xmrig | f9ea187fbc1a6d306775667f572d559c77679ac571f1165e50a09934ca4de2e8

Analysis

max time kernel
27s
max time network
21s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 19:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
Size

1.9MB
MD5

05efe60cace292c33e4b17f94b1af7f7
SHA1

d3ae4c6c1790f86a6b8b55423c9f3fec25a85f69
SHA256

f9ea187fbc1a6d306775667f572d559c77679ac571f1165e50a09934ca4de2e8
SHA512

f6c510eed961844e38087d2b1b696b056901c1692a3b672688a557aa55c39e96a53be1b621c9874b3c3b4ce24a85f5614db501e1b714515c0eb6961af25c2dec
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UX:NAB2

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2540-29-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/112-43-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig
behavioral1/memory/2636-44-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2860-42-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	xmrig
behavioral1/memory/2276-76-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2680-74-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/2168-754-0x000000013FB80000-0x000000013FF72000-memory.dmp	xmrig
behavioral1/memory/1232-802-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1232	cKMCcXV.exe
2636	lIZQYiM.exe
2540	LDZArfO.exe
2860	kCLHVCz.exe
112	xitsUvZ.exe
2460	IardeZE.exe
1784	vmESiec.exe
2680	iEEqpQj.exe
2276	lqdSHEp.exe
2940	PanmCDk.exe
1904	GYuvLwy.exe
1372	YCNvyrA.exe
2128	YaARZsh.exe
2592	eERpRbX.exe
2756	TmVbTCX.exe
1948	OQxTzWi.exe
1512	YfkqlcK.exe
1364	VdpRMJC.exe
1328	BmuaZZh.exe
1960	KgTMfWg.exe
2204	HlAsijv.exe
2072	tSTtIVo.exe
2820	NEqWqlJ.exe
2152	jJLsDsl.exe
2512	yeCfame.exe
688	BhxRxzV.exe
648	BxqdGDm.exe
1792	DwGxkkn.exe
1892	wquvQLM.exe
2284	DxuZuJP.exe
2380	lyICkKa.exe
1672	JWtdAGc.exe
2104	wwJQCsi.exe
2888	KjKJtFS.exe
1696	CmUpeTQ.exe
1552	eiUrosz.exe
1332	drTshWA.exe
1724	kJkWSfW.exe
548	UqlRkEt.exe
2892	rzmYQaZ.exe
868	LwFcmzH.exe
2252	MeaEUvR.exe
700	sBUzQVo.exe
2308	uzXJXdM.exe
2140	xlobzHw.exe
676	KiBoUcV.exe
2728	vegTODa.exe
1584	wFEjgGe.exe
1912	fkPxzfJ.exe
1444	zXIGCpY.exe
2164	fIcAvXA.exe
760	xcmcMRx.exe
1728	YjwbwMn.exe
1640	cdHChsW.exe
2984	iLQWRlJ.exe
2628	SSEUGhX.exe
2024	pWhwDRM.exe
2596	dViGzRP.exe
2472	LvmvsJp.exe
2976	WZmLFny.exe
2952	fcFpHCp.exe
1808	AQDZjvu.exe
2388	REjDcdc.exe
2488	cJrXSLi.exe

