xmrig | 1b4c17af087c8a75a5ecafe81cbc3468b0833a9ed1f5fd1892cda6dacb921651

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27-07-2024 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
Size

2.0MB
MD5

02cbadfb57fd5226e5ab17813869039b
SHA1

b0a6f75cba68aa58ed15b26cc312c3367a4d351d
SHA256

1b4c17af087c8a75a5ecafe81cbc3468b0833a9ed1f5fd1892cda6dacb921651
SHA512

db86d7a28147865fa5910558bce1017a819675c24bde22961935ac07b545d303b7d4a7360df7dc9c9063de660c51c33ff4fed7afa98e5257e60987bf0aee5db4
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1nfl:NAB4

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral1/memory/2772-25-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2736-78-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2548-85-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2680-88-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/2768-64-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig
behavioral1/memory/2760-62-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2556-61-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2500-84-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2720-83-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/3064-77-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2580-72-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig
behavioral1/memory/2500-4509-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2680-4510-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/2720-4519-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/2736-4520-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2760-4522-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2580-4524-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig
behavioral1/memory/2556-4527-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/3064-4530-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2772-4545-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2548-4586-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2208	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2772	owPhyqX.exe
2556	yLRWmxq.exe
2760	fXZaGVo.exe
2768	AxpUIbg.exe
2720	PJNeJQN.exe
2500	refBXVF.exe
2580	JbDuQYY.exe
3064	YSEkcPw.exe
2736	okOMxHJ.exe
2548	sTlaUfK.exe
2680	RgCRult.exe
2316	iEbIqwy.exe
2732	GTNaAYt.exe
2436	QZEXhVh.exe
1056	XEskouP.exe
2388	ERgYoSw.exe
1084	mQdBVKM.exe
1476	WWBuErP.exe
2128	dQDrfFc.exe
2264	tythVqW.exe
764	bNsfspK.exe
1896	vNbvfRQ.exe
2224	NjKQyTs.exe
2116	zUCzCqK.exe
2396	ULAazTn.exe
1124	YTBixLo.exe
2192	nWinbsl.exe
344	kpHGqiI.exe
1492	YlJCOUx.exe
2140	ZrkSnwY.exe
2504	HnHgCrR.exe
2416	mcTizOv.exe
3060	HIFEXfk.exe
2368	iQwtvdr.exe
596	rWVTBKk.exe
2004	VuhmtWi.exe
684	PfvsojG.exe
1728	lKNpbVV.exe
1544	xSspGOv.exe
1716	OLtCjxu.exe
2448	mvXiMvF.exe
1696	qlibySc.exe
3000	ayemFrN.exe
1028	qKSutIK.exe
568	poEnGom.exe
1684	kOzuXCt.exe
1816	yLINcwb.exe
2080	ZWXRUmV.exe
1600	VBPQWXF.exe
2764	iymnoHC.exe
2904	mZVgxwC.exe
2792	PfPLdOb.exe
2604	LfwSLTN.exe
2684	ggWhiEy.exe
1732	UeyxGtJ.exe
2640	gBEZmDS.exe
3040	Qvituuz.exe
2392	lCWBGeK.exe
2276	vTldxMS.exe
2312	rQkzPFR.exe
2212	hvPibVI.exe
708	odDhjFV.exe
376	tzqldZK.exe
1136	wWoUWcp.exe

Loads dropped DLL 64 IoCs

pid	Process
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000012115-2.dat	upx
behavioral1/files/0x0007000000017131-14.dat	upx
behavioral1/files/0x00070000000175d2-20.dat	upx
behavioral1/files/0x0005000000019419-40.dat	upx
behavioral1/files/0x0007000000017292-23.dat	upx
behavioral1/files/0x0007000000018716-30.dat	upx
behavioral1/memory/2772-25-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/files/0x000500000001940f-36.dat	upx
behavioral1/files/0x00050000000194d4-70.dat	upx
behavioral1/memory/2736-78-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/files/0x00050000000194cc-43.dat	upx
behavioral1/memory/2548-85-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2680-88-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/files/0x001c000000005591-100.dat	upx
behavioral1/files/0x0005000000019553-118.dat	upx
behavioral1/files/0x0005000000019571-130.dat	upx
behavioral1/files/0x000500000001960c-147.dat	upx
behavioral1/files/0x0005000000019614-165.dat	upx
behavioral1/files/0x000500000001961a-185.dat	upx
behavioral1/files/0x0018000000016dbf-146.dat	upx
behavioral1/files/0x0005000000019612-159.dat	upx
behavioral1/files/0x0005000000019618-176.dat	upx
behavioral1/files/0x0005000000019615-168.dat	upx
behavioral1/files/0x000500000001960e-164.dat	upx
behavioral1/files/0x0005000000019616-174.dat	upx
behavioral1/files/0x00050000000195c9-136.dat	upx
behavioral1/files/0x0005000000019610-157.dat	upx
behavioral1/files/0x000500000001960a-140.dat	upx
behavioral1/files/0x0005000000019557-126.dat	upx
behavioral1/files/0x0005000000019526-124.dat	upx
behavioral1/files/0x00060000000194f3-113.dat	upx
behavioral1/files/0x00050000000194e0-96.dat	upx
behavioral1/files/0x0005000000019503-107.dat	upx
behavioral1/memory/2768-64-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/memory/2760-62-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/2556-61-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/files/0x00050000000193e6-51.dat	upx
behavioral1/files/0x00080000000175e4-50.dat	upx
behavioral1/memory/2500-84-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/memory/2720-83-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/memory/3064-77-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2580-72-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/files/0x00070000000170f2-22.dat	upx
behavioral1/files/0x0008000000016ddf-29.dat	upx
behavioral1/memory/2232-10-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/2500-4509-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/memory/2680-4510-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/2720-4519-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/memory/2736-4520-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/2760-4522-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/2580-4524-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/memory/2556-4527-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/3064-4530-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2772-4545-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/2548-4586-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KcGqzDa.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\dIzzmod.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\YEJAFMJ.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\NkiDbVR.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\HTAlTUY.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\ZQVryVa.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\xKqaDur.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\OoZKBGg.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\QhUtElB.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\HqNqhXC.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\sCUZbQo.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\tegymDQ.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\reDnMdU.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\jrxXoWk.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\vfLSqey.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\NPsmkci.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\wEoTwqw.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\lxxfMxg.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\eyVMoLd.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\QYmKflJ.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\CTwWZNe.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\oAHBASm.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\ZrXUqxI.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\qHANJKN.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\caEboke.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\mnIxMRF.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\PoLnuSr.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\vySJCIL.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\cMcAmwX.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\SkSwEcQ.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\YBTLQyM.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\jSqgnRu.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\xucCJNC.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\nrrxLde.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\fBaGpDo.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\qSosiPJ.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\MlSNjAg.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\onNSUIb.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\UZqLrja.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\EoPuCMP.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\PrdzBXT.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\uEASdgK.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\XMyfvuL.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\TzzeHKv.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\OmOYVDZ.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\KtQhUQS.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\qPEDUEZ.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\UFtKOmK.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\oySeXSy.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\ZTHcslJ.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\NxfqPVn.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\pMoxKAs.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\WRdWcZU.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\CAFoCIp.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\eGBfUTG.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\ZnAKCtF.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\YdeEAOA.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\ckJBzqn.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\OFncotn.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\Pyuwade.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\EbGtDDD.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\uhbPeDQ.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\jAromBa.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
File created	C:\Windows\System\gVCCJCf.exe	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2208	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
Token: SeDebugPrivilege	2208	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2208	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	31
PID 2232 wrote to memory of 2208	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	31
PID 2232 wrote to memory of 2208	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	31
PID 2232 wrote to memory of 2772	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	32
PID 2232 wrote to memory of 2772	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	32
PID 2232 wrote to memory of 2772	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	32
PID 2232 wrote to memory of 2768	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	33
PID 2232 wrote to memory of 2768	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	33
PID 2232 wrote to memory of 2768	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	33
PID 2232 wrote to memory of 2556	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	34
PID 2232 wrote to memory of 2556	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	34
PID 2232 wrote to memory of 2556	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	34
PID 2232 wrote to memory of 2720	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	35
PID 2232 wrote to memory of 2720	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	35
PID 2232 wrote to memory of 2720	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	35
PID 2232 wrote to memory of 2760	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	36
PID 2232 wrote to memory of 2760	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	36
PID 2232 wrote to memory of 2760	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	36
PID 2232 wrote to memory of 2736	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	37
PID 2232 wrote to memory of 2736	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	37
PID 2232 wrote to memory of 2736	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	37
PID 2232 wrote to memory of 2500	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	38
PID 2232 wrote to memory of 2500	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	38
PID 2232 wrote to memory of 2500	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	38
PID 2232 wrote to memory of 2548	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	39
PID 2232 wrote to memory of 2548	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	39
PID 2232 wrote to memory of 2548	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	39
PID 2232 wrote to memory of 2580	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	40
PID 2232 wrote to memory of 2580	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	40
PID 2232 wrote to memory of 2580	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	40
PID 2232 wrote to memory of 2680	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	41
PID 2232 wrote to memory of 2680	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	41
PID 2232 wrote to memory of 2680	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	41
PID 2232 wrote to memory of 3064	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	42
PID 2232 wrote to memory of 3064	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	42
PID 2232 wrote to memory of 3064	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	42
PID 2232 wrote to memory of 2732	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	43
PID 2232 wrote to memory of 2732	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	43
PID 2232 wrote to memory of 2732	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	43
PID 2232 wrote to memory of 2316	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	44
PID 2232 wrote to memory of 2316	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	44
PID 2232 wrote to memory of 2316	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	44
PID 2232 wrote to memory of 2436	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	45
PID 2232 wrote to memory of 2436	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	45
PID 2232 wrote to memory of 2436	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	45
PID 2232 wrote to memory of 1056	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	46
PID 2232 wrote to memory of 1056	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	46
PID 2232 wrote to memory of 1056	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	46
PID 2232 wrote to memory of 1084	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	47
PID 2232 wrote to memory of 1084	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	47
PID 2232 wrote to memory of 1084	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	47
PID 2232 wrote to memory of 2388	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	48
PID 2232 wrote to memory of 2388	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	48
PID 2232 wrote to memory of 2388	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	48
PID 2232 wrote to memory of 2128	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	49
PID 2232 wrote to memory of 2128	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	49
PID 2232 wrote to memory of 2128	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	49
PID 2232 wrote to memory of 1476	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	50
PID 2232 wrote to memory of 1476	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	50
PID 2232 wrote to memory of 1476	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	50
PID 2232 wrote to memory of 2264	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	51
PID 2232 wrote to memory of 2264	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	51
PID 2232 wrote to memory of 2264	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	51
PID 2232 wrote to memory of 764	2232	02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe	52

