xmrig | ed0a64e11ec3d1110efca4867159a62be50397a2743417b0d32273df098a98aa

Analysis

max time kernel
26s
max time network
28s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
Size

2.3MB
MD5

0a34efed2268834c226b00adb5c0613c
SHA1

ab7361df0f9ebe1caeadda8eec52f3e280ae8358
SHA256

ed0a64e11ec3d1110efca4867159a62be50397a2743417b0d32273df098a98aa
SHA512

e131d94af7e5b0372650683b7f98c9beb60457c3ddc8e2a48bf44a0ade4ef1e97185bd14d9e68757288611f12b17a9d05f5d6f00c63341baa86656256366aa70
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqxpP:NABq

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/3036-12-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/2680-35-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/960-141-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2720-146-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/1104-143-0x000000013FA40000-0x000000013FE32000-memory.dmp	xmrig
behavioral1/memory/2464-140-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig
behavioral1/memory/2608-136-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2476-134-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig
behavioral1/memory/2344-15-0x000000013FD60000-0x0000000140152000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3036	rOMHKIY.exe
2344	aJXHBrr.exe
2680	kXddITm.exe
2476	kdeNwaC.exe
2720	BWtrGRY.exe
2608	AGiieEF.exe
2464	ZUEVNoQ.exe
960	RoMVcnS.exe
1104	AxqXYMW.exe
2868	baRKJQM.exe
964	GSzzVqk.exe
1320	kvbKAEt.exe
2812	ynVHbuK.exe
2840	FIYvCkc.exe
2528	fpvcQXp.exe
2972	dovqMoN.exe
1572	HJmJAPw.exe
1796	wXsfbPu.exe
2980	ZxdWxlc.exe
324	nKaRWOm.exe
2508	IHdXqYt.exe
1752	CQXwjoB.exe
2560	XeieMob.exe
1856	lqCEQKp.exe
620	EzsdWLY.exe
824	DgjRGre.exe
1392	oEhcvlI.exe
2120	fElHwtH.exe
572	CPBwejj.exe
452	oeBqWVr.exe
2052	AZTEPsn.exe
1580	JQFNzGn.exe
920	ovmXQrN.exe
1808	VvpcVYR.exe
1516	YtAcFBd.exe
1164	oAXoBHY.exe
2996	xZVdcUp.exe
1184	gMnzVyQ.exe
968	fhTKEWc.exe
2236	nFNLvyq.exe
2408	oLnoJGj.exe
2920	qOOlDbF.exe
2200	LIhuBnK.exe
2108	qaXJEbx.exe
1784	MYmXqOn.exe
2420	UYUTlNl.exe
2084	PxindSE.exe
2208	RGMTaiT.exe
1632	DgYiXsX.exe
2556	wLfaSSZ.exe
2596	XqnuljT.exe
2356	afSeNSs.exe
1624	aznsjXf.exe
2672	AdzPcwp.exe
2792	WRZVbUx.exe
2456	iJyJthx.exe
1556	JCAcPUz.exe
1456	vtFjeEn.exe
1720	GDqqKwr.exe
1316	NlQExWD.exe
604	Yeoyeuo.exe
2204	tEHrZfs.exe
2856	ZDycHze.exe
2132	legOXIY.exe