Loads dropped DLL 64 IoCs

pid	Process
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2168-0-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/files/0x000c000000013413-6.dat	upx
behavioral1/files/0x0035000000013a3a-16.dat	upx
behavioral1/memory/1232-15-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/files/0x000e0000000054ab-20.dat	upx
behavioral1/files/0x000800000001415f-23.dat	upx
behavioral1/files/0x0007000000014175-30.dat	upx
behavioral1/memory/2540-29-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/memory/112-43-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/memory/2636-44-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/2860-42-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/files/0x0007000000014207-54.dat	upx
behavioral1/memory/2460-50-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/1784-58-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/files/0x0007000000014186-48.dat	upx
behavioral1/files/0x000800000001471a-59.dat	upx
behavioral1/files/0x0006000000014826-71.dat	upx
behavioral1/files/0x000600000001487f-81.dat	upx
behavioral1/files/0x0006000000014b18-88.dat	upx
behavioral1/files/0x0006000000014bbc-100.dat	upx
behavioral1/files/0x0006000000014e71-103.dat	upx
behavioral1/files/0x000600000001535e-116.dat	upx
behavioral1/files/0x0006000000015684-141.dat	upx
behavioral1/files/0x0006000000015cb6-161.dat	upx
behavioral1/files/0x0006000000015cd9-168.dat	upx
behavioral1/files/0x0006000000015ce3-182.dat	upx
behavioral1/files/0x0006000000015d20-186.dat	upx
behavioral1/files/0x0006000000015cff-179.dat	upx
behavioral1/files/0x0006000000015ccd-166.dat	upx
behavioral1/files/0x0006000000015cae-157.dat	upx
behavioral1/files/0x0006000000015c87-147.dat	upx
behavioral1/files/0x0006000000015c9e-151.dat	upx
behavioral1/files/0x0006000000015677-137.dat	upx
behavioral1/files/0x0006000000015653-126.dat	upx
behavioral1/files/0x000600000001565d-130.dat	upx
behavioral1/files/0x000600000001564f-121.dat	upx
behavioral1/files/0x0006000000014fa2-111.dat	upx
behavioral1/files/0x0006000000014b4c-95.dat	upx
behavioral1/files/0x0006000000014a9a-86.dat	upx
behavioral1/memory/2276-76-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/2680-74-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/files/0x0035000000013a46-65.dat	upx
behavioral1/memory/2168-754-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/memory/1232-802-0x000000013FC70000-0x0000000140062000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FiMnJfP.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\XUUyeDG.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\gdtwHoN.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\fVjHWwx.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\rPyOoRq.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\aHSbnhJ.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\WLNbuaj.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\Rxcutrp.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\HvoTXGD.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\UwLjNxe.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\SCaRsci.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\JyHIHZP.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\LXzZDoF.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\vmESiec.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\ebFRlyi.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\dPBdFfH.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\jIXbYBo.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\rPWbZQZ.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\bllZHiZ.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\iHaCpme.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\BuKnKKg.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\RrWlyMX.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\rmIkNaV.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\cCbvnyI.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\unsupVN.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\jtvgJkr.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\RXbZAcx.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\ffluDvd.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\VOMvTPR.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\zOarUsE.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\uvAhAWL.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\irKbQgB.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\ZHXIiKY.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\QIccVRG.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\PhvgKGs.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\WfCozQx.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\GFamLbo.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\sieGNbx.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\fpfHWZK.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\vegTODa.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\WyecOvl.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\GukBRNS.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\iNxImnN.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\FVdXGAo.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\jCCXNku.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\buSbjZD.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\lqdSHEp.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\mzMysWE.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\rvCdgEX.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\ToIknkS.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\ugIoMpI.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\mJHObjg.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\mhLNAsa.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\PmgZKgw.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\HUQhEsL.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\dTqFsmb.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\ciEriTl.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\umPSAZt.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\HwvVHaq.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\PWOQSlC.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\tuihUKO.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\AmBsbsu.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\sjPGURb.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
File created	C:\Windows\System\roVqTNt.exe	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2600	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
Token: SeDebugPrivilege	2600	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2600	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	29
PID 2168 wrote to memory of 2600	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	29
PID 2168 wrote to memory of 2600	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	29
PID 2168 wrote to memory of 1232	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	30
PID 2168 wrote to memory of 1232	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	30
PID 2168 wrote to memory of 1232	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	30
PID 2168 wrote to memory of 2636	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	31
PID 2168 wrote to memory of 2636	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	31
PID 2168 wrote to memory of 2636	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	31
PID 2168 wrote to memory of 2540	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	32
PID 2168 wrote to memory of 2540	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	32
PID 2168 wrote to memory of 2540	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	32
PID 2168 wrote to memory of 2860	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	33
PID 2168 wrote to memory of 2860	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	33
PID 2168 wrote to memory of 2860	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	33
PID 2168 wrote to memory of 112	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	34
PID 2168 wrote to memory of 112	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	34
PID 2168 wrote to memory of 112	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	34
PID 2168 wrote to memory of 2460	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	35
PID 2168 wrote to memory of 2460	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	35
PID 2168 wrote to memory of 2460	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	35
PID 2168 wrote to memory of 1784	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	36
PID 2168 wrote to memory of 1784	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	36
PID 2168 wrote to memory of 1784	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	36
PID 2168 wrote to memory of 2276	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	37
PID 2168 wrote to memory of 2276	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	37
PID 2168 wrote to memory of 2276	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	37
PID 2168 wrote to memory of 2680	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	38
PID 2168 wrote to memory of 2680	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	38
PID 2168 wrote to memory of 2680	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	38
PID 2168 wrote to memory of 2940	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	39
PID 2168 wrote to memory of 2940	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	39
PID 2168 wrote to memory of 2940	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	39
PID 2168 wrote to memory of 1904	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	40
PID 2168 wrote to memory of 1904	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	40
PID 2168 wrote to memory of 1904	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	40
PID 2168 wrote to memory of 1372	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	41
PID 2168 wrote to memory of 1372	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	41
PID 2168 wrote to memory of 1372	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	41
PID 2168 wrote to memory of 2128	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	42
PID 2168 wrote to memory of 2128	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	42
PID 2168 wrote to memory of 2128	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	42
PID 2168 wrote to memory of 2592	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	43
PID 2168 wrote to memory of 2592	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	43
PID 2168 wrote to memory of 2592	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	43
PID 2168 wrote to memory of 2756	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	44
PID 2168 wrote to memory of 2756	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	44
PID 2168 wrote to memory of 2756	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	44
PID 2168 wrote to memory of 1948	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	45
PID 2168 wrote to memory of 1948	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	45
PID 2168 wrote to memory of 1948	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	45
PID 2168 wrote to memory of 1512	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	46
PID 2168 wrote to memory of 1512	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	46
PID 2168 wrote to memory of 1512	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	46
PID 2168 wrote to memory of 1364	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	47
PID 2168 wrote to memory of 1364	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	47
PID 2168 wrote to memory of 1364	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	47
PID 2168 wrote to memory of 1328	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	48
PID 2168 wrote to memory of 1328	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	48
PID 2168 wrote to memory of 1328	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	48
PID 2168 wrote to memory of 1960	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	49
PID 2168 wrote to memory of 1960	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	49
PID 2168 wrote to memory of 1960	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	49
PID 2168 wrote to memory of 2204	2168	05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05efe60cace292c33e4b17f94b1af7f7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\System\cKMCcXV.exe
  C:\Windows\System\cKMCcXV.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\lIZQYiM.exe
  C:\Windows\System\lIZQYiM.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\LDZArfO.exe
  C:\Windows\System\LDZArfO.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\kCLHVCz.exe
  C:\Windows\System\kCLHVCz.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\xitsUvZ.exe
  C:\Windows\System\xitsUvZ.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\IardeZE.exe
  C:\Windows\System\IardeZE.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\vmESiec.exe
  C:\Windows\System\vmESiec.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\lqdSHEp.exe
  C:\Windows\System\lqdSHEp.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\iEEqpQj.exe
  C:\Windows\System\iEEqpQj.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\PanmCDk.exe
  C:\Windows\System\PanmCDk.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\GYuvLwy.exe
  C:\Windows\System\GYuvLwy.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\YCNvyrA.exe
  C:\Windows\System\YCNvyrA.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\YaARZsh.exe
  C:\Windows\System\YaARZsh.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\eERpRbX.exe
  C:\Windows\System\eERpRbX.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\TmVbTCX.exe
  C:\Windows\System\TmVbTCX.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\OQxTzWi.exe
  C:\Windows\System\OQxTzWi.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\YfkqlcK.exe
  C:\Windows\System\YfkqlcK.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\VdpRMJC.exe
  C:\Windows\System\VdpRMJC.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\BmuaZZh.exe
  C:\Windows\System\BmuaZZh.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\KgTMfWg.exe
  C:\Windows\System\KgTMfWg.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\HlAsijv.exe
  C:\Windows\System\HlAsijv.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\tSTtIVo.exe
  C:\Windows\System\tSTtIVo.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\NEqWqlJ.exe
  C:\Windows\System\NEqWqlJ.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\jJLsDsl.exe
  C:\Windows\System\jJLsDsl.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\yeCfame.exe
  C:\Windows\System\yeCfame.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\BhxRxzV.exe
  C:\Windows\System\BhxRxzV.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\BxqdGDm.exe
  C:\Windows\System\BxqdGDm.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\DwGxkkn.exe
  C:\Windows\System\DwGxkkn.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\wquvQLM.exe
  C:\Windows\System\wquvQLM.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\lyICkKa.exe
  C:\Windows\System\lyICkKa.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\DxuZuJP.exe
  C:\Windows\System\DxuZuJP.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\JWtdAGc.exe
  C:\Windows\System\JWtdAGc.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\wwJQCsi.exe
  C:\Windows\System\wwJQCsi.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\CmUpeTQ.exe
  C:\Windows\System\CmUpeTQ.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\KjKJtFS.exe
  C:\Windows\System\KjKJtFS.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\eiUrosz.exe
  C:\Windows\System\eiUrosz.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\drTshWA.exe