C:\Users\Admin\AppData\Local\Temp\02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02cbadfb57fd5226e5ab17813869039b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Windows\System\owPhyqX.exe
  C:\Windows\System\owPhyqX.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\AxpUIbg.exe
  C:\Windows\System\AxpUIbg.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\yLRWmxq.exe
  C:\Windows\System\yLRWmxq.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\PJNeJQN.exe
  C:\Windows\System\PJNeJQN.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\fXZaGVo.exe
  C:\Windows\System\fXZaGVo.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\okOMxHJ.exe
  C:\Windows\System\okOMxHJ.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\refBXVF.exe
  C:\Windows\System\refBXVF.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\sTlaUfK.exe
  C:\Windows\System\sTlaUfK.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\JbDuQYY.exe
  C:\Windows\System\JbDuQYY.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\RgCRult.exe
  C:\Windows\System\RgCRult.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\YSEkcPw.exe
  C:\Windows\System\YSEkcPw.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\GTNaAYt.exe
  C:\Windows\System\GTNaAYt.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\iEbIqwy.exe
  C:\Windows\System\iEbIqwy.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\QZEXhVh.exe
  C:\Windows\System\QZEXhVh.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\XEskouP.exe
  C:\Windows\System\XEskouP.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\mQdBVKM.exe
  C:\Windows\System\mQdBVKM.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\ERgYoSw.exe
  C:\Windows\System\ERgYoSw.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\dQDrfFc.exe
  C:\Windows\System\dQDrfFc.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\WWBuErP.exe
  C:\Windows\System\WWBuErP.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\tythVqW.exe
  C:\Windows\System\tythVqW.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\bNsfspK.exe
  C:\Windows\System\bNsfspK.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\vNbvfRQ.exe
  C:\Windows\System\vNbvfRQ.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\NjKQyTs.exe
  C:\Windows\System\NjKQyTs.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\zUCzCqK.exe
  C:\Windows\System\zUCzCqK.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\ULAazTn.exe
  C:\Windows\System\ULAazTn.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\nWinbsl.exe
  C:\Windows\System\nWinbsl.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\YTBixLo.exe
  C:\Windows\System\YTBixLo.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\ZrkSnwY.exe
  C:\Windows\System\ZrkSnwY.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\kpHGqiI.exe
  C:\Windows\System\kpHGqiI.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\lKNpbVV.exe
  C:\Windows\System\lKNpbVV.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\YlJCOUx.exe
  C:\Windows\System\YlJCOUx.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\xSspGOv.exe
  C:\Windows\System\xSspGOv.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\HnHgCrR.exe
  C:\Windows\System\HnHgCrR.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\OLtCjxu.exe
  C:\Windows\System\OLtCjxu.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\mcTizOv.exe
  C:\Windows\System\mcTizOv.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\mvXiMvF.exe
  C:\Windows\System\mvXiMvF.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\HIFEXfk.exe
  C:\Windows\System\HIFEXfk.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\ayemFrN.exe
  C:\Windows\System\ayemFrN.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\iQwtvdr.exe
  C:\Windows\System\iQwtvdr.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\qKSutIK.exe
  C:\Windows\System\qKSutIK.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\rWVTBKk.exe
  C:\Windows\System\rWVTBKk.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\poEnGom.exe
  C:\Windows\System\poEnGom.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\VuhmtWi.exe
  C:\Windows\System\VuhmtWi.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\kOzuXCt.exe
  C:\Windows\System\kOzuXCt.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\PfvsojG.exe
  C:\Windows\System\PfvsojG.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\yLINcwb.exe
  C:\Windows\System\yLINcwb.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\qlibySc.exe
  C:\Windows\System\qlibySc.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\ZWXRUmV.exe
  C:\Windows\System\ZWXRUmV.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\VBPQWXF.exe
  C:\Windows\System\VBPQWXF.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\iymnoHC.exe
  C:\Windows\System\iymnoHC.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\mZVgxwC.exe
  C:\Windows\System\mZVgxwC.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\LfwSLTN.exe
  C:\Windows\System\LfwSLTN.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\PfPLdOb.exe
  C:\Windows\System\PfPLdOb.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\gBEZmDS.exe
  C:\Windows\System\gBEZmDS.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\ggWhiEy.exe
  C:\Windows\System\ggWhiEy.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\Qvituuz.exe
  C:\Windows\System\Qvituuz.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\UeyxGtJ.exe
  C:\Windows\System\UeyxGtJ.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\lCWBGeK.exe
  C:\Windows\System\lCWBGeK.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\vTldxMS.exe
  C:\Windows\System\vTldxMS.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\tzqldZK.exe
  C:\Windows\System\tzqldZK.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\rQkzPFR.exe
  C:\Windows\System\rQkzPFR.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\wWoUWcp.exe
  C:\Windows\System\wWoUWcp.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\hvPibVI.exe
  C:\Windows\System\hvPibVI.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\sVqTFSG.exe
  C:\Windows\System\sVqTFSG.exe
  2⤵
  PID:1364
- C:\Windows\System\odDhjFV.exe
  C:\Windows\System\odDhjFV.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\XjjJgPp.exe
  C:\Windows\System\XjjJgPp.exe
  2⤵
  PID:3016
- C:\Windows\System\AEKeWSZ.exe
  C:\Windows\System\AEKeWSZ.exe
  2⤵
  PID:1916
- C:\Windows\System\mlqsBMD.exe
  C:\Windows\System\mlqsBMD.exe
  2⤵
  PID:284
- C:\Windows\System\jHljakP.exe
  C:\Windows\System\jHljakP.exe
  2⤵
  PID:2196
- C:\Windows\System\qUgVvbS.exe
  C:\Windows\System\qUgVvbS.exe
  2⤵
  PID:1848
- C:\Windows\System\FGeuzKx.exe
  C:\Windows\System\FGeuzKx.exe
  2⤵
  PID:1804
- C:\Windows\System\EUrBzrF.exe
  C:\Windows\System\EUrBzrF.exe
  2⤵
  PID:2888
- C:\Windows\System\jqtyIEm.exe
  C:\Windows\System\jqtyIEm.exe
  2⤵
  PID:1096
- C:\Windows\System\fYoatKJ.exe
  C:\Windows\System\fYoatKJ.exe
  2⤵
  PID:1980
- C:\Windows\System\qQSfsRr.exe
  C:\Windows\System\qQSfsRr.exe
  2⤵
  PID:2664
- C:\Windows\System\eZFvXlE.exe
  C:\Windows\System\eZFvXlE.exe
  2⤵
  PID:2284
- C:\Windows\System\JwDBpmA.exe
  C:\Windows\System\JwDBpmA.exe
  2⤵
  PID:2588
- C:\Windows\System\PaeWpNZ.exe
  C:\Windows\System\PaeWpNZ.exe
  2⤵
  PID:2716
- C:\Windows\System\hImuECk.exe
  C:\Windows\System\hImuECk.exe
  2⤵
  PID:2632
- C:\Windows\System\PIbzyTN.exe
  C:\Windows\System\PIbzyTN.exe
  2⤵
  PID:3024
- C:\Windows\System\qPVYglI.exe
  C:\Windows\System\qPVYglI.exe
  2⤵
  PID:1568
- C:\Windows\System\PlHtGHs.exe
  C:\Windows\System\PlHtGHs.exe
  2⤵
  PID:1708
- C:\Windows\System\mAdZJEv.exe
  C:\Windows\System\mAdZJEv.exe
  2⤵
  PID:1496
- C:\Windows\System\BNSMuEj.exe
  C:\Windows\System\BNSMuEj.exe
  2⤵
  PID:2360
- C:\Windows\System\hLllism.exe
  C:\Windows\System\hLllism.exe
  2⤵
  PID:2856
- C:\Windows\System\wybDxRD.exe
  C:\Windows\System\wybDxRD.exe
  2⤵
  PID:2948
- C:\Windows\System\yNXZlIz.exe
  C:\Windows\System\yNXZlIz.exe
  2⤵
  PID:1584
- C:\Windows\System\eQTgwbV.exe
  C:\Windows\System\eQTgwbV.exe
  2⤵
  PID:2564
- C:\Windows\System\dsgtfUX.exe
  C:\Windows\System\dsgtfUX.exe
  2⤵
  PID:2172
- C:\Windows\System\sXbKeYs.exe
  C:\Windows\System\sXbKeYs.exe
  2⤵
  PID:1956
- C:\Windows\System\epKBNTv.exe
  C:\Windows\System\epKBNTv.exe
  2⤵
  PID:1652
- C:\Windows\System\LLWHeSS.exe
  C:\Windows\System\LLWHeSS.exe
  2⤵
  PID:2520
- C:\Windows\System\eolToad.exe
  C:\Windows\System\eolToad.exe
  2⤵
  PID:1756
- C:\Windows\System\gJHRWFs.exe
  C:\Windows\System\gJHRWFs.exe
  2⤵
  PID:2744
- C:\Windows\System\MSJDBoB.exe
  C:\Windows\System\MSJDBoB.exe
  2⤵
  PID:2964
- C:\Windows\System\UIHoplR.exe
  C:\Windows\System\UIHoplR.exe
  2⤵
  PID:1632
- C:\Windows\System\SLYAPGt.exe
  C:\Windows\System\SLYAPGt.exe
  2⤵
  PID:3084
- C:\Windows\System\RSSkYTn.exe
  C:\Windows\System\RSSkYTn.exe
  2⤵
  PID:3100
- C:\Windows\System\cWaewoJ.exe
  C:\Windows\System\cWaewoJ.exe
  2⤵
  PID:3116
- C:\Windows\System\ojpAbwF.exe
  C:\Windows\System\ojpAbwF.exe
  2⤵
  PID:3132
- C:\Windows\System\NONhuNM.exe
  C:\Windows\System\NONhuNM.exe
  2⤵
  PID:3152
- C:\Windows\System\ECCHjwt.exe
  C:\Windows\System\ECCHjwt.exe
  2⤵
  PID:3168
- C:\Windows\System\QOOYsAP.exe
  C:\Windows\System\QOOYsAP.exe
  2⤵
  PID:3184
- C:\Windows\System\RbjDlFA.exe
  C:\Windows\System\RbjDlFA.exe
  2⤵
  PID:3268
- C:\Windows\System\hnaonFJ.exe
  C:\Windows\System\hnaonFJ.exe
  2⤵
  PID:3292
- C:\Windows\System\kHmvjJG.exe
  C:\Windows\System\kHmvjJG.exe
  2⤵
  PID:3324
- C:\Windows\System\VCjcgjC.exe
  C:\Windows\System\VCjcgjC.exe
  2⤵
  PID:3352
- C:\Windows\System\cWmhoic.exe
  C:\Windows\System\cWmhoic.exe
  2⤵
  PID:3400
- C:\Windows\System\lPJxQyL.exe
  C:\Windows\System\lPJxQyL.exe
  2⤵
  PID:3464
- C:\Windows\System\fBaGpDo.exe
  C:\Windows\System\fBaGpDo.exe
  2⤵
  PID:3516
- C:\Windows\System\TFltKnQ.exe
  C:\Windows\System\TFltKnQ.exe
  2⤵
  PID:3536
- C:\Windows\System\UVhaHXz.exe
  C:\Windows\System\UVhaHXz.exe
  2⤵
  PID:3556
- C:\Windows\System\yKGzzSK.exe
  C:\Windows\System\yKGzzSK.exe
  2⤵
  PID:3572
- C:\Windows\System\YZwucet.exe
  C:\Windows\System\YZwucet.exe
  2⤵
  PID:3588
- C:\Windows\System\VMcNzjF.exe
  C:\Windows\System\VMcNzjF.exe
  2⤵
  PID:3604
- C:\Windows\System\aSuRcdV.exe
  C:\Windows\System\aSuRcdV.exe
  2⤵
  PID:3620
- C:\Windows\System\LHhQecx.exe
  C:\Windows\System\LHhQecx.exe
  2⤵
  PID:3640
- C:\Windows\System\spxlPrY.exe
  C:\Windows\System\spxlPrY.exe
  2⤵
  PID:3656
- C:\Windows\System\GTiUsgy.exe
  C:\Windows\System\GTiUsgy.exe
  2⤵
  PID:3676
- C:\Windows\System\ioNzRFU.exe
  C:\Windows\System\ioNzRFU.exe
  2⤵
  PID:3704
- C:\Windows\System\ycOLYIe.exe
  C:\Windows\System\ycOLYIe.exe
  2⤵
  PID:3720
- C:\Windows\System\UpYonxa.exe
  C:\Windows\System\UpYonxa.exe
  2⤵
  PID:3736
- C:\Windows\System\vvOeUYO.exe
  C:\Windows\System\vvOeUYO.exe
  2⤵
  PID:3752
- C:\Windows\System\cEYQWxs.exe
  C:\Windows\System\cEYQWxs.exe
  2⤵
  PID:3772
- C:\Windows\System\hwBOROE.exe
  C:\Windows\System\hwBOROE.exe
  2⤵
  PID:3788
- C:\Windows\System\EiBqzMo.exe
  C:\Windows\System\EiBqzMo.exe
  2⤵
  PID:3808
- C:\Windows\System\oEwryde.exe
  C:\Windows\System\oEwryde.exe
  2⤵
  PID:3824
- C:\Windows\System\ptZQHDS.exe
  C:\Windows\System\ptZQHDS.exe
  2⤵
  PID:3840
- C:\Windows\System\OtSZxSm.exe
  C:\Windows\System\OtSZxSm.exe
  2⤵
  PID:3856
- C:\Windows\System\NTGDyvt.exe
  C:\Windows\System\NTGDyvt.exe
  2⤵
  PID:3872
- C:\Windows\System\yOfXYbH.exe
  C:\Windows\System\yOfXYbH.exe
  2⤵
  PID:3888
- C:\Windows\System\MJJuoyA.exe
  C:\Windows\System\MJJuoyA.exe
  2⤵
  PID:3904
- C:\Windows\System\TXJWPRV.exe
  C:\Windows\System\TXJWPRV.exe
  2⤵
  PID:3920
- C:\Windows\System\abpWBYs.exe
  C:\Windows\System\abpWBYs.exe
  2⤵
  PID:3940
- C:\Windows\System\ktnPzUG.exe
  C:\Windows\System\ktnPzUG.exe
  2⤵
  PID:3960
- C:\Windows\System\PCaHTZn.exe
  C:\Windows\System\PCaHTZn.exe
  2⤵
  PID:3976
- C:\Windows\System\WExJQWT.exe
  C:\Windows\System\WExJQWT.exe
  2⤵
  PID:3992
- C:\Windows\System\clTxwdr.exe
  C:\Windows\System\clTxwdr.exe
  2⤵
  PID:4008
- C:\Windows\System\YuUpBBF.exe
  C:\Windows\System\YuUpBBF.exe
  2⤵
  PID:4024
- C:\Windows\System\eOTsKjj.exe
  C:\Windows\System\eOTsKjj.exe
  2⤵
  PID:4044
- C:\Windows\System\UYwLtDU.exe
  C:\Windows\System\UYwLtDU.exe
  2⤵
  PID:4060
- C:\Windows\System\dCYCkzN.exe
  C:\Windows\System\dCYCkzN.exe
  2⤵
  PID:4076
- C:\Windows\System\YMXpYMj.exe
  C:\Windows\System\YMXpYMj.exe
  2⤵
  PID:4092
- C:\Windows\System\YNCLAsA.exe
  C:\Windows\System\YNCLAsA.exe
  2⤵
  PID:2832
- C:\Windows\System\agSTJwM.exe
  C:\Windows\System\agSTJwM.exe
  2⤵
  PID:2676
- C:\Windows\System\RQpBLYK.exe
  C:\Windows\System\RQpBLYK.exe
  2⤵
  PID:2752
- C:\Windows\System\VjuWcwC.exe
  C:\Windows\System\VjuWcwC.exe
  2⤵
  PID:3128
- C:\Windows\System\zwIbSSJ.exe
  C:\Windows\System\zwIbSSJ.exe
  2⤵
  PID:2836
- C:\Windows\System\fSWVlzu.exe
  C:\Windows\System\fSWVlzu.exe
  2⤵
  PID:1472
- C:\Windows\System\TCdPeVr.exe
  C:\Windows\System\TCdPeVr.exe
  2⤵
  PID:1228
- C:\Windows\System\VyDGZKe.exe
  C:\Windows\System\VyDGZKe.exe
  2⤵
  PID:3204
- C:\Windows\System\wVQPwjx.exe
  C:\Windows\System\wVQPwjx.exe
  2⤵
  PID:3220
- C:\Windows\System\MgvpKuE.exe
  C:\Windows\System\MgvpKuE.exe
  2⤵
  PID:3236
- C:\Windows\System\xgZYiuy.exe
  C:\Windows\System\xgZYiuy.exe
  2⤵
  PID:3252
- C:\Windows\System\AcrRrac.exe
  C:\Windows\System\AcrRrac.exe
  2⤵
  PID:1744
- C:\Windows\System\AKrsRwQ.exe
  C:\Windows\System\AKrsRwQ.exe
  2⤵
  PID:892
- C:\Windows\System\bcMjPcQ.exe
  C:\Windows\System\bcMjPcQ.exe
  2⤵
  PID:2800
- C:\Windows\System\pKHsZTc.exe
  C:\Windows\System\pKHsZTc.exe
  2⤵
  PID:3300
- C:\Windows\System\marsUBJ.exe
  C:\Windows\System\marsUBJ.exe
  2⤵
  PID:3308
- C:\Windows\System\WAXwGWL.exe
