ccb3495a030fd428137f219a2e13
SHA256

e197bdabdf4b7a4b3aae7763dae87b4d5a835bb45dd3ace7e03fd50c51002d94
SHA512

5f2de45c869e2eca32ff549d054e643eb00b9d0e7028bb37914955e6d6d6e11b5f81e8624027e1676d4ca5f6097544246950bc0ba8eb97edf77b5507d17f5835
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfA:NABn

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/1804-75-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2152-71-0x000000013FF60000-0x0000000140352000-memory.dmp	xmrig
behavioral1/memory/1896-21-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/1428-13-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig
behavioral1/memory/2388-104-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig
behavioral1/memory/2516-103-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2560-102-0x000000013F380000-0x000000013F772000-memory.dmp	xmrig
behavioral1/memory/2616-91-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/1428-1585-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig
behavioral1/memory/2296-1577-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1428	BmnMBBe.exe
1896	cTHyxfH.exe
2152	aTOsJmR.exe
1804	eDEzrdQ.exe
2560	NxZaXgg.exe
2516	kmiLEzH.exe
2616	BYsCtUj.exe
2388	hxhlImy.exe
2416	IsAhxwX.exe
1772	OuIoOrm.exe
3008	XNDCncj.exe
2636	vsrlmSO.exe
2508	DdQusDP.exe
2576	VoFcxQA.exe
1060	mNhMpsn.exe
2960	rcGStNT.exe
2372	MDLQRUg.exe
2036	BmAGVlz.exe
2452	AHOahIQ.exe
2584	kfRLhTj.exe
1604	AQDXxrc.exe
752	KbPVWQf.exe
2400	rEMQXUo.exe
1944	KPOkepz.exe
1780	VRreCqb.exe
2460	VmFnmKQ.exe
1120	vneDNPX.exe
1488	LZxRlYe.exe
1680	UYqHvgn.exe
1876	NFvfIsN.exe
1128	rHUFUqA.exe
1088	GbIsvFK.exe
1040	HTkVbww.exe
1476	eXFwciW.exe
1932	YrCUhoj.exe
1392	BuOhroP.exe
652	yrkXyab.exe
3068	VnJSmLR.exe
1736	XJMzChf.exe
1608	TzAyqQS.exe
776	ZmAnJTq.exe
2308	MuLtmGC.exe
2056	SKrWNAL.exe
352	kaucxdc.exe
2216	adjbGFB.exe
3052	DXvCBfg.exe
2968	ySlYtHd.exe
876	EpUbosn.exe
2184	JlhIJgl.exe
2796	IseBMfj.exe
1568	IlfjdfA.exe
1296	VXzUIHR.exe
2280	AXzJguT.exe
2672	dIiAxyo.exe
2644	qtCQKYz.exe
2548	DtsHPzc.exe
1996	wYbwolF.exe
2676	RRePkmC.exe
2496	TYgIEor.exe
2736	OefJULl.exe
2564	CJEhqfT.exe
1552	rSMOaaD.exe
2692	rkVDAHq.exe
2872	TxZRhbO.exe