Loads dropped DLL 64 IoCs

pid	Process
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2956-0-0x000000013F690000-0x000000013FA82000-memory.dmp	upx
behavioral1/files/0x000a000000014120-6.dat	upx
behavioral1/files/0x00090000000143ec-7.dat	upx
behavioral1/files/0x0008000000014539-9.dat	upx
behavioral1/files/0x0007000000014667-25.dat	upx
behavioral1/memory/3036-12-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/files/0x000f000000005578-36.dat	upx
behavioral1/files/0x00090000000146b8-39.dat	upx
behavioral1/memory/2680-35-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/files/0x00070000000149f5-62.dat	upx
behavioral1/files/0x0006000000014b70-70.dat	upx
behavioral1/files/0x0006000000015616-103.dat	upx
behavioral1/files/0x0006000000015c52-122.dat	upx
behavioral1/files/0x0006000000015c78-131.dat	upx
behavioral1/memory/960-141-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/files/0x0006000000015626-169.dat	upx
behavioral1/files/0x0006000000015605-162.dat	upx
behavioral1/files/0x00060000000155f3-160.dat	upx
behavioral1/files/0x0006000000015018-158.dat	upx
behavioral1/files/0x0006000000014de9-156.dat	upx
behavioral1/files/0x000900000001448a-151.dat	upx
behavioral1/files/0x0006000000014b31-130.dat	upx
behavioral1/files/0x0006000000015c6b-125.dat	upx
behavioral1/files/0x0006000000015b6f-117.dat	upx
behavioral1/files/0x0006000000015c3d-116.dat	upx
behavioral1/files/0x0007000000014abe-112.dat	upx
behavioral1/files/0x0006000000015cb6-184.dat	upx
behavioral1/files/0x0006000000014ef8-81.dat	upx
behavioral1/files/0x0007000000014af6-65.dat	upx
behavioral1/files/0x0006000000015c83-166.dat	upx
behavioral1/files/0x0009000000014825-48.dat	upx
behavioral1/memory/2720-146-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/1104-143-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/memory/2464-140-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/memory/2608-136-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/memory/2476-134-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/files/0x00060000000155f7-96.dat	upx
behavioral1/files/0x00060000000155ed-88.dat	upx
behavioral1/files/0x0006000000015cee-190.dat	upx
behavioral1/files/0x0006000000015c9f-180.dat	upx
behavioral1/files/0x0006000000015cce-187.dat	upx
behavioral1/files/0x00080000000146c0-61.dat	upx
behavioral1/memory/2344-15-0x000000013FD60000-0x0000000140152000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wVcyuPY.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\TVMSFEs.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\KSNofPA.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\mmmYshy.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\uVquBvJ.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\dNRETBc.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\PmpvTon.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\RtimiIb.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\uJwraeU.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\cHlPmrY.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\AdzPcwp.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\vNANuor.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\OJLMIrH.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\pmZYNOh.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\yKSccnb.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\JbUNVMs.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\jNMjPwK.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\xcHKugl.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\KCUncQo.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\ASfWGQR.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\BjOQdQw.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\qtAPVup.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\ZYxODRm.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\NrBylNT.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\ivyDyqk.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\wKOGmzo.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\CImyOYf.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\mkdSyCb.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\dbvnQLP.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\MSVGqIr.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\nyuEiQi.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\iJyJthx.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\ywOWtQA.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\dmtpLhq.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\gUtKFDS.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\WLAyTQE.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\DZVrOvf.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\nFNLvyq.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\xhPEluy.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\KLMMMHX.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\QTBvUTm.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\yKTwWhE.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\BGrvPtB.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\lBBqagB.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\ZxdWxlc.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\RAqcZjW.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\rabbrIA.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\zNmQlLt.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\fSAZkcd.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\WSHXYQX.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\BcxHjfm.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\TSpdTBY.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\GSzzVqk.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\RpPagVS.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\wxSdpYp.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\IBZzUxf.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\MdoWwag.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\YMmqFQb.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\ElAohKN.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\lsJWIEJ.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\tKnXDWZ.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\OgmfImc.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\woeNiSb.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
File created	C:\Windows\System\vdGAWpb.exe	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2240	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
Token: SeDebugPrivilege	2240	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2240	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	29
PID 2956 wrote to memory of 2240	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	29
PID 2956 wrote to memory of 2240	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	29
PID 2956 wrote to memory of 3036	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	30
PID 2956 wrote to memory of 3036	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	30
PID 2956 wrote to memory of 3036	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	30
PID 2956 wrote to memory of 2344	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	31
PID 2956 wrote to memory of 2344	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	31
PID 2956 wrote to memory of 2344	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	31
PID 2956 wrote to memory of 2680	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	32
PID 2956 wrote to memory of 2680	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	32
PID 2956 wrote to memory of 2680	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	32
PID 2956 wrote to memory of 2476	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	33
PID 2956 wrote to memory of 2476	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	33
PID 2956 wrote to memory of 2476	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	33
PID 2956 wrote to memory of 2720	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	34
PID 2956 wrote to memory of 2720	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	34
PID 2956 wrote to memory of 2720	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	34
PID 2956 wrote to memory of 2608	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	35
PID 2956 wrote to memory of 2608	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	35
PID 2956 wrote to memory of 2608	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	35
PID 2956 wrote to memory of 2464	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	36
PID 2956 wrote to memory of 2464	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	36
PID 2956 wrote to memory of 2464	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	36
PID 2956 wrote to memory of 2528	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	37
PID 2956 wrote to memory of 2528	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	37
PID 2956 wrote to memory of 2528	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	37
PID 2956 wrote to memory of 960	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	38
PID 2956 wrote to memory of 960	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	38
PID 2956 wrote to memory of 960	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	38
PID 2956 wrote to memory of 2972	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	39
PID 2956 wrote to memory of 2972	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	39
PID 2956 wrote to memory of 2972	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	39
PID 2956 wrote to memory of 1104	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	40
PID 2956 wrote to memory of 1104	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	40
PID 2956 wrote to memory of 1104	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	40
PID 2956 wrote to memory of 2980	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	41
PID 2956 wrote to memory of 2980	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	41
PID 2956 wrote to memory of 2980	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	41
PID 2956 wrote to memory of 2868	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	42
PID 2956 wrote to memory of 2868	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	42
PID 2956 wrote to memory of 2868	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	42
PID 2956 wrote to memory of 2508	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	43
PID 2956 wrote to memory of 2508	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	43
PID 2956 wrote to memory of 2508	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	43
PID 2956 wrote to memory of 964	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	44
PID 2956 wrote to memory of 964	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	44
PID 2956 wrote to memory of 964	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	44
PID 2956 wrote to memory of 1752	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	45
PID 2956 wrote to memory of 1752	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	45
PID 2956 wrote to memory of 1752	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	45
PID 2956 wrote to memory of 1320	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	46
PID 2956 wrote to memory of 1320	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	46
PID 2956 wrote to memory of 1320	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	46
PID 2956 wrote to memory of 2560	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	47
PID 2956 wrote to memory of 2560	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	47
PID 2956 wrote to memory of 2560	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	47
PID 2956 wrote to memory of 2812	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	48
PID 2956 wrote to memory of 2812	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	48
PID 2956 wrote to memory of 2812	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	48
PID 2956 wrote to memory of 1856	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	49
PID 2956 wrote to memory of 1856	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	49
PID 2956 wrote to memory of 1856	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	49
PID 2956 wrote to memory of 2840	2956	0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a34efed2268834c226b00adb5c0613c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2240
- C:\Windows\System\rOMHKIY.exe
  C:\Windows\System\rOMHKIY.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\aJXHBrr.exe
  C:\Windows\System\aJXHBrr.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\kXddITm.exe
  C:\Windows\System\kXddITm.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\kdeNwaC.exe
  C:\Windows\System\kdeNwaC.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\BWtrGRY.exe
  C:\Windows\System\BWtrGRY.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\AGiieEF.exe
  C:\Windows\System\AGiieEF.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\ZUEVNoQ.exe
  C:\Windows\System\ZUEVNoQ.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\fpvcQXp.exe
  C:\Windows\System\fpvcQXp.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\RoMVcnS.exe
  C:\Windows\System\RoMVcnS.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\dovqMoN.exe
  C:\Windows\System\dovqMoN.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\AxqXYMW.exe
  C:\Windows\System\AxqXYMW.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\ZxdWxlc.exe
  C:\Windows\System\ZxdWxlc.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\baRKJQM.exe
  C:\Windows\System\baRKJQM.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\IHdXqYt.exe
  C:\Windows\System\IHdXqYt.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\GSzzVqk.exe
  C:\Windows\System\GSzzVqk.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\CQXwjoB.exe
  C:\Windows\System\CQXwjoB.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\kvbKAEt.exe
  C:\Windows\System\kvbKAEt.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\XeieMob.exe
  C:\Windows\System\XeieMob.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\ynVHbuK.exe
  C:\Windows\System\ynVHbuK.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\lqCEQKp.exe
  C:\Windows\System\lqCEQKp.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\FIYvCkc.exe
  C:\Windows\System\FIYvCkc.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\DgjRGre.exe
  C:\Windows\System\DgjRGre.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\HJmJAPw.exe
  C:\Windows\System\HJmJAPw.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\oEhcvlI.exe
  C:\Windows\System\oEhcvlI.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\wXsfbPu.exe
  C:\Windows\System\wXsfbPu.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\fElHwtH.exe
  C:\Windows\System\fElHwtH.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\nKaRWOm.exe
  C:\Windows\System\nKaRWOm.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\CPBwejj.exe
  C:\Windows\System\CPBwejj.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\EzsdWLY.exe
  C:\Windows\System\EzsdWLY.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\oeBqWVr.exe
  C:\Windows\System\oeBqWVr.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\AZTEPsn.exe
  C:\Windows\System\AZTEPsn.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\YtAcFBd.exe
  C:\Windows\System\YtAcFBd.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\JQFNzGn.exe
  C:\Windows\System\JQFNzGn.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\oAXoBHY.exe
  C:\Windows\System\oAXoBHY.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\ovmXQrN.exe
  C:\Windows\System\ovmXQrN.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\xZVdcUp.exe
  C:\Windows\System\xZVdcUp.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\VvpcVYR.exe
  C:\Windows\System\VvpcVYR.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\gMnzVyQ.exe
