xmrig | 40079724dbdf62f70139682c7b7e021d8b419c4de4a4771c37dd92b08707bd79

Analysis

max time kernel
133s
max time network
142s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 01:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
Size

2.2MB
MD5

0d2acde3160fbfbe2a155efd3260d00f
SHA1

e5e1a91bb672a6188d0705f1e9da3b049c2f2b13
SHA256

40079724dbdf62f70139682c7b7e021d8b419c4de4a4771c37dd92b08707bd79
SHA512

3fe38c41205a874c681efbcc2f365f17ff7ea14bf3beeeac9532d88fba273bbad779f92f09ff4cc739fbe493a3982a7fbde4642f5a919e16eaf56082337acacb
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfq:NAB9

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2640-218-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/2752-216-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2448-213-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2488-212-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2484-207-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2592-205-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2656-201-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/2544-200-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2640	KcZlUJV.exe
3016	kuxgzkg.exe
2544	TiDvqYt.exe
2656	nkWakJZ.exe
2592	akcChKq.exe
2484	xDIaJBf.exe
2488	dpAmfrN.exe
2448	VwMQySf.exe
2752	qshHsso.exe
1196	kmYDrRb.exe
2088	AVeNmhm.exe
2476	HJyRkOy.exe
1616	idvdyfL.exe
1668	mDzrjoc.exe
940	vJwmfxu.exe
2680	wDQHrUj.exe
2804	LfGCzAy.exe
2624	HYEHTqC.exe
1960	WzLmezN.exe
2504	hznBiha.exe
324	JWTqiin.exe
1236	VHOOEWg.exe
584	fjpOMiQ.exe
2944	SEIsYRt.exe
908	cjDEuHz.exe
2176	RpBBFjl.exe
772	RCGIUej.exe
1576	NshnUif.exe
1868	bbSbflz.exe
2792	DrEvvgU.exe
1528	LdTfXGJ.exe
3068	uBLArDk.exe
2028	SELhrJa.exe
784	AespRhg.exe
280	mnTpTeo.exe
832	zcItOuP.exe
412	higTqyF.exe
876	iRfQKZR.exe
1532	fARaZab.exe
776	yUIsxvj.exe
1832	WngKSci.exe
2264	qXIIDoH.exe
2132	eNUNUrL.exe
2992	HYuDKEu.exe
2316	tRzfjzj.exe
3040	NSlPRqC.exe
848	iWreVHx.exe
1076	CmcQsOd.exe
2876	jpAyJPG.exe
2660	pkNlFGn.exe
2952	hneJffB.exe
1208	axoFKBc.exe
1816	GdisKqM.exe
1800	bmGCXIQ.exe
2668	KIenUlX.exe
2472	JsNzefR.exe
1296	CXzOjpU.exe
1452	CADhTTf.exe
1200	eeCcYoZ.exe
2436	juykbHH.exe
1520	NOdEfkQ.exe
2252	bDHOkoq.exe
1428	tJnzWIw.exe
1088	rBQsHaR.exe

Loads dropped DLL 64 IoCs

pid	Process
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2640-218-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/memory/2752-216-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2448-213-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2488-212-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/2484-207-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/memory/2592-205-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2656-201-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/files/0x0006000000015605-171.dat	upx
behavioral1/files/0x0006000000015d0f-168.dat	upx
behavioral1/memory/2544-200-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/files/0x0006000000014de9-158.dat	upx
behavioral1/files/0x0006000000015cfe-153.dat	upx
behavioral1/files/0x0006000000015cce-145.dat	upx
behavioral1/files/0x0006000000015cee-144.dat	upx
behavioral1/files/0x0006000000015cb6-137.dat	upx
behavioral1/files/0x0006000000014b31-132.dat	upx
behavioral1/files/0x0006000000015c78-127.dat	upx
behavioral1/files/0x0006000000015c83-126.dat	upx
behavioral1/files/0x0007000000014abe-122.dat	upx
behavioral1/files/0x0006000000015c6b-117.dat	upx
behavioral1/files/0x0006000000015c3d-108.dat	upx
behavioral1/files/0x0006000000015626-101.dat	upx
behavioral1/files/0x00060000000155f7-92.dat	upx
behavioral1/files/0x00060000000155f3-84.dat	upx
behavioral1/files/0x000a000000014825-78.dat	upx
behavioral1/files/0x0006000000015018-75.dat	upx
behavioral1/files/0x00090000000146b8-68.dat	upx
behavioral1/files/0x000f000000005578-42.dat	upx
behavioral1/files/0x0007000000014667-40.dat	upx
behavioral1/files/0x0006000000015d07-161.dat	upx
behavioral1/files/0x0006000000015cf6-150.dat	upx
behavioral1/files/0x0006000000015c9f-135.dat	upx
behavioral1/files/0x0006000000015c52-114.dat	upx
behavioral1/files/0x0006000000015b6f-107.dat	upx
behavioral1/files/0x0006000000015616-99.dat	upx
behavioral1/files/0x00060000000155ed-83.dat	upx
behavioral1/files/0x0006000000014ef8-74.dat	upx
behavioral1/files/0x0006000000014b70-73.dat	upx
behavioral1/files/0x00090000000143ec-10.dat	upx
behavioral1/files/0x0007000000014af6-55.dat	upx
behavioral1/files/0x00070000000149f5-54.dat	upx
behavioral1/files/0x00070000000146a2-30.dat	upx
behavioral1/files/0x0008000000014539-29.dat	upx
behavioral1/memory/3016-28-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/files/0x000c0000000141c0-15.dat	upx
behavioral1/memory/2364-0-0x000000013FD70000-0x0000000140162000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mJRnspz.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\CjUIXwN.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\kydnnEv.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\GKhcMGH.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\JEQlSlx.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\MJxofIk.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\zmzmlpK.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\tYpOyeX.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\ahzXMRk.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\nSJHroD.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\eyeZbKi.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\Fmbepym.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\dhNtPey.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\alYxqVw.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\wggYWlg.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\kbkaRXQ.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\WFgEXOz.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\MmDojHq.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\bZsYpQg.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\vjnDbdE.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\wSycisL.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\WzZibxC.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\ieSwswG.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\JOqiccd.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\HJCfFvV.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\mELoSxs.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\AvGeuRB.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\ZTZRjuH.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\dJyfhTE.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\XGcmFBh.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\JZrbXis.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\fYphbYe.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\BqEYjAC.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\zznscMN.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\UYesnmm.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\wapbGJp.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\LfGCzAy.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\IcxmYAd.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\NrpgJQw.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\Nyzlulg.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\lCXKwsI.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\zspPvge.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\wNaUNgd.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\TTfuSod.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\bKlBQUD.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\pqGjjry.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\Gpybtyk.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\ktwhcFe.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\nkWakJZ.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\szbEUTQ.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\htcsOUA.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\PeuDbyQ.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\qiTGKNV.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\BQYvAMa.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\FzBPONS.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\XJcsoTL.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\qzUbkuV.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\xAaEbqF.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\itNNPVT.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\rilYXMN.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\sAluUWM.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\UCViRIm.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\zpovQZP.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
File created	C:\Windows\System\LqjVBnF.exe	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2372	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
Token: SeDebugPrivilege	2372	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2372	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	29
PID 2364 wrote to memory of 2372	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	29
PID 2364 wrote to memory of 2372	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	29
PID 2364 wrote to memory of 3016	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	30
PID 2364 wrote to memory of 3016	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	30
PID 2364 wrote to memory of 3016	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	30
PID 2364 wrote to memory of 2640	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	31
PID 2364 wrote to memory of 2640	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	31
PID 2364 wrote to memory of 2640	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	31
PID 2364 wrote to memory of 2544	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	32
PID 2364 wrote to memory of 2544	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	32
PID 2364 wrote to memory of 2544	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	32
PID 2364 wrote to memory of 2592	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	33
PID 2364 wrote to memory of 2592	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	33
PID 2364 wrote to memory of 2592	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	33
PID 2364 wrote to memory of 2656	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	34
PID 2364 wrote to memory of 2656	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	34
PID 2364 wrote to memory of 2656	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	34
PID 2364 wrote to memory of 2752	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	35
PID 2364 wrote to memory of 2752	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	35
PID 2364 wrote to memory of 2752	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	35
PID 2364 wrote to memory of 2484	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	36
PID 2364 wrote to memory of 2484	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	36
PID 2364 wrote to memory of 2484	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	36
PID 2364 wrote to memory of 2476	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	37
PID 2364 wrote to memory of 2476	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	37
PID 2364 wrote to memory of 2476	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	37
PID 2364 wrote to memory of 2488	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	38
PID 2364 wrote to memory of 2488	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	38
PID 2364 wrote to memory of 2488	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	38
PID 2364 wrote to memory of 2624	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	39
PID 2364 wrote to memory of 2624	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	39
PID 2364 wrote to memory of 2624	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	39
PID 2364 wrote to memory of 2448	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	40
PID 2364 wrote to memory of 2448	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	40
PID 2364 wrote to memory of 2448	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	40
PID 2364 wrote to memory of 2504	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	41
PID 2364 wrote to memory of 2504	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	41
PID 2364 wrote to memory of 2504	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	41
PID 2364 wrote to memory of 1196	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	42
PID 2364 wrote to memory of 1196	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	42
PID 2364 wrote to memory of 1196	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	42
PID 2364 wrote to memory of 2944	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	43
PID 2364 wrote to memory of 2944	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	43
PID 2364 wrote to memory of 2944	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	43
PID 2364 wrote to memory of 2088	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	44
PID 2364 wrote to memory of 2088	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	44
PID 2364 wrote to memory of 2088	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	44
PID 2364 wrote to memory of 2176	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	45
PID 2364 wrote to memory of 2176	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	45
PID 2364 wrote to memory of 2176	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	45
PID 2364 wrote to memory of 1616	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	46
PID 2364 wrote to memory of 1616	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	46
PID 2364 wrote to memory of 1616	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	46
PID 2364 wrote to memory of 772	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	47
PID 2364 wrote to memory of 772	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	47
PID 2364 wrote to memory of 772	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	47
PID 2364 wrote to memory of 1668	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	48
PID 2364 wrote to memory of 1668	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	48
PID 2364 wrote to memory of 1668	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	48
PID 2364 wrote to memory of 1576	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	49
PID 2364 wrote to memory of 1576	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	49
PID 2364 wrote to memory of 1576	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	49
PID 2364 wrote to memory of 940	2364	0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe	50

