xmrig | 21ecc77c13901145132c5841d5d642a722ac5bf972adbaf3d69495f9b53918cb

Analysis

max time kernel
43s
max time network
40s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
Size

2.1MB
MD5

04be6914d9ec062b59d6f6b6b4f82da2
SHA1

a36bbf3c01178a7137821eb00cb1205f4a14d842
SHA256

21ecc77c13901145132c5841d5d642a722ac5bf972adbaf3d69495f9b53918cb
SHA512

252cbccd1035ecb29c6c0280fad777e6244cd5bad59a7d6d29b97310c6815edb583a890fe0ec21826e473cfeac49aaa3c392326fa8fbd831d3a1377b4499072b
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM4h:NABc

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 5 IoCs

miner

resource	yara_rule
behavioral1/memory/2540-20-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/2512-74-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2444-70-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2712-640-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/848-60-0x000000013F870000-0x000000013FC62000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2540	UoQSVCg.exe
2544	HDZOjpV.exe
2616	goEhKVx.exe
2712	TwvWXYR.exe
848	uHqhamD.exe
2444	VIPSVAb.exe
2512	QZjgsIF.exe
2240	MUZkQxT.exe
2428	UHfkyie.exe
2528	umjHkDw.exe
2408	eHUnPFG.exe
1592	BRtCmvP.exe
2740	DOgIZwT.exe
1516	cETBRBX.exe
2572	GKGXDiP.exe
892	ugPWyHX.exe
1588	bNILLld.exe
2672	stkNcRk.exe
2664	MaSkXIP.exe
488	clmMMhW.exe
616	byaWsUH.exe
500	OniYIyt.exe
932	hYjJtnr.exe
916	zFLuZIc.exe
1244	fZsKFPe.exe
1260	RnNTaNF.exe
1648	JlcfeDH.exe
1412	dyfkQom.exe
1748	jnPvoSG.exe
1980	cVwlEaQ.exe
2376	rjOShQj.exe
760	sbvuWGD.exe
1424	vqGiXDB.exe
1764	vbakymL.exe
2984	oCzwMsc.exe
1012	wmObyLa.exe
1724	mCRCQCR.exe
2256	JiPqQeo.exe
1620	Qucpbet.exe
1116	kbpAyYr.exe
1304	bwqPBLV.exe
1140	gwjdXXR.exe
2040	ycpItci.exe
1644	AAcTwgu.exe
876	ZwvqTwu.exe
1004	hRmxjLk.exe
1512	nZDjMet.exe
952	DpZuJFK.exe
1068	gofkiDw.exe
1776	dYssuCb.exe
1288	XzLzKMk.exe
1056	OahHUoh.exe
112	cXxlkZK.exe
1688	knTtPqF.exe
2252	WVkfmkO.exe
3016	HSbHFEE.exe
2128	KUIxfEj.exe
2164	IHUOMtZ.exe
564	dCphdJd.exe
2368	ozvsGIY.exe
2136	YfvemTL.exe
2848	HQZMtlG.exe
1696	xfvHzMX.exe
884	rQRMxUQ.exe

