xmrig | 459e16ec12f573ec4685ce2a044627ed1b7e21679dc16846030d549b54c39c1c

Analysis

max time kernel
34s
max time network
33s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
Size

1.8MB
MD5

0a459b36599f515cb10a628810fe1a7e
SHA1

ce3aec0edad1727c3853b051cc0268a2dda2e7a8
SHA256

459e16ec12f573ec4685ce2a044627ed1b7e21679dc16846030d549b54c39c1c
SHA512

192ca59b9f5341643e80cf4ed44a27f1aeccd2d02685f2c4b929ad3c889ce5973c4d8b1fe90cd639e855a981cdaff73a2b8c05596dc58f3cf7d14c09aef5ea3f
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlM:NABx

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/3028-172-0x000000013FEA0000-0x0000000140292000-memory.dmp	xmrig
behavioral1/memory/2700-178-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2664-183-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/2576-182-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/2064-191-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2724-179-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2568-177-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2168-176-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/3064-117-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3064	CjryXql.exe
2064	NoyAwZW.exe
3028	WzybWpK.exe
2168	tPJGHCY.exe
2568	DPhZgvb.exe
2700	wLikElN.exe
2724	yrSKuvL.exe
2576	VcxVTAe.exe
2664	HBmRgEc.exe
2868	dtzwwzr.exe
2148	TzEEIWM.exe
2480	fYkurRn.exe
2500	FIoqGpW.exe
2488	YAcnSKr.exe
2000	qNQjxgt.exe
2460	OWuAmBS.exe
2536	jEKEadK.exe
2996	DuwZkHC.exe
2828	ecbOCtJ.exe
1128	IHofFiO.exe
1872	kodePyW.exe
2788	tyrAqgI.exe
1668	aFISeCq.exe
2792	wfFaJBc.exe
764	TLxCwyu.exe
2268	RkOZYGv.exe
1688	srPvheu.exe
1952	hXojzVt.exe
2040	GzjmGIo.exe
1656	wuukXLY.exe
2776	NaOLIfD.exe
1420	ssjzfyN.exe
2952	qcLNTaF.exe
2876	AGDrPRT.exe
2036	qLPVXTY.exe
1012	oUUIxIC.exe
2132	uUUtcbJ.exe
2044	ofeSsaA.exe
276	ywiHeph.exe
692	RFwZcaW.exe
2076	HeOaUXk.exe
1748	YmcsGqH.exe
1700	RNrxaGA.exe
1744	JdXpQRh.exe
2880	jtNZtxj.exe
1636	Fbbnijv.exe
2096	NBfThNg.exe
1772	yvdjKBx.exe
2244	VyoeAKB.exe
1604	kjLTHat.exe
2360	wsIfoyz.exe
2276	aOFeTup.exe
2852	xqlcaJc.exe
3060	NjIsGLA.exe
2524	vjYGmgm.exe
1204	Ucthhno.exe
1132	JAPUXUL.exe
2588	kFpkcpA.exe
2464	ARRKILY.exe
1696	RAknScx.exe
2456	ezutxWM.exe
1940	YuTjIFq.exe
2180	mKFkfay.exe
600	cAVyASQ.exe