  C:\Windows\System\gMnzVyQ.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\fhTKEWc.exe
  C:\Windows\System\fhTKEWc.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\nFNLvyq.exe
  C:\Windows\System\nFNLvyq.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\oLnoJGj.exe
  C:\Windows\System\oLnoJGj.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\LIhuBnK.exe
  C:\Windows\System\LIhuBnK.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\qOOlDbF.exe
  C:\Windows\System\qOOlDbF.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\qaXJEbx.exe
  C:\Windows\System\qaXJEbx.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\MYmXqOn.exe
  C:\Windows\System\MYmXqOn.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\UYUTlNl.exe
  C:\Windows\System\UYUTlNl.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\PxindSE.exe
  C:\Windows\System\PxindSE.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\RGMTaiT.exe
  C:\Windows\System\RGMTaiT.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\DgYiXsX.exe
  C:\Windows\System\DgYiXsX.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\aznsjXf.exe
  C:\Windows\System\aznsjXf.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\wLfaSSZ.exe
  C:\Windows\System\wLfaSSZ.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\AdzPcwp.exe
  C:\Windows\System\AdzPcwp.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\XqnuljT.exe
  C:\Windows\System\XqnuljT.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\WRZVbUx.exe
  C:\Windows\System\WRZVbUx.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\afSeNSs.exe
  C:\Windows\System\afSeNSs.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\tEHrZfs.exe
  C:\Windows\System\tEHrZfs.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\iJyJthx.exe
  C:\Windows\System\iJyJthx.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\ZDycHze.exe
  C:\Windows\System\ZDycHze.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\JCAcPUz.exe
  C:\Windows\System\JCAcPUz.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\BjurhAD.exe
  C:\Windows\System\BjurhAD.exe
  2⤵
  PID:2364
- C:\Windows\System\vtFjeEn.exe
  C:\Windows\System\vtFjeEn.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\BnZXfnz.exe
  C:\Windows\System\BnZXfnz.exe
  2⤵
  PID:2548
- C:\Windows\System\GDqqKwr.exe
  C:\Windows\System\GDqqKwr.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\cfFxPfm.exe
  C:\Windows\System\cfFxPfm.exe
  2⤵
  PID:1848
- C:\Windows\System\NlQExWD.exe
  C:\Windows\System\NlQExWD.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\OCBTRqA.exe
  C:\Windows\System\OCBTRqA.exe
  2⤵
  PID:904
- C:\Windows\System\Yeoyeuo.exe
  C:\Windows\System\Yeoyeuo.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\AHantgZ.exe
  C:\Windows\System\AHantgZ.exe
  2⤵
  PID:1212
- C:\Windows\System\legOXIY.exe
  C:\Windows\System\legOXIY.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\hhjOdbo.exe
  C:\Windows\System\hhjOdbo.exe
  2⤵
  PID:2500
- C:\Windows\System\OfXSvKY.exe
  C:\Windows\System\OfXSvKY.exe
  2⤵
  PID:992
- C:\Windows\System\NemlLdA.exe
  C:\Windows\System\NemlLdA.exe
  2⤵
  PID:2800
- C:\Windows\System\OxxdLTV.exe
  C:\Windows\System\OxxdLTV.exe
  2⤵
  PID:768
- C:\Windows\System\aDpEyiT.exe
  C:\Windows\System\aDpEyiT.exe
  2⤵
  PID:2936
- C:\Windows\System\soprcLf.exe
  C:\Windows\System\soprcLf.exe
  2⤵
  PID:1460
- C:\Windows\System\swOleXr.exe
  C:\Windows\System\swOleXr.exe
  2⤵
  PID:1704
- C:\Windows\System\pdDXrii.exe
  C:\Windows\System\pdDXrii.exe
  2⤵
  PID:1500
- C:\Windows\System\PQrGpQv.exe
  C:\Windows\System\PQrGpQv.exe
  2⤵
  PID:1864
- C:\Windows\System\sBhOtEK.exe
  C:\Windows\System\sBhOtEK.exe
  2⤵
  PID:776
- C:\Windows\System\aPUdhci.exe
  C:\Windows\System\aPUdhci.exe
  2⤵
  PID:792
- C:\Windows\System\VxJVhdN.exe
  C:\Windows\System\VxJVhdN.exe
  2⤵
  PID:1712
- C:\Windows\System\QeChbvd.exe
  C:\Windows\System\QeChbvd.exe
  2⤵
  PID:2280
- C:\Windows\System\FncATTR.exe
  C:\Windows\System\FncATTR.exe
  2⤵
  PID:2816
- C:\Windows\System\SxHOdRE.exe
  C:\Windows\System\SxHOdRE.exe
  2⤵
  PID:2000
- C:\Windows\System\NLbbTZz.exe
  C:\Windows\System\NLbbTZz.exe
  2⤵
  PID:2676
- C:\Windows\System\myobvxT.exe
  C:\Windows\System\myobvxT.exe
  2⤵
  PID:2748
- C:\Windows\System\kAtZoZK.exe
  C:\Windows\System\kAtZoZK.exe
  2⤵
  PID:2232
- C:\Windows\System\DZVrOvf.exe
  C:\Windows\System\DZVrOvf.exe
  2⤵
  PID:2660
- C:\Windows\System\holPtgY.exe
  C:\Windows\System\holPtgY.exe
  2⤵
  PID:1840
- C:\Windows\System\CcnhLLq.exe
  C:\Windows\System\CcnhLLq.exe
  2⤵
  PID:2164
- C:\Windows\System\hxENLOg.exe
  C:\Windows\System\hxENLOg.exe
  2⤵
  PID:2872
- C:\Windows\System\gCGfaNZ.exe
  C:\Windows\System\gCGfaNZ.exe
  2⤵
  PID:1628
- C:\Windows\System\cyEcrZb.exe
  C:\Windows\System\cyEcrZb.exe
  2⤵
  PID:2700
- C:\Windows\System\HaDcIqI.exe
  C:\Windows\System\HaDcIqI.exe
  2⤵
  PID:2624
- C:\Windows\System\SLYVRWM.exe
  C:\Windows\System\SLYVRWM.exe
  2⤵
  PID:2104
- C:\Windows\System\QviPOcB.exe
  C:\Windows\System\QviPOcB.exe
  2⤵
  PID:2316
- C:\Windows\System\sDZQHVL.exe
  C:\Windows\System\sDZQHVL.exe
  2⤵
  PID:684
- C:\Windows\System\lGvMHMQ.exe
  C:\Windows\System\lGvMHMQ.exe
  2⤵
  PID:2328
- C:\Windows\System\cnTigvZ.exe
  C:\Windows\System\cnTigvZ.exe
  2⤵
  PID:1488
- C:\Windows\System\psKivuJ.exe
  C:\Windows\System\psKivuJ.exe
  2⤵
  PID:3052
- C:\Windows\System\Xbngbmy.exe
  C:\Windows\System\Xbngbmy.exe
  2⤵
  PID:804
- C:\Windows\System\VHmtyyk.exe
  C:\Windows\System\VHmtyyk.exe
  2⤵
  PID:2580
- C:\Windows\System\SOdHBqM.exe
  C:\Windows\System\SOdHBqM.exe
  2⤵
  PID:2520
- C:\Windows\System\dkaSzNr.exe
  C:\Windows\System\dkaSzNr.exe
  2⤵
  PID:2732
- C:\Windows\System\wGeojpd.exe
  C:\Windows\System\wGeojpd.exe
  2⤵
  PID:2988
- C:\Windows\System\vZjliBY.exe
  C:\Windows\System\vZjliBY.exe
  2⤵
  PID:336
- C:\Windows\System\BIhWXxq.exe
  C:\Windows\System\BIhWXxq.exe
  2⤵
  PID:1708
- C:\Windows\System\SqWpIjY.exe
  C:\Windows\System\SqWpIjY.exe
  2⤵
  PID:2300
- C:\Windows\System\vgJEmOg.exe
  C:\Windows\System\vgJEmOg.exe
  2⤵
  PID:576
- C:\Windows\System\VmpmzUv.exe
  C:\Windows\System\VmpmzUv.exe
  2⤵
  PID:1388
- C:\Windows\System\dNRETBc.exe
  C:\Windows\System\dNRETBc.exe
  2⤵
  PID:240
- C:\Windows\System\ggpuAGk.exe
  C:\Windows\System\ggpuAGk.exe
  2⤵
  PID:1092
- C:\Windows\System\AWvzpDJ.exe
  C:\Windows\System\AWvzpDJ.exe
  2⤵
  PID:624
- C:\Windows\System\pgAKwAY.exe
  C:\Windows\System\pgAKwAY.exe
  2⤵
  PID:3008
- C:\Windows\System\RYgqtkn.exe
  C:\Windows\System\RYgqtkn.exe
  2⤵
  PID:2620
- C:\Windows\System\odAUuXh.exe
  C:\Windows\System\odAUuXh.exe
  2⤵
  PID:1760
- C:\Windows\System\FXSndAj.exe
  C:\Windows\System\FXSndAj.exe
  2⤵
  PID:2612
- C:\Windows\System\STDldzz.exe
  C:\Windows\System\STDldzz.exe
  2⤵
  PID:1076
- C:\Windows\System\uMAPUPK.exe
  C:\Windows\System\uMAPUPK.exe
  2⤵
  PID:2028
- C:\Windows\System\thddCOJ.exe
  C:\Windows\System\thddCOJ.exe
  2⤵
  PID:2716
- C:\Windows\System\SgqZNVm.exe
  C:\Windows\System\SgqZNVm.exe
  2⤵
  PID:1188
- C:\Windows\System\nqrzdih.exe
  C:\Windows\System\nqrzdih.exe
  2⤵
  PID:2196
- C:\Windows\System\PIihQrd.exe
  C:\Windows\System\PIihQrd.exe
  2⤵
  PID:3076
- C:\Windows\System\abxhYRE.exe
  C:\Windows\System\abxhYRE.exe
  2⤵
  PID:3092
- C:\Windows\System\sUGSdMt.exe
  C:\Windows\System\sUGSdMt.exe
  2⤵
  PID:3248
- C:\Windows\System\eOvBwCE.exe
  C:\Windows\System\eOvBwCE.exe
  2⤵
  PID:3272
- C:\Windows\System\oJJNEWV.exe
  C:\Windows\System\oJJNEWV.exe
  2⤵
  PID:3288
- C:\Windows\System\fYrKsWG.exe
  C:\Windows\System\fYrKsWG.exe
  2⤵
  PID:3304
- C:\Windows\System\wjgNCiA.exe
  C:\Windows\System\wjgNCiA.exe
  2⤵
  PID:3320
- C:\Windows\System\hMCSMNP.exe
  C:\Windows\System\hMCSMNP.exe
  2⤵
  PID:3336
- C:\Windows\System\mTTBVke.exe
  C:\Windows\System\mTTBVke.exe
  2⤵
  PID:3352
- C:\Windows\System\YaDWBrb.exe
  C:\Windows\System\YaDWBrb.exe
  2⤵
  PID:3368
- C:\Windows\System\uhKDQHm.exe
  C:\Windows\System\uhKDQHm.exe
  2⤵
  PID:3384
- C:\Windows\System\CAymXYa.exe
  C:\Windows\System\CAymXYa.exe
  2⤵
  PID:3400
- C:\Windows\System\gWwsHlz.exe
  C:\Windows\System\gWwsHlz.exe
  2⤵
  PID:3416
- C:\Windows\System\gdYENug.exe
  C:\Windows\System\gdYENug.exe
  2⤵
  PID:3432
- C:\Windows\System\EKfyZab.exe
  C:\Windows\System\EKfyZab.exe
  2⤵
  PID:3448
- C:\Windows\System\prndzUu.exe
  C:\Windows\System\prndzUu.exe
  2⤵
  PID:3468
- C:\Windows\System\CxwaQBw.exe
  C:\Windows\System\CxwaQBw.exe
  2⤵
  PID:3484
- C:\Windows\System\eabRCux.exe
  C:\Windows\System\eabRCux.exe
  2⤵
  PID:3500
- C:\Windows\System\aiUKkUa.exe
  C:\Windows\System\aiUKkUa.exe
  2⤵
  PID:3516
- C:\Windows\System\qEeRGLV.exe
  C:\Windows\System\qEeRGLV.exe
  2⤵
  PID:3532
- C:\Windows\System\OQFprno.exe
  C:\Windows\System\OQFprno.exe
  2⤵
  PID:3548
- C:\Windows\System\blICbnn.exe
  C:\Windows\System\blICbnn.exe
  2⤵
  PID:3564
- C:\Windows\System\zWtUPQQ.exe
  C:\Windows\System\zWtUPQQ.exe
  2⤵
  PID:3580
- C:\Windows\System\oTRCzWk.exe
  C:\Windows\System\oTRCzWk.exe
  2⤵
  PID:3596
- C:\Windows\System\TlLgYDW.exe
  C:\Windows\System\TlLgYDW.exe
  2⤵
  PID:3616
- C:\Windows\System\LQWxASF.exe
  C:\Windows\System\LQWxASF.exe
  2⤵
  PID:3632
- C:\Windows\System\jrCSLzg.exe
  C:\Windows\System\jrCSLzg.exe
  2⤵
  PID:3728
- C:\Windows\System\ujOqWtq.exe
  C:\Windows\System\ujOqWtq.exe
  2⤵
  PID:3744
- C:\Windows\System\GPCKGwQ.exe
  C:\Windows\System\GPCKGwQ.exe
  2⤵
  PID:3760
- C:\Windows\System\wcRFwQr.exe
  C:\Windows\System\wcRFwQr.exe
  2⤵
  PID:3776
- C:\Windows\System\XZzTVPV.exe
  C:\Windows\System\XZzTVPV.exe
  2⤵
  PID:3792
- C:\Windows\System\MJPdJaK.exe
  C:\Windows\System\MJPdJaK.exe
  2⤵
  PID:3808
- C:\Windows\System\CrFcABT.exe
  C:\Windows\System\CrFcABT.exe
  2⤵
  PID:3824
- C:\Windows\System\PLUawEe.exe
  C:\Windows\System\PLUawEe.exe
  2⤵
  PID:3840
- C:\Windows\System\uHjvhzH.exe
  C:\Windows\System\uHjvhzH.exe
  2⤵
  PID:3856
- C:\Windows\System\CGnzQsI.exe
  C:\Windows\System\CGnzQsI.exe
  2⤵
  PID:3872
- C:\Windows\System\rVfbwZr.exe
  C:\Windows\System\rVfbwZr.exe
  2⤵
  PID:3888
- C:\Windows\System\uiTlzeJ.exe
  C:\Windows\System\uiTlzeJ.exe
  2⤵
  PID:3904
- C:\Windows\System\WuyjZtq.exe
  C:\Windows\System\WuyjZtq.exe
  2⤵
  PID:3920
- C:\Windows\System\tNhysJO.exe
  C:\Windows\System\tNhysJO.exe
  2⤵
  PID:3936
- C:\Windows\System\jRzVRnK.exe
  C:\Windows\System\jRzVRnK.exe
  2⤵
  PID:3952
- C:\Windows\System\tKnXDWZ.exe
  C:\Windows\System\tKnXDWZ.exe
  2⤵
  PID:4028
- C:\Windows\System\sYgOkZc.exe
  C:\Windows\System\sYgOkZc.exe
  2⤵
  PID:4048
- C:\Windows\System\BeNENYM.exe
  C:\Windows\System\BeNENYM.exe
  2⤵
  PID:4064
- C:\Windows\System\KjQBsQO.exe
  C:\Windows\System\KjQBsQO.exe
  2⤵
  PID:4080
- C:\Windows\System\aUWRYQR.exe
  C:\Windows\System\aUWRYQR.exe
  2⤵
  PID:2436
- C:\Windows\System\YlvCAyf.exe
  C:\Windows\System\YlvCAyf.exe
  2⤵
  PID:1608
- C:\Windows\System\JVArIms.exe
  C:\Windows\System\JVArIms.exe
  2⤵
  PID:3016
- C:\Windows\System\iHvnLnd.exe
  C:\Windows\System\iHvnLnd.exe
  2⤵
  PID:1052
- C:\Windows\System\nCadzte.exe
  C:\Windows\System\nCadzte.exe
  2⤵
  PID:1860
- C:\Windows\System\hqwTGFH.exe
  C:\Windows\System\hqwTGFH.exe
  2⤵
  PID:708
- C:\Windows\System\CkDGPdw.exe
  C:\Windows\System\CkDGPdw.exe
  2⤵
  PID:1508
- C:\Windows\System\sLFOOuT.exe
  C:\Windows\System\sLFOOuT.exe
  2⤵
  PID:3020
- C:\Windows\System\gIFkmBW.exe
  C:\Windows\System\gIFkmBW.exe
  2⤵
  PID:772
- C:\Windows\System\enngkzG.exe
  C:\Windows\System\enngkzG.exe
  2⤵
  PID:952
- C:\Windows\System\SncjGdy.exe
  C:\Windows\System\SncjGdy.exe
  2⤵
  PID:2228
- C:\Windows\System\jDgpYOi.exe
  C:\Windows\System\jDgpYOi.exe
  2⤵
  PID:2892
- C:\Windows\System\hwXZWNd.exe
  C:\Windows\System\hwXZWNd.exe
  2⤵
  PID:2176
- C:\Windows\System\jXkrZhU.exe
  C:\Windows\System\jXkrZhU.exe
  2⤵
  PID:2992
- C:\Windows\System\ywOWtQA.exe
  C:\Windows\System\ywOWtQA.exe
  2⤵
  PID:2224
- C:\Windows\System\dpfMZNz.exe
  C:\Windows\System\dpfMZNz.exe
  2⤵
  PID:2012
- C:\Windows\System\zhnSCxI.exe
  C:\Windows\System\zhnSCxI.exe
  2⤵
  PID:3044
- C:\Windows\System\uzKpNWD.exe
  C:\Windows\System\uzKpNWD.exe
  2⤵
  PID:2976
- C:\Windows\System\YObQbom.exe
  C:\Windows\System\YObQbom.exe
  2⤵
  PID:1612
- C:\Windows\System\OQnhhqR.exe
  C:\Windows\System\OQnhhqR.exe
  2⤵
  PID:3108
- C:\Windows\System\mbKRtjN.exe
  C:\Windows\System\mbKRtjN.exe
  2⤵
  PID:3136
- C:\Windows\System\HGCjZnb.exe
  C:\Windows\System\HGCjZnb.exe
  2⤵
  PID:3168
- C:\Windows\System\HzxEPUb.exe
  C:\Windows\System\HzxEPUb.exe
  2⤵
  PID:3152
- C:\Windows\System\VHgVBWa.exe
  C:\Windows\System\VHgVBWa.exe
  2⤵
  PID:3184
- C:\Windows\System\oqvCNwz.exe
  C:\Windows\System\oqvCNwz.exe
  2⤵
  PID:3200
- C:\Windows\System\fmqDpPY.exe
  C:\Windows\System\fmqDpPY.exe
  2⤵
  PID:3220
- C:\Windows\System\tMCvMkE.exe
  C:\Windows\System\tMCvMkE.exe
  2⤵
  PID:3232
- C:\Windows\System\WVUfcJp.exe
  C:\Windows\System\WVUfcJp.exe
  2⤵
  PID:3280
- C:\Windows\System\gLRxakU.exe
  C:\Windows\System\gLRxakU.exe
  2⤵
  PID:112
- C:\Windows\System\phneSVI.exe
  C:\Windows\System\phneSVI.exe
  2⤵
  PID:712
- C:\Windows\System\bKvonaK.exe
  C:\Windows\System\bKvonaK.exe
  2⤵
  PID:2116
- C:\Windows\System\VYBqFuB.exe
  C:\Windows\System\VYBqFuB.exe
  2⤵
  PID:3668
- C:\Windows\System\ymyVETp.exe
  C:\Windows\System\ymyVETp.exe
  2⤵
  PID:3528
- C:\Windows\System\WOKMgZk.exe
  C:\Windows\System\WOKMgZk.exe
  2⤵
  PID:3260
- C:\Windows\System\eybQAhu.exe
  C:\Windows\System\eybQAhu.exe
  2⤵
  PID:3608
- C:\Windows\System\CzNwZnL.exe
  C:\Windows\System\CzNwZnL.exe
  2⤵
  PID:3716
- C:\Windows\System\BDGqTiC.exe
  C:\Windows\System\BDGqTiC.exe
  2⤵
  PID:3588
- C:\Windows\System\EBwpmhH.exe
  C:\Windows\System\EBwpmhH.exe
  2⤵
  PID:3268
- C:\Windows\System\GQzFpuB.exe
  C:\Windows\System\GQzFpuB.exe
  2⤵
  PID:3328
- C:\Windows\System\FDyhfNd.exe
  C:\Windows\System\FDyhfNd.exe
  2⤵
  PID:3364
- C:\Windows\System\brEhVKR.exe
  C:\Windows\System\brEhVKR.exe
  2⤵
  PID:3464
- C:\Windows\System\NwicgJi.exe
  C:\Windows\System\NwicgJi.exe
  2⤵
  PID:2064
- C:\Windows\System\CaLuqoI.exe
  C:\Windows\System\CaLuqoI.exe
  2⤵
  PID:3560
- C:\Windows\System\eVUalCs.exe
  C:\Windows\System\eVUalCs.exe
  2⤵
  PID:1816
- C:\Windows\System\IPBQtMm.exe
  C:\Windows\System\IPBQtMm.exe
  2⤵
  PID:3816
- C:\Windows\System\ziELIcR.exe
  C:\Windows\System\ziELIcR.exe
  2⤵
  PID:3880
- C:\Windows\System\KhGxTHp.exe
  C:\Windows\System\KhGxTHp.exe
  2⤵
  PID:3916
- C:\Windows\System\bxoTOVN.exe
  C:\Windows\System\bxoTOVN.exe
  2⤵
  PID:3784
- C:\Windows\System\rItxHBQ.exe
  C:\Windows\System\rItxHBQ.exe
  2⤵
  PID:3768
- C:\Windows\System\BtagHHM.exe
  C:\Windows\System\BtagHHM.exe
  2⤵
  PID:3832
- C:\Windows\System\HMasUYk.exe
  C:\Windows\System\HMasUYk.exe
  2⤵
  PID:3896
- C:\Windows\System\EBehSsn.exe
  C:\Windows\System\EBehSsn.exe
  2⤵
  PID:3964
- C:\Windows\System\RpPagVS.exe
  C:\Windows\System\RpPagVS.exe
  2⤵
  PID:4016
- C:\Windows\System\aFUwnII.exe
  C:\Windows\System\aFUwnII.exe
  2⤵
  PID:3996
- C:\Windows\System\FGsyZJL.exe
  C:\Windows\System\FGsyZJL.exe
  2⤵
  PID:3984
- C:\Windows\System\peQBCRx.exe
  C:\Windows\System\peQBCRx.exe
  2⤵
  PID:4036
- C:\Windows\System\yzHuFIb.exe
  C:\Windows\System\yzHuFIb.exe
  2⤵
  PID:4076
- C:\Windows\System\JMQDtjM.exe
  C:\Windows\System\JMQDtjM.exe
  2⤵
  PID:860
- C:\Windows\System\SVnuONR.exe
  C:\Windows\System\SVnuONR.exe
  2⤵
  PID:892
- C:\Windows\System\dYCGuCw.exe
  C:\Windows\System\dYCGuCw.exe
  2⤵
  PID:4088
- C:\Windows\System\hfWouEA.exe
  C:\Windows\System\hfWouEA.exe
  2⤵
  PID:1616
- C:\Windows\System\TPNXaSP.exe
  C:\Windows\System\TPNXaSP.exe
  2⤵
  PID:2668
- C:\Windows\System\vUucJru.exe
  C:\Windows\System\vUucJru.exe
  2⤵
  PID:3084
- C:\Windows\System\BbcbhsA.exe