  C:\Windows\System\drTshWA.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\kJkWSfW.exe
  C:\Windows\System\kJkWSfW.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\UqlRkEt.exe
  C:\Windows\System\UqlRkEt.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\rzmYQaZ.exe
  C:\Windows\System\rzmYQaZ.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\LwFcmzH.exe
  C:\Windows\System\LwFcmzH.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\MeaEUvR.exe
  C:\Windows\System\MeaEUvR.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\sBUzQVo.exe
  C:\Windows\System\sBUzQVo.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\uzXJXdM.exe
  C:\Windows\System\uzXJXdM.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\xlobzHw.exe
  C:\Windows\System\xlobzHw.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\KiBoUcV.exe
  C:\Windows\System\KiBoUcV.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\vegTODa.exe
  C:\Windows\System\vegTODa.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\fkPxzfJ.exe
  C:\Windows\System\fkPxzfJ.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\wFEjgGe.exe
  C:\Windows\System\wFEjgGe.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\fIcAvXA.exe
  C:\Windows\System\fIcAvXA.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\zXIGCpY.exe
  C:\Windows\System\zXIGCpY.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\xcmcMRx.exe
  C:\Windows\System\xcmcMRx.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\YjwbwMn.exe
  C:\Windows\System\YjwbwMn.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\cdHChsW.exe
  C:\Windows\System\cdHChsW.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\iLQWRlJ.exe
  C:\Windows\System\iLQWRlJ.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\SSEUGhX.exe
  C:\Windows\System\SSEUGhX.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\pWhwDRM.exe
  C:\Windows\System\pWhwDRM.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\dViGzRP.exe
  C:\Windows\System\dViGzRP.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\LvmvsJp.exe
  C:\Windows\System\LvmvsJp.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\cJrXSLi.exe
  C:\Windows\System\cJrXSLi.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\WZmLFny.exe
  C:\Windows\System\WZmLFny.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\WjxvYiY.exe
  C:\Windows\System\WjxvYiY.exe
  2⤵
  PID:2548
- C:\Windows\System\fcFpHCp.exe
  C:\Windows\System\fcFpHCp.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\jeziCqE.exe
  C:\Windows\System\jeziCqE.exe
  2⤵
  PID:2040
- C:\Windows\System\AQDZjvu.exe
  C:\Windows\System\AQDZjvu.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\mBjSxWp.exe
  C:\Windows\System\mBjSxWp.exe
  2⤵
  PID:2772
- C:\Windows\System\REjDcdc.exe
  C:\Windows\System\REjDcdc.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\mCzariX.exe
  C:\Windows\System\mCzariX.exe
  2⤵
  PID:2808
- C:\Windows\System\MwHivGg.exe
  C:\Windows\System\MwHivGg.exe
  2⤵
  PID:1256
- C:\Windows\System\khtIZzB.exe
  C:\Windows\System\khtIZzB.exe
  2⤵
  PID:1176
- C:\Windows\System\pmvWMiM.exe
  C:\Windows\System\pmvWMiM.exe
  2⤵
  PID:1956
- C:\Windows\System\SHpkoXB.exe
  C:\Windows\System\SHpkoXB.exe
  2⤵
  PID:1620
- C:\Windows\System\heELfMw.exe
  C:\Windows\System\heELfMw.exe
  2⤵
  PID:604
- C:\Windows\System\ZgdYkus.exe
  C:\Windows\System\ZgdYkus.exe
  2⤵
  PID:2880
- C:\Windows\System\tngHZgT.exe
  C:\Windows\System\tngHZgT.exe
  2⤵
  PID:2392
- C:\Windows\System\QrehbwH.exe
  C:\Windows\System\QrehbwH.exe
  2⤵
  PID:568
- C:\Windows\System\FtEHTAK.exe
  C:\Windows\System\FtEHTAK.exe
  2⤵
  PID:2532
- C:\Windows\System\fOPYDMn.exe
  C:\Windows\System\fOPYDMn.exe
  2⤵
  PID:2908
- C:\Windows\System\mknOTUi.exe
  C:\Windows\System\mknOTUi.exe
  2⤵
  PID:2108
- C:\Windows\System\RheAnIb.exe
  C:\Windows\System\RheAnIb.exe
  2⤵
  PID:2448
- C:\Windows\System\mzMysWE.exe
  C:\Windows\System\mzMysWE.exe
  2⤵
  PID:284
- C:\Windows\System\HeEdnYm.exe
  C:\Windows\System\HeEdnYm.exe
  2⤵
  PID:2124
- C:\Windows\System\GIsEzAU.exe
  C:\Windows\System\GIsEzAU.exe
  2⤵
  PID:2248
- C:\Windows\System\EkMXjWv.exe
  C:\Windows\System\EkMXjWv.exe
  2⤵
  PID:844
- C:\Windows\System\OVpzuIg.exe
  C:\Windows\System\OVpzuIg.exe
  2⤵
  PID:2180
- C:\Windows\System\WPThzWO.exe
  C:\Windows\System\WPThzWO.exe
  2⤵
  PID:1932
- C:\Windows\System\JMkjJMD.exe
  C:\Windows\System\JMkjJMD.exe
  2⤵
  PID:2184
- C:\Windows\System\FBgQvxE.exe
  C:\Windows\System\FBgQvxE.exe
  2⤵
  PID:2852
- C:\Windows\System\knoFKBl.exe
  C:\Windows\System\knoFKBl.exe
  2⤵
  PID:3028
- C:\Windows\System\IutaDTq.exe
  C:\Windows\System\IutaDTq.exe
  2⤵
  PID:344
- C:\Windows\System\djSzgag.exe
  C:\Windows\System\djSzgag.exe
  2⤵
  PID:404
- C:\Windows\System\HDuubdx.exe
  C:\Windows\System\HDuubdx.exe
  2⤵
  PID:1520
- C:\Windows\System\yDXOBGg.exe
  C:\Windows\System\yDXOBGg.exe
  2⤵
  PID:532
- C:\Windows\System\uPZTjTY.exe
  C:\Windows\System\uPZTjTY.exe
  2⤵
  PID:2172
- C:\Windows\System\wFCBLBe.exe
  C:\Windows\System\wFCBLBe.exe
  2⤵
  PID:2496
- C:\Windows\System\jUzjeSz.exe
  C:\Windows\System\jUzjeSz.exe
  2⤵
  PID:2748
- C:\Windows\System\icmPLrT.exe
  C:\Windows\System\icmPLrT.exe
  2⤵
  PID:2800
- C:\Windows\System\WyecOvl.exe
  C:\Windows\System\WyecOvl.exe
  2⤵
  PID:2468
- C:\Windows\System\QsYdSfh.exe
  C:\Windows\System\QsYdSfh.exe
  2⤵
  PID:2764
- C:\Windows\System\mPAeJSj.exe
  C:\Windows\System\mPAeJSj.exe
  2⤵
  PID:2760
- C:\Windows\System\JuSRJfF.exe
  C:\Windows\System\JuSRJfF.exe
  2⤵
  PID:2464
- C:\Windows\System\duQqjcH.exe
  C:\Windows\System\duQqjcH.exe
  2⤵
  PID:2740
- C:\Windows\System\WPEmfRj.exe
  C:\Windows\System\WPEmfRj.exe
  2⤵
  PID:2092
- C:\Windows\System\rPWbZQZ.exe
  C:\Windows\System\rPWbZQZ.exe
  2⤵
  PID:1980
- C:\Windows\System\yyxzJnG.exe
  C:\Windows\System\yyxzJnG.exe
  2⤵
  PID:2824
- C:\Windows\System\akOBoZL.exe
  C:\Windows\System\akOBoZL.exe
  2⤵
  PID:1068
- C:\Windows\System\QNAmUDo.exe
  C:\Windows\System\QNAmUDo.exe
  2⤵
  PID:1416
- C:\Windows\System\nnxhSPt.exe
  C:\Windows\System\nnxhSPt.exe
  2⤵
  PID:312
- C:\Windows\System\pzEDxKh.exe
  C:\Windows\System\pzEDxKh.exe
  2⤵
  PID:1708
- C:\Windows\System\TPDpCuy.exe
  C:\Windows\System\TPDpCuy.exe
  2⤵
  PID:304
- C:\Windows\System\kuUeVQU.exe
  C:\Windows\System\kuUeVQU.exe
  2⤵
  PID:1268
- C:\Windows\System\fpKZtUk.exe
  C:\Windows\System\fpKZtUk.exe
  2⤵
  PID:2856
- C:\Windows\System\EfEElDf.exe
  C:\Windows\System\EfEElDf.exe
  2⤵
  PID:1132
- C:\Windows\System\UnGZXRN.exe
  C:\Windows\System\UnGZXRN.exe
  2⤵
  PID:2196
- C:\Windows\System\DcJFlwx.exe
  C:\Windows\System\DcJFlwx.exe
  2⤵
  PID:1536
- C:\Windows\System\xSCrDkT.exe
  C:\Windows\System\xSCrDkT.exe
  2⤵
  PID:1840
- C:\Windows\System\QAXBHfn.exe
  C:\Windows\System\QAXBHfn.exe
  2⤵
  PID:1440
- C:\Windows\System\PAWeLHb.exe
  C:\Windows\System\PAWeLHb.exe
  2⤵
  PID:1076
- C:\Windows\System\DCeyapV.exe
  C:\Windows\System\DCeyapV.exe
  2⤵
  PID:2484
- C:\Windows\System\bdktGPX.exe
  C:\Windows\System\bdktGPX.exe
  2⤵
  PID:1220
- C:\Windows\System\HXQSMdl.exe
  C:\Windows\System\HXQSMdl.exe
  2⤵
  PID:1700
- C:\Windows\System\FrnubuC.exe
  C:\Windows\System\FrnubuC.exe
  2⤵
  PID:600
- C:\Windows\System\IukZQOi.exe
  C:\Windows\System\IukZQOi.exe
  2⤵
  PID:2560
- C:\Windows\System\bMYFONR.exe
  C:\Windows\System\bMYFONR.exe
  2⤵
  PID:2084
- C:\Windows\System\jtOcapX.exe
  C:\Windows\System\jtOcapX.exe
  2⤵
  PID:2684
- C:\Windows\System\aHbPkLs.exe
  C:\Windows\System\aHbPkLs.exe
  2⤵
  PID:2944
- C:\Windows\System\qGLpzFc.exe
  C:\Windows\System\qGLpzFc.exe
  2⤵
  PID:2504
- C:\Windows\System\utJrSMO.exe
  C:\Windows\System\utJrSMO.exe
  2⤵
  PID:860
- C:\Windows\System\NVmVvgj.exe
  C:\Windows\System\NVmVvgj.exe
  2⤵
  PID:3044
- C:\Windows\System\aVNLOxj.exe
  C:\Windows\System\aVNLOxj.exe
  2⤵
  PID:2236
- C:\Windows\System\yclkCLE.exe
  C:\Windows\System\yclkCLE.exe
  2⤵
  PID:2432
- C:\Windows\System\gRdGroj.exe
  C:\Windows\System\gRdGroj.exe
  2⤵
  PID:1800
- C:\Windows\System\sccHFVU.exe
  C:\Windows\System\sccHFVU.exe
  2⤵
  PID:1140
- C:\Windows\System\vgxQZfN.exe
  C:\Windows\System\vgxQZfN.exe
  2⤵
  PID:1064
- C:\Windows\System\fXGCcEM.exe
  C:\Windows\System\fXGCcEM.exe
  2⤵
  PID:1300
- C:\Windows\System\GukBRNS.exe
  C:\Windows\System\GukBRNS.exe
  2⤵
  PID:1072
- C:\Windows\System\gUwwvFh.exe
  C:\Windows\System\gUwwvFh.exe
  2⤵
  PID:640
- C:\Windows\System\kLftGOy.exe
  C:\Windows\System\kLftGOy.exe
  2⤵
  PID:840
- C:\Windows\System\BUSJsft.exe
  C:\Windows\System\BUSJsft.exe
  2⤵
  PID:1036
- C:\Windows\System\tHccbbi.exe
  C:\Windows\System\tHccbbi.exe
  2⤵
  PID:2272
- C:\Windows\System\FiMnJfP.exe
  C:\Windows\System\FiMnJfP.exe
  2⤵
  PID:1744
- C:\Windows\System\xDuAKHb.exe
  C:\Windows\System\xDuAKHb.exe
  2⤵
  PID:1464
- C:\Windows\System\oqRlhcY.exe
  C:\Windows\System\oqRlhcY.exe
  2⤵
  PID:1532
- C:\Windows\System\WbDUPad.exe
  C:\Windows\System\WbDUPad.exe
  2⤵
  PID:2704
- C:\Windows\System\EyavZqx.exe
  C:\Windows\System\EyavZqx.exe
  2⤵
  PID:1228
- C:\Windows\System\vTSQPyM.exe
  C:\Windows\System\vTSQPyM.exe
  2⤵
  PID:2676
- C:\Windows\System\yoMlOLB.exe
  C:\Windows\System\yoMlOLB.exe
  2⤵
  PID:1976
- C:\Windows\System\GDiahIJ.exe
  C:\Windows\System\GDiahIJ.exe
  2⤵
  PID:1648
- C:\Windows\System\WWmQHlC.exe
  C:\Windows\System\WWmQHlC.exe
  2⤵
  PID:2416
- C:\Windows\System\sAdGBML.exe
  C:\Windows\System\sAdGBML.exe
  2⤵
  PID:2936
- C:\Windows\System\rLOCrxJ.exe
  C:\Windows\System\rLOCrxJ.exe
  2⤵
  PID:2788
- C:\Windows\System\hOHXveY.exe
  C:\Windows\System\hOHXveY.exe
  2⤵
  PID:2444
- C:\Windows\System\uvAhAWL.exe
  C:\Windows\System\uvAhAWL.exe
  2⤵
  PID:588
- C:\Windows\System\xQplJen.exe
  C:\Windows\System\xQplJen.exe
  2⤵
  PID:912
- C:\Windows\System\nAyovez.exe
  C:\Windows\System\nAyovez.exe
  2⤵
  PID:2932
- C:\Windows\System\SzwyMPy.exe
  C:\Windows\System\SzwyMPy.exe
  2⤵
  PID:2296
- C:\Windows\System\yqDtvVZ.exe
  C:\Windows\System\yqDtvVZ.exe
  2⤵
  PID:1212
- C:\Windows\System\anspUxW.exe
  C:\Windows\System\anspUxW.exe
  2⤵
  PID:1684
- C:\Windows\System\xRSpqzR.exe
  C:\Windows\System\xRSpqzR.exe
  2⤵
  PID:1244
- C:\Windows\System\YLbHUOb.exe
  C:\Windows\System\YLbHUOb.exe
  2⤵
  PID:2736
- C:\Windows\System\MQYoKbK.exe
  C:\Windows\System\MQYoKbK.exe
  2⤵
  PID:2520
- C:\Windows\System\RVjGfKn.exe
  C:\Windows\System\RVjGfKn.exe
  2⤵
  PID:2568
- C:\Windows\System\UOqzYtR.exe
  C:\Windows\System\UOqzYtR.exe
  2⤵
  PID:2332
- C:\Windows\System\roAyAye.exe
  C:\Windows\System\roAyAye.exe
  2⤵
  PID:2964
- C:\Windows\System\PmgZKgw.exe
  C:\Windows\System\PmgZKgw.exe
  2⤵
  PID:2612
- C:\Windows\System\LXyKrrr.exe
  C:\Windows\System\LXyKrrr.exe
  2⤵
  PID:2424
- C:\Windows\System\UTgZkno.exe
  C:\Windows\System\UTgZkno.exe
  2⤵
  PID:2340
- C:\Windows\System\yFkWyqb.exe
  C:\Windows\System\yFkWyqb.exe
  2⤵
  PID:1564
- C:\Windows\System\RXxnCiA.exe
  C:\Windows\System\RXxnCiA.exe
  2⤵
  PID:1616
- C:\Windows\System\DttRoqH.exe
  C:\Windows\System\DttRoqH.exe
  2⤵
  PID:2712
- C:\Windows\System\prrbgYd.exe
  C:\Windows\System\prrbgYd.exe
  2⤵
  PID:3060
- C:\Windows\System\XUUyeDG.exe
  C:\Windows\System\XUUyeDG.exe
  2⤵
  PID:328
- C:\Windows\System\UGLVsmA.exe
  C:\Windows\System\UGLVsmA.exe
  2⤵
  PID:2992
- C:\Windows\System\QlTYbiD.exe
  C:\Windows\System\QlTYbiD.exe
  2⤵
  PID:2700
- C:\Windows\System\sCxybDF.exe
  C:\Windows\System\sCxybDF.exe
  2⤵
  PID:3088
- C:\Windows\System\loQlrHR.exe
  C:\Windows\System\loQlrHR.exe
  2⤵
  PID:3104
- C:\Windows\System\gsMRJhc.exe
  C:\Windows\System\gsMRJhc.exe
  2⤵
  PID:3120
- C:\Windows\System\HHcBnrm.exe
  C:\Windows\System\HHcBnrm.exe
  2⤵
  PID:3188
- C:\Windows\System\iXpPHSC.exe
  C:\Windows\System\iXpPHSC.exe
  2⤵
  PID:3204
- C:\Windows\System\xbCOZYd.exe
  C:\Windows\System\xbCOZYd.exe
  2⤵
  PID:3220
- C:\Windows\System\RWpFlGQ.exe
  C:\Windows\System\RWpFlGQ.exe
  2⤵
  PID:3244
- C:\Windows\System\HyDnPkI.exe
  C:\Windows\System\HyDnPkI.exe
  2⤵
  PID:3268
- C:\Windows\System\AdVWhnR.exe
  C:\Windows\System\AdVWhnR.exe
  2⤵
  PID:3292
- C:\Windows\System\WBbpeAg.exe
  C:\Windows\System\WBbpeAg.exe
  2⤵
  PID:3308
- C:\Windows\System\BHcrLXU.exe
  C:\Windows\System\BHcrLXU.exe
  2⤵
  PID:3328
- C:\Windows\System\XukUTLS.exe
  C:\Windows\System\XukUTLS.exe
  2⤵
  PID:3348
- C:\Windows\System\HUQhEsL.exe
  C:\Windows\System\HUQhEsL.exe
  2⤵
  PID:3368
- C:\Windows\System\rvCdgEX.exe
  C:\Windows\System\rvCdgEX.exe
  2⤵
  PID:3384
- C:\Windows\System\uqGIvcs.exe
  C:\Windows\System\uqGIvcs.exe
  2⤵
  PID:3408
- C:\Windows\System\CjiHOOK.exe
  C:\Windows\System\CjiHOOK.exe
  2⤵
  PID:3432
- C:\Windows\System\ZcvyxCq.exe
  C:\Windows\System\ZcvyxCq.exe
  2⤵
  PID:3448
- C:\Windows\System\IWDTqRp.exe
  C:\Windows\System\IWDTqRp.exe
  2⤵
  PID:3472
- C:\Windows\System\VLvaJPq.exe
  C:\Windows\System\VLvaJPq.exe
  2⤵
  PID:3488
- C:\Windows\System\zKJXjoy.exe
  C:\Windows\System\zKJXjoy.exe
  2⤵
  PID:3508
- C:\Windows\System\CxGTAYw.exe
  C:\Windows\System\CxGTAYw.exe
  2⤵
  PID:3528
- C:\Windows\System\GUADFrN.exe
  C:\Windows\System\GUADFrN.exe
  2⤵
  PID:3552
- C:\Windows\System\DJPGAYV.exe
  C:\Windows\System\DJPGAYV.exe
  2⤵
  PID:3568
- C:\Windows\System\LmBYUkU.exe
  C:\Windows\System\LmBYUkU.exe
  2⤵
  PID:3592
- C:\Windows\System\FDrzbXH.exe
  C:\Windows\System\FDrzbXH.exe
  2⤵
  PID:3608
- C:\Windows\System\LviRTDc.exe
  C:\Windows\System\LviRTDc.exe
  2⤵
  PID:3632
- C:\Windows\System\zdZiykI.exe
  C:\Windows\System\zdZiykI.exe
  2⤵
  PID:3648
- C:\Windows\System\ukAIARE.exe
  C:\Windows\System\ukAIARE.exe
  2⤵
  PID:3672
- C:\Windows\System\MfyVSOd.exe
  C:\Windows\System\MfyVSOd.exe
  2⤵
  PID:3688
- C:\Windows\System\RHbzYvk.exe
  C:\Windows\System\RHbzYvk.exe
  2⤵
  PID:3712
- C:\Windows\System\asOvMqG.exe
  C:\Windows\System\asOvMqG.exe
  2⤵
  PID:3728
- C:\Windows\System\KEGxojl.exe
  C:\Windows\System\KEGxojl.exe
  2⤵
  PID:3748
- C:\Windows\System\bcINmlF.exe
  C:\Windows\System\bcINmlF.exe
  2⤵
  PID:3768
- C:\Windows\System\VnyHvvk.exe
  C:\Windows\System\VnyHvvk.exe
  2⤵
  PID:3792
- C:\Windows\System\LBZVokx.exe
  C:\Windows\System\LBZVokx.exe
  2⤵
  PID:3808
- C:\Windows\System\hDApboi.exe
  C:\Windows\System\hDApboi.exe
  2⤵
  PID:3832
- C:\Windows\System\HuUQNpf.exe
  C:\Windows\System\HuUQNpf.exe
  2⤵
  PID:3848
- C:\Windows\System\ctuNiYW.exe
  C:\Windows\System\ctuNiYW.exe
  2⤵
  PID:3872
- C:\Windows\System\xpJEbRx.exe
  C:\Windows\System\xpJEbRx.exe
  2⤵
  PID:3888
- C:\Windows\System\RUInMcb.exe
  C:\Windows\System\RUInMcb.exe
  2⤵
  PID:3904
- C:\Windows\System\cKuIjDV.exe
  C:\Windows\System\cKuIjDV.exe
  2⤵
  PID:3920
- C:\Windows\System\jFeQAzt.exe
  C:\Windows\System\jFeQAzt.exe
  2⤵
  PID:3936
- C:\Windows\System\QXhpgUw.exe
  C:\Windows\System\QXhpgUw.exe
  2⤵
  PID:3952
- C:\Windows\System\cxjzPFW.exe
  C:\Windows\System\cxjzPFW.exe
  2⤵
  PID:3968
- C:\Windows\System\zuMDRoC.exe
  C:\Windows\System\zuMDRoC.exe
  2⤵
  PID:3984
- C:\Windows\System\CGzsADF.exe
  C:\Windows\System\CGzsADF.exe
  2⤵
  PID:4032
- C:\Windows\System\QKeGUnU.exe
  C:\Windows\System\QKeGUnU.exe
  2⤵
  PID:4048
- C:\Windows\System\TnQYDBG.exe
  C:\Windows\System\TnQYDBG.exe
  2⤵
  PID:4068
- C:\Windows\System\GkoTnyD.exe
  C:\Windows\System\GkoTnyD.exe
  2⤵
  PID:4084
- C:\Windows\System\ypOzmhE.exe
  C:\Windows\System\ypOzmhE.exe
  2⤵
  PID:2200
- C:\Windows\System\rrzNAJJ.exe
  C:\Windows\System\rrzNAJJ.exe
  2⤵
  PID:2648
- C:\Windows\System\RYbzIUP.exe
  C:\Windows\System\RYbzIUP.exe
  2⤵
  PID:1540
- C:\Windows\System\SmCcOGW.exe
  C:\Windows\System\SmCcOGW.exe
  2⤵
  PID:1548
- C:\Windows\System\LBKjhIE.exe
  C:\Windows\System\LBKjhIE.exe
  2⤵
  PID:2956
- C:\Windows\System\PpNsnEr.exe
  C:\Windows\System\PpNsnEr.exe
  2⤵
  PID:3136
- C:\Windows\System\YPNOVnK.exe
  C:\Windows\System\YPNOVnK.exe
  2⤵
  PID:3144