Loads dropped DLL 64 IoCs

pid	Process
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2296-1-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/files/0x00070000000122cd-5.dat	upx
behavioral1/files/0x0008000000014185-10.dat	upx
behavioral1/files/0x0006000000014e51-45.dat	upx
behavioral1/files/0x000600000001568c-123.dat	upx
behavioral1/files/0x0006000000015ca6-133.dat	upx
behavioral1/files/0x0006000000015be6-128.dat	upx
behavioral1/files/0x000600000001567f-118.dat	upx
behavioral1/files/0x0006000000014baa-83.dat	upx
behavioral1/files/0x0008000000014b27-82.dat	upx
behavioral1/files/0x0007000000014318-81.dat	upx
behavioral1/files/0x000800000001420f-80.dat	upx
behavioral1/files/0x0006000000015d5e-179.dat	upx
behavioral1/files/0x0006000000015d4a-171.dat	upx
behavioral1/files/0x0006000000015d07-163.dat	upx
behavioral1/files/0x0006000000015ce1-155.dat	upx
behavioral1/files/0x0006000000015d56-175.dat	upx
behavioral1/files/0x0006000000015d28-167.dat	upx
behavioral1/files/0x0006000000015cba-152.dat	upx
behavioral1/files/0x000a000000013a7c-151.dat	upx
behavioral1/files/0x0006000000015ceb-158.dat	upx
behavioral1/files/0x000600000001566b-114.dat	upx
behavioral1/files/0x0006000000015cd5-145.dat	upx
behavioral1/files/0x0007000000015653-79.dat	upx
behavioral1/files/0x000600000001508a-78.dat	upx
behavioral1/memory/1804-75-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/files/0x0006000000014bea-74.dat	upx
behavioral1/files/0x0006000000014b63-73.dat	upx
behavioral1/memory/2152-71-0x000000013FF60000-0x0000000140352000-memory.dmp	upx
behavioral1/files/0x000700000001432c-70.dat	upx
behavioral1/files/0x000700000001424e-65.dat	upx
behavioral1/files/0x0006000000015659-63.dat	upx
behavioral1/files/0x0007000000004e76-55.dat	upx
behavioral1/memory/1896-21-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/1428-13-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/memory/2388-104-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/memory/2516-103-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/2560-102-0x000000013F380000-0x000000013F772000-memory.dmp	upx
behavioral1/memory/2616-91-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/files/0x0006000000015661-87.dat	upx
behavioral1/files/0x000a000000013a45-12.dat	upx
behavioral1/memory/1428-1585-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/memory/2296-1577-0x000000013FE60000-0x0000000140252000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JyCBhyE.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\jQlcGAj.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\AyPuVdE.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\nWOMfEs.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\hnjvjIp.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\MsRQyRp.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\IbEnmyh.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\xZXCXzj.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\tsJXPlB.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\XkyUzdq.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\KGqDqpq.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\IUxwxHA.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\tHZTmwR.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\hAlbBGc.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\IxZqJmY.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\MDLQRUg.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\UtVxQHL.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\KtzwZCg.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\Yicumas.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\wTMGKYo.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\AHOahIQ.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\oXkAKaJ.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\rSLHxGX.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\vQiXTcp.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\TusFFoa.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\SfbNDvl.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\KPOkepz.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\zyjTkXY.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\YBtxQTu.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\EcJVCJd.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\EyirZcR.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\lPRgYeY.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\wGaZZAh.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\RrccFkC.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\mullPdx.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\RREbGvX.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\pddOWbe.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\nLFcaMl.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\VXzUIHR.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\KoYmWKE.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\vnpTfsO.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\BixXipG.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\OCwfZzH.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\XCsUvoE.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\DTsUaXQ.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\TvRwFbH.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\DHMuIia.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\eQXhkKs.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\pHQUBNc.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\NIURNrG.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\rcGStNT.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\apPyYrx.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\tLmiBfW.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\wRlFxVU.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\BpGoDEi.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\cbwgJVq.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\JdjjJBS.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\ufZplzD.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\syFaiFr.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\IuQMXIr.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\DdQusDP.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\UWLDKNs.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\XjuGWBA.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
File created	C:\Windows\System\zdoFqZJ.exe	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1796	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
Token: SeDebugPrivilege	1796	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 1796	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	29
PID 2296 wrote to memory of 1796	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	29
PID 2296 wrote to memory of 1796	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	29
PID 2296 wrote to memory of 1428	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	30
PID 2296 wrote to memory of 1428	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	30
PID 2296 wrote to memory of 1428	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	30
PID 2296 wrote to memory of 1896	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	31
PID 2296 wrote to memory of 1896	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	31
PID 2296 wrote to memory of 1896	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	31
PID 2296 wrote to memory of 2152	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	32
PID 2296 wrote to memory of 2152	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	32
PID 2296 wrote to memory of 2152	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	32
PID 2296 wrote to memory of 1772	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	33
PID 2296 wrote to memory of 1772	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	33
PID 2296 wrote to memory of 1772	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	33
PID 2296 wrote to memory of 1804	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	34
PID 2296 wrote to memory of 1804	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	34
PID 2296 wrote to memory of 1804	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	34
PID 2296 wrote to memory of 3008	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	35
PID 2296 wrote to memory of 3008	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	35
PID 2296 wrote to memory of 3008	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	35
PID 2296 wrote to memory of 2560	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	36
PID 2296 wrote to memory of 2560	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	36
PID 2296 wrote to memory of 2560	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	36
PID 2296 wrote to memory of 2636	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	37
PID 2296 wrote to memory of 2636	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	37
PID 2296 wrote to memory of 2636	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	37
PID 2296 wrote to memory of 2516	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	38
PID 2296 wrote to memory of 2516	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	38
PID 2296 wrote to memory of 2516	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	38
PID 2296 wrote to memory of 2508	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	39
PID 2296 wrote to memory of 2508	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	39
PID 2296 wrote to memory of 2508	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	39
PID 2296 wrote to memory of 2616	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	40
PID 2296 wrote to memory of 2616	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	40
PID 2296 wrote to memory of 2616	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	40
PID 2296 wrote to memory of 2576	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	41
PID 2296 wrote to memory of 2576	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	41
PID 2296 wrote to memory of 2576	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	41
PID 2296 wrote to memory of 2388	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	42
PID 2296 wrote to memory of 2388	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	42
PID 2296 wrote to memory of 2388	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	42
PID 2296 wrote to memory of 2960	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	43
PID 2296 wrote to memory of 2960	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	43
PID 2296 wrote to memory of 2960	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	43
PID 2296 wrote to memory of 2416	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	44
PID 2296 wrote to memory of 2416	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	44
PID 2296 wrote to memory of 2416	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	44
PID 2296 wrote to memory of 2372	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	45
PID 2296 wrote to memory of 2372	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	45
PID 2296 wrote to memory of 2372	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	45
PID 2296 wrote to memory of 1060	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	46
PID 2296 wrote to memory of 1060	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	46
PID 2296 wrote to memory of 1060	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	46
PID 2296 wrote to memory of 2036	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	47
PID 2296 wrote to memory of 2036	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	47
PID 2296 wrote to memory of 2036	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	47
PID 2296 wrote to memory of 2452	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	48
PID 2296 wrote to memory of 2452	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	48
PID 2296 wrote to memory of 2452	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	48
PID 2296 wrote to memory of 2584	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	49
PID 2296 wrote to memory of 2584	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	49
PID 2296 wrote to memory of 2584	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	49
PID 2296 wrote to memory of 1604	2296	08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08be58b43d5253fdc67a1334f5b98f59_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1796
- C:\Windows\System\BmnMBBe.exe
  C:\Windows\System\BmnMBBe.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\cTHyxfH.exe
  C:\Windows\System\cTHyxfH.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\aTOsJmR.exe
  C:\Windows\System\aTOsJmR.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\OuIoOrm.exe
  C:\Windows\System\OuIoOrm.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\eDEzrdQ.exe
  C:\Windows\System\eDEzrdQ.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\XNDCncj.exe
  C:\Windows\System\XNDCncj.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\NxZaXgg.exe
  C:\Windows\System\NxZaXgg.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\vsrlmSO.exe
  C:\Windows\System\vsrlmSO.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\kmiLEzH.exe
  C:\Windows\System\kmiLEzH.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\DdQusDP.exe
  C:\Windows\System\DdQusDP.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\BYsCtUj.exe
  C:\Windows\System\BYsCtUj.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\VoFcxQA.exe
  C:\Windows\System\VoFcxQA.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\hxhlImy.exe
  C:\Windows\System\hxhlImy.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\rcGStNT.exe
  C:\Windows\System\rcGStNT.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\IsAhxwX.exe
  C:\Windows\System\IsAhxwX.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\MDLQRUg.exe
  C:\Windows\System\MDLQRUg.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\mNhMpsn.exe
  C:\Windows\System\mNhMpsn.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\BmAGVlz.exe
  C:\Windows\System\BmAGVlz.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\AHOahIQ.exe
  C:\Windows\System\AHOahIQ.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\kfRLhTj.exe
  C:\Windows\System\kfRLhTj.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\AQDXxrc.exe
  C:\Windows\System\AQDXxrc.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\KPOkepz.exe
  C:\Windows\System\KPOkepz.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\KbPVWQf.exe
  C:\Windows\System\KbPVWQf.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\VRreCqb.exe
  C:\Windows\System\VRreCqb.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\rEMQXUo.exe
  C:\Windows\System\rEMQXUo.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\VmFnmKQ.exe
  C:\Windows\System\VmFnmKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\vneDNPX.exe
  C:\Windows\System\vneDNPX.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\LZxRlYe.exe
  C:\Windows\System\LZxRlYe.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\UYqHvgn.exe
  C:\Windows\System\UYqHvgn.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\NFvfIsN.exe
  C:\Windows\System\NFvfIsN.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\rHUFUqA.exe
  C:\Windows\System\rHUFUqA.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\GbIsvFK.exe
  C:\Windows\System\GbIsvFK.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\HTkVbww.exe
  C:\Windows\System\HTkVbww.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\eXFwciW.exe
  C:\Windows\System\eXFwciW.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\YrCUhoj.exe
  C:\Windows\System\YrCUhoj.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\BuOhroP.exe
  C:\Windows\System\BuOhroP.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\yrkXyab.exe