C:\Windows\System32\slsogk.exe
"C:\Windows\System32\slsogk.exe"
1⤵
PID:1564

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1968

C:\Users\Admin\AppData\Local\Temp\0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0d2acde3160fbfbe2a155efd3260d00f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- C:\Windows\System\kuxgzkg.exe
  C:\Windows\System\kuxgzkg.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\KcZlUJV.exe
  C:\Windows\System\KcZlUJV.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\TiDvqYt.exe
  C:\Windows\System\TiDvqYt.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\akcChKq.exe
  C:\Windows\System\akcChKq.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\nkWakJZ.exe
  C:\Windows\System\nkWakJZ.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\qshHsso.exe
  C:\Windows\System\qshHsso.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\xDIaJBf.exe
  C:\Windows\System\xDIaJBf.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\HJyRkOy.exe
  C:\Windows\System\HJyRkOy.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\dpAmfrN.exe
  C:\Windows\System\dpAmfrN.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\HYEHTqC.exe
  C:\Windows\System\HYEHTqC.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\VwMQySf.exe
  C:\Windows\System\VwMQySf.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\hznBiha.exe
  C:\Windows\System\hznBiha.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\kmYDrRb.exe
  C:\Windows\System\kmYDrRb.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\SEIsYRt.exe
  C:\Windows\System\SEIsYRt.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\AVeNmhm.exe
  C:\Windows\System\AVeNmhm.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\RpBBFjl.exe
  C:\Windows\System\RpBBFjl.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\idvdyfL.exe
  C:\Windows\System\idvdyfL.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\RCGIUej.exe
  C:\Windows\System\RCGIUej.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\mDzrjoc.exe
  C:\Windows\System\mDzrjoc.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\NshnUif.exe
  C:\Windows\System\NshnUif.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\vJwmfxu.exe
  C:\Windows\System\vJwmfxu.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\bbSbflz.exe
  C:\Windows\System\bbSbflz.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\wDQHrUj.exe
  C:\Windows\System\wDQHrUj.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\DrEvvgU.exe
  C:\Windows\System\DrEvvgU.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\LfGCzAy.exe
  C:\Windows\System\LfGCzAy.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\LdTfXGJ.exe
  C:\Windows\System\LdTfXGJ.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\WzLmezN.exe
  C:\Windows\System\WzLmezN.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\SELhrJa.exe
  C:\Windows\System\SELhrJa.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\JWTqiin.exe
  C:\Windows\System\JWTqiin.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\AespRhg.exe
  C:\Windows\System\AespRhg.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\VHOOEWg.exe
  C:\Windows\System\VHOOEWg.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\mnTpTeo.exe
  C:\Windows\System\mnTpTeo.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\fjpOMiQ.exe
  C:\Windows\System\fjpOMiQ.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\zcItOuP.exe
  C:\Windows\System\zcItOuP.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\cjDEuHz.exe
  C:\Windows\System\cjDEuHz.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\higTqyF.exe
  C:\Windows\System\higTqyF.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\uBLArDk.exe
  C:\Windows\System\uBLArDk.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\fARaZab.exe
  C:\Windows\System\fARaZab.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\iRfQKZR.exe
  C:\Windows\System\iRfQKZR.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\yUIsxvj.exe
  C:\Windows\System\yUIsxvj.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\WngKSci.exe
  C:\Windows\System\WngKSci.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\eNUNUrL.exe
  C:\Windows\System\eNUNUrL.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\qXIIDoH.exe
  C:\Windows\System\qXIIDoH.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\gBjKaAV.exe
  C:\Windows\System\gBjKaAV.exe
  2⤵
  PID:3056
- C:\Windows\System\HYuDKEu.exe
  C:\Windows\System\HYuDKEu.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\XhvlLCB.exe
  C:\Windows\System\XhvlLCB.exe
  2⤵
  PID:1164
- C:\Windows\System\tRzfjzj.exe
  C:\Windows\System\tRzfjzj.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\QMcEzgq.exe
  C:\Windows\System\QMcEzgq.exe
  2⤵
  PID:1808
- C:\Windows\System\NSlPRqC.exe
  C:\Windows\System\NSlPRqC.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\gsAQmGc.exe
  C:\Windows\System\gsAQmGc.exe
  2⤵
  PID:1976
- C:\Windows\System\iWreVHx.exe
  C:\Windows\System\iWreVHx.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\swUOHBJ.exe
  C:\Windows\System\swUOHBJ.exe
  2⤵
  PID:2288
- C:\Windows\System\CmcQsOd.exe
  C:\Windows\System\CmcQsOd.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\ULNDKJA.exe
  C:\Windows\System\ULNDKJA.exe
  2⤵
  PID:1692
- C:\Windows\System\jpAyJPG.exe
  C:\Windows\System\jpAyJPG.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\TUhyoIY.exe
  C:\Windows\System\TUhyoIY.exe
  2⤵
  PID:2716
- C:\Windows\System\pkNlFGn.exe
  C:\Windows\System\pkNlFGn.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\luWcpJx.exe
  C:\Windows\System\luWcpJx.exe
  2⤵
  PID:3032
- C:\Windows\System\hneJffB.exe
  C:\Windows\System\hneJffB.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\RFGoxfc.exe
  C:\Windows\System\RFGoxfc.exe
  2⤵
  PID:2500
- C:\Windows\System\axoFKBc.exe
  C:\Windows\System\axoFKBc.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\zcwDpoK.exe
  C:\Windows\System\zcwDpoK.exe
  2⤵
  PID:2696
- C:\Windows\System\GdisKqM.exe
  C:\Windows\System\GdisKqM.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\gKujSCN.exe
  C:\Windows\System\gKujSCN.exe
  2⤵
  PID:1436
- C:\Windows\System\bmGCXIQ.exe
  C:\Windows\System\bmGCXIQ.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\VlaWSmh.exe
  C:\Windows\System\VlaWSmh.exe
  2⤵
  PID:2008
- C:\Windows\System\KIenUlX.exe
  C:\Windows\System\KIenUlX.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\EvNLDnK.exe
  C:\Windows\System\EvNLDnK.exe
  2⤵
  PID:2864
- C:\Windows\System\JsNzefR.exe
  C:\Windows\System\JsNzefR.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\hKgIbZs.exe
  C:\Windows\System\hKgIbZs.exe
  2⤵
  PID:2732
- C:\Windows\System\CXzOjpU.exe
  C:\Windows\System\CXzOjpU.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\vSOWBoy.exe
  C:\Windows\System\vSOWBoy.exe
  2⤵
  PID:1620
- C:\Windows\System\CADhTTf.exe
  C:\Windows\System\CADhTTf.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\OOEZMBk.exe
  C:\Windows\System\OOEZMBk.exe
  2⤵
  PID:1672
- C:\Windows\System\eeCcYoZ.exe
  C:\Windows\System\eeCcYoZ.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\CsIHaSN.exe
  C:\Windows\System\CsIHaSN.exe
  2⤵
  PID:2676
- C:\Windows\System\juykbHH.exe
  C:\Windows\System\juykbHH.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\NpZRVtm.exe
  C:\Windows\System\NpZRVtm.exe
  2⤵
  PID:2800
- C:\Windows\System\NOdEfkQ.exe
  C:\Windows\System\NOdEfkQ.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\YQDcIJn.exe
  C:\Windows\System\YQDcIJn.exe
  2⤵
  PID:1552
- C:\Windows\System\bDHOkoq.exe
  C:\Windows\System\bDHOkoq.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\mpWXNHX.exe
  C:\Windows\System\mpWXNHX.exe
  2⤵
  PID:2820
- C:\Windows\System\tJnzWIw.exe
  C:\Windows\System\tJnzWIw.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\aoiRCGo.exe
  C:\Windows\System\aoiRCGo.exe
  2⤵
  PID:2344
- C:\Windows\System\rBQsHaR.exe
  C:\Windows\System\rBQsHaR.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\wokfwHa.exe
  C:\Windows\System\wokfwHa.exe
  2⤵
  PID:1072
- C:\Windows\System\MnrbVPJ.exe
  C:\Windows\System\MnrbVPJ.exe
  2⤵
  PID:2236
- C:\Windows\System\NifZrGg.exe
  C:\Windows\System\NifZrGg.exe
  2⤵
  PID:2336
- C:\Windows\System\HGVqjLh.exe
  C:\Windows\System\HGVqjLh.exe
  2⤵
  PID:2608
- C:\Windows\System\GyTobyA.exe
  C:\Windows\System\GyTobyA.exe
  2⤵
  PID:2136
- C:\Windows\System\eAWNPPQ.exe
  C:\Windows\System\eAWNPPQ.exe
  2⤵
  PID:696
- C:\Windows\System\tpDrWUi.exe
  C:\Windows\System\tpDrWUi.exe
  2⤵
  PID:2064
- C:\Windows\System\GLAsOdL.exe
  C:\Windows\System\GLAsOdL.exe
  2⤵
  PID:2188
- C:\Windows\System\eCwylcd.exe
  C:\Windows\System\eCwylcd.exe
  2⤵
  PID:1664
- C:\Windows\System\XEIVyrO.exe
  C:\Windows\System\XEIVyrO.exe
  2⤵
  PID:328
- C:\Windows\System\SaHsvLJ.exe
  C:\Windows\System\SaHsvLJ.exe
  2⤵
  PID:1792
- C:\Windows\System\QSZkfqp.exe
  C:\Windows\System\QSZkfqp.exe
  2⤵
  PID:2908
- C:\Windows\System\FXWEgpJ.exe
  C:\Windows\System\FXWEgpJ.exe
  2⤵
  PID:2616
- C:\Windows\System\dvbOsqD.exe
  C:\Windows\System\dvbOsqD.exe
  2⤵
  PID:1916
- C:\Windows\System\bZlVqct.exe
  C:\Windows\System\bZlVqct.exe
  2⤵
  PID:2704
- C:\Windows\System\JEQlSlx.exe
  C:\Windows\System\JEQlSlx.exe
  2⤵
  PID:2240
- C:\Windows\System\DOBIqsj.exe
  C:\Windows\System\DOBIqsj.exe
  2⤵
  PID:2808
- C:\Windows\System\XrcSJJV.exe
  C:\Windows\System\XrcSJJV.exe
  2⤵
  PID:2468
- C:\Windows\System\YWIKVXh.exe
  C:\Windows\System\YWIKVXh.exe
  2⤵
  PID:3084
- C:\Windows\System\uDhcmXX.exe
  C:\Windows\System\uDhcmXX.exe
  2⤵
  PID:3100
- C:\Windows\System\BKGqOWt.exe
  C:\Windows\System\BKGqOWt.exe
  2⤵
  PID:3116
- C:\Windows\System\Xpukefx.exe
  C:\Windows\System\Xpukefx.exe
  2⤵
  PID:3132
- C:\Windows\System\wphWaIX.exe
  C:\Windows\System\wphWaIX.exe
  2⤵
  PID:3332
- C:\Windows\System\woYNmFz.exe
  C:\Windows\System\woYNmFz.exe
  2⤵
  PID:3456
- C:\Windows\System\mzmhhOl.exe
  C:\Windows\System\mzmhhOl.exe
  2⤵
  PID:3476
- C:\Windows\System\YrWLOjl.exe
  C:\Windows\System\YrWLOjl.exe
  2⤵
  PID:3500
- C:\Windows\System\DFhWbNA.exe
  C:\Windows\System\DFhWbNA.exe
  2⤵
  PID:3516
- C:\Windows\System\LgEJmoP.exe
  C:\Windows\System\LgEJmoP.exe
  2⤵
  PID:3532
- C:\Windows\System\wAxgHhm.exe
  C:\Windows\System\wAxgHhm.exe
  2⤵
  PID:3548
- C:\Windows\System\AugjvNP.exe
  C:\Windows\System\AugjvNP.exe
  2⤵
  PID:3564
- C:\Windows\System\qYlFImf.exe
  C:\Windows\System\qYlFImf.exe
  2⤵
  PID:3584
- C:\Windows\System\jeAyJDN.exe
  C:\Windows\System\jeAyJDN.exe
  2⤵
  PID:3604
- C:\Windows\System\rcTQVMQ.exe
  C:\Windows\System\rcTQVMQ.exe
  2⤵
  PID:3632
- C:\Windows\System\azRMjJr.exe
  C:\Windows\System\azRMjJr.exe
  2⤵
  PID:3656
- C:\Windows\System\vfVFjkG.exe
  C:\Windows\System\vfVFjkG.exe
  2⤵
  PID:3672
- C:\Windows\System\kZxcZXp.exe
  C:\Windows\System\kZxcZXp.exe
  2⤵
  PID:3700
- C:\Windows\System\fCZMWRo.exe
  C:\Windows\System\fCZMWRo.exe
  2⤵
  PID:3716
- C:\Windows\System\VXgEurE.exe
  C:\Windows\System\VXgEurE.exe
  2⤵
  PID:3736
- C:\Windows\System\XVMRcun.exe
  C:\Windows\System\XVMRcun.exe
  2⤵
  PID:3752
- C:\Windows\System\uHpBdNO.exe
  C:\Windows\System\uHpBdNO.exe
  2⤵
  PID:3768
- C:\Windows\System\FOaHdqW.exe
  C:\Windows\System\FOaHdqW.exe
  2⤵
  PID:3788
- C:\Windows\System\KZHbjIW.exe
  C:\Windows\System\KZHbjIW.exe
  2⤵
  PID:3808
- C:\Windows\System\dhNtPey.exe
  C:\Windows\System\dhNtPey.exe
  2⤵
  PID:3824
- C:\Windows\System\ldmRsxp.exe
  C:\Windows\System\ldmRsxp.exe
  2⤵
  PID:3840
- C:\Windows\System\dhAKbLA.exe
  C:\Windows\System\dhAKbLA.exe
  2⤵
  PID:3856
- C:\Windows\System\iJemNTR.exe
  C:\Windows\System\iJemNTR.exe
  2⤵
  PID:3872
- C:\Windows\System\YCqxuRT.exe
  C:\Windows\System\YCqxuRT.exe
  2⤵
  PID:3888
- C:\Windows\System\ZnBgDpW.exe
  C:\Windows\System\ZnBgDpW.exe
  2⤵
  PID:3904
- C:\Windows\System\PsziufB.exe
  C:\Windows\System\PsziufB.exe
  2⤵
  PID:3920
- C:\Windows\System\vTlvPEj.exe
  C:\Windows\System\vTlvPEj.exe
  2⤵
  PID:3940
- C:\Windows\System\LYDFgqR.exe
  C:\Windows\System\LYDFgqR.exe
  2⤵
  PID:3956
- C:\Windows\System\FGpaMZr.exe
  C:\Windows\System\FGpaMZr.exe
  2⤵
  PID:3972
- C:\Windows\System\qfEdTbV.exe
  C:\Windows\System\qfEdTbV.exe
  2⤵
  PID:3988
- C:\Windows\System\zjXMRzz.exe
  C:\Windows\System\zjXMRzz.exe
  2⤵
  PID:4004
- C:\Windows\System\VGYOShz.exe
  C:\Windows\System\VGYOShz.exe
  2⤵
  PID:4020
- C:\Windows\System\LzlvvBT.exe
  C:\Windows\System\LzlvvBT.exe
  2⤵
  PID:4040
- C:\Windows\System\slNwjIE.exe
  C:\Windows\System\slNwjIE.exe
  2⤵
  PID:4056
- C:\Windows\System\VTfxIlT.exe
  C:\Windows\System\VTfxIlT.exe
  2⤵
  PID:4072
- C:\Windows\System\sRSBsaF.exe
  C:\Windows\System\sRSBsaF.exe
  2⤵
  PID:4088
- C:\Windows\System\eluAfDj.exe
  C:\Windows\System\eluAfDj.exe
  2⤵
  PID:2760
- C:\Windows\System\AKsRUDm.exe
  C:\Windows\System\AKsRUDm.exe
  2⤵
  PID:3112
- C:\Windows\System\xJBeUbL.exe
  C:\Windows\System\xJBeUbL.exe
  2⤵
  PID:892
- C:\Windows\System\Sochxdb.exe
  C:\Windows\System\Sochxdb.exe
  2⤵
  PID:3044
- C:\Windows\System\IcXlRzg.exe
  C:\Windows\System\IcXlRzg.exe
  2⤵
  PID:2340
- C:\Windows\System\YJaZNMi.exe
  C:\Windows\System\YJaZNMi.exe
  2⤵
  PID:2960
- C:\Windows\System\DjBNjko.exe
  C:\Windows\System\DjBNjko.exe
  2⤵
  PID:2728
- C:\Windows\System\XGcecQj.exe
  C:\Windows\System\XGcecQj.exe
  2⤵
  PID:2836
- C:\Windows\System\wlzLLAS.exe
  C:\Windows\System\wlzLLAS.exe
  2⤵
  PID:3156
- C:\Windows\System\lZMTelH.exe
  C:\Windows\System\lZMTelH.exe
  2⤵
  PID:3172
- C:\Windows\System\nMjYHfv.exe
  C:\Windows\System\nMjYHfv.exe
  2⤵
  PID:3188
- C:\Windows\System\bLTehZA.exe
  C:\Windows\System\bLTehZA.exe
  2⤵
  PID:1632
- C:\Windows\System\IufNobC.exe
  C:\Windows\System\IufNobC.exe
  2⤵
  PID:3212
- C:\Windows\System\bThJGVI.exe
  C:\Windows\System\bThJGVI.exe