  C:\Windows\System\WAXwGWL.exe
  2⤵
  PID:3304
- C:\Windows\System\LjQVMzZ.exe
  C:\Windows\System\LjQVMzZ.exe
  2⤵
  PID:3368
- C:\Windows\System\oKPUWfi.exe
  C:\Windows\System\oKPUWfi.exe
  2⤵
  PID:3380
- C:\Windows\System\SgNpaKj.exe
  C:\Windows\System\SgNpaKj.exe
  2⤵
  PID:3176
- C:\Windows\System\pSemTGZ.exe
  C:\Windows\System\pSemTGZ.exe
  2⤵
  PID:1592
- C:\Windows\System\zyhnhyL.exe
  C:\Windows\System\zyhnhyL.exe
  2⤵
  PID:1100
- C:\Windows\System\fUowdKt.exe
  C:\Windows\System\fUowdKt.exe
  2⤵
  PID:2280
- C:\Windows\System\kLXbytI.exe
  C:\Windows\System\kLXbytI.exe
  2⤵
  PID:3076
- C:\Windows\System\oiJmqpm.exe
  C:\Windows\System\oiJmqpm.exe
  2⤵
  PID:3276
- C:\Windows\System\qXKKcmj.exe
  C:\Windows\System\qXKKcmj.exe
  2⤵
  PID:3336
- C:\Windows\System\OaNRSQe.exe
  C:\Windows\System\OaNRSQe.exe
  2⤵
  PID:3408
- C:\Windows\System\EYtFcLp.exe
  C:\Windows\System\EYtFcLp.exe
  2⤵
  PID:3440
- C:\Windows\System\dgMoNKH.exe
  C:\Windows\System\dgMoNKH.exe
  2⤵
  PID:3512
- C:\Windows\System\AsUZMoH.exe
  C:\Windows\System\AsUZMoH.exe
  2⤵
  PID:3584
- C:\Windows\System\JTPQSDl.exe
  C:\Windows\System\JTPQSDl.exe
  2⤵
  PID:3684
- C:\Windows\System\VILgxBo.exe
  C:\Windows\System\VILgxBo.exe
  2⤵
  PID:3732
- C:\Windows\System\DcAZcnI.exe
  C:\Windows\System\DcAZcnI.exe
  2⤵
  PID:3564
- C:\Windows\System\ZHYbvWp.exe
  C:\Windows\System\ZHYbvWp.exe
  2⤵
  PID:3864
- C:\Windows\System\FwoXSRr.exe
  C:\Windows\System\FwoXSRr.exe
  2⤵
  PID:3928
- C:\Windows\System\crYfSsX.exe
  C:\Windows\System\crYfSsX.exe
  2⤵
  PID:3668
- C:\Windows\System\nwuUcUB.exe
  C:\Windows\System\nwuUcUB.exe
  2⤵
  PID:3716
- C:\Windows\System\mNXLMyO.exe
  C:\Windows\System\mNXLMyO.exe
  2⤵
  PID:3932
- C:\Windows\System\RstOYca.exe
  C:\Windows\System\RstOYca.exe
  2⤵
  PID:3912
- C:\Windows\System\WhNDZsh.exe
  C:\Windows\System\WhNDZsh.exe
  2⤵
  PID:3956
- C:\Windows\System\klsUJno.exe
  C:\Windows\System\klsUJno.exe
  2⤵
  PID:3968
- C:\Windows\System\iuQkpVH.exe
  C:\Windows\System\iuQkpVH.exe
  2⤵
  PID:4004
- C:\Windows\System\fUCgmvt.exe
  C:\Windows\System\fUCgmvt.exe
  2⤵
  PID:4072
- C:\Windows\System\HZHZduZ.exe
  C:\Windows\System\HZHZduZ.exe
  2⤵
  PID:2148
- C:\Windows\System\VBsLfGe.exe
  C:\Windows\System\VBsLfGe.exe
  2⤵
  PID:2636
- C:\Windows\System\GUaidaP.exe
  C:\Windows\System\GUaidaP.exe
  2⤵
  PID:3248
- C:\Windows\System\CCIHsEM.exe
  C:\Windows\System\CCIHsEM.exe
  2⤵
  PID:464
- C:\Windows\System\IrDQgSd.exe
  C:\Windows\System\IrDQgSd.exe
  2⤵
  PID:480
- C:\Windows\System\pXtTGoY.exe
  C:\Windows\System\pXtTGoY.exe
  2⤵
  PID:3672
- C:\Windows\System\ZszuSbx.exe
  C:\Windows\System\ZszuSbx.exe
  2⤵
  PID:2180
- C:\Windows\System\IrtIdpo.exe
  C:\Windows\System\IrtIdpo.exe
  2⤵
  PID:2228
- C:\Windows\System\UxoTLGc.exe
  C:\Windows\System\UxoTLGc.exe
  2⤵
  PID:768
- C:\Windows\System\jLXYrIL.exe
  C:\Windows\System\jLXYrIL.exe
  2⤵
  PID:1352
- C:\Windows\System\XVqfZeO.exe
  C:\Windows\System\XVqfZeO.exe
  2⤵
  PID:2596
- C:\Windows\System\IBwzbef.exe
  C:\Windows\System\IBwzbef.exe
  2⤵
  PID:3448
- C:\Windows\System\hXHUGnC.exe
  C:\Windows\System\hXHUGnC.exe
  2⤵
  PID:2704
- C:\Windows\System\eeyrxLs.exe
  C:\Windows\System\eeyrxLs.exe
  2⤵
  PID:532
- C:\Windows\System\LiAJXFG.exe
  C:\Windows\System\LiAJXFG.exe
  2⤵
  PID:3228
- C:\Windows\System\ADuDCkP.exe
  C:\Windows\System\ADuDCkP.exe
  2⤵
  PID:2032
- C:\Windows\System\iunhccN.exe
  C:\Windows\System\iunhccN.exe
  2⤵
  PID:2924
- C:\Windows\System\hSQdBLP.exe
  C:\Windows\System\hSQdBLP.exe
  2⤵
  PID:3852
- C:\Windows\System\umOPKHL.exe
  C:\Windows\System\umOPKHL.exe
  2⤵
  PID:2712
- C:\Windows\System\fVkdPGD.exe
  C:\Windows\System\fVkdPGD.exe
  2⤵
  PID:1920
- C:\Windows\System\VySrbyZ.exe
  C:\Windows\System\VySrbyZ.exe
  2⤵
  PID:3348
- C:\Windows\System\FbZsEsv.exe
  C:\Windows\System\FbZsEsv.exe
  2⤵
  PID:664
- C:\Windows\System\AMpjBhN.exe
  C:\Windows\System\AMpjBhN.exe
  2⤵
  PID:3284
- C:\Windows\System\ekqwZsH.exe
  C:\Windows\System\ekqwZsH.exe
  2⤵
  PID:748
- C:\Windows\System\gEAalHf.exe
  C:\Windows\System\gEAalHf.exe
  2⤵
  PID:3416
- C:\Windows\System\mRuOGmU.exe
  C:\Windows\System\mRuOGmU.exe
  2⤵
  PID:3548
- C:\Windows\System\RqlumoE.exe
  C:\Windows\System\RqlumoE.exe
  2⤵
  PID:1324
- C:\Windows\System\rFiEGfQ.exe
  C:\Windows\System\rFiEGfQ.exe
  2⤵
  PID:3796
- C:\Windows\System\VCmnEiL.exe
  C:\Windows\System\VCmnEiL.exe
  2⤵
  PID:3900
- C:\Windows\System\SUeVRjN.exe
  C:\Windows\System\SUeVRjN.exe
  2⤵
  PID:3524
- C:\Windows\System\kzBJlJS.exe
  C:\Windows\System\kzBJlJS.exe
  2⤵
  PID:3628
- C:\Windows\System\BunwUwC.exe
  C:\Windows\System\BunwUwC.exe
  2⤵
  PID:3748
- C:\Windows\System\toaHGUg.exe
  C:\Windows\System\toaHGUg.exe
  2⤵
  PID:3816
- C:\Windows\System\FIelYLH.exe
  C:\Windows\System\FIelYLH.exe
  2⤵
  PID:4032
- C:\Windows\System\sJPZwyh.exe
  C:\Windows\System\sJPZwyh.exe
  2⤵
  PID:3244
- C:\Windows\System\DLWMQmV.exe
  C:\Windows\System\DLWMQmV.exe
  2⤵
  PID:3988
- C:\Windows\System\NtEiqvq.exe
  C:\Windows\System\NtEiqvq.exe
  2⤵
  PID:3160
- C:\Windows\System\xQDqISL.exe
  C:\Windows\System\xQDqISL.exe
  2⤵
  PID:2200
- C:\Windows\System\oBLFVNi.exe
  C:\Windows\System\oBLFVNi.exe
  2⤵
  PID:3092
- C:\Windows\System\mTBZSHg.exe
  C:\Windows\System\mTBZSHg.exe
  2⤵
  PID:2112
- C:\Windows\System\AEtmqnv.exe
  C:\Windows\System\AEtmqnv.exe
  2⤵
  PID:1216
- C:\Windows\System\KsNFmAC.exe
  C:\Windows\System\KsNFmAC.exe
  2⤵
  PID:3140
- C:\Windows\System\QyLHLaJ.exe
  C:\Windows\System\QyLHLaJ.exe
  2⤵
  PID:1344
- C:\Windows\System\feFdrdO.exe
  C:\Windows\System\feFdrdO.exe
  2⤵
  PID:3260
- C:\Windows\System\iCGKrzJ.exe
  C:\Windows\System\iCGKrzJ.exe
  2⤵
  PID:4088
- C:\Windows\System\bKnrZQi.exe
  C:\Windows\System\bKnrZQi.exe
  2⤵
  PID:1772
- C:\Windows\System\kxYwxvq.exe
  C:\Windows\System\kxYwxvq.exe
  2⤵
  PID:1240
- C:\Windows\System\VzRKCbU.exe
  C:\Windows\System\VzRKCbU.exe
  2⤵
  PID:3596
- C:\Windows\System\UWBkWaG.exe
  C:\Windows\System\UWBkWaG.exe
  2⤵
  PID:3376
- C:\Windows\System\liAnaYT.exe
  C:\Windows\System\liAnaYT.exe
  2⤵
  PID:2616
- C:\Windows\System\KicmrGB.exe
  C:\Windows\System\KicmrGB.exe
  2⤵
  PID:2088
- C:\Windows\System\EcmxTcv.exe
  C:\Windows\System\EcmxTcv.exe
  2⤵
  PID:2840
- C:\Windows\System\QakiBUp.exe
  C:\Windows\System\QakiBUp.exe
  2⤵
  PID:1840
- C:\Windows\System\VFcmPWc.exe
  C:\Windows\System\VFcmPWc.exe
  2⤵
  PID:3332
- C:\Windows\System\SSgGGAo.exe
  C:\Windows\System\SSgGGAo.exe
  2⤵
  PID:2872
- C:\Windows\System\yloLBij.exe
  C:\Windows\System\yloLBij.exe
  2⤵
  PID:1788
- C:\Windows\System\XwkXAdf.exe
  C:\Windows\System\XwkXAdf.exe
  2⤵
  PID:2272
- C:\Windows\System\poxYsou.exe
  C:\Windows\System\poxYsou.exe
  2⤵
  PID:3148
- C:\Windows\System\ebtsUTp.exe
  C:\Windows\System\ebtsUTp.exe
  2⤵
  PID:3192
- C:\Windows\System\pTHitat.exe
  C:\Windows\System\pTHitat.exe
  2⤵
  PID:3768
- C:\Windows\System\jPneuTS.exe
  C:\Windows\System\jPneuTS.exe
  2⤵
  PID:1444
- C:\Windows\System\ZQturAz.exe
  C:\Windows\System\ZQturAz.exe
  2⤵
  PID:2784
- C:\Windows\System\TKdemWh.exe
  C:\Windows\System\TKdemWh.exe
  2⤵
  PID:3616
- C:\Windows\System\RRBTjkr.exe
  C:\Windows\System\RRBTjkr.exe
  2⤵
  PID:3728
- C:\Windows\System\OvGfLMS.exe
  C:\Windows\System\OvGfLMS.exe
  2⤵
  PID:2976
- C:\Windows\System\wIzugwW.exe
  C:\Windows\System\wIzugwW.exe
  2⤵
  PID:3216
- C:\Windows\System\nSoFHlo.exe
  C:\Windows\System\nSoFHlo.exe
  2⤵
  PID:2124
- C:\Windows\System\ZIexdud.exe
  C:\Windows\System\ZIexdud.exe
  2⤵
  PID:2352
- C:\Windows\System\eOOqyts.exe
  C:\Windows\System\eOOqyts.exe
  2⤵
  PID:3952
- C:\Windows\System\FCepgou.exe
  C:\Windows\System\FCepgou.exe
  2⤵
  PID:3508
- C:\Windows\System\SanWvZY.exe
  C:\Windows\System\SanWvZY.exe
  2⤵
  PID:1720
- C:\Windows\System\GZqrdad.exe
  C:\Windows\System\GZqrdad.exe
  2⤵
  PID:3360
- C:\Windows\System\OxypHcP.exe
  C:\Windows\System\OxypHcP.exe
  2⤵
  PID:3820
- C:\Windows\System\DNrHGTu.exe
  C:\Windows\System\DNrHGTu.exe
  2⤵
  PID:3344
- C:\Windows\System\qkYDmeV.exe
  C:\Windows\System\qkYDmeV.exe
  2⤵
  PID:1948
- C:\Windows\System\Eiqtgqq.exe
  C:\Windows\System\Eiqtgqq.exe
  2⤵
  PID:1072
- C:\Windows\System\HxhdMvs.exe
  C:\Windows\System\HxhdMvs.exe
  2⤵
  PID:2380
- C:\Windows\System\QijVxrH.exe
  C:\Windows\System\QijVxrH.exe
  2⤵
  PID:2072
- C:\Windows\System\mKKpisp.exe
  C:\Windows\System\mKKpisp.exe
  2⤵
  PID:3144
- C:\Windows\System\UeGKlyu.exe
  C:\Windows\System\UeGKlyu.exe
  2⤵
  PID:3600
- C:\Windows\System\PfGTxfI.exe
  C:\Windows\System\PfGTxfI.exe
  2⤵
  PID:1224
- C:\Windows\System\NpIuvHA.exe
  C:\Windows\System\NpIuvHA.exe
  2⤵
  PID:2696
- C:\Windows\System\gRwRVel.exe
  C:\Windows\System\gRwRVel.exe
  2⤵
  PID:3200
- C:\Windows\System\cvuBKql.exe
  C:\Windows\System\cvuBKql.exe
  2⤵
  PID:4068
- C:\Windows\System\PTYmSiN.exe
  C:\Windows\System\PTYmSiN.exe
  2⤵
  PID:3212
- C:\Windows\System\BiZEtGU.exe
  C:\Windows\System\BiZEtGU.exe
  2⤵
  PID:4104
- C:\Windows\System\LuGmsHO.exe
  C:\Windows\System\LuGmsHO.exe
  2⤵
  PID:4120
- C:\Windows\System\TJFQBXr.exe
  C:\Windows\System\TJFQBXr.exe
  2⤵
  PID:4136
- C:\Windows\System\ONOvXZv.exe
  C:\Windows\System\ONOvXZv.exe
  2⤵
  PID:4156
- C:\Windows\System\HumluGL.exe
  C:\Windows\System\HumluGL.exe
  2⤵
  PID:4176
- C:\Windows\System\ecIWthh.exe
  C:\Windows\System\ecIWthh.exe
  2⤵
  PID:4192
- C:\Windows\System\RKWETKN.exe
  C:\Windows\System\RKWETKN.exe
  2⤵
  PID:4208
- C:\Windows\System\fJzASCD.exe
  C:\Windows\System\fJzASCD.exe
  2⤵
  PID:4224
- C:\Windows\System\vXNQYFD.exe
  C:\Windows\System\vXNQYFD.exe
  2⤵
  PID:4240
- C:\Windows\System\zVBdYJc.exe
  C:\Windows\System\zVBdYJc.exe
  2⤵
  PID:4256
- C:\Windows\System\huHGrlh.exe
  C:\Windows\System\huHGrlh.exe
  2⤵
  PID:4272
- C:\Windows\System\iuckDaS.exe
  C:\Windows\System\iuckDaS.exe
  2⤵
  PID:4292
- C:\Windows\System\xhNCCEn.exe
  C:\Windows\System\xhNCCEn.exe
  2⤵
  PID:4308
- C:\Windows\System\JjopKzK.exe
  C:\Windows\System\JjopKzK.exe
  2⤵
  PID:4324
- C:\Windows\System\PHnTbaG.exe
  C:\Windows\System\PHnTbaG.exe
  2⤵
  PID:4340
- C:\Windows\System\hnEvQqT.exe
  C:\Windows\System\hnEvQqT.exe
  2⤵
  PID:4364
- C:\Windows\System\DiczIKV.exe
  C:\Windows\System\DiczIKV.exe
  2⤵
  PID:4384
- C:\Windows\System\cDkCOgs.exe
  C:\Windows\System\cDkCOgs.exe
  2⤵
  PID:4400
- C:\Windows\System\jlbNnKY.exe
  C:\Windows\System\jlbNnKY.exe
  2⤵
  PID:4416
- C:\Windows\System\xEdJTTV.exe
  C:\Windows\System\xEdJTTV.exe
  2⤵
  PID:4492
- C:\Windows\System\CSObIAY.exe
  C:\Windows\System\CSObIAY.exe
  2⤵
  PID:4524
- C:\Windows\System\FQJqKeZ.exe
  C:\Windows\System\FQJqKeZ.exe
  2⤵
  PID:4544
- C:\Windows\System\RukfkFz.exe
  C:\Windows\System\RukfkFz.exe
  2⤵
  PID:4560
- C:\Windows\System\dBINLZv.exe
  C:\Windows\System\dBINLZv.exe
  2⤵
  PID:4576
- C:\Windows\System\FLumJyJ.exe
  C:\Windows\System\FLumJyJ.exe
  2⤵
  PID:4600
- C:\Windows\System\DrZKmJx.exe
  C:\Windows\System\DrZKmJx.exe
  2⤵
  PID:4628
- C:\Windows\System\DQhMwEk.exe
  C:\Windows\System\DQhMwEk.exe
  2⤵
  PID:4644
- C:\Windows\System\XycxNAK.exe
  C:\Windows\System\XycxNAK.exe
  2⤵
  PID:4664
- C:\Windows\System\WXfySDc.exe
  C:\Windows\System\WXfySDc.exe
  2⤵
  PID:4680
- C:\Windows\System\MuAdDmO.exe
  C:\Windows\System\MuAdDmO.exe
  2⤵
  PID:4700
- C:\Windows\System\eHQfECx.exe
  C:\Windows\System\eHQfECx.exe
  2⤵
  PID:4716
- C:\Windows\System\BLvZzkz.exe
  C:\Windows\System\BLvZzkz.exe
  2⤵
  PID:4748
- C:\Windows\System\bTQpbpu.exe
  C:\Windows\System\bTQpbpu.exe
  2⤵
  PID:4764
- C:\Windows\System\YtTSeaT.exe
  C:\Windows\System\YtTSeaT.exe
  2⤵
  PID:4780
- C:\Windows\System\TWpEaXK.exe
  C:\Windows\System\TWpEaXK.exe
  2⤵
  PID:4812
- C:\Windows\System\tUqLvpw.exe
  C:\Windows\System\tUqLvpw.exe
  2⤵
  PID:4952
- C:\Windows\System\BbovZcD.exe
  C:\Windows\System\BbovZcD.exe
  2⤵
  PID:4980
- C:\Windows\System\NYsSxRk.exe
  C:\Windows\System\NYsSxRk.exe
  2⤵
  PID:5000
- C:\Windows\System\tkoVqeX.exe
  C:\Windows\System\tkoVqeX.exe
  2⤵
  PID:5024
- C:\Windows\System\qJuzzgU.exe
  C:\Windows\System\qJuzzgU.exe
  2⤵
  PID:5048
- C:\Windows\System\miEEfZH.exe
  C:\Windows\System\miEEfZH.exe
  2⤵
  PID:5112
- C:\Windows\System\vvEQdVD.exe
  C:\Windows\System\vvEQdVD.exe
  2⤵
  PID:828
- C:\Windows\System\ZHRyTVF.exe
  C:\Windows\System\ZHRyTVF.exe
  2⤵
  PID:3712
- C:\Windows\System\kvkBkba.exe
  C:\Windows\System\kvkBkba.exe
  2⤵
  PID:4164
- C:\Windows\System\XQCyGPn.exe
  C:\Windows\System\XQCyGPn.exe
  2⤵
  PID:4172
- C:\Windows\System\xWfrpAu.exe
  C:\Windows\System\xWfrpAu.exe
  2⤵
  PID:4304
- C:\Windows\System\GYrjAgI.exe
  C:\Windows\System\GYrjAgI.exe
  2⤵
  PID:2040
- C:\Windows\System\xqnMysS.exe
  C:\Windows\System\xqnMysS.exe
  2⤵
  PID:4248
- C:\Windows\System\kUGjPxE.exe
  C:\Windows\System\kUGjPxE.exe
  2⤵
  PID:4288
- C:\Windows\System\TgKYoPd.exe
  C:\Windows\System\TgKYoPd.exe
  2⤵
  PID:4352
- C:\Windows\System\bCFpKGl.exe
  C:\Windows\System\bCFpKGl.exe
  2⤵
  PID:4396
- C:\Windows\System\yyShoAm.exe
  C:\Windows\System\yyShoAm.exe
  2⤵
  PID:4456
- C:\Windows\System\VYqYLdm.exe
  C:\Windows\System\VYqYLdm.exe
  2⤵
  PID:2204
- C:\Windows\System\VGXaNKq.exe
  C:\Windows\System\VGXaNKq.exe
  2⤵
  PID:1604
- C:\Windows\System\LtyendS.exe
  C:\Windows\System\LtyendS.exe
  2⤵
  PID:4484
- C:\Windows\System\SvgBSzy.exe
  C:\Windows\System\SvgBSzy.exe
  2⤵
  PID:4520
- C:\Windows\System\ilyRVJs.exe
  C:\Windows\System\ilyRVJs.exe
  2⤵
  PID:4536
- C:\Windows\System\MmrEWsQ.exe
  C:\Windows\System\MmrEWsQ.exe
  2⤵
  PID:4556
- C:\Windows\System\oVnzjhJ.exe
  C:\Windows\System\oVnzjhJ.exe
  2⤵
  PID:4592
- C:\Windows\System\jMWfVkB.exe
  C:\Windows\System\jMWfVkB.exe
  2⤵
  PID:4616
- C:\Windows\System\NFiWWgl.exe
  C:\Windows\System\NFiWWgl.exe
  2⤵
  PID:4652
- C:\Windows\System\WRgQsLz.exe