  C:\Windows\System\BbcbhsA.exe
  2⤵
  PID:2136
- C:\Windows\System\sFJhxnZ.exe
  C:\Windows\System\sFJhxnZ.exe
  2⤵
  PID:844
- C:\Windows\System\YzoMWgf.exe
  C:\Windows\System\YzoMWgf.exe
  2⤵
  PID:3172
- C:\Windows\System\FaIYZzY.exe
  C:\Windows\System\FaIYZzY.exe
  2⤵
  PID:3212
- C:\Windows\System\pMMNUVE.exe
  C:\Windows\System\pMMNUVE.exe
  2⤵
  PID:3244
- C:\Windows\System\UdUeDJz.exe
  C:\Windows\System\UdUeDJz.exe
  2⤵
  PID:3376
- C:\Windows\System\YCtMFES.exe
  C:\Windows\System\YCtMFES.exe
  2⤵
  PID:1496
- C:\Windows\System\UWuzFTQ.exe
  C:\Windows\System\UWuzFTQ.exe
  2⤵
  PID:2572
- C:\Windows\System\HmPEfMF.exe
  C:\Windows\System\HmPEfMF.exe
  2⤵
  PID:3572
- C:\Windows\System\fSAZkcd.exe
  C:\Windows\System\fSAZkcd.exe
  2⤵
  PID:3640
- C:\Windows\System\oodnKIp.exe
  C:\Windows\System\oodnKIp.exe
  2⤵
  PID:3656
- C:\Windows\System\lfoGstp.exe
  C:\Windows\System\lfoGstp.exe
  2⤵
  PID:672
- C:\Windows\System\APXLPHK.exe
  C:\Windows\System\APXLPHK.exe
  2⤵
  PID:1656
- C:\Windows\System\WSHXYQX.exe
  C:\Windows\System\WSHXYQX.exe
  2⤵
  PID:3128
- C:\Windows\System\mkdSyCb.exe
  C:\Windows\System\mkdSyCb.exe
  2⤵
  PID:3192
- C:\Windows\System\OdqIUyo.exe
  C:\Windows\System\OdqIUyo.exe
  2⤵
  PID:3344
- C:\Windows\System\sFLxlBg.exe
  C:\Windows\System\sFLxlBg.exe
  2⤵
  PID:1648
- C:\Windows\System\PKnOPPg.exe
  C:\Windows\System\PKnOPPg.exe
  2⤵
  PID:3712
- C:\Windows\System\yNwyGZW.exe
  C:\Windows\System\yNwyGZW.exe
  2⤵
  PID:3392
- C:\Windows\System\zXiRuyY.exe
  C:\Windows\System\zXiRuyY.exe
  2⤵
  PID:3628
- C:\Windows\System\USnziBS.exe
  C:\Windows\System\USnziBS.exe
  2⤵
  PID:3688
- C:\Windows\System\fGQpVbo.exe
  C:\Windows\System\fGQpVbo.exe
  2⤵
  PID:3424
- C:\Windows\System\wdNvVeH.exe
  C:\Windows\System\wdNvVeH.exe
  2⤵
  PID:1888
- C:\Windows\System\Itgwwnu.exe
  C:\Windows\System\Itgwwnu.exe
  2⤵
  PID:3740
- C:\Windows\System\HARWQru.exe
  C:\Windows\System\HARWQru.exe
  2⤵
  PID:2684
- C:\Windows\System\jGXEOKF.exe
  C:\Windows\System\jGXEOKF.exe
  2⤵
  PID:4044
- C:\Windows\System\iEoBmCE.exe
  C:\Windows\System\iEoBmCE.exe
  2⤵
  PID:540
- C:\Windows\System\sphvYWN.exe
  C:\Windows\System\sphvYWN.exe
  2⤵
  PID:3004
- C:\Windows\System\MxlLLLm.exe
  C:\Windows\System\MxlLLLm.exe
  2⤵
  PID:3800
- C:\Windows\System\UJYxWGQ.exe
  C:\Windows\System\UJYxWGQ.exe
  2⤵
  PID:4112
- C:\Windows\System\LWbRrCA.exe
  C:\Windows\System\LWbRrCA.exe
  2⤵
  PID:4128
- C:\Windows\System\cUYZhqq.exe
  C:\Windows\System\cUYZhqq.exe
  2⤵
  PID:4144
- C:\Windows\System\Oiwlhwm.exe
  C:\Windows\System\Oiwlhwm.exe
  2⤵
  PID:4160
- C:\Windows\System\aliVzvD.exe
  C:\Windows\System\aliVzvD.exe
  2⤵
  PID:4292
- C:\Windows\System\wKOGmzo.exe
  C:\Windows\System\wKOGmzo.exe
  2⤵
  PID:4308
- C:\Windows\System\JufmyKv.exe
  C:\Windows\System\JufmyKv.exe
  2⤵
  PID:4324
- C:\Windows\System\IbOAtFf.exe
  C:\Windows\System\IbOAtFf.exe
  2⤵
  PID:4340
- C:\Windows\System\MsiPfxP.exe
  C:\Windows\System\MsiPfxP.exe
  2⤵
  PID:4356
- C:\Windows\System\lKDKMmR.exe
  C:\Windows\System\lKDKMmR.exe
  2⤵
  PID:4372
- C:\Windows\System\pjUifIh.exe
  C:\Windows\System\pjUifIh.exe
  2⤵
  PID:4388
- C:\Windows\System\wVcyuPY.exe
  C:\Windows\System\wVcyuPY.exe
  2⤵
  PID:4404
- C:\Windows\System\cYqLMFl.exe
  C:\Windows\System\cYqLMFl.exe
  2⤵
  PID:4420
- C:\Windows\System\LIwZOMg.exe
  C:\Windows\System\LIwZOMg.exe
  2⤵
  PID:4436
- C:\Windows\System\PHghuKe.exe
  C:\Windows\System\PHghuKe.exe
  2⤵
  PID:4452
- C:\Windows\System\oKYMydq.exe
  C:\Windows\System\oKYMydq.exe
  2⤵
  PID:4468
- C:\Windows\System\RZNURUX.exe
  C:\Windows\System\RZNURUX.exe
  2⤵
  PID:4484
- C:\Windows\System\KCUncQo.exe
  C:\Windows\System\KCUncQo.exe
  2⤵
  PID:4500
- C:\Windows\System\OSihbqe.exe
  C:\Windows\System\OSihbqe.exe
  2⤵
  PID:4516
- C:\Windows\System\xPCBtck.exe
  C:\Windows\System\xPCBtck.exe
  2⤵
  PID:4532
- C:\Windows\System\oKbwalP.exe
  C:\Windows\System\oKbwalP.exe
  2⤵
  PID:4548
- C:\Windows\System\QJrFsBT.exe
  C:\Windows\System\QJrFsBT.exe
  2⤵
  PID:4564
- C:\Windows\System\VQJyyOW.exe
  C:\Windows\System\VQJyyOW.exe
  2⤵
  PID:4580
- C:\Windows\System\dmmcfql.exe
  C:\Windows\System\dmmcfql.exe
  2⤵
  PID:4596
- C:\Windows\System\ASfWGQR.exe
  C:\Windows\System\ASfWGQR.exe
  2⤵
  PID:4612
- C:\Windows\System\RJtPVNL.exe
  C:\Windows\System\RJtPVNL.exe
  2⤵
  PID:4628
- C:\Windows\System\ZJeOdWB.exe
  C:\Windows\System\ZJeOdWB.exe
  2⤵
  PID:4644
- C:\Windows\System\XrtQSAX.exe
  C:\Windows\System\XrtQSAX.exe
  2⤵
  PID:4660
- C:\Windows\System\AinaeNe.exe
  C:\Windows\System\AinaeNe.exe
  2⤵
  PID:4676
- C:\Windows\System\EpXkDbV.exe
  C:\Windows\System\EpXkDbV.exe
  2⤵
  PID:4692
- C:\Windows\System\ancGUFI.exe
  C:\Windows\System\ancGUFI.exe
  2⤵
  PID:4708
- C:\Windows\System\AhUOfGP.exe
  C:\Windows\System\AhUOfGP.exe
  2⤵
  PID:4728
- C:\Windows\System\BcxHjfm.exe
  C:\Windows\System\BcxHjfm.exe
  2⤵
  PID:4744
- C:\Windows\System\XjMXzUL.exe
  C:\Windows\System\XjMXzUL.exe
  2⤵
  PID:4760
- C:\Windows\System\YmgMEPH.exe
  C:\Windows\System\YmgMEPH.exe
  2⤵
  PID:4776
- C:\Windows\System\lTRHkhs.exe
  C:\Windows\System\lTRHkhs.exe
  2⤵
  PID:4792
- C:\Windows\System\hcHZWhW.exe
  C:\Windows\System\hcHZWhW.exe
  2⤵
  PID:4812
- C:\Windows\System\EFrarRX.exe
  C:\Windows\System\EFrarRX.exe
  2⤵
  PID:4832
- C:\Windows\System\jNMjPwK.exe
  C:\Windows\System\jNMjPwK.exe
  2⤵
  PID:4848
- C:\Windows\System\OTMfEWF.exe
  C:\Windows\System\OTMfEWF.exe
  2⤵
  PID:4864
- C:\Windows\System\cIuomSz.exe
  C:\Windows\System\cIuomSz.exe
  2⤵
  PID:4880
- C:\Windows\System\aTCIZrP.exe
  C:\Windows\System\aTCIZrP.exe
  2⤵
  PID:4896
- C:\Windows\System\tDWkWXj.exe
  C:\Windows\System\tDWkWXj.exe
  2⤵
  PID:4912
- C:\Windows\System\pYpvXMu.exe
  C:\Windows\System\pYpvXMu.exe
  2⤵
  PID:4928
- C:\Windows\System\gNWovqR.exe
  C:\Windows\System\gNWovqR.exe
  2⤵
  PID:4944
- C:\Windows\System\KBTiSbI.exe
  C:\Windows\System\KBTiSbI.exe
  2⤵
  PID:4960
- C:\Windows\System\LkOMuZR.exe
  C:\Windows\System\LkOMuZR.exe
  2⤵
  PID:4976
- C:\Windows\System\fyRUyYU.exe
  C:\Windows\System\fyRUyYU.exe
  2⤵
  PID:4992
- C:\Windows\System\LUUFAUd.exe
  C:\Windows\System\LUUFAUd.exe
  2⤵
  PID:5012
- C:\Windows\System\XnpnHWi.exe
  C:\Windows\System\XnpnHWi.exe
  2⤵
  PID:5028
- C:\Windows\System\zavqAqz.exe
  C:\Windows\System\zavqAqz.exe
  2⤵
  PID:5044
- C:\Windows\System\QshojTj.exe
  C:\Windows\System\QshojTj.exe
  2⤵
  PID:5060
- C:\Windows\System\KMPwkCZ.exe
  C:\Windows\System\KMPwkCZ.exe
  2⤵
  PID:5076
- C:\Windows\System\mbXQVmV.exe
  C:\Windows\System\mbXQVmV.exe
  2⤵
  PID:5096
- C:\Windows\System\HqoYhPr.exe
  C:\Windows\System\HqoYhPr.exe
  2⤵
  PID:5112
- C:\Windows\System\YtikEDo.exe
  C:\Windows\System\YtikEDo.exe
  2⤵
  PID:3960
- C:\Windows\System\kprGCML.exe
  C:\Windows\System\kprGCML.exe
  2⤵
  PID:3988
- C:\Windows\System\TVMSFEs.exe
  C:\Windows\System\TVMSFEs.exe
  2⤵
  PID:4060
- C:\Windows\System\KSNofPA.exe
  C:\Windows\System\KSNofPA.exe
  2⤵
  PID:1592
- C:\Windows\System\pJnnpuZ.exe
  C:\Windows\System\pJnnpuZ.exe
  2⤵
  PID:1852
- C:\Windows\System\hresAfR.exe
  C:\Windows\System\hresAfR.exe
  2⤵
  PID:2820
- C:\Windows\System\kBQsBXz.exe
  C:\Windows\System\kBQsBXz.exe
  2⤵
  PID:1868
- C:\Windows\System\pMrCIjb.exe
  C:\Windows\System\pMrCIjb.exe
  2⤵
  PID:912
- C:\Windows\System\AHJOXbE.exe
  C:\Windows\System\AHJOXbE.exe
  2⤵
  PID:3756
- C:\Windows\System\QONugeE.exe
  C:\Windows\System\QONugeE.exe
  2⤵
  PID:4200
- C:\Windows\System\flSFFQs.exe
  C:\Windows\System\flSFFQs.exe
  2⤵
  PID:4216
- C:\Windows\System\BeqYVbB.exe
  C:\Windows\System\BeqYVbB.exe
  2⤵
  PID:4244
- C:\Windows\System\EYnQToC.exe
  C:\Windows\System\EYnQToC.exe
  2⤵
  PID:4268
- C:\Windows\System\PFWYGfy.exe
  C:\Windows\System\PFWYGfy.exe
  2⤵
  PID:4524
- C:\Windows\System\PabJiOg.exe
  C:\Windows\System\PabJiOg.exe
  2⤵
  PID:4620
- C:\Windows\System\bzavQWh.exe
  C:\Windows\System\bzavQWh.exe
  2⤵
  PID:4688
- C:\Windows\System\IwyCFGx.exe
  C:\Windows\System\IwyCFGx.exe
  2⤵
  PID:4752
- C:\Windows\System\mZgFZpC.exe
  C:\Windows\System\mZgFZpC.exe
  2⤵
  PID:4316
- C:\Windows\System\UAyhimI.exe
  C:\Windows\System\UAyhimI.exe
  2⤵
  PID:4380
- C:\Windows\System\JeDbWWz.exe
  C:\Windows\System\JeDbWWz.exe
  2⤵
  PID:4444
- C:\Windows\System\nfDrnIn.exe
  C:\Windows\System\nfDrnIn.exe
  2⤵
  PID:4480
- C:\Windows\System\UFkjCje.exe
  C:\Windows\System\UFkjCje.exe
  2⤵
  PID:4572
- C:\Windows\System\NZvSnEI.exe
  C:\Windows\System\NZvSnEI.exe
  2⤵
  PID:4636
- C:\Windows\System\hiISmch.exe
  C:\Windows\System\hiISmch.exe
  2⤵
  PID:4700
- C:\Windows\System\cVcPfcj.exe
  C:\Windows\System\cVcPfcj.exe
  2⤵
  PID:4768
- C:\Windows\System\WnjheNC.exe
  C:\Windows\System\WnjheNC.exe
  2⤵
  PID:4804
- C:\Windows\System\WbEGRgk.exe
  C:\Windows\System\WbEGRgk.exe
  2⤵
  PID:4828
- C:\Windows\System\XKwaQHz.exe
  C:\Windows\System\XKwaQHz.exe
  2⤵
  PID:4888
- C:\Windows\System\OFaYWxz.exe
  C:\Windows\System\OFaYWxz.exe
  2⤵
  PID:4924
- C:\Windows\System\ERgNqFC.exe
  C:\Windows\System\ERgNqFC.exe
  2⤵
  PID:5056
- C:\Windows\System\GJYLSsB.exe
  C:\Windows\System\GJYLSsB.exe
  2⤵
  PID:4988
- C:\Windows\System\FSvaVbG.exe
  C:\Windows\System\FSvaVbG.exe
  2⤵
  PID:3928
- C:\Windows\System\MPYXEEv.exe
  C:\Windows\System\MPYXEEv.exe
  2⤵
  PID:2724
- C:\Windows\System\PmpvTon.exe
  C:\Windows\System\PmpvTon.exe
  2⤵
  PID:3480
- C:\Windows\System\dmtpLhq.exe
  C:\Windows\System\dmtpLhq.exe
  2⤵
  PID:5072
- C:\Windows\System\ssJOvyn.exe
  C:\Windows\System\ssJOvyn.exe
  2⤵
  PID:4000
- C:\Windows\System\BcDbNQn.exe
  C:\Windows\System\BcDbNQn.exe
  2⤵
  PID:1108
- C:\Windows\System\QGVEPjS.exe
  C:\Windows\System\QGVEPjS.exe
  2⤵
  PID:4936
- C:\Windows\System\DrsJEZd.exe
  C:\Windows\System\DrsJEZd.exe
  2⤵
  PID:5008
- C:\Windows\System\UzAvClN.exe
  C:\Windows\System\UzAvClN.exe
  2⤵
  PID:3348
- C:\Windows\System\BjOQdQw.exe
  C:\Windows\System\BjOQdQw.exe
  2⤵
  PID:3700
- C:\Windows\System\RtimiIb.exe
  C:\Windows\System\RtimiIb.exe
  2⤵
  PID:3868
- C:\Windows\System\CxHhttw.exe
  C:\Windows\System\CxHhttw.exe
  2⤵
  PID:3948
- C:\Windows\System\tYvpRyo.exe
  C:\Windows\System\tYvpRyo.exe
  2⤵
  PID:4120
- C:\Windows\System\EuLSdwo.exe
  C:\Windows\System\EuLSdwo.exe
  2⤵
  PID:3444
- C:\Windows\System\stAHUrs.exe
  C:\Windows\System\stAHUrs.exe
  2⤵
  PID:1476
- C:\Windows\System\UGLZajq.exe
  C:\Windows\System\UGLZajq.exe
  2⤵
  PID:3144
- C:\Windows\System\wxSdpYp.exe
  C:\Windows\System\wxSdpYp.exe
  2⤵
  PID:3604
- C:\Windows\System\GbsTpHz.exe
  C:\Windows\System\GbsTpHz.exe
  2⤵
  PID:3412
- C:\Windows\System\pzOybdy.exe
  C:\Windows\System\pzOybdy.exe
  2⤵
  PID:2912
- C:\Windows\System\qemPNds.exe
  C:\Windows\System\qemPNds.exe
  2⤵
  PID:3300
- C:\Windows\System\LcPlQNZ.exe
  C:\Windows\System\LcPlQNZ.exe
  2⤵
  PID:3972
- C:\Windows\System\YxtSdVn.exe
  C:\Windows\System\YxtSdVn.exe
  2⤵
  PID:4108
- C:\Windows\System\PGLJJgf.exe
  C:\Windows\System\PGLJJgf.exe
  2⤵
  PID:4168
- C:\Windows\System\kdXFIMe.exe
  C:\Windows\System\kdXFIMe.exe
  2⤵
  PID:4188
- C:\Windows\System\ykUkIAK.exe
  C:\Windows\System\ykUkIAK.exe
  2⤵
  PID:4224
- C:\Windows\System\EtuneBG.exe
  C:\Windows\System\EtuneBG.exe
  2⤵
  PID:4304
- C:\Windows\System\limMSri.exe
  C:\Windows\System\limMSri.exe
  2⤵
  PID:4684
- C:\Windows\System\iPJvPaL.exe
  C:\Windows\System\iPJvPaL.exe
  2⤵
  PID:4412
- C:\Windows\System\rPddXIa.exe
  C:\Windows\System\rPddXIa.exe
  2⤵
  PID:4668
- C:\Windows\System\kgznOeK.exe
  C:\Windows\System\kgznOeK.exe
  2⤵
  PID:4872
- C:\Windows\System\WsOlmHH.exe
  C:\Windows\System\WsOlmHH.exe
  2⤵
  PID:4348
- C:\Windows\System\WMTWysm.exe
  C:\Windows\System\WMTWysm.exe
  2⤵
  PID:4736
- C:\Windows\System\qLVRjML.exe
  C:\Windows\System\qLVRjML.exe
  2⤵
  PID:4476
- C:\Windows\System\qesoJZP.exe
  C:\Windows\System\qesoJZP.exe
  2⤵
  PID:4920
- C:\Windows\System\dvHPtop.exe
  C:\Windows\System\dvHPtop.exe
  2⤵
  PID:5024
- C:\Windows\System\RAqcZjW.exe
  C:\Windows\System\RAqcZjW.exe
  2⤵
  PID:3512
- C:\Windows\System\fueZItJ.exe
  C:\Windows\System\fueZItJ.exe
  2⤵
  PID:3240
- C:\Windows\System\btqNNTr.exe
  C:\Windows\System\btqNNTr.exe
  2⤵
  PID:2628
- C:\Windows\System\ELMotAN.exe
  C:\Windows\System\ELMotAN.exe
  2⤵
  PID:5000
- C:\Windows\System\QWtIvFA.exe
  C:\Windows\System\QWtIvFA.exe
  2⤵
  PID:5040
- C:\Windows\System\IBZzUxf.exe
  C:\Windows\System\IBZzUxf.exe
  2⤵
  PID:2696
- C:\Windows\System\LuUIKsX.exe
  C:\Windows\System\LuUIKsX.exe
  2⤵
  PID:312
- C:\Windows\System\sXiHkoe.exe
  C:\Windows\System\sXiHkoe.exe
  2⤵
  PID:2664
- C:\Windows\System\lGQJXkq.exe
  C:\Windows\System\lGQJXkq.exe
  2⤵
  PID:4228
- C:\Windows\System\vXWrPqr.exe
  C:\Windows\System\vXWrPqr.exe
  2⤵
  PID:5068
- C:\Windows\System\uJIYvSC.exe
  C:\Windows\System\uJIYvSC.exe
  2⤵
  PID:380
- C:\Windows\System\HGcKaPf.exe
  C:\Windows\System\HGcKaPf.exe
  2⤵
  PID:3540
- C:\Windows\System\hGCEgXm.exe
  C:\Windows\System\hGCEgXm.exe
  2⤵
  PID:4136
- C:\Windows\System\qmIeWyl.exe
  C:\Windows\System\qmIeWyl.exe
  2⤵
  PID:2384
- C:\Windows\System\fcNkqSr.exe
  C:\Windows\System\fcNkqSr.exe
  2⤵
  PID:4892
- C:\Windows\System\RhestWZ.exe
  C:\Windows\System\RhestWZ.exe
  2⤵
  PID:3704
- C:\Windows\System\pnrfQmw.exe
  C:\Windows\System\pnrfQmw.exe
  2⤵
  PID:4124
- C:\Windows\System\okrhsDt.exe
  C:\Windows\System\okrhsDt.exe
  2⤵
  PID:5108
- C:\Windows\System\OYfxRex.exe
  C:\Windows\System\OYfxRex.exe
  2⤵
  PID:2100
- C:\Windows\System\yBxaIFE.exe
  C:\Windows\System\yBxaIFE.exe
  2⤵
  PID:4400
- C:\Windows\System\bdjMOBQ.exe
  C:\Windows\System\bdjMOBQ.exe
  2⤵
  PID:4428
- C:\Windows\System\uuTKGls.exe
  C:\Windows\System\uuTKGls.exe
  2⤵
  PID:4556
- C:\Windows\System\qWnqNDE.exe
  C:\Windows\System\qWnqNDE.exe
  2⤵
  PID:4652
- C:\Windows\System\PpOapAE.exe
  C:\Windows\System\PpOapAE.exe
  2⤵
  PID:4724
- C:\Windows\System\AyPPCwN.exe
  C:\Windows\System\AyPPCwN.exe
  2⤵
  PID:4956
- C:\Windows\System\TXDDIJn.exe
  C:\Windows\System\TXDDIJn.exe
  2⤵
  PID:4056
- C:\Windows\System\QinjIvu.exe
  C:\Windows\System\QinjIvu.exe
  2⤵
  PID:1324
- C:\Windows\System\NuFNhpb.exe
  C:\Windows\System\NuFNhpb.exe
  2⤵
  PID:4192
- C:\Windows\System\wQzqGpP.exe
  C:\Windows\System\wQzqGpP.exe
  2⤵
  PID:5052
- C:\Windows\System\PRkxQEq.exe
  C:\Windows\System\PRkxQEq.exe
  2⤵
  PID:4904
- C:\Windows\System\RfisqWn.exe
  C:\Windows\System\RfisqWn.exe
  2⤵
  PID:4540
- C:\Windows\System\yDYtlqt.exe
  C:\Windows\System\yDYtlqt.exe
  2⤵
  PID:4300
- C:\Windows\System\rtFSxRm.exe
  C:\Windows\System\rtFSxRm.exe
  2⤵
  PID:5124
- C:\Windows\System\kahfQPj.exe
  C:\Windows\System\kahfQPj.exe
  2⤵
  PID:5140
- C:\Windows\System\jYrfhNT.exe
  C:\Windows\System\jYrfhNT.exe
  2⤵
  PID:5156
- C:\Windows\System\LovUpHD.exe
  C:\Windows\System\LovUpHD.exe
  2⤵
  PID:5172
- C:\Windows\System\GoxjCcg.exe
  C:\Windows\System\GoxjCcg.exe
  2⤵
  PID:5188
- C:\Windows\System\ENLEAcn.exe
  C:\Windows\System\ENLEAcn.exe
  2⤵
  PID:5204
- C:\Windows\System\NDOVyjB.exe
  C:\Windows\System\NDOVyjB.exe
  2⤵
  PID:5220
- C:\Windows\System\RykhHyL.exe
  C:\Windows\System\RykhHyL.exe
  2⤵
  PID:5236
- C:\Windows\System\fUxGnmP.exe
  C:\Windows\System\fUxGnmP.exe
  2⤵
  PID:5252
- C:\Windows\System\jFbCJuk.exe
  C:\Windows\System\jFbCJuk.exe
  2⤵
  PID:5272
- C:\Windows\System\oJvbYZz.exe
  C:\Windows\System\oJvbYZz.exe
  2⤵
  PID:5416
- C:\Windows\System\ZMAkhAn.exe
  C:\Windows\System\ZMAkhAn.exe
  2⤵
  PID:5432
- C:\Windows\System\xckxjqU.exe
  C:\Windows\System\xckxjqU.exe
  2⤵
  PID:5448
- C:\Windows\System\yTUBCgB.exe
  C:\Windows\System\yTUBCgB.exe
  2⤵
  PID:5464
- C:\Windows\System\nJmldQZ.exe
  C:\Windows\System\nJmldQZ.exe
  2⤵
  PID:5488
- C:\Windows\System\HdDBWJo.exe
  C:\Windows\System\HdDBWJo.exe
  2⤵
  PID:5512
- C:\Windows\System\QTxtujX.exe
  C:\Windows\System\QTxtujX.exe
