xmrig | 13294d57fb571908162b889a0988d47e62b480c23e73822b5bc8320d9e34ffd9

Analysis

max time kernel
29s
max time network
28s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
Size

1.9MB
MD5

03c49bb60175c5d6a577aec9a99228ec
SHA1

ae2e6bc10568b0e00af371101039f1cfa0e51b21
SHA256

13294d57fb571908162b889a0988d47e62b480c23e73822b5bc8320d9e34ffd9
SHA512

4787d2a3a1265c989bdad5e593cf15c688e9230e3081eb45c1acbf51f0b500019733c0c023bbf3d0d0d8745c32f127aaaa8937c7eeaf25b9188130f261f1a402
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UC:NABX

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2692-9-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2080-145-0x0000000002FD0000-0x00000000033C2000-memory.dmp	xmrig
behavioral1/memory/2536-144-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/2428-142-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2472-140-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	xmrig
behavioral1/memory/2080-138-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	xmrig
behavioral1/memory/2200-137-0x000000013FE40000-0x0000000140232000-memory.dmp	xmrig
behavioral1/memory/2724-135-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2576-133-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2424-128-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

Processes:

sqXlqhw.exeUlbFFZP.exexAwnHbN.exeWypaJjO.exelpTOaMI.exeFclBrgG.exearMaHrj.exeBcqxmBI.exeZewPyXu.exeQIDRqJw.exeZkDiuOt.exeJTZxHOG.exedvryrED.exekMOSfxw.exePymLMty.exeeYGYeLB.exeFZWiiXD.exeDynyxBV.exewpVZbTF.exeqaoDjTd.exezlUSdur.exeXoZiQpr.exemWVPnjQ.exeiDnJuNb.exezPTXJYG.exefXtQaun.exewgJFpDB.exeNiRnAES.exeRWApcor.exeHDmvKXr.exeNBRXxNS.exeLcrSNNS.exefIXMehm.exeGlNncfa.exeSDIXoXh.exeBNPGQBu.exeVmDByqH.exeoSiyzpK.exeoBFGSTB.exebBejbaG.exevLIWTOY.exexIQYjBK.exeCeKSYfr.exeXsdDCNs.exeyvcuCBv.exeCLHJqHV.exenyfZxkb.exeRCIghTm.exeXNRapsE.exeQJmqnan.exeQgyXvUr.exeBWGkGDI.exezKQyKGQ.exetDFMLga.exebChcCvN.exesnmIuWx.exePONSqmX.exeefCXLVm.exeGCKtRtQ.exeVhzGLps.exeolaetCT.exeDLNiVaK.exervaaVWJ.exeKzQnMYJ.exe

pid	process
2692	sqXlqhw.exe
2620	UlbFFZP.exe
2424	xAwnHbN.exe
2576	WypaJjO.exe
2724	lpTOaMI.exe
2200	FclBrgG.exe
2472	arMaHrj.exe
2428	BcqxmBI.exe
2536	ZewPyXu.exe
2912	QIDRqJw.exe
1568	ZkDiuOt.exe
2300	JTZxHOG.exe
808	dvryrED.exe
1620	kMOSfxw.exe
1348	PymLMty.exe
1644	eYGYeLB.exe
240	FZWiiXD.exe
2336	DynyxBV.exe
2040	wpVZbTF.exe
824	qaoDjTd.exe
1880	zlUSdur.exe
1892	XoZiQpr.exe
2212	mWVPnjQ.exe
1608	iDnJuNb.exe
1236	zPTXJYG.exe
1116	fXtQaun.exe
2168	wgJFpDB.exe
2056	NiRnAES.exe
548	RWApcor.exe
1484	HDmvKXr.exe
412	NBRXxNS.exe
868	LcrSNNS.exe
2924	fIXMehm.exe
1948	GlNncfa.exe
988	SDIXoXh.exe
1288	BNPGQBu.exe
2960	VmDByqH.exe
1988	oSiyzpK.exe
920	oBFGSTB.exe
3064	bBejbaG.exe
3048	vLIWTOY.exe
2864	xIQYjBK.exe
3032	CeKSYfr.exe
2872	XsdDCNs.exe
2816	yvcuCBv.exe
1576	CLHJqHV.exe
2396	nyfZxkb.exe
2280	RCIghTm.exe
888	XNRapsE.exe
2796	QJmqnan.exe
2800	QgyXvUr.exe
1524	BWGkGDI.exe
1528	zKQyKGQ.exe
2764	tDFMLga.exe
2704	bChcCvN.exe
2560	snmIuWx.exe
2532	PONSqmX.exe
2448	efCXLVm.exe
2488	GCKtRtQ.exe
1756	VhzGLps.exe
1636	olaetCT.exe
1580	DLNiVaK.exe
1856	rvaaVWJ.exe
332	KzQnMYJ.exe

Loads dropped DLL 64 IoCs

Processes:

03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe

pid	process
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\system\sqXlqhw.exe	upx
behavioral1/memory/2080-1-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/2692-9-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
C:\Windows\system\xAwnHbN.exe	upx
C:\Windows\system\WypaJjO.exe	upx
C:\Windows\system\FclBrgG.exe	upx
C:\Windows\system\arMaHrj.exe	upx
C:\Windows\system\QIDRqJw.exe	upx
C:\Windows\system\dvryrED.exe	upx
\Windows\system\PymLMty.exe	upx
\Windows\system\wpVZbTF.exe	upx
C:\Windows\system\DynyxBV.exe	upx
\Windows\system\mWVPnjQ.exe	upx
C:\Windows\system\XoZiQpr.exe	upx
C:\Windows\system\zlUSdur.exe	upx
\Windows\system\RWApcor.exe	upx
\Windows\system\HDmvKXr.exe	upx
C:\Windows\system\LcrSNNS.exe	upx
C:\Windows\system\NBRXxNS.exe	upx
C:\Windows\system\NiRnAES.exe	upx
C:\Windows\system\wgJFpDB.exe	upx
C:\Windows\system\fXtQaun.exe	upx
C:\Windows\system\iDnJuNb.exe	upx
behavioral1/memory/2536-144-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/memory/2428-142-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2472-140-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	upx
behavioral1/memory/2200-137-0x000000013FE40000-0x0000000140232000-memory.dmp	upx
behavioral1/memory/2724-135-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2576-133-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2424-128-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
C:\Windows\system\zPTXJYG.exe	upx
C:\Windows\system\qaoDjTd.exe	upx
C:\Windows\system\eYGYeLB.exe	upx
C:\Windows\system\FZWiiXD.exe	upx
C:\Windows\system\kMOSfxw.exe	upx
C:\Windows\system\JTZxHOG.exe	upx
C:\Windows\system\ZkDiuOt.exe	upx
C:\Windows\system\ZewPyXu.exe	upx
C:\Windows\system\BcqxmBI.exe	upx
C:\Windows\system\lpTOaMI.exe	upx
behavioral1/memory/2620-18-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
C:\Windows\system\UlbFFZP.exe	upx

Drops file in Windows directory 64 IoCs

Processes:

03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\System\TAzexeC.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\toDeucC.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\SUsAusi.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\DMsiIjD.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\UyLrBGT.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\VVRDsoS.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\HzUQUWM.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\MhTJowY.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\KfmsCUe.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\PrrTksz.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\sTGBJrq.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\tBnvJcZ.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\VthKLvC.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\GRpAspW.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\YNdIJBl.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\uisiLaE.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\fTLBBYu.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\fdYwajT.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\DWfAmjM.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\OoRlAYr.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\uDmKbTq.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\ssCVKxA.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\yfctakO.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\oSDyWCk.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\MqnxUYa.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\fnmxRvh.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\vGLKEht.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\aMvfJWJ.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\VgGStdi.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\ywMgVXh.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\ryGpjqC.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\KRZkaAs.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\ptAUAAN.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\aBrmXvu.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\tnDEdrS.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\fvAnqhd.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\ncqPPcr.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\VgabRYl.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\IejjIrQ.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\kgKEQIi.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\NatcQZd.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\PjcAReW.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\FIckbDc.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\lAOLjpg.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\NQeIvfT.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\DynyxBV.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\fXtQaun.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\BHSBEig.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\jDEuIfU.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\EklITAd.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\fDJyiNG.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\QNrRmYL.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\ZFydGmO.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\THcceHU.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\zNoKPLI.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\PtEuAJK.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\LwwSeXN.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\ObTfSGq.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\jOJPZoB.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\luIVUZr.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\gqblpmN.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\jACJONp.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\eippQbI.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
File created	C:\Windows\System\SsQCrFO.exe	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2064 powershell.exe

pid	process
2064	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exepowershell.exe

description	pid	process
Token: SeLockMemoryPrivilege	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
Token: SeDebugPrivilege	2064	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe

description	pid	process	target process
PID 2080 wrote to memory of 2064	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	powershell.exe
PID 2080 wrote to memory of 2064	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	powershell.exe
PID 2080 wrote to memory of 2064	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	powershell.exe
PID 2080 wrote to memory of 2692	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	sqXlqhw.exe
PID 2080 wrote to memory of 2692	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	sqXlqhw.exe
PID 2080 wrote to memory of 2692	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	sqXlqhw.exe
PID 2080 wrote to memory of 2620	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	UlbFFZP.exe
PID 2080 wrote to memory of 2620	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	UlbFFZP.exe
PID 2080 wrote to memory of 2620	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	UlbFFZP.exe
PID 2080 wrote to memory of 2424	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	xAwnHbN.exe
PID 2080 wrote to memory of 2424	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	xAwnHbN.exe
PID 2080 wrote to memory of 2424	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	xAwnHbN.exe
PID 2080 wrote to memory of 2576	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	WypaJjO.exe
PID 2080 wrote to memory of 2576	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	WypaJjO.exe
PID 2080 wrote to memory of 2576	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	WypaJjO.exe
PID 2080 wrote to memory of 2724	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	lpTOaMI.exe
PID 2080 wrote to memory of 2724	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	lpTOaMI.exe
PID 2080 wrote to memory of 2724	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	lpTOaMI.exe
PID 2080 wrote to memory of 2200	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	FclBrgG.exe
PID 2080 wrote to memory of 2200	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	FclBrgG.exe
PID 2080 wrote to memory of 2200	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	FclBrgG.exe
PID 2080 wrote to memory of 2472	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	arMaHrj.exe
PID 2080 wrote to memory of 2472	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	arMaHrj.exe
PID 2080 wrote to memory of 2472	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	arMaHrj.exe
PID 2080 wrote to memory of 2428	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	BcqxmBI.exe
PID 2080 wrote to memory of 2428	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	BcqxmBI.exe
PID 2080 wrote to memory of 2428	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	BcqxmBI.exe
PID 2080 wrote to memory of 2536	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	ZewPyXu.exe
PID 2080 wrote to memory of 2536	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	ZewPyXu.exe
PID 2080 wrote to memory of 2536	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	ZewPyXu.exe
PID 2080 wrote to memory of 2912	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	QIDRqJw.exe
PID 2080 wrote to memory of 2912	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	QIDRqJw.exe
PID 2080 wrote to memory of 2912	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	QIDRqJw.exe
PID 2080 wrote to memory of 1568	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	ZkDiuOt.exe
PID 2080 wrote to memory of 1568	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	ZkDiuOt.exe
PID 2080 wrote to memory of 1568	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	ZkDiuOt.exe
PID 2080 wrote to memory of 2300	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	JTZxHOG.exe
PID 2080 wrote to memory of 2300	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	JTZxHOG.exe
PID 2080 wrote to memory of 2300	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	JTZxHOG.exe
PID 2080 wrote to memory of 808	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	dvryrED.exe
PID 2080 wrote to memory of 808	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	dvryrED.exe
PID 2080 wrote to memory of 808	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	dvryrED.exe
PID 2080 wrote to memory of 1620	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	kMOSfxw.exe
PID 2080 wrote to memory of 1620	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	kMOSfxw.exe
PID 2080 wrote to memory of 1620	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	kMOSfxw.exe
PID 2080 wrote to memory of 1348	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	PymLMty.exe
PID 2080 wrote to memory of 1348	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	PymLMty.exe
PID 2080 wrote to memory of 1348	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	PymLMty.exe
PID 2080 wrote to memory of 1644	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	eYGYeLB.exe
PID 2080 wrote to memory of 1644	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	eYGYeLB.exe
PID 2080 wrote to memory of 1644	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	eYGYeLB.exe
PID 2080 wrote to memory of 240	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	FZWiiXD.exe
PID 2080 wrote to memory of 240	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	FZWiiXD.exe
PID 2080 wrote to memory of 240	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	FZWiiXD.exe
PID 2080 wrote to memory of 2336	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	DynyxBV.exe
PID 2080 wrote to memory of 2336	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	DynyxBV.exe
PID 2080 wrote to memory of 2336	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	DynyxBV.exe
PID 2080 wrote to memory of 2040	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	wpVZbTF.exe
PID 2080 wrote to memory of 2040	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	wpVZbTF.exe
PID 2080 wrote to memory of 2040	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	wpVZbTF.exe
PID 2080 wrote to memory of 824	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	qaoDjTd.exe
PID 2080 wrote to memory of 824	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	qaoDjTd.exe
PID 2080 wrote to memory of 824	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	qaoDjTd.exe
PID 2080 wrote to memory of 1880	2080	03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe	zlUSdur.exe