Loads dropped DLL 64 IoCs

pid	Process
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a000000014af6-2.dat	upx
behavioral1/files/0x00090000000155f3-5.dat	upx
behavioral1/files/0x0007000000015c52-51.dat	upx
behavioral1/files/0x0006000000016448-97.dat	upx
behavioral1/files/0x00060000000165ae-103.dat	upx
behavioral1/memory/3028-172-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/memory/2700-178-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/2664-183-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/2576-182-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/memory/2064-191-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/files/0x0006000000016bfb-121.dat	upx
behavioral1/memory/2724-179-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/2568-177-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2168-176-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/3064-117-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	upx
behavioral1/files/0x0006000000016a29-113.dat	upx
behavioral1/files/0x0006000000016176-154.dat	upx
behavioral1/files/0x0006000000015f7a-153.dat	upx
behavioral1/files/0x0006000000015df1-152.dat	upx
behavioral1/files/0x0006000000016c04-149.dat	upx
behavioral1/files/0x0006000000016be2-148.dat	upx
behavioral1/files/0x00060000000167d5-147.dat	upx
behavioral1/files/0x000600000001650c-146.dat	upx
behavioral1/files/0x0006000000016287-145.dat	upx
behavioral1/files/0x00060000000160af-143.dat	upx
behavioral1/files/0x0006000000015d31-141.dat	upx
behavioral1/files/0x0006000000015f01-139.dat	upx
behavioral1/files/0x0006000000015d98-138.dat	upx
behavioral1/files/0x0006000000015d1a-134.dat	upx
behavioral1/files/0x0006000000015d07-132.dat	upx
behavioral1/files/0x0006000000015d27-131.dat	upx
behavioral1/files/0x0006000000015d0f-130.dat	upx
behavioral1/files/0x0006000000015cfe-129.dat	upx
behavioral1/files/0x000a000000015c9f-67.dat	upx
behavioral1/files/0x0008000000015cb6-45.dat	upx
behavioral1/files/0x000a000000015c78-44.dat	upx
behavioral1/files/0x0007000000015c3d-43.dat	upx
behavioral1/files/0x0008000000015626-42.dat	upx
behavioral1/files/0x0006000000015cf6-93.dat	upx
behavioral1/files/0x0007000000015cce-79.dat	upx
behavioral1/files/0x0007000000015cee-39.dat	upx
behavioral1/files/0x0007000000015b6f-31.dat	upx
behavioral1/memory/1936-9-0x000000013F720000-0x000000013FB12000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bnyoUIi.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\KVxLFuJ.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\yVdpwyg.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\RkOZYGv.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\LACceTR.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\wBsbhsf.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\CemTzdL.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\EcAZSTX.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\Louhekt.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\wsIfoyz.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\NjIsGLA.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\mKFkfay.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\VSuFZOI.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\DuwZkHC.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\bkYZDMZ.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\WtjPgMm.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\YuTjIFq.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\dmxlksr.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\kodePyW.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\TLxCwyu.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\qLPVXTY.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\TAfJSdZ.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\MbnYqdM.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\wZwputD.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\ouqGqgY.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\HBmRgEc.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\WrSSTmZ.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\BUyCoqO.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\YBUhlqM.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\OWuAmBS.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\qNQjxgt.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\BbxwTiC.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\DPhZgvb.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\yvdjKBx.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\NoyAwZW.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\UpMjjzN.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\guBJIYv.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\vqdXmUJ.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\QCzeylD.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\UukyaHl.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\fndJMvA.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\YTnajbC.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\fzkZqrX.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\vFiSXdo.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\eOJhEfo.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\CqHmzPP.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\hXojzVt.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\ECeHWWK.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\IeZuabR.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\XaJijSR.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\QTYvDAD.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\iMHmqhL.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\iwglAqJ.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\kVGzIVJ.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\FyocbaG.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\srPvheu.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\ssjzfyN.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\FnuxiYP.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\DAeNZfk.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\pOZejtx.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\EYxGrzQ.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\wuukXLY.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\xqlcaJc.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
File created	C:\Windows\System\ARRKILY.exe	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3040	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
Token: SeDebugPrivilege	3040	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 3040	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	29
PID 1936 wrote to memory of 3040	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	29
PID 1936 wrote to memory of 3040	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	29
PID 1936 wrote to memory of 2064	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	30
PID 1936 wrote to memory of 2064	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	30
PID 1936 wrote to memory of 2064	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	30
PID 1936 wrote to memory of 3064	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	31
PID 1936 wrote to memory of 3064	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	31
PID 1936 wrote to memory of 3064	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	31
PID 1936 wrote to memory of 2168	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	32
PID 1936 wrote to memory of 2168	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	32
PID 1936 wrote to memory of 2168	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	32
PID 1936 wrote to memory of 3028	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	33
PID 1936 wrote to memory of 3028	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	33
PID 1936 wrote to memory of 3028	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	33
PID 1936 wrote to memory of 2568	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	34
PID 1936 wrote to memory of 2568	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	34
PID 1936 wrote to memory of 2568	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	34
PID 1936 wrote to memory of 2664	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	35
PID 1936 wrote to memory of 2664	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	35
PID 1936 wrote to memory of 2664	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	35
PID 1936 wrote to memory of 2700	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	36
PID 1936 wrote to memory of 2700	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	36
PID 1936 wrote to memory of 2700	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	36
PID 1936 wrote to memory of 2868	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	37
PID 1936 wrote to memory of 2868	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	37
PID 1936 wrote to memory of 2868	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	37
PID 1936 wrote to memory of 2724	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	38
PID 1936 wrote to memory of 2724	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	38
PID 1936 wrote to memory of 2724	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	38
PID 1936 wrote to memory of 2148	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	39
PID 1936 wrote to memory of 2148	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	39
PID 1936 wrote to memory of 2148	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	39
PID 1936 wrote to memory of 2576	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	40
PID 1936 wrote to memory of 2576	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	40
PID 1936 wrote to memory of 2576	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	40
PID 1936 wrote to memory of 2480	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	41
PID 1936 wrote to memory of 2480	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	41
PID 1936 wrote to memory of 2480	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	41
PID 1936 wrote to memory of 2500	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	42
PID 1936 wrote to memory of 2500	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	42
PID 1936 wrote to memory of 2500	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	42
PID 1936 wrote to memory of 2460	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	43
PID 1936 wrote to memory of 2460	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	43
PID 1936 wrote to memory of 2460	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	43
PID 1936 wrote to memory of 2488	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	44
PID 1936 wrote to memory of 2488	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	44
PID 1936 wrote to memory of 2488	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	44
PID 1936 wrote to memory of 2536	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	45
PID 1936 wrote to memory of 2536	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	45
PID 1936 wrote to memory of 2536	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	45
PID 1936 wrote to memory of 2000	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	46
PID 1936 wrote to memory of 2000	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	46
PID 1936 wrote to memory of 2000	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	46
PID 1936 wrote to memory of 1128	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	47
PID 1936 wrote to memory of 1128	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	47
PID 1936 wrote to memory of 1128	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	47
PID 1936 wrote to memory of 2996	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	48
PID 1936 wrote to memory of 2996	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	48
PID 1936 wrote to memory of 2996	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	48
PID 1936 wrote to memory of 1688	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	49
PID 1936 wrote to memory of 1688	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	49
PID 1936 wrote to memory of 1688	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	49
PID 1936 wrote to memory of 2828	1936	0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a459b36599f515cb10a628810fe1a7e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\System\NoyAwZW.exe
  C:\Windows\System\NoyAwZW.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\CjryXql.exe
  C:\Windows\System\CjryXql.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\tPJGHCY.exe
  C:\Windows\System\tPJGHCY.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\WzybWpK.exe
  C:\Windows\System\WzybWpK.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\DPhZgvb.exe
  C:\Windows\System\DPhZgvb.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\HBmRgEc.exe
  C:\Windows\System\HBmRgEc.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\wLikElN.exe
  C:\Windows\System\wLikElN.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\dtzwwzr.exe
  C:\Windows\System\dtzwwzr.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\yrSKuvL.exe
  C:\Windows\System\yrSKuvL.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\TzEEIWM.exe
  C:\Windows\System\TzEEIWM.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\VcxVTAe.exe
  C:\Windows\System\VcxVTAe.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\fYkurRn.exe
  C:\Windows\System\fYkurRn.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\FIoqGpW.exe
  C:\Windows\System\FIoqGpW.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\OWuAmBS.exe
  C:\Windows\System\OWuAmBS.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\YAcnSKr.exe
  C:\Windows\System\YAcnSKr.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\jEKEadK.exe
  C:\Windows\System\jEKEadK.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\qNQjxgt.exe
  C:\Windows\System\qNQjxgt.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\IHofFiO.exe
  C:\Windows\System\IHofFiO.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\DuwZkHC.exe
  C:\Windows\System\DuwZkHC.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\srPvheu.exe
  C:\Windows\System\srPvheu.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\ecbOCtJ.exe
  C:\Windows\System\ecbOCtJ.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\hXojzVt.exe
  C:\Windows\System\hXojzVt.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\kodePyW.exe
  C:\Windows\System\kodePyW.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\GzjmGIo.exe
  C:\Windows\System\GzjmGIo.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\tyrAqgI.exe
  C:\Windows\System\tyrAqgI.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\wuukXLY.exe
  C:\Windows\System\wuukXLY.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\aFISeCq.exe
  C:\Windows\System\aFISeCq.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\NaOLIfD.exe
  C:\Windows\System\NaOLIfD.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\wfFaJBc.exe
  C:\Windows\System\wfFaJBc.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\ssjzfyN.exe
  C:\Windows\System\ssjzfyN.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\TLxCwyu.exe
  C:\Windows\System\TLxCwyu.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\qcLNTaF.exe
  C:\Windows\System\qcLNTaF.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\RkOZYGv.exe
  C:\Windows\System\RkOZYGv.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\AGDrPRT.exe
  C:\Windows\System\AGDrPRT.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\qLPVXTY.exe
  C:\Windows\System\qLPVXTY.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\oUUIxIC.exe
  C:\Windows\System\oUUIxIC.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\uUUtcbJ.exe
  C:\Windows\System\uUUtcbJ.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\ofeSsaA.exe