  C:\Windows\System\WRgQsLz.exe
  2⤵
  PID:4692
- C:\Windows\System\HolkUXp.exe
  C:\Windows\System\HolkUXp.exe
  2⤵
  PID:4736
- C:\Windows\System\AWBvtwn.exe
  C:\Windows\System\AWBvtwn.exe
  2⤵
  PID:4640
- C:\Windows\System\wVTmDNk.exe
  C:\Windows\System\wVTmDNk.exe
  2⤵
  PID:4728
- C:\Windows\System\PzAnPah.exe
  C:\Windows\System\PzAnPah.exe
  2⤵
  PID:4772
- C:\Windows\System\wINvyje.exe
  C:\Windows\System\wINvyje.exe
  2⤵
  PID:4808
- C:\Windows\System\iNtRlgD.exe
  C:\Windows\System\iNtRlgD.exe
  2⤵
  PID:4832
- C:\Windows\System\uaTNtsQ.exe
  C:\Windows\System\uaTNtsQ.exe
  2⤵
  PID:4824
- C:\Windows\System\JEkVPGL.exe
  C:\Windows\System\JEkVPGL.exe
  2⤵
  PID:4852
- C:\Windows\System\aTSKVYl.exe
  C:\Windows\System\aTSKVYl.exe
  2⤵
  PID:4888
- C:\Windows\System\sgYiVDM.exe
  C:\Windows\System\sgYiVDM.exe
  2⤵
  PID:4912
- C:\Windows\System\OKkJear.exe
  C:\Windows\System\OKkJear.exe
  2⤵
  PID:4936
- C:\Windows\System\hGCCQhO.exe
  C:\Windows\System\hGCCQhO.exe
  2⤵
  PID:4960
- C:\Windows\System\LoUGyar.exe
  C:\Windows\System\LoUGyar.exe
  2⤵
  PID:5056
- C:\Windows\System\eldfACj.exe
  C:\Windows\System\eldfACj.exe
  2⤵
  PID:4996
- C:\Windows\System\myAnzWM.exe
  C:\Windows\System\myAnzWM.exe
  2⤵
  PID:5080
- C:\Windows\System\sTHvtIH.exe
  C:\Windows\System\sTHvtIH.exe
  2⤵
  PID:5040
- C:\Windows\System\oZGpJyG.exe
  C:\Windows\System\oZGpJyG.exe
  2⤵
  PID:5072
- C:\Windows\System\UIqpOVP.exe
  C:\Windows\System\UIqpOVP.exe
  2⤵
  PID:5104
- C:\Windows\System\JUobyoW.exe
  C:\Windows\System\JUobyoW.exe
  2⤵
  PID:108
- C:\Windows\System\ZhzkyUn.exe
  C:\Windows\System\ZhzkyUn.exe
  2⤵
  PID:4200
- C:\Windows\System\mKGKiKW.exe
  C:\Windows\System\mKGKiKW.exe
  2⤵
  PID:4100
- C:\Windows\System\bOfpeqm.exe
  C:\Windows\System\bOfpeqm.exe
  2⤵
  PID:4116
- C:\Windows\System\yWLGGYo.exe
  C:\Windows\System\yWLGGYo.exe
  2⤵
  PID:2452
- C:\Windows\System\lyuEpCB.exe
  C:\Windows\System\lyuEpCB.exe
  2⤵
  PID:268
- C:\Windows\System\GbEZfti.exe
  C:\Windows\System\GbEZfti.exe
  2⤵
  PID:4216
- C:\Windows\System\TtxTzjS.exe
  C:\Windows\System\TtxTzjS.exe
  2⤵
  PID:4452
- C:\Windows\System\EEAkCFZ.exe
  C:\Windows\System\EEAkCFZ.exe
  2⤵
  PID:4424
- C:\Windows\System\wrCNvFj.exe
  C:\Windows\System\wrCNvFj.exe
  2⤵
  PID:1776
- C:\Windows\System\JGpoyxx.exe
  C:\Windows\System\JGpoyxx.exe
  2⤵
  PID:2384
- C:\Windows\System\cfkdmXG.exe
  C:\Windows\System\cfkdmXG.exe
  2⤵
  PID:4476
- C:\Windows\System\FeVHway.exe
  C:\Windows\System\FeVHway.exe
  2⤵
  PID:4688
- C:\Windows\System\UWptAyw.exe
  C:\Windows\System\UWptAyw.exe
  2⤵
  PID:4724
- C:\Windows\System\AHFwaOe.exe
  C:\Windows\System\AHFwaOe.exe
  2⤵
  PID:4624
- C:\Windows\System\NFNqdOn.exe
  C:\Windows\System\NFNqdOn.exe
  2⤵
  PID:4864
- C:\Windows\System\rKpGFpY.exe
  C:\Windows\System\rKpGFpY.exe
  2⤵
  PID:4796
- C:\Windows\System\rVKYAnA.exe
  C:\Windows\System\rVKYAnA.exe
  2⤵
  PID:4876
- C:\Windows\System\jlmqrvw.exe
  C:\Windows\System\jlmqrvw.exe
  2⤵
  PID:4836
- C:\Windows\System\WEumeEi.exe
  C:\Windows\System\WEumeEi.exe
  2⤵
  PID:1552
- C:\Windows\System\bUwAYHI.exe
  C:\Windows\System\bUwAYHI.exe
  2⤵
  PID:4588
- C:\Windows\System\jhADIyp.exe
  C:\Windows\System\jhADIyp.exe
  2⤵
  PID:2256
- C:\Windows\System\BPjduyF.exe
  C:\Windows\System\BPjduyF.exe
  2⤵
  PID:4856
- C:\Windows\System\javRpPE.exe
  C:\Windows\System\javRpPE.exe
  2⤵
  PID:2960
- C:\Windows\System\vdHivNj.exe
  C:\Windows\System\vdHivNj.exe
  2⤵
  PID:4932
- C:\Windows\System\QapslIG.exe
  C:\Windows\System\QapslIG.exe
  2⤵
  PID:2740
- C:\Windows\System\sEMUJdU.exe
  C:\Windows\System\sEMUJdU.exe
  2⤵
  PID:4976
- C:\Windows\System\GZwMYjW.exe
  C:\Windows\System\GZwMYjW.exe
  2⤵
  PID:5020
- C:\Windows\System\QYmKflJ.exe
  C:\Windows\System\QYmKflJ.exe
  2⤵
  PID:5032
- C:\Windows\System\HSmNxAI.exe
  C:\Windows\System\HSmNxAI.exe
  2⤵
  PID:2020
- C:\Windows\System\bFadtJU.exe
  C:\Windows\System\bFadtJU.exe
  2⤵
  PID:4284
- C:\Windows\System\BTFGTGk.exe
  C:\Windows\System\BTFGTGk.exe
  2⤵
  PID:4188
- C:\Windows\System\EIfEHOI.exe
  C:\Windows\System\EIfEHOI.exe
  2⤵
  PID:1952
- C:\Windows\System\ocETAXj.exe
  C:\Windows\System\ocETAXj.exe
  2⤵
  PID:1760
- C:\Windows\System\AlFfarF.exe
  C:\Windows\System\AlFfarF.exe
  2⤵
  PID:4584
- C:\Windows\System\NWIcSWC.exe
  C:\Windows\System\NWIcSWC.exe
  2⤵
  PID:4516
- C:\Windows\System\LhZUDDf.exe
  C:\Windows\System\LhZUDDf.exe
  2⤵
  PID:1516
- C:\Windows\System\XqeouQG.exe
  C:\Windows\System\XqeouQG.exe
  2⤵
  PID:4540
- C:\Windows\System\xFmgJDh.exe
  C:\Windows\System\xFmgJDh.exe
  2⤵
  PID:4792
- C:\Windows\System\sCSjJCy.exe
  C:\Windows\System\sCSjJCy.exe
  2⤵
  PID:4660
- C:\Windows\System\owNRbjF.exe
  C:\Windows\System\owNRbjF.exe
  2⤵
  PID:4908
- C:\Windows\System\PMgzMYt.exe
  C:\Windows\System\PMgzMYt.exe
  2⤵
  PID:4992
- C:\Windows\System\cVrhHFB.exe
  C:\Windows\System\cVrhHFB.exe
  2⤵
  PID:3896
- C:\Windows\System\SdfkffD.exe
  C:\Windows\System\SdfkffD.exe
  2⤵
  PID:5108
- C:\Windows\System\aiqRZVM.exe
  C:\Windows\System\aiqRZVM.exe
  2⤵
  PID:5012
- C:\Windows\System\JtfEmNu.exe
  C:\Windows\System\JtfEmNu.exe
  2⤵
  PID:2968
- C:\Windows\System\YwEDXhJ.exe
  C:\Windows\System\YwEDXhJ.exe
  2⤵
  PID:4268
- C:\Windows\System\kMarROO.exe
  C:\Windows\System\kMarROO.exe
  2⤵
  PID:1844
- C:\Windows\System\iCiuORb.exe
  C:\Windows\System\iCiuORb.exe
  2⤵
  PID:4440
- C:\Windows\System\DLvfKvP.exe
  C:\Windows\System\DLvfKvP.exe
  2⤵
  PID:4320
- C:\Windows\System\SLJpgvf.exe
  C:\Windows\System\SLJpgvf.exe
  2⤵
  PID:5136
- C:\Windows\System\ucOQorg.exe
  C:\Windows\System\ucOQorg.exe
  2⤵
  PID:5156
- C:\Windows\System\zZvVjTC.exe
  C:\Windows\System\zZvVjTC.exe
  2⤵
  PID:5172
- C:\Windows\System\SMpxafq.exe
  C:\Windows\System\SMpxafq.exe
  2⤵
  PID:5188
- C:\Windows\System\XwFjDvn.exe
  C:\Windows\System\XwFjDvn.exe
  2⤵
  PID:5204
- C:\Windows\System\IawpTrf.exe
  C:\Windows\System\IawpTrf.exe
  2⤵
  PID:5220
- C:\Windows\System\MidNsRO.exe
  C:\Windows\System\MidNsRO.exe
  2⤵
  PID:5240
- C:\Windows\System\EAPsngK.exe
  C:\Windows\System\EAPsngK.exe
  2⤵
  PID:5256
- C:\Windows\System\PoLnuSr.exe
  C:\Windows\System\PoLnuSr.exe
  2⤵
  PID:5272
- C:\Windows\System\RhBUiJo.exe
  C:\Windows\System\RhBUiJo.exe
  2⤵
  PID:5288
- C:\Windows\System\meqDlVu.exe
  C:\Windows\System\meqDlVu.exe
  2⤵
  PID:5308
- C:\Windows\System\HlJjaWu.exe
  C:\Windows\System\HlJjaWu.exe
  2⤵
  PID:5324
- C:\Windows\System\YpvbWjs.exe
  C:\Windows\System\YpvbWjs.exe
  2⤵
  PID:5340
- C:\Windows\System\ecsiRTT.exe
  C:\Windows\System\ecsiRTT.exe
  2⤵
  PID:5356
- C:\Windows\System\wgnAKxo.exe
  C:\Windows\System\wgnAKxo.exe
  2⤵
  PID:5372
- C:\Windows\System\OlSwTKt.exe
  C:\Windows\System\OlSwTKt.exe
  2⤵
  PID:5388
- C:\Windows\System\bZYRTwS.exe
  C:\Windows\System\bZYRTwS.exe
  2⤵
  PID:5404
- C:\Windows\System\FpmEIQs.exe
  C:\Windows\System\FpmEIQs.exe
  2⤵
  PID:5420
- C:\Windows\System\auLpNmu.exe
  C:\Windows\System\auLpNmu.exe
  2⤵
  PID:5436
- C:\Windows\System\zdniBEk.exe
  C:\Windows\System\zdniBEk.exe
  2⤵
  PID:5452
- C:\Windows\System\cBncPvF.exe
  C:\Windows\System\cBncPvF.exe
  2⤵
  PID:5472
- C:\Windows\System\oMJaPYa.exe
  C:\Windows\System\oMJaPYa.exe
  2⤵
  PID:5488
- C:\Windows\System\zUySetW.exe
  C:\Windows\System\zUySetW.exe
  2⤵
  PID:5504
- C:\Windows\System\BDwvdRB.exe
  C:\Windows\System\BDwvdRB.exe
  2⤵
  PID:5520
- C:\Windows\System\YkulNVK.exe
  C:\Windows\System\YkulNVK.exe
  2⤵
  PID:5536
- C:\Windows\System\AugoNoA.exe
  C:\Windows\System\AugoNoA.exe
  2⤵
  PID:5552
- C:\Windows\System\awnPwtE.exe
  C:\Windows\System\awnPwtE.exe
  2⤵
  PID:5568
- C:\Windows\System\hRILbHz.exe
  C:\Windows\System\hRILbHz.exe
  2⤵
  PID:5588
- C:\Windows\System\YyWKQUt.exe
  C:\Windows\System\YyWKQUt.exe
  2⤵
  PID:5604
- C:\Windows\System\WpSZJXT.exe
  C:\Windows\System\WpSZJXT.exe
  2⤵
  PID:5620
- C:\Windows\System\AnVqwut.exe
  C:\Windows\System\AnVqwut.exe
  2⤵
  PID:5636
- C:\Windows\System\TBUZZKd.exe
  C:\Windows\System\TBUZZKd.exe
  2⤵
  PID:5652
- C:\Windows\System\MuHRhJt.exe
  C:\Windows\System\MuHRhJt.exe
  2⤵
  PID:5668
- C:\Windows\System\RyNOxjF.exe
  C:\Windows\System\RyNOxjF.exe
  2⤵
  PID:5684
- C:\Windows\System\taoTFpT.exe
  C:\Windows\System\taoTFpT.exe
  2⤵
  PID:5700
- C:\Windows\System\PEaIcvO.exe
  C:\Windows\System\PEaIcvO.exe
  2⤵
  PID:5716
- C:\Windows\System\rmgxGfL.exe
  C:\Windows\System\rmgxGfL.exe
  2⤵
  PID:5732
- C:\Windows\System\nYSykhv.exe
  C:\Windows\System\nYSykhv.exe
  2⤵
  PID:5748
- C:\Windows\System\pDLEPyC.exe
  C:\Windows\System\pDLEPyC.exe
  2⤵
  PID:5764
- C:\Windows\System\dvpZjTL.exe
  C:\Windows\System\dvpZjTL.exe
  2⤵
  PID:5780
- C:\Windows\System\iWBcQsF.exe
  C:\Windows\System\iWBcQsF.exe
  2⤵
  PID:5808
- C:\Windows\System\GiHwfVY.exe
  C:\Windows\System\GiHwfVY.exe
  2⤵
  PID:5844
- C:\Windows\System\AJxLOJK.exe
  C:\Windows\System\AJxLOJK.exe
  2⤵
  PID:5860
- C:\Windows\System\HqsXVBL.exe
  C:\Windows\System\HqsXVBL.exe
  2⤵
  PID:5876
- C:\Windows\System\eBoXmrx.exe
  C:\Windows\System\eBoXmrx.exe
  2⤵
  PID:5892
- C:\Windows\System\gecSFba.exe
  C:\Windows\System\gecSFba.exe
  2⤵
  PID:5908
- C:\Windows\System\eMfteHW.exe
  C:\Windows\System\eMfteHW.exe
  2⤵
  PID:5924
- C:\Windows\System\VhGBRxE.exe
  C:\Windows\System\VhGBRxE.exe
  2⤵
  PID:5940
- C:\Windows\System\oglozCh.exe
  C:\Windows\System\oglozCh.exe
  2⤵
  PID:5956
- C:\Windows\System\PtsGgkA.exe
  C:\Windows\System\PtsGgkA.exe
  2⤵
  PID:5972
- C:\Windows\System\FMhSEIi.exe
  C:\Windows\System\FMhSEIi.exe
  2⤵
  PID:5988
- C:\Windows\System\wAomePX.exe
  C:\Windows\System\wAomePX.exe
  2⤵
  PID:6004
- C:\Windows\System\cXQSunV.exe
  C:\Windows\System\cXQSunV.exe
  2⤵
  PID:6024
- C:\Windows\System\NSYvBQx.exe
  C:\Windows\System\NSYvBQx.exe
  2⤵
  PID:6040
- C:\Windows\System\wSOxNbe.exe
  C:\Windows\System\wSOxNbe.exe
  2⤵
  PID:6056
- C:\Windows\System\OOqdgLM.exe
  C:\Windows\System\OOqdgLM.exe
  2⤵
  PID:6072
- C:\Windows\System\klhNIVg.exe
  C:\Windows\System\klhNIVg.exe
  2⤵
  PID:6088
- C:\Windows\System\HGqaYvV.exe
  C:\Windows\System\HGqaYvV.exe
  2⤵
  PID:6104
- C:\Windows\System\bERqNtt.exe
  C:\Windows\System\bERqNtt.exe
  2⤵
  PID:6120
- C:\Windows\System\nxyIHAm.exe
  C:\Windows\System\nxyIHAm.exe
  2⤵
  PID:6140
- C:\Windows\System\IvCygAz.exe
  C:\Windows\System\IvCygAz.exe
  2⤵
  PID:2532
- C:\Windows\System\HastcSq.exe
  C:\Windows\System\HastcSq.exe
  2⤵
  PID:5096
- C:\Windows\System\ievChSu.exe
  C:\Windows\System\ievChSu.exe
  2⤵
  PID:4884
- C:\Windows\System\PrbunAG.exe
  C:\Windows\System\PrbunAG.exe
  2⤵
  PID:4744
- C:\Windows\System\vkdcXzP.exe
  C:\Windows\System\vkdcXzP.exe
  2⤵
  PID:5132
- C:\Windows\System\MqucCbt.exe
  C:\Windows\System\MqucCbt.exe
  2⤵
  PID:5200
- C:\Windows\System\zCsbaJj.exe
  C:\Windows\System\zCsbaJj.exe
  2⤵
  PID:5268
- C:\Windows\System\sHxWtJN.exe
  C:\Windows\System\sHxWtJN.exe
  2⤵
  PID:5380
- C:\Windows\System\qhWdUTt.exe
  C:\Windows\System\qhWdUTt.exe
  2⤵
  PID:5512
- C:\Windows\System\thkDDbh.exe
  C:\Windows\System\thkDDbh.exe
  2⤵
  PID:5484
- C:\Windows\System\jahNSwq.exe
  C:\Windows\System\jahNSwq.exe
  2⤵
  PID:5516
- C:\Windows\System\jrAZIyx.exe
  C:\Windows\System\jrAZIyx.exe
  2⤵
  PID:5584
- C:\Windows\System\HcAKcQN.exe
  C:\Windows\System\HcAKcQN.exe
  2⤵
  PID:4360
- C:\Windows\System\lHjabBS.exe
  C:\Windows\System\lHjabBS.exe
  2⤵
  PID:5152
- C:\Windows\System\tYIVQQK.exe
  C:\Windows\System\tYIVQQK.exe
  2⤵
  PID:5336
- C:\Windows\System\UKWvoep.exe
  C:\Windows\System\UKWvoep.exe
  2⤵
  PID:5216
- C:\Windows\System\NxvlvNs.exe
  C:\Windows\System\NxvlvNs.exe
  2⤵
  PID:5400
- C:\Windows\System\PZTZGUt.exe
  C:\Windows\System\PZTZGUt.exe
  2⤵
  PID:5464
- C:\Windows\System\VLURdAo.exe
  C:\Windows\System\VLURdAo.exe
  2⤵
  PID:5528
- C:\Windows\System\WzTeGGZ.exe
  C:\Windows\System\WzTeGGZ.exe
  2⤵
  PID:5596
- C:\Windows\System\jdSfqRV.exe
  C:\Windows\System\jdSfqRV.exe
  2⤵
  PID:5900
- C:\Windows\System\qETzlng.exe
  C:\Windows\System\qETzlng.exe
  2⤵
  PID:5952
- C:\Windows\System\GzvudSS.exe
  C:\Windows\System\GzvudSS.exe
  2⤵
  PID:6016
- C:\Windows\System\uLOsBkr.exe
  C:\Windows\System\uLOsBkr.exe
  2⤵
  PID:6116
- C:\Windows\System\ERFseFF.exe
  C:\Windows\System\ERFseFF.exe
  2⤵
  PID:5016
- C:\Windows\System\GAuDgoZ.exe
  C:\Windows\System\GAuDgoZ.exe
  2⤵
  PID:5904
- C:\Windows\System\jADsyvv.exe
  C:\Windows\System\jADsyvv.exe
  2⤵
  PID:5968
- C:\Windows\System\OgqwnEV.exe
  C:\Windows\System\OgqwnEV.exe
  2⤵
  PID:6036
- C:\Windows\System\lTspllm.exe
  C:\Windows\System\lTspllm.exe
  2⤵
  PID:6100
- C:\Windows\System\WZHgEie.exe
  C:\Windows\System\WZHgEie.exe
  2⤵
  PID:2692
- C:\Windows\System\ubVloDZ.exe
  C:\Windows\System\ubVloDZ.exe
  2⤵
  PID:4264
- C:\Windows\System\vySJCIL.exe
  C:\Windows\System\vySJCIL.exe
  2⤵
  PID:5412
- C:\Windows\System\eJNhVYM.exe
  C:\Windows\System\eJNhVYM.exe
  2⤵
  PID:5316
- C:\Windows\System\TvATeCJ.exe
  C:\Windows\System\TvATeCJ.exe
  2⤵
  PID:5264
- C:\Windows\System\nDECqnK.exe
  C:\Windows\System\nDECqnK.exe
  2⤵
  PID:5444
- C:\Windows\System\CSmJyYQ.exe
  C:\Windows\System\CSmJyYQ.exe
  2⤵
  PID:5680
- C:\Windows\System\BPWupnk.exe
  C:\Windows\System\BPWupnk.exe
  2⤵
  PID:5744
- C:\Windows\System\GDumPwV.exe
  C:\Windows\System\GDumPwV.exe
  2⤵
  PID:4920
- C:\Windows\System\ntBpLvF.exe
  C:\Windows\System\ntBpLvF.exe
  2⤵
  PID:4620
- C:\Windows\System\BTLFTmv.exe
  C:\Windows\System\BTLFTmv.exe
  2⤵
  PID:5044
- C:\Windows\System\zwsYFuy.exe
  C:\Windows\System\zwsYFuy.exe
  2⤵
  PID:1960
- C:\Windows\System\TQwVQKk.exe
  C:\Windows\System\TQwVQKk.exe
  2⤵
  PID:4572
- C:\Windows\System\ZQTTSsX.exe
  C:\Windows\System\ZQTTSsX.exe
  2⤵
  PID:5212
- C:\Windows\System\CUTwuxf.exe
  C:\Windows\System\CUTwuxf.exe
  2⤵