  C:\Windows\System\yrkXyab.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\VnJSmLR.exe
  C:\Windows\System\VnJSmLR.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\XJMzChf.exe
  C:\Windows\System\XJMzChf.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\TzAyqQS.exe
  C:\Windows\System\TzAyqQS.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\ZmAnJTq.exe
  C:\Windows\System\ZmAnJTq.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\MuLtmGC.exe
  C:\Windows\System\MuLtmGC.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\SKrWNAL.exe
  C:\Windows\System\SKrWNAL.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\kaucxdc.exe
  C:\Windows\System\kaucxdc.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\adjbGFB.exe
  C:\Windows\System\adjbGFB.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\DXvCBfg.exe
  C:\Windows\System\DXvCBfg.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\ySlYtHd.exe
  C:\Windows\System\ySlYtHd.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\EpUbosn.exe
  C:\Windows\System\EpUbosn.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\JlhIJgl.exe
  C:\Windows\System\JlhIJgl.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\IseBMfj.exe
  C:\Windows\System\IseBMfj.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\IlfjdfA.exe
  C:\Windows\System\IlfjdfA.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\VXzUIHR.exe
  C:\Windows\System\VXzUIHR.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\AXzJguT.exe
  C:\Windows\System\AXzJguT.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\dIiAxyo.exe
  C:\Windows\System\dIiAxyo.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\qtCQKYz.exe
  C:\Windows\System\qtCQKYz.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\DtsHPzc.exe
  C:\Windows\System\DtsHPzc.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\wYbwolF.exe
  C:\Windows\System\wYbwolF.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\RRePkmC.exe
  C:\Windows\System\RRePkmC.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\TYgIEor.exe
  C:\Windows\System\TYgIEor.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\OefJULl.exe
  C:\Windows\System\OefJULl.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\CJEhqfT.exe
  C:\Windows\System\CJEhqfT.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\rSMOaaD.exe
  C:\Windows\System\rSMOaaD.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\rkVDAHq.exe
  C:\Windows\System\rkVDAHq.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\TxZRhbO.exe
  C:\Windows\System\TxZRhbO.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\KaVixTv.exe
  C:\Windows\System\KaVixTv.exe
  2⤵
  PID:2524
- C:\Windows\System\mwMnfFl.exe
  C:\Windows\System\mwMnfFl.exe
  2⤵
  PID:2536
- C:\Windows\System\UHvwybU.exe
  C:\Windows\System\UHvwybU.exe
  2⤵
  PID:2440
- C:\Windows\System\oVLWieQ.exe
  C:\Windows\System\oVLWieQ.exe
  2⤵
  PID:1444
- C:\Windows\System\DDgYlXz.exe
  C:\Windows\System\DDgYlXz.exe
  2⤵
  PID:1864
- C:\Windows\System\OcJSLSj.exe
  C:\Windows\System\OcJSLSj.exe
  2⤵
  PID:1808
- C:\Windows\System\sEhfzwu.exe
  C:\Windows\System\sEhfzwu.exe
  2⤵
  PID:948
- C:\Windows\System\tQIiLsj.exe
  C:\Windows\System\tQIiLsj.exe
  2⤵
  PID:2912
- C:\Windows\System\jDpMuUq.exe
  C:\Windows\System\jDpMuUq.exe
  2⤵
  PID:1692
- C:\Windows\System\URYjvTV.exe
  C:\Windows\System\URYjvTV.exe
  2⤵
  PID:540
- C:\Windows\System\gAvjqPN.exe
  C:\Windows\System\gAvjqPN.exe
  2⤵
  PID:488
- C:\Windows\System\JGUTzwg.exe
  C:\Windows\System\JGUTzwg.exe
  2⤵
  PID:1532
- C:\Windows\System\StDSuhb.exe
  C:\Windows\System\StDSuhb.exe
  2⤵
  PID:1852
- C:\Windows\System\QjooBqQ.exe
  C:\Windows\System\QjooBqQ.exe
  2⤵
  PID:2448
- C:\Windows\System\rRMwZIy.exe
  C:\Windows\System\rRMwZIy.exe
  2⤵
  PID:1536
- C:\Windows\System\pRoENGP.exe
  C:\Windows\System\pRoENGP.exe
  2⤵
  PID:1356
- C:\Windows\System\IZWThmJ.exe
  C:\Windows\System\IZWThmJ.exe
  2⤵
  PID:1940
- C:\Windows\System\UoXSGUc.exe
  C:\Windows\System\UoXSGUc.exe
  2⤵
  PID:1756
- C:\Windows\System\MNzuSge.exe
  C:\Windows\System\MNzuSge.exe
  2⤵
  PID:3024
- C:\Windows\System\xxZogNh.exe
  C:\Windows\System\xxZogNh.exe
  2⤵
  PID:3016
- C:\Windows\System\cbwgJVq.exe
  C:\Windows\System\cbwgJVq.exe
  2⤵
  PID:2316
- C:\Windows\System\fbPypRY.exe
  C:\Windows\System\fbPypRY.exe
  2⤵
  PID:2748
- C:\Windows\System\zzgBilE.exe
  C:\Windows\System\zzgBilE.exe
  2⤵
  PID:2340
- C:\Windows\System\vBFcONl.exe
  C:\Windows\System\vBFcONl.exe
  2⤵
  PID:884
- C:\Windows\System\gCXwmCC.exe
  C:\Windows\System\gCXwmCC.exe
  2⤵
  PID:1504
- C:\Windows\System\SHUnVEK.exe
  C:\Windows\System\SHUnVEK.exe
  2⤵
  PID:2944
- C:\Windows\System\zdAvGtj.exe
  C:\Windows\System\zdAvGtj.exe
  2⤵
  PID:1904
- C:\Windows\System\yrlfEKV.exe
  C:\Windows\System\yrlfEKV.exe
  2⤵
  PID:2128
- C:\Windows\System\hcuqUlB.exe
  C:\Windows\System\hcuqUlB.exe
  2⤵
  PID:2668
- C:\Windows\System\ARSMlXR.exe
  C:\Windows\System\ARSMlXR.exe
  2⤵
  PID:2684
- C:\Windows\System\XlguDfh.exe
  C:\Windows\System\XlguDfh.exe
  2⤵
  PID:2384
- C:\Windows\System\OZmtEMF.exe
  C:\Windows\System\OZmtEMF.exe
  2⤵
  PID:2044
- C:\Windows\System\JdjjJBS.exe
  C:\Windows\System\JdjjJBS.exe
  2⤵
  PID:1936
- C:\Windows\System\KjAIlMe.exe
  C:\Windows\System\KjAIlMe.exe
  2⤵
  PID:1460
- C:\Windows\System\oilCYVV.exe
  C:\Windows\System\oilCYVV.exe
  2⤵
  PID:2628
- C:\Windows\System\EfSgVPH.exe
  C:\Windows\System\EfSgVPH.exe
  2⤵
  PID:2012
- C:\Windows\System\WRJkVSy.exe
  C:\Windows\System\WRJkVSy.exe
  2⤵
  PID:2696
- C:\Windows\System\hQAHzBy.exe
  C:\Windows\System\hQAHzBy.exe
  2⤵
  PID:2348
- C:\Windows\System\cAAnJWF.exe
  C:\Windows\System\cAAnJWF.exe
  2⤵
  PID:2712
- C:\Windows\System\HayRyii.exe
  C:\Windows\System\HayRyii.exe
  2⤵
  PID:1920
- C:\Windows\System\XjuGWBA.exe
  C:\Windows\System\XjuGWBA.exe
  2⤵
  PID:2176
- C:\Windows\System\YTLLiAA.exe
  C:\Windows\System\YTLLiAA.exe
  2⤵
  PID:384
- C:\Windows\System\MUWHHKG.exe
  C:\Windows\System\MUWHHKG.exe
  2⤵
  PID:840
- C:\Windows\System\KoYmWKE.exe
  C:\Windows\System\KoYmWKE.exe
  2⤵
  PID:1632
- C:\Windows\System\tYjynRR.exe
  C:\Windows\System\tYjynRR.exe
  2⤵
  PID:1696
- C:\Windows\System\SzRrhVy.exe
  C:\Windows\System\SzRrhVy.exe
  2⤵
  PID:1548
- C:\Windows\System\duiXiLi.exe
  C:\Windows\System\duiXiLi.exe
  2⤵
  PID:1664
- C:\Windows\System\xxJjsez.exe
  C:\Windows\System\xxJjsez.exe
  2⤵
  PID:2116
- C:\Windows\System\oXkAKaJ.exe
  C:\Windows\System\oXkAKaJ.exe
  2⤵
  PID:1544
- C:\Windows\System\xZXCXzj.exe
  C:\Windows\System\xZXCXzj.exe
  2⤵
  PID:2820
- C:\Windows\System\JrKQhDp.exe
  C:\Windows\System\JrKQhDp.exe
  2⤵
  PID:2088
- C:\Windows\System\zzcLEcd.exe
  C:\Windows\System\zzcLEcd.exe
  2⤵
  PID:1988
- C:\Windows\System\XUsGluy.exe
  C:\Windows\System\XUsGluy.exe
  2⤵
  PID:1292
- C:\Windows\System\LqVmmlX.exe
  C:\Windows\System\LqVmmlX.exe
  2⤵
  PID:1728
- C:\Windows\System\tBaPKaA.exe
  C:\Windows\System\tBaPKaA.exe
  2⤵
  PID:2052
- C:\Windows\System\CFYXNbR.exe
  C:\Windows\System\CFYXNbR.exe
  2⤵
  PID:868
- C:\Windows\System\siOyelL.exe
  C:\Windows\System\siOyelL.exe
  2⤵
  PID:2572
- C:\Windows\System\WstHjty.exe
  C:\Windows\System\WstHjty.exe
  2⤵
  PID:2248
- C:\Windows\System\DnmchTE.exe
  C:\Windows\System\DnmchTE.exe
  2⤵
  PID:2480
- C:\Windows\System\XReWLJU.exe
  C:\Windows\System\XReWLJU.exe
  2⤵
  PID:1884
- C:\Windows\System\UVKmNoU.exe
  C:\Windows\System\UVKmNoU.exe
  2⤵
  PID:2420
- C:\Windows\System\MTWqiGI.exe
  C:\Windows\System\MTWqiGI.exe
  2⤵
  PID:1816
- C:\Windows\System\AwdRBIx.exe
  C:\Windows\System\AwdRBIx.exe
  2⤵
  PID:2032
- C:\Windows\System\rorVyoi.exe
  C:\Windows\System\rorVyoi.exe
  2⤵
  PID:2816
- C:\Windows\System\ACQhhTz.exe
  C:\Windows\System\ACQhhTz.exe
  2⤵
  PID:1276
- C:\Windows\System\ErpJbXo.exe
  C:\Windows\System\ErpJbXo.exe
  2⤵
  PID:2392
- C:\Windows\System\mikUosB.exe
  C:\Windows\System\mikUosB.exe
  2⤵
  PID:2408
- C:\Windows\System\spfOOYC.exe
  C:\Windows\System\spfOOYC.exe
  2⤵
  PID:636
- C:\Windows\System\rxpIJFE.exe
  C:\Windows\System\rxpIJFE.exe
  2⤵
  PID:1244
- C:\Windows\System\jQlcGAj.exe
  C:\Windows\System\jQlcGAj.exe
  2⤵
  PID:3088
- C:\Windows\System\AvUTeOM.exe
  C:\Windows\System\AvUTeOM.exe
  2⤵
  PID:3104
- C:\Windows\System\OCwfZzH.exe
  C:\Windows\System\OCwfZzH.exe
  2⤵
  PID:3124
- C:\Windows\System\gAzCTLR.exe
  C:\Windows\System\gAzCTLR.exe
  2⤵
  PID:3140
- C:\Windows\System\szEUrDw.exe
  C:\Windows\System\szEUrDw.exe
  2⤵
  PID:3156
- C:\Windows\System\LPaHIDi.exe
  C:\Windows\System\LPaHIDi.exe
  2⤵
  PID:3176
- C:\Windows\System\PsyoAaF.exe
  C:\Windows\System\PsyoAaF.exe
  2⤵
  PID:3192
- C:\Windows\System\qHRLNSb.exe
  C:\Windows\System\qHRLNSb.exe
  2⤵
  PID:3212
- C:\Windows\System\yTJwMFt.exe
  C:\Windows\System\yTJwMFt.exe
  2⤵
  PID:3228
- C:\Windows\System\HsudzoZ.exe
  C:\Windows\System\HsudzoZ.exe
  2⤵
  PID:3244
- C:\Windows\System\JykoxKM.exe
  C:\Windows\System\JykoxKM.exe
  2⤵
  PID:3260
- C:\Windows\System\jmyvMbs.exe
  C:\Windows\System\jmyvMbs.exe
  2⤵
  PID:3276
- C:\Windows\System\CsDhAUE.exe
  C:\Windows\System\CsDhAUE.exe
  2⤵
  PID:3292
- C:\Windows\System\fDEmckx.exe
  C:\Windows\System\fDEmckx.exe
  2⤵
  PID:3308
- C:\Windows\System\cGfIqJv.exe
  C:\Windows\System\cGfIqJv.exe
  2⤵
  PID:3324
- C:\Windows\System\XFWxWgT.exe
  C:\Windows\System\XFWxWgT.exe
  2⤵
  PID:3344
- C:\Windows\System\BDnxojO.exe
  C:\Windows\System\BDnxojO.exe
  2⤵
  PID:3360
- C:\Windows\System\xErGCtN.exe
  C:\Windows\System\xErGCtN.exe
  2⤵
  PID:3376
- C:\Windows\System\kYEHuNV.exe
  C:\Windows\System\kYEHuNV.exe
  2⤵
  PID:3392
- C:\Windows\System\jkFRcPw.exe
  C:\Windows\System\jkFRcPw.exe
  2⤵
  PID:3408
- C:\Windows\System\bnfLVOH.exe
  C:\Windows\System\bnfLVOH.exe
  2⤵
  PID:3424
- C:\Windows\System\zaOrHXp.exe
  C:\Windows\System\zaOrHXp.exe
  2⤵
  PID:3440
- C:\Windows\System\lyvWVid.exe
  C:\Windows\System\lyvWVid.exe
  2⤵
  PID:3456
- C:\Windows\System\VDicaOR.exe
  C:\Windows\System\VDicaOR.exe
  2⤵
  PID:3472
- C:\Windows\System\QeTPJAC.exe
  C:\Windows\System\QeTPJAC.exe
  2⤵
  PID:3488
- C:\Windows\System\EXFgBfm.exe
  C:\Windows\System\EXFgBfm.exe
  2⤵
  PID:3532
- C:\Windows\System\FWoeSbh.exe
  C:\Windows\System\FWoeSbh.exe
  2⤵
  PID:3548
- C:\Windows\System\LbsTywo.exe
  C:\Windows\System\LbsTywo.exe
  2⤵
  PID:3816
- C:\Windows\System\WycTrrh.exe
  C:\Windows\System\WycTrrh.exe
  2⤵
  PID:3832
- C:\Windows\System\KwkzYjB.exe
  C:\Windows\System\KwkzYjB.exe
  2⤵
  PID:3848
- C:\Windows\System\kZPNmoL.exe
  C:\Windows\System\kZPNmoL.exe
  2⤵
  PID:3864
- C:\Windows\System\CligqbQ.exe
  C:\Windows\System\CligqbQ.exe
  2⤵
  PID:3880
- C:\Windows\System\CXpxHCU.exe
  C:\Windows\System\CXpxHCU.exe
  2⤵
  PID:3900
- C:\Windows\System\nsRFctj.exe
  C:\Windows\System\nsRFctj.exe
  2⤵
  PID:3916
- C:\Windows\System\tsJXPlB.exe
  C:\Windows\System\tsJXPlB.exe
  2⤵
  PID:3932
- C:\Windows\System\OAbQfSI.exe
  C:\Windows\System\OAbQfSI.exe
  2⤵
  PID:3948
- C:\Windows\System\TTvrTaY.exe
  C:\Windows\System\TTvrTaY.exe
  2⤵
  PID:3964
- C:\Windows\System\qBiUOoQ.exe
  C:\Windows\System\qBiUOoQ.exe
  2⤵
  PID:3984
- C:\Windows\System\mullPdx.exe
  C:\Windows\System\mullPdx.exe
  2⤵
  PID:4000
- C:\Windows\System\KtzwZCg.exe
  C:\Windows\System\KtzwZCg.exe
  2⤵
  PID:4016
- C:\Windows\System\DrcCYOD.exe
  C:\Windows\System\DrcCYOD.exe
  2⤵
  PID:4032
- C:\Windows\System\WitZWmX.exe
  C:\Windows\System\WitZWmX.exe
  2⤵
  PID:4052
- C:\Windows\System\tLmiBfW.exe
  C:\Windows\System\tLmiBfW.exe
  2⤵
  PID:808
- C:\Windows\System\MlQFDqJ.exe
  C:\Windows\System\MlQFDqJ.exe
  2⤵
  PID:1416
- C:\Windows\System\oIZDAXu.exe
  C:\Windows\System\oIZDAXu.exe
  2⤵
  PID:2724
- C:\Windows\System\OohGOQP.exe
  C:\Windows\System\OohGOQP.exe
  2⤵
  PID:556
- C:\Windows\System\TTnHAwx.exe
  C:\Windows\System\TTnHAwx.exe
  2⤵
  PID:1764
- C:\Windows\System\ODqvGXs.exe
  C:\Windows\System\ODqvGXs.exe
  2⤵
  PID:1624
- C:\Windows\System\hwlKCKj.exe
  C:\Windows\System\hwlKCKj.exe
  2⤵
  PID:1584
- C:\Windows\System\KSkzVTd.exe
  C:\Windows\System\KSkzVTd.exe
  2⤵
  PID:3036
- C:\Windows\System\EHcndfw.exe
  C:\Windows\System\EHcndfw.exe
  2⤵
  PID:2624
- C:\Windows\System\JULaYvt.exe
  C:\Windows\System\JULaYvt.exe
  2⤵
  PID:2528
- C:\Windows\System\GRdPHqE.exe
  C:\Windows\System\GRdPHqE.exe
  2⤵
  PID:3080
- C:\Windows\System\SRQsvoX.exe
  C:\Windows\System\SRQsvoX.exe
  2⤵
  PID:3148
- C:\Windows\System\dsngkDs.exe
  C:\Windows\System\dsngkDs.exe
  2⤵
  PID:3220
- C:\Windows\System\WfAGRaf.exe
  C:\Windows\System\WfAGRaf.exe
  2⤵
  PID:3288
- C:\Windows\System\XkWfeAA.exe
  C:\Windows\System\XkWfeAA.exe
  2⤵
  PID:3356
- C:\Windows\System\FhYURXs.exe
  C:\Windows\System\FhYURXs.exe
  2⤵
  PID:3420
- C:\Windows\System\ZuEKhez.exe
  C:\Windows\System\ZuEKhez.exe
  2⤵
  PID:3484
- C:\Windows\System\PfOdnpz.exe
  C:\Windows\System\PfOdnpz.exe
  2⤵
  PID:2208
- C:\Windows\System\apPyYrx.exe
  C:\Windows\System\apPyYrx.exe
  2⤵
  PID:2332
- C:\Windows\System\mXVLGmQ.exe
  C:\Windows\System\mXVLGmQ.exe
  2⤵
  PID:2936
- C:\Windows\System\cBCoxoU.exe
  C:\Windows\System\cBCoxoU.exe
  2⤵
  PID:3096
- C:\Windows\System\GjekDEH.exe
  C:\Windows\System\GjekDEH.exe
  2⤵
  PID:3168
- C:\Windows\System\xgnjzUm.exe
  C:\Windows\System\xgnjzUm.exe
  2⤵
  PID:3208
- C:\Windows\System\NTEXTDf.exe
  C:\Windows\System\NTEXTDf.exe
  2⤵
  PID:3332
- C:\Windows\System\yTsDIiQ.exe
  C:\Windows\System\yTsDIiQ.exe
  2⤵
  PID:3372
- C:\Windows\System\pVuuHFk.exe
  C:\Windows\System\pVuuHFk.exe
  2⤵
  PID:3436
- C:\Windows\System\qkUVBLa.exe
  C:\Windows\System\qkUVBLa.exe
  2⤵
  PID:3500
- C:\Windows\System\MJpkTAJ.exe
  C:\Windows\System\MJpkTAJ.exe
  2⤵
  PID:3512
- C:\Windows\System\BeiasrZ.exe
  C:\Windows\System\BeiasrZ.exe
  2⤵
  PID:2412
- C:\Windows\System\JLHzqTI.exe
  C:\Windows\System\JLHzqTI.exe
  2⤵
  PID:3828
- C:\Windows\System\FLvyvTT.exe
  C:\Windows\System\FLvyvTT.exe
  2⤵
  PID:3924
- C:\Windows\System\IKOHBqA.exe
  C:\Windows\System\IKOHBqA.exe
  2⤵
  PID:3992
- C:\Windows\System\oJNrLGH.exe
  C:\Windows\System\oJNrLGH.exe
  2⤵
  PID:1892
- C:\Windows\System\MTXhXye.exe
  C:\Windows\System\MTXhXye.exe
  2⤵
  PID:844
- C:\Windows\System\nCaErIi.exe
  C:\Windows\System\nCaErIi.exe
  2⤵
  PID:1872
- C:\Windows\System\CiJBbpf.exe
  C:\Windows\System\CiJBbpf.exe
  2⤵
  PID:2884
- C:\Windows\System\DlfcyVl.exe
  C:\Windows\System\DlfcyVl.exe
  2⤵
  PID:3872
- C:\Windows\System\JyoORrR.exe
  C:\Windows\System\JyoORrR.exe
  2⤵
  PID:3940
- C:\Windows\System\YDsRlDI.exe
  C:\Windows\System\YDsRlDI.exe
  2⤵
  PID:4084
- C:\Windows\System\gNEywri.exe
  C:\Windows\System\gNEywri.exe
  2⤵
  PID:2764
- C:\Windows\System\cquRkpj.exe
  C:\Windows\System\cquRkpj.exe
  2⤵
  PID:2220
- C:\Windows\System\zXNbdeS.exe
  C:\Windows\System\zXNbdeS.exe
  2⤵
  PID:3640
- C:\Windows\System\KGqDqpq.exe
  C:\Windows\System\KGqDqpq.exe
  2⤵
  PID:3652
- C:\Windows\System\VpNOyuB.exe
  C:\Windows\System\VpNOyuB.exe
  2⤵
  PID:3668
- C:\Windows\System\qiDjyIY.exe
  C:\Windows\System\qiDjyIY.exe
  2⤵
  PID:3684
- C:\Windows\System\gYOiEwL.exe
  C:\Windows\System\gYOiEwL.exe
  2⤵
  PID:3704
- C:\Windows\System\GQiXxzG.exe
  C:\Windows\System\GQiXxzG.exe
  2⤵
  PID:3720
- C:\Windows\System\jepIvGz.exe
  C:\Windows\System\jepIvGz.exe
  2⤵
  PID:3736
- C:\Windows\System\bdlSFEs.exe
  C:\Windows\System\bdlSFEs.exe
  2⤵
  PID:3752
- C:\Windows\System\nijUzab.exe
  C:\Windows\System\nijUzab.exe
  2⤵
  PID:1340
- C:\Windows\System\kvDROHt.exe
  C:\Windows\System\kvDROHt.exe
  2⤵
  PID:1752
- C:\Windows\System\sNjkaFv.exe
  C:\Windows\System\sNjkaFv.exe
  2⤵
  PID:1828
- C:\Windows\System\xATbvEX.exe
  C:\Windows\System\xATbvEX.exe
  2⤵
  PID:2640
- C:\Windows\System\MPLTzRg.exe
  C:\Windows\System\MPLTzRg.exe
  2⤵
  PID:3184
- C:\Windows\System\ElYhHZe.exe
  C:\Windows\System\ElYhHZe.exe
  2⤵
  PID:1820
- C:\Windows\System\yMVlFTG.exe