  C:\Windows\System\ofeSsaA.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\ywiHeph.exe
  C:\Windows\System\ywiHeph.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\RFwZcaW.exe
  C:\Windows\System\RFwZcaW.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\HeOaUXk.exe
  C:\Windows\System\HeOaUXk.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\YmcsGqH.exe
  C:\Windows\System\YmcsGqH.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\RNrxaGA.exe
  C:\Windows\System\RNrxaGA.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\JdXpQRh.exe
  C:\Windows\System\JdXpQRh.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\jtNZtxj.exe
  C:\Windows\System\jtNZtxj.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\Fbbnijv.exe
  C:\Windows\System\Fbbnijv.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\NBfThNg.exe
  C:\Windows\System\NBfThNg.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\yvdjKBx.exe
  C:\Windows\System\yvdjKBx.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\VyoeAKB.exe
  C:\Windows\System\VyoeAKB.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\kjLTHat.exe
  C:\Windows\System\kjLTHat.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\wsIfoyz.exe
  C:\Windows\System\wsIfoyz.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\aOFeTup.exe
  C:\Windows\System\aOFeTup.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\xqlcaJc.exe
  C:\Windows\System\xqlcaJc.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\NjIsGLA.exe
  C:\Windows\System\NjIsGLA.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\vjYGmgm.exe
  C:\Windows\System\vjYGmgm.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\Ucthhno.exe
  C:\Windows\System\Ucthhno.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\JAPUXUL.exe
  C:\Windows\System\JAPUXUL.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\kFpkcpA.exe
  C:\Windows\System\kFpkcpA.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\ARRKILY.exe
  C:\Windows\System\ARRKILY.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\ezutxWM.exe
  C:\Windows\System\ezutxWM.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\RAknScx.exe
  C:\Windows\System\RAknScx.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\YuTjIFq.exe
  C:\Windows\System\YuTjIFq.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\OSXHdGF.exe
  C:\Windows\System\OSXHdGF.exe
  2⤵
  PID:1084
- C:\Windows\System\mKFkfay.exe
  C:\Windows\System\mKFkfay.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\TsnByNu.exe
  C:\Windows\System\TsnByNu.exe
  2⤵
  PID:1540
- C:\Windows\System\cAVyASQ.exe
  C:\Windows\System\cAVyASQ.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\xBReGiG.exe
  C:\Windows\System\xBReGiG.exe
  2⤵
  PID:380
- C:\Windows\System\TdqIyxc.exe
  C:\Windows\System\TdqIyxc.exe
  2⤵
  PID:1192
- C:\Windows\System\HLLRmoz.exe
  C:\Windows\System\HLLRmoz.exe
  2⤵
  PID:1432
- C:\Windows\System\ThCUOXB.exe
  C:\Windows\System\ThCUOXB.exe
  2⤵
  PID:1472
- C:\Windows\System\EvuXdbd.exe
  C:\Windows\System\EvuXdbd.exe
  2⤵
  PID:1120
- C:\Windows\System\ABLMRkp.exe
  C:\Windows\System\ABLMRkp.exe
  2⤵
  PID:2252
- C:\Windows\System\uxUCyzD.exe
  C:\Windows\System\uxUCyzD.exe
  2⤵
  PID:2640
- C:\Windows\System\LVPJcox.exe
  C:\Windows\System\LVPJcox.exe
  2⤵
  PID:1544
- C:\Windows\System\FnuxiYP.exe
  C:\Windows\System\FnuxiYP.exe
  2⤵
  PID:2408
- C:\Windows\System\wQnKPly.exe
  C:\Windows\System\wQnKPly.exe
  2⤵
  PID:1160
- C:\Windows\System\TAfJSdZ.exe
  C:\Windows\System\TAfJSdZ.exe
  2⤵
  PID:800
- C:\Windows\System\SInsFBu.exe
  C:\Windows\System\SInsFBu.exe
  2⤵
  PID:2888
- C:\Windows\System\xTgEzcQ.exe
  C:\Windows\System\xTgEzcQ.exe
  2⤵
  PID:2340
- C:\Windows\System\gsyLpEH.exe
  C:\Windows\System\gsyLpEH.exe
  2⤵
  PID:2020
- C:\Windows\System\nVegyTA.exe
  C:\Windows\System\nVegyTA.exe
  2⤵
  PID:572
- C:\Windows\System\FXNdNko.exe
  C:\Windows\System\FXNdNko.exe
  2⤵
  PID:2016
- C:\Windows\System\ICIIwDQ.exe
  C:\Windows\System\ICIIwDQ.exe
  2⤵
  PID:1440
- C:\Windows\System\DAeNZfk.exe
  C:\Windows\System\DAeNZfk.exe
  2⤵
  PID:2032
- C:\Windows\System\ECeHWWK.exe
  C:\Windows\System\ECeHWWK.exe
  2⤵
  PID:1248
- C:\Windows\System\fFixUjx.exe
  C:\Windows\System\fFixUjx.exe
  2⤵
  PID:2200
- C:\Windows\System\spcBPhc.exe
  C:\Windows\System\spcBPhc.exe
  2⤵
  PID:1088
- C:\Windows\System\BbxwTiC.exe
  C:\Windows\System\BbxwTiC.exe
  2⤵
  PID:1916
- C:\Windows\System\wZwputD.exe
  C:\Windows\System\wZwputD.exe
  2⤵
  PID:2468
- C:\Windows\System\UpMjjzN.exe
  C:\Windows\System\UpMjjzN.exe
  2⤵
  PID:2904
- C:\Windows\System\VcZIVqS.exe
  C:\Windows\System\VcZIVqS.exe
  2⤵
  PID:2332
- C:\Windows\System\OErSMUm.exe
  C:\Windows\System\OErSMUm.exe
  2⤵
  PID:1080
- C:\Windows\System\KKKDkLN.exe
  C:\Windows\System\KKKDkLN.exe
  2⤵
  PID:3068
- C:\Windows\System\MbnYqdM.exe
  C:\Windows\System\MbnYqdM.exe
  2⤵
  PID:2692
- C:\Windows\System\uMSGIHF.exe
  C:\Windows\System\uMSGIHF.exe
  2⤵
  PID:2556
- C:\Windows\System\eyHHUaD.exe
  C:\Windows\System\eyHHUaD.exe
  2⤵
  PID:836
- C:\Windows\System\KnwnWWe.exe
  C:\Windows\System\KnwnWWe.exe
  2⤵
  PID:2684
- C:\Windows\System\uvUZgwG.exe
  C:\Windows\System\uvUZgwG.exe
  2⤵
  PID:2596
- C:\Windows\System\pOZejtx.exe
  C:\Windows\System\pOZejtx.exe
  2⤵
  PID:1996
- C:\Windows\System\dmxlksr.exe
  C:\Windows\System\dmxlksr.exe
  2⤵
  PID:2712
- C:\Windows\System\MfHpAgm.exe
  C:\Windows\System\MfHpAgm.exe
  2⤵
  PID:2668
- C:\Windows\System\Pvgcdps.exe
  C:\Windows\System\Pvgcdps.exe
  2⤵
  PID:1824
- C:\Windows\System\fBqxpup.exe
  C:\Windows\System\fBqxpup.exe
  2⤵
  PID:1932
- C:\Windows\System\ouqGqgY.exe
  C:\Windows\System\ouqGqgY.exe
  2⤵
  PID:2508
- C:\Windows\System\XpkpWvx.exe
  C:\Windows\System\XpkpWvx.exe
  2⤵
  PID:2024
- C:\Windows\System\OzvDszy.exe
  C:\Windows\System\OzvDszy.exe
  2⤵
  PID:1964
- C:\Windows\System\iDZcXKP.exe
  C:\Windows\System\iDZcXKP.exe
  2⤵
  PID:1644
- C:\Windows\System\vqdXmUJ.exe
  C:\Windows\System\vqdXmUJ.exe
  2⤵
  PID:1416
- C:\Windows\System\aRuiWOZ.exe
  C:\Windows\System\aRuiWOZ.exe
  2⤵
  PID:3048
- C:\Windows\System\OKMpPxg.exe
  C:\Windows\System\OKMpPxg.exe
  2⤵
  PID:2872
- C:\Windows\System\QwcYCTD.exe
  C:\Windows\System\QwcYCTD.exe
  2⤵
  PID:1496
- C:\Windows\System\htcEcET.exe
  C:\Windows\System\htcEcET.exe
  2⤵
  PID:2344
- C:\Windows\System\QyYqYNq.exe
  C:\Windows\System\QyYqYNq.exe
  2⤵
  PID:1896
- C:\Windows\System\BUyCoqO.exe
  C:\Windows\System\BUyCoqO.exe
  2⤵
  PID:1328
- C:\Windows\System\MIjYdgx.exe
  C:\Windows\System\MIjYdgx.exe
  2⤵
  PID:2836
- C:\Windows\System\bnyoUIi.exe
  C:\Windows\System\bnyoUIi.exe
  2⤵
  PID:2288
- C:\Windows\System\NOuwVer.exe
  C:\Windows\System\NOuwVer.exe
  2⤵
  PID:1792
- C:\Windows\System\FELpKyi.exe
  C:\Windows\System\FELpKyi.exe
  2⤵
  PID:320
- C:\Windows\System\kVGzIVJ.exe
  C:\Windows\System\kVGzIVJ.exe
  2⤵
  PID:2100
- C:\Windows\System\LACceTR.exe
  C:\Windows\System\LACceTR.exe
  2⤵
  PID:2772
- C:\Windows\System\wBsbhsf.exe
  C:\Windows\System\wBsbhsf.exe
  2⤵
  PID:896
- C:\Windows\System\CezWLRb.exe
  C:\Windows\System\CezWLRb.exe
  2⤵
  PID:2496
- C:\Windows\System\hfKMGSC.exe
  C:\Windows\System\hfKMGSC.exe
  2⤵
  PID:488
- C:\Windows\System\QCzeylD.exe
  C:\Windows\System\QCzeylD.exe
  2⤵
  PID:2376
- C:\Windows\System\bkYZDMZ.exe
  C:\Windows\System\bkYZDMZ.exe
  2⤵
  PID:2636
- C:\Windows\System\pXqqhnC.exe
  C:\Windows\System\pXqqhnC.exe
  2⤵
  PID:3076
- C:\Windows\System\fdqjYrH.exe
  C:\Windows\System\fdqjYrH.exe
  2⤵
  PID:3092
- C:\Windows\System\XaJijSR.exe
  C:\Windows\System\XaJijSR.exe
  2⤵
  PID:3112
- C:\Windows\System\CemTzdL.exe
  C:\Windows\System\CemTzdL.exe
  2⤵
  PID:3128
- C:\Windows\System\FyocbaG.exe
  C:\Windows\System\FyocbaG.exe
  2⤵
  PID:3144
- C:\Windows\System\UsaAWmx.exe
  C:\Windows\System\UsaAWmx.exe
  2⤵
  PID:3160
- C:\Windows\System\jOUwxWP.exe
  C:\Windows\System\jOUwxWP.exe
  2⤵
  PID:3176
- C:\Windows\System\vgDEYIu.exe
  C:\Windows\System\vgDEYIu.exe
  2⤵
  PID:3192
- C:\Windows\System\cRFLnPT.exe
  C:\Windows\System\cRFLnPT.exe
  2⤵
  PID:3212
- C:\Windows\System\KVxLFuJ.exe
  C:\Windows\System\KVxLFuJ.exe
  2⤵
  PID:3228
- C:\Windows\System\QTYvDAD.exe
  C:\Windows\System\QTYvDAD.exe
  2⤵
  PID:3244
- C:\Windows\System\fNKDJVg.exe
  C:\Windows\System\fNKDJVg.exe
  2⤵
  PID:3260
- C:\Windows\System\XBachgJ.exe
  C:\Windows\System\XBachgJ.exe
  2⤵
  PID:3276
- C:\Windows\System\bfYLCgL.exe
  C:\Windows\System\bfYLCgL.exe
  2⤵
  PID:3292
- C:\Windows\System\fzkZqrX.exe
  C:\Windows\System\fzkZqrX.exe
  2⤵
  PID:3308
- C:\Windows\System\WtjPgMm.exe
  C:\Windows\System\WtjPgMm.exe
  2⤵
  PID:3324
- C:\Windows\System\JNCxUxr.exe
  C:\Windows\System\JNCxUxr.exe
  2⤵
  PID:3344
- C:\Windows\System\DCDooqK.exe
  C:\Windows\System\DCDooqK.exe
  2⤵
  PID:3360
- C:\Windows\System\JtdrSmx.exe
  C:\Windows\System\JtdrSmx.exe
  2⤵
  PID:3376
- C:\Windows\System\EcAZSTX.exe
  C:\Windows\System\EcAZSTX.exe
  2⤵
  PID:3392
- C:\Windows\System\pNaZXWQ.exe
  C:\Windows\System\pNaZXWQ.exe
  2⤵
  PID:3408
- C:\Windows\System\IeZuabR.exe
  C:\Windows\System\IeZuabR.exe
  2⤵
  PID:3424
- C:\Windows\System\OjIWiVj.exe
  C:\Windows\System\OjIWiVj.exe
  2⤵
  PID:3632
- C:\Windows\System\CqHmzPP.exe
  C:\Windows\System\CqHmzPP.exe
  2⤵
  PID:3648
- C:\Windows\System\PRXCgCB.exe
  C:\Windows\System\PRXCgCB.exe
  2⤵
  PID:3688
- C:\Windows\System\WGiZYMI.exe
  C:\Windows\System\WGiZYMI.exe
  2⤵
  PID:3704
- C:\Windows\System\XInQYgS.exe
  C:\Windows\System\XInQYgS.exe
  2⤵
  PID:3720
- C:\Windows\System\BnUepgH.exe
  C:\Windows\System\BnUepgH.exe
  2⤵
  PID:3736
- C:\Windows\System\kICwcCN.exe
  C:\Windows\System\kICwcCN.exe
  2⤵
  PID:3756
- C:\Windows\System\Louhekt.exe
  C:\Windows\System\Louhekt.exe
  2⤵
  PID:3772
- C:\Windows\System\wIXOriO.exe
  C:\Windows\System\wIXOriO.exe
  2⤵
  PID:3788
- C:\Windows\System\UukyaHl.exe
  C:\Windows\System\UukyaHl.exe
  2⤵
  PID:3804
- C:\Windows\System\yVdpwyg.exe
  C:\Windows\System\yVdpwyg.exe
  2⤵
  PID:3820
- C:\Windows\System\WrSSTmZ.exe
  C:\Windows\System\WrSSTmZ.exe
  2⤵
  PID:3836
- C:\Windows\System\VsoIzlA.exe
  C:\Windows\System\VsoIzlA.exe
  2⤵
  PID:3852
- C:\Windows\System\MJNtjHp.exe
  C:\Windows\System\MJNtjHp.exe
  2⤵
  PID:3868
- C:\Windows\System\rKdAkRT.exe
  C:\Windows\System\rKdAkRT.exe
  2⤵
  PID:3884
- C:\Windows\System\MBQBcfc.exe
  C:\Windows\System\MBQBcfc.exe
  2⤵
  PID:3900
- C:\Windows\System\PikGMKw.exe
  C:\Windows\System\PikGMKw.exe
  2⤵
  PID:3916
- C:\Windows\System\KiDeWLq.exe
  C:\Windows\System\KiDeWLq.exe
  2⤵
  PID:3932
- C:\Windows\System\nqELiqs.exe
  C:\Windows\System\nqELiqs.exe
  2⤵
  PID:3952
- C:\Windows\System\KNQSTMx.exe
  C:\Windows\System\KNQSTMx.exe
  2⤵
  PID:3968
- C:\Windows\System\fcNeZaV.exe
  C:\Windows\System\fcNeZaV.exe
  2⤵
  PID:3984
- C:\Windows\System\FHpgrva.exe
  C:\Windows\System\FHpgrva.exe
  2⤵
  PID:4000
- C:\Windows\System\opGhQvz.exe
  C:\Windows\System\opGhQvz.exe
  2⤵
  PID:4016
- C:\Windows\System\qtIxbRP.exe
  C:\Windows\System\qtIxbRP.exe
  2⤵
  PID:4032
- C:\Windows\System\HSCknIR.exe
  C:\Windows\System\HSCknIR.exe
  2⤵
  PID:4048
- C:\Windows\System\oGogUrR.exe
  C:\Windows\System\oGogUrR.exe
  2⤵
  PID:4068
- C:\Windows\System\hMyxvQB.exe
  C:\Windows\System\hMyxvQB.exe
  2⤵
  PID:4084
- C:\Windows\System\pSwBqiA.exe
  C:\Windows\System\pSwBqiA.exe
  2⤵
  PID:2088
- C:\Windows\System\kcgUnWH.exe
  C:\Windows\System\kcgUnWH.exe
  2⤵
  PID:2848
- C:\Windows\System\EUyXIFb.exe
  C:\Windows\System\EUyXIFb.exe
  2⤵
  PID:1612
- C:\Windows\System\yelSvBW.exe
  C:\Windows\System\yelSvBW.exe
  2⤵
  PID:280
- C:\Windows\System\vFiSXdo.exe
  C:\Windows\System\vFiSXdo.exe
  2⤵
  PID:2084
- C:\Windows\System\eOJhEfo.exe
  C:\Windows\System\eOJhEfo.exe
  2⤵
  PID:2940
- C:\Windows\System\lkKexat.exe
  C:\Windows\System\lkKexat.exe
  2⤵
  PID:2184
- C:\Windows\System\wYFXaGg.exe
  C:\Windows\System\wYFXaGg.exe
  2⤵
  PID:2928
- C:\Windows\System\mzjlaXN.exe
  C:\Windows\System\mzjlaXN.exe
  2⤵
  PID:3184
- C:\Windows\System\VSuFZOI.exe
  C:\Windows\System\VSuFZOI.exe
  2⤵
  PID:3284
- C:\Windows\System\iMHmqhL.exe
  C:\Windows\System\iMHmqhL.exe
  2⤵
  PID:3388
- C:\Windows\System\EYxGrzQ.exe
  C:\Windows\System\EYxGrzQ.exe
  2⤵
  PID:2520
- C:\Windows\System\pqIflEb.exe
  C:\Windows\System\pqIflEb.exe
  2⤵
  PID:1436
- C:\Windows\System\TYKEXyf.exe
  C:\Windows\System\TYKEXyf.exe
  2⤵
  PID:3288
- C:\Windows\System\YBUhlqM.exe
  C:\Windows\System\YBUhlqM.exe
  2⤵
  PID:1144
- C:\Windows\System\DHzBdGO.exe
  C:\Windows\System\DHzBdGO.exe
  2⤵
  PID:856
- C:\Windows\System\OQUnomd.exe
  C:\Windows\System\OQUnomd.exe
  2⤵
  PID:1048
- C:\Windows\System\XcOSlov.exe
  C:\Windows\System\XcOSlov.exe
  2⤵
  PID:1592
- C:\Windows\System\fndJMvA.exe
  C:\Windows\System\fndJMvA.exe
  2⤵
  PID:2504
- C:\Windows\System\flIxztT.exe
  C:\Windows\System\flIxztT.exe
  2⤵
  PID:660
- C:\Windows\System\HJIMIYI.exe
  C:\Windows\System\HJIMIYI.exe
  2⤵
  PID:2256
- C:\Windows\System\guBJIYv.exe
  C:\Windows\System\guBJIYv.exe
  2⤵
  PID:616
- C:\Windows\System\qWTAhfr.exe
  C:\Windows\System\qWTAhfr.exe
  2⤵
  PID:3100
- C:\Windows\System\vAbiEjq.exe
  C:\Windows\System\vAbiEjq.exe
  2⤵
  PID:3140
- C:\Windows\System\SnLaFry.exe
  C:\Windows\System\SnLaFry.exe
  2⤵
  PID:3204
- C:\Windows\System\nKJnnLT.exe
  C:\Windows\System\nKJnnLT.exe
  2⤵
  PID:3272
- C:\Windows\System\SVJgUUl.exe
  C:\Windows\System\SVJgUUl.exe
  2⤵
  PID:3336
- C:\Windows\System\jxNkjgk.exe
  C:\Windows\System\jxNkjgk.exe
  2⤵
  PID:3400
- C:\Windows\System\ydDjcXV.exe
  C:\Windows\System\ydDjcXV.exe
  2⤵
  PID:3440
- C:\Windows\System\IEQclCQ.exe
  C:\Windows\System\IEQclCQ.exe
  2⤵
  PID:3640
- C:\Windows\System\YTnajbC.exe
  C:\Windows\System\YTnajbC.exe
  2⤵
  PID:3464
- C:\Windows\System\FAMLGyt.exe
  C:\Windows\System\FAMLGyt.exe
  2⤵
  PID:3488
- C:\Windows\System\iwglAqJ.exe
  C:\Windows\System\iwglAqJ.exe
  2⤵
  PID:3492
- C:\Windows\System\eOqaEff.exe
  C:\Windows\System\eOqaEff.exe
  2⤵
  PID:3516
- C:\Windows\System\QKTaCcm.exe
  C:\Windows\System\QKTaCcm.exe
  2⤵
  PID:3532
- C:\Windows\System\GXIfXCc.exe
  C:\Windows\System\GXIfXCc.exe
  2⤵
  PID:3552
- C:\Windows\System\XEqphpM.exe
  C:\Windows\System\XEqphpM.exe
  2⤵
  PID:3572
- C:\Windows\System\EGhQyoP.exe
  C:\Windows\System\EGhQyoP.exe
  2⤵
  PID:3584
- C:\Windows\System\TWIDuba.exe
  C:\Windows\System\TWIDuba.exe
  2⤵
  PID:3600
- C:\Windows\System\YkWEYqm.exe
  C:\Windows\System\YkWEYqm.exe
  2⤵
  PID:3616
- C:\Windows\System\FpWUApw.exe
  C:\Windows\System\FpWUApw.exe
  2⤵
  PID:3696
- C:\Windows\System\VeDKAFY.exe
  C:\Windows\System\VeDKAFY.exe
  2⤵
  PID:3800
- C:\Windows\System\TAyDELj.exe
  C:\Windows\System\TAyDELj.exe
  2⤵
  PID:3668
- C:\Windows\System\YdkYzhn.exe
  C:\Windows\System\YdkYzhn.exe
  2⤵
  PID:3864
- C:\Windows\System\aSgcEiH.exe
  C:\Windows\System\aSgcEiH.exe
  2⤵
  PID:4100
- C:\Windows\System\gcSlipq.exe
  C:\Windows\System\gcSlipq.exe
  2⤵
  PID:4116
- C:\Windows\System\NTyzUXv.exe
  C:\Windows\System\NTyzUXv.exe
  2⤵
  PID:4132
- C:\Windows\System\BPuzaPw.exe
  C:\Windows\System\BPuzaPw.exe
  2⤵
  PID:4152
- C:\Windows\System\sWVpeJO.exe
  C:\Windows\System\sWVpeJO.exe
  2⤵
  PID:4168
- C:\Windows\System\bkFToXP.exe
  C:\Windows\System\bkFToXP.exe
  2⤵
  PID:4184
- C:\Windows\System\ASFfMVY.exe
  C:\Windows\System\ASFfMVY.exe
  2⤵
  PID:4200
- C:\Windows\System\gKTqVan.exe
  C:\Windows\System\gKTqVan.exe
  2⤵
  PID:4216
- C:\Windows\System\DiknTPK.exe
  C:\Windows\System\DiknTPK.exe
  2⤵
  PID:4232
- C:\Windows\System\ziSzDwi.exe
  C:\Windows\System\ziSzDwi.exe
  2⤵
  PID:4248
- C:\Windows\System\vzHulWd.exe
  C:\Windows\System\vzHulWd.exe
  2⤵
  PID:4264
- C:\Windows\System\txLGjPZ.exe
  C:\Windows\System\txLGjPZ.exe
  2⤵
  PID:4284
- C:\Windows\System\GEhEpDe.exe
  C:\Windows\System\GEhEpDe.exe