C:\Users\Admin\AppData\Local\Temp\03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03c49bb60175c5d6a577aec9a99228ec_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2064
- C:\Windows\System\sqXlqhw.exe
  C:\Windows\System\sqXlqhw.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\UlbFFZP.exe
  C:\Windows\System\UlbFFZP.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\xAwnHbN.exe
  C:\Windows\System\xAwnHbN.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\WypaJjO.exe
  C:\Windows\System\WypaJjO.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\lpTOaMI.exe
  C:\Windows\System\lpTOaMI.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\FclBrgG.exe
  C:\Windows\System\FclBrgG.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\arMaHrj.exe
  C:\Windows\System\arMaHrj.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\BcqxmBI.exe
  C:\Windows\System\BcqxmBI.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\ZewPyXu.exe
  C:\Windows\System\ZewPyXu.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\QIDRqJw.exe
  C:\Windows\System\QIDRqJw.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\ZkDiuOt.exe
  C:\Windows\System\ZkDiuOt.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\JTZxHOG.exe
  C:\Windows\System\JTZxHOG.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\dvryrED.exe
  C:\Windows\System\dvryrED.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\kMOSfxw.exe
  C:\Windows\System\kMOSfxw.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\PymLMty.exe
  C:\Windows\System\PymLMty.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\eYGYeLB.exe
  C:\Windows\System\eYGYeLB.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\FZWiiXD.exe
  C:\Windows\System\FZWiiXD.exe
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Windows\System\DynyxBV.exe
  C:\Windows\System\DynyxBV.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\wpVZbTF.exe
  C:\Windows\System\wpVZbTF.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\qaoDjTd.exe
  C:\Windows\System\qaoDjTd.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\zlUSdur.exe
  C:\Windows\System\zlUSdur.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\XoZiQpr.exe
  C:\Windows\System\XoZiQpr.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\mWVPnjQ.exe
  C:\Windows\System\mWVPnjQ.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\fXtQaun.exe
  C:\Windows\System\fXtQaun.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\iDnJuNb.exe
  C:\Windows\System\iDnJuNb.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\wgJFpDB.exe
  C:\Windows\System\wgJFpDB.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\zPTXJYG.exe
  C:\Windows\System\zPTXJYG.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\NiRnAES.exe
  C:\Windows\System\NiRnAES.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\RWApcor.exe
  C:\Windows\System\RWApcor.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\HDmvKXr.exe
  C:\Windows\System\HDmvKXr.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\NBRXxNS.exe
  C:\Windows\System\NBRXxNS.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\LcrSNNS.exe
  C:\Windows\System\LcrSNNS.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\fIXMehm.exe
  C:\Windows\System\fIXMehm.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\SDIXoXh.exe
  C:\Windows\System\SDIXoXh.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\GlNncfa.exe
  C:\Windows\System\GlNncfa.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\BNPGQBu.exe
  C:\Windows\System\BNPGQBu.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\VmDByqH.exe
  C:\Windows\System\VmDByqH.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\oSiyzpK.exe
  C:\Windows\System\oSiyzpK.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\oBFGSTB.exe
  C:\Windows\System\oBFGSTB.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\vLIWTOY.exe
  C:\Windows\System\vLIWTOY.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\bBejbaG.exe
  C:\Windows\System\bBejbaG.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\XsdDCNs.exe
  C:\Windows\System\XsdDCNs.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\xIQYjBK.exe
  C:\Windows\System\xIQYjBK.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\CLHJqHV.exe
  C:\Windows\System\CLHJqHV.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\CeKSYfr.exe
  C:\Windows\System\CeKSYfr.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\nyfZxkb.exe
  C:\Windows\System\nyfZxkb.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\yvcuCBv.exe
  C:\Windows\System\yvcuCBv.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\RCIghTm.exe
  C:\Windows\System\RCIghTm.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\XNRapsE.exe
  C:\Windows\System\XNRapsE.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\QJmqnan.exe
  C:\Windows\System\QJmqnan.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\QgyXvUr.exe
  C:\Windows\System\QgyXvUr.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\BWGkGDI.exe
  C:\Windows\System\BWGkGDI.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\zKQyKGQ.exe
  C:\Windows\System\zKQyKGQ.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\snmIuWx.exe
  C:\Windows\System\snmIuWx.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\tDFMLga.exe
  C:\Windows\System\tDFMLga.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\PONSqmX.exe
  C:\Windows\System\PONSqmX.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\bChcCvN.exe
  C:\Windows\System\bChcCvN.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\efCXLVm.exe
  C:\Windows\System\efCXLVm.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\GCKtRtQ.exe
  C:\Windows\System\GCKtRtQ.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\VhzGLps.exe
  C:\Windows\System\VhzGLps.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\olaetCT.exe
  C:\Windows\System\olaetCT.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\DLNiVaK.exe
  C:\Windows\System\DLNiVaK.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\rvaaVWJ.exe
  C:\Windows\System\rvaaVWJ.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\KzQnMYJ.exe
  C:\Windows\System\KzQnMYJ.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\MqnxUYa.exe
  C:\Windows\System\MqnxUYa.exe
  2⤵
  PID:1868
- C:\Windows\System\LoNidVx.exe
  C:\Windows\System\LoNidVx.exe
  2⤵
  PID:1884
- C:\Windows\System\whQzzkt.exe
  C:\Windows\System\whQzzkt.exe
  2⤵
  PID:356
- C:\Windows\System\yvSkRrk.exe
  C:\Windows\System\yvSkRrk.exe
  2⤵
  PID:1848
- C:\Windows\System\JdfLxPD.exe
  C:\Windows\System\JdfLxPD.exe
  2⤵
  PID:2364
- C:\Windows\System\gYkGqYD.exe
  C:\Windows\System\gYkGqYD.exe
  2⤵
  PID:896
- C:\Windows\System\TTujWIf.exe
  C:\Windows\System\TTujWIf.exe
  2⤵
  PID:2368
- C:\Windows\System\xpNBJlA.exe
  C:\Windows\System\xpNBJlA.exe
  2⤵
  PID:324
- C:\Windows\System\XBiPeQA.exe
  C:\Windows\System\XBiPeQA.exe
  2⤵
  PID:2932
- C:\Windows\System\ujtmUyf.exe
  C:\Windows\System\ujtmUyf.exe
  2⤵
  PID:2928
- C:\Windows\System\HVVddrM.exe
  C:\Windows\System\HVVddrM.exe
  2⤵
  PID:632
- C:\Windows\System\EdIOPvg.exe
  C:\Windows\System\EdIOPvg.exe
  2⤵
  PID:2260
- C:\Windows\System\wvHelaw.exe
  C:\Windows\System\wvHelaw.exe
  2⤵
  PID:1708
- C:\Windows\System\ARlCeus.exe
  C:\Windows\System\ARlCeus.exe
  2⤵
  PID:2292
- C:\Windows\System\sisNwGj.exe
  C:\Windows\System\sisNwGj.exe
  2⤵
  PID:1616
- C:\Windows\System\LsElLoa.exe
  C:\Windows\System\LsElLoa.exe
  2⤵
  PID:1752
- C:\Windows\System\gCwpfFn.exe
  C:\Windows\System\gCwpfFn.exe
  2⤵
  PID:1248
- C:\Windows\System\NQcMFLd.exe
  C:\Windows\System\NQcMFLd.exe
  2⤵
  PID:2868
- C:\Windows\System\MfJoMkt.exe
  C:\Windows\System\MfJoMkt.exe
  2⤵
  PID:2188
- C:\Windows\System\XdUSkgO.exe
  C:\Windows\System\XdUSkgO.exe
  2⤵
  PID:2940
- C:\Windows\System\ZfJvzpw.exe
  C:\Windows\System\ZfJvzpw.exe
  2⤵
  PID:900
- C:\Windows\System\YENidAS.exe
  C:\Windows\System\YENidAS.exe
  2⤵
  PID:576
- C:\Windows\System\iQuoHkX.exe
  C:\Windows\System\iQuoHkX.exe
  2⤵
  PID:2416
- C:\Windows\System\FbSxsTN.exe
  C:\Windows\System\FbSxsTN.exe
  2⤵
  PID:1624
- C:\Windows\System\wIbYWSr.exe
  C:\Windows\System\wIbYWSr.exe
  2⤵
  PID:2752
- C:\Windows\System\ZAuRPKs.exe
  C:\Windows\System\ZAuRPKs.exe
  2⤵
  PID:2668
- C:\Windows\System\VRbRVbB.exe
  C:\Windows\System\VRbRVbB.exe
  2⤵
  PID:1864
- C:\Windows\System\EFPgklY.exe
  C:\Windows\System\EFPgklY.exe
  2⤵
  PID:1680
- C:\Windows\System\zZTOCUP.exe
  C:\Windows\System\zZTOCUP.exe
  2⤵
  PID:2468
- C:\Windows\System\yOwyxvG.exe
  C:\Windows\System\yOwyxvG.exe
  2⤵
  PID:2708
- C:\Windows\System\NatcQZd.exe
  C:\Windows\System\NatcQZd.exe
  2⤵
  PID:1888
- C:\Windows\System\mmuQkPV.exe
  C:\Windows\System\mmuQkPV.exe
  2⤵
  PID:644
- C:\Windows\System\WZokIBm.exe
  C:\Windows\System\WZokIBm.exe
  2⤵
  PID:680
- C:\Windows\System\xuQpwIe.exe
  C:\Windows\System\xuQpwIe.exe
  2⤵
  PID:1660
- C:\Windows\System\IuYjAaZ.exe
  C:\Windows\System\IuYjAaZ.exe
  2⤵
  PID:1972
- C:\Windows\System\MANwMqS.exe
  C:\Windows\System\MANwMqS.exe
  2⤵
  PID:604
- C:\Windows\System\LQLNdcs.exe
  C:\Windows\System\LQLNdcs.exe
  2⤵
  PID:2780
- C:\Windows\System\BOSzmlV.exe
  C:\Windows\System\BOSzmlV.exe
  2⤵
  PID:2184
- C:\Windows\System\GPvtMmN.exe
  C:\Windows\System\GPvtMmN.exe
  2⤵
  PID:2204
- C:\Windows\System\OQZCXGr.exe
  C:\Windows\System\OQZCXGr.exe
  2⤵
  PID:2440
- C:\Windows\System\upLtIBH.exe
  C:\Windows\System\upLtIBH.exe
  2⤵
  PID:2384
- C:\Windows\System\jWHbfdF.exe
  C:\Windows\System\jWHbfdF.exe
  2⤵
  PID:3036
- C:\Windows\System\VgGStdi.exe
  C:\Windows\System\VgGStdi.exe
  2⤵
  PID:1468
- C:\Windows\System\mmJAAjE.exe
  C:\Windows\System\mmJAAjE.exe
  2⤵
  PID:1516
- C:\Windows\System\YyxHIqc.exe
  C:\Windows\System\YyxHIqc.exe
  2⤵
  PID:1532
- C:\Windows\System\vQhuLPU.exe
  C:\Windows\System\vQhuLPU.exe
  2⤵
  PID:2412
- C:\Windows\System\OTXMyCb.exe
  C:\Windows\System\OTXMyCb.exe
  2⤵
  PID:1416
- C:\Windows\System\YwCQkwV.exe
  C:\Windows\System\YwCQkwV.exe
  2⤵
  PID:1916
- C:\Windows\System\IigJdXZ.exe
  C:\Windows\System\IigJdXZ.exe
  2⤵
  PID:1960
- C:\Windows\System\uHZFTmC.exe
  C:\Windows\System\uHZFTmC.exe
  2⤵
  PID:2660
- C:\Windows\System\HOIcxaq.exe
  C:\Windows\System\HOIcxaq.exe
  2⤵
  PID:2980
- C:\Windows\System\IVITGhY.exe
  C:\Windows\System\IVITGhY.exe
  2⤵
  PID:3076
- C:\Windows\System\fDNODtC.exe
  C:\Windows\System\fDNODtC.exe
  2⤵
  PID:3100
- C:\Windows\System\HXPEkia.exe
  C:\Windows\System\HXPEkia.exe
  2⤵
  PID:3116
- C:\Windows\System\jOJPZoB.exe
  C:\Windows\System\jOJPZoB.exe
  2⤵
  PID:3136
- C:\Windows\System\dacdxBx.exe
  C:\Windows\System\dacdxBx.exe
  2⤵
  PID:3152
- C:\Windows\System\NxtlPiG.exe
  C:\Windows\System\NxtlPiG.exe
  2⤵
  PID:3172
- C:\Windows\System\lOnudob.exe
  C:\Windows\System\lOnudob.exe
  2⤵
  PID:3188
- C:\Windows\System\WnPSoYg.exe
  C:\Windows\System\WnPSoYg.exe
  2⤵
  PID:3204
- C:\Windows\System\dWRhEsO.exe
  C:\Windows\System\dWRhEsO.exe
  2⤵
  PID:3236
- C:\Windows\System\igOJrPz.exe
  C:\Windows\System\igOJrPz.exe
  2⤵
  PID:3260
- C:\Windows\System\SXefHim.exe
  C:\Windows\System\SXefHim.exe
  2⤵
  PID:3280
- C:\Windows\System\VcQngiX.exe
  C:\Windows\System\VcQngiX.exe
  2⤵
  PID:3296
- C:\Windows\System\LDYgGWp.exe
  C:\Windows\System\LDYgGWp.exe
  2⤵
  PID:3312
- C:\Windows\System\VOqtxQI.exe
  C:\Windows\System\VOqtxQI.exe
  2⤵
  PID:3328
- C:\Windows\System\BTERawt.exe
  C:\Windows\System\BTERawt.exe
  2⤵
  PID:3344
- C:\Windows\System\WKZpgcr.exe
  C:\Windows\System\WKZpgcr.exe
  2⤵
  PID:3368
- C:\Windows\System\rqxKtsi.exe
  C:\Windows\System\rqxKtsi.exe
  2⤵
  PID:3388
- C:\Windows\System\tlomyYx.exe
  C:\Windows\System\tlomyYx.exe
  2⤵
  PID:3404
- C:\Windows\System\EvsnMxB.exe
  C:\Windows\System\EvsnMxB.exe
  2⤵
  PID:3420
- C:\Windows\System\uuIUSiT.exe
  C:\Windows\System\uuIUSiT.exe
  2⤵
  PID:3440
- C:\Windows\System\QvgaBny.exe
  C:\Windows\System\QvgaBny.exe
  2⤵
  PID:3504
- C:\Windows\System\zbCGyht.exe
  C:\Windows\System\zbCGyht.exe
  2⤵
  PID:3604
- C:\Windows\System\OcwVkeB.exe
  C:\Windows\System\OcwVkeB.exe
  2⤵
  PID:3620
- C:\Windows\System\NcDnPHB.exe
  C:\Windows\System\NcDnPHB.exe
  2⤵
  PID:3636
- C:\Windows\System\BuqzCJD.exe
  C:\Windows\System\BuqzCJD.exe
  2⤵
  PID:3652
- C:\Windows\System\PbQcJLV.exe
  C:\Windows\System\PbQcJLV.exe
  2⤵
  PID:3668
- C:\Windows\System\JBvBqfF.exe
  C:\Windows\System\JBvBqfF.exe
  2⤵
  PID:3684
- C:\Windows\System\jWBzIPR.exe
  C:\Windows\System\jWBzIPR.exe
  2⤵
  PID:3700
- C:\Windows\System\oVyVhdy.exe
  C:\Windows\System\oVyVhdy.exe
  2⤵
  PID:3720
- C:\Windows\System\knMljdr.exe
  C:\Windows\System\knMljdr.exe
  2⤵
  PID:3736
- C:\Windows\System\KnVYWoz.exe
  C:\Windows\System\KnVYWoz.exe
  2⤵
  PID:3752
- C:\Windows\System\TmPGrTr.exe
  C:\Windows\System\TmPGrTr.exe
  2⤵
  PID:3768
- C:\Windows\System\QnvJBig.exe
  C:\Windows\System\QnvJBig.exe
  2⤵
  PID:3784
- C:\Windows\System\XWTnqrH.exe
  C:\Windows\System\XWTnqrH.exe
  2⤵
  PID:3800
- C:\Windows\System\ScfemMO.exe
  C:\Windows\System\ScfemMO.exe
  2⤵
  PID:3816
- C:\Windows\System\ZFydGmO.exe
  C:\Windows\System\ZFydGmO.exe
  2⤵
  PID:3832
- C:\Windows\System\bcsZwDa.exe
  C:\Windows\System\bcsZwDa.exe
  2⤵
  PID:3848
- C:\Windows\System\yISIObg.exe
  C:\Windows\System\yISIObg.exe
  2⤵
  PID:3932
- C:\Windows\System\KhUKIFK.exe
  C:\Windows\System\KhUKIFK.exe
  2⤵
  PID:3960
- C:\Windows\System\fQdJLTa.exe
  C:\Windows\System\fQdJLTa.exe
  2⤵
  PID:3980
- C:\Windows\System\UEQFnHC.exe
  C:\Windows\System\UEQFnHC.exe
  2⤵
  PID:4000
- C:\Windows\System\IEBqdGa.exe
  C:\Windows\System\IEBqdGa.exe
  2⤵
  PID:4020
- C:\Windows\System\bgguJtK.exe
  C:\Windows\System\bgguJtK.exe
  2⤵
  PID:4040
- C:\Windows\System\PWPFeaG.exe
  C:\Windows\System\PWPFeaG.exe
  2⤵
  PID:4060