Loads dropped DLL 64 IoCs

pid	Process
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/996-1-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/files/0x00080000000122cd-6.dat	upx
behavioral1/files/0x00060000000161e7-46.dat	upx
behavioral1/files/0x0006000000016572-54.dat	upx
behavioral1/files/0x000600000001630b-39.dat	upx
behavioral1/memory/2616-34-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/files/0x0008000000016117-31.dat	upx
behavioral1/memory/2544-26-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/files/0x0007000000015ceb-24.dat	upx
behavioral1/files/0x003600000001566b-19.dat	upx
behavioral1/files/0x0008000000015cba-16.dat	upx
behavioral1/files/0x00060000000164b2-48.dat	upx
behavioral1/files/0x0007000000015d07-45.dat	upx
behavioral1/files/0x0007000000015ce1-44.dat	upx
behavioral1/memory/2540-20-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/files/0x0008000000015ca6-15.dat	upx
behavioral1/memory/2512-74-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/2444-70-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/files/0x0006000000016a9a-79.dat	upx
behavioral1/files/0x0007000000004e76-86.dat	upx
behavioral1/files/0x0006000000016c4a-93.dat	upx
behavioral1/files/0x0006000000016d1e-117.dat	upx
behavioral1/files/0x0006000000016d3a-125.dat	upx
behavioral1/files/0x0006000000016d90-133.dat	upx
behavioral1/files/0x0006000000016dbf-145.dat	upx
behavioral1/memory/2712-640-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/memory/2408-638-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/2528-637-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/memory/2428-636-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/memory/2240-635-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/files/0x0006000000016eb2-153.dat	upx
behavioral1/files/0x0006000000016e94-149.dat	upx
behavioral1/files/0x0006000000016dbb-141.dat	upx
behavioral1/files/0x0006000000016da7-137.dat	upx
behavioral1/files/0x0006000000016d7e-129.dat	upx
behavioral1/files/0x0006000000016d26-121.dat	upx
behavioral1/files/0x0006000000016d0d-113.dat	upx
behavioral1/files/0x0006000000016ce4-109.dat	upx
behavioral1/files/0x0006000000016cb7-105.dat	upx
behavioral1/files/0x0006000000016c6b-101.dat	upx
behavioral1/files/0x0006000000016c63-97.dat	upx
behavioral1/files/0x0007000000016843-89.dat	upx
behavioral1/memory/848-60-0x000000013F870000-0x000000013FC62000-memory.dmp	upx
behavioral1/files/0x003400000001567f-73.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HQZMtlG.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\aXbvrpU.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\JaNPahg.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\EaasjFk.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\eWfEhOA.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\WgkpADd.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\cVIGljV.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\ePKqbpL.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\PtzHAHw.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\rTgwTcK.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\IWXHTig.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\STmweYY.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\KxomaPR.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\VAHlcuP.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\vLgmBHJ.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\mKTsTrD.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\gbBwkvZ.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\UdppMUT.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\QbrRNEa.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\IGoNNVL.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\EEKHkNj.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\UQDiMDU.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\oOYMpYl.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\kEJBCIE.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\WeRkFAE.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\GoqBtwj.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\UQPIXJw.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\NGYjtps.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\AyefHVL.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\uoooVmW.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\gGSSVgH.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\mbvBDEM.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\xfvHzMX.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\ooyZtEk.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\AKjYxDx.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\slAaHwb.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\vliBtdU.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\UOHAQJk.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\aCdVKku.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\usVRKvI.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\QJnFFVP.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\KUIxfEj.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\aTsCvxo.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\jAMFniz.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\iqvLRPB.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\topEUkk.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\irugHNv.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\AYIdgUX.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\TaGJWgq.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\CGFNdZu.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\aPUIuFF.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\UrpVtbm.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\KihMaHD.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\YnJUJvO.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\fCrNUvI.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\mBpewcP.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\MebBYAb.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\oxruXXA.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\LMlwamK.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\ovIduUz.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\nbEWcfY.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\yMjzjqf.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\WDyVheV.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
File created	C:\Windows\System\xwfMMHX.exe	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2500	powershell.exe
2500	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
Token: SeDebugPrivilege	2500	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 2500	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	29
PID 996 wrote to memory of 2500	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	29
PID 996 wrote to memory of 2500	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	29
PID 996 wrote to memory of 2540	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	30
PID 996 wrote to memory of 2540	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	30
PID 996 wrote to memory of 2540	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	30
PID 996 wrote to memory of 2616	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	31
PID 996 wrote to memory of 2616	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	31
PID 996 wrote to memory of 2616	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	31
PID 996 wrote to memory of 2544	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	32
PID 996 wrote to memory of 2544	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	32
PID 996 wrote to memory of 2544	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	32
PID 996 wrote to memory of 2240	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	33
PID 996 wrote to memory of 2240	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	33
PID 996 wrote to memory of 2240	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	33
PID 996 wrote to memory of 2712	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	34
PID 996 wrote to memory of 2712	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	34
PID 996 wrote to memory of 2712	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	34
PID 996 wrote to memory of 2428	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	35
PID 996 wrote to memory of 2428	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	35
PID 996 wrote to memory of 2428	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	35
PID 996 wrote to memory of 848	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	36
PID 996 wrote to memory of 848	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	36
PID 996 wrote to memory of 848	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	36
PID 996 wrote to memory of 2528	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	37
PID 996 wrote to memory of 2528	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	37
PID 996 wrote to memory of 2528	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	37
PID 996 wrote to memory of 2444	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	38
PID 996 wrote to memory of 2444	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	38
PID 996 wrote to memory of 2444	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	38
PID 996 wrote to memory of 2408	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	39
PID 996 wrote to memory of 2408	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	39
PID 996 wrote to memory of 2408	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	39
PID 996 wrote to memory of 2512	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	40
PID 996 wrote to memory of 2512	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	40
PID 996 wrote to memory of 2512	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	40
PID 996 wrote to memory of 2740	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	41
PID 996 wrote to memory of 2740	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	41
PID 996 wrote to memory of 2740	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	41
PID 996 wrote to memory of 1592	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	42
PID 996 wrote to memory of 1592	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	42
PID 996 wrote to memory of 1592	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	42
PID 996 wrote to memory of 1516	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	43
PID 996 wrote to memory of 1516	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	43
PID 996 wrote to memory of 1516	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	43
PID 996 wrote to memory of 2572	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	44
PID 996 wrote to memory of 2572	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	44
PID 996 wrote to memory of 2572	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	44
PID 996 wrote to memory of 892	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	45
PID 996 wrote to memory of 892	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	45
PID 996 wrote to memory of 892	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	45
PID 996 wrote to memory of 1588	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	46
PID 996 wrote to memory of 1588	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	46
PID 996 wrote to memory of 1588	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	46
PID 996 wrote to memory of 2672	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	47
PID 996 wrote to memory of 2672	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	47
PID 996 wrote to memory of 2672	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	47
PID 996 wrote to memory of 2664	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	48
PID 996 wrote to memory of 2664	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	48
PID 996 wrote to memory of 2664	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	48
PID 996 wrote to memory of 488	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	49
PID 996 wrote to memory of 488	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	49
PID 996 wrote to memory of 488	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	49
PID 996 wrote to memory of 616	996	04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04be6914d9ec062b59d6f6b6b4f82da2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\System\UoQSVCg.exe
  C:\Windows\System\UoQSVCg.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\goEhKVx.exe
  C:\Windows\System\goEhKVx.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\HDZOjpV.exe
  C:\Windows\System\HDZOjpV.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\MUZkQxT.exe
  C:\Windows\System\MUZkQxT.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\TwvWXYR.exe
  C:\Windows\System\TwvWXYR.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\UHfkyie.exe
  C:\Windows\System\UHfkyie.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\uHqhamD.exe
  C:\Windows\System\uHqhamD.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\umjHkDw.exe
  C:\Windows\System\umjHkDw.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\VIPSVAb.exe
  C:\Windows\System\VIPSVAb.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\eHUnPFG.exe
  C:\Windows\System\eHUnPFG.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\QZjgsIF.exe
  C:\Windows\System\QZjgsIF.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\DOgIZwT.exe
  C:\Windows\System\DOgIZwT.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\BRtCmvP.exe
  C:\Windows\System\BRtCmvP.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\cETBRBX.exe
  C:\Windows\System\cETBRBX.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\GKGXDiP.exe
  C:\Windows\System\GKGXDiP.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\ugPWyHX.exe
  C:\Windows\System\ugPWyHX.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\bNILLld.exe
  C:\Windows\System\bNILLld.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\stkNcRk.exe
  C:\Windows\System\stkNcRk.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\MaSkXIP.exe
  C:\Windows\System\MaSkXIP.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\clmMMhW.exe
  C:\Windows\System\clmMMhW.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\byaWsUH.exe
  C:\Windows\System\byaWsUH.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\OniYIyt.exe
  C:\Windows\System\OniYIyt.exe
  2⤵
  - Executes dropped EXE
  PID:500
- C:\Windows\System\hYjJtnr.exe
  C:\Windows\System\hYjJtnr.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\zFLuZIc.exe
  C:\Windows\System\zFLuZIc.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\fZsKFPe.exe
  C:\Windows\System\fZsKFPe.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\RnNTaNF.exe
  C:\Windows\System\RnNTaNF.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\JlcfeDH.exe
  C:\Windows\System\JlcfeDH.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\dyfkQom.exe
  C:\Windows\System\dyfkQom.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\jnPvoSG.exe
  C:\Windows\System\jnPvoSG.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\cVwlEaQ.exe
  C:\Windows\System\cVwlEaQ.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\rjOShQj.exe
  C:\Windows\System\rjOShQj.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\sbvuWGD.exe
  C:\Windows\System\sbvuWGD.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\vqGiXDB.exe
  C:\Windows\System\vqGiXDB.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\vbakymL.exe
  C:\Windows\System\vbakymL.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\oCzwMsc.exe
  C:\Windows\System\oCzwMsc.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\wmObyLa.exe
  C:\Windows\System\wmObyLa.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\mCRCQCR.exe