  2⤵
  PID:4300
- C:\Windows\System\eEMvyfw.exe
  C:\Windows\System\eEMvyfw.exe
  2⤵
  PID:4316
- C:\Windows\System\xwcgQpf.exe
  C:\Windows\System\xwcgQpf.exe
  2⤵
  PID:4332
- C:\Windows\System\NRqRCaP.exe
  C:\Windows\System\NRqRCaP.exe
  2⤵
  PID:4348
- C:\Windows\System\edzcHkP.exe
  C:\Windows\System\edzcHkP.exe
  2⤵
  PID:4364
- C:\Windows\System\JZReUxT.exe
  C:\Windows\System\JZReUxT.exe
  2⤵
  PID:4384
- C:\Windows\System\mFTBxvl.exe
  C:\Windows\System\mFTBxvl.exe
  2⤵
  PID:4400
- C:\Windows\System\alQwrQy.exe
  C:\Windows\System\alQwrQy.exe
  2⤵
  PID:4416
- C:\Windows\System\HXPxOLh.exe
  C:\Windows\System\HXPxOLh.exe
  2⤵
  PID:4432
- C:\Windows\System\esZFUTm.exe
  C:\Windows\System\esZFUTm.exe
  2⤵
  PID:4448
- C:\Windows\System\XmvAgbt.exe
  C:\Windows\System\XmvAgbt.exe
  2⤵
  PID:4464
- C:\Windows\System\axxVznV.exe
  C:\Windows\System\axxVznV.exe
  2⤵
  PID:4480
- C:\Windows\System\HjavvFn.exe
  C:\Windows\System\HjavvFn.exe
  2⤵
  PID:4496
- C:\Windows\System\mlXboqW.exe
  C:\Windows\System\mlXboqW.exe
  2⤵
  PID:4516
- C:\Windows\System\gHYKnON.exe
  C:\Windows\System\gHYKnON.exe
  2⤵
  PID:4532
- C:\Windows\System\UPmZGGn.exe
  C:\Windows\System\UPmZGGn.exe
  2⤵
  PID:4548
- C:\Windows\System\uITuEHx.exe
  C:\Windows\System\uITuEHx.exe
  2⤵
  PID:4564
- C:\Windows\System\ewEAxBq.exe
  C:\Windows\System\ewEAxBq.exe
  2⤵
  PID:4580
- C:\Windows\System\tvNqbDw.exe
  C:\Windows\System\tvNqbDw.exe
  2⤵
  PID:4596
- C:\Windows\System\NsQlphj.exe
  C:\Windows\System\NsQlphj.exe
  2⤵
  PID:4612
- C:\Windows\System\liKBXJi.exe
  C:\Windows\System\liKBXJi.exe
  2⤵
  PID:4632
- C:\Windows\System\nRgagPD.exe
  C:\Windows\System\nRgagPD.exe
  2⤵
  PID:4648
- C:\Windows\System\NuMvEUS.exe
  C:\Windows\System\NuMvEUS.exe
  2⤵
  PID:4664
- C:\Windows\System\ICDtEeL.exe
  C:\Windows\System\ICDtEeL.exe
  2⤵
  PID:4680
- C:\Windows\System\fmEeXGs.exe
  C:\Windows\System\fmEeXGs.exe
  2⤵
  PID:4696
- C:\Windows\System\UekkQSf.exe
  C:\Windows\System\UekkQSf.exe
  2⤵
  PID:4712
- C:\Windows\System\qcGrJeK.exe
  C:\Windows\System\qcGrJeK.exe
  2⤵
  PID:4732
- C:\Windows\System\gFAPtnW.exe
  C:\Windows\System\gFAPtnW.exe
  2⤵
  PID:4748
- C:\Windows\System\tauOIat.exe
  C:\Windows\System\tauOIat.exe
  2⤵
  PID:4764
- C:\Windows\System\vyoODzX.exe
  C:\Windows\System\vyoODzX.exe
  2⤵
  PID:4780
- C:\Windows\System\lZnXHtz.exe
  C:\Windows\System\lZnXHtz.exe
  2⤵
  PID:4796
- C:\Windows\System\ERzNYCR.exe
  C:\Windows\System\ERzNYCR.exe
  2⤵
  PID:4812
- C:\Windows\System\vbzWphT.exe
  C:\Windows\System\vbzWphT.exe
  2⤵
  PID:5060
- C:\Windows\System\NmiSBdJ.exe
  C:\Windows\System\NmiSBdJ.exe
  2⤵
  PID:5108
- C:\Windows\System\fjsmfBz.exe
  C:\Windows\System\fjsmfBz.exe
  2⤵
  PID:2604
- C:\Windows\System\OnhkbGF.exe
  C:\Windows\System\OnhkbGF.exe
  2⤵
  PID:3712
- C:\Windows\System\MHPVUVF.exe
  C:\Windows\System\MHPVUVF.exe
  2⤵
  PID:3780
- C:\Windows\System\yFTYLeK.exe
  C:\Windows\System\yFTYLeK.exe
  2⤵
  PID:3876
- C:\Windows\System\CessQYh.exe
  C:\Windows\System\CessQYh.exe
  2⤵
  PID:3944
- C:\Windows\System\ObdgbdP.exe
  C:\Windows\System\ObdgbdP.exe
  2⤵
  PID:4008
- C:\Windows\System\IlsOsXA.exe
  C:\Windows\System\IlsOsXA.exe
  2⤵
  PID:4080
- C:\Windows\System\aZzmLcD.exe
  C:\Windows\System\aZzmLcD.exe
  2⤵
  PID:2676
- C:\Windows\System\pYeTRaP.exe
  C:\Windows\System\pYeTRaP.exe
  2⤵
  PID:2752
- C:\Windows\System\SzSHMue.exe
  C:\Windows\System\SzSHMue.exe
  2⤵
  PID:3224
- C:\Windows\System\bXljKLu.exe
  C:\Windows\System\bXljKLu.exe
  2⤵
  PID:1568
- C:\Windows\System\bVEqiRc.exe
  C:\Windows\System\bVEqiRc.exe
  2⤵
  PID:3928
- C:\Windows\System\gYKzDyX.exe
  C:\Windows\System\gYKzDyX.exe
  2⤵
  PID:3700
- C:\Windows\System\vfsKPDr.exe
  C:\Windows\System\vfsKPDr.exe
  2⤵
  PID:4160
- C:\Windows\System\loRczDA.exe
  C:\Windows\System\loRczDA.exe
  2⤵
  PID:4260
- C:\Windows\System\axOixxd.exe
  C:\Windows\System\axOixxd.exe
  2⤵
  PID:4360
- C:\Windows\System\PJLVbnI.exe
  C:\Windows\System\PJLVbnI.exe
  2⤵
  PID:2012
- C:\Windows\System\jnYGsCo.exe
  C:\Windows\System\jnYGsCo.exe
  2⤵
  PID:3108
- C:\Windows\System\MJWocCv.exe
  C:\Windows\System\MJWocCv.exe
  2⤵
  PID:3268
- C:\Windows\System\VPfNglz.exe
  C:\Windows\System\VPfNglz.exe
  2⤵
  PID:3452
- C:\Windows\System\tGJeNrp.exe
  C:\Windows\System\tGJeNrp.exe
  2⤵
  PID:3508
- C:\Windows\System\eAFkQSK.exe
  C:\Windows\System\eAFkQSK.exe
  2⤵
  PID:3580
- C:\Windows\System\cTnBRxI.exe
  C:\Windows\System\cTnBRxI.exe
  2⤵
  PID:4852
- C:\Windows\System\hGnBipM.exe
  C:\Windows\System\hGnBipM.exe
  2⤵
  PID:4864
- C:\Windows\System\dafRQlt.exe
  C:\Windows\System\dafRQlt.exe
  2⤵
  PID:4872
- C:\Windows\System\JDetDpG.exe
  C:\Windows\System\JDetDpG.exe
  2⤵
  PID:4884
- C:\Windows\System\VIwCTWG.exe
  C:\Windows\System\VIwCTWG.exe
  2⤵
  PID:4904
- C:\Windows\System\IdnzNQV.exe
  C:\Windows\System\IdnzNQV.exe
  2⤵
  PID:4920
- C:\Windows\System\IlgsGUi.exe
  C:\Windows\System\IlgsGUi.exe
  2⤵
  PID:4940
- C:\Windows\System\YesdHyO.exe
  C:\Windows\System\YesdHyO.exe
  2⤵
  PID:4960
- C:\Windows\System\QOFVCDY.exe
  C:\Windows\System\QOFVCDY.exe
  2⤵
  PID:4980
- C:\Windows\System\oEoXdvO.exe
  C:\Windows\System\oEoXdvO.exe
  2⤵
  PID:4996
- C:\Windows\System\uYJXFkx.exe
  C:\Windows\System\uYJXFkx.exe
  2⤵
  PID:4196
- C:\Windows\System\apyDhMK.exe
  C:\Windows\System\apyDhMK.exe
  2⤵
  PID:5012
- C:\Windows\System\aajyupJ.exe
  C:\Windows\System\aajyupJ.exe
  2⤵
  PID:5028
- C:\Windows\System\AcbkAox.exe
  C:\Windows\System\AcbkAox.exe
  2⤵
  PID:5044
- C:\Windows\System\MRSQCCe.exe
  C:\Windows\System\MRSQCCe.exe
  2⤵
  PID:4456
- C:\Windows\System\wWAfCZV.exe
  C:\Windows\System\wWAfCZV.exe
  2⤵
  PID:4824
- C:\Windows\System\rIQyeEq.exe
  C:\Windows\System\rIQyeEq.exe
  2⤵
  PID:4720
- C:\Windows\System\MRehyfP.exe
  C:\Windows\System\MRehyfP.exe
  2⤵
  PID:4856
- C:\Windows\System\WHjhDGT.exe
  C:\Windows\System\WHjhDGT.exe
  2⤵
  PID:4964
- C:\Windows\System\VlinNYm.exe
  C:\Windows\System\VlinNYm.exe
  2⤵
  PID:1424
- C:\Windows\System\aePmZww.exe
  C:\Windows\System\aePmZww.exe
  2⤵
  PID:2544
- C:\Windows\System\oCMxPPN.exe
  C:\Windows\System\oCMxPPN.exe
  2⤵
  PID:3680
- C:\Windows\System\XnGpmMI.exe
  C:\Windows\System\XnGpmMI.exe
  2⤵
  PID:4140
- C:\Windows\System\SZprxMr.exe
  C:\Windows\System\SZprxMr.exe
  2⤵
  PID:4208
- C:\Windows\System\jgRcBzC.exe
  C:\Windows\System\jgRcBzC.exe
  2⤵
  PID:4272
- C:\Windows\System\EYmpLDK.exe
  C:\Windows\System\EYmpLDK.exe
  2⤵
  PID:4740
- C:\Windows\System\ypldMGF.exe
  C:\Windows\System\ypldMGF.exe
  2⤵
  PID:5076
- C:\Windows\System\iIMOUii.exe
  C:\Windows\System\iIMOUii.exe
  2⤵
  PID:4724
- C:\Windows\System\xXBxZVv.exe
  C:\Windows\System\xXBxZVv.exe
  2⤵
  PID:4776
- C:\Windows\System\SVEDMmY.exe
  C:\Windows\System\SVEDMmY.exe
  2⤵
  PID:5096
- C:\Windows\System\FhCsWMz.exe
  C:\Windows\System\FhCsWMz.exe
  2⤵
  PID:3996
- C:\Windows\System\ZAqAUjh.exe
  C:\Windows\System\ZAqAUjh.exe
  2⤵
  PID:272
- C:\Windows\System\CwXGBvM.exe
  C:\Windows\System\CwXGBvM.exe
  2⤵
  PID:1616
- C:\Windows\System\ASzolje.exe
  C:\Windows\System\ASzolje.exe
  2⤵
  PID:2216
- C:\Windows\System\WExJpuR.exe
  C:\Windows\System\WExJpuR.exe
  2⤵
  PID:3056
- C:\Windows\System\tTxYckc.exe
  C:\Windows\System\tTxYckc.exe
  2⤵
  PID:3436
- C:\Windows\System\vtYmtzx.exe
  C:\Windows\System\vtYmtzx.exe
  2⤵
  PID:3520
- C:\Windows\System\XwvDSLs.exe
  C:\Windows\System\XwvDSLs.exe
  2⤵
  PID:2176
- C:\Windows\System\QWEcbae.exe
  C:\Windows\System\QWEcbae.exe
  2⤵
  PID:3912
- C:\Windows\System\qCqEgll.exe
  C:\Windows\System\qCqEgll.exe
  2⤵
  PID:980
- C:\Windows\System\qriGwbF.exe
  C:\Windows\System\qriGwbF.exe
  2⤵
  PID:3220
- C:\Windows\System\DPQSVLK.exe
  C:\Windows\System\DPQSVLK.exe
  2⤵
  PID:4040
- C:\Windows\System\RdNXeaK.exe
  C:\Windows\System\RdNXeaK.exe
  2⤵
  PID:4228
- C:\Windows\System\tKCxVkB.exe
  C:\Windows\System\tKCxVkB.exe
  2⤵
  PID:3624
- C:\Windows\System\mWTqVOV.exe
  C:\Windows\System\mWTqVOV.exe
  2⤵
  PID:4044
- C:\Windows\System\SJwAdTs.exe
  C:\Windows\System\SJwAdTs.exe
  2⤵
  PID:4424
- C:\Windows\System\HipkLwW.exe
  C:\Windows\System\HipkLwW.exe
  2⤵
  PID:4488
- C:\Windows\System\xJQJVgZ.exe
  C:\Windows\System\xJQJVgZ.exe
  2⤵
  PID:4660
- C:\Windows\System\uNTDnWE.exe
  C:\Windows\System\uNTDnWE.exe
  2⤵
  PID:2528
- C:\Windows\System\yhYFhPC.exe
  C:\Windows\System\yhYFhPC.exe
  2⤵
  PID:3476
- C:\Windows\System\XkDsMJD.exe
  C:\Windows\System\XkDsMJD.exe
  2⤵
  PID:3544
- C:\Windows\System\tcxFPxe.exe
  C:\Windows\System\tcxFPxe.exe
  2⤵
  PID:1992
- C:\Windows\System\VzofxzO.exe
  C:\Windows\System\VzofxzO.exe
  2⤵
  PID:3352
- C:\Windows\System\EGuwJKR.exe
  C:\Windows\System\EGuwJKR.exe
  2⤵
  PID:4868
- C:\Windows\System\gassVMc.exe
  C:\Windows\System\gassVMc.exe
  2⤵
  PID:4928
- C:\Windows\System\cBsFuKh.exe
  C:\Windows\System\cBsFuKh.exe
  2⤵
  PID:4164
- C:\Windows\System\klDHayp.exe
  C:\Windows\System\klDHayp.exe
  2⤵
  PID:3460
- C:\Windows\System\jyXAoNZ.exe
  C:\Windows\System\jyXAoNZ.exe
  2⤵
  PID:4956
- C:\Windows\System\RsTydJa.exe
  C:\Windows\System\RsTydJa.exe
  2⤵
  PID:5024
- C:\Windows\System\aDkZmfQ.exe
  C:\Windows\System\aDkZmfQ.exe
  2⤵
  PID:5036
- C:\Windows\System\psVDiGi.exe
  C:\Windows\System\psVDiGi.exe
  2⤵
  PID:708
- C:\Windows\System\xALZCSs.exe
  C:\Windows\System\xALZCSs.exe
  2⤵
  PID:5072
- C:\Windows\System\GhRcrdE.exe
  C:\Windows\System\GhRcrdE.exe
  2⤵
  PID:4372
- C:\Windows\System\pEjBduQ.exe
  C:\Windows\System\pEjBduQ.exe
  2⤵
  PID:4848
- C:\Windows\System\lkjBXPu.exe
  C:\Windows\System\lkjBXPu.exe
  2⤵
  PID:4244
- C:\Windows\System\vUSkJll.exe
  C:\Windows\System\vUSkJll.exe
  2⤵
  PID:4148
- C:\Windows\System\FlMjcJa.exe
  C:\Windows\System\FlMjcJa.exe
  2⤵
  PID:4504
- C:\Windows\System\axpbQwD.exe
  C:\Windows\System\axpbQwD.exe
  2⤵
  PID:4540
- C:\Windows\System\TnhUdlx.exe
  C:\Windows\System\TnhUdlx.exe
  2⤵
  PID:4608
- C:\Windows\System\fLrhAEM.exe
  C:\Windows\System\fLrhAEM.exe
  2⤵
  PID:1660
- C:\Windows\System\lExYJJK.exe
  C:\Windows\System\lExYJJK.exe
  2⤵
  PID:1352
- C:\Windows\System\NGwwXaV.exe
  C:\Windows\System\NGwwXaV.exe
  2⤵
  PID:4708
- C:\Windows\System\sDrbPFm.exe
  C:\Windows\System\sDrbPFm.exe
  2⤵
  PID:5092
- C:\Windows\System\WGwxtmm.exe
  C:\Windows\System\WGwxtmm.exe
  2⤵
  PID:5116
- C:\Windows\System\BTaOFnc.exe
  C:\Windows\System\BTaOFnc.exe
  2⤵
  PID:3732
- C:\Windows\System\TiEkRyX.exe
  C:\Windows\System\TiEkRyX.exe
  2⤵
  PID:3012
- C:\Windows\System\CYTZuuR.exe
  C:\Windows\System\CYTZuuR.exe
  2⤵
  PID:1816
- C:\Windows\System\syIBEfL.exe
  C:\Windows\System\syIBEfL.exe
  2⤵
  PID:3332
- C:\Windows\System\NCGNSMT.exe
  C:\Windows\System\NCGNSMT.exe
  2⤵
  PID:3896
- C:\Windows\System\wCeTezQ.exe
  C:\Windows\System\wCeTezQ.exe
  2⤵
  PID:3752
- C:\Windows\System\RLEflPh.exe
  C:\Windows\System\RLEflPh.exe
  2⤵
  PID:3844
- C:\Windows\System\mocTKGn.exe
  C:\Windows\System\mocTKGn.exe
  2⤵
  PID:3420
- C:\Windows\System\AnqfqZT.exe
  C:\Windows\System\AnqfqZT.exe
  2⤵
  PID:1728
- C:\Windows\System\tjzallS.exe
  C:\Windows\System\tjzallS.exe
  2⤵
  PID:4296
- C:\Windows\System\tvoLQGo.exe
  C:\Windows\System\tvoLQGo.exe
  2⤵
  PID:1960
- C:\Windows\System\rPrDvZI.exe
  C:\Windows\System\rPrDvZI.exe
  2⤵
  PID:3664
- C:\Windows\System\dJFlzmG.exe
  C:\Windows\System\dJFlzmG.exe
  2⤵
  PID:2172
- C:\Windows\System\ZymyErD.exe
  C:\Windows\System\ZymyErD.exe
  2⤵
  PID:4560
- C:\Windows\System\SnKuSRL.exe
  C:\Windows\System\SnKuSRL.exe
  2⤵
  PID:4688
- C:\Windows\System\MtVAHXZ.exe
  C:\Windows\System\MtVAHXZ.exe
  2⤵
  PID:2188
- C:\Windows\System\MqwgoyL.exe
  C:\Windows\System\MqwgoyL.exe
  2⤵
  PID:1340
- C:\Windows\System\OekolrL.exe
  C:\Windows\System\OekolrL.exe
  2⤵
  PID:1548
- C:\Windows\System\MZgreZo.exe
  C:\Windows\System\MZgreZo.exe
  2⤵
  PID:3156
- C:\Windows\System\aRQhIOy.exe
  C:\Windows\System\aRQhIOy.exe
  2⤵
  PID:4860
- C:\Windows\System\umgydQK.exe
  C:\Windows\System\umgydQK.exe
  2⤵
  PID:4128
- C:\Windows\System\pKDwHuD.exe
  C:\Windows\System\pKDwHuD.exe
  2⤵
  PID:4880
- C:\Windows\System\CoMSLZs.exe
  C:\Windows\System\CoMSLZs.exe
  2⤵
  PID:4916
- C:\Windows\System\brSbXPU.exe
  C:\Windows\System\brSbXPU.exe
  2⤵
  PID:1692
- C:\Windows\System\YiXHRjM.exe
  C:\Windows\System\YiXHRjM.exe
  2⤵
  PID:1456
- C:\Windows\System\xyfLhxw.exe
  C:\Windows\System\xyfLhxw.exe
  2⤵
  PID:3796
- C:\Windows\System\pcENIHD.exe
  C:\Windows\System\pcENIHD.exe
  2⤵
  PID:4440
- C:\Windows\System\tmDowgq.exe
  C:\Windows\System\tmDowgq.exe
  2⤵
  PID:3768
- C:\Windows\System\WvmXgzj.exe
  C:\Windows\System\WvmXgzj.exe
  2⤵
  PID:4604
- C:\Windows\System\eWLHgJp.exe
  C:\Windows\System\eWLHgJp.exe
  2⤵
  PID:4804
- C:\Windows\System\yeTOnPQ.exe
  C:\Windows\System\yeTOnPQ.exe
  2⤵
  PID:1168
- C:\Windows\System\tpDJVvq.exe
  C:\Windows\System\tpDJVvq.exe
  2⤵
  PID:3976
- C:\Windows\System\pKohogV.exe
  C:\Windows\System\pKohogV.exe
  2⤵
  PID:4644
- C:\Windows\System\TmbEBho.exe
  C:\Windows\System\TmbEBho.exe
  2⤵
  PID:1584
- C:\Windows\System\znnUMWL.exe
  C:\Windows\System\znnUMWL.exe
  2⤵
  PID:1764
- C:\Windows\System\fZsELZb.exe
  C:\Windows\System\fZsELZb.exe
  2⤵
  PID:4624
- C:\Windows\System\EsDWDcO.exe
  C:\Windows\System\EsDWDcO.exe
  2⤵
  PID:2336
- C:\Windows\System\ibGjpVh.exe
  C:\Windows\System\ibGjpVh.exe
  2⤵
  PID:4976
- C:\Windows\System\PcMoWVk.exe
  C:\Windows\System\PcMoWVk.exe
  2⤵
  PID:4180
- C:\Windows\System\xySqYeX.exe
  C:\Windows\System\xySqYeX.exe
  2⤵
  PID:4792
- C:\Windows\System\gAfZjul.exe
  C:\Windows\System\gAfZjul.exe
  2⤵
  PID:4064
- C:\Windows\System\siFRHnd.exe
  C:\Windows\System\siFRHnd.exe
  2⤵
  PID:3980
- C:\Windows\System\YcDptvF.exe
  C:\Windows\System\YcDptvF.exe
  2⤵
  PID:2864
- C:\Windows\System\OSmGUBu.exe
  C:\Windows\System\OSmGUBu.exe
  2⤵
  PID:4556
- C:\Windows\System\laPMZJG.exe
  C:\Windows\System\laPMZJG.exe
  2⤵
  PID:3496
- C:\Windows\System\iNbztlE.exe
  C:\Windows\System\iNbztlE.exe
  2⤵
  PID:4060
- C:\Windows\System\MSvfheP.exe
  C:\Windows\System\MSvfheP.exe
  2⤵
  PID:1864
- C:\Windows\System\AvgtULA.exe
  C:\Windows\System\AvgtULA.exe
  2⤵
  PID:3528
- C:\Windows\System\srdovcw.exe
  C:\Windows\System\srdovcw.exe
  2⤵
  PID:4408
- C:\Windows\System\wHILKSa.exe
  C:\Windows\System\wHILKSa.exe
  2⤵
  PID:1016
- C:\Windows\System\TxRMthc.exe
  C:\Windows\System\TxRMthc.exe
  2⤵
  PID:1036
- C:\Windows\System\tRapgxi.exe
  C:\Windows\System\tRapgxi.exe
  2⤵
  PID:3020
- C:\Windows\System\hGhzvSj.exe
  C:\Windows\System\hGhzvSj.exe
  2⤵
  PID:4472
- C:\Windows\System\ZHcXCXe.exe
  C:\Windows\System\ZHcXCXe.exe
  2⤵
  PID:4900
- C:\Windows\System\gkGORlA.exe
  C:\Windows\System\gkGORlA.exe
  2⤵
  PID:412
- C:\Windows\System\YzWJnRU.exe
  C:\Windows\System\YzWJnRU.exe
  2⤵
  PID:3596
- C:\Windows\System\NLvBwjb.exe
  C:\Windows\System\NLvBwjb.exe
  2⤵
  PID:3960
- C:\Windows\System\qoRjNSH.exe
  C:\Windows\System\qoRjNSH.exe
  2⤵
  PID:4240
- C:\Windows\System\YwzzBKf.exe
  C:\Windows\System\YwzzBKf.exe
  2⤵
  PID:3992
- C:\Windows\System\IIBeOCI.exe
  C:\Windows\System\IIBeOCI.exe
  2⤵
  PID:5056
- C:\Windows\System\xEXmRRw.exe
  C:\Windows\System\xEXmRRw.exe
  2⤵
  PID:1348
- C:\Windows\System\gqzIrbL.exe
  C:\Windows\System\gqzIrbL.exe
  2⤵
  PID:4676
- C:\Windows\System\ZkkpEnJ.exe
  C:\Windows\System\ZkkpEnJ.exe
  2⤵
  PID:5124
- C:\Windows\System\kpakbgJ.exe
  C:\Windows\System\kpakbgJ.exe
  2⤵
  PID:5140
- C:\Windows\System\maRiJdk.exe
  C:\Windows\System\maRiJdk.exe
  2⤵
  PID:5156
- C:\Windows\System\XFFugmL.exe
  C:\Windows\System\XFFugmL.exe
  2⤵
  PID:5172
- C:\Windows\System\VXYDjOF.exe
  C:\Windows\System\VXYDjOF.exe
  2⤵
  PID:5188
- C:\Windows\System\aWDDoQa.exe
  C:\Windows\System\aWDDoQa.exe
  2⤵
  PID:5204
- C:\Windows\System\WsyAvly.exe
  C:\Windows\System\WsyAvly.exe