  2⤵
  PID:3228
- C:\Windows\System\JMdICxc.exe
  C:\Windows\System\JMdICxc.exe
  2⤵
  PID:3244
- C:\Windows\System\vXMztrd.exe
  C:\Windows\System\vXMztrd.exe
  2⤵
  PID:3264
- C:\Windows\System\jaxgGpv.exe
  C:\Windows\System\jaxgGpv.exe
  2⤵
  PID:3280
- C:\Windows\System\fsBhQwS.exe
  C:\Windows\System\fsBhQwS.exe
  2⤵
  PID:3300
- C:\Windows\System\gsoXImP.exe
  C:\Windows\System\gsoXImP.exe
  2⤵
  PID:1900
- C:\Windows\System\tAVbzYv.exe
  C:\Windows\System\tAVbzYv.exe
  2⤵
  PID:2572
- C:\Windows\System\JtfGAzR.exe
  C:\Windows\System\JtfGAzR.exe
  2⤵
  PID:2932
- C:\Windows\System\aUEDfAN.exe
  C:\Windows\System\aUEDfAN.exe
  2⤵
  PID:2868
- C:\Windows\System\WpMWJKL.exe
  C:\Windows\System\WpMWJKL.exe
  2⤵
  PID:2548
- C:\Windows\System\ORjXPHe.exe
  C:\Windows\System\ORjXPHe.exe
  2⤵
  PID:2528
- C:\Windows\System\NYNzkgu.exe
  C:\Windows\System\NYNzkgu.exe
  2⤵
  PID:2456
- C:\Windows\System\tRWyGYi.exe
  C:\Windows\System\tRWyGYi.exe
  2⤵
  PID:2724
- C:\Windows\System\AtRzIef.exe
  C:\Windows\System\AtRzIef.exe
  2⤵
  PID:1572
- C:\Windows\System\igbwDZA.exe
  C:\Windows\System\igbwDZA.exe
  2⤵
  PID:320
- C:\Windows\System\vyoKVdh.exe
  C:\Windows\System\vyoKVdh.exe
  2⤵
  PID:2984
- C:\Windows\System\weUiXbS.exe
  C:\Windows\System\weUiXbS.exe
  2⤵
  PID:2388
- C:\Windows\System\NoVcBZl.exe
  C:\Windows\System\NoVcBZl.exe
  2⤵
  PID:1788
- C:\Windows\System\jBPDVXu.exe
  C:\Windows\System\jBPDVXu.exe
  2⤵
  PID:2512
- C:\Windows\System\YHjMgsk.exe
  C:\Windows\System\YHjMgsk.exe
  2⤵
  PID:1588
- C:\Windows\System\kHzcJvK.exe
  C:\Windows\System\kHzcJvK.exe
  2⤵
  PID:1132
- C:\Windows\System\GXyUMnY.exe
  C:\Windows\System\GXyUMnY.exe
  2⤵
  PID:1796
- C:\Windows\System\XImdyib.exe
  C:\Windows\System\XImdyib.exe
  2⤵
  PID:1860
- C:\Windows\System\gQlXYgj.exe
  C:\Windows\System\gQlXYgj.exe
  2⤵
  PID:3004
- C:\Windows\System\LdFSkqh.exe
  C:\Windows\System\LdFSkqh.exe
  2⤵
  PID:3468
- C:\Windows\System\JmRYeJx.exe
  C:\Windows\System\JmRYeJx.exe
  2⤵
  PID:3428
- C:\Windows\System\kduokIv.exe
  C:\Windows\System\kduokIv.exe
  2⤵
  PID:3440
- C:\Windows\System\dJyfhTE.exe
  C:\Windows\System\dJyfhTE.exe
  2⤵
  PID:3400
- C:\Windows\System\andHysL.exe
  C:\Windows\System\andHysL.exe
  2⤵
  PID:3508
- C:\Windows\System\COQBTfr.exe
  C:\Windows\System\COQBTfr.exe
  2⤵
  PID:3528
- C:\Windows\System\pxCzoGo.exe
  C:\Windows\System\pxCzoGo.exe
  2⤵
  PID:3572
- C:\Windows\System\ezwQmuP.exe
  C:\Windows\System\ezwQmuP.exe
  2⤵
  PID:2600
- C:\Windows\System\RhsdWuj.exe
  C:\Windows\System\RhsdWuj.exe
  2⤵
  PID:3624
- C:\Windows\System\wBxohLh.exe
  C:\Windows\System\wBxohLh.exe
  2⤵
  PID:3640
- C:\Windows\System\qtdrriS.exe
  C:\Windows\System\qtdrriS.exe
  2⤵
  PID:3648
- C:\Windows\System\NMWZuZY.exe
  C:\Windows\System\NMWZuZY.exe
  2⤵
  PID:3680
- C:\Windows\System\qTxRHsy.exe
  C:\Windows\System\qTxRHsy.exe
  2⤵
  PID:3708
- C:\Windows\System\HchMRcT.exe
  C:\Windows\System\HchMRcT.exe
  2⤵
  PID:3728
- C:\Windows\System\fBuECSG.exe
  C:\Windows\System\fBuECSG.exe
  2⤵
  PID:3744
- C:\Windows\System\lLKXOzx.exe
  C:\Windows\System\lLKXOzx.exe
  2⤵
  PID:3732
- C:\Windows\System\XKqNVcT.exe
  C:\Windows\System\XKqNVcT.exe
  2⤵
  PID:3820
- C:\Windows\System\RjLCPFo.exe
  C:\Windows\System\RjLCPFo.exe
  2⤵
  PID:3832
- C:\Windows\System\YlGAuwg.exe
  C:\Windows\System\YlGAuwg.exe
  2⤵
  PID:3896
- C:\Windows\System\XFwLtlV.exe
  C:\Windows\System\XFwLtlV.exe
  2⤵
  PID:3936
- C:\Windows\System\zRvFMez.exe
  C:\Windows\System\zRvFMez.exe
  2⤵
  PID:4000
- C:\Windows\System\ZWBiwed.exe
  C:\Windows\System\ZWBiwed.exe
  2⤵
  PID:3804
- C:\Windows\System\jAIfrqS.exe
  C:\Windows\System\jAIfrqS.exe
  2⤵
  PID:4028
- C:\Windows\System\XeJWJcy.exe
  C:\Windows\System\XeJWJcy.exe
  2⤵
  PID:3448
- C:\Windows\System\NaFYhoo.exe
  C:\Windows\System\NaFYhoo.exe
  2⤵
  PID:3616
- C:\Windows\System\jtSSdoM.exe
  C:\Windows\System\jtSSdoM.exe
  2⤵
  PID:3760
- C:\Windows\System\krPuYbO.exe
  C:\Windows\System\krPuYbO.exe
  2⤵
  PID:3928
- C:\Windows\System\wAxMXgm.exe
  C:\Windows\System\wAxMXgm.exe
  2⤵
  PID:936
- C:\Windows\System\jubWiAo.exe
  C:\Windows\System\jubWiAo.exe
  2⤵
  PID:2708
- C:\Windows\System\yrYAILr.exe
  C:\Windows\System\yrYAILr.exe
  2⤵
  PID:3376
- C:\Windows\System\kYtBtFf.exe
  C:\Windows\System\kYtBtFf.exe
  2⤵
  PID:3684
- C:\Windows\System\lpXyalb.exe
  C:\Windows\System\lpXyalb.exe
  2⤵
  PID:1852
- C:\Windows\System\yaMfeWg.exe
  C:\Windows\System\yaMfeWg.exe
  2⤵
  PID:2904
- C:\Windows\System\kTXLzXR.exe
  C:\Windows\System\kTXLzXR.exe
  2⤵
  PID:3348
- C:\Windows\System\uoCnRum.exe
  C:\Windows\System\uoCnRum.exe
  2⤵
  PID:1536
- C:\Windows\System\NnFJzeH.exe
  C:\Windows\System\NnFJzeH.exe
  2⤵
  PID:3432
- C:\Windows\System\EKXSPZl.exe
  C:\Windows\System\EKXSPZl.exe
  2⤵
  PID:3488
- C:\Windows\System\YtFFaDW.exe
  C:\Windows\System\YtFFaDW.exe
  2⤵
  PID:3592
- C:\Windows\System\kdXnNgr.exe
  C:\Windows\System\kdXnNgr.exe
  2⤵
  PID:3652
- C:\Windows\System\vWSaNuF.exe
  C:\Windows\System\vWSaNuF.exe
  2⤵
  PID:3816
- C:\Windows\System\HLkxHYY.exe
  C:\Windows\System\HLkxHYY.exe
  2⤵
  PID:3996
- C:\Windows\System\RkyZqaV.exe
  C:\Windows\System\RkyZqaV.exe
  2⤵
  PID:3916
- C:\Windows\System\NOowqLB.exe
  C:\Windows\System\NOowqLB.exe
  2⤵
  PID:4012
- C:\Windows\System\oNVtOSn.exe
  C:\Windows\System\oNVtOSn.exe
  2⤵
  PID:4080
- C:\Windows\System\GPuebXe.exe
  C:\Windows\System\GPuebXe.exe
  2⤵
  PID:2036
- C:\Windows\System\XIvHryG.exe
  C:\Windows\System\XIvHryG.exe
  2⤵
  PID:3140
- C:\Windows\System\polXdRb.exe
  C:\Windows\System\polXdRb.exe
  2⤵
  PID:788
- C:\Windows\System\FMbNpKQ.exe
  C:\Windows\System\FMbNpKQ.exe
  2⤵
  PID:3256
- C:\Windows\System\cbeyBqc.exe
  C:\Windows\System\cbeyBqc.exe
  2⤵
  PID:2688
- C:\Windows\System\QDQDFem.exe
  C:\Windows\System\QDQDFem.exe
  2⤵
  PID:2712
- C:\Windows\System\JbqrgjT.exe
  C:\Windows\System\JbqrgjT.exe
  2⤵
  PID:3204
- C:\Windows\System\aFBTFon.exe
  C:\Windows\System\aFBTFon.exe
  2⤵
  PID:3276
- C:\Windows\System\qGjuNDn.exe
  C:\Windows\System\qGjuNDn.exe
  2⤵
  PID:3324
- C:\Windows\System\GrexYJo.exe
  C:\Windows\System\GrexYJo.exe
  2⤵
  PID:600
- C:\Windows\System\EIZfARh.exe
  C:\Windows\System\EIZfARh.exe
  2⤵
  PID:2736
- C:\Windows\System\BbJvSuB.exe
  C:\Windows\System\BbJvSuB.exe
  2⤵
  PID:1824
- C:\Windows\System\MNmsKvp.exe
  C:\Windows\System\MNmsKvp.exe
  2⤵
  PID:3124
- C:\Windows\System\EVjyRSn.exe
  C:\Windows\System\EVjyRSn.exe
  2⤵
  PID:2896
- C:\Windows\System\rzvvdEj.exe
  C:\Windows\System\rzvvdEj.exe
  2⤵
  PID:3420
- C:\Windows\System\XxugCfE.exe
  C:\Windows\System\XxugCfE.exe
  2⤵
  PID:2584
- C:\Windows\System\xrYLbiz.exe
  C:\Windows\System\xrYLbiz.exe
  2⤵
  PID:3800
- C:\Windows\System\tKznfAy.exe
  C:\Windows\System\tKznfAy.exe
  2⤵
  PID:2400
- C:\Windows\System\LUDWAXc.exe
  C:\Windows\System\LUDWAXc.exe
  2⤵
  PID:2348
- C:\Windows\System\lskfvZu.exe
  C:\Windows\System\lskfvZu.exe
  2⤵
  PID:2052
- C:\Windows\System\nrKhYtD.exe
  C:\Windows\System\nrKhYtD.exe
  2⤵
  PID:3696
- C:\Windows\System\JMxZJTZ.exe
  C:\Windows\System\JMxZJTZ.exe
  2⤵
  PID:2516
- C:\Windows\System\xUROIcY.exe
  C:\Windows\System\xUROIcY.exe
  2⤵
  PID:1104
- C:\Windows\System\BGSoSFp.exe
  C:\Windows\System\BGSoSFp.exe
  2⤵
  PID:3252
- C:\Windows\System\WDPpNkZ.exe
  C:\Windows\System\WDPpNkZ.exe
  2⤵
  PID:2160
- C:\Windows\System\XSNWgLR.exe
  C:\Windows\System\XSNWgLR.exe
  2⤵
  PID:2768
- C:\Windows\System\ABTiogi.exe
  C:\Windows\System\ABTiogi.exe
  2⤵
  PID:3224
- C:\Windows\System\DdxnWmg.exe
  C:\Windows\System\DdxnWmg.exe
  2⤵
  PID:1116
- C:\Windows\System\MXibwIa.exe
  C:\Windows\System\MXibwIa.exe
  2⤵
  PID:3796
- C:\Windows\System\WmSpzNf.exe
  C:\Windows\System\WmSpzNf.exe
  2⤵
  PID:3600
- C:\Windows\System\AvvchfW.exe
  C:\Windows\System\AvvchfW.exe
  2⤵
  PID:3496
- C:\Windows\System\gcabYLV.exe
  C:\Windows\System\gcabYLV.exe
  2⤵
  PID:3968
- C:\Windows\System\nzWcptp.exe
  C:\Windows\System\nzWcptp.exe
  2⤵
  PID:1220
- C:\Windows\System\kJAqDWY.exe
  C:\Windows\System\kJAqDWY.exe
  2⤵
  PID:3260
- C:\Windows\System\skxJupX.exe
  C:\Windows\System\skxJupX.exe
  2⤵
  PID:2828
- C:\Windows\System\exGqgmp.exe
  C:\Windows\System\exGqgmp.exe
  2⤵
  PID:3128
- C:\Windows\System\aRIupsX.exe
  C:\Windows\System\aRIupsX.exe
  2⤵
  PID:1512
- C:\Windows\System\PvBdffq.exe
  C:\Windows\System\PvBdffq.exe
  2⤵
  PID:1604
- C:\Windows\System\GkrFuTr.exe
  C:\Windows\System\GkrFuTr.exe
  2⤵
  PID:3328
- C:\Windows\System\TQiWHMA.exe
  C:\Windows\System\TQiWHMA.exe
  2⤵
  PID:3912
- C:\Windows\System\cRvQAVE.exe
  C:\Windows\System\cRvQAVE.exe
  2⤵
  PID:2168
- C:\Windows\System\gTQwGZq.exe
  C:\Windows\System\gTQwGZq.exe
  2⤵
  PID:2852
- C:\Windows\System\ESjgBhW.exe
  C:\Windows\System\ESjgBhW.exe
  2⤵
  PID:3712
- C:\Windows\System\wojMVSo.exe
  C:\Windows\System\wojMVSo.exe
  2⤵
  PID:2628
- C:\Windows\System\wypwIDR.exe
  C:\Windows\System\wypwIDR.exe
  2⤵
  PID:1804
- C:\Windows\System\weAdEiv.exe
  C:\Windows\System\weAdEiv.exe
  2⤵
  PID:3576
- C:\Windows\System\pAuWeNf.exe
  C:\Windows\System\pAuWeNf.exe
  2⤵
  PID:2180
- C:\Windows\System\FWHxXgG.exe
  C:\Windows\System\FWHxXgG.exe
  2⤵
  PID:3108
- C:\Windows\System\ensuvNm.exe
  C:\Windows\System\ensuvNm.exe
  2⤵
  PID:3168
- C:\Windows\System\PUllvbi.exe
  C:\Windows\System\PUllvbi.exe
  2⤵
  PID:3884
- C:\Windows\System\NMJfVIZ.exe
  C:\Windows\System\NMJfVIZ.exe
  2⤵
  PID:1968
- C:\Windows\System\PQZxiGp.exe
  C:\Windows\System\PQZxiGp.exe
  2⤵
  PID:2884
- C:\Windows\System\CXZzdnj.exe
  C:\Windows\System\CXZzdnj.exe
  2⤵
  PID:2284
- C:\Windows\System\wfxTCMc.exe
  C:\Windows\System\wfxTCMc.exe
  2⤵
  PID:3664
- C:\Windows\System\ydnWwtU.exe
  C:\Windows\System\ydnWwtU.exe
  2⤵
  PID:1828
- C:\Windows\System\civIITj.exe
  C:\Windows\System\civIITj.exe
  2⤵
  PID:1764
- C:\Windows\System\IhEkbBj.exe
  C:\Windows\System\IhEkbBj.exe
  2⤵
  PID:2564
- C:\Windows\System\NYNhYPs.exe
  C:\Windows\System\NYNhYPs.exe
  2⤵
  PID:3544
- C:\Windows\System\bzakSWA.exe
  C:\Windows\System\bzakSWA.exe
  2⤵
  PID:380
- C:\Windows\System\KJISYYT.exe
  C:\Windows\System\KJISYYT.exe
  2⤵
  PID:3984
- C:\Windows\System\Rsoehxe.exe
  C:\Windows\System\Rsoehxe.exe
  2⤵
  PID:3404
- C:\Windows\System\DFjneVn.exe
  C:\Windows\System\DFjneVn.exe
  2⤵
  PID:4108
- C:\Windows\System\LcFdioh.exe
  C:\Windows\System\LcFdioh.exe
  2⤵
  PID:4124
- C:\Windows\System\ZlhHjRp.exe
  C:\Windows\System\ZlhHjRp.exe
  2⤵
  PID:4140
- C:\Windows\System\ZAdGEGu.exe
  C:\Windows\System\ZAdGEGu.exe
  2⤵
  PID:4156
- C:\Windows\System\eegyECx.exe
  C:\Windows\System\eegyECx.exe
  2⤵
  PID:4172
- C:\Windows\System\EfIUMlV.exe
  C:\Windows\System\EfIUMlV.exe
  2⤵
  PID:4188
- C:\Windows\System\CedTgwr.exe
  C:\Windows\System\CedTgwr.exe
  2⤵
  PID:4204
- C:\Windows\System\tZgrzit.exe
  C:\Windows\System\tZgrzit.exe
  2⤵
  PID:4220
- C:\Windows\System\xdLcKkX.exe
  C:\Windows\System\xdLcKkX.exe
  2⤵
  PID:4236
- C:\Windows\System\pvUawHQ.exe
  C:\Windows\System\pvUawHQ.exe
  2⤵
  PID:4252
- C:\Windows\System\ymlVEZh.exe
  C:\Windows\System\ymlVEZh.exe
  2⤵
  PID:4268
- C:\Windows\System\rumtrCM.exe
  C:\Windows\System\rumtrCM.exe
  2⤵
  PID:4284
- C:\Windows\System\NngeLwx.exe
  C:\Windows\System\NngeLwx.exe
  2⤵
  PID:4304
- C:\Windows\System\boaCabx.exe
  C:\Windows\System\boaCabx.exe
  2⤵
  PID:4320
- C:\Windows\System\VNUGGeC.exe
  C:\Windows\System\VNUGGeC.exe
  2⤵
  PID:4336
- C:\Windows\System\zrfYZZN.exe
  C:\Windows\System\zrfYZZN.exe
  2⤵
  PID:4352
- C:\Windows\System\PLsRqcv.exe
  C:\Windows\System\PLsRqcv.exe
  2⤵
  PID:4368
- C:\Windows\System\EzoyZGf.exe
  C:\Windows\System\EzoyZGf.exe
  2⤵
  PID:4384
- C:\Windows\System\xoJyMjM.exe
  C:\Windows\System\xoJyMjM.exe
  2⤵
  PID:4400
- C:\Windows\System\LSiYvWb.exe
  C:\Windows\System\LSiYvWb.exe
  2⤵
  PID:4416
- C:\Windows\System\pcZymOq.exe
  C:\Windows\System\pcZymOq.exe
  2⤵
  PID:4432
- C:\Windows\System\mkPwSDr.exe
  C:\Windows\System\mkPwSDr.exe
  2⤵
  PID:4448
- C:\Windows\System\rmUKsns.exe
  C:\Windows\System\rmUKsns.exe
  2⤵
  PID:4468
- C:\Windows\System\ZYzplPA.exe
  C:\Windows\System\ZYzplPA.exe
  2⤵
  PID:4484
- C:\Windows\System\ByYotfy.exe
  C:\Windows\System\ByYotfy.exe
  2⤵
  PID:4500
- C:\Windows\System\XGeTOkc.exe
  C:\Windows\System\XGeTOkc.exe
  2⤵
  PID:4516
- C:\Windows\System\PjFdrFr.exe
  C:\Windows\System\PjFdrFr.exe
  2⤵
  PID:4532
- C:\Windows\System\DtizaEL.exe
  C:\Windows\System\DtizaEL.exe
  2⤵
  PID:4548
- C:\Windows\System\phQSSXr.exe
  C:\Windows\System\phQSSXr.exe
  2⤵
  PID:4564
- C:\Windows\System\fRQilZC.exe
  C:\Windows\System\fRQilZC.exe
  2⤵
  PID:4580
- C:\Windows\System\kFfsJjU.exe
  C:\Windows\System\kFfsJjU.exe
  2⤵
  PID:4596
- C:\Windows\System\OKXHvRb.exe
  C:\Windows\System\OKXHvRb.exe
  2⤵
  PID:4612
- C:\Windows\System\GObAmtW.exe
  C:\Windows\System\GObAmtW.exe
  2⤵
  PID:4628
- C:\Windows\System\WAzNKvi.exe
  C:\Windows\System\WAzNKvi.exe
  2⤵
  PID:4644
- C:\Windows\System\msRpTbf.exe
  C:\Windows\System\msRpTbf.exe
  2⤵
  PID:4660
- C:\Windows\System\FZWBGOD.exe
  C:\Windows\System\FZWBGOD.exe
  2⤵
  PID:4676
- C:\Windows\System\Osyuwwo.exe
  C:\Windows\System\Osyuwwo.exe
  2⤵
  PID:4692
- C:\Windows\System\EUZmzeV.exe
  C:\Windows\System\EUZmzeV.exe
  2⤵
  PID:4708
- C:\Windows\System\fqyoBMM.exe
  C:\Windows\System\fqyoBMM.exe
  2⤵
  PID:4724
- C:\Windows\System\IbynCVJ.exe
  C:\Windows\System\IbynCVJ.exe
  2⤵
  PID:4744
- C:\Windows\System\PsztdIq.exe
  C:\Windows\System\PsztdIq.exe
  2⤵
  PID:4760
- C:\Windows\System\QFRupZN.exe
  C:\Windows\System\QFRupZN.exe
  2⤵
  PID:4776
- C:\Windows\System\TTfuSod.exe
  C:\Windows\System\TTfuSod.exe
  2⤵
  PID:4792
- C:\Windows\System\FIdzjIR.exe
  C:\Windows\System\FIdzjIR.exe
  2⤵
  PID:4812
- C:\Windows\System\fKiEWEn.exe