  PID:5564
- C:\Windows\System\UdhWwuB.exe
  C:\Windows\System\UdhWwuB.exe
  2⤵
  PID:5500
- C:\Windows\System\PakDiPy.exe
  C:\Windows\System\PakDiPy.exe
  2⤵
  PID:5696
- C:\Windows\System\bXeGqBK.exe
  C:\Windows\System\bXeGqBK.exe
  2⤵
  PID:5788
- C:\Windows\System\RNIhMTy.exe
  C:\Windows\System\RNIhMTy.exe
  2⤵
  PID:5800
- C:\Windows\System\mAFlyKH.exe
  C:\Windows\System\mAFlyKH.exe
  2⤵
  PID:5888
- C:\Windows\System\uBLQwgp.exe
  C:\Windows\System\uBLQwgp.exe
  2⤵
  PID:5296
- C:\Windows\System\BGFKSqz.exe
  C:\Windows\System\BGFKSqz.exe
  2⤵
  PID:5832
- C:\Windows\System\ybJssDU.exe
  C:\Windows\System\ybJssDU.exe
  2⤵
  PID:6012
- C:\Windows\System\EBdmSNW.exe
  C:\Windows\System\EBdmSNW.exe
  2⤵
  PID:5948
- C:\Windows\System\mTDZJwh.exe
  C:\Windows\System\mTDZJwh.exe
  2⤵
  PID:6080
- C:\Windows\System\jzFOfVr.exe
  C:\Windows\System\jzFOfVr.exe
  2⤵
  PID:5964
- C:\Windows\System\qSosiPJ.exe
  C:\Windows\System\qSosiPJ.exe
  2⤵
  PID:5384
- C:\Windows\System\VlJbAEN.exe
  C:\Windows\System\VlJbAEN.exe
  2⤵
  PID:5712
- C:\Windows\System\SCHerCj.exe
  C:\Windows\System\SCHerCj.exe
  2⤵
  PID:5164
- C:\Windows\System\xSeOKrj.exe
  C:\Windows\System\xSeOKrj.exe
  2⤵
  PID:5236
- C:\Windows\System\hislimy.exe
  C:\Windows\System\hislimy.exe
  2⤵
  PID:6136
- C:\Windows\System\UDvYIgR.exe
  C:\Windows\System\UDvYIgR.exe
  2⤵
  PID:5816
- C:\Windows\System\FKITdzc.exe
  C:\Windows\System\FKITdzc.exe
  2⤵
  PID:4372
- C:\Windows\System\wzKoutG.exe
  C:\Windows\System\wzKoutG.exe
  2⤵
  PID:5304
- C:\Windows\System\ukHxEAL.exe
  C:\Windows\System\ukHxEAL.exe
  2⤵
  PID:5628
- C:\Windows\System\cFXRWgF.exe
  C:\Windows\System\cFXRWgF.exe
  2⤵
  PID:5280
- C:\Windows\System\JiCOkBW.exe
  C:\Windows\System\JiCOkBW.exe
  2⤵
  PID:5920
- C:\Windows\System\cKvOTlm.exe
  C:\Windows\System\cKvOTlm.exe
  2⤵
  PID:5284
- C:\Windows\System\adgLeAd.exe
  C:\Windows\System\adgLeAd.exe
  2⤵
  PID:4972
- C:\Windows\System\wqSGXth.exe
  C:\Windows\System\wqSGXth.exe
  2⤵
  PID:5368
- C:\Windows\System\vHZMoIH.exe
  C:\Windows\System\vHZMoIH.exe
  2⤵
  PID:5576
- C:\Windows\System\KoZcESm.exe
  C:\Windows\System\KoZcESm.exe
  2⤵
  PID:444
- C:\Windows\System\dNfTkkc.exe
  C:\Windows\System\dNfTkkc.exe
  2⤵
  PID:2912
- C:\Windows\System\WlNzhgE.exe
  C:\Windows\System\WlNzhgE.exe
  2⤵
  PID:5664
- C:\Windows\System\UpWbQqx.exe
  C:\Windows\System\UpWbQqx.exe
  2⤵
  PID:5828
- C:\Windows\System\HAwmfhH.exe
  C:\Windows\System\HAwmfhH.exe
  2⤵
  PID:5776
- C:\Windows\System\SfyjWMe.exe
  C:\Windows\System\SfyjWMe.exe
  2⤵
  PID:5252
- C:\Windows\System\LCFjkWe.exe
  C:\Windows\System\LCFjkWe.exe
  2⤵
  PID:5836
- C:\Windows\System\rRvPcas.exe
  C:\Windows\System\rRvPcas.exe
  2⤵
  PID:4928
- C:\Windows\System\hyfilBR.exe
  C:\Windows\System\hyfilBR.exe
  2⤵
  PID:5632
- C:\Windows\System\yXaTpGo.exe
  C:\Windows\System\yXaTpGo.exe
  2⤵
  PID:6148
- C:\Windows\System\dYRbPJw.exe
  C:\Windows\System\dYRbPJw.exe
  2⤵
  PID:6168
- C:\Windows\System\vLXacce.exe
  C:\Windows\System\vLXacce.exe
  2⤵
  PID:6184
- C:\Windows\System\HZEGcrc.exe
  C:\Windows\System\HZEGcrc.exe
  2⤵
  PID:6200
- C:\Windows\System\HGkvGqk.exe
  C:\Windows\System\HGkvGqk.exe
  2⤵
  PID:6216
- C:\Windows\System\DGFyKCK.exe
  C:\Windows\System\DGFyKCK.exe
  2⤵
  PID:6232
- C:\Windows\System\AGcJCMM.exe
  C:\Windows\System\AGcJCMM.exe
  2⤵
  PID:6248
- C:\Windows\System\RFfxSeh.exe
  C:\Windows\System\RFfxSeh.exe
  2⤵
  PID:6264
- C:\Windows\System\TgkuNIn.exe
  C:\Windows\System\TgkuNIn.exe
  2⤵
  PID:6280
- C:\Windows\System\qcFsast.exe
  C:\Windows\System\qcFsast.exe
  2⤵
  PID:6296
- C:\Windows\System\OFDbXeC.exe
  C:\Windows\System\OFDbXeC.exe
  2⤵
  PID:6312
- C:\Windows\System\RezzhWl.exe
  C:\Windows\System\RezzhWl.exe
  2⤵
  PID:6328
- C:\Windows\System\jrxXoWk.exe
  C:\Windows\System\jrxXoWk.exe
  2⤵
  PID:6344
- C:\Windows\System\rriqnMF.exe
  C:\Windows\System\rriqnMF.exe
  2⤵
  PID:6360
- C:\Windows\System\pyQIHym.exe
  C:\Windows\System\pyQIHym.exe
  2⤵
  PID:6376
- C:\Windows\System\LTQxnsM.exe
  C:\Windows\System\LTQxnsM.exe
  2⤵
  PID:6392
- C:\Windows\System\zCujRbg.exe
  C:\Windows\System\zCujRbg.exe
  2⤵
  PID:6408
- C:\Windows\System\yCXUGVc.exe
  C:\Windows\System\yCXUGVc.exe
  2⤵
  PID:6428
- C:\Windows\System\HNPyJRC.exe
  C:\Windows\System\HNPyJRC.exe
  2⤵
  PID:6444
- C:\Windows\System\UKFuwyM.exe
  C:\Windows\System\UKFuwyM.exe
  2⤵
  PID:6460
- C:\Windows\System\mcJzyyN.exe
  C:\Windows\System\mcJzyyN.exe
  2⤵
  PID:6476
- C:\Windows\System\qphliXS.exe
  C:\Windows\System\qphliXS.exe
  2⤵
  PID:6496
- C:\Windows\System\UcGShNJ.exe
  C:\Windows\System\UcGShNJ.exe
  2⤵
  PID:6512
- C:\Windows\System\cdnsbnt.exe
  C:\Windows\System\cdnsbnt.exe
  2⤵
  PID:6528
- C:\Windows\System\QtmKZuF.exe
  C:\Windows\System\QtmKZuF.exe
  2⤵
  PID:6544
- C:\Windows\System\AybAcap.exe
  C:\Windows\System\AybAcap.exe
  2⤵
  PID:6560
- C:\Windows\System\PtsaLPE.exe
  C:\Windows\System\PtsaLPE.exe
  2⤵
  PID:6576
- C:\Windows\System\isJVZzw.exe
  C:\Windows\System\isJVZzw.exe
  2⤵
  PID:6596
- C:\Windows\System\ualifSa.exe
  C:\Windows\System\ualifSa.exe
  2⤵
  PID:6612
- C:\Windows\System\JOrKPgn.exe
  C:\Windows\System\JOrKPgn.exe
  2⤵
  PID:6628
- C:\Windows\System\SpYvEDY.exe
  C:\Windows\System\SpYvEDY.exe
  2⤵
  PID:6644
- C:\Windows\System\SCrMkQw.exe
  C:\Windows\System\SCrMkQw.exe
  2⤵
  PID:6660
- C:\Windows\System\oPczjyq.exe
  C:\Windows\System\oPczjyq.exe
  2⤵
  PID:6676
- C:\Windows\System\QTZHmuS.exe
  C:\Windows\System\QTZHmuS.exe
  2⤵
  PID:6696
- C:\Windows\System\FqHwGHY.exe
  C:\Windows\System\FqHwGHY.exe
  2⤵
  PID:6712
- C:\Windows\System\OwXzISC.exe
  C:\Windows\System\OwXzISC.exe
  2⤵
  PID:6728
- C:\Windows\System\CTwWZNe.exe
  C:\Windows\System\CTwWZNe.exe
  2⤵
  PID:6744
- C:\Windows\System\bSPjTXT.exe
  C:\Windows\System\bSPjTXT.exe
  2⤵
  PID:6760
- C:\Windows\System\bcZwmBD.exe
  C:\Windows\System\bcZwmBD.exe
  2⤵
  PID:6780
- C:\Windows\System\UgisnUn.exe
  C:\Windows\System\UgisnUn.exe
  2⤵
  PID:6900
- C:\Windows\System\pXkqmEr.exe
  C:\Windows\System\pXkqmEr.exe
  2⤵
  PID:7016
- C:\Windows\System\Xqchcil.exe
  C:\Windows\System\Xqchcil.exe
  2⤵
  PID:7032
- C:\Windows\System\ignLzSc.exe
  C:\Windows\System\ignLzSc.exe
  2⤵
  PID:7048
- C:\Windows\System\YaJWToF.exe
  C:\Windows\System\YaJWToF.exe
  2⤵
  PID:7064
- C:\Windows\System\fvDzJYm.exe
  C:\Windows\System\fvDzJYm.exe
  2⤵
  PID:7080
- C:\Windows\System\jZtogvF.exe
  C:\Windows\System\jZtogvF.exe
  2⤵
  PID:7096
- C:\Windows\System\uNkxGpU.exe
  C:\Windows\System\uNkxGpU.exe
  2⤵
  PID:7112
- C:\Windows\System\ggzWePg.exe
  C:\Windows\System\ggzWePg.exe
  2⤵
  PID:7132
- C:\Windows\System\uODBtOY.exe
  C:\Windows\System\uODBtOY.exe
  2⤵
  PID:7148
- C:\Windows\System\LSewzCn.exe
  C:\Windows\System\LSewzCn.exe
  2⤵
  PID:7164
- C:\Windows\System\kjhkiMw.exe
  C:\Windows\System\kjhkiMw.exe
  2⤵
  PID:6164
- C:\Windows\System\HIKGdci.exe
  C:\Windows\System\HIKGdci.exe
  2⤵
  PID:6224
- C:\Windows\System\BXWKiPZ.exe
  C:\Windows\System\BXWKiPZ.exe
  2⤵
  PID:5916
- C:\Windows\System\glXOera.exe
  C:\Windows\System\glXOera.exe
  2⤵
  PID:5756
- C:\Windows\System\FPeEOLS.exe
  C:\Windows\System\FPeEOLS.exe
  2⤵
  PID:5496
- C:\Windows\System\tCjKaeA.exe
  C:\Windows\System\tCjKaeA.exe
  2⤵
  PID:6208
- C:\Windows\System\zbsMqgF.exe
  C:\Windows\System\zbsMqgF.exe
  2⤵
  PID:6288
- C:\Windows\System\kjzhmOw.exe
  C:\Windows\System\kjzhmOw.exe
  2⤵
  PID:6304
- C:\Windows\System\cKfRoox.exe
  C:\Windows\System\cKfRoox.exe
  2⤵
  PID:6352
- C:\Windows\System\OuJqAPM.exe
  C:\Windows\System\OuJqAPM.exe
  2⤵
  PID:6452
- C:\Windows\System\YcsIxYK.exe
  C:\Windows\System\YcsIxYK.exe
  2⤵
  PID:6492
- C:\Windows\System\edzeBvW.exe
  C:\Windows\System\edzeBvW.exe
  2⤵
  PID:6552
- C:\Windows\System\PqndAsS.exe
  C:\Windows\System\PqndAsS.exe
  2⤵
  PID:6620
- C:\Windows\System\QeCIgxi.exe
  C:\Windows\System\QeCIgxi.exe
  2⤵
  PID:6688
- C:\Windows\System\qThoVMJ.exe
  C:\Windows\System\qThoVMJ.exe
  2⤵
  PID:6340
- C:\Windows\System\lRSRXpd.exe
  C:\Windows\System\lRSRXpd.exe
  2⤵
  PID:6568
- C:\Windows\System\XmbZszC.exe
  C:\Windows\System\XmbZszC.exe
  2⤵
  PID:6336
- C:\Windows\System\qPCnjks.exe
  C:\Windows\System\qPCnjks.exe
  2⤵
  PID:6368
- C:\Windows\System\eutxLkm.exe
  C:\Windows\System\eutxLkm.exe
  2⤵
  PID:6708
- C:\Windows\System\mVZUTep.exe
  C:\Windows\System\mVZUTep.exe
  2⤵
  PID:6540
- C:\Windows\System\PfiQfho.exe
  C:\Windows\System\PfiQfho.exe
  2⤵
  PID:6672
- C:\Windows\System\AMsuVVK.exe
  C:\Windows\System\AMsuVVK.exe
  2⤵
  PID:6772
- C:\Windows\System\BhcUsWk.exe
  C:\Windows\System\BhcUsWk.exe
  2⤵
  PID:6804
- C:\Windows\System\hfEkARO.exe
  C:\Windows\System\hfEkARO.exe
  2⤵
  PID:6816
- C:\Windows\System\rEhZEUq.exe
  C:\Windows\System\rEhZEUq.exe
  2⤵
  PID:6832
- C:\Windows\System\hTlpYCw.exe
  C:\Windows\System\hTlpYCw.exe
  2⤵
  PID:6848
- C:\Windows\System\PSUEKXG.exe
  C:\Windows\System\PSUEKXG.exe
  2⤵
  PID:6860
- C:\Windows\System\EcBejBu.exe
  C:\Windows\System\EcBejBu.exe
  2⤵
  PID:6880
- C:\Windows\System\KSUvZiG.exe
  C:\Windows\System\KSUvZiG.exe
  2⤵
  PID:6888
- C:\Windows\System\TofbjIa.exe
  C:\Windows\System\TofbjIa.exe
  2⤵
  PID:6920
- C:\Windows\System\QadCoPp.exe
  C:\Windows\System\QadCoPp.exe
  2⤵
  PID:6936
- C:\Windows\System\vzDcfDl.exe
  C:\Windows\System\vzDcfDl.exe
  2⤵
  PID:6952
- C:\Windows\System\jYKkGfB.exe
  C:\Windows\System\jYKkGfB.exe
  2⤵
  PID:6968
- C:\Windows\System\ecxihST.exe
  C:\Windows\System\ecxihST.exe
  2⤵
  PID:6980
- C:\Windows\System\IXxIbGt.exe
  C:\Windows\System\IXxIbGt.exe
  2⤵
  PID:7024
- C:\Windows\System\ORlulKe.exe
  C:\Windows\System\ORlulKe.exe
  2⤵
  PID:7088
- C:\Windows\System\IwMODQa.exe
  C:\Windows\System\IwMODQa.exe
  2⤵
  PID:7128
- C:\Windows\System\VPVSZfs.exe
  C:\Windows\System\VPVSZfs.exe
  2⤵
  PID:7008
- C:\Windows\System\FCojfbY.exe
  C:\Windows\System\FCojfbY.exe
  2⤵
  PID:7076
- C:\Windows\System\eyNonWm.exe
  C:\Windows\System\eyNonWm.exe
  2⤵
  PID:7144
- C:\Windows\System\WCghnPb.exe
  C:\Windows\System\WCghnPb.exe
  2⤵
  PID:6096
- C:\Windows\System\tjVgoXV.exe
  C:\Windows\System\tjVgoXV.exe
  2⤵
  PID:1972
- C:\Windows\System\CSDFxGj.exe
  C:\Windows\System\CSDFxGj.exe
  2⤵
  PID:1564
- C:\Windows\System\ablYTcY.exe
  C:\Windows\System\ablYTcY.exe
  2⤵
  PID:6272
- C:\Windows\System\KPHfvAX.exe
  C:\Windows\System\KPHfvAX.exe
  2⤵
  PID:6256
- C:\Windows\System\xGAHkls.exe
  C:\Windows\System\xGAHkls.exe
  2⤵
  PID:6424
- C:\Windows\System\VBlJZDL.exe
  C:\Windows\System\VBlJZDL.exe
  2⤵
  PID:6324
- C:\Windows\System\oYTtOXd.exe
  C:\Windows\System\oYTtOXd.exe
  2⤵
  PID:6484
- C:\Windows\System\HjvqtaZ.exe
  C:\Windows\System\HjvqtaZ.exe
  2⤵
  PID:6488
- C:\Windows\System\MlSNjAg.exe
  C:\Windows\System\MlSNjAg.exe
  2⤵
  PID:6508
- C:\Windows\System\BjgNQhr.exe
  C:\Windows\System\BjgNQhr.exe
  2⤵
  PID:6808
- C:\Windows\System\jRJRWRG.exe
  C:\Windows\System\jRJRWRG.exe
  2⤵
  PID:6872
- C:\Windows\System\NZZLCwy.exe
  C:\Windows\System\NZZLCwy.exe
  2⤵
  PID:6720
- C:\Windows\System\ZlfkhTy.exe
  C:\Windows\System\ZlfkhTy.exe
  2⤵
  PID:6796
- C:\Windows\System\WjxAxuK.exe
  C:\Windows\System\WjxAxuK.exe
  2⤵
  PID:6944
- C:\Windows\System\fGXTZtH.exe
  C:\Windows\System\fGXTZtH.exe
  2⤵
  PID:6928
- C:\Windows\System\nsLJABv.exe
  C:\Windows\System\nsLJABv.exe
  2⤵
  PID:6960
- C:\Windows\System\xtaTILY.exe
  C:\Windows\System\xtaTILY.exe
  2⤵
  PID:7120
- C:\Windows\System\hlPvyhF.exe
  C:\Windows\System\hlPvyhF.exe
  2⤵
  PID:7108
- C:\Windows\System\WRJvbMs.exe
  C:\Windows\System\WRJvbMs.exe
  2⤵
  PID:7072
- C:\Windows\System\PPIXWMA.exe
  C:\Windows\System\PPIXWMA.exe
  2⤵
  PID:7160
- C:\Windows\System\rhVZLla.exe
  C:\Windows\System\rhVZLla.exe
  2⤵
  PID:6260
- C:\Windows\System\MPtNJol.exe
  C:\Windows\System\MPtNJol.exe
  2⤵
  PID:6592
- C:\Windows\System\LysnQMO.exe
  C:\Windows\System\LysnQMO.exe
  2⤵
  PID:6652
- C:\Windows\System\xpdNVZF.exe
  C:\Windows\System\xpdNVZF.exe
  2⤵
  PID:6372
- C:\Windows\System\sSfLuFT.exe
  C:\Windows\System\sSfLuFT.exe
  2⤵
  PID:6908
- C:\Windows\System\ErALQsR.exe
  C:\Windows\System\ErALQsR.exe
  2⤵
  PID:6668
- C:\Windows\System\ANydhgm.exe
  C:\Windows\System\ANydhgm.exe
  2⤵
  PID:6468
- C:\Windows\System\XKukbql.exe
  C:\Windows\System\XKukbql.exe
  2⤵
  PID:6988
- C:\Windows\System\oKarPSQ.exe
  C:\Windows\System\oKarPSQ.exe
  2⤵
  PID:6976
- C:\Windows\System\qYTJoee.exe
  C:\Windows\System\qYTJoee.exe
  2⤵
  PID:6384
- C:\Windows\System\zNwfeCN.exe
  C:\Windows\System\zNwfeCN.exe
  2⤵
  PID:6768
- C:\Windows\System\rRqOIya.exe
  C:\Windows\System\rRqOIya.exe
  2⤵
  PID:6996
- C:\Windows\System\JrJnZBO.exe
  C:\Windows\System\JrJnZBO.exe
  2⤵
  PID:7188
- C:\Windows\System\aWHfTsd.exe
  C:\Windows\System\aWHfTsd.exe
  2⤵
  PID:7204
- C:\Windows\System\VFVnsDE.exe
  C:\Windows\System\VFVnsDE.exe
  2⤵
  PID:7220
- C:\Windows\System\gJJbozG.exe
  C:\Windows\System\gJJbozG.exe
  2⤵
  PID:7244
- C:\Windows\System\qTSJkVO.exe
  C:\Windows\System\qTSJkVO.exe
  2⤵
  PID:7260
- C:\Windows\System\kCyopLt.exe
  C:\Windows\System\kCyopLt.exe
  2⤵
  PID:7276
- C:\Windows\System\ImJDfbe.exe
  C:\Windows\System\ImJDfbe.exe
  2⤵
  PID:7292
- C:\Windows\System\jaHKuZo.exe
  C:\Windows\System\jaHKuZo.exe
  2⤵
  PID:7308
- C:\Windows\System\wDPcBii.exe
  C:\Windows\System\wDPcBii.exe
  2⤵
  PID:7328
- C:\Windows\System\aPQeaaa.exe
  C:\Windows\System\aPQeaaa.exe
  2⤵
  PID:7344
- C:\Windows\System\dspgmAI.exe
  C:\Windows\System\dspgmAI.exe
  2⤵
  PID:7360
- C:\Windows\System\ATsgDYG.exe
  C:\Windows\System\ATsgDYG.exe
  2⤵
  PID:7380
- C:\Windows\System\nYmhiYH.exe
  C:\Windows\System\nYmhiYH.exe
  2⤵
  PID:7400
- C:\Windows\System\RkfSXlp.exe
  C:\Windows\System\RkfSXlp.exe
  2⤵
  PID:7416
- C:\Windows\System\aJtoOyU.exe
  C:\Windows\System\aJtoOyU.exe