  C:\Windows\System\yMVlFTG.exe
  2⤵
  PID:3352
- C:\Windows\System\TwPlhxt.exe
  C:\Windows\System\TwPlhxt.exe
  2⤵
  PID:2656
- C:\Windows\System\CKtHHVX.exe
  C:\Windows\System\CKtHHVX.exe
  2⤵
  PID:2892
- C:\Windows\System\qCjsRhP.exe
  C:\Windows\System\qCjsRhP.exe
  2⤵
  PID:3316
- C:\Windows\System\IUxwxHA.exe
  C:\Windows\System\IUxwxHA.exe
  2⤵
  PID:1492
- C:\Windows\System\LtoDLwV.exe
  C:\Windows\System\LtoDLwV.exe
  2⤵
  PID:3116
- C:\Windows\System\nBsGEns.exe
  C:\Windows\System\nBsGEns.exe
  2⤵
  PID:1380
- C:\Windows\System\InGbSpF.exe
  C:\Windows\System\InGbSpF.exe
  2⤵
  PID:3004
- C:\Windows\System\EgSMFTc.exe
  C:\Windows\System\EgSMFTc.exe
  2⤵
  PID:2100
- C:\Windows\System\LMLJbWW.exe
  C:\Windows\System\LMLJbWW.exe
  2⤵
  PID:628
- C:\Windows\System\tdrEjUC.exe
  C:\Windows\System\tdrEjUC.exe
  2⤵
  PID:2900
- C:\Windows\System\fOfgNQw.exe
  C:\Windows\System\fOfgNQw.exe
  2⤵
  PID:3132
- C:\Windows\System\KXpDLdI.exe
  C:\Windows\System\KXpDLdI.exe
  2⤵
  PID:2244
- C:\Windows\System\zIwoWvZ.exe
  C:\Windows\System\zIwoWvZ.exe
  2⤵
  PID:3268
- C:\Windows\System\reIXZtr.exe
  C:\Windows\System\reIXZtr.exe
  2⤵
  PID:3432
- C:\Windows\System\QTkztWH.exe
  C:\Windows\System\QTkztWH.exe
  2⤵
  PID:3496
- C:\Windows\System\kMkhrTm.exe
  C:\Windows\System\kMkhrTm.exe
  2⤵
  PID:3608
- C:\Windows\System\OYpLRUZ.exe
  C:\Windows\System\OYpLRUZ.exe
  2⤵
  PID:3956
- C:\Windows\System\QfSPEMb.exe
  C:\Windows\System\QfSPEMb.exe
  2⤵
  PID:2876
- C:\Windows\System\JZAmBHQ.exe
  C:\Windows\System\JZAmBHQ.exe
  2⤵
  PID:3912
- C:\Windows\System\UWLDKNs.exe
  C:\Windows\System\UWLDKNs.exe
  2⤵
  PID:3944
- C:\Windows\System\AQjnoPn.exe
  C:\Windows\System\AQjnoPn.exe
  2⤵
  PID:3664
- C:\Windows\System\yHbyHFI.exe
  C:\Windows\System\yHbyHFI.exe
  2⤵
  PID:3840
- C:\Windows\System\HqMSRBp.exe
  C:\Windows\System\HqMSRBp.exe
  2⤵
  PID:4080
- C:\Windows\System\NOkkohb.exe
  C:\Windows\System\NOkkohb.exe
  2⤵
  PID:3648
- C:\Windows\System\rLSORwn.exe
  C:\Windows\System\rLSORwn.exe
  2⤵
  PID:3744
- C:\Windows\System\bdyMBnA.exe
  C:\Windows\System\bdyMBnA.exe
  2⤵
  PID:4104
- C:\Windows\System\yihSWvt.exe
  C:\Windows\System\yihSWvt.exe
  2⤵
  PID:4120
- C:\Windows\System\aaGajUR.exe
  C:\Windows\System\aaGajUR.exe
  2⤵
  PID:4136
- C:\Windows\System\GmXLbfn.exe
  C:\Windows\System\GmXLbfn.exe
  2⤵
  PID:4156
- C:\Windows\System\wmXPZQc.exe
  C:\Windows\System\wmXPZQc.exe
  2⤵
  PID:4172
- C:\Windows\System\sRnEIKi.exe
  C:\Windows\System\sRnEIKi.exe
  2⤵
  PID:4188
- C:\Windows\System\nXjutuV.exe
  C:\Windows\System\nXjutuV.exe
  2⤵
  PID:4208
- C:\Windows\System\lrJOJSA.exe
  C:\Windows\System\lrJOJSA.exe
  2⤵
  PID:4224
- C:\Windows\System\EAsMSND.exe
  C:\Windows\System\EAsMSND.exe
  2⤵
  PID:4240
- C:\Windows\System\EYVhYhZ.exe
  C:\Windows\System\EYVhYhZ.exe
  2⤵
  PID:4256
- C:\Windows\System\tZVQQlV.exe
  C:\Windows\System\tZVQQlV.exe
  2⤵
  PID:4276
- C:\Windows\System\sdveDPO.exe
  C:\Windows\System\sdveDPO.exe
  2⤵
  PID:4292
- C:\Windows\System\sXdSrgs.exe
  C:\Windows\System\sXdSrgs.exe
  2⤵
  PID:4308
- C:\Windows\System\pYAlJop.exe
  C:\Windows\System\pYAlJop.exe
  2⤵
  PID:4324
- C:\Windows\System\uKcfluP.exe
  C:\Windows\System\uKcfluP.exe
  2⤵
  PID:4344
- C:\Windows\System\bQSumjd.exe
  C:\Windows\System\bQSumjd.exe
  2⤵
  PID:4360
- C:\Windows\System\VcnVoIt.exe
  C:\Windows\System\VcnVoIt.exe
  2⤵
  PID:4376
- C:\Windows\System\zAqbXtS.exe
  C:\Windows\System\zAqbXtS.exe
  2⤵
  PID:4392
- C:\Windows\System\TRTjrje.exe
  C:\Windows\System\TRTjrje.exe
  2⤵
  PID:4412
- C:\Windows\System\IsaPuCU.exe
  C:\Windows\System\IsaPuCU.exe
  2⤵
  PID:4428
- C:\Windows\System\qeSnozO.exe
  C:\Windows\System\qeSnozO.exe
  2⤵
  PID:4444
- C:\Windows\System\EokkOOl.exe
  C:\Windows\System\EokkOOl.exe
  2⤵
  PID:4464
- C:\Windows\System\YLvCiAw.exe
  C:\Windows\System\YLvCiAw.exe
  2⤵
  PID:4480
- C:\Windows\System\rOVWvmf.exe
  C:\Windows\System\rOVWvmf.exe
  2⤵
  PID:4496
- C:\Windows\System\kWDvpks.exe
  C:\Windows\System\kWDvpks.exe
  2⤵
  PID:4512
- C:\Windows\System\pDWOcYs.exe
  C:\Windows\System\pDWOcYs.exe
  2⤵
  PID:4528
- C:\Windows\System\CrTZBVb.exe
  C:\Windows\System\CrTZBVb.exe
  2⤵
  PID:4620
- C:\Windows\System\cORFiiU.exe
  C:\Windows\System\cORFiiU.exe
  2⤵
  PID:4692
- C:\Windows\System\GEWgYHf.exe
  C:\Windows\System\GEWgYHf.exe
  2⤵
  PID:4736
- C:\Windows\System\AOkMbav.exe
  C:\Windows\System\AOkMbav.exe
  2⤵
  PID:4812
- C:\Windows\System\WqiRXvY.exe
  C:\Windows\System\WqiRXvY.exe
  2⤵
  PID:4828
- C:\Windows\System\UrPKpwl.exe
  C:\Windows\System\UrPKpwl.exe
  2⤵
  PID:4844
- C:\Windows\System\gaUTivy.exe
  C:\Windows\System\gaUTivy.exe
  2⤵
  PID:4860
- C:\Windows\System\uPnwqzM.exe
  C:\Windows\System\uPnwqzM.exe
  2⤵
  PID:4876
- C:\Windows\System\SEytULP.exe
  C:\Windows\System\SEytULP.exe
  2⤵
  PID:4916
- C:\Windows\System\Tndfbus.exe
  C:\Windows\System\Tndfbus.exe
  2⤵
  PID:4932
- C:\Windows\System\egMHmPW.exe
  C:\Windows\System\egMHmPW.exe
  2⤵
  PID:4948
- C:\Windows\System\jNtnJjo.exe
  C:\Windows\System\jNtnJjo.exe
  2⤵
  PID:4964
- C:\Windows\System\ORfeyoU.exe
  C:\Windows\System\ORfeyoU.exe
  2⤵
  PID:4984
- C:\Windows\System\cneqgZw.exe
  C:\Windows\System\cneqgZw.exe
  2⤵
  PID:5092
- C:\Windows\System\jZCrKWW.exe
  C:\Windows\System\jZCrKWW.exe
  2⤵
  PID:5108
- C:\Windows\System\XTcMdVM.exe
  C:\Windows\System\XTcMdVM.exe
  2⤵
  PID:3368
- C:\Windows\System\IlFIWbR.exe
  C:\Windows\System\IlFIWbR.exe
  2⤵
  PID:3892
- C:\Windows\System\JsdKlhS.exe
  C:\Windows\System\JsdKlhS.exe
  2⤵
  PID:3540
- C:\Windows\System\vAYjcxT.exe
  C:\Windows\System\vAYjcxT.exe
  2⤵
  PID:3112
- C:\Windows\System\TgaVPbu.exe
  C:\Windows\System\TgaVPbu.exe
  2⤵
  PID:1648
- C:\Windows\System\TJiNXvh.exe
  C:\Windows\System\TJiNXvh.exe
  2⤵
  PID:3712
- C:\Windows\System\lAQwbFc.exe
  C:\Windows\System\lAQwbFc.exe
  2⤵
  PID:3716
- C:\Windows\System\XFnZamb.exe
  C:\Windows\System\XFnZamb.exe
  2⤵
  PID:4152
- C:\Windows\System\cjsIklX.exe
  C:\Windows\System\cjsIklX.exe
  2⤵
  PID:4252
- C:\Windows\System\RREbGvX.exe
  C:\Windows\System\RREbGvX.exe
  2⤵
  PID:4352
- C:\Windows\System\ghQQEci.exe
  C:\Windows\System\ghQQEci.exe
  2⤵
  PID:4420
- C:\Windows\System\MWuYRTx.exe
  C:\Windows\System\MWuYRTx.exe
  2⤵
  PID:4460
- C:\Windows\System\dfxucgv.exe
  C:\Windows\System\dfxucgv.exe
  2⤵
  PID:3564
- C:\Windows\System\mKahpmr.exe
  C:\Windows\System\mKahpmr.exe
  2⤵
  PID:3764
- C:\Windows\System\mESGSxt.exe
  C:\Windows\System\mESGSxt.exe
  2⤵
  PID:3568
- C:\Windows\System\zLzaAHO.exe
  C:\Windows\System\zLzaAHO.exe
  2⤵
  PID:4196
- C:\Windows\System\DkYBvxa.exe
  C:\Windows\System\DkYBvxa.exe
  2⤵
  PID:4044
- C:\Windows\System\dNlhjPD.exe
  C:\Windows\System\dNlhjPD.exe
  2⤵
  PID:3796
- C:\Windows\System\sBUtkFD.exe
  C:\Windows\System\sBUtkFD.exe
  2⤵
  PID:4064
- C:\Windows\System\KrdtpcD.exe
  C:\Windows\System\KrdtpcD.exe
  2⤵
  PID:3644
- C:\Windows\System\YEVODxh.exe
  C:\Windows\System\YEVODxh.exe
  2⤵
  PID:4204
- C:\Windows\System\xErKKxy.exe
  C:\Windows\System\xErKKxy.exe
  2⤵
  PID:3064
- C:\Windows\System\EuclFMZ.exe
  C:\Windows\System\EuclFMZ.exe
  2⤵
  PID:1636
- C:\Windows\System\lfJnyXk.exe
  C:\Windows\System\lfJnyXk.exe
  2⤵
  PID:3416
- C:\Windows\System\tpCapLH.exe
  C:\Windows\System\tpCapLH.exe
  2⤵
  PID:3240
- C:\Windows\System\sNvMkbp.exe
  C:\Windows\System\sNvMkbp.exe
  2⤵
  PID:3972
- C:\Windows\System\gjCzdBl.exe
  C:\Windows\System\gjCzdBl.exe
  2⤵
  PID:4300
- C:\Windows\System\KdcqkFT.exe
  C:\Windows\System\KdcqkFT.exe
  2⤵
  PID:4556
- C:\Windows\System\PDVapTG.exe
  C:\Windows\System\PDVapTG.exe
  2⤵
  PID:4576
- C:\Windows\System\GhASpIL.exe
  C:\Windows\System\GhASpIL.exe
  2⤵
  PID:4400
- C:\Windows\System\MReWrWO.exe
  C:\Windows\System\MReWrWO.exe
  2⤵
  PID:4612
- C:\Windows\System\gDTDBUr.exe
  C:\Windows\System\gDTDBUr.exe
  2⤵
  PID:4592
- C:\Windows\System\RWFJIKn.exe
  C:\Windows\System\RWFJIKn.exe
  2⤵
  PID:4508
- C:\Windows\System\hodwRbY.exe
  C:\Windows\System\hodwRbY.exe
  2⤵
  PID:4332
- C:\Windows\System\xJXkCVK.exe
  C:\Windows\System\xJXkCVK.exe
  2⤵
  PID:2132
- C:\Windows\System\xZIxeXa.exe
  C:\Windows\System\xZIxeXa.exe
  2⤵
  PID:4644
- C:\Windows\System\GVzSRLK.exe
  C:\Windows\System\GVzSRLK.exe
  2⤵
  PID:4660
- C:\Windows\System\aSQVxFW.exe
  C:\Windows\System\aSQVxFW.exe
  2⤵
  PID:4684
- C:\Windows\System\YtvIGIk.exe
  C:\Windows\System\YtvIGIk.exe
  2⤵
  PID:4716
- C:\Windows\System\smoCxZb.exe
  C:\Windows\System\smoCxZb.exe
  2⤵
  PID:4724
- C:\Windows\System\mAOJEjB.exe
  C:\Windows\System\mAOJEjB.exe
  2⤵
  PID:4756
- C:\Windows\System\QuIOkdI.exe
  C:\Windows\System\QuIOkdI.exe
  2⤵
  PID:4772
- C:\Windows\System\ezmLBPa.exe
  C:\Windows\System\ezmLBPa.exe
  2⤵
  PID:4792
- C:\Windows\System\aYEOpwI.exe
  C:\Windows\System\aYEOpwI.exe
  2⤵
  PID:2300
- C:\Windows\System\pCGbWcT.exe
  C:\Windows\System\pCGbWcT.exe
  2⤵
  PID:4836
- C:\Windows\System\qNNRjIR.exe
  C:\Windows\System\qNNRjIR.exe
  2⤵
  PID:4884
- C:\Windows\System\JpgfzAO.exe
  C:\Windows\System\JpgfzAO.exe
  2⤵
  PID:4616
- C:\Windows\System\qyoFolD.exe
  C:\Windows\System\qyoFolD.exe
  2⤵
  PID:4956
- C:\Windows\System\DrFRnIr.exe
  C:\Windows\System\DrFRnIr.exe
  2⤵
  PID:4940
- C:\Windows\System\TcyomNI.exe
  C:\Windows\System\TcyomNI.exe
  2⤵
  PID:5052
- C:\Windows\System\KLGReao.exe
  C:\Windows\System\KLGReao.exe
  2⤵
  PID:5080
- C:\Windows\System\HzzJJXt.exe
  C:\Windows\System\HzzJJXt.exe
  2⤵
  PID:5048
- C:\Windows\System\kpDExyw.exe
  C:\Windows\System\kpDExyw.exe
  2⤵
  PID:5064
- C:\Windows\System\LCOcTHR.exe
  C:\Windows\System\LCOcTHR.exe
  2⤵
  PID:4908
- C:\Windows\System\RvhFiqw.exe
  C:\Windows\System\RvhFiqw.exe
  2⤵
  PID:5116
- C:\Windows\System\qKrIYmU.exe
  C:\Windows\System\qKrIYmU.exe
  2⤵
  PID:3860
- C:\Windows\System\vWDmgEp.exe
  C:\Windows\System\vWDmgEp.exe
  2⤵
  PID:3320
- C:\Windows\System\aRChoXK.exe
  C:\Windows\System\aRChoXK.exe
  2⤵
  PID:2336
- C:\Windows\System\erxUBzI.exe
  C:\Windows\System\erxUBzI.exe
  2⤵
  PID:4248
- C:\Windows\System\bYhpmRz.exe
  C:\Windows\System\bYhpmRz.exe
  2⤵
  PID:4288
- C:\Windows\System\EJsirre.exe
  C:\Windows\System\EJsirre.exe
  2⤵
  PID:4452
- C:\Windows\System\ULiNtrv.exe
  C:\Windows\System\ULiNtrv.exe
  2⤵
  PID:4492
- C:\Windows\System\sAVoweZ.exe
  C:\Windows\System\sAVoweZ.exe
  2⤵
  PID:4132
- C:\Windows\System\GElBoPK.exe
  C:\Windows\System\GElBoPK.exe
  2⤵
  PID:4128
- C:\Windows\System\oKFwdJv.exe
  C:\Windows\System\oKFwdJv.exe
  2⤵
  PID:4336
- C:\Windows\System\zCYLpPJ.exe
  C:\Windows\System\zCYLpPJ.exe
  2⤵
  PID:3788
- C:\Windows\System\coEeLcL.exe
  C:\Windows\System\coEeLcL.exe
  2⤵
  PID:4012
- C:\Windows\System\OFUERgI.exe
  C:\Windows\System\OFUERgI.exe
  2⤵
  PID:2004
- C:\Windows\System\XCsUvoE.exe
  C:\Windows\System\XCsUvoE.exe
  2⤵
  PID:3388
- C:\Windows\System\XQjLIBG.exe
  C:\Windows\System\XQjLIBG.exe
  2⤵
  PID:2880
- C:\Windows\System\fuRKvBJ.exe
  C:\Windows\System\fuRKvBJ.exe
  2⤵
  PID:4552
- C:\Windows\System\XpWjANv.exe
  C:\Windows\System\XpWjANv.exe
  2⤵
  PID:4340
- C:\Windows\System\BmywYjQ.exe
  C:\Windows\System\BmywYjQ.exe
  2⤵
  PID:4440
- C:\Windows\System\DBzbSpc.exe
  C:\Windows\System\DBzbSpc.exe
  2⤵
  PID:4476
- C:\Windows\System\fXJNYTi.exe
  C:\Windows\System\fXJNYTi.exe
  2⤵
  PID:2468
- C:\Windows\System\AKRfzul.exe
  C:\Windows\System\AKRfzul.exe
  2⤵
  PID:4676
- C:\Windows\System\HzQLpaP.exe
  C:\Windows\System\HzQLpaP.exe
  2⤵
  PID:4656
- C:\Windows\System\uRrmlft.exe
  C:\Windows\System\uRrmlft.exe
  2⤵
  PID:4708
- C:\Windows\System\GamNZLK.exe
  C:\Windows\System\GamNZLK.exe
  2⤵
  PID:1684
- C:\Windows\System\AvyjDRE.exe
  C:\Windows\System\AvyjDRE.exe
  2⤵
  PID:4900
- C:\Windows\System\IRLATrS.exe
  C:\Windows\System\IRLATrS.exe
  2⤵
  PID:4972
- C:\Windows\System\FDwYMJZ.exe
  C:\Windows\System\FDwYMJZ.exe
  2⤵
  PID:5008
- C:\Windows\System\SuXsDvX.exe
  C:\Windows\System\SuXsDvX.exe
  2⤵
  PID:5028
- C:\Windows\System\ZhrwFLY.exe
  C:\Windows\System\ZhrwFLY.exe
  2⤵
  PID:5016
- C:\Windows\System\CzzoYPi.exe
  C:\Windows\System\CzzoYPi.exe
  2⤵
  PID:2484
- C:\Windows\System\CbUCbkF.exe
  C:\Windows\System\CbUCbkF.exe
  2⤵
  PID:1708
- C:\Windows\System\LwmobLB.exe
  C:\Windows\System\LwmobLB.exe
  2⤵
  PID:5024
- C:\Windows\System\rBVlytt.exe
  C:\Windows\System\rBVlytt.exe
  2⤵
  PID:3304
- C:\Windows\System\AvMaZYf.exe
  C:\Windows\System\AvMaZYf.exe
  2⤵
  PID:4144
- C:\Windows\System\iKhKmTq.exe
  C:\Windows\System\iKhKmTq.exe
  2⤵
  PID:4220
- C:\Windows\System\AyPuVdE.exe
  C:\Windows\System\AyPuVdE.exe
  2⤵
  PID:2592
- C:\Windows\System\muupByt.exe
  C:\Windows\System\muupByt.exe
  2⤵
  PID:3732
- C:\Windows\System\sRGOoPa.exe
  C:\Windows\System\sRGOoPa.exe
  2⤵
  PID:2020
- C:\Windows\System\qXfUkRW.exe
  C:\Windows\System\qXfUkRW.exe
  2⤵
  PID:4092
- C:\Windows\System\NCzoBAK.exe
  C:\Windows\System\NCzoBAK.exe
  2⤵
  PID:4540
- C:\Windows\System\xCZoOSG.exe
  C:\Windows\System\xCZoOSG.exe
  2⤵
  PID:4580
- C:\Windows\System\WPOgBdz.exe
  C:\Windows\System\WPOgBdz.exe
  2⤵
  PID:4472
- C:\Windows\System\ImgLEWl.exe
  C:\Windows\System\ImgLEWl.exe
  2⤵
  PID:2964
- C:\Windows\System\POVfHSX.exe
  C:\Windows\System\POVfHSX.exe
  2⤵
  PID:4236
- C:\Windows\System\OOqEKZJ.exe
  C:\Windows\System\OOqEKZJ.exe
  2⤵
  PID:4732
- C:\Windows\System\pHQUBNc.exe
  C:\Windows\System\pHQUBNc.exe
  2⤵
  PID:4752
- C:\Windows\System\OPjAoPp.exe
  C:\Windows\System\OPjAoPp.exe
  2⤵
  PID:4800
- C:\Windows\System\NwsCnGq.exe
  C:\Windows\System\NwsCnGq.exe
  2⤵
  PID:4784
- C:\Windows\System\sdEJJwm.exe
  C:\Windows\System\sdEJJwm.exe
  2⤵
  PID:4824
- C:\Windows\System\xiaeTmJ.exe
  C:\Windows\System\xiaeTmJ.exe
  2⤵
  PID:4976
- C:\Windows\System\nWOMfEs.exe
  C:\Windows\System\nWOMfEs.exe
  2⤵
  PID:5000
- C:\Windows\System\ZEJdkCV.exe
  C:\Windows\System\ZEJdkCV.exe
  2⤵
  PID:3660
- C:\Windows\System\ZdLqPJN.exe
  C:\Windows\System\ZdLqPJN.exe
  2⤵
  PID:3680
- C:\Windows\System\bhyFtRi.exe
  C:\Windows\System\bhyFtRi.exe
  2⤵
  PID:3784
- C:\Windows\System\kgcBfyH.exe
  C:\Windows\System\kgcBfyH.exe
  2⤵
  PID:4168
- C:\Windows\System\yLCMACW.exe
  C:\Windows\System\yLCMACW.exe
  2⤵
  PID:3980
- C:\Windows\System\tbScvIJ.exe
  C:\Windows\System\tbScvIJ.exe
  2⤵
  PID:3996
- C:\Windows\System\YaJnjdA.exe
  C:\Windows\System\YaJnjdA.exe
  2⤵
  PID:4640
- C:\Windows\System\DHMuIia.exe
  C:\Windows\System\DHMuIia.exe
  2⤵
  PID:4404
- C:\Windows\System\aZVvYEc.exe
  C:\Windows\System\aZVvYEc.exe
  2⤵
  PID:4572
- C:\Windows\System\DUXWjvh.exe
  C:\Windows\System\DUXWjvh.exe
  2⤵
  PID:4652
- C:\Windows\System\kQJtZCF.exe
  C:\Windows\System\kQJtZCF.exe
  2⤵
  PID:5036
- C:\Windows\System\BHcBKFf.exe
  C:\Windows\System\BHcBKFf.exe
  2⤵
  PID:4872
- C:\Windows\System\kTXAJMZ.exe
  C:\Windows\System\kTXAJMZ.exe
  2⤵
  PID:4388
- C:\Windows\System\ZoxquwD.exe
  C:\Windows\System\ZoxquwD.exe
  2⤵
  PID:5104
- C:\Windows\System\jvvzDhE.exe
  C:\Windows\System\jvvzDhE.exe
  2⤵
  PID:4980
- C:\Windows\System\NupVxHm.exe
  C:\Windows\System\NupVxHm.exe
  2⤵
  PID:5128
- C:\Windows\System\aXLknzx.exe
  C:\Windows\System\aXLknzx.exe
  2⤵
  PID:5144
- C:\Windows\System\HWigfxB.exe
  C:\Windows\System\HWigfxB.exe
  2⤵
  PID:5160
- C:\Windows\System\FtKvMrA.exe
  C:\Windows\System\FtKvMrA.exe
  2⤵
  PID:5180
- C:\Windows\System\XtoOMVl.exe
  C:\Windows\System\XtoOMVl.exe
  2⤵
  PID:5196
- C:\Windows\System\DpAYmHE.exe
  C:\Windows\System\DpAYmHE.exe
  2⤵
  PID:5212
- C:\Windows\System\FsZlBGF.exe
  C:\Windows\System\FsZlBGF.exe
  2⤵
  PID:5228
- C:\Windows\System\nNpfHyk.exe
  C:\Windows\System\nNpfHyk.exe
  2⤵
  PID:5248
- C:\Windows\System\CkQqYkf.exe
  C:\Windows\System\CkQqYkf.exe
  2⤵
  PID:5264
- C:\Windows\System\UVFoxyE.exe
  C:\Windows\System\UVFoxyE.exe
  2⤵
  PID:5280
- C:\Windows\System\UtVxQHL.exe