  C:\Windows\System\fKiEWEn.exe
  2⤵
  PID:4836
- C:\Windows\System\fwOuHOV.exe
  C:\Windows\System\fwOuHOV.exe
  2⤵
  PID:4852
- C:\Windows\System\mXPtpdi.exe
  C:\Windows\System\mXPtpdi.exe
  2⤵
  PID:4868
- C:\Windows\System\nLgiAMZ.exe
  C:\Windows\System\nLgiAMZ.exe
  2⤵
  PID:4884
- C:\Windows\System\MgttjRT.exe
  C:\Windows\System\MgttjRT.exe
  2⤵
  PID:4900
- C:\Windows\System\GkWRajk.exe
  C:\Windows\System\GkWRajk.exe
  2⤵
  PID:4916
- C:\Windows\System\wJmXIlc.exe
  C:\Windows\System\wJmXIlc.exe
  2⤵
  PID:4932
- C:\Windows\System\WDHFrnU.exe
  C:\Windows\System\WDHFrnU.exe
  2⤵
  PID:4948
- C:\Windows\System\RKAWULM.exe
  C:\Windows\System\RKAWULM.exe
  2⤵
  PID:4964
- C:\Windows\System\tcWGOsl.exe
  C:\Windows\System\tcWGOsl.exe
  2⤵
  PID:4980
- C:\Windows\System\CJssATr.exe
  C:\Windows\System\CJssATr.exe
  2⤵
  PID:4996
- C:\Windows\System\WFeskOB.exe
  C:\Windows\System\WFeskOB.exe
  2⤵
  PID:5016
- C:\Windows\System\vUCDXkw.exe
  C:\Windows\System\vUCDXkw.exe
  2⤵
  PID:5032
- C:\Windows\System\ibUBavX.exe
  C:\Windows\System\ibUBavX.exe
  2⤵
  PID:5048
- C:\Windows\System\CZdwKXo.exe
  C:\Windows\System\CZdwKXo.exe
  2⤵
  PID:5064
- C:\Windows\System\dqWxhtc.exe
  C:\Windows\System\dqWxhtc.exe
  2⤵
  PID:5080
- C:\Windows\System\cCHpETW.exe
  C:\Windows\System\cCHpETW.exe
  2⤵
  PID:5096
- C:\Windows\System\BmhHXdD.exe
  C:\Windows\System\BmhHXdD.exe
  2⤵
  PID:5112
- C:\Windows\System\WzjpOHZ.exe
  C:\Windows\System\WzjpOHZ.exe
  2⤵
  PID:4132
- C:\Windows\System\qdXdMIW.exe
  C:\Windows\System\qdXdMIW.exe
  2⤵
  PID:900
- C:\Windows\System\lGkSfyr.exe
  C:\Windows\System\lGkSfyr.exe
  2⤵
  PID:4168
- C:\Windows\System\NXLIIpE.exe
  C:\Windows\System\NXLIIpE.exe
  2⤵
  PID:4260
- C:\Windows\System\YlwGciQ.exe
  C:\Windows\System\YlwGciQ.exe
  2⤵
  PID:4924
- C:\Windows\System\CrJRMJC.exe
  C:\Windows\System\CrJRMJC.exe
  2⤵
  PID:4992
- C:\Windows\System\qKaMRyv.exe
  C:\Windows\System\qKaMRyv.exe
  2⤵
  PID:960
- C:\Windows\System\ZmTCrEg.exe
  C:\Windows\System\ZmTCrEg.exe
  2⤵
  PID:4672
- C:\Windows\System\stNNWLe.exe
  C:\Windows\System\stNNWLe.exe
  2⤵
  PID:5092
- C:\Windows\System\XUGCKsL.exe
  C:\Windows\System\XUGCKsL.exe
  2⤵
  PID:2596
- C:\Windows\System\sEnTLAK.exe
  C:\Windows\System\sEnTLAK.exe
  2⤵
  PID:5012
- C:\Windows\System\ieXdWwk.exe
  C:\Windows\System\ieXdWwk.exe
  2⤵
  PID:5104
- C:\Windows\System\NjQXHBE.exe
  C:\Windows\System\NjQXHBE.exe
  2⤵
  PID:4380
- C:\Windows\System\ZAjyzNN.exe
  C:\Windows\System\ZAjyzNN.exe
  2⤵
  PID:4480
- C:\Windows\System\dNUepDC.exe
  C:\Windows\System\dNUepDC.exe
  2⤵
  PID:4604
- C:\Windows\System\uhjnAwq.exe
  C:\Windows\System\uhjnAwq.exe
  2⤵
  PID:4700
- C:\Windows\System\xSVdhva.exe
  C:\Windows\System\xSVdhva.exe
  2⤵
  PID:4808
- C:\Windows\System\EGEsNMf.exe
  C:\Windows\System\EGEsNMf.exe
  2⤵
  PID:4912
- C:\Windows\System\Utmprow.exe
  C:\Windows\System\Utmprow.exe
  2⤵
  PID:5040
- C:\Windows\System\CBLtzXM.exe
  C:\Windows\System\CBLtzXM.exe
  2⤵
  PID:4136
- C:\Windows\System\CbTwwCX.exe
  C:\Windows\System\CbTwwCX.exe
  2⤵
  PID:4292
- C:\Windows\System\JKVdyZT.exe
  C:\Windows\System\JKVdyZT.exe
  2⤵
  PID:3236
- C:\Windows\System\NHUUqAv.exe
  C:\Windows\System\NHUUqAv.exe
  2⤵
  PID:4152
- C:\Windows\System\Ltzsmsn.exe
  C:\Windows\System\Ltzsmsn.exe
  2⤵
  PID:1204
- C:\Windows\System\CCfwcgC.exe
  C:\Windows\System\CCfwcgC.exe
  2⤵
  PID:4280
- C:\Windows\System\liofiza.exe
  C:\Windows\System\liofiza.exe
  2⤵
  PID:4216
- C:\Windows\System\Dhjfimx.exe
  C:\Windows\System\Dhjfimx.exe
  2⤵
  PID:4392
- C:\Windows\System\KtpfrRM.exe
  C:\Windows\System\KtpfrRM.exe
  2⤵
  PID:4396
- C:\Windows\System\IshcpPz.exe
  C:\Windows\System\IshcpPz.exe
  2⤵
  PID:4456
- C:\Windows\System\EOHrWcQ.exe
  C:\Windows\System\EOHrWcQ.exe
  2⤵
  PID:4652
- C:\Windows\System\cJxFkjx.exe
  C:\Windows\System\cJxFkjx.exe
  2⤵
  PID:4824
- C:\Windows\System\khRfLkf.exe
  C:\Windows\System\khRfLkf.exe
  2⤵
  PID:4756
- C:\Windows\System\uTAwmkM.exe
  C:\Windows\System\uTAwmkM.exe
  2⤵
  PID:4832
- C:\Windows\System\iJgMePq.exe
  C:\Windows\System\iJgMePq.exe
  2⤵
  PID:4896
- C:\Windows\System\EHfvSDG.exe
  C:\Windows\System\EHfvSDG.exe
  2⤵
  PID:5056
- C:\Windows\System\hTxwigx.exe
  C:\Windows\System\hTxwigx.exe
  2⤵
  PID:4576
- C:\Windows\System\igkByNv.exe
  C:\Windows\System\igkByNv.exe
  2⤵
  PID:5148
- C:\Windows\System\zluGtTs.exe
  C:\Windows\System\zluGtTs.exe
  2⤵
  PID:5168
- C:\Windows\System\wxQKDyh.exe
  C:\Windows\System\wxQKDyh.exe
  2⤵
  PID:5236
- C:\Windows\System\XnAtoVF.exe
  C:\Windows\System\XnAtoVF.exe
  2⤵
  PID:5308
- C:\Windows\System\lJBBofm.exe
  C:\Windows\System\lJBBofm.exe
  2⤵
  PID:5336
- C:\Windows\System\QqAObko.exe
  C:\Windows\System\QqAObko.exe
  2⤵
  PID:5352
- C:\Windows\System\OgQjmXD.exe
  C:\Windows\System\OgQjmXD.exe
  2⤵
  PID:5392
- C:\Windows\System\PwRmHUj.exe
  C:\Windows\System\PwRmHUj.exe
  2⤵
  PID:5408
- C:\Windows\System\AaQnVLr.exe
  C:\Windows\System\AaQnVLr.exe
  2⤵
  PID:5596
- C:\Windows\System\XFUENrF.exe
  C:\Windows\System\XFUENrF.exe
  2⤵
  PID:5628
- C:\Windows\System\jDVYNMr.exe
  C:\Windows\System\jDVYNMr.exe
  2⤵
  PID:5648
- C:\Windows\System\MWtqCJE.exe
  C:\Windows\System\MWtqCJE.exe
  2⤵
  PID:5664
- C:\Windows\System\AdFZico.exe
  C:\Windows\System\AdFZico.exe
  2⤵
  PID:5680
- C:\Windows\System\AcTeALV.exe
  C:\Windows\System\AcTeALV.exe
  2⤵
  PID:5696
- C:\Windows\System\eWeeHTZ.exe
  C:\Windows\System\eWeeHTZ.exe
  2⤵
  PID:5712
- C:\Windows\System\EtMXaQQ.exe
  C:\Windows\System\EtMXaQQ.exe
  2⤵
  PID:5728
- C:\Windows\System\uYQmONv.exe
  C:\Windows\System\uYQmONv.exe
  2⤵
  PID:5744
- C:\Windows\System\XQPsxIC.exe
  C:\Windows\System\XQPsxIC.exe
  2⤵
  PID:5764
- C:\Windows\System\oXgZoju.exe
  C:\Windows\System\oXgZoju.exe
  2⤵
  PID:5780
- C:\Windows\System\jRJKsHa.exe
  C:\Windows\System\jRJKsHa.exe
  2⤵
  PID:5796
- C:\Windows\System\pQxuRhJ.exe
  C:\Windows\System\pQxuRhJ.exe
  2⤵
  PID:5816
- C:\Windows\System\cLyyfvf.exe
  C:\Windows\System\cLyyfvf.exe
  2⤵
  PID:5832
- C:\Windows\System\UczBEFu.exe
  C:\Windows\System\UczBEFu.exe
  2⤵
  PID:5868
- C:\Windows\System\roTaWeN.exe
  C:\Windows\System\roTaWeN.exe
  2⤵
  PID:5888
- C:\Windows\System\PoGhtIj.exe
  C:\Windows\System\PoGhtIj.exe
  2⤵
  PID:5904
- C:\Windows\System\vBlBDlO.exe
  C:\Windows\System\vBlBDlO.exe
  2⤵
  PID:5920
- C:\Windows\System\SmiXzcj.exe
  C:\Windows\System\SmiXzcj.exe
  2⤵
  PID:5936
- C:\Windows\System\NgsPVTP.exe
  C:\Windows\System\NgsPVTP.exe
  2⤵
  PID:5952
- C:\Windows\System\SicvSmL.exe
  C:\Windows\System\SicvSmL.exe
  2⤵
  PID:5968
- C:\Windows\System\SSuYHxD.exe
  C:\Windows\System\SSuYHxD.exe
  2⤵
  PID:5984
- C:\Windows\System\FWIXBBM.exe
  C:\Windows\System\FWIXBBM.exe
  2⤵
  PID:6000
- C:\Windows\System\AdHHtKM.exe
  C:\Windows\System\AdHHtKM.exe
  2⤵
  PID:6016
- C:\Windows\System\ZJbSWVd.exe
  C:\Windows\System\ZJbSWVd.exe
  2⤵
  PID:6036
- C:\Windows\System\eMPEzsd.exe
  C:\Windows\System\eMPEzsd.exe
  2⤵
  PID:6052
- C:\Windows\System\vVyhnuN.exe
  C:\Windows\System\vVyhnuN.exe
  2⤵
  PID:6068
- C:\Windows\System\lKySTQY.exe
  C:\Windows\System\lKySTQY.exe
  2⤵
  PID:6088
- C:\Windows\System\CbyxvJx.exe
  C:\Windows\System\CbyxvJx.exe
  2⤵
  PID:6108
- C:\Windows\System\dSkdWlg.exe
  C:\Windows\System\dSkdWlg.exe
  2⤵
  PID:6132
- C:\Windows\System\uOBYViy.exe
  C:\Windows\System\uOBYViy.exe
  2⤵
  PID:4772
- C:\Windows\System\rWDiPwY.exe
  C:\Windows\System\rWDiPwY.exe
  2⤵
  PID:1312
- C:\Windows\System\WkjvOqR.exe
  C:\Windows\System\WkjvOqR.exe
  2⤵
  PID:4212
- C:\Windows\System\QjJHNId.exe
  C:\Windows\System\QjJHNId.exe
  2⤵
  PID:4656
- C:\Windows\System\ZJOmWuS.exe
  C:\Windows\System\ZJOmWuS.exe
  2⤵
  PID:5108
- C:\Windows\System\fpfuXCs.exe
  C:\Windows\System\fpfuXCs.exe
  2⤵
  PID:4312
- C:\Windows\System\ZYrjCMB.exe
  C:\Windows\System\ZYrjCMB.exe
  2⤵
  PID:1684
- C:\Windows\System\cFlCpmn.exe
  C:\Windows\System\cFlCpmn.exe
  2⤵
  PID:4544
- C:\Windows\System\jnnHtPm.exe
  C:\Windows\System\jnnHtPm.exe
  2⤵
  PID:3320
- C:\Windows\System\tqAPzds.exe
  C:\Windows\System\tqAPzds.exe
  2⤵
  PID:4784
- C:\Windows\System\NWIrMjX.exe
  C:\Windows\System\NWIrMjX.exe
  2⤵
  PID:5192
- C:\Windows\System\wxKpHQi.exe
  C:\Windows\System\wxKpHQi.exe
  2⤵
  PID:5200
- C:\Windows\System\iJVxOTH.exe
  C:\Windows\System\iJVxOTH.exe
  2⤵
  PID:5220
- C:\Windows\System\ulToqQp.exe
  C:\Windows\System\ulToqQp.exe
  2⤵
  PID:5260
- C:\Windows\System\RcaWGSb.exe
  C:\Windows\System\RcaWGSb.exe
  2⤵
  PID:5292
- C:\Windows\System\NYslANR.exe
  C:\Windows\System\NYslANR.exe
  2⤵
  PID:5288
- C:\Windows\System\nfeLfKq.exe
  C:\Windows\System\nfeLfKq.exe
  2⤵
  PID:5360
- C:\Windows\System\VbFvzhE.exe
  C:\Windows\System\VbFvzhE.exe
  2⤵
  PID:5376
- C:\Windows\System\ouAoMsF.exe
  C:\Windows\System\ouAoMsF.exe
  2⤵
  PID:5420
- C:\Windows\System\CoNvUEF.exe
  C:\Windows\System\CoNvUEF.exe
  2⤵
  PID:5436
- C:\Windows\System\bcbbMYC.exe
  C:\Windows\System\bcbbMYC.exe
  2⤵
  PID:5452
- C:\Windows\System\UCViRIm.exe
  C:\Windows\System\UCViRIm.exe
  2⤵
  PID:5460
- C:\Windows\System\pPhMOZT.exe
  C:\Windows\System\pPhMOZT.exe
  2⤵
  PID:5404
- C:\Windows\System\dwcihjG.exe
  C:\Windows\System\dwcihjG.exe
  2⤵
  PID:5508
- C:\Windows\System\JQfsaTM.exe
  C:\Windows\System\JQfsaTM.exe
  2⤵
  PID:5540
- C:\Windows\System\cbwKcNU.exe
  C:\Windows\System\cbwKcNU.exe
  2⤵
  PID:5480
- C:\Windows\System\xEfmiiN.exe
  C:\Windows\System\xEfmiiN.exe
  2⤵
  PID:5504
- C:\Windows\System\WzZibxC.exe
  C:\Windows\System\WzZibxC.exe
  2⤵
  PID:5536
- C:\Windows\System\PIJFpMl.exe
  C:\Windows\System\PIJFpMl.exe
  2⤵
  PID:5560
- C:\Windows\System\UHWxOvS.exe
  C:\Windows\System\UHWxOvS.exe
  2⤵
  PID:5584
- C:\Windows\System\DdFZeud.exe
  C:\Windows\System\DdFZeud.exe
  2⤵
  PID:5640
- C:\Windows\System\TxtWdOJ.exe
  C:\Windows\System\TxtWdOJ.exe
  2⤵
  PID:5708
- C:\Windows\System\XpUyBMG.exe
  C:\Windows\System\XpUyBMG.exe
  2⤵
  PID:5776
- C:\Windows\System\qKmFHqB.exe
  C:\Windows\System\qKmFHqB.exe
  2⤵
  PID:5812
- C:\Windows\System\tRJRNYb.exe
  C:\Windows\System\tRJRNYb.exe
  2⤵
  PID:5660
- C:\Windows\System\undAdCd.exe
  C:\Windows\System\undAdCd.exe
  2⤵
  PID:5604
- C:\Windows\System\DudPrDn.exe
  C:\Windows\System\DudPrDn.exe
  2⤵
  PID:5848
- C:\Windows\System\ZpnflCm.exe
  C:\Windows\System\ZpnflCm.exe
  2⤵
  PID:5932
- C:\Windows\System\vBEBPbm.exe
  C:\Windows\System\vBEBPbm.exe
  2⤵
  PID:5720
- C:\Windows\System\DNBepQc.exe
  C:\Windows\System\DNBepQc.exe
  2⤵
  PID:6024
- C:\Windows\System\XAfQPKw.exe
  C:\Windows\System\XAfQPKw.exe
  2⤵
  PID:5620
- C:\Windows\System\PwbIPmk.exe
  C:\Windows\System\PwbIPmk.exe
  2⤵
  PID:6060
- C:\Windows\System\XzByEXs.exe
  C:\Windows\System\XzByEXs.exe
  2⤵
  PID:6104
- C:\Windows\System\IsRWZCP.exe
  C:\Windows\System\IsRWZCP.exe
  2⤵
  PID:4120
- C:\Windows\System\bOqcLPs.exe
  C:\Windows\System\bOqcLPs.exe
  2⤵
  PID:4908
- C:\Windows\System\guBvOsR.exe
  C:\Windows\System\guBvOsR.exe
  2⤵
  PID:5788
- C:\Windows\System\YhjvZnG.exe
  C:\Windows\System\YhjvZnG.exe
  2⤵
  PID:4440
- C:\Windows\System\ggaJTaI.exe
  C:\Windows\System\ggaJTaI.exe
  2⤵
  PID:5948
- C:\Windows\System\MlIkJBy.exe
  C:\Windows\System\MlIkJBy.exe
  2⤵
  PID:4876
- C:\Windows\System\dvMHhEi.exe
  C:\Windows\System\dvMHhEi.exe
  2⤵
  PID:6008
- C:\Windows\System\qsKgUzI.exe
  C:\Windows\System\qsKgUzI.exe
  2⤵
  PID:6076
- C:\Windows\System\ZCbEGlC.exe
  C:\Windows\System\ZCbEGlC.exe
  2⤵
  PID:6120
- C:\Windows\System\yYjFMYk.exe
  C:\Windows\System\yYjFMYk.exe
  2⤵
  PID:4184
- C:\Windows\System\AWikULt.exe
  C:\Windows\System\AWikULt.exe
  2⤵
  PID:4300
- C:\Windows\System\zLTURhp.exe
  C:\Windows\System\zLTURhp.exe
  2⤵
  PID:5144
- C:\Windows\System\gXUtrFG.exe
  C:\Windows\System\gXUtrFG.exe
  2⤵
  PID:4428
- C:\Windows\System\bjoQgaf.exe
  C:\Windows\System\bjoQgaf.exe
  2⤵
  PID:5132
- C:\Windows\System\shhxsea.exe
  C:\Windows\System\shhxsea.exe
  2⤵
  PID:5156
- C:\Windows\System\BxZMATz.exe
  C:\Windows\System\BxZMATz.exe
  2⤵
  PID:4788
- C:\Windows\System\AjCBUIE.exe
  C:\Windows\System\AjCBUIE.exe
  2⤵
  PID:4720
- C:\Windows\System\gRPFhez.exe
  C:\Windows\System\gRPFhez.exe
  2⤵
  PID:4572
- C:\Windows\System\IeYivmr.exe
  C:\Windows\System\IeYivmr.exe
  2⤵
  PID:5204
- C:\Windows\System\lnlxmkb.exe
  C:\Windows\System\lnlxmkb.exe
  2⤵
  PID:5176
- C:\Windows\System\ZVxVCfl.exe
  C:\Windows\System\ZVxVCfl.exe
  2⤵
  PID:5212
- C:\Windows\System\HdUBoKY.exe
  C:\Windows\System\HdUBoKY.exe
  2⤵
  PID:5244
- C:\Windows\System\YMOnLxz.exe
  C:\Windows\System\YMOnLxz.exe
  2⤵
  PID:5272
- C:\Windows\System\BJeHaGs.exe
  C:\Windows\System\BJeHaGs.exe
  2⤵
  PID:5324
- C:\Windows\System\jptLbbt.exe
  C:\Windows\System\jptLbbt.exe
  2⤵
  PID:5316
- C:\Windows\System\uvJQZeq.exe
  C:\Windows\System\uvJQZeq.exe
  2⤵
  PID:2100
- C:\Windows\System\PeHBTmx.exe
  C:\Windows\System\PeHBTmx.exe
  2⤵
  PID:5468
- C:\Windows\System\eZXIKRV.exe
  C:\Windows\System\eZXIKRV.exe
  2⤵
  PID:5496
- C:\Windows\System\HYlZKKM.exe
  C:\Windows\System\HYlZKKM.exe
  2⤵
  PID:5636
- C:\Windows\System\VBLxAUr.exe
  C:\Windows\System\VBLxAUr.exe
  2⤵
  PID:5856
- C:\Windows\System\wsKryvn.exe
  C:\Windows\System\wsKryvn.exe
  2⤵
  PID:2928
- C:\Windows\System\PFuUgKN.exe
  C:\Windows\System\PFuUgKN.exe
  2⤵
  PID:5476
- C:\Windows\System\zCdJvAp.exe
  C:\Windows\System\zCdJvAp.exe
  2⤵
  PID:5864
- C:\Windows\System\wFsFsxS.exe
  C:\Windows\System\wFsFsxS.exe
  2⤵
  PID:5852
- C:\Windows\System\oeuSuiV.exe
  C:\Windows\System\oeuSuiV.exe
  2⤵
  PID:5688
- C:\Windows\System\tIcKXkM.exe
  C:\Windows\System\tIcKXkM.exe
  2⤵
  PID:6100
- C:\Windows\System\vZMtapP.exe
  C:\Windows\System\vZMtapP.exe
  2⤵
  PID:5656
- C:\Windows\System\vagtlZY.exe
  C:\Windows\System\vagtlZY.exe
  2⤵
  PID:5488