  2⤵
  PID:5224
- C:\Windows\System\eUUyUOA.exe
  C:\Windows\System\eUUyUOA.exe
  2⤵
  PID:5240
- C:\Windows\System\oKWJsbn.exe
  C:\Windows\System\oKWJsbn.exe
  2⤵
  PID:5256
- C:\Windows\System\XcfaUIu.exe
  C:\Windows\System\XcfaUIu.exe
  2⤵
  PID:5272
- C:\Windows\System\HmXssOW.exe
  C:\Windows\System\HmXssOW.exe
  2⤵
  PID:5288
- C:\Windows\System\AxhreVI.exe
  C:\Windows\System\AxhreVI.exe
  2⤵
  PID:5488
- C:\Windows\System\bElupzS.exe
  C:\Windows\System\bElupzS.exe
  2⤵
  PID:5504
- C:\Windows\System\JrQyRcc.exe
  C:\Windows\System\JrQyRcc.exe
  2⤵
  PID:5520
- C:\Windows\System\DLoUSbm.exe
  C:\Windows\System\DLoUSbm.exe
  2⤵
  PID:5536
- C:\Windows\System\CWHcyEw.exe
  C:\Windows\System\CWHcyEw.exe
  2⤵
  PID:5552
- C:\Windows\System\Xupknfy.exe
  C:\Windows\System\Xupknfy.exe
  2⤵
  PID:5568
- C:\Windows\System\RjACUbb.exe
  C:\Windows\System\RjACUbb.exe
  2⤵
  PID:5588
- C:\Windows\System\NPScrPW.exe
  C:\Windows\System\NPScrPW.exe
  2⤵
  PID:5604
- C:\Windows\System\DZlxgyK.exe
  C:\Windows\System\DZlxgyK.exe
  2⤵
  PID:5620
- C:\Windows\System\zJcvwfa.exe
  C:\Windows\System\zJcvwfa.exe
  2⤵
  PID:5636
- C:\Windows\System\LbtHvns.exe
  C:\Windows\System\LbtHvns.exe
  2⤵
  PID:5652
- C:\Windows\System\dHebhzn.exe
  C:\Windows\System\dHebhzn.exe
  2⤵
  PID:5672
- C:\Windows\System\KuXnKZa.exe
  C:\Windows\System\KuXnKZa.exe
  2⤵
  PID:5688
- C:\Windows\System\frArVUp.exe
  C:\Windows\System\frArVUp.exe
  2⤵
  PID:5704
- C:\Windows\System\idNTLaE.exe
  C:\Windows\System\idNTLaE.exe
  2⤵
  PID:5720
- C:\Windows\System\QAwVcxE.exe
  C:\Windows\System\QAwVcxE.exe
  2⤵
  PID:5736
- C:\Windows\System\FdVQMYL.exe
  C:\Windows\System\FdVQMYL.exe
  2⤵
  PID:5752
- C:\Windows\System\iZICAuE.exe
  C:\Windows\System\iZICAuE.exe
  2⤵
  PID:5772
- C:\Windows\System\lGXFVzQ.exe
  C:\Windows\System\lGXFVzQ.exe
  2⤵
  PID:5788
- C:\Windows\System\AWZAvaH.exe
  C:\Windows\System\AWZAvaH.exe
  2⤵
  PID:5804
- C:\Windows\System\HFTyrnv.exe
  C:\Windows\System\HFTyrnv.exe
  2⤵
  PID:5820
- C:\Windows\System\Bowytgb.exe
  C:\Windows\System\Bowytgb.exe
  2⤵
  PID:5840
- C:\Windows\System\iMDKMjI.exe
  C:\Windows\System\iMDKMjI.exe
  2⤵
  PID:5856
- C:\Windows\System\eePCtQZ.exe
  C:\Windows\System\eePCtQZ.exe
  2⤵
  PID:5944
- C:\Windows\System\GDJKypx.exe
  C:\Windows\System\GDJKypx.exe
  2⤵
  PID:5964
- C:\Windows\System\oFNhcFH.exe
  C:\Windows\System\oFNhcFH.exe
  2⤵
  PID:5980
- C:\Windows\System\qHysdlu.exe
  C:\Windows\System\qHysdlu.exe
  2⤵
  PID:5996
- C:\Windows\System\hyOWBjs.exe
  C:\Windows\System\hyOWBjs.exe
  2⤵
  PID:6012
- C:\Windows\System\obHkanF.exe
  C:\Windows\System\obHkanF.exe
  2⤵
  PID:6028
- C:\Windows\System\VanFJtO.exe
  C:\Windows\System\VanFJtO.exe
  2⤵
  PID:6044
- C:\Windows\System\cAhFIIf.exe
  C:\Windows\System\cAhFIIf.exe
  2⤵
  PID:6064
- C:\Windows\System\GOdvODj.exe
  C:\Windows\System\GOdvODj.exe
  2⤵
  PID:6080
- C:\Windows\System\bFZgdpj.exe
  C:\Windows\System\bFZgdpj.exe
  2⤵
  PID:6096
- C:\Windows\System\WCLFfyL.exe
  C:\Windows\System\WCLFfyL.exe
  2⤵
  PID:6112
- C:\Windows\System\SWxFjgp.exe
  C:\Windows\System\SWxFjgp.exe
  2⤵
  PID:6128
- C:\Windows\System\ZvLiyOc.exe
  C:\Windows\System\ZvLiyOc.exe
  2⤵
  PID:4492
- C:\Windows\System\mFVRziz.exe
  C:\Windows\System\mFVRziz.exe
  2⤵
  PID:1164
- C:\Windows\System\tGqLzoW.exe
  C:\Windows\System\tGqLzoW.exe
  2⤵
  PID:5252
- C:\Windows\System\ImVLmoV.exe
  C:\Windows\System\ImVLmoV.exe
  2⤵
  PID:5216
- C:\Windows\System\JlGlhYP.exe
  C:\Windows\System\JlGlhYP.exe
  2⤵
  PID:4508
- C:\Windows\System\qEFjkVD.exe
  C:\Windows\System\qEFjkVD.exe
  2⤵
  PID:5136
- C:\Windows\System\jjaQePA.exe
  C:\Windows\System\jjaQePA.exe
  2⤵
  PID:5300
- C:\Windows\System\QuvhVEN.exe
  C:\Windows\System\QuvhVEN.exe
  2⤵
  PID:5196
- C:\Windows\System\pgmNkLw.exe
  C:\Windows\System\pgmNkLw.exe
  2⤵
  PID:5268
- C:\Windows\System\bZHRalZ.exe
  C:\Windows\System\bZHRalZ.exe
  2⤵
  PID:3576
- C:\Windows\System\gHDubFA.exe
  C:\Windows\System\gHDubFA.exe
  2⤵
  PID:3940
- C:\Windows\System\NYJViPW.exe
  C:\Windows\System\NYJViPW.exe
  2⤵
  PID:5352
- C:\Windows\System\IxtUjBy.exe
  C:\Windows\System\IxtUjBy.exe
  2⤵
  PID:5348
- C:\Windows\System\iRaNNLi.exe
  C:\Windows\System\iRaNNLi.exe
  2⤵
  PID:5376
- C:\Windows\System\hhVNeTb.exe
  C:\Windows\System\hhVNeTb.exe
  2⤵
  PID:5392
- C:\Windows\System\TMurHxJ.exe
  C:\Windows\System\TMurHxJ.exe
  2⤵
  PID:5416
- C:\Windows\System\lZKifwO.exe
  C:\Windows\System\lZKifwO.exe
  2⤵
  PID:5428
- C:\Windows\System\wZgrShX.exe
  C:\Windows\System\wZgrShX.exe
  2⤵
  PID:5448
- C:\Windows\System\AIHrUjZ.exe
  C:\Windows\System\AIHrUjZ.exe
  2⤵
  PID:5832
- C:\Windows\System\dRHuCdj.exe
  C:\Windows\System\dRHuCdj.exe
  2⤵
  PID:5668
- C:\Windows\System\szimsDQ.exe
  C:\Windows\System\szimsDQ.exe
  2⤵
  PID:5896
- C:\Windows\System\PRoHcSq.exe
  C:\Windows\System\PRoHcSq.exe
  2⤵
  PID:5920
- C:\Windows\System\wIpDGhi.exe
  C:\Windows\System\wIpDGhi.exe
  2⤵
  PID:5904
- C:\Windows\System\qOFhXme.exe
  C:\Windows\System\qOFhXme.exe
  2⤵
  PID:5836
- C:\Windows\System\iHvlGRU.exe
  C:\Windows\System\iHvlGRU.exe
  2⤵
  PID:5460
- C:\Windows\System\FiwevPI.exe
  C:\Windows\System\FiwevPI.exe
  2⤵
  PID:5480
- C:\Windows\System\BwjGicz.exe
  C:\Windows\System\BwjGicz.exe
  2⤵
  PID:5580
- C:\Windows\System\UwqZQlb.exe
  C:\Windows\System\UwqZQlb.exe
  2⤵
  PID:5484
- C:\Windows\System\womZPob.exe
  C:\Windows\System\womZPob.exe
  2⤵
  PID:5712
- C:\Windows\System\ihgbVzF.exe
  C:\Windows\System\ihgbVzF.exe
  2⤵
  PID:5816
- C:\Windows\System\tzEnocH.exe
  C:\Windows\System\tzEnocH.exe
  2⤵
  PID:6008
- C:\Windows\System\rSxwYZN.exe
  C:\Windows\System\rSxwYZN.exe
  2⤵
  PID:6104
- C:\Windows\System\xbAJqnJ.exe
  C:\Windows\System\xbAJqnJ.exe
  2⤵
  PID:6136
- C:\Windows\System\dmGqMxi.exe
  C:\Windows\System\dmGqMxi.exe
  2⤵
  PID:5284
- C:\Windows\System\BHwGvXo.exe
  C:\Windows\System\BHwGvXo.exe
  2⤵
  PID:5232
- C:\Windows\System\RikFXKM.exe
  C:\Windows\System\RikFXKM.exe
  2⤵
  PID:6108
- C:\Windows\System\aqewLpp.exe
  C:\Windows\System\aqewLpp.exe
  2⤵
  PID:5952
- C:\Windows\System\rRWMJYQ.exe
  C:\Windows\System\rRWMJYQ.exe
  2⤵
  PID:6024
- C:\Windows\System\iNRWLNY.exe
  C:\Windows\System\iNRWLNY.exe
  2⤵
  PID:5304
- C:\Windows\System\rZeNGtL.exe
  C:\Windows\System\rZeNGtL.exe
  2⤵
  PID:6092
- C:\Windows\System\hJWurZc.exe
  C:\Windows\System\hJWurZc.exe
  2⤵
  PID:1528
- C:\Windows\System\ECavcWZ.exe
  C:\Windows\System\ECavcWZ.exe
  2⤵
  PID:5344
- C:\Windows\System\nGLXHwD.exe
  C:\Windows\System\nGLXHwD.exe
  2⤵
  PID:5360
- C:\Windows\System\NUWOZcr.exe
  C:\Windows\System\NUWOZcr.exe
  2⤵
  PID:5372
- C:\Windows\System\dNjofkJ.exe
  C:\Windows\System\dNjofkJ.exe
  2⤵
  PID:5432
- C:\Windows\System\gmMzQHZ.exe
  C:\Windows\System\gmMzQHZ.exe
  2⤵
  PID:5464
- C:\Windows\System\nXkhyMU.exe
  C:\Windows\System\nXkhyMU.exe
  2⤵
  PID:5660
- C:\Windows\System\SeZrbCj.exe
  C:\Windows\System\SeZrbCj.exe
  2⤵
  PID:5472
- C:\Windows\System\iCQwkFZ.exe
  C:\Windows\System\iCQwkFZ.exe
  2⤵
  PID:5576
- C:\Windows\System\aIKqKJs.exe
  C:\Windows\System\aIKqKJs.exe
  2⤵
  PID:5796
- C:\Windows\System\sOGqEjn.exe
  C:\Windows\System\sOGqEjn.exe
  2⤵
  PID:5884
- C:\Windows\System\DNrZYGV.exe
  C:\Windows\System\DNrZYGV.exe
  2⤵
  PID:5864
- C:\Windows\System\ltgMyRN.exe
  C:\Windows\System\ltgMyRN.exe
  2⤵
  PID:5716
- C:\Windows\System\zGgpxdV.exe
  C:\Windows\System\zGgpxdV.exe
  2⤵
  PID:5544
- C:\Windows\System\wUOkGoy.exe
  C:\Windows\System\wUOkGoy.exe
  2⤵
  PID:5976
- C:\Windows\System\vkXUGZq.exe
  C:\Windows\System\vkXUGZq.exe
  2⤵
  PID:6124
- C:\Windows\System\dqipdpp.exe
  C:\Windows\System\dqipdpp.exe
  2⤵
  PID:4692
- C:\Windows\System\UqyqGSV.exe
  C:\Windows\System\UqyqGSV.exe
  2⤵
  PID:5408
- C:\Windows\System\RnCbbPv.exe
  C:\Windows\System\RnCbbPv.exe
  2⤵
  PID:5972
- C:\Windows\System\jsJCSFC.exe
  C:\Windows\System\jsJCSFC.exe
  2⤵
  PID:5184
- C:\Windows\System\tQKYACa.exe
  C:\Windows\System\tQKYACa.exe
  2⤵
  PID:4280
- C:\Windows\System\elysZRf.exe
  C:\Windows\System\elysZRf.exe
  2⤵
  PID:5612
- C:\Windows\System\IFAsSsz.exe
  C:\Windows\System\IFAsSsz.exe
  2⤵
  PID:6076
- C:\Windows\System\owrPhJA.exe
  C:\Windows\System\owrPhJA.exe
  2⤵
  PID:5320
- C:\Windows\System\shbRJlo.exe
  C:\Windows\System\shbRJlo.exe
  2⤵
  PID:1820
- C:\Windows\System\Mgdstoz.exe
  C:\Windows\System\Mgdstoz.exe
  2⤵
  PID:5340
- C:\Windows\System\chDkJaJ.exe
  C:\Windows\System\chDkJaJ.exe
  2⤵
  PID:5528
- C:\Windows\System\IdkUSJk.exe
  C:\Windows\System\IdkUSJk.exe
  2⤵
  PID:5700
- C:\Windows\System\IqqzKtn.exe
  C:\Windows\System\IqqzKtn.exe
  2⤵
  PID:5932
- C:\Windows\System\cLHNXfa.exe
  C:\Windows\System\cLHNXfa.exe
  2⤵
  PID:3560
- C:\Windows\System\oabtwQL.exe
  C:\Windows\System\oabtwQL.exe
  2⤵
  PID:6056
- C:\Windows\System\ApLFuNg.exe
  C:\Windows\System\ApLFuNg.exe
  2⤵
  PID:5784
- C:\Windows\System\QPQZvKP.exe
  C:\Windows\System\QPQZvKP.exe
  2⤵
  PID:5680
- C:\Windows\System\eaFCmkt.exe
  C:\Windows\System\eaFCmkt.exe
  2⤵
  PID:5316
- C:\Windows\System\SxPuEWM.exe
  C:\Windows\System\SxPuEWM.exe
  2⤵
  PID:5888
- C:\Windows\System\ilOiKNG.exe
  C:\Windows\System\ilOiKNG.exe
  2⤵
  PID:3908
- C:\Windows\System\EaqquNt.exe
  C:\Windows\System\EaqquNt.exe
  2⤵
  PID:6040
- C:\Windows\System\pWXxqvH.exe
  C:\Windows\System\pWXxqvH.exe
  2⤵
  PID:5684
- C:\Windows\System\WIoltDS.exe
  C:\Windows\System\WIoltDS.exe
  2⤵
  PID:5992
- C:\Windows\System\HsphExm.exe
  C:\Windows\System\HsphExm.exe
  2⤵
  PID:5928
- C:\Windows\System\sIGpuSt.exe
  C:\Windows\System\sIGpuSt.exe
  2⤵
  PID:5564
- C:\Windows\System\mXMLFgP.exe
  C:\Windows\System\mXMLFgP.exe
  2⤵
  PID:5852
- C:\Windows\System\BeNxwEN.exe
  C:\Windows\System\BeNxwEN.exe
  2⤵
  PID:5728
- C:\Windows\System\iKGrjFH.exe
  C:\Windows\System\iKGrjFH.exe
  2⤵
  PID:6156
- C:\Windows\System\kkbdniY.exe
  C:\Windows\System\kkbdniY.exe
  2⤵
  PID:6172
- C:\Windows\System\TGDtFpb.exe
  C:\Windows\System\TGDtFpb.exe
  2⤵
  PID:6188
- C:\Windows\System\aBYRPLL.exe
  C:\Windows\System\aBYRPLL.exe
  2⤵
  PID:6204
- C:\Windows\System\QBJwCVr.exe
  C:\Windows\System\QBJwCVr.exe
  2⤵
  PID:6220
- C:\Windows\System\KLRdaBQ.exe
  C:\Windows\System\KLRdaBQ.exe
  2⤵
  PID:6236
- C:\Windows\System\uPSWxwN.exe
  C:\Windows\System\uPSWxwN.exe
  2⤵
  PID:6256
- C:\Windows\System\UVrbIyr.exe
  C:\Windows\System\UVrbIyr.exe
  2⤵
  PID:6272
- C:\Windows\System\lSitBmT.exe
  C:\Windows\System\lSitBmT.exe
  2⤵
  PID:6288
- C:\Windows\System\WmZLsHA.exe
  C:\Windows\System\WmZLsHA.exe
  2⤵
  PID:6304
- C:\Windows\System\RyPhORx.exe
  C:\Windows\System\RyPhORx.exe
  2⤵
  PID:6324
- C:\Windows\System\abHHQkW.exe
  C:\Windows\System\abHHQkW.exe
  2⤵
  PID:6340
- C:\Windows\System\sMkWaWG.exe
  C:\Windows\System\sMkWaWG.exe
  2⤵
  PID:6356
- C:\Windows\System\SPgQsSO.exe
  C:\Windows\System\SPgQsSO.exe
  2⤵
  PID:6376
- C:\Windows\System\NJvNaDc.exe
  C:\Windows\System\NJvNaDc.exe
  2⤵
  PID:6392
- C:\Windows\System\JowcbUA.exe
  C:\Windows\System\JowcbUA.exe
  2⤵
  PID:6408
- C:\Windows\System\NTJHvID.exe
  C:\Windows\System\NTJHvID.exe
  2⤵
  PID:6436
- C:\Windows\System\SlNrmJV.exe
  C:\Windows\System\SlNrmJV.exe
  2⤵
  PID:6452
- C:\Windows\System\uWMWvWF.exe
  C:\Windows\System\uWMWvWF.exe
  2⤵
  PID:6540
- C:\Windows\System\gDTKNmg.exe
  C:\Windows\System\gDTKNmg.exe
  2⤵
  PID:6628
- C:\Windows\System\UiRoFIX.exe
  C:\Windows\System\UiRoFIX.exe
  2⤵
  PID:6644
- C:\Windows\System\AVZrLuv.exe
  C:\Windows\System\AVZrLuv.exe
  2⤵
  PID:6664
- C:\Windows\System\RtjHWMJ.exe
  C:\Windows\System\RtjHWMJ.exe
  2⤵
  PID:6680
- C:\Windows\System\goocIGF.exe
  C:\Windows\System\goocIGF.exe
  2⤵
  PID:6772
- C:\Windows\System\oUDStdZ.exe
  C:\Windows\System\oUDStdZ.exe
  2⤵
  PID:6788
- C:\Windows\System\UyZneZu.exe
  C:\Windows\System\UyZneZu.exe
  2⤵
  PID:6804
- C:\Windows\System\XobMyIS.exe
  C:\Windows\System\XobMyIS.exe
  2⤵
  PID:6820
- C:\Windows\System\DWlJKua.exe
  C:\Windows\System\DWlJKua.exe
  2⤵
  PID:6836
- C:\Windows\System\FVigYza.exe
  C:\Windows\System\FVigYza.exe
  2⤵
  PID:6852
- C:\Windows\System\vDftKHy.exe
  C:\Windows\System\vDftKHy.exe
  2⤵
  PID:6872
- C:\Windows\System\zpbxhlr.exe
  C:\Windows\System\zpbxhlr.exe
  2⤵
  PID:6888
- C:\Windows\System\qawSpeE.exe
  C:\Windows\System\qawSpeE.exe
  2⤵
  PID:6904
- C:\Windows\System\cqgGeoh.exe
  C:\Windows\System\cqgGeoh.exe
  2⤵
  PID:6920
- C:\Windows\System\mobybqC.exe
  C:\Windows\System\mobybqC.exe
  2⤵
  PID:6936
- C:\Windows\System\tZnnVjY.exe
  C:\Windows\System\tZnnVjY.exe
  2⤵
  PID:6956
- C:\Windows\System\oURhCxQ.exe
  C:\Windows\System\oURhCxQ.exe
  2⤵
  PID:6972
- C:\Windows\System\lRTcCfv.exe
  C:\Windows\System\lRTcCfv.exe
  2⤵
  PID:6988
- C:\Windows\System\lDWVeGd.exe
  C:\Windows\System\lDWVeGd.exe
  2⤵
  PID:7004
- C:\Windows\System\mBYUOqi.exe
  C:\Windows\System\mBYUOqi.exe
  2⤵
  PID:7020
- C:\Windows\System\isDYBmW.exe
  C:\Windows\System\isDYBmW.exe
  2⤵
  PID:7036
- C:\Windows\System\lABVeJz.exe
  C:\Windows\System\lABVeJz.exe
  2⤵
  PID:7052
- C:\Windows\System\KtiSxxN.exe
  C:\Windows\System\KtiSxxN.exe
  2⤵
  PID:7068
- C:\Windows\System\MKEzSYn.exe
  C:\Windows\System\MKEzSYn.exe
  2⤵
  PID:7084
- C:\Windows\System\VdlYnSq.exe
  C:\Windows\System\VdlYnSq.exe
  2⤵
  PID:7104
- C:\Windows\System\bSfGXbj.exe
  C:\Windows\System\bSfGXbj.exe
  2⤵
  PID:7120
- C:\Windows\System\LdUbmsL.exe
  C:\Windows\System\LdUbmsL.exe
  2⤵
  PID:7136
- C:\Windows\System\HTMuqbo.exe
  C:\Windows\System\HTMuqbo.exe
  2⤵
  PID:7152
- C:\Windows\System\JrfErOR.exe
  C:\Windows\System\JrfErOR.exe
  2⤵
  PID:6232
- C:\Windows\System\PKrTLtr.exe
  C:\Windows\System\PKrTLtr.exe
  2⤵
  PID:6164
- C:\Windows\System\IWctXvX.exe
  C:\Windows\System\IWctXvX.exe
  2⤵
  PID:6364
- C:\Windows\System\NTCFggV.exe
  C:\Windows\System\NTCFggV.exe
  2⤵
  PID:6372
- C:\Windows\System\UPkJIhA.exe
  C:\Windows\System\UPkJIhA.exe
  2⤵
  PID:6060
- C:\Windows\System\iTFJvLE.exe
  C:\Windows\System\iTFJvLE.exe
  2⤵
  PID:6184
- C:\Windows\System\zDCjUZG.exe
  C:\Windows\System\zDCjUZG.exe
  2⤵
  PID:6280
- C:\Windows\System\DGVMCBJ.exe
  C:\Windows\System\DGVMCBJ.exe
  2⤵
  PID:6320
- C:\Windows\System\uiinNgA.exe
  C:\Windows\System\uiinNgA.exe
  2⤵
  PID:6388
- C:\Windows\System\mkTWQmt.exe
  C:\Windows\System\mkTWQmt.exe
  2⤵
  PID:6420
- C:\Windows\System\tZtZUmI.exe
  C:\Windows\System\tZtZUmI.exe
  2⤵
  PID:6460
- C:\Windows\System\oZQXlCO.exe
  C:\Windows\System\oZQXlCO.exe
  2⤵
  PID:6468
- C:\Windows\System\GLMbdaT.exe
  C:\Windows\System\GLMbdaT.exe
  2⤵
  PID:6480
- C:\Windows\System\oSvGxjv.exe
  C:\Windows\System\oSvGxjv.exe
  2⤵
  PID:6496
- C:\Windows\System\HjSpfDw.exe
  C:\Windows\System\HjSpfDw.exe
  2⤵
  PID:6516
- C:\Windows\System\pzPajAQ.exe
  C:\Windows\System\pzPajAQ.exe
  2⤵
  PID:6568
- C:\Windows\System\rgScwam.exe
  C:\Windows\System\rgScwam.exe
  2⤵
  PID:6584
- C:\Windows\System\CQRRmxO.exe
  C:\Windows\System\CQRRmxO.exe
  2⤵
  PID:6604
- C:\Windows\System\eYpBKCm.exe
  C:\Windows\System\eYpBKCm.exe
  2⤵
  PID:6528
- C:\Windows\System\CgSSEHD.exe
  C:\Windows\System\CgSSEHD.exe
  2⤵
  PID:6652
- C:\Windows\System\IkGduQa.exe
  C:\Windows\System\IkGduQa.exe
  2⤵
  PID:6688
- C:\Windows\System\fbwGclg.exe
  C:\Windows\System\fbwGclg.exe
  2⤵
  PID:6708
- C:\Windows\System\eBriMPT.exe
  C:\Windows\System\eBriMPT.exe
  2⤵
  PID:6724
- C:\Windows\System\ljfWCDS.exe
  C:\Windows\System\ljfWCDS.exe
  2⤵
  PID:6744
- C:\Windows\System\UNtRmBw.exe
  C:\Windows\System\UNtRmBw.exe
  2⤵
  PID:6640
- C:\Windows\System\Jhifvmu.exe
  C:\Windows\System\Jhifvmu.exe
  2⤵
  PID:6760
- C:\Windows\System\aGuhOUd.exe
  C:\Windows\System\aGuhOUd.exe
  2⤵
  PID:5596
- C:\Windows\System\vfTkkaQ.exe
  C:\Windows\System\vfTkkaQ.exe
  2⤵
  PID:6880
- C:\Windows\System\MQTwGSl.exe
  C:\Windows\System\MQTwGSl.exe
  2⤵