- C:\Windows\System\QeaIxdW.exe
  C:\Windows\System\QeaIxdW.exe
  2⤵
  PID:4080
- C:\Windows\System\KcIIllC.exe
  C:\Windows\System\KcIIllC.exe
  2⤵
  PID:2340
- C:\Windows\System\bSJJfxF.exe
  C:\Windows\System\bSJJfxF.exe
  2⤵
  PID:1900
- C:\Windows\System\aBrmXvu.exe
  C:\Windows\System\aBrmXvu.exe
  2⤵
  PID:2232
- C:\Windows\System\sfCOzcW.exe
  C:\Windows\System\sfCOzcW.exe
  2⤵
  PID:3148
- C:\Windows\System\FUkDoNL.exe
  C:\Windows\System\FUkDoNL.exe
  2⤵
  PID:2296
- C:\Windows\System\cEkcEvW.exe
  C:\Windows\System\cEkcEvW.exe
  2⤵
  PID:2136
- C:\Windows\System\iYwEdXO.exe
  C:\Windows\System\iYwEdXO.exe
  2⤵
  PID:3228
- C:\Windows\System\BHSBEig.exe
  C:\Windows\System\BHSBEig.exe
  2⤵
  PID:2388
- C:\Windows\System\KJzDSJd.exe
  C:\Windows\System\KJzDSJd.exe
  2⤵
  PID:3304
- C:\Windows\System\JqrxVNE.exe
  C:\Windows\System\JqrxVNE.exe
  2⤵
  PID:3384
- C:\Windows\System\tFZreBl.exe
  C:\Windows\System\tFZreBl.exe
  2⤵
  PID:1548
- C:\Windows\System\wFrvpwD.exe
  C:\Windows\System\wFrvpwD.exe
  2⤵
  PID:3468
- C:\Windows\System\DHIScYP.exe
  C:\Windows\System\DHIScYP.exe
  2⤵
  PID:3480
- C:\Windows\System\ZGSXMjZ.exe
  C:\Windows\System\ZGSXMjZ.exe
  2⤵
  PID:3492
- C:\Windows\System\cWJqmcT.exe
  C:\Windows\System\cWJqmcT.exe
  2⤵
  PID:3500
- C:\Windows\System\jwZjlsu.exe
  C:\Windows\System\jwZjlsu.exe
  2⤵
  PID:2508
- C:\Windows\System\POqtJHo.exe
  C:\Windows\System\POqtJHo.exe
  2⤵
  PID:2572
- C:\Windows\System\frEqZAk.exe
  C:\Windows\System\frEqZAk.exe
  2⤵
  PID:2784
- C:\Windows\System\ueUKhIY.exe
  C:\Windows\System\ueUKhIY.exe
  2⤵
  PID:1804
- C:\Windows\System\czQqHoo.exe
  C:\Windows\System\czQqHoo.exe
  2⤵
  PID:960
- C:\Windows\System\OMLNlbD.exe
  C:\Windows\System\OMLNlbD.exe
  2⤵
  PID:1852
- C:\Windows\System\RaGQUvV.exe
  C:\Windows\System\RaGQUvV.exe
  2⤵
  PID:3352
- C:\Windows\System\mEsySdp.exe
  C:\Windows\System\mEsySdp.exe
  2⤵
  PID:2160
- C:\Windows\System\zwcdFqZ.exe
  C:\Windows\System\zwcdFqZ.exe
  2⤵
  PID:3012
- C:\Windows\System\UyLrBGT.exe
  C:\Windows\System\UyLrBGT.exe
  2⤵
  PID:2760
- C:\Windows\System\rmNWUie.exe
  C:\Windows\System\rmNWUie.exe
  2⤵
  PID:3096
- C:\Windows\System\eENlVDf.exe
  C:\Windows\System\eENlVDf.exe
  2⤵
  PID:3256
- C:\Windows\System\ujFIddR.exe
  C:\Windows\System\ujFIddR.exe
  2⤵
  PID:3356
- C:\Windows\System\bRgeHjN.exe
  C:\Windows\System\bRgeHjN.exe
  2⤵
  PID:3396
- C:\Windows\System\wXBRQeO.exe
  C:\Windows\System\wXBRQeO.exe
  2⤵
  PID:3516
- C:\Windows\System\WjHtaga.exe
  C:\Windows\System\WjHtaga.exe
  2⤵
  PID:3528
- C:\Windows\System\DJkQVzk.exe
  C:\Windows\System\DJkQVzk.exe
  2⤵
  PID:3548
- C:\Windows\System\oZfCGlm.exe
  C:\Windows\System\oZfCGlm.exe
  2⤵
  PID:3164
- C:\Windows\System\wsYtBaz.exe
  C:\Windows\System\wsYtBaz.exe
  2⤵
  PID:3088
- C:\Windows\System\UZqgXnv.exe
  C:\Windows\System\UZqgXnv.exe
  2⤵
  PID:1924
- C:\Windows\System\qFrMIyM.exe
  C:\Windows\System\qFrMIyM.exe
  2⤵
  PID:3592
- C:\Windows\System\NfRcsRx.exe
  C:\Windows\System\NfRcsRx.exe
  2⤵
  PID:3616
- C:\Windows\System\qREohTY.exe
  C:\Windows\System\qREohTY.exe
  2⤵
  PID:3648
- C:\Windows\System\vIzZBNI.exe
  C:\Windows\System\vIzZBNI.exe
  2⤵
  PID:3680
- C:\Windows\System\DaIWTpn.exe
  C:\Windows\System\DaIWTpn.exe
  2⤵
  PID:3712
- C:\Windows\System\swhuhMM.exe
  C:\Windows\System\swhuhMM.exe
  2⤵
  PID:3744
- C:\Windows\System\zWPXSti.exe
  C:\Windows\System\zWPXSti.exe
  2⤵
  PID:3776
- C:\Windows\System\aIOXqLV.exe
  C:\Windows\System\aIOXqLV.exe
  2⤵
  PID:3808
- C:\Windows\System\PmLYRwn.exe
  C:\Windows\System\PmLYRwn.exe
  2⤵
  PID:3812
- C:\Windows\System\NpRMSes.exe
  C:\Windows\System\NpRMSes.exe
  2⤵
  PID:3860
- C:\Windows\System\QQrxtim.exe
  C:\Windows\System\QQrxtim.exe
  2⤵
  PID:3856
- C:\Windows\System\wowubqE.exe
  C:\Windows\System\wowubqE.exe
  2⤵
  PID:2352
- C:\Windows\System\FvJTVow.exe
  C:\Windows\System\FvJTVow.exe
  2⤵
  PID:2844
- C:\Windows\System\tjHsLNM.exe
  C:\Windows\System\tjHsLNM.exe
  2⤵
  PID:3872
- C:\Windows\System\snvXEId.exe
  C:\Windows\System\snvXEId.exe
  2⤵
  PID:3888
- C:\Windows\System\ZKUdjbR.exe
  C:\Windows\System\ZKUdjbR.exe
  2⤵
  PID:3904
- C:\Windows\System\ggcQFmD.exe
  C:\Windows\System\ggcQFmD.exe
  2⤵
  PID:3920
- C:\Windows\System\ZSRNDRy.exe
  C:\Windows\System\ZSRNDRy.exe
  2⤵
  PID:2320
- C:\Windows\System\XnUuHSP.exe
  C:\Windows\System\XnUuHSP.exe
  2⤵
  PID:3996
- C:\Windows\System\ZBYLNOi.exe
  C:\Windows\System\ZBYLNOi.exe
  2⤵
  PID:2044
- C:\Windows\System\ZTCWdit.exe
  C:\Windows\System\ZTCWdit.exe
  2⤵
  PID:2404
- C:\Windows\System\PjcAReW.exe
  C:\Windows\System\PjcAReW.exe
  2⤵
  PID:776
- C:\Windows\System\SIPGqbm.exe
  C:\Windows\System\SIPGqbm.exe
  2⤵
  PID:4056
- C:\Windows\System\UsrLCBG.exe
  C:\Windows\System\UsrLCBG.exe
  2⤵
  PID:4052
- C:\Windows\System\ayweSTl.exe
  C:\Windows\System\ayweSTl.exe
  2⤵
  PID:1584
- C:\Windows\System\KRZkaAs.exe
  C:\Windows\System\KRZkaAs.exe
  2⤵
  PID:2376
- C:\Windows\System\hsyZfsq.exe
  C:\Windows\System\hsyZfsq.exe
  2⤵
  PID:2972
- C:\Windows\System\ihAiMwj.exe
  C:\Windows\System\ihAiMwj.exe
  2⤵
  PID:3108
- C:\Windows\System\jyqmTxq.exe
  C:\Windows\System\jyqmTxq.exe
  2⤵
  PID:2584
- C:\Windows\System\IXzpinP.exe
  C:\Windows\System\IXzpinP.exe
  2⤵
  PID:2832
- C:\Windows\System\qwLjjhv.exe
  C:\Windows\System\qwLjjhv.exe
  2⤵
  PID:1048
- C:\Windows\System\AQXbvce.exe
  C:\Windows\System\AQXbvce.exe
  2⤵
  PID:3184
- C:\Windows\System\KiFEmvD.exe
  C:\Windows\System\KiFEmvD.exe
  2⤵
  PID:3276
- C:\Windows\System\mkBHOtw.exe
  C:\Windows\System\mkBHOtw.exe
  2⤵
  PID:3268
- C:\Windows\System\tqAiVyK.exe
  C:\Windows\System\tqAiVyK.exe
  2⤵
  PID:3376
- C:\Windows\System\EYjgGJr.exe
  C:\Windows\System\EYjgGJr.exe
  2⤵
  PID:1200
- C:\Windows\System\UOlWfyt.exe
  C:\Windows\System\UOlWfyt.exe
  2⤵
  PID:3476
- C:\Windows\System\UAVUXiA.exe
  C:\Windows\System\UAVUXiA.exe
  2⤵
  PID:1716
- C:\Windows\System\UKOquDi.exe
  C:\Windows\System\UKOquDi.exe
  2⤵
  PID:2540
- C:\Windows\System\VEQKbQu.exe
  C:\Windows\System\VEQKbQu.exe
  2⤵
  PID:2548
- C:\Windows\System\bLrSppE.exe
  C:\Windows\System\bLrSppE.exe
  2⤵
  PID:1144
- C:\Windows\System\tRkHLeW.exe
  C:\Windows\System\tRkHLeW.exe
  2⤵
  PID:4112
- C:\Windows\System\tjNRsgS.exe
  C:\Windows\System\tjNRsgS.exe
  2⤵
  PID:4128
- C:\Windows\System\zsOdFLI.exe
  C:\Windows\System\zsOdFLI.exe
  2⤵
  PID:4144
- C:\Windows\System\tFQAcLO.exe
  C:\Windows\System\tFQAcLO.exe
  2⤵
  PID:4160
- C:\Windows\System\LVCIVMj.exe
  C:\Windows\System\LVCIVMj.exe
  2⤵
  PID:4176
- C:\Windows\System\sfUWwqp.exe
  C:\Windows\System\sfUWwqp.exe
  2⤵
  PID:4192
- C:\Windows\System\lPYSCER.exe
  C:\Windows\System\lPYSCER.exe
  2⤵
  PID:4208
- C:\Windows\System\KoLFuUV.exe
  C:\Windows\System\KoLFuUV.exe
  2⤵
  PID:4224
- C:\Windows\System\ebSyRwr.exe
  C:\Windows\System\ebSyRwr.exe
  2⤵
  PID:4240
- C:\Windows\System\ghlNxRA.exe
  C:\Windows\System\ghlNxRA.exe
  2⤵
  PID:4256
- C:\Windows\System\DuqSXTq.exe
  C:\Windows\System\DuqSXTq.exe
  2⤵
  PID:4272
- C:\Windows\System\YvIrMzc.exe
  C:\Windows\System\YvIrMzc.exe
  2⤵
  PID:4288
- C:\Windows\System\KvIJqIF.exe
  C:\Windows\System\KvIJqIF.exe
  2⤵
  PID:4308
- C:\Windows\System\iXcVhPf.exe
  C:\Windows\System\iXcVhPf.exe
  2⤵
  PID:4324
- C:\Windows\System\xDjHzZg.exe
  C:\Windows\System\xDjHzZg.exe
  2⤵
  PID:4340
- C:\Windows\System\hKkfRbk.exe
  C:\Windows\System\hKkfRbk.exe
  2⤵
  PID:4356
- C:\Windows\System\AWyJNrS.exe
  C:\Windows\System\AWyJNrS.exe
  2⤵
  PID:4372
- C:\Windows\System\PNHSwUD.exe
  C:\Windows\System\PNHSwUD.exe
  2⤵
  PID:4388
- C:\Windows\System\wOOGMKV.exe
  C:\Windows\System\wOOGMKV.exe
  2⤵
  PID:4404
- C:\Windows\System\LMgRTnN.exe
  C:\Windows\System\LMgRTnN.exe
  2⤵
  PID:4424
- C:\Windows\System\FAvanAB.exe
  C:\Windows\System\FAvanAB.exe
  2⤵
  PID:4440
- C:\Windows\System\ZOUsOsM.exe
  C:\Windows\System\ZOUsOsM.exe
  2⤵
  PID:4456
- C:\Windows\System\Olligme.exe
  C:\Windows\System\Olligme.exe
  2⤵
  PID:4472
- C:\Windows\System\TWTLyKj.exe
  C:\Windows\System\TWTLyKj.exe
  2⤵
  PID:4488
- C:\Windows\System\EmWXFlg.exe
  C:\Windows\System\EmWXFlg.exe
  2⤵
  PID:4504
- C:\Windows\System\NymNrbn.exe
  C:\Windows\System\NymNrbn.exe
  2⤵
  PID:4524
- C:\Windows\System\NOSbsdC.exe
  C:\Windows\System\NOSbsdC.exe
  2⤵
  PID:4540
- C:\Windows\System\lfQMXhG.exe
  C:\Windows\System\lfQMXhG.exe
  2⤵
  PID:4556
- C:\Windows\System\DUvyksv.exe
  C:\Windows\System\DUvyksv.exe
  2⤵
  PID:4572
- C:\Windows\System\fVnalDh.exe
  C:\Windows\System\fVnalDh.exe
  2⤵
  PID:4588
- C:\Windows\System\cNutjdo.exe
  C:\Windows\System\cNutjdo.exe
  2⤵
  PID:4604
- C:\Windows\System\neDNzkw.exe
  C:\Windows\System\neDNzkw.exe
  2⤵
  PID:4620
- C:\Windows\System\vQvneNJ.exe
  C:\Windows\System\vQvneNJ.exe
  2⤵
  PID:4636
- C:\Windows\System\oiFYjCg.exe
  C:\Windows\System\oiFYjCg.exe
  2⤵
  PID:4652
- C:\Windows\System\edOYqRI.exe
  C:\Windows\System\edOYqRI.exe
  2⤵
  PID:4668
- C:\Windows\System\JKRnSvt.exe
  C:\Windows\System\JKRnSvt.exe
  2⤵
  PID:4684
- C:\Windows\System\UeRoLjt.exe
  C:\Windows\System\UeRoLjt.exe
  2⤵
  PID:4700
- C:\Windows\System\IoBngbE.exe
  C:\Windows\System\IoBngbE.exe
  2⤵
  PID:4716
- C:\Windows\System\MUDCOdE.exe
  C:\Windows\System\MUDCOdE.exe
  2⤵
  PID:4736
- C:\Windows\System\dlsHQvb.exe
  C:\Windows\System\dlsHQvb.exe
  2⤵
  PID:4752
- C:\Windows\System\afIpChK.exe
  C:\Windows\System\afIpChK.exe
  2⤵
  PID:4772
- C:\Windows\System\AFMPbxQ.exe
  C:\Windows\System\AFMPbxQ.exe
  2⤵
  PID:4788
- C:\Windows\System\rwpQUTb.exe
  C:\Windows\System\rwpQUTb.exe
  2⤵
  PID:4804
- C:\Windows\System\uKAlcRz.exe
  C:\Windows\System\uKAlcRz.exe
  2⤵
  PID:4820
- C:\Windows\System\lJsHMGU.exe
  C:\Windows\System\lJsHMGU.exe
  2⤵
  PID:4836
- C:\Windows\System\SPiopXB.exe
  C:\Windows\System\SPiopXB.exe
  2⤵
  PID:4852
- C:\Windows\System\lBCszqh.exe
  C:\Windows\System\lBCszqh.exe
  2⤵
  PID:4868
- C:\Windows\System\hHyTsvd.exe
  C:\Windows\System\hHyTsvd.exe
  2⤵
  PID:4884
- C:\Windows\System\aUtEVUg.exe
  C:\Windows\System\aUtEVUg.exe
  2⤵
  PID:4900
- C:\Windows\System\BpolCIb.exe
  C:\Windows\System\BpolCIb.exe
  2⤵
  PID:4920
- C:\Windows\System\THcceHU.exe
  C:\Windows\System\THcceHU.exe
  2⤵
  PID:4940
- C:\Windows\System\xzLfLtx.exe
  C:\Windows\System\xzLfLtx.exe
  2⤵
  PID:4956
- C:\Windows\System\gogamqF.exe
  C:\Windows\System\gogamqF.exe
  2⤵
  PID:4972
- C:\Windows\System\bWWrcgz.exe
  C:\Windows\System\bWWrcgz.exe
  2⤵
  PID:4988
- C:\Windows\System\NxLiwAo.exe
  C:\Windows\System\NxLiwAo.exe
  2⤵
  PID:5004
- C:\Windows\System\VnujtPF.exe
  C:\Windows\System\VnujtPF.exe
  2⤵
  PID:5024
- C:\Windows\System\XFzKhgV.exe
  C:\Windows\System\XFzKhgV.exe
  2⤵
  PID:5040
- C:\Windows\System\LWAHays.exe
  C:\Windows\System\LWAHays.exe
  2⤵
  PID:5056
- C:\Windows\System\vSQbaLZ.exe
  C:\Windows\System\vSQbaLZ.exe
  2⤵
  PID:5072
- C:\Windows\System\ujzRfID.exe
  C:\Windows\System\ujzRfID.exe
  2⤵
  PID:5092
- C:\Windows\System\cNGGUJs.exe
  C:\Windows\System\cNGGUJs.exe
  2⤵
  PID:5108
- C:\Windows\System\dcbcsBO.exe
  C:\Windows\System\dcbcsBO.exe
  2⤵
  PID:3364
- C:\Windows\System\ATovDWD.exe
  C:\Windows\System\ATovDWD.exe
  2⤵
  PID:2984
- C:\Windows\System\IrCBeoU.exe
  C:\Windows\System\IrCBeoU.exe
  2⤵
  PID:5124
- C:\Windows\System\HtwTjuP.exe
  C:\Windows\System\HtwTjuP.exe
  2⤵
  PID:5140
- C:\Windows\System\yfbDhLR.exe
  C:\Windows\System\yfbDhLR.exe
  2⤵
  PID:5156
- C:\Windows\System\VVRDsoS.exe
  C:\Windows\System\VVRDsoS.exe
  2⤵
  PID:5176
- C:\Windows\System\XuEHAtk.exe
  C:\Windows\System\XuEHAtk.exe
  2⤵
  PID:5192
- C:\Windows\System\dYVMQCe.exe
  C:\Windows\System\dYVMQCe.exe
  2⤵
  PID:5208
- C:\Windows\System\NVxzRrw.exe
  C:\Windows\System\NVxzRrw.exe
  2⤵
  PID:5224
- C:\Windows\System\HdxVBYo.exe
  C:\Windows\System\HdxVBYo.exe
  2⤵
  PID:5240
- C:\Windows\System\CEINuVn.exe
  C:\Windows\System\CEINuVn.exe
  2⤵
  PID:5256
- C:\Windows\System\pPBpSIl.exe
  C:\Windows\System\pPBpSIl.exe
  2⤵
  PID:5272
- C:\Windows\System\VOGJZVP.exe
  C:\Windows\System\VOGJZVP.exe
  2⤵
  PID:5288
- C:\Windows\System\hbqBbqf.exe
  C:\Windows\System\hbqBbqf.exe
  2⤵
  PID:5452
- C:\Windows\System\FvBUPPB.exe
  C:\Windows\System\FvBUPPB.exe
  2⤵
  PID:5476
- C:\Windows\System\xmfPyGL.exe
  C:\Windows\System\xmfPyGL.exe
  2⤵
  PID:5492
- C:\Windows\System\DdQmznX.exe
  C:\Windows\System\DdQmznX.exe
  2⤵
  PID:5508
- C:\Windows\System\sDmaDio.exe
  C:\Windows\System\sDmaDio.exe
  2⤵
  PID:5524
- C:\Windows\System\pFdKhTk.exe
  C:\Windows\System\pFdKhTk.exe
  2⤵
  PID:5540
- C:\Windows\System\tRsuENS.exe
  C:\Windows\System\tRsuENS.exe
  2⤵
  PID:5556
- C:\Windows\System\HzUQUWM.exe
  C:\Windows\System\HzUQUWM.exe
  2⤵
  PID:5572
- C:\Windows\System\zcHYGql.exe
  C:\Windows\System\zcHYGql.exe
  2⤵
  PID:5588
- C:\Windows\System\bMeVpaN.exe
  C:\Windows\System\bMeVpaN.exe
  2⤵
  PID:5604
- C:\Windows\System\UpSTbTx.exe
  C:\Windows\System\UpSTbTx.exe
  2⤵
  PID:5628
- C:\Windows\System\jFJxIJM.exe
  C:\Windows\System\jFJxIJM.exe
  2⤵
  PID:5644
- C:\Windows\System\zznOSfY.exe
  C:\Windows\System\zznOSfY.exe
  2⤵
  PID:5660
- C:\Windows\System\lDWBZer.exe
  C:\Windows\System\lDWBZer.exe
  2⤵
  PID:5676
- C:\Windows\System\nyRQDsm.exe
  C:\Windows\System\nyRQDsm.exe
  2⤵
  PID:5692
- C:\Windows\System\eKSLsvK.exe
  C:\Windows\System\eKSLsvK.exe
  2⤵
  PID:5708
- C:\Windows\System\JevMiHI.exe
  C:\Windows\System\JevMiHI.exe
  2⤵
  PID:5724
- C:\Windows\System\roGwUpU.exe
  C:\Windows\System\roGwUpU.exe
  2⤵
  PID:5740
- C:\Windows\System\zgzyexa.exe
  C:\Windows\System\zgzyexa.exe
  2⤵
  PID:5768
- C:\Windows\System\HywIewz.exe
  C:\Windows\System\HywIewz.exe
  2⤵
  PID:5892
- C:\Windows\System\sTGBJrq.exe
  C:\Windows\System\sTGBJrq.exe
  2⤵
  PID:5908
- C:\Windows\System\JgtWtKh.exe
  C:\Windows\System\JgtWtKh.exe
  2⤵
  PID:5928