  2⤵
  PID:5528
- C:\Windows\System\xseIVEz.exe
  C:\Windows\System\xseIVEz.exe
  2⤵
  PID:5544
- C:\Windows\System\fnujxom.exe
  C:\Windows\System\fnujxom.exe
  2⤵
  PID:5560
- C:\Windows\System\cwACwCF.exe
  C:\Windows\System\cwACwCF.exe
  2⤵
  PID:5576
- C:\Windows\System\mlktMPk.exe
  C:\Windows\System\mlktMPk.exe
  2⤵
  PID:5596
- C:\Windows\System\wMZvajE.exe
  C:\Windows\System\wMZvajE.exe
  2⤵
  PID:5612
- C:\Windows\System\jryYZxu.exe
  C:\Windows\System\jryYZxu.exe
  2⤵
  PID:5628
- C:\Windows\System\aPJYDeZ.exe
  C:\Windows\System\aPJYDeZ.exe
  2⤵
  PID:5644
- C:\Windows\System\cZMSYqo.exe
  C:\Windows\System\cZMSYqo.exe
  2⤵
  PID:5660
- C:\Windows\System\HzUBMjP.exe
  C:\Windows\System\HzUBMjP.exe
  2⤵
  PID:5676
- C:\Windows\System\IXrCMPb.exe
  C:\Windows\System\IXrCMPb.exe
  2⤵
  PID:5692
- C:\Windows\System\FWMIHFT.exe
  C:\Windows\System\FWMIHFT.exe
  2⤵
  PID:5708
- C:\Windows\System\vNANuor.exe
  C:\Windows\System\vNANuor.exe
  2⤵
  PID:5728
- C:\Windows\System\nxuFilc.exe
  C:\Windows\System\nxuFilc.exe
  2⤵
  PID:5744
- C:\Windows\System\eoGufWz.exe
  C:\Windows\System\eoGufWz.exe
  2⤵
  PID:5764
- C:\Windows\System\aVgBvdW.exe
  C:\Windows\System\aVgBvdW.exe
  2⤵
  PID:5780
- C:\Windows\System\YwrsJgB.exe
  C:\Windows\System\YwrsJgB.exe
  2⤵
  PID:5796
- C:\Windows\System\tjdyzJt.exe
  C:\Windows\System\tjdyzJt.exe
  2⤵
  PID:5812
- C:\Windows\System\xmOTWuo.exe
  C:\Windows\System\xmOTWuo.exe
  2⤵
  PID:5828
- C:\Windows\System\SPVqjVP.exe
  C:\Windows\System\SPVqjVP.exe
  2⤵
  PID:5844
- C:\Windows\System\njDMKBB.exe
  C:\Windows\System\njDMKBB.exe
  2⤵
  PID:5860
- C:\Windows\System\xPJHkyL.exe
  C:\Windows\System\xPJHkyL.exe
  2⤵
  PID:5880
- C:\Windows\System\XLqwxgX.exe
  C:\Windows\System\XLqwxgX.exe
  2⤵
  PID:5896
- C:\Windows\System\VTJoang.exe
  C:\Windows\System\VTJoang.exe
  2⤵
  PID:5912
- C:\Windows\System\BMGXdxB.exe
  C:\Windows\System\BMGXdxB.exe
  2⤵
  PID:5932
- C:\Windows\System\QkSrvLd.exe
  C:\Windows\System\QkSrvLd.exe
  2⤵
  PID:5948
- C:\Windows\System\QOaFplM.exe
  C:\Windows\System\QOaFplM.exe
  2⤵
  PID:5964
- C:\Windows\System\FRWeNOg.exe
  C:\Windows\System\FRWeNOg.exe
  2⤵
  PID:5984
- C:\Windows\System\TJZksls.exe
  C:\Windows\System\TJZksls.exe
  2⤵
  PID:6000
- C:\Windows\System\gLKkrCF.exe
  C:\Windows\System\gLKkrCF.exe
  2⤵
  PID:6016
- C:\Windows\System\zUnELXC.exe
  C:\Windows\System\zUnELXC.exe
  2⤵
  PID:6032
- C:\Windows\System\lldvTer.exe
  C:\Windows\System\lldvTer.exe
  2⤵
  PID:6048
- C:\Windows\System\ENkEKet.exe
  C:\Windows\System\ENkEKet.exe
  2⤵
  PID:6068
- C:\Windows\System\UHkcMRa.exe
  C:\Windows\System\UHkcMRa.exe
  2⤵
  PID:6084
- C:\Windows\System\FVQDqCm.exe
  C:\Windows\System\FVQDqCm.exe
  2⤵
  PID:6104
- C:\Windows\System\maNUbbf.exe
  C:\Windows\System\maNUbbf.exe
  2⤵
  PID:6120
- C:\Windows\System\xZsKHIC.exe
  C:\Windows\System\xZsKHIC.exe
  2⤵
  PID:6140
- C:\Windows\System\owpoiml.exe
  C:\Windows\System\owpoiml.exe
  2⤵
  PID:4656
- C:\Windows\System\qMozKlW.exe
  C:\Windows\System\qMozKlW.exe
  2⤵
  PID:3156
- C:\Windows\System\BKeEXJe.exe
  C:\Windows\System\BKeEXJe.exe
  2⤵
  PID:4336
- C:\Windows\System\ZjyvXfM.exe
  C:\Windows\System\ZjyvXfM.exe
  2⤵
  PID:5184
- C:\Windows\System\sHaROee.exe
  C:\Windows\System\sHaROee.exe
  2⤵
  PID:4396
- C:\Windows\System\uOCHtvf.exe
  C:\Windows\System\uOCHtvf.exe
  2⤵
  PID:5196
- C:\Windows\System\ZhMwQMB.exe
  C:\Windows\System\ZhMwQMB.exe
  2⤵
  PID:5136
- C:\Windows\System\HrXBdcL.exe
  C:\Windows\System\HrXBdcL.exe
  2⤵
  PID:5288
- C:\Windows\System\zSgXDEA.exe
  C:\Windows\System\zSgXDEA.exe
  2⤵
  PID:5228
- C:\Windows\System\sUjnkjz.exe
  C:\Windows\System\sUjnkjz.exe
  2⤵
  PID:5232
- C:\Windows\System\BvXLSud.exe
  C:\Windows\System\BvXLSud.exe
  2⤵
  PID:4004
- C:\Windows\System\EWXRTRw.exe
  C:\Windows\System\EWXRTRw.exe
  2⤵
  PID:5300
- C:\Windows\System\gUGZmNn.exe
  C:\Windows\System\gUGZmNn.exe
  2⤵
  PID:5316
- C:\Windows\System\NkTsbUS.exe
  C:\Windows\System\NkTsbUS.exe
  2⤵
  PID:5392
- C:\Windows\System\sIHgnUd.exe
  C:\Windows\System\sIHgnUd.exe
  2⤵
  PID:5376
- C:\Windows\System\lYUGjkb.exe
  C:\Windows\System\lYUGjkb.exe
  2⤵
  PID:5356
- C:\Windows\System\WohnmGL.exe
  C:\Windows\System\WohnmGL.exe
  2⤵
  PID:5340
- C:\Windows\System\WtOtcNA.exe
  C:\Windows\System\WtOtcNA.exe
  2⤵
  PID:5396
- C:\Windows\System\mWTVCyS.exe
  C:\Windows\System\mWTVCyS.exe
  2⤵
  PID:5408
- C:\Windows\System\OGKRlCu.exe
  C:\Windows\System\OGKRlCu.exe
  2⤵
  PID:5480
- C:\Windows\System\QacYuje.exe
  C:\Windows\System\QacYuje.exe
  2⤵
  PID:5520
- C:\Windows\System\EozsevJ.exe
  C:\Windows\System\EozsevJ.exe
  2⤵
  PID:5556
- C:\Windows\System\McjvKZj.exe
  C:\Windows\System\McjvKZj.exe
  2⤵
  PID:5652
- C:\Windows\System\hYGOiPd.exe
  C:\Windows\System\hYGOiPd.exe
  2⤵
  PID:5684
- C:\Windows\System\nmVtMsW.exe
  C:\Windows\System\nmVtMsW.exe
  2⤵
  PID:5536
- C:\Windows\System\ztQziMZ.exe
  C:\Windows\System\ztQziMZ.exe
  2⤵
  PID:5724
- C:\Windows\System\YzJMbzx.exe
  C:\Windows\System\YzJMbzx.exe
  2⤵
  PID:5460
- C:\Windows\System\YVzRSsr.exe
  C:\Windows\System\YVzRSsr.exe
  2⤵
  PID:5756
- C:\Windows\System\SQZqcxT.exe
  C:\Windows\System\SQZqcxT.exe
  2⤵
  PID:5820
- C:\Windows\System\fLAzPsp.exe
  C:\Windows\System\fLAzPsp.exe
  2⤵
  PID:5888
- C:\Windows\System\rsHdjXU.exe
  C:\Windows\System\rsHdjXU.exe
  2⤵
  PID:5924
- C:\Windows\System\kQBqOfk.exe
  C:\Windows\System\kQBqOfk.exe
  2⤵
  PID:5604
- C:\Windows\System\XbZNoik.exe
  C:\Windows\System\XbZNoik.exe
  2⤵
  PID:5672
- C:\Windows\System\oKqdVlb.exe
  C:\Windows\System\oKqdVlb.exe
  2⤵
  PID:5992
- C:\Windows\System\zsGIWgk.exe
  C:\Windows\System\zsGIWgk.exe
  2⤵
  PID:5772
- C:\Windows\System\vwNjahX.exe
  C:\Windows\System\vwNjahX.exe
  2⤵
  PID:5940
- C:\Windows\System\giBJGUI.exe
  C:\Windows\System\giBJGUI.exe
  2⤵
  PID:5840
- C:\Windows\System\MdoWwag.exe
  C:\Windows\System\MdoWwag.exe
  2⤵
  PID:5908
- C:\Windows\System\ZiZmFyT.exe
  C:\Windows\System\ZiZmFyT.exe
  2⤵
  PID:6024
- C:\Windows\System\MyaRIpf.exe
  C:\Windows\System\MyaRIpf.exe
  2⤵
  PID:6012
- C:\Windows\System\ndBEFez.exe
  C:\Windows\System\ndBEFez.exe
  2⤵
  PID:6060
- C:\Windows\System\AsWnFPI.exe
  C:\Windows\System\AsWnFPI.exe
  2⤵
  PID:6116
- C:\Windows\System\fXiwnzK.exe
  C:\Windows\System\fXiwnzK.exe
  2⤵
  PID:6092
- C:\Windows\System\qxifaON.exe
  C:\Windows\System\qxifaON.exe
  2⤵
  PID:4984
- C:\Windows\System\HHdwIDQ.exe
  C:\Windows\System\HHdwIDQ.exe
  2⤵
  PID:6096
- C:\Windows\System\jhzalCR.exe
  C:\Windows\System\jhzalCR.exe
  2⤵
  PID:4196
- C:\Windows\System\NGmOAVC.exe
  C:\Windows\System\NGmOAVC.exe
  2⤵
  PID:5180
- C:\Windows\System\ywuZsWJ.exe
  C:\Windows\System\ywuZsWJ.exe
  2⤵
  PID:1996
- C:\Windows\System\cLFlUud.exe
  C:\Windows\System\cLFlUud.exe
  2⤵
  PID:4972
- C:\Windows\System\itzjZcg.exe
  C:\Windows\System\itzjZcg.exe
  2⤵
  PID:3852
- C:\Windows\System\NXgzSAh.exe
  C:\Windows\System\NXgzSAh.exe
  2⤵
  PID:4824
- C:\Windows\System\bIaoXpd.exe
  C:\Windows\System\bIaoXpd.exe
  2⤵
  PID:5312
- C:\Windows\System\qtAPVup.exe
  C:\Windows\System\qtAPVup.exe
  2⤵
  PID:5404
- C:\Windows\System\KmJuOSS.exe
  C:\Windows\System\KmJuOSS.exe
  2⤵
  PID:5444
- C:\Windows\System\qeLANlb.exe
  C:\Windows\System\qeLANlb.exe
  2⤵
  PID:5620
- C:\Windows\System\iLypWxJ.exe
  C:\Windows\System\iLypWxJ.exe
  2⤵
  PID:5504
- C:\Windows\System\vdGAWpb.exe
  C:\Windows\System\vdGAWpb.exe
  2⤵
  PID:5852
- C:\Windows\System\Kbharfz.exe
  C:\Windows\System\Kbharfz.exe
  2⤵
  PID:5572
- C:\Windows\System\YRCiTCo.exe
  C:\Windows\System\YRCiTCo.exe
  2⤵
  PID:5428
- C:\Windows\System\hTPPRGs.exe
  C:\Windows\System\hTPPRGs.exe
  2⤵
  PID:5700
- C:\Windows\System\QEGbKNW.exe
  C:\Windows\System\QEGbKNW.exe
  2⤵
  PID:5804
- C:\Windows\System\kaDDxXf.exe
  C:\Windows\System\kaDDxXf.exe
  2⤵
  PID:5668
- C:\Windows\System\ZlAkekH.exe
  C:\Windows\System\ZlAkekH.exe
  2⤵
  PID:6112
- C:\Windows\System\ccbFXNw.exe
  C:\Windows\System\ccbFXNw.exe
  2⤵
  PID:5996
- C:\Windows\System\BfvVXuT.exe
  C:\Windows\System\BfvVXuT.exe
  2⤵
  PID:6044
- C:\Windows\System\MEVmUWB.exe
  C:\Windows\System\MEVmUWB.exe
  2⤵
  PID:5132
- C:\Windows\System\uHGDbbu.exe
  C:\Windows\System\uHGDbbu.exe
  2⤵
  PID:4800
- C:\Windows\System\kdDlQnX.exe
  C:\Windows\System\kdDlQnX.exe
  2⤵
  PID:3104
- C:\Windows\System\IaTkGLA.exe
  C:\Windows\System\IaTkGLA.exe
  2⤵
  PID:5284
- C:\Windows\System\MHBwMET.exe
  C:\Windows\System\MHBwMET.exe
  2⤵
  PID:5332
- C:\Windows\System\HZrZIbA.exe
  C:\Windows\System\HZrZIbA.exe
  2⤵
  PID:5720
- C:\Windows\System\RyEZyIf.exe
  C:\Windows\System\RyEZyIf.exe
  2⤵
  PID:5788
- C:\Windows\System\tNPHuVb.exe
  C:\Windows\System\tNPHuVb.exe
  2⤵
  PID:5808
- C:\Windows\System\pbXtyQh.exe
  C:\Windows\System\pbXtyQh.exe
  2⤵
  PID:5588
- C:\Windows\System\NOUyZvx.exe
  C:\Windows\System\NOUyZvx.exe
  2⤵
  PID:5164
- C:\Windows\System\vchzhcr.exe
  C:\Windows\System\vchzhcr.exe
  2⤵
  PID:5608
- C:\Windows\System\HeUwmdC.exe
  C:\Windows\System\HeUwmdC.exe
  2⤵
  PID:5856
- C:\Windows\System\rsVlYFw.exe
  C:\Windows\System\rsVlYFw.exe
  2⤵
  PID:6064
- C:\Windows\System\SNfNkoZ.exe
  C:\Windows\System\SNfNkoZ.exe
  2⤵
  PID:5792
- C:\Windows\System\lJHlGDt.exe
  C:\Windows\System\lJHlGDt.exe
  2⤵
  PID:5372
- C:\Windows\System\GVGVhpb.exe
  C:\Windows\System\GVGVhpb.exe
  2⤵
  PID:5328
- C:\Windows\System\ycpbNur.exe
  C:\Windows\System\ycpbNur.exe
  2⤵
  PID:5216
- C:\Windows\System\WGcSbQg.exe
  C:\Windows\System\WGcSbQg.exe
  2⤵
  PID:5248
- C:\Windows\System\bYmrrKH.exe
  C:\Windows\System\bYmrrKH.exe
  2⤵
  PID:5904
- C:\Windows\System\OCafROI.exe
  C:\Windows\System\OCafROI.exe
  2⤵
  PID:4184
- C:\Windows\System\cepRlHa.exe
  C:\Windows\System\cepRlHa.exe
  2⤵
  PID:6160
- C:\Windows\System\ilixouY.exe
  C:\Windows\System\ilixouY.exe
  2⤵
  PID:6176
- C:\Windows\System\CtxzLCm.exe
  C:\Windows\System\CtxzLCm.exe
  2⤵
  PID:6192
- C:\Windows\System\ZAtaDHU.exe
  C:\Windows\System\ZAtaDHU.exe
  2⤵
  PID:6208
- C:\Windows\System\BSBODka.exe
  C:\Windows\System\BSBODka.exe
  2⤵
  PID:6224
- C:\Windows\System\xUINrXm.exe
  C:\Windows\System\xUINrXm.exe
  2⤵
  PID:6244
- C:\Windows\System\uJwraeU.exe
  C:\Windows\System\uJwraeU.exe
  2⤵
  PID:6260
- C:\Windows\System\YMmqFQb.exe
  C:\Windows\System\YMmqFQb.exe
  2⤵
  PID:6276
- C:\Windows\System\SgTVLTX.exe
  C:\Windows\System\SgTVLTX.exe
  2⤵
  PID:6292
- C:\Windows\System\oSGyxkN.exe
  C:\Windows\System\oSGyxkN.exe
  2⤵
  PID:6308
- C:\Windows\System\DIxXuYv.exe
  C:\Windows\System\DIxXuYv.exe
  2⤵
  PID:6324
- C:\Windows\System\FvkFHQY.exe
  C:\Windows\System\FvkFHQY.exe
  2⤵
  PID:6340
- C:\Windows\System\TXIAYJN.exe
  C:\Windows\System\TXIAYJN.exe
  2⤵
  PID:6356
- C:\Windows\System\xxvtabn.exe
  C:\Windows\System\xxvtabn.exe
  2⤵
  PID:6376
- C:\Windows\System\ROqvTob.exe
  C:\Windows\System\ROqvTob.exe
  2⤵
  PID:6392
- C:\Windows\System\JeaizrI.exe
  C:\Windows\System\JeaizrI.exe
  2⤵
  PID:6408
- C:\Windows\System\ITWviSQ.exe
  C:\Windows\System\ITWviSQ.exe
  2⤵
  PID:6424
- C:\Windows\System\cHlPmrY.exe
  C:\Windows\System\cHlPmrY.exe
  2⤵
  PID:6440
- C:\Windows\System\MruJTxi.exe
  C:\Windows\System\MruJTxi.exe
  2⤵
  PID:6456
- C:\Windows\System\IDUWkum.exe
  C:\Windows\System\IDUWkum.exe
  2⤵
  PID:6472
- C:\Windows\System\QxSDDwa.exe
  C:\Windows\System\QxSDDwa.exe
  2⤵
  PID:6588
- C:\Windows\System\RsCfEXC.exe
  C:\Windows\System\RsCfEXC.exe
  2⤵
  PID:6744
- C:\Windows\System\eYaoKTq.exe
  C:\Windows\System\eYaoKTq.exe
  2⤵
  PID:6760
- C:\Windows\System\RGWzcCn.exe
  C:\Windows\System\RGWzcCn.exe
  2⤵
  PID:6776
- C:\Windows\System\WVpyjXM.exe
  C:\Windows\System\WVpyjXM.exe
  2⤵
  PID:6792
- C:\Windows\System\rqlxCFe.exe
  C:\Windows\System\rqlxCFe.exe
  2⤵
  PID:6808
- C:\Windows\System\yYzPkVl.exe
  C:\Windows\System\yYzPkVl.exe
  2⤵
  PID:6824
- C:\Windows\System\NhwGpaQ.exe
  C:\Windows\System\NhwGpaQ.exe
  2⤵
  PID:6840
- C:\Windows\System\blHRJvC.exe
  C:\Windows\System\blHRJvC.exe
  2⤵
  PID:6856
- C:\Windows\System\SWJuxSN.exe
  C:\Windows\System\SWJuxSN.exe
  2⤵
  PID:6872
- C:\Windows\System\beubxlO.exe
  C:\Windows\System\beubxlO.exe
  2⤵
  PID:6888
- C:\Windows\System\ARDISKg.exe
  C:\Windows\System\ARDISKg.exe
  2⤵
  PID:6904
- C:\Windows\System\wvlIoBj.exe
  C:\Windows\System\wvlIoBj.exe
  2⤵
  PID:6920
- C:\Windows\System\kZHOIcH.exe
  C:\Windows\System\kZHOIcH.exe
  2⤵
  PID:6936
- C:\Windows\System\VZTzWqE.exe
  C:\Windows\System\VZTzWqE.exe
  2⤵
  PID:6952
- C:\Windows\System\JlJzYQu.exe
  C:\Windows\System\JlJzYQu.exe
  2⤵
  PID:6968
- C:\Windows\System\jzxrcOA.exe
  C:\Windows\System\jzxrcOA.exe
  2⤵
  PID:6988
- C:\Windows\System\bQszSZc.exe
  C:\Windows\System\bQszSZc.exe
  2⤵
  PID:7004
- C:\Windows\System\AciBjon.exe
  C:\Windows\System\AciBjon.exe
  2⤵
  PID:7020
- C:\Windows\System\UiRHmHp.exe
  C:\Windows\System\UiRHmHp.exe
  2⤵
  PID:7036
- C:\Windows\System\gOWKTyG.exe
  C:\Windows\System\gOWKTyG.exe
  2⤵
  PID:7052
- C:\Windows\System\hVunRVo.exe
  C:\Windows\System\hVunRVo.exe
  2⤵
  PID:7068
- C:\Windows\System\mnOpAgx.exe
  C:\Windows\System\mnOpAgx.exe
  2⤵
  PID:7084
- C:\Windows\System\IUTNzDD.exe
  C:\Windows\System\IUTNzDD.exe
  2⤵
  PID:7104
- C:\Windows\System\NZOBKMm.exe
  C:\Windows\System\NZOBKMm.exe
  2⤵
  PID:7120
- C:\Windows\System\UHZqZLW.exe
  C:\Windows\System\UHZqZLW.exe
  2⤵
  PID:7136
- C:\Windows\System\YlTGdRT.exe
  C:\Windows\System\YlTGdRT.exe
  2⤵
  PID:7152
- C:\Windows\System\JJmPMnS.exe
  C:\Windows\System\JJmPMnS.exe
  2⤵
  PID:6152
- C:\Windows\System\yLdRqXD.exe
  C:\Windows\System\yLdRqXD.exe
  2⤵
  PID:6216
- C:\Windows\System\urtdgBQ.exe
  C:\Windows\System\urtdgBQ.exe
  2⤵
  PID:6284
- C:\Windows\System\YAyGdGJ.exe
  C:\Windows\System\YAyGdGJ.exe
  2⤵
  PID:6348
- C:\Windows\System\malJFsn.exe
  C:\Windows\System\malJFsn.exe
  2⤵
  PID:6136
- C:\Windows\System\ZXGWAIM.exe
  C:\Windows\System\ZXGWAIM.exe
  2⤵
  PID:5960
- C:\Windows\System\sdqqWGg.exe
  C:\Windows\System\sdqqWGg.exe
  2⤵
  PID:6172
- C:\Windows\System\vkxEUfT.exe
  C:\Windows\System\vkxEUfT.exe
  2⤵
  PID:6240
- C:\Windows\System\MHMPNnM.exe
  C:\Windows\System\MHMPNnM.exe
  2⤵
  PID:6304
- C:\Windows\System\mbMLLEF.exe
  C:\Windows\System\mbMLLEF.exe
  2⤵
  PID:6368
- C:\Windows\System\XMCGegp.exe
  C:\Windows\System\XMCGegp.exe
  2⤵
  PID:6448
- C:\Windows\System\UZcBfvV.exe
  C:\Windows\System\UZcBfvV.exe
  2⤵
  PID:6468
- C:\Windows\System\pTKBTvA.exe
  C:\Windows\System\pTKBTvA.exe
  2⤵
  PID:6492
- C:\Windows\System\UJPEXLc.exe
  C:\Windows\System\UJPEXLc.exe
  2⤵
  PID:6512
- C:\Windows\System\rdBXKLW.exe
  C:\Windows\System\rdBXKLW.exe
  2⤵
  PID:6524
- C:\Windows\System\LBpsVSI.exe
  C:\Windows\System\LBpsVSI.exe
  2⤵
  PID:6544
- C:\Windows\System\EGNWfzt.exe
  C:\Windows\System\EGNWfzt.exe
  2⤵
  PID:6568
- C:\Windows\System\UkbwPgP.exe
  C:\Windows\System\UkbwPgP.exe
  2⤵
  PID:6576
- C:\Windows\System\VZgKCOC.exe
  C:\Windows\System\VZgKCOC.exe
  2⤵
  PID:6600
- C:\Windows\System\XhBNbKx.exe
  C:\Windows\System\XhBNbKx.exe
  2⤵
  PID:6788
- C:\Windows\System\mSgfVZL.exe
  C:\Windows\System\mSgfVZL.exe
  2⤵
  PID:6852
- C:\Windows\System\VlBZYLR.exe
  C:\Windows\System\VlBZYLR.exe
  2⤵
  PID:6916
- C:\Windows\System\LZgNEwR.exe
  C:\Windows\System\LZgNEwR.exe
  2⤵
  PID:6608
- C:\Windows\System\TyVhLGO.exe
  C:\Windows\System\TyVhLGO.exe
  2⤵
  PID:7016
- C:\Windows\System\qPQqkkl.exe
  C:\Windows\System\qPQqkkl.exe
  2⤵
  PID:6708
- C:\Windows\System\RAfvBTU.exe
  C:\Windows\System\RAfvBTU.exe
  2⤵
  PID:7144
- C:\Windows\System\rRIGIxv.exe
  C:\Windows\System\rRIGIxv.exe
  2⤵
  PID:6316
- C:\Windows\System\ByRFYoy.exe
  C:\Windows\System\ByRFYoy.exe
  2⤵
  PID:6204
- C:\Windows\System\dVqMZKm.exe
  C:\Windows\System\dVqMZKm.exe
  2⤵
  PID:6372
- C:\Windows\System\hFCpQYk.exe
  C:\Windows\System\hFCpQYk.exe