  PID:6944
- C:\Windows\System\utVhUxw.exe
  C:\Windows\System\utVhUxw.exe
  2⤵
  PID:7016
- C:\Windows\System\vRVlvkq.exe
  C:\Windows\System\vRVlvkq.exe
  2⤵
  PID:7080
- C:\Windows\System\LKckDbb.exe
  C:\Windows\System\LKckDbb.exe
  2⤵
  PID:7148
- C:\Windows\System\rjIDyzc.exe
  C:\Windows\System\rjIDyzc.exe
  2⤵
  PID:6844
- C:\Windows\System\cwaTBak.exe
  C:\Windows\System\cwaTBak.exe
  2⤵
  PID:6196
- C:\Windows\System\nWmXEqF.exe
  C:\Windows\System\nWmXEqF.exe
  2⤵
  PID:6264
- C:\Windows\System\FIHlerN.exe
  C:\Windows\System\FIHlerN.exe
  2⤵
  PID:7164
- C:\Windows\System\uGIVbGr.exe
  C:\Windows\System\uGIVbGr.exe
  2⤵
  PID:7060
- C:\Windows\System\SBrCLBv.exe
  C:\Windows\System\SBrCLBv.exe
  2⤵
  PID:5532
- C:\Windows\System\mOKWsro.exe
  C:\Windows\System\mOKWsro.exe
  2⤵
  PID:6248
- C:\Windows\System\GmDnbXS.exe
  C:\Windows\System\GmDnbXS.exe
  2⤵
  PID:6428
- C:\Windows\System\uNAoAAw.exe
  C:\Windows\System\uNAoAAw.exe
  2⤵
  PID:6508
- C:\Windows\System\yNgxOaN.exe
  C:\Windows\System\yNgxOaN.exe
  2⤵
  PID:6608
- C:\Windows\System\IpuhkyA.exe
  C:\Windows\System\IpuhkyA.exe
  2⤵
  PID:6728
- C:\Windows\System\uHHvutN.exe
  C:\Windows\System\uHHvutN.exe
  2⤵
  PID:6796
- C:\Windows\System\TrLtnWj.exe
  C:\Windows\System\TrLtnWj.exe
  2⤵
  PID:7048
- C:\Windows\System\FDZqkVC.exe
  C:\Windows\System\FDZqkVC.exe
  2⤵
  PID:7076
- C:\Windows\System\AdQdiIe.exe
  C:\Windows\System\AdQdiIe.exe
  2⤵
  PID:5424
- C:\Windows\System\tuPxvKu.exe
  C:\Windows\System\tuPxvKu.exe
  2⤵
  PID:5780
- C:\Windows\System\ZesyjGR.exe
  C:\Windows\System\ZesyjGR.exe
  2⤵
  PID:6740
- C:\Windows\System\QNVKyNf.exe
  C:\Windows\System\QNVKyNf.exe
  2⤵
  PID:7116
- C:\Windows\System\EFhQclg.exe
  C:\Windows\System\EFhQclg.exe
  2⤵
  PID:6600
- C:\Windows\System\amDTnsp.exe
  C:\Windows\System\amDTnsp.exe
  2⤵
  PID:6368
- C:\Windows\System\cxckfSR.exe
  C:\Windows\System\cxckfSR.exe
  2⤵
  PID:6488
- C:\Windows\System\pVZpTRo.exe
  C:\Windows\System\pVZpTRo.exe
  2⤵
  PID:6616
- C:\Windows\System\hJCcZqb.exe
  C:\Windows\System\hJCcZqb.exe
  2⤵
  PID:6952
- C:\Windows\System\dSpuNnc.exe
  C:\Windows\System\dSpuNnc.exe
  2⤵
  PID:5632
- C:\Windows\System\ZXmCjep.exe
  C:\Windows\System\ZXmCjep.exe
  2⤵
  PID:7028
- C:\Windows\System\bGRGUIv.exe
  C:\Windows\System\bGRGUIv.exe
  2⤵
  PID:6928
- C:\Windows\System\NVEfCyN.exe
  C:\Windows\System\NVEfCyN.exe
  2⤵
  PID:6868
- C:\Windows\System\tRKAFXE.exe
  C:\Windows\System\tRKAFXE.exe
  2⤵
  PID:6384
- C:\Windows\System\ubrvCmv.exe
  C:\Windows\System\ubrvCmv.exe
  2⤵
  PID:6720
- C:\Windows\System\srCcIaY.exe
  C:\Windows\System\srCcIaY.exe
  2⤵
  PID:6764
- C:\Windows\System\WVZzctQ.exe
  C:\Windows\System\WVZzctQ.exe
  2⤵
  PID:6180
- C:\Windows\System\nAKpIPh.exe
  C:\Windows\System\nAKpIPh.exe
  2⤵
  PID:6784
- C:\Windows\System\jEOIMrN.exe
  C:\Windows\System\jEOIMrN.exe
  2⤵
  PID:6996
- C:\Windows\System\TgeAioM.exe
  C:\Windows\System\TgeAioM.exe
  2⤵
  PID:7100
- C:\Windows\System\itBLXCQ.exe
  C:\Windows\System\itBLXCQ.exe
  2⤵
  PID:7032
- C:\Windows\System\ufVUOFN.exe
  C:\Windows\System\ufVUOFN.exe
  2⤵
  PID:6148
- C:\Windows\System\ocbOOMU.exe
  C:\Windows\System\ocbOOMU.exe
  2⤵
  PID:7000
- C:\Windows\System\phyyjGt.exe
  C:\Windows\System\phyyjGt.exe
  2⤵
  PID:6476
- C:\Windows\System\ZYVjmjn.exe
  C:\Windows\System\ZYVjmjn.exe
  2⤵
  PID:6912
- C:\Windows\System\aakWBOy.exe
  C:\Windows\System\aakWBOy.exe
  2⤵
  PID:6524
- C:\Windows\System\sHXMFPF.exe
  C:\Windows\System\sHXMFPF.exe
  2⤵
  PID:6752
- C:\Windows\System\qslsESO.exe
  C:\Windows\System\qslsESO.exe
  2⤵
  PID:7184
- C:\Windows\System\gkDQmIc.exe
  C:\Windows\System\gkDQmIc.exe
  2⤵
  PID:7200
- C:\Windows\System\CErEtxZ.exe
  C:\Windows\System\CErEtxZ.exe
  2⤵
  PID:7216
- C:\Windows\System\GsYXAQo.exe
  C:\Windows\System\GsYXAQo.exe
  2⤵
  PID:7232
- C:\Windows\System\ksbMxVq.exe
  C:\Windows\System\ksbMxVq.exe
  2⤵
  PID:7340
- C:\Windows\System\KYOMGYl.exe
  C:\Windows\System\KYOMGYl.exe
  2⤵
  PID:7360
- C:\Windows\System\aUASJiV.exe
  C:\Windows\System\aUASJiV.exe
  2⤵
  PID:7380
- C:\Windows\System\vZRavpc.exe
  C:\Windows\System\vZRavpc.exe
  2⤵
  PID:7396
- C:\Windows\System\yjhVaAQ.exe
  C:\Windows\System\yjhVaAQ.exe
  2⤵
  PID:7412
- C:\Windows\System\lzfBlgE.exe
  C:\Windows\System\lzfBlgE.exe
  2⤵
  PID:7428
- C:\Windows\System\RLapZQd.exe
  C:\Windows\System\RLapZQd.exe
  2⤵
  PID:7448
- C:\Windows\System\ijmbiEs.exe
  C:\Windows\System\ijmbiEs.exe
  2⤵
  PID:7464
- C:\Windows\System\AJmciLF.exe
  C:\Windows\System\AJmciLF.exe
  2⤵
  PID:7480
- C:\Windows\System\pbeewxI.exe
  C:\Windows\System\pbeewxI.exe
  2⤵
  PID:7496
- C:\Windows\System\hmjCPbo.exe
  C:\Windows\System\hmjCPbo.exe
  2⤵
  PID:7512
- C:\Windows\System\tUKrnOJ.exe
  C:\Windows\System\tUKrnOJ.exe
  2⤵
  PID:7644
- C:\Windows\System\lCDfjYL.exe
  C:\Windows\System\lCDfjYL.exe
  2⤵
  PID:7660
- C:\Windows\System\siReDpE.exe
  C:\Windows\System\siReDpE.exe
  2⤵
  PID:7676
- C:\Windows\System\AWMWzzh.exe
  C:\Windows\System\AWMWzzh.exe
  2⤵
  PID:7692
- C:\Windows\System\QSLEGEN.exe
  C:\Windows\System\QSLEGEN.exe
  2⤵
  PID:7708
- C:\Windows\System\uaWAFAW.exe
  C:\Windows\System\uaWAFAW.exe
  2⤵
  PID:7724
- C:\Windows\System\UUrgcdN.exe
  C:\Windows\System\UUrgcdN.exe
  2⤵
  PID:7744
- C:\Windows\System\TLvTwkW.exe
  C:\Windows\System\TLvTwkW.exe
  2⤵
  PID:7760
- C:\Windows\System\meyZhCs.exe
  C:\Windows\System\meyZhCs.exe
  2⤵
  PID:7776
- C:\Windows\System\XXANBWc.exe
  C:\Windows\System\XXANBWc.exe
  2⤵
  PID:7796
- C:\Windows\System\FznsLDu.exe
  C:\Windows\System\FznsLDu.exe
  2⤵
  PID:7812
- C:\Windows\System\oQKafSr.exe
  C:\Windows\System\oQKafSr.exe
  2⤵
  PID:7828
- C:\Windows\System\USbZMRw.exe
  C:\Windows\System\USbZMRw.exe
  2⤵
  PID:7844
- C:\Windows\System\uhnUVqo.exe
  C:\Windows\System\uhnUVqo.exe
  2⤵
  PID:7860
- C:\Windows\System\krbXPiB.exe
  C:\Windows\System\krbXPiB.exe
  2⤵
  PID:7880
- C:\Windows\System\KrxPEDz.exe
  C:\Windows\System\KrxPEDz.exe
  2⤵
  PID:7896
- C:\Windows\System\GxzxQss.exe
  C:\Windows\System\GxzxQss.exe
  2⤵
  PID:7912
- C:\Windows\System\noOaEJQ.exe
  C:\Windows\System\noOaEJQ.exe
  2⤵
  PID:7932
- C:\Windows\System\qHFsqVi.exe
  C:\Windows\System\qHFsqVi.exe
  2⤵
  PID:7948
- C:\Windows\System\lowRzFy.exe
  C:\Windows\System\lowRzFy.exe
  2⤵
  PID:7968
- C:\Windows\System\TMuOSaG.exe
  C:\Windows\System\TMuOSaG.exe
  2⤵
  PID:7984
- C:\Windows\System\XUTwUIj.exe
  C:\Windows\System\XUTwUIj.exe
  2⤵
  PID:8000
- C:\Windows\System\UcVSvMI.exe
  C:\Windows\System\UcVSvMI.exe
  2⤵
  PID:8020
- C:\Windows\System\ldCBxQZ.exe
  C:\Windows\System\ldCBxQZ.exe
  2⤵
  PID:8036
- C:\Windows\System\tMLHsUH.exe
  C:\Windows\System\tMLHsUH.exe
  2⤵
  PID:8052
- C:\Windows\System\wFLXzhQ.exe
  C:\Windows\System\wFLXzhQ.exe
  2⤵
  PID:8072
- C:\Windows\System\EOaeEtu.exe
  C:\Windows\System\EOaeEtu.exe
  2⤵
  PID:8088
- C:\Windows\System\WLAxzpc.exe
  C:\Windows\System\WLAxzpc.exe
  2⤵
  PID:8104
- C:\Windows\System\sHEVKGg.exe
  C:\Windows\System\sHEVKGg.exe
  2⤵
  PID:8120
- C:\Windows\System\DYixOta.exe
  C:\Windows\System\DYixOta.exe
  2⤵
  PID:8140
- C:\Windows\System\gkwYxpg.exe
  C:\Windows\System\gkwYxpg.exe
  2⤵
  PID:8156
- C:\Windows\System\qbYIUVj.exe
  C:\Windows\System\qbYIUVj.exe
  2⤵
  PID:8176
- C:\Windows\System\NmhYUaw.exe
  C:\Windows\System\NmhYUaw.exe
  2⤵
  PID:7196
- C:\Windows\System\NdHqfSR.exe
  C:\Windows\System\NdHqfSR.exe
  2⤵
  PID:7224
- C:\Windows\System\yVVNHoS.exe
  C:\Windows\System\yVVNHoS.exe
  2⤵
  PID:7208
- C:\Windows\System\HUlvmFl.exe
  C:\Windows\System\HUlvmFl.exe
  2⤵
  PID:7256
- C:\Windows\System\DdiUSdb.exe
  C:\Windows\System\DdiUSdb.exe
  2⤵
  PID:7280
- C:\Windows\System\LbQrtrk.exe
  C:\Windows\System\LbQrtrk.exe
  2⤵
  PID:7300
- C:\Windows\System\QCvqAiw.exe
  C:\Windows\System\QCvqAiw.exe
  2⤵
  PID:7316
- C:\Windows\System\isiksgz.exe
  C:\Windows\System\isiksgz.exe
  2⤵
  PID:7336
- C:\Windows\System\zNbplMm.exe
  C:\Windows\System\zNbplMm.exe
  2⤵
  PID:7492
- C:\Windows\System\dPyPHKn.exe
  C:\Windows\System\dPyPHKn.exe
  2⤵
  PID:7424
- C:\Windows\System\hIwZrml.exe
  C:\Windows\System\hIwZrml.exe
  2⤵
  PID:7368
- C:\Windows\System\GdUsWYJ.exe
  C:\Windows\System\GdUsWYJ.exe
  2⤵
  PID:7408
- C:\Windows\System\rfiutTv.exe
  C:\Windows\System\rfiutTv.exe
  2⤵
  PID:7376
- C:\Windows\System\utqGrWu.exe
  C:\Windows\System\utqGrWu.exe
  2⤵
  PID:7540
- C:\Windows\System\bXcJmoq.exe
  C:\Windows\System\bXcJmoq.exe
  2⤵
  PID:7560
- C:\Windows\System\GoiJkBU.exe
  C:\Windows\System\GoiJkBU.exe
  2⤵
  PID:7572
- C:\Windows\System\zaLkVHr.exe
  C:\Windows\System\zaLkVHr.exe
  2⤵
  PID:7592
- C:\Windows\System\CNEMKBi.exe
  C:\Windows\System\CNEMKBi.exe
  2⤵
  PID:7608
- C:\Windows\System\xOYjsod.exe
  C:\Windows\System\xOYjsod.exe
  2⤵
  PID:7624
- C:\Windows\System\BNyWXOW.exe
  C:\Windows\System\BNyWXOW.exe
  2⤵
  PID:7668
- C:\Windows\System\eWRFjRq.exe
  C:\Windows\System\eWRFjRq.exe
  2⤵
  PID:7732
- C:\Windows\System\xVXilBN.exe
  C:\Windows\System\xVXilBN.exe
  2⤵
  PID:7868
- C:\Windows\System\EyrYOjg.exe
  C:\Windows\System\EyrYOjg.exe
  2⤵
  PID:7772
- C:\Windows\System\ZrMODcz.exe
  C:\Windows\System\ZrMODcz.exe
  2⤵
  PID:7808
- C:\Windows\System\cOTJGFm.exe
  C:\Windows\System\cOTJGFm.exe
  2⤵
  PID:8044
- C:\Windows\System\GTVgoNI.exe
  C:\Windows\System\GTVgoNI.exe
  2⤵
  PID:8116
- C:\Windows\System\KZHOKWi.exe
  C:\Windows\System\KZHOKWi.exe
  2⤵
  PID:7956
- C:\Windows\System\PznKoQe.exe
  C:\Windows\System\PznKoQe.exe
  2⤵
  PID:7756
- C:\Windows\System\boarHfM.exe
  C:\Windows\System\boarHfM.exe
  2⤵
  PID:7892
- C:\Windows\System\upGPQxY.exe
  C:\Windows\System\upGPQxY.exe
  2⤵
  PID:7792
- C:\Windows\System\YrqIRKF.exe
  C:\Windows\System\YrqIRKF.exe
  2⤵
  PID:7924
- C:\Windows\System\OZKaEgf.exe
  C:\Windows\System\OZKaEgf.exe
  2⤵
  PID:7960
- C:\Windows\System\VKGVojD.exe
  C:\Windows\System\VKGVojD.exe
  2⤵
  PID:8028
- C:\Windows\System\kLRahiD.exe
  C:\Windows\System\kLRahiD.exe
  2⤵
  PID:7720
- C:\Windows\System\LdrEzwP.exe
  C:\Windows\System\LdrEzwP.exe
  2⤵
  PID:7704
- C:\Windows\System\NTxGteM.exe
  C:\Windows\System\NTxGteM.exe
  2⤵
  PID:6756
- C:\Windows\System\dlkyjVx.exe
  C:\Windows\System\dlkyjVx.exe
  2⤵
  PID:6216
- C:\Windows\System\ztxDKJu.exe
  C:\Windows\System\ztxDKJu.exe
  2⤵
  PID:6484
- C:\Windows\System\QoepzJy.exe
  C:\Windows\System\QoepzJy.exe
  2⤵
  PID:6736
- C:\Windows\System\oXsCNNu.exe
  C:\Windows\System\oXsCNNu.exe
  2⤵
  PID:6980
- C:\Windows\System\jQakoCW.exe
  C:\Windows\System\jQakoCW.exe
  2⤵
  PID:7192
- C:\Windows\System\KSSBCmv.exe
  C:\Windows\System\KSSBCmv.exe
  2⤵
  PID:7180
- C:\Windows\System\tLVANCw.exe
  C:\Windows\System\tLVANCw.exe
  2⤵
  PID:7264
- C:\Windows\System\GIGiOhL.exe
  C:\Windows\System\GIGiOhL.exe
  2⤵
  PID:6800
- C:\Windows\System\NDqcCTo.exe
  C:\Windows\System\NDqcCTo.exe
  2⤵
  PID:7312
- C:\Windows\System\UXeTzpi.exe
  C:\Windows\System\UXeTzpi.exe
  2⤵
  PID:7520
- C:\Windows\System\eGhicVH.exe
  C:\Windows\System\eGhicVH.exe
  2⤵
  PID:7292
- C:\Windows\System\XYXbJct.exe
  C:\Windows\System\XYXbJct.exe
  2⤵
  PID:7456
- C:\Windows\System\swciAtM.exe
  C:\Windows\System\swciAtM.exe
  2⤵
  PID:7332
- C:\Windows\System\tXFBJMh.exe
  C:\Windows\System\tXFBJMh.exe
  2⤵
  PID:7584
- C:\Windows\System\adHTgJd.exe
  C:\Windows\System\adHTgJd.exe
  2⤵
  PID:7296
- C:\Windows\System\fddcqMb.exe
  C:\Windows\System\fddcqMb.exe
  2⤵
  PID:7904
- C:\Windows\System\qyVpvhw.exe
  C:\Windows\System\qyVpvhw.exe
  2⤵
  PID:7804
- C:\Windows\System\vlPGgUM.exe
  C:\Windows\System\vlPGgUM.exe
  2⤵
  PID:7944
- C:\Windows\System\Momaynh.exe
  C:\Windows\System\Momaynh.exe
  2⤵
  PID:8012
- C:\Windows\System\jQTpCbO.exe
  C:\Windows\System\jQTpCbO.exe
  2⤵
  PID:7820
- C:\Windows\System\QKkrgnR.exe
  C:\Windows\System\QKkrgnR.exe
  2⤵
  PID:7784
- C:\Windows\System\ciGTpUI.exe
  C:\Windows\System\ciGTpUI.exe
  2⤵
  PID:6200
- C:\Windows\System\OqiIovl.exe
  C:\Windows\System\OqiIovl.exe
  2⤵
  PID:6580
- C:\Windows\System\PeBtQxH.exe
  C:\Windows\System\PeBtQxH.exe
  2⤵
  PID:7240
- C:\Windows\System\XCwoiNJ.exe
  C:\Windows\System\XCwoiNJ.exe
  2⤵
  PID:7536
- C:\Windows\System\iuOSWip.exe
  C:\Windows\System\iuOSWip.exe
  2⤵
  PID:7404
- C:\Windows\System\OodPrLX.exe
  C:\Windows\System\OodPrLX.exe
  2⤵
  PID:7716
- C:\Windows\System\NDhXzRO.exe
  C:\Windows\System\NDhXzRO.exe
  2⤵
  PID:6656
- C:\Windows\System\gIZmttF.exe
  C:\Windows\System\gIZmttF.exe
  2⤵
  PID:8112
- C:\Windows\System\iYZEbkq.exe
  C:\Windows\System\iYZEbkq.exe
  2⤵
  PID:8064
- C:\Windows\System\wHMTgTf.exe
  C:\Windows\System\wHMTgTf.exe
  2⤵
  PID:8188
- C:\Windows\System\kxssAOH.exe
  C:\Windows\System\kxssAOH.exe
  2⤵
  PID:7352
- C:\Windows\System\HlJeYoe.exe
  C:\Windows\System\HlJeYoe.exe
  2⤵
  PID:7524
- C:\Windows\System\nOEqmsa.exe
  C:\Windows\System\nOEqmsa.exe
  2⤵
  PID:7620
- C:\Windows\System\ipyepGu.exe
  C:\Windows\System\ipyepGu.exe
  2⤵
  PID:7552
- C:\Windows\System\ycxrFTx.exe
  C:\Windows\System\ycxrFTx.exe
  2⤵
  PID:7976
- C:\Windows\System\dYLKeTs.exe
  C:\Windows\System\dYLKeTs.exe
  2⤵
  PID:7888
- C:\Windows\System\Qobotvh.exe
  C:\Windows\System\Qobotvh.exe
  2⤵
  PID:1576
- C:\Windows\System\aFevnIv.exe
  C:\Windows\System\aFevnIv.exe
  2⤵
  PID:7544
- C:\Windows\System\nwpfsGb.exe
  C:\Windows\System\nwpfsGb.exe
  2⤵
  PID:7684
- C:\Windows\System\aeVQyxc.exe
  C:\Windows\System\aeVQyxc.exe
  2⤵
  PID:6828
- C:\Windows\System\FZUXCHs.exe
  C:\Windows\System\FZUXCHs.exe
  2⤵
  PID:7788
- C:\Windows\System\NKABHMg.exe
  C:\Windows\System\NKABHMg.exe
  2⤵
  PID:7768
- C:\Windows\System\IGnvLpq.exe
  C:\Windows\System\IGnvLpq.exe
  2⤵
  PID:7472
- C:\Windows\System\fNONxkq.exe
  C:\Windows\System\fNONxkq.exe
  2⤵
  PID:7992
- C:\Windows\System\JDXehDV.exe
  C:\Windows\System\JDXehDV.exe
  2⤵
  PID:6560
- C:\Windows\System\krHStwi.exe
  C:\Windows\System\krHStwi.exe
  2⤵
  PID:7064
- C:\Windows\System\rbVXrjB.exe
  C:\Windows\System\rbVXrjB.exe
  2⤵
  PID:8204
- C:\Windows\System\ltKupyM.exe
  C:\Windows\System\ltKupyM.exe
  2⤵
  PID:8224
- C:\Windows\System\rFlAVpM.exe
  C:\Windows\System\rFlAVpM.exe
  2⤵
  PID:8240
- C:\Windows\System\qcRfcyy.exe
  C:\Windows\System\qcRfcyy.exe
  2⤵
  PID:8256
- C:\Windows\System\itCSoQR.exe
  C:\Windows\System\itCSoQR.exe
  2⤵
  PID:8284
- C:\Windows\System\fpwDgKR.exe
  C:\Windows\System\fpwDgKR.exe
  2⤵
  PID:8304
- C:\Windows\System\hpeoXCr.exe
  C:\Windows\System\hpeoXCr.exe
  2⤵
  PID:8320
- C:\Windows\System\IjWSAmO.exe
  C:\Windows\System\IjWSAmO.exe
  2⤵
  PID:8336
- C:\Windows\System\xERVQjq.exe
  C:\Windows\System\xERVQjq.exe
  2⤵
  PID:8352
- C:\Windows\System\cWLlriz.exe
  C:\Windows\System\cWLlriz.exe
  2⤵
  PID:8372
- C:\Windows\System\KRVCpAP.exe
  C:\Windows\System\KRVCpAP.exe
  2⤵
  PID:8388
- C:\Windows\System\DXeDkhT.exe
  C:\Windows\System\DXeDkhT.exe
  2⤵
  PID:8408
- C:\Windows\System\OuHChGa.exe
  C:\Windows\System\OuHChGa.exe
  2⤵
  PID:8424
- C:\Windows\System\SEczBma.exe
  C:\Windows\System\SEczBma.exe
  2⤵
  PID:8440
- C:\Windows\System\rxHfNPB.exe
  C:\Windows\System\rxHfNPB.exe
  2⤵
  PID:8456
- C:\Windows\System\wDUqEXq.exe
  C:\Windows\System\wDUqEXq.exe
  2⤵
  PID:8472
- C:\Windows\System\qcvUIkW.exe
  C:\Windows\System\qcvUIkW.exe
  2⤵
  PID:8488
- C:\Windows\System\hKxmOxv.exe
  C:\Windows\System\hKxmOxv.exe
  2⤵
  PID:8504
- C:\Windows\System\CMuGOjp.exe
  C:\Windows\System\CMuGOjp.exe
  2⤵
  PID:8520
- C:\Windows\System\DdlkLJS.exe
  C:\Windows\System\DdlkLJS.exe
  2⤵
  PID:8536
- C:\Windows\System\DeAlJcn.exe
  C:\Windows\System\DeAlJcn.exe
  2⤵
  PID:8552
- C:\Windows\System\OJmmWoM.exe
  C:\Windows\System\OJmmWoM.exe
  2⤵
  PID:8568
- C:\Windows\System\IPprFYx.exe
  C:\Windows\System\IPprFYx.exe
  2⤵
  PID:8584
- C:\Windows\System\LGvkCyy.exe
  C:\Windows\System\LGvkCyy.exe
  2⤵
  PID:8600