- C:\Windows\System\ooGHCXe.exe
  C:\Windows\System\ooGHCXe.exe
  2⤵
  PID:5948
- C:\Windows\System\ikWslDj.exe
  C:\Windows\System\ikWslDj.exe
  2⤵
  PID:5964
- C:\Windows\System\SOHzxec.exe
  C:\Windows\System\SOHzxec.exe
  2⤵
  PID:5980
- C:\Windows\System\guWVqZF.exe
  C:\Windows\System\guWVqZF.exe
  2⤵
  PID:6016
- C:\Windows\System\VEpQCiP.exe
  C:\Windows\System\VEpQCiP.exe
  2⤵
  PID:3940
- C:\Windows\System\FCIqKNP.exe
  C:\Windows\System\FCIqKNP.exe
  2⤵
  PID:652
- C:\Windows\System\WSqOFKX.exe
  C:\Windows\System\WSqOFKX.exe
  2⤵
  PID:3252
- C:\Windows\System\LMjzDob.exe
  C:\Windows\System\LMjzDob.exe
  2⤵
  PID:4380
- C:\Windows\System\uusXCNG.exe
  C:\Windows\System\uusXCNG.exe
  2⤵
  PID:4484
- C:\Windows\System\UyqzDhe.exe
  C:\Windows\System\UyqzDhe.exe
  2⤵
  PID:4616
- C:\Windows\System\SixJmcc.exe
  C:\Windows\System\SixJmcc.exe
  2⤵
  PID:4680
- C:\Windows\System\PvwnZfA.exe
  C:\Windows\System\PvwnZfA.exe
  2⤵
  PID:4708
- C:\Windows\System\ZyLvaoz.exe
  C:\Windows\System\ZyLvaoz.exe
  2⤵
  PID:4880
- C:\Windows\System\Kgysyfv.exe
  C:\Windows\System\Kgysyfv.exe
  2⤵
  PID:4980
- C:\Windows\System\GwVSSHW.exe
  C:\Windows\System\GwVSSHW.exe
  2⤵
  PID:2672
- C:\Windows\System\vsuUKZN.exe
  C:\Windows\System\vsuUKZN.exe
  2⤵
  PID:3360
- C:\Windows\System\TzWiNQP.exe
  C:\Windows\System\TzWiNQP.exe
  2⤵
  PID:780
- C:\Windows\System\CwARgGF.exe
  C:\Windows\System\CwARgGF.exe
  2⤵
  PID:3092
- C:\Windows\System\NVauYji.exe
  C:\Windows\System\NVauYji.exe
  2⤵
  PID:5148
- C:\Windows\System\uWhyRMq.exe
  C:\Windows\System\uWhyRMq.exe
  2⤵
  PID:5152
- C:\Windows\System\NZUWGWj.exe
  C:\Windows\System\NZUWGWj.exe
  2⤵
  PID:3632
- C:\Windows\System\VVxRjyu.exe
  C:\Windows\System\VVxRjyu.exe
  2⤵
  PID:3760
- C:\Windows\System\indLHnC.exe
  C:\Windows\System\indLHnC.exe
  2⤵
  PID:2480
- C:\Windows\System\WLTNPMD.exe
  C:\Windows\System\WLTNPMD.exe
  2⤵
  PID:2116
- C:\Windows\System\MUenyPM.exe
  C:\Windows\System\MUenyPM.exe
  2⤵
  PID:5252
- C:\Windows\System\jmyxPXu.exe
  C:\Windows\System\jmyxPXu.exe
  2⤵
  PID:3456
- C:\Windows\System\csNWLvb.exe
  C:\Windows\System\csNWLvb.exe
  2⤵
  PID:4908
- C:\Windows\System\cpfqJRZ.exe
  C:\Windows\System\cpfqJRZ.exe
  2⤵
  PID:5220
- C:\Windows\System\hilwIMX.exe
  C:\Windows\System\hilwIMX.exe
  2⤵
  PID:3196
- C:\Windows\System\XrMVDZq.exe
  C:\Windows\System\XrMVDZq.exe
  2⤵
  PID:3948
- C:\Windows\System\mMQSoMV.exe
  C:\Windows\System\mMQSoMV.exe
  2⤵
  PID:3488
- C:\Windows\System\TvHERYS.exe
  C:\Windows\System\TvHERYS.exe
  2⤵
  PID:3484
- C:\Windows\System\UhRQMGq.exe
  C:\Windows\System\UhRQMGq.exe
  2⤵
  PID:3200
- C:\Windows\System\ByMcFGf.exe
  C:\Windows\System\ByMcFGf.exe
  2⤵
  PID:5168
- C:\Windows\System\rFvueJQ.exe
  C:\Windows\System\rFvueJQ.exe
  2⤵
  PID:5232
- C:\Windows\System\pNFEmfJ.exe
  C:\Windows\System\pNFEmfJ.exe
  2⤵
  PID:5316
- C:\Windows\System\hOzcXeT.exe
  C:\Windows\System\hOzcXeT.exe
  2⤵
  PID:5332
- C:\Windows\System\tEOLTPl.exe
  C:\Windows\System\tEOLTPl.exe
  2⤵
  PID:5348
- C:\Windows\System\BoCuajS.exe
  C:\Windows\System\BoCuajS.exe
  2⤵
  PID:5368
- C:\Windows\System\sbkkpgR.exe
  C:\Windows\System\sbkkpgR.exe
  2⤵
  PID:5384
- C:\Windows\System\bAZqVgh.exe
  C:\Windows\System\bAZqVgh.exe
  2⤵
  PID:5400
- C:\Windows\System\fvRGZRb.exe
  C:\Windows\System\fvRGZRb.exe
  2⤵
  PID:5420
- C:\Windows\System\aOxtvSQ.exe
  C:\Windows\System\aOxtvSQ.exe
  2⤵
  PID:5428
- C:\Windows\System\ORXLRnJ.exe
  C:\Windows\System\ORXLRnJ.exe
  2⤵
  PID:4136
- C:\Windows\System\hFyJnmf.exe
  C:\Windows\System\hFyJnmf.exe
  2⤵
  PID:4400
- C:\Windows\System\RgMaDvS.exe
  C:\Windows\System\RgMaDvS.exe
  2⤵
  PID:4436
- C:\Windows\System\TUmwcuy.exe
  C:\Windows\System\TUmwcuy.exe
  2⤵
  PID:4500
- C:\Windows\System\vfBlpbE.exe
  C:\Windows\System\vfBlpbE.exe
  2⤵
  PID:4564
- C:\Windows\System\RZThtWI.exe
  C:\Windows\System\RZThtWI.exe
  2⤵
  PID:4768
- C:\Windows\System\CIziEGm.exe
  C:\Windows\System\CIziEGm.exe
  2⤵
  PID:4724
- C:\Windows\System\MBaqXGJ.exe
  C:\Windows\System\MBaqXGJ.exe
  2⤵
  PID:4632
- C:\Windows\System\bxweWVU.exe
  C:\Windows\System\bxweWVU.exe
  2⤵
  PID:4596
- C:\Windows\System\INHULse.exe
  C:\Windows\System\INHULse.exe
  2⤵
  PID:4828
- C:\Windows\System\YhqBcoe.exe
  C:\Windows\System\YhqBcoe.exe
  2⤵
  PID:4896
- C:\Windows\System\TlDdqcl.exe
  C:\Windows\System\TlDdqcl.exe
  2⤵
  PID:4936
- C:\Windows\System\xbAvLcc.exe
  C:\Windows\System\xbAvLcc.exe
  2⤵
  PID:5032
- C:\Windows\System\pbEUiWu.exe
  C:\Windows\System\pbEUiWu.exe
  2⤵
  PID:5536
- C:\Windows\System\peCpYxT.exe
  C:\Windows\System\peCpYxT.exe
  2⤵
  PID:5596
- C:\Windows\System\TyOykZX.exe
  C:\Windows\System\TyOykZX.exe
  2⤵
  PID:5104
- C:\Windows\System\tfDSDgF.exe
  C:\Windows\System\tfDSDgF.exe
  2⤵
  PID:5296
- C:\Windows\System\NWyOQzb.exe
  C:\Windows\System\NWyOQzb.exe
  2⤵
  PID:5640
- C:\Windows\System\SfljAJj.exe
  C:\Windows\System\SfljAJj.exe
  2⤵
  PID:5520
- C:\Windows\System\hWLLlQm.exe
  C:\Windows\System\hWLLlQm.exe
  2⤵
  PID:5584
- C:\Windows\System\QCirXwD.exe
  C:\Windows\System\QCirXwD.exe
  2⤵
  PID:352
- C:\Windows\System\mpFKBJd.exe
  C:\Windows\System\mpFKBJd.exe
  2⤵
  PID:5484
- C:\Windows\System\moGcHhe.exe
  C:\Windows\System\moGcHhe.exe
  2⤵
  PID:5668
- C:\Windows\System\MaalLQA.exe
  C:\Windows\System\MaalLQA.exe
  2⤵
  PID:5620
- C:\Windows\System\McrRSir.exe
  C:\Windows\System\McrRSir.exe
  2⤵
  PID:5716
- C:\Windows\System\EpsAJai.exe
  C:\Windows\System\EpsAJai.exe
  2⤵
  PID:3004
- C:\Windows\System\RZkOlPc.exe
  C:\Windows\System\RZkOlPc.exe
  2⤵
  PID:5784
- C:\Windows\System\jyBEbzc.exe
  C:\Windows\System\jyBEbzc.exe
  2⤵
  PID:5792
- C:\Windows\System\wfQuiXP.exe
  C:\Windows\System\wfQuiXP.exe
  2⤵
  PID:5844
- C:\Windows\System\TxUHIEX.exe
  C:\Windows\System\TxUHIEX.exe
  2⤵
  PID:5824
- C:\Windows\System\VCfgKis.exe
  C:\Windows\System\VCfgKis.exe
  2⤵
  PID:5828
- C:\Windows\System\LkbTAba.exe
  C:\Windows\System\LkbTAba.exe
  2⤵
  PID:5860
- C:\Windows\System\LNXHvXX.exe
  C:\Windows\System\LNXHvXX.exe
  2⤵
  PID:5876
- C:\Windows\System\SLIQkyy.exe
  C:\Windows\System\SLIQkyy.exe
  2⤵
  PID:5900
- C:\Windows\System\pRyqdfX.exe
  C:\Windows\System\pRyqdfX.exe
  2⤵
  PID:5916
- C:\Windows\System\SrBvuKx.exe
  C:\Windows\System\SrBvuKx.exe
  2⤵
  PID:5944
- C:\Windows\System\dHSZbIS.exe
  C:\Windows\System\dHSZbIS.exe
  2⤵
  PID:5972
- C:\Windows\System\zznebTx.exe
  C:\Windows\System\zznebTx.exe
  2⤵
  PID:6004
- C:\Windows\System\NyOBGYo.exe
  C:\Windows\System\NyOBGYo.exe
  2⤵
  PID:6024
- C:\Windows\System\tBnvJcZ.exe
  C:\Windows\System\tBnvJcZ.exe
  2⤵
  PID:5444
- C:\Windows\System\IKbCsFe.exe
  C:\Windows\System\IKbCsFe.exe
  2⤵
  PID:6072
- C:\Windows\System\YBPTSIN.exe
  C:\Windows\System\YBPTSIN.exe
  2⤵
  PID:6040
- C:\Windows\System\eippQbI.exe
  C:\Windows\System\eippQbI.exe
  2⤵
  PID:6076
- C:\Windows\System\biumECV.exe
  C:\Windows\System\biumECV.exe
  2⤵
  PID:6100
- C:\Windows\System\JDuUZqV.exe
  C:\Windows\System\JDuUZqV.exe
  2⤵
  PID:6120
- C:\Windows\System\YgRhExN.exe
  C:\Windows\System\YgRhExN.exe
  2⤵
  PID:6132
- C:\Windows\System\YhqijpN.exe
  C:\Windows\System\YhqijpN.exe
  2⤵
  PID:1872
- C:\Windows\System\iyIKiRb.exe
  C:\Windows\System\iyIKiRb.exe
  2⤵
  PID:4068
- C:\Windows\System\pMnpVSF.exe
  C:\Windows\System\pMnpVSF.exe
  2⤵
  PID:4036
- C:\Windows\System\EvIvQFs.exe
  C:\Windows\System\EvIvQFs.exe
  2⤵
  PID:1264
- C:\Windows\System\kfpgcxv.exe
  C:\Windows\System\kfpgcxv.exe
  2⤵
  PID:4232
- C:\Windows\System\IWFnTIb.exe
  C:\Windows\System\IWFnTIb.exe
  2⤵
  PID:4204
- C:\Windows\System\bnXXlBQ.exe
  C:\Windows\System\bnXXlBQ.exe
  2⤵
  PID:4236
- C:\Windows\System\hzDcMsQ.exe
  C:\Windows\System\hzDcMsQ.exe
  2⤵
  PID:4284
- C:\Windows\System\psLiYTb.exe
  C:\Windows\System\psLiYTb.exe
  2⤵
  PID:4220
- C:\Windows\System\oYAVwTb.exe
  C:\Windows\System\oYAVwTb.exe
  2⤵
  PID:4320
- C:\Windows\System\CJrcaEg.exe
  C:\Windows\System\CJrcaEg.exe
  2⤵
  PID:4304
- C:\Windows\System\iKzoSqA.exe
  C:\Windows\System\iKzoSqA.exe
  2⤵
  PID:4156
- C:\Windows\System\BXopjii.exe
  C:\Windows\System\BXopjii.exe
  2⤵
  PID:4420
- C:\Windows\System\mIYMIpy.exe
  C:\Windows\System\mIYMIpy.exe
  2⤵
  PID:4512
- C:\Windows\System\fxvYbDs.exe
  C:\Windows\System\fxvYbDs.exe
  2⤵
  PID:4744
- C:\Windows\System\lmBpeCE.exe
  C:\Windows\System\lmBpeCE.exe
  2⤵
  PID:4876
- C:\Windows\System\PnQOELU.exe
  C:\Windows\System\PnQOELU.exe
  2⤵
  PID:4916
- C:\Windows\System\YhjwDDD.exe
  C:\Windows\System\YhjwDDD.exe
  2⤵
  PID:2600
- C:\Windows\System\PHhHwhs.exe
  C:\Windows\System\PHhHwhs.exe
  2⤵
  PID:5052
- C:\Windows\System\szunCLK.exe
  C:\Windows\System\szunCLK.exe
  2⤵
  PID:1712
- C:\Windows\System\CUlDdes.exe
  C:\Windows\System\CUlDdes.exe
  2⤵
  PID:3880
- C:\Windows\System\ZCGwclz.exe
  C:\Windows\System\ZCGwclz.exe
  2⤵
  PID:3436
- C:\Windows\System\SoIcwIq.exe
  C:\Windows\System\SoIcwIq.exe
  2⤵
  PID:3588
- C:\Windows\System\xqzaAfp.exe
  C:\Windows\System\xqzaAfp.exe
  2⤵
  PID:3696
- C:\Windows\System\KvxocvV.exe
  C:\Windows\System\KvxocvV.exe
  2⤵
  PID:2192
- C:\Windows\System\XtszoQK.exe
  C:\Windows\System\XtszoQK.exe
  2⤵
  PID:5280
- C:\Windows\System\CMmGsKh.exe
  C:\Windows\System\CMmGsKh.exe
  2⤵
  PID:3524
- C:\Windows\System\JxrZzav.exe
  C:\Windows\System\JxrZzav.exe
  2⤵
  PID:5324
- C:\Windows\System\pGAaKbv.exe
  C:\Windows\System\pGAaKbv.exe
  2⤵
  PID:5364
- C:\Windows\System\MhTJowY.exe
  C:\Windows\System\MhTJowY.exe
  2⤵
  PID:3988
- C:\Windows\System\KmkSMPd.exe
  C:\Windows\System\KmkSMPd.exe
  2⤵
  PID:1016
- C:\Windows\System\berSvbZ.exe
  C:\Windows\System\berSvbZ.exe
  2⤵
  PID:5436
- C:\Windows\System\BUAmRgw.exe
  C:\Windows\System\BUAmRgw.exe
  2⤵
  PID:5380
- C:\Windows\System\uctDKxW.exe
  C:\Windows\System\uctDKxW.exe
  2⤵
  PID:2276
- C:\Windows\System\OaqTLmQ.exe
  C:\Windows\System\OaqTLmQ.exe
  2⤵
  PID:3144
- C:\Windows\System\JMDCGOA.exe
  C:\Windows\System\JMDCGOA.exe
  2⤵
  PID:4332
- C:\Windows\System\puPlYge.exe
  C:\Windows\System\puPlYge.exe
  2⤵
  PID:4800
- C:\Windows\System\NnUDOkw.exe
  C:\Windows\System\NnUDOkw.exe
  2⤵
  PID:5472
- C:\Windows\System\lmBoQst.exe
  C:\Windows\System\lmBoQst.exe
  2⤵
  PID:5064
- C:\Windows\System\mnlrBRK.exe
  C:\Windows\System\mnlrBRK.exe
  2⤵
  PID:5552
- C:\Windows\System\DQtcdky.exe
  C:\Windows\System\DQtcdky.exe
  2⤵
  PID:5688
- C:\Windows\System\nZAsNzW.exe
  C:\Windows\System\nZAsNzW.exe
  2⤵
  PID:5700
- C:\Windows\System\veRDpTA.exe
  C:\Windows\System\veRDpTA.exe
  2⤵
  PID:5796
- C:\Windows\System\QJFkvvp.exe
  C:\Windows\System\QJFkvvp.exe
  2⤵
  PID:1260
- C:\Windows\System\ROQJKvc.exe
  C:\Windows\System\ROQJKvc.exe
  2⤵
  PID:2516
- C:\Windows\System\dLxfWas.exe
  C:\Windows\System\dLxfWas.exe
  2⤵
  PID:5340
- C:\Windows\System\JtUChUQ.exe
  C:\Windows\System\JtUChUQ.exe
  2⤵
  PID:4364
- C:\Windows\System\LicxgGE.exe
  C:\Windows\System\LicxgGE.exe
  2⤵
  PID:2936
- C:\Windows\System\MpzJGkL.exe
  C:\Windows\System\MpzJGkL.exe
  2⤵
  PID:2008
- C:\Windows\System\ywMgVXh.exe
  C:\Windows\System\ywMgVXh.exe
  2⤵
  PID:4628
- C:\Windows\System\swkhbHF.exe
  C:\Windows\System\swkhbHF.exe
  2⤵
  PID:4996
- C:\Windows\System\JukYGmW.exe
  C:\Windows\System\JukYGmW.exe
  2⤵
  PID:5300
- C:\Windows\System\AwzPdlJ.exe
  C:\Windows\System\AwzPdlJ.exe
  2⤵
  PID:5624
- C:\Windows\System\qQFOgZQ.exe
  C:\Windows\System\qQFOgZQ.exe
  2⤵
  PID:5732
- C:\Windows\System\SGcnVQQ.exe
  C:\Windows\System\SGcnVQQ.exe
  2⤵
  PID:5804
- C:\Windows\System\SBKlqVh.exe
  C:\Windows\System\SBKlqVh.exe
  2⤵
  PID:5852
- C:\Windows\System\uEHBTor.exe
  C:\Windows\System\uEHBTor.exe
  2⤵
  PID:5924
- C:\Windows\System\DVWNVCx.exe
  C:\Windows\System\DVWNVCx.exe
  2⤵
  PID:6000
- C:\Windows\System\FnGFdyJ.exe
  C:\Windows\System\FnGFdyJ.exe
  2⤵
  PID:6104
- C:\Windows\System\kcUIKSt.exe
  C:\Windows\System\kcUIKSt.exe
  2⤵
  PID:2580
- C:\Windows\System\mshbeIA.exe
  C:\Windows\System\mshbeIA.exe
  2⤵
  PID:2264
- C:\Windows\System\vGJMKDI.exe
  C:\Windows\System\vGJMKDI.exe
  2⤵
  PID:4268
- C:\Windows\System\JdXGqOx.exe
  C:\Windows\System\JdXGqOx.exe
  2⤵
  PID:4248
- C:\Windows\System\wdJqsBC.exe
  C:\Windows\System\wdJqsBC.exe
  2⤵
  PID:2564
- C:\Windows\System\LLCszhI.exe
  C:\Windows\System\LLCszhI.exe
  2⤵
  PID:5888
- C:\Windows\System\KyNuuje.exe
  C:\Windows\System\KyNuuje.exe
  2⤵
  PID:6064
- C:\Windows\System\PJoDOxv.exe
  C:\Windows\System\PJoDOxv.exe
  2⤵
  PID:3900
- C:\Windows\System\gawdDyJ.exe
  C:\Windows\System\gawdDyJ.exe
  2⤵
  PID:1652
- C:\Windows\System\lgnIvco.exe
  C:\Windows\System\lgnIvco.exe
  2⤵
  PID:4188
- C:\Windows\System\ShHzXjX.exe
  C:\Windows\System\ShHzXjX.exe
  2⤵
  PID:4584
- C:\Windows\System\wFuXcwL.exe
  C:\Windows\System\wFuXcwL.exe
  2⤵
  PID:3320
- C:\Windows\System\SZhCcSZ.exe
  C:\Windows\System\SZhCcSZ.exe
  2⤵
  PID:1460
- C:\Windows\System\vNMVIFr.exe
  C:\Windows\System\vNMVIFr.exe
  2⤵
  PID:3272
- C:\Windows\System\yHrEuHD.exe
  C:\Windows\System\yHrEuHD.exe
  2⤵
  PID:5204
- C:\Windows\System\bWZJTni.exe
  C:\Windows\System\bWZJTni.exe
  2⤵
  PID:4648
- C:\Windows\System\tqOMoop.exe
  C:\Windows\System\tqOMoop.exe
  2⤵
  PID:2164
- C:\Windows\System\gYjsRwJ.exe
  C:\Windows\System\gYjsRwJ.exe
  2⤵
  PID:4552
- C:\Windows\System\zlyhgOB.exe
  C:\Windows\System\zlyhgOB.exe
  2⤵
  PID:5068
- C:\Windows\System\Tbokuwg.exe
  C:\Windows\System\Tbokuwg.exe
  2⤵
  PID:4844
- C:\Windows\System\XhKjkke.exe
  C:\Windows\System\XhKjkke.exe
  2⤵
  PID:3128
- C:\Windows\System\UJtXPBi.exe
  C:\Windows\System\UJtXPBi.exe
  2⤵
  PID:2316
- C:\Windows\System\LcvsGKi.exe
  C:\Windows\System\LcvsGKi.exe
  2⤵
  PID:4496
- C:\Windows\System\HnUmdit.exe
  C:\Windows\System\HnUmdit.exe
  2⤵
  PID:5264
- C:\Windows\System\rMOKSpT.exe
  C:\Windows\System\rMOKSpT.exe