  C:\Windows\System\UtVxQHL.exe
  2⤵
  PID:5296
- C:\Windows\System\AlUSPnG.exe
  C:\Windows\System\AlUSPnG.exe
  2⤵
  PID:5312
- C:\Windows\System\UzPTFuf.exe
  C:\Windows\System\UzPTFuf.exe
  2⤵
  PID:5332
- C:\Windows\System\LjqElBT.exe
  C:\Windows\System\LjqElBT.exe
  2⤵
  PID:5348
- C:\Windows\System\PnvGiMI.exe
  C:\Windows\System\PnvGiMI.exe
  2⤵
  PID:5368
- C:\Windows\System\xsgUhSU.exe
  C:\Windows\System\xsgUhSU.exe
  2⤵
  PID:5384
- C:\Windows\System\skfHPRH.exe
  C:\Windows\System\skfHPRH.exe
  2⤵
  PID:5520
- C:\Windows\System\KaZbAWP.exe
  C:\Windows\System\KaZbAWP.exe
  2⤵
  PID:5536
- C:\Windows\System\OYHLpVb.exe
  C:\Windows\System\OYHLpVb.exe
  2⤵
  PID:5552
- C:\Windows\System\ecBVmhP.exe
  C:\Windows\System\ecBVmhP.exe
  2⤵
  PID:5572
- C:\Windows\System\XAlRlev.exe
  C:\Windows\System\XAlRlev.exe
  2⤵
  PID:5592
- C:\Windows\System\VbrkIKK.exe
  C:\Windows\System\VbrkIKK.exe
  2⤵
  PID:5608
- C:\Windows\System\OVYdZaf.exe
  C:\Windows\System\OVYdZaf.exe
  2⤵
  PID:5628
- C:\Windows\System\VpXmoGZ.exe
  C:\Windows\System\VpXmoGZ.exe
  2⤵
  PID:5644
- C:\Windows\System\QYDiroo.exe
  C:\Windows\System\QYDiroo.exe
  2⤵
  PID:5660
- C:\Windows\System\MIZApaT.exe
  C:\Windows\System\MIZApaT.exe
  2⤵
  PID:5676
- C:\Windows\System\zNejtwM.exe
  C:\Windows\System\zNejtwM.exe
  2⤵
  PID:5696
- C:\Windows\System\qnIEYcf.exe
  C:\Windows\System\qnIEYcf.exe
  2⤵
  PID:5728
- C:\Windows\System\BqjzjOd.exe
  C:\Windows\System\BqjzjOd.exe
  2⤵
  PID:5744
- C:\Windows\System\SMVXaMD.exe
  C:\Windows\System\SMVXaMD.exe
  2⤵
  PID:5764
- C:\Windows\System\fRrAVCK.exe
  C:\Windows\System\fRrAVCK.exe
  2⤵
  PID:5780
- C:\Windows\System\qDKKiKh.exe
  C:\Windows\System\qDKKiKh.exe
  2⤵
  PID:5796
- C:\Windows\System\bVWMlPm.exe
  C:\Windows\System\bVWMlPm.exe
  2⤵
  PID:5812
- C:\Windows\System\BMeCZcz.exe
  C:\Windows\System\BMeCZcz.exe
  2⤵
  PID:5828
- C:\Windows\System\CmXrKrw.exe
  C:\Windows\System\CmXrKrw.exe
  2⤵
  PID:5844
- C:\Windows\System\bwZcSWW.exe
  C:\Windows\System\bwZcSWW.exe
  2⤵
  PID:5860
- C:\Windows\System\TRMTyQZ.exe
  C:\Windows\System\TRMTyQZ.exe
  2⤵
  PID:5880
- C:\Windows\System\CZgzhhM.exe
  C:\Windows\System\CZgzhhM.exe
  2⤵
  PID:5896
- C:\Windows\System\vudHHWC.exe
  C:\Windows\System\vudHHWC.exe
  2⤵
  PID:5912
- C:\Windows\System\hnjvjIp.exe
  C:\Windows\System\hnjvjIp.exe
  2⤵
  PID:5928
- C:\Windows\System\meQGMlI.exe
  C:\Windows\System\meQGMlI.exe
  2⤵
  PID:5944
- C:\Windows\System\lPRgYeY.exe
  C:\Windows\System\lPRgYeY.exe
  2⤵
  PID:5964
- C:\Windows\System\Gxprftj.exe
  C:\Windows\System\Gxprftj.exe
  2⤵
  PID:5984
- C:\Windows\System\oaPlYxS.exe
  C:\Windows\System\oaPlYxS.exe
  2⤵
  PID:6000
- C:\Windows\System\QMzlGjF.exe
  C:\Windows\System\QMzlGjF.exe
  2⤵
  PID:6016
- C:\Windows\System\pGxkNZF.exe
  C:\Windows\System\pGxkNZF.exe
  2⤵
  PID:6036
- C:\Windows\System\lFWGsat.exe
  C:\Windows\System\lFWGsat.exe
  2⤵
  PID:6052
- C:\Windows\System\SPucWlg.exe
  C:\Windows\System\SPucWlg.exe
  2⤵
  PID:6072
- C:\Windows\System\mYzFvzj.exe
  C:\Windows\System\mYzFvzj.exe
  2⤵
  PID:6088
- C:\Windows\System\StNwZLc.exe
  C:\Windows\System\StNwZLc.exe
  2⤵
  PID:6104
- C:\Windows\System\XQZtijU.exe
  C:\Windows\System\XQZtijU.exe
  2⤵
  PID:6120
- C:\Windows\System\rUAwvkA.exe
  C:\Windows\System\rUAwvkA.exe
  2⤵
  PID:6140
- C:\Windows\System\UIavqfE.exe
  C:\Windows\System\UIavqfE.exe
  2⤵
  PID:3340
- C:\Windows\System\DDNNGVt.exe
  C:\Windows\System\DDNNGVt.exe
  2⤵
  PID:3076
- C:\Windows\System\eQXhkKs.exe
  C:\Windows\System\eQXhkKs.exe
  2⤵
  PID:5204
- C:\Windows\System\UfFBNuw.exe
  C:\Windows\System\UfFBNuw.exe
  2⤵
  PID:5272
- C:\Windows\System\uVfsfrb.exe
  C:\Windows\System\uVfsfrb.exe
  2⤵
  PID:4568
- C:\Windows\System\fbNuxdk.exe
  C:\Windows\System\fbNuxdk.exe
  2⤵
  PID:5084
- C:\Windows\System\bIMSLzA.exe
  C:\Windows\System\bIMSLzA.exe
  2⤵
  PID:5340
- C:\Windows\System\KcwHpAe.exe
  C:\Windows\System\KcwHpAe.exe
  2⤵
  PID:2476
- C:\Windows\System\YkgXDqQ.exe
  C:\Windows\System\YkgXDqQ.exe
  2⤵
  PID:5124
- C:\Windows\System\PwejMHo.exe
  C:\Windows\System\PwejMHo.exe
  2⤵
  PID:5260
- C:\Windows\System\JNkGusq.exe
  C:\Windows\System\JNkGusq.exe
  2⤵
  PID:5408
- C:\Windows\System\nDTZCTF.exe
  C:\Windows\System\nDTZCTF.exe
  2⤵
  PID:5392
- C:\Windows\System\cRhQfLN.exe
  C:\Windows\System\cRhQfLN.exe
  2⤵
  PID:5328
- C:\Windows\System\EgHIJFa.exe
  C:\Windows\System\EgHIJFa.exe
  2⤵
  PID:2740
- C:\Windows\System\WLoytZi.exe
  C:\Windows\System\WLoytZi.exe
  2⤵
  PID:4744
- C:\Windows\System\YvCmjkO.exe
  C:\Windows\System\YvCmjkO.exe
  2⤵
  PID:5188
- C:\Windows\System\fwRICyk.exe
  C:\Windows\System\fwRICyk.exe
  2⤵
  PID:5192
- C:\Windows\System\RDPVcBe.exe
  C:\Windows\System\RDPVcBe.exe
  2⤵
  PID:5448
- C:\Windows\System\OFwOhTp.exe
  C:\Windows\System\OFwOhTp.exe
  2⤵
  PID:5460
- C:\Windows\System\GJCmdrz.exe
  C:\Windows\System\GJCmdrz.exe
  2⤵
  PID:5480
- C:\Windows\System\TqwhshU.exe
  C:\Windows\System\TqwhshU.exe
  2⤵
  PID:5492
- C:\Windows\System\ifYkFTd.exe
  C:\Windows\System\ifYkFTd.exe
  2⤵
  PID:5508
- C:\Windows\System\eUehXHE.exe
  C:\Windows\System\eUehXHE.exe
  2⤵
  PID:5544
- C:\Windows\System\OoSZZhU.exe
  C:\Windows\System\OoSZZhU.exe
  2⤵
  PID:5568
- C:\Windows\System\yyYxMKF.exe
  C:\Windows\System\yyYxMKF.exe
  2⤵
  PID:5720
- C:\Windows\System\aSPKsGM.exe
  C:\Windows\System\aSPKsGM.exe
  2⤵
  PID:5788
- C:\Windows\System\JIKsWBh.exe
  C:\Windows\System\JIKsWBh.exe
  2⤵
  PID:5804
- C:\Windows\System\gMOXHdV.exe
  C:\Windows\System\gMOXHdV.exe
  2⤵
  PID:5656
- C:\Windows\System\kZPCNwc.exe
  C:\Windows\System\kZPCNwc.exe
  2⤵
  PID:5580
- C:\Windows\System\vRLInyQ.exe
  C:\Windows\System\vRLInyQ.exe
  2⤵
  PID:5924
- C:\Windows\System\oVJuoiv.exe
  C:\Windows\System\oVJuoiv.exe
  2⤵
  PID:5920
- C:\Windows\System\WpkRlwz.exe
  C:\Windows\System\WpkRlwz.exe
  2⤵
  PID:6068
- C:\Windows\System\uAaKQAU.exe
  C:\Windows\System\uAaKQAU.exe
  2⤵
  PID:6028
- C:\Windows\System\vOBGNNU.exe
  C:\Windows\System\vOBGNNU.exe
  2⤵
  PID:6096
- C:\Windows\System\FGrRihh.exe
  C:\Windows\System\FGrRihh.exe
  2⤵
  PID:2328
- C:\Windows\System\FsvEOmK.exe
  C:\Windows\System\FsvEOmK.exe
  2⤵
  PID:5236
- C:\Windows\System\nbSvGMG.exe
  C:\Windows\System\nbSvGMG.exe
  2⤵
  PID:4700
- C:\Windows\System\gDlSSNT.exe
  C:\Windows\System\gDlSSNT.exe
  2⤵
  PID:5396
- C:\Windows\System\oZZpfhJ.exe
  C:\Windows\System\oZZpfhJ.exe
  2⤵
  PID:5436
- C:\Windows\System\yjWGkDY.exe
  C:\Windows\System\yjWGkDY.exe
  2⤵
  PID:5440
- C:\Windows\System\Yicumas.exe
  C:\Windows\System\Yicumas.exe
  2⤵
  PID:5560
- C:\Windows\System\RXPmORH.exe
  C:\Windows\System\RXPmORH.exe
  2⤵
  PID:5868
- C:\Windows\System\sVspTWr.exe
  C:\Windows\System\sVspTWr.exe
  2⤵
  PID:5904
- C:\Windows\System\qqUZsRV.exe
  C:\Windows\System\qqUZsRV.exe
  2⤵
  PID:6116
- C:\Windows\System\nQwhyEH.exe
  C:\Windows\System\nQwhyEH.exe
  2⤵
  PID:5176
- C:\Windows\System\XcvPzxZ.exe
  C:\Windows\System\XcvPzxZ.exe
  2⤵
  PID:5240
- C:\Windows\System\wYplNKa.exe
  C:\Windows\System\wYplNKa.exe
  2⤵
  PID:5356
- C:\Windows\System\GwJfwHD.exe
  C:\Windows\System\GwJfwHD.exe
  2⤵
  PID:5424
- C:\Windows\System\SUTAgOD.exe
  C:\Windows\System\SUTAgOD.exe
  2⤵
  PID:5488
- C:\Windows\System\CvVVWEJ.exe
  C:\Windows\System\CvVVWEJ.exe
  2⤵
  PID:5636
- C:\Windows\System\CHPzPVe.exe
  C:\Windows\System\CHPzPVe.exe
  2⤵
  PID:5760
- C:\Windows\System\XRkCyYF.exe
  C:\Windows\System\XRkCyYF.exe
  2⤵
  PID:5824
- C:\Windows\System\DlgARMq.exe
  C:\Windows\System\DlgARMq.exe
  2⤵
  PID:5716
- C:\Windows\System\FdEPUsN.exe
  C:\Windows\System\FdEPUsN.exe
  2⤵
  PID:5620
- C:\Windows\System\obcdpto.exe
  C:\Windows\System\obcdpto.exe
  2⤵
  PID:1564
- C:\Windows\System\dOQaKcQ.exe
  C:\Windows\System\dOQaKcQ.exe
  2⤵
  PID:6060
- C:\Windows\System\bayrLio.exe
  C:\Windows\System\bayrLio.exe
  2⤵
  PID:4368
- C:\Windows\System\MzbGdkT.exe
  C:\Windows\System\MzbGdkT.exe
  2⤵
  PID:6136
- C:\Windows\System\nJCcCGM.exe
  C:\Windows\System\nJCcCGM.exe
  2⤵
  PID:5836
- C:\Windows\System\rDqdjgo.exe
  C:\Windows\System\rDqdjgo.exe
  2⤵
  PID:4928
- C:\Windows\System\EFpLInD.exe
  C:\Windows\System\EFpLInD.exe
  2⤵
  PID:5156
- C:\Windows\System\HSEJVTn.exe
  C:\Windows\System\HSEJVTn.exe
  2⤵
  PID:5692
- C:\Windows\System\BWcIydh.exe
  C:\Windows\System\BWcIydh.exe
  2⤵
  PID:5940
- C:\Windows\System\LoUxIpy.exe
  C:\Windows\System\LoUxIpy.exe
  2⤵
  PID:5976
- C:\Windows\System\VMtutfq.exe
  C:\Windows\System\VMtutfq.exe
  2⤵
  PID:6012
- C:\Windows\System\iOphNZC.exe
  C:\Windows\System\iOphNZC.exe
  2⤵
  PID:6084
- C:\Windows\System\fmtQNrr.exe
  C:\Windows\System\fmtQNrr.exe
  2⤵
  PID:2720
- C:\Windows\System\vnpTfsO.exe
  C:\Windows\System\vnpTfsO.exe
  2⤵
  PID:5532
- C:\Windows\System\gNeVfVW.exe
  C:\Windows\System\gNeVfVW.exe
  2⤵
  PID:5808
- C:\Windows\System\CGUvaNQ.exe
  C:\Windows\System\CGUvaNQ.exe
  2⤵
  PID:4628
- C:\Windows\System\SztafUd.exe
  C:\Windows\System\SztafUd.exe
  2⤵
  PID:4852
- C:\Windows\System\hUqbERL.exe
  C:\Windows\System\hUqbERL.exe
  2⤵
  PID:5888
- C:\Windows\System\QyDngmy.exe
  C:\Windows\System\QyDngmy.exe
  2⤵
  PID:5704
- C:\Windows\System\ApMhlaJ.exe
  C:\Windows\System\ApMhlaJ.exe
  2⤵
  PID:5936
- C:\Windows\System\XXmoqMd.exe
  C:\Windows\System\XXmoqMd.exe
  2⤵
  PID:5380
- C:\Windows\System\hlzNvKI.exe
  C:\Windows\System\hlzNvKI.exe
  2⤵
  PID:5972
- C:\Windows\System\BixXipG.exe
  C:\Windows\System\BixXipG.exe
  2⤵
  PID:6160
- C:\Windows\System\mSWDVua.exe
  C:\Windows\System\mSWDVua.exe
  2⤵
  PID:6176
- C:\Windows\System\gntklRg.exe
  C:\Windows\System\gntklRg.exe
  2⤵
  PID:6192
- C:\Windows\System\wBLurBQ.exe
  C:\Windows\System\wBLurBQ.exe
  2⤵
  PID:6208
- C:\Windows\System\wTbsXJb.exe
  C:\Windows\System\wTbsXJb.exe
  2⤵
  PID:6224
- C:\Windows\System\HtCNcwZ.exe
  C:\Windows\System\HtCNcwZ.exe
  2⤵
  PID:6240
- C:\Windows\System\wGaZZAh.exe
  C:\Windows\System\wGaZZAh.exe
  2⤵
  PID:6256
- C:\Windows\System\YVDANSE.exe
  C:\Windows\System\YVDANSE.exe
  2⤵
  PID:6272
- C:\Windows\System\AugvCvm.exe
  C:\Windows\System\AugvCvm.exe
  2⤵
  PID:6288
- C:\Windows\System\wlhpgzW.exe
  C:\Windows\System\wlhpgzW.exe
  2⤵
  PID:6304
- C:\Windows\System\CxjlYvn.exe
  C:\Windows\System\CxjlYvn.exe
  2⤵
  PID:6376
- C:\Windows\System\xgehTZO.exe
  C:\Windows\System\xgehTZO.exe
  2⤵
  PID:6392
- C:\Windows\System\mHAQbwr.exe
  C:\Windows\System\mHAQbwr.exe
  2⤵
  PID:6408
- C:\Windows\System\tYZTkDb.exe
  C:\Windows\System\tYZTkDb.exe
  2⤵
  PID:6424
- C:\Windows\System\DvLDaRO.exe
  C:\Windows\System\DvLDaRO.exe
  2⤵
  PID:6444
- C:\Windows\System\ezcFylJ.exe
  C:\Windows\System\ezcFylJ.exe
  2⤵
  PID:6460
- C:\Windows\System\AuuJFNL.exe
  C:\Windows\System\AuuJFNL.exe
  2⤵
  PID:6476
- C:\Windows\System\dZGFFaB.exe
  C:\Windows\System\dZGFFaB.exe
  2⤵
  PID:6492
- C:\Windows\System\RUIcRSF.exe
  C:\Windows\System\RUIcRSF.exe
  2⤵
  PID:6508
- C:\Windows\System\TXJPopA.exe
  C:\Windows\System\TXJPopA.exe
  2⤵
  PID:6524
- C:\Windows\System\FkBwJJS.exe
  C:\Windows\System\FkBwJJS.exe
  2⤵
  PID:6540
- C:\Windows\System\YRaMvJY.exe
  C:\Windows\System\YRaMvJY.exe
  2⤵
  PID:6556
- C:\Windows\System\NUFqiDA.exe
  C:\Windows\System\NUFqiDA.exe
  2⤵
  PID:6572
- C:\Windows\System\vlrhJaA.exe
  C:\Windows\System\vlrhJaA.exe
  2⤵
  PID:6588
- C:\Windows\System\otpFrUq.exe
  C:\Windows\System\otpFrUq.exe
  2⤵
  PID:6604
- C:\Windows\System\xmfqSWf.exe
  C:\Windows\System\xmfqSWf.exe
  2⤵
  PID:6620
- C:\Windows\System\kWofGmd.exe
  C:\Windows\System\kWofGmd.exe
  2⤵
  PID:6636
- C:\Windows\System\MUDxaBZ.exe
  C:\Windows\System\MUDxaBZ.exe
  2⤵
  PID:6652
- C:\Windows\System\JGbDlZc.exe
  C:\Windows\System\JGbDlZc.exe
  2⤵
  PID:6668
- C:\Windows\System\mFBUYna.exe
  C:\Windows\System\mFBUYna.exe
  2⤵
  PID:6684
- C:\Windows\System\GhXDwxY.exe
  C:\Windows\System\GhXDwxY.exe
  2⤵
  PID:6700
- C:\Windows\System\yoXvIUj.exe
  C:\Windows\System\yoXvIUj.exe
  2⤵
  PID:6716
- C:\Windows\System\KpeyIxP.exe
  C:\Windows\System\KpeyIxP.exe
  2⤵
  PID:6736
- C:\Windows\System\mATXtuI.exe
  C:\Windows\System\mATXtuI.exe
  2⤵
  PID:6752
- C:\Windows\System\eteKxsR.exe
  C:\Windows\System\eteKxsR.exe
  2⤵
  PID:6768
- C:\Windows\System\mggYgen.exe
  C:\Windows\System\mggYgen.exe
  2⤵
  PID:6784
- C:\Windows\System\dwUDFze.exe
  C:\Windows\System\dwUDFze.exe
  2⤵
  PID:6800
- C:\Windows\System\RgOHETf.exe
  C:\Windows\System\RgOHETf.exe
  2⤵
  PID:6816
- C:\Windows\System\vZftOLa.exe
  C:\Windows\System\vZftOLa.exe
  2⤵
  PID:6832
- C:\Windows\System\NWBMyoj.exe
  C:\Windows\System\NWBMyoj.exe
  2⤵
  PID:6848
- C:\Windows\System\nKQSHlN.exe
  C:\Windows\System\nKQSHlN.exe
  2⤵
  PID:6864
- C:\Windows\System\GXkraEz.exe
  C:\Windows\System\GXkraEz.exe
  2⤵
  PID:6880
- C:\Windows\System\OvPHMaC.exe
  C:\Windows\System\OvPHMaC.exe
  2⤵
  PID:6896
- C:\Windows\System\vWYSviu.exe
  C:\Windows\System\vWYSviu.exe
  2⤵
  PID:6912
- C:\Windows\System\vIvTwIA.exe
  C:\Windows\System\vIvTwIA.exe
  2⤵
  PID:6928
- C:\Windows\System\iuYDxQj.exe
  C:\Windows\System\iuYDxQj.exe
  2⤵
  PID:6944
- C:\Windows\System\qSdcjdn.exe
  C:\Windows\System\qSdcjdn.exe
  2⤵
  PID:6960
- C:\Windows\System\mpGxtsn.exe
  C:\Windows\System\mpGxtsn.exe
  2⤵
  PID:6976
- C:\Windows\System\lMnXhAh.exe
  C:\Windows\System\lMnXhAh.exe
  2⤵
  PID:6992
- C:\Windows\System\tENkZSa.exe
  C:\Windows\System\tENkZSa.exe
  2⤵
  PID:7008
- C:\Windows\System\KGGzPcN.exe
  C:\Windows\System\KGGzPcN.exe
  2⤵
  PID:7024
- C:\Windows\System\RIHDlWN.exe
  C:\Windows\System\RIHDlWN.exe
  2⤵
  PID:7040
- C:\Windows\System\KVXnmhc.exe
  C:\Windows\System\KVXnmhc.exe
  2⤵
  PID:7056
- C:\Windows\System\pHAMWld.exe
  C:\Windows\System\pHAMWld.exe
  2⤵
  PID:7072
- C:\Windows\System\KZGApie.exe
  C:\Windows\System\KZGApie.exe
  2⤵
  PID:7088
- C:\Windows\System\hKZoXTR.exe
  C:\Windows\System\hKZoXTR.exe
  2⤵
  PID:7104
- C:\Windows\System\pAaOVIv.exe
  C:\Windows\System\pAaOVIv.exe
  2⤵
  PID:7120
- C:\Windows\System\ZKVqevw.exe
  C:\Windows\System\ZKVqevw.exe
  2⤵
  PID:7136
- C:\Windows\System\bwOapSn.exe
  C:\Windows\System\bwOapSn.exe
  2⤵
  PID:7152
- C:\Windows\System\pqaFesE.exe
  C:\Windows\System\pqaFesE.exe
  2⤵
  PID:5616
- C:\Windows\System\qVvAgwb.exe
  C:\Windows\System\qVvAgwb.exe
  2⤵
  PID:6008
- C:\Windows\System\RQHPbKN.exe
  C:\Windows\System\RQHPbKN.exe
  2⤵
  PID:5472
- C:\Windows\System\FKeXZBQ.exe
  C:\Windows\System\FKeXZBQ.exe
  2⤵
  PID:760
- C:\Windows\System\qCDSRSu.exe
  C:\Windows\System\qCDSRSu.exe
  2⤵
  PID:6236
- C:\Windows\System\OuISWmU.exe
  C:\Windows\System\OuISWmU.exe
  2⤵
  PID:5400
- C:\Windows\System\GEKPQRz.exe
  C:\Windows\System\GEKPQRz.exe
  2⤵
  PID:6080
- C:\Windows\System\OpfNRrd.exe
  C:\Windows\System\OpfNRrd.exe
  2⤵
  PID:4600
- C:\Windows\System\FLbftcz.exe
  C:\Windows\System\FLbftcz.exe
  2⤵
  PID:5892
- C:\Windows\System\SbTtwTG.exe
  C:\Windows\System\SbTtwTG.exe
  2⤵
  PID:6300
- C:\Windows\System\PFRMgfK.exe
  C:\Windows\System\PFRMgfK.exe
  2⤵
  PID:6280
- C:\Windows\System\jsVivCp.exe
  C:\Windows\System\jsVivCp.exe
  2⤵
  PID:6324
- C:\Windows\System\NfAnGkz.exe
  C:\Windows\System\NfAnGkz.exe
  2⤵
  PID:6156
- C:\Windows\System\oBsRgOi.exe
  C:\Windows\System\oBsRgOi.exe
  2⤵
  PID:6248
- C:\Windows\System\sLtgPlr.exe
  C:\Windows\System\sLtgPlr.exe
  2⤵
  PID:6328
- C:\Windows\System\qdQBKkY.exe
  C:\Windows\System\qdQBKkY.exe
  2⤵
  PID:6356
- C:\Windows\System\uUpoosx.exe
  C:\Windows\System\uUpoosx.exe
  2⤵
  PID:6384
- C:\Windows\System\anKNlRk.exe
  C:\Windows\System\anKNlRk.exe
  2⤵
  PID:6456
- C:\Windows\System\eFmABZQ.exe
  C:\Windows\System\eFmABZQ.exe
  2⤵
  PID:6440
- C:\Windows\System\zyjTkXY.exe
  C:\Windows\System\zyjTkXY.exe
  2⤵
  PID:6516
- C:\Windows\System\vJjQqqv.exe
  C:\Windows\System\vJjQqqv.exe
  2⤵
  PID:6404
- C:\Windows\System\SVOEteF.exe
  C:\Windows\System\SVOEteF.exe