  2⤵
  PID:7436
- C:\Windows\System\eLMMWVg.exe
  C:\Windows\System\eLMMWVg.exe
  2⤵
  PID:7452
- C:\Windows\System\SQBoKzn.exe
  C:\Windows\System\SQBoKzn.exe
  2⤵
  PID:7468
- C:\Windows\System\SGUgGQS.exe
  C:\Windows\System\SGUgGQS.exe
  2⤵
  PID:7488
- C:\Windows\System\lrxAkmC.exe
  C:\Windows\System\lrxAkmC.exe
  2⤵
  PID:7504
- C:\Windows\System\VqLjrga.exe
  C:\Windows\System\VqLjrga.exe
  2⤵
  PID:7520
- C:\Windows\System\CWkrFHP.exe
  C:\Windows\System\CWkrFHP.exe
  2⤵
  PID:7536
- C:\Windows\System\ToXEqBX.exe
  C:\Windows\System\ToXEqBX.exe
  2⤵
  PID:7552
- C:\Windows\System\eTqzAWn.exe
  C:\Windows\System\eTqzAWn.exe
  2⤵
  PID:7572
- C:\Windows\System\bFWgcxD.exe
  C:\Windows\System\bFWgcxD.exe
  2⤵
  PID:7588
- C:\Windows\System\OBkPuHq.exe
  C:\Windows\System\OBkPuHq.exe
  2⤵
  PID:7604
- C:\Windows\System\DsquZOs.exe
  C:\Windows\System\DsquZOs.exe
  2⤵
  PID:7624
- C:\Windows\System\mSVGCRR.exe
  C:\Windows\System\mSVGCRR.exe
  2⤵
  PID:7644
- C:\Windows\System\qCZmQwf.exe
  C:\Windows\System\qCZmQwf.exe
  2⤵
  PID:7660
- C:\Windows\System\ixAdcem.exe
  C:\Windows\System\ixAdcem.exe
  2⤵
  PID:7680
- C:\Windows\System\jTZQddb.exe
  C:\Windows\System\jTZQddb.exe
  2⤵
  PID:7696
- C:\Windows\System\jhtkNYK.exe
  C:\Windows\System\jhtkNYK.exe
  2⤵
  PID:7716
- C:\Windows\System\RVBDoJk.exe
  C:\Windows\System\RVBDoJk.exe
  2⤵
  PID:7984
- C:\Windows\System\CJBnjtX.exe
  C:\Windows\System\CJBnjtX.exe
  2⤵
  PID:8000
- C:\Windows\System\iDSTlRL.exe
  C:\Windows\System\iDSTlRL.exe
  2⤵
  PID:8028
- C:\Windows\System\vmsQEEn.exe
  C:\Windows\System\vmsQEEn.exe
  2⤵
  PID:8044
- C:\Windows\System\gZQmZaT.exe
  C:\Windows\System\gZQmZaT.exe
  2⤵
  PID:8060
- C:\Windows\System\bIPBtLU.exe
  C:\Windows\System\bIPBtLU.exe
  2⤵
  PID:8076
- C:\Windows\System\HxOYfAk.exe
  C:\Windows\System\HxOYfAk.exe
  2⤵
  PID:8096
- C:\Windows\System\NtQYOdI.exe
  C:\Windows\System\NtQYOdI.exe
  2⤵
  PID:8116
- C:\Windows\System\keQuZAR.exe
  C:\Windows\System\keQuZAR.exe
  2⤵
  PID:8132
- C:\Windows\System\MdpmNik.exe
  C:\Windows\System\MdpmNik.exe
  2⤵
  PID:8152
- C:\Windows\System\VVwvYQH.exe
  C:\Windows\System\VVwvYQH.exe
  2⤵
  PID:8180
- C:\Windows\System\ZZbOGRj.exe
  C:\Windows\System\ZZbOGRj.exe
  2⤵
  PID:6948
- C:\Windows\System\ZoMamLC.exe
  C:\Windows\System\ZoMamLC.exe
  2⤵
  PID:7180
- C:\Windows\System\akhuZok.exe
  C:\Windows\System\akhuZok.exe
  2⤵
  PID:7216
- C:\Windows\System\NeaCXFF.exe
  C:\Windows\System\NeaCXFF.exe
  2⤵
  PID:5184
- C:\Windows\System\hCvhdNt.exe
  C:\Windows\System\hCvhdNt.exe
  2⤵
  PID:6388
- C:\Windows\System\ekkCLMN.exe
  C:\Windows\System\ekkCLMN.exe
  2⤵
  PID:6844
- C:\Windows\System\vcSgIzD.exe
  C:\Windows\System\vcSgIzD.exe
  2⤵
  PID:7196
- C:\Windows\System\qcsitRH.exe
  C:\Windows\System\qcsitRH.exe
  2⤵
  PID:7236
- C:\Windows\System\MeNIbUZ.exe
  C:\Windows\System\MeNIbUZ.exe
  2⤵
  PID:7272
- C:\Windows\System\DQSlCxF.exe
  C:\Windows\System\DQSlCxF.exe
  2⤵
  PID:7336
- C:\Windows\System\XQrytmK.exe
  C:\Windows\System\XQrytmK.exe
  2⤵
  PID:7352
- C:\Windows\System\czSatYI.exe
  C:\Windows\System\czSatYI.exe
  2⤵
  PID:7476
- C:\Windows\System\xdUDMMK.exe
  C:\Windows\System\xdUDMMK.exe
  2⤵
  PID:7464
- C:\Windows\System\fkFIWeM.exe
  C:\Windows\System\fkFIWeM.exe
  2⤵
  PID:7512
- C:\Windows\System\PvPLTmV.exe
  C:\Windows\System\PvPLTmV.exe
  2⤵
  PID:7528
- C:\Windows\System\iMHTDej.exe
  C:\Windows\System\iMHTDej.exe
  2⤵
  PID:7568
- C:\Windows\System\QaQpzUs.exe
  C:\Windows\System\QaQpzUs.exe
  2⤵
  PID:7580
- C:\Windows\System\UQcowPg.exe
  C:\Windows\System\UQcowPg.exe
  2⤵
  PID:7584
- C:\Windows\System\vYduJQb.exe
  C:\Windows\System\vYduJQb.exe
  2⤵
  PID:7692
- C:\Windows\System\YfWnWYw.exe
  C:\Windows\System\YfWnWYw.exe
  2⤵
  PID:7636
- C:\Windows\System\duIJyOO.exe
  C:\Windows\System\duIJyOO.exe
  2⤵
  PID:7672
- C:\Windows\System\hwRQXyH.exe
  C:\Windows\System\hwRQXyH.exe
  2⤵
  PID:6416
- C:\Windows\System\XLYLBNB.exe
  C:\Windows\System\XLYLBNB.exe
  2⤵
  PID:7904
- C:\Windows\System\rFaPKSW.exe
  C:\Windows\System\rFaPKSW.exe
  2⤵
  PID:7864
- C:\Windows\System\feIbknt.exe
  C:\Windows\System\feIbknt.exe
  2⤵
  PID:7944
- C:\Windows\System\DwxhoUy.exe
  C:\Windows\System\DwxhoUy.exe
  2⤵
  PID:7760
- C:\Windows\System\kpaMWnR.exe
  C:\Windows\System\kpaMWnR.exe
  2⤵
  PID:7776
- C:\Windows\System\jQlBhrf.exe
  C:\Windows\System\jQlBhrf.exe
  2⤵
  PID:7804
- C:\Windows\System\wfjCWKQ.exe
  C:\Windows\System\wfjCWKQ.exe
  2⤵
  PID:7820
- C:\Windows\System\uMdWhDV.exe
  C:\Windows\System\uMdWhDV.exe
  2⤵
  PID:7836
- C:\Windows\System\XbHuvQQ.exe
  C:\Windows\System\XbHuvQQ.exe
  2⤵
  PID:7852
- C:\Windows\System\xBSpLPx.exe
  C:\Windows\System\xBSpLPx.exe
  2⤵
  PID:7872
- C:\Windows\System\IZCJryc.exe
  C:\Windows\System\IZCJryc.exe
  2⤵
  PID:7892
- C:\Windows\System\TyIbjYU.exe
  C:\Windows\System\TyIbjYU.exe
  2⤵
  PID:7948
- C:\Windows\System\BaUPpdh.exe
  C:\Windows\System\BaUPpdh.exe
  2⤵
  PID:7968
- C:\Windows\System\fndkmsH.exe
  C:\Windows\System\fndkmsH.exe
  2⤵
  PID:7896
- C:\Windows\System\JxpkkVe.exe
  C:\Windows\System\JxpkkVe.exe
  2⤵
  PID:8036
- C:\Windows\System\uMrGexd.exe
  C:\Windows\System\uMrGexd.exe
  2⤵
  PID:8104
- C:\Windows\System\xgsPQtC.exe
  C:\Windows\System\xgsPQtC.exe
  2⤵
  PID:8144
- C:\Windows\System\igdNrjR.exe
  C:\Windows\System\igdNrjR.exe
  2⤵
  PID:7000
- C:\Windows\System\BChQzuZ.exe
  C:\Windows\System\BChQzuZ.exe
  2⤵
  PID:6852
- C:\Windows\System\dJErtjk.exe
  C:\Windows\System\dJErtjk.exe
  2⤵
  PID:7268
- C:\Windows\System\xpoxoli.exe
  C:\Windows\System\xpoxoli.exe
  2⤵
  PID:7320
- C:\Windows\System\IOHnUbK.exe
  C:\Windows\System\IOHnUbK.exe
  2⤵
  PID:8168
- C:\Windows\System\HmQesyN.exe
  C:\Windows\System\HmQesyN.exe
  2⤵
  PID:7300
- C:\Windows\System\aXuGDRA.exe
  C:\Windows\System\aXuGDRA.exe
  2⤵
  PID:8012
- C:\Windows\System\nWlvztv.exe
  C:\Windows\System\nWlvztv.exe
  2⤵
  PID:8052
- C:\Windows\System\tZbuqYC.exe
  C:\Windows\System\tZbuqYC.exe
  2⤵
  PID:8092
- C:\Windows\System\CjaLgqC.exe
  C:\Windows\System\CjaLgqC.exe
  2⤵
  PID:8172
- C:\Windows\System\VYxmNWJ.exe
  C:\Windows\System\VYxmNWJ.exe
  2⤵
  PID:6992
- C:\Windows\System\KxYrxYD.exe
  C:\Windows\System\KxYrxYD.exe
  2⤵
  PID:7324
- C:\Windows\System\TmVNDUX.exe
  C:\Windows\System\TmVNDUX.exe
  2⤵
  PID:7412
- C:\Windows\System\pgAgvLY.exe
  C:\Windows\System\pgAgvLY.exe
  2⤵
  PID:7496
- C:\Windows\System\slSGEvc.exe
  C:\Windows\System\slSGEvc.exe
  2⤵
  PID:7548
- C:\Windows\System\QDiJtHu.exe
  C:\Windows\System\QDiJtHu.exe
  2⤵
  PID:7632
- C:\Windows\System\JRarvfe.exe
  C:\Windows\System\JRarvfe.exe
  2⤵
  PID:7688
- C:\Windows\System\jqfOYrp.exe
  C:\Windows\System\jqfOYrp.exe
  2⤵
  PID:7656
- C:\Windows\System\IhYSelz.exe
  C:\Windows\System\IhYSelz.exe
  2⤵
  PID:7900
- C:\Windows\System\hilJYXm.exe
  C:\Windows\System\hilJYXm.exe
  2⤵
  PID:7772
- C:\Windows\System\fpxyhje.exe
  C:\Windows\System\fpxyhje.exe
  2⤵
  PID:7848
- C:\Windows\System\gEnqpFk.exe
  C:\Windows\System\gEnqpFk.exe
  2⤵
  PID:7796
- C:\Windows\System\piKZrBn.exe
  C:\Windows\System\piKZrBn.exe
  2⤵
  PID:7964
- C:\Windows\System\yMWIzxw.exe
  C:\Windows\System\yMWIzxw.exe
  2⤵
  PID:7912
- C:\Windows\System\TkqHRSJ.exe
  C:\Windows\System\TkqHRSJ.exe
  2⤵
  PID:7832
- C:\Windows\System\UGalboP.exe
  C:\Windows\System\UGalboP.exe
  2⤵
  PID:7996
- C:\Windows\System\fvJNiTu.exe
  C:\Windows\System\fvJNiTu.exe
  2⤵
  PID:8068
- C:\Windows\System\WssLqlc.exe
  C:\Windows\System\WssLqlc.exe
  2⤵
  PID:7288
- C:\Windows\System\aQhweWl.exe
  C:\Windows\System\aQhweWl.exe
  2⤵
  PID:7004
- C:\Windows\System\JArEdqv.exe
  C:\Windows\System\JArEdqv.exe
  2⤵
  PID:6892
- C:\Windows\System\ixtloOV.exe
  C:\Windows\System\ixtloOV.exe
  2⤵
  PID:8024
- C:\Windows\System\WVoxkor.exe
  C:\Windows\System\WVoxkor.exe
  2⤵
  PID:8084
- C:\Windows\System\AUNaZsL.exe
  C:\Windows\System\AUNaZsL.exe
  2⤵
  PID:7240
- C:\Windows\System\rQlrEAZ.exe
  C:\Windows\System\rQlrEAZ.exe
  2⤵
  PID:7372
- C:\Windows\System\YQerRyi.exe
  C:\Windows\System\YQerRyi.exe
  2⤵
  PID:7940
- C:\Windows\System\dImJVec.exe
  C:\Windows\System\dImJVec.exe
  2⤵
  PID:7732
- C:\Windows\System\heKChNj.exe
  C:\Windows\System\heKChNj.exe
  2⤵
  PID:7768
- C:\Windows\System\AEXeooT.exe
  C:\Windows\System\AEXeooT.exe
  2⤵
  PID:7884
- C:\Windows\System\kQqhgmC.exe
  C:\Windows\System\kQqhgmC.exe
  2⤵
  PID:7956
- C:\Windows\System\fjmQfBD.exe
  C:\Windows\System\fjmQfBD.exe
  2⤵
  PID:7736
- C:\Windows\System\ACWwMSY.exe
  C:\Windows\System\ACWwMSY.exe
  2⤵
  PID:6180
- C:\Windows\System\LpYIWjd.exe
  C:\Windows\System\LpYIWjd.exe
  2⤵
  PID:6856
- C:\Windows\System\SGBgFhN.exe
  C:\Windows\System\SGBgFhN.exe
  2⤵
  PID:7368
- C:\Windows\System\xitjcqV.exe
  C:\Windows\System\xitjcqV.exe
  2⤵
  PID:7620
- C:\Windows\System\GGSkPsq.exe
  C:\Windows\System\GGSkPsq.exe
  2⤵
  PID:7960
- C:\Windows\System\fSyLiIk.exe
  C:\Windows\System\fSyLiIk.exe
  2⤵
  PID:7408
- C:\Windows\System\AZJpPJa.exe
  C:\Windows\System\AZJpPJa.exe
  2⤵
  PID:8200
- C:\Windows\System\ielQtzc.exe
  C:\Windows\System\ielQtzc.exe
  2⤵
  PID:8216
- C:\Windows\System\oGqmmwm.exe
  C:\Windows\System\oGqmmwm.exe
  2⤵
  PID:8232
- C:\Windows\System\JgkQuho.exe
  C:\Windows\System\JgkQuho.exe
  2⤵
  PID:8252
- C:\Windows\System\LTkzXpv.exe
  C:\Windows\System\LTkzXpv.exe
  2⤵
  PID:8268
- C:\Windows\System\KYINGti.exe
  C:\Windows\System\KYINGti.exe
  2⤵
  PID:8284
- C:\Windows\System\MBnZRAx.exe
  C:\Windows\System\MBnZRAx.exe
  2⤵
  PID:8300
- C:\Windows\System\qqggtyG.exe
  C:\Windows\System\qqggtyG.exe
  2⤵
  PID:8316
- C:\Windows\System\haLfeHp.exe
  C:\Windows\System\haLfeHp.exe
  2⤵
  PID:8332
- C:\Windows\System\vSJoAoS.exe
  C:\Windows\System\vSJoAoS.exe
  2⤵
  PID:8348
- C:\Windows\System\QBOSOTi.exe
  C:\Windows\System\QBOSOTi.exe
  2⤵
  PID:8364
- C:\Windows\System\CaUpWzY.exe
  C:\Windows\System\CaUpWzY.exe
  2⤵
  PID:8380
- C:\Windows\System\YwHOvNK.exe
  C:\Windows\System\YwHOvNK.exe
  2⤵
  PID:8396
- C:\Windows\System\vUzOJZf.exe
  C:\Windows\System\vUzOJZf.exe
  2⤵
  PID:8412
- C:\Windows\System\OBlbItl.exe
  C:\Windows\System\OBlbItl.exe
  2⤵
  PID:8428
- C:\Windows\System\xFEoGtZ.exe
  C:\Windows\System\xFEoGtZ.exe
  2⤵
  PID:8444
- C:\Windows\System\JGbGTNV.exe
  C:\Windows\System\JGbGTNV.exe
  2⤵
  PID:8460
- C:\Windows\System\GDWJiJz.exe
  C:\Windows\System\GDWJiJz.exe
  2⤵
  PID:8476
- C:\Windows\System\dbqBWSX.exe
  C:\Windows\System\dbqBWSX.exe
  2⤵
  PID:8492
- C:\Windows\System\pHqKXla.exe
  C:\Windows\System\pHqKXla.exe
  2⤵
  PID:8508
- C:\Windows\System\nXQHKTl.exe
  C:\Windows\System\nXQHKTl.exe
  2⤵
  PID:8524
- C:\Windows\System\UpCyJfE.exe
  C:\Windows\System\UpCyJfE.exe
  2⤵
  PID:8540
- C:\Windows\System\yjmhxGN.exe
  C:\Windows\System\yjmhxGN.exe
  2⤵
  PID:8556
- C:\Windows\System\VUECIfn.exe
  C:\Windows\System\VUECIfn.exe
  2⤵
  PID:8572
- C:\Windows\System\xdwyxkL.exe
  C:\Windows\System\xdwyxkL.exe
  2⤵
  PID:8588
- C:\Windows\System\CZdIIhf.exe
  C:\Windows\System\CZdIIhf.exe
  2⤵
  PID:8604
- C:\Windows\System\GosRQqW.exe
  C:\Windows\System\GosRQqW.exe
  2⤵
  PID:8620
- C:\Windows\System\BOYjcnL.exe
  C:\Windows\System\BOYjcnL.exe
  2⤵
  PID:8636
- C:\Windows\System\qdgKNoU.exe
  C:\Windows\System\qdgKNoU.exe
  2⤵
  PID:8652
- C:\Windows\System\OucPvxG.exe
  C:\Windows\System\OucPvxG.exe
  2⤵
  PID:8668
- C:\Windows\System\hNTDYcI.exe
  C:\Windows\System\hNTDYcI.exe
  2⤵
  PID:8684
- C:\Windows\System\kqJNUDy.exe
  C:\Windows\System\kqJNUDy.exe
  2⤵
  PID:8700
- C:\Windows\System\yTQowQa.exe
  C:\Windows\System\yTQowQa.exe
  2⤵
  PID:8716
- C:\Windows\System\wcLEWvC.exe
  C:\Windows\System\wcLEWvC.exe
  2⤵
  PID:8732
- C:\Windows\System\QUPJPZT.exe
  C:\Windows\System\QUPJPZT.exe
  2⤵
  PID:8748
- C:\Windows\System\TCbvphW.exe
  C:\Windows\System\TCbvphW.exe
  2⤵
  PID:8764
- C:\Windows\System\JNGvbtc.exe
  C:\Windows\System\JNGvbtc.exe
  2⤵
  PID:8780
- C:\Windows\System\zWFfQCK.exe
  C:\Windows\System\zWFfQCK.exe
  2⤵
  PID:8796
- C:\Windows\System\drqlKao.exe
  C:\Windows\System\drqlKao.exe
  2⤵
  PID:8812
- C:\Windows\System\BvxFTZx.exe
  C:\Windows\System\BvxFTZx.exe
  2⤵
  PID:8828
- C:\Windows\System\ujYRjVQ.exe
  C:\Windows\System\ujYRjVQ.exe
  2⤵
  PID:8844
- C:\Windows\System\abpyYyJ.exe
  C:\Windows\System\abpyYyJ.exe
  2⤵
  PID:8860
- C:\Windows\System\OMXVhgh.exe
  C:\Windows\System\OMXVhgh.exe
  2⤵
  PID:8876
- C:\Windows\System\KcGqzDa.exe
  C:\Windows\System\KcGqzDa.exe
  2⤵
  PID:8896
- C:\Windows\System\uJFBtBH.exe
  C:\Windows\System\uJFBtBH.exe
  2⤵
  PID:8912
- C:\Windows\System\eVjVhJa.exe
  C:\Windows\System\eVjVhJa.exe
  2⤵
  PID:8928
- C:\Windows\System\UJyvsPe.exe
  C:\Windows\System\UJyvsPe.exe
  2⤵
  PID:8944
- C:\Windows\System\qBpSwtS.exe
  C:\Windows\System\qBpSwtS.exe
  2⤵
  PID:8960
- C:\Windows\System\dQkWWyg.exe
  C:\Windows\System\dQkWWyg.exe
  2⤵
  PID:8976
- C:\Windows\System\sVKuzFQ.exe
  C:\Windows\System\sVKuzFQ.exe
  2⤵
  PID:8992
- C:\Windows\System\wpSlCeO.exe
  C:\Windows\System\wpSlCeO.exe
  2⤵
  PID:9012
- C:\Windows\System\ozCkYvX.exe
  C:\Windows\System\ozCkYvX.exe
  2⤵
  PID:9028
- C:\Windows\System\zAphgYI.exe
  C:\Windows\System\zAphgYI.exe
  2⤵
  PID:9044
- C:\Windows\System\UFOHTlq.exe
  C:\Windows\System\UFOHTlq.exe
  2⤵
  PID:9060
- C:\Windows\System\tEITITG.exe
  C:\Windows\System\tEITITG.exe
  2⤵
  PID:9076
- C:\Windows\System\hutiPyA.exe
  C:\Windows\System\hutiPyA.exe
  2⤵
  PID:9092
- C:\Windows\System\xKnQFdf.exe
  C:\Windows\System\xKnQFdf.exe
  2⤵
  PID:9108
- C:\Windows\System\JKztwty.exe
  C:\Windows\System\JKztwty.exe
  2⤵
  PID:9124
- C:\Windows\System\hdiwDpX.exe
  C:\Windows\System\hdiwDpX.exe
  2⤵
  PID:9140
- C:\Windows\System\SEcEHOE.exe
  C:\Windows\System\SEcEHOE.exe
  2⤵
  PID:9156
- C:\Windows\System\BCVptje.exe