  C:\Windows\System\mCRCQCR.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\JiPqQeo.exe
  C:\Windows\System\JiPqQeo.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\Qucpbet.exe
  C:\Windows\System\Qucpbet.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\kbpAyYr.exe
  C:\Windows\System\kbpAyYr.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\bwqPBLV.exe
  C:\Windows\System\bwqPBLV.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\gwjdXXR.exe
  C:\Windows\System\gwjdXXR.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\ycpItci.exe
  C:\Windows\System\ycpItci.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\AAcTwgu.exe
  C:\Windows\System\AAcTwgu.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\ZwvqTwu.exe
  C:\Windows\System\ZwvqTwu.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\hRmxjLk.exe
  C:\Windows\System\hRmxjLk.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\nZDjMet.exe
  C:\Windows\System\nZDjMet.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\DpZuJFK.exe
  C:\Windows\System\DpZuJFK.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\gofkiDw.exe
  C:\Windows\System\gofkiDw.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\dYssuCb.exe
  C:\Windows\System\dYssuCb.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\XzLzKMk.exe
  C:\Windows\System\XzLzKMk.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\OahHUoh.exe
  C:\Windows\System\OahHUoh.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\cXxlkZK.exe
  C:\Windows\System\cXxlkZK.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\knTtPqF.exe
  C:\Windows\System\knTtPqF.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\WVkfmkO.exe
  C:\Windows\System\WVkfmkO.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\HSbHFEE.exe
  C:\Windows\System\HSbHFEE.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\KUIxfEj.exe
  C:\Windows\System\KUIxfEj.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\IHUOMtZ.exe
  C:\Windows\System\IHUOMtZ.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\dCphdJd.exe
  C:\Windows\System\dCphdJd.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\ozvsGIY.exe
  C:\Windows\System\ozvsGIY.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\YfvemTL.exe
  C:\Windows\System\YfvemTL.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\HQZMtlG.exe
  C:\Windows\System\HQZMtlG.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\xfvHzMX.exe
  C:\Windows\System\xfvHzMX.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\rQRMxUQ.exe
  C:\Windows\System\rQRMxUQ.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\iLjTFBj.exe
  C:\Windows\System\iLjTFBj.exe
  2⤵
  PID:1668
- C:\Windows\System\KYGDWUI.exe
  C:\Windows\System\KYGDWUI.exe
  2⤵
  PID:1912
- C:\Windows\System\QocWBQR.exe
  C:\Windows\System\QocWBQR.exe
  2⤵
  PID:3060
- C:\Windows\System\IsNjbag.exe
  C:\Windows\System\IsNjbag.exe
  2⤵
  PID:1636
- C:\Windows\System\ucRpQAk.exe
  C:\Windows\System\ucRpQAk.exe
  2⤵
  PID:1524
- C:\Windows\System\tpOWVAo.exe
  C:\Windows\System\tpOWVAo.exe
  2⤵
  PID:2272
- C:\Windows\System\vPHBCyB.exe
  C:\Windows\System\vPHBCyB.exe
  2⤵
  PID:2600
- C:\Windows\System\oUXLmrz.exe
  C:\Windows\System\oUXLmrz.exe
  2⤵
  PID:880
- C:\Windows\System\EhovyAn.exe
  C:\Windows\System\EhovyAn.exe
  2⤵
  PID:2560
- C:\Windows\System\ZsqHlxv.exe
  C:\Windows\System\ZsqHlxv.exe
  2⤵
  PID:3068
- C:\Windows\System\LPIucgW.exe
  C:\Windows\System\LPIucgW.exe
  2⤵
  PID:2504
- C:\Windows\System\wIgzCOP.exe
  C:\Windows\System\wIgzCOP.exe
  2⤵
  PID:2988
- C:\Windows\System\VNEqkGM.exe
  C:\Windows\System\VNEqkGM.exe
  2⤵
  PID:2856
- C:\Windows\System\RvbbwgR.exe
  C:\Windows\System\RvbbwgR.exe
  2⤵
  PID:2696
- C:\Windows\System\RxfmeOM.exe
  C:\Windows\System\RxfmeOM.exe
  2⤵
  PID:320
- C:\Windows\System\AxqbRoF.exe
  C:\Windows\System\AxqbRoF.exe
  2⤵
  PID:356
- C:\Windows\System\NIFODEk.exe
  C:\Windows\System\NIFODEk.exe
  2⤵
  PID:2224
- C:\Windows\System\DnRcFaf.exe
  C:\Windows\System\DnRcFaf.exe
  2⤵
  PID:2424
- C:\Windows\System\IkaEXHW.exe
  C:\Windows\System\IkaEXHW.exe
  2⤵
  PID:2404
- C:\Windows\System\iUEEGrV.exe
  C:\Windows\System\iUEEGrV.exe
  2⤵
  PID:2448
- C:\Windows\System\pwPJUkw.exe
  C:\Windows\System\pwPJUkw.exe
  2⤵
  PID:2452
- C:\Windows\System\TpkZrTC.exe
  C:\Windows\System\TpkZrTC.exe
  2⤵
  PID:1444
- C:\Windows\System\eRAQzzN.exe
  C:\Windows\System\eRAQzzN.exe
  2⤵
  PID:2468
- C:\Windows\System\auOcFFD.exe
  C:\Windows\System\auOcFFD.exe
  2⤵
  PID:1852
- C:\Windows\System\jqZwUHO.exe
  C:\Windows\System\jqZwUHO.exe
  2⤵
  PID:1736
- C:\Windows\System\ikANFkD.exe
  C:\Windows\System\ikANFkD.exe
  2⤵
  PID:676
- C:\Windows\System\WeRkFAE.exe
  C:\Windows\System\WeRkFAE.exe
  2⤵
  PID:328
- C:\Windows\System\zBLLUeS.exe
  C:\Windows\System\zBLLUeS.exe
  2⤵
  PID:696
- C:\Windows\System\nuxkPeE.exe
  C:\Windows\System\nuxkPeE.exe
  2⤵
  PID:1268
- C:\Windows\System\VhUDssq.exe
  C:\Windows\System\VhUDssq.exe
  2⤵
  PID:2012
- C:\Windows\System\CzGfUWb.exe
  C:\Windows\System\CzGfUWb.exe
  2⤵
  PID:1264
- C:\Windows\System\xWJeWYP.exe
  C:\Windows\System\xWJeWYP.exe
  2⤵
  PID:2868
- C:\Windows\System\HvFuDet.exe
  C:\Windows\System\HvFuDet.exe
  2⤵
  PID:2852
- C:\Windows\System\BjdCWLw.exe
  C:\Windows\System\BjdCWLw.exe
  2⤵
  PID:1720
- C:\Windows\System\YXvYiAS.exe
  C:\Windows\System\YXvYiAS.exe
  2⤵
  PID:2076
- C:\Windows\System\mxiFYbN.exe
  C:\Windows\System\mxiFYbN.exe
  2⤵
  PID:452
- C:\Windows\System\dcKvmRA.exe
  C:\Windows\System\dcKvmRA.exe
  2⤵
  PID:1960
- C:\Windows\System\jjrwKQT.exe
  C:\Windows\System\jjrwKQT.exe
  2⤵
  PID:108
- C:\Windows\System\MebBYAb.exe
  C:\Windows\System\MebBYAb.exe
  2⤵
  PID:2264
- C:\Windows\System\RBJhIMg.exe
  C:\Windows\System\RBJhIMg.exe
  2⤵
  PID:392
- C:\Windows\System\Fahujds.exe
  C:\Windows\System\Fahujds.exe
  2⤵
  PID:756
- C:\Windows\System\UXVrGlu.exe
  C:\Windows\System\UXVrGlu.exe
  2⤵
  PID:3024
- C:\Windows\System\bLxcnSn.exe
  C:\Windows\System\bLxcnSn.exe
  2⤵
  PID:2232
- C:\Windows\System\uyuwPkR.exe
  C:\Windows\System\uyuwPkR.exe
  2⤵
  PID:1768
- C:\Windows\System\sIziYMS.exe
  C:\Windows\System\sIziYMS.exe
  2⤵
  PID:2024
- C:\Windows\System\xxckGIZ.exe
  C:\Windows\System\xxckGIZ.exe
  2⤵
  PID:1000
- C:\Windows\System\AiAcaNj.exe
  C:\Windows\System\AiAcaNj.exe
  2⤵
  PID:636
- C:\Windows\System\WoYhCxI.exe
  C:\Windows\System\WoYhCxI.exe
  2⤵
  PID:896
- C:\Windows\System\TlVPqRp.exe
  C:\Windows\System\TlVPqRp.exe
  2⤵
  PID:1508
- C:\Windows\System\KWXHSnE.exe
  C:\Windows\System\KWXHSnE.exe
  2⤵
  PID:1528
- C:\Windows\System\attWmoR.exe
  C:\Windows\System\attWmoR.exe
  2⤵
  PID:3036
- C:\Windows\System\aLCaZmS.exe
  C:\Windows\System\aLCaZmS.exe
  2⤵
  PID:2596
- C:\Windows\System\jvwmSAP.exe
  C:\Windows\System\jvwmSAP.exe
  2⤵
  PID:2436
- C:\Windows\System\eYCttfM.exe
  C:\Windows\System\eYCttfM.exe
  2⤵
  PID:2780
- C:\Windows\System\HKjHoBY.exe
  C:\Windows\System\HKjHoBY.exe
  2⤵
  PID:2776
- C:\Windows\System\UrAtZOZ.exe
  C:\Windows\System\UrAtZOZ.exe
  2⤵
  PID:3052
- C:\Windows\System\dbbTrPT.exe
  C:\Windows\System\dbbTrPT.exe
  2⤵
  PID:1556
- C:\Windows\System\qBeOdKY.exe
  C:\Windows\System\qBeOdKY.exe
  2⤵
  PID:2764
- C:\Windows\System\XxVbpJn.exe
  C:\Windows\System\XxVbpJn.exe
  2⤵
  PID:2652
- C:\Windows\System\vDSJWzM.exe
  C:\Windows\System\vDSJWzM.exe
  2⤵
  PID:2976
- C:\Windows\System\glLYFUf.exe
  C:\Windows\System\glLYFUf.exe
  2⤵
  PID:2668
- C:\Windows\System\QpMmOtP.exe
  C:\Windows\System\QpMmOtP.exe
  2⤵
  PID:1060
- C:\Windows\System\WVXjBRJ.exe
  C:\Windows\System\WVXjBRJ.exe
  2⤵
  PID:1988
- C:\Windows\System\uUejqsN.exe
  C:\Windows\System\uUejqsN.exe
  2⤵
  PID:2492
- C:\Windows\System\HKOSbAh.exe
  C:\Windows\System\HKOSbAh.exe
  2⤵
  PID:2088
- C:\Windows\System\CfzdyFL.exe
  C:\Windows\System\CfzdyFL.exe
  2⤵
  PID:2896
- C:\Windows\System\DUluihu.exe
  C:\Windows\System\DUluihu.exe
  2⤵
  PID:2160
- C:\Windows\System\zGyNwHA.exe
  C:\Windows\System\zGyNwHA.exe
  2⤵
  PID:1600
- C:\Windows\System\DYJxTxf.exe
  C:\Windows\System\DYJxTxf.exe
  2⤵
  PID:1036
- C:\Windows\System\dYyriCt.exe
  C:\Windows\System\dYyriCt.exe
  2⤵
  PID:1484
- C:\Windows\System\rnUSQCm.exe
  C:\Windows\System\rnUSQCm.exe
  2⤵
  PID:2176
- C:\Windows\System\LBZllrO.exe
  C:\Windows\System\LBZllrO.exe
  2⤵
  PID:2344
- C:\Windows\System\SeqLRNR.exe
  C:\Windows\System\SeqLRNR.exe
  2⤵
  PID:1952
- C:\Windows\System\rIvIhqZ.exe
  C:\Windows\System\rIvIhqZ.exe
  2⤵
  PID:2388
- C:\Windows\System\AYIdgUX.exe
  C:\Windows\System\AYIdgUX.exe
  2⤵
  PID:2464
- C:\Windows\System\mvhFGjd.exe
  C:\Windows\System\mvhFGjd.exe
  2⤵
  PID:2936
- C:\Windows\System\vAZnZuD.exe
  C:\Windows\System\vAZnZuD.exe
  2⤵
  PID:2552
- C:\Windows\System\ELxIpat.exe
  C:\Windows\System\ELxIpat.exe
  2⤵
  PID:1896
- C:\Windows\System\slAaHwb.exe
  C:\Windows\System\slAaHwb.exe
  2⤵
  PID:1572
- C:\Windows\System\gtZscHv.exe
  C:\Windows\System\gtZscHv.exe
  2⤵
  PID:3088
- C:\Windows\System\iwwrGVu.exe
  C:\Windows\System\iwwrGVu.exe
  2⤵
  PID:3104
- C:\Windows\System\vtaDCUC.exe
  C:\Windows\System\vtaDCUC.exe
  2⤵
  PID:3120
- C:\Windows\System\NFJnbrR.exe
  C:\Windows\System\NFJnbrR.exe
  2⤵
  PID:3136
- C:\Windows\System\LUtKddn.exe
  C:\Windows\System\LUtKddn.exe
  2⤵
  PID:3152
- C:\Windows\System\FhGVwSf.exe
  C:\Windows\System\FhGVwSf.exe
  2⤵
  PID:3168
- C:\Windows\System\zhzoEXK.exe
  C:\Windows\System\zhzoEXK.exe
  2⤵
  PID:3184
- C:\Windows\System\LnBFaCz.exe
  C:\Windows\System\LnBFaCz.exe
  2⤵
  PID:3200
- C:\Windows\System\mpoCIjz.exe
  C:\Windows\System\mpoCIjz.exe
  2⤵
  PID:3216
- C:\Windows\System\mRrnsnx.exe
  C:\Windows\System\mRrnsnx.exe
  2⤵
  PID:3232
- C:\Windows\System\wcmDLrq.exe
  C:\Windows\System\wcmDLrq.exe
  2⤵
  PID:3248
- C:\Windows\System\czhwqHf.exe
  C:\Windows\System\czhwqHf.exe
  2⤵
  PID:3264
- C:\Windows\System\ydYZJTF.exe
  C:\Windows\System\ydYZJTF.exe
  2⤵
  PID:3280
- C:\Windows\System\GoqBtwj.exe
  C:\Windows\System\GoqBtwj.exe
  2⤵
  PID:3296
- C:\Windows\System\SDCPiui.exe
  C:\Windows\System\SDCPiui.exe
  2⤵
  PID:3312
- C:\Windows\System\RzfaZjx.exe
  C:\Windows\System\RzfaZjx.exe
  2⤵
  PID:3328
- C:\Windows\System\lPazprd.exe
  C:\Windows\System\lPazprd.exe
  2⤵
  PID:3344
- C:\Windows\System\HRpYzYs.exe
  C:\Windows\System\HRpYzYs.exe
  2⤵
  PID:3360
- C:\Windows\System\ERHIVQN.exe
  C:\Windows\System\ERHIVQN.exe
  2⤵
  PID:3376
- C:\Windows\System\NvWcDxJ.exe
  C:\Windows\System\NvWcDxJ.exe
  2⤵
  PID:3392
- C:\Windows\System\nyvOEzy.exe
  C:\Windows\System\nyvOEzy.exe
  2⤵
  PID:3408
- C:\Windows\System\SxuBMJE.exe
  C:\Windows\System\SxuBMJE.exe
  2⤵
  PID:3424
- C:\Windows\System\dITbJqR.exe
  C:\Windows\System\dITbJqR.exe
  2⤵
  PID:3440
- C:\Windows\System\MPSUexy.exe
  C:\Windows\System\MPSUexy.exe
  2⤵
  PID:3456
- C:\Windows\System\nFlmPRm.exe
  C:\Windows\System\nFlmPRm.exe
  2⤵
  PID:3472
- C:\Windows\System\vcRjPLS.exe
  C:\Windows\System\vcRjPLS.exe
  2⤵
  PID:3492
- C:\Windows\System\igdtZxF.exe
  C:\Windows\System\igdtZxF.exe
  2⤵
  PID:3508
- C:\Windows\System\ISkkFVs.exe
  C:\Windows\System\ISkkFVs.exe
  2⤵
  PID:3524
- C:\Windows\System\zadDnvW.exe
  C:\Windows\System\zadDnvW.exe
  2⤵
  PID:3540
- C:\Windows\System\RqSLuwv.exe
  C:\Windows\System\RqSLuwv.exe
  2⤵
  PID:3556
- C:\Windows\System\giIucTY.exe
  C:\Windows\System\giIucTY.exe
  2⤵
  PID:3572
- C:\Windows\System\RBtQJLc.exe
  C:\Windows\System\RBtQJLc.exe
  2⤵
  PID:3588
- C:\Windows\System\jZBgHOa.exe
  C:\Windows\System\jZBgHOa.exe
  2⤵
  PID:3604
- C:\Windows\System\yMjzjqf.exe
  C:\Windows\System\yMjzjqf.exe
  2⤵
  PID:3620
- C:\Windows\System\Colyvuu.exe
  C:\Windows\System\Colyvuu.exe
  2⤵
  PID:3636
- C:\Windows\System\WxuSyMq.exe
  C:\Windows\System\WxuSyMq.exe
  2⤵
  PID:3652
- C:\Windows\System\FClnnjp.exe
  C:\Windows\System\FClnnjp.exe
  2⤵
  PID:3668
- C:\Windows\System\rCbEDkG.exe
  C:\Windows\System\rCbEDkG.exe
  2⤵
  PID:3684
- C:\Windows\System\IKRvRnN.exe
  C:\Windows\System\IKRvRnN.exe
  2⤵
  PID:3700
- C:\Windows\System\scGxQCp.exe
  C:\Windows\System\scGxQCp.exe
  2⤵
  PID:3716
- C:\Windows\System\rWfTcYM.exe
  C:\Windows\System\rWfTcYM.exe
  2⤵
  PID:3732
- C:\Windows\System\Iyvwswd.exe
  C:\Windows\System\Iyvwswd.exe
  2⤵
  PID:3748
- C:\Windows\System\RbHbJgn.exe
  C:\Windows\System\RbHbJgn.exe
  2⤵
  PID:3764
- C:\Windows\System\GMVFhWK.exe
  C:\Windows\System\GMVFhWK.exe
  2⤵
  PID:3780
- C:\Windows\System\pQlEkZy.exe
  C:\Windows\System\pQlEkZy.exe
  2⤵
  PID:3796
- C:\Windows\System\deplTaM.exe
  C:\Windows\System\deplTaM.exe
  2⤵
  PID:3812
- C:\Windows\System\xvcvJMH.exe
  C:\Windows\System\xvcvJMH.exe
  2⤵
  PID:3828
- C:\Windows\System\ftAKNWJ.exe
  C:\Windows\System\ftAKNWJ.exe
  2⤵
  PID:3844
- C:\Windows\System\GDbKyJe.exe
  C:\Windows\System\GDbKyJe.exe
  2⤵
  PID:3860
- C:\Windows\System\BHuvrGS.exe
  C:\Windows\System\BHuvrGS.exe
  2⤵
  PID:3876
- C:\Windows\System\UNeTRbW.exe
  C:\Windows\System\UNeTRbW.exe
  2⤵
  PID:3892
- C:\Windows\System\PApbTCo.exe
  C:\Windows\System\PApbTCo.exe
  2⤵
  PID:3908
- C:\Windows\System\eBXEjSv.exe
  C:\Windows\System\eBXEjSv.exe
  2⤵
  PID:3924
- C:\Windows\System\dSEUbDq.exe
  C:\Windows\System\dSEUbDq.exe
  2⤵
  PID:3940
- C:\Windows\System\EEKRczI.exe
  C:\Windows\System\EEKRczI.exe
  2⤵
  PID:3956
- C:\Windows\System\axZezcp.exe
  C:\Windows\System\axZezcp.exe
  2⤵
  PID:3972
- C:\Windows\System\opGaKJz.exe
  C:\Windows\System\opGaKJz.exe
  2⤵
  PID:3988
- C:\Windows\System\ktkNNoe.exe
  C:\Windows\System\ktkNNoe.exe
  2⤵
  PID:4004
- C:\Windows\System\BvTUyZU.exe
  C:\Windows\System\BvTUyZU.exe
  2⤵
  PID:4020
- C:\Windows\System\Toufcac.exe
  C:\Windows\System\Toufcac.exe
  2⤵
  PID:4036
- C:\Windows\System\LvuGfXq.exe
  C:\Windows\System\LvuGfXq.exe
  2⤵
  PID:4052
- C:\Windows\System\OihvuXy.exe
  C:\Windows\System\OihvuXy.exe
  2⤵
  PID:4068
- C:\Windows\System\EkyuXjr.exe
  C:\Windows\System\EkyuXjr.exe
  2⤵
  PID:4084
- C:\Windows\System\WDyVheV.exe
  C:\Windows\System\WDyVheV.exe
  2⤵
  PID:2924
- C:\Windows\System\iUFhTqN.exe
  C:\Windows\System\iUFhTqN.exe
  2⤵
  PID:596
- C:\Windows\System\rRLvxqe.exe
  C:\Windows\System\rRLvxqe.exe
  2⤵
  PID:1248
- C:\Windows\System\WKEKuvW.exe
  C:\Windows\System\WKEKuvW.exe
  2⤵
  PID:948
- C:\Windows\System\kVLbvwI.exe
  C:\Windows\System\kVLbvwI.exe
  2⤵
  PID:2204
- C:\Windows\System\ERoeyJr.exe
  C:\Windows\System\ERoeyJr.exe
  2⤵
  PID:1532
- C:\Windows\System\WpHQXEh.exe
  C:\Windows\System\WpHQXEh.exe
  2⤵
  PID:2456
- C:\Windows\System\KxndPvZ.exe
  C:\Windows\System\KxndPvZ.exe
  2⤵
  PID:1604
- C:\Windows\System\wSfIHZS.exe
  C:\Windows\System\wSfIHZS.exe
  2⤵
  PID:2736
- C:\Windows\System\LkocHKn.exe
  C:\Windows\System\LkocHKn.exe
  2⤵
  PID:3084
- C:\Windows\System\VxFRqqr.exe
  C:\Windows\System\VxFRqqr.exe
  2⤵
  PID:3116
- C:\Windows\System\dHeKmAK.exe
  C:\Windows\System\dHeKmAK.exe
  2⤵
  PID:3148
- C:\Windows\System\BjsEwLt.exe
  C:\Windows\System\BjsEwLt.exe
  2⤵
  PID:3164
- C:\Windows\System\kDptPXC.exe
  C:\Windows\System\kDptPXC.exe
  2⤵
  PID:3212
- C:\Windows\System\ZpKbzyO.exe
  C:\Windows\System\ZpKbzyO.exe
  2⤵
  PID:3244
- C:\Windows\System\yFzVavy.exe
  C:\Windows\System\yFzVavy.exe
  2⤵
  PID:3276
- C:\Windows\System\DBInAPf.exe
  C:\Windows\System\DBInAPf.exe
  2⤵
  PID:3308
- C:\Windows\System\yIxQHLq.exe
  C:\Windows\System\yIxQHLq.exe
  2⤵
  PID:3340
- C:\Windows\System\iZNcGqe.exe
  C:\Windows\System\iZNcGqe.exe
  2⤵
  PID:3356
- C:\Windows\System\QPDqUiD.exe
  C:\Windows\System\QPDqUiD.exe
  2⤵
  PID:3388
- C:\Windows\System\gKLxkPd.exe
  C:\Windows\System\gKLxkPd.exe
  2⤵
  PID:3420
- C:\Windows\System\YnJUJvO.exe
  C:\Windows\System\YnJUJvO.exe
  2⤵
  PID:3452
- C:\Windows\System\pZAjNNo.exe
  C:\Windows\System\pZAjNNo.exe
  2⤵
  PID:3488
- C:\Windows\System\XDbZeKN.exe
  C:\Windows\System\XDbZeKN.exe
  2⤵
  PID:3532
- C:\Windows\System\TNWdWpd.exe