  2⤵
  PID:6612
- C:\Windows\System\QNwBiEK.exe
  C:\Windows\System\QNwBiEK.exe
  2⤵
  PID:6676
- C:\Windows\System\KKfnzAB.exe
  C:\Windows\System\KKfnzAB.exe
  2⤵
  PID:6680
- C:\Windows\System\JWBGCQQ.exe
  C:\Windows\System\JWBGCQQ.exe
  2⤵
  PID:6748
- C:\Windows\System\BWJISps.exe
  C:\Windows\System\BWJISps.exe
  2⤵
  PID:6808
- C:\Windows\System\FdrKSVq.exe
  C:\Windows\System\FdrKSVq.exe
  2⤵
  PID:6844
- C:\Windows\System\ufZplzD.exe
  C:\Windows\System\ufZplzD.exe
  2⤵
  PID:6732
- C:\Windows\System\FJfzdvB.exe
  C:\Windows\System\FJfzdvB.exe
  2⤵
  PID:6908
- C:\Windows\System\lxAWdxo.exe
  C:\Windows\System\lxAWdxo.exe
  2⤵
  PID:6760
- C:\Windows\System\rSLHxGX.exe
  C:\Windows\System\rSLHxGX.exe
  2⤵
  PID:6660
- C:\Windows\System\jrbMWRT.exe
  C:\Windows\System\jrbMWRT.exe
  2⤵
  PID:6824
- C:\Windows\System\eBKJYSX.exe
  C:\Windows\System\eBKJYSX.exe
  2⤵
  PID:7000
- C:\Windows\System\zLNZPvE.exe
  C:\Windows\System\zLNZPvE.exe
  2⤵
  PID:6796
- C:\Windows\System\WlgCGZi.exe
  C:\Windows\System\WlgCGZi.exe
  2⤵
  PID:7032
- C:\Windows\System\hfjXByN.exe
  C:\Windows\System\hfjXByN.exe
  2⤵
  PID:7064
- C:\Windows\System\dQdOkPw.exe
  C:\Windows\System\dQdOkPw.exe
  2⤵
  PID:6952
- C:\Windows\System\howbScl.exe
  C:\Windows\System\howbScl.exe
  2⤵
  PID:7068
- C:\Windows\System\ScgvaMo.exe
  C:\Windows\System\ScgvaMo.exe
  2⤵
  PID:7128
- C:\Windows\System\TEUIqov.exe
  C:\Windows\System\TEUIqov.exe
  2⤵
  PID:7164
- C:\Windows\System\AFlzolQ.exe
  C:\Windows\System\AFlzolQ.exe
  2⤵
  PID:7116
- C:\Windows\System\SsMvseh.exe
  C:\Windows\System\SsMvseh.exe
  2⤵
  PID:7148
- C:\Windows\System\LPrQwGk.exe
  C:\Windows\System\LPrQwGk.exe
  2⤵
  PID:5740
- C:\Windows\System\UnakoLa.exe
  C:\Windows\System\UnakoLa.exe
  2⤵
  PID:6204
- C:\Windows\System\GdqCYNc.exe
  C:\Windows\System\GdqCYNc.exe
  2⤵
  PID:5292
- C:\Windows\System\fGQUiyO.exe
  C:\Windows\System\fGQUiyO.exe
  2⤵
  PID:5600
- C:\Windows\System\RCDdpIQ.exe
  C:\Windows\System\RCDdpIQ.exe
  2⤵
  PID:6316
- C:\Windows\System\vmScxjq.exe
  C:\Windows\System\vmScxjq.exe
  2⤵
  PID:6216
- C:\Windows\System\mOlfwbN.exe
  C:\Windows\System\mOlfwbN.exe
  2⤵
  PID:5712
- C:\Windows\System\QUyJbcQ.exe
  C:\Windows\System\QUyJbcQ.exe
  2⤵
  PID:6352
- C:\Windows\System\vQiXTcp.exe
  C:\Windows\System\vQiXTcp.exe
  2⤵
  PID:6488
- C:\Windows\System\vDBNjLX.exe
  C:\Windows\System\vDBNjLX.exe
  2⤵
  PID:6648
- C:\Windows\System\tqzxIFw.exe
  C:\Windows\System\tqzxIFw.exe
  2⤵
  PID:6840
- C:\Windows\System\xqFINla.exe
  C:\Windows\System\xqFINla.exe
  2⤵
  PID:6600
- C:\Windows\System\ljcEkIB.exe
  C:\Windows\System\ljcEkIB.exe
  2⤵
  PID:6628
- C:\Windows\System\xudhNUO.exe
  C:\Windows\System\xudhNUO.exe
  2⤵
  PID:6500
- C:\Windows\System\QBzLwNP.exe
  C:\Windows\System\QBzLwNP.exe
  2⤵
  PID:6860
- C:\Windows\System\penynGS.exe
  C:\Windows\System\penynGS.exe
  2⤵
  PID:7048
- C:\Windows\System\LDzcDyu.exe
  C:\Windows\System\LDzcDyu.exe
  2⤵
  PID:7112
- C:\Windows\System\eAdGMEl.exe
  C:\Windows\System\eAdGMEl.exe
  2⤵
  PID:6664
- C:\Windows\System\zjtZjqv.exe
  C:\Windows\System\zjtZjqv.exe
  2⤵
  PID:5672
- C:\Windows\System\hOpvPzy.exe
  C:\Windows\System\hOpvPzy.exe
  2⤵
  PID:7132
- C:\Windows\System\hOIqgpR.exe
  C:\Windows\System\hOIqgpR.exe
  2⤵
  PID:6184
- C:\Windows\System\QsrFvRE.exe
  C:\Windows\System\QsrFvRE.exe
  2⤵
  PID:6024
- C:\Windows\System\LbwRPCZ.exe
  C:\Windows\System\LbwRPCZ.exe
  2⤵
  PID:6312
- C:\Windows\System\YUZHQBN.exe
  C:\Windows\System\YUZHQBN.exe
  2⤵
  PID:6320
- C:\Windows\System\BlZEKru.exe
  C:\Windows\System\BlZEKru.exe
  2⤵
  PID:6220
- C:\Windows\System\NKcgvmc.exe
  C:\Windows\System\NKcgvmc.exe
  2⤵
  PID:6568
- C:\Windows\System\fCYyFuZ.exe
  C:\Windows\System\fCYyFuZ.exe
  2⤵
  PID:6780
- C:\Windows\System\ulQNoBi.exe
  C:\Windows\System\ulQNoBi.exe
  2⤵
  PID:6856
- C:\Windows\System\TvBlnfB.exe
  C:\Windows\System\TvBlnfB.exe
  2⤵
  PID:6984
- C:\Windows\System\WuNGnpE.exe
  C:\Windows\System\WuNGnpE.exe
  2⤵
  PID:7020
- C:\Windows\System\DqdjSpG.exe
  C:\Windows\System\DqdjSpG.exe
  2⤵
  PID:5588
- C:\Windows\System\VwmILfx.exe
  C:\Windows\System\VwmILfx.exe
  2⤵
  PID:5452
- C:\Windows\System\PMprqLy.exe
  C:\Windows\System\PMprqLy.exe
  2⤵
  PID:6416
- C:\Windows\System\riqAZUh.exe
  C:\Windows\System\riqAZUh.exe
  2⤵
  PID:6432
- C:\Windows\System\uctAgAp.exe
  C:\Windows\System\uctAgAp.exe
  2⤵
  PID:3404
- C:\Windows\System\fqtrQZJ.exe
  C:\Windows\System\fqtrQZJ.exe
  2⤵
  PID:6504
- C:\Windows\System\tfmNAlV.exe
  C:\Windows\System\tfmNAlV.exe
  2⤵
  PID:6644
- C:\Windows\System\wHFABmo.exe
  C:\Windows\System\wHFABmo.exe
  2⤵
  PID:5640
- C:\Windows\System\bBtTQqL.exe
  C:\Windows\System\bBtTQqL.exe
  2⤵
  PID:6724
- C:\Windows\System\QVmjCNm.exe
  C:\Windows\System\QVmjCNm.exe
  2⤵
  PID:7180
- C:\Windows\System\vEQkLwD.exe
  C:\Windows\System\vEQkLwD.exe
  2⤵
  PID:7196
- C:\Windows\System\wiQGusZ.exe
  C:\Windows\System\wiQGusZ.exe
  2⤵
  PID:7212
- C:\Windows\System\wdlmIvX.exe
  C:\Windows\System\wdlmIvX.exe
  2⤵
  PID:7228
- C:\Windows\System\gCKCbDc.exe
  C:\Windows\System\gCKCbDc.exe
  2⤵
  PID:7244
- C:\Windows\System\syFaiFr.exe
  C:\Windows\System\syFaiFr.exe
  2⤵
  PID:7260
- C:\Windows\System\JyCBhyE.exe
  C:\Windows\System\JyCBhyE.exe
  2⤵
  PID:7276
- C:\Windows\System\ZlqjzHJ.exe
  C:\Windows\System\ZlqjzHJ.exe
  2⤵
  PID:7292
- C:\Windows\System\jLoZXPq.exe
  C:\Windows\System\jLoZXPq.exe
  2⤵
  PID:7308
- C:\Windows\System\QJFnuLi.exe
  C:\Windows\System\QJFnuLi.exe
  2⤵
  PID:7324
- C:\Windows\System\IrbeYSy.exe
  C:\Windows\System\IrbeYSy.exe
  2⤵
  PID:7340
- C:\Windows\System\izvjCoE.exe
  C:\Windows\System\izvjCoE.exe
  2⤵
  PID:7356
- C:\Windows\System\VUPuYWU.exe
  C:\Windows\System\VUPuYWU.exe
  2⤵
  PID:7372
- C:\Windows\System\midKfkw.exe
  C:\Windows\System\midKfkw.exe
  2⤵
  PID:7388
- C:\Windows\System\OmqFETj.exe
  C:\Windows\System\OmqFETj.exe
  2⤵
  PID:7404
- C:\Windows\System\aMzYkRY.exe
  C:\Windows\System\aMzYkRY.exe
  2⤵
  PID:7420
- C:\Windows\System\ONctLbQ.exe
  C:\Windows\System\ONctLbQ.exe
  2⤵
  PID:7436
- C:\Windows\System\WgjLWMd.exe
  C:\Windows\System\WgjLWMd.exe
  2⤵
  PID:7452
- C:\Windows\System\xMWdUtz.exe
  C:\Windows\System\xMWdUtz.exe
  2⤵
  PID:7468
- C:\Windows\System\YDQnKsq.exe
  C:\Windows\System\YDQnKsq.exe
  2⤵
  PID:7484
- C:\Windows\System\iKajumN.exe
  C:\Windows\System\iKajumN.exe
  2⤵
  PID:7504
- C:\Windows\System\oGoWSWz.exe
  C:\Windows\System\oGoWSWz.exe
  2⤵
  PID:7520
- C:\Windows\System\PjmEQkj.exe
  C:\Windows\System\PjmEQkj.exe
  2⤵
  PID:7536
- C:\Windows\System\PTQzrqs.exe
  C:\Windows\System\PTQzrqs.exe
  2⤵
  PID:7572
- C:\Windows\System\YBZZXUN.exe
  C:\Windows\System\YBZZXUN.exe
  2⤵
  PID:7592
- C:\Windows\System\YBtxQTu.exe
  C:\Windows\System\YBtxQTu.exe
  2⤵
  PID:7608
- C:\Windows\System\DlGiJWK.exe
  C:\Windows\System\DlGiJWK.exe
  2⤵
  PID:7624
- C:\Windows\System\BjTMfnK.exe
  C:\Windows\System\BjTMfnK.exe
  2⤵
  PID:7640
- C:\Windows\System\pddOWbe.exe
  C:\Windows\System\pddOWbe.exe
  2⤵
  PID:7656
- C:\Windows\System\EKvIqmd.exe
  C:\Windows\System\EKvIqmd.exe
  2⤵
  PID:7672
- C:\Windows\System\EcJVCJd.exe
  C:\Windows\System\EcJVCJd.exe
  2⤵
  PID:7688
- C:\Windows\System\ucpBrOD.exe
  C:\Windows\System\ucpBrOD.exe
  2⤵
  PID:7704
- C:\Windows\System\KvbMaXI.exe
  C:\Windows\System\KvbMaXI.exe
  2⤵
  PID:7720
- C:\Windows\System\XNcjatJ.exe
  C:\Windows\System\XNcjatJ.exe
  2⤵
  PID:7736
- C:\Windows\System\sxYcynC.exe
  C:\Windows\System\sxYcynC.exe
  2⤵
  PID:7752
- C:\Windows\System\DaHBEnX.exe
  C:\Windows\System\DaHBEnX.exe
  2⤵
  PID:7768
- C:\Windows\System\gfbEZLI.exe
  C:\Windows\System\gfbEZLI.exe
  2⤵
  PID:7784
- C:\Windows\System\KfNStko.exe
  C:\Windows\System\KfNStko.exe
  2⤵
  PID:7800
- C:\Windows\System\IcQSoki.exe
  C:\Windows\System\IcQSoki.exe
  2⤵
  PID:7816
- C:\Windows\System\UXeRjKy.exe
  C:\Windows\System\UXeRjKy.exe
  2⤵
  PID:7832
- C:\Windows\System\GRRqatl.exe
  C:\Windows\System\GRRqatl.exe
  2⤵
  PID:7848
- C:\Windows\System\YGrXuXt.exe
  C:\Windows\System\YGrXuXt.exe
  2⤵
  PID:7864
- C:\Windows\System\GgqtaIE.exe
  C:\Windows\System\GgqtaIE.exe
  2⤵
  PID:7880
- C:\Windows\System\IiFJhyw.exe
  C:\Windows\System\IiFJhyw.exe
  2⤵
  PID:7896
- C:\Windows\System\ojMjPTD.exe
  C:\Windows\System\ojMjPTD.exe
  2⤵
  PID:7912
- C:\Windows\System\nLFcaMl.exe
  C:\Windows\System\nLFcaMl.exe
  2⤵
  PID:7928
- C:\Windows\System\IuQMXIr.exe
  C:\Windows\System\IuQMXIr.exe
  2⤵
  PID:7944
- C:\Windows\System\NSsGTHP.exe
  C:\Windows\System\NSsGTHP.exe
  2⤵
  PID:7960
- C:\Windows\System\PgiwSwf.exe
  C:\Windows\System\PgiwSwf.exe
  2⤵
  PID:7976
- C:\Windows\System\MBURika.exe
  C:\Windows\System\MBURika.exe
  2⤵
  PID:7992
- C:\Windows\System\WeAWgVn.exe
  C:\Windows\System\WeAWgVn.exe
  2⤵
  PID:8008
- C:\Windows\System\DUMqxeD.exe
  C:\Windows\System\DUMqxeD.exe
  2⤵
  PID:8024
- C:\Windows\System\tHZTmwR.exe
  C:\Windows\System\tHZTmwR.exe
  2⤵
  PID:8040
- C:\Windows\System\xvBssge.exe
  C:\Windows\System\xvBssge.exe
  2⤵
  PID:8056
- C:\Windows\System\SWPTBPh.exe
  C:\Windows\System\SWPTBPh.exe
  2⤵
  PID:8072
- C:\Windows\System\SKtkGGQ.exe
  C:\Windows\System\SKtkGGQ.exe
  2⤵
  PID:8088
- C:\Windows\System\GtaRBKc.exe
  C:\Windows\System\GtaRBKc.exe
  2⤵
  PID:8104
- C:\Windows\System\aFkCtYI.exe
  C:\Windows\System\aFkCtYI.exe
  2⤵
  PID:8120
- C:\Windows\System\EFygest.exe
  C:\Windows\System\EFygest.exe
  2⤵
  PID:8136
- C:\Windows\System\NnfGPIM.exe
  C:\Windows\System\NnfGPIM.exe
  2⤵
  PID:8152
- C:\Windows\System\xiJoJBm.exe
  C:\Windows\System\xiJoJBm.exe
  2⤵
  PID:8168
- C:\Windows\System\WnSPVlG.exe
  C:\Windows\System\WnSPVlG.exe
  2⤵
  PID:8184
- C:\Windows\System\GRaPZst.exe
  C:\Windows\System\GRaPZst.exe
  2⤵
  PID:7188
- C:\Windows\System\SbAVnuS.exe
  C:\Windows\System\SbAVnuS.exe
  2⤵
  PID:7192
- C:\Windows\System\DTsUaXQ.exe
  C:\Windows\System\DTsUaXQ.exe
  2⤵
  PID:7220
- C:\Windows\System\PWWwPgU.exe
  C:\Windows\System\PWWwPgU.exe
  2⤵
  PID:7252
- C:\Windows\System\WCkZvYm.exe
  C:\Windows\System\WCkZvYm.exe
  2⤵
  PID:7316
- C:\Windows\System\Xwssedh.exe
  C:\Windows\System\Xwssedh.exe
  2⤵
  PID:7304
- C:\Windows\System\hafgmuG.exe
  C:\Windows\System\hafgmuG.exe
  2⤵
  PID:7272
- C:\Windows\System\BkHVmUk.exe
  C:\Windows\System\BkHVmUk.exe
  2⤵
  PID:7384
- C:\Windows\System\TVditgs.exe
  C:\Windows\System\TVditgs.exe
  2⤵
  PID:7368
- C:\Windows\System\RhmhksS.exe
  C:\Windows\System\RhmhksS.exe
  2⤵
  PID:7400
- C:\Windows\System\uGaUSEN.exe
  C:\Windows\System\uGaUSEN.exe
  2⤵
  PID:7464
- C:\Windows\System\GHCzPoM.exe
  C:\Windows\System\GHCzPoM.exe
  2⤵
  PID:7500
- C:\Windows\System\UvPIFsO.exe
  C:\Windows\System\UvPIFsO.exe
  2⤵
  PID:7556
- C:\Windows\System\mgMAhPZ.exe
  C:\Windows\System\mgMAhPZ.exe
  2⤵
  PID:7584
- C:\Windows\System\MSDOEUu.exe
  C:\Windows\System\MSDOEUu.exe
  2⤵
  PID:7632
- C:\Windows\System\GfVTJtw.exe
  C:\Windows\System\GfVTJtw.exe
  2⤵
  PID:7700
- C:\Windows\System\DQdGKfl.exe
  C:\Windows\System\DQdGKfl.exe
  2⤵
  PID:7652
- C:\Windows\System\naKbcfO.exe
  C:\Windows\System\naKbcfO.exe
  2⤵
  PID:7616
- C:\Windows\System\anGvHuo.exe
  C:\Windows\System\anGvHuo.exe
  2⤵
  PID:7792
- C:\Windows\System\cyCYOEO.exe
  C:\Windows\System\cyCYOEO.exe
  2⤵
  PID:7812
- C:\Windows\System\OLYMjAw.exe
  C:\Windows\System\OLYMjAw.exe
  2⤵
  PID:7780
- C:\Windows\System\lhitlFf.exe
  C:\Windows\System\lhitlFf.exe
  2⤵
  PID:7860
- C:\Windows\System\zjQHnCM.exe
  C:\Windows\System\zjQHnCM.exe
  2⤵
  PID:7920
- C:\Windows\System\yMKCJWG.exe
  C:\Windows\System\yMKCJWG.exe
  2⤵
  PID:7840
- C:\Windows\System\fbkRzRN.exe
  C:\Windows\System\fbkRzRN.exe
  2⤵
  PID:7940
- C:\Windows\System\WJxBJRx.exe
  C:\Windows\System\WJxBJRx.exe
  2⤵
  PID:8016
- C:\Windows\System\zTlcxEw.exe
  C:\Windows\System\zTlcxEw.exe
  2⤵
  PID:8112
- C:\Windows\System\weiqmIL.exe
  C:\Windows\System\weiqmIL.exe
  2⤵
  PID:7268
- C:\Windows\System\zJRMezy.exe
  C:\Windows\System\zJRMezy.exe
  2⤵
  PID:8128
- C:\Windows\System\kshJWVH.exe
  C:\Windows\System\kshJWVH.exe
  2⤵
  PID:7348
- C:\Windows\System\nyJLUqc.exe
  C:\Windows\System\nyJLUqc.exe
  2⤵
  PID:8096
- C:\Windows\System\gCylaOb.exe
  C:\Windows\System\gCylaOb.exe
  2⤵
  PID:8068
- C:\Windows\System\DlUixsd.exe
  C:\Windows\System\DlUixsd.exe
  2⤵
  PID:8160
- C:\Windows\System\DSvCmzq.exe
  C:\Windows\System\DSvCmzq.exe
  2⤵
  PID:7568
- C:\Windows\System\KQaFnoA.exe
  C:\Windows\System\KQaFnoA.exe
  2⤵
  PID:7668
- C:\Windows\System\rwOnOzQ.exe
  C:\Windows\System\rwOnOzQ.exe
  2⤵
  PID:7716
- C:\Windows\System\LwwZtaG.exe
  C:\Windows\System\LwwZtaG.exe
  2⤵
  PID:7956
- C:\Windows\System\AscpdBQ.exe
  C:\Windows\System\AscpdBQ.exe
  2⤵
  PID:7648
- C:\Windows\System\iTJEqiR.exe
  C:\Windows\System\iTJEqiR.exe
  2⤵
  PID:7872
- C:\Windows\System\zvtKmej.exe
  C:\Windows\System\zvtKmej.exe
  2⤵
  PID:8176
- C:\Windows\System\qQjMJBP.exe
  C:\Windows\System\qQjMJBP.exe
  2⤵
  PID:7300
- C:\Windows\System\hdWkxrx.exe
  C:\Windows\System\hdWkxrx.exe
  2⤵
  PID:7776
- C:\Windows\System\TvRwFbH.exe
  C:\Windows\System\TvRwFbH.exe
  2⤵
  PID:8208
- C:\Windows\System\InWBSpq.exe
  C:\Windows\System\InWBSpq.exe
  2⤵
  PID:8224
- C:\Windows\System\gUhfLnX.exe
  C:\Windows\System\gUhfLnX.exe
  2⤵
  PID:8240
- C:\Windows\System\fpSqICm.exe
  C:\Windows\System\fpSqICm.exe
  2⤵
  PID:8256
- C:\Windows\System\DCMvfXq.exe
  C:\Windows\System\DCMvfXq.exe
  2⤵
  PID:8272
- C:\Windows\System\KQRAbOu.exe
  C:\Windows\System\KQRAbOu.exe
  2⤵
  PID:8292
- C:\Windows\System\jrhPwMQ.exe
  C:\Windows\System\jrhPwMQ.exe
  2⤵
  PID:8316
- C:\Windows\System\odyoXek.exe
  C:\Windows\System\odyoXek.exe
  2⤵
  PID:8332
- C:\Windows\System\gZZGnjt.exe
  C:\Windows\System\gZZGnjt.exe
  2⤵
  PID:8348
- C:\Windows\System\WEDyrqs.exe
  C:\Windows\System\WEDyrqs.exe
  2⤵
  PID:8368
- C:\Windows\System\UHOORqP.exe
  C:\Windows\System\UHOORqP.exe
  2⤵
  PID:8384
- C:\Windows\System\OpZpOLm.exe
  C:\Windows\System\OpZpOLm.exe
  2⤵
  PID:8400
- C:\Windows\System\vblQyUe.exe
  C:\Windows\System\vblQyUe.exe
  2⤵
  PID:8480
- C:\Windows\System\AvQRtzn.exe
  C:\Windows\System\AvQRtzn.exe
  2⤵
  PID:8496
- C:\Windows\System\hAlbBGc.exe
  C:\Windows\System\hAlbBGc.exe
  2⤵
  PID:8512
- C:\Windows\System\HqsPakn.exe
  C:\Windows\System\HqsPakn.exe
  2⤵
  PID:8528
- C:\Windows\System\ffJffwA.exe
  C:\Windows\System\ffJffwA.exe
  2⤵
  PID:8544
- C:\Windows\System\LxkxZVs.exe
  C:\Windows\System\LxkxZVs.exe
  2⤵
  PID:8560
- C:\Windows\System\uZbiWve.exe
  C:\Windows\System\uZbiWve.exe
  2⤵
  PID:8612
- C:\Windows\System\ABwzMwC.exe
  C:\Windows\System\ABwzMwC.exe
  2⤵
  PID:8636
- C:\Windows\System\blipzKM.exe
  C:\Windows\System\blipzKM.exe
  2⤵
  PID:8660
- C:\Windows\System\dLkXFfQ.exe
  C:\Windows\System\dLkXFfQ.exe
  2⤵
  PID:8676
- C:\Windows\System\HwrxiDt.exe
  C:\Windows\System\HwrxiDt.exe
  2⤵
  PID:8692
- C:\Windows\System\ehJoJdg.exe
  C:\Windows\System\ehJoJdg.exe
  2⤵
  PID:8708
- C:\Windows\System\TusFFoa.exe
  C:\Windows\System\TusFFoa.exe
  2⤵
  PID:8724
- C:\Windows\System\SusYnQo.exe
  C:\Windows\System\SusYnQo.exe
  2⤵
  PID:8740
- C:\Windows\System\RLxXPaM.exe
  C:\Windows\System\RLxXPaM.exe
  2⤵
  PID:8756
- C:\Windows\System\emDJarF.exe
  C:\Windows\System\emDJarF.exe
  2⤵
  PID:8772
- C:\Windows\System\tRTqCBy.exe
  C:\Windows\System\tRTqCBy.exe
  2⤵
  PID:8788
- C:\Windows\System\MTLZYGC.exe
  C:\Windows\System\MTLZYGC.exe
  2⤵
  PID:8808
- C:\Windows\System\BXUzXIP.exe
  C:\Windows\System\BXUzXIP.exe
  2⤵
  PID:8824
- C:\Windows\System\PuIVbvz.exe
  C:\Windows\System\PuIVbvz.exe
  2⤵
  PID:8840
- C:\Windows\System\xJltQPT.exe
  C:\Windows\System\xJltQPT.exe
  2⤵
  PID:8860
- C:\Windows\System\QLgAuPY.exe
  C:\Windows\System\QLgAuPY.exe
  2⤵
  PID:8876
- C:\Windows\System\MsRQyRp.exe
  C:\Windows\System\MsRQyRp.exe
  2⤵