  C:\Windows\System\BCVptje.exe
  2⤵
  PID:9172
- C:\Windows\System\blhKqDx.exe
  C:\Windows\System\blhKqDx.exe
  2⤵
  PID:9188
- C:\Windows\System\DYySgdl.exe
  C:\Windows\System\DYySgdl.exe
  2⤵
  PID:9204
- C:\Windows\System\wOyqxyO.exe
  C:\Windows\System\wOyqxyO.exe
  2⤵
  PID:6212
- C:\Windows\System\SXljkwk.exe
  C:\Windows\System\SXljkwk.exe
  2⤵
  PID:8196
- C:\Windows\System\PQxdMVM.exe
  C:\Windows\System\PQxdMVM.exe
  2⤵
  PID:7232
- C:\Windows\System\FDnsEJh.exe
  C:\Windows\System\FDnsEJh.exe
  2⤵
  PID:7712
- C:\Windows\System\fEIMSCz.exe
  C:\Windows\System\fEIMSCz.exe
  2⤵
  PID:7212
- C:\Windows\System\FoGlqsc.exe
  C:\Windows\System\FoGlqsc.exe
  2⤵
  PID:7424
- C:\Windows\System\oktQHqS.exe
  C:\Windows\System\oktQHqS.exe
  2⤵
  PID:8264
- C:\Windows\System\qpACkWg.exe
  C:\Windows\System\qpACkWg.exe
  2⤵
  PID:8312
- C:\Windows\System\twjnQXK.exe
  C:\Windows\System\twjnQXK.exe
  2⤵
  PID:8340
- C:\Windows\System\YmxDhXf.exe
  C:\Windows\System\YmxDhXf.exe
  2⤵
  PID:8404
- C:\Windows\System\xTSFVaF.exe
  C:\Windows\System\xTSFVaF.exe
  2⤵
  PID:8436
- C:\Windows\System\adqtuWe.exe
  C:\Windows\System\adqtuWe.exe
  2⤵
  PID:8500
- C:\Windows\System\slygKfa.exe
  C:\Windows\System\slygKfa.exe
  2⤵
  PID:8564
- C:\Windows\System\OSwmezR.exe
  C:\Windows\System\OSwmezR.exe
  2⤵
  PID:8628
- C:\Windows\System\xUXcOZz.exe
  C:\Windows\System\xUXcOZz.exe
  2⤵
  PID:8664
- C:\Windows\System\btYpGwI.exe
  C:\Windows\System\btYpGwI.exe
  2⤵
  PID:8452
- C:\Windows\System\fcBNvuo.exe
  C:\Windows\System\fcBNvuo.exe
  2⤵
  PID:8724
- C:\Windows\System\UxLUqPz.exe
  C:\Windows\System\UxLUqPz.exe
  2⤵
  PID:8728
- C:\Windows\System\EdfVghI.exe
  C:\Windows\System\EdfVghI.exe
  2⤵
  PID:8520
- C:\Windows\System\TvweWoX.exe
  C:\Windows\System\TvweWoX.exe
  2⤵
  PID:8456
- C:\Windows\System\REbqpcl.exe
  C:\Windows\System\REbqpcl.exe
  2⤵
  PID:8648
- C:\Windows\System\uIyTHEI.exe
  C:\Windows\System\uIyTHEI.exe
  2⤵
  PID:8612
- C:\Windows\System\GnAxcsd.exe
  C:\Windows\System\GnAxcsd.exe
  2⤵
  PID:8744
- C:\Windows\System\qzMYOHx.exe
  C:\Windows\System\qzMYOHx.exe
  2⤵
  PID:8820
- C:\Windows\System\NxfqPVn.exe
  C:\Windows\System\NxfqPVn.exe
  2⤵
  PID:8836
- C:\Windows\System\fhREUnZ.exe
  C:\Windows\System\fhREUnZ.exe
  2⤵
  PID:8868
- C:\Windows\System\vAcloZs.exe
  C:\Windows\System\vAcloZs.exe
  2⤵
  PID:8904
- C:\Windows\System\ILHZfHV.exe
  C:\Windows\System\ILHZfHV.exe
  2⤵
  PID:8908
- C:\Windows\System\EumEivF.exe
  C:\Windows\System\EumEivF.exe
  2⤵
  PID:8988
- C:\Windows\System\slRrFjr.exe
  C:\Windows\System\slRrFjr.exe
  2⤵
  PID:9024
- C:\Windows\System\OAVNHGD.exe
  C:\Windows\System\OAVNHGD.exe
  2⤵
  PID:8972
- C:\Windows\System\QunYAKx.exe
  C:\Windows\System\QunYAKx.exe
  2⤵
  PID:9040
- C:\Windows\System\aPtRxVo.exe
  C:\Windows\System\aPtRxVo.exe
  2⤵
  PID:9088
- C:\Windows\System\XZrDXRP.exe
  C:\Windows\System\XZrDXRP.exe
  2⤵
  PID:9120
- C:\Windows\System\OzyjHQa.exe
  C:\Windows\System\OzyjHQa.exe
  2⤵
  PID:9148
- C:\Windows\System\ikIlTJT.exe
  C:\Windows\System\ikIlTJT.exe
  2⤵
  PID:9184
- C:\Windows\System\qssaDuq.exe
  C:\Windows\System\qssaDuq.exe
  2⤵
  PID:9200
- C:\Windows\System\YQTnkaC.exe
  C:\Windows\System\YQTnkaC.exe
  2⤵
  PID:8224
- C:\Windows\System\ATNPuMS.exe
  C:\Windows\System\ATNPuMS.exe
  2⤵
  PID:8140
- C:\Windows\System\QdaovHP.exe
  C:\Windows\System\QdaovHP.exe
  2⤵
  PID:8276
- C:\Windows\System\HZlzqbv.exe
  C:\Windows\System\HZlzqbv.exe
  2⤵
  PID:8296
- C:\Windows\System\XpnoMVL.exe
  C:\Windows\System\XpnoMVL.exe
  2⤵
  PID:8324
- C:\Windows\System\XATbVsv.exe
  C:\Windows\System\XATbVsv.exe
  2⤵
  PID:8468
- C:\Windows\System\kxypWpN.exe
  C:\Windows\System\kxypWpN.exe
  2⤵
  PID:8600
- C:\Windows\System\ssLlcUk.exe
  C:\Windows\System\ssLlcUk.exe
  2⤵
  PID:8516
- C:\Windows\System\TuMcIQs.exe
  C:\Windows\System\TuMcIQs.exe
  2⤵
  PID:8676
- C:\Windows\System\VbzyVwk.exe
  C:\Windows\System\VbzyVwk.exe
  2⤵
  PID:8708
- C:\Windows\System\AxTuVCr.exe
  C:\Windows\System\AxTuVCr.exe
  2⤵
  PID:8804
- C:\Windows\System\kKhlPAK.exe
  C:\Windows\System\kKhlPAK.exe
  2⤵
  PID:8788
- C:\Windows\System\jbWFmqa.exe
  C:\Windows\System\jbWFmqa.exe
  2⤵
  PID:8852
- C:\Windows\System\rRlnHVJ.exe
  C:\Windows\System\rRlnHVJ.exe
  2⤵
  PID:8924
- C:\Windows\System\hblJKnL.exe
  C:\Windows\System\hblJKnL.exe
  2⤵
  PID:9084
- C:\Windows\System\KfUPNIs.exe
  C:\Windows\System\KfUPNIs.exe
  2⤵
  PID:9212
- C:\Windows\System\jDDnnET.exe
  C:\Windows\System\jDDnnET.exe
  2⤵
  PID:9180
- C:\Windows\System\ybqjLDV.exe
  C:\Windows\System\ybqjLDV.exe
  2⤵
  PID:7888
- C:\Windows\System\JShsbiO.exe
  C:\Windows\System\JShsbiO.exe
  2⤵
  PID:7724
- C:\Windows\System\gaVajBp.exe
  C:\Windows\System\gaVajBp.exe
  2⤵
  PID:8260
- C:\Windows\System\tEeNirK.exe
  C:\Windows\System\tEeNirK.exe
  2⤵
  PID:8536
- C:\Windows\System\oAHBASm.exe
  C:\Windows\System\oAHBASm.exe
  2⤵
  PID:8760
- C:\Windows\System\SiyOUgF.exe
  C:\Windows\System\SiyOUgF.exe
  2⤵
  PID:8484
- C:\Windows\System\dhIjZXi.exe
  C:\Windows\System\dhIjZXi.exe
  2⤵
  PID:8920
- C:\Windows\System\rWvNxHb.exe
  C:\Windows\System\rWvNxHb.exe
  2⤵
  PID:8792
- C:\Windows\System\UiafxCI.exe
  C:\Windows\System\UiafxCI.exe
  2⤵
  PID:9008
- C:\Windows\System\ReoDxnQ.exe
  C:\Windows\System\ReoDxnQ.exe
  2⤵
  PID:8660
- C:\Windows\System\eQSkYid.exe
  C:\Windows\System\eQSkYid.exe
  2⤵
  PID:8280
- C:\Windows\System\XxessOQ.exe
  C:\Windows\System\XxessOQ.exe
  2⤵
  PID:8420
- C:\Windows\System\BafnrMw.exe
  C:\Windows\System\BafnrMw.exe
  2⤵
  PID:9236
- C:\Windows\System\FOBzMpm.exe
  C:\Windows\System\FOBzMpm.exe
  2⤵
  PID:9256
- C:\Windows\System\dItRDHH.exe
  C:\Windows\System\dItRDHH.exe
  2⤵
  PID:9272
- C:\Windows\System\xQmnpsa.exe
  C:\Windows\System\xQmnpsa.exe
  2⤵
  PID:9288
- C:\Windows\System\dyUReed.exe
  C:\Windows\System\dyUReed.exe
  2⤵
  PID:9304
- C:\Windows\System\CEIHzqD.exe
  C:\Windows\System\CEIHzqD.exe
  2⤵
  PID:9320
- C:\Windows\System\miZuill.exe
  C:\Windows\System\miZuill.exe
  2⤵
  PID:9336
- C:\Windows\System\CDBxlOQ.exe
  C:\Windows\System\CDBxlOQ.exe
  2⤵
  PID:9352
- C:\Windows\System\tIBnuEB.exe
  C:\Windows\System\tIBnuEB.exe
  2⤵
  PID:9368
- C:\Windows\System\gTLeUsB.exe
  C:\Windows\System\gTLeUsB.exe
  2⤵
  PID:9388
- C:\Windows\System\ZNREgOr.exe
  C:\Windows\System\ZNREgOr.exe
  2⤵
  PID:9404
- C:\Windows\System\hmsxEyJ.exe
  C:\Windows\System\hmsxEyJ.exe
  2⤵
  PID:9420
- C:\Windows\System\GUDLezV.exe
  C:\Windows\System\GUDLezV.exe
  2⤵
  PID:9440
- C:\Windows\System\BZygnDQ.exe
  C:\Windows\System\BZygnDQ.exe
  2⤵
  PID:9456
- C:\Windows\System\OCVRYIY.exe
  C:\Windows\System\OCVRYIY.exe
  2⤵
  PID:9472
- C:\Windows\System\vtwpDsc.exe
  C:\Windows\System\vtwpDsc.exe
  2⤵
  PID:9488
- C:\Windows\System\seKwQXR.exe
  C:\Windows\System\seKwQXR.exe
  2⤵
  PID:9508
- C:\Windows\System\RMLexhW.exe
  C:\Windows\System\RMLexhW.exe
  2⤵
  PID:9524
- C:\Windows\System\EvJYxhg.exe
  C:\Windows\System\EvJYxhg.exe
  2⤵
  PID:9540
- C:\Windows\System\IAPIDSz.exe
  C:\Windows\System\IAPIDSz.exe
  2⤵
  PID:9556
- C:\Windows\System\EVupMjQ.exe
  C:\Windows\System\EVupMjQ.exe
  2⤵
  PID:9572
- C:\Windows\System\bScXTga.exe
  C:\Windows\System\bScXTga.exe
  2⤵
  PID:9588
- C:\Windows\System\aJFKqxP.exe
  C:\Windows\System\aJFKqxP.exe
  2⤵
  PID:9604
- C:\Windows\System\OmEMMMq.exe
  C:\Windows\System\OmEMMMq.exe
  2⤵
  PID:9620
- C:\Windows\System\FWFSzjm.exe
  C:\Windows\System\FWFSzjm.exe
  2⤵
  PID:9636
- C:\Windows\System\sAxQMzS.exe
  C:\Windows\System\sAxQMzS.exe
  2⤵
  PID:9652
- C:\Windows\System\KMZkdqD.exe
  C:\Windows\System\KMZkdqD.exe
  2⤵
  PID:9668
- C:\Windows\System\QBcMpsP.exe
  C:\Windows\System\QBcMpsP.exe
  2⤵
  PID:9684
- C:\Windows\System\RXGWFJH.exe
  C:\Windows\System\RXGWFJH.exe
  2⤵
  PID:9700
- C:\Windows\System\dTOyxYf.exe
  C:\Windows\System\dTOyxYf.exe
  2⤵
  PID:9720
- C:\Windows\System\wfQCGbw.exe
  C:\Windows\System\wfQCGbw.exe
  2⤵
  PID:9736
- C:\Windows\System\NgSxXYX.exe
  C:\Windows\System\NgSxXYX.exe
  2⤵
  PID:9752
- C:\Windows\System\JaczcyL.exe
  C:\Windows\System\JaczcyL.exe
  2⤵
  PID:9768
- C:\Windows\System\gxmoiZd.exe
  C:\Windows\System\gxmoiZd.exe
  2⤵
  PID:9784
- C:\Windows\System\GHpbPag.exe
  C:\Windows\System\GHpbPag.exe
  2⤵
  PID:9800
- C:\Windows\System\kGTbAJI.exe
  C:\Windows\System\kGTbAJI.exe
  2⤵
  PID:9816
- C:\Windows\System\BFuyaaT.exe
  C:\Windows\System\BFuyaaT.exe
  2⤵
  PID:9832
- C:\Windows\System\RCxnnhD.exe
  C:\Windows\System\RCxnnhD.exe
  2⤵
  PID:9848
- C:\Windows\System\jCZeAWl.exe
  C:\Windows\System\jCZeAWl.exe
  2⤵
  PID:9868
- C:\Windows\System\rRDpfji.exe
  C:\Windows\System\rRDpfji.exe
  2⤵
  PID:9884
- C:\Windows\System\ZJYJBSd.exe
  C:\Windows\System\ZJYJBSd.exe
  2⤵
  PID:9900
- C:\Windows\System\yPFkEZb.exe
  C:\Windows\System\yPFkEZb.exe
  2⤵
  PID:9916
- C:\Windows\System\JEYLuhw.exe
  C:\Windows\System\JEYLuhw.exe
  2⤵
  PID:9932
- C:\Windows\System\VSxELTW.exe
  C:\Windows\System\VSxELTW.exe
  2⤵
  PID:9948
- C:\Windows\System\ArAJnGr.exe
  C:\Windows\System\ArAJnGr.exe
  2⤵
  PID:9964
- C:\Windows\System\NdWkiCl.exe
  C:\Windows\System\NdWkiCl.exe
  2⤵
  PID:9980
- C:\Windows\System\YedfiRv.exe
  C:\Windows\System\YedfiRv.exe
  2⤵
  PID:9996
- C:\Windows\System\WkGbwBC.exe
  C:\Windows\System\WkGbwBC.exe
  2⤵
  PID:10012
- C:\Windows\System\nYMoNBP.exe
  C:\Windows\System\nYMoNBP.exe
  2⤵
  PID:10028
- C:\Windows\System\dnrgrkH.exe
  C:\Windows\System\dnrgrkH.exe
  2⤵
  PID:10044
- C:\Windows\System\bUmATVs.exe
  C:\Windows\System\bUmATVs.exe
  2⤵
  PID:10060
- C:\Windows\System\hkftFxL.exe
  C:\Windows\System\hkftFxL.exe
  2⤵
  PID:10076
- C:\Windows\System\Uuzhcoc.exe
  C:\Windows\System\Uuzhcoc.exe
  2⤵
  PID:10092
- C:\Windows\System\HPEVNWb.exe
  C:\Windows\System\HPEVNWb.exe
  2⤵
  PID:10108
- C:\Windows\System\MWEJFpb.exe
  C:\Windows\System\MWEJFpb.exe
  2⤵
  PID:10132
- C:\Windows\System\pMoxKAs.exe
  C:\Windows\System\pMoxKAs.exe
  2⤵
  PID:10148
- C:\Windows\System\lhCevUm.exe
  C:\Windows\System\lhCevUm.exe
  2⤵
  PID:10164
- C:\Windows\System\rbslVBm.exe
  C:\Windows\System\rbslVBm.exe
  2⤵
  PID:10180
- C:\Windows\System\HvZAZob.exe
  C:\Windows\System\HvZAZob.exe
  2⤵
  PID:10196
- C:\Windows\System\RNwOwtB.exe
  C:\Windows\System\RNwOwtB.exe
  2⤵
  PID:10212
- C:\Windows\System\RvYuVBy.exe
  C:\Windows\System\RvYuVBy.exe
  2⤵
  PID:10228
- C:\Windows\System\taEpJCg.exe
  C:\Windows\System\taEpJCg.exe
  2⤵
  PID:8680
- C:\Windows\System\SKkXTXJ.exe
  C:\Windows\System\SKkXTXJ.exe
  2⤵
  PID:9152
- C:\Windows\System\URvPIbL.exe
  C:\Windows\System\URvPIbL.exe
  2⤵
  PID:9220
- C:\Windows\System\ZKgMiVp.exe
  C:\Windows\System\ZKgMiVp.exe
  2⤵
  PID:9264
- C:\Windows\System\VOrsORS.exe
  C:\Windows\System\VOrsORS.exe
  2⤵
  PID:9328
- C:\Windows\System\ZizhyXP.exe
  C:\Windows\System\ZizhyXP.exe
  2⤵
  PID:9364
- C:\Windows\System\KAVyHxI.exe
  C:\Windows\System\KAVyHxI.exe
  2⤵
  PID:9244
- C:\Windows\System\RwXpWpW.exe
  C:\Windows\System\RwXpWpW.exe
  2⤵
  PID:9428
- C:\Windows\System\MPiMNeT.exe
  C:\Windows\System\MPiMNeT.exe
  2⤵
  PID:9280
- C:\Windows\System\tHVtrte.exe
  C:\Windows\System\tHVtrte.exe
  2⤵
  PID:9344
- C:\Windows\System\kcJljsM.exe
  C:\Windows\System\kcJljsM.exe
  2⤵
  PID:9384
- C:\Windows\System\DEMRHrB.exe
  C:\Windows\System\DEMRHrB.exe
  2⤵
  PID:9416
- C:\Windows\System\GhwSrGe.exe
  C:\Windows\System\GhwSrGe.exe
  2⤵
  PID:9496
- C:\Windows\System\fSQGvBW.exe
  C:\Windows\System\fSQGvBW.exe
  2⤵
  PID:9504
- C:\Windows\System\LCjhvbN.exe
  C:\Windows\System\LCjhvbN.exe
  2⤵
  PID:9536
- C:\Windows\System\PaIxHFa.exe
  C:\Windows\System\PaIxHFa.exe
  2⤵
  PID:9600
- C:\Windows\System\GAOLYLY.exe
  C:\Windows\System\GAOLYLY.exe
  2⤵
  PID:9664
- C:\Windows\System\PscCAPx.exe
  C:\Windows\System\PscCAPx.exe
  2⤵
  PID:9732
- C:\Windows\System\djuHBxs.exe
  C:\Windows\System\djuHBxs.exe
  2⤵
  PID:9796
- C:\Windows\System\lukLxuv.exe
  C:\Windows\System\lukLxuv.exe
  2⤵
  PID:9864
- C:\Windows\System\XaOgYtz.exe
  C:\Windows\System\XaOgYtz.exe
  2⤵
  PID:9928
- C:\Windows\System\vLswOpJ.exe
  C:\Windows\System\vLswOpJ.exe
  2⤵
  PID:9644
- C:\Windows\System\CTzEDNj.exe
  C:\Windows\System\CTzEDNj.exe
  2⤵
  PID:10052
- C:\Windows\System\axJAOey.exe
  C:\Windows\System\axJAOey.exe
  2⤵
  PID:9548
- C:\Windows\System\ykbSjrv.exe
  C:\Windows\System\ykbSjrv.exe
  2⤵
  PID:9676
- C:\Windows\System\dRdtFSr.exe
  C:\Windows\System\dRdtFSr.exe
  2⤵
  PID:9584
- C:\Windows\System\PknvjVt.exe
  C:\Windows\System\PknvjVt.exe
  2⤵
  PID:9648
- C:\Windows\System\RDBHThZ.exe
  C:\Windows\System\RDBHThZ.exe
  2⤵
  PID:9712
- C:\Windows\System\dWRBTWy.exe
  C:\Windows\System\dWRBTWy.exe
  2⤵
  PID:9808
- C:\Windows\System\QiJuiIv.exe
  C:\Windows\System\QiJuiIv.exe
  2⤵
  PID:9876
- C:\Windows\System\ibSwsFz.exe
  C:\Windows\System\ibSwsFz.exe
  2⤵
  PID:9908
- C:\Windows\System\YfYowoq.exe
  C:\Windows\System\YfYowoq.exe
  2⤵
  PID:9972
- C:\Windows\System\MPsERIp.exe
  C:\Windows\System\MPsERIp.exe
  2⤵
  PID:10072
- C:\Windows\System\pmZLGXY.exe
  C:\Windows\System\pmZLGXY.exe
  2⤵
  PID:10192
- C:\Windows\System\WhetZCx.exe
  C:\Windows\System\WhetZCx.exe
  2⤵
  PID:10140
- C:\Windows\System\isACJBk.exe
  C:\Windows\System\isACJBk.exe
  2⤵
  PID:10144
- C:\Windows\System\aTYMaEP.exe
  C:\Windows\System\aTYMaEP.exe
  2⤵
  PID:8936
- C:\Windows\System\MUXtBRk.exe
  C:\Windows\System\MUXtBRk.exe
  2⤵
  PID:8984
- C:\Windows\System\WLNQogb.exe
  C:\Windows\System\WLNQogb.exe
  2⤵
  PID:9296
- C:\Windows\System\NMXWTvw.exe
  C:\Windows\System\NMXWTvw.exe
  2⤵
  PID:8212
- C:\Windows\System\niHiDcn.exe
  C:\Windows\System\niHiDcn.exe
  2⤵
  PID:8488
- C:\Windows\System\AzvJBmE.exe
  C:\Windows\System\AzvJBmE.exe
  2⤵
  PID:9568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AxpUIbg.exe