- C:\Windows\System\QOHYzPb.exe
  C:\Windows\System\QOHYzPb.exe
  2⤵
  PID:8616
- C:\Windows\System\Gxqhqon.exe
  C:\Windows\System\Gxqhqon.exe
  2⤵
  PID:8632
- C:\Windows\System\YIoigBA.exe
  C:\Windows\System\YIoigBA.exe
  2⤵
  PID:8648
- C:\Windows\System\AKPbCGN.exe
  C:\Windows\System\AKPbCGN.exe
  2⤵
  PID:8664
- C:\Windows\System\GLKECib.exe
  C:\Windows\System\GLKECib.exe
  2⤵
  PID:8680
- C:\Windows\System\guInsDc.exe
  C:\Windows\System\guInsDc.exe
  2⤵
  PID:8696
- C:\Windows\System\yotTiSR.exe
  C:\Windows\System\yotTiSR.exe
  2⤵
  PID:8712
- C:\Windows\System\vyfOJiJ.exe
  C:\Windows\System\vyfOJiJ.exe
  2⤵
  PID:8728
- C:\Windows\System\IsniqmR.exe
  C:\Windows\System\IsniqmR.exe
  2⤵
  PID:8744
- C:\Windows\System\NOQaFnt.exe
  C:\Windows\System\NOQaFnt.exe
  2⤵
  PID:8760
- C:\Windows\System\YsWQQNm.exe
  C:\Windows\System\YsWQQNm.exe
  2⤵
  PID:8776
- C:\Windows\System\QqEMPZR.exe
  C:\Windows\System\QqEMPZR.exe
  2⤵
  PID:8792
- C:\Windows\System\WubpjXS.exe
  C:\Windows\System\WubpjXS.exe
  2⤵
  PID:8960
- C:\Windows\System\nXIQsKM.exe
  C:\Windows\System\nXIQsKM.exe
  2⤵
  PID:8980
- C:\Windows\System\zAVtefm.exe
  C:\Windows\System\zAVtefm.exe
  2⤵
  PID:8996
- C:\Windows\System\dEwnnZg.exe
  C:\Windows\System\dEwnnZg.exe
  2⤵
  PID:9020
- C:\Windows\System\OaPDnwM.exe
  C:\Windows\System\OaPDnwM.exe
  2⤵
  PID:9048
- C:\Windows\System\ZLFOpPu.exe
  C:\Windows\System\ZLFOpPu.exe
  2⤵
  PID:9068
- C:\Windows\System\HDwTpkQ.exe
  C:\Windows\System\HDwTpkQ.exe
  2⤵
  PID:9084
- C:\Windows\System\VpIYflV.exe
  C:\Windows\System\VpIYflV.exe
  2⤵
  PID:9100
- C:\Windows\System\JmeZtRx.exe
  C:\Windows\System\JmeZtRx.exe
  2⤵
  PID:9116
- C:\Windows\System\sRlctoC.exe
  C:\Windows\System\sRlctoC.exe
  2⤵
  PID:9132
- C:\Windows\System\bFrLOsi.exe
  C:\Windows\System\bFrLOsi.exe
  2⤵
  PID:9148
- C:\Windows\System\zwXRMQh.exe
  C:\Windows\System\zwXRMQh.exe
  2⤵
  PID:9164
- C:\Windows\System\kvkngmR.exe
  C:\Windows\System\kvkngmR.exe
  2⤵
  PID:9180
- C:\Windows\System\PSNjcyA.exe
  C:\Windows\System\PSNjcyA.exe
  2⤵
  PID:9196
- C:\Windows\System\sMrdGyk.exe
  C:\Windows\System\sMrdGyk.exe
  2⤵
  PID:9212
- C:\Windows\System\MJhEwFc.exe
  C:\Windows\System\MJhEwFc.exe
  2⤵
  PID:8080
- C:\Windows\System\DzGGtqg.exe
  C:\Windows\System\DzGGtqg.exe
  2⤵
  PID:7616
- C:\Windows\System\sLqyanu.exe
  C:\Windows\System\sLqyanu.exe
  2⤵
  PID:8196
- C:\Windows\System\eZtrEni.exe
  C:\Windows\System\eZtrEni.exe
  2⤵
  PID:8216
- C:\Windows\System\tmXqOGC.exe
  C:\Windows\System\tmXqOGC.exe
  2⤵
  PID:8200
- C:\Windows\System\WNWADYL.exe
  C:\Windows\System\WNWADYL.exe
  2⤵
  PID:8264
- C:\Windows\System\EvZsBxc.exe
  C:\Windows\System\EvZsBxc.exe
  2⤵
  PID:8528
- C:\Windows\System\pgRYBOm.exe
  C:\Windows\System\pgRYBOm.exe
  2⤵
  PID:8596
- C:\Windows\System\OTVQyfl.exe
  C:\Windows\System\OTVQyfl.exe
  2⤵
  PID:8660
- C:\Windows\System\cnKhlVF.exe
  C:\Windows\System\cnKhlVF.exe
  2⤵
  PID:8724
- C:\Windows\System\JXriZzt.exe
  C:\Windows\System\JXriZzt.exe
  2⤵
  PID:8788
- C:\Windows\System\zuvmekf.exe
  C:\Windows\System\zuvmekf.exe
  2⤵
  PID:8672
- C:\Windows\System\MMglidY.exe
  C:\Windows\System\MMglidY.exe
  2⤵
  PID:8420
- C:\Windows\System\Uqehcfj.exe
  C:\Windows\System\Uqehcfj.exe
  2⤵
  PID:8484
- C:\Windows\System\UJgQcxQ.exe
  C:\Windows\System\UJgQcxQ.exe
  2⤵
  PID:8548
- C:\Windows\System\DslyUPx.exe
  C:\Windows\System\DslyUPx.exe
  2⤵
  PID:8708
- C:\Windows\System\vEQscIT.exe
  C:\Windows\System\vEQscIT.exe
  2⤵
  PID:8772
- C:\Windows\System\YjQapAt.exe
  C:\Windows\System\YjQapAt.exe
  2⤵
  PID:8836
- C:\Windows\System\MDzGaIM.exe
  C:\Windows\System\MDzGaIM.exe
  2⤵
  PID:8952
- C:\Windows\System\AjPPNKl.exe
  C:\Windows\System\AjPPNKl.exe
  2⤵
  PID:8856
- C:\Windows\System\AfXahPp.exe
  C:\Windows\System\AfXahPp.exe
  2⤵
  PID:8808
- C:\Windows\System\DDXStKw.exe
  C:\Windows\System\DDXStKw.exe
  2⤵
  PID:8928
- C:\Windows\System\EZomMDF.exe
  C:\Windows\System\EZomMDF.exe
  2⤵
  PID:9004
- C:\Windows\System\UHnliZq.exe
  C:\Windows\System\UHnliZq.exe
  2⤵
  PID:9060
- C:\Windows\System\pBnlcNJ.exe
  C:\Windows\System\pBnlcNJ.exe
  2⤵
  PID:8988
- C:\Windows\System\DfqzlxW.exe
  C:\Windows\System\DfqzlxW.exe
  2⤵
  PID:9008
- C:\Windows\System\FQRBdmZ.exe
  C:\Windows\System\FQRBdmZ.exe
  2⤵
  PID:9188
- C:\Windows\System\WpmJWvW.exe
  C:\Windows\System\WpmJWvW.exe
  2⤵
  PID:8840
- C:\Windows\System\iUohkMC.exe
  C:\Windows\System\iUohkMC.exe
  2⤵
  PID:9108
- C:\Windows\System\WiBBVyL.exe
  C:\Windows\System\WiBBVyL.exe
  2⤵
  PID:8876
- C:\Windows\System\ZvjUGts.exe
  C:\Windows\System\ZvjUGts.exe
  2⤵
  PID:8896
- C:\Windows\System\GSqVyKK.exe
  C:\Windows\System\GSqVyKK.exe
  2⤵
  PID:8916
- C:\Windows\System\zYkGdYk.exe
  C:\Windows\System\zYkGdYk.exe
  2⤵
  PID:9144
- C:\Windows\System\rxngVsY.exe
  C:\Windows\System\rxngVsY.exe
  2⤵
  PID:9036
- C:\Windows\System\iFghcOC.exe
  C:\Windows\System\iFghcOC.exe
  2⤵
  PID:8992
- C:\Windows\System\qNpPqOl.exe
  C:\Windows\System\qNpPqOl.exe
  2⤵
  PID:8172
- C:\Windows\System\bUHZTgV.exe
  C:\Windows\System\bUHZTgV.exe
  2⤵
  PID:8248
- C:\Windows\System\OdIjlBZ.exe
  C:\Windows\System\OdIjlBZ.exe
  2⤵
  PID:6716
- C:\Windows\System\iEHYvJM.exe
  C:\Windows\System\iEHYvJM.exe
  2⤵
  PID:8280
- C:\Windows\System\NgUhNWK.exe
  C:\Windows\System\NgUhNWK.exe
  2⤵
  PID:8316
- C:\Windows\System\dwObOrR.exe
  C:\Windows\System\dwObOrR.exe
  2⤵
  PID:8384
- C:\Windows\System\OJJQWiX.exe
  C:\Windows\System\OJJQWiX.exe
  2⤵
  PID:8300
- C:\Windows\System\pPqIPum.exe
  C:\Windows\System\pPqIPum.exe
  2⤵
  PID:8332
- C:\Windows\System\KylSuzQ.exe
  C:\Windows\System\KylSuzQ.exe
  2⤵
  PID:8436
- C:\Windows\System\ydqViod.exe
  C:\Windows\System\ydqViod.exe
  2⤵
  PID:8432
- C:\Windows\System\GrCCMoP.exe
  C:\Windows\System\GrCCMoP.exe
  2⤵
  PID:8628
- C:\Windows\System\ATteVYA.exe
  C:\Windows\System\ATteVYA.exe
  2⤵
  PID:8416
- C:\Windows\System\bTcqXPF.exe
  C:\Windows\System\bTcqXPF.exe
  2⤵
  PID:8740
- C:\Windows\System\rUnYxjT.exe
  C:\Windows\System\rUnYxjT.exe
  2⤵
  PID:8516
- C:\Windows\System\bjpeQIM.exe
  C:\Windows\System\bjpeQIM.exe
  2⤵
  PID:8480
- C:\Windows\System\NPyRknc.exe
  C:\Windows\System\NPyRknc.exe
  2⤵
  PID:8688
- C:\Windows\System\KPFEEwT.exe
  C:\Windows\System\KPFEEwT.exe
  2⤵
  PID:8576
- C:\Windows\System\GSoVGgp.exe
  C:\Windows\System\GSoVGgp.exe
  2⤵
  PID:8812
- C:\Windows\System\mTxbvpL.exe
  C:\Windows\System\mTxbvpL.exe
  2⤵
  PID:8944
- C:\Windows\System\oYHhcsB.exe
  C:\Windows\System\oYHhcsB.exe
  2⤵
  PID:9124
- C:\Windows\System\VDxQgjU.exe
  C:\Windows\System\VDxQgjU.exe
  2⤵
  PID:9112
- C:\Windows\System\TgjHQpm.exe
  C:\Windows\System\TgjHQpm.exe
  2⤵
  PID:8136
- C:\Windows\System\TsNQDnq.exe
  C:\Windows\System\TsNQDnq.exe
  2⤵
  PID:8220
- C:\Windows\System\FpXqpYH.exe
  C:\Windows\System\FpXqpYH.exe
  2⤵
  PID:8380
- C:\Windows\System\MXLleot.exe
  C:\Windows\System\MXLleot.exe
  2⤵
  PID:9028
- C:\Windows\System\lpbEPFz.exe
  C:\Windows\System\lpbEPFz.exe
  2⤵
  PID:9044
- C:\Windows\System\cmBtBxh.exe
  C:\Windows\System\cmBtBxh.exe
  2⤵
  PID:8864
- C:\Windows\System\uEBrJik.exe
  C:\Windows\System\uEBrJik.exe
  2⤵
  PID:8860
- C:\Windows\System\IpQYyef.exe
  C:\Windows\System\IpQYyef.exe
  2⤵
  PID:8784
- C:\Windows\System\NatptEH.exe
  C:\Windows\System\NatptEH.exe
  2⤵
  PID:8832
- C:\Windows\System\rcCOkns.exe
  C:\Windows\System\rcCOkns.exe
  2⤵
  PID:8296
- C:\Windows\System\RNTPqBx.exe
  C:\Windows\System\RNTPqBx.exe
  2⤵
  PID:9016
- C:\Windows\System\UjPIqSi.exe
  C:\Windows\System\UjPIqSi.exe
  2⤵
  PID:8560
- C:\Windows\System\JVeURiN.exe
  C:\Windows\System\JVeURiN.exe
  2⤵
  PID:8580
- C:\Windows\System\ayPvsZD.exe
  C:\Windows\System\ayPvsZD.exe
  2⤵
  PID:9076
- C:\Windows\System\rReOlNP.exe
  C:\Windows\System\rReOlNP.exe
  2⤵
  PID:8852
- C:\Windows\System\visZMpt.exe
  C:\Windows\System\visZMpt.exe
  2⤵
  PID:8328
- C:\Windows\System\TBKtfCA.exe
  C:\Windows\System\TBKtfCA.exe
  2⤵
  PID:9176
- C:\Windows\System\JfPwDLQ.exe
  C:\Windows\System\JfPwDLQ.exe
  2⤵
  PID:8888
- C:\Windows\System\tQvYQfg.exe
  C:\Windows\System\tQvYQfg.exe
  2⤵
  PID:9096
- C:\Windows\System\KnbNgZb.exe
  C:\Windows\System\KnbNgZb.exe
  2⤵
  PID:8676
- C:\Windows\System\BnpEzEn.exe
  C:\Windows\System\BnpEzEn.exe
  2⤵
  PID:8932
- C:\Windows\System\lGzeTeI.exe
  C:\Windows\System\lGzeTeI.exe
  2⤵
  PID:8500
- C:\Windows\System\KLzlgYP.exe
  C:\Windows\System\KLzlgYP.exe
  2⤵
  PID:8276
- C:\Windows\System\tGYsHaO.exe
  C:\Windows\System\tGYsHaO.exe
  2⤵
  PID:8592
- C:\Windows\System\AirHRJv.exe
  C:\Windows\System\AirHRJv.exe
  2⤵
  PID:8564
- C:\Windows\System\rbnPNes.exe
  C:\Windows\System\rbnPNes.exe
  2⤵
  PID:9232
- C:\Windows\System\GltxcMY.exe
  C:\Windows\System\GltxcMY.exe
  2⤵
  PID:9248
- C:\Windows\System\HnGkztl.exe
  C:\Windows\System\HnGkztl.exe
  2⤵
  PID:9264
- C:\Windows\System\yizLSRi.exe
  C:\Windows\System\yizLSRi.exe
  2⤵
  PID:9280
- C:\Windows\System\QqJiVzt.exe
  C:\Windows\System\QqJiVzt.exe
  2⤵
  PID:9296
- C:\Windows\System\QtylKUN.exe
  C:\Windows\System\QtylKUN.exe
  2⤵
  PID:9312
- C:\Windows\System\jJDszPO.exe
  C:\Windows\System\jJDszPO.exe
  2⤵
  PID:9328
- C:\Windows\System\LEISuHR.exe
  C:\Windows\System\LEISuHR.exe
  2⤵
  PID:9344
- C:\Windows\System\NLprNhD.exe
  C:\Windows\System\NLprNhD.exe
  2⤵
  PID:9360
- C:\Windows\System\lEMDRDx.exe
  C:\Windows\System\lEMDRDx.exe
  2⤵
  PID:9376
- C:\Windows\System\wRtmVjy.exe
  C:\Windows\System\wRtmVjy.exe
  2⤵
  PID:9392
- C:\Windows\System\LYuvniT.exe
  C:\Windows\System\LYuvniT.exe
  2⤵
  PID:9408
- C:\Windows\System\iqEbPKn.exe
  C:\Windows\System\iqEbPKn.exe
  2⤵
  PID:9424
- C:\Windows\System\YyCkcbX.exe
  C:\Windows\System\YyCkcbX.exe
  2⤵
  PID:9440
- C:\Windows\System\drtMaib.exe
  C:\Windows\System\drtMaib.exe
  2⤵
  PID:9456
- C:\Windows\System\KDdahJl.exe
  C:\Windows\System\KDdahJl.exe
  2⤵
  PID:9472
- C:\Windows\System\dqsjYxW.exe
  C:\Windows\System\dqsjYxW.exe
  2⤵
  PID:9488
- C:\Windows\System\XJoUCyN.exe
  C:\Windows\System\XJoUCyN.exe
  2⤵
  PID:9504
- C:\Windows\System\PsRuEvA.exe
  C:\Windows\System\PsRuEvA.exe
  2⤵
  PID:9520
- C:\Windows\System\kmJpkCZ.exe
  C:\Windows\System\kmJpkCZ.exe
  2⤵
  PID:9536
- C:\Windows\System\zZOFddR.exe
  C:\Windows\System\zZOFddR.exe
  2⤵
  PID:9552
- C:\Windows\System\SxkJuIo.exe
  C:\Windows\System\SxkJuIo.exe
  2⤵
  PID:9568
- C:\Windows\System\HUzsSoi.exe
  C:\Windows\System\HUzsSoi.exe
  2⤵
  PID:9584
- C:\Windows\System\SueFQPE.exe
  C:\Windows\System\SueFQPE.exe
  2⤵
  PID:9600
- C:\Windows\System\cnCRVCG.exe
  C:\Windows\System\cnCRVCG.exe
  2⤵
  PID:9620
- C:\Windows\System\PYrRqqw.exe
  C:\Windows\System\PYrRqqw.exe
  2⤵
  PID:9636
- C:\Windows\System\aRtrDbG.exe
  C:\Windows\System\aRtrDbG.exe
  2⤵
  PID:9652
- C:\Windows\System\qYAlmXa.exe
  C:\Windows\System\qYAlmXa.exe
  2⤵
  PID:9668
- C:\Windows\System\XghsUUT.exe
  C:\Windows\System\XghsUUT.exe
  2⤵
  PID:9684
- C:\Windows\System\OFeASQi.exe
  C:\Windows\System\OFeASQi.exe
  2⤵
  PID:9700
- C:\Windows\System\sMlMNLE.exe
  C:\Windows\System\sMlMNLE.exe
  2⤵
  PID:9716
- C:\Windows\System\SofOBfc.exe
  C:\Windows\System\SofOBfc.exe
  2⤵
  PID:9732
- C:\Windows\System\RTOmxTm.exe
  C:\Windows\System\RTOmxTm.exe
  2⤵
  PID:9748
- C:\Windows\System\YSzCsJM.exe
  C:\Windows\System\YSzCsJM.exe
  2⤵
  PID:9764
- C:\Windows\System\MQVaThW.exe
  C:\Windows\System\MQVaThW.exe
  2⤵
  PID:9780
- C:\Windows\System\gjAsxRF.exe
  C:\Windows\System\gjAsxRF.exe
  2⤵
  PID:9796
- C:\Windows\System\lxkOijS.exe
  C:\Windows\System\lxkOijS.exe
  2⤵
  PID:9812
- C:\Windows\System\yXlrWoy.exe
  C:\Windows\System\yXlrWoy.exe
  2⤵
  PID:9828
- C:\Windows\System\xqdFqgh.exe
  C:\Windows\System\xqdFqgh.exe
  2⤵
  PID:9844
- C:\Windows\System\BPTonFt.exe
  C:\Windows\System\BPTonFt.exe
  2⤵
  PID:9860
- C:\Windows\System\qiOOVKz.exe
  C:\Windows\System\qiOOVKz.exe
  2⤵
  PID:9876
- C:\Windows\System\swMAVBV.exe
  C:\Windows\System\swMAVBV.exe
  2⤵
  PID:9892
- C:\Windows\System\Yfqlzjq.exe
  C:\Windows\System\Yfqlzjq.exe
  2⤵
  PID:9908
- C:\Windows\System\cljyTHa.exe
  C:\Windows\System\cljyTHa.exe
  2⤵
  PID:9924
- C:\Windows\System\EyucxPc.exe
  C:\Windows\System\EyucxPc.exe
  2⤵
  PID:9940
- C:\Windows\System\hLKEEGG.exe
  C:\Windows\System\hLKEEGG.exe
  2⤵
  PID:9956
- C:\Windows\System\xygImvq.exe
  C:\Windows\System\xygImvq.exe
  2⤵
  PID:9976
- C:\Windows\System\WkOAbdO.exe
  C:\Windows\System\WkOAbdO.exe
  2⤵
  PID:9992
- C:\Windows\System\XxhxYNk.exe
  C:\Windows\System\XxhxYNk.exe
  2⤵
  PID:10008
- C:\Windows\System\IGTUtfI.exe
  C:\Windows\System\IGTUtfI.exe
  2⤵
  PID:10024
- C:\Windows\System\hTZktVA.exe
  C:\Windows\System\hTZktVA.exe
  2⤵
  PID:10040
- C:\Windows\System\bAMToXR.exe
  C:\Windows\System\bAMToXR.exe
  2⤵
  PID:10056
- C:\Windows\System\RElgWBF.exe
  C:\Windows\System\RElgWBF.exe
  2⤵
  PID:10072
- C:\Windows\System\ksUyLYI.exe
  C:\Windows\System\ksUyLYI.exe
  2⤵
  PID:10088
- C:\Windows\System\OzauqWt.exe
  C:\Windows\System\OzauqWt.exe
  2⤵
  PID:10104
- C:\Windows\System\wXwfhDr.exe
  C:\Windows\System\wXwfhDr.exe
  2⤵
  PID:10120
- C:\Windows\System\AiITEPJ.exe
  C:\Windows\System\AiITEPJ.exe
  2⤵
  PID:10136
- C:\Windows\System\rkVBuXR.exe
  C:\Windows\System\rkVBuXR.exe
  2⤵
  PID:10152
- C:\Windows\System\YEQNIhd.exe
  C:\Windows\System\YEQNIhd.exe
  2⤵
  PID:10168
- C:\Windows\System\NxosPwK.exe
  C:\Windows\System\NxosPwK.exe
  2⤵
  PID:10184
- C:\Windows\System\mIsdPsk.exe
  C:\Windows\System\mIsdPsk.exe
  2⤵
  PID:10200
- C:\Windows\System\IdaDzlI.exe
  C:\Windows\System\IdaDzlI.exe
  2⤵
  PID:10216
- C:\Windows\System\kbGCGyX.exe
  C:\Windows\System\kbGCGyX.exe
  2⤵
  PID:10232
- C:\Windows\System\dMTVPlh.exe
  C:\Windows\System\dMTVPlh.exe
  2⤵
  PID:9244
- C:\Windows\System\obiLKBN.exe
  C:\Windows\System\obiLKBN.exe
  2⤵
  PID:9308
- C:\Windows\System\GixEZUh.exe
  C:\Windows\System\GixEZUh.exe
  2⤵
  PID:9372
- C:\Windows\System\FAovsYr.exe
  C:\Windows\System\FAovsYr.exe
  2⤵
  PID:8452
- C:\Windows\System\BhykPYr.exe
  C:\Windows\System\BhykPYr.exe
  2⤵
  PID:8900
- C:\Windows\System\JzRrSoR.exe
  C:\Windows\System\JzRrSoR.exe
  2⤵
  PID:9320
- C:\Windows\System\gLNNHMQ.exe
  C:\Windows\System\gLNNHMQ.exe
  2⤵
  PID:9256
- C:\Windows\System\YiWDLur.exe
  C:\Windows\System\YiWDLur.exe
  2⤵
  PID:9324
- C:\Windows\System\QxWQCUM.exe
  C:\Windows\System\QxWQCUM.exe
  2⤵
  PID:9436
- C:\Windows\System\tFSssKk.exe
  C:\Windows\System\tFSssKk.exe
  2⤵
  PID:9500
- C:\Windows\System\fXyBNFN.exe
  C:\Windows\System\fXyBNFN.exe
  2⤵
  PID:9564
- C:\Windows\System\GjWNBRc.exe
  C:\Windows\System\GjWNBRc.exe
  2⤵
  PID:9632
- C:\Windows\System\ITyJeFx.exe
  C:\Windows\System\ITyJeFx.exe
  2⤵
  PID:9452
- C:\Windows\System\GOAgvql.exe
  C:\Windows\System\GOAgvql.exe
  2⤵
  PID:9484
- C:\Windows\System\DdeWodd.exe
  C:\Windows\System\DdeWodd.exe
  2⤵
  PID:9548
- C:\Windows\System\IHSbyHU.exe
  C:\Windows\System\IHSbyHU.exe
  2⤵
  PID:9544
- C:\Windows\System\pLRzaWp.exe
  C:\Windows\System\pLRzaWp.exe
  2⤵
  PID:9516
- C:\Windows\System\dWMDTUp.exe
  C:\Windows\System\dWMDTUp.exe
  2⤵
  PID:9728
- C:\Windows\System\jXvvbzR.exe
  C:\Windows\System\jXvvbzR.exe
  2⤵
  PID:9744
- C:\Windows\System\coimYjp.exe
  C:\Windows\System\coimYjp.exe
  2⤵
  PID:9824
- C:\Windows\System\uanastJ.exe
  C:\Windows\System\uanastJ.exe
  2⤵
  PID:9808
- C:\Windows\System\MedNKcU.exe
  C:\Windows\System\MedNKcU.exe
  2⤵
  PID:9840
- C:\Windows\System\eSqErHX.exe
  C:\Windows\System\eSqErHX.exe
  2⤵
  PID:9900
- C:\Windows\System\TjwLerS.exe
  C:\Windows\System\TjwLerS.exe
  2⤵
  PID:9904
- C:\Windows\System\mpGEjKl.exe
  C:\Windows\System\mpGEjKl.exe
  2⤵
  PID:9920
- C:\Windows\System\kvFtYkf.exe
  C:\Windows\System\kvFtYkf.exe
  2⤵
  PID:9988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DPhZgvb.exe