  2⤵
  PID:6364
- C:\Windows\System\PtGfZIw.exe
  C:\Windows\System\PtGfZIw.exe
  2⤵
  PID:6536
- C:\Windows\System\ZIudYGw.exe
  C:\Windows\System\ZIudYGw.exe
  2⤵
  PID:6564
- C:\Windows\System\GJVrijS.exe
  C:\Windows\System\GJVrijS.exe
  2⤵
  PID:6784
- C:\Windows\System\EZBxmsX.exe
  C:\Windows\System\EZBxmsX.exe
  2⤵
  PID:6704
- C:\Windows\System\dBxCcTv.exe
  C:\Windows\System\dBxCcTv.exe
  2⤵
  PID:6352
- C:\Windows\System\VHOGNxo.exe
  C:\Windows\System\VHOGNxo.exe
  2⤵
  PID:6740
- C:\Windows\System\TieygBD.exe
  C:\Windows\System\TieygBD.exe
  2⤵
  PID:6896
- C:\Windows\System\CBpJRcO.exe
  C:\Windows\System\CBpJRcO.exe
  2⤵
  PID:6656
- C:\Windows\System\WVqXcNc.exe
  C:\Windows\System\WVqXcNc.exe
  2⤵
  PID:7076
- C:\Windows\System\QJwYPIJ.exe
  C:\Windows\System\QJwYPIJ.exe
  2⤵
  PID:6672
- C:\Windows\System\bpYipSA.exe
  C:\Windows\System\bpYipSA.exe
  2⤵
  PID:7116
- C:\Windows\System\MYtqfWX.exe
  C:\Windows\System\MYtqfWX.exe
  2⤵
  PID:7000
- C:\Windows\System\DjAvwcD.exe
  C:\Windows\System\DjAvwcD.exe
  2⤵
  PID:7100
- C:\Windows\System\pTAJKyX.exe
  C:\Windows\System\pTAJKyX.exe
  2⤵
  PID:6272
- C:\Windows\System\dkeOZSM.exe
  C:\Windows\System\dkeOZSM.exe
  2⤵
  PID:6480
- C:\Windows\System\uvXpciB.exe
  C:\Windows\System\uvXpciB.exe
  2⤵
  PID:6836
- C:\Windows\System\qSTqFCg.exe
  C:\Windows\System\qSTqFCg.exe
  2⤵
  PID:6932
- C:\Windows\System\KJthgop.exe
  C:\Windows\System\KJthgop.exe
  2⤵
  PID:7064
- C:\Windows\System\KhbGRrf.exe
  C:\Windows\System\KhbGRrf.exe
  2⤵
  PID:7164
- C:\Windows\System\GWfPJBq.exe
  C:\Windows\System\GWfPJBq.exe
  2⤵
  PID:5152
- C:\Windows\System\MRCRUyY.exe
  C:\Windows\System\MRCRUyY.exe
  2⤵
  PID:6528
- C:\Windows\System\gHqhZWj.exe
  C:\Windows\System\gHqhZWj.exe
  2⤵
  PID:6752
- C:\Windows\System\BjAxmXB.exe
  C:\Windows\System\BjAxmXB.exe
  2⤵
  PID:7080
- C:\Windows\System\CIhDimP.exe
  C:\Windows\System\CIhDimP.exe
  2⤵
  PID:6432
- C:\Windows\System\bDGIaRL.exe
  C:\Windows\System\bDGIaRL.exe
  2⤵
  PID:6560
- C:\Windows\System\meMeyLQ.exe
  C:\Windows\System\meMeyLQ.exe
  2⤵
  PID:6720
- C:\Windows\System\UfObEan.exe
  C:\Windows\System\UfObEan.exe
  2⤵
  PID:6336
- C:\Windows\System\nSTvKDV.exe
  C:\Windows\System\nSTvKDV.exe
  2⤵
  PID:7012
- C:\Windows\System\LrbkMJS.exe
  C:\Windows\System\LrbkMJS.exe
  2⤵
  PID:6984
- C:\Windows\System\VuftngJ.exe
  C:\Windows\System\VuftngJ.exe
  2⤵
  PID:6640
- C:\Windows\System\ZGvPISr.exe
  C:\Windows\System\ZGvPISr.exe
  2⤵
  PID:6644
- C:\Windows\System\HdtmXRE.exe
  C:\Windows\System\HdtmXRE.exe
  2⤵
  PID:6948
- C:\Windows\System\SPkytxd.exe
  C:\Windows\System\SPkytxd.exe
  2⤵
  PID:6584
- C:\Windows\System\LTParcd.exe
  C:\Windows\System\LTParcd.exe
  2⤵
  PID:6900
- C:\Windows\System\qMVDIYK.exe
  C:\Windows\System\qMVDIYK.exe
  2⤵
  PID:6520
- C:\Windows\System\NSreBAy.exe
  C:\Windows\System\NSreBAy.exe
  2⤵
  PID:6184
- C:\Windows\System\ISqAbnV.exe
  C:\Windows\System\ISqAbnV.exe
  2⤵
  PID:6168
- C:\Windows\System\raBPaGn.exe
  C:\Windows\System\raBPaGn.exe
  2⤵
  PID:6680
- C:\Windows\System\IoWXkkA.exe
  C:\Windows\System\IoWXkkA.exe
  2⤵
  PID:7048
- C:\Windows\System\ytFGaMc.exe
  C:\Windows\System\ytFGaMc.exe
  2⤵
  PID:6508
- C:\Windows\System\gUtKFDS.exe
  C:\Windows\System\gUtKFDS.exe
  2⤵
  PID:7060
- C:\Windows\System\GipXfBk.exe
  C:\Windows\System\GipXfBk.exe
  2⤵
  PID:6128
- C:\Windows\System\QAJGOvR.exe
  C:\Windows\System\QAJGOvR.exe
  2⤵
  PID:6928
- C:\Windows\System\waIqDUu.exe
  C:\Windows\System\waIqDUu.exe
  2⤵
  PID:6756
- C:\Windows\System\yAghwTz.exe
  C:\Windows\System\yAghwTz.exe
  2⤵
  PID:7184
- C:\Windows\System\IcWSGMZ.exe
  C:\Windows\System\IcWSGMZ.exe
  2⤵
  PID:7200
- C:\Windows\System\BDSgiYL.exe
  C:\Windows\System\BDSgiYL.exe
  2⤵
  PID:7216
- C:\Windows\System\snEkJEK.exe
  C:\Windows\System\snEkJEK.exe
  2⤵
  PID:7232
- C:\Windows\System\MUkpEEq.exe
  C:\Windows\System\MUkpEEq.exe
  2⤵
  PID:7248
- C:\Windows\System\YvErUhL.exe
  C:\Windows\System\YvErUhL.exe
  2⤵
  PID:7264
- C:\Windows\System\aGOSHeC.exe
  C:\Windows\System\aGOSHeC.exe
  2⤵
  PID:7284
- C:\Windows\System\xBXfXjW.exe
  C:\Windows\System\xBXfXjW.exe
  2⤵
  PID:7300
- C:\Windows\System\mhsVbCO.exe
  C:\Windows\System\mhsVbCO.exe
  2⤵
  PID:7316
- C:\Windows\System\MxKbQYX.exe
  C:\Windows\System\MxKbQYX.exe
  2⤵
  PID:7336
- C:\Windows\System\JHmWnoE.exe
  C:\Windows\System\JHmWnoE.exe
  2⤵
  PID:7352
- C:\Windows\System\zVcWhmw.exe
  C:\Windows\System\zVcWhmw.exe
  2⤵
  PID:7368
- C:\Windows\System\oSibATI.exe
  C:\Windows\System\oSibATI.exe
  2⤵
  PID:7384
- C:\Windows\System\tBQpIXt.exe
  C:\Windows\System\tBQpIXt.exe
  2⤵
  PID:7400
- C:\Windows\System\tirXROX.exe
  C:\Windows\System\tirXROX.exe
  2⤵
  PID:7416
- C:\Windows\System\xYEGNUE.exe
  C:\Windows\System\xYEGNUE.exe
  2⤵
  PID:7432
- C:\Windows\System\BKVtDpi.exe
  C:\Windows\System\BKVtDpi.exe
  2⤵
  PID:7448
- C:\Windows\System\QZaUJtf.exe
  C:\Windows\System\QZaUJtf.exe
  2⤵
  PID:7464
- C:\Windows\System\fMfuobl.exe
  C:\Windows\System\fMfuobl.exe
  2⤵
  PID:7480
- C:\Windows\System\AJzRcPs.exe
  C:\Windows\System\AJzRcPs.exe
  2⤵
  PID:7496
- C:\Windows\System\JZypOmk.exe
  C:\Windows\System\JZypOmk.exe
  2⤵
  PID:7512
- C:\Windows\System\vtmWaFi.exe
  C:\Windows\System\vtmWaFi.exe
  2⤵
  PID:7528
- C:\Windows\System\XblJoRg.exe
  C:\Windows\System\XblJoRg.exe
  2⤵
  PID:7544
- C:\Windows\System\szxLdza.exe
  C:\Windows\System\szxLdza.exe
  2⤵
  PID:7560
- C:\Windows\System\IeLoSfb.exe
  C:\Windows\System\IeLoSfb.exe
  2⤵
  PID:7576
- C:\Windows\System\WyUgNYV.exe
  C:\Windows\System\WyUgNYV.exe
  2⤵
  PID:7592
- C:\Windows\System\dbfcPww.exe
  C:\Windows\System\dbfcPww.exe
  2⤵
  PID:7608
- C:\Windows\System\LKvRfAu.exe
  C:\Windows\System\LKvRfAu.exe
  2⤵
  PID:7624
- C:\Windows\System\omwjawS.exe
  C:\Windows\System\omwjawS.exe
  2⤵
  PID:7640
- C:\Windows\System\cLxWwAs.exe
  C:\Windows\System\cLxWwAs.exe
  2⤵
  PID:7656
- C:\Windows\System\dkzOtVF.exe
  C:\Windows\System\dkzOtVF.exe
  2⤵
  PID:7676
- C:\Windows\System\vWFLZPB.exe
  C:\Windows\System\vWFLZPB.exe
  2⤵
  PID:7692
- C:\Windows\System\ZrpkGXV.exe
  C:\Windows\System\ZrpkGXV.exe
  2⤵
  PID:7708
- C:\Windows\System\RXHYugo.exe
  C:\Windows\System\RXHYugo.exe
  2⤵
  PID:7724
- C:\Windows\System\iZbEuKh.exe
  C:\Windows\System\iZbEuKh.exe
  2⤵
  PID:7740
- C:\Windows\System\nGlcgxe.exe
  C:\Windows\System\nGlcgxe.exe
  2⤵
  PID:7756
- C:\Windows\System\PcCGMkC.exe
  C:\Windows\System\PcCGMkC.exe
  2⤵
  PID:7772
- C:\Windows\System\SGTGGjo.exe
  C:\Windows\System\SGTGGjo.exe
  2⤵
  PID:7788
- C:\Windows\System\ElAohKN.exe
  C:\Windows\System\ElAohKN.exe
  2⤵
  PID:7804
- C:\Windows\System\FSVmcrt.exe
  C:\Windows\System\FSVmcrt.exe
  2⤵
  PID:7820
- C:\Windows\System\valwokC.exe
  C:\Windows\System\valwokC.exe
  2⤵
  PID:7836
- C:\Windows\System\vBuPhCB.exe
  C:\Windows\System\vBuPhCB.exe
  2⤵
  PID:7852
- C:\Windows\System\jmWZZxz.exe
  C:\Windows\System\jmWZZxz.exe
  2⤵
  PID:7868
- C:\Windows\System\jIbCnxz.exe
  C:\Windows\System\jIbCnxz.exe
  2⤵
  PID:7884
- C:\Windows\System\TSOpBPB.exe
  C:\Windows\System\TSOpBPB.exe
  2⤵
  PID:7900
- C:\Windows\System\tidBlhG.exe
  C:\Windows\System\tidBlhG.exe
  2⤵
  PID:7916
- C:\Windows\System\wsngQSF.exe
  C:\Windows\System\wsngQSF.exe
  2⤵
  PID:7932
- C:\Windows\System\XxxYTBq.exe
  C:\Windows\System\XxxYTBq.exe
  2⤵
  PID:7948
- C:\Windows\System\kLYoPlS.exe
  C:\Windows\System\kLYoPlS.exe
  2⤵
  PID:7964
- C:\Windows\System\zspqVKQ.exe
  C:\Windows\System\zspqVKQ.exe
  2⤵
  PID:7980
- C:\Windows\System\YHycFSk.exe
  C:\Windows\System\YHycFSk.exe
  2⤵
  PID:7996
- C:\Windows\System\khXZBFa.exe
  C:\Windows\System\khXZBFa.exe
  2⤵
  PID:8012
- C:\Windows\System\MnAjHQj.exe
  C:\Windows\System\MnAjHQj.exe
  2⤵
  PID:8032
- C:\Windows\System\IaeIUpQ.exe
  C:\Windows\System\IaeIUpQ.exe
  2⤵
  PID:8048
- C:\Windows\System\jGdbKyK.exe
  C:\Windows\System\jGdbKyK.exe
  2⤵
  PID:8064
- C:\Windows\System\XeelKWj.exe
  C:\Windows\System\XeelKWj.exe
  2⤵
  PID:8080
- C:\Windows\System\JTKJnlA.exe
  C:\Windows\System\JTKJnlA.exe
  2⤵
  PID:8096
- C:\Windows\System\ajtdlTY.exe
  C:\Windows\System\ajtdlTY.exe
  2⤵
  PID:8112
- C:\Windows\System\dbvnQLP.exe
  C:\Windows\System\dbvnQLP.exe
  2⤵
  PID:8128
- C:\Windows\System\SFWsEMl.exe
  C:\Windows\System\SFWsEMl.exe
  2⤵
  PID:8144
- C:\Windows\System\fnVnCtf.exe
  C:\Windows\System\fnVnCtf.exe
  2⤵
  PID:8160
- C:\Windows\System\IxYRdjW.exe
  C:\Windows\System\IxYRdjW.exe
  2⤵
  PID:8176
- C:\Windows\System\wpuigUh.exe
  C:\Windows\System\wpuigUh.exe
  2⤵
  PID:5260
- C:\Windows\System\jxFBmNl.exe
  C:\Windows\System\jxFBmNl.exe
  2⤵
  PID:6716
- C:\Windows\System\XiyTjqV.exe
  C:\Windows\System\XiyTjqV.exe
  2⤵
  PID:7296
- C:\Windows\System\IXxjnHc.exe
  C:\Windows\System\IXxjnHc.exe
  2⤵
  PID:7256
- C:\Windows\System\wVlJFeL.exe
  C:\Windows\System\wVlJFeL.exe
  2⤵
  PID:6684
- C:\Windows\System\aDUeTxN.exe
  C:\Windows\System\aDUeTxN.exe
  2⤵
  PID:7396
- C:\Windows\System\JvDYQnC.exe
  C:\Windows\System\JvDYQnC.exe
  2⤵
  PID:7424
- C:\Windows\System\QeRZukf.exe
  C:\Windows\System\QeRZukf.exe
  2⤵
  PID:7308
- C:\Windows\System\spITwKB.exe
  C:\Windows\System\spITwKB.exe
  2⤵
  PID:6676
- C:\Windows\System\lLcqRgB.exe
  C:\Windows\System\lLcqRgB.exe
  2⤵
  PID:7240
- C:\Windows\System\uUgvhuv.exe
  C:\Windows\System\uUgvhuv.exe
  2⤵
  PID:6724
- C:\Windows\System\lsJWIEJ.exe
  C:\Windows\System\lsJWIEJ.exe
  2⤵
  PID:5280
- C:\Windows\System\WVrPiqB.exe
  C:\Windows\System\WVrPiqB.exe
  2⤵
  PID:7312
- C:\Windows\System\LLayKhI.exe
  C:\Windows\System\LLayKhI.exe
  2⤵
  PID:7492
- C:\Windows\System\WWsABMy.exe
  C:\Windows\System\WWsABMy.exe
  2⤵
  PID:7524
- C:\Windows\System\ueTPBDC.exe
  C:\Windows\System\ueTPBDC.exe
  2⤵
  PID:7556
- C:\Windows\System\vkDUleY.exe
  C:\Windows\System\vkDUleY.exe
  2⤵
  PID:7584
- C:\Windows\System\dfCtsTr.exe
  C:\Windows\System\dfCtsTr.exe
  2⤵
  PID:7540
- C:\Windows\System\ZYxODRm.exe
  C:\Windows\System\ZYxODRm.exe
  2⤵
  PID:7684
- C:\Windows\System\HDoLMDs.exe
  C:\Windows\System\HDoLMDs.exe
  2⤵
  PID:7720
- C:\Windows\System\bxkqTth.exe
  C:\Windows\System\bxkqTth.exe
  2⤵
  PID:7700
- C:\Windows\System\mmmYshy.exe
  C:\Windows\System\mmmYshy.exe
  2⤵
  PID:7672
- C:\Windows\System\rVTDeuw.exe
  C:\Windows\System\rVTDeuw.exe
  2⤵
  PID:7780
- C:\Windows\System\jjAqzSS.exe
  C:\Windows\System\jjAqzSS.exe
  2⤵
  PID:7844
- C:\Windows\System\EpWwXAy.exe
  C:\Windows\System\EpWwXAy.exe
  2⤵
  PID:7764
- C:\Windows\System\VYCBdYT.exe
  C:\Windows\System\VYCBdYT.exe
  2⤵
  PID:7848
- C:\Windows\System\JAlQsqU.exe
  C:\Windows\System\JAlQsqU.exe
  2⤵
  PID:7912
- C:\Windows\System\nNvWnQK.exe
  C:\Windows\System\nNvWnQK.exe
  2⤵
  PID:7976
- C:\Windows\System\IFzCbrL.exe
  C:\Windows\System\IFzCbrL.exe
  2⤵
  PID:7860
- C:\Windows\System\OEMphgM.exe
  C:\Windows\System\OEMphgM.exe
  2⤵
  PID:7896
- C:\Windows\System\OSrgHBu.exe
  C:\Windows\System\OSrgHBu.exe
  2⤵
  PID:7988
- C:\Windows\System\CvJkUEt.exe
  C:\Windows\System\CvJkUEt.exe
  2⤵
  PID:8044
- C:\Windows\System\AqLLvNp.exe
  C:\Windows\System\AqLLvNp.exe
  2⤵
  PID:8108
- C:\Windows\System\xhPEluy.exe
  C:\Windows\System\xhPEluy.exe
  2⤵
  PID:8140
- C:\Windows\System\pYOrRyo.exe
  C:\Windows\System\pYOrRyo.exe
  2⤵
  PID:8152
- C:\Windows\System\BqCnEQx.exe
  C:\Windows\System\BqCnEQx.exe
  2⤵
  PID:8092
- C:\Windows\System\iXPhLNT.exe
  C:\Windows\System\iXPhLNT.exe
  2⤵
  PID:8188
- C:\Windows\System\mjLKkrv.exe
  C:\Windows\System\mjLKkrv.exe
  2⤵
  PID:6976
- C:\Windows\System\ormnQIj.exe
  C:\Windows\System\ormnQIj.exe
  2⤵
  PID:7228
- C:\Windows\System\tQshlqt.exe
  C:\Windows\System\tQshlqt.exe
  2⤵
  PID:7176
- C:\Windows\System\mgOjsTC.exe
  C:\Windows\System\mgOjsTC.exe
  2⤵
  PID:7160
- C:\Windows\System\vRxWheM.exe
  C:\Windows\System\vRxWheM.exe
  2⤵
  PID:7244
- C:\Windows\System\kOqxMdl.exe
  C:\Windows\System\kOqxMdl.exe
  2⤵
  PID:7552
- C:\Windows\System\yCbzEND.exe
  C:\Windows\System\yCbzEND.exe
  2⤵
  PID:7716
- C:\Windows\System\Tvbgnih.exe
  C:\Windows\System\Tvbgnih.exe
  2⤵
  PID:7488
- C:\Windows\System\qBRPEjQ.exe
  C:\Windows\System\qBRPEjQ.exe
  2⤵
  PID:7648
- C:\Windows\System\uQQspOv.exe
  C:\Windows\System\uQQspOv.exe
  2⤵
  PID:7668
- C:\Windows\System\zTyfffd.exe
  C:\Windows\System\zTyfffd.exe
  2⤵
  PID:7800
- C:\Windows\System\dsieOFB.exe
  C:\Windows\System\dsieOFB.exe
  2⤵
  PID:7892
- C:\Windows\System\jlsyjdD.exe
  C:\Windows\System\jlsyjdD.exe
  2⤵
  PID:8136
- C:\Windows\System\DkHnaJm.exe
  C:\Windows\System\DkHnaJm.exe
  2⤵
  PID:8088
- C:\Windows\System\mKYAdRX.exe
  C:\Windows\System\mKYAdRX.exe
  2⤵
  PID:7960
- C:\Windows\System\BgkkdtL.exe
  C:\Windows\System\BgkkdtL.exe
  2⤵
  PID:7376
- C:\Windows\System\GUhfcaK.exe
  C:\Windows\System\GUhfcaK.exe
  2⤵
  PID:7832
- C:\Windows\System\mCSATxU.exe
  C:\Windows\System\mCSATxU.exe
  2⤵
  PID:7212
- C:\Windows\System\sPYFeLk.exe
  C:\Windows\System\sPYFeLk.exe
  2⤵
  PID:7812
- C:\Windows\System\gQToSXs.exe
  C:\Windows\System\gQToSXs.exe
  2⤵
  PID:7992
- C:\Windows\System\KNuYeWI.exe
  C:\Windows\System\KNuYeWI.exe
  2⤵
  PID:8172
- C:\Windows\System\HahBPiT.exe
  C:\Windows\System\HahBPiT.exe
  2⤵
  PID:7428
- C:\Windows\System\BsOvCaE.exe
  C:\Windows\System\BsOvCaE.exe
  2⤵
  PID:8040
- C:\Windows\System\QtXZHuy.exe
  C:\Windows\System\QtXZHuy.exe
  2⤵
  PID:7636
- C:\Windows\System\HSPJCsX.exe
  C:\Windows\System\HSPJCsX.exe
  2⤵
  PID:7748
- C:\Windows\System\HRrkRdz.exe
  C:\Windows\System\HRrkRdz.exe
  2⤵
  PID:8076
- C:\Windows\System\zGCaIVV.exe
  C:\Windows\System\zGCaIVV.exe
  2⤵
  PID:7616
- C:\Windows\System\YNdPxPg.exe
  C:\Windows\System\YNdPxPg.exe
  2⤵
  PID:8196
- C:\Windows\System\OzHJzpc.exe
  C:\Windows\System\OzHJzpc.exe
  2⤵
  PID:8212
- C:\Windows\System\fWmTdQd.exe
  C:\Windows\System\fWmTdQd.exe
  2⤵
  PID:8228
- C:\Windows\System\gOaoKUm.exe
  C:\Windows\System\gOaoKUm.exe
  2⤵
  PID:8244
- C:\Windows\System\BoiWQDP.exe
  C:\Windows\System\BoiWQDP.exe
  2⤵
  PID:8260
- C:\Windows\System\OpPXlBd.exe
  C:\Windows\System\OpPXlBd.exe
  2⤵
  PID:8276
- C:\Windows\System\iZkzlLR.exe
  C:\Windows\System\iZkzlLR.exe
  2⤵
  PID:8292
- C:\Windows\System\GkGSdWw.exe
  C:\Windows\System\GkGSdWw.exe
  2⤵
  PID:8308
- C:\Windows\System\yUqUEHD.exe
  C:\Windows\System\yUqUEHD.exe
  2⤵
  PID:8324
- C:\Windows\System\GriORWe.exe
  C:\Windows\System\GriORWe.exe
  2⤵
  PID:8340
- C:\Windows\System\EQDDnFQ.exe
  C:\Windows\System\EQDDnFQ.exe
  2⤵
  PID:8356
- C:\Windows\System\qXpBiBu.exe
  C:\Windows\System\qXpBiBu.exe
  2⤵
  PID:8372
- C:\Windows\System\yREUozA.exe
  C:\Windows\System\yREUozA.exe
  2⤵
  PID:8388
- C:\Windows\System\dHwgkDq.exe
  C:\Windows\System\dHwgkDq.exe
  2⤵
  PID:8404
- C:\Windows\System\cWsntCj.exe
  C:\Windows\System\cWsntCj.exe
  2⤵
  PID:8420
- C:\Windows\System\UQpctir.exe
  C:\Windows\System\UQpctir.exe
  2⤵
  PID:8440
- C:\Windows\System\ROEqWHQ.exe
  C:\Windows\System\ROEqWHQ.exe
  2⤵
  PID:8456
- C:\Windows\System\RSKpMUu.exe
  C:\Windows\System\RSKpMUu.exe
  2⤵
  PID:8472
- C:\Windows\System\SIYbmoH.exe
  C:\Windows\System\SIYbmoH.exe
  2⤵
  PID:8492
- C:\Windows\System\SBYrgbs.exe
  C:\Windows\System\SBYrgbs.exe
  2⤵
  PID:8508
- C:\Windows\System\dgfxFpS.exe
  C:\Windows\System\dgfxFpS.exe
  2⤵
  PID:8524
- C:\Windows\System\BhRWYfo.exe
  C:\Windows\System\BhRWYfo.exe
  2⤵
  PID:8540
- C:\Windows\System\pENjzom.exe
  C:\Windows\System\pENjzom.exe
  2⤵
  PID:8560
- C:\Windows\System\KvpEBwq.exe
  C:\Windows\System\KvpEBwq.exe
  2⤵
  PID:8576
- C:\Windows\System\hvYLcyG.exe
  C:\Windows\System\hvYLcyG.exe
  2⤵
  PID:8596
- C:\Windows\System\JcopMrz.exe
  C:\Windows\System\JcopMrz.exe
  2⤵
  PID:8612
- C:\Windows\System\xHKbCpC.exe
  C:\Windows\System\xHKbCpC.exe
  2⤵
  PID:8628
- C:\Windows\System\YIboMtN.exe
  C:\Windows\System\YIboMtN.exe
  2⤵