- C:\Windows\System\CDhwcrR.exe
  C:\Windows\System\CDhwcrR.exe
  2⤵
  PID:3168
- C:\Windows\System\CweuHst.exe
  C:\Windows\System\CweuHst.exe
  2⤵
  PID:3180
- C:\Windows\System\cYwXCBl.exe
  C:\Windows\System\cYwXCBl.exe
  2⤵
  PID:2780
- C:\Windows\System\tuvccnc.exe
  C:\Windows\System\tuvccnc.exe
  2⤵
  PID:2672
- C:\Windows\System\dPVDxVL.exe
  C:\Windows\System\dPVDxVL.exe
  2⤵
  PID:3116
- C:\Windows\System\oTcYVga.exe
  C:\Windows\System\oTcYVga.exe
  2⤵
  PID:3200
- C:\Windows\System\sbpKeBr.exe
  C:\Windows\System\sbpKeBr.exe
  2⤵
  PID:3240
- C:\Windows\System\KOYfGXz.exe
  C:\Windows\System\KOYfGXz.exe
  2⤵
  PID:3264
- C:\Windows\System\JZfGGiO.exe
  C:\Windows\System\JZfGGiO.exe
  2⤵
  PID:3256
- C:\Windows\System\JtheVfG.exe
  C:\Windows\System\JtheVfG.exe
  2⤵
  PID:3316
- C:\Windows\System\lFtbTWX.exe
  C:\Windows\System\lFtbTWX.exe
  2⤵
  PID:3344
- C:\Windows\System\gdtwHoN.exe
  C:\Windows\System\gdtwHoN.exe
  2⤵
  PID:3360
- C:\Windows\System\SXBkiUR.exe
  C:\Windows\System\SXBkiUR.exe
  2⤵
  PID:3392
- C:\Windows\System\yjAKJal.exe
  C:\Windows\System\yjAKJal.exe
  2⤵
  PID:3416
- C:\Windows\System\NeKloAu.exe
  C:\Windows\System\NeKloAu.exe
  2⤵
  PID:1636
- C:\Windows\System\DcMdeHo.exe
  C:\Windows\System\DcMdeHo.exe
  2⤵
  PID:3464
- C:\Windows\System\NkCkWSH.exe
  C:\Windows\System\NkCkWSH.exe
  2⤵
  PID:3484
- C:\Windows\System\DPNrfQJ.exe
  C:\Windows\System\DPNrfQJ.exe
  2⤵
  PID:3516
- C:\Windows\System\nDaOQSH.exe
  C:\Windows\System\nDaOQSH.exe
  2⤵
  PID:3784
- C:\Windows\System\rvFJYIT.exe
  C:\Windows\System\rvFJYIT.exe
  2⤵
  PID:3816
- C:\Windows\System\wSsTtMx.exe
  C:\Windows\System\wSsTtMx.exe
  2⤵
  PID:3820
- C:\Windows\System\eKqgkIQ.exe
  C:\Windows\System\eKqgkIQ.exe
  2⤵
  PID:3844
- C:\Windows\System\TucOJiz.exe
  C:\Windows\System\TucOJiz.exe
  2⤵
  PID:3884
- C:\Windows\System\bfOESnY.exe
  C:\Windows\System\bfOESnY.exe
  2⤵
  PID:3944
- C:\Windows\System\weDTFkM.exe
  C:\Windows\System\weDTFkM.exe
  2⤵
  PID:4008
- C:\Windows\System\XMYqqqk.exe
  C:\Windows\System\XMYqqqk.exe
  2⤵
  PID:3960
- C:\Windows\System\FEJvKsU.exe
  C:\Windows\System\FEJvKsU.exe
  2⤵
  PID:4028
- C:\Windows\System\zsBNAbW.exe
  C:\Windows\System\zsBNAbW.exe
  2⤵
  PID:3336
- C:\Windows\System\fQepOZO.exe
  C:\Windows\System\fQepOZO.exe
  2⤵
  PID:3300
- C:\Windows\System\ZmwIdrS.exe
  C:\Windows\System\ZmwIdrS.exe
  2⤵
  PID:592
- C:\Windows\System\ddmsfWT.exe
  C:\Windows\System\ddmsfWT.exe
  2⤵
  PID:3140
- C:\Windows\System\DQStBPz.exe
  C:\Windows\System\DQStBPz.exe
  2⤵
  PID:3260
- C:\Windows\System\DScMnwd.exe
  C:\Windows\System\DScMnwd.exe
  2⤵
  PID:3400
- C:\Windows\System\nNrPEIz.exe
  C:\Windows\System\nNrPEIz.exe
  2⤵
  PID:3504
- C:\Windows\System\TBEFfBn.exe
  C:\Windows\System\TBEFfBn.exe
  2⤵
  PID:3100
- C:\Windows\System\NDgBrYL.exe
  C:\Windows\System\NDgBrYL.exe
  2⤵
  PID:1288
- C:\Windows\System\ELatNMa.exe
  C:\Windows\System\ELatNMa.exe
  2⤵
  PID:3236
- C:\Windows\System\mLEHURh.exe
  C:\Windows\System\mLEHURh.exe
  2⤵
  PID:4092
- C:\Windows\System\mnYhWFm.exe
  C:\Windows\System\mnYhWFm.exe
  2⤵
  PID:3576
- C:\Windows\System\MxgekZX.exe
  C:\Windows\System\MxgekZX.exe
  2⤵
  PID:3600
- C:\Windows\System\LRBSscV.exe
  C:\Windows\System\LRBSscV.exe
  2⤵
  PID:3628
- C:\Windows\System\aBloDJQ.exe
  C:\Windows\System\aBloDJQ.exe
  2⤵
  PID:3644
- C:\Windows\System\lQZgpPU.exe
  C:\Windows\System\lQZgpPU.exe
  2⤵
  PID:2604
- C:\Windows\System\FMwtPBN.exe
  C:\Windows\System\FMwtPBN.exe
  2⤵
  PID:3460
- C:\Windows\System\XBriATO.exe
  C:\Windows\System\XBriATO.exe
  2⤵
  PID:3544
- C:\Windows\System\TkGJhNG.exe
  C:\Windows\System\TkGJhNG.exe
  2⤵
  PID:3564
- C:\Windows\System\JGoLMJF.exe
  C:\Windows\System\JGoLMJF.exe
  2⤵
  PID:3760
- C:\Windows\System\LEbFZde.exe
  C:\Windows\System\LEbFZde.exe
  2⤵
  PID:3828
- C:\Windows\System\pszcBER.exe
  C:\Windows\System\pszcBER.exe
  2⤵
  PID:3980
- C:\Windows\System\HWwMozE.exe
  C:\Windows\System\HWwMozE.exe
  2⤵
  PID:3856
- C:\Windows\System\jWfqiMU.exe
  C:\Windows\System\jWfqiMU.exe
  2⤵
  PID:3964
- C:\Windows\System\FTxzhYS.exe
  C:\Windows\System\FTxzhYS.exe
  2⤵
  PID:4004
- C:\Windows\System\NhBBgvr.exe
  C:\Windows\System\NhBBgvr.exe
  2⤵
  PID:4080
- C:\Windows\System\lQLmdwU.exe
  C:\Windows\System\lQLmdwU.exe
  2⤵
  PID:4064
- C:\Windows\System\EcZBKAX.exe
  C:\Windows\System\EcZBKAX.exe
  2⤵
  PID:4104
- C:\Windows\System\fjsYMSF.exe
  C:\Windows\System\fjsYMSF.exe
  2⤵
  PID:4124
- C:\Windows\System\DYLQaog.exe
  C:\Windows\System\DYLQaog.exe
  2⤵
  PID:4140
- C:\Windows\System\nMxEwMe.exe
  C:\Windows\System\nMxEwMe.exe
  2⤵
  PID:4156
- C:\Windows\System\xhvSAdP.exe
  C:\Windows\System\xhvSAdP.exe
  2⤵
  PID:4172
- C:\Windows\System\ECbXJfj.exe
  C:\Windows\System\ECbXJfj.exe
  2⤵
  PID:4188
- C:\Windows\System\nDGPAit.exe
  C:\Windows\System\nDGPAit.exe
  2⤵
  PID:4204
- C:\Windows\System\PZQdMYd.exe
  C:\Windows\System\PZQdMYd.exe
  2⤵
  PID:4220
- C:\Windows\System\lZiZfck.exe
  C:\Windows\System\lZiZfck.exe
  2⤵
  PID:4240
- C:\Windows\System\evNjNxA.exe
  C:\Windows\System\evNjNxA.exe
  2⤵
  PID:4256
- C:\Windows\System\MuoLZlc.exe
  C:\Windows\System\MuoLZlc.exe
  2⤵
  PID:4272
- C:\Windows\System\dhiOxtR.exe
  C:\Windows\System\dhiOxtR.exe
  2⤵
  PID:4288
- C:\Windows\System\XIDgQHh.exe
  C:\Windows\System\XIDgQHh.exe
  2⤵
  PID:4304
- C:\Windows\System\eOlVUne.exe
  C:\Windows\System\eOlVUne.exe
  2⤵
  PID:4320
- C:\Windows\System\vEiuutS.exe
  C:\Windows\System\vEiuutS.exe
  2⤵
  PID:4336
- C:\Windows\System\Uzdiuzc.exe
  C:\Windows\System\Uzdiuzc.exe
  2⤵
  PID:4352
- C:\Windows\System\TlKVZbY.exe
  C:\Windows\System\TlKVZbY.exe
  2⤵
  PID:4372
- C:\Windows\System\UaCiyWr.exe
  C:\Windows\System\UaCiyWr.exe
  2⤵
  PID:4420
- C:\Windows\System\bsGvsAy.exe
  C:\Windows\System\bsGvsAy.exe
  2⤵
  PID:4564
- C:\Windows\System\cDGjzux.exe
  C:\Windows\System\cDGjzux.exe
  2⤵
  PID:4592
- C:\Windows\System\dysyoQe.exe
  C:\Windows\System\dysyoQe.exe
  2⤵
  PID:4608
- C:\Windows\System\bllZHiZ.exe
  C:\Windows\System\bllZHiZ.exe
  2⤵
  PID:4628
- C:\Windows\System\NKTHVGA.exe
  C:\Windows\System\NKTHVGA.exe
  2⤵
  PID:4644
- C:\Windows\System\OHHDHmN.exe
  C:\Windows\System\OHHDHmN.exe
  2⤵
  PID:4668
- C:\Windows\System\CDaHDih.exe
  C:\Windows\System\CDaHDih.exe
  2⤵
  PID:4692
- C:\Windows\System\HaivGDa.exe
  C:\Windows\System\HaivGDa.exe
  2⤵
  PID:4708
- C:\Windows\System\XCPpxTM.exe
  C:\Windows\System\XCPpxTM.exe
  2⤵
  PID:4724
- C:\Windows\System\XKDMfMg.exe
  C:\Windows\System\XKDMfMg.exe
  2⤵
  PID:4740
- C:\Windows\System\OiAFfLh.exe
  C:\Windows\System\OiAFfLh.exe
  2⤵
  PID:4756
- C:\Windows\System\xOEFcgR.exe
  C:\Windows\System\xOEFcgR.exe
  2⤵
  PID:4772
- C:\Windows\System\PLDlaJt.exe
  C:\Windows\System\PLDlaJt.exe
  2⤵
  PID:4792
- C:\Windows\System\WwORurF.exe
  C:\Windows\System\WwORurF.exe
  2⤵
  PID:4808
- C:\Windows\System\yeijWXb.exe
  C:\Windows\System\yeijWXb.exe
  2⤵
  PID:4824
- C:\Windows\System\ojzipdR.exe
  C:\Windows\System\ojzipdR.exe
  2⤵
  PID:4840
- C:\Windows\System\zPEufgk.exe
  C:\Windows\System\zPEufgk.exe
  2⤵
  PID:4856
- C:\Windows\System\hggDezd.exe
  C:\Windows\System\hggDezd.exe
  2⤵
  PID:4872
- C:\Windows\System\aIHFdmS.exe
  C:\Windows\System\aIHFdmS.exe
  2⤵
  PID:4924
- C:\Windows\System\MJsBdVf.exe
  C:\Windows\System\MJsBdVf.exe
  2⤵
  PID:4944
- C:\Windows\System\asmGYux.exe
  C:\Windows\System\asmGYux.exe
  2⤵
  PID:4960
- C:\Windows\System\zgylXuH.exe
  C:\Windows\System\zgylXuH.exe
  2⤵
  PID:4976
- C:\Windows\System\MOENlve.exe
  C:\Windows\System\MOENlve.exe
  2⤵
  PID:4996
- C:\Windows\System\PiJqEYV.exe
  C:\Windows\System\PiJqEYV.exe
  2⤵
  PID:5012
- C:\Windows\System\mFzOWye.exe
  C:\Windows\System\mFzOWye.exe
  2⤵
  PID:5028
- C:\Windows\System\pkPrdBH.exe
  C:\Windows\System\pkPrdBH.exe
  2⤵
  PID:5044
- C:\Windows\System\qpMIlDQ.exe
  C:\Windows\System\qpMIlDQ.exe
  2⤵
  PID:5060
- C:\Windows\System\bbDGBiE.exe
  C:\Windows\System\bbDGBiE.exe
  2⤵
  PID:5080
- C:\Windows\System\bJhnvfH.exe
  C:\Windows\System\bJhnvfH.exe
  2⤵
  PID:5096
- C:\Windows\System\PWOQSlC.exe
  C:\Windows\System\PWOQSlC.exe
  2⤵
  PID:5112
- C:\Windows\System\sBQlxoz.exe
  C:\Windows\System\sBQlxoz.exe
  2⤵
  PID:4040
- C:\Windows\System\GpWsulX.exe
  C:\Windows\System\GpWsulX.exe
  2⤵
  PID:3380
- C:\Windows\System\OarvJoU.exe
  C:\Windows\System\OarvJoU.exe
  2⤵
  PID:3664
- C:\Windows\System\OQfsDht.exe
  C:\Windows\System\OQfsDht.exe
  2⤵
  PID:3524
- C:\Windows\System\YDSbwUy.exe
  C:\Windows\System\YDSbwUy.exe
  2⤵
  PID:3976
- C:\Windows\System\POYPvGq.exe
  C:\Windows\System\POYPvGq.exe
  2⤵
  PID:3932
- C:\Windows\System\FixzLQf.exe
  C:\Windows\System\FixzLQf.exe
  2⤵
  PID:4100
- C:\Windows\System\peYuOfW.exe
  C:\Windows\System\peYuOfW.exe
  2⤵
  PID:2292
- C:\Windows\System\IQmchtH.exe
  C:\Windows\System\IQmchtH.exe
  2⤵
  PID:3152
- C:\Windows\System\RHcoVIF.exe
  C:\Windows\System\RHcoVIF.exe
  2⤵
  PID:3992
- C:\Windows\System\DuJkeCY.exe
  C:\Windows\System\DuJkeCY.exe
  2⤵
  PID:4148
- C:\Windows\System\GQpCAnn.exe
  C:\Windows\System\GQpCAnn.exe
  2⤵
  PID:4348
- C:\Windows\System\VZyLjSQ.exe
  C:\Windows\System\VZyLjSQ.exe
  2⤵
  PID:3680
- C:\Windows\System\UmSWQym.exe
  C:\Windows\System\UmSWQym.exe
  2⤵
  PID:3540
- C:\Windows\System\WHmaDJB.exe
  C:\Windows\System\WHmaDJB.exe
  2⤵
  PID:3780
- C:\Windows\System\dyvlgrG.exe
  C:\Windows\System\dyvlgrG.exe
  2⤵
  PID:4180
- C:\Windows\System\SwWAXan.exe
  C:\Windows\System\SwWAXan.exe
  2⤵
  PID:4384
- C:\Windows\System\wCSYwBw.exe
  C:\Windows\System\wCSYwBw.exe
  2⤵
  PID:4388
- C:\Windows\System\cCbvnyI.exe
  C:\Windows\System\cCbvnyI.exe
  2⤵
  PID:4416
- C:\Windows\System\yArVWPK.exe
  C:\Windows\System\yArVWPK.exe
  2⤵
  PID:4444
- C:\Windows\System\wIllJak.exe
  C:\Windows\System\wIllJak.exe
  2⤵
  PID:4456
- C:\Windows\System\FVxhnZV.exe
  C:\Windows\System\FVxhnZV.exe
  2⤵
  PID:4460
- C:\Windows\System\VfRmCvE.exe
  C:\Windows\System\VfRmCvE.exe
  2⤵
  PID:4488
- C:\Windows\System\QJkDupx.exe
  C:\Windows\System\QJkDupx.exe
  2⤵
  PID:4504
- C:\Windows\System\RHdtkcW.exe
  C:\Windows\System\RHdtkcW.exe
  2⤵
  PID:4520
- C:\Windows\System\AOaVfkt.exe
  C:\Windows\System\AOaVfkt.exe
  2⤵
  PID:4540
- C:\Windows\System\jtvgJkr.exe
  C:\Windows\System\jtvgJkr.exe
  2⤵
  PID:4556
- C:\Windows\System\CTCMmam.exe
  C:\Windows\System\CTCMmam.exe
  2⤵
  PID:4576
- C:\Windows\System\jcHpLGk.exe
  C:\Windows\System\jcHpLGk.exe
  2⤵
  PID:4600
- C:\Windows\System\pTFQFjZ.exe
  C:\Windows\System\pTFQFjZ.exe
  2⤵
  PID:4636
- C:\Windows\System\bWeTGRy.exe
  C:\Windows\System\bWeTGRy.exe
  2⤵
  PID:4640
- C:\Windows\System\hGXhFkq.exe
  C:\Windows\System\hGXhFkq.exe
  2⤵
  PID:4700
- C:\Windows\System\wlezzKN.exe
  C:\Windows\System\wlezzKN.exe
  2⤵
  PID:4804
- C:\Windows\System\pqFaCKh.exe
  C:\Windows\System\pqFaCKh.exe
  2⤵
  PID:4800
- C:\Windows\System\wPfFHnF.exe
  C:\Windows\System\wPfFHnF.exe
  2⤵
  PID:4884
- C:\Windows\System\ILNCqIk.exe
  C:\Windows\System\ILNCqIk.exe
  2⤵
  PID:4748
- C:\Windows\System\uWQZOnc.exe
  C:\Windows\System\uWQZOnc.exe
  2⤵
  PID:4904
- C:\Windows\System\NLxtzGG.exe
  C:\Windows\System\NLxtzGG.exe
  2⤵
  PID:4788
- C:\Windows\System\mhRZALx.exe
  C:\Windows\System\mhRZALx.exe
  2⤵
  PID:4988
- C:\Windows\System\XnTgnYE.exe
  C:\Windows\System\XnTgnYE.exe
  2⤵
  PID:5052
- C:\Windows\System\OySDavt.exe
  C:\Windows\System\OySDavt.exe
  2⤵
  PID:1988
- C:\Windows\System\jXKqlpY.exe
  C:\Windows\System\jXKqlpY.exe
  2⤵
  PID:3624
- C:\Windows\System\MUKoiex.exe
  C:\Windows\System\MUKoiex.exe
  2⤵
  PID:3536
- C:\Windows\System\cDHYMEs.exe
  C:\Windows\System\cDHYMEs.exe
  2⤵
  PID:5040
- C:\Windows\System\cNwpoKG.exe
  C:\Windows\System\cNwpoKG.exe
  2⤵
  PID:4232
- C:\Windows\System\irKbQgB.exe
  C:\Windows\System\irKbQgB.exe
  2⤵
  PID:4268
- C:\Windows\System\hpqgflR.exe
  C:\Windows\System\hpqgflR.exe
  2⤵
  PID:4360
- C:\Windows\System\KmTWTHR.exe
  C:\Windows\System\KmTWTHR.exe
  2⤵
  PID:3212
- C:\Windows\System\rFPLUEE.exe
  C:\Windows\System\rFPLUEE.exe
  2⤵
  PID:4024
- C:\Windows\System\AuJAZZR.exe
  C:\Windows\System\AuJAZZR.exe
  2⤵
  PID:4216
- C:\Windows\System\WXjUjSo.exe
  C:\Windows\System\WXjUjSo.exe
  2⤵
  PID:4316
- C:\Windows\System\VRUfbQz.exe
  C:\Windows\System\VRUfbQz.exe
  2⤵
  PID:4368
- C:\Windows\System\LYHAaSm.exe
  C:\Windows\System\LYHAaSm.exe
  2⤵
  PID:4588
- C:\Windows\System\QyqtymB.exe
  C:\Windows\System\QyqtymB.exe
  2⤵
  PID:4516
- C:\Windows\System\oWUuKKR.exe
  C:\Windows\System\oWUuKKR.exe
  2⤵
  PID:4452
- C:\Windows\System\uikEUmn.exe
  C:\Windows\System\uikEUmn.exe
  2⤵
  PID:3668
- C:\Windows\System\ZwBYMtW.exe
  C:\Windows\System\ZwBYMtW.exe
  2⤵
  PID:4396
- C:\Windows\System\HvJEZmp.exe
  C:\Windows\System\HvJEZmp.exe
  2⤵
  PID:4468
- C:\Windows\System\gwPoXnD.exe
  C:\Windows\System\gwPoXnD.exe
  2⤵
  PID:4500
- C:\Windows\System\FinPDWN.exe
  C:\Windows\System\FinPDWN.exe
  2⤵
  PID:3660
- C:\Windows\System\iNxImnN.exe
  C:\Windows\System\iNxImnN.exe
  2⤵
  PID:4664
- C:\Windows\System\rhpprAC.exe
  C:\Windows\System\rhpprAC.exe
  2⤵
  PID:4852
- C:\Windows\System\wIzXaRu.exe
  C:\Windows\System\wIzXaRu.exe
  2⤵
  PID:4704
- C:\Windows\System\rxIFSSN.exe
  C:\Windows\System\rxIFSSN.exe
  2⤵
  PID:4880
- C:\Windows\System\frolMKi.exe
  C:\Windows\System\frolMKi.exe
  2⤵
  PID:5088
- C:\Windows\System\XxqCuiP.exe
  C:\Windows\System\XxqCuiP.exe
  2⤵
  PID:4968
- C:\Windows\System\dTqFsmb.exe
  C:\Windows\System\dTqFsmb.exe
  2⤵
  PID:4892
- C:\Windows\System\npUqDmf.exe
  C:\Windows\System\npUqDmf.exe
  2⤵
  PID:4836
- C:\Windows\System\ftwOFyk.exe
  C:\Windows\System\ftwOFyk.exe
  2⤵
  PID:4916
- C:\Windows\System\EuzYIvX.exe
  C:\Windows\System\EuzYIvX.exe
  2⤵
  PID:4228
- C:\Windows\System\psmeWFY.exe
  C:\Windows\System\psmeWFY.exe
  2⤵
  PID:4252
- C:\Windows\System\cryYRMI.exe
  C:\Windows\System\cryYRMI.exe
  2⤵
  PID:4652
- C:\Windows\System\NYKomYq.exe
  C:\Windows\System\NYKomYq.exe
  2⤵
  PID:5072
- C:\Windows\System\fuirGVC.exe
  C:\Windows\System\fuirGVC.exe
  2⤵
  PID:4956
- C:\Windows\System\UAtpkVO.exe
  C:\Windows\System\UAtpkVO.exe
  2⤵
  PID:4620
- C:\Windows\System\aItrBfM.exe
  C:\Windows\System\aItrBfM.exe
  2⤵
  PID:3824
- C:\Windows\System\MIClFpu.exe
  C:\Windows\System\MIClFpu.exe
  2⤵
  PID:5004
- C:\Windows\System\qLKcykw.exe
  C:\Windows\System\qLKcykw.exe
  2⤵
  PID:4136
- C:\Windows\System\EqGRFDd.exe
  C:\Windows\System\EqGRFDd.exe
  2⤵
  PID:4168
- C:\Windows\System\hcywGgs.exe
  C:\Windows\System\hcywGgs.exe
  2⤵
  PID:5076
- C:\Windows\System\CNuptzh.exe
  C:\Windows\System\CNuptzh.exe
  2⤵
  PID:4768
- C:\Windows\System\FpNMNZd.exe
  C:\Windows\System\FpNMNZd.exe
  2⤵
  PID:3604
- C:\Windows\System\FdMefDH.exe
  C:\Windows\System\FdMefDH.exe
  2⤵
  PID:3588
- C:\Windows\System\zCYgEhy.exe
  C:\Windows\System\zCYgEhy.exe
  2⤵
  PID:4536
- C:\Windows\System\ryjTRcw.exe
  C:\Windows\System\ryjTRcw.exe
  2⤵
  PID:4432
- C:\Windows\System\YpHeAqY.exe
  C:\Windows\System\YpHeAqY.exe
  2⤵
  PID:3324
- C:\Windows\System\asruUrp.exe
  C:\Windows\System\asruUrp.exe
  2⤵
  PID:4284
- C:\Windows\System\QIxpVYQ.exe
  C:\Windows\System\QIxpVYQ.exe
  2⤵
  PID:4184
- C:\Windows\System\ciEriTl.exe
  C:\Windows\System\ciEriTl.exe
  2⤵
  PID:4848
- C:\Windows\System\vllgvZJ.exe
  C:\Windows\System\vllgvZJ.exe
  2⤵
  PID:5132
- C:\Windows\System\yUIEXxl.exe
  C:\Windows\System\yUIEXxl.exe
  2⤵
  PID:5156
- C:\Windows\System\ZoZsYqA.exe
  C:\Windows\System\ZoZsYqA.exe
  2⤵
  PID:5172
- C:\Windows\System\Ccgsprj.exe
  C:\Windows\System\Ccgsprj.exe
  2⤵
  PID:5188
- C:\Windows\System\uhBLBrJ.exe
  C:\Windows\System\uhBLBrJ.exe
  2⤵
  PID:5204
- C:\Windows\System\ZTmnzRY.exe
  C:\Windows\System\ZTmnzRY.exe
  2⤵
  PID:5220
- C:\Windows\System\uRakqqj.exe
  C:\Windows\System\uRakqqj.exe
  2⤵
  PID:5240
- C:\Windows\System\bbJjOEc.exe