  C:\Windows\System\TNWdWpd.exe
  2⤵
  PID:3552
- C:\Windows\System\HxXLwjB.exe
  C:\Windows\System\HxXLwjB.exe
  2⤵
  PID:3600
- C:\Windows\System\lPOqwLS.exe
  C:\Windows\System\lPOqwLS.exe
  2⤵
  PID:3616
- C:\Windows\System\ZdAofmj.exe
  C:\Windows\System\ZdAofmj.exe
  2⤵
  PID:3660
- C:\Windows\System\EgdoGNP.exe
  C:\Windows\System\EgdoGNP.exe
  2⤵
  PID:3692
- C:\Windows\System\EvAUlMi.exe
  C:\Windows\System\EvAUlMi.exe
  2⤵
  PID:3708
- C:\Windows\System\DYXbbyg.exe
  C:\Windows\System\DYXbbyg.exe
  2⤵
  PID:3756
- C:\Windows\System\zLUNXmO.exe
  C:\Windows\System\zLUNXmO.exe
  2⤵
  PID:3772
- C:\Windows\System\RlkqGgj.exe
  C:\Windows\System\RlkqGgj.exe
  2⤵
  PID:3820
- C:\Windows\System\JZlzfkd.exe
  C:\Windows\System\JZlzfkd.exe
  2⤵
  PID:3836
- C:\Windows\System\VbTKNSV.exe
  C:\Windows\System\VbTKNSV.exe
  2⤵
  PID:3868
- C:\Windows\System\fYhFbyY.exe
  C:\Windows\System\fYhFbyY.exe
  2⤵
  PID:2460
- C:\Windows\System\DRclONI.exe
  C:\Windows\System\DRclONI.exe
  2⤵
  PID:3920
- C:\Windows\System\TWbOnDm.exe
  C:\Windows\System\TWbOnDm.exe
  2⤵
  PID:3936
- C:\Windows\System\CMcKEhh.exe
  C:\Windows\System\CMcKEhh.exe
  2⤵
  PID:3984
- C:\Windows\System\uhBDWeh.exe
  C:\Windows\System\uhBDWeh.exe
  2⤵
  PID:4016
- C:\Windows\System\AQSeCOs.exe
  C:\Windows\System\AQSeCOs.exe
  2⤵
  PID:4048
- C:\Windows\System\DBRNCUO.exe
  C:\Windows\System\DBRNCUO.exe
  2⤵
  PID:4076
- C:\Windows\System\nvgGWBa.exe
  C:\Windows\System\nvgGWBa.exe
  2⤵
  PID:2260
- C:\Windows\System\uTbTJbH.exe
  C:\Windows\System\uTbTJbH.exe
  2⤵
  PID:1880
- C:\Windows\System\zFPswVB.exe
  C:\Windows\System\zFPswVB.exe
  2⤵
  PID:1440
- C:\Windows\System\DykUHrD.exe
  C:\Windows\System\DykUHrD.exe
  2⤵
  PID:2676
- C:\Windows\System\Yvurtlp.exe
  C:\Windows\System\Yvurtlp.exe
  2⤵
  PID:2660
- C:\Windows\System\lasadOO.exe
  C:\Windows\System\lasadOO.exe
  2⤵
  PID:1240
- C:\Windows\System\rltKjir.exe
  C:\Windows\System\rltKjir.exe
  2⤵
  PID:540
- C:\Windows\System\UJdpfIw.exe
  C:\Windows\System\UJdpfIw.exe
  2⤵
  PID:3208
- C:\Windows\System\xlSWMbp.exe
  C:\Windows\System\xlSWMbp.exe
  2⤵
  PID:3240
- C:\Windows\System\ImjRwub.exe
  C:\Windows\System\ImjRwub.exe
  2⤵
  PID:772
- C:\Windows\System\tSMXkhK.exe
  C:\Windows\System\tSMXkhK.exe
  2⤵
  PID:3324
- C:\Windows\System\QkZOPVI.exe
  C:\Windows\System\QkZOPVI.exe
  2⤵
  PID:1452
- C:\Windows\System\MAaMeTb.exe
  C:\Windows\System\MAaMeTb.exe
  2⤵
  PID:3416
- C:\Windows\System\gCrSYrd.exe
  C:\Windows\System\gCrSYrd.exe
  2⤵
  PID:3516
- C:\Windows\System\GHPcYKL.exe
  C:\Windows\System\GHPcYKL.exe
  2⤵
  PID:580
- C:\Windows\System\zRBjoAY.exe
  C:\Windows\System\zRBjoAY.exe
  2⤵
  PID:2956
- C:\Windows\System\WhnizyO.exe
  C:\Windows\System\WhnizyO.exe
  2⤵
  PID:3632
- C:\Windows\System\qitxGEz.exe
  C:\Windows\System\qitxGEz.exe
  2⤵
  PID:864
- C:\Windows\System\nceJLcT.exe
  C:\Windows\System\nceJLcT.exe
  2⤵
  PID:3676
- C:\Windows\System\cAvMKGZ.exe
  C:\Windows\System\cAvMKGZ.exe
  2⤵
  PID:1708
- C:\Windows\System\fsgMPdl.exe
  C:\Windows\System\fsgMPdl.exe
  2⤵
  PID:3744
- C:\Windows\System\jTpPHrN.exe
  C:\Windows\System\jTpPHrN.exe
  2⤵
  PID:3792
- C:\Windows\System\cVByBel.exe
  C:\Windows\System\cVByBel.exe
  2⤵
  PID:3852
- C:\Windows\System\xmpGlfZ.exe
  C:\Windows\System\xmpGlfZ.exe
  2⤵
  PID:3900
- C:\Windows\System\wfuEPCQ.exe
  C:\Windows\System\wfuEPCQ.exe
  2⤵
  PID:4060
- C:\Windows\System\JmCqNDH.exe
  C:\Windows\System\JmCqNDH.exe
  2⤵
  PID:4080
- C:\Windows\System\sNzunyo.exe
  C:\Windows\System\sNzunyo.exe
  2⤵
  PID:1088
- C:\Windows\System\QbrRNEa.exe
  C:\Windows\System\QbrRNEa.exe
  2⤵
  PID:2864
- C:\Windows\System\xZvIqYR.exe
  C:\Windows\System\xZvIqYR.exe
  2⤵
  PID:2748
- C:\Windows\System\aXnwzGa.exe
  C:\Windows\System\aXnwzGa.exe
  2⤵
  PID:3112
- C:\Windows\System\gCZiJWF.exe
  C:\Windows\System\gCZiJWF.exe
  2⤵
  PID:1972
- C:\Windows\System\qvoaxKM.exe
  C:\Windows\System\qvoaxKM.exe
  2⤵
  PID:3228
- C:\Windows\System\PnkIpAz.exe
  C:\Windows\System\PnkIpAz.exe
  2⤵
  PID:556
- C:\Windows\System\qllYceW.exe
  C:\Windows\System\qllYceW.exe
  2⤵
  PID:3372
- C:\Windows\System\CiFExsV.exe
  C:\Windows\System\CiFExsV.exe
  2⤵
  PID:3548
- C:\Windows\System\ZxjCnyP.exe
  C:\Windows\System\ZxjCnyP.exe
  2⤵
  PID:3564
- C:\Windows\System\HpEhdWy.exe
  C:\Windows\System\HpEhdWy.exe
  2⤵
  PID:1228
- C:\Windows\System\WBupvis.exe
  C:\Windows\System\WBupvis.exe
  2⤵
  PID:3712
- C:\Windows\System\RkpWAbX.exe
  C:\Windows\System\RkpWAbX.exe
  2⤵
  PID:4100
- C:\Windows\System\IUbRdcZ.exe
  C:\Windows\System\IUbRdcZ.exe
  2⤵
  PID:4116
- C:\Windows\System\stKuRTe.exe
  C:\Windows\System\stKuRTe.exe
  2⤵
  PID:4132
- C:\Windows\System\fcKwfGC.exe
  C:\Windows\System\fcKwfGC.exe
  2⤵
  PID:4148
- C:\Windows\System\pgHKUTt.exe
  C:\Windows\System\pgHKUTt.exe
  2⤵
  PID:4164
- C:\Windows\System\QBDhRlF.exe
  C:\Windows\System\QBDhRlF.exe
  2⤵
  PID:4180
- C:\Windows\System\usVRKvI.exe
  C:\Windows\System\usVRKvI.exe
  2⤵
  PID:4196
- C:\Windows\System\YDtAtVs.exe
  C:\Windows\System\YDtAtVs.exe
  2⤵
  PID:4212
- C:\Windows\System\ecCIUwK.exe
  C:\Windows\System\ecCIUwK.exe
  2⤵
  PID:4228
- C:\Windows\System\coAByjk.exe
  C:\Windows\System\coAByjk.exe
  2⤵
  PID:4244
- C:\Windows\System\uczbvzh.exe
  C:\Windows\System\uczbvzh.exe
  2⤵
  PID:4260
- C:\Windows\System\vFGmZwz.exe
  C:\Windows\System\vFGmZwz.exe
  2⤵
  PID:4276
- C:\Windows\System\RwRVXbV.exe
  C:\Windows\System\RwRVXbV.exe
  2⤵
  PID:4292
- C:\Windows\System\tgsEFVp.exe
  C:\Windows\System\tgsEFVp.exe
  2⤵
  PID:4308
- C:\Windows\System\LJjUfBq.exe
  C:\Windows\System\LJjUfBq.exe
  2⤵
  PID:4324
- C:\Windows\System\SmkHDLr.exe
  C:\Windows\System\SmkHDLr.exe
  2⤵
  PID:4340
- C:\Windows\System\xLKtBxs.exe
  C:\Windows\System\xLKtBxs.exe
  2⤵
  PID:4356
- C:\Windows\System\xNIWXnE.exe
  C:\Windows\System\xNIWXnE.exe
  2⤵
  PID:4372
- C:\Windows\System\QkiDiOZ.exe
  C:\Windows\System\QkiDiOZ.exe
  2⤵
  PID:4388
- C:\Windows\System\twnYWvv.exe
  C:\Windows\System\twnYWvv.exe
  2⤵
  PID:4404
- C:\Windows\System\uYiBlsS.exe
  C:\Windows\System\uYiBlsS.exe
  2⤵
  PID:4420
- C:\Windows\System\KiXroKz.exe
  C:\Windows\System\KiXroKz.exe
  2⤵
  PID:4436
- C:\Windows\System\txbERAt.exe
  C:\Windows\System\txbERAt.exe
  2⤵
  PID:4452
- C:\Windows\System\jyNFJBg.exe
  C:\Windows\System\jyNFJBg.exe
  2⤵
  PID:4468
- C:\Windows\System\AoXQxRu.exe
  C:\Windows\System\AoXQxRu.exe
  2⤵
  PID:4484
- C:\Windows\System\RaVkwMK.exe
  C:\Windows\System\RaVkwMK.exe
  2⤵
  PID:4500
- C:\Windows\System\ZtVbnom.exe
  C:\Windows\System\ZtVbnom.exe
  2⤵
  PID:4516
- C:\Windows\System\xPlstfw.exe
  C:\Windows\System\xPlstfw.exe
  2⤵
  PID:4532
- C:\Windows\System\OSvyzMp.exe
  C:\Windows\System\OSvyzMp.exe
  2⤵
  PID:4548
- C:\Windows\System\IdIfMQm.exe
  C:\Windows\System\IdIfMQm.exe
  2⤵
  PID:4564
- C:\Windows\System\gHqEzNn.exe
  C:\Windows\System\gHqEzNn.exe
  2⤵
  PID:4580
- C:\Windows\System\ludjzwD.exe
  C:\Windows\System\ludjzwD.exe
  2⤵
  PID:4596
- C:\Windows\System\CuzQyhJ.exe
  C:\Windows\System\CuzQyhJ.exe
  2⤵
  PID:4612
- C:\Windows\System\XTvQjjX.exe
  C:\Windows\System\XTvQjjX.exe
  2⤵
  PID:4628
- C:\Windows\System\WALbboW.exe
  C:\Windows\System\WALbboW.exe
  2⤵
  PID:4644
- C:\Windows\System\dvoXGGI.exe
  C:\Windows\System\dvoXGGI.exe
  2⤵
  PID:4660
- C:\Windows\System\dIZAopA.exe
  C:\Windows\System\dIZAopA.exe
  2⤵
  PID:4676
- C:\Windows\System\HlTKtjw.exe
  C:\Windows\System\HlTKtjw.exe
  2⤵
  PID:4692
- C:\Windows\System\xpysAnU.exe
  C:\Windows\System\xpysAnU.exe
  2⤵
  PID:4708
- C:\Windows\System\PkMghGG.exe
  C:\Windows\System\PkMghGG.exe
  2⤵
  PID:2080
- C:\Windows\System\ZbuEXjP.exe
  C:\Windows\System\ZbuEXjP.exe
  2⤵
  PID:2772
- C:\Windows\System\HPHsFcZ.exe
  C:\Windows\System\HPHsFcZ.exe
  2⤵
  PID:3180
- C:\Windows\System\nOmEnfQ.exe
  C:\Windows\System\nOmEnfQ.exe
  2⤵
  PID:4140
- C:\Windows\System\YHqZhJr.exe
  C:\Windows\System\YHqZhJr.exe
  2⤵
  PID:3664
- C:\Windows\System\uWiESQi.exe
  C:\Windows\System\uWiESQi.exe
  2⤵
  PID:4428
- C:\Windows\System\MPegeVr.exe
  C:\Windows\System\MPegeVr.exe
  2⤵
  PID:4336
- C:\Windows\System\eotYDRa.exe
  C:\Windows\System\eotYDRa.exe
  2⤵
  PID:4560
- C:\Windows\System\GSPVMmt.exe
  C:\Windows\System\GSPVMmt.exe
  2⤵
  PID:4624
- C:\Windows\System\qNQNKic.exe
  C:\Windows\System\qNQNKic.exe
  2⤵
  PID:4524
- C:\Windows\System\aXbvrpU.exe
  C:\Windows\System\aXbvrpU.exe
  2⤵
  PID:4784
- C:\Windows\System\hTbEuBS.exe
  C:\Windows\System\hTbEuBS.exe
  2⤵
  PID:4720
- C:\Windows\System\vliBtdU.exe
  C:\Windows\System\vliBtdU.exe
  2⤵
  PID:4736
- C:\Windows\System\OvKOOdJ.exe
  C:\Windows\System\OvKOOdJ.exe
  2⤵
  PID:4752
- C:\Windows\System\syXVtjE.exe
  C:\Windows\System\syXVtjE.exe
  2⤵
  PID:4768
- C:\Windows\System\eDaQpNF.exe
  C:\Windows\System\eDaQpNF.exe
  2⤵
  PID:4788
- C:\Windows\System\gWvJNbO.exe
  C:\Windows\System\gWvJNbO.exe
  2⤵
  PID:4804
- C:\Windows\System\wjEhRSO.exe
  C:\Windows\System\wjEhRSO.exe
  2⤵
  PID:4820
- C:\Windows\System\jolNzra.exe
  C:\Windows\System\jolNzra.exe
  2⤵
  PID:4836
- C:\Windows\System\xRgeeVO.exe
  C:\Windows\System\xRgeeVO.exe
  2⤵
  PID:4852
- C:\Windows\System\qKHDRYD.exe
  C:\Windows\System\qKHDRYD.exe
  2⤵
  PID:4872
- C:\Windows\System\GYpBueF.exe
  C:\Windows\System\GYpBueF.exe
  2⤵
  PID:4888
- C:\Windows\System\TlROxEh.exe
  C:\Windows\System\TlROxEh.exe
  2⤵
  PID:4904
- C:\Windows\System\ustSiua.exe
  C:\Windows\System\ustSiua.exe
  2⤵
  PID:4920
- C:\Windows\System\BKdLupU.exe
  C:\Windows\System\BKdLupU.exe
  2⤵
  PID:4936
- C:\Windows\System\vUkAqRx.exe
  C:\Windows\System\vUkAqRx.exe
  2⤵
  PID:4952
- C:\Windows\System\wzMHfiQ.exe
  C:\Windows\System\wzMHfiQ.exe
  2⤵
  PID:4968
- C:\Windows\System\GvvqzDN.exe
  C:\Windows\System\GvvqzDN.exe
  2⤵
  PID:4984
- C:\Windows\System\qooeJTt.exe
  C:\Windows\System\qooeJTt.exe
  2⤵
  PID:5000
- C:\Windows\System\EmOrEja.exe
  C:\Windows\System\EmOrEja.exe
  2⤵
  PID:5016
- C:\Windows\System\UZiMxeG.exe
  C:\Windows\System\UZiMxeG.exe
  2⤵
  PID:5032
- C:\Windows\System\oOZrmTd.exe
  C:\Windows\System\oOZrmTd.exe
  2⤵
  PID:5052
- C:\Windows\System\htreZke.exe
  C:\Windows\System\htreZke.exe
  2⤵
  PID:4156
- C:\Windows\System\pdnZsaC.exe
  C:\Windows\System\pdnZsaC.exe
  2⤵
  PID:4576
- C:\Windows\System\UmneLDE.exe
  C:\Windows\System\UmneLDE.exe
  2⤵
  PID:1552
- C:\Windows\System\jtQHnyn.exe
  C:\Windows\System\jtQHnyn.exe
  2⤵
  PID:4996
- C:\Windows\System\pwWZDfP.exe
  C:\Windows\System\pwWZDfP.exe
  2⤵
  PID:4432
- C:\Windows\System\goUKYRU.exe
  C:\Windows\System\goUKYRU.exe
  2⤵
  PID:4684
- C:\Windows\System\dHJVCxS.exe
  C:\Windows\System\dHJVCxS.exe
  2⤵
  PID:4748
- C:\Windows\System\sZWVHJR.exe
  C:\Windows\System\sZWVHJR.exe
  2⤵
  PID:4844
- C:\Windows\System\BfiKaoe.exe
  C:\Windows\System\BfiKaoe.exe
  2⤵
  PID:4916
- C:\Windows\System\IxWslEA.exe
  C:\Windows\System\IxWslEA.exe
  2⤵
  PID:1732
- C:\Windows\System\PAKxzEJ.exe
  C:\Windows\System\PAKxzEJ.exe
  2⤵
  PID:4224
- C:\Windows\System\WKPhwon.exe
  C:\Windows\System\WKPhwon.exe
  2⤵
  PID:1976
- C:\Windows\System\yDpQRtO.exe
  C:\Windows\System\yDpQRtO.exe
  2⤵
  PID:4032
- C:\Windows\System\HSaJkUF.exe
  C:\Windows\System\HSaJkUF.exe
  2⤵
  PID:4928
- C:\Windows\System\wwPrzMS.exe
  C:\Windows\System\wwPrzMS.exe
  2⤵
  PID:4780
- C:\Windows\System\Pxpuxrl.exe
  C:\Windows\System\Pxpuxrl.exe
  2⤵
  PID:4656
- C:\Windows\System\zfSdCeZ.exe
  C:\Windows\System\zfSdCeZ.exe
  2⤵
  PID:4980
- C:\Windows\System\zmUhCTK.exe
  C:\Windows\System\zmUhCTK.exe
  2⤵
  PID:2324
- C:\Windows\System\knQyeWu.exe
  C:\Windows\System\knQyeWu.exe
  2⤵
  PID:5092
- C:\Windows\System\vrLCRfw.exe
  C:\Windows\System\vrLCRfw.exe
  2⤵
  PID:1548
- C:\Windows\System\JqWNgJV.exe
  C:\Windows\System\JqWNgJV.exe
  2⤵
  PID:5112
- C:\Windows\System\uOjBaZR.exe
  C:\Windows\System\uOjBaZR.exe
  2⤵
  PID:3628
- C:\Windows\System\ZRFwGwA.exe
  C:\Windows\System\ZRFwGwA.exe
  2⤵
  PID:2960
- C:\Windows\System\GhkioOW.exe
  C:\Windows\System\GhkioOW.exe
  2⤵
  PID:5028
- C:\Windows\System\IbirzUz.exe
  C:\Windows\System\IbirzUz.exe
  2⤵
  PID:4636
- C:\Windows\System\KpatqfN.exe
  C:\Windows\System\KpatqfN.exe
  2⤵
  PID:4884
- C:\Windows\System\oHvoiMT.exe
  C:\Windows\System\oHvoiMT.exe
  2⤵
  PID:4900
- C:\Windows\System\KlFXrrD.exe
  C:\Windows\System\KlFXrrD.exe
  2⤵
  PID:5068
- C:\Windows\System\nyfSkUt.exe
  C:\Windows\System\nyfSkUt.exe
  2⤵
  PID:2132
- C:\Windows\System\uZJVASA.exe
  C:\Windows\System\uZJVASA.exe
  2⤵
  PID:3884
- C:\Windows\System\AojgVUj.exe
  C:\Windows\System\AojgVUj.exe
  2⤵
  PID:4284
- C:\Windows\System\gBVInxR.exe
  C:\Windows\System\gBVInxR.exe
  2⤵
  PID:1456
- C:\Windows\System\FUzhQYt.exe
  C:\Windows\System\FUzhQYt.exe
  2⤵
  PID:3952
- C:\Windows\System\PAqqzOu.exe
  C:\Windows\System\PAqqzOu.exe
  2⤵
  PID:4348
- C:\Windows\System\lJEiuhb.exe
  C:\Windows\System\lJEiuhb.exe
  2⤵
  PID:2536
- C:\Windows\System\XYuIsYd.exe
  C:\Windows\System\XYuIsYd.exe
  2⤵
  PID:4796
- C:\Windows\System\Dkemtyz.exe
  C:\Windows\System\Dkemtyz.exe
  2⤵
  PID:3612
- C:\Windows\System\tTkStRJ.exe
  C:\Windows\System\tTkStRJ.exe
  2⤵
  PID:4412
- C:\Windows\System\MGRbcjM.exe
  C:\Windows\System\MGRbcjM.exe
  2⤵
  PID:1920
- C:\Windows\System\KQFVDtr.exe
  C:\Windows\System\KQFVDtr.exe
  2⤵
  PID:4992
- C:\Windows\System\gXTWbsT.exe
  C:\Windows\System\gXTWbsT.exe
  2⤵
  PID:4512
- C:\Windows\System\TaMmixW.exe
  C:\Windows\System\TaMmixW.exe
  2⤵
  PID:1900
- C:\Windows\System\ofYwUQd.exe
  C:\Windows\System\ofYwUQd.exe
  2⤵
  PID:3776
- C:\Windows\System\RbwSbTq.exe
  C:\Windows\System\RbwSbTq.exe
  2⤵
  PID:4188
- C:\Windows\System\CQkRkXF.exe
  C:\Windows\System\CQkRkXF.exe
  2⤵
  PID:4464
- C:\Windows\System\CxDiZBv.exe
  C:\Windows\System\CxDiZBv.exe
  2⤵
  PID:4760
- C:\Windows\System\UHHYLtI.exe
  C:\Windows\System\UHHYLtI.exe
  2⤵
  PID:4812
- C:\Windows\System\cRwkHja.exe
  C:\Windows\System\cRwkHja.exe
  2⤵
  PID:4256
- C:\Windows\System\vadkYQN.exe
  C:\Windows\System\vadkYQN.exe
  2⤵
  PID:2348
- C:\Windows\System\npsLXmW.exe
  C:\Windows\System\npsLXmW.exe
  2⤵
  PID:4716
- C:\Windows\System\dotvhRQ.exe
  C:\Windows\System\dotvhRQ.exe
  2⤵
  PID:4732
- C:\Windows\System\nIAyZms.exe
  C:\Windows\System\nIAyZms.exe
  2⤵
  PID:5124
- C:\Windows\System\bPbFmsB.exe
  C:\Windows\System\bPbFmsB.exe
  2⤵
  PID:5140
- C:\Windows\System\zCIuape.exe
  C:\Windows\System\zCIuape.exe
  2⤵
  PID:5160
- C:\Windows\System\kaAEIqH.exe
  C:\Windows\System\kaAEIqH.exe
  2⤵
  PID:5176
- C:\Windows\System\naAArof.exe
  C:\Windows\System\naAArof.exe
  2⤵
  PID:5192
- C:\Windows\System\pYhzrIP.exe
  C:\Windows\System\pYhzrIP.exe
  2⤵
  PID:5208
- C:\Windows\System\sZjAavT.exe
  C:\Windows\System\sZjAavT.exe
  2⤵
  PID:5228
- C:\Windows\System\CJzYxBX.exe
  C:\Windows\System\CJzYxBX.exe
  2⤵
  PID:5244
- C:\Windows\System\kidhCZv.exe
  C:\Windows\System\kidhCZv.exe
  2⤵
  PID:5260
- C:\Windows\System\kfgZTBN.exe
  C:\Windows\System\kfgZTBN.exe
  2⤵
  PID:5276
- C:\Windows\System\UOHAQJk.exe
  C:\Windows\System\UOHAQJk.exe
  2⤵
  PID:5296
- C:\Windows\System\giJJEbm.exe
  C:\Windows\System\giJJEbm.exe
  2⤵
  PID:5312
- C:\Windows\System\bQjZefT.exe
  C:\Windows\System\bQjZefT.exe
  2⤵
  PID:5328
- C:\Windows\System\hnxCXea.exe
  C:\Windows\System\hnxCXea.exe
  2⤵
  PID:5348
- C:\Windows\System\XWNMBrA.exe
  C:\Windows\System\XWNMBrA.exe
  2⤵
  PID:5364
- C:\Windows\System\InFkbxI.exe
  C:\Windows\System\InFkbxI.exe
  2⤵
  PID:5380
- C:\Windows\System\konUmEL.exe
  C:\Windows\System\konUmEL.exe
  2⤵
  PID:5396
- C:\Windows\System\eqJIIbo.exe
  C:\Windows\System\eqJIIbo.exe
  2⤵
  PID:5412
- C:\Windows\System\tjZiANY.exe
  C:\Windows\System\tjZiANY.exe
  2⤵
  PID:5432
- C:\Windows\System\pPixxNu.exe
  C:\Windows\System\pPixxNu.exe
  2⤵
  PID:5456
- C:\Windows\System\wszaPiU.exe