- C:\Windows\System\tfmZdCn.exe
  C:\Windows\System\tfmZdCn.exe
  2⤵
  PID:5828
- C:\Windows\System\rfapfak.exe
  C:\Windows\System\rfapfak.exe
  2⤵
  PID:5808
- C:\Windows\System\AUSGhBS.exe
  C:\Windows\System\AUSGhBS.exe
  2⤵
  PID:6044
- C:\Windows\System\LdakCgH.exe
  C:\Windows\System\LdakCgH.exe
  2⤵
  PID:4800
- C:\Windows\System\uyhNgfT.exe
  C:\Windows\System\uyhNgfT.exe
  2⤵
  PID:5724
- C:\Windows\System\NikLAOD.exe
  C:\Windows\System\NikLAOD.exe
  2⤵
  PID:5008
- C:\Windows\System\CTZBCCL.exe
  C:\Windows\System\CTZBCCL.exe
  2⤵
  PID:2164
- C:\Windows\System\ZJCWTdQ.exe
  C:\Windows\System\ZJCWTdQ.exe
  2⤵
  PID:6084
- C:\Windows\System\ZOkEhKS.exe
  C:\Windows\System\ZOkEhKS.exe
  2⤵
  PID:4880
- C:\Windows\System\mUtIvUM.exe
  C:\Windows\System\mUtIvUM.exe
  2⤵
  PID:4360
- C:\Windows\System\yUlJMmq.exe
  C:\Windows\System\yUlJMmq.exe
  2⤵
  PID:4828
- C:\Windows\System\PaDLOXY.exe
  C:\Windows\System\PaDLOXY.exe
  2⤵
  PID:5180
- C:\Windows\System\IfwCdem.exe
  C:\Windows\System\IfwCdem.exe
  2⤵
  PID:4684
- C:\Windows\System\TMLtbtf.exe
  C:\Windows\System\TMLtbtf.exe
  2⤵
  PID:1084
- C:\Windows\System\EUSroJs.exe
  C:\Windows\System\EUSroJs.exe
  2⤵
  PID:5196
- C:\Windows\System\PWYRIMj.exe
  C:\Windows\System\PWYRIMj.exe
  2⤵
  PID:5348
- C:\Windows\System\uVaDyBq.exe
  C:\Windows\System\uVaDyBq.exe
  2⤵
  PID:5520
- C:\Windows\System\YhpFWvl.exe
  C:\Windows\System\YhpFWvl.exe
  2⤵
  PID:5860
- C:\Windows\System\mEsUIdE.exe
  C:\Windows\System\mEsUIdE.exe
  2⤵
  PID:5616
- C:\Windows\System\sgLhTDz.exe
  C:\Windows\System\sgLhTDz.exe
  2⤵
  PID:5976
- C:\Windows\System\EDZgxix.exe
  C:\Windows\System\EDZgxix.exe
  2⤵
  PID:5900
- C:\Windows\System\LPwPyWX.exe
  C:\Windows\System\LPwPyWX.exe
  2⤵
  PID:4972
- C:\Windows\System\NWvLeLo.exe
  C:\Windows\System\NWvLeLo.exe
  2⤵
  PID:5328
- C:\Windows\System\aWMPgIG.exe
  C:\Windows\System\aWMPgIG.exe
  2⤵
  PID:636
- C:\Windows\System\KecAMYb.exe
  C:\Windows\System\KecAMYb.exe
  2⤵
  PID:5128
- C:\Windows\System\yqObTPn.exe
  C:\Windows\System\yqObTPn.exe
  2⤵
  PID:5304
- C:\Windows\System\iyJKJbk.exe
  C:\Windows\System\iyJKJbk.exe
  2⤵
  PID:880
- C:\Windows\System\rHOddEe.exe
  C:\Windows\System\rHOddEe.exe
  2⤵
  PID:2744
- C:\Windows\System\QHQVtfu.exe
  C:\Windows\System\QHQVtfu.exe
  2⤵
  PID:4620
- C:\Windows\System\lxDzrty.exe
  C:\Windows\System\lxDzrty.exe
  2⤵
  PID:5592
- C:\Windows\System\zmaRIfa.exe
  C:\Windows\System\zmaRIfa.exe
  2⤵
  PID:2144
- C:\Windows\System\nSocLbD.exe
  C:\Windows\System\nSocLbD.exe
  2⤵
  PID:5528
- C:\Windows\System\HcznOHb.exe
  C:\Windows\System\HcznOHb.exe
  2⤵
  PID:5992
- C:\Windows\System\LDjHXRK.exe
  C:\Windows\System\LDjHXRK.exe
  2⤵
  PID:5944
- C:\Windows\System\fqujxaT.exe
  C:\Windows\System\fqujxaT.exe
  2⤵
  PID:6128
- C:\Windows\System\OIxeQhJ.exe
  C:\Windows\System\OIxeQhJ.exe
  2⤵
  PID:5448
- C:\Windows\System\qtQGzNI.exe
  C:\Windows\System\qtQGzNI.exe
  2⤵
  PID:5996
- C:\Windows\System\lDTsTUm.exe
  C:\Windows\System\lDTsTUm.exe
  2⤵
  PID:4232
- C:\Windows\System\FgOGULC.exe
  C:\Windows\System\FgOGULC.exe
  2⤵
  PID:5428
- C:\Windows\System\MkTebJb.exe
  C:\Windows\System\MkTebJb.exe
  2⤵
  PID:6156
- C:\Windows\System\BDZimQc.exe
  C:\Windows\System\BDZimQc.exe
  2⤵
  PID:6172
- C:\Windows\System\QRzqfuD.exe
  C:\Windows\System\QRzqfuD.exe
  2⤵
  PID:6188
- C:\Windows\System\qFLNkLr.exe
  C:\Windows\System\qFLNkLr.exe
  2⤵
  PID:6204
- C:\Windows\System\Wzmplys.exe
  C:\Windows\System\Wzmplys.exe
  2⤵
  PID:6220
- C:\Windows\System\FdqwEHn.exe
  C:\Windows\System\FdqwEHn.exe
  2⤵
  PID:6236
- C:\Windows\System\sxiIMnY.exe
  C:\Windows\System\sxiIMnY.exe
  2⤵
  PID:6252
- C:\Windows\System\AoRDjId.exe
  C:\Windows\System\AoRDjId.exe
  2⤵
  PID:6268
- C:\Windows\System\GUyfcFT.exe
  C:\Windows\System\GUyfcFT.exe
  2⤵
  PID:6284
- C:\Windows\System\nZuTNuy.exe
  C:\Windows\System\nZuTNuy.exe
  2⤵
  PID:6300
- C:\Windows\System\wDIxnoh.exe
  C:\Windows\System\wDIxnoh.exe
  2⤵
  PID:6316
- C:\Windows\System\rhOvfXo.exe
  C:\Windows\System\rhOvfXo.exe
  2⤵
  PID:6332
- C:\Windows\System\vwauCuW.exe
  C:\Windows\System\vwauCuW.exe
  2⤵
  PID:6348
- C:\Windows\System\tmjBPFP.exe
  C:\Windows\System\tmjBPFP.exe
  2⤵
  PID:6364
- C:\Windows\System\AwYQsOs.exe
  C:\Windows\System\AwYQsOs.exe
  2⤵
  PID:6380
- C:\Windows\System\dHJpQhr.exe
  C:\Windows\System\dHJpQhr.exe
  2⤵
  PID:6396
- C:\Windows\System\OzQpTvx.exe
  C:\Windows\System\OzQpTvx.exe
  2⤵
  PID:6412
- C:\Windows\System\HlifwFn.exe
  C:\Windows\System\HlifwFn.exe
  2⤵
  PID:6428
- C:\Windows\System\fwzOtrM.exe
  C:\Windows\System\fwzOtrM.exe
  2⤵
  PID:6444
- C:\Windows\System\YxRDWnv.exe
  C:\Windows\System\YxRDWnv.exe
  2⤵
  PID:6460
- C:\Windows\System\OjccpPu.exe
  C:\Windows\System\OjccpPu.exe
  2⤵
  PID:6476
- C:\Windows\System\JrNJXCz.exe
  C:\Windows\System\JrNJXCz.exe
  2⤵
  PID:6492
- C:\Windows\System\WbaOOeB.exe
  C:\Windows\System\WbaOOeB.exe
  2⤵
  PID:6508
- C:\Windows\System\HDECtrN.exe
  C:\Windows\System\HDECtrN.exe
  2⤵
  PID:6524
- C:\Windows\System\wBqLoOY.exe
  C:\Windows\System\wBqLoOY.exe
  2⤵
  PID:6540
- C:\Windows\System\mpiyCDm.exe
  C:\Windows\System\mpiyCDm.exe
  2⤵
  PID:6556
- C:\Windows\System\oocbbPV.exe
  C:\Windows\System\oocbbPV.exe
  2⤵
  PID:6572
- C:\Windows\System\jHooFFu.exe
  C:\Windows\System\jHooFFu.exe
  2⤵
  PID:6588
- C:\Windows\System\IksxQZf.exe
  C:\Windows\System\IksxQZf.exe
  2⤵
  PID:6604
- C:\Windows\System\nTxOgwJ.exe
  C:\Windows\System\nTxOgwJ.exe
  2⤵
  PID:6620
- C:\Windows\System\ZmRgKfF.exe
  C:\Windows\System\ZmRgKfF.exe
  2⤵
  PID:6636
- C:\Windows\System\yqYFHnX.exe
  C:\Windows\System\yqYFHnX.exe
  2⤵
  PID:6652
- C:\Windows\System\cixVYqB.exe
  C:\Windows\System\cixVYqB.exe
  2⤵
  PID:6668
- C:\Windows\System\xjbBEzB.exe
  C:\Windows\System\xjbBEzB.exe
  2⤵
  PID:6684
- C:\Windows\System\KYPbsNV.exe
  C:\Windows\System\KYPbsNV.exe
  2⤵
  PID:6700
- C:\Windows\System\GyDrXQv.exe
  C:\Windows\System\GyDrXQv.exe
  2⤵
  PID:6716
- C:\Windows\System\DdDkJlP.exe
  C:\Windows\System\DdDkJlP.exe
  2⤵
  PID:6732
- C:\Windows\System\ieSwswG.exe
  C:\Windows\System\ieSwswG.exe
  2⤵
  PID:6748
- C:\Windows\System\KNyfCgs.exe
  C:\Windows\System\KNyfCgs.exe
  2⤵
  PID:6764
- C:\Windows\System\dPmpPDk.exe
  C:\Windows\System\dPmpPDk.exe
  2⤵
  PID:6780
- C:\Windows\System\BrQeUVd.exe
  C:\Windows\System\BrQeUVd.exe
  2⤵
  PID:6796
- C:\Windows\System\LHipYQD.exe
  C:\Windows\System\LHipYQD.exe
  2⤵
  PID:6812
- C:\Windows\System\pkJlnII.exe
  C:\Windows\System\pkJlnII.exe
  2⤵
  PID:6828
- C:\Windows\System\Wfkjlxb.exe
  C:\Windows\System\Wfkjlxb.exe
  2⤵
  PID:6844
- C:\Windows\System\iXTyyGu.exe
  C:\Windows\System\iXTyyGu.exe
  2⤵
  PID:6860
- C:\Windows\System\NmGrSvO.exe
  C:\Windows\System\NmGrSvO.exe
  2⤵
  PID:6876
- C:\Windows\System\bzPFMCf.exe
  C:\Windows\System\bzPFMCf.exe
  2⤵
  PID:6892
- C:\Windows\System\qjBassS.exe
  C:\Windows\System\qjBassS.exe
  2⤵
  PID:6908
- C:\Windows\System\NYYEpos.exe
  C:\Windows\System\NYYEpos.exe
  2⤵
  PID:6924
- C:\Windows\System\CJzMrui.exe
  C:\Windows\System\CJzMrui.exe
  2⤵
  PID:6940
- C:\Windows\System\cpjVDlr.exe
  C:\Windows\System\cpjVDlr.exe
  2⤵
  PID:6956
- C:\Windows\System\AOKWmNs.exe
  C:\Windows\System\AOKWmNs.exe
  2⤵
  PID:6972
- C:\Windows\System\oWLqxYj.exe
  C:\Windows\System\oWLqxYj.exe
  2⤵
  PID:6988
- C:\Windows\System\WvbIlMU.exe
  C:\Windows\System\WvbIlMU.exe
  2⤵
  PID:7004
- C:\Windows\System\CrFqITT.exe
  C:\Windows\System\CrFqITT.exe
  2⤵
  PID:7020
- C:\Windows\System\tQqvRqR.exe
  C:\Windows\System\tQqvRqR.exe
  2⤵
  PID:7036
- C:\Windows\System\gHnSWfV.exe
  C:\Windows\System\gHnSWfV.exe
  2⤵
  PID:7052
- C:\Windows\System\WPLyDiY.exe
  C:\Windows\System\WPLyDiY.exe
  2⤵
  PID:7068
- C:\Windows\System\snnEoIR.exe
  C:\Windows\System\snnEoIR.exe
  2⤵
  PID:7084
- C:\Windows\System\fzbAeyf.exe
  C:\Windows\System\fzbAeyf.exe
  2⤵
  PID:7100
- C:\Windows\System\DaKyiJN.exe
  C:\Windows\System\DaKyiJN.exe
  2⤵
  PID:7116
- C:\Windows\System\acxxPli.exe
  C:\Windows\System\acxxPli.exe
  2⤵
  PID:7132
- C:\Windows\System\fswbQUK.exe
  C:\Windows\System\fswbQUK.exe
  2⤵
  PID:7148
- C:\Windows\System\sdUVxPg.exe
  C:\Windows\System\sdUVxPg.exe
  2⤵
  PID:7164
- C:\Windows\System\kKiSCna.exe
  C:\Windows\System\kKiSCna.exe
  2⤵
  PID:6184
- C:\Windows\System\aXuXbhe.exe
  C:\Windows\System\aXuXbhe.exe
  2⤵
  PID:6244
- C:\Windows\System\tBlSjst.exe
  C:\Windows\System\tBlSjst.exe
  2⤵
  PID:5280
- C:\Windows\System\ktypPbN.exe
  C:\Windows\System\ktypPbN.exe
  2⤵
  PID:5556
- C:\Windows\System\xIfjEnt.exe
  C:\Windows\System\xIfjEnt.exe
  2⤵
  PID:3196
- C:\Windows\System\BpQueRk.exe
  C:\Windows\System\BpQueRk.exe
  2⤵
  PID:5380
- C:\Windows\System\RBcWluu.exe
  C:\Windows\System\RBcWluu.exe
  2⤵
  PID:5320
- C:\Windows\System\ynSdVbS.exe
  C:\Windows\System\ynSdVbS.exe
  2⤵
  PID:6264
- C:\Windows\System\ovnbkhN.exe
  C:\Windows\System\ovnbkhN.exe
  2⤵
  PID:6344
- C:\Windows\System\evrFmbN.exe
  C:\Windows\System\evrFmbN.exe
  2⤵
  PID:6408
- C:\Windows\System\FkWkxlv.exe
  C:\Windows\System\FkWkxlv.exe
  2⤵
  PID:6468
- C:\Windows\System\HTlxmWr.exe
  C:\Windows\System\HTlxmWr.exe
  2⤵
  PID:6532
- C:\Windows\System\FqVjCth.exe
  C:\Windows\System\FqVjCth.exe
  2⤵
  PID:6568
- C:\Windows\System\uHivMpS.exe
  C:\Windows\System\uHivMpS.exe
  2⤵
  PID:6632
- C:\Windows\System\vJXDhAu.exe
  C:\Windows\System\vJXDhAu.exe
  2⤵
  PID:6484
- C:\Windows\System\VnIuulo.exe
  C:\Windows\System\VnIuulo.exe
  2⤵
  PID:6580
- C:\Windows\System\atIKnEE.exe
  C:\Windows\System\atIKnEE.exe
  2⤵
  PID:6324
- C:\Windows\System\knvKFQB.exe
  C:\Windows\System\knvKFQB.exe
  2⤵
  PID:6420
- C:\Windows\System\ivbJLSa.exe
  C:\Windows\System\ivbJLSa.exe
  2⤵
  PID:6488
- C:\Windows\System\MmDojHq.exe
  C:\Windows\System\MmDojHq.exe
  2⤵
  PID:6648
- C:\Windows\System\pPaLsaV.exe
  C:\Windows\System\pPaLsaV.exe
  2⤵
  PID:6696
- C:\Windows\System\VwsVtkO.exe
  C:\Windows\System\VwsVtkO.exe
  2⤵
  PID:6756
- C:\Windows\System\fUvJUYt.exe
  C:\Windows\System\fUvJUYt.exe
  2⤵
  PID:6820
- C:\Windows\System\qNvkdke.exe
  C:\Windows\System\qNvkdke.exe
  2⤵
  PID:6884
- C:\Windows\System\RsAfPZm.exe
  C:\Windows\System\RsAfPZm.exe
  2⤵
  PID:6916
- C:\Windows\System\jZjPBgZ.exe
  C:\Windows\System\jZjPBgZ.exe
  2⤵
  PID:6772
- C:\Windows\System\bGKCEZT.exe
  C:\Windows\System\bGKCEZT.exe
  2⤵
  PID:6804
- C:\Windows\System\roTdrea.exe
  C:\Windows\System\roTdrea.exe
  2⤵
  PID:6744
- C:\Windows\System\RVrMgiH.exe
  C:\Windows\System\RVrMgiH.exe
  2⤵
  PID:7076
- C:\Windows\System\HTAkgTl.exe
  C:\Windows\System\HTAkgTl.exe
  2⤵
  PID:6872
- C:\Windows\System\pJQZptk.exe
  C:\Windows\System\pJQZptk.exe
  2⤵
  PID:6808
- C:\Windows\System\FyYqcGU.exe
  C:\Windows\System\FyYqcGU.exe
  2⤵
  PID:6840
- C:\Windows\System\FnkJqoY.exe
  C:\Windows\System\FnkJqoY.exe
  2⤵
  PID:6152
- C:\Windows\System\TbuUnka.exe
  C:\Windows\System\TbuUnka.exe
  2⤵
  PID:6936
- C:\Windows\System\NYIvOnz.exe
  C:\Windows\System\NYIvOnz.exe
  2⤵
  PID:7000
- C:\Windows\System\fPCwtav.exe
  C:\Windows\System\fPCwtav.exe
  2⤵
  PID:7096
- C:\Windows\System\EzMwTAK.exe
  C:\Windows\System\EzMwTAK.exe
  2⤵
  PID:5088
- C:\Windows\System\wmoTkAd.exe
  C:\Windows\System\wmoTkAd.exe
  2⤵
  PID:5284
- C:\Windows\System\LAHFkXZ.exe
  C:\Windows\System\LAHFkXZ.exe
  2⤵
  PID:6312
- C:\Windows\System\TmLsfnK.exe
  C:\Windows\System\TmLsfnK.exe
  2⤵
  PID:6356
- C:\Windows\System\icIoQEB.exe
  C:\Windows\System\icIoQEB.exe
  2⤵
  PID:6664
- C:\Windows\System\cvFJsXn.exe
  C:\Windows\System\cvFJsXn.exe
  2⤵
  PID:6452
- C:\Windows\System\KIdbVfd.exe
  C:\Windows\System\KIdbVfd.exe
  2⤵
  PID:6232
- C:\Windows\System\rtWNZsy.exe
  C:\Windows\System\rtWNZsy.exe
  2⤵
  PID:6600
- C:\Windows\System\UForUaR.exe
  C:\Windows\System\UForUaR.exe
  2⤵
  PID:6360
- C:\Windows\System\mBzHPXU.exe
  C:\Windows\System\mBzHPXU.exe
  2⤵
  PID:1748
- C:\Windows\System\kdmNIFo.exe
  C:\Windows\System\kdmNIFo.exe
  2⤵
  PID:6644
- C:\Windows\System\VBKlrjt.exe
  C:\Windows\System\VBKlrjt.exe
  2⤵
  PID:6952
- C:\Windows\System\ByfhHyF.exe
  C:\Windows\System\ByfhHyF.exe
  2⤵
  PID:6740
- C:\Windows\System\vHzKBFl.exe
  C:\Windows\System\vHzKBFl.exe
  2⤵
  PID:6900
- C:\Windows\System\AVbBjlt.exe
  C:\Windows\System\AVbBjlt.exe
  2⤵
  PID:3372
- C:\Windows\System\IARFfrI.exe
  C:\Windows\System\IARFfrI.exe
  2⤵
  PID:7044
- C:\Windows\System\FbSKDxP.exe
  C:\Windows\System\FbSKDxP.exe
  2⤵
  PID:7032
- C:\Windows\System\rsZhdvQ.exe
  C:\Windows\System\rsZhdvQ.exe
  2⤵
  PID:6216
- C:\Windows\System\juMBnFr.exe
  C:\Windows\System\juMBnFr.exe
  2⤵
  PID:6376
- C:\Windows\System\GLxRogL.exe
  C:\Windows\System\GLxRogL.exe
  2⤵
  PID:6276
- C:\Windows\System\AsDgqNq.exe
  C:\Windows\System\AsDgqNq.exe
  2⤵
  PID:6548
- C:\Windows\System\pgdpttE.exe
  C:\Windows\System\pgdpttE.exe
  2⤵
  PID:6392
- C:\Windows\System\nGaWhuL.exe
  C:\Windows\System\nGaWhuL.exe
  2⤵
  PID:5368
- C:\Windows\System\fHlNpbv.exe
  C:\Windows\System\fHlNpbv.exe
  2⤵
  PID:6852
- C:\Windows\System\MKrlwCh.exe
  C:\Windows\System\MKrlwCh.exe
  2⤵
  PID:6680
- C:\Windows\System\VqOqTfo.exe
  C:\Windows\System\VqOqTfo.exe
  2⤵
  PID:7012
- C:\Windows\System\isMCnrS.exe
  C:\Windows\System\isMCnrS.exe
  2⤵
  PID:6968
- C:\Windows\System\SzdtPMs.exe
  C:\Windows\System\SzdtPMs.exe
  2⤵
  PID:6280
- C:\Windows\System\avAHLWp.exe
  C:\Windows\System\avAHLWp.exe
  2⤵
  PID:6500
- C:\Windows\System\YmtuXuA.exe
  C:\Windows\System\YmtuXuA.exe
  2⤵
  PID:6980
- C:\Windows\System\lReufXg.exe
  C:\Windows\System\lReufXg.exe
  2⤵
  PID:6776
- C:\Windows\System\wyuYEPH.exe
  C:\Windows\System\wyuYEPH.exe
  2⤵
  PID:7172
- C:\Windows\System\YvhdZYS.exe
  C:\Windows\System\YvhdZYS.exe
  2⤵
  PID:7188
- C:\Windows\System\jipSwGs.exe
  C:\Windows\System\jipSwGs.exe