  2⤵
  PID:3460
- C:\Windows\System\PBGeYUs.exe
  C:\Windows\System\PBGeYUs.exe
  2⤵
  PID:5788
- C:\Windows\System\zVfaYbf.exe
  C:\Windows\System\zVfaYbf.exe
  2⤵
  PID:5748
- C:\Windows\System\zctsHvU.exe
  C:\Windows\System\zctsHvU.exe
  2⤵
  PID:2072
- C:\Windows\System\sgLqgvo.exe
  C:\Windows\System\sgLqgvo.exe
  2⤵
  PID:4536
- C:\Windows\System\rWZejps.exe
  C:\Windows\System\rWZejps.exe
  2⤵
  PID:5568
- C:\Windows\System\MUhVFHc.exe
  C:\Windows\System\MUhVFHc.exe
  2⤵
  PID:4760
- C:\Windows\System\AbRMjfZ.exe
  C:\Windows\System\AbRMjfZ.exe
  2⤵
  PID:3452
- C:\Windows\System\gUVGStg.exe
  C:\Windows\System\gUVGStg.exe
  2⤵
  PID:5996
- C:\Windows\System\RQfRZpL.exe
  C:\Windows\System\RQfRZpL.exe
  2⤵
  PID:5832
- C:\Windows\System\EpYHvDm.exe
  C:\Windows\System\EpYHvDm.exe
  2⤵
  PID:5884
- C:\Windows\System\Sofdtva.exe
  C:\Windows\System\Sofdtva.exe
  2⤵
  PID:1268
- C:\Windows\System\FdHWyjn.exe
  C:\Windows\System\FdHWyjn.exe
  2⤵
  PID:6092
- C:\Windows\System\zGIkIUN.exe
  C:\Windows\System\zGIkIUN.exe
  2⤵
  PID:2664
- C:\Windows\System\ryGpjqC.exe
  C:\Windows\System\ryGpjqC.exe
  2⤵
  PID:4452
- C:\Windows\System\jvRhhDa.exe
  C:\Windows\System\jvRhhDa.exe
  2⤵
  PID:6060
- C:\Windows\System\GdrTYyh.exe
  C:\Windows\System\GdrTYyh.exe
  2⤵
  PID:4812
- C:\Windows\System\wxyRmnU.exe
  C:\Windows\System\wxyRmnU.exe
  2⤵
  PID:4612
- C:\Windows\System\tAeaFni.exe
  C:\Windows\System\tAeaFni.exe
  2⤵
  PID:4664
- C:\Windows\System\wunqtZA.exe
  C:\Windows\System\wunqtZA.exe
  2⤵
  PID:4104
- C:\Windows\System\XGCiKEy.exe
  C:\Windows\System\XGCiKEy.exe
  2⤵
  PID:4780
- C:\Windows\System\GPawGEC.exe
  C:\Windows\System\GPawGEC.exe
  2⤵
  PID:1692
- C:\Windows\System\YfJPCrL.exe
  C:\Windows\System\YfJPCrL.exe
  2⤵
  PID:4464
- C:\Windows\System\hOLAheg.exe
  C:\Windows\System\hOLAheg.exe
  2⤵
  PID:4532
- C:\Windows\System\lVZARtp.exe
  C:\Windows\System\lVZARtp.exe
  2⤵
  PID:5988
- C:\Windows\System\oDpqVTK.exe
  C:\Windows\System\oDpqVTK.exe
  2⤵
  PID:4264
- C:\Windows\System\KsipqZC.exe
  C:\Windows\System\KsipqZC.exe
  2⤵
  PID:4316
- C:\Windows\System\xGzabJm.exe
  C:\Windows\System\xGzabJm.exe
  2⤵
  PID:4348
- C:\Windows\System\ePqaVPb.exe
  C:\Windows\System\ePqaVPb.exe
  2⤵
  PID:5504
- C:\Windows\System\ccNCgfH.exe
  C:\Windows\System\ccNCgfH.exe
  2⤵
  PID:6136
- C:\Windows\System\WIsWCwc.exe
  C:\Windows\System\WIsWCwc.exe
  2⤵
  PID:5872
- C:\Windows\System\vMFJBSG.exe
  C:\Windows\System\vMFJBSG.exe
  2⤵
  PID:5904
- C:\Windows\System\KtrwvaL.exe
  C:\Windows\System\KtrwvaL.exe
  2⤵
  PID:5344
- C:\Windows\System\eURZgiL.exe
  C:\Windows\System\eURZgiL.exe
  2⤵
  PID:2568
- C:\Windows\System\qWmTQjx.exe
  C:\Windows\System\qWmTQjx.exe
  2⤵
  PID:5652
- C:\Windows\System\QbkclBm.exe
  C:\Windows\System\QbkclBm.exe
  2⤵
  PID:1552
- C:\Windows\System\ifwNbvb.exe
  C:\Windows\System\ifwNbvb.exe
  2⤵
  PID:2144
- C:\Windows\System\AsDFAUa.exe
  C:\Windows\System\AsDFAUa.exe
  2⤵
  PID:4784
- C:\Windows\System\KEFLCyd.exe
  C:\Windows\System\KEFLCyd.exe
  2⤵
  PID:5356
- C:\Windows\System\VthKLvC.exe
  C:\Windows\System\VthKLvC.exe
  2⤵
  PID:4008
- C:\Windows\System\ijoGxVp.exe
  C:\Windows\System\ijoGxVp.exe
  2⤵
  PID:2740
- C:\Windows\System\mrKYWXz.exe
  C:\Windows\System\mrKYWXz.exe
  2⤵
  PID:4012
- C:\Windows\System\GrsreHR.exe
  C:\Windows\System\GrsreHR.exe
  2⤵
  PID:6156
- C:\Windows\System\HnoJTiV.exe
  C:\Windows\System\HnoJTiV.exe
  2⤵
  PID:6172
- C:\Windows\System\XPOhVZA.exe
  C:\Windows\System\XPOhVZA.exe
  2⤵
  PID:6188
- C:\Windows\System\sYLuzFU.exe
  C:\Windows\System\sYLuzFU.exe
  2⤵
  PID:6204
- C:\Windows\System\MhONRar.exe
  C:\Windows\System\MhONRar.exe
  2⤵
  PID:6220
- C:\Windows\System\vKZCxsk.exe
  C:\Windows\System\vKZCxsk.exe
  2⤵
  PID:6236
- C:\Windows\System\WswbPFL.exe
  C:\Windows\System\WswbPFL.exe
  2⤵
  PID:6252
- C:\Windows\System\JKKvUzf.exe
  C:\Windows\System\JKKvUzf.exe
  2⤵
  PID:6276
- C:\Windows\System\UVVQdaV.exe
  C:\Windows\System\UVVQdaV.exe
  2⤵
  PID:6292
- C:\Windows\System\gyDyLPu.exe
  C:\Windows\System\gyDyLPu.exe
  2⤵
  PID:6308
- C:\Windows\System\GBkKPLN.exe
  C:\Windows\System\GBkKPLN.exe
  2⤵
  PID:6324
- C:\Windows\System\PJJbLDk.exe
  C:\Windows\System\PJJbLDk.exe
  2⤵
  PID:6340
- C:\Windows\System\lUdvvkv.exe
  C:\Windows\System\lUdvvkv.exe
  2⤵
  PID:6356
- C:\Windows\System\ztzNuCH.exe
  C:\Windows\System\ztzNuCH.exe
  2⤵
  PID:6372
- C:\Windows\System\VJXQuzj.exe
  C:\Windows\System\VJXQuzj.exe
  2⤵
  PID:6388
- C:\Windows\System\bGSDxJO.exe
  C:\Windows\System\bGSDxJO.exe
  2⤵
  PID:6404
- C:\Windows\System\cIpAFaH.exe
  C:\Windows\System\cIpAFaH.exe
  2⤵
  PID:6424
- C:\Windows\System\yLYwcyM.exe
  C:\Windows\System\yLYwcyM.exe
  2⤵
  PID:6440
- C:\Windows\System\khMKQIL.exe
  C:\Windows\System\khMKQIL.exe
  2⤵
  PID:6456
- C:\Windows\System\bvgQNxI.exe
  C:\Windows\System\bvgQNxI.exe
  2⤵
  PID:6472
- C:\Windows\System\QZqgNel.exe
  C:\Windows\System\QZqgNel.exe
  2⤵
  PID:6488
- C:\Windows\System\ezsznHt.exe
  C:\Windows\System\ezsznHt.exe
  2⤵
  PID:6504
- C:\Windows\System\xkcEJUs.exe
  C:\Windows\System\xkcEJUs.exe
  2⤵
  PID:6520
- C:\Windows\System\LMkwRwm.exe
  C:\Windows\System\LMkwRwm.exe
  2⤵
  PID:6536
- C:\Windows\System\AFIqXgN.exe
  C:\Windows\System\AFIqXgN.exe
  2⤵
  PID:6552
- C:\Windows\System\ybBkCOa.exe
  C:\Windows\System\ybBkCOa.exe
  2⤵
  PID:6568
- C:\Windows\System\LrYPCVC.exe
  C:\Windows\System\LrYPCVC.exe
  2⤵
  PID:6584
- C:\Windows\System\CRYcmsE.exe
  C:\Windows\System\CRYcmsE.exe
  2⤵
  PID:6600
- C:\Windows\System\uTlrNLG.exe
  C:\Windows\System\uTlrNLG.exe
  2⤵
  PID:6616
- C:\Windows\System\DMNsRKL.exe
  C:\Windows\System\DMNsRKL.exe
  2⤵
  PID:6632
- C:\Windows\System\RZLLFBb.exe
  C:\Windows\System\RZLLFBb.exe
  2⤵
  PID:6648
- C:\Windows\System\tTOnKCp.exe
  C:\Windows\System\tTOnKCp.exe
  2⤵
  PID:6664
- C:\Windows\System\bjhMINi.exe
  C:\Windows\System\bjhMINi.exe
  2⤵
  PID:6680
- C:\Windows\System\GexkiYZ.exe
  C:\Windows\System\GexkiYZ.exe
  2⤵
  PID:6696
- C:\Windows\System\OKwkGLz.exe
  C:\Windows\System\OKwkGLz.exe
  2⤵
  PID:6712
- C:\Windows\System\TbfaIlw.exe
  C:\Windows\System\TbfaIlw.exe
  2⤵
  PID:6728
- C:\Windows\System\WzNHwsb.exe
  C:\Windows\System\WzNHwsb.exe
  2⤵
  PID:6744
- C:\Windows\System\nhQmlwS.exe
  C:\Windows\System\nhQmlwS.exe
  2⤵
  PID:6760
- C:\Windows\System\JxWbZEz.exe
  C:\Windows\System\JxWbZEz.exe
  2⤵
  PID:6776
- C:\Windows\System\OGRvxsg.exe
  C:\Windows\System\OGRvxsg.exe
  2⤵
  PID:6792
- C:\Windows\System\UPluupi.exe
  C:\Windows\System\UPluupi.exe
  2⤵
  PID:6812
- C:\Windows\System\MpMUBfE.exe
  C:\Windows\System\MpMUBfE.exe
  2⤵
  PID:6828
- C:\Windows\System\vjjPuDN.exe
  C:\Windows\System\vjjPuDN.exe
  2⤵
  PID:6844
- C:\Windows\System\iBWgaSY.exe
  C:\Windows\System\iBWgaSY.exe
  2⤵
  PID:6860
- C:\Windows\System\ekYzDVG.exe
  C:\Windows\System\ekYzDVG.exe
  2⤵
  PID:6876
- C:\Windows\System\IvmrfEa.exe
  C:\Windows\System\IvmrfEa.exe
  2⤵
  PID:6892
- C:\Windows\System\RvcEbwN.exe
  C:\Windows\System\RvcEbwN.exe
  2⤵
  PID:6908
- C:\Windows\System\rySFJmD.exe
  C:\Windows\System\rySFJmD.exe
  2⤵
  PID:6924
- C:\Windows\System\qLMeoXP.exe
  C:\Windows\System\qLMeoXP.exe
  2⤵
  PID:6940
- C:\Windows\System\iyQyYHZ.exe
  C:\Windows\System\iyQyYHZ.exe
  2⤵
  PID:6956
- C:\Windows\System\mWAUTXV.exe
  C:\Windows\System\mWAUTXV.exe
  2⤵
  PID:6972
- C:\Windows\System\uZKjnjU.exe
  C:\Windows\System\uZKjnjU.exe
  2⤵
  PID:6988
- C:\Windows\System\kKeQruI.exe
  C:\Windows\System\kKeQruI.exe
  2⤵
  PID:7004
- C:\Windows\System\vtbDAAR.exe
  C:\Windows\System\vtbDAAR.exe
  2⤵
  PID:7020
- C:\Windows\System\QGQBQIs.exe
  C:\Windows\System\QGQBQIs.exe
  2⤵
  PID:7036
- C:\Windows\System\FxPibbX.exe
  C:\Windows\System\FxPibbX.exe
  2⤵
  PID:7052
- C:\Windows\System\dgcuZAY.exe
  C:\Windows\System\dgcuZAY.exe
  2⤵
  PID:7068
- C:\Windows\System\nAkiGbV.exe
  C:\Windows\System\nAkiGbV.exe
  2⤵
  PID:7084
- C:\Windows\System\JDvEujt.exe
  C:\Windows\System\JDvEujt.exe
  2⤵
  PID:7100
- C:\Windows\System\sEdFdSy.exe
  C:\Windows\System\sEdFdSy.exe
  2⤵
  PID:7116
- C:\Windows\System\julCmaV.exe
  C:\Windows\System\julCmaV.exe
  2⤵
  PID:7132
- C:\Windows\System\FUdFLuS.exe
  C:\Windows\System\FUdFLuS.exe
  2⤵
  PID:7148
- C:\Windows\System\uUyvPOa.exe
  C:\Windows\System\uUyvPOa.exe
  2⤵
  PID:7164
- C:\Windows\System\iDAOAmJ.exe
  C:\Windows\System\iDAOAmJ.exe
  2⤵
  PID:6152
- C:\Windows\System\yJTJMzd.exe
  C:\Windows\System\yJTJMzd.exe
  2⤵
  PID:6212
- C:\Windows\System\rIesYgJ.exe
  C:\Windows\System\rIesYgJ.exe
  2⤵
  PID:1128
- C:\Windows\System\myXScQi.exe
  C:\Windows\System\myXScQi.exe
  2⤵
  PID:4892
- C:\Windows\System\GNMEyPA.exe
  C:\Windows\System\GNMEyPA.exe
  2⤵
  PID:6248
- C:\Windows\System\rEgRrzE.exe
  C:\Windows\System\rEgRrzE.exe
  2⤵
  PID:6228
- C:\Windows\System\UtHUmaE.exe
  C:\Windows\System\UtHUmaE.exe
  2⤵
  PID:6284
- C:\Windows\System\SKWKydu.exe
  C:\Windows\System\SKWKydu.exe
  2⤵
  PID:6316
- C:\Windows\System\BBapmsM.exe
  C:\Windows\System\BBapmsM.exe
  2⤵
  PID:6380
- C:\Windows\System\BSgEBcL.exe
  C:\Windows\System\BSgEBcL.exe
  2⤵
  PID:6420
- C:\Windows\System\pjreRsS.exe
  C:\Windows\System\pjreRsS.exe
  2⤵
  PID:6304
- C:\Windows\System\SKbcPcD.exe
  C:\Windows\System\SKbcPcD.exe
  2⤵
  PID:6396
- C:\Windows\System\MFYZVbl.exe
  C:\Windows\System\MFYZVbl.exe
  2⤵
  PID:6452
- C:\Windows\System\TZFyIuI.exe
  C:\Windows\System\TZFyIuI.exe
  2⤵
  PID:6512
- C:\Windows\System\jEjWDEP.exe
  C:\Windows\System\jEjWDEP.exe
  2⤵
  PID:6576
- C:\Windows\System\jbjIwyC.exe
  C:\Windows\System\jbjIwyC.exe
  2⤵
  PID:6640
- C:\Windows\System\qWeXOKP.exe
  C:\Windows\System\qWeXOKP.exe
  2⤵
  PID:6704
- C:\Windows\System\MbtlEmb.exe
  C:\Windows\System\MbtlEmb.exe
  2⤵
  PID:6592
- C:\Windows\System\anmYlRh.exe
  C:\Windows\System\anmYlRh.exe
  2⤵
  PID:6528
- C:\Windows\System\KfmsCUe.exe
  C:\Windows\System\KfmsCUe.exe
  2⤵
  PID:6596
- C:\Windows\System\YFGdkOD.exe
  C:\Windows\System\YFGdkOD.exe
  2⤵
  PID:6688
- C:\Windows\System\HBQgQKN.exe
  C:\Windows\System\HBQgQKN.exe
  2⤵
  PID:6740
- C:\Windows\System\lpUzDOP.exe
  C:\Windows\System\lpUzDOP.exe
  2⤵
  PID:6772
- C:\Windows\System\UTgHYNl.exe
  C:\Windows\System\UTgHYNl.exe
  2⤵
  PID:6964
- C:\Windows\System\DEjIzpQ.exe
  C:\Windows\System\DEjIzpQ.exe
  2⤵
  PID:6948
- C:\Windows\System\lPigfBW.exe
  C:\Windows\System\lPigfBW.exe
  2⤵
  PID:6788
- C:\Windows\System\LZgDwnR.exe
  C:\Windows\System\LZgDwnR.exe
  2⤵
  PID:6952
- C:\Windows\System\qHKXmHn.exe
  C:\Windows\System\qHKXmHn.exe
  2⤵
  PID:6980
- C:\Windows\System\vyiTgBN.exe
  C:\Windows\System\vyiTgBN.exe
  2⤵
  PID:7044
- C:\Windows\System\lAreZEN.exe
  C:\Windows\System\lAreZEN.exe
  2⤵
  PID:7060
- C:\Windows\System\VhmeAdc.exe
  C:\Windows\System\VhmeAdc.exe
  2⤵
  PID:7124
- C:\Windows\System\EaqZrKC.exe
  C:\Windows\System\EaqZrKC.exe
  2⤵
  PID:2596
- C:\Windows\System\hsOHcGq.exe
  C:\Windows\System\hsOHcGq.exe
  2⤵
  PID:6168
- C:\Windows\System\yOTvump.exe
  C:\Windows\System\yOTvump.exe
  2⤵
  PID:6300
- C:\Windows\System\JuNjrWX.exe
  C:\Windows\System\JuNjrWX.exe
  2⤵
  PID:6480
- C:\Windows\System\HTSMQpu.exe
  C:\Windows\System\HTSMQpu.exe
  2⤵
  PID:6736
- C:\Windows\System\kzpcnrj.exe
  C:\Windows\System\kzpcnrj.exe
  2⤵
  PID:5200
- C:\Windows\System\ezPFsXY.exe
  C:\Windows\System\ezPFsXY.exe
  2⤵
  PID:6264
- C:\Windows\System\wMVJHDG.exe
  C:\Windows\System\wMVJHDG.exe
  2⤵
  PID:6448
- C:\Windows\System\RQzINea.exe
  C:\Windows\System\RQzINea.exe
  2⤵
  PID:7108
- C:\Windows\System\sgFruRj.exe
  C:\Windows\System\sgFruRj.exe
  2⤵
  PID:4140
- C:\Windows\System\juUFViQ.exe
  C:\Windows\System\juUFViQ.exe
  2⤵
  PID:6548
- C:\Windows\System\ifrdVOY.exe
  C:\Windows\System\ifrdVOY.exe
  2⤵
  PID:6496
- C:\Windows\System\SsQCrFO.exe
  C:\Windows\System\SsQCrFO.exe
  2⤵
  PID:6836
- C:\Windows\System\tGgRDwN.exe
  C:\Windows\System\tGgRDwN.exe
  2⤵
  PID:6800
- C:\Windows\System\iwNeQTV.exe
  C:\Windows\System\iwNeQTV.exe
  2⤵
  PID:5012
- C:\Windows\System\lNGnqmO.exe
  C:\Windows\System\lNGnqmO.exe
  2⤵
  PID:6784
- C:\Windows\System\SdFMQhu.exe
  C:\Windows\System\SdFMQhu.exe
  2⤵
  PID:6916
- C:\Windows\System\lyEHzYC.exe
  C:\Windows\System\lyEHzYC.exe
  2⤵
  PID:7156
- C:\Windows\System\mAOQsIH.exe
  C:\Windows\System\mAOQsIH.exe
  2⤵
  PID:6608
- C:\Windows\System\JZMKing.exe
  C:\Windows\System\JZMKing.exe
  2⤵
  PID:7076
- C:\Windows\System\kKSNADu.exe
  C:\Windows\System\kKSNADu.exe
  2⤵
  PID:6432
- C:\Windows\System\GmFUJlF.exe
  C:\Windows\System\GmFUJlF.exe
  2⤵
  PID:6868
- C:\Windows\System\gwDSsex.exe
  C:\Windows\System\gwDSsex.exe
  2⤵
  PID:6268
- C:\Windows\System\SsJnMxj.exe
  C:\Windows\System\SsJnMxj.exe
  2⤵
  PID:6856
- C:\Windows\System\kTwaxbG.exe
  C:\Windows\System\kTwaxbG.exe
  2⤵
  PID:6824
- C:\Windows\System\qLmpgWx.exe
  C:\Windows\System\qLmpgWx.exe
  2⤵
  PID:7096
- C:\Windows\System\EYXbgwK.exe
  C:\Windows\System\EYXbgwK.exe
  2⤵
  PID:4092
- C:\Windows\System\cQiYyfk.exe
  C:\Windows\System\cQiYyfk.exe
  2⤵
  PID:5812
- C:\Windows\System\zoXUumB.exe
  C:\Windows\System\zoXUumB.exe
  2⤵
  PID:7140
- C:\Windows\System\KHaeJxz.exe
  C:\Windows\System\KHaeJxz.exe
  2⤵
  PID:7016
- C:\Windows\System\dPVoton.exe
  C:\Windows\System\dPVoton.exe
  2⤵
  PID:6904
- C:\Windows\System\hMWnNAI.exe
  C:\Windows\System\hMWnNAI.exe
  2⤵
  PID:6260
- C:\Windows\System\zkjsJAD.exe
  C:\Windows\System\zkjsJAD.exe
  2⤵
  PID:7080
- C:\Windows\System\iAWbvAZ.exe
  C:\Windows\System\iAWbvAZ.exe
  2⤵
  PID:6368
- C:\Windows\System\NhERTiv.exe
  C:\Windows\System\NhERTiv.exe
  2⤵
  PID:6656
- C:\Windows\System\wokjwCP.exe
  C:\Windows\System\wokjwCP.exe
  2⤵
  PID:7092
- C:\Windows\System\daZtReC.exe
  C:\Windows\System\daZtReC.exe
  2⤵
  PID:7012
- C:\Windows\System\TAzexeC.exe