  C:\Windows\System\wszaPiU.exe
  2⤵
  PID:5472
- C:\Windows\System\rwcUhIg.exe
  C:\Windows\System\rwcUhIg.exe
  2⤵
  PID:5488
- C:\Windows\System\XIiAnWX.exe
  C:\Windows\System\XIiAnWX.exe
  2⤵
  PID:5504
- C:\Windows\System\aBaUWlR.exe
  C:\Windows\System\aBaUWlR.exe
  2⤵
  PID:5592
- C:\Windows\System\YxMqDuR.exe
  C:\Windows\System\YxMqDuR.exe
  2⤵
  PID:5628
- C:\Windows\System\ssFfIsy.exe
  C:\Windows\System\ssFfIsy.exe
  2⤵
  PID:5644
- C:\Windows\System\FwVNbhF.exe
  C:\Windows\System\FwVNbhF.exe
  2⤵
  PID:5660
- C:\Windows\System\RDnMYJT.exe
  C:\Windows\System\RDnMYJT.exe
  2⤵
  PID:5680
- C:\Windows\System\qciohki.exe
  C:\Windows\System\qciohki.exe
  2⤵
  PID:5700
- C:\Windows\System\IKAzIjJ.exe
  C:\Windows\System\IKAzIjJ.exe
  2⤵
  PID:5820
- C:\Windows\System\bFyfkoB.exe
  C:\Windows\System\bFyfkoB.exe
  2⤵
  PID:5836
- C:\Windows\System\STCNAda.exe
  C:\Windows\System\STCNAda.exe
  2⤵
  PID:5852
- C:\Windows\System\ZveTEll.exe
  C:\Windows\System\ZveTEll.exe
  2⤵
  PID:5872
- C:\Windows\System\nkiJHLX.exe
  C:\Windows\System\nkiJHLX.exe
  2⤵
  PID:5888
- C:\Windows\System\MMxswvK.exe
  C:\Windows\System\MMxswvK.exe
  2⤵
  PID:5904
- C:\Windows\System\yTHjDTB.exe
  C:\Windows\System\yTHjDTB.exe
  2⤵
  PID:5920
- C:\Windows\System\JfpkwNR.exe
  C:\Windows\System\JfpkwNR.exe
  2⤵
  PID:5936
- C:\Windows\System\zaMsUMN.exe
  C:\Windows\System\zaMsUMN.exe
  2⤵
  PID:5952
- C:\Windows\System\txBExhv.exe
  C:\Windows\System\txBExhv.exe
  2⤵
  PID:5976
- C:\Windows\System\nrSryen.exe
  C:\Windows\System\nrSryen.exe
  2⤵
  PID:6000
- C:\Windows\System\SeHYdOC.exe
  C:\Windows\System\SeHYdOC.exe
  2⤵
  PID:6016
- C:\Windows\System\INQgCuc.exe
  C:\Windows\System\INQgCuc.exe
  2⤵
  PID:6032
- C:\Windows\System\RxPujAj.exe
  C:\Windows\System\RxPujAj.exe
  2⤵
  PID:6048
- C:\Windows\System\STmweYY.exe
  C:\Windows\System\STmweYY.exe
  2⤵
  PID:6068
- C:\Windows\System\BwOUlUb.exe
  C:\Windows\System\BwOUlUb.exe
  2⤵
  PID:6084
- C:\Windows\System\ndGwlha.exe
  C:\Windows\System\ndGwlha.exe
  2⤵
  PID:6100
- C:\Windows\System\FiiSRRA.exe
  C:\Windows\System\FiiSRRA.exe
  2⤵
  PID:6116
- C:\Windows\System\hajsmDy.exe
  C:\Windows\System\hajsmDy.exe
  2⤵
  PID:6136
- C:\Windows\System\swfPzQd.exe
  C:\Windows\System\swfPzQd.exe
  2⤵
  PID:5172
- C:\Windows\System\FsUHIRc.exe
  C:\Windows\System\FsUHIRc.exe
  2⤵
  PID:5240
- C:\Windows\System\ykolHzW.exe
  C:\Windows\System\ykolHzW.exe
  2⤵
  PID:4508
- C:\Windows\System\AfofUfb.exe
  C:\Windows\System\AfofUfb.exe
  2⤵
  PID:5344
- C:\Windows\System\waMavPY.exe
  C:\Windows\System\waMavPY.exe
  2⤵
  PID:5376
- C:\Windows\System\ylDJEew.exe
  C:\Windows\System\ylDJEew.exe
  2⤵
  PID:5040
- C:\Windows\System\kcgNqvy.exe
  C:\Windows\System\kcgNqvy.exe
  2⤵
  PID:4592
- C:\Windows\System\cXbqdkW.exe
  C:\Windows\System\cXbqdkW.exe
  2⤵
  PID:4832
- C:\Windows\System\IlVWtts.exe
  C:\Windows\System\IlVWtts.exe
  2⤵
  PID:4320
- C:\Windows\System\HZSgOvc.exe
  C:\Windows\System\HZSgOvc.exe
  2⤵
  PID:4960
- C:\Windows\System\rGsazXx.exe
  C:\Windows\System\rGsazXx.exe
  2⤵
  PID:5044
- C:\Windows\System\PkMISur.exe
  C:\Windows\System\PkMISur.exe
  2⤵
  PID:1660
- C:\Windows\System\MiINFCn.exe
  C:\Windows\System\MiINFCn.exe
  2⤵
  PID:4352
- C:\Windows\System\pffWeVq.exe
  C:\Windows\System\pffWeVq.exe
  2⤵
  PID:5216
- C:\Windows\System\etAKCxA.exe
  C:\Windows\System\etAKCxA.exe
  2⤵
  PID:5256
- C:\Windows\System\FsAaCtb.exe
  C:\Windows\System\FsAaCtb.exe
  2⤵
  PID:5360
- C:\Windows\System\IlhQtlI.exe
  C:\Windows\System\IlhQtlI.exe
  2⤵
  PID:5420
- C:\Windows\System\lieszlj.exe
  C:\Windows\System\lieszlj.exe
  2⤵
  PID:5428
- C:\Windows\System\ialTqqP.exe
  C:\Windows\System\ialTqqP.exe
  2⤵
  PID:5500
- C:\Windows\System\oQcFtyK.exe
  C:\Windows\System\oQcFtyK.exe
  2⤵
  PID:5188
- C:\Windows\System\JkTmwDR.exe
  C:\Windows\System\JkTmwDR.exe
  2⤵
  PID:5452
- C:\Windows\System\brZiFFJ.exe
  C:\Windows\System\brZiFFJ.exe
  2⤵
  PID:5520
- C:\Windows\System\oAepDkH.exe
  C:\Windows\System\oAepDkH.exe
  2⤵
  PID:5536
- C:\Windows\System\CaWheSQ.exe
  C:\Windows\System\CaWheSQ.exe
  2⤵
  PID:5556
- C:\Windows\System\mKMJXQj.exe
  C:\Windows\System\mKMJXQj.exe
  2⤵
  PID:5576
- C:\Windows\System\rRrotcd.exe
  C:\Windows\System\rRrotcd.exe
  2⤵
  PID:5600
- C:\Windows\System\derRjIS.exe
  C:\Windows\System\derRjIS.exe
  2⤵
  PID:5636
- C:\Windows\System\HLZMDjF.exe
  C:\Windows\System\HLZMDjF.exe
  2⤵
  PID:5624
- C:\Windows\System\FsHHKsi.exe
  C:\Windows\System\FsHHKsi.exe
  2⤵
  PID:5728
- C:\Windows\System\pSMEeDF.exe
  C:\Windows\System\pSMEeDF.exe
  2⤵
  PID:5748
- C:\Windows\System\JhwJzkx.exe
  C:\Windows\System\JhwJzkx.exe
  2⤵
  PID:5768
- C:\Windows\System\DkSirgZ.exe
  C:\Windows\System\DkSirgZ.exe
  2⤵
  PID:5788
- C:\Windows\System\gsCINGK.exe
  C:\Windows\System\gsCINGK.exe
  2⤵
  PID:5804
- C:\Windows\System\IMeDUld.exe
  C:\Windows\System\IMeDUld.exe
  2⤵
  PID:5688
- C:\Windows\System\fmVTYtJ.exe
  C:\Windows\System\fmVTYtJ.exe
  2⤵
  PID:5656
- C:\Windows\System\cVIGljV.exe
  C:\Windows\System\cVIGljV.exe
  2⤵
  PID:5848
- C:\Windows\System\wiTHTMX.exe
  C:\Windows\System\wiTHTMX.exe
  2⤵
  PID:5884
- C:\Windows\System\puWIfng.exe
  C:\Windows\System\puWIfng.exe
  2⤵
  PID:5896
- C:\Windows\System\ydfCjcN.exe
  C:\Windows\System\ydfCjcN.exe
  2⤵
  PID:5988
- C:\Windows\System\rOkAlQz.exe
  C:\Windows\System\rOkAlQz.exe
  2⤵
  PID:6056
- C:\Windows\System\ZOyhhzV.exe
  C:\Windows\System\ZOyhhzV.exe
  2⤵
  PID:6108
- C:\Windows\System\PJvLfgX.exe
  C:\Windows\System\PJvLfgX.exe
  2⤵
  PID:6012
- C:\Windows\System\uEbpVnB.exe
  C:\Windows\System\uEbpVnB.exe
  2⤵
  PID:5960
- C:\Windows\System\OLRIGCL.exe
  C:\Windows\System\OLRIGCL.exe
  2⤵
  PID:4000
- C:\Windows\System\zaRWthk.exe
  C:\Windows\System\zaRWthk.exe
  2⤵
  PID:4540
- C:\Windows\System\XGiIMOc.exe
  C:\Windows\System\XGiIMOc.exe
  2⤵
  PID:4764
- C:\Windows\System\GNBQoYK.exe
  C:\Windows\System\GNBQoYK.exe
  2⤵
  PID:5132
- C:\Windows\System\ECGMJJo.exe
  C:\Windows\System\ECGMJJo.exe
  2⤵
  PID:4384
- C:\Windows\System\qxRORSV.exe
  C:\Windows\System\qxRORSV.exe
  2⤵
  PID:2900
- C:\Windows\System\KxomaPR.exe
  C:\Windows\System\KxomaPR.exe
  2⤵
  PID:5308
- C:\Windows\System\oSxfaig.exe
  C:\Windows\System\oSxfaig.exe
  2⤵
  PID:5072
- C:\Windows\System\CdZowpc.exe
  C:\Windows\System\CdZowpc.exe
  2⤵
  PID:5184
- C:\Windows\System\aElKpAV.exe
  C:\Windows\System\aElKpAV.exe
  2⤵
  PID:5512
- C:\Windows\System\ySXwHPC.exe
  C:\Windows\System\ySXwHPC.exe
  2⤵
  PID:5588
- C:\Windows\System\ridtddw.exe
  C:\Windows\System\ridtddw.exe
  2⤵
  PID:5320
- C:\Windows\System\vqTngBX.exe
  C:\Windows\System\vqTngBX.exe
  2⤵
  PID:3480
- C:\Windows\System\VlecYPf.exe
  C:\Windows\System\VlecYPf.exe
  2⤵
  PID:4976
- C:\Windows\System\eDVjntC.exe
  C:\Windows\System\eDVjntC.exe
  2⤵
  PID:1672
- C:\Windows\System\NkBzWsA.exe
  C:\Windows\System\NkBzWsA.exe
  2⤵
  PID:5468
- C:\Windows\System\LvXehrU.exe
  C:\Windows\System\LvXehrU.exe
  2⤵
  PID:5528
- C:\Windows\System\TaGJWgq.exe
  C:\Windows\System\TaGJWgq.exe
  2⤵
  PID:5780
- C:\Windows\System\NjRVfej.exe
  C:\Windows\System\NjRVfej.exe
  2⤵
  PID:5736
- C:\Windows\System\fCrNUvI.exe
  C:\Windows\System\fCrNUvI.exe
  2⤵
  PID:5800
- C:\Windows\System\yVBmWju.exe
  C:\Windows\System\yVBmWju.exe
  2⤵
  PID:5880
- C:\Windows\System\Yssncmn.exe
  C:\Windows\System\Yssncmn.exe
  2⤵
  PID:5616
- C:\Windows\System\PjRAiNe.exe
  C:\Windows\System\PjRAiNe.exe
  2⤵
  PID:5868
- C:\Windows\System\RUbkxfi.exe
  C:\Windows\System\RUbkxfi.exe
  2⤵
  PID:5900
- C:\Windows\System\vhBqhHJ.exe
  C:\Windows\System\vhBqhHJ.exe
  2⤵
  PID:6076
- C:\Windows\System\MMJLKWm.exe
  C:\Windows\System\MMJLKWm.exe
  2⤵
  PID:5972
- C:\Windows\System\DkoeqXU.exe
  C:\Windows\System\DkoeqXU.exe
  2⤵
  PID:1872
- C:\Windows\System\ovVCRRl.exe
  C:\Windows\System\ovVCRRl.exe
  2⤵
  PID:5156
- C:\Windows\System\utRzqlA.exe
  C:\Windows\System\utRzqlA.exe
  2⤵
  PID:6132
- C:\Windows\System\HMPgBpO.exe
  C:\Windows\System\HMPgBpO.exe
  2⤵
  PID:5928
- C:\Windows\System\JpuYZoH.exe
  C:\Windows\System\JpuYZoH.exe
  2⤵
  PID:5740
- C:\Windows\System\GuWeptT.exe
  C:\Windows\System\GuWeptT.exe
  2⤵
  PID:5288
- C:\Windows\System\SjJPgSY.exe
  C:\Windows\System\SjJPgSY.exe
  2⤵
  PID:4800
- C:\Windows\System\aaHlKeh.exe
  C:\Windows\System\aaHlKeh.exe
  2⤵
  PID:4448
- C:\Windows\System\PVCGgAe.exe
  C:\Windows\System\PVCGgAe.exe
  2⤵
  PID:5272
- C:\Windows\System\tZtQjbl.exe
  C:\Windows\System\tZtQjbl.exe
  2⤵
  PID:4544
- C:\Windows\System\rqylTCb.exe
  C:\Windows\System\rqylTCb.exe
  2⤵
  PID:5444
- C:\Windows\System\BfOkzwr.exe
  C:\Windows\System\BfOkzwr.exe
  2⤵
  PID:4828
- C:\Windows\System\OFzTjki.exe
  C:\Windows\System\OFzTjki.exe
  2⤵
  PID:5844
- C:\Windows\System\CWlLWXl.exe
  C:\Windows\System\CWlLWXl.exe
  2⤵
  PID:5552
- C:\Windows\System\EzNHIOp.exe
  C:\Windows\System\EzNHIOp.exe
  2⤵
  PID:5760
- C:\Windows\System\xwfMMHX.exe
  C:\Windows\System\xwfMMHX.exe
  2⤵
  PID:6092
- C:\Windows\System\ODmqwxu.exe
  C:\Windows\System\ODmqwxu.exe
  2⤵
  PID:4112
- C:\Windows\System\JLyBOoR.exe
  C:\Windows\System\JLyBOoR.exe
  2⤵
  PID:5916
- C:\Windows\System\fuKXWnh.exe
  C:\Windows\System\fuKXWnh.exe
  2⤵
  PID:6128
- C:\Windows\System\vXjwpxa.exe
  C:\Windows\System\vXjwpxa.exe
  2⤵
  PID:6064
- C:\Windows\System\gahmmQD.exe
  C:\Windows\System\gahmmQD.exe
  2⤵
  PID:4528
- C:\Windows\System\cQVemId.exe
  C:\Windows\System\cQVemId.exe
  2⤵
  PID:5548
- C:\Windows\System\iGWOdlq.exe
  C:\Windows\System\iGWOdlq.exe
  2⤵
  PID:4044
- C:\Windows\System\AIXZRrB.exe
  C:\Windows\System\AIXZRrB.exe
  2⤵
  PID:6156
- C:\Windows\System\RfEAMPX.exe
  C:\Windows\System\RfEAMPX.exe
  2⤵
  PID:6172
- C:\Windows\System\XZfpkIR.exe
  C:\Windows\System\XZfpkIR.exe
  2⤵
  PID:6188
- C:\Windows\System\bHhEDIT.exe
  C:\Windows\System\bHhEDIT.exe
  2⤵
  PID:6204
- C:\Windows\System\sNFJDSz.exe
  C:\Windows\System\sNFJDSz.exe
  2⤵
  PID:6220
- C:\Windows\System\oknGRTL.exe
  C:\Windows\System\oknGRTL.exe
  2⤵
  PID:6236
- C:\Windows\System\WbvYkrm.exe
  C:\Windows\System\WbvYkrm.exe
  2⤵
  PID:6252
- C:\Windows\System\LPiCrYS.exe
  C:\Windows\System\LPiCrYS.exe
  2⤵
  PID:6268
- C:\Windows\System\DMhYOHc.exe
  C:\Windows\System\DMhYOHc.exe
  2⤵
  PID:6284
- C:\Windows\System\eGhCyVb.exe
  C:\Windows\System\eGhCyVb.exe
  2⤵
  PID:6300
- C:\Windows\System\srcecVN.exe
  C:\Windows\System\srcecVN.exe
  2⤵
  PID:6316
- C:\Windows\System\ZuGgsgJ.exe
  C:\Windows\System\ZuGgsgJ.exe
  2⤵
  PID:6332
- C:\Windows\System\ynMjTXz.exe
  C:\Windows\System\ynMjTXz.exe
  2⤵
  PID:6348
- C:\Windows\System\AhZnFio.exe
  C:\Windows\System\AhZnFio.exe
  2⤵
  PID:6364
- C:\Windows\System\fjjxrWG.exe
  C:\Windows\System\fjjxrWG.exe
  2⤵
  PID:6380
- C:\Windows\System\PEWuqhq.exe
  C:\Windows\System\PEWuqhq.exe
  2⤵
  PID:6396
- C:\Windows\System\pcflcwC.exe
  C:\Windows\System\pcflcwC.exe
  2⤵
  PID:6412
- C:\Windows\System\DmlveBZ.exe
  C:\Windows\System\DmlveBZ.exe
  2⤵
  PID:6428
- C:\Windows\System\ICIviYr.exe
  C:\Windows\System\ICIviYr.exe
  2⤵
  PID:6444
- C:\Windows\System\dEJumel.exe
  C:\Windows\System\dEJumel.exe
  2⤵
  PID:6460
- C:\Windows\System\OrYrgWL.exe
  C:\Windows\System\OrYrgWL.exe
  2⤵
  PID:6476
- C:\Windows\System\jNhPckw.exe
  C:\Windows\System\jNhPckw.exe
  2⤵
  PID:6492
- C:\Windows\System\dgoCTWH.exe
  C:\Windows\System\dgoCTWH.exe
  2⤵
  PID:6508
- C:\Windows\System\eBMUomi.exe
  C:\Windows\System\eBMUomi.exe
  2⤵
  PID:6524
- C:\Windows\System\xMfsZJq.exe
  C:\Windows\System\xMfsZJq.exe
  2⤵
  PID:6540
- C:\Windows\System\AWmdosW.exe
  C:\Windows\System\AWmdosW.exe
  2⤵
  PID:6556
- C:\Windows\System\dMWjDlk.exe
  C:\Windows\System\dMWjDlk.exe
  2⤵
  PID:6572
- C:\Windows\System\NLbKTJQ.exe
  C:\Windows\System\NLbKTJQ.exe
  2⤵
  PID:6588
- C:\Windows\System\MAyZCgD.exe
  C:\Windows\System\MAyZCgD.exe
  2⤵
  PID:6604
- C:\Windows\System\FQACoSq.exe
  C:\Windows\System\FQACoSq.exe
  2⤵
  PID:6620
- C:\Windows\System\zyYtdQl.exe
  C:\Windows\System\zyYtdQl.exe
  2⤵
  PID:6636
- C:\Windows\System\oZwbtNO.exe
  C:\Windows\System\oZwbtNO.exe
  2⤵
  PID:6652
- C:\Windows\System\bzJFDxW.exe
  C:\Windows\System\bzJFDxW.exe
  2⤵
  PID:6668
- C:\Windows\System\zyxkvxl.exe
  C:\Windows\System\zyxkvxl.exe
  2⤵
  PID:6684
- C:\Windows\System\IGoNNVL.exe
  C:\Windows\System\IGoNNVL.exe
  2⤵
  PID:6700
- C:\Windows\System\VAlXKfe.exe
  C:\Windows\System\VAlXKfe.exe
  2⤵
  PID:6716
- C:\Windows\System\EayiqMn.exe
  C:\Windows\System\EayiqMn.exe
  2⤵
  PID:6732
- C:\Windows\System\kJglAis.exe
  C:\Windows\System\kJglAis.exe
  2⤵
  PID:6748
- C:\Windows\System\mTdfaPM.exe
  C:\Windows\System\mTdfaPM.exe
  2⤵
  PID:6764
- C:\Windows\System\SzWrEiZ.exe
  C:\Windows\System\SzWrEiZ.exe
  2⤵
  PID:6780
- C:\Windows\System\RNgAtSR.exe
  C:\Windows\System\RNgAtSR.exe
  2⤵
  PID:6796
- C:\Windows\System\sMxFSGe.exe
  C:\Windows\System\sMxFSGe.exe
  2⤵
  PID:6812
- C:\Windows\System\gvfmRdq.exe
  C:\Windows\System\gvfmRdq.exe
  2⤵
  PID:6828
- C:\Windows\System\ZHexvEq.exe
  C:\Windows\System\ZHexvEq.exe
  2⤵
  PID:6844
- C:\Windows\System\SbqBfRF.exe
  C:\Windows\System\SbqBfRF.exe
  2⤵
  PID:6860
- C:\Windows\System\VVYMSGy.exe
  C:\Windows\System\VVYMSGy.exe
  2⤵
  PID:6876
- C:\Windows\System\OxwHKhn.exe
  C:\Windows\System\OxwHKhn.exe
  2⤵
  PID:6892
- C:\Windows\System\lfgwqJw.exe
  C:\Windows\System\lfgwqJw.exe
  2⤵
  PID:6908
- C:\Windows\System\ppYtfHk.exe
  C:\Windows\System\ppYtfHk.exe
  2⤵
  PID:6924
- C:\Windows\System\sRhzNqY.exe
  C:\Windows\System\sRhzNqY.exe
  2⤵
  PID:6940
- C:\Windows\System\DXSYlQs.exe
  C:\Windows\System\DXSYlQs.exe
  2⤵
  PID:6956
- C:\Windows\System\ewOUkjn.exe
  C:\Windows\System\ewOUkjn.exe
  2⤵
  PID:6972
- C:\Windows\System\ehYzHpM.exe
  C:\Windows\System\ehYzHpM.exe
  2⤵
  PID:6988
- C:\Windows\System\gfQLoTt.exe
  C:\Windows\System\gfQLoTt.exe
  2⤵
  PID:7004
- C:\Windows\System\ksDFtGk.exe
  C:\Windows\System\ksDFtGk.exe
  2⤵
  PID:7020
- C:\Windows\System\kjWLEVq.exe
  C:\Windows\System\kjWLEVq.exe
  2⤵
  PID:7036
- C:\Windows\System\XULSbAq.exe
  C:\Windows\System\XULSbAq.exe
  2⤵
  PID:7056
- C:\Windows\System\kwYFmRl.exe
  C:\Windows\System\kwYFmRl.exe
  2⤵
  PID:7072
- C:\Windows\System\ZobbGLO.exe
  C:\Windows\System\ZobbGLO.exe
  2⤵
  PID:7088
- C:\Windows\System\BudJzqC.exe
  C:\Windows\System\BudJzqC.exe
  2⤵
  PID:7104
- C:\Windows\System\QJnFFVP.exe
  C:\Windows\System\QJnFFVP.exe
  2⤵
  PID:7120
- C:\Windows\System\aLFJSNo.exe
  C:\Windows\System\aLFJSNo.exe
  2⤵
  PID:7136
- C:\Windows\System\tWqrgdM.exe
  C:\Windows\System\tWqrgdM.exe
  2⤵
  PID:7152
- C:\Windows\System\wuYBkTi.exe
  C:\Windows\System\wuYBkTi.exe
  2⤵
  PID:5652
- C:\Windows\System\ErJEEWA.exe
  C:\Windows\System\ErJEEWA.exe
  2⤵
  PID:4912
- C:\Windows\System\wlIOmCL.exe
  C:\Windows\System\wlIOmCL.exe
  2⤵
  PID:5776
- C:\Windows\System\kaumCmz.exe
  C:\Windows\System\kaumCmz.exe
  2⤵
  PID:4444
- C:\Windows\System\IiDGXlF.exe
  C:\Windows\System\IiDGXlF.exe
  2⤵
  PID:5484
- C:\Windows\System\rHiJaVj.exe
  C:\Windows\System\rHiJaVj.exe
  2⤵
  PID:5572
- C:\Windows\System\tIdVdPu.exe
  C:\Windows\System\tIdVdPu.exe
  2⤵
  PID:6028
- C:\Windows\System\ofZFPSc.exe
  C:\Windows\System\ofZFPSc.exe
  2⤵
  PID:6244
- C:\Windows\System\eqGAjda.exe
  C:\Windows\System\eqGAjda.exe
  2⤵
  PID:6312
- C:\Windows\System\XoOxUcB.exe
  C:\Windows\System\XoOxUcB.exe
  2⤵
  PID:6200
- C:\Windows\System\viFXTOJ.exe
  C:\Windows\System\viFXTOJ.exe
  2⤵
  PID:6420
- C:\Windows\System\qOmxnZE.exe
  C:\Windows\System\qOmxnZE.exe
  2⤵
  PID:6328
- C:\Windows\System\JaNPahg.exe
  C:\Windows\System\JaNPahg.exe
  2⤵
  PID:6264
- C:\Windows\System\vdzagic.exe
  C:\Windows\System\vdzagic.exe
  2⤵
  PID:6308
- C:\Windows\System\ftsHKgW.exe
  C:\Windows\System\ftsHKgW.exe
  2⤵
  PID:6436
- C:\Windows\System\KGBucOw.exe
  C:\Windows\System\KGBucOw.exe