  2⤵
  PID:7204
- C:\Windows\System\BLYzkpr.exe
  C:\Windows\System\BLYzkpr.exe
  2⤵
  PID:7220
- C:\Windows\System\yaNJbUp.exe
  C:\Windows\System\yaNJbUp.exe
  2⤵
  PID:7236
- C:\Windows\System\YahnAcX.exe
  C:\Windows\System\YahnAcX.exe
  2⤵
  PID:7252
- C:\Windows\System\dceTpIP.exe
  C:\Windows\System\dceTpIP.exe
  2⤵
  PID:7268
- C:\Windows\System\IOzIXnH.exe
  C:\Windows\System\IOzIXnH.exe
  2⤵
  PID:7284
- C:\Windows\System\cUeSXaS.exe
  C:\Windows\System\cUeSXaS.exe
  2⤵
  PID:7300
- C:\Windows\System\PLNiVxY.exe
  C:\Windows\System\PLNiVxY.exe
  2⤵
  PID:7316
- C:\Windows\System\BMdZqgP.exe
  C:\Windows\System\BMdZqgP.exe
  2⤵
  PID:7332
- C:\Windows\System\ypclNxU.exe
  C:\Windows\System\ypclNxU.exe
  2⤵
  PID:7348
- C:\Windows\System\viPYhra.exe
  C:\Windows\System\viPYhra.exe
  2⤵
  PID:7364
- C:\Windows\System\gHnYzbu.exe
  C:\Windows\System\gHnYzbu.exe
  2⤵
  PID:7380
- C:\Windows\System\MEecEaQ.exe
  C:\Windows\System\MEecEaQ.exe
  2⤵
  PID:7396
- C:\Windows\System\cHnhJjs.exe
  C:\Windows\System\cHnhJjs.exe
  2⤵
  PID:7412
- C:\Windows\System\OZfhrXX.exe
  C:\Windows\System\OZfhrXX.exe
  2⤵
  PID:7428
- C:\Windows\System\wSycisL.exe
  C:\Windows\System\wSycisL.exe
  2⤵
  PID:7444
- C:\Windows\System\bpOSDIm.exe
  C:\Windows\System\bpOSDIm.exe
  2⤵
  PID:7460
- C:\Windows\System\FCJnZGx.exe
  C:\Windows\System\FCJnZGx.exe
  2⤵
  PID:7476
- C:\Windows\System\EAmnxas.exe
  C:\Windows\System\EAmnxas.exe
  2⤵
  PID:7492
- C:\Windows\System\MXRQDet.exe
  C:\Windows\System\MXRQDet.exe
  2⤵
  PID:7508
- C:\Windows\System\QMZvDpD.exe
  C:\Windows\System\QMZvDpD.exe
  2⤵
  PID:7524
- C:\Windows\System\CEDzpqz.exe
  C:\Windows\System\CEDzpqz.exe
  2⤵
  PID:7540
- C:\Windows\System\jKUdgit.exe
  C:\Windows\System\jKUdgit.exe
  2⤵
  PID:7556
- C:\Windows\System\OoLrWTj.exe
  C:\Windows\System\OoLrWTj.exe
  2⤵
  PID:7572
- C:\Windows\System\JobTEVD.exe
  C:\Windows\System\JobTEVD.exe
  2⤵
  PID:7588
- C:\Windows\System\KGclUGW.exe
  C:\Windows\System\KGclUGW.exe
  2⤵
  PID:7604
- C:\Windows\System\ytLBiHS.exe
  C:\Windows\System\ytLBiHS.exe
  2⤵
  PID:7620
- C:\Windows\System\ltzPZFJ.exe
  C:\Windows\System\ltzPZFJ.exe
  2⤵
  PID:7636
- C:\Windows\System\lckjLeg.exe
  C:\Windows\System\lckjLeg.exe
  2⤵
  PID:7652
- C:\Windows\System\iBREVkf.exe
  C:\Windows\System\iBREVkf.exe
  2⤵
  PID:7668
- C:\Windows\System\pSrcpPj.exe
  C:\Windows\System\pSrcpPj.exe
  2⤵
  PID:7684
- C:\Windows\System\qzUbkuV.exe
  C:\Windows\System\qzUbkuV.exe
  2⤵
  PID:7700
- C:\Windows\System\fDZPxFt.exe
  C:\Windows\System\fDZPxFt.exe
  2⤵
  PID:7716
- C:\Windows\System\wyypsyi.exe
  C:\Windows\System\wyypsyi.exe
  2⤵
  PID:7732
- C:\Windows\System\RRKFcJh.exe
  C:\Windows\System\RRKFcJh.exe
  2⤵
  PID:7748
- C:\Windows\System\OpnoJCX.exe
  C:\Windows\System\OpnoJCX.exe
  2⤵
  PID:7768
- C:\Windows\System\CEpFfub.exe
  C:\Windows\System\CEpFfub.exe
  2⤵
  PID:7784
- C:\Windows\System\dsstzMY.exe
  C:\Windows\System\dsstzMY.exe
  2⤵
  PID:7800
- C:\Windows\System\EsKuIIN.exe
  C:\Windows\System\EsKuIIN.exe
  2⤵
  PID:7816
- C:\Windows\System\rtrWcCc.exe
  C:\Windows\System\rtrWcCc.exe
  2⤵
  PID:7832
- C:\Windows\System\ZEoJRJg.exe
  C:\Windows\System\ZEoJRJg.exe
  2⤵
  PID:7848
- C:\Windows\System\FJkxTUw.exe
  C:\Windows\System\FJkxTUw.exe
  2⤵
  PID:7864
- C:\Windows\System\HyPSiNW.exe
  C:\Windows\System\HyPSiNW.exe
  2⤵
  PID:7880
- C:\Windows\System\BYbsuuL.exe
  C:\Windows\System\BYbsuuL.exe
  2⤵
  PID:7896
- C:\Windows\System\EbJcFHX.exe
  C:\Windows\System\EbJcFHX.exe
  2⤵
  PID:7912
- C:\Windows\System\jATlnvU.exe
  C:\Windows\System\jATlnvU.exe
  2⤵
  PID:7928
- C:\Windows\System\zliLSZE.exe
  C:\Windows\System\zliLSZE.exe
  2⤵
  PID:7944
- C:\Windows\System\ezHlYlM.exe
  C:\Windows\System\ezHlYlM.exe
  2⤵
  PID:7960
- C:\Windows\System\SaXrNQp.exe
  C:\Windows\System\SaXrNQp.exe
  2⤵
  PID:7976
- C:\Windows\System\OYNytPf.exe
  C:\Windows\System\OYNytPf.exe
  2⤵
  PID:7992
- C:\Windows\System\hxvlCTK.exe
  C:\Windows\System\hxvlCTK.exe
  2⤵
  PID:8008
- C:\Windows\System\GFWneNI.exe
  C:\Windows\System\GFWneNI.exe
  2⤵
  PID:8024
- C:\Windows\System\lsMaDcg.exe
  C:\Windows\System\lsMaDcg.exe
  2⤵
  PID:8040
- C:\Windows\System\IuhtyKG.exe
  C:\Windows\System\IuhtyKG.exe
  2⤵
  PID:8056
- C:\Windows\System\HdJNkcK.exe
  C:\Windows\System\HdJNkcK.exe
  2⤵
  PID:8072
- C:\Windows\System\OUHzDfZ.exe
  C:\Windows\System\OUHzDfZ.exe
  2⤵
  PID:8088
- C:\Windows\System\iBTXMcx.exe
  C:\Windows\System\iBTXMcx.exe
  2⤵
  PID:8104
- C:\Windows\System\eOFfIqG.exe
  C:\Windows\System\eOFfIqG.exe
  2⤵
  PID:8120
- C:\Windows\System\jQqWWAJ.exe
  C:\Windows\System\jQqWWAJ.exe
  2⤵
  PID:8136
- C:\Windows\System\HIzxIsX.exe
  C:\Windows\System\HIzxIsX.exe
  2⤵
  PID:8152
- C:\Windows\System\iaVIxnp.exe
  C:\Windows\System\iaVIxnp.exe
  2⤵
  PID:8168
- C:\Windows\System\sKvUQdR.exe
  C:\Windows\System\sKvUQdR.exe
  2⤵
  PID:8184
- C:\Windows\System\rGsKsfp.exe
  C:\Windows\System\rGsKsfp.exe
  2⤵
  PID:7180
- C:\Windows\System\IYtKNMy.exe
  C:\Windows\System\IYtKNMy.exe
  2⤵
  PID:7244
- C:\Windows\System\YWavXBU.exe
  C:\Windows\System\YWavXBU.exe
  2⤵
  PID:7028
- C:\Windows\System\PIxLxtH.exe
  C:\Windows\System\PIxLxtH.exe
  2⤵
  PID:7340
- C:\Windows\System\kGxWyTF.exe
  C:\Windows\System\kGxWyTF.exe
  2⤵
  PID:7404
- C:\Windows\System\shOVKcM.exe
  C:\Windows\System\shOVKcM.exe
  2⤵
  PID:7436
- C:\Windows\System\ezbZTNt.exe
  C:\Windows\System\ezbZTNt.exe
  2⤵
  PID:7504
- C:\Windows\System\DAgqFjg.exe
  C:\Windows\System\DAgqFjg.exe
  2⤵
  PID:7328
- C:\Windows\System\qeAzzic.exe
  C:\Windows\System\qeAzzic.exe
  2⤵
  PID:7568
- C:\Windows\System\DiDBnFC.exe
  C:\Windows\System\DiDBnFC.exe
  2⤵
  PID:7628
- C:\Windows\System\XlQZoxK.exe
  C:\Windows\System\XlQZoxK.exe
  2⤵
  PID:7140
- C:\Windows\System\xquSvvq.exe
  C:\Windows\System\xquSvvq.exe
  2⤵
  PID:7664
- C:\Windows\System\dGaLtAF.exe
  C:\Windows\System\dGaLtAF.exe
  2⤵
  PID:7580
- C:\Windows\System\cGynsEQ.exe
  C:\Windows\System\cGynsEQ.exe
  2⤵
  PID:7392
- C:\Windows\System\eDPitAO.exe
  C:\Windows\System\eDPitAO.exe
  2⤵
  PID:7696
- C:\Windows\System\YejmgOJ.exe
  C:\Windows\System\YejmgOJ.exe
  2⤵
  PID:7260
- C:\Windows\System\QLkslrZ.exe
  C:\Windows\System\QLkslrZ.exe
  2⤵
  PID:7756
- C:\Windows\System\gyDVrLV.exe
  C:\Windows\System\gyDVrLV.exe
  2⤵
  PID:7424
- C:\Windows\System\oeUACjo.exe
  C:\Windows\System\oeUACjo.exe
  2⤵
  PID:7488
- C:\Windows\System\YrdwokI.exe
  C:\Windows\System\YrdwokI.exe
  2⤵
  PID:7744
- C:\Windows\System\QOwfKLM.exe
  C:\Windows\System\QOwfKLM.exe
  2⤵
  PID:7712
- C:\Windows\System\yGKOPFq.exe
  C:\Windows\System\yGKOPFq.exe
  2⤵
  PID:7824
- C:\Windows\System\HEdWMak.exe
  C:\Windows\System\HEdWMak.exe
  2⤵
  PID:7780
- C:\Windows\System\GKkEjdR.exe
  C:\Windows\System\GKkEjdR.exe
  2⤵
  PID:7924
- C:\Windows\System\szbEUTQ.exe
  C:\Windows\System\szbEUTQ.exe
  2⤵
  PID:6260
- C:\Windows\System\lSuJnAm.exe
  C:\Windows\System\lSuJnAm.exe
  2⤵
  PID:7844
- C:\Windows\System\qVFHyUu.exe
  C:\Windows\System\qVFHyUu.exe
  2⤵
  PID:7812
- C:\Windows\System\EAesJQE.exe
  C:\Windows\System\EAesJQE.exe
  2⤵
  PID:7872
- C:\Windows\System\KBZchKS.exe
  C:\Windows\System\KBZchKS.exe
  2⤵
  PID:8016
- C:\Windows\System\bKlBQUD.exe
  C:\Windows\System\bKlBQUD.exe
  2⤵
  PID:8084
- C:\Windows\System\HTLFHTN.exe
  C:\Windows\System\HTLFHTN.exe
  2⤵
  PID:8004
- C:\Windows\System\ypmHwHx.exe
  C:\Windows\System\ypmHwHx.exe
  2⤵
  PID:8032
- C:\Windows\System\fPKowSK.exe
  C:\Windows\System\fPKowSK.exe
  2⤵
  PID:8128
- C:\Windows\System\UNUqbxn.exe
  C:\Windows\System\UNUqbxn.exe
  2⤵
  PID:8132
- C:\Windows\System\aPRBCJy.exe
  C:\Windows\System\aPRBCJy.exe
  2⤵
  PID:7216
- C:\Windows\System\WRGhHhW.exe
  C:\Windows\System\WRGhHhW.exe
  2⤵
  PID:7232
- C:\Windows\System\lEeaNFb.exe
  C:\Windows\System\lEeaNFb.exe
  2⤵
  PID:6904
- C:\Windows\System\lumMGSC.exe
  C:\Windows\System\lumMGSC.exe
  2⤵
  PID:7372
- C:\Windows\System\MgKPUFf.exe
  C:\Windows\System\MgKPUFf.exe
  2⤵
  PID:7196
- C:\Windows\System\ibDpWYg.exe
  C:\Windows\System\ibDpWYg.exe
  2⤵
  PID:7660
- C:\Windows\System\uRHuhgr.exe
  C:\Windows\System\uRHuhgr.exe
  2⤵
  PID:7648
- C:\Windows\System\GLQFDea.exe
  C:\Windows\System\GLQFDea.exe
  2⤵
  PID:6436
- C:\Windows\System\irlzfFG.exe
  C:\Windows\System\irlzfFG.exe
  2⤵
  PID:7920
- C:\Windows\System\DIbslMz.exe
  C:\Windows\System\DIbslMz.exe
  2⤵
  PID:7228
- C:\Windows\System\kQAgGpY.exe
  C:\Windows\System\kQAgGpY.exe
  2⤵
  PID:8116
- C:\Windows\System\XXufCMH.exe
  C:\Windows\System\XXufCMH.exe
  2⤵
  PID:7548
- C:\Windows\System\yVJpgOp.exe
  C:\Windows\System\yVJpgOp.exe
  2⤵
  PID:7292
- C:\Windows\System\BMzvhsp.exe
  C:\Windows\System\BMzvhsp.exe
  2⤵
  PID:7708
- C:\Windows\System\ILocwLT.exe
  C:\Windows\System\ILocwLT.exe
  2⤵
  PID:7984
- C:\Windows\System\tEFvkKI.exe
  C:\Windows\System\tEFvkKI.exe
  2⤵
  PID:8000
- C:\Windows\System\gPJtrgE.exe
  C:\Windows\System\gPJtrgE.exe
  2⤵
  PID:7312
- C:\Windows\System\gsUHeiq.exe
  C:\Windows\System\gsUHeiq.exe
  2⤵
  PID:7280
- C:\Windows\System\yXxeBBq.exe
  C:\Windows\System\yXxeBBq.exe
  2⤵
  PID:7516
- C:\Windows\System\zmZwPTL.exe
  C:\Windows\System\zmZwPTL.exe
  2⤵
  PID:6788
- C:\Windows\System\CxpiXYo.exe
  C:\Windows\System\CxpiXYo.exe
  2⤵
  PID:7360
- C:\Windows\System\wysNkAe.exe
  C:\Windows\System\wysNkAe.exe
  2⤵
  PID:7936
- C:\Windows\System\UtCEcIR.exe
  C:\Windows\System\UtCEcIR.exe
  2⤵
  PID:7968
- C:\Windows\System\htcsOUA.exe
  C:\Windows\System\htcsOUA.exe
  2⤵
  PID:8036
- C:\Windows\System\iUjquSv.exe
  C:\Windows\System\iUjquSv.exe
  2⤵
  PID:8256
- C:\Windows\System\OKfMFWW.exe
  C:\Windows\System\OKfMFWW.exe
  2⤵
  PID:8272
- C:\Windows\System\auaIpPg.exe
  C:\Windows\System\auaIpPg.exe
  2⤵
  PID:8288
- C:\Windows\System\vKpoNAe.exe
  C:\Windows\System\vKpoNAe.exe
  2⤵
  PID:8304
- C:\Windows\System\tMjeRdy.exe
  C:\Windows\System\tMjeRdy.exe
  2⤵
  PID:8324
- C:\Windows\System\JDjXhNc.exe
  C:\Windows\System\JDjXhNc.exe
  2⤵
  PID:8340
- C:\Windows\System\kMHXTPy.exe
  C:\Windows\System\kMHXTPy.exe
  2⤵
  PID:8356
- C:\Windows\System\JjmOHlC.exe
  C:\Windows\System\JjmOHlC.exe
  2⤵
  PID:8416
- C:\Windows\System\oKnJear.exe
  C:\Windows\System\oKnJear.exe
  2⤵
  PID:8432
- C:\Windows\System\xecvqYr.exe
  C:\Windows\System\xecvqYr.exe
  2⤵
  PID:8448
- C:\Windows\System\iZkQtwj.exe
  C:\Windows\System\iZkQtwj.exe
  2⤵
  PID:8464
- C:\Windows\System\poScrrq.exe
  C:\Windows\System\poScrrq.exe
  2⤵
  PID:8484
- C:\Windows\System\GMSREPK.exe
  C:\Windows\System\GMSREPK.exe
  2⤵
  PID:8500
- C:\Windows\System\PKBcFuf.exe
  C:\Windows\System\PKBcFuf.exe
  2⤵
  PID:8516
- C:\Windows\System\sjomVie.exe
  C:\Windows\System\sjomVie.exe
  2⤵
  PID:8532
- C:\Windows\System\urnkjZo.exe
  C:\Windows\System\urnkjZo.exe
  2⤵
  PID:8548
- C:\Windows\System\ouGmLUr.exe
  C:\Windows\System\ouGmLUr.exe
  2⤵
  PID:8564
- C:\Windows\System\KaWTwIg.exe
  C:\Windows\System\KaWTwIg.exe
  2⤵
  PID:8580
- C:\Windows\System\VVUYNTv.exe
  C:\Windows\System\VVUYNTv.exe
  2⤵
  PID:8596
- C:\Windows\System\cAhAuPV.exe
  C:\Windows\System\cAhAuPV.exe
  2⤵
  PID:8612
- C:\Windows\System\IYpWubk.exe
  C:\Windows\System\IYpWubk.exe
  2⤵
  PID:8632
- C:\Windows\System\PCyAIwL.exe
  C:\Windows\System\PCyAIwL.exe
  2⤵
  PID:8648
- C:\Windows\System\yuLTCTW.exe
  C:\Windows\System\yuLTCTW.exe
  2⤵
  PID:8664
- C:\Windows\System\JhmBqaP.exe
  C:\Windows\System\JhmBqaP.exe
  2⤵
  PID:8680
- C:\Windows\System\HEdbqfg.exe
  C:\Windows\System\HEdbqfg.exe
  2⤵
  PID:8696
- C:\Windows\System\zuOkerf.exe
  C:\Windows\System\zuOkerf.exe
  2⤵
  PID:8716
- C:\Windows\System\rpuokdB.exe
  C:\Windows\System\rpuokdB.exe
  2⤵
  PID:8732
- C:\Windows\System\KFOlYPI.exe
  C:\Windows\System\KFOlYPI.exe
  2⤵
  PID:8748
- C:\Windows\System\iHjArUW.exe
  C:\Windows\System\iHjArUW.exe
  2⤵
  PID:8768
- C:\Windows\System\SfRHuGV.exe
  C:\Windows\System\SfRHuGV.exe
  2⤵
  PID:8784
- C:\Windows\System\VqjzWsD.exe
  C:\Windows\System\VqjzWsD.exe
  2⤵
  PID:8800
- C:\Windows\System\shWWfNN.exe
  C:\Windows\System\shWWfNN.exe
  2⤵
  PID:8816
- C:\Windows\System\FmwMgaL.exe
  C:\Windows\System\FmwMgaL.exe
  2⤵
  PID:8832
- C:\Windows\System\vlNbQaJ.exe
  C:\Windows\System\vlNbQaJ.exe
  2⤵
  PID:8852
- C:\Windows\System\REoddvc.exe
  C:\Windows\System\REoddvc.exe
  2⤵
  PID:8868
- C:\Windows\System\EoWUEIL.exe
  C:\Windows\System\EoWUEIL.exe
  2⤵
  PID:8888
- C:\Windows\System\nZwrBRx.exe
  C:\Windows\System\nZwrBRx.exe
  2⤵
  PID:8904
- C:\Windows\System\JOqiccd.exe
  C:\Windows\System\JOqiccd.exe
  2⤵
  PID:8920
- C:\Windows\System\WmeWycJ.exe
  C:\Windows\System\WmeWycJ.exe
  2⤵
  PID:8936
- C:\Windows\System\bhvHNAI.exe
  C:\Windows\System\bhvHNAI.exe
  2⤵
  PID:8952
- C:\Windows\System\LzmHgLK.exe
  C:\Windows\System\LzmHgLK.exe
  2⤵
  PID:8968
- C:\Windows\System\IXYgFhu.exe
  C:\Windows\System\IXYgFhu.exe
  2⤵
  PID:8984
- C:\Windows\System\PMRVWbh.exe
  C:\Windows\System\PMRVWbh.exe
  2⤵
  PID:9000
- C:\Windows\System\mjcZxUv.exe
  C:\Windows\System\mjcZxUv.exe
  2⤵
  PID:9016
- C:\Windows\System\TmFRoFu.exe
  C:\Windows\System\TmFRoFu.exe
  2⤵
  PID:9036
- C:\Windows\System\aXmqOFu.exe
  C:\Windows\System\aXmqOFu.exe
  2⤵
  PID:9052
- C:\Windows\System\FFFFtkM.exe
  C:\Windows\System\FFFFtkM.exe
  2⤵
  PID:9072
- C:\Windows\System\vDWiUfA.exe
  C:\Windows\System\vDWiUfA.exe
  2⤵
  PID:9200
- C:\Windows\System\CyFmWHN.exe
  C:\Windows\System\CyFmWHN.exe
  2⤵
  PID:8148
- C:\Windows\System\uQMONMX.exe
  C:\Windows\System\uQMONMX.exe
  2⤵
  PID:8160
- C:\Windows\System\rCsfLuZ.exe
  C:\Windows\System\rCsfLuZ.exe
  2⤵
  PID:7764
- C:\Windows\System\zKUAiFE.exe
  C:\Windows\System\zKUAiFE.exe
  2⤵
  PID:8204
- C:\Windows\System\wlSNywW.exe
  C:\Windows\System\wlSNywW.exe
  2⤵
  PID:8212
- C:\Windows\System\FIqifyk.exe