  C:\Windows\System\TAzexeC.exe
  2⤵
  PID:6332
- C:\Windows\System\oqSZOMF.exe
  C:\Windows\System\oqSZOMF.exe
  2⤵
  PID:7184
- C:\Windows\System\cwBccXv.exe
  C:\Windows\System\cwBccXv.exe
  2⤵
  PID:7200
- C:\Windows\System\HmeBAzl.exe
  C:\Windows\System\HmeBAzl.exe
  2⤵
  PID:7220
- C:\Windows\System\xueUBYp.exe
  C:\Windows\System\xueUBYp.exe
  2⤵
  PID:7236
- C:\Windows\System\aooSuNu.exe
  C:\Windows\System\aooSuNu.exe
  2⤵
  PID:7252
- C:\Windows\System\DKeCDdK.exe
  C:\Windows\System\DKeCDdK.exe
  2⤵
  PID:7268
- C:\Windows\System\NUjQVXn.exe
  C:\Windows\System\NUjQVXn.exe
  2⤵
  PID:7284
- C:\Windows\System\Lvasrlf.exe
  C:\Windows\System\Lvasrlf.exe
  2⤵
  PID:7300
- C:\Windows\System\JxASYlZ.exe
  C:\Windows\System\JxASYlZ.exe
  2⤵
  PID:7316
- C:\Windows\System\HZviBFl.exe
  C:\Windows\System\HZviBFl.exe
  2⤵
  PID:7336
- C:\Windows\System\vpSlpXG.exe
  C:\Windows\System\vpSlpXG.exe
  2⤵
  PID:7352
- C:\Windows\System\lGGNgpC.exe
  C:\Windows\System\lGGNgpC.exe
  2⤵
  PID:7368
- C:\Windows\System\UQyRpMa.exe
  C:\Windows\System\UQyRpMa.exe
  2⤵
  PID:7384
- C:\Windows\System\TyLcuRK.exe
  C:\Windows\System\TyLcuRK.exe
  2⤵
  PID:7400
- C:\Windows\System\iVNMJbU.exe
  C:\Windows\System\iVNMJbU.exe
  2⤵
  PID:7416
- C:\Windows\System\bJrqWwu.exe
  C:\Windows\System\bJrqWwu.exe
  2⤵
  PID:7432
- C:\Windows\System\vJEYOke.exe
  C:\Windows\System\vJEYOke.exe
  2⤵
  PID:7452
- C:\Windows\System\EcwEYFk.exe
  C:\Windows\System\EcwEYFk.exe
  2⤵
  PID:7468
- C:\Windows\System\FiYxqyc.exe
  C:\Windows\System\FiYxqyc.exe
  2⤵
  PID:7484
- C:\Windows\System\TcytjAg.exe
  C:\Windows\System\TcytjAg.exe
  2⤵
  PID:7500
- C:\Windows\System\GRpAspW.exe
  C:\Windows\System\GRpAspW.exe
  2⤵
  PID:7516
- C:\Windows\System\JDFDulZ.exe
  C:\Windows\System\JDFDulZ.exe
  2⤵
  PID:7532
- C:\Windows\System\sZMdvkW.exe
  C:\Windows\System\sZMdvkW.exe
  2⤵
  PID:7552
- C:\Windows\System\JWmpOGm.exe
  C:\Windows\System\JWmpOGm.exe
  2⤵
  PID:7568
- C:\Windows\System\ndTAgOt.exe
  C:\Windows\System\ndTAgOt.exe
  2⤵
  PID:7584
- C:\Windows\System\eADbkHM.exe
  C:\Windows\System\eADbkHM.exe
  2⤵
  PID:7600
- C:\Windows\System\IaZyFIl.exe
  C:\Windows\System\IaZyFIl.exe
  2⤵
  PID:7616
- C:\Windows\System\MSPYkmO.exe
  C:\Windows\System\MSPYkmO.exe
  2⤵
  PID:7632
- C:\Windows\System\dqxjXOy.exe
  C:\Windows\System\dqxjXOy.exe
  2⤵
  PID:7648
- C:\Windows\System\JSkSjlz.exe
  C:\Windows\System\JSkSjlz.exe
  2⤵
  PID:7664
- C:\Windows\System\cKUGonr.exe
  C:\Windows\System\cKUGonr.exe
  2⤵
  PID:7680
- C:\Windows\System\jCqHyOK.exe
  C:\Windows\System\jCqHyOK.exe
  2⤵
  PID:7696
- C:\Windows\System\njIXUHy.exe
  C:\Windows\System\njIXUHy.exe
  2⤵
  PID:7712
- C:\Windows\System\HNBJCaD.exe
  C:\Windows\System\HNBJCaD.exe
  2⤵
  PID:7728
- C:\Windows\System\fCXEuSp.exe
  C:\Windows\System\fCXEuSp.exe
  2⤵
  PID:7748
- C:\Windows\System\BvNeMFp.exe
  C:\Windows\System\BvNeMFp.exe
  2⤵
  PID:7776
- C:\Windows\System\hjUGRPx.exe
  C:\Windows\System\hjUGRPx.exe
  2⤵
  PID:7792
- C:\Windows\System\dQdTdOd.exe
  C:\Windows\System\dQdTdOd.exe
  2⤵
  PID:7808
- C:\Windows\System\aXTDNSa.exe
  C:\Windows\System\aXTDNSa.exe
  2⤵
  PID:7844
- C:\Windows\System\QqltPYg.exe
  C:\Windows\System\QqltPYg.exe
  2⤵
  PID:7912
- C:\Windows\System\YEmhYTJ.exe
  C:\Windows\System\YEmhYTJ.exe
  2⤵
  PID:7928
- C:\Windows\System\HYSCfze.exe
  C:\Windows\System\HYSCfze.exe
  2⤵
  PID:7944
- C:\Windows\System\caRBdSU.exe
  C:\Windows\System\caRBdSU.exe
  2⤵
  PID:7960
- C:\Windows\System\gLnWSFw.exe
  C:\Windows\System\gLnWSFw.exe
  2⤵
  PID:7984
- C:\Windows\System\uNtsqoN.exe
  C:\Windows\System\uNtsqoN.exe
  2⤵
  PID:8000
- C:\Windows\System\VAuePzr.exe
  C:\Windows\System\VAuePzr.exe
  2⤵
  PID:8016
- C:\Windows\System\DzSUSpZ.exe
  C:\Windows\System\DzSUSpZ.exe
  2⤵
  PID:8032
- C:\Windows\System\XGndmfu.exe
  C:\Windows\System\XGndmfu.exe
  2⤵
  PID:8048
- C:\Windows\System\xZCAsqa.exe
  C:\Windows\System\xZCAsqa.exe
  2⤵
  PID:8064
- C:\Windows\System\hTkdzSP.exe
  C:\Windows\System\hTkdzSP.exe
  2⤵
  PID:8080
- C:\Windows\System\erLiFXR.exe
  C:\Windows\System\erLiFXR.exe
  2⤵
  PID:8096
- C:\Windows\System\QLqufNT.exe
  C:\Windows\System\QLqufNT.exe
  2⤵
  PID:8112
- C:\Windows\System\WKCXEXX.exe
  C:\Windows\System\WKCXEXX.exe
  2⤵
  PID:8128
- C:\Windows\System\vvSOZrY.exe
  C:\Windows\System\vvSOZrY.exe
  2⤵
  PID:8144
- C:\Windows\System\RmEXshA.exe
  C:\Windows\System\RmEXshA.exe
  2⤵
  PID:8160
- C:\Windows\System\xdWGdFV.exe
  C:\Windows\System\xdWGdFV.exe
  2⤵
  PID:8176
- C:\Windows\System\NvHOtDR.exe
  C:\Windows\System\NvHOtDR.exe
  2⤵
  PID:6804
- C:\Windows\System\oFXeYqF.exe
  C:\Windows\System\oFXeYqF.exe
  2⤵
  PID:7176
- C:\Windows\System\qoTCvjl.exe
  C:\Windows\System\qoTCvjl.exe
  2⤵
  PID:7192
- C:\Windows\System\ZKtKssk.exe
  C:\Windows\System\ZKtKssk.exe
  2⤵
  PID:7276
- C:\Windows\System\oJMjcgc.exe
  C:\Windows\System\oJMjcgc.exe
  2⤵
  PID:7308
- C:\Windows\System\PHYHsel.exe
  C:\Windows\System\PHYHsel.exe
  2⤵
  PID:7332
- C:\Windows\System\MvzzIcN.exe
  C:\Windows\System\MvzzIcN.exe
  2⤵
  PID:7348
- C:\Windows\System\AbthMRr.exe
  C:\Windows\System\AbthMRr.exe
  2⤵
  PID:7360
- C:\Windows\System\riOSQTw.exe
  C:\Windows\System\riOSQTw.exe
  2⤵
  PID:7412
- C:\Windows\System\TRZiojU.exe
  C:\Windows\System\TRZiojU.exe
  2⤵
  PID:7428
- C:\Windows\System\GWpDuFU.exe
  C:\Windows\System\GWpDuFU.exe
  2⤵
  PID:7464
- C:\Windows\System\cUKFXMg.exe
  C:\Windows\System\cUKFXMg.exe
  2⤵
  PID:7512
- C:\Windows\System\ywESRRx.exe
  C:\Windows\System\ywESRRx.exe
  2⤵
  PID:7528
- C:\Windows\System\glnCgIE.exe
  C:\Windows\System\glnCgIE.exe
  2⤵
  PID:7576
- C:\Windows\System\sEEDwlP.exe
  C:\Windows\System\sEEDwlP.exe
  2⤵
  PID:7640
- C:\Windows\System\UteiNXq.exe
  C:\Windows\System\UteiNXq.exe
  2⤵
  PID:7676
- C:\Windows\System\KQKlshk.exe
  C:\Windows\System\KQKlshk.exe
  2⤵
  PID:7624
- C:\Windows\System\CSvQcGV.exe
  C:\Windows\System\CSvQcGV.exe
  2⤵
  PID:7704
- C:\Windows\System\VtbFiiK.exe
  C:\Windows\System\VtbFiiK.exe
  2⤵
  PID:7736
- C:\Windows\System\HkDJpcb.exe
  C:\Windows\System\HkDJpcb.exe
  2⤵
  PID:6936
- C:\Windows\System\cCriLCA.exe
  C:\Windows\System\cCriLCA.exe
  2⤵
  PID:7800
- C:\Windows\System\TUXsTyo.exe
  C:\Windows\System\TUXsTyo.exe
  2⤵
  PID:7768
- C:\Windows\System\mRQayZk.exe
  C:\Windows\System\mRQayZk.exe
  2⤵
  PID:7816
- C:\Windows\System\HMGMrHy.exe
  C:\Windows\System\HMGMrHy.exe
  2⤵
  PID:7832
- C:\Windows\System\BbvYkrM.exe
  C:\Windows\System\BbvYkrM.exe
  2⤵
  PID:7860
- C:\Windows\System\LIyrIrI.exe
  C:\Windows\System\LIyrIrI.exe
  2⤵
  PID:7876
- C:\Windows\System\LLmwoRO.exe
  C:\Windows\System\LLmwoRO.exe
  2⤵
  PID:7892
- C:\Windows\System\KaapFuG.exe
  C:\Windows\System\KaapFuG.exe
  2⤵
  PID:7920
- C:\Windows\System\KJEDvbc.exe
  C:\Windows\System\KJEDvbc.exe
  2⤵
  PID:7992
- C:\Windows\System\sbxLsId.exe
  C:\Windows\System\sbxLsId.exe
  2⤵
  PID:7980
- C:\Windows\System\mLrgyxQ.exe
  C:\Windows\System\mLrgyxQ.exe
  2⤵
  PID:7936
- C:\Windows\System\puBgItA.exe
  C:\Windows\System\puBgItA.exe
  2⤵
  PID:8028
- C:\Windows\System\WIrvnix.exe
  C:\Windows\System\WIrvnix.exe
  2⤵
  PID:8088
- C:\Windows\System\nYEpesn.exe
  C:\Windows\System\nYEpesn.exe
  2⤵
  PID:8152
- C:\Windows\System\WGeMHkp.exe
  C:\Windows\System\WGeMHkp.exe
  2⤵
  PID:8188
- C:\Windows\System\nYMEuYs.exe
  C:\Windows\System\nYMEuYs.exe
  2⤵
  PID:7216
- C:\Windows\System\cvVqQSf.exe
  C:\Windows\System\cvVqQSf.exe
  2⤵
  PID:7324
- C:\Windows\System\SclRKqb.exe
  C:\Windows\System\SclRKqb.exe
  2⤵
  PID:8072
- C:\Windows\System\AGyzJsH.exe
  C:\Windows\System\AGyzJsH.exe
  2⤵
  PID:8140
- C:\Windows\System\TkZVEny.exe
  C:\Windows\System\TkZVEny.exe
  2⤵
  PID:7312
- C:\Windows\System\vBAhIoR.exe
  C:\Windows\System\vBAhIoR.exe
  2⤵
  PID:7244
- C:\Windows\System\DWfAmjM.exe
  C:\Windows\System\DWfAmjM.exe
  2⤵
  PID:7380
- C:\Windows\System\fnmxRvh.exe
  C:\Windows\System\fnmxRvh.exe
  2⤵
  PID:7524
- C:\Windows\System\aHyWhYR.exe
  C:\Windows\System\aHyWhYR.exe
  2⤵
  PID:7548
- C:\Windows\System\blIVOOZ.exe
  C:\Windows\System\blIVOOZ.exe
  2⤵
  PID:7560
- C:\Windows\System\mptJdLi.exe
  C:\Windows\System\mptJdLi.exe
  2⤵
  PID:7744
- C:\Windows\System\ZPWrtSp.exe
  C:\Windows\System\ZPWrtSp.exe
  2⤵
  PID:7788
- C:\Windows\System\CJteCtX.exe
  C:\Windows\System\CJteCtX.exe
  2⤵
  PID:7884
- C:\Windows\System\TCFxcbt.exe
  C:\Windows\System\TCFxcbt.exe
  2⤵
  PID:7828
- C:\Windows\System\YQPftKw.exe
  C:\Windows\System\YQPftKw.exe
  2⤵
  PID:7952
- C:\Windows\System\wWkCCZm.exe
  C:\Windows\System\wWkCCZm.exe
  2⤵
  PID:8056
- C:\Windows\System\dZyrXth.exe
  C:\Windows\System\dZyrXth.exe
  2⤵
  PID:8024
- C:\Windows\System\xfQTJrS.exe
  C:\Windows\System\xfQTJrS.exe
  2⤵
  PID:7392
- C:\Windows\System\zNvuztA.exe
  C:\Windows\System\zNvuztA.exe
  2⤵
  PID:7480
- C:\Windows\System\xipFJjG.exe
  C:\Windows\System\xipFJjG.exe
  2⤵
  PID:8172
- C:\Windows\System\Ookzkvp.exe
  C:\Windows\System\Ookzkvp.exe
  2⤵
  PID:7908
- C:\Windows\System\MaArPYz.exe
  C:\Windows\System\MaArPYz.exe
  2⤵
  PID:7000
- C:\Windows\System\DgoaftC.exe
  C:\Windows\System\DgoaftC.exe
  2⤵
  PID:7824
- C:\Windows\System\BSkPAok.exe
  C:\Windows\System\BSkPAok.exe
  2⤵
  PID:7396
- C:\Windows\System\dPKlYDP.exe
  C:\Windows\System\dPKlYDP.exe
  2⤵
  PID:8012
- C:\Windows\System\QUZUKpL.exe
  C:\Windows\System\QUZUKpL.exe
  2⤵
  PID:7280
- C:\Windows\System\YNdIJBl.exe
  C:\Windows\System\YNdIJBl.exe
  2⤵
  PID:2788
- C:\Windows\System\vJlYULh.exe
  C:\Windows\System\vJlYULh.exe
  2⤵
  PID:7972
- C:\Windows\System\eSsnUur.exe
  C:\Windows\System\eSsnUur.exe
  2⤵
  PID:8184
- C:\Windows\System\bijdDLT.exe
  C:\Windows\System\bijdDLT.exe
  2⤵
  PID:7544
- C:\Windows\System\nIFUJKR.exe
  C:\Windows\System\nIFUJKR.exe
  2⤵
  PID:7656
- C:\Windows\System\vzhfRnX.exe
  C:\Windows\System\vzhfRnX.exe
  2⤵
  PID:7460
- C:\Windows\System\kVUDXEu.exe
  C:\Windows\System\kVUDXEu.exe
  2⤵
  PID:7492
- C:\Windows\System\uvuvjlT.exe
  C:\Windows\System\uvuvjlT.exe
  2⤵
  PID:7756
- C:\Windows\System\jZHyrjv.exe
  C:\Windows\System\jZHyrjv.exe
  2⤵
  PID:7660
- C:\Windows\System\yyaWsMW.exe
  C:\Windows\System\yyaWsMW.exe
  2⤵
  PID:7564
- C:\Windows\System\TJZryvO.exe
  C:\Windows\System\TJZryvO.exe
  2⤵
  PID:8204
- C:\Windows\System\XyNKpXj.exe
  C:\Windows\System\XyNKpXj.exe
  2⤵
  PID:8220
- C:\Windows\System\ijUmpes.exe
  C:\Windows\System\ijUmpes.exe
  2⤵
  PID:8236
- C:\Windows\System\GJzSYsx.exe
  C:\Windows\System\GJzSYsx.exe
  2⤵
  PID:8252
- C:\Windows\System\vKYhuSp.exe
  C:\Windows\System\vKYhuSp.exe
  2⤵
  PID:8268
- C:\Windows\System\SsFwNsO.exe
  C:\Windows\System\SsFwNsO.exe
  2⤵
  PID:8284
- C:\Windows\System\ivjeGIJ.exe
  C:\Windows\System\ivjeGIJ.exe
  2⤵
  PID:8300
- C:\Windows\System\XQtbhTV.exe
  C:\Windows\System\XQtbhTV.exe
  2⤵
  PID:8316
- C:\Windows\System\uaplyKt.exe
  C:\Windows\System\uaplyKt.exe
  2⤵
  PID:8332
- C:\Windows\System\UmuhsOG.exe
  C:\Windows\System\UmuhsOG.exe
  2⤵
  PID:8348
- C:\Windows\System\tFkImtp.exe
  C:\Windows\System\tFkImtp.exe
  2⤵
  PID:8364
- C:\Windows\System\slDGSpO.exe
  C:\Windows\System\slDGSpO.exe
  2⤵
  PID:8380
- C:\Windows\System\IGBMOCX.exe
  C:\Windows\System\IGBMOCX.exe
  2⤵
  PID:8396
- C:\Windows\System\zNoKPLI.exe
  C:\Windows\System\zNoKPLI.exe
  2⤵
  PID:8412
- C:\Windows\System\nNGYLUT.exe
  C:\Windows\System\nNGYLUT.exe
  2⤵
  PID:8428
- C:\Windows\System\iGVyoGX.exe
  C:\Windows\System\iGVyoGX.exe
  2⤵
  PID:8444
- C:\Windows\System\gTsRgfT.exe
  C:\Windows\System\gTsRgfT.exe
  2⤵
  PID:8460
- C:\Windows\System\VtAsFra.exe
  C:\Windows\System\VtAsFra.exe
  2⤵
  PID:8476
- C:\Windows\System\dtsBsAO.exe
  C:\Windows\System\dtsBsAO.exe
  2⤵
  PID:8492
- C:\Windows\System\PIOLewy.exe
  C:\Windows\System\PIOLewy.exe
  2⤵
  PID:8508
- C:\Windows\System\FJuXIXY.exe
  C:\Windows\System\FJuXIXY.exe
  2⤵
  PID:8524
- C:\Windows\System\SqovcVo.exe
  C:\Windows\System\SqovcVo.exe
  2⤵
  PID:8540
- C:\Windows\System\RLbHpYO.exe
  C:\Windows\System\RLbHpYO.exe
  2⤵
  PID:8556
- C:\Windows\System\QrmzuQl.exe
  C:\Windows\System\QrmzuQl.exe
  2⤵
  PID:8572
- C:\Windows\System\DYLTtky.exe
  C:\Windows\System\DYLTtky.exe
  2⤵
  PID:8588
- C:\Windows\System\OrNlGyG.exe
  C:\Windows\System\OrNlGyG.exe
  2⤵
  PID:8604
- C:\Windows\System\MxDKesv.exe
  C:\Windows\System\MxDKesv.exe
  2⤵
  PID:8620
- C:\Windows\System\pMxdwkO.exe
  C:\Windows\System\pMxdwkO.exe
  2⤵
  PID:8636
- C:\Windows\System\aoSepKV.exe
  C:\Windows\System\aoSepKV.exe
  2⤵
  PID:8652
- C:\Windows\System\mVAXcAS.exe
  C:\Windows\System\mVAXcAS.exe
  2⤵
  PID:8668
- C:\Windows\System\JyFZSHA.exe
  C:\Windows\System\JyFZSHA.exe
  2⤵
  PID:8684
- C:\Windows\System\ALedUcy.exe
  C:\Windows\System\ALedUcy.exe
  2⤵
  PID:8700
- C:\Windows\System\JVunykL.exe
  C:\Windows\System\JVunykL.exe
  2⤵
  PID:8716
- C:\Windows\System\gaOknjQ.exe
  C:\Windows\System\gaOknjQ.exe
  2⤵
  PID:8732
- C:\Windows\System\OoRlAYr.exe
  C:\Windows\System\OoRlAYr.exe
  2⤵
  PID:8748
- C:\Windows\System\wcjOtxW.exe
  C:\Windows\System\wcjOtxW.exe
  2⤵
  PID:8764
- C:\Windows\System\LtgRWGM.exe
  C:\Windows\System\LtgRWGM.exe
  2⤵
  PID:8780
- C:\Windows\System\FgCuhRM.exe
  C:\Windows\System\FgCuhRM.exe
  2⤵
  PID:8796
- C:\Windows\System\JsUUAeF.exe
  C:\Windows\System\JsUUAeF.exe
  2⤵
  PID:8812
- C:\Windows\System\fsSALdK.exe
  C:\Windows\System\fsSALdK.exe
  2⤵
  PID:8828
- C:\Windows\System\JLLvljW.exe
  C:\Windows\System\JLLvljW.exe
  2⤵
  PID:8844
- C:\Windows\System\IECYEVG.exe
  C:\Windows\System\IECYEVG.exe
  2⤵
  PID:8860
- C:\Windows\System\FJsKClM.exe
  C:\Windows\System\FJsKClM.exe
  2⤵
  PID:8876
- C:\Windows\System\CtFKuNd.exe
  C:\Windows\System\CtFKuNd.exe
  2⤵
  PID:8892
- C:\Windows\System\HUKbSxx.exe
  C:\Windows\System\HUKbSxx.exe
  2⤵
  PID:8908
- C:\Windows\System\kvMXOxa.exe