  2⤵
  PID:6408
- C:\Windows\System\zTZuMkn.exe
  C:\Windows\System\zTZuMkn.exe
  2⤵
  PID:6504
- C:\Windows\System\tMYzvQJ.exe
  C:\Windows\System\tMYzvQJ.exe
  2⤵
  PID:6516
- C:\Windows\System\yMRfdjl.exe
  C:\Windows\System\yMRfdjl.exe
  2⤵
  PID:6580
- C:\Windows\System\uoooVmW.exe
  C:\Windows\System\uoooVmW.exe
  2⤵
  PID:6484
- C:\Windows\System\jmKymBs.exe
  C:\Windows\System\jmKymBs.exe
  2⤵
  PID:6644
- C:\Windows\System\rqxrIlT.exe
  C:\Windows\System\rqxrIlT.exe
  2⤵
  PID:6740
- C:\Windows\System\GNYdmuo.exe
  C:\Windows\System\GNYdmuo.exe
  2⤵
  PID:6660
- C:\Windows\System\vAixYzh.exe
  C:\Windows\System\vAixYzh.exe
  2⤵
  PID:6568
- C:\Windows\System\KZTFFeW.exe
  C:\Windows\System\KZTFFeW.exe
  2⤵
  PID:6808
- C:\Windows\System\ykrjMOL.exe
  C:\Windows\System\ykrjMOL.exe
  2⤵
  PID:6600
- C:\Windows\System\mEGBCuN.exe
  C:\Windows\System\mEGBCuN.exe
  2⤵
  PID:6696
- C:\Windows\System\TfHpaTH.exe
  C:\Windows\System\TfHpaTH.exe
  2⤵
  PID:6840
- C:\Windows\System\EAlWZmO.exe
  C:\Windows\System\EAlWZmO.exe
  2⤵
  PID:6932
- C:\Windows\System\zNiNhIe.exe
  C:\Windows\System\zNiNhIe.exe
  2⤵
  PID:6964
- C:\Windows\System\WoxddIK.exe
  C:\Windows\System\WoxddIK.exe
  2⤵
  PID:7028
- C:\Windows\System\XULqTyf.exe
  C:\Windows\System\XULqTyf.exe
  2⤵
  PID:6916
- C:\Windows\System\kHFBHTH.exe
  C:\Windows\System\kHFBHTH.exe
  2⤵
  PID:7016
- C:\Windows\System\QwuygXS.exe
  C:\Windows\System\QwuygXS.exe
  2⤵
  PID:6952
- C:\Windows\System\gGSSVgH.exe
  C:\Windows\System\gGSSVgH.exe
  2⤵
  PID:7064
- C:\Windows\System\lEeIURM.exe
  C:\Windows\System\lEeIURM.exe
  2⤵
  PID:7084
- C:\Windows\System\xXoSVlu.exe
  C:\Windows\System\xXoSVlu.exe
  2⤵
  PID:7112
- C:\Windows\System\HEcziFb.exe
  C:\Windows\System\HEcziFb.exe
  2⤵
  PID:7164
- C:\Windows\System\CaCSaAz.exe
  C:\Windows\System\CaCSaAz.exe
  2⤵
  PID:6152
- C:\Windows\System\QNSCzIO.exe
  C:\Windows\System\QNSCzIO.exe
  2⤵
  PID:6280
- C:\Windows\System\YfrOQwc.exe
  C:\Windows\System\YfrOQwc.exe
  2⤵
  PID:6296
- C:\Windows\System\oxruXXA.exe
  C:\Windows\System\oxruXXA.exe
  2⤵
  PID:6468
- C:\Windows\System\ZRQfINn.exe
  C:\Windows\System\ZRQfINn.exe
  2⤵
  PID:6548
- C:\Windows\System\wlhIqAq.exe
  C:\Windows\System\wlhIqAq.exe
  2⤵
  PID:6772
- C:\Windows\System\KTZrDvZ.exe
  C:\Windows\System\KTZrDvZ.exe
  2⤵
  PID:6404
- C:\Windows\System\lpBXmvg.exe
  C:\Windows\System\lpBXmvg.exe
  2⤵
  PID:6792
- C:\Windows\System\yoxMoVT.exe
  C:\Windows\System\yoxMoVT.exe
  2⤵
  PID:6852
- C:\Windows\System\oTMTEGP.exe
  C:\Windows\System\oTMTEGP.exe
  2⤵
  PID:7048
- C:\Windows\System\nICjLzD.exe
  C:\Windows\System\nICjLzD.exe
  2⤵
  PID:4608
- C:\Windows\System\ejkKYqf.exe
  C:\Windows\System\ejkKYqf.exe
  2⤵
  PID:652
- C:\Windows\System\BZpfLkq.exe
  C:\Windows\System\BZpfLkq.exe
  2⤵
  PID:7000
- C:\Windows\System\RGYiOYa.exe
  C:\Windows\System\RGYiOYa.exe
  2⤵
  PID:6804
- C:\Windows\System\LdlTwek.exe
  C:\Windows\System\LdlTwek.exe
  2⤵
  PID:7180
- C:\Windows\System\WJvvAeE.exe
  C:\Windows\System\WJvvAeE.exe
  2⤵
  PID:7196
- C:\Windows\System\XzmSbYx.exe
  C:\Windows\System\XzmSbYx.exe
  2⤵
  PID:7212
- C:\Windows\System\DGsSoej.exe
  C:\Windows\System\DGsSoej.exe
  2⤵
  PID:7228
- C:\Windows\System\TozuinG.exe
  C:\Windows\System\TozuinG.exe
  2⤵
  PID:7244
- C:\Windows\System\ufZpnfp.exe
  C:\Windows\System\ufZpnfp.exe
  2⤵
  PID:7264
- C:\Windows\System\KrquNzC.exe
  C:\Windows\System\KrquNzC.exe
  2⤵
  PID:7280
- C:\Windows\System\IlRTpBe.exe
  C:\Windows\System\IlRTpBe.exe
  2⤵
  PID:7296
- C:\Windows\System\iwPzuSo.exe
  C:\Windows\System\iwPzuSo.exe
  2⤵
  PID:7312
- C:\Windows\System\UQPIXJw.exe
  C:\Windows\System\UQPIXJw.exe
  2⤵
  PID:7328
- C:\Windows\System\emIIbjz.exe
  C:\Windows\System\emIIbjz.exe
  2⤵
  PID:7344
- C:\Windows\System\Ibqxebt.exe
  C:\Windows\System\Ibqxebt.exe
  2⤵
  PID:7360
- C:\Windows\System\WPinBYA.exe
  C:\Windows\System\WPinBYA.exe
  2⤵
  PID:7376
- C:\Windows\System\aFZfrDl.exe
  C:\Windows\System\aFZfrDl.exe
  2⤵
  PID:7392
- C:\Windows\System\zkWyzUR.exe
  C:\Windows\System\zkWyzUR.exe
  2⤵
  PID:7408
- C:\Windows\System\pobOhIE.exe
  C:\Windows\System\pobOhIE.exe
  2⤵
  PID:7424
- C:\Windows\System\UzToiDw.exe
  C:\Windows\System\UzToiDw.exe
  2⤵
  PID:7440
- C:\Windows\System\eiSfCYK.exe
  C:\Windows\System\eiSfCYK.exe
  2⤵
  PID:7456
- C:\Windows\System\cCrgInF.exe
  C:\Windows\System\cCrgInF.exe
  2⤵
  PID:7472
- C:\Windows\System\vbUSGia.exe
  C:\Windows\System\vbUSGia.exe
  2⤵
  PID:7488
- C:\Windows\System\gbVwQJE.exe
  C:\Windows\System\gbVwQJE.exe
  2⤵
  PID:7504
- C:\Windows\System\cIWWHqT.exe
  C:\Windows\System\cIWWHqT.exe
  2⤵
  PID:7520
- C:\Windows\System\XoZhdbt.exe
  C:\Windows\System\XoZhdbt.exe
  2⤵
  PID:7536
- C:\Windows\System\raRyTkl.exe
  C:\Windows\System\raRyTkl.exe
  2⤵
  PID:7552
- C:\Windows\System\DowPIXr.exe
  C:\Windows\System\DowPIXr.exe
  2⤵
  PID:7568
- C:\Windows\System\jBvbCUU.exe
  C:\Windows\System\jBvbCUU.exe
  2⤵
  PID:7584
- C:\Windows\System\XTrXwwB.exe
  C:\Windows\System\XTrXwwB.exe
  2⤵
  PID:7600
- C:\Windows\System\DQPSloS.exe
  C:\Windows\System\DQPSloS.exe
  2⤵
  PID:7616
- C:\Windows\System\rWcIref.exe
  C:\Windows\System\rWcIref.exe
  2⤵
  PID:7632
- C:\Windows\System\zQfGSBx.exe
  C:\Windows\System\zQfGSBx.exe
  2⤵
  PID:7692
- C:\Windows\System\JgdKuIj.exe
  C:\Windows\System\JgdKuIj.exe
  2⤵
  PID:7888
- C:\Windows\System\UnIzeon.exe
  C:\Windows\System\UnIzeon.exe
  2⤵
  PID:7912
- C:\Windows\System\rOupOgj.exe
  C:\Windows\System\rOupOgj.exe
  2⤵
  PID:7928
- C:\Windows\System\vHKAXIv.exe
  C:\Windows\System\vHKAXIv.exe
  2⤵
  PID:7944
- C:\Windows\System\iTiqXFl.exe
  C:\Windows\System\iTiqXFl.exe
  2⤵
  PID:7960
- C:\Windows\System\gXLsppN.exe
  C:\Windows\System\gXLsppN.exe
  2⤵
  PID:7976
- C:\Windows\System\pXnxcCt.exe
  C:\Windows\System\pXnxcCt.exe
  2⤵
  PID:7996
- C:\Windows\System\IWLtzRl.exe
  C:\Windows\System\IWLtzRl.exe
  2⤵
  PID:8012
- C:\Windows\System\fvvPSOW.exe
  C:\Windows\System\fvvPSOW.exe
  2⤵
  PID:8104
- C:\Windows\System\kHJcHZI.exe
  C:\Windows\System\kHJcHZI.exe
  2⤵
  PID:8120
- C:\Windows\System\BRHiXQZ.exe
  C:\Windows\System\BRHiXQZ.exe
  2⤵
  PID:8140
- C:\Windows\System\dLrbJPo.exe
  C:\Windows\System\dLrbJPo.exe
  2⤵
  PID:8156
- C:\Windows\System\BfNktDj.exe
  C:\Windows\System\BfNktDj.exe
  2⤵
  PID:8172
- C:\Windows\System\gMMntAV.exe
  C:\Windows\System\gMMntAV.exe
  2⤵
  PID:8188
- C:\Windows\System\wPoubnf.exe
  C:\Windows\System\wPoubnf.exe
  2⤵
  PID:6164
- C:\Windows\System\TLyKkOm.exe
  C:\Windows\System\TLyKkOm.exe
  2⤵
  PID:6212
- C:\Windows\System\VAHlcuP.exe
  C:\Windows\System\VAHlcuP.exe
  2⤵
  PID:6356
- C:\Windows\System\qSUgskE.exe
  C:\Windows\System\qSUgskE.exe
  2⤵
  PID:6824
- C:\Windows\System\vgWUwzo.exe
  C:\Windows\System\vgWUwzo.exe
  2⤵
  PID:6536
- C:\Windows\System\KUkyfhV.exe
  C:\Windows\System\KUkyfhV.exe
  2⤵
  PID:6664
- C:\Windows\System\uWLvfAn.exe
  C:\Windows\System\uWLvfAn.exe
  2⤵
  PID:6900
- C:\Windows\System\cuJyYHh.exe
  C:\Windows\System\cuJyYHh.exe
  2⤵
  PID:6984
- C:\Windows\System\HFVTmCe.exe
  C:\Windows\System\HFVTmCe.exe
  2⤵
  PID:6456
- C:\Windows\System\MwczqRM.exe
  C:\Windows\System\MwczqRM.exe
  2⤵
  PID:6388
- C:\Windows\System\unqGrPD.exe
  C:\Windows\System\unqGrPD.exe
  2⤵
  PID:6616
- C:\Windows\System\jTMjyrV.exe
  C:\Windows\System\jTMjyrV.exe
  2⤵
  PID:7204
- C:\Windows\System\RjrFqoR.exe
  C:\Windows\System\RjrFqoR.exe
  2⤵
  PID:7240
- C:\Windows\System\nzxATdh.exe
  C:\Windows\System\nzxATdh.exe
  2⤵
  PID:7340
- C:\Windows\System\ayRgRZw.exe
  C:\Windows\System\ayRgRZw.exe
  2⤵
  PID:7432
- C:\Windows\System\kQyYVUD.exe
  C:\Windows\System\kQyYVUD.exe
  2⤵
  PID:7292
- C:\Windows\System\NuCYFEo.exe
  C:\Windows\System\NuCYFEo.exe
  2⤵
  PID:7356
- C:\Windows\System\EEKHkNj.exe
  C:\Windows\System\EEKHkNj.exe
  2⤵
  PID:7448
- C:\Windows\System\qjNFGwR.exe
  C:\Windows\System\qjNFGwR.exe
  2⤵
  PID:7512
- C:\Windows\System\rarnrfj.exe
  C:\Windows\System\rarnrfj.exe
  2⤵
  PID:7660
- C:\Windows\System\SheugOV.exe
  C:\Windows\System\SheugOV.exe
  2⤵
  PID:7644
- C:\Windows\System\mCmKjeD.exe
  C:\Windows\System\mCmKjeD.exe
  2⤵
  PID:7676
- C:\Windows\System\wwcFvRi.exe
  C:\Windows\System\wwcFvRi.exe
  2⤵
  PID:7688
- C:\Windows\System\tDkLTab.exe
  C:\Windows\System\tDkLTab.exe
  2⤵
  PID:7716
- C:\Windows\System\WzaHdkc.exe
  C:\Windows\System\WzaHdkc.exe
  2⤵
  PID:7732
- C:\Windows\System\XlpDOWB.exe
  C:\Windows\System\XlpDOWB.exe
  2⤵
  PID:7748
- C:\Windows\System\POlNlJD.exe
  C:\Windows\System\POlNlJD.exe
  2⤵
  PID:7764
- C:\Windows\System\UQDiMDU.exe
  C:\Windows\System\UQDiMDU.exe
  2⤵
  PID:7784
- C:\Windows\System\cOMBmWD.exe
  C:\Windows\System\cOMBmWD.exe
  2⤵
  PID:7800
- C:\Windows\System\ARhBeDu.exe
  C:\Windows\System\ARhBeDu.exe
  2⤵
  PID:7824
- C:\Windows\System\AplUnXW.exe
  C:\Windows\System\AplUnXW.exe
  2⤵
  PID:7832
- C:\Windows\System\oHAmwCJ.exe
  C:\Windows\System\oHAmwCJ.exe
  2⤵
  PID:7848
- C:\Windows\System\sWECIEN.exe
  C:\Windows\System\sWECIEN.exe
  2⤵
  PID:7872
- C:\Windows\System\CGFNdZu.exe
  C:\Windows\System\CGFNdZu.exe
  2⤵
  PID:7860
- C:\Windows\System\BLbJZlj.exe
  C:\Windows\System\BLbJZlj.exe
  2⤵
  PID:7936
- C:\Windows\System\JPvkGtH.exe
  C:\Windows\System\JPvkGtH.exe
  2⤵
  PID:8004
- C:\Windows\System\lEOutuo.exe
  C:\Windows\System\lEOutuo.exe
  2⤵
  PID:7956
- C:\Windows\System\ZqUbdiD.exe
  C:\Windows\System\ZqUbdiD.exe
  2⤵
  PID:8020
- C:\Windows\System\wUPgPBV.exe
  C:\Windows\System\wUPgPBV.exe
  2⤵
  PID:8036
- C:\Windows\System\vezIovd.exe
  C:\Windows\System\vezIovd.exe
  2⤵
  PID:8052
- C:\Windows\System\CxqjLna.exe
  C:\Windows\System\CxqjLna.exe
  2⤵
  PID:7920
- C:\Windows\System\oOYMpYl.exe
  C:\Windows\System\oOYMpYl.exe
  2⤵
  PID:6676
- C:\Windows\System\YXmadSA.exe
  C:\Windows\System\YXmadSA.exe
  2⤵
  PID:5744
- C:\Windows\System\YfMcKyZ.exe
  C:\Windows\System\YfMcKyZ.exe
  2⤵
  PID:7464
- C:\Windows\System\mZlrlev.exe
  C:\Windows\System\mZlrlev.exe
  2⤵
  PID:7468
- C:\Windows\System\nyrTeCW.exe
  C:\Windows\System\nyrTeCW.exe
  2⤵
  PID:6856
- C:\Windows\System\lMIbYBs.exe
  C:\Windows\System\lMIbYBs.exe
  2⤵
  PID:6196
- C:\Windows\System\OErXqeZ.exe
  C:\Windows\System\OErXqeZ.exe
  2⤵
  PID:6760
- C:\Windows\System\DjgQMrC.exe
  C:\Windows\System\DjgQMrC.exe
  2⤵
  PID:7132
- C:\Windows\System\SvxJsLB.exe
  C:\Windows\System\SvxJsLB.exe
  2⤵
  PID:6692
- C:\Windows\System\TwWzEIg.exe
  C:\Windows\System\TwWzEIg.exe
  2⤵
  PID:7400
- C:\Windows\System\tMlBpJT.exe
  C:\Windows\System\tMlBpJT.exe
  2⤵
  PID:7564
- C:\Windows\System\UqBEKBP.exe
  C:\Windows\System\UqBEKBP.exe
  2⤵
  PID:7596
- C:\Windows\System\CUvcyJx.exe
  C:\Windows\System\CUvcyJx.exe
  2⤵
  PID:7260
- C:\Windows\System\oJHjZFy.exe
  C:\Windows\System\oJHjZFy.exe
  2⤵
  PID:7484
- C:\Windows\System\iOSfydt.exe
  C:\Windows\System\iOSfydt.exe
  2⤵
  PID:7864
- C:\Windows\System\EarLkAz.exe
  C:\Windows\System\EarLkAz.exe
  2⤵
  PID:7952
- C:\Windows\System\vvtQetf.exe
  C:\Windows\System\vvtQetf.exe
  2⤵
  PID:8064
- C:\Windows\System\ETgLPVR.exe
  C:\Windows\System\ETgLPVR.exe
  2⤵
  PID:7776
- C:\Windows\System\WEnFdOT.exe
  C:\Windows\System\WEnFdOT.exe
  2⤵
  PID:7840
- C:\Windows\System\QofqsQg.exe
  C:\Windows\System\QofqsQg.exe
  2⤵
  PID:7968
- C:\Windows\System\fCMnPps.exe
  C:\Windows\System\fCMnPps.exe
  2⤵
  PID:8048
- C:\Windows\System\mBgDdjg.exe
  C:\Windows\System\mBgDdjg.exe
  2⤵
  PID:8084
- C:\Windows\System\XoLpTwg.exe
  C:\Windows\System\XoLpTwg.exe
  2⤵
  PID:8100
- C:\Windows\System\vUXFYnF.exe
  C:\Windows\System\vUXFYnF.exe
  2⤵
  PID:8132
- C:\Windows\System\YWxzcLs.exe
  C:\Windows\System\YWxzcLs.exe
  2⤵
  PID:6920
- C:\Windows\System\duFypDK.exe
  C:\Windows\System\duFypDK.exe
  2⤵
  PID:5584
- C:\Windows\System\CSAnqzb.exe
  C:\Windows\System\CSAnqzb.exe
  2⤵
  PID:8164
- C:\Windows\System\LEXeLrq.exe
  C:\Windows\System\LEXeLrq.exe
  2⤵
  PID:7160
- C:\Windows\System\QZfzylN.exe
  C:\Windows\System\QZfzylN.exe
  2⤵
  PID:7336
- C:\Windows\System\rVmVsAf.exe
  C:\Windows\System\rVmVsAf.exe
  2⤵
  PID:7148
- C:\Windows\System\xialMDY.exe
  C:\Windows\System\xialMDY.exe
  2⤵
  PID:7532
- C:\Windows\System\cnwmmmf.exe
  C:\Windows\System\cnwmmmf.exe
  2⤵
  PID:7324
- C:\Windows\System\KWnJDct.exe
  C:\Windows\System\KWnJDct.exe
  2⤵
  PID:7384
- C:\Windows\System\KPmYcYF.exe
  C:\Windows\System\KPmYcYF.exe
  2⤵
  PID:7544
- C:\Windows\System\WzsFfRq.exe
  C:\Windows\System\WzsFfRq.exe
  2⤵
  PID:7684
- C:\Windows\System\ZSfPBht.exe
  C:\Windows\System\ZSfPBht.exe
  2⤵
  PID:7724
- C:\Windows\System\JWOaeGZ.exe
  C:\Windows\System\JWOaeGZ.exe
  2⤵
  PID:7792
- C:\Windows\System\rvQYump.exe
  C:\Windows\System\rvQYump.exe
  2⤵
  PID:7808
- C:\Windows\System\BFocVfI.exe
  C:\Windows\System\BFocVfI.exe
  2⤵
  PID:7904
- C:\Windows\System\iteXZFk.exe
  C:\Windows\System\iteXZFk.exe
  2⤵
  PID:8032
- C:\Windows\System\ctYsMOD.exe
  C:\Windows\System\ctYsMOD.exe
  2⤵
  PID:7704
- C:\Windows\System\CaOZQYM.exe
  C:\Windows\System\CaOZQYM.exe
  2⤵
  PID:7972
- C:\Windows\System\MXOhvxX.exe
  C:\Windows\System\MXOhvxX.exe
  2⤵
  PID:8076
- C:\Windows\System\mUGafvz.exe
  C:\Windows\System\mUGafvz.exe
  2⤵
  PID:6936
- C:\Windows\System\tNWGgdo.exe
  C:\Windows\System\tNWGgdo.exe
  2⤵
  PID:7288
- C:\Windows\System\XzwVdIP.exe
  C:\Windows\System\XzwVdIP.exe
  2⤵
  PID:7868
- C:\Windows\System\DfbtxYw.exe
  C:\Windows\System\DfbtxYw.exe
  2⤵
  PID:7700
- C:\Windows\System\ViRJfYN.exe
  C:\Windows\System\ViRJfYN.exe
  2⤵
  PID:7880
- C:\Windows\System\dqFewXi.exe
  C:\Windows\System\dqFewXi.exe
  2⤵
  PID:7856
- C:\Windows\System\MfAqfeq.exe
  C:\Windows\System\MfAqfeq.exe
  2⤵
  PID:8072
- C:\Windows\System\GcZKKnB.exe
  C:\Windows\System\GcZKKnB.exe
  2⤵
  PID:8168
- C:\Windows\System\nTfPZEC.exe
  C:\Windows\System\nTfPZEC.exe
  2⤵
  PID:7420
- C:\Windows\System\EaasjFk.exe
  C:\Windows\System\EaasjFk.exe
  2⤵
  PID:5948
- C:\Windows\System\rfdjCXB.exe
  C:\Windows\System\rfdjCXB.exe
  2⤵
  PID:7884
- C:\Windows\System\CaJcOCj.exe
  C:\Windows\System\CaJcOCj.exe
  2⤵
  PID:7648
- C:\Windows\System\FBPIkod.exe
  C:\Windows\System\FBPIkod.exe
  2⤵
  PID:7608
- C:\Windows\System\gqngHwL.exe
  C:\Windows\System\gqngHwL.exe
  2⤵
  PID:6392
- C:\Windows\System\zNNuZuj.exe
  C:\Windows\System\zNNuZuj.exe
  2⤵
  PID:6632
- C:\Windows\System\VLZsFRJ.exe
  C:\Windows\System\VLZsFRJ.exe
  2⤵
  PID:7224
- C:\Windows\System\zUggbzg.exe
  C:\Windows\System\zUggbzg.exe
  2⤵
  PID:8136
- C:\Windows\System\HQaeczX.exe
  C:\Windows\System\HQaeczX.exe
  2⤵
  PID:8196
- C:\Windows\System\yxdrKAJ.exe
  C:\Windows\System\yxdrKAJ.exe
  2⤵
  PID:8216
- C:\Windows\System\iocBaxh.exe
  C:\Windows\System\iocBaxh.exe
  2⤵
  PID:8232
- C:\Windows\System\YfPzDNl.exe
  C:\Windows\System\YfPzDNl.exe
  2⤵
  PID:8248
- C:\Windows\System\RAtKawY.exe
  C:\Windows\System\RAtKawY.exe
  2⤵
  PID:8264
- C:\Windows\System\QbMcrtK.exe
  C:\Windows\System\QbMcrtK.exe
  2⤵
  PID:8280
- C:\Windows\System\VpYBNzg.exe
  C:\Windows\System\VpYBNzg.exe
  2⤵
  PID:8296
- C:\Windows\System\zuJjGij.exe
  C:\Windows\System\zuJjGij.exe
  2⤵
  PID:8312
- C:\Windows\System\PcExbST.exe
  C:\Windows\System\PcExbST.exe
  2⤵
  PID:8328
- C:\Windows\System\xFoDJeM.exe
  C:\Windows\System\xFoDJeM.exe
  2⤵
  PID:8344
- C:\Windows\System\CAZciiV.exe
  C:\Windows\System\CAZciiV.exe
  2⤵
  PID:8360
- C:\Windows\System\egsmirD.exe
  C:\Windows\System\egsmirD.exe
  2⤵
  PID:8376
- C:\Windows\System\jVaUlyB.exe
  C:\Windows\System\jVaUlyB.exe
  2⤵
  PID:8392
- C:\Windows\System\OxbKcbI.exe
  C:\Windows\System\OxbKcbI.exe
  2⤵
  PID:8412
- C:\Windows\System\GGfMVZe.exe
  C:\Windows\System\GGfMVZe.exe
  2⤵
  PID:8428
- C:\Windows\System\bJeDZaf.exe
  C:\Windows\System\bJeDZaf.exe
  2⤵
  PID:8448
- C:\Windows\System\SbihzWp.exe
  C:\Windows\System\SbihzWp.exe
  2⤵