  PID:8896
- C:\Windows\System\WcAEsFt.exe
  C:\Windows\System\WcAEsFt.exe
  2⤵
  PID:8912
- C:\Windows\System\aGTORDX.exe
  C:\Windows\System\aGTORDX.exe
  2⤵
  PID:8928
- C:\Windows\System\zdoFqZJ.exe
  C:\Windows\System\zdoFqZJ.exe
  2⤵
  PID:8944
- C:\Windows\System\gcUGdnt.exe
  C:\Windows\System\gcUGdnt.exe
  2⤵
  PID:8964
- C:\Windows\System\digdnsP.exe
  C:\Windows\System\digdnsP.exe
  2⤵
  PID:8984
- C:\Windows\System\zaeeWXw.exe
  C:\Windows\System\zaeeWXw.exe
  2⤵
  PID:9000
- C:\Windows\System\qGtwsYl.exe
  C:\Windows\System\qGtwsYl.exe
  2⤵
  PID:9020
- C:\Windows\System\dOXVRhm.exe
  C:\Windows\System\dOXVRhm.exe
  2⤵
  PID:9036
- C:\Windows\System\hppqtaN.exe
  C:\Windows\System\hppqtaN.exe
  2⤵
  PID:9052
- C:\Windows\System\jqbGBmU.exe
  C:\Windows\System\jqbGBmU.exe
  2⤵
  PID:9072
- C:\Windows\System\ymhMfdW.exe
  C:\Windows\System\ymhMfdW.exe
  2⤵
  PID:9200
- C:\Windows\System\FHaZzCi.exe
  C:\Windows\System\FHaZzCi.exe
  2⤵
  PID:7512
- C:\Windows\System\XbdhuPa.exe
  C:\Windows\System\XbdhuPa.exe
  2⤵
  PID:7204
- C:\Windows\System\PNzmaHH.exe
  C:\Windows\System\PNzmaHH.exe
  2⤵
  PID:7532
- C:\Windows\System\ThkiEVa.exe
  C:\Windows\System\ThkiEVa.exe
  2⤵
  PID:7808
- C:\Windows\System\nBOVJbP.exe
  C:\Windows\System\nBOVJbP.exe
  2⤵
  PID:8148
- C:\Windows\System\SHianwy.exe
  C:\Windows\System\SHianwy.exe
  2⤵
  PID:8216
- C:\Windows\System\wOmDiJI.exe
  C:\Windows\System\wOmDiJI.exe
  2⤵
  PID:8280
- C:\Windows\System\KDjAtOh.exe
  C:\Windows\System\KDjAtOh.exe
  2⤵
  PID:7552
- C:\Windows\System\OsHSxvs.exe
  C:\Windows\System\OsHSxvs.exe
  2⤵
  PID:8360
- C:\Windows\System\dwCMscx.exe
  C:\Windows\System\dwCMscx.exe
  2⤵
  PID:7364
- C:\Windows\System\ShnYcAM.exe
  C:\Windows\System\ShnYcAM.exe
  2⤵
  PID:8032
- C:\Windows\System\pGcbDNg.exe
  C:\Windows\System\pGcbDNg.exe
  2⤵
  PID:8164
- C:\Windows\System\aTPjGgV.exe
  C:\Windows\System\aTPjGgV.exe
  2⤵
  PID:7856
- C:\Windows\System\IFVcvsA.exe
  C:\Windows\System\IFVcvsA.exe
  2⤵
  PID:8116
- C:\Windows\System\sVcfUlg.exe
  C:\Windows\System\sVcfUlg.exe
  2⤵
  PID:8264
- C:\Windows\System\qHaDiUv.exe
  C:\Windows\System\qHaDiUv.exe
  2⤵
  PID:8308
- C:\Windows\System\HriFSXr.exe
  C:\Windows\System\HriFSXr.exe
  2⤵
  PID:8416
- C:\Windows\System\vQxFaNs.exe
  C:\Windows\System\vQxFaNs.exe
  2⤵
  PID:8432
- C:\Windows\System\FDEIDot.exe
  C:\Windows\System\FDEIDot.exe
  2⤵
  PID:8344
- C:\Windows\System\rjerrIu.exe
  C:\Windows\System\rjerrIu.exe
  2⤵
  PID:7240
- C:\Windows\System\IdaNHBL.exe
  C:\Windows\System\IdaNHBL.exe
  2⤵
  PID:8232
- C:\Windows\System\SSitBTC.exe
  C:\Windows\System\SSitBTC.exe
  2⤵
  PID:8584
- C:\Windows\System\lzPjdsf.exe
  C:\Windows\System\lzPjdsf.exe
  2⤵
  PID:8596
- C:\Windows\System\tCOVcvm.exe
  C:\Windows\System\tCOVcvm.exe
  2⤵
  PID:8648
- C:\Windows\System\uPfVyAU.exe
  C:\Windows\System\uPfVyAU.exe
  2⤵
  PID:8716
- C:\Windows\System\dFThVgS.exe
  C:\Windows\System\dFThVgS.exe
  2⤵
  PID:8780
- C:\Windows\System\KaWKAzQ.exe
  C:\Windows\System\KaWKAzQ.exe
  2⤵
  PID:8848
- C:\Windows\System\giODZxs.exe
  C:\Windows\System\giODZxs.exe
  2⤵
  PID:8888
- C:\Windows\System\TgGMcra.exe
  C:\Windows\System\TgGMcra.exe
  2⤵
  PID:8956
- C:\Windows\System\UhWQRNc.exe
  C:\Windows\System\UhWQRNc.exe
  2⤵
  PID:9028
- C:\Windows\System\pedZGUR.exe
  C:\Windows\System\pedZGUR.exe
  2⤵
  PID:8644
- C:\Windows\System\UgtXhdx.exe
  C:\Windows\System\UgtXhdx.exe
  2⤵
  PID:8628
- C:\Windows\System\jhrHKGp.exe
  C:\Windows\System\jhrHKGp.exe
  2⤵
  PID:8796
- C:\Windows\System\UfoDxmO.exe
  C:\Windows\System\UfoDxmO.exe
  2⤵
  PID:7732
- C:\Windows\System\iNWPUon.exe
  C:\Windows\System\iNWPUon.exe
  2⤵
  PID:8328
- C:\Windows\System\cLwXPLq.exe
  C:\Windows\System\cLwXPLq.exe
  2⤵
  PID:8700
- C:\Windows\System\qpPpxIO.exe
  C:\Windows\System\qpPpxIO.exe
  2⤵
  PID:8764
- C:\Windows\System\ZWOQlNu.exe
  C:\Windows\System\ZWOQlNu.exe
  2⤵
  PID:7696
- C:\Windows\System\TCWVOPF.exe
  C:\Windows\System\TCWVOPF.exe
  2⤵
  PID:9104
- C:\Windows\System\lMsxMri.exe
  C:\Windows\System\lMsxMri.exe
  2⤵
  PID:9124
- C:\Windows\System\bLNTMHz.exe
  C:\Windows\System\bLNTMHz.exe
  2⤵
  PID:9144
- C:\Windows\System\mEIVGDL.exe
  C:\Windows\System\mEIVGDL.exe
  2⤵
  PID:9220
- C:\Windows\System\gpfJIrR.exe
  C:\Windows\System\gpfJIrR.exe
  2⤵
  PID:9236
- C:\Windows\System\EyirZcR.exe
  C:\Windows\System\EyirZcR.exe
  2⤵
  PID:9252
- C:\Windows\System\mkhGOrC.exe
  C:\Windows\System\mkhGOrC.exe
  2⤵
  PID:9276
- C:\Windows\System\wmyCrqQ.exe
  C:\Windows\System\wmyCrqQ.exe
  2⤵
  PID:9292
- C:\Windows\System\gCbzvYU.exe
  C:\Windows\System\gCbzvYU.exe
  2⤵
  PID:9312
- C:\Windows\System\zqmjSnf.exe
  C:\Windows\System\zqmjSnf.exe
  2⤵
  PID:9332
- C:\Windows\System\CUnwdcA.exe
  C:\Windows\System\CUnwdcA.exe
  2⤵
  PID:9348
- C:\Windows\System\KnIjBxY.exe
  C:\Windows\System\KnIjBxY.exe
  2⤵
  PID:9368
- C:\Windows\System\aFuMCty.exe
  C:\Windows\System\aFuMCty.exe
  2⤵
  PID:9384
- C:\Windows\System\JuuoxeP.exe
  C:\Windows\System\JuuoxeP.exe
  2⤵
  PID:9400
- C:\Windows\System\mVxqqUh.exe
  C:\Windows\System\mVxqqUh.exe
  2⤵
  PID:9416
- C:\Windows\System\QKRzRFy.exe
  C:\Windows\System\QKRzRFy.exe
  2⤵
  PID:9436
- C:\Windows\System\blSZUqZ.exe
  C:\Windows\System\blSZUqZ.exe
  2⤵
  PID:9468
- C:\Windows\System\ZbMlRHW.exe
  C:\Windows\System\ZbMlRHW.exe
  2⤵
  PID:9496
- C:\Windows\System\wTMGKYo.exe
  C:\Windows\System\wTMGKYo.exe
  2⤵
  PID:9516
- C:\Windows\System\YmDAdjJ.exe
  C:\Windows\System\YmDAdjJ.exe
  2⤵
  PID:9536
- C:\Windows\System\hOErYXE.exe
  C:\Windows\System\hOErYXE.exe
  2⤵
  PID:9560
- C:\Windows\System\HdAxfpi.exe
  C:\Windows\System\HdAxfpi.exe
  2⤵
  PID:9580
- C:\Windows\System\takryUM.exe
  C:\Windows\System\takryUM.exe
  2⤵
  PID:9604
- C:\Windows\System\NsQXSlW.exe
  C:\Windows\System\NsQXSlW.exe
  2⤵
  PID:9780
- C:\Windows\System\RwJZJXS.exe
  C:\Windows\System\RwJZJXS.exe
  2⤵
  PID:9908
- C:\Windows\System\vpLrNOB.exe
  C:\Windows\System\vpLrNOB.exe
  2⤵
  PID:9928
- C:\Windows\System\etERdQI.exe
  C:\Windows\System\etERdQI.exe
  2⤵
  PID:9948
- C:\Windows\System\pnGSyAr.exe
  C:\Windows\System\pnGSyAr.exe
  2⤵
  PID:9964
- C:\Windows\System\UYnoPhL.exe
  C:\Windows\System\UYnoPhL.exe
  2⤵
  PID:9984
- C:\Windows\System\SXyCMzD.exe
  C:\Windows\System\SXyCMzD.exe
  2⤵
  PID:10012
- C:\Windows\System\ZNIfMiD.exe
  C:\Windows\System\ZNIfMiD.exe
  2⤵
  PID:10032
- C:\Windows\System\QZIXtAf.exe
  C:\Windows\System\QZIXtAf.exe
  2⤵
  PID:10052
- C:\Windows\System\sxzgqsK.exe
  C:\Windows\System\sxzgqsK.exe
  2⤵
  PID:10212
- C:\Windows\System\AIOkcob.exe
  C:\Windows\System\AIOkcob.exe
  2⤵
  PID:10228
- C:\Windows\System\LpXKNHN.exe
  C:\Windows\System\LpXKNHN.exe
  2⤵
  PID:7380
- C:\Windows\System\BXMbtyH.exe
  C:\Windows\System\BXMbtyH.exe
  2⤵
  PID:8604
- C:\Windows\System\czzkUDw.exe
  C:\Windows\System\czzkUDw.exe
  2⤵
  PID:8856
- C:\Windows\System\PiSehIP.exe
  C:\Windows\System\PiSehIP.exe
  2⤵
  PID:9212
- C:\Windows\System\PHIrDQR.exe
  C:\Windows\System\PHIrDQR.exe
  2⤵
  PID:8804
- C:\Windows\System\Ixmnifl.exe
  C:\Windows\System\Ixmnifl.exe
  2⤵
  PID:8656
- C:\Windows\System\tRKaYVJ.exe
  C:\Windows\System\tRKaYVJ.exe
  2⤵
  PID:9060
- C:\Windows\System\mJaeSoS.exe
  C:\Windows\System\mJaeSoS.exe
  2⤵
  PID:8252
- C:\Windows\System\ANOpRdB.exe
  C:\Windows\System\ANOpRdB.exe
  2⤵
  PID:8868
- C:\Windows\System\Kbmjyvj.exe
  C:\Windows\System\Kbmjyvj.exe
  2⤵
  PID:9180
- C:\Windows\System\JnghMDU.exe
  C:\Windows\System\JnghMDU.exe
  2⤵
  PID:8872
- C:\Windows\System\hxKtRnf.exe
  C:\Windows\System\hxKtRnf.exe
  2⤵
  PID:8908
- C:\Windows\System\QzKqndq.exe
  C:\Windows\System\QzKqndq.exe
  2⤵
  PID:9044
- C:\Windows\System\gpzBytI.exe
  C:\Windows\System\gpzBytI.exe
  2⤵
  PID:9084
- C:\Windows\System\ZDXyQej.exe
  C:\Windows\System\ZDXyQej.exe
  2⤵
  PID:8376
- C:\Windows\System\uZujLDX.exe
  C:\Windows\System\uZujLDX.exe
  2⤵
  PID:8200
- C:\Windows\System\TxgfphJ.exe
  C:\Windows\System\TxgfphJ.exe
  2⤵
  PID:9100
- C:\Windows\System\vhxzbFM.exe
  C:\Windows\System\vhxzbFM.exe
  2⤵
  PID:8004
- C:\Windows\System\NYRYcvi.exe
  C:\Windows\System\NYRYcvi.exe
  2⤵
  PID:7764
- C:\Windows\System\ESpXlkG.exe
  C:\Windows\System\ESpXlkG.exe
  2⤵
  PID:8180
- C:\Windows\System\PelXbWm.exe
  C:\Windows\System\PelXbWm.exe
  2⤵
  PID:9272
- C:\Windows\System\hPvHkQE.exe
  C:\Windows\System\hPvHkQE.exe
  2⤵
  PID:9412
- C:\Windows\System\hbuKgVr.exe
  C:\Windows\System\hbuKgVr.exe
  2⤵
  PID:9460
- C:\Windows\System\yqYfUCD.exe
  C:\Windows\System\yqYfUCD.exe
  2⤵
  PID:8572
- C:\Windows\System\ocSaMad.exe
  C:\Windows\System\ocSaMad.exe
  2⤵
  PID:9556
- C:\Windows\System\ntjJaOp.exe
  C:\Windows\System\ntjJaOp.exe
  2⤵
  PID:9600
- C:\Windows\System\ChZBcTj.exe
  C:\Windows\System\ChZBcTj.exe
  2⤵
  PID:8424
- C:\Windows\System\YFjMZmq.exe
  C:\Windows\System\YFjMZmq.exe
  2⤵
  PID:7208
- C:\Windows\System\iGFGLAD.exe
  C:\Windows\System\iGFGLAD.exe
  2⤵
  PID:8520
- C:\Windows\System\yVgIwfE.exe
  C:\Windows\System\yVgIwfE.exe
  2⤵
  PID:8536
- C:\Windows\System\HyzamRc.exe
  C:\Windows\System\HyzamRc.exe
  2⤵
  PID:8380
- C:\Windows\System\fWSUGqQ.exe
  C:\Windows\System\fWSUGqQ.exe
  2⤵
  PID:9356
- C:\Windows\System\mwmVcTz.exe
  C:\Windows\System\mwmVcTz.exe
  2⤵
  PID:9676
- C:\Windows\System\cPdnfrS.exe
  C:\Windows\System\cPdnfrS.exe
  2⤵
  PID:9152
- C:\Windows\System\iRPClBf.exe
  C:\Windows\System\iRPClBf.exe
  2⤵
  PID:9196
- C:\Windows\System\NPoWUmV.exe
  C:\Windows\System\NPoWUmV.exe
  2⤵
  PID:9424
- C:\Windows\System\XjvDVXs.exe
  C:\Windows\System\XjvDVXs.exe
  2⤵
  PID:9476
- C:\Windows\System\IxZqJmY.exe
  C:\Windows\System\IxZqJmY.exe
  2⤵
  PID:9524
- C:\Windows\System\WuwAhgI.exe
  C:\Windows\System\WuwAhgI.exe
  2⤵
  PID:9612
- C:\Windows\System\sBSbqCh.exe
  C:\Windows\System\sBSbqCh.exe
  2⤵
  PID:9632
- C:\Windows\System\pvOsckP.exe
  C:\Windows\System\pvOsckP.exe
  2⤵
  PID:9696
- C:\Windows\System\Jhuabid.exe
  C:\Windows\System\Jhuabid.exe
  2⤵
  PID:9772
- C:\Windows\System\wZKPaGY.exe
  C:\Windows\System\wZKPaGY.exe
  2⤵
  PID:9728
- C:\Windows\System\BAIPaVg.exe
  C:\Windows\System\BAIPaVg.exe
  2⤵
  PID:9744
- C:\Windows\System\dTsZxZg.exe
  C:\Windows\System\dTsZxZg.exe
  2⤵
  PID:9760
- C:\Windows\System\OnWuTZR.exe
  C:\Windows\System\OnWuTZR.exe
  2⤵
  PID:9444
- C:\Windows\System\THCYnma.exe
  C:\Windows\System\THCYnma.exe
  2⤵
  PID:9248
- C:\Windows\System\haTXYgL.exe
  C:\Windows\System\haTXYgL.exe
  2⤵
  PID:9268
- C:\Windows\System\TNUeANg.exe
  C:\Windows\System\TNUeANg.exe
  2⤵
  PID:9804
- C:\Windows\System\YCpBShX.exe
  C:\Windows\System\YCpBShX.exe
  2⤵
  PID:9916
- C:\Windows\System\BiQZOCZ.exe
  C:\Windows\System\BiQZOCZ.exe
  2⤵
  PID:9960
- C:\Windows\System\rezMTWl.exe
  C:\Windows\System\rezMTWl.exe
  2⤵
  PID:10008
- C:\Windows\System\pWgUubC.exe
  C:\Windows\System\pWgUubC.exe
  2⤵
  PID:9848
- C:\Windows\System\nOPrUzt.exe
  C:\Windows\System\nOPrUzt.exe
  2⤵
  PID:9896
- C:\Windows\System\zJEkJIr.exe
  C:\Windows\System\zJEkJIr.exe
  2⤵
  PID:9944
- C:\Windows\System\RtUEFiB.exe
  C:\Windows\System\RtUEFiB.exe
  2⤵
  PID:9308
- C:\Windows\System\fqTcUPY.exe
  C:\Windows\System\fqTcUPY.exe
  2⤵
  PID:9844
- C:\Windows\System\VTSMlAp.exe
  C:\Windows\System\VTSMlAp.exe
  2⤵
  PID:9936
- C:\Windows\System\WTBJuBa.exe
  C:\Windows\System\WTBJuBa.exe
  2⤵
  PID:9860
- C:\Windows\System\QgoaVWO.exe
  C:\Windows\System\QgoaVWO.exe
  2⤵
  PID:10024
- C:\Windows\System\omJSSDg.exe
  C:\Windows\System\omJSSDg.exe
  2⤵
  PID:9088
- C:\Windows\System\MKyPAAm.exe
  C:\Windows\System\MKyPAAm.exe
  2⤵
  PID:10072
- C:\Windows\System\DOcbngG.exe
  C:\Windows\System\DOcbngG.exe
  2⤵
  PID:10084
- C:\Windows\System\kWLCaQJ.exe
  C:\Windows\System\kWLCaQJ.exe
  2⤵
  PID:8620
- C:\Windows\System\IGXRnko.exe
  C:\Windows\System\IGXRnko.exe
  2⤵
  PID:10096
- C:\Windows\System\RrccFkC.exe
  C:\Windows\System\RrccFkC.exe
  2⤵
  PID:8588
- C:\Windows\System\GpECfpN.exe
  C:\Windows\System\GpECfpN.exe
  2⤵
  PID:10048
- C:\Windows\System\oNUlEkf.exe
  C:\Windows\System\oNUlEkf.exe
  2⤵
  PID:8940
- C:\Windows\System\hTLZrbJ.exe
  C:\Windows\System\hTLZrbJ.exe
  2⤵
  PID:9080
- C:\Windows\System\SfbNDvl.exe
  C:\Windows\System\SfbNDvl.exe
  2⤵
  PID:8748
- C:\Windows\System\wRlFxVU.exe
  C:\Windows\System\wRlFxVU.exe
  2⤵
  PID:10100
- C:\Windows\System\QrUysmm.exe
  C:\Windows\System\QrUysmm.exe
  2⤵
  PID:9136
- C:\Windows\System\PxRxVMB.exe
  C:\Windows\System\PxRxVMB.exe
  2⤵
  PID:9192
- C:\Windows\System\zjavtDO.exe
  C:\Windows\System\zjavtDO.exe
  2⤵
  PID:9344
- C:\Windows\System\BDfcoxT.exe
  C:\Windows\System\BDfcoxT.exe
  2⤵
  PID:9376
- C:\Windows\System\rvePEbr.exe
  C:\Windows\System\rvePEbr.exe
  2⤵
  PID:7448
- C:\Windows\System\tZbARQa.exe
  C:\Windows\System\tZbARQa.exe
  2⤵
  PID:10108
- C:\Windows\System\lPIYkzV.exe
  C:\Windows\System\lPIYkzV.exe
  2⤵
  PID:10140
- C:\Windows\System\VWzlEgJ.exe
  C:\Windows\System\VWzlEgJ.exe
  2⤵
  PID:10152
- C:\Windows\System\JsHsVZM.exe
  C:\Windows\System\JsHsVZM.exe
  2⤵
  PID:10164
- C:\Windows\System\AuSgljd.exe
  C:\Windows\System\AuSgljd.exe
  2⤵
  PID:10180
- C:\Windows\System\KyWqgwO.exe
  C:\Windows\System\KyWqgwO.exe
  2⤵
  PID:7712
- C:\Windows\System\BDWTntM.exe
  C:\Windows\System\BDWTntM.exe
  2⤵
  PID:7892
- C:\Windows\System\UtVqRnO.exe
  C:\Windows\System\UtVqRnO.exe
  2⤵
  PID:9008
- C:\Windows\System\olxQYne.exe
  C:\Windows\System\olxQYne.exe
  2⤵
  PID:8100
- C:\Windows\System\NIURNrG.exe
  C:\Windows\System\NIURNrG.exe
  2⤵
  PID:9228
- C:\Windows\System\AfHbvnX.exe
  C:\Windows\System\AfHbvnX.exe
  2⤵
  PID:9456
- C:\Windows\System\cwitaVQ.exe
  C:\Windows\System\cwitaVQ.exe
  2⤵
  PID:9364
- C:\Windows\System\kaUFXDi.exe
  C:\Windows\System\kaUFXDi.exe
  2⤵
  PID:8300
- C:\Windows\System\fLnwfBZ.exe
  C:\Windows\System\fLnwfBZ.exe
  2⤵
  PID:8304
- C:\Windows\System\XkyUzdq.exe
  C:\Windows\System\XkyUzdq.exe
  2⤵
  PID:8464
- C:\Windows\System\wgsCktw.exe
  C:\Windows\System\wgsCktw.exe
  2⤵
  PID:9488
- C:\Windows\System\ITVwIjz.exe
  C:\Windows\System\ITVwIjz.exe
  2⤵
  PID:9160
- C:\Windows\System\unponWM.exe
  C:\Windows\System\unponWM.exe
  2⤵
  PID:9532
- C:\Windows\System\ZhUdrfu.exe
  C:\Windows\System\ZhUdrfu.exe
  2⤵
  PID:9644
- C:\Windows\System\BpGoDEi.exe
  C:\Windows\System\BpGoDEi.exe
  2⤵
  PID:9656
- C:\Windows\System\ALYSEgh.exe
  C:\Windows\System\ALYSEgh.exe
  2⤵
  PID:9704
- C:\Windows\System\IbEnmyh.exe
  C:\Windows\System\IbEnmyh.exe
  2⤵
  PID:9680
- C:\Windows\System\RKeAuqN.exe
  C:\Windows\System\RKeAuqN.exe
  2⤵
  PID:8816
- C:\Windows\System\eIalHoH.exe
  C:\Windows\System\eIalHoH.exe
  2⤵
  PID:9688
- C:\Windows\System\OFbJmhe.exe
  C:\Windows\System\OFbJmhe.exe
  2⤵
  PID:9720
- C:\Windows\System\czsawCP.exe
  C:\Windows\System\czsawCP.exe
  2⤵
  PID:9244
- C:\Windows\System\LNBgYZi.exe
  C:\Windows\System\LNBgYZi.exe
  2⤵
  PID:9996
- C:\Windows\System\mJRUCcP.exe
  C:\Windows\System\mJRUCcP.exe
  2⤵
  PID:9880
- C:\Windows\System\YECIhNo.exe
  C:\Windows\System\YECIhNo.exe
  2⤵
  PID:10020
- C:\Windows\System\CbmHYhW.exe
  C:\Windows\System\CbmHYhW.exe
  2⤵
  PID:10060
- C:\Windows\System\gCrxCZH.exe
  C:\Windows\System\gCrxCZH.exe
  2⤵
  PID:9976
- C:\Windows\System\khCLseu.exe
  C:\Windows\System\khCLseu.exe
  2⤵
  PID:9792
- C:\Windows\System\NqAWjlU.exe
  C:\Windows\System\NqAWjlU.exe
  2⤵
  PID:10028
- C:\Windows\System\aTGNaxb.exe
  C:\Windows\System\aTGNaxb.exe
  2⤵
  PID:9940
- C:\Windows\System\zDCTsfs.exe
  C:\Windows\System\zDCTsfs.exe
  2⤵
  PID:8624
- C:\Windows\System\FyQCmHA.exe
  C:\Windows\System\FyQCmHA.exe
  2⤵
  PID:9876
- C:\Windows\System\xRPFaTv.exe
  C:\Windows\System\xRPFaTv.exe
  2⤵
  PID:10208
- C:\Windows\System\eAdfzCB.exe
  C:\Windows\System\eAdfzCB.exe
  2⤵
  PID:8668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AHOahIQ.exe