  C:\Windows\System\bbJjOEc.exe
  2⤵
  PID:5256
- C:\Windows\System\vOVXLgG.exe
  C:\Windows\System\vOVXLgG.exe
  2⤵
  PID:5272
- C:\Windows\System\JxkvFQj.exe
  C:\Windows\System\JxkvFQj.exe
  2⤵
  PID:5292
- C:\Windows\System\HxksoSF.exe
  C:\Windows\System\HxksoSF.exe
  2⤵
  PID:5308
- C:\Windows\System\nuoBKgF.exe
  C:\Windows\System\nuoBKgF.exe
  2⤵
  PID:5324
- C:\Windows\System\MeDLcbo.exe
  C:\Windows\System\MeDLcbo.exe
  2⤵
  PID:5340
- C:\Windows\System\hORVjoH.exe
  C:\Windows\System\hORVjoH.exe
  2⤵
  PID:5360
- C:\Windows\System\oXgWRLy.exe
  C:\Windows\System\oXgWRLy.exe
  2⤵
  PID:5380
- C:\Windows\System\YrUmVwO.exe
  C:\Windows\System\YrUmVwO.exe
  2⤵
  PID:5396
- C:\Windows\System\bsemtYt.exe
  C:\Windows\System\bsemtYt.exe
  2⤵
  PID:5420
- C:\Windows\System\mKCDWeE.exe
  C:\Windows\System\mKCDWeE.exe
  2⤵
  PID:5440
- C:\Windows\System\EajSEgm.exe
  C:\Windows\System\EajSEgm.exe
  2⤵
  PID:5476
- C:\Windows\System\bDxVoqy.exe
  C:\Windows\System\bDxVoqy.exe
  2⤵
  PID:5492
- C:\Windows\System\MFUAZYV.exe
  C:\Windows\System\MFUAZYV.exe
  2⤵
  PID:5508
- C:\Windows\System\gtfjfcz.exe
  C:\Windows\System\gtfjfcz.exe
  2⤵
  PID:5524
- C:\Windows\System\SMSrSsH.exe
  C:\Windows\System\SMSrSsH.exe
  2⤵
  PID:5540
- C:\Windows\System\rVbduhK.exe
  C:\Windows\System\rVbduhK.exe
  2⤵
  PID:5556
- C:\Windows\System\BUNbMyw.exe
  C:\Windows\System\BUNbMyw.exe
  2⤵
  PID:5664
- C:\Windows\System\CczgOdz.exe
  C:\Windows\System\CczgOdz.exe
  2⤵
  PID:5700
- C:\Windows\System\YQahTUS.exe
  C:\Windows\System\YQahTUS.exe
  2⤵
  PID:5716
- C:\Windows\System\gMYrZMC.exe
  C:\Windows\System\gMYrZMC.exe
  2⤵
  PID:5732
- C:\Windows\System\uSnrIgJ.exe
  C:\Windows\System\uSnrIgJ.exe
  2⤵
  PID:5748
- C:\Windows\System\bGVgkKW.exe
  C:\Windows\System\bGVgkKW.exe
  2⤵
  PID:5764
- C:\Windows\System\IbQPvbu.exe
  C:\Windows\System\IbQPvbu.exe
  2⤵
  PID:5780
- C:\Windows\System\FYhmUSE.exe
  C:\Windows\System\FYhmUSE.exe
  2⤵
  PID:5796
- C:\Windows\System\bwKjUSZ.exe
  C:\Windows\System\bwKjUSZ.exe
  2⤵
  PID:5812
- C:\Windows\System\LHwMeMq.exe
  C:\Windows\System\LHwMeMq.exe
  2⤵
  PID:5828
- C:\Windows\System\XpFJRuf.exe
  C:\Windows\System\XpFJRuf.exe
  2⤵
  PID:5844
- C:\Windows\System\xJfYVVt.exe
  C:\Windows\System\xJfYVVt.exe
  2⤵
  PID:5860
- C:\Windows\System\ZYiiaRF.exe
  C:\Windows\System\ZYiiaRF.exe
  2⤵
  PID:5876
- C:\Windows\System\PhACRiy.exe
  C:\Windows\System\PhACRiy.exe
  2⤵
  PID:5892
- C:\Windows\System\AgAfIhk.exe
  C:\Windows\System\AgAfIhk.exe
  2⤵
  PID:5908
- C:\Windows\System\FoTPPnd.exe
  C:\Windows\System\FoTPPnd.exe
  2⤵
  PID:5924
- C:\Windows\System\VdXxURi.exe
  C:\Windows\System\VdXxURi.exe
  2⤵
  PID:5940
- C:\Windows\System\QDizxuk.exe
  C:\Windows\System\QDizxuk.exe
  2⤵
  PID:5956
- C:\Windows\System\TDcrEej.exe
  C:\Windows\System\TDcrEej.exe
  2⤵
  PID:5972
- C:\Windows\System\auwzteM.exe
  C:\Windows\System\auwzteM.exe
  2⤵
  PID:5988
- C:\Windows\System\mYtQEHe.exe
  C:\Windows\System\mYtQEHe.exe
  2⤵
  PID:6012
- C:\Windows\System\LgSLFyS.exe
  C:\Windows\System\LgSLFyS.exe
  2⤵
  PID:6040
- C:\Windows\System\aJeeKiS.exe
  C:\Windows\System\aJeeKiS.exe
  2⤵
  PID:6056
- C:\Windows\System\AdPSvLF.exe
  C:\Windows\System\AdPSvLF.exe
  2⤵
  PID:6072
- C:\Windows\System\ipKPabL.exe
  C:\Windows\System\ipKPabL.exe
  2⤵
  PID:6088
- C:\Windows\System\CWtKcqv.exe
  C:\Windows\System\CWtKcqv.exe
  2⤵
  PID:6104
- C:\Windows\System\pphSOeC.exe
  C:\Windows\System\pphSOeC.exe
  2⤵
  PID:6124
- C:\Windows\System\GjvoBek.exe
  C:\Windows\System\GjvoBek.exe
  2⤵
  PID:6140
- C:\Windows\System\ditsZpg.exe
  C:\Windows\System\ditsZpg.exe
  2⤵
  PID:4020
- C:\Windows\System\RmRTtwB.exe
  C:\Windows\System\RmRTtwB.exe
  2⤵
  PID:4528
- C:\Windows\System\xChMOjM.exe
  C:\Windows\System\xChMOjM.exe
  2⤵
  PID:2044
- C:\Windows\System\FMycHLk.exe
  C:\Windows\System\FMycHLk.exe
  2⤵
  PID:4972
- C:\Windows\System\ePZZBUa.exe
  C:\Windows\System\ePZZBUa.exe
  2⤵
  PID:4716
- C:\Windows\System\rPyOoRq.exe
  C:\Windows\System\rPyOoRq.exe
  2⤵
  PID:2312
- C:\Windows\System\ierODPo.exe
  C:\Windows\System\ierODPo.exe
  2⤵
  PID:5264
- C:\Windows\System\qnHXHRs.exe
  C:\Windows\System\qnHXHRs.exe
  2⤵
  PID:5196
- C:\Windows\System\ZkQdhHE.exe
  C:\Windows\System\ZkQdhHE.exe
  2⤵
  PID:5236
- C:\Windows\System\YGMGiSK.exe
  C:\Windows\System\YGMGiSK.exe
  2⤵
  PID:4364
- C:\Windows\System\NDTsXQX.exe
  C:\Windows\System\NDTsXQX.exe
  2⤵
  PID:5304
- C:\Windows\System\EPqQnKJ.exe
  C:\Windows\System\EPqQnKJ.exe
  2⤵
  PID:4680
- C:\Windows\System\ZoYjJQJ.exe
  C:\Windows\System\ZoYjJQJ.exe
  2⤵
  PID:5144
- C:\Windows\System\UqherYS.exe
  C:\Windows\System\UqherYS.exe
  2⤵
  PID:5184
- C:\Windows\System\ndvPmab.exe
  C:\Windows\System\ndvPmab.exe
  2⤵
  PID:5280
- C:\Windows\System\CfPCFBg.exe
  C:\Windows\System\CfPCFBg.exe
  2⤵
  PID:5320
- C:\Windows\System\dJwkeOb.exe
  C:\Windows\System\dJwkeOb.exe
  2⤵
  PID:5352
- C:\Windows\System\dFJNoge.exe
  C:\Windows\System\dFJNoge.exe
  2⤵
  PID:5372
- C:\Windows\System\PXXkxSL.exe
  C:\Windows\System\PXXkxSL.exe
  2⤵
  PID:5416
- C:\Windows\System\sCASZtU.exe
  C:\Windows\System\sCASZtU.exe
  2⤵
  PID:5448
- C:\Windows\System\FpfASsP.exe
  C:\Windows\System\FpfASsP.exe
  2⤵
  PID:5484
- C:\Windows\System\HrHyFvk.exe
  C:\Windows\System\HrHyFvk.exe
  2⤵
  PID:5520
- C:\Windows\System\kApwzcv.exe
  C:\Windows\System\kApwzcv.exe
  2⤵
  PID:5536
- C:\Windows\System\AGyiZrB.exe
  C:\Windows\System\AGyiZrB.exe
  2⤵
  PID:5500
- C:\Windows\System\yWUcMLo.exe
  C:\Windows\System\yWUcMLo.exe
  2⤵
  PID:5576
- C:\Windows\System\OphQrIS.exe
  C:\Windows\System\OphQrIS.exe
  2⤵
  PID:5588
- C:\Windows\System\YajAZEA.exe
  C:\Windows\System\YajAZEA.exe
  2⤵
  PID:5612
- C:\Windows\System\sROocJA.exe
  C:\Windows\System\sROocJA.exe
  2⤵
  PID:5632
- C:\Windows\System\DJYaQVe.exe
  C:\Windows\System\DJYaQVe.exe
  2⤵
  PID:5648
- C:\Windows\System\kvfjPkn.exe
  C:\Windows\System\kvfjPkn.exe
  2⤵
  PID:5672
- C:\Windows\System\meOHJfQ.exe
  C:\Windows\System\meOHJfQ.exe
  2⤵
  PID:5692
- C:\Windows\System\uCOiVzl.exe
  C:\Windows\System\uCOiVzl.exe
  2⤵
  PID:5728
- C:\Windows\System\ZgggKrD.exe
  C:\Windows\System\ZgggKrD.exe
  2⤵
  PID:5756
- C:\Windows\System\eWTcxXy.exe
  C:\Windows\System\eWTcxXy.exe
  2⤵
  PID:5824
- C:\Windows\System\OFqyaPx.exe
  C:\Windows\System\OFqyaPx.exe
  2⤵
  PID:5804
- C:\Windows\System\onvSYRB.exe
  C:\Windows\System\onvSYRB.exe
  2⤵
  PID:5916
- C:\Windows\System\iLSvdhf.exe
  C:\Windows\System\iLSvdhf.exe
  2⤵
  PID:5904
- C:\Windows\System\ZHXIiKY.exe
  C:\Windows\System\ZHXIiKY.exe
  2⤵
  PID:5900
- C:\Windows\System\YxkeMgz.exe
  C:\Windows\System\YxkeMgz.exe
  2⤵
  PID:5968
- C:\Windows\System\ZEPHWTJ.exe
  C:\Windows\System\ZEPHWTJ.exe
  2⤵
  PID:6020
- C:\Windows\System\GrYsZJK.exe
  C:\Windows\System\GrYsZJK.exe
  2⤵
  PID:6028
- C:\Windows\System\tXWAaxd.exe
  C:\Windows\System\tXWAaxd.exe
  2⤵
  PID:6068
- C:\Windows\System\fYMWrSU.exe
  C:\Windows\System\fYMWrSU.exe
  2⤵
  PID:6100
- C:\Windows\System\yOZyrKf.exe
  C:\Windows\System\yOZyrKf.exe
  2⤵
  PID:3580
- C:\Windows\System\YtkaaLM.exe
  C:\Windows\System\YtkaaLM.exe
  2⤵
  PID:2280
- C:\Windows\System\KZrrzYB.exe
  C:\Windows\System\KZrrzYB.exe
  2⤵
  PID:4236
- C:\Windows\System\YVvtPyP.exe
  C:\Windows\System\YVvtPyP.exe
  2⤵
  PID:6052
- C:\Windows\System\dkCiGkM.exe
  C:\Windows\System\dkCiGkM.exe
  2⤵
  PID:5020
- C:\Windows\System\NdfjlXV.exe
  C:\Windows\System\NdfjlXV.exe
  2⤵
  PID:5548
- C:\Windows\System\pIMwJHs.exe
  C:\Windows\System\pIMwJHs.exe
  2⤵
  PID:6112
- C:\Windows\System\qaVJZiV.exe
  C:\Windows\System\qaVJZiV.exe
  2⤵
  PID:6048
- C:\Windows\System\GSVnWRK.exe
  C:\Windows\System\GSVnWRK.exe
  2⤵
  PID:6116
- C:\Windows\System\EYRNsts.exe
  C:\Windows\System\EYRNsts.exe
  2⤵
  PID:5008
- C:\Windows\System\gXbGwTJ.exe
  C:\Windows\System\gXbGwTJ.exe
  2⤵
  PID:5228
- C:\Windows\System\lUbzoJH.exe
  C:\Windows\System\lUbzoJH.exe
  2⤵
  PID:4820
- C:\Windows\System\RsAsasA.exe
  C:\Windows\System\RsAsasA.exe
  2⤵
  PID:5252
- C:\Windows\System\vkGewbG.exe
  C:\Windows\System\vkGewbG.exe
  2⤵
  PID:5456
- C:\Windows\System\HCucsuq.exe
  C:\Windows\System\HCucsuq.exe
  2⤵
  PID:5596
- C:\Windows\System\NpfxZZj.exe
  C:\Windows\System\NpfxZZj.exe
  2⤵
  PID:5624
- C:\Windows\System\pQqnlyq.exe
  C:\Windows\System\pQqnlyq.exe
  2⤵
  PID:5644
- C:\Windows\System\QQSUQXC.exe
  C:\Windows\System\QQSUQXC.exe
  2⤵
  PID:5740
- C:\Windows\System\srngPVg.exe
  C:\Windows\System\srngPVg.exe
  2⤵
  PID:5776
- C:\Windows\System\uUXRDpZ.exe
  C:\Windows\System\uUXRDpZ.exe
  2⤵
  PID:5840
- C:\Windows\System\RZeroVp.exe
  C:\Windows\System\RZeroVp.exe
  2⤵
  PID:5984
- C:\Windows\System\jLXXISI.exe
  C:\Windows\System\jLXXISI.exe
  2⤵
  PID:5884
- C:\Windows\System\MEvrUZG.exe
  C:\Windows\System\MEvrUZG.exe
  2⤵
  PID:5932
- C:\Windows\System\VHZUkvH.exe
  C:\Windows\System\VHZUkvH.exe
  2⤵
  PID:5348
- C:\Windows\System\FlFihon.exe
  C:\Windows\System\FlFihon.exe
  2⤵
  PID:6080
- C:\Windows\System\DSqjzAS.exe
  C:\Windows\System\DSqjzAS.exe
  2⤵
  PID:3916
- C:\Windows\System\ZlKGIxD.exe
  C:\Windows\System\ZlKGIxD.exe
  2⤵
  PID:5564
- C:\Windows\System\UIDqSVT.exe
  C:\Windows\System\UIDqSVT.exe
  2⤵
  PID:5724
- C:\Windows\System\hxwLMPq.exe
  C:\Windows\System\hxwLMPq.exe
  2⤵
  PID:6148
- C:\Windows\System\QIvzfot.exe
  C:\Windows\System\QIvzfot.exe
  2⤵
  PID:6172
- C:\Windows\System\dagkRKx.exe
  C:\Windows\System\dagkRKx.exe
  2⤵
  PID:6188
- C:\Windows\System\KeGorOE.exe
  C:\Windows\System\KeGorOE.exe
  2⤵
  PID:6204
- C:\Windows\System\ndrEgMS.exe
  C:\Windows\System\ndrEgMS.exe
  2⤵
  PID:6224
- C:\Windows\System\jexuiQH.exe
  C:\Windows\System\jexuiQH.exe
  2⤵
  PID:6244
- C:\Windows\System\bcEoxwa.exe
  C:\Windows\System\bcEoxwa.exe
  2⤵
  PID:6260
- C:\Windows\System\CJYVfGv.exe
  C:\Windows\System\CJYVfGv.exe
  2⤵
  PID:6276
- C:\Windows\System\umPSAZt.exe
  C:\Windows\System\umPSAZt.exe
  2⤵
  PID:6292
- C:\Windows\System\aHSbnhJ.exe
  C:\Windows\System\aHSbnhJ.exe
  2⤵
  PID:6316
- C:\Windows\System\PQTyWHS.exe
  C:\Windows\System\PQTyWHS.exe
  2⤵
  PID:6332
- C:\Windows\System\EpMdrHa.exe
  C:\Windows\System\EpMdrHa.exe
  2⤵
  PID:6348
- C:\Windows\System\fTxcoux.exe
  C:\Windows\System\fTxcoux.exe
  2⤵
  PID:6364
- C:\Windows\System\gQJKrlW.exe
  C:\Windows\System\gQJKrlW.exe
  2⤵
  PID:6380
- C:\Windows\System\QFKJznQ.exe
  C:\Windows\System\QFKJznQ.exe
  2⤵
  PID:6396
- C:\Windows\System\WhCLJGS.exe
  C:\Windows\System\WhCLJGS.exe
  2⤵
  PID:6412
- C:\Windows\System\FVdXGAo.exe
  C:\Windows\System\FVdXGAo.exe
  2⤵
  PID:6428
- C:\Windows\System\KBVUdTg.exe
  C:\Windows\System\KBVUdTg.exe
  2⤵
  PID:6444
- C:\Windows\System\qSIeOAC.exe
  C:\Windows\System\qSIeOAC.exe
  2⤵
  PID:6460
- C:\Windows\System\lwOTTio.exe
  C:\Windows\System\lwOTTio.exe
  2⤵
  PID:6476
- C:\Windows\System\ypKswdQ.exe
  C:\Windows\System\ypKswdQ.exe
  2⤵
  PID:6492
- C:\Windows\System\glDPZgN.exe
  C:\Windows\System\glDPZgN.exe
  2⤵
  PID:6508
- C:\Windows\System\qsNfDMB.exe
  C:\Windows\System\qsNfDMB.exe
  2⤵
  PID:6524
- C:\Windows\System\ukEPylI.exe
  C:\Windows\System\ukEPylI.exe
  2⤵
  PID:6540
- C:\Windows\System\FYhEJvH.exe
  C:\Windows\System\FYhEJvH.exe
  2⤵
  PID:6556
- C:\Windows\System\XRomvKm.exe
  C:\Windows\System\XRomvKm.exe
  2⤵
  PID:6572
- C:\Windows\System\ixzwyqi.exe
  C:\Windows\System\ixzwyqi.exe
  2⤵
  PID:6588
- C:\Windows\System\WOjgFkW.exe
  C:\Windows\System\WOjgFkW.exe
  2⤵
  PID:6604
- C:\Windows\System\MuJlaeq.exe
  C:\Windows\System\MuJlaeq.exe
  2⤵
  PID:6620
- C:\Windows\System\QQvTsiM.exe
  C:\Windows\System\QQvTsiM.exe
  2⤵
  PID:6636
- C:\Windows\System\tntUVht.exe
  C:\Windows\System\tntUVht.exe
  2⤵
  PID:6652
- C:\Windows\System\aTUltjE.exe
  C:\Windows\System\aTUltjE.exe
  2⤵
  PID:6668
- C:\Windows\System\CHWvpwP.exe
  C:\Windows\System\CHWvpwP.exe
  2⤵
  PID:6684
- C:\Windows\System\ZubbbBP.exe
  C:\Windows\System\ZubbbBP.exe
  2⤵
  PID:6700
- C:\Windows\System\lKmYZoo.exe
  C:\Windows\System\lKmYZoo.exe
  2⤵
  PID:6716
- C:\Windows\System\SVaLWXx.exe
  C:\Windows\System\SVaLWXx.exe
  2⤵
  PID:6732
- C:\Windows\System\uRPZyPq.exe
  C:\Windows\System\uRPZyPq.exe
  2⤵
  PID:6748
- C:\Windows\System\IFfGtXG.exe
  C:\Windows\System\IFfGtXG.exe
  2⤵
  PID:6764
- C:\Windows\System\prKECwO.exe
  C:\Windows\System\prKECwO.exe
  2⤵
  PID:6780
- C:\Windows\System\msgcMaI.exe
  C:\Windows\System\msgcMaI.exe
  2⤵
  PID:6796
- C:\Windows\System\VTKbBtq.exe
  C:\Windows\System\VTKbBtq.exe
  2⤵
  PID:6812
- C:\Windows\System\TUKVoru.exe
  C:\Windows\System\TUKVoru.exe
  2⤵
  PID:6828
- C:\Windows\System\sJwtoAC.exe
  C:\Windows\System\sJwtoAC.exe
  2⤵
  PID:6844
- C:\Windows\System\ToIknkS.exe
  C:\Windows\System\ToIknkS.exe
  2⤵
  PID:6860
- C:\Windows\System\wKOWZuv.exe
  C:\Windows\System\wKOWZuv.exe
  2⤵
  PID:6876
- C:\Windows\System\SjElPjS.exe
  C:\Windows\System\SjElPjS.exe
  2⤵
  PID:6892
- C:\Windows\System\AalWxaZ.exe
  C:\Windows\System\AalWxaZ.exe
  2⤵
  PID:6908
- C:\Windows\System\tFaRRht.exe
  C:\Windows\System\tFaRRht.exe
  2⤵
  PID:6924
- C:\Windows\System\IJeVODb.exe
  C:\Windows\System\IJeVODb.exe
  2⤵
  PID:6940
- C:\Windows\System\qRmLliD.exe
  C:\Windows\System\qRmLliD.exe
  2⤵
  PID:6956
- C:\Windows\System\CxoboqD.exe
  C:\Windows\System\CxoboqD.exe
  2⤵
  PID:6972
- C:\Windows\System\UCFkPCj.exe
  C:\Windows\System\UCFkPCj.exe
  2⤵
  PID:6988
- C:\Windows\System\kRsbSkY.exe
  C:\Windows\System\kRsbSkY.exe
  2⤵
  PID:7004
- C:\Windows\System\GebxAVF.exe
  C:\Windows\System\GebxAVF.exe
  2⤵
  PID:7020
- C:\Windows\System\qzNPIhX.exe
  C:\Windows\System\qzNPIhX.exe
  2⤵
  PID:7036
- C:\Windows\System\xdhFcvp.exe
  C:\Windows\System\xdhFcvp.exe
  2⤵
  PID:7052
- C:\Windows\System\sehzNJN.exe
  C:\Windows\System\sehzNJN.exe
  2⤵
  PID:7072
- C:\Windows\System\XNMcvDl.exe
  C:\Windows\System\XNMcvDl.exe
  2⤵
  PID:7088
- C:\Windows\System\ZMYebyp.exe
  C:\Windows\System\ZMYebyp.exe
  2⤵
  PID:7108
- C:\Windows\System\tPKKXYy.exe
  C:\Windows\System\tPKKXYy.exe
  2⤵
  PID:7124
- C:\Windows\System\cHDDDXg.exe
  C:\Windows\System\cHDDDXg.exe
  2⤵
  PID:7140
- C:\Windows\System\YjNKzpR.exe
  C:\Windows\System\YjNKzpR.exe
  2⤵
  PID:7156
- C:\Windows\System\mGyLxKE.exe
  C:\Windows\System\mGyLxKE.exe
  2⤵
  PID:5568
- C:\Windows\System\bDVdQCP.exe
  C:\Windows\System\bDVdQCP.exe
  2⤵
  PID:5872
- C:\Windows\System\IWKcGjU.exe
  C:\Windows\System\IWKcGjU.exe
  2⤵
  PID:6216
- C:\Windows\System\lterZEH.exe
  C:\Windows\System\lterZEH.exe
  2⤵
  PID:6256
- C:\Windows\System\sATMfEt.exe
  C:\Windows\System\sATMfEt.exe
  2⤵
  PID:5964
- C:\Windows\System\XVLVtyl.exe
  C:\Windows\System\XVLVtyl.exe
  2⤵
  PID:6004
- C:\Windows\System\QhzyWOk.exe
  C:\Windows\System\QhzyWOk.exe
  2⤵
  PID:4936
- C:\Windows\System\ScLTMSF.exe
  C:\Windows\System\ScLTMSF.exe
  2⤵
  PID:5336
- C:\Windows\System\GpEXpCh.exe
  C:\Windows\System\GpEXpCh.exe
  2⤵
  PID:5268
- C:\Windows\System\DWFWOyc.exe
  C:\Windows\System\DWFWOyc.exe
  2⤵
  PID:5608
- C:\Windows\System\CBMiEvI.exe
  C:\Windows\System\CBMiEvI.exe
  2⤵
  PID:5128
- C:\Windows\System\RXbZAcx.exe
  C:\Windows\System\RXbZAcx.exe
  2⤵
  PID:6164
- C:\Windows\System\MxjiPKH.exe
  C:\Windows\System\MxjiPKH.exe
  2⤵
  PID:6232
- C:\Windows\System\FrXKSGh.exe
  C:\Windows\System\FrXKSGh.exe
  2⤵
  PID:6272
- C:\Windows\System\YemlsHj.exe
  C:\Windows\System\YemlsHj.exe
  2⤵
  PID:6308
- C:\Windows\System\undFXwJ.exe
  C:\Windows\System\undFXwJ.exe
  2⤵
  PID:6420
- C:\Windows\System\KGbJgwX.exe
  C:\Windows\System\KGbJgwX.exe
  2⤵
  PID:6324
- C:\Windows\System\XcaQALn.exe
  C:\Windows\System\XcaQALn.exe
  2⤵
  PID:6488
- C:\Windows\System\WQqVUGj.exe
  C:\Windows\System\WQqVUGj.exe
  2⤵
  PID:6404
- C:\Windows\System\PZJeemG.exe
  C:\Windows\System\PZJeemG.exe
  2⤵
  PID:6468
- C:\Windows\System\XQKeKsL.exe