  PID:8644
- C:\Windows\System\qVSyiKz.exe
  C:\Windows\System\qVSyiKz.exe
  2⤵
  PID:8664
- C:\Windows\System\yUsnETj.exe
  C:\Windows\System\yUsnETj.exe
  2⤵
  PID:8680
- C:\Windows\System\QiWGhAq.exe
  C:\Windows\System\QiWGhAq.exe
  2⤵
  PID:8696
- C:\Windows\System\SJRYVTf.exe
  C:\Windows\System\SJRYVTf.exe
  2⤵
  PID:8712
- C:\Windows\System\eUFYfGs.exe
  C:\Windows\System\eUFYfGs.exe
  2⤵
  PID:8728
- C:\Windows\System\wDyyvSO.exe
  C:\Windows\System\wDyyvSO.exe
  2⤵
  PID:8768
- C:\Windows\System\cGqwbUh.exe
  C:\Windows\System\cGqwbUh.exe
  2⤵
  PID:8784
- C:\Windows\System\VkXrIKt.exe
  C:\Windows\System\VkXrIKt.exe
  2⤵
  PID:8800
- C:\Windows\System\ELGMgzb.exe
  C:\Windows\System\ELGMgzb.exe
  2⤵
  PID:8816
- C:\Windows\System\vaMKVBS.exe
  C:\Windows\System\vaMKVBS.exe
  2⤵
  PID:8832
- C:\Windows\System\uhskPxU.exe
  C:\Windows\System\uhskPxU.exe
  2⤵
  PID:8848
- C:\Windows\System\OUUzgoO.exe
  C:\Windows\System\OUUzgoO.exe
  2⤵
  PID:8864
- C:\Windows\System\IWVyBmW.exe
  C:\Windows\System\IWVyBmW.exe
  2⤵
  PID:8884
- C:\Windows\System\inlaQXN.exe
  C:\Windows\System\inlaQXN.exe
  2⤵
  PID:8900
- C:\Windows\System\nPHVYCd.exe
  C:\Windows\System\nPHVYCd.exe
  2⤵
  PID:8916
- C:\Windows\System\NrBylNT.exe
  C:\Windows\System\NrBylNT.exe
  2⤵
  PID:8932
- C:\Windows\System\GSKSmwI.exe
  C:\Windows\System\GSKSmwI.exe
  2⤵
  PID:8948
- C:\Windows\System\XbiSmFe.exe
  C:\Windows\System\XbiSmFe.exe
  2⤵
  PID:8964
- C:\Windows\System\KamjsfX.exe
  C:\Windows\System\KamjsfX.exe
  2⤵
  PID:8980
- C:\Windows\System\jbxImxN.exe
  C:\Windows\System\jbxImxN.exe
  2⤵
  PID:8996
- C:\Windows\System\hcdJbdx.exe
  C:\Windows\System\hcdJbdx.exe
  2⤵
  PID:9012
- C:\Windows\System\KLMMMHX.exe
  C:\Windows\System\KLMMMHX.exe
  2⤵
  PID:9028
- C:\Windows\System\IHyZmIk.exe
  C:\Windows\System\IHyZmIk.exe
  2⤵
  PID:9044
- C:\Windows\System\FfYqmCo.exe
  C:\Windows\System\FfYqmCo.exe
  2⤵
  PID:9060
- C:\Windows\System\MEZWSPO.exe
  C:\Windows\System\MEZWSPO.exe
  2⤵
  PID:9076
- C:\Windows\System\zIFcetb.exe
  C:\Windows\System\zIFcetb.exe
  2⤵
  PID:9092
- C:\Windows\System\sVwRlbE.exe
  C:\Windows\System\sVwRlbE.exe
  2⤵
  PID:9108
- C:\Windows\System\JSFdAAB.exe
  C:\Windows\System\JSFdAAB.exe
  2⤵
  PID:9124
- C:\Windows\System\eWtKttm.exe
  C:\Windows\System\eWtKttm.exe
  2⤵
  PID:9140
- C:\Windows\System\wDPbErg.exe
  C:\Windows\System\wDPbErg.exe
  2⤵
  PID:9156
- C:\Windows\System\zTTTkTY.exe
  C:\Windows\System\zTTTkTY.exe
  2⤵
  PID:9172
- C:\Windows\System\QBlyxKX.exe
  C:\Windows\System\QBlyxKX.exe
  2⤵
  PID:9188
- C:\Windows\System\UEVbfsz.exe
  C:\Windows\System\UEVbfsz.exe
  2⤵
  PID:9204
- C:\Windows\System\ThbkZXb.exe
  C:\Windows\System\ThbkZXb.exe
  2⤵
  PID:8204
- C:\Windows\System\PmhWSSb.exe
  C:\Windows\System\PmhWSSb.exe
  2⤵
  PID:7332
- C:\Windows\System\YBTpLrF.exe
  C:\Windows\System\YBTpLrF.exe
  2⤵
  PID:7944
- C:\Windows\System\VtZhAbj.exe
  C:\Windows\System\VtZhAbj.exe
  2⤵
  PID:6388
- C:\Windows\System\tEGRPCd.exe
  C:\Windows\System\tEGRPCd.exe
  2⤵
  PID:8008
- C:\Windows\System\oIeyjOS.exe
  C:\Windows\System\oIeyjOS.exe
  2⤵
  PID:7280
- C:\Windows\System\MsDDDqE.exe
  C:\Windows\System\MsDDDqE.exe
  2⤵
  PID:8024
- C:\Windows\System\HhrBLjJ.exe
  C:\Windows\System\HhrBLjJ.exe
  2⤵
  PID:8304
- C:\Windows\System\VdxaDpT.exe
  C:\Windows\System\VdxaDpT.exe
  2⤵
  PID:8320
- C:\Windows\System\nvqDRNP.exe
  C:\Windows\System\nvqDRNP.exe
  2⤵
  PID:8352
- C:\Windows\System\mXudUUT.exe
  C:\Windows\System\mXudUUT.exe
  2⤵
  PID:8396
- C:\Windows\System\grqGaXt.exe
  C:\Windows\System\grqGaXt.exe
  2⤵
  PID:8436
- C:\Windows\System\fceXvWH.exe
  C:\Windows\System\fceXvWH.exe
  2⤵
  PID:8448
- C:\Windows\System\MSVGqIr.exe
  C:\Windows\System\MSVGqIr.exe
  2⤵
  PID:8480
- C:\Windows\System\bmNKJQS.exe
  C:\Windows\System\bmNKJQS.exe
  2⤵
  PID:8504
- C:\Windows\System\rabbrIA.exe
  C:\Windows\System\rabbrIA.exe
  2⤵
  PID:8568
- C:\Windows\System\NMYpRdB.exe
  C:\Windows\System\NMYpRdB.exe
  2⤵
  PID:8556
- C:\Windows\System\GmFSbCL.exe
  C:\Windows\System\GmFSbCL.exe
  2⤵
  PID:8592
- C:\Windows\System\NcygXGy.exe
  C:\Windows\System\NcygXGy.exe
  2⤵
  PID:8620
- C:\Windows\System\woeNiSb.exe
  C:\Windows\System\woeNiSb.exe
  2⤵
  PID:8672
- C:\Windows\System\MJyGzaX.exe
  C:\Windows\System\MJyGzaX.exe
  2⤵
  PID:8736
- C:\Windows\System\SumVBjh.exe
  C:\Windows\System\SumVBjh.exe
  2⤵
  PID:8692
- C:\Windows\System\VadEPZv.exe
  C:\Windows\System\VadEPZv.exe
  2⤵
  PID:8752
- C:\Windows\System\OgmfImc.exe
  C:\Windows\System\OgmfImc.exe
  2⤵
  PID:8764
- C:\Windows\System\fygmkRQ.exe
  C:\Windows\System\fygmkRQ.exe
  2⤵
  PID:8828
- C:\Windows\System\PTkrKXI.exe
  C:\Windows\System\PTkrKXI.exe
  2⤵
  PID:8896
- C:\Windows\System\SQaJrdb.exe
  C:\Windows\System\SQaJrdb.exe
  2⤵
  PID:8940
- C:\Windows\System\ytXHAMd.exe
  C:\Windows\System\ytXHAMd.exe
  2⤵
  PID:8812
- C:\Windows\System\SlYgxfv.exe
  C:\Windows\System\SlYgxfv.exe
  2⤵
  PID:8988
- C:\Windows\System\OsSlYgV.exe
  C:\Windows\System\OsSlYgV.exe
  2⤵
  PID:8912
- C:\Windows\System\CDgcWZo.exe
  C:\Windows\System\CDgcWZo.exe
  2⤵
  PID:8976
- C:\Windows\System\mDAkGEU.exe
  C:\Windows\System\mDAkGEU.exe
  2⤵
  PID:9052
- C:\Windows\System\dmDsOer.exe
  C:\Windows\System\dmDsOer.exe
  2⤵
  PID:9084
- C:\Windows\System\iGoMBkx.exe
  C:\Windows\System\iGoMBkx.exe
  2⤵
  PID:9116
- C:\Windows\System\xMcairu.exe
  C:\Windows\System\xMcairu.exe
  2⤵
  PID:9104
- C:\Windows\System\ZOXyBpa.exe
  C:\Windows\System\ZOXyBpa.exe
  2⤵
  PID:9136
- C:\Windows\System\PAqhvcN.exe
  C:\Windows\System\PAqhvcN.exe
  2⤵
  PID:9212
- C:\Windows\System\gqFJWii.exe
  C:\Windows\System\gqFJWii.exe
  2⤵
  PID:7972
- C:\Windows\System\pKJMHFD.exe
  C:\Windows\System\pKJMHFD.exe
  2⤵
  PID:8220
- C:\Windows\System\MphqNiT.exe
  C:\Windows\System\MphqNiT.exe
  2⤵
  PID:8316
- C:\Windows\System\bmwsFPu.exe
  C:\Windows\System\bmwsFPu.exe
  2⤵
  PID:8380
- C:\Windows\System\rLmrsrH.exe
  C:\Windows\System\rLmrsrH.exe
  2⤵
  PID:8500
- C:\Windows\System\NCbgCCR.exe
  C:\Windows\System\NCbgCCR.exe
  2⤵
  PID:8536
- C:\Windows\System\apODQKR.exe
  C:\Windows\System\apODQKR.exe
  2⤵
  PID:8300
- C:\Windows\System\YBPwyWd.exe
  C:\Windows\System\YBPwyWd.exe
  2⤵
  PID:8608
- C:\Windows\System\EBDHEff.exe
  C:\Windows\System\EBDHEff.exe
  2⤵
  PID:7472
- C:\Windows\System\QTBvUTm.exe
  C:\Windows\System\QTBvUTm.exe
  2⤵
  PID:8532
- C:\Windows\System\KeaiVVc.exe
  C:\Windows\System\KeaiVVc.exe
  2⤵
  PID:8588
- C:\Windows\System\vvipbTx.exe
  C:\Windows\System\vvipbTx.exe
  2⤵
  PID:8824
- C:\Windows\System\qjpOpGn.exe
  C:\Windows\System\qjpOpGn.exe
  2⤵
  PID:8760
- C:\Windows\System\BXTbiyO.exe
  C:\Windows\System\BXTbiyO.exe
  2⤵
  PID:8928
- C:\Windows\System\ivyDyqk.exe
  C:\Windows\System\ivyDyqk.exe
  2⤵
  PID:8780
- C:\Windows\System\rWNbQGW.exe
  C:\Windows\System\rWNbQGW.exe
  2⤵
  PID:7572
- C:\Windows\System\jgEZhXf.exe
  C:\Windows\System\jgEZhXf.exe
  2⤵
  PID:8876
- C:\Windows\System\AUFFGFN.exe
  C:\Windows\System\AUFFGFN.exe
  2⤵
  PID:8880
- C:\Windows\System\GFFXHJL.exe
  C:\Windows\System\GFFXHJL.exe
  2⤵
  PID:8240
- C:\Windows\System\GFFnklF.exe
  C:\Windows\System\GFFnklF.exe
  2⤵
  PID:7796
- C:\Windows\System\GIMMGzL.exe
  C:\Windows\System\GIMMGzL.exe
  2⤵
  PID:8892
- C:\Windows\System\MetPStL.exe
  C:\Windows\System\MetPStL.exe
  2⤵
  PID:8972
- C:\Windows\System\XfJMaUz.exe
  C:\Windows\System\XfJMaUz.exe
  2⤵
  PID:8660
- C:\Windows\System\vVRcrmn.exe
  C:\Windows\System\vVRcrmn.exe
  2⤵
  PID:8956
- C:\Windows\System\iZdooEd.exe
  C:\Windows\System\iZdooEd.exe
  2⤵
  PID:9132
- C:\Windows\System\wNgiPAB.exe
  C:\Windows\System\wNgiPAB.exe
  2⤵
  PID:9200
- C:\Windows\System\PMvLTWA.exe
  C:\Windows\System\PMvLTWA.exe
  2⤵
  PID:8060
- C:\Windows\System\RKtSwlT.exe
  C:\Windows\System\RKtSwlT.exe
  2⤵
  PID:8348
- C:\Windows\System\nQVpeth.exe
  C:\Windows\System\nQVpeth.exe
  2⤵
  PID:8796
- C:\Windows\System\oNbvXsD.exe
  C:\Windows\System\oNbvXsD.exe
  2⤵
  PID:8452
- C:\Windows\System\WweDKBI.exe
  C:\Windows\System\WweDKBI.exe
  2⤵
  PID:7736
- C:\Windows\System\synqQYS.exe
  C:\Windows\System\synqQYS.exe
  2⤵
  PID:9068
- C:\Windows\System\MOsAasE.exe
  C:\Windows\System\MOsAasE.exe
  2⤵
  PID:8756
- C:\Windows\System\MuueDis.exe
  C:\Windows\System\MuueDis.exe
  2⤵
  PID:8708
- C:\Windows\System\oTjaSzM.exe
  C:\Windows\System\oTjaSzM.exe
  2⤵
  PID:8332
- C:\Windows\System\FmnAeIV.exe
  C:\Windows\System\FmnAeIV.exe
  2⤵
  PID:8384
- C:\Windows\System\QoxHbYs.exe
  C:\Windows\System\QoxHbYs.exe
  2⤵
  PID:9120
- C:\Windows\System\cbBfbWK.exe
  C:\Windows\System\cbBfbWK.exe
  2⤵
  PID:9228
- C:\Windows\System\fljQvwW.exe
  C:\Windows\System\fljQvwW.exe
  2⤵
  PID:9244
- C:\Windows\System\roCkDXr.exe
  C:\Windows\System\roCkDXr.exe
  2⤵
  PID:9260
- C:\Windows\System\OJLMIrH.exe
  C:\Windows\System\OJLMIrH.exe
  2⤵
  PID:9276
- C:\Windows\System\hUzeDBB.exe
  C:\Windows\System\hUzeDBB.exe
  2⤵
  PID:9292
- C:\Windows\System\XxGseFN.exe
  C:\Windows\System\XxGseFN.exe
  2⤵
  PID:9308
- C:\Windows\System\sDotPzo.exe
  C:\Windows\System\sDotPzo.exe
  2⤵
  PID:9324
- C:\Windows\System\cZDCTjD.exe
  C:\Windows\System\cZDCTjD.exe
  2⤵
  PID:9340
- C:\Windows\System\gVijoBC.exe
  C:\Windows\System\gVijoBC.exe
  2⤵
  PID:9356
- C:\Windows\System\zVecDmO.exe
  C:\Windows\System\zVecDmO.exe
  2⤵
  PID:9372
- C:\Windows\System\NrsPIKM.exe
  C:\Windows\System\NrsPIKM.exe
  2⤵
  PID:9388
- C:\Windows\System\IVfDdSN.exe
  C:\Windows\System\IVfDdSN.exe
  2⤵
  PID:9404
- C:\Windows\System\svKxwdt.exe
  C:\Windows\System\svKxwdt.exe
  2⤵
  PID:9420
- C:\Windows\System\YeUTIGQ.exe
  C:\Windows\System\YeUTIGQ.exe
  2⤵
  PID:9436
- C:\Windows\System\fNRYlWM.exe
  C:\Windows\System\fNRYlWM.exe
  2⤵
  PID:9452
- C:\Windows\System\dRQkcAd.exe
  C:\Windows\System\dRQkcAd.exe
  2⤵
  PID:9468
- C:\Windows\System\MzBcZtu.exe
  C:\Windows\System\MzBcZtu.exe
  2⤵
  PID:9484
- C:\Windows\System\QqDUypk.exe
  C:\Windows\System\QqDUypk.exe
  2⤵
  PID:9500
- C:\Windows\System\jFJZYJG.exe
  C:\Windows\System\jFJZYJG.exe
  2⤵
  PID:9516
- C:\Windows\System\SvxSbzt.exe
  C:\Windows\System\SvxSbzt.exe
  2⤵
  PID:9532
- C:\Windows\System\DBeUjWC.exe
  C:\Windows\System\DBeUjWC.exe
  2⤵
  PID:9548
- C:\Windows\System\QfShCaP.exe
  C:\Windows\System\QfShCaP.exe
  2⤵
  PID:9564
- C:\Windows\System\eZlHZZc.exe
  C:\Windows\System\eZlHZZc.exe
  2⤵
  PID:9580
- C:\Windows\System\UVenMSf.exe
  C:\Windows\System\UVenMSf.exe
  2⤵
  PID:9596
- C:\Windows\System\BZJzARq.exe
  C:\Windows\System\BZJzARq.exe
  2⤵
  PID:9612
- C:\Windows\System\MTXkZCX.exe
  C:\Windows\System\MTXkZCX.exe
  2⤵
  PID:9628
- C:\Windows\System\KJHodHk.exe
  C:\Windows\System\KJHodHk.exe
  2⤵
  PID:9644
- C:\Windows\System\nADEcsZ.exe
  C:\Windows\System\nADEcsZ.exe
  2⤵
  PID:9660
- C:\Windows\System\lQQRvyB.exe
  C:\Windows\System\lQQRvyB.exe
  2⤵
  PID:9676
- C:\Windows\System\ewSruEp.exe
  C:\Windows\System\ewSruEp.exe
  2⤵
  PID:9692
- C:\Windows\System\EYbSJIv.exe
  C:\Windows\System\EYbSJIv.exe
  2⤵
  PID:9708
- C:\Windows\System\EoilXca.exe
  C:\Windows\System\EoilXca.exe
  2⤵
  PID:9724
- C:\Windows\System\CqSDFcN.exe
  C:\Windows\System\CqSDFcN.exe
  2⤵
  PID:9740
- C:\Windows\System\lfjvekH.exe
  C:\Windows\System\lfjvekH.exe
  2⤵
  PID:9756
- C:\Windows\System\vjqJRCJ.exe
  C:\Windows\System\vjqJRCJ.exe
  2⤵
  PID:9772
- C:\Windows\System\TylMZfV.exe
  C:\Windows\System\TylMZfV.exe
  2⤵
  PID:9788
- C:\Windows\System\IfhABep.exe
  C:\Windows\System\IfhABep.exe
  2⤵
  PID:9804
- C:\Windows\System\xggVcGm.exe
  C:\Windows\System\xggVcGm.exe
  2⤵
  PID:9820
- C:\Windows\System\gBJqxYq.exe
  C:\Windows\System\gBJqxYq.exe
  2⤵
  PID:9836
- C:\Windows\System\SAuSICG.exe
  C:\Windows\System\SAuSICG.exe
  2⤵
  PID:9852
- C:\Windows\System\pmZYNOh.exe
  C:\Windows\System\pmZYNOh.exe
  2⤵
  PID:9868
- C:\Windows\System\XfMvmNe.exe
  C:\Windows\System\XfMvmNe.exe
  2⤵
  PID:9884
- C:\Windows\System\TQsKabo.exe
  C:\Windows\System\TQsKabo.exe
  2⤵
  PID:9900
- C:\Windows\System\geVjhNn.exe
  C:\Windows\System\geVjhNn.exe
  2⤵
  PID:9916
- C:\Windows\System\glEQwxx.exe
  C:\Windows\System\glEQwxx.exe
  2⤵
  PID:9932
- C:\Windows\System\RAByRfl.exe
  C:\Windows\System\RAByRfl.exe
  2⤵
  PID:9948
- C:\Windows\System\rgMFHUF.exe
  C:\Windows\System\rgMFHUF.exe
  2⤵
  PID:9964
- C:\Windows\System\Nytrcpm.exe
  C:\Windows\System\Nytrcpm.exe
  2⤵
  PID:9980
- C:\Windows\System\yTgIopG.exe
  C:\Windows\System\yTgIopG.exe
  2⤵
  PID:9996
- C:\Windows\System\psqHMtn.exe
  C:\Windows\System\psqHMtn.exe
  2⤵
  PID:10012
- C:\Windows\System\KTQBVbu.exe
  C:\Windows\System\KTQBVbu.exe
  2⤵
  PID:10028
- C:\Windows\System\CMGQgYg.exe
  C:\Windows\System\CMGQgYg.exe
  2⤵
  PID:10044
- C:\Windows\System\PJJmScb.exe
  C:\Windows\System\PJJmScb.exe
  2⤵
  PID:10060
- C:\Windows\System\RKohnPn.exe
  C:\Windows\System\RKohnPn.exe
  2⤵
  PID:10076
- C:\Windows\System\xcHKugl.exe
  C:\Windows\System\xcHKugl.exe
  2⤵
  PID:10092
- C:\Windows\System\fdSwbOL.exe
  C:\Windows\System\fdSwbOL.exe
  2⤵
  PID:10108
- C:\Windows\System\VWDXaUW.exe
  C:\Windows\System\VWDXaUW.exe
  2⤵
  PID:10124
- C:\Windows\System\vnFCldp.exe
  C:\Windows\System\vnFCldp.exe
  2⤵
  PID:10144
- C:\Windows\System\rnhUPsC.exe
  C:\Windows\System\rnhUPsC.exe
  2⤵
  PID:10160
- C:\Windows\System\tHmchKc.exe
  C:\Windows\System\tHmchKc.exe
  2⤵
  PID:10176
- C:\Windows\System\sIZhgsg.exe
  C:\Windows\System\sIZhgsg.exe
  2⤵
  PID:10192
- C:\Windows\System\EzWGlfh.exe
  C:\Windows\System\EzWGlfh.exe
  2⤵
  PID:10208
- C:\Windows\System\cwvJIPV.exe
  C:\Windows\System\cwvJIPV.exe
  2⤵
  PID:10224
- C:\Windows\System\ORBtXdg.exe
  C:\Windows\System\ORBtXdg.exe
  2⤵
  PID:9220
- C:\Windows\System\EpjUqbP.exe
  C:\Windows\System\EpjUqbP.exe
  2⤵
  PID:9284
- C:\Windows\System\NjtbxmZ.exe
  C:\Windows\System\NjtbxmZ.exe
  2⤵
  PID:9320
- C:\Windows\System\UUXCSLW.exe
  C:\Windows\System\UUXCSLW.exe
  2⤵
  PID:9380
- C:\Windows\System\yKTwWhE.exe
  C:\Windows\System\yKTwWhE.exe
  2⤵
  PID:9236
- C:\Windows\System\yKSccnb.exe
  C:\Windows\System\yKSccnb.exe
  2⤵
  PID:9272
- C:\Windows\System\YOkoRir.exe
  C:\Windows\System\YOkoRir.exe
  2⤵
  PID:9336
- C:\Windows\System\tMPLlcl.exe
  C:\Windows\System\tMPLlcl.exe
  2⤵
  PID:9508
- C:\Windows\System\qAunNip.exe
  C:\Windows\System\qAunNip.exe
  2⤵
  PID:9544
- C:\Windows\System\tsNUpHn.exe
  C:\Windows\System\tsNUpHn.exe
  2⤵
  PID:9604
- C:\Windows\System\KmSwfUj.exe
  C:\Windows\System\KmSwfUj.exe
  2⤵
  PID:9640
- C:\Windows\System\NRfdTMT.exe
  C:\Windows\System\NRfdTMT.exe
  2⤵
  PID:9672
- C:\Windows\System\hiUuxEd.exe
  C:\Windows\System\hiUuxEd.exe
  2⤵
  PID:9492
- C:\Windows\System\PrNnHuf.exe
  C:\Windows\System\PrNnHuf.exe
  2⤵
  PID:9652
- C:\Windows\System\JuclzKw.exe
  C:\Windows\System\JuclzKw.exe
  2⤵
  PID:9560
- C:\Windows\System\aFpuNvK.exe
  C:\Windows\System\aFpuNvK.exe
  2⤵
  PID:9736
- C:\Windows\System\MPeVUOx.exe
  C:\Windows\System\MPeVUOx.exe
  2⤵
  PID:9768
- C:\Windows\System\pXYuDNK.exe
  C:\Windows\System\pXYuDNK.exe
  2⤵
  PID:9752
- C:\Windows\System\dKBlWLJ.exe
  C:\Windows\System\dKBlWLJ.exe
  2⤵
  PID:9796
- C:\Windows\System\MQWaFxw.exe
  C:\Windows\System\MQWaFxw.exe
  2⤵
  PID:9860
- C:\Windows\System\bwTxtVn.exe
  C:\Windows\System\bwTxtVn.exe
  2⤵
  PID:9896
- C:\Windows\System\tDZElof.exe
  C:\Windows\System\tDZElof.exe
  2⤵
  PID:9848
- C:\Windows\System\cIeJeju.exe
  C:\Windows\System\cIeJeju.exe
  2⤵
  PID:9928
- C:\Windows\System\mynNATS.exe
  C:\Windows\System\mynNATS.exe
  2⤵
  PID:9992
- C:\Windows\System\GDlDxlo.exe
  C:\Windows\System\GDlDxlo.exe
  2⤵
  PID:10056
- C:\Windows\System\wweXpQv.exe
  C:\Windows\System\wweXpQv.exe
  2⤵
  PID:10120
- C:\Windows\System\uMMXAgb.exe
  C:\Windows\System\uMMXAgb.exe
  2⤵
  PID:10188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AZTEPsn.exe