  PID:8464
- C:\Windows\System\QdGptaL.exe
  C:\Windows\System\QdGptaL.exe
  2⤵
  PID:8480
- C:\Windows\System\hXjDpRW.exe
  C:\Windows\System\hXjDpRW.exe
  2⤵
  PID:8496
- C:\Windows\System\GydfyCT.exe
  C:\Windows\System\GydfyCT.exe
  2⤵
  PID:8512
- C:\Windows\System\hkZClve.exe
  C:\Windows\System\hkZClve.exe
  2⤵
  PID:8528
- C:\Windows\System\RBWBaPn.exe
  C:\Windows\System\RBWBaPn.exe
  2⤵
  PID:8544
- C:\Windows\System\qnmJtWm.exe
  C:\Windows\System\qnmJtWm.exe
  2⤵
  PID:8560
- C:\Windows\System\JutqFAn.exe
  C:\Windows\System\JutqFAn.exe
  2⤵
  PID:8580
- C:\Windows\System\waSaTeS.exe
  C:\Windows\System\waSaTeS.exe
  2⤵
  PID:8596
- C:\Windows\System\sylvccS.exe
  C:\Windows\System\sylvccS.exe
  2⤵
  PID:8612
- C:\Windows\System\gvOXMdc.exe
  C:\Windows\System\gvOXMdc.exe
  2⤵
  PID:8628
- C:\Windows\System\SSyNzqu.exe
  C:\Windows\System\SSyNzqu.exe
  2⤵
  PID:8644
- C:\Windows\System\izGocMx.exe
  C:\Windows\System\izGocMx.exe
  2⤵
  PID:8660
- C:\Windows\System\ROkWfbv.exe
  C:\Windows\System\ROkWfbv.exe
  2⤵
  PID:8680
- C:\Windows\System\aPUIuFF.exe
  C:\Windows\System\aPUIuFF.exe
  2⤵
  PID:8696
- C:\Windows\System\ooyZtEk.exe
  C:\Windows\System\ooyZtEk.exe
  2⤵
  PID:8712
- C:\Windows\System\yzQyDXx.exe
  C:\Windows\System\yzQyDXx.exe
  2⤵
  PID:8728
- C:\Windows\System\GYUPBas.exe
  C:\Windows\System\GYUPBas.exe
  2⤵
  PID:8744
- C:\Windows\System\IuDBoPI.exe
  C:\Windows\System\IuDBoPI.exe
  2⤵
  PID:8760
- C:\Windows\System\SuzIfZW.exe
  C:\Windows\System\SuzIfZW.exe
  2⤵
  PID:8784
- C:\Windows\System\yomXtMq.exe
  C:\Windows\System\yomXtMq.exe
  2⤵
  PID:8800
- C:\Windows\System\dXBXeAu.exe
  C:\Windows\System\dXBXeAu.exe
  2⤵
  PID:8816
- C:\Windows\System\dwcNVGm.exe
  C:\Windows\System\dwcNVGm.exe
  2⤵
  PID:8832
- C:\Windows\System\msKlQYm.exe
  C:\Windows\System\msKlQYm.exe
  2⤵
  PID:8852
- C:\Windows\System\WinXCef.exe
  C:\Windows\System\WinXCef.exe
  2⤵
  PID:8868
- C:\Windows\System\dnVleZX.exe
  C:\Windows\System\dnVleZX.exe
  2⤵
  PID:8884
- C:\Windows\System\AQwVdnS.exe
  C:\Windows\System\AQwVdnS.exe
  2⤵
  PID:8900
- C:\Windows\System\ThrdWBD.exe
  C:\Windows\System\ThrdWBD.exe
  2⤵
  PID:8916
- C:\Windows\System\qoghoMQ.exe
  C:\Windows\System\qoghoMQ.exe
  2⤵
  PID:8932
- C:\Windows\System\OSIHKLx.exe
  C:\Windows\System\OSIHKLx.exe
  2⤵
  PID:8952
- C:\Windows\System\klWqkvh.exe
  C:\Windows\System\klWqkvh.exe
  2⤵
  PID:8968
- C:\Windows\System\fPdNDue.exe
  C:\Windows\System\fPdNDue.exe
  2⤵
  PID:8984
- C:\Windows\System\QQvVqrs.exe
  C:\Windows\System\QQvVqrs.exe
  2⤵
  PID:9000
- C:\Windows\System\zdiAQwJ.exe
  C:\Windows\System\zdiAQwJ.exe
  2⤵
  PID:9016
- C:\Windows\System\ESoeXUt.exe
  C:\Windows\System\ESoeXUt.exe
  2⤵
  PID:9032
- C:\Windows\System\vLgmBHJ.exe
  C:\Windows\System\vLgmBHJ.exe
  2⤵
  PID:9048
- C:\Windows\System\debdDBM.exe
  C:\Windows\System\debdDBM.exe
  2⤵
  PID:9064
- C:\Windows\System\UpYNjKP.exe
  C:\Windows\System\UpYNjKP.exe
  2⤵
  PID:9080
- C:\Windows\System\VVJVhDJ.exe
  C:\Windows\System\VVJVhDJ.exe
  2⤵
  PID:9096
- C:\Windows\System\AGJhYwn.exe
  C:\Windows\System\AGJhYwn.exe
  2⤵
  PID:9112
- C:\Windows\System\bRlVyGw.exe
  C:\Windows\System\bRlVyGw.exe
  2⤵
  PID:9128
- C:\Windows\System\oYIKqRW.exe
  C:\Windows\System\oYIKqRW.exe
  2⤵
  PID:9144
- C:\Windows\System\BNZOXQZ.exe
  C:\Windows\System\BNZOXQZ.exe
  2⤵
  PID:9160
- C:\Windows\System\imHEtuL.exe
  C:\Windows\System\imHEtuL.exe
  2⤵
  PID:9176
- C:\Windows\System\fKnXYcy.exe
  C:\Windows\System\fKnXYcy.exe
  2⤵
  PID:9192
- C:\Windows\System\xLAwSKm.exe
  C:\Windows\System\xLAwSKm.exe
  2⤵
  PID:9208
- C:\Windows\System\ZJjGdhG.exe
  C:\Windows\System\ZJjGdhG.exe
  2⤵
  PID:8208
- C:\Windows\System\bzkbdcR.exe
  C:\Windows\System\bzkbdcR.exe
  2⤵
  PID:8184
- C:\Windows\System\BqZiiPa.exe
  C:\Windows\System\BqZiiPa.exe
  2⤵
  PID:7500
- C:\Windows\System\aZrvlIa.exe
  C:\Windows\System\aZrvlIa.exe
  2⤵
  PID:8244
- C:\Windows\System\RYDzgtR.exe
  C:\Windows\System\RYDzgtR.exe
  2⤵
  PID:8224
- C:\Windows\System\JflVGOw.exe
  C:\Windows\System\JflVGOw.exe
  2⤵
  PID:8308
- C:\Windows\System\vpxrLVj.exe
  C:\Windows\System\vpxrLVj.exe
  2⤵
  PID:8368
- C:\Windows\System\DoWFafS.exe
  C:\Windows\System\DoWFafS.exe
  2⤵
  PID:8288
- C:\Windows\System\uwoELYl.exe
  C:\Windows\System\uwoELYl.exe
  2⤵
  PID:8404
- C:\Windows\System\uWLovMJ.exe
  C:\Windows\System\uWLovMJ.exe
  2⤵
  PID:8472
- C:\Windows\System\iPOVmyn.exe
  C:\Windows\System\iPOVmyn.exe
  2⤵
  PID:8508
- C:\Windows\System\yZGkhRI.exe
  C:\Windows\System\yZGkhRI.exe
  2⤵
  PID:7416
- C:\Windows\System\sIiRuPt.exe
  C:\Windows\System\sIiRuPt.exe
  2⤵
  PID:8388
- C:\Windows\System\tLlfLaz.exe
  C:\Windows\System\tLlfLaz.exe
  2⤵
  PID:8556
- C:\Windows\System\hqFHfXz.exe
  C:\Windows\System\hqFHfXz.exe
  2⤵
  PID:8576
- C:\Windows\System\LMlwamK.exe
  C:\Windows\System\LMlwamK.exe
  2⤵
  PID:8588
- C:\Windows\System\DUduvMn.exe
  C:\Windows\System\DUduvMn.exe
  2⤵
  PID:8640
- C:\Windows\System\rGejgVA.exe
  C:\Windows\System\rGejgVA.exe
  2⤵
  PID:8620
- C:\Windows\System\VHVtOKV.exe
  C:\Windows\System\VHVtOKV.exe
  2⤵
  PID:8776
- C:\Windows\System\ttcjiVd.exe
  C:\Windows\System\ttcjiVd.exe
  2⤵
  PID:8848
- C:\Windows\System\XwkqhXU.exe
  C:\Windows\System\XwkqhXU.exe
  2⤵
  PID:8912
- C:\Windows\System\cHPMVvq.exe
  C:\Windows\System\cHPMVvq.exe
  2⤵
  PID:8652
- C:\Windows\System\IEBRzRC.exe
  C:\Windows\System\IEBRzRC.exe
  2⤵
  PID:8724
- C:\Windows\System\aTsCvxo.exe
  C:\Windows\System\aTsCvxo.exe
  2⤵
  PID:8752
- C:\Windows\System\ePKqbpL.exe
  C:\Windows\System\ePKqbpL.exe
  2⤵
  PID:8896
- C:\Windows\System\fYenuic.exe
  C:\Windows\System\fYenuic.exe
  2⤵
  PID:8980
- C:\Windows\System\hXlCoPs.exe
  C:\Windows\System\hXlCoPs.exe
  2⤵
  PID:9040
- C:\Windows\System\ffxeTup.exe
  C:\Windows\System\ffxeTup.exe
  2⤵
  PID:9104
- C:\Windows\System\ewKdpHg.exe
  C:\Windows\System\ewKdpHg.exe
  2⤵
  PID:9136
- C:\Windows\System\RpKEXoq.exe
  C:\Windows\System\RpKEXoq.exe
  2⤵
  PID:9200
- C:\Windows\System\aIiNLHM.exe
  C:\Windows\System\aIiNLHM.exe
  2⤵
  PID:8960
- C:\Windows\System\gTTAISH.exe
  C:\Windows\System\gTTAISH.exe
  2⤵
  PID:9024
- C:\Windows\System\ytQbLGN.exe
  C:\Windows\System\ytQbLGN.exe
  2⤵
  PID:6344
- C:\Windows\System\PCLvrqz.exe
  C:\Windows\System\PCLvrqz.exe
  2⤵
  PID:9124
- C:\Windows\System\AapQxlL.exe
  C:\Windows\System\AapQxlL.exe
  2⤵
  PID:7528
- C:\Windows\System\LiRYJQh.exe
  C:\Windows\System\LiRYJQh.exe
  2⤵
  PID:8276
- C:\Windows\System\VAGADpl.exe
  C:\Windows\System\VAGADpl.exe
  2⤵
  PID:8044
- C:\Windows\System\LzPDKEb.exe
  C:\Windows\System\LzPDKEb.exe
  2⤵
  PID:8352
- C:\Windows\System\nsbIyis.exe
  C:\Windows\System\nsbIyis.exe
  2⤵
  PID:8356
- C:\Windows\System\RpqRyom.exe
  C:\Windows\System\RpqRyom.exe
  2⤵
  PID:8340
- C:\Windows\System\XapzNOF.exe
  C:\Windows\System\XapzNOF.exe
  2⤵
  PID:8456
- C:\Windows\System\aSEvzUb.exe
  C:\Windows\System\aSEvzUb.exe
  2⤵
  PID:8604
- C:\Windows\System\jkJSYRw.exe
  C:\Windows\System\jkJSYRw.exe
  2⤵
  PID:8608
- C:\Windows\System\NmIJysm.exe
  C:\Windows\System\NmIJysm.exe
  2⤵
  PID:8840
- C:\Windows\System\JDuqRpV.exe
  C:\Windows\System\JDuqRpV.exe
  2⤵
  PID:8880
- C:\Windows\System\YHsYtHk.exe
  C:\Windows\System\YHsYtHk.exe
  2⤵
  PID:8860
- C:\Windows\System\tLmiHfC.exe
  C:\Windows\System\tLmiHfC.exe
  2⤵
  PID:9076
- C:\Windows\System\lnHUrdI.exe
  C:\Windows\System\lnHUrdI.exe
  2⤵
  PID:8892
- C:\Windows\System\xoboyzB.exe
  C:\Windows\System\xoboyzB.exe
  2⤵
  PID:9056
- C:\Windows\System\jUCVlZm.exe
  C:\Windows\System\jUCVlZm.exe
  2⤵
  PID:8212
- C:\Windows\System\boUCRtT.exe
  C:\Windows\System\boUCRtT.exe
  2⤵
  PID:8488
- C:\Windows\System\ZukoqJY.exe
  C:\Windows\System\ZukoqJY.exe
  2⤵
  PID:8460
- C:\Windows\System\uBnAsEm.exe
  C:\Windows\System\uBnAsEm.exe
  2⤵
  PID:8384
- C:\Windows\System\dtkdmhL.exe
  C:\Windows\System\dtkdmhL.exe
  2⤵
  PID:8924
- C:\Windows\System\zxnMxXa.exe
  C:\Windows\System\zxnMxXa.exe
  2⤵
  PID:8692
- C:\Windows\System\tExadZX.exe
  C:\Windows\System\tExadZX.exe
  2⤵
  PID:8372
- C:\Windows\System\vbNBFCX.exe
  C:\Windows\System\vbNBFCX.exe
  2⤵
  PID:8772
- C:\Windows\System\PeFvegL.exe
  C:\Windows\System\PeFvegL.exe
  2⤵
  PID:9168
- C:\Windows\System\CxwVKia.exe
  C:\Windows\System\CxwVKia.exe
  2⤵
  PID:9156
- C:\Windows\System\eUpeBgL.exe
  C:\Windows\System\eUpeBgL.exe
  2⤵
  PID:8116
- C:\Windows\System\mKTsTrD.exe
  C:\Windows\System\mKTsTrD.exe
  2⤵
  PID:7744
- C:\Windows\System\bPMupMA.exe
  C:\Windows\System\bPMupMA.exe
  2⤵
  PID:8520
- C:\Windows\System\rIyyZds.exe
  C:\Windows\System\rIyyZds.exe
  2⤵
  PID:8272
- C:\Windows\System\zawFRwP.exe
  C:\Windows\System\zawFRwP.exe
  2⤵
  PID:9028
- C:\Windows\System\MLWyzzF.exe
  C:\Windows\System\MLWyzzF.exe
  2⤵
  PID:8864
- C:\Windows\System\FlzFDLb.exe
  C:\Windows\System\FlzFDLb.exe
  2⤵
  PID:8524
- C:\Windows\System\LmsgBez.exe
  C:\Windows\System\LmsgBez.exe
  2⤵
  PID:9232
- C:\Windows\System\QtjvXuw.exe
  C:\Windows\System\QtjvXuw.exe
  2⤵
  PID:9248
- C:\Windows\System\bRORZNO.exe
  C:\Windows\System\bRORZNO.exe
  2⤵
  PID:9264
- C:\Windows\System\uYrmxGB.exe
  C:\Windows\System\uYrmxGB.exe
  2⤵
  PID:9280
- C:\Windows\System\rZDtAzE.exe
  C:\Windows\System\rZDtAzE.exe
  2⤵
  PID:9296
- C:\Windows\System\qGlIXjh.exe
  C:\Windows\System\qGlIXjh.exe
  2⤵
  PID:9312
- C:\Windows\System\GJdGazt.exe
  C:\Windows\System\GJdGazt.exe
  2⤵
  PID:9328
- C:\Windows\System\OJQkDWy.exe
  C:\Windows\System\OJQkDWy.exe
  2⤵
  PID:9344
- C:\Windows\System\ZDYjPhd.exe
  C:\Windows\System\ZDYjPhd.exe
  2⤵
  PID:9360
- C:\Windows\System\doTIlex.exe
  C:\Windows\System\doTIlex.exe
  2⤵
  PID:9376
- C:\Windows\System\niWWmZS.exe
  C:\Windows\System\niWWmZS.exe
  2⤵
  PID:9396
- C:\Windows\System\gbHVAMC.exe
  C:\Windows\System\gbHVAMC.exe
  2⤵
  PID:9412
- C:\Windows\System\tKjCkUN.exe
  C:\Windows\System\tKjCkUN.exe
  2⤵
  PID:9428
- C:\Windows\System\wXYXJDD.exe
  C:\Windows\System\wXYXJDD.exe
  2⤵
  PID:9444
- C:\Windows\System\zEYNCGn.exe
  C:\Windows\System\zEYNCGn.exe
  2⤵
  PID:9460
- C:\Windows\System\qThXSdK.exe
  C:\Windows\System\qThXSdK.exe
  2⤵
  PID:9476
- C:\Windows\System\vsgzboO.exe
  C:\Windows\System\vsgzboO.exe
  2⤵
  PID:9492
- C:\Windows\System\kEJBCIE.exe
  C:\Windows\System\kEJBCIE.exe
  2⤵
  PID:9508
- C:\Windows\System\SYiqAuS.exe
  C:\Windows\System\SYiqAuS.exe
  2⤵
  PID:9524
- C:\Windows\System\SKVdTjc.exe
  C:\Windows\System\SKVdTjc.exe
  2⤵
  PID:9544
- C:\Windows\System\oHeUAsW.exe
  C:\Windows\System\oHeUAsW.exe
  2⤵
  PID:9560
- C:\Windows\System\eWfEhOA.exe
  C:\Windows\System\eWfEhOA.exe
  2⤵
  PID:9580
- C:\Windows\System\mXGqPAm.exe
  C:\Windows\System\mXGqPAm.exe
  2⤵
  PID:9648
- C:\Windows\System\msWvCNZ.exe
  C:\Windows\System\msWvCNZ.exe
  2⤵
  PID:9668
- C:\Windows\System\aatZjqo.exe
  C:\Windows\System\aatZjqo.exe
  2⤵
  PID:9684
- C:\Windows\System\JOAyaSE.exe
  C:\Windows\System\JOAyaSE.exe
  2⤵
  PID:9700
- C:\Windows\System\KVynNWt.exe
  C:\Windows\System\KVynNWt.exe
  2⤵
  PID:9716
- C:\Windows\System\YJvmRxU.exe
  C:\Windows\System\YJvmRxU.exe
  2⤵
  PID:9732
- C:\Windows\System\HUwnCHv.exe
  C:\Windows\System\HUwnCHv.exe
  2⤵
  PID:9748
- C:\Windows\System\UdPYdcp.exe
  C:\Windows\System\UdPYdcp.exe
  2⤵
  PID:9764
- C:\Windows\System\tMJdGdb.exe
  C:\Windows\System\tMJdGdb.exe
  2⤵
  PID:9780
- C:\Windows\System\YMIWYuz.exe
  C:\Windows\System\YMIWYuz.exe
  2⤵
  PID:9796
- C:\Windows\System\aiiXlJz.exe
  C:\Windows\System\aiiXlJz.exe
  2⤵
  PID:9812
- C:\Windows\System\RmkKpsz.exe
  C:\Windows\System\RmkKpsz.exe
  2⤵
  PID:9828
- C:\Windows\System\zyTImlS.exe
  C:\Windows\System\zyTImlS.exe
  2⤵
  PID:9844
- C:\Windows\System\jAMFniz.exe
  C:\Windows\System\jAMFniz.exe
  2⤵
  PID:9860
- C:\Windows\System\qsyKupa.exe
  C:\Windows\System\qsyKupa.exe
  2⤵
  PID:9876
- C:\Windows\System\HXftsuY.exe
  C:\Windows\System\HXftsuY.exe
  2⤵
  PID:9892
- C:\Windows\System\RlinTZG.exe
  C:\Windows\System\RlinTZG.exe
  2⤵
  PID:9908
- C:\Windows\System\fOkeVKq.exe
  C:\Windows\System\fOkeVKq.exe
  2⤵
  PID:9924
- C:\Windows\System\gnfrfMs.exe
  C:\Windows\System\gnfrfMs.exe
  2⤵
  PID:9940
- C:\Windows\System\LFzeKNh.exe
  C:\Windows\System\LFzeKNh.exe
  2⤵
  PID:9956
- C:\Windows\System\PtzHAHw.exe
  C:\Windows\System\PtzHAHw.exe
  2⤵
  PID:9972
- C:\Windows\System\MNWyZZg.exe
  C:\Windows\System\MNWyZZg.exe
  2⤵
  PID:9992
- C:\Windows\System\apffafc.exe
  C:\Windows\System\apffafc.exe
  2⤵
  PID:10008
- C:\Windows\System\wlCSJaS.exe
  C:\Windows\System\wlCSJaS.exe
  2⤵
  PID:10028
- C:\Windows\System\JIsxDbt.exe
  C:\Windows\System\JIsxDbt.exe
  2⤵
  PID:10044
- C:\Windows\System\gJGAcaJ.exe
  C:\Windows\System\gJGAcaJ.exe
  2⤵
  PID:10060
- C:\Windows\System\BSWNzhk.exe
  C:\Windows\System\BSWNzhk.exe
  2⤵
  PID:10076
- C:\Windows\System\FXfUMLH.exe
  C:\Windows\System\FXfUMLH.exe
  2⤵
  PID:10092
- C:\Windows\System\WyxKFFN.exe
  C:\Windows\System\WyxKFFN.exe
  2⤵
  PID:10108
- C:\Windows\System\njZagDo.exe
  C:\Windows\System\njZagDo.exe
  2⤵
  PID:10124
- C:\Windows\System\mgubazg.exe
  C:\Windows\System\mgubazg.exe
  2⤵
  PID:10140
- C:\Windows\System\UMeScDq.exe
  C:\Windows\System\UMeScDq.exe
  2⤵
  PID:10156
- C:\Windows\System\ZrNUrMw.exe
  C:\Windows\System\ZrNUrMw.exe
  2⤵
  PID:10172
- C:\Windows\System\EYwaEpo.exe
  C:\Windows\System\EYwaEpo.exe
  2⤵
  PID:10188
- C:\Windows\System\JajWkNA.exe
  C:\Windows\System\JajWkNA.exe
  2⤵
  PID:10204
- C:\Windows\System\qXFBfsk.exe
  C:\Windows\System\qXFBfsk.exe
  2⤵
  PID:10224
- C:\Windows\System\NfAqXiO.exe
  C:\Windows\System\NfAqXiO.exe
  2⤵
  PID:9008
- C:\Windows\System\fuBeusr.exe
  C:\Windows\System\fuBeusr.exe
  2⤵
  PID:9240
- C:\Windows\System\KGIGWzo.exe
  C:\Windows\System\KGIGWzo.exe
  2⤵
  PID:9304
- C:\Windows\System\sqckJKP.exe
  C:\Windows\System\sqckJKP.exe
  2⤵
  PID:9288
- C:\Windows\System\vXlMbVv.exe
  C:\Windows\System\vXlMbVv.exe
  2⤵
  PID:9292
- C:\Windows\System\gbBwkvZ.exe
  C:\Windows\System\gbBwkvZ.exe
  2⤵
  PID:9320
- C:\Windows\System\ovIduUz.exe
  C:\Windows\System\ovIduUz.exe
  2⤵
  PID:9436
- C:\Windows\System\nPFDUMK.exe
  C:\Windows\System\nPFDUMK.exe
  2⤵
  PID:9424
- C:\Windows\System\ygOiyro.exe
  C:\Windows\System\ygOiyro.exe
  2⤵
  PID:9504
- C:\Windows\System\azOtHOo.exe
  C:\Windows\System\azOtHOo.exe
  2⤵
  PID:9568
- C:\Windows\System\lFAzMmg.exe
  C:\Windows\System\lFAzMmg.exe
  2⤵
  PID:8592
- C:\Windows\System\hZVVhPz.exe
  C:\Windows\System\hZVVhPz.exe
  2⤵
  PID:9516
- C:\Windows\System\hqXdeCw.exe
  C:\Windows\System\hqXdeCw.exe
  2⤵
  PID:9556
- C:\Windows\System\sOYNvid.exe
  C:\Windows\System\sOYNvid.exe
  2⤵
  PID:9592
- C:\Windows\System\LMvnpye.exe
  C:\Windows\System\LMvnpye.exe
  2⤵
  PID:9608
- C:\Windows\System\uWHNAXP.exe
  C:\Windows\System\uWHNAXP.exe
  2⤵
  PID:9616
- C:\Windows\System\MvtzZIn.exe
  C:\Windows\System\MvtzZIn.exe
  2⤵
  PID:9696
- C:\Windows\System\eYhKEqH.exe
  C:\Windows\System\eYhKEqH.exe
  2⤵
  PID:9788
- C:\Windows\System\rWjJMTv.exe
  C:\Windows\System\rWjJMTv.exe
  2⤵
  PID:9824
- C:\Windows\System\REXZKwT.exe
  C:\Windows\System\REXZKwT.exe
  2⤵
  PID:9884
- C:\Windows\System\rRMTffy.exe
  C:\Windows\System\rRMTffy.exe
  2⤵
  PID:9984
- C:\Windows\System\hbSqxOY.exe
  C:\Windows\System\hbSqxOY.exe
  2⤵
  PID:10016
- C:\Windows\System\NqMbNCz.exe
  C:\Windows\System\NqMbNCz.exe
  2⤵
  PID:9628
- C:\Windows\System\NGYjtps.exe
  C:\Windows\System\NGYjtps.exe
  2⤵
  PID:10088
- C:\Windows\System\enwOLmo.exe
  C:\Windows\System\enwOLmo.exe
  2⤵
  PID:10152
- C:\Windows\System\vNwbZGM.exe
  C:\Windows\System\vNwbZGM.exe
  2⤵
  PID:10180
- C:\Windows\System\GRvzuVX.exe
  C:\Windows\System\GRvzuVX.exe
  2⤵
  PID:9640
- C:\Windows\System\VjnURla.exe
  C:\Windows\System\VjnURla.exe
  2⤵
  PID:9712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BRtCmvP.exe