  C:\Windows\System\FIqifyk.exe
  2⤵
  PID:8368
- C:\Windows\System\VsflEda.exe
  C:\Windows\System\VsflEda.exe
  2⤵
  PID:8248
- C:\Windows\System\MYklPLb.exe
  C:\Windows\System\MYklPLb.exe
  2⤵
  PID:8316
- C:\Windows\System\lgqZNlp.exe
  C:\Windows\System\lgqZNlp.exe
  2⤵
  PID:8380
- C:\Windows\System\ICQmBMh.exe
  C:\Windows\System\ICQmBMh.exe
  2⤵
  PID:8396
- C:\Windows\System\vuffJsA.exe
  C:\Windows\System\vuffJsA.exe
  2⤵
  PID:8412
- C:\Windows\System\rkrmkIR.exe
  C:\Windows\System\rkrmkIR.exe
  2⤵
  PID:8476
- C:\Windows\System\PxweGbT.exe
  C:\Windows\System\PxweGbT.exe
  2⤵
  PID:8424
- C:\Windows\System\DSmqLAc.exe
  C:\Windows\System\DSmqLAc.exe
  2⤵
  PID:8492
- C:\Windows\System\CzWKItD.exe
  C:\Windows\System\CzWKItD.exe
  2⤵
  PID:8540
- C:\Windows\System\gTzFbWD.exe
  C:\Windows\System\gTzFbWD.exe
  2⤵
  PID:8604
- C:\Windows\System\ZwDBojq.exe
  C:\Windows\System\ZwDBojq.exe
  2⤵
  PID:8556
- C:\Windows\System\DsTAnOp.exe
  C:\Windows\System\DsTAnOp.exe
  2⤵
  PID:8676
- C:\Windows\System\EEKXMfJ.exe
  C:\Windows\System\EEKXMfJ.exe
  2⤵
  PID:8560
- C:\Windows\System\pUaMrOD.exe
  C:\Windows\System\pUaMrOD.exe
  2⤵
  PID:8744
- C:\Windows\System\pVurtzO.exe
  C:\Windows\System\pVurtzO.exe
  2⤵
  PID:8688
- C:\Windows\System\ZjjjvvQ.exe
  C:\Windows\System\ZjjjvvQ.exe
  2⤵
  PID:8812
- C:\Windows\System\doYDcTT.exe
  C:\Windows\System\doYDcTT.exe
  2⤵
  PID:8764
- C:\Windows\System\SkFtYyx.exe
  C:\Windows\System\SkFtYyx.exe
  2⤵
  PID:8692
- C:\Windows\System\uHbYGpX.exe
  C:\Windows\System\uHbYGpX.exe
  2⤵
  PID:8756
- C:\Windows\System\DPdVhkT.exe
  C:\Windows\System\DPdVhkT.exe
  2⤵
  PID:8792
- C:\Windows\System\CZLXlnO.exe
  C:\Windows\System\CZLXlnO.exe
  2⤵
  PID:8896
- C:\Windows\System\qQWkKMF.exe
  C:\Windows\System\qQWkKMF.exe
  2⤵
  PID:8944
- C:\Windows\System\kPCMEEj.exe
  C:\Windows\System\kPCMEEj.exe
  2⤵
  PID:8976
- C:\Windows\System\PYVstqs.exe
  C:\Windows\System\PYVstqs.exe
  2⤵
  PID:8992
- C:\Windows\System\PxCpieb.exe
  C:\Windows\System\PxCpieb.exe
  2⤵
  PID:9028
- C:\Windows\System\DmQNqeG.exe
  C:\Windows\System\DmQNqeG.exe
  2⤵
  PID:9064
- C:\Windows\System\wzsYiRR.exe
  C:\Windows\System\wzsYiRR.exe
  2⤵
  PID:9092
- C:\Windows\System\bXEzYCR.exe
  C:\Windows\System\bXEzYCR.exe
  2⤵
  PID:9124
- C:\Windows\System\nlOhyza.exe
  C:\Windows\System\nlOhyza.exe
  2⤵
  PID:9144
- C:\Windows\System\KnHdUhH.exe
  C:\Windows\System\KnHdUhH.exe
  2⤵
  PID:9156
- C:\Windows\System\jLpekul.exe
  C:\Windows\System\jLpekul.exe
  2⤵
  PID:7692
- C:\Windows\System\BKVUMoO.exe
  C:\Windows\System\BKVUMoO.exe
  2⤵
  PID:7324
- C:\Windows\System\CAoBSIC.exe
  C:\Windows\System\CAoBSIC.exe
  2⤵
  PID:8200
- C:\Windows\System\Shrswho.exe
  C:\Windows\System\Shrswho.exe
  2⤵
  PID:8280
- C:\Windows\System\ZFefqeW.exe
  C:\Windows\System\ZFefqeW.exe
  2⤵
  PID:8208
- C:\Windows\System\rbCbLSi.exe
  C:\Windows\System\rbCbLSi.exe
  2⤵
  PID:8376
- C:\Windows\System\VPQHOeM.exe
  C:\Windows\System\VPQHOeM.exe
  2⤵
  PID:9088
- C:\Windows\System\NZOJamU.exe
  C:\Windows\System\NZOJamU.exe
  2⤵
  PID:8496
- C:\Windows\System\xXnNtBL.exe
  C:\Windows\System\xXnNtBL.exe
  2⤵
  PID:8644
- C:\Windows\System\QedXBRu.exe
  C:\Windows\System\QedXBRu.exe
  2⤵
  PID:8780
- C:\Windows\System\jsFgTte.exe
  C:\Windows\System\jsFgTte.exe
  2⤵
  PID:8860
- C:\Windows\System\DzTyGWY.exe
  C:\Windows\System\DzTyGWY.exe
  2⤵
  PID:8980
- C:\Windows\System\nQZSmhh.exe
  C:\Windows\System\nQZSmhh.exe
  2⤵
  PID:9100
- C:\Windows\System\qNuwqXG.exe
  C:\Windows\System\qNuwqXG.exe
  2⤵
  PID:9104
- C:\Windows\System\SYazdGn.exe
  C:\Windows\System\SYazdGn.exe
  2⤵
  PID:8456
- C:\Windows\System\LNMZYTV.exe
  C:\Windows\System\LNMZYTV.exe
  2⤵
  PID:8524
- C:\Windows\System\HJCfFvV.exe
  C:\Windows\System\HJCfFvV.exe
  2⤵
  PID:8708
- C:\Windows\System\OrOHkrB.exe
  C:\Windows\System\OrOHkrB.exe
  2⤵
  PID:8728
- C:\Windows\System\JDYwXyX.exe
  C:\Windows\System\JDYwXyX.exe
  2⤵
  PID:8884
- C:\Windows\System\SfbgWvK.exe
  C:\Windows\System\SfbgWvK.exe
  2⤵
  PID:8960
- C:\Windows\System\zgyrusL.exe
  C:\Windows\System\zgyrusL.exe
  2⤵
  PID:9132
- C:\Windows\System\zCfqVMm.exe
  C:\Windows\System\zCfqVMm.exe
  2⤵
  PID:9176
- C:\Windows\System\hkHMNcS.exe
  C:\Windows\System\hkHMNcS.exe
  2⤵
  PID:9196
- C:\Windows\System\lVqYnIF.exe
  C:\Windows\System\lVqYnIF.exe
  2⤵
  PID:7860
- C:\Windows\System\fTmaLIV.exe
  C:\Windows\System\fTmaLIV.exe
  2⤵
  PID:8296
- C:\Windows\System\ZLgICxp.exe
  C:\Windows\System\ZLgICxp.exe
  2⤵
  PID:8332
- C:\Windows\System\ELGXDwG.exe
  C:\Windows\System\ELGXDwG.exe
  2⤵
  PID:1564
- C:\Windows\System\XZiTAre.exe
  C:\Windows\System\XZiTAre.exe
  2⤵
  PID:8196
- C:\Windows\System\tVwvWHq.exe
  C:\Windows\System\tVwvWHq.exe
  2⤵
  PID:8240
- C:\Windows\System\hjyAgUh.exe
  C:\Windows\System\hjyAgUh.exe
  2⤵
  PID:8404
- C:\Windows\System\hsMXcWu.exe
  C:\Windows\System\hsMXcWu.exe
  2⤵
  PID:8572
- C:\Windows\System\nEeGmnj.exe
  C:\Windows\System\nEeGmnj.exe
  2⤵
  PID:9048
- C:\Windows\System\ITVAGDD.exe
  C:\Windows\System\ITVAGDD.exe
  2⤵
  PID:8740
- C:\Windows\System\AwVCtjE.exe
  C:\Windows\System\AwVCtjE.exe
  2⤵
  PID:9112
- C:\Windows\System\uTZcQHE.exe
  C:\Windows\System\uTZcQHE.exe
  2⤵
  PID:9136
- C:\Windows\System\PtKNQEm.exe
  C:\Windows\System\PtKNQEm.exe
  2⤵
  PID:9172
- C:\Windows\System\kqXaPhD.exe
  C:\Windows\System\kqXaPhD.exe
  2⤵
  PID:8300
- C:\Windows\System\QKuxnHr.exe
  C:\Windows\System\QKuxnHr.exe
  2⤵
  PID:9068
- C:\Windows\System\qwFOCes.exe
  C:\Windows\System\qwFOCes.exe
  2⤵
  PID:9184
- C:\Windows\System\JlxpiyE.exe
  C:\Windows\System\JlxpiyE.exe
  2⤵
  PID:8364
- C:\Windows\System\xzERbTe.exe
  C:\Windows\System\xzERbTe.exe
  2⤵
  PID:8372
- C:\Windows\System\JKpFTiI.exe
  C:\Windows\System\JKpFTiI.exe
  2⤵
  PID:8576
- C:\Windows\System\ZHefqeG.exe
  C:\Windows\System\ZHefqeG.exe
  2⤵
  PID:8244
- C:\Windows\System\cQXkzHl.exe
  C:\Windows\System\cQXkzHl.exe
  2⤵
  PID:9024
- C:\Windows\System\zbvejuc.exe
  C:\Windows\System\zbvejuc.exe
  2⤵
  PID:8052
- C:\Windows\System\gAFfZGE.exe
  C:\Windows\System\gAFfZGE.exe
  2⤵
  PID:9212
- C:\Windows\System\oyOQxVj.exe
  C:\Windows\System\oyOQxVj.exe
  2⤵
  PID:9140
- C:\Windows\System\OtLdyWt.exe
  C:\Windows\System\OtLdyWt.exe
  2⤵
  PID:9220
- C:\Windows\System\hQAbOdi.exe
  C:\Windows\System\hQAbOdi.exe
  2⤵
  PID:9240
- C:\Windows\System\QEjlWIG.exe
  C:\Windows\System\QEjlWIG.exe
  2⤵
  PID:9256
- C:\Windows\System\DPjGbYn.exe
  C:\Windows\System\DPjGbYn.exe
  2⤵
  PID:9272
- C:\Windows\System\brOvUDd.exe
  C:\Windows\System\brOvUDd.exe
  2⤵
  PID:9368
- C:\Windows\System\zHDwfSZ.exe
  C:\Windows\System\zHDwfSZ.exe
  2⤵
  PID:9384
- C:\Windows\System\HmfDinL.exe
  C:\Windows\System\HmfDinL.exe
  2⤵
  PID:9400
- C:\Windows\System\AgJgShI.exe
  C:\Windows\System\AgJgShI.exe
  2⤵
  PID:9416
- C:\Windows\System\pHmdtjD.exe
  C:\Windows\System\pHmdtjD.exe
  2⤵
  PID:9432
- C:\Windows\System\OBnzWyY.exe
  C:\Windows\System\OBnzWyY.exe
  2⤵
  PID:9448
- C:\Windows\System\JqFsRlS.exe
  C:\Windows\System\JqFsRlS.exe
  2⤵
  PID:9464
- C:\Windows\System\fedHiiw.exe
  C:\Windows\System\fedHiiw.exe
  2⤵
  PID:9480
- C:\Windows\System\gsKdPWr.exe
  C:\Windows\System\gsKdPWr.exe
  2⤵
  PID:9500
- C:\Windows\System\GQRDOhM.exe
  C:\Windows\System\GQRDOhM.exe
  2⤵
  PID:9516
- C:\Windows\System\svTNest.exe
  C:\Windows\System\svTNest.exe
  2⤵
  PID:9532
- C:\Windows\System\MFgkESD.exe
  C:\Windows\System\MFgkESD.exe
  2⤵
  PID:9548
- C:\Windows\System\mSJjvMD.exe
  C:\Windows\System\mSJjvMD.exe
  2⤵
  PID:9568
- C:\Windows\System\KFzkihu.exe
  C:\Windows\System\KFzkihu.exe
  2⤵
  PID:9584
- C:\Windows\System\FagoFND.exe
  C:\Windows\System\FagoFND.exe
  2⤵
  PID:9608
- C:\Windows\System\aQuaJcX.exe
  C:\Windows\System\aQuaJcX.exe
  2⤵
  PID:9624
- C:\Windows\System\IcxmYAd.exe
  C:\Windows\System\IcxmYAd.exe
  2⤵
  PID:9640
- C:\Windows\System\OPXpzHJ.exe
  C:\Windows\System\OPXpzHJ.exe
  2⤵
  PID:9656
- C:\Windows\System\LfOFucZ.exe
  C:\Windows\System\LfOFucZ.exe
  2⤵
  PID:9676
- C:\Windows\System\BGxOtZl.exe
  C:\Windows\System\BGxOtZl.exe
  2⤵
  PID:9692
- C:\Windows\System\TVGrkQy.exe
  C:\Windows\System\TVGrkQy.exe
  2⤵
  PID:9708
- C:\Windows\System\SqYtODU.exe
  C:\Windows\System\SqYtODU.exe
  2⤵
  PID:9724
- C:\Windows\System\ZExQAes.exe
  C:\Windows\System\ZExQAes.exe
  2⤵
  PID:9740
- C:\Windows\System\OTlRaCg.exe
  C:\Windows\System\OTlRaCg.exe
  2⤵
  PID:9756
- C:\Windows\System\YrSVzAq.exe
  C:\Windows\System\YrSVzAq.exe
  2⤵
  PID:9772
- C:\Windows\System\QdnuCrh.exe
  C:\Windows\System\QdnuCrh.exe
  2⤵
  PID:9788
- C:\Windows\System\KOplXhC.exe
  C:\Windows\System\KOplXhC.exe
  2⤵
  PID:9804
- C:\Windows\System\igHedct.exe
  C:\Windows\System\igHedct.exe
  2⤵
  PID:9820
- C:\Windows\System\CnkTFhU.exe
  C:\Windows\System\CnkTFhU.exe
  2⤵
  PID:9836
- C:\Windows\System\zXqWklp.exe
  C:\Windows\System\zXqWklp.exe
  2⤵
  PID:9852
- C:\Windows\System\CoaBBBM.exe
  C:\Windows\System\CoaBBBM.exe
  2⤵
  PID:9868
- C:\Windows\System\hakRmYW.exe
  C:\Windows\System\hakRmYW.exe
  2⤵
  PID:9884
- C:\Windows\System\mfUUxPe.exe
  C:\Windows\System\mfUUxPe.exe
  2⤵
  PID:9900
- C:\Windows\System\RcJUFeF.exe
  C:\Windows\System\RcJUFeF.exe
  2⤵
  PID:9916
- C:\Windows\System\GgIDUIp.exe
  C:\Windows\System\GgIDUIp.exe
  2⤵
  PID:9932
- C:\Windows\System\pXtFgKQ.exe
  C:\Windows\System\pXtFgKQ.exe
  2⤵
  PID:9948
- C:\Windows\System\YbrMTiV.exe
  C:\Windows\System\YbrMTiV.exe
  2⤵
  PID:9964
- C:\Windows\System\gNhSsII.exe
  C:\Windows\System\gNhSsII.exe
  2⤵
  PID:9980
- C:\Windows\System\LECMnjO.exe
  C:\Windows\System\LECMnjO.exe
  2⤵
  PID:9996
- C:\Windows\System\cLcFAkj.exe
  C:\Windows\System\cLcFAkj.exe
  2⤵
  PID:10012
- C:\Windows\System\hBErDTz.exe
  C:\Windows\System\hBErDTz.exe
  2⤵
  PID:10028
- C:\Windows\System\alYxqVw.exe
  C:\Windows\System\alYxqVw.exe
  2⤵
  PID:10044
- C:\Windows\System\NEbQxAQ.exe
  C:\Windows\System\NEbQxAQ.exe
  2⤵
  PID:10060
- C:\Windows\System\uiTAqYu.exe
  C:\Windows\System\uiTAqYu.exe
  2⤵
  PID:10076
- C:\Windows\System\MDsFwwb.exe
  C:\Windows\System\MDsFwwb.exe
  2⤵
  PID:10092
- C:\Windows\System\XrBSNGI.exe
  C:\Windows\System\XrBSNGI.exe
  2⤵
  PID:10108
- C:\Windows\System\VYrzVOT.exe
  C:\Windows\System\VYrzVOT.exe
  2⤵
  PID:10124
- C:\Windows\System\EbIHtmy.exe
  C:\Windows\System\EbIHtmy.exe
  2⤵
  PID:10160
- C:\Windows\System\MldNAFF.exe
  C:\Windows\System\MldNAFF.exe
  2⤵
  PID:10176
- C:\Windows\System\GgHoKXH.exe
  C:\Windows\System\GgHoKXH.exe
  2⤵
  PID:10192
- C:\Windows\System\VJerIOS.exe
  C:\Windows\System\VJerIOS.exe
  2⤵
  PID:10212
- C:\Windows\System\HLinDGF.exe
  C:\Windows\System\HLinDGF.exe
  2⤵
  PID:10228
- C:\Windows\System\qjqRZPg.exe
  C:\Windows\System\qjqRZPg.exe
  2⤵
  PID:9168
- C:\Windows\System\PeuDbyQ.exe
  C:\Windows\System\PeuDbyQ.exe
  2⤵
  PID:9252
- C:\Windows\System\tSSQXiG.exe
  C:\Windows\System\tSSQXiG.exe
  2⤵
  PID:8228
- C:\Windows\System\MKJTrED.exe
  C:\Windows\System\MKJTrED.exe
  2⤵
  PID:8264
- C:\Windows\System\dbtDBBj.exe
  C:\Windows\System\dbtDBBj.exe
  2⤵
  PID:9264
- C:\Windows\System\zCawqOy.exe
  C:\Windows\System\zCawqOy.exe
  2⤵
  PID:9292
- C:\Windows\System\KOJxFeW.exe
  C:\Windows\System\KOJxFeW.exe
  2⤵
  PID:9308
- C:\Windows\System\TcFtOKz.exe
  C:\Windows\System\TcFtOKz.exe
  2⤵
  PID:9320
- C:\Windows\System\mLkjigV.exe
  C:\Windows\System\mLkjigV.exe
  2⤵
  PID:9340
- C:\Windows\System\Kxienya.exe
  C:\Windows\System\Kxienya.exe
  2⤵
  PID:9356
- C:\Windows\System\RlbrGSR.exe
  C:\Windows\System\RlbrGSR.exe
  2⤵
  PID:9364
- C:\Windows\System\VPPNyIb.exe
  C:\Windows\System\VPPNyIb.exe
  2⤵
  PID:9412
- C:\Windows\System\eQoFDlL.exe
  C:\Windows\System\eQoFDlL.exe
  2⤵
  PID:9476
- C:\Windows\System\rwyuUyc.exe
  C:\Windows\System\rwyuUyc.exe
  2⤵
  PID:9544
- C:\Windows\System\OCfEDfu.exe
  C:\Windows\System\OCfEDfu.exe
  2⤵
  PID:9460
- C:\Windows\System\ikPlLIC.exe
  C:\Windows\System\ikPlLIC.exe
  2⤵
  PID:9524
- C:\Windows\System\uXifxoe.exe
  C:\Windows\System\uXifxoe.exe
  2⤵
  PID:9564
- C:\Windows\System\VEXMmnc.exe
  C:\Windows\System\VEXMmnc.exe
  2⤵
  PID:9604
- C:\Windows\System\WsNCmuy.exe
  C:\Windows\System\WsNCmuy.exe
  2⤵
  PID:9664
- C:\Windows\System\LRmcRmt.exe
  C:\Windows\System\LRmcRmt.exe
  2⤵
  PID:9704
- C:\Windows\System\qvPtXPU.exe
  C:\Windows\System\qvPtXPU.exe
  2⤵
  PID:9764
- C:\Windows\System\uyToLiK.exe
  C:\Windows\System\uyToLiK.exe
  2⤵
  PID:9652
- C:\Windows\System\aZQHvWW.exe
  C:\Windows\System\aZQHvWW.exe
  2⤵
  PID:9720
- C:\Windows\System\kBdImYt.exe
  C:\Windows\System\kBdImYt.exe
  2⤵
  PID:9784
- C:\Windows\System\JZrbXis.exe
  C:\Windows\System\JZrbXis.exe
  2⤵
  PID:10084
- C:\Windows\System\ScaayXO.exe
  C:\Windows\System\ScaayXO.exe
  2⤵
  PID:9944
- C:\Windows\System\gaGGHVi.exe
  C:\Windows\System\gaGGHVi.exe
  2⤵
  PID:10036
- C:\Windows\System\qCueukn.exe
  C:\Windows\System\qCueukn.exe
  2⤵
  PID:10100
- C:\Windows\System\udpLPQe.exe
  C:\Windows\System\udpLPQe.exe
  2⤵
  PID:2976
- C:\Windows\System\NJjElWq.exe
  C:\Windows\System\NJjElWq.exe
  2⤵
  PID:10148
- C:\Windows\System\woJnEHv.exe
  C:\Windows\System\woJnEHv.exe
  2⤵
  PID:10172
- C:\Windows\System\gxSrICP.exe
  C:\Windows\System\gxSrICP.exe
  2⤵
  PID:10188
- C:\Windows\System\jURprEB.exe
  C:\Windows\System\jURprEB.exe
  2⤵
  PID:9248
- C:\Windows\System\izSJpxI.exe
  C:\Windows\System\izSJpxI.exe
  2⤵
  PID:8760
- C:\Windows\System\wCIuVeZ.exe
  C:\Windows\System\wCIuVeZ.exe
  2⤵
  PID:9236
- C:\Windows\System\hgeFILR.exe
  C:\Windows\System\hgeFILR.exe
  2⤵
  PID:9012
- C:\Windows\System\MFXnutM.exe
  C:\Windows\System\MFXnutM.exe
  2⤵
  PID:9328
- C:\Windows\System\DnsmNjn.exe
  C:\Windows\System\DnsmNjn.exe
  2⤵
  PID:9348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AVeNmhm.exe