Filesize
1.8MB

MD5
c2c4e826767ab6e69f1966acc079ab44

SHA1
8af2d4545412414b5804d37f0ea967ff6dd3d9e5

SHA256
8ba9d8ba82bf355f491cf1103a448193098860751898fac5f503314af7e92b9b

SHA512
d20410fff14f5e05d115f8baff892b839027436497d8e25482ede15eadf3f73eaf760105cd2ae7ae08b42a4660c2f2cbec21d979ca11c150b123c998d69defac

Download Submit
C:\Windows\system\DuwZkHC.exe

Filesize
1.9MB

MD5
8d4df3ce1d88e0bd82f74bdd0db8d796

SHA1
ea3b50525f04f60f8aaf07d1131d6ce1ae3080f4

SHA256
5398ea576f9e08bd2ad0ba55c9fc08df2320ade8aeda1aa8e0a1747fd32cd74a

SHA512
c0bcf69676cc6559ab9f55586421057abbdeff913b60cda5277e7547344ef622ed517489df0db8f4a7d93ad4884a9bcef04c1c0be42dccee4409d04b9817ac5a

Download Submit
C:\Windows\system\FIoqGpW.exe

Filesize
1.9MB

MD5
988d22dd3005de6531ae883b859e2145

SHA1
4f56827560430af14136a1a9351c49d710cbf683

SHA256
ec8a5adf8b8dfd0b783868f80600bf1ee98897f81724bd55353140ba20de3c33

SHA512
7da2b4ae0677a90729075b0502299e648e73e81aa729f01730dad1253bc12eb5bc174eb02683405a2ec6f5bba0d2d859127920f360b0579c42cca93fc339e474

Download Submit
C:\Windows\system\GzjmGIo.exe

Filesize
1.9MB

MD5
92b68904322781d42a5796c56af6c9d2

SHA1
89cb318c6ad68fbc90f21909c62a09cbc0296b0e

SHA256
8735d156843c51eeae5cdadb5aacf57effafb881d12575bf038c75f78928c51d

SHA512
dbb6e65de596f71b372cb9ee1953321e98e10a6d95030f74278e69ba605752f41e7badcf121ca95710839f2f81c079993067c35279332c15908835b7a72826fb

Download Submit
C:\Windows\system\HBmRgEc.exe

Filesize
1.8MB

MD5
5347a96ff84674ffc9dabadbc03914ad

SHA1
a8d3f287506ae2e633569289d44096eb78c47d3e

SHA256
421ff1f4ff2a49d072377bae464d2eef87dd7c034cefdfca59bc558e31bda424

SHA512
e6bcdb0463dea2fba7424de0bce1272c4d4a63dcfbc299cb5e6be2f3f510d19116c97eb94ec1aa7b28f011e7a2fc4c2c573cb8770383991f62267040b71e8ab2

Download Submit
C:\Windows\system\IHofFiO.exe

Filesize
1.9MB

MD5
204bb7215481f0e91491b06c0f6985b8

SHA1
aced910d19d678e86426f96d11e1e7e3fb8d0fd4

SHA256
fd8b2514901fa7ed5fdb23cc54577df06a50e2ed93b8fc859235922c8940ef16

SHA512
c13c0cdf0bfbb9268df5513755d20109c52673fb2cdd23ffed6339ab957d6380c603b8dd3fecf248dca31ee65123022772db79ebabf7851e81c34c3c1713433c

Download Submit
C:\Windows\system\OWuAmBS.exe

Filesize
1.9MB

MD5
fd5e366d62600ba3115c376c68beb9fc

SHA1
b230e8b48f10c25f2ebabc12d3f6bd699563d721

SHA256
6eec4891af3880579c01dedf55ce7a8aa6452fcd5f6c23a3b41a7ddcc9a667b4

SHA512
3e03a9721db32adae0acbdc23a5e8459b7a4876301c9519d2bbb59dc769845779327986127b7f1c597b85a8ddee8f8443021628a24ef164239b50926b63bda6f

Download Submit
C:\Windows\system\RkOZYGv.exe

Filesize
1.9MB

MD5
7d51f1bb0af35a648415dc3c0c6af7ce

SHA1
4b67046c9c58e33a0e8bb68f02652944b71bfbc1

SHA256
4ff7fc643ee8dd1cd297dad9d55d752c935b12540bf35387cab777797dd07a4d

SHA512
efd5ef2aa232eae83cd5eef6523869747844178238b3721181dd54377d470548c664e3a37eba082c88a13d4904693701176a65c11611a3c9ba4d44b2cbed1178

Download Submit
C:\Windows\system\TLxCwyu.exe

Filesize
1.9MB

MD5
de06f91727e3598d6994376d53721e4c

SHA1
7c09d785048433789dd2530820f08f8d75c8e115

SHA256
c9a5c3fe1016af9f6efc2cd265ffc3c8f72169abb870e65adde7b758c1da570e

SHA512
8edd2852c74ad12e1c075db905fb21100712eea8f952b582aff2535af1fdda86b390623c4d205371d1d681a7dace865f3223f5fe70ca4eb24e5139c9663a94bb

Download Submit
C:\Windows\system\TzEEIWM.exe

Filesize
1.9MB

MD5
1dd9ee333784e0218ced34b9b28fe07e

SHA1
14cd7c0ac97a445a7e10096e99c843b35e636a3c

SHA256
4db773fa11cfd5badc846f0450caa1595f2da46ad7fb8d7ad2db640b0e56ef4d

SHA512
db8bc5f710b9ff4229a76eccb0a18ccb50e1591cfe230e348fa494d9212e80fdf415c5cafd9e8973c6744f5481bcae9aadd5f28b884e31ba7f8d4d78eae8a6a7

Download Submit
C:\Windows\system\WzybWpK.exe

Filesize
1.8MB

MD5
c4220ba1b47171eca27dafc19f96b977

SHA1
a8967c6010e4ed71a9057b4be3dffb5f848a623e

SHA256
ae6550046e55483fff7be72f63aec58fc2b451214754a57021dcbf0645eda24e

SHA512
1faba52a016fe670ca1936af24fc44e240d28da853fa67d2baa8412c847d82d0f96e37da896fa6485056258603cee52408445d31498b1637e2da55c1f034f22a

Download Submit
C:\Windows\system\YAcnSKr.exe

Filesize
1.9MB

MD5
a2d51f884e6301aa31e389d3cc5c3022

SHA1
0d90269eeeb000d6c035f7cef097d31673e9932f

SHA256
0e14648df8f6d210ec98bfc9bf4e05926e24805c872a9923afd142cb7c31fd2d

SHA512
49e13f126c755f7b87951867448fd53cde5cffa59139bfdcf9ae2b32813d37f717b44e40b071b47c9f90611e478fe3e71d15909ab46e002efe04a97e42717b44

Download Submit
C:\Windows\system\aFISeCq.exe

Filesize
1.9MB

MD5
979487f7485ebcc57394d45690713432

SHA1
aa2f8435567c533b7956e3bede2a810148a6284c

SHA256
1bf40674ce5d84168a872c481627c603ff6f50ee8e7d6f0d97cfe7f15be02a7c

SHA512
34263befeb1087534497de1ed2fb4e2d9e77ecfad3706c6e0c7b5be6a7c14cb874ed5dea1e90ddcc3762319a8315271ec2c682440775771ffd33d78b4227e467

Download Submit
C:\Windows\system\dtzwwzr.exe

Filesize
1.9MB

MD5
8f1ec217142ee9efe01cb6c0012480da

SHA1
405c5d8b17174146d825503677a14f11aa8be169

SHA256
e2358886fbfd17057f4c4542ab0d20fe7c6b23a2737bb28ddaa6f4be620ccb92

SHA512
e7617518e68502313b10945ba0ef5cb95726cf1628f67973e3983d034500268be0e0ce77a4b897214657b41eb83ad5dc2abb24ed0324a47fac1669d48f84ce08

Download Submit
C:\Windows\system\ecbOCtJ.exe

Filesize
1.9MB

MD5
f6accf18d38b1a5ae76a83e470821115

SHA1
838a6a02b9893c1043a519fd4669b34b754b0d87

SHA256
d8ab2b4668b5b589e7ad2c7e3f7d387d279c691a41d0f71c177bcc392921dd4a

SHA512
f92154b5b2e556e3310d9427e430f1ee6301c5ec5c5dea2924d934ee6e19f0c35ba800921310cc91ff376de77607debfdd0d527b94386ab34fd75b2ee27ebc97

Download Submit
C:\Windows\system\fYkurRn.exe

Filesize
1.9MB

MD5
9c94e322ea7eaf82a3532e8e442343c9

SHA1
4296f637e700f8ed1c8594e8faf1b00613ef1dea

SHA256
7fb95b218922af84820d600121b9bd35311f492c3ecb63d89e07c1940b3b50d0

SHA512
2ef3eb33f672c01009e0ebba91944b8c4705518ef2a50824390fe21aab03ec806448210d65c214b0ed98150a875cb708aecad2e0ab2b53c3f9f801c55949ec5e

Download Submit
C:\Windows\system\hXojzVt.exe

Filesize
1.9MB

MD5
85b8f59f957ad184e167d39a2518e8b0

SHA1
fc7a0c79c27f076cceb94dc62b6949fbcd537c97

SHA256
fbbe3cd23d3c8cb3f11de2ac98fde43ed58d831ab76a436003bc9d37d0796d38

SHA512
43fd88b5b6d47f2352de5c4d64eaec71e6083e5cf4caa0cb6822d0e8516428e687bc4e60e1e2345877f65414a76b09183bfcd7cb36b18160c1d1ffa04cec353f

Download Submit
C:\Windows\system\jEKEadK.exe

Filesize
1.9MB

MD5
696c0da34bd2a2a1bdc653e96f28ae74

SHA1
9f8977d4e585faf90072c4b641bdc96a37a4576c

SHA256
c0989e4bff19293d28be7dd7e600441d3aaf59b749cd82896d12b8150e381a8b

SHA512
8efd5f830b43dc66189a1b3f1726a732506441f8b532aeec9ca1621d5ce99ee49885b050cf83697bb1cb9c83e5b8cfca5d06fda2375a58c8b47c7db2f3d3f8d2

Download Submit
C:\Windows\system\kodePyW.exe

Filesize
1.9MB

MD5
8ae86ca12539d6c4ac5ff94cff91d929

SHA1
118f09b592d7cbeea9cf79da61b8707c9257d614

SHA256
4079bc5b19e6531b8582f3c177ed8ff2eb3dadde3e2cbe0bddd614736cda3352

SHA512
f0db986f21c0e2b6754c3258b9fbf1c9057a28abad5e32e631ee39044bf222aa18b045b6934b0ed9b33823971f8748068cd005fcefa1c5b899de08f0d1ad927a

Download Submit
C:\Windows\system\qNQjxgt.exe

Filesize
1.9MB

MD5
d8b4d827401f2e708898d45ec2a9c181

SHA1
5666ea18fa5925ffef35da697d0d018c1ae9d7c6

SHA256
b448836fb7fc927033c2b0932361578e60cdd65e359f18d2f17c108fbc443dfd

SHA512
734f3c3c18da41e022f7476db262e7ad199612b0e280751a7e8c9f09aa7fd3387c55f03e1c3ff348c84e6d93649b30b6feb741bfc8829dc65920f4326c1e5843

Download Submit
C:\Windows\system\srPvheu.exe

Filesize
1.9MB

MD5
a0a07991ca763b80636773f6e8b3ba0b

SHA1
ae9e327a04d33fac7e558c0486b44c00ad156079

SHA256
af9dbb0714b16b8ab6978f801873a8f9a4d403004eed1f67f636f108f74a18a2

SHA512
b855a7e7333f5874940366c76ed939b62f13732d0a71ba76cb4a9cc60e5df234c6e99b6712eeea836153cd5615535d737a80639c1a14e985fab0a5120641800d

Download Submit
C:\Windows\system\tPJGHCY.exe

Filesize
1.8MB

MD5
ba2385a87ac190a0c8cabf5e5797ffa4

SHA1
46d7ddaaaafac3ce7187a15c764c0cdae1340c3c

SHA256
65f10e6297c29565f09f23f2be8c870972b931d3030500f0ef6751c55488a7b9

SHA512
b6775b10a76bc007c755d6371c14740ed641e9034e7004107f9be4599f3010a8cc89e8a595ca54ac9a571f99ed5dad735f84bf9ab45f101e32322d7df6197231

Download Submit
C:\Windows\system\tyrAqgI.exe

Filesize
1.9MB

MD5
6a74182ef1bc1ea0e35d6bae2c935812

SHA1
2dc99832e7e22806c696d22bb2fa5187508fd052

SHA256
a893a35d512c62d077743c617288576ebcdc7f0d2b4f042db4283074949569b9

SHA512
fcf7948a522791eabb68c809a6356a204a8375525b6acb940404ba813dbb0248480a26188f86cd0e4d2c303f51ac7105119413eda3bb220c44cffd18759a0e30

Download Submit
C:\Windows\system\wLikElN.exe

Filesize
1.8MB

MD5
8930efd27403d9568b2b94eef480786b

SHA1
fa4cce794a2badc5d091c895ea55912651150f5e

SHA256
bc8fc1da26988000b117450947f506164477c1a4c2e9f50c54cd8c3c94660f9d

SHA512
1f190709f133e3e3828625b9bda841bf0f1b33395cc880dbaa1eb837c3690a2804e29c86ad1aa883a1db046f673a84f992034645ba22a93afe7b21b81ad6c564

Download Submit
C:\Windows\system\wfFaJBc.exe

Filesize
1.9MB

MD5
6dae7a307a64b48cf54986975b1020e8

SHA1
1ce4864d39365fe3da34fa39085cd6c02d9689a4

SHA256
a1ca75d8d1be9dddd1d06d45066bbf37d4c83ffac647ef86370e31d7d0ef92f2

SHA512
3f2e3496a637bf9389561e2592c886c510e78b3dd0ff819383152e95f957f09ebb0f52da599757eceffd224418d8858fef544501d4bda7d411d8c582e254a478

Download Submit
C:\Windows\system\yrSKuvL.exe

Filesize
1.9MB

MD5
be60c252bf30fadb1428d718d437429c

SHA1
52a469b2d04ac021a090bf4ad975fed14daee299

SHA256
52dd18c775ab7d88d734e3c3b9af44a4fbf0e519d8d9d7f30c7c370f71957466

SHA512
29accbf874403aedb8a7ef623511f5994578b7001ae6a6f875813a62fbff1d78ad6f050db4ba36410dfa4ed5794ca067e05dca45bcde85b3726913d65daf45ea

Download Submit
\Windows\system\CjryXql.exe

Filesize
1.8MB

MD5
878aca7f9c170c7ea3c629d269d79dc9

SHA1
7b1ba3ac50430d3cc69af631e16583aac5d6602e

SHA256
544463923cfa99c6499fc97d22a48a5bca297633c37cd26ecb70e525d42fdbc1

SHA512
d007a13a79ae0f798136a9ab684a72b3836c5e57fadcad247984d2e890b6276af932395a884fb98a4da3b2fc3f15df9acf40b3a2b36180a9b1d9e1c1c26666b3

Download Submit
\Windows\system\NaOLIfD.exe

Filesize
1.9MB

MD5
f60bf9c1fbc105df85a9c4d2e3e66fea

SHA1
625973603df3a742e06c24067eed32d69d30181e

SHA256
06ba3b9094ec255bbb8f624b84e3ec8b7f880a42ba4a4396775f89ea6bd67f2f

SHA512
1bd6c2154c7a7457a8df8026248d7f950442d4664187e9fe0fa63f9e55d62da648b083e7f82c0994f488b4d7f47351a379e7bece19c47b4b35cf2ef2d024015c

Download Submit
\Windows\system\NoyAwZW.exe

Filesize
1.8MB

MD5
7793acb1707b323b17678204ba110cda

SHA1
c35c93ab30451e1db328b69bd64d4af9e8db582c

SHA256
4ad21c06a95a959c49fff42f6468011bed522ea8f49a8089c347560e8e464467

SHA512
3748ff7175a2616c2d886b123db3a9648b2d43e7bb51fe2ac8c7aaabb6441013f129ed39e6fc20c85630701919b0461b428f3c7a0892c8ea02bb4000531a0784

Download Submit
\Windows\system\VcxVTAe.exe

Filesize
1.9MB

MD5
6185f62d538819e52739a85b0099acf9

SHA1
ce6ca7ca6223331d7c4846619f5b43bb202b6ab0

SHA256
3eac1c01b74a15238c99a7469c233733d53755cff048290db8bc51d220946ac8

SHA512
39b8e2eeb7cd16a4f61e55271cc6c5feff07fad6721689a5cafb026db4478e5dcf1049c09aa3df20a39588aa470cf1a76ee065d7796d2a20577229f6457d7125

Download Submit
\Windows\system\qcLNTaF.exe

Filesize
1.9MB

MD5
1e270fb49d97ba77e67ac72cb5474d87

SHA1
a59015639a3225f1fdd132c9c8c8b5f6547d9c8c

SHA256
5c7b5ed27cc17e09521c1bc142534a7d6b5b98b1e8586a44bc86dc57edc8f29c

SHA512
6a5bf2f427ff6a361a50a2d7d93a76dc6121f3f200ee4ee0f35776bec05b49e38f3dde2b7b80c9646a2040919f331132a8f7cb3350c490d16bc3e53c703f5a1f

Download Submit
\Windows\system\ssjzfyN.exe

Filesize
1.9MB

MD5
dac43282ed0d8646c9f8ce2e848ec3e4

SHA1
a0dccdfa246142585429b10f9e02a5f1aa2b72c8

SHA256
9a03833d9cb3424cdf7885cedff93c2dbafef9d662fb948671b6c32ec859953c

SHA512
371502c8f6b54cfab119e714ea0f9557e02693efe31d139b88c66fedd6c23562a4212c28e36995f0e3ba587b3ad33a2e5bc70403addd910545d93899da11a7a6

Download Submit
\Windows\system\wuukXLY.exe

Filesize
1.9MB

MD5
4bd42b69a9e0b398dc5d672d1d468674

SHA1
7230ef18983c55927a1492b15c2f92f27962f8fd

SHA256
397de324cc2d846300c91319c8b9eb01d2dad198bd92afcf41fe6a5a70c38bee

SHA512
a3375d9013b0648f18edd908bdf4be174894789e7bbccf6f805d4070e881156c8f294c36f77945d07156fe15f8d08955a2c112b2b9bf5abc769a5ed163e56422

Download Submit
memory/1936-189-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/1936-187-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/1936-151-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/1936-162-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/1936-164-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/1936-173-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/1936-175-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/1936-9-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/1936-28-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/1936-190-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/1936-128-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-180-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-186-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/1936-192-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/1936-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2064-191-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2168-176-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-177-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-182-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/2664-183-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-178-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2724-179-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/3028-172-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/3040-200-0x0000000002230000-0x0000000002238000-memory.dmp

Filesize
32KB

Download
memory/3040-193-0x000000001B570000-0x000000001B852000-memory.dmp

Filesize
2.9MB

Download
memory/3064-117-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download