  C:\Windows\System\kvMXOxa.exe
  2⤵
  PID:8924
- C:\Windows\System\nWDKwUV.exe
  C:\Windows\System\nWDKwUV.exe
  2⤵
  PID:8944
- C:\Windows\System\bFGcbTz.exe
  C:\Windows\System\bFGcbTz.exe
  2⤵
  PID:8960
- C:\Windows\System\iLrokQE.exe
  C:\Windows\System\iLrokQE.exe
  2⤵
  PID:8976
- C:\Windows\System\MJlRzyC.exe
  C:\Windows\System\MJlRzyC.exe
  2⤵
  PID:8992
- C:\Windows\System\hJEtEsI.exe
  C:\Windows\System\hJEtEsI.exe
  2⤵
  PID:9008
- C:\Windows\System\JAcwgeg.exe
  C:\Windows\System\JAcwgeg.exe
  2⤵
  PID:9024
- C:\Windows\System\pVfCeQZ.exe
  C:\Windows\System\pVfCeQZ.exe
  2⤵
  PID:9040
- C:\Windows\System\ineQunZ.exe
  C:\Windows\System\ineQunZ.exe
  2⤵
  PID:9056
- C:\Windows\System\uKbOkfC.exe
  C:\Windows\System\uKbOkfC.exe
  2⤵
  PID:9072
- C:\Windows\System\lhbLVct.exe
  C:\Windows\System\lhbLVct.exe
  2⤵
  PID:9088
- C:\Windows\System\sqtQDcG.exe
  C:\Windows\System\sqtQDcG.exe
  2⤵
  PID:9104
- C:\Windows\System\GMnMeAC.exe
  C:\Windows\System\GMnMeAC.exe
  2⤵
  PID:9120
- C:\Windows\System\GEEPIeL.exe
  C:\Windows\System\GEEPIeL.exe
  2⤵
  PID:9136
- C:\Windows\System\JRWZaAG.exe
  C:\Windows\System\JRWZaAG.exe
  2⤵
  PID:9152
- C:\Windows\System\uGEmvES.exe
  C:\Windows\System\uGEmvES.exe
  2⤵
  PID:9168
- C:\Windows\System\MuARXBd.exe
  C:\Windows\System\MuARXBd.exe
  2⤵
  PID:9184
- C:\Windows\System\NbIhehy.exe
  C:\Windows\System\NbIhehy.exe
  2⤵
  PID:9200
- C:\Windows\System\HCOAlvO.exe
  C:\Windows\System\HCOAlvO.exe
  2⤵
  PID:7872
- C:\Windows\System\gRwKkVp.exe
  C:\Windows\System\gRwKkVp.exe
  2⤵
  PID:8244
- C:\Windows\System\NJyeqkK.exe
  C:\Windows\System\NJyeqkK.exe
  2⤵
  PID:8232
- C:\Windows\System\JudwwBW.exe
  C:\Windows\System\JudwwBW.exe
  2⤵
  PID:8308
- C:\Windows\System\FnIxhVO.exe
  C:\Windows\System\FnIxhVO.exe
  2⤵
  PID:8260
- C:\Windows\System\iOqqSIV.exe
  C:\Windows\System\iOqqSIV.exe
  2⤵
  PID:8328
- C:\Windows\System\heKEjWC.exe
  C:\Windows\System\heKEjWC.exe
  2⤵
  PID:8376
- C:\Windows\System\FYVSSNM.exe
  C:\Windows\System\FYVSSNM.exe
  2⤵
  PID:8392
- C:\Windows\System\hWDqgzp.exe
  C:\Windows\System\hWDqgzp.exe
  2⤵
  PID:8440
- C:\Windows\System\uqWcnPx.exe
  C:\Windows\System\uqWcnPx.exe
  2⤵
  PID:8500
- C:\Windows\System\gzlsHIe.exe
  C:\Windows\System\gzlsHIe.exe
  2⤵
  PID:8564
- C:\Windows\System\DlOGxMf.exe
  C:\Windows\System\DlOGxMf.exe
  2⤵
  PID:8596
- C:\Windows\System\YnyPixQ.exe
  C:\Windows\System\YnyPixQ.exe
  2⤵
  PID:8456
- C:\Windows\System\VSPJCfa.exe
  C:\Windows\System\VSPJCfa.exe
  2⤵
  PID:8692
- C:\Windows\System\iFfjtLf.exe
  C:\Windows\System\iFfjtLf.exe
  2⤵
  PID:8756
- C:\Windows\System\GFTNMIe.exe
  C:\Windows\System\GFTNMIe.exe
  2⤵
  PID:8820
- C:\Windows\System\yzRgQCJ.exe
  C:\Windows\System\yzRgQCJ.exe
  2⤵
  PID:8884
- C:\Windows\System\AUNDtRM.exe
  C:\Windows\System\AUNDtRM.exe
  2⤵
  PID:8952
- C:\Windows\System\yOAdLVY.exe
  C:\Windows\System\yOAdLVY.exe
  2⤵
  PID:9016
- C:\Windows\System\fIqlrkf.exe
  C:\Windows\System\fIqlrkf.exe
  2⤵
  PID:9080
- C:\Windows\System\MAVKrNS.exe
  C:\Windows\System\MAVKrNS.exe
  2⤵
  PID:8644
- C:\Windows\System\TBvHNoL.exe
  C:\Windows\System\TBvHNoL.exe
  2⤵
  PID:8488
- C:\Windows\System\tENWHiA.exe
  C:\Windows\System\tENWHiA.exe
  2⤵
  PID:8740
- C:\Windows\System\UWMUdSI.exe
  C:\Windows\System\UWMUdSI.exe
  2⤵
  PID:8776
- C:\Windows\System\lkrXkSI.exe
  C:\Windows\System\lkrXkSI.exe
  2⤵
  PID:8868
- C:\Windows\System\eaPWCFh.exe
  C:\Windows\System\eaPWCFh.exe
  2⤵
  PID:8904
- C:\Windows\System\IZpIosU.exe
  C:\Windows\System\IZpIosU.exe
  2⤵
  PID:8584
- C:\Windows\System\hHWsPUb.exe
  C:\Windows\System\hHWsPUb.exe
  2⤵
  PID:8616
- C:\Windows\System\CZvjpiY.exe
  C:\Windows\System\CZvjpiY.exe
  2⤵
  PID:8520
- C:\Windows\System\UBcDimQ.exe
  C:\Windows\System\UBcDimQ.exe
  2⤵
  PID:9068
- C:\Windows\System\MsZvAaH.exe
  C:\Windows\System\MsZvAaH.exe
  2⤵
  PID:8676
- C:\Windows\System\afwEtCJ.exe
  C:\Windows\System\afwEtCJ.exe
  2⤵
  PID:9196
- C:\Windows\System\PhuKAfT.exe
  C:\Windows\System\PhuKAfT.exe
  2⤵
  PID:9000
- C:\Windows\System\BqnyQXU.exe
  C:\Windows\System\BqnyQXU.exe
  2⤵
  PID:9192
- C:\Windows\System\vDiiamE.exe
  C:\Windows\System\vDiiamE.exe
  2⤵
  PID:8228
- C:\Windows\System\sgUNEIh.exe
  C:\Windows\System\sgUNEIh.exe
  2⤵
  PID:8408
- C:\Windows\System\PrrTksz.exe
  C:\Windows\System\PrrTksz.exe
  2⤵
  PID:7692
- C:\Windows\System\AruZGId.exe
  C:\Windows\System\AruZGId.exe
  2⤵
  PID:8724
- C:\Windows\System\nVXxWjx.exe
  C:\Windows\System\nVXxWjx.exe
  2⤵
  PID:8472
- C:\Windows\System\VDSumxX.exe
  C:\Windows\System\VDSumxX.exe
  2⤵
  PID:8664
- C:\Windows\System\pqiovni.exe
  C:\Windows\System\pqiovni.exe
  2⤵
  PID:8856
- C:\Windows\System\lNgUsWa.exe
  C:\Windows\System\lNgUsWa.exe
  2⤵
  PID:9116
- C:\Windows\System\XsronwE.exe
  C:\Windows\System\XsronwE.exe
  2⤵
  PID:8836
- C:\Windows\System\tsSDXwI.exe
  C:\Windows\System\tsSDXwI.exe
  2⤵
  PID:9128
- C:\Windows\System\arxryWp.exe
  C:\Windows\System\arxryWp.exe
  2⤵
  PID:9132
- C:\Windows\System\UoLVaXH.exe
  C:\Windows\System\UoLVaXH.exe
  2⤵
  PID:8972
- C:\Windows\System\jDEuIfU.exe
  C:\Windows\System\jDEuIfU.exe
  2⤵
  PID:8536
- C:\Windows\System\EyljPMq.exe
  C:\Windows\System\EyljPMq.exe
  2⤵
  PID:8360
- C:\Windows\System\kJvdKnm.exe
  C:\Windows\System\kJvdKnm.exe
  2⤵
  PID:8840
- C:\Windows\System\sIVitGP.exe
  C:\Windows\System\sIVitGP.exe
  2⤵
  PID:9212
- C:\Windows\System\unAkBOJ.exe
  C:\Windows\System\unAkBOJ.exe
  2⤵
  PID:9180
- C:\Windows\System\WExZgSw.exe
  C:\Windows\System\WExZgSw.exe
  2⤵
  PID:8280
- C:\Windows\System\oCSRDlw.exe
  C:\Windows\System\oCSRDlw.exe
  2⤵
  PID:8788
- C:\Windows\System\uTkNyAO.exe
  C:\Windows\System\uTkNyAO.exe
  2⤵
  PID:8612
- C:\Windows\System\rsHVPHW.exe
  C:\Windows\System\rsHVPHW.exe
  2⤵
  PID:8712
- C:\Windows\System\lKLcWDE.exe
  C:\Windows\System\lKLcWDE.exe
  2⤵
  PID:8628
- C:\Windows\System\KLhxQYH.exe
  C:\Windows\System\KLhxQYH.exe
  2⤵
  PID:8792
- C:\Windows\System\EBJNGMN.exe
  C:\Windows\System\EBJNGMN.exe
  2⤵
  PID:8484
- C:\Windows\System\zSxmYSe.exe
  C:\Windows\System\zSxmYSe.exe
  2⤵
  PID:8372
- C:\Windows\System\kADhwVc.exe
  C:\Windows\System\kADhwVc.exe
  2⤵
  PID:8968
- C:\Windows\System\ZSNjvuK.exe
  C:\Windows\System\ZSNjvuK.exe
  2⤵
  PID:8852
- C:\Windows\System\gztncSs.exe
  C:\Windows\System\gztncSs.exe
  2⤵
  PID:8548
- C:\Windows\System\BpXNBYO.exe
  C:\Windows\System\BpXNBYO.exe
  2⤵
  PID:9100
- C:\Windows\System\dPcpZpy.exe
  C:\Windows\System\dPcpZpy.exe
  2⤵
  PID:9232
- C:\Windows\System\ouusxul.exe
  C:\Windows\System\ouusxul.exe
  2⤵
  PID:9248
- C:\Windows\System\fBaUNwd.exe
  C:\Windows\System\fBaUNwd.exe
  2⤵
  PID:9264
- C:\Windows\System\cUqHLWi.exe
  C:\Windows\System\cUqHLWi.exe
  2⤵
  PID:9280
- C:\Windows\System\gyGMJCb.exe
  C:\Windows\System\gyGMJCb.exe
  2⤵
  PID:9296
- C:\Windows\System\YwHlKKr.exe
  C:\Windows\System\YwHlKKr.exe
  2⤵
  PID:9312
- C:\Windows\System\ALkWgBU.exe
  C:\Windows\System\ALkWgBU.exe
  2⤵
  PID:9328
- C:\Windows\System\pxgGDEk.exe
  C:\Windows\System\pxgGDEk.exe
  2⤵
  PID:9344
- C:\Windows\System\yECTDjv.exe
  C:\Windows\System\yECTDjv.exe
  2⤵
  PID:9360
- C:\Windows\System\TIWjUPs.exe
  C:\Windows\System\TIWjUPs.exe
  2⤵
  PID:9376
- C:\Windows\System\LNXbghG.exe
  C:\Windows\System\LNXbghG.exe
  2⤵
  PID:9392
- C:\Windows\System\VrvcGky.exe
  C:\Windows\System\VrvcGky.exe
  2⤵
  PID:9408
- C:\Windows\System\uGcGtxr.exe
  C:\Windows\System\uGcGtxr.exe
  2⤵
  PID:9424
- C:\Windows\System\eZrMCLJ.exe
  C:\Windows\System\eZrMCLJ.exe
  2⤵
  PID:9440
- C:\Windows\System\irSfXXv.exe
  C:\Windows\System\irSfXXv.exe
  2⤵
  PID:9456
- C:\Windows\System\seNDcCQ.exe
  C:\Windows\System\seNDcCQ.exe
  2⤵
  PID:9472
- C:\Windows\System\KAahTMC.exe
  C:\Windows\System\KAahTMC.exe
  2⤵
  PID:9488
- C:\Windows\System\ZHjYmqV.exe
  C:\Windows\System\ZHjYmqV.exe
  2⤵
  PID:9504
- C:\Windows\System\VRQdFfK.exe
  C:\Windows\System\VRQdFfK.exe
  2⤵
  PID:9520
- C:\Windows\System\heztLbI.exe
  C:\Windows\System\heztLbI.exe
  2⤵
  PID:9536
- C:\Windows\System\EDCqPQb.exe
  C:\Windows\System\EDCqPQb.exe
  2⤵
  PID:9552
- C:\Windows\System\UjvlMnT.exe
  C:\Windows\System\UjvlMnT.exe
  2⤵
  PID:9568
- C:\Windows\System\lfBKsYm.exe
  C:\Windows\System\lfBKsYm.exe
  2⤵
  PID:9584
- C:\Windows\System\cnmTXuC.exe
  C:\Windows\System\cnmTXuC.exe
  2⤵
  PID:9600
- C:\Windows\System\tAwUikC.exe
  C:\Windows\System\tAwUikC.exe
  2⤵
  PID:9616
- C:\Windows\System\mGnlAMC.exe
  C:\Windows\System\mGnlAMC.exe
  2⤵
  PID:9632
- C:\Windows\System\jLiVzPx.exe
  C:\Windows\System\jLiVzPx.exe
  2⤵
  PID:9648
- C:\Windows\System\wulziTu.exe
  C:\Windows\System\wulziTu.exe
  2⤵
  PID:9664
- C:\Windows\System\JjJFWyR.exe
  C:\Windows\System\JjJFWyR.exe
  2⤵
  PID:9680
- C:\Windows\System\lKotiBG.exe
  C:\Windows\System\lKotiBG.exe
  2⤵
  PID:9696
- C:\Windows\System\OznBteO.exe
  C:\Windows\System\OznBteO.exe
  2⤵
  PID:9712
- C:\Windows\System\ltaovzb.exe
  C:\Windows\System\ltaovzb.exe
  2⤵
  PID:9728
- C:\Windows\System\tntcfqo.exe
  C:\Windows\System\tntcfqo.exe
  2⤵
  PID:9744
- C:\Windows\System\aZOhadH.exe
  C:\Windows\System\aZOhadH.exe
  2⤵
  PID:9760
- C:\Windows\System\yFhtxDW.exe
  C:\Windows\System\yFhtxDW.exe
  2⤵
  PID:9776
- C:\Windows\System\bfiRtnM.exe
  C:\Windows\System\bfiRtnM.exe
  2⤵
  PID:9792
- C:\Windows\System\bZXSaHZ.exe
  C:\Windows\System\bZXSaHZ.exe
  2⤵
  PID:9808
- C:\Windows\System\weZhrAR.exe
  C:\Windows\System\weZhrAR.exe
  2⤵
  PID:9828
- C:\Windows\System\YDRQnky.exe
  C:\Windows\System\YDRQnky.exe
  2⤵
  PID:9844
- C:\Windows\System\gOOyBwY.exe
  C:\Windows\System\gOOyBwY.exe
  2⤵
  PID:9860
- C:\Windows\System\DxGMAar.exe
  C:\Windows\System\DxGMAar.exe
  2⤵
  PID:9876
- C:\Windows\System\HhzqcUs.exe
  C:\Windows\System\HhzqcUs.exe
  2⤵
  PID:9892
- C:\Windows\System\UWLpbeL.exe
  C:\Windows\System\UWLpbeL.exe
  2⤵
  PID:9908
- C:\Windows\System\zkpgyES.exe
  C:\Windows\System\zkpgyES.exe
  2⤵
  PID:9924
- C:\Windows\System\FkpbPhZ.exe
  C:\Windows\System\FkpbPhZ.exe
  2⤵
  PID:9940
- C:\Windows\System\nNwkKEZ.exe
  C:\Windows\System\nNwkKEZ.exe
  2⤵
  PID:9956
- C:\Windows\System\luIVUZr.exe
  C:\Windows\System\luIVUZr.exe
  2⤵
  PID:9972
- C:\Windows\System\hBuDQPo.exe
  C:\Windows\System\hBuDQPo.exe
  2⤵
  PID:9988
- C:\Windows\System\XkOcDFB.exe
  C:\Windows\System\XkOcDFB.exe
  2⤵
  PID:10004
- C:\Windows\System\dbJRSuX.exe
  C:\Windows\System\dbJRSuX.exe
  2⤵
  PID:10020
- C:\Windows\System\gsucVpn.exe
  C:\Windows\System\gsucVpn.exe
  2⤵
  PID:10036
- C:\Windows\System\yxiCEXs.exe
  C:\Windows\System\yxiCEXs.exe
  2⤵
  PID:10052
- C:\Windows\System\TwjEpaL.exe
  C:\Windows\System\TwjEpaL.exe
  2⤵
  PID:10068
- C:\Windows\System\cSvDuGp.exe
  C:\Windows\System\cSvDuGp.exe
  2⤵
  PID:10084
- C:\Windows\System\uDmKbTq.exe
  C:\Windows\System\uDmKbTq.exe
  2⤵
  PID:10100
- C:\Windows\System\QxYdSbV.exe
  C:\Windows\System\QxYdSbV.exe
  2⤵
  PID:10116
- C:\Windows\System\XGSrscK.exe
  C:\Windows\System\XGSrscK.exe
  2⤵
  PID:10132
- C:\Windows\System\OVkEwfQ.exe
  C:\Windows\System\OVkEwfQ.exe
  2⤵
  PID:10148
- C:\Windows\System\WoLKgwx.exe
  C:\Windows\System\WoLKgwx.exe
  2⤵
  PID:10164
- C:\Windows\System\mHZpSij.exe
  C:\Windows\System\mHZpSij.exe
  2⤵
  PID:10180
- C:\Windows\System\qCLdenX.exe
  C:\Windows\System\qCLdenX.exe
  2⤵
  PID:10196
- C:\Windows\System\aOkhbtm.exe
  C:\Windows\System\aOkhbtm.exe
  2⤵
  PID:10212
- C:\Windows\System\BybTgTm.exe
  C:\Windows\System\BybTgTm.exe
  2⤵
  PID:10228
- C:\Windows\System\WLufEeq.exe
  C:\Windows\System\WLufEeq.exe
  2⤵
  PID:8680
- C:\Windows\System\inLVHNm.exe
  C:\Windows\System\inLVHNm.exe
  2⤵
  PID:9112
- C:\Windows\System\toDeucC.exe
  C:\Windows\System\toDeucC.exe
  2⤵
  PID:9272
- C:\Windows\System\XUWvaMl.exe
  C:\Windows\System\XUWvaMl.exe
  2⤵
  PID:9336
- C:\Windows\System\aphQwhH.exe
  C:\Windows\System\aphQwhH.exe
  2⤵
  PID:9292
- C:\Windows\System\SzQKfLm.exe
  C:\Windows\System\SzQKfLm.exe
  2⤵
  PID:9352
- C:\Windows\System\GAdMHdR.exe
  C:\Windows\System\GAdMHdR.exe
  2⤵
  PID:9384
- C:\Windows\System\iBnwUZK.exe
  C:\Windows\System\iBnwUZK.exe
  2⤵
  PID:9400
- C:\Windows\System\QlHqEkd.exe
  C:\Windows\System\QlHqEkd.exe
  2⤵
  PID:9420
- C:\Windows\System\pAeTPir.exe
  C:\Windows\System\pAeTPir.exe
  2⤵
  PID:9484
- C:\Windows\System\BcVCqWK.exe
  C:\Windows\System\BcVCqWK.exe
  2⤵
  PID:9528
- C:\Windows\System\XXRGInj.exe
  C:\Windows\System\XXRGInj.exe
  2⤵
  PID:9592
- C:\Windows\System\YbfUZlm.exe
  C:\Windows\System\YbfUZlm.exe
  2⤵
  PID:9628
- C:\Windows\System\TIHZsOK.exe
  C:\Windows\System\TIHZsOK.exe
  2⤵
  PID:9580
- C:\Windows\System\SSfZBKY.exe
  C:\Windows\System\SSfZBKY.exe
  2⤵
  PID:9656
- C:\Windows\System\TtRgiqL.exe
  C:\Windows\System\TtRgiqL.exe
  2⤵
  PID:9672
- C:\Windows\System\aMFBBMY.exe
  C:\Windows\System\aMFBBMY.exe
  2⤵
  PID:9720
- C:\Windows\System\YuQKSKG.exe
  C:\Windows\System\YuQKSKG.exe
  2⤵
  PID:9784
- C:\Windows\System\knBShAw.exe
  C:\Windows\System\knBShAw.exe
  2⤵
  PID:9852
- C:\Windows\System\bZiixTE.exe
  C:\Windows\System\bZiixTE.exe
  2⤵
  PID:9884
- C:\Windows\System\BhMSUTf.exe
  C:\Windows\System\BhMSUTf.exe
  2⤵
  PID:9740
- C:\Windows\System\dwZyVWR.exe
  C:\Windows\System\dwZyVWR.exe
  2⤵
  PID:9804
- C:\Windows\System\MNbtAOU.exe
  C:\Windows\System\MNbtAOU.exe
  2⤵
  PID:9900
- C:\Windows\System\PNbiYTH.exe
  C:\Windows\System\PNbiYTH.exe
  2⤵
  PID:9948
- C:\Windows\System\bHQZVWn.exe
  C:\Windows\System\bHQZVWn.exe
  2⤵
  PID:9936
- C:\Windows\System\HxCViEV.exe
  C:\Windows\System\HxCViEV.exe
  2⤵
  PID:10000
- C:\Windows\System\PtBZlAa.exe
  C:\Windows\System\PtBZlAa.exe
  2⤵
  PID:10012
- C:\Windows\System\arzAjal.exe
  C:\Windows\System\arzAjal.exe
  2⤵
  PID:10092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BcqxmBI.exe