Filesize
2.0MB

MD5
037d72a196e9bd42a449fddc97212c8b

SHA1
43f2b6ddb5852db98bfabacc3b3089afa67552f8

SHA256
19c25aef81796f05fc42c20b281ba7f69d1c3931d3e3645d27eb2d7b8f972170

SHA512
725b9905a0116d3e58ddd0a686cd442529b762aba2445b48e28647dcbca50a3d5fd334ac2413af0c2b3de58f8405a8d1a054b5f060ea5db679af131d5296a86b

Download Submit
C:\Windows\system\BjZrUYg.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\system\ERgYoSw.exe

Filesize
2.0MB

MD5
64b6a6d24479d16278e0fe4d40f88ff1

SHA1
fa1970a453695c6e068989409f601f64e93c7ceb

SHA256
92c7c51ce0254a00fa0ee9ec10432b5158eafbb1f29b159fc00b847641a3e6c4

SHA512
c204865519fd82ea2b7fcd58922f8cdf38032cbd7b0dbd0a0bffa6e1e175445867e7d22cce326956459b6b04afa53b27b6e6638f8bfcc7ba3846e61b623d9d90

Download Submit
C:\Windows\system\HnHgCrR.exe

Filesize
2.0MB

MD5
6c30574cc2d904227cc0c50a5fd4013b

SHA1
757dabdf530070feb73dba31a18297fa33004823

SHA256
1dc3c740bc29fa27e9b43159d1baaf84b09f6677441144a37fd154ca0a97459d

SHA512
46a26c09c9a17f3b7f70f74dd069ab841f30d4e5a94c63fd4b3be68c450254edd0ebabcdb7fe80173d6d8929e98aa658514caab261115fb3248801e3396e6dd9

Download Submit
C:\Windows\system\JbDuQYY.exe

Filesize
2.0MB

MD5
a3bf09e44139766e09f5d4ecddb2ab8a

SHA1
fa5d1b989330f4cbc04eb06caa4d4485c152471d

SHA256
9f34fce5d3118108db6c94af731c39830379608e6e8242cf10207d273d7a35cb

SHA512
3aeb491302610b9914b87a464e892b7a361c34d009a1f8f0e8809927dcfaeb3fe96afdc38bb54c667f785c7cde98b7fb649b3bf412e9c9d0118277609fc90d42

Download Submit
C:\Windows\system\NjKQyTs.exe

Filesize
2.0MB

MD5
8d77d5d99b4fca0705314c60909823af

SHA1
4bc213d3424b23d55a63a1f12dabc15c6386d261

SHA256
79df4a10120c701d21049187df84144bb1884c0da663f9cf7159da76b9035417

SHA512
32d9173d3eb98a0cf9fed66ceee54baef0a88e6767ee9bf18e09c4a42d2af97130a48f91442b267a1902002015b754f0b836802fbb73c4aecfd311fd09810f23

Download Submit
C:\Windows\system\QZEXhVh.exe

Filesize
2.0MB

MD5
d5f686ef63dec23b0a7aa29ad366162e

SHA1
79597fefd38ee7b062444575b9c2bff94d3457ff

SHA256
d263dbcc63b91fab06fae47ee2eacd8666dd81081bed47523e1499b501660321

SHA512
907280798154901369f3030c43f0931b41b891360902b281a29921db7413c12dda8f358c9f9a7cf4ac3716ec4e4774ae6d49a304d711a0f2b09786c0fc973a15

Download Submit
C:\Windows\system\WWBuErP.exe

Filesize
2.0MB

MD5
13b1b9e1887a72c81bc99c31b66dcf69

SHA1
a7444f498f5b4dd5ddb030d88399232fcccb5a9b

SHA256
df2c3b358b8cb2fe69e2463e64f00201e6113fe68723790974b2c4b95a680228

SHA512
a7284a1faefeb88e61a7f2e30150e0761257615e899fd2a0a64640d8e1b222bd10710daa33287904e486d61f1d8edbee2bfa061144d6470a3a7ba425a7407e6a

Download Submit
C:\Windows\system\XEskouP.exe

Filesize
2.0MB

MD5
6c6823dc6f86cfbd40f0e00df727b96b

SHA1
c59da1d08b1336f4eaea817baaacecb45fe8a9be

SHA256
7c0d7a5dad6c1875fcdba7a5ab09366c693c4d9f363d7f1186d8e2d5ef886543

SHA512
6531b97d3f144b01ec9b3b8ed5035c5bdde458ca2487c3c03b4a79f3b6181542c49f02ae7277bf265a0d38f0878dbfd2dbec2a8cbb9022ddf14824f955f2d3ed

Download Submit
C:\Windows\system\YTBixLo.exe

Filesize
2.0MB

MD5
bf15b18597b7af34d335b7c672db34c8

SHA1
68dd5f5e9307c6a2d46143e0ef79524cb71607ad

SHA256
63cf3c853c27d0bea54d5160526ac245091b8d003a0d14feff7a15ac57bca8c7

SHA512
97be5cbf8cb4e486019dadc32096f26efb10e7635662fe9bd51a3441181aec88a460db2c679ff5b5e3a8c2fb987a8785f6311a1045f346a2fc1372d86813025a

Download Submit
C:\Windows\system\YlJCOUx.exe

Filesize
2.0MB

MD5
0b0bb59cbbd3c77d94b345473f3b809c

SHA1
c17f438f42cd5c77bcdc57cecc94b4cc40f23b9e

SHA256
f537f4be7b6e991ee849a513ba92f8487a3350de7f2b10127aec3a93b187af1f

SHA512
5fbc70b15009fccd6e291c67f344c31d94c77e1276a2d89d963be89439c5390b8b91719dd0eceaea42bf60e707efd0e1bb6191e9af1a8f8ff740c847fa5025f1

Download Submit
C:\Windows\system\bNsfspK.exe

Filesize
2.0MB

MD5
b811bbfa7f3f54f7549633cbefbc94b1

SHA1
02d78751aa95d249902494a0c24f831ce275b9d9

SHA256
76de24cb6eaceaad74c443a3489fdc8f455d6c2c16786998637d27ae82f9d87b

SHA512
747924a86476907e650130c35cb37cfb676829199ce39f314df2aea6a43f0cd2d059b867ee9bc726a2cb5e0ea2c1271d04dc0c9d93472ced0a683b0365b75c3b

Download Submit
C:\Windows\system\dQDrfFc.exe

Filesize
2.0MB

MD5
a46c8e38864c015e239427e307c85a35

SHA1
03e9ea906ce4b7759a3c1320d16ec10fb7013253

SHA256
6cce0bbb199cebd873e5f3bdadc567f563b532d3a2cf9dda61c9b049ca149f9c

SHA512
0249bda38417eb342305579fe8c489082736e5cf120b2baa5c06fb78f9c57e9b513f5b236898f03f6abe33d31bfba6e61039b5e5a7f0cb688bae996016a98b4e

Download Submit
C:\Windows\system\fXZaGVo.exe

Filesize
2.0MB

MD5
9e061c4b28b32c8dd3cfec3f707b9e0e

SHA1
631e8559287b3ac58e5411f9d06bb37c4fd24bd2

SHA256
5dcd1bcda68fb8777e530e870296609606071c330d63e36092827331a7b70616

SHA512
44e07c034a6f5d24649048600b036f52d4c22ed612aad3375d7a93783da35d2a53beecbfbad5fe2dc7d534f0d4f7f1403dc85fe2674b8511ca3e0bb0abb44a57

Download Submit
C:\Windows\system\mQdBVKM.exe

Filesize
2.0MB

MD5
cea4a3861e22f7238296402889aa805a

SHA1
e47ec7b7a479aa6da66c2cc80d9767e5f5b21bf1

SHA256
85e1c006b09be40a9673466b406999b2cb64cb17b55d1f33520ebec45c43fce5

SHA512
cc708d566a804d20481995f3cee2ad5a077838b057d55c45af6debfa4f6002d266623b8f26dfab8934a49eb0bf7b96fee3f1b26cb6b17ea67a12f501f383f22e

Download Submit
C:\Windows\system\nWinbsl.exe

Filesize
2.0MB

MD5
ea2ee3b6cb1b2f014ba125d9b866e38b

SHA1
ed6e6307bded20b54b1d2e4694392f405f4d36f3

SHA256
814e6a3be233a6789bf7f254527b8652d1e0f2405e01b4d142be87842f5bdc18

SHA512
85ce4ab1f6d39e06ceb0ce3bac7027a871449f370c7cad4761286628834cd279c7de9d65a52e17aca53220b33eafd5725ecd45f85cd5f91b1fe4e563d1d5bc1c

Download Submit
C:\Windows\system\refBXVF.exe

Filesize
2.0MB

MD5
2ea7626018760032342bf576e37741e7

SHA1
cd466b938885239b97fc0dda923f663546e38559

SHA256
bfd7ff66093e5b918cb9de5774debcd2a15b78a81753419e07e4c571919b1922

SHA512
ec28677fff0da508d7cbe59ef6453d9546792065dd5e4def99522ae90f9ae0f4ba250dcebaaf280dbdc147f360752274ec04ce3e21545dbdbbbd2ed4dd337217

Download Submit
C:\Windows\system\tythVqW.exe

Filesize
2.0MB

MD5
f96b005663941f4f034e02e67684ce9d

SHA1
fda50458ebfca97fa4196cac888b3c8574e4efc7

SHA256
a30b390a285176c01f9c9835134168687328a3089c35aa0a1f4db7480a300622

SHA512
c22441b31c6846b1edacbac6c08a800634426b7e535352f57b7514343014fd127f1aa3aa2d08ad91b9d088055c9006ed5ec7e2bcb8c1fb65741985d07c463794

Download Submit
C:\Windows\system\vNbvfRQ.exe

Filesize
2.0MB

MD5
1e7e856fd70bd1ef97071476a79764d3

SHA1
9fcb1ff3af803b5c0d83a6a68924bb1126f60040

SHA256
c17dc17def7ef653401d4ced4b3b11b94defce51c441b3ca98eb16767be9622f

SHA512
c7221a36559105a449c7937c0cdf0624319958d43732933091052aa96538c37eaff7176641e375d36fe7dbed39b24b46c3c1bfb2b10e0411508fbb4767324a08

Download Submit
C:\Windows\system\yLRWmxq.exe

Filesize
2.0MB

MD5
ca228fd59d4ac3922d002df45422effc

SHA1
e698754152d7fe7497a532111e7a32e7fd1ffd4e

SHA256
b97b1694533a1b09ca9e05bd5dfff26586a091741c69f5e2e6552191309f58a2

SHA512
dff9d85d16abb7110d3db2ed08c4e0ceab532b676a50896fe70145ea31110b3554c1194e8ada71e977e30f53b5dede47387fc9f7e7a9afb621ff889cbe5d4cb9

Download Submit
C:\Windows\system\zUCzCqK.exe

Filesize
2.0MB

MD5
401be2277ea8269d2a69b3694eb05a29

SHA1
a093a963a5cc2f867c87ba88ef8ccf6146199495

SHA256
e989da973fb871a7d6a68609c37b7403b72ebdd24ba22aadb041c133c7fecf6d

SHA512
cbed9e62c22419ba1fc7f76090cd1e39fee508f3aae9bc3edbe8bcf4cfa57ae8101f206aaa8167d8278263f0bce67627f6480b1669c05a44bfd483fe59469103

Download Submit
\Windows\system\GTNaAYt.exe

Filesize
2.0MB

MD5
855987fc347f61c8d9e69f13c37960e4

SHA1
5ca4df05eb4c5860e15d284fee80f62dba5ee46c

SHA256
07a6834f0e224d3d65f5f29c99d32269f8b765d086020b7788f552d0a87edc10

SHA512
e4ed7c9a819b6cf570ff4d32191e7753b3880462c8c1446d3ed1725ff7d6f99ee13b8f5e9f63a55ff1d60d094caf86c9e931de04596b3e39cebe2864111dad35

Download Submit
\Windows\system\PJNeJQN.exe

Filesize
2.0MB

MD5
ce605fb4be613877c3cd9c56899ed83f

SHA1
a131ca21d1e4e1d0cde131fdefd5ddc7f5e89141

SHA256
a26c93484c51fe31e67036cbd739bdd9b27ebea3aa3484af4068308d2961c6fc

SHA512
3a770bdf798457894c57c2fec397605af68d90b776e7d6b21abbe769b5781feea5391c85d4c7d694a0dfe23184bcdc23483754052cdf2815bb8f92010e968a2a

Download Submit
\Windows\system\RgCRult.exe

Filesize
2.0MB

MD5
fe3c481c995710a258937b405be19597

SHA1
5d1e9c8c15abe2d6c11abb3faa6f87ad758b4e85

SHA256
245dc1516d2e437bf9fcd330758f4aa723e16144677f9031a6d00ed649462fd6

SHA512
22fd819efc1e4f528cc47ee1b01dc5756cab546b01480e764ffba9ff09595f923ecc2ea9c5b6dfbb0f7cffcacffe64329bb52721b787ea6df792a231d832b0c3

Download Submit
\Windows\system\ULAazTn.exe

Filesize
2.0MB

MD5
f119a0ef01bfe03173d99731da12e301

SHA1
c2565aee439205513687f05e61be96db304d1ce2

SHA256
d633b0e5770ebdce0dde0fbca2d82f879e039977845167e3b40e5a2db29b6bdb

SHA512
6bda301b9aa940a32855bf918ac7c347d3a5b56a08490484bb2e902a9495aaf85ebce515767e2f58097cb6068b33a74220327e414f1d1f3aea57983d53b0577e

Download Submit
\Windows\system\YSEkcPw.exe

Filesize
2.0MB

MD5
817a93fdc2a787fc859d7e69d29b07d4

SHA1
de8b695a601a7373ea796814d3c7b4c0e2453ac7

SHA256
2af2e8d48e9e949aa3be906d3cbd8b5074e6979cf48d0d972b3b7882664b5eee

SHA512
3df2563bd5f76836887af811585414b5d3a9aedb85f300e3b4549a5988cce439ec8b380f6d442634b973fb82ff6bdcc4ad35d08a2d44b3884e0295b421b28773

Download Submit
\Windows\system\ZrkSnwY.exe

Filesize
2.0MB

MD5
4f68d9e504c18b3d3c6841ef63d808de

SHA1
9f1cdbac4d72998421da1e2a93d3c6aa2cf004aa

SHA256
79b2aacd27720f60ddc01f5756178172dd568d2d65e747f4cc61eb99cca927a4

SHA512
6f27c60f1da40b366627254d61146d9178ebadc01fdd03dbcce1cfe05e1ee06176e7e7802374d34b00d4f209b81d9edababfdb7f03bd77d0ebd1fc98dd3818ed

Download Submit
\Windows\system\iEbIqwy.exe

Filesize
2.0MB

MD5
9452ed16844d91006e192f5cef6dc2af

SHA1
4542df6dfd53723f0acd3a39db5fa3f9727a6f6d

SHA256
b5c1c6665c239af41e54b3a00d2e4e6f3c99124a35d80752905575c84f06b0ed

SHA512
4475e9776f7fed68e5a6aa61657f6376fa210c3941ad7ab47e5138b58f57f0672c612f2420a99af403427cc57199a948dc45a7d2daf9fa9211047cc9626ee8d8

Download Submit
\Windows\system\kpHGqiI.exe

Filesize
2.0MB

MD5
90afc253d879be9f822ffa2927cff193

SHA1
4eebd18b02def298d45bf1f37074541aee003442

SHA256
07c90d802ad865edfcf25e86ff37df1253d6dc4a2488baa4f3ace3ea62531208

SHA512
aa00aa2ae1d264250629e6ade8da8fa3598a7b6a7864d8971e1032e297916d5fcab194c38e5139cbe3ba6eacbaa98d062c69657b34c5ffffbfe38dbd5fb8370e

Download Submit
\Windows\system\lKNpbVV.exe

Filesize
2.0MB

MD5
a8a298022c768c6d6f11f42db8b5b8c2

SHA1
8e62f1a4700ba13bceab15eca5d19998c9cd9cb5

SHA256
0c832ff32a5d6db3756680525a1ae6efc38a33927843c52110f7fb54f28b3bc2

SHA512
8baac2d7cd3307b10bf6c66f8f0780b8a67a6740145590b8d46c29b5bedb51b673fcf2777573dd8202ce489e899caf9658254be9baf76ad4c6b24d412b25b67b

Download Submit
\Windows\system\okOMxHJ.exe

Filesize
2.0MB

MD5
0f6ae357f6b27f86ac56f99f671e1acc

SHA1
7e2d884c40940d91c2559c1149ec159f5c612327

SHA256
ebbd98460f6117f8b90fd7a3d83c62fd1a0242de515b55ad7f371d29fe68a335

SHA512
080068e549471c6f4e3647ebbc2f1e3340d5e6cb4ff77d8d8a9c635741afedba1fa9eca7d121722ac33c472d21330a6d58771853e7f4ccffaff5a65757267b60

Download Submit
\Windows\system\owPhyqX.exe

Filesize
2.0MB

MD5
7a2a93a6597fc4699836686ea981a6d5

SHA1
395ca9236f38b6a62678f773bdbf7b2afb09b308

SHA256
86be2c90ee26112cee618675e94a07174182fa547760440c7bbddd50b0963623

SHA512
72c9e02edc808c2df1b080dfe3c74e39eb5cd129728054444c9f5695b75d22b4f8305436df697266b3a3e547351fbb71f516c9ba53f56d6fdb5ed4cb98ef66d0

Download Submit
\Windows\system\sTlaUfK.exe

Filesize
2.0MB

MD5
03b1b5b0a11c162835b8cf86c669a9a9

SHA1
ff2eafc7412e856dd6efed91e7240d206dbd0420

SHA256
2c84dd38cfd0995c74901d2f5b618e8a4c3329e51fe4119ab4ac87b64c1d426d

SHA512
0d52f4e2fa89fabb0e463e3252d42629dceb207cedc7da64eaa37fe1675afc7824de3ec15f1f01c732de68b8c0c354bf044b331562cf88663ea8d79eec971f95

Download Submit
\Windows\system\xSspGOv.exe

Filesize
2.0MB

MD5
5b22304d7a4073b0820f9dbc4d1d6664

SHA1
4025a9f45b6bf974855da2e9f1dcd61977a28b2e

SHA256
2d24e9a4c082e21b62a4febee804b0f3f6dff16f8457be18db325b68775633fd

SHA512
5de27e1407a9f0fe78e32cf43d79571081da3951a35b5c23ec63929b4169caecb5f1ee887076dde008067b89e4717c5548ea0670ad88ee8545777663d86c1762

Download Submit
memory/2208-296-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/2208-297-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2232-49-0x0000000002DD0000-0x00000000031C2000-memory.dmp

Filesize
3.9MB

Download
memory/2232-81-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2232-66-0x0000000002F60000-0x0000000003352000-memory.dmp

Filesize
3.9MB

Download
memory/2232-10-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2232-63-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2232-71-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2232-0-0x0000000000580000-0x0000000000590000-memory.dmp

Filesize
64KB

Download
memory/2232-59-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2232-58-0x0000000002DD0000-0x00000000031C2000-memory.dmp

Filesize
3.9MB

Download
memory/2232-67-0x0000000002F60000-0x0000000003352000-memory.dmp

Filesize
3.9MB

Download
memory/2232-68-0x0000000002F60000-0x0000000003352000-memory.dmp

Filesize
3.9MB

Download
memory/2232-80-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2232-86-0x00000000034C0000-0x00000000038B2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-84-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2500-4509-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2548-4586-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-85-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2556-4527-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2556-61-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-4524-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2580-72-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2680-88-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2680-4510-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2720-4519-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2720-83-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2736-4520-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2736-78-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2760-62-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2760-4522-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2768-64-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2772-25-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2772-4545-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/3064-4530-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/3064-77-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download