  C:\Windows\System\XQKeKsL.exe
  2⤵
  PID:6520
- C:\Windows\System\OjvHYqn.exe
  C:\Windows\System\OjvHYqn.exe
  2⤵
  PID:6612
- C:\Windows\System\njSLHhQ.exe
  C:\Windows\System\njSLHhQ.exe
  2⤵
  PID:6644
- C:\Windows\System\QZvZUgj.exe
  C:\Windows\System\QZvZUgj.exe
  2⤵
  PID:6712
- C:\Windows\System\QIccVRG.exe
  C:\Windows\System\QIccVRG.exe
  2⤵
  PID:6776
- C:\Windows\System\MjdFPkA.exe
  C:\Windows\System\MjdFPkA.exe
  2⤵
  PID:6840
- C:\Windows\System\AlFyfUZ.exe
  C:\Windows\System\AlFyfUZ.exe
  2⤵
  PID:6900
- C:\Windows\System\UonPche.exe
  C:\Windows\System\UonPche.exe
  2⤵
  PID:6968
- C:\Windows\System\wqOCbFr.exe
  C:\Windows\System\wqOCbFr.exe
  2⤵
  PID:7028
- C:\Windows\System\DLdcaHG.exe
  C:\Windows\System\DLdcaHG.exe
  2⤵
  PID:7044
- C:\Windows\System\mbmTdZj.exe
  C:\Windows\System\mbmTdZj.exe
  2⤵
  PID:6920
- C:\Windows\System\tWWolQF.exe
  C:\Windows\System\tWWolQF.exe
  2⤵
  PID:7084
- C:\Windows\System\xahpmxy.exe
  C:\Windows\System\xahpmxy.exe
  2⤵
  PID:6184
- C:\Windows\System\HXIoBeq.exe
  C:\Windows\System\HXIoBeq.exe
  2⤵
  PID:5216
- C:\Windows\System\PhvgKGs.exe
  C:\Windows\System\PhvgKGs.exe
  2⤵
  PID:5232
- C:\Windows\System\tuihUKO.exe
  C:\Windows\System\tuihUKO.exe
  2⤵
  PID:5104
- C:\Windows\System\ffluDvd.exe
  C:\Windows\System\ffluDvd.exe
  2⤵
  PID:5412
- C:\Windows\System\lBNvbZF.exe
  C:\Windows\System\lBNvbZF.exe
  2⤵
  PID:5660
- C:\Windows\System\YiZruDj.exe
  C:\Windows\System\YiZruDj.exe
  2⤵
  PID:5680
- C:\Windows\System\VgzHrvj.exe
  C:\Windows\System\VgzHrvj.exe
  2⤵
  PID:5288
- C:\Windows\System\wYulTTz.exe
  C:\Windows\System\wYulTTz.exe
  2⤵
  PID:6304
- C:\Windows\System\fAwKHFx.exe
  C:\Windows\System\fAwKHFx.exe
  2⤵
  PID:6372
- C:\Windows\System\RNfWTbD.exe
  C:\Windows\System\RNfWTbD.exe
  2⤵
  PID:6580
- C:\Windows\System\MYBLzAQ.exe
  C:\Windows\System\MYBLzAQ.exe
  2⤵
  PID:6872
- C:\Windows\System\WfCozQx.exe
  C:\Windows\System\WfCozQx.exe
  2⤵
  PID:7032
- C:\Windows\System\MdrYkgW.exe
  C:\Windows\System\MdrYkgW.exe
  2⤵
  PID:6268
- C:\Windows\System\InOUQKC.exe
  C:\Windows\System\InOUQKC.exe
  2⤵
  PID:6160
- C:\Windows\System\MtYuLvC.exe
  C:\Windows\System\MtYuLvC.exe
  2⤵
  PID:6584
- C:\Windows\System\QxIPMOg.exe
  C:\Windows\System\QxIPMOg.exe
  2⤵
  PID:6836
- C:\Windows\System\fxnmGkg.exe
  C:\Windows\System\fxnmGkg.exe
  2⤵
  PID:7016
- C:\Windows\System\zRJbQwI.exe
  C:\Windows\System\zRJbQwI.exe
  2⤵
  PID:6632
- C:\Windows\System\rEpbWGV.exe
  C:\Windows\System\rEpbWGV.exe
  2⤵
  PID:6696
- C:\Windows\System\yqCgEmc.exe
  C:\Windows\System\yqCgEmc.exe
  2⤵
  PID:6756
- C:\Windows\System\HmEoulu.exe
  C:\Windows\System\HmEoulu.exe
  2⤵
  PID:6820
- C:\Windows\System\yLpdwCr.exe
  C:\Windows\System\yLpdwCr.exe
  2⤵
  PID:6884
- C:\Windows\System\VnWnOsn.exe
  C:\Windows\System\VnWnOsn.exe
  2⤵
  PID:7096
- C:\Windows\System\cXtufjG.exe
  C:\Windows\System\cXtufjG.exe
  2⤵
  PID:7104
- C:\Windows\System\ebFRlyi.exe
  C:\Windows\System\ebFRlyi.exe
  2⤵
  PID:4312
- C:\Windows\System\nEGgITA.exe
  C:\Windows\System\nEGgITA.exe
  2⤵
  PID:7152
- C:\Windows\System\ZopFibg.exe
  C:\Windows\System\ZopFibg.exe
  2⤵
  PID:6252
- C:\Windows\System\MmQcOCp.exe
  C:\Windows\System\MmQcOCp.exe
  2⤵
  PID:5856
- C:\Windows\System\isZruwv.exe
  C:\Windows\System\isZruwv.exe
  2⤵
  PID:7132
- C:\Windows\System\BHACSXa.exe
  C:\Windows\System\BHACSXa.exe
  2⤵
  PID:5744
- C:\Windows\System\OFYJVoz.exe
  C:\Windows\System\OFYJVoz.exe
  2⤵
  PID:5408
- C:\Windows\System\srkwpxb.exe
  C:\Windows\System\srkwpxb.exe
  2⤵
  PID:5068
- C:\Windows\System\JQSCrPI.exe
  C:\Windows\System\JQSCrPI.exe
  2⤵
  PID:6552
- C:\Windows\System\ruZtOUo.exe
  C:\Windows\System\ruZtOUo.exe
  2⤵
  PID:6596
- C:\Windows\System\hENjqUP.exe
  C:\Windows\System\hENjqUP.exe
  2⤵
  PID:6852
- C:\Windows\System\BjKouna.exe
  C:\Windows\System\BjKouna.exe
  2⤵
  PID:5552
- C:\Windows\System\MzouFLx.exe
  C:\Windows\System\MzouFLx.exe
  2⤵
  PID:5432
- C:\Windows\System\KjSLXQQ.exe
  C:\Windows\System\KjSLXQQ.exe
  2⤵
  PID:6980
- C:\Windows\System\IapwpGy.exe
  C:\Windows\System\IapwpGy.exe
  2⤵
  PID:6484
- C:\Windows\System\pidqEhQ.exe
  C:\Windows\System\pidqEhQ.exe
  2⤵
  PID:6664
- C:\Windows\System\DJopgpn.exe
  C:\Windows\System\DJopgpn.exe
  2⤵
  PID:7048
- C:\Windows\System\WLNbuaj.exe
  C:\Windows\System\WLNbuaj.exe
  2⤵
  PID:7060
- C:\Windows\System\jwLepyG.exe
  C:\Windows\System\jwLepyG.exe
  2⤵
  PID:6708
- C:\Windows\System\acTFwsB.exe
  C:\Windows\System\acTFwsB.exe
  2⤵
  PID:7068
- C:\Windows\System\PofsUnK.exe
  C:\Windows\System\PofsUnK.exe
  2⤵
  PID:6200
- C:\Windows\System\cqyATTf.exe
  C:\Windows\System\cqyATTf.exe
  2⤵
  PID:7000
- C:\Windows\System\YtBkRJn.exe
  C:\Windows\System\YtBkRJn.exe
  2⤵
  PID:7176
- C:\Windows\System\MDJWCca.exe
  C:\Windows\System\MDJWCca.exe
  2⤵
  PID:7192
- C:\Windows\System\TkJpTzg.exe
  C:\Windows\System\TkJpTzg.exe
  2⤵
  PID:7208
- C:\Windows\System\gWDcJFI.exe
  C:\Windows\System\gWDcJFI.exe
  2⤵
  PID:7224
- C:\Windows\System\ruwbahk.exe
  C:\Windows\System\ruwbahk.exe
  2⤵
  PID:7240
- C:\Windows\System\XkPdBri.exe
  C:\Windows\System\XkPdBri.exe
  2⤵
  PID:7256
- C:\Windows\System\AQtvfYW.exe
  C:\Windows\System\AQtvfYW.exe
  2⤵
  PID:7272
- C:\Windows\System\VCFhLpy.exe
  C:\Windows\System\VCFhLpy.exe
  2⤵
  PID:7288
- C:\Windows\System\VgATdWR.exe
  C:\Windows\System\VgATdWR.exe
  2⤵
  PID:7304
- C:\Windows\System\GkIhlQu.exe
  C:\Windows\System\GkIhlQu.exe
  2⤵
  PID:7320
- C:\Windows\System\AcNiQhy.exe
  C:\Windows\System\AcNiQhy.exe
  2⤵
  PID:7336
- C:\Windows\System\fuDxjai.exe
  C:\Windows\System\fuDxjai.exe
  2⤵
  PID:7352
- C:\Windows\System\XlBKhXX.exe
  C:\Windows\System\XlBKhXX.exe
  2⤵
  PID:7368
- C:\Windows\System\YYzHxbq.exe
  C:\Windows\System\YYzHxbq.exe
  2⤵
  PID:7384
- C:\Windows\System\rvwgZfF.exe
  C:\Windows\System\rvwgZfF.exe
  2⤵
  PID:7400
- C:\Windows\System\aSvMrUe.exe
  C:\Windows\System\aSvMrUe.exe
  2⤵
  PID:7416
- C:\Windows\System\KDGdAoI.exe
  C:\Windows\System\KDGdAoI.exe
  2⤵
  PID:7432
- C:\Windows\System\ldFXguF.exe
  C:\Windows\System\ldFXguF.exe
  2⤵
  PID:7448
- C:\Windows\System\NxHxCRy.exe
  C:\Windows\System\NxHxCRy.exe
  2⤵
  PID:7464
- C:\Windows\System\hUUuaXI.exe
  C:\Windows\System\hUUuaXI.exe
  2⤵
  PID:7480
- C:\Windows\System\UQDheFW.exe
  C:\Windows\System\UQDheFW.exe
  2⤵
  PID:7496
- C:\Windows\System\TFfquRK.exe
  C:\Windows\System\TFfquRK.exe
  2⤵
  PID:7512
- C:\Windows\System\clJdKSM.exe
  C:\Windows\System\clJdKSM.exe
  2⤵
  PID:7528
- C:\Windows\System\IBKvaWt.exe
  C:\Windows\System\IBKvaWt.exe
  2⤵
  PID:7544
- C:\Windows\System\hcVwKGo.exe
  C:\Windows\System\hcVwKGo.exe
  2⤵
  PID:7560
- C:\Windows\System\PVgnXXL.exe
  C:\Windows\System\PVgnXXL.exe
  2⤵
  PID:7576
- C:\Windows\System\JFrCNcV.exe
  C:\Windows\System\JFrCNcV.exe
  2⤵
  PID:7592
- C:\Windows\System\hTSxGTQ.exe
  C:\Windows\System\hTSxGTQ.exe
  2⤵
  PID:7612
- C:\Windows\System\yqfjWYb.exe
  C:\Windows\System\yqfjWYb.exe
  2⤵
  PID:7628
- C:\Windows\System\tugNbsK.exe
  C:\Windows\System\tugNbsK.exe
  2⤵
  PID:7644
- C:\Windows\System\uiDoWKV.exe
  C:\Windows\System\uiDoWKV.exe
  2⤵
  PID:7672
- C:\Windows\System\HqakYKq.exe
  C:\Windows\System\HqakYKq.exe
  2⤵
  PID:7688
- C:\Windows\System\HflEeoJ.exe
  C:\Windows\System\HflEeoJ.exe
  2⤵
  PID:7704
- C:\Windows\System\zQxQecC.exe
  C:\Windows\System\zQxQecC.exe
  2⤵
  PID:7720
- C:\Windows\System\bCstjuM.exe
  C:\Windows\System\bCstjuM.exe
  2⤵
  PID:7736
- C:\Windows\System\XtlisCB.exe
  C:\Windows\System\XtlisCB.exe
  2⤵
  PID:7752
- C:\Windows\System\qUwNrQo.exe
  C:\Windows\System\qUwNrQo.exe
  2⤵
  PID:7768
- C:\Windows\System\hRDlfVz.exe
  C:\Windows\System\hRDlfVz.exe
  2⤵
  PID:7784
- C:\Windows\System\rOQxUOs.exe
  C:\Windows\System\rOQxUOs.exe
  2⤵
  PID:7800
- C:\Windows\System\RLWKhnA.exe
  C:\Windows\System\RLWKhnA.exe
  2⤵
  PID:7816
- C:\Windows\System\IkCRSlA.exe
  C:\Windows\System\IkCRSlA.exe
  2⤵
  PID:7832
- C:\Windows\System\azqCnLX.exe
  C:\Windows\System\azqCnLX.exe
  2⤵
  PID:7848
- C:\Windows\System\xLBHOTI.exe
  C:\Windows\System\xLBHOTI.exe
  2⤵
  PID:7864
- C:\Windows\System\mkQNliq.exe
  C:\Windows\System\mkQNliq.exe
  2⤵
  PID:7880
- C:\Windows\System\lmIrxfn.exe
  C:\Windows\System\lmIrxfn.exe
  2⤵
  PID:7896
- C:\Windows\System\hhIMGiq.exe
  C:\Windows\System\hhIMGiq.exe
  2⤵
  PID:7912
- C:\Windows\System\eItKCRU.exe
  C:\Windows\System\eItKCRU.exe
  2⤵
  PID:7928
- C:\Windows\System\socAsKB.exe
  C:\Windows\System\socAsKB.exe
  2⤵
  PID:7944
- C:\Windows\System\PCptlFI.exe
  C:\Windows\System\PCptlFI.exe
  2⤵
  PID:7960
- C:\Windows\System\eALTzBu.exe
  C:\Windows\System\eALTzBu.exe
  2⤵
  PID:7980
- C:\Windows\System\VyuuWjS.exe
  C:\Windows\System\VyuuWjS.exe
  2⤵
  PID:7996
- C:\Windows\System\bCpXpvM.exe
  C:\Windows\System\bCpXpvM.exe
  2⤵
  PID:8012
- C:\Windows\System\WJGlAgv.exe
  C:\Windows\System\WJGlAgv.exe
  2⤵
  PID:8028
- C:\Windows\System\METWJZI.exe
  C:\Windows\System\METWJZI.exe
  2⤵
  PID:8044
- C:\Windows\System\OYLkrGE.exe
  C:\Windows\System\OYLkrGE.exe
  2⤵
  PID:8064
- C:\Windows\System\wfgfVBY.exe
  C:\Windows\System\wfgfVBY.exe
  2⤵
  PID:8080
- C:\Windows\System\vjNhrHi.exe
  C:\Windows\System\vjNhrHi.exe
  2⤵
  PID:8096
- C:\Windows\System\FvfiUqB.exe
  C:\Windows\System\FvfiUqB.exe
  2⤵
  PID:8112
- C:\Windows\System\FtzTqLW.exe
  C:\Windows\System\FtzTqLW.exe
  2⤵
  PID:8128
- C:\Windows\System\KJNoLnt.exe
  C:\Windows\System\KJNoLnt.exe
  2⤵
  PID:8144
- C:\Windows\System\eSHeSAU.exe
  C:\Windows\System\eSHeSAU.exe
  2⤵
  PID:8164
- C:\Windows\System\nlvKayI.exe
  C:\Windows\System\nlvKayI.exe
  2⤵
  PID:8180
- C:\Windows\System\QdEbjlz.exe
  C:\Windows\System\QdEbjlz.exe
  2⤵
  PID:7188
- C:\Windows\System\RwJxLzP.exe
  C:\Windows\System\RwJxLzP.exe
  2⤵
  PID:7280
- C:\Windows\System\nrnwszs.exe
  C:\Windows\System\nrnwszs.exe
  2⤵
  PID:7344
- C:\Windows\System\iAULfJc.exe
  C:\Windows\System\iAULfJc.exe
  2⤵
  PID:7408
- C:\Windows\System\gOIAOwq.exe
  C:\Windows\System\gOIAOwq.exe
  2⤵
  PID:7472
- C:\Windows\System\lUdXEnF.exe
  C:\Windows\System\lUdXEnF.exe
  2⤵
  PID:7536
- C:\Windows\System\GFamLbo.exe
  C:\Windows\System\GFamLbo.exe
  2⤵
  PID:7572
- C:\Windows\System\ZlcHBKN.exe
  C:\Windows\System\ZlcHBKN.exe
  2⤵
  PID:6660
- C:\Windows\System\huYwDTE.exe
  C:\Windows\System\huYwDTE.exe
  2⤵
  PID:7424
- C:\Windows\System\ePPFzIF.exe
  C:\Windows\System\ePPFzIF.exe
  2⤵
  PID:7520
- C:\Windows\System\iHaCpme.exe
  C:\Windows\System\iHaCpme.exe
  2⤵
  PID:7652
- C:\Windows\System\EYeznsp.exe
  C:\Windows\System\EYeznsp.exe
  2⤵
  PID:7668
- C:\Windows\System\GnplmTp.exe
  C:\Windows\System\GnplmTp.exe
  2⤵
  PID:7296
- C:\Windows\System\OPNoxXF.exe
  C:\Windows\System\OPNoxXF.exe
  2⤵
  PID:7588
- C:\Windows\System\YbyMWdx.exe
  C:\Windows\System\YbyMWdx.exe
  2⤵
  PID:6436
- C:\Windows\System\qIYPiMx.exe
  C:\Windows\System\qIYPiMx.exe
  2⤵
  PID:6916
- C:\Windows\System\IWMZXxg.exe
  C:\Windows\System\IWMZXxg.exe
  2⤵
  PID:7264
- C:\Windows\System\EqDXFDR.exe
  C:\Windows\System\EqDXFDR.exe
  2⤵
  PID:7428
- C:\Windows\System\AobPFCP.exe
  C:\Windows\System\AobPFCP.exe
  2⤵
  PID:7624
- C:\Windows\System\NvWaFOr.exe
  C:\Windows\System\NvWaFOr.exe
  2⤵
  PID:7700
- C:\Windows\System\GodkjHb.exe
  C:\Windows\System\GodkjHb.exe
  2⤵
  PID:7728
- C:\Windows\System\uafofsE.exe
  C:\Windows\System\uafofsE.exe
  2⤵
  PID:7780
- C:\Windows\System\sDMAAZz.exe
  C:\Windows\System\sDMAAZz.exe
  2⤵
  PID:7844
- C:\Windows\System\Rxcutrp.exe
  C:\Windows\System\Rxcutrp.exe
  2⤵
  PID:7828
- C:\Windows\System\AcyDsvf.exe
  C:\Windows\System\AcyDsvf.exe
  2⤵
  PID:7824
- C:\Windows\System\OByKBRA.exe
  C:\Windows\System\OByKBRA.exe
  2⤵
  PID:7892
- C:\Windows\System\ObjqEqj.exe
  C:\Windows\System\ObjqEqj.exe
  2⤵
  PID:7988
- C:\Windows\System\WRzNYdy.exe
  C:\Windows\System\WRzNYdy.exe
  2⤵
  PID:7976
- C:\Windows\System\qsdenmx.exe
  C:\Windows\System\qsdenmx.exe
  2⤵
  PID:8040
- C:\Windows\System\ulRIUxr.exe
  C:\Windows\System\ulRIUxr.exe
  2⤵
  PID:8104
- C:\Windows\System\npTyRDg.exe
  C:\Windows\System\npTyRDg.exe
  2⤵
  PID:8172
- C:\Windows\System\nbsGaAQ.exe
  C:\Windows\System\nbsGaAQ.exe
  2⤵
  PID:7248
- C:\Windows\System\DzBtDBD.exe
  C:\Windows\System\DzBtDBD.exe
  2⤵
  PID:5464
- C:\Windows\System\HvoTXGD.exe
  C:\Windows\System\HvoTXGD.exe
  2⤵
  PID:8092
- C:\Windows\System\xVUaTzg.exe
  C:\Windows\System\xVUaTzg.exe
  2⤵
  PID:8156
- C:\Windows\System\cGmlxIL.exe
  C:\Windows\System\cGmlxIL.exe
  2⤵
  PID:7504
- C:\Windows\System\xIUbcMB.exe
  C:\Windows\System\xIUbcMB.exe
  2⤵
  PID:7608
- C:\Windows\System\SteWWCS.exe
  C:\Windows\System\SteWWCS.exe
  2⤵
  PID:6516
- C:\Windows\System\vihmkLp.exe
  C:\Windows\System\vihmkLp.exe
  2⤵
  PID:7396
- C:\Windows\System\mpPwbMn.exe
  C:\Windows\System\mpPwbMn.exe
  2⤵
  PID:6388
- C:\Windows\System\ixiWgIh.exe
  C:\Windows\System\ixiWgIh.exe
  2⤵
  PID:7712
- C:\Windows\System\ntFGHMd.exe
  C:\Windows\System\ntFGHMd.exe
  2⤵
  PID:7760
- C:\Windows\System\DNyQdXJ.exe
  C:\Windows\System\DNyQdXJ.exe
  2⤵
  PID:7908
- C:\Windows\System\cLgODUM.exe
  C:\Windows\System\cLgODUM.exe
  2⤵
  PID:7172
- C:\Windows\System\ugIoMpI.exe
  C:\Windows\System\ugIoMpI.exe
  2⤵
  PID:7524
- C:\Windows\System\WhDTAHP.exe
  C:\Windows\System\WhDTAHP.exe
  2⤵
  PID:7636
- C:\Windows\System\bFzdgXE.exe
  C:\Windows\System\bFzdgXE.exe
  2⤵
  PID:7936
- C:\Windows\System\oZuXyKM.exe
  C:\Windows\System\oZuXyKM.exe
  2⤵
  PID:7696
- C:\Windows\System\rHWFgjY.exe
  C:\Windows\System\rHWFgjY.exe
  2⤵
  PID:7952
- C:\Windows\System\BfbJbpW.exe
  C:\Windows\System\BfbJbpW.exe
  2⤵
  PID:8140
- C:\Windows\System\pGyFwXB.exe
  C:\Windows\System\pGyFwXB.exe
  2⤵
  PID:7312
- C:\Windows\System\EQjdnQM.exe
  C:\Windows\System\EQjdnQM.exe
  2⤵
  PID:7604
- C:\Windows\System\OGaNJLB.exe
  C:\Windows\System\OGaNJLB.exe
  2⤵
  PID:8152
- C:\Windows\System\SiiSpnj.exe
  C:\Windows\System\SiiSpnj.exe
  2⤵
  PID:6792
- C:\Windows\System\GvShKnZ.exe
  C:\Windows\System\GvShKnZ.exe
  2⤵
  PID:7116
- C:\Windows\System\yHMCXbI.exe
  C:\Windows\System\yHMCXbI.exe
  2⤵
  PID:5616
- C:\Windows\System\nObuAWO.exe
  C:\Windows\System\nObuAWO.exe
  2⤵
  PID:7888
- C:\Windows\System\nYeFXuG.exe
  C:\Windows\System\nYeFXuG.exe
  2⤵
  PID:7204
- C:\Windows\System\mYeLQOl.exe
  C:\Windows\System\mYeLQOl.exe
  2⤵
  PID:7992
- C:\Windows\System\EYnvDNi.exe
  C:\Windows\System\EYnvDNi.exe
  2⤵
  PID:8076
- C:\Windows\System\dXdbAxf.exe
  C:\Windows\System\dXdbAxf.exe
  2⤵
  PID:7184
- C:\Windows\System\POJeGpu.exe
  C:\Windows\System\POJeGpu.exe
  2⤵
  PID:7584
- C:\Windows\System\gHZQDCb.exe
  C:\Windows\System\gHZQDCb.exe
  2⤵
  PID:7568
- C:\Windows\System\mrFFQPE.exe
  C:\Windows\System\mrFFQPE.exe
  2⤵
  PID:7252
- C:\Windows\System\iZOCxNm.exe
  C:\Windows\System\iZOCxNm.exe
  2⤵
  PID:7792
- C:\Windows\System\pkrSmTR.exe
  C:\Windows\System\pkrSmTR.exe
  2⤵
  PID:5920
- C:\Windows\System\CVaZyes.exe
  C:\Windows\System\CVaZyes.exe
  2⤵
  PID:8208
- C:\Windows\System\UgAtxns.exe
  C:\Windows\System\UgAtxns.exe
  2⤵
  PID:8224
- C:\Windows\System\bJNVZMO.exe
  C:\Windows\System\bJNVZMO.exe
  2⤵
  PID:8240
- C:\Windows\System\neNDCKg.exe
  C:\Windows\System\neNDCKg.exe
  2⤵
  PID:8256
- C:\Windows\System\GCfgkOl.exe
  C:\Windows\System\GCfgkOl.exe
  2⤵
  PID:8272
- C:\Windows\System\UwLjNxe.exe
  C:\Windows\System\UwLjNxe.exe
  2⤵
  PID:8304
- C:\Windows\System\unAmWUt.exe
  C:\Windows\System\unAmWUt.exe
  2⤵
  PID:8324
- C:\Windows\System\IFksXLZ.exe
  C:\Windows\System\IFksXLZ.exe
  2⤵
  PID:8348
- C:\Windows\System\DWSRKnp.exe
  C:\Windows\System\DWSRKnp.exe
  2⤵
  PID:8364
- C:\Windows\System\ePUejqQ.exe
  C:\Windows\System\ePUejqQ.exe
  2⤵
  PID:8384
- C:\Windows\System\qbLXLYV.exe
  C:\Windows\System\qbLXLYV.exe
  2⤵
  PID:8404
- C:\Windows\System\BfgAVRg.exe
  C:\Windows\System\BfgAVRg.exe