Filesize
1.9MB

MD5
7f4d931070c4898a9134814fbcbf68fd

SHA1
afe84f3f6f10144b51df06f5cdbb1996aae783c2

SHA256
637be459cffb26c21b2c0d52a8bebe16aec86735644c138b2f6127c667092a4d

SHA512
fdd889a7439f3571192cb59e89c31d5ba4c5b7f924c73ce97bdc4e03d18509eaa92701fa5135038aef2700929ed6feaa5eec84b55629d6f7201d3a01e6192e83

Download Submit
C:\Windows\system\DynyxBV.exe

Filesize
1.9MB

MD5
e9d23d921bbc3d9d5282fc0da3ccddbb

SHA1
fe798e4588fd4d2767fc9b0fa454273d9f865c1f

SHA256
338b884280813db03ea1b0896fe87dfd1e07f3db269cb486346fee9f08692986

SHA512
35e7acb5da369fd9b6776b0e88360451f86b429cf2d3ddb4a3938aa197714eab2389f17c60b2d01b55d55bc7c6506b2636995636d1b67e47413757afc039fd67

Download Submit
C:\Windows\system\FZWiiXD.exe

Filesize
1.9MB

MD5
59a8215cba9dab83aa5bea2483e1a66f

SHA1
40139bbb6cc79d61886675d39d71abfd6bfbbc76

SHA256
394419c57c2141ec0d7ed69ca7cf13be634ac7fdb8994d636e48f3cd8296b334

SHA512
a9c954bbf0f5c45d22fe5247bb610e7755858c6a402da65aeb291497535eb0ee683b00887aaa8f34838885661ac04596c15c75d2cf1da68e735ccd63c36fd7e2

Download Submit
C:\Windows\system\FclBrgG.exe

Filesize
1.9MB

MD5
6099af82c74f0b279121537d691c54be

SHA1
bba34cd159ebf640af40581d42d5e9b869226a87

SHA256
e4eec6f737d294a32549d631885d81b08fe7cc8a64be2287e920aa296f00b339

SHA512
4fbab258efb44525f5da9399626222931737da2422eb4f013a1d426691bc765ed1b8bbb50be7bfa6109425eb8e76555e5c92a536e9bdc3320d831de7d11489a5

Download Submit
C:\Windows\system\JTZxHOG.exe

Filesize
1.9MB

MD5
0b9dbd5a317728d3b8497ccb22bc6060

SHA1
9769af7f0f8b94146eef0671488b259e3bde0d39

SHA256
1d514b8adf31437346c104f69b0893716f339526c160a3611d0275b9f0ddbd4d

SHA512
609d77dbc14c4a036b1e2821565321c52861ac740152e23c504e0cb7ed3cafb89d929714654691cd8aa70641b9e9e6f40382763bdf59b6b8c1e75a3b1d1bcf8e

Download Submit
C:\Windows\system\LcrSNNS.exe

Filesize
1.9MB

MD5
a172d892ad2dfee2b62be68bbec741a0

SHA1
5f1fd440ea35c3c760fa21b5744204d170a61808

SHA256
251a59b2ba6c76c1cd2aa860daf5f5788b1ec076e6ca5a156023e8c71adba6ee

SHA512
35fd188995245877aa8a3c4e04dd9e230375c62a50635d8a8517c30cd2b7692c3b91d7c8330a3514b5b4e4c0f7273301e68335611374d45d9cbfa27f995034b6

Download Submit
C:\Windows\system\NBRXxNS.exe

Filesize
1.9MB

MD5
73dbdb679ff82739df4545552dd3fd4b

SHA1
1dd6ba8d47fda8cb1608ed5e6a59f4baab2961ae

SHA256
30b4d4de498f510acd911fdc1ce8c1caddb7bb26fee4a92b901d13e306dc21ae

SHA512
00dc53e8a2484e2b2c969f3b149e58636dd32060c6c896afceb44131518d85e8a5b1b0050e2ff0dc36a50a1910dee2c667b43036ebe079f2ba372b89212e3f06

Download Submit
C:\Windows\system\NiRnAES.exe

Filesize
1.9MB

MD5
37bd78b54d6667d75482a3d6633129a8

SHA1
08e5d8fc04b244a11d71c3a6abc5c01c2fd02e2d

SHA256
e6331bad462847daa3f9bd7b895d483ea552176a6a09ee83960a06c2504978a0

SHA512
7e54fc88dcf6db7b6636bc70a577083b7123531492cfe4cecf8ba5008da32cbbaacb719c4a27f53cda8412b346bc4830993cdc2666db94631c7b72fabd524783

Download Submit
C:\Windows\system\QIDRqJw.exe

Filesize
1.9MB

MD5
a2ab761ec3cf2ead9dd2fa10fea9a392

SHA1
51b85a3ffb84b2d17faecb5a5293c54bf7fbaa75

SHA256
f0a58f16a03ce2e680c7d67a916f786e5e8bb80b55e9f3dc04f02e8749152010

SHA512
0c2d35214cb6da80ccc450ac65dca987d947226599d0a5a8c1875ccfb7b7e2db033405466ff5962db5c094684ffbd7681a458e020b02ec1c733e1dd5b2238c54

Download Submit
C:\Windows\system\UlbFFZP.exe

Filesize
1.9MB

MD5
73ba84117f6998907402235b02b2e2d1

SHA1
c826a56e10e29b978bccd3a81a0073bb6be2f68a

SHA256
91ab87e5a5a84286ed672146e1062e42aa422a7e62f28a557215b81697f9b0d2

SHA512
e45c75c02e5142b4f87b4abd52b8a65f372e1b35e4367ecc33c99430d68b598cdd879b61aca708785ccdf52baeeb51b2237bb9aa1c01184f2865f6d4fec7c8e2

Download Submit
C:\Windows\system\WypaJjO.exe

Filesize
1.9MB

MD5
adab879e91ba098bac128c2d1f2bd61e

SHA1
32d27f8821c00b1637b8e59b6b465a9bbc64bf54

SHA256
f12e1b22de95be505ac72ef2462f93e6f09b7c37ce5f40a199df5a15715d9cc6

SHA512
411f641bc73299a361619d3a2afd079d47a7fd2f300d0961ad94574b5da3c98fccd1393a82a1e5b6fabbd4a0f2c217aad3927ac50aa6705e97222f8df3dda543

Download Submit
C:\Windows\system\XoZiQpr.exe

Filesize
1.9MB

MD5
5603605e67afb5246df4347ac7ff9225

SHA1
a20e3cdc4b163997dc15e65ec665e9d222a2ca6b

SHA256
2c9c28014039bf5e676df6ea927abb185fec74e5bb602d675035bed80f5d3489

SHA512
923916d23936e06ce33c4fca0c855519430841b4a02cdcd0c50466ad4139e2f393991d7c550f2fb369a97b04ec91ee460c225fa4aef68777cd1af8784575307b

Download Submit
C:\Windows\system\ZewPyXu.exe

Filesize
1.9MB

MD5
1c7736f32fc45c198308e2be5adacec1

SHA1
afbff3607482a73fc65074617246001cbc443961

SHA256
a04f1e6ac2253019989617930b578fc4930f2356112599369b497d67c39b3a61

SHA512
a8f92bd9d8dc2dbdb304f355fc332582d28a881f5885bc7c093c98fc966526ae9243e37f968de52a381166bbc03e8ee7daf81142c9f8ed3cb38680c9b4026990

Download Submit
C:\Windows\system\ZkDiuOt.exe

Filesize
1.9MB

MD5
cdcf304a4b17854341c481ea79e97e4b

SHA1
966a603f61ae252559718dc1cc8f28960ef426dc

SHA256
5aca71d044caf377649988325ebecc362df2399a43c82501cfe7c13677b931bc

SHA512
3d75d261e7e5ad7cce701ef40edbf326e790e17d3d5c31beeb93c9c45677f07f7d8dc93a795d395a2849d55da4a910a205e96913c82601f721f1ee87036f54b3

Download Submit
C:\Windows\system\arMaHrj.exe

Filesize
1.9MB

MD5
6b07f2dac30b5aa08afa340b8ad318cc

SHA1
b6ffdb02e3f2db502a9e64f1c8f0921ee7ccdab0

SHA256
9b12dd65847e7ca74ed1052d8ab19f25dd3985ad96a46147810aca44f6ce5345

SHA512
9c8ffe0803be945df2f1a6d87cfe04e2e4827152e603e6ba83ca0b79eedef3c9c2c5f2fb670fce519605c4fa4ef243dcfdf4ff773cc92f416817698206b54ebd

Download Submit
C:\Windows\system\dvryrED.exe

Filesize
1.9MB

MD5
082c138a01ede1b3fcb4e2176fc7b54b

SHA1
8e21d6ec9864b0cadbe6cc200fb324b71246a1c0

SHA256
ae52df5c5ece752669424387af7c42a26528b42098d7de97eda6f532da36e352

SHA512
5f9cc4a95e548f1965f937ade25556b33fa93adcffea45154609ce5257e1fd8af5278c641a3a809ab61c26d9abca4a50909ae49f4bb404fbab241844f210e3ed

Download Submit
C:\Windows\system\eYGYeLB.exe

Filesize
1.9MB

MD5
531ba74efdad93dfa4054361778461c8

SHA1
117f0ffd626b620136ca0c0efe7786dde9c66be1

SHA256
68d1879d0d59cb597b00a2a870e7c34cdbd0e8b7ec3ea39d29819b518be6c74c

SHA512
8eed404a10dccd88d45b092c708e78542ff94c9bc538ce9482ea60d8b1a0788f74bff88a33a06cdc2e107a07f6780315ab892083685eac92f97135fcd53971fa

Download Submit
C:\Windows\system\fXtQaun.exe

Filesize
1.9MB

MD5
841985b633a90137720e67f751463d5c

SHA1
d86222cf12a9d11787ac42232074f9866cdff464

SHA256
0be103236ae07fc05e84d6f8bc544fc17b65775e069cba3d7329f3348d3eb582

SHA512
3c4b73bfa5e115c6f9956727d6de233d1476296f46a75b4089951d4418bc5e8f63b48ee7ee52c69c21d9f09591aee05c56ebe38e886cf2ad7df98eee6e04d93b

Download Submit
C:\Windows\system\iDnJuNb.exe

Filesize
1.9MB

MD5
dd3c9cd92db3ea5b81f889470b33df74

SHA1
ebc3fca7bdcf61ac621916e3e3eb31ae1c2f2004

SHA256
900529550e609c032fe7aa6d0987dbf10aa63b7a3c147380549332fde0d3f0c1

SHA512
429019c1093a74490a8d95b8dd5b136825cef439f17c2681cd82ad29a631516f80d0f2c897ddecae79ace4492ef0971b84d538ab6239669bca1784cab23979e6

Download Submit
C:\Windows\system\kMOSfxw.exe

Filesize
1.9MB

MD5
8626bf9fde98629deb26b1d42c2e5302

SHA1
84f5c42fc116d1f88421fadfdfbd84da93feb997

SHA256
16cea416926648919fada867d1bef850ad5cce0ec2b15b5a7b2ba07d2070f0b1

SHA512
95fbf9adba0e70dd848529b1572579446197eaf9110d42b3e6e73758e4d8e55a224596cb2490324716a52bf5cbca8170676433fb220efe0eebf06e9ff547f5d6

Download Submit
C:\Windows\system\lpTOaMI.exe

Filesize
1.9MB

MD5
5116462a35c7dd7ed9126fdd787137fc

SHA1
92c04b456a6e16c6a9b5109c9e2038306f5feac5

SHA256
8b24092178da397303a2f114ebe1cfb470b44dcf854c8a938e6e2b31801bcf6f

SHA512
6b376686dbc0c6e13b325ed03728f6031062828420fae5e80c36794373c7bb8352e745046019f750c5f0f2074f3b54213fb727b505b699a8dabe7b0d62cfecef

Download Submit
C:\Windows\system\qaoDjTd.exe

Filesize
1.9MB

MD5
9a81a4180a1d004ba97683fa7f59b118

SHA1
83273019e9e46fa33ce373012ed34e40b4c4d927

SHA256
2b02d054f12131776b019a51fbbd6643fd2d2052fa1296a8a8a86f3a324cb08e

SHA512
79e25c0f036bda34939cd5da6bd9c2beda0573c311f99c295e87acc863320836302b47fff7f93e42af63b98d2207e55cfdf8a29d9a635b5b571762c21b62249f

Download Submit
C:\Windows\system\sqXlqhw.exe

Filesize
1.9MB

MD5
74e434c1377228c7e5e2cda80b51731b

SHA1
3582ab7cd69a90dfd630d8526211aff9c8697ffa

SHA256
c25218c0ef876790587d786e05bb23c141748239353025b0385b779ccff56299

SHA512
02a080f4bd7a6cb34a0d91eb9055d1f82a04ca23e27141268c8f287b35f2abcb57ce14351f98e6ab419929bcdbe9820aa37e20776be7fd87a7765ec0d67eed6f

Download Submit
C:\Windows\system\wgJFpDB.exe

Filesize
1.9MB

MD5
068ccf9c412bc36f50fc61f6eaa91bd9

SHA1
f87dc5d1314cdf46ccc85c1a968a1a9284b0eca7

SHA256
58320087cd3dce475bf5630b682573819960329e0a4e182d599d3f2bf8ba69e6

SHA512
10ff6773ed267e2d422dd9a388fad57501cc3443d9a320412c3d7f8d5e6f8897f0f4fcb0a30846d5e7a45ec31eb0e6326925386199ea2be2ec0661ef99126c26

Download Submit
C:\Windows\system\xAwnHbN.exe

Filesize
1.9MB

MD5
b2c6f3ca2853ba10e2bbfcd73f61c3d1

SHA1
b0243d08e14c324994fd7234a0f3d830c8f35ca5

SHA256
77bdc2923759d477d3ad62eae9c25fed6662929e280766da388efb116c686533

SHA512
4457b5c33e562bc86a533cd49c881a5be783d07810d979d684e9c389cc1e66001122aaad945f4c4527d0c1e40d37a0c9e0a9865614822d34be7bfdd2b51f8f8f

Download Submit
C:\Windows\system\zPTXJYG.exe

Filesize
1.9MB

MD5
b5f979f4db2d2ee8abaef41677a29098

SHA1
8bdbf69941eed75e5838cf9f9cc8d98115bfe969

SHA256
4b669f1eb54e24f4d372a6845ff226c06eac5f8afcebe35ccb038b6e035916d2

SHA512
75bd49f238eff4250248a29717b8298e933821947597f44ee004671a41b89455d0a450162c32771f5d990bd134cc1c649ce1067607ab0ade8a8e28ab06d639ff

Download Submit
C:\Windows\system\zlUSdur.exe

Filesize
1.9MB

MD5
f7400d331fbd2278a788d26431231850

SHA1
51b7ee56e1fc866ff812ede83a5c0376b19ffc7f

SHA256
24d709f199efb0affe5299854ebcafe56cfa696afa8e10aaa0c10efdb71de6d1

SHA512
b45b1a1fa1e1d9a067c9306500f8b8ebcd6ade0522d3c20a4656b194b8d01056b8ac14c21a4cc59c23e8db582770d991c3ec7fc0fa5297eaeb3fdc7b18a46128

Download Submit
\Windows\system\HDmvKXr.exe

Filesize
1.9MB

MD5
b909e4449863ee638bee7ff9b2739683

SHA1
68223ff817702519e2db362fbfac9e797e38002c

SHA256
ca16fbc2c61be5f269962dfc9414f492a76dc4888175400c4cd2f4a18ee9a54b

SHA512
ff34946a77121133c4b5d5e023c98f0daf397fb9ffe74b0e4f48663e67bdbe30e458284a1ae9e4de1e0be547cad80fe44f2e952d4e478cd0dd2c330a4ed476d2

Download Submit
\Windows\system\PymLMty.exe

Filesize
1.9MB

MD5
5a71c29812d77fc61d24e1cec0e02e9d

SHA1
d90192677a2829d85766effd4cfe6681205065dd

SHA256
cb841950c178fd653309d1cf4765bb811a14eff139b501efb239bd136622ae12

SHA512
405cb9d3eee886aec5ca4e820bca3248caa7d78261895d955b043909540e86e8ed41eefdb52d2868773f3b55cd1fc375f35c1985134514b3dc590f25c881c503

Download Submit
\Windows\system\RWApcor.exe

Filesize
1.9MB

MD5
cb7a6b534d6863f6f9a3f3093c314ddc

SHA1
65cf72fa8347b0f57ce3c6bb4149600a4117cb0d

SHA256
fdafa28d2cc15fe64e77c440697930637f897c8f6eef09fb8bc08273a1415555

SHA512
ab12788934975ac77aed07a477c7dc055600b0eb18c36beb97a34f597e816b39468d3efc8a4974f992257b1d871bc7a5892e04ca774dfec0b545e22d748c9306

Download Submit
\Windows\system\mWVPnjQ.exe

Filesize
1.9MB

MD5
6f7f4a1cff1fea92468856854c6ae390

SHA1
d0f4b92f297354f921aae590f01b5d6dfc6fe294

SHA256
40f392aee031265b1efef439ce935f024d163b21a444cc34900d68443b34b61a

SHA512
5f135dd9afe8cb10dd78243c65499b76acbcf1ceaf3bf94821a3ac9675d8071fcb69a69c4eda20cb0328a95dd04215006ba07d0a82f6d93fa964cf2ad203fe2d

Download Submit
\Windows\system\wpVZbTF.exe

Filesize
1.9MB

MD5
150e4bc4c73786c125ff367ccf23e110

SHA1
bbd8d352f0a1655887d016b1bf8b743aabd49642

SHA256
1311b7d0cb437e1d2ee4d5807e954f9607a8c4f40f40023d8d89bd8988406c91

SHA512
61072c600138fe3eafe7bf08e2fc95e399c4700beab32596c91757447679f73a4fc3c2f1c6fa0c13cbde8b5bd82b4e177116448cfc59e78af5f859f746aff13d

Download Submit
memory/2064-146-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

Filesize
9.6MB

Download
memory/2064-495-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2064-127-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/2064-139-0x000000001B860000-0x000000001BB42000-memory.dmp

Filesize
2.9MB

Download
memory/2064-19-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/2064-2760-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

Filesize
9.6MB

Download
memory/2064-126-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

Filesize
9.6MB

Download
memory/2080-145-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-143-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-132-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-7-0x0000000002840000-0x0000000002C32000-memory.dmp

Filesize
3.9MB

Download
memory/2080-134-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-1-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-136-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-150-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-0-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download
memory/2080-138-0x000000013F3B0000-0x000000013F7A2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-141-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2200-137-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/2424-128-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2428-142-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2472-140-0x000000013F3B0000-0x000000013F7A2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-144-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2576-133-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2620-18-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2692-9-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2724-135-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download