Filesize
2.2MB

MD5
c8206c4061c6122e9fc8f1c53727a29d

SHA1
688aadb2901b67333d2c752baa901993c1a7a117

SHA256
34c999f9155e9a9463c93d77d1a0eed1bf50fd335121fb3e498c47d1a6ea6135

SHA512
ffce09dc1f0e38fe249f0ce11a7bd2140c734629c68426fa2ae9a1b607a5d9ae4a9f3b536f9af23ab2edffcabc34eab15c6154b7911243e8e54585cf5e3ff743

Download Submit
C:\Windows\system\AQDXxrc.exe

Filesize
2.2MB

MD5
e439c5be143bb8ddb7375377ec76a4ef

SHA1
dca20eae10cc7549b74d0a8a30594e5e9bdde6bc

SHA256
84926db2e88aba99b940a3713946916796a3dcd48234b2444db685f8ec0732a8

SHA512
dff9a7c2629e425a4b60667a282c55fa9442106246eb720f92af35769bca3da1fbf513a179673e85d6b8ce544299d799d64ad9176ee288c3a2ad9adf9afd4960

Download Submit
C:\Windows\system\BYsCtUj.exe

Filesize
2.2MB

MD5
ef914f98052e55d5baf728d383659240

SHA1
6510003dd647abc7c196093478646591f7bf2016

SHA256
cd56d3457f9587f17548161825f9dbe79cef73af08ad2dce8ab73a8db91a1ca4

SHA512
42051cbe024880d52ebad5c1253e27c3b4f18a1ea4939fd1da29806369102148718b6ec3cfd5cea8bb6633ccf20f31c25f49db13af3dc55263b1824d2f204641

Download Submit
C:\Windows\system\BmAGVlz.exe

Filesize
2.2MB

MD5
1dd326c58ebbfaaf4005bad8983ca113

SHA1
028aa190a7bc11e1d336a7f371bd98975b96d9b8

SHA256
6d849a907c7de60ec9ca6c61e02b312be4e147b73e9583af5772ab912188ca18

SHA512
ab990baaa94160ad5a718bec5c9a60a573e50b5be203d24ed3ecc476f6a26af5a126053caa452bfef36784cfea6b7ab19817dc758309150edc1d2ca834658d24

Download Submit
C:\Windows\system\BmnMBBe.exe

Filesize
2.2MB

MD5
f862f51696d0c3ad0341fd6310855203

SHA1
51dbfd4428a24854cc0127ae8019223f05356bef

SHA256
4be45392f673eeb91f9efd8b48c820c5db706fa59ad4c23251c65d3ceadac86c

SHA512
93d06436184e46d44bec0648316d30bfaa4f2486c0b8946d90aa463d7b57ecd7efa90324c89400028676a7d667d606ecf63590c50197aeb0a057aaf0427c6599

Download Submit
C:\Windows\system\DdQusDP.exe

Filesize
2.2MB

MD5
97bd2f8c8d87300cf1fce93c84ede43f

SHA1
045dc8eee364eb52d299924bbe48dfe6075f420d

SHA256
717d0d07b8b48646f5554c96518e601105bb8001ca0bbbefe6a298cb52d288ba

SHA512
aee0789122fb8962e5330b89640f9ddc03d74f2db35d9ada76a6bb8d5fc685b2e033bf26d60c4062b7e951cef4eab6cf1416e9d05f30a605fd2adfca29236f8b

Download Submit
C:\Windows\system\GbIsvFK.exe

Filesize
2.2MB

MD5
96c72e07b41070e177faecc8d80dfdc0

SHA1
c1ab2f2e6f6bc19c503518244e0c29c8f0f9d033

SHA256
489b55ee77e773c4baf467fe9fb72382ce5bc909f301943636ecbbc87dd622c7

SHA512
70d127961a3f1c4670f40fd7e6e7a5d707313095131cfbfe192abfa7f42196ded03a1933603edad2aa6c68c981dde4b131e58a365645e0df272b46de49fce1b3

Download Submit
C:\Windows\system\IsAhxwX.exe

Filesize
2.2MB

MD5
a78d7bb6a0e7284bc4a6d3681ce71610

SHA1
09d839abc16d5cfc2eafbed61d495863a697fc7b

SHA256
43489eab11dbdd303ac6f9d966ce14eb548b247646864161ceedff9bf84098d7

SHA512
c7e012f9bd764e521a572b85891672e255728a410bbe9c103ee9af5750add1528cc9264ef6a4851b0c23e2396646e19f7de905980195fc28840d43f6f226408c

Download Submit
C:\Windows\system\KPOkepz.exe

Filesize
2.2MB

MD5
fd8260a378ce1e7049f370b6b7015d9a

SHA1
22a83af78abbae202a67c2b0506d1f2bc1a5f1ca

SHA256
8da5e6cf5e56f5f75f9299aaa8dcd4a4bd2633ed71dfd6de6d2d5e630b57658d

SHA512
dc21a3278802832d7e992323c739681970473d26e0f3f08365db08bc4a9f961f7ddfe350b606be8b9a348488ae59495f9edd50b97b787246365025702de14a41

Download Submit
C:\Windows\system\LZxRlYe.exe

Filesize
2.2MB

MD5
446a9a97863b4b7eacc135ab8081d4fb

SHA1
7ec84a4026302dabc1d3dcd68f89214ce225bd9a

SHA256
7254bcdb4b02fe0f6cc5fc66ffc4573c5408aecd6875d58b858b52e54b28053e

SHA512
90d8f91958b39ee84f405f21dc8a180ecc3afa8812980192db959953fa76c7b7342850d05dd8fd6be7aac7591384edf40e3ab4f1170ce8ae0593f3868a5254d6

Download Submit
C:\Windows\system\NFvfIsN.exe

Filesize
2.2MB

MD5
c793c7868f719a1278bd0130c8603132

SHA1
7b14c2b7a5952440dc6612924cba9ed2e551a987

SHA256
273712234ab22c3d872039913a66a48523c2cae5e6fa8b448bd37a6ffec9c824

SHA512
195a2478d8aadccde8d19742f57636c5933b3d483cb804bcb50d5e03fec00e818f58e6621153c3e68f9ee18c04cdb71716d2ddd118a1b02fa705ac1a5711cbbd

Download Submit
C:\Windows\system\NxZaXgg.exe

Filesize
2.2MB

MD5
d22c1e489f65b0b3c4b0ec15f8b04122

SHA1
7f36df0451bbf43dfa17d48ca0ed78646995de01

SHA256
09ea41ca7f8deb93355e921b520f43b4a83079bdfc39cee6cd4c09d7a4b1d851

SHA512
71dd832ce5549893f6a85a72786dd28379912a707926a312e3dd22219ccbc66ec7f03514ca0d25e6377519c41f6321465c8943d35acbb6cfa44e8aa51a37f06c

Download Submit
C:\Windows\system\OuIoOrm.exe

Filesize
2.2MB

MD5
2c1d553d0ac73f5971f34f9df6b070aa

SHA1
59c860d770b95f8e9c4e44113254b7d98ce0f086

SHA256
8e3908f5f83b6bcf4bf0da2369117b31b91f50a1c3fbfe96f6f7f6df0af80766

SHA512
e4e239604612198a21cc8a7ee25d6a32141939f3c1cd4fe7aab8190374685c9cd981b97db99478f87bc0a1ce3014ee3851a4d0656309a6c15b158055a7750be9

Download Submit
C:\Windows\system\UYqHvgn.exe

Filesize
2.2MB

MD5
7824aba870f32b142ac87b938766c5a4

SHA1
7d9d6c3107cca4144e459f8932a50a74302bedf2

SHA256
6f3e36ff6b89688450e3561dcbc3db430a468483590399183275dc69308b653a

SHA512
792c225d9f99647f7fd17cfa93a83a874250d40af505e1ca028bcfd55f4b3d216fb6db2b73c37559250ae416030b210bc5fe3ec31dd086ba469f87dcb148f77a

Download Submit
C:\Windows\system\VRreCqb.exe

Filesize
2.2MB

MD5
fc13c7dbcb2aafe27ef6fe4e97c4f2dd

SHA1
e386b94f873f7c5f334af6a27ac676147796ead9

SHA256
915d59b1632879425b82c95002ef096f7599363c71320a673a9dc705f8bc7a86

SHA512
10e46a6299dd9d3ea151a630126f3381c704d2888535fa5018df8652508dfe0ae6635d0345d6d7ec652ee6fed987a148edd19ad4a38be200dee13abca3f5802a

Download Submit
C:\Windows\system\VmFnmKQ.exe

Filesize
2.2MB

MD5
5822cbc17de3e8e8c1e7e56520a70c64

SHA1
4f19ba810d1ddc82ac2f439935652fc08cf864f6

SHA256
d4747088d7852a9982d714ae45e2ba44e2e5e2d05ac8f078ec40444781408c81

SHA512
9995d17c8c85f053f61b240c34c89f94ff10ac0582a0e139a5a8b6bc7a05442c0994ffb2c5d6403b0186f7370f7a9b3cd59b35aa3b6090ea48668e3a4e59e394

Download Submit
C:\Windows\system\XNDCncj.exe

Filesize
2.2MB

MD5
87a08e26aeeaa0885ecc70a689310ddf

SHA1
21b2faf1002394b95702cf9f266a0abeb0599fcd

SHA256
95a55062295b47a9dbcfa9ced8a20d9c46045f1756e7f0580143ecf7ed29831b

SHA512
e4fcbe947a18144f6b494ef86f4d62de3a8d42942c9fa32d8ea03ccc04ed8badd83e98a16835c934098e029d255910714051159a7c3873b5fe4932c6fd0850db

Download Submit
C:\Windows\system\aTOsJmR.exe

Filesize
2.2MB

MD5
d091d4dfdf01558524f5fc1aff9be0dc

SHA1
540f5671b6a4ad3fbdeaabe5a5279f79ce6a4fad

SHA256
889e877fe8d41559900920f3150b409ab8ad87c848a43dc0f6e9137c21459750

SHA512
e5dc7400a3a32ecf1b9a3d781fd5f70ff7f3814a47e86db1df0ab190e7bf812006e13d2f9f4d31caf4450451999b81f4c1754546cd551098d394b43d6155778d

Download Submit
C:\Windows\system\cTHyxfH.exe

Filesize
2.2MB

MD5
4c1bdf567e45381b9026dddcead367cb

SHA1
b3633226bb39a27649ed8ef41c2f86417301423f

SHA256
8a3cdaa759b641562817f99f8ee8abf65cba5d75906d3522e730ce38e44f5255

SHA512
3256eccfda94d155cf46673e602996173d498a4ab295625d82a51ce2252021f40d12e03f4ce2720ce212ee88137ab950ef03efe502023b5c7f0553c8733ff935

Download Submit
C:\Windows\system\eDEzrdQ.exe

Filesize
2.2MB

MD5
14d0ba9872b50bbb09e0c533e6dd884b

SHA1
c551a1978535154586ad7c390cc0a6448e0f678a

SHA256
9463fbecba2f29f2a8b0f35efba277cb96028b22233467edeb64209006d85a78

SHA512
b8a7a1573a9a19a54c0830acbdf7bf63fdb21bf046568075bfde829706a956fa1a29a695bf89ee8a0895aa8dcb040f9c75db65cc151a8d4797a140d19af96e06

Download Submit
C:\Windows\system\hxhlImy.exe

Filesize
2.2MB

MD5
5e845bbc62d8277d41575bbb17c30200

SHA1
8017fa0282d2bfe7618ebe3034309d722c48b18c

SHA256
d463ba397f3ce363b99539101f31953f4ae0506fdcaa0995ba220570215d04d0

SHA512
bf1e505042373d5cfa7c194cf665ff350d0a171f6df6eed53202b38cc1522ee2fc49d300383571f515e79109b9d5f83078525b36b2cec1f75b3c8a2a5ff2b20a

Download Submit
C:\Windows\system\kfRLhTj.exe

Filesize
2.2MB

MD5
88edefce052cce3e325c5061df7e1c09

SHA1
43558d50d878ea9e349733401bba5a1c0390a7fc

SHA256
8470113660ad63ffdd3e4151493a3e86b9b02db919018b2931f9f5cd08e8a6f4

SHA512
228885d6baeb39ab9e3ae0222a4f9c2f8e87962d379d55d7aaa454f712a424ad4692f34019973f4a6b776dab693f207b675b81de6ad9c9496844fe7aac9f13bc

Download Submit
C:\Windows\system\kmiLEzH.exe

Filesize
2.2MB

MD5
44c758a23fa206468d9b3e6a9e968dc5

SHA1
151815d4ff06296bfce4fc019ea3fcf32c9dbc10

SHA256
c6403b9ecc28a6d1980c97c9129d494be70cf1cae17669b42550fd6d2c33824f

SHA512
3055e8ad70d4b7aaa8e1f53a1e198d7bcc6514afb185b3bc55e63c398f449374ad1bee782a1c0ddc9d4ba5c2396bffd9cd9512f73a45dbc993578708ef763ef3

Download Submit
C:\Windows\system\mNhMpsn.exe

Filesize
2.2MB

MD5
a6ef531d190ed5a2bd04ee64be69994b

SHA1
47d2dec89770e96b2a71a974c90f4c69ada0c3b6

SHA256
0277ccd33eef1fd84816c0a668d7cdd8cc3ecabb5150c0c5a9cb8502053f4b5f

SHA512
7cba2de981ab51e207be9eeab435ee7231dff327605e67a8efb1f8ec044fc3d10554e1df2d60f02eb651bc8e11effaaee45782bfebd29ca31475ea8443b5a6b3

Download Submit
C:\Windows\system\rEMQXUo.exe

Filesize
2.2MB

MD5
196d75ddae67314f0609fca743b2167a

SHA1
b54f9fb1d3db3ba7bac6f4df95910a3072ebd952

SHA256
4348bb4cbbb15285076945c71615fcd006429bd7e24f5b51bf12dc9c6832156c

SHA512
ecea198f601b196698a534977fb35d890282f350207c5ae9a9c6f82e919f99527b0879a96fa763051211813ac2098c9e1685503fbe34021903d97baf8dde6478

Download Submit
C:\Windows\system\rHUFUqA.exe

Filesize
2.2MB

MD5
00fc6bd63144763b0b6dd0203fee492f

SHA1
9d75721ea8a40a3b7afc29da3c4ff8c636af99a3

SHA256
ccd56aeb8f0650924a03eaea3d0e66bb307158bae1c6d43d017a56b76d2116a2

SHA512
12964ed6c26da4ffee289e979c87d0b58b7c666d57cf3fef956b3a9010d01e20327f34104bdd4107747a769649f78b3c1b1014063821d70cfb3569ebbd4391fd

Download Submit
C:\Windows\system\vneDNPX.exe

Filesize
2.2MB

MD5
3921556b6fafda1d9e438e9cc0e3dcfd

SHA1
e1b84d438b8273cc05b99cecff43136dff44ea83

SHA256
c23c1c808cd018ae42b4b3f9b68dac8af741fefb593fb99826c7d6da7215baf4

SHA512
6b6a83b0d416700ee12e4e258980a37a3636efaac7bb85f2b3fe8c4e341a322c82aef53bc329828d2fbb83714ccacd235e270bee9c20dd1caa75b2f8b525a06d

Download Submit
C:\Windows\system\vsrlmSO.exe

Filesize
2.2MB

MD5
338d04255c04e112fd629f3767e2a12b

SHA1
67a67321a67377541f0a046edbf9da026e4921b6

SHA256
538b707c266f581cc8edb7c7a75d3b3d8c9ea6040d59e278465a9a45affe4e3a

SHA512
0e1e40dc9eff2296fb09cdde01b72adf5a064699be45a89d99ab2c4886cdcd15013d41c51ab456206e00e63e687985b98c80dab7cc37a85b9bcb63f9253df901

Download Submit
\Windows\system\KbPVWQf.exe

Filesize
2.2MB

MD5
307f08ff01331b8b1a99cc43472c8508

SHA1
f0dd0e3337cbf17fad212d569638b7e45abc73ca

SHA256
48e822926e643a5af2662aad02e4e7593b2913163cbd1c04cde785a6f61d7958

SHA512
938461386bda15d4c0583dbe1ccea3bbf4e5420e91ccf6075d4b3d507ea180a53f65edcc4d52f9a7072d1855ffb9f07ffb0cfcf7b45aeda6a6249f867c8326e0

Download Submit
\Windows\system\MDLQRUg.exe

Filesize
2.2MB

MD5
eb4d2340edd818a5383a95886d285ce7

SHA1
e361e47ef27879dcd8d5c89b35b23af1d5f96a1f

SHA256
513def927c82aff01b2aafb0391aad2edcf12334b6beb40ab6255f2eca36a82f

SHA512
4a3b08a11328d80f5644ac8b1f6c799108738588573e878bc3e3d8fd664b7ab4c76a9b5d720d40a7345538be89f08778451d0d87c4dee777fa3666a0be060d45

Download Submit
\Windows\system\VoFcxQA.exe

Filesize
2.2MB

MD5
27474b83aef1ca97685c9c72616b6e21

SHA1
01d2bdd17b5f2fdbb20b9e6df362cdbfc36205e3

SHA256
2b575a6eb497620ecdfd59f95a50659b27f9bfa006f6a087bf1a96e6d402127a

SHA512
7d8e71c6456bbbbadfacbed895b15215ce26b9b71302333793c0f3d0bc2a0b4fce2e0ca9e7a88ba441b77b5ed834eca8386b9fea6713b95d536bf6a57e568cb7

Download Submit
\Windows\system\rcGStNT.exe

Filesize
2.2MB

MD5
e97323cddac22c817e126fc64e6b823d

SHA1
56c16c197836c39795d959a334a4e3335529ea3c

SHA256
5f559892c5ecab9ed44203483cbb7975a7c67f6f718499ad3d9eef5f45484c37

SHA512
55fc5de4c5670189d3bab3273962208448a2bcdab2f4b07d9d2a2ffc7bbf581eb57b4dd997e0f38d58faa2784d593695f7c0dde86b78f54a5f409033dd7b49ca

Download Submit
memory/1428-1585-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/1428-13-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/1796-99-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/1796-95-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/1804-75-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/1896-21-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2152-71-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2296-92-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2296-7-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/2296-1577-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2296-101-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2296-100-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2296-1-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2296-28-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/2296-93-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/2296-58-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/2296-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2296-67-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2296-62-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/2296-17-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2388-104-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2516-103-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2560-102-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2616-91-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download