Filesize
2.1MB

MD5
4ebef068db483da93b1fa11c78d0af9d

SHA1
5a6a5ac3156122180380e35c4449a28220d0f5a9

SHA256
8bcc621af8bb01e260ef8195396770e08c4b287446c1b4dbe6cded60871343c8

SHA512
45550cc00de9645d407cebb2dc1c6c6e825db799f9c8e9ac5c9a219e5474c450b665507ac56e34a7cd2edd2e1439f89640f2a7efe98e399441b1b5f3b34a9674

Download Submit
C:\Windows\system\GKGXDiP.exe

Filesize
2.1MB

MD5
2246768ce6064791b82a829a6245da20

SHA1
6586e19484a460f53b55ba221518335c16c62ff0

SHA256
d6bd25187e3f928d594f3b7c6a1f67060ee891d712a81167764bc5b0c159a0e7

SHA512
df77489924674aa8d1dbe6004b5b33636fe0aca4a992107e313a3ae641fb302b92164e7a6f137b7447288fdf10de563f19a0b595dc5c7a656ba2d93f9043c474

Download Submit
C:\Windows\system\HDZOjpV.exe

Filesize
2.1MB

MD5
2a2eb48549adf495310f2e87c92e4da8

SHA1
547a522b2f552def1e1223d48a3466008878ef6c

SHA256
9c85138f9412c31a5123aee7c3859e3476bccd35b68aef2bbf4d80028b42d1a7

SHA512
b5752b14a3473c0d432242bc60424ca494148533fae3203b7731d571306bd976e76fbb44620ee1afe9b7ab0a40ce896ff6f49ceea4f76cc35919f7c4bb421306

Download Submit
C:\Windows\system\JlcfeDH.exe

Filesize
2.1MB

MD5
8a5d642f1e390c1cb037c44ac4d9091e

SHA1
5e3d798d2ad8410803fcd98e4e162ad960e51fc9

SHA256
bdc71094e85ce208f40a7a9ac8c685f2649d88fa830d65fd5d915c112ca6f49c

SHA512
ff0fa12cb22e01c710b5c6b16b36b49b8aff08b30f3a0815cdb6ed6fd44ea5776b72bf864b71896f053b96aeac61bd9f91109024e61944b36e0bd9a1c2ce2c5f

Download Submit
C:\Windows\system\MaSkXIP.exe

Filesize
2.1MB

MD5
8f31c518c2b1be9557b87ba4aa0d650b

SHA1
7d6e67a67d90d85663a6c98d77fcfe138315fdb6

SHA256
395218b8e6f093fa8c9239d4d802836fa9769289e9849d00881cba793321531a

SHA512
ae767af52e1bee15e9a78d0357c9d2d2ceb966d2cefa43d9c94ef15264e04186f31d0986d1b97fa20e935d95193f3cd3cfb1201300218a27dd0743266337e1da

Download Submit
C:\Windows\system\OniYIyt.exe

Filesize
2.1MB

MD5
7c4ca94b0424fb948f68a648a5b53e67

SHA1
3567ce88f0cc5f4921492639486938df48f93b69

SHA256
9bade6fad053fb82c43a3c05325dccc004dcc5b9b91a381b4654de31705f2728

SHA512
59e238dc9bf4e7c70b47062f5e9aaa7fb37a3746b34266938205671602c3e0ed06b0f94ec1475a45269d242a345d5d1bc9a12ab4f73444b7519a39a46bd416ae

Download Submit
C:\Windows\system\QZjgsIF.exe

Filesize
2.1MB

MD5
d9eec3e2716cdfe9cedad8e2d9a83f81

SHA1
84a5d61d11b1c35308b8f9364a96a57b3b57f19b

SHA256
1f248dc86a37de3ea18ef1de983a39cf4faa06cfb510ab0832d91071d9ddd634

SHA512
670cf81f0c29f6baa157a8983146d9ceb20c56890e1fe00958815c1556c1831f62ab78f33ab79f6ef2ca01ceff0ff62983cbb974f68134f5e16a10aacabb5369

Download Submit
C:\Windows\system\RnNTaNF.exe

Filesize
2.1MB

MD5
7150aed790104785faef2ac77d32b3f9

SHA1
2ec7001c1da45642cbe916dbb1c746a587a7fe9d

SHA256
b2a9f5cb67203250cc91493b6504130b380c16a133520174c3c79c48ceab7328

SHA512
a650a04548523f0ac3716041335ca0b7b315ed7ae4fbd3737b7ed3e5c298ba85cfda3b8aab06b2d7523ed893178282ddb8efff91adff136548d01a35d4126dca

Download Submit
C:\Windows\system\TwvWXYR.exe

Filesize
2.1MB

MD5
69c581b7435ecbbde968158163b01885

SHA1
b4aff245d2d5f2b4ff18ae9b75d143f834e8f59c

SHA256
8046152875973fc4ae6d895ca4feaee5b6b17bcbb73e366bffd149ed6091529c

SHA512
ef43ddb56053ccd101c5c88ca0f6386a8ac81ddf82fb13295467ba9db28226e2f7c412c0c207c97d1a7c9d4954718b28a425f6567f5713266db0b8a90a9f0726

Download Submit
C:\Windows\system\UoQSVCg.exe

Filesize
2.1MB

MD5
22a78d1f108fe9f97037bb7b26136207

SHA1
e8c1d6fdea754e255c2bdbb203d1681ceac9ab6f

SHA256
5e43e287b43533d26ec3d2af8c5c5be9c3b21f72544861607cde6b7ca773f91f

SHA512
b89b4fe5717559f0fd1d179928e616c8c18fa95c2bad1438bd1fc1901db971c28f074ce8e50acf4cd0b969f6edd4c56a09f8f1a7ba436d70e7d0af54673a6280

Download Submit
C:\Windows\system\VIPSVAb.exe

Filesize
2.1MB

MD5
60aa196fcdeaa456ef7ef57bfd024460

SHA1
f934db6f03a4f31fc4967f723975dbb035c5b038

SHA256
b1f72a05c4c97be5be2be49dfadb0fe277eb0598dbebf2576f0f977e4f52c04b

SHA512
cb821cb4189bb3256b97d9596fade522b8c29a460981d79a16d97092044ff78c3719cf1c11b2a92405c3c60604280fde01609a46b8198410c3fea11e7de6537a

Download Submit
C:\Windows\system\bNILLld.exe

Filesize
2.1MB

MD5
034f3186f216b9abd25fa8067f55de01

SHA1
ef2e5c4c9e16a56d211fae96e4fe194ff31b8443

SHA256
48988ade0039bd179d238f8d578107077eab52612059221bd8d52890fa234093

SHA512
51f2c9b41d734329a0da0e5a2456d0d57a79f2e820461b6cc50fa78292191eb0f19681b47d1fef7ed064922e056bb0c791c593549337da65d056f76c290a0e7e

Download Submit
C:\Windows\system\byaWsUH.exe

Filesize
2.1MB

MD5
29b4027ee6fd9ee98e3733748f558ee5

SHA1
41e12697adefb337684117b22efa0af80172e8a4

SHA256
09cd24ee59c22ad2b7301a239ccb4b72e915987f35597d49c541ac435a0add55

SHA512
cfb259987895cdcd3b5f2ff23fdc16a5608db55b65b978b2a3ef8bd5a498415ca8161cc8b7dfd9c7c816564d053efe0653e3327aa94067c263a1b8e709ce49ab

Download Submit
C:\Windows\system\cVwlEaQ.exe

Filesize
2.1MB

MD5
bdca536bef6bf604a4fd9d5969342f4c

SHA1
39b357cff97c905dc40466257c2e4234ec2f0886

SHA256
bd0962f1fddc83e978a702437b1a95b41ab618eb3c4adb5fbc06d66a9703ded9

SHA512
9062906dd84127e2f539ab0d8b5ee3eb4099d87dc298dfef4fbc6abdc769fdcb3ed03108729d07745fed0e96b012deadceec4fac000ac6b186940be94facf18c

Download Submit
C:\Windows\system\clmMMhW.exe

Filesize
2.1MB

MD5
e1ab7d9bbec9e39242e2b065c4c42729

SHA1
4322f2e212ade13483143cb7cd05a3f0cfc1d101

SHA256
4c17add1da498c20f1d57cb19e7b57f0c189d3947c42425607e63ef021b4231f

SHA512
a55fb02d65c17651fc4b0b49bd4223329045fcbe7bb8fe55942be54e40c28655fbfdd56fd9bf1700589de19739579a4c742cd975b43ca5468911c089311567b9

Download Submit
C:\Windows\system\dyfkQom.exe

Filesize
2.1MB

MD5
f1d56357c4bea7214a4be34f75a702b0

SHA1
36bd123aed901f7e610f1dc48585884c71295b2d

SHA256
2e89e2d38c2d80f64455357f2338fca39bb0769f8b7dde1cd03717cdb6b60e3c

SHA512
a13cb7fed726fd3da3a3118ab7cab199c38c75082a02bcf009309308e031537c3c45eaaed777e64f25843aa70bd74673feca71eb1c23b87b8e798cea760d4d34

Download Submit
C:\Windows\system\fZsKFPe.exe

Filesize
2.1MB

MD5
def4fe335564fb2c530a5b47bcc9c455

SHA1
806949d621f998d1896a72c311a5c3fa5ca721b5

SHA256
3f65a8423812e7bce2ceb4f1d9647b21573f985585d1f9a03cdd5d959fa5420b

SHA512
9aa2a536ab71e63154059bbde490a2d436eec453a40aa61e71f44cf47db0eb953e46308b0df419f1821181328e37337cd66884a1ce4120696d13648fa3701bb6

Download Submit
C:\Windows\system\goEhKVx.exe

Filesize
2.1MB

MD5
9bbbdfbb459a1798c8a713496be81962

SHA1
cf5ee4e0381f61e5e084f2ffdb75d43f2aa433fc

SHA256
4479e37713ed1d34e75e1e067b354d9f3193d643912f911b96c5ab1460030a44

SHA512
c0608ef78ba618cc8c9ad63ae83edd030ce6bcf4b18e339efe3287673d9b0e01709c5b0e9fd5c07d66ab1869ed0e3904a93404c597ea55659bc0431ef3a8de2a

Download Submit
C:\Windows\system\hYjJtnr.exe

Filesize
2.1MB

MD5
a6c54ebf2872b6e6971b87d4b82bc7c7

SHA1
c1ff2baf8a51fba499d5b04294d9a47a53cfa673

SHA256
561a439bcc8fa1937e57b96c7458cc8700d1665b52ea720b302156baef3ca446

SHA512
5fd5da9504e7cd174232dbd866fb2b9aac951b11ff3a4927450ddaab6584407f47259194d5df8b47566fa61254f5cdf1dfb6b728120fa266c2eb44aa9160f41e

Download Submit
C:\Windows\system\jnPvoSG.exe

Filesize
2.1MB

MD5
cc45204ccdcc418e99f673e860b3a7f4

SHA1
a0474259d0c24d76a40f400d08f2a6e60a56fa56

SHA256
931cc02778309b106e870498a30f8a329653a59d3038a712f1ea32d6b56d0c5d

SHA512
4c813065564f3065becfa831712be4181e9aaf415e430c6baf0c5ce22fb35827f4e29bb283228f92b6c1e868622544e906b3ea8ecae2e26cd6899f564698a12b

Download Submit
C:\Windows\system\rjOShQj.exe

Filesize
2.1MB

MD5
92c7d58dda7944a83e5f3930d2b0b58a

SHA1
018c79cfab691cc792682cc3564113d5cc48a06c

SHA256
601465fb9d824ed83b6d2bcedd4b6bb05c4874276740e651b3128e8654502aa7

SHA512
66f52b61ce9c5d3caa769b1f7fc7aab0eb0b2cbbec5024373a3565bb4bfc3ed64e6c1cc49d0ce2602e79ab7301263444206adcfb49dd4538727f4fc339368c6e

Download Submit
C:\Windows\system\sbvuWGD.exe

Filesize
2.1MB

MD5
2217ab4c0aab2e544c5a292d177ce376

SHA1
6225c0b2b4f80d79383f1da260bdaeb3b04885aa

SHA256
0036fb923056fb45ba68f99c58dd7aedc4c91d01c759aeef44cfbde8d2b52dbd

SHA512
d54a37a07d5ec6f61e6bf9e1bd1955f367d81a8e2f7e71b11e12ee41dba65723ec9e616f45d7baaba8de2be2efa78a9018cbcc51822392729c72a88767190f9d

Download Submit
C:\Windows\system\stkNcRk.exe

Filesize
2.1MB

MD5
6ef504052330afa433d3c324047e9874

SHA1
a1eb9f4b5d3086325ce2d09b86744a1bb6b5d66d

SHA256
b48ab26753b33be1a9d250222cae35a65ee82d8c491a937b17a4502b78fc6599

SHA512
68942173018e7ef4c86b3b1ecfd492ae648343710727b447bd496ccb0d3d05fac9f805fa32c66172fe7c2f9c70d96a9d0a03c726f8f888be828a6006289122b1

Download Submit
C:\Windows\system\uHqhamD.exe

Filesize
2.1MB

MD5
6847635253b7865b21af48b535d5bd0a

SHA1
05d04df5acebeb298e6976fd5220d3c1625296dd

SHA256
33c12a8fa54fe17fd8863f7105db345b3df2bcdfb9eb8d83781b0cccc273d95d

SHA512
980b810d61f6e41fce3d5e87098c63ab8ba36b74bb3d7390268bb39520f10bd47cf18a52131435cae958005c7522002653eb93b316462880feb0fe732e448d95

Download Submit
C:\Windows\system\ugPWyHX.exe

Filesize
2.1MB

MD5
dbe406029a67d73f1fcc13d1ce022b7d

SHA1
94f914cbee61dbe021606d74dda7913479f31154

SHA256
deb7f4e7a2cd3c96816d2402b5d898a0982816d98f860a2a26d8f3a590902543

SHA512
ee963f53c49f8981cca2b9b2298f5807feca95b58c4727ae7046b53350f4d34b07a2fff3c66ec209bb3e2d315b8094b0ca3f3896bda8a2e64426b1cecb9672a0

Download Submit
C:\Windows\system\zFLuZIc.exe

Filesize
2.1MB

MD5
fe21772b3030f9f0c0acae68fab8f54b

SHA1
642798f0d510bf04770c516004417d06899d1db7

SHA256
b039d34d20ada2ce1da002ab43db6dbef97624d29d3c4ba2bb265cd6f80c8c93

SHA512
4c02d35cf9ce802a34cd80b7d5b271cda146c6c7f95adcae683e66caa6aa43e8481e7f4bd6555817c187a1ccd96f26fb9a7991e561768c883d9493d4f0b4b4a4

Download Submit
\Windows\system\DOgIZwT.exe

Filesize
2.1MB

MD5
a95b147eb742d5d4ef4e7913b37422b5

SHA1
1b0207e6439c5b134526b4a154fbad9977d993fc

SHA256
126bbd7de070d1f11938a230d8bbe58c2015a1d8d221793b3b84c14e64e67ff7

SHA512
ed54500690c0c84c7f8bf56e639f51b6d653e28a31861895d43e82738d5a9480f59eafbb24f5e0032ab2610303bb15c782fea6acbb77450985b2a14ab25af6bb

Download Submit
\Windows\system\MUZkQxT.exe

Filesize
2.1MB

MD5
31de233827ddc8969cd18bd4485eef78

SHA1
cb8db684857a9b3283e85280dde5f5e97413150a

SHA256
ef090aae4b9c7da61bc8cef369ff1b56dba9597e051403cac64f5ea4b2ea8a31

SHA512
accd0bef0e67baab8f383d595fd64910f8fad845d69cc790d120061dba0197ca399dd92e183da920546db2386d1053d1115c53923495f72d4ac05a6a6687a299

Download Submit
\Windows\system\UHfkyie.exe

Filesize
2.1MB

MD5
09b4d9eeae4f28db6bc2cca6cd86c4d5

SHA1
c28b50a0bd34fd1bb4ec5764096eaa812297e087

SHA256
3a99f10541244b9579b438c37c62693516fe68c3445c3bd452257ec2d80b535b

SHA512
40726afd2c0bd64fc96995f9ea7421679c019e41ce0729c4fbf6e0c4e9fd34a0edbaef4aeb964f95d3b14029ef7ffa3711fa785041211efcb7c3ce66cc7d9022

Download Submit
\Windows\system\cETBRBX.exe

Filesize
2.1MB

MD5
d8a2fadf5de0f701b462d594dbda5703

SHA1
58bbac0c703a369d1722e34dd2f87aaee50df34b

SHA256
8daea8f8a324670561b72d03a5aabdda63024b9c57e033b15c9f2befc058456a

SHA512
9ab9b6465f5531cacff8c72bfce2a419b3cd2af16fcd126e21d027e4bfed66a5ee2eb2cd2e6e296ca537d06235bf6f82a4fb49c368e1498212a826d9403ff5ef

Download Submit
\Windows\system\eHUnPFG.exe

Filesize
2.1MB

MD5
cd707ac52fb9df4b239a99a3dbaa0374

SHA1
fa9105383c13783c29067bb2784b2b770161af80

SHA256
64dfd87e56774350b05ec518942b924a30da49b662c02276822c2895b3aadf0f

SHA512
9b77ac40d94b36ee992f3a1098cdabaa3451d8553e763a2ce2a69401645e4a5bfa57f173125582805af8b9f8faa7b2689222601193100ad7438b0237f92427bb

Download Submit
\Windows\system\umjHkDw.exe

Filesize
2.1MB

MD5
b2c19edfd6a286960ac9c5c4af760ecc

SHA1
b745cddcccc79dd806675b08fb938b0ca6a33f7d

SHA256
50e25f7706dd5172dc46423b3314d2c9ae4410e536f2f2fe94c74f4667f723cf

SHA512
8a2a8dfadf2d3df474a34e9f8b328e2803bd1873eaa4566f0bfdca9108c3d79e9d862c211285fae8b2cb69dca8110c7ac8a6146d56f3ac7051d029f9078a3103

Download Submit
memory/848-60-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/996-57-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/996-642-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/996-639-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/996-59-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/996-58-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/996-56-0x0000000002FE0000-0x00000000033D2000-memory.dmp

Filesize
3.9MB

Download
memory/996-14-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/996-42-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/996-1-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/996-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/996-38-0x0000000002FE0000-0x00000000033D2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-635-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2408-638-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2428-636-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2444-70-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2500-1491-0x000000001B750000-0x000000001BA32000-memory.dmp

Filesize
2.9MB

Download
memory/2500-2033-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/2512-74-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2528-637-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2540-20-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2544-26-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-34-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/2712-640-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download