  2⤵
  PID:8420
- C:\Windows\System\MTGBLqk.exe
  C:\Windows\System\MTGBLqk.exe
  2⤵
  PID:8436
- C:\Windows\System\zBVdwSZ.exe
  C:\Windows\System\zBVdwSZ.exe
  2⤵
  PID:8452
- C:\Windows\System\UOhSiEl.exe
  C:\Windows\System\UOhSiEl.exe
  2⤵
  PID:8536
- C:\Windows\System\McKtgWe.exe
  C:\Windows\System\McKtgWe.exe
  2⤵
  PID:8572
- C:\Windows\System\CESepxx.exe
  C:\Windows\System\CESepxx.exe
  2⤵
  PID:8588
- C:\Windows\System\ZVxBFzJ.exe
  C:\Windows\System\ZVxBFzJ.exe
  2⤵
  PID:8604
- C:\Windows\System\ZJWCphx.exe
  C:\Windows\System\ZJWCphx.exe
  2⤵
  PID:8620
- C:\Windows\System\sTDrngu.exe
  C:\Windows\System\sTDrngu.exe
  2⤵
  PID:8636
- C:\Windows\System\HRAuuQB.exe
  C:\Windows\System\HRAuuQB.exe
  2⤵
  PID:8652
- C:\Windows\System\OOUHcUV.exe
  C:\Windows\System\OOUHcUV.exe
  2⤵
  PID:8668
- C:\Windows\System\XMYaTKV.exe
  C:\Windows\System\XMYaTKV.exe
  2⤵
  PID:8684
- C:\Windows\System\GLhUNYR.exe
  C:\Windows\System\GLhUNYR.exe
  2⤵
  PID:8700
- C:\Windows\System\DhHtwXC.exe
  C:\Windows\System\DhHtwXC.exe
  2⤵
  PID:8736
- C:\Windows\System\GOngcwU.exe
  C:\Windows\System\GOngcwU.exe
  2⤵
  PID:8752
- C:\Windows\System\ZNGfycO.exe
  C:\Windows\System\ZNGfycO.exe
  2⤵
  PID:8792
- C:\Windows\System\SCaRsci.exe
  C:\Windows\System\SCaRsci.exe
  2⤵
  PID:8808
- C:\Windows\System\KPLDFTh.exe
  C:\Windows\System\KPLDFTh.exe
  2⤵
  PID:8824
- C:\Windows\System\TqEgevy.exe
  C:\Windows\System\TqEgevy.exe
  2⤵
  PID:8840
- C:\Windows\System\NLzymFk.exe
  C:\Windows\System\NLzymFk.exe
  2⤵
  PID:8856
- C:\Windows\System\Stupzit.exe
  C:\Windows\System\Stupzit.exe
  2⤵
  PID:8872
- C:\Windows\System\AaPZOoK.exe
  C:\Windows\System\AaPZOoK.exe
  2⤵
  PID:8892
- C:\Windows\System\QgVcnaT.exe
  C:\Windows\System\QgVcnaT.exe
  2⤵
  PID:8908
- C:\Windows\System\SwXApeb.exe
  C:\Windows\System\SwXApeb.exe
  2⤵
  PID:8924
- C:\Windows\System\SZcmGYt.exe
  C:\Windows\System\SZcmGYt.exe
  2⤵
  PID:8940
- C:\Windows\System\mCixNxy.exe
  C:\Windows\System\mCixNxy.exe
  2⤵
  PID:8956
- C:\Windows\System\VvCFPqR.exe
  C:\Windows\System\VvCFPqR.exe
  2⤵
  PID:8972
- C:\Windows\System\aEcMSDS.exe
  C:\Windows\System\aEcMSDS.exe
  2⤵
  PID:8988
- C:\Windows\System\qsIMhtY.exe
  C:\Windows\System\qsIMhtY.exe
  2⤵
  PID:9008
- C:\Windows\System\eOIwtbI.exe
  C:\Windows\System\eOIwtbI.exe
  2⤵
  PID:9024
- C:\Windows\System\fKHDEno.exe
  C:\Windows\System\fKHDEno.exe
  2⤵
  PID:9064
- C:\Windows\System\mfKHxOM.exe
  C:\Windows\System\mfKHxOM.exe
  2⤵
  PID:9080
- C:\Windows\System\RxLNxWM.exe
  C:\Windows\System\RxLNxWM.exe
  2⤵
  PID:9096
- C:\Windows\System\nhptAeW.exe
  C:\Windows\System\nhptAeW.exe
  2⤵
  PID:9112
- C:\Windows\System\ewAVlFj.exe
  C:\Windows\System\ewAVlFj.exe
  2⤵
  PID:9128
- C:\Windows\System\oOcBdrD.exe
  C:\Windows\System\oOcBdrD.exe
  2⤵
  PID:9144
- C:\Windows\System\lIOsWPr.exe
  C:\Windows\System\lIOsWPr.exe
  2⤵
  PID:9160
- C:\Windows\System\LixykzQ.exe
  C:\Windows\System\LixykzQ.exe
  2⤵
  PID:9176
- C:\Windows\System\WocRuHZ.exe
  C:\Windows\System\WocRuHZ.exe
  2⤵
  PID:9192
- C:\Windows\System\eAdzhDW.exe
  C:\Windows\System\eAdzhDW.exe
  2⤵
  PID:9208
- C:\Windows\System\etRVUBB.exe
  C:\Windows\System\etRVUBB.exe
  2⤵
  PID:6356
- C:\Windows\System\sjaMleU.exe
  C:\Windows\System\sjaMleU.exe
  2⤵
  PID:8236
- C:\Windows\System\FLARjIs.exe
  C:\Windows\System\FLARjIs.exe
  2⤵
  PID:7620
- C:\Windows\System\FGLtmIj.exe
  C:\Windows\System\FGLtmIj.exe
  2⤵
  PID:7924
- C:\Windows\System\sieGNbx.exe
  C:\Windows\System\sieGNbx.exe
  2⤵
  PID:8248
- C:\Windows\System\ZwdyTmr.exe
  C:\Windows\System\ZwdyTmr.exe
  2⤵
  PID:8292
- C:\Windows\System\DwzkoBh.exe
  C:\Windows\System\DwzkoBh.exe
  2⤵
  PID:8336
- C:\Windows\System\DyhmTbJ.exe
  C:\Windows\System\DyhmTbJ.exe
  2⤵
  PID:8376
- C:\Windows\System\LPCculm.exe
  C:\Windows\System\LPCculm.exe
  2⤵
  PID:8380
- C:\Windows\System\gtvEpjz.exe
  C:\Windows\System\gtvEpjz.exe
  2⤵
  PID:8356
- C:\Windows\System\jCCXNku.exe
  C:\Windows\System\jCCXNku.exe
  2⤵
  PID:8448
- C:\Windows\System\sFNKhqh.exe
  C:\Windows\System\sFNKhqh.exe
  2⤵
  PID:8400
- C:\Windows\System\HBIZSar.exe
  C:\Windows\System\HBIZSar.exe
  2⤵
  PID:8460
- C:\Windows\System\YmaqyUU.exe
  C:\Windows\System\YmaqyUU.exe
  2⤵
  PID:8480
- C:\Windows\System\eHKcKfg.exe
  C:\Windows\System\eHKcKfg.exe
  2⤵
  PID:8496
- C:\Windows\System\lSxBsHz.exe
  C:\Windows\System\lSxBsHz.exe
  2⤵
  PID:8512
- C:\Windows\System\ELCXZif.exe
  C:\Windows\System\ELCXZif.exe
  2⤵
  PID:8544
- C:\Windows\System\oUHNmIj.exe
  C:\Windows\System\oUHNmIj.exe
  2⤵
  PID:8548
- C:\Windows\System\qVKidrI.exe
  C:\Windows\System\qVKidrI.exe
  2⤵
  PID:8560
- C:\Windows\System\wMRQjux.exe
  C:\Windows\System\wMRQjux.exe
  2⤵
  PID:8584
- C:\Windows\System\pRRyPui.exe
  C:\Windows\System\pRRyPui.exe
  2⤵
  PID:8664
- C:\Windows\System\AhWBSKs.exe
  C:\Windows\System\AhWBSKs.exe
  2⤵
  PID:8648
- C:\Windows\System\dukKduJ.exe
  C:\Windows\System\dukKduJ.exe
  2⤵
  PID:8676
- C:\Windows\System\tptUZZy.exe
  C:\Windows\System\tptUZZy.exe
  2⤵
  PID:8716
- C:\Windows\System\xDFBAEi.exe
  C:\Windows\System\xDFBAEi.exe
  2⤵
  PID:8720
- C:\Windows\System\pgqIZzN.exe
  C:\Windows\System\pgqIZzN.exe
  2⤵
  PID:8804
- C:\Windows\System\dIkuyjf.exe
  C:\Windows\System\dIkuyjf.exe
  2⤵
  PID:8832
- C:\Windows\System\hlQoURK.exe
  C:\Windows\System\hlQoURK.exe
  2⤵
  PID:8936
- C:\Windows\System\LYUWHIA.exe
  C:\Windows\System\LYUWHIA.exe
  2⤵
  PID:9000
- C:\Windows\System\gEBhCKC.exe
  C:\Windows\System\gEBhCKC.exe
  2⤵
  PID:8776
- C:\Windows\System\dvMdKRd.exe
  C:\Windows\System\dvMdKRd.exe
  2⤵
  PID:8768
- C:\Windows\System\GziLyiw.exe
  C:\Windows\System\GziLyiw.exe
  2⤵
  PID:8888
- C:\Windows\System\SwADVhQ.exe
  C:\Windows\System\SwADVhQ.exe
  2⤵
  PID:8784
- C:\Windows\System\czvXhPt.exe
  C:\Windows\System\czvXhPt.exe
  2⤵
  PID:8952
- C:\Windows\System\EtDMfSm.exe
  C:\Windows\System\EtDMfSm.exe
  2⤵
  PID:9040
- C:\Windows\System\DewdtLd.exe
  C:\Windows\System\DewdtLd.exe
  2⤵
  PID:9052
- C:\Windows\System\kOXkpiO.exe
  C:\Windows\System\kOXkpiO.exe
  2⤵
  PID:9072
- C:\Windows\System\YAUEeLn.exe
  C:\Windows\System\YAUEeLn.exe
  2⤵
  PID:9124
- C:\Windows\System\RmAXqax.exe
  C:\Windows\System\RmAXqax.exe
  2⤵
  PID:9184
- C:\Windows\System\ufWskiU.exe
  C:\Windows\System\ufWskiU.exe
  2⤵
  PID:9108
- C:\Windows\System\GzgdGRo.exe
  C:\Windows\System\GzgdGRo.exe
  2⤵
  PID:9204
- C:\Windows\System\bRjHACQ.exe
  C:\Windows\System\bRjHACQ.exe
  2⤵
  PID:8268
- C:\Windows\System\BDHOiqi.exe
  C:\Windows\System\BDHOiqi.exe
  2⤵
  PID:8216
- C:\Windows\System\vnzhTUp.exe
  C:\Windows\System\vnzhTUp.exe
  2⤵
  PID:8332
- C:\Windows\System\XdiJPxE.exe
  C:\Windows\System\XdiJPxE.exe
  2⤵
  PID:8344
- C:\Windows\System\rHEoDKb.exe
  C:\Windows\System\rHEoDKb.exe
  2⤵
  PID:8416
- C:\Windows\System\UKVGDND.exe
  C:\Windows\System\UKVGDND.exe
  2⤵
  PID:8492
- C:\Windows\System\AmBsbsu.exe
  C:\Windows\System\AmBsbsu.exe
  2⤵
  PID:8360
- C:\Windows\System\iUjXZTb.exe
  C:\Windows\System\iUjXZTb.exe
  2⤵
  PID:8500
- C:\Windows\System\UnOTSmd.exe
  C:\Windows\System\UnOTSmd.exe
  2⤵
  PID:8528
- C:\Windows\System\WakprUr.exe
  C:\Windows\System\WakprUr.exe
  2⤵
  PID:8660
- C:\Windows\System\VncaOhB.exe
  C:\Windows\System\VncaOhB.exe
  2⤵
  PID:8696
- C:\Windows\System\QpqRXxr.exe
  C:\Windows\System\QpqRXxr.exe
  2⤵
  PID:8680
- C:\Windows\System\JGjYUFv.exe
  C:\Windows\System\JGjYUFv.exe
  2⤵
  PID:8868
- C:\Windows\System\NVTpzHf.exe
  C:\Windows\System\NVTpzHf.exe
  2⤵
  PID:8964
- C:\Windows\System\HwvVHaq.exe
  C:\Windows\System\HwvVHaq.exe
  2⤵
  PID:8900
- C:\Windows\System\xdYspCn.exe
  C:\Windows\System\xdYspCn.exe
  2⤵
  PID:8848
- C:\Windows\System\enyLbJJ.exe
  C:\Windows\System\enyLbJJ.exe
  2⤵
  PID:8984
- C:\Windows\System\dPBdFfH.exe
  C:\Windows\System\dPBdFfH.exe
  2⤵
  PID:8948
- C:\Windows\System\NxHtTlx.exe
  C:\Windows\System\NxHtTlx.exe
  2⤵
  PID:9172
- C:\Windows\System\uuXmAVC.exe
  C:\Windows\System\uuXmAVC.exe
  2⤵
  PID:9156
- C:\Windows\System\ciFAjxH.exe
  C:\Windows\System\ciFAjxH.exe
  2⤵
  PID:8476
- C:\Windows\System\dDmtiNR.exe
  C:\Windows\System\dDmtiNR.exe
  2⤵
  PID:8372
- C:\Windows\System\wvjzsyb.exe
  C:\Windows\System\wvjzsyb.exe
  2⤵
  PID:8692
- C:\Windows\System\iMIZVJK.exe
  C:\Windows\System\iMIZVJK.exe
  2⤵
  PID:9048
- C:\Windows\System\wpYCXpc.exe
  C:\Windows\System\wpYCXpc.exe
  2⤵
  PID:9092
- C:\Windows\System\fpfHWZK.exe
  C:\Windows\System\fpfHWZK.exe
  2⤵
  PID:8188
- C:\Windows\System\CTlJrUH.exe
  C:\Windows\System\CTlJrUH.exe
  2⤵
  PID:8288
- C:\Windows\System\LLGNTzt.exe
  C:\Windows\System\LLGNTzt.exe
  2⤵
  PID:8524
- C:\Windows\System\wQomVoI.exe
  C:\Windows\System\wQomVoI.exe
  2⤵
  PID:8432
- C:\Windows\System\DvpOPLo.exe
  C:\Windows\System\DvpOPLo.exe
  2⤵
  PID:8748
- C:\Windows\System\bApIuFA.exe
  C:\Windows\System\bApIuFA.exe
  2⤵
  PID:8204
- C:\Windows\System\oUMghfO.exe
  C:\Windows\System\oUMghfO.exe
  2⤵
  PID:9056
- C:\Windows\System\mwjoiYg.exe
  C:\Windows\System\mwjoiYg.exe
  2⤵
  PID:7316
- C:\Windows\System\OgTkPpk.exe
  C:\Windows\System\OgTkPpk.exe
  2⤵
  PID:8320
- C:\Windows\System\SZGmzOH.exe
  C:\Windows\System\SZGmzOH.exe
  2⤵
  PID:8600
- C:\Windows\System\PzRmOVD.exe
  C:\Windows\System\PzRmOVD.exe
  2⤵
  PID:8732
- C:\Windows\System\HqQYcXu.exe
  C:\Windows\System\HqQYcXu.exe
  2⤵
  PID:9220
- C:\Windows\System\FrMLNRX.exe
  C:\Windows\System\FrMLNRX.exe
  2⤵
  PID:9236
- C:\Windows\System\IZFMkjl.exe
  C:\Windows\System\IZFMkjl.exe
  2⤵
  PID:9252
- C:\Windows\System\OgkYiwt.exe
  C:\Windows\System\OgkYiwt.exe
  2⤵
  PID:9268
- C:\Windows\System\Zpecnti.exe
  C:\Windows\System\Zpecnti.exe
  2⤵
  PID:9284
- C:\Windows\System\ajTjytX.exe
  C:\Windows\System\ajTjytX.exe
  2⤵
  PID:9300
- C:\Windows\System\OgPzCbQ.exe
  C:\Windows\System\OgPzCbQ.exe
  2⤵
  PID:9316
- C:\Windows\System\EngGvEM.exe
  C:\Windows\System\EngGvEM.exe
  2⤵
  PID:9332
- C:\Windows\System\dqIxHzS.exe
  C:\Windows\System\dqIxHzS.exe
  2⤵
  PID:9348
- C:\Windows\System\IZtiify.exe
  C:\Windows\System\IZtiify.exe
  2⤵
  PID:9364
- C:\Windows\System\JViHnFc.exe
  C:\Windows\System\JViHnFc.exe
  2⤵
  PID:9380
- C:\Windows\System\sjPGURb.exe
  C:\Windows\System\sjPGURb.exe
  2⤵
  PID:9396
- C:\Windows\System\Fzsyywi.exe
  C:\Windows\System\Fzsyywi.exe
  2⤵
  PID:9412
- C:\Windows\System\uFyBYzy.exe
  C:\Windows\System\uFyBYzy.exe
  2⤵
  PID:9428
- C:\Windows\System\GrUvnTG.exe
  C:\Windows\System\GrUvnTG.exe
  2⤵
  PID:9444
- C:\Windows\System\nxRdWGv.exe
  C:\Windows\System\nxRdWGv.exe
  2⤵
  PID:9460
- C:\Windows\System\VsChOQi.exe
  C:\Windows\System\VsChOQi.exe
  2⤵
  PID:9476
- C:\Windows\System\eEVJNqh.exe
  C:\Windows\System\eEVJNqh.exe
  2⤵
  PID:9492
- C:\Windows\System\hLGqDvw.exe
  C:\Windows\System\hLGqDvw.exe
  2⤵
  PID:9508
- C:\Windows\System\rhqXFvA.exe
  C:\Windows\System\rhqXFvA.exe
  2⤵
  PID:9524
- C:\Windows\System\roVqTNt.exe
  C:\Windows\System\roVqTNt.exe
  2⤵
  PID:9540
- C:\Windows\System\BuKnKKg.exe
  C:\Windows\System\BuKnKKg.exe
  2⤵
  PID:9556
- C:\Windows\System\vVAxomJ.exe
  C:\Windows\System\vVAxomJ.exe
  2⤵
  PID:9572
- C:\Windows\System\BDwONEw.exe
  C:\Windows\System\BDwONEw.exe
  2⤵
  PID:9588
- C:\Windows\System\RqacecM.exe
  C:\Windows\System\RqacecM.exe
  2⤵
  PID:9604
- C:\Windows\System\hNGYygm.exe
  C:\Windows\System\hNGYygm.exe
  2⤵
  PID:9620
- C:\Windows\System\tbKeHTk.exe
  C:\Windows\System\tbKeHTk.exe
  2⤵
  PID:9636
- C:\Windows\System\bTHnmss.exe
  C:\Windows\System\bTHnmss.exe
  2⤵
  PID:9652
- C:\Windows\System\yiJCUIQ.exe
  C:\Windows\System\yiJCUIQ.exe
  2⤵
  PID:9668
- C:\Windows\System\RNdKOUb.exe
  C:\Windows\System\RNdKOUb.exe
  2⤵
  PID:9684
- C:\Windows\System\JTIzqYY.exe
  C:\Windows\System\JTIzqYY.exe
  2⤵
  PID:9700
- C:\Windows\System\WfeUPQR.exe
  C:\Windows\System\WfeUPQR.exe
  2⤵
  PID:9716
- C:\Windows\System\ScCkKST.exe
  C:\Windows\System\ScCkKST.exe
  2⤵
  PID:9732
- C:\Windows\System\pnKKtpx.exe
  C:\Windows\System\pnKKtpx.exe
  2⤵
  PID:9748
- C:\Windows\System\FWSGEha.exe
  C:\Windows\System\FWSGEha.exe
  2⤵
  PID:9764
- C:\Windows\System\ezXExMx.exe
  C:\Windows\System\ezXExMx.exe
  2⤵
  PID:9780
- C:\Windows\System\DqhkIIs.exe
  C:\Windows\System\DqhkIIs.exe
  2⤵
  PID:9796
- C:\Windows\System\ljtkUOS.exe
  C:\Windows\System\ljtkUOS.exe
  2⤵
  PID:9812
- C:\Windows\System\xtpVsgY.exe
  C:\Windows\System\xtpVsgY.exe
  2⤵
  PID:9828
- C:\Windows\System\cIvwRZg.exe
  C:\Windows\System\cIvwRZg.exe
  2⤵
  PID:9844
- C:\Windows\System\wSUJsgo.exe
  C:\Windows\System\wSUJsgo.exe
  2⤵
  PID:9860
- C:\Windows\System\MPNPRxG.exe
  C:\Windows\System\MPNPRxG.exe
  2⤵
  PID:9876
- C:\Windows\System\rLcOIKZ.exe
  C:\Windows\System\rLcOIKZ.exe
  2⤵
  PID:9892
- C:\Windows\System\YgSMqcS.exe
  C:\Windows\System\YgSMqcS.exe
  2⤵
  PID:9908
- C:\Windows\System\ODypPHN.exe
  C:\Windows\System\ODypPHN.exe
  2⤵
  PID:9924
- C:\Windows\System\nxIAFKA.exe
  C:\Windows\System\nxIAFKA.exe
  2⤵
  PID:9940
- C:\Windows\System\iUPeswD.exe
  C:\Windows\System\iUPeswD.exe
  2⤵
  PID:9956
- C:\Windows\System\VOMvTPR.exe
  C:\Windows\System\VOMvTPR.exe
  2⤵
  PID:9972
- C:\Windows\System\KWWysQt.exe
  C:\Windows\System\KWWysQt.exe
  2⤵
  PID:9988
- C:\Windows\System\fehJgAh.exe
  C:\Windows\System\fehJgAh.exe
  2⤵
  PID:10004
- C:\Windows\System\FsoVgtG.exe
  C:\Windows\System\FsoVgtG.exe
  2⤵
  PID:10020
- C:\Windows\System\KjVBYnj.exe
  C:\Windows\System\KjVBYnj.exe
  2⤵
  PID:10036
- C:\Windows\System\egmaZzV.exe
  C:\Windows\System\egmaZzV.exe
  2⤵
  PID:10052
- C:\Windows\System\GwBsVaJ.exe
  C:\Windows\System\GwBsVaJ.exe
  2⤵
  PID:10068
- C:\Windows\System\ATUxNJb.exe
  C:\Windows\System\ATUxNJb.exe
  2⤵
  PID:10084
- C:\Windows\System\tMdzZre.exe
  C:\Windows\System\tMdzZre.exe
  2⤵
  PID:10100
- C:\Windows\System\UUZigYY.exe
  C:\Windows\System\UUZigYY.exe
  2⤵
  PID:10116
- C:\Windows\System\PvfYMmG.exe
  C:\Windows\System\PvfYMmG.exe
  2⤵
  PID:10132
- C:\Windows\System\daIAMyc.exe
  C:\Windows\System\daIAMyc.exe
  2⤵
  PID:10148
- C:\Windows\System\ZwYHaGQ.exe
  C:\Windows\System\ZwYHaGQ.exe
  2⤵
  PID:10164
- C:\Windows\System\eKvCQcT.exe
  C:\Windows\System\eKvCQcT.exe
  2⤵
  PID:10180
- C:\Windows\System\bbLkxhc.exe
  C:\Windows\System\bbLkxhc.exe
  2⤵
  PID:10196
- C:\Windows\System\MwnvQyc.exe
  C:\Windows\System\MwnvQyc.exe
  2⤵
  PID:10212
- C:\Windows\System\tYMSekQ.exe
  C:\Windows\System\tYMSekQ.exe
  2⤵
  PID:10228
- C:\Windows\System\qzemZsY.exe
  C:\Windows\System\qzemZsY.exe
  2⤵
  PID:9232
- C:\Windows\System\jWTXaNN.exe
  C:\Windows\System\jWTXaNN.exe
  2⤵
  PID:8864
- C:\Windows\System\CVsRrhA.exe
  C:\Windows\System\CVsRrhA.exe
  2⤵
  PID:9324
- C:\Windows\System\EgzyGIy.exe
  C:\Windows\System\EgzyGIy.exe
  2⤵
  PID:9140
- C:\Windows\System\XWZeRWf.exe
  C:\Windows\System\XWZeRWf.exe
  2⤵
  PID:9280
- C:\Windows\System\dLUbujn.exe
  C:\Windows\System\dLUbujn.exe
  2⤵
  PID:9308
- C:\Windows\System\DIuKcUa.exe
  C:\Windows\System\DIuKcUa.exe
  2⤵
  PID:9360
- C:\Windows\System\JyHIHZP.exe
  C:\Windows\System\JyHIHZP.exe
  2⤵
  PID:9392
- C:\Windows\System\mkbnDRg.exe
  C:\Windows\System\mkbnDRg.exe
  2⤵
  PID:9424
- C:\Windows\System\mnvWwSS.exe
  C:\Windows\System\mnvWwSS.exe
  2⤵
  PID:9408
- C:\Windows\System\cSmJUJj.exe
  C:\Windows\System\cSmJUJj.exe
  2⤵
  PID:9516
- C:\Windows\System\cmigTwj.exe
  C:\Windows\System\cmigTwj.exe
  2⤵
  PID:9504
- C:\Windows\System\Gsavgwd.exe
  C:\Windows\System\Gsavgwd.exe
  2⤵
  PID:9564
- C:\Windows\System\IvwYmri.exe
  C:\Windows\System\IvwYmri.exe
  2⤵
  PID:9632
- C:\Windows\System\XOkClYp.exe
  C:\Windows\System\XOkClYp.exe
  2⤵
  PID:9548
- C:\Windows\System\qrpHFPs.exe
  C:\Windows\System\qrpHFPs.exe
  2⤵
  PID:9612
- C:\Windows\System\MnPikka.exe
  C:\Windows\System\MnPikka.exe
  2⤵
  PID:9676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BhxRxzV.exe