Filesize
2.3MB

MD5
8db095a17feb782a11ded2557fce9218

SHA1
a503c9c593b8ebadbff6d4a74a994fd7a60721c5

SHA256
08d8d919eb29317bd063bed027d7e37a481a87799b6958c86954219c0103dca7

SHA512
762d1a64390a2389e697aa5d7f504f554facbc60684ba2952f0a5933f205ee5118c8b26909dc7653e22d12f8042552d16aaf7dc41ef845400d551bf20099762e

Download Submit
C:\Windows\system\AxqXYMW.exe

Filesize
2.3MB

MD5
9ddb0d4e7ac1832afab5100f7f20ae59

SHA1
749e5a2286eed78fa0f359a483d787947e1a4f12

SHA256
f2002edc23a4160b1cb7f1d7e836931eb4431440d4bd7510f842ba0b4e94b131

SHA512
118ce5e7b4751226177e0fb9cdda39d27703ac2b513557f516c06b0aee362398eba9f81620a768e9466d29d87a298c53512d22fb44a97463ba127e25a29b1f99

Download Submit
C:\Windows\system\BWtrGRY.exe

Filesize
2.3MB

MD5
d0eed3751b5afaa5ccd176494f9ea14d

SHA1
0c37e233315865e55a51e4b85bbc3e26b6e9a12a

SHA256
86906f9aba57169de89e60452dfb8d46be98553172fd60a516806440e76ed6c3

SHA512
82bb80e0431b19a0fce66ea1b9bd1396d4c6172ef904695c7b10d827bdfb76df20c50c09eeb99e0087f732de03278e24080f7310e768fab2bee78a64be7fbe29

Download Submit
C:\Windows\system\CQXwjoB.exe

Filesize
2.3MB

MD5
dbbf26f3ba4841a1785733d87f84fd2e

SHA1
1797830821aa7001f0b95aeb01ef1ff70dd4087f

SHA256
84b20099eb8fe7b812c547635d19659183178a56244a6a116575b4353cf364aa

SHA512
6a6f961ed2b52aa69be9f99bf1c5e441e8993fb1caaa2ae9aa2287ffa1b521983178a74d7ea2babcf5bb23514064decde31406ee48482cd36199119fee4f7768

Download Submit
C:\Windows\system\DgjRGre.exe

Filesize
2.3MB

MD5
65ae765db4d6cba147b63a3638e00518

SHA1
190628e1cae1401084afeb5c888bf4166af0f461

SHA256
0fbfb3df9754637b79709208d1decf447c3502d0d0ec0720ec7f1069369d60e3

SHA512
222d6ad92988e3847430c81362bb58106909f9673bbcee66726b4e1dfda728b435c902e8c6bf3f4ea3b3092e88a1f1ab71c808ad81481c50088a8ac5766599ab

Download Submit
C:\Windows\system\EzsdWLY.exe

Filesize
2.3MB

MD5
d90a25c81363d6d829b0767ee8b1949a

SHA1
ec02d8a07b1a11a2fa61e7baf4676ff4bf2e17c8

SHA256
79f413b27ac7a6c801bd006ec1f438443f5859b61a6fbb1c6a44cb3abdfac6ff

SHA512
e28db00afce7268690d35f3ab0c5156ab6e9118d0c5db78ec6c2983568fee372365993c859267f61c5962ff283799409c3d32d25709d69e6a2cb7ba2454908ab

Download Submit
C:\Windows\system\FIYvCkc.exe

Filesize
2.3MB

MD5
c6f7a8bc18d545add833b98f99adf25c

SHA1
9402fdb793e502fbc5ad3f46e1ec126f981ce8a1

SHA256
20f3417407e797eec2b3019324646780b8a6d8ad5914a0e28a407b40243ac319

SHA512
5fa6f36001e8c26dda9d6394ec612c672138e3bcfd92f2da67cb829d64a317547ab24995bb8aac5aebb42a060e93cf635710a8baa2528da69c61d9fc10d65b45

Download Submit
C:\Windows\system\GSzzVqk.exe

Filesize
2.3MB

MD5
0ee42b9fe2f6fd40f6edae37fd2a752c

SHA1
e02c771602567dbf1997b9f5960c3539b7361db4

SHA256
46a540d91b34c1d764e21fb173657cf2181094c6542e665ee1d052bfc3d9dd89

SHA512
8b3484175c3f149658d4a9218d5268974f2986fb77c5b0b67197abface70a1388bc68ccfcbc8700f8ff4a4ee347c910fe58804d2e1e1514d6968b16c15ca982b

Download Submit
C:\Windows\system\HJmJAPw.exe

Filesize
2.3MB

MD5
88385cc7df7e35684908c9ea76bf6e59

SHA1
b4773db23bdc16eecb926db4b170bede7a9e7280

SHA256
ea3f2b7303981f3fa3067b6c37f50a2359eead1e4b76681fd63841f351b5d7c3

SHA512
226b7c6c045149c68500b51d6bf0b1c8a508a0d558016a6c9053b4b9aa42694ea02e759d0a43927f1dafd14c3dc1131906ed7a2bfceb3a3d5efdfbd601b0cac9

Download Submit
C:\Windows\system\IHdXqYt.exe

Filesize
2.3MB

MD5
3953dbc5f70bca0d95cbe0fc1f9d91d9

SHA1
4b48e7c8e05fa0da5383bbdd14aeb9824bd03e0b

SHA256
4a25f5cc89ced0a48349dce185d4d36937bd034c8d537b1b5460be4118143f78

SHA512
755fa4cff1ee087383d71d4a08059d181f6dd37d0c7eaea91d44acbbe34299dbfed6e0e406e208231278e8f115cda2da0e4df935bf77681f2d4c3fd6c071a392

Download Submit
C:\Windows\system\RoMVcnS.exe

Filesize
2.3MB

MD5
ab441fbb6f57b9ea2bb4672e14af1678

SHA1
75a8f18d3d8f276c0aaf0c3aadf1d40a48103ec5

SHA256
91b6f71860463dd4d21b624d8c5f4e068eacf9f3b6b9a4707ea2d1bcaa85327c

SHA512
5e482ee02f751c1b095ea6fcbd38bbb13e122735c4f21fdde24f96dd613ffe38786253887b0115f389c2c1911742844738ec502567f9944873b7bd2da1ae3962

Download Submit
C:\Windows\system\XeieMob.exe

Filesize
2.3MB

MD5
17af66b353544091dc211114933b6a6e

SHA1
cc9b80c3999a43274cd7e5b431c71a8404149bcd

SHA256
6812869790c515aaf170a49f8ac49110eb4acf013657cd8e4505402c4180efcd

SHA512
d4dd4a0a2e321d5f3238708a4b0547bf58e07020fc83b3d3ea65cfc4517526fd2c67fdec941c159803fb3ea15ff3b8e48ed9f938782effeb200354599af9b581

Download Submit
C:\Windows\system\ZUEVNoQ.exe

Filesize
2.3MB

MD5
c3ac048d9ca7e419b35e95e51fc37c31

SHA1
4870614fe406e39094cd7db829534d65991f83eb

SHA256
f2e86cfc43e80d679e311de826a8bf48d0466b5aafd3187ae0a5af3d475142b0

SHA512
5e3d17d31fbd6fbd19030d5455ddb4e2d3eee096a0343ecd11e8d20c9b00b92c747a8a73e8063fdad8e732776c1efa890336fb594d7d8cb52c9bf14ce1c20afe

Download Submit
C:\Windows\system\ZxdWxlc.exe

Filesize
2.3MB

MD5
0adc5144850c5f5516e8c2909f6648fc

SHA1
3bc3c1131aded5eab71aabc02bcd87b8bfb8c33f

SHA256
2cb84cf6885666ee618f0b4e6fe955d21806d4344f56cd52a64f943d54105626

SHA512
d81d4e4fe6ddfafd787be8e7d7d1b2d308780997054ecbb4a07445f8348e2f21890947434ead3a56d9e4ce77d6fbb8fdfb025cb89b9d1bbd01cc6e6db713f1a5

Download Submit
C:\Windows\system\baRKJQM.exe

Filesize
2.3MB

MD5
a38b9d30548012813e44e5182df2f889

SHA1
1fc0465628c098b1f79ffef01e812c534ee0b9ee

SHA256
8dd7806bfee5368cec211589573291f13f926ddccf30091c0a3f8dc15d81f1d4

SHA512
2213ba8b1ae1b398113dab95f39d59a30d7f011bf342b8632a66dc0b3106fa3d358336369a87888f3687d7f99b569b292dbf3dc498118713fd2b9d8e6e1bfd71

Download Submit
C:\Windows\system\dovqMoN.exe

Filesize
2.3MB

MD5
cfd74f1440549aad0ca2a187c17dfb65

SHA1
f654144b98be4753b204cc1352838a4c6d0383c8

SHA256
88f4bcaf4e7bc9f329ebac7a0b85640664d348f9a56105a20e6ebd0b3de513bc

SHA512
a15c93243091fdec4122142272d77d47e9a3162a504b83e023072aa9b420841367743925ebe4e5a38d5d577dffe119cbc58033a8d4429abf0fd28184765eb1a7

Download Submit
C:\Windows\system\kXddITm.exe

Filesize
2.3MB

MD5
a82a7a17de8a651c3b38bfb808201341

SHA1
b1e386fc0ac6388543a2c5050c2bceb99e58fb27

SHA256
dac29c7375a7d8bf71e010883e152972124fa0298ff5bb5d2f3c3da3f8ea4bf1

SHA512
993e17add2f211cc0d66fad95bf6ffacaf062f296c1d36a5d44e578cdd808be31923569a8e4a1db8135b4b2a27a4b29fddd9670a1b35a1d5c259544ef424e259

Download Submit
C:\Windows\system\kvbKAEt.exe

Filesize
2.3MB

MD5
4e22fad6280c935f9c57cbdfed0904b0

SHA1
02721ad964d00041513cf74aeea7837c9d0dabaa

SHA256
59de5f66fb92d6875fb4c83d3267dc0ebbcf890cf0776bc4c13e0401f1c81fb9

SHA512
c1920ff4cba2b36383a9f041898f9884ddd6ec06346f1c29a5d10010359a2fc4581846a3ed6b65dc31754531b0bc9189137421da3c965ff7647ec95a69938824

Download Submit
C:\Windows\system\lqCEQKp.exe

Filesize
2.3MB

MD5
c56369307a48baccfabd644a04406028

SHA1
e4ff354eafd2fb8a3520e31b45e5728bb6e1051e

SHA256
95038ad0fd59c0d68f5c9428b60c75e2ff040ba9730222416d90f382c9100002

SHA512
f71c7f0f7b3011343092f2a2349f8c7f6989156b47f44e8b8931305689c8c57ba1da6b0465c9c9ceb87bb264e1c4adec4b112e73cf48a09fb14e5566953d2f2c

Download Submit
C:\Windows\system\oeBqWVr.exe

Filesize
2.3MB

MD5
b5cf80426cf318525c95a61745c382d6

SHA1
1810ea4c9f92cb7fb29bc6e7d0e4f9cc35e186c6

SHA256
afd49a47b66a9614f9fe055e37506a15aaa71476556a424d926f79e952a2363e

SHA512
a0e74c3a4f74ac6517624420195febeab91b323fe0d9badf78cc2eebd286e67c33f5e19604a40140b6cb55f1dfff5926df557e4923ea8c23f6f0f8303001e563

Download Submit
C:\Windows\system\rOMHKIY.exe

Filesize
2.3MB

MD5
4bd1567cd02eab820ed2f67ee70327ae

SHA1
55d6b8592af7a69118cf461ba5821bc4ee12aa4c

SHA256
886d5a1b9caadaaaf191d4bec2b5b75951205857b8b071183e43353f193468be

SHA512
785739e2f01b3a45404a11209c29e9912e347e97868dbe31bb9e77d028e68e11c0e55b5937eadcf111d06aca5bd9b3c1885604f324d45008cc35ba83bfac62b4

Download Submit
C:\Windows\system\wXsfbPu.exe

Filesize
2.3MB

MD5
7be09cefe89228a1a0e81750ddbefcfa

SHA1
1c417553121bf25303b13e78a92693e0ae4d820c

SHA256
a360e1780840b23d2617228a3406a1b1a429f379d707fb45d26bdc797685e62d

SHA512
a0f520fce306337947d6996b77deebeca5f1e2a7598238da06780d015b9f85adb796518f1b70d224c6462639104e979050d4546f0e5ec725632ba4b6297338b9

Download Submit
C:\Windows\system\ynVHbuK.exe

Filesize
2.3MB

MD5
26a96311833d485deab5a74eb67f29bd

SHA1
f223d2d6f0afa81492b31d4d0b8ad49eaa2b13ae

SHA256
76fcc76958e672536ee74bfdfa88922de94de934ad270e2dcca276e55b3505cf

SHA512
59106a53b2f3b143e31298d9e6611ae974da2dbf5161a9571cfeef95a84949014b069a65e383d10b360b12f5d447a6d21a3491cb540c9379c2d9f522cf75f444

Download Submit
\Windows\system\AGiieEF.exe

Filesize
2.3MB

MD5
a27ab22b8bcbff1307d84f01e19d09f3

SHA1
0d606f1fadd6d15653a78362d76c5429861f03bf

SHA256
f0acb5eed7ff7a1c3154eb7b362ef4985241f3e5b9ca97162b2122849598dfa8

SHA512
0cbec9909633065bb59a059b2b92d53f7fc1435268b83979d82acb36d903eee9fca45ce99dc2e5e0051bb3aca6b136bd3ca421cdc845550d69c417c746146ed8

Download Submit
\Windows\system\CPBwejj.exe

Filesize
2.3MB

MD5
eed7a0cf78fe0171dcfa6dfbe6e26273

SHA1
cd57390c8ea23c743bbf5a96d87a50d95c90e82b

SHA256
3ba8d7a385446818926cda03ea3650ce17b0cb28950f9062990ff9277d1d428f

SHA512
8135ad4c780f968cef7a35bea408ebcd97b7a940cc13ec78ddc76ab485a48c23969e5110f90a7af8959d07f0b82ec2639709c5fd24d6f7ee5364c5b7c5531afe

Download Submit
\Windows\system\JQFNzGn.exe

Filesize
2.3MB

MD5
8771628e6fc94047f52e23da4441af3f

SHA1
32ca41ea81387696aa302adabddb93dd10124afc

SHA256
5f271a9aeb4da4b542cfef846916e1bd53f2e295613d4013d8c740060ea2544e

SHA512
41d7347f900aaa69e0cef11fe8333dbb263c615484de1e71b05d3378c9f9f50306b87d0217ae8f59fb7f784bcc00d74c9f79b3a45c754882451c2463c8120bc4

Download Submit
\Windows\system\YtAcFBd.exe

Filesize
2.3MB

MD5
e70c746ca0ea88ff12d1b5283af88af6

SHA1
de3a7a2e291b73717fdeef12ee0dcecf32a195da

SHA256
a0472ab7486f9e38d9f85bcb6fcf49c1de69ac07e6a9f78c920443e00b27597c

SHA512
33e810c772ade0627b3025fdf0db885639fdf3fbd2ce2b87d955352b740ea3a8e4f47c27c76e0d148016de4d2ddc6cd9d0a65e6a8d1ba4b929b85df17efcb3de

Download Submit
\Windows\system\aJXHBrr.exe

Filesize
2.3MB

MD5
937cc377491b5ef5b0f409b70dca619f

SHA1
e38277c5e941ffabbd1cc963f0cc784fa68e740a

SHA256
eda3127c0e7d0dfc660d84d97ad7d2056248f23b2853dfc422ed1db0bcca8a3e

SHA512
40343167241b358ef39e416ba9ae34ff968ad0504a5650d348465893d68f8c348640e913b56bec9a502e89a73f95d06b37130a9ef3a1e47b12feec572d896ef3

Download Submit
\Windows\system\fElHwtH.exe

Filesize
2.3MB

MD5
d389363fe4682ab749bc8edf4ed9dd25

SHA1
bbbd014bc3cd9ce9288b076a546fd8481b8b84b1

SHA256
49d5a94fb828378a44fe3b81a68450dcaca787cfaba15e901f0503972639cb85

SHA512
6ca420e4463b2781ee5a31134be12a31d933c1579c1714b6e19d394ebc46955c73590a4699abe8450bfa6a200fd14c26b1246004787f30f03bc2d679d8516203

Download Submit
\Windows\system\fpvcQXp.exe

Filesize
2.3MB

MD5
99e02985dcc3468e7e4264b3d0649f92

SHA1
0ebf1151c4211f6e79ec3783261f00f4569bb64b

SHA256
62a6cd9ae2ab5b2202fa09eb260d2a7285e2df2201ca70c3888dd77b9cb8517c

SHA512
d67272cc14700fbec07c7bc71d2b1c3056c9e3c0d8475a3b8f41963aa3e26c1c67bae200e6c7ddec55e325ffa29a847ca4cab147478bf8e75e809c1e27f2bfab

Download Submit
\Windows\system\kdeNwaC.exe

Filesize
2.3MB

MD5
7db8e20859dfe911ecb6d731e621c98c

SHA1
05a56f48acd2b613ce7f45fb13dc8d8e630a19ee

SHA256
32d9464aed32587492761ca73a74f30fe323106d325e709f06149de6e88432bf

SHA512
d4e67c8e5cc4103815a1f57f7ff98bcc36346bf74833f7fc90749215008bb58cba305dd56d301ef4f162e986358db7936929afc9ed0ef4cdcac7368d18cfdac4

Download Submit
\Windows\system\nKaRWOm.exe

Filesize
2.3MB

MD5
b355904a1f8fb6de8a0b060dcec86c8d

SHA1
3eb98d8179a0e593f1a692b6f30340054f9ecbd7

SHA256
af1063d202e5db99162b57b3f3e60a2977d5d1c80b8dc365c5c16e1da850449d

SHA512
4df35cf34bb1689e87040372a535cc4252130a9072935e7f30c7766e134831f15f5b8a233fbbafb909cd1a6ffb653c7d20266fb7cc08c24c7a425d33e29e6cc4

Download Submit
\Windows\system\oEhcvlI.exe

Filesize
2.3MB

MD5
7a108c5826dee87b3ccce348dac8da35

SHA1
ce136c99901011e66323db6aeaf3a3d3d8d3eaf4

SHA256
3f4d6a9ffe36437efae4c0e60450a8182d6d04d8c25f8412314d5eae41049038

SHA512
2a8707fadb801779e3a990114b1ec14d9cf7b3ad1f07fdaf218114c1d587b7c7dadfbb0e09bea0920c2d6e2d56f045d6e1a29ed2c685b5174020f176266b982c

Download Submit
memory/960-141-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/1104-143-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2240-40-0x000000001B7E0000-0x000000001BAC2000-memory.dmp

Filesize
2.9MB

Download
memory/2240-41-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/2240-228-0x000007FEF5BE0000-0x000007FEF657D000-memory.dmp

Filesize
9.6MB

Download
memory/2240-132-0x000007FEF5BE0000-0x000007FEF657D000-memory.dmp

Filesize
9.6MB

Download
memory/2240-133-0x0000000002A90000-0x0000000002B10000-memory.dmp

Filesize
512KB

Download
memory/2344-15-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2464-140-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-134-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2608-136-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2680-35-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2720-146-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2956-11-0x00000000026A0000-0x0000000002A92000-memory.dmp

Filesize
3.9MB

Download
memory/2956-37-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2956-142-0x00000000035B0000-0x00000000039A2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-144-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-145-0x0000000003250000-0x0000000003642000-memory.dmp

Filesize
3.9MB

Download
memory/2956-147-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-139-0x00000000035B0000-0x00000000039A2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-135-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-138-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2956-1-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/2956-0-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/2956-33-0x0000000003250000-0x0000000003642000-memory.dmp

Filesize
3.9MB

Download
memory/2956-137-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2956-14-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/3036-12-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download