Filesize
1.9MB

MD5
49e16bb003ec37cb27d9c29e33ae6261

SHA1
ca2e536f8085d9c0c98ea2c7b1cf9e23eb026128

SHA256
af84a1400c01d28347191279ce821943339ccc04864e26ecfc0e5bdb831638b9

SHA512
563f3fd7cb7d2e79aac26c8e150459b31d5bfae15fd8132089b5dab3c1001ec9e08f8a42d0127ccb6c347dd17278622793d449eded2a0914dd3fbb898176a915

Download Submit
C:\Windows\system\BmuaZZh.exe

Filesize
1.9MB

MD5
9e119417c433de92209c11fcee34eb4b

SHA1
f338667474ffbda3f5fcb327f2fdb2039e03662a

SHA256
53cb8d7808136301bab5382048c76380c3fb9b01af79da8a2a670b48b5b13888

SHA512
6fbca2160ff4a4f57d2ea3e49670c995feb3abf2df87442a43f714042fba17d7b7b7f93cf35bd7667ba12531b2b46512f2d4d05fabb0ad29364bda9a3ddd352a

Download Submit
C:\Windows\system\BxqdGDm.exe

Filesize
1.9MB

MD5
86ba21d7b0d879078273bf4e84274a98

SHA1
36839015dfb6ce6bea6a1d303efbf5254cdc49cc

SHA256
e9733ee40704bdf45e4dcb0a1aa42289811ff9092119e8369a1177143227f740

SHA512
d82e796e29d8ec022abb5a5b15773e77a064bf6494fae79a1b4060390bb7ce83a5d66e64ad1c8bf1c60f2e5954f0207e54ee5a0b5dbb2a8402a073a59656c15e

Download Submit
C:\Windows\system\DwGxkkn.exe

Filesize
1.9MB

MD5
417fa36b44f3c3b073c2bf99a4132b0d

SHA1
a1ccae73a40f2383cb4d6c289b2c3468ddc6610c

SHA256
206ed82ceec119369d9f402259c9d616fc8cc480f3040730e9e633535badfc49

SHA512
cc625f42a6310cbaf57bc66eac83da56339241a004e37a3dbb0b235d4658800998053a23d43aaf0d74d2b9fde77eb22e78a404df0e263dda972aa83c3a88513d

Download Submit
C:\Windows\system\DxuZuJP.exe

Filesize
1.9MB

MD5
c7c2485b3bd46d7ca4cc8e8cbeceff60

SHA1
a9359925e3232df773164046f0783bdae2e0789f

SHA256
759fdf55493772eafb2c3d16bd73392f6c374e200e7449f04f77c6664a16eebb

SHA512
4f94cc0d566d16a211e5ab7c4230b82f47fd09178aa0798a75940016493b66c412002d06a9af27f68a2bc0504173116c1eb1cea677e82e9d7b79671033e75f94

Download Submit
C:\Windows\system\GYuvLwy.exe

Filesize
1.9MB

MD5
acbc65b4f318c7469eecd4f8b0344501

SHA1
4f36b499114045de241e3e0746ec990334857a67

SHA256
a4c2f2c9bf5865c86e4c1acb1001e230299cb6ef3b9f5e0db1d72d56b7ce9667

SHA512
4b4b75cecfc4c3d05c632ac2b283df8969b49141868ebd70e4915c15c81af57a15e2964b8025a07a3a002f850c34883701b27c365d425e776cf614e3f8149a46

Download Submit
C:\Windows\system\HlAsijv.exe

Filesize
1.9MB

MD5
badda3431699877b0e11cc12d50e1d6b

SHA1
09c3c4aa6dd2b498a618367e1c2cac942b0e984f

SHA256
b50519c370a9943a7b43e44ae864892bb4c8368c48c831ccc406060e3f29423d

SHA512
028113ceabd5cec9a9269fb5f21345422a7c4b378a1e09a1d71ad0a731ef852591615446b762ca71d48851fc74cb1c7ffb65d70a0627b7b586d3bdb5ad0287a9

Download Submit
C:\Windows\system\IardeZE.exe

Filesize
1.9MB

MD5
54c651a6f12927969c12a3ba2408dd00

SHA1
465e0e63b85a8c8a075011c7309f72c107996883

SHA256
71edd6b5586cc4130b18a5cdde2e1db495032f8ddd5ce6d3d6cfdad053e1f11a

SHA512
e1f2cce9510c1e039d294cacc386aff8dff582144f75a653cbe35451219ff4a70196a360cec44a261bf3012a340e6c635995485a37817726ae59ae2b3ffa5d07

Download Submit
C:\Windows\system\JWtdAGc.exe

Filesize
1.9MB

MD5
d3b1cd23a69d62a17fd26c6d7968d150

SHA1
c766e929deb8d545bb3ca078261c5b96b09945df

SHA256
8efd0157aad1759785e643bd1f0746e53ff732ec284b0acd638a45de71895f17

SHA512
203deb1c250f826201c8018817cc6b5657fe5383a8ac246484617e29e0945d069498122d2d93c8fcb274c8160469dac269fbb6050f1d43b62e07c53fd9632199

Download Submit
C:\Windows\system\KgTMfWg.exe

Filesize
1.9MB

MD5
8764905d3613f64a572ca8b7ef6ceb6a

SHA1
608cd220c20e4f4d20933501d0e67f93b5a0fb5f

SHA256
061dfbaef86d2d618e37aeb9d2047468b4399dd473718bf3368bdf453a3a7b37

SHA512
5903b1c7552476d6d41dd7d9d77b6cb0784c5a4d6e6e65ebc14a5f89981bef1a3c19834f2b671c8a7f8a3aeef60af7c84e7ddd0e4e7ff96d0a44cdd314b41048

Download Submit
C:\Windows\system\LDZArfO.exe

Filesize
1.9MB

MD5
466193aa728a63ebcf8eb901495ff60e

SHA1
cebb9ac9e0e6c0e378e171103b122fa76a32b9d1

SHA256
19e72cfcf42854ab35ec46a8d13bd67bef4f7ef477d783dc3b1e3a7968ab8600

SHA512
8f5af72da96edf4ac1e0267e2cc9e43e587b2afe74b21271519e071a01a7729193759402dc9a19834fca2c08b3a854cd278cd4f9d1e3d87f6dfcce1a34b03b73

Download Submit
C:\Windows\system\NEqWqlJ.exe

Filesize
1.9MB

MD5
2db7a7f6b8b44e8d0b4154bdd531a41c

SHA1
fecd93c812b0a8b4a27718e1c99f34ef9fae39b0

SHA256
277f39cf3cd98de571f9bd25ff382888c01524b908a8d8338cae524ca7051023

SHA512
6764d5fa8b42a961d02a6b3125fac4688cb94e21e076ac02f6bf443bda1a05c0255001cb738d4cb3cfc69bdb2cefac652c12ea53f7e6811534f4aa045bed9091

Download Submit
C:\Windows\system\TmVbTCX.exe

Filesize
1.9MB

MD5
27a9520fe60d7b9142f846938775490c

SHA1
7fa852f30ede19361e42f3487c7b38a6b71fd532

SHA256
40515199115856ebf3160b13cc6cf5787c712323c92b41a2a0cd019616bc2d67

SHA512
17f1f567ad8061fcaece15c50b30e7fa5b7913d2c2703c66d3a7911325dc0e614b1311ad511c301ef449eae8ea43321cfbd0c425f6d31358d4f0aa9ba2113034

Download Submit
C:\Windows\system\VdpRMJC.exe

Filesize
1.9MB

MD5
435aef0a814a1bd140d4b557f4444758

SHA1
d6cfd74d2099e3ace8ef8487f51678ee32cf2461

SHA256
bc5ac4f17c47b1c80f8f1f8c0a32d6819b63cdeb147b792f3ff2d4686330adda

SHA512
650d9a1767d999be404a65067c6c0786789d8569baa2fd85b536559c72a35d158fbca5ee29a2c596e241763a9be70bb0e8ca071cad8874bde8515cfaae703e4d

Download Submit
C:\Windows\system\YCNvyrA.exe

Filesize
1.9MB

MD5
caaeb06456f15049c3a09a80c04ba864

SHA1
15d2b25ec9f64a2bb43874e2e6f7c388cea98dd2

SHA256
acaa8262cbf7f05b89ed805db95781ab01e709c4575c9c93e1a096f2cb79282a

SHA512
fb38e5f188bb166af5a94eabb9133800eeeff2c9e7174a788bf569b9cf4ca87d3aaac37ab8392dd620e4e9d3e07c088ab4179238812de5bbea80025a9f8a18ef

Download Submit
C:\Windows\system\YfkqlcK.exe

Filesize
1.9MB

MD5
75beffb0e5f01a3eafd897db2755aba8

SHA1
f91c5c72bafe0f7665b685fd0ec2e7e25f034b94

SHA256
d4d2e928bd2c3e71f6089b30340af78c64d7cb3f62740355f4ad978c16a0d20e

SHA512
b986ee52ad0a5dfcecd88832c7d172197638c9bef0b0a8569ce58cd729e15fb63e8eff60a67a8fcf9c226993f39d5105da82d39c97185b43f924f6801c7f4d4e

Download Submit
C:\Windows\system\cKMCcXV.exe

Filesize
1.9MB

MD5
690c0576f81bba25c8608f5a90151a08

SHA1
7c357eee62b10e83f07c94d9d6acf3bd0d05f95a

SHA256
3534ca9c6576d2c0cae2336ec0e41ffcf8ba9741f802cc65cfa0236659d9a9bf

SHA512
3b6c861d4a825db4f49df242fd2fde5831db367fe0275491570a59103cb493c1142af00ba9e284c7614a3607f94880a5953451fbab4a0a2af6bd3e91c8a6f8db

Download Submit
C:\Windows\system\eERpRbX.exe

Filesize
1.9MB

MD5
eb8098de31bcabee6a70b892d6d99e8c

SHA1
200156559644083b05fc44adf9bf0adc904f4b9f

SHA256
8426ff1d377c9f0ed119b63fef41a63fd9426951c502c82d61bc675ffefa43ff

SHA512
bafdfb488f9ad4e32141cdfd0f92c7f936f4ad6b3edc3714c59e242251a5b481bf74951e60f49a8683fd1912071130936bf2c63aa7ef58d5ddcbaa39014b9cda

Download Submit
C:\Windows\system\iEEqpQj.exe

Filesize
1.9MB

MD5
92fe59cbd8a85f8c513a15bec6954007

SHA1
a96039f49ed74dea21ef45e1282cd7117217a47e

SHA256
614e2b854ecddc98a6900c51d6d5587026f29c6f65a0dcfd7aebc519fc3fecb7

SHA512
e1fac7452105b90144e11b62f9aca75e491301ca0cc60a3afdec7de23e60c65df42897491bd4bdd4f9914298f2e6aac08e6c8903f27316b8c46182e831590e0c

Download Submit
C:\Windows\system\jJLsDsl.exe

Filesize
1.9MB

MD5
1ed14b66155ce93f285253094f426420

SHA1
e21549cd8e72b3967c0cd6014234767a309fd4b9

SHA256
16f615a30be2a912434235fe16c4e54fbef48e9505dcc58f4e59532824ab9dbe

SHA512
f3ae8faa047338f9f260a2775455c624c010916b4eb54ecce345a024e010cd6f4759dff4a0059095c96698849a615d327af6a2b5b886d0b0e05ae41447e045f6

Download Submit
C:\Windows\system\lIZQYiM.exe

Filesize
1.9MB

MD5
48f7f2926b4145b76b560622d4f2db98

SHA1
db48fa36b14d7da456e1e577be3cb1087182e77b

SHA256
71e1b25aeb1773fef6b1bd47ace1f6c55d03a4704f64d5d71ddde303fdf7bd5b

SHA512
a113e771aa3ec7d8f9162c1faa4037c1c04b891249ed09cd1eb0bf0d560d171411ff5515b1e2b63c533fdcfe77dc8d38c44118d2355afe1b6de93a1d5f166bbf

Download Submit
C:\Windows\system\lyICkKa.exe

Filesize
1.9MB

MD5
42f7338bd30c8bb0bf5e37ffb9fb5989

SHA1
529cfd73679d74cf336294173f7972123aa0136c

SHA256
f5f2d5a6c0abf6d909fc6c13867aed440aacf48790c81b6c55ceb44eb4499beb

SHA512
b06b2b8b9ec5d03ce841e97a6664b1ea26254ca3928c66b544f5618db7223e6cd3a04bb4700988d13c4d610eb74a87f410c939f6f9762f5394a2384cbd4932c9

Download Submit
C:\Windows\system\tSTtIVo.exe

Filesize
1.9MB

MD5
775055ec4893256a7519a061061467ca

SHA1
c7e27e09e7bbb76d9297312d5fa8564d7523ef0e

SHA256
f2fe6f2e978744418177265e87ec122d2ca923eab2c134a4d674a8be5ee48549

SHA512
1cb46741f7db697593990ff97581642f18d07e97d26df5849f02460f0a6ec67e50776303ca10fb1ab00898872880ffb043d0b06a56f9d0508f6081de603e7b74

Download Submit
C:\Windows\system\vmESiec.exe

Filesize
1.9MB

MD5
9f46ad9cdabe61e737f0e34190fc5a08

SHA1
b8cf969187c9f95aa639162388278bfd61603a2e

SHA256
dd1f9f07fbcaeb3ab19fcdbafb3e70cbc48bb8524e2d8630f80c646784fb31ff

SHA512
776c7402c46d2f6f422dd33808f56849565ab082dec0b9d0484efa5c9f901cc518875114cbc461d8d77319f712ba3e58b312af5b35538c853a49c17d57b28beb

Download Submit
C:\Windows\system\yeCfame.exe

Filesize
1.9MB

MD5
5217e3321cf243d84542e18960756b76

SHA1
53d6e4f46c5aae10d09550ddc29b0d87aaf43d9b

SHA256
bc4d4645491b953dceedd3e496f7f7bc388b70bcca1a5b8cbf70acea2a317177

SHA512
4eec43b4b0239b651761eaa15c5945fdb770ce09c14681c7cfa5ad891fdcba083e023a47d48e740b110006de8697068d18d47063a454b87b2414852999fd096e

Download Submit
\Windows\system\OQxTzWi.exe

Filesize
1.9MB

MD5
4141b4d911ad5dafbc01f9517475a588

SHA1
f30f050afad542b8c81b31aa741d3a204ecb7992

SHA256
49cf2c65299f6b2d5737b781bd7533778a6dabb42dafb726c7f1af7faffe62bc

SHA512
b32d1ccc6946c7c1ffea8bb0450b39e24faca3f8d4edf6e4a866afb644a680b3f88a39264ded85b37a4cc8ea790af941a47d9bf3eed2321f890c1d4df02971c8

Download Submit
\Windows\system\PanmCDk.exe

Filesize
1.9MB

MD5
4d48c2fde4b7389cae7fd1b9552ce7a2

SHA1
3a6e09c7c08ad2f4ec67cac2dfa6b54b54a40375

SHA256
d24c8ac0c25f84a16bd96a1d6d35c4135a24f9cfca23c06f1fec30e1d438256d

SHA512
1c1f211a274d10f89b3b76eddee7e5ea629e952b4430ac0430169f2576bb794a79979cb1c64c18544819694c9e55b759383edc0e037fd3ecf79a6fffdaf651ef

Download Submit
\Windows\system\YaARZsh.exe

Filesize
1.9MB

MD5
5b2d6c08fe880a0a6f8559c25f674e6b

SHA1
9be16eab600d9e875078048bc9c5387fd288bf39

SHA256
2182d0ab4859a82cf38a02f7b53b5d1569ea8033aa183cc7926df3329953f10d

SHA512
986cf5ea3edf57150351be21b4ae57738e31278ef42d024709631b862280e38e9bad3b96a1abb0fa8af7dca1c0bc7be7a4c514fad6674f640baaaf4092c74fb0

Download Submit
\Windows\system\kCLHVCz.exe

Filesize
1.9MB

MD5
ad211cc7c4f74c7ca5daa9b24502bba4

SHA1
7b4f3f3c128283028f499f15477a4dd9b7b08e47

SHA256
a8cfed3f4697a03e3b0ebf548a48ef5c73a4340be2c4da2c68bddcd3ae16030d

SHA512
7123e5b30b55be8776848fd203d00cd8d4f57ce9f230bb37b624631a98eb05f8b66a8d89331ea609fe1ffa95958c55d3ac6c76526e42a33cbc1dab6f78ec8509

Download Submit
\Windows\system\lqdSHEp.exe

Filesize
1.9MB

MD5
77ede9ca59d769e0ac060476cae38115

SHA1
c82abf1886d9656275ed8ecf99885e8f7eb3991f

SHA256
27ddd94d5b322e25c4dc2c5188dd45a1dcfdbed9bc10bf18d06ccd6dd1fc6a93

SHA512
6e31988608b20cd1140ce0addbc041ffe2141244640738e14f3a51b26a7159e6c895308fdceedc7527b6c634858f531c4883daaeb1247e18df5f21fd53d668d4

Download Submit
\Windows\system\wquvQLM.exe

Filesize
1.9MB

MD5
ba24811e2b1c52313353cfa20938c539

SHA1
f16e91c37991820d186cdfbf575eb12cc0719ec9

SHA256
a3ec6517185321721df30209eaa22d77fdc4a4a9a05c91bc3c740d1c2ba88bcf

SHA512
7fc7cd9606b912aee3406c18d8438eb18d723aebc37bb6a4b475db261e1ec68bfef48220caad4fbc6146daef6977dcf39afe70ef67f72cf2c030a0e6ba771906

Download Submit
\Windows\system\xitsUvZ.exe

Filesize
1.9MB

MD5
baa5b810fc2941fd1f568ba9effdc4d2

SHA1
116bd1402db0db470226c0614398d79d5d6c2ff8

SHA256
e8b3ef6c45d2a91123d30ade17cbc39d896335a6e5ab3d8da3e28b8ce8f0ec54

SHA512
be12daeb0fc6482dbf66593f43d26f54f90c8d9ab1826fa7d0d54304221e58f2be88b26e704416d38e15c7af775d85238813dc3c1ff088a416d0d2029360f7d1

Download Submit
memory/112-43-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/1232-15-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/1232-802-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/1784-58-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2168-754-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2168-0-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2168-1-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/2168-55-0x0000000003640000-0x0000000003A32000-memory.dmp

Filesize
3.9MB

Download
memory/2168-28-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2168-70-0x0000000003640000-0x0000000003A32000-memory.dmp

Filesize
3.9MB

Download
memory/2168-40-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2168-7-0x00000000030C0000-0x00000000034B2000-memory.dmp

Filesize
3.9MB

Download
memory/2168-60-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2168-45-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2168-77-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2276-76-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2460-50-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2540-29-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2600-41-0x000007FEF5760000-0x000007FEF60FD000-memory.dmp

Filesize
9.6MB

Download
memory/2600-31-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2600-362-0x000007FEF5760000-0x000007FEF60FD000-memory.dmp

Filesize
9.6MB

Download
memory/2600-39-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2600-38-0x000007FEF5760000-0x000007FEF60FD000-memory.dmp

Filesize
9.6MB

Download
memory/2600-35-0x0000000002330000-0x0000000002338000-memory.dmp

Filesize
32KB

Download
memory/2636-44-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2680-74-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-42-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download