Filesize
2.2MB

MD5
b1526c23d09982e8dca65d2eb227ea2f

SHA1
6b965701a5427d3c0a8426128f897a871758d7ac

SHA256
5eeac7f56219c2eb5c2a3fef9f2c7c721f7d2f4f05cd4f8c20257b2ee94dae21

SHA512
59873fe4182e3c9d1fc63b10d6e83b1e0437d7294be4c92d6d744ab7bf13383f6649da409fac0baf7b3459532277af50f84b95b943ad88e555705a006f8d094b

Download Submit
C:\Windows\system\HJyRkOy.exe

Filesize
2.2MB

MD5
f77f299dc89d91f2f0096bcf0c5c06e9

SHA1
4f08f9bae1fc9e2040030f21d982f2a787c188e2

SHA256
b8eaa9c05ff9536dbe16d32cb30f63f570fff250fed9bc287006e2f33ddea95a

SHA512
da10147c667ae726c2c170c52a87561402baeba994639f1a1f411d723ff3282f3fbbf2f497d3368078f018abb5969483a66aa7069367bbbc7ae49a55a5dddeac

Download Submit
C:\Windows\system\HYEHTqC.exe

Filesize
2.2MB

MD5
83bc05b1a24b79516b3cd933b2833a8e

SHA1
242698ed20bbcfd0aefbbc238817a2e1dec39637

SHA256
9cac85dbe2b51d82120d193885b0d61f7f523f97f097d762492144608abd3759

SHA512
c9316d0864b0ba849deb23474f9315e99dc1f38bf1cf147a4d83a5bc148d52a90d27fc54cc2bc426bfeb66bae6827d7e744528a45927578083ed6490f0ea36ed

Download Submit
C:\Windows\system\JWTqiin.exe

Filesize
2.2MB

MD5
68275c8c3ce9d65c54cbac7773cd1afc

SHA1
9095cb7ec3c9e1feaff4e481a4ae7868e8ffda93

SHA256
751852a9f0a7956ddbac3915966fadde357175ee65a07c9361a1c4af1ca19740

SHA512
ec7ebe043cf7e0e0408d696a6133d6e2c625205237533c621e4754e573ec0798ab6b1a898ac15b05f4e2551d2cc7233adb4f2c6696e9a6f381f7e6bf00113a65

Download Submit
C:\Windows\system\KcZlUJV.exe

Filesize
2.2MB

MD5
51245f14c8842f58ee8c0f3258937bcf

SHA1
7bac09014ebf2334a282cd15f7b5b346e3fcde16

SHA256
b313093307933a5e692740aa392ef2b7b95662b55e8dc45987df71323c0a2a68

SHA512
e98e2d9c20ba0eb6117ef622db38f759a897066040727bfc322b0981ce25a1bb40202d88e2a00e4d83ff89e4a9ea54fc646fad53b79d1a45c6231f9bd56e2188

Download Submit
C:\Windows\system\LfGCzAy.exe

Filesize
2.2MB

MD5
44458ae54ff5b52bfc10db7417d90ab5

SHA1
937200141a199b856d31a9771566d2afab20a6ea

SHA256
ec161fce18ba951c6ed991be9daa71874f7dfc93b4c020f82d63d054df197609

SHA512
b37f4b53c5123975fc4ae932e0f28cbfbd21f983e7013d5d612d307272b642424b574591f90937408543b0515f23c0bb5359290249840739075a9f5d597224be

Download Submit
C:\Windows\system\NshnUif.exe

Filesize
2.2MB

MD5
3449e00b272a7bb99d439d1d08ef97c3

SHA1
7cfc69328cb879451dc6317dd99bf4b5f155e4ab

SHA256
90f800f8148551def4d8a98ca6e81514b82223df555d625aa7b9682fffe407c7

SHA512
6a82944e6c9fc9f212e15d2ee314881e2d9e10683b6c9eed0fcb43d81f74d80c498de6a620a1b30cc63b58f1b2596f68aa3c49807c931207c060e220608a63b0

Download Submit
C:\Windows\system\SEIsYRt.exe

Filesize
2.2MB

MD5
e420eaedfd8177626785344ef198fe0e

SHA1
dc5fbc1da91d392eea9df584abeac3f2bd828d81

SHA256
16f26dafb995a8e7f2cba88ec777b7bc73de075af426171c357bf40c7e397d51

SHA512
bbbc395d5df731897887d2f531159a668fb8c35de6f6aeee000fa9a231bcdfb36eb3357c1d1fcf18a761a76a01492a726ae30e0a15efc3b11ef388bea1d27b1c

Download Submit
C:\Windows\system\TiDvqYt.exe

Filesize
2.2MB

MD5
f17dded13298705cdd6544e3d8c04186

SHA1
1e6303222063c244b365810737eeeccd22510776

SHA256
28984ce4c48d2adfcdb8fe4e584b0ccc7b6450a6b5c6d34f7ec891aa8da6f883

SHA512
de0e13db644c85064122f550d29f2fc693b3fe56011a98605b1ef3dd4e9ee8785cdc4708e69ba822d6839e14cb9d8bc0828b05dd642956af9d04c8f16fa19824

Download Submit
C:\Windows\system\VHOOEWg.exe

Filesize
2.2MB

MD5
73a4366992250bfeaba554f8d627e044

SHA1
5e1e990ab493507147d48d2bb4324003e2b047de

SHA256
da14536372dfc4e85a17d6c555f3544654ed2ee68f7a2b9050f232e5e0602df4

SHA512
cd2faa47ed2d22867c2ab777f4d616544e4949544d085499300462abe0c75c6a4001aa60b08c9e7e7dbca4a02832f57e5394d75a18112b5f37e6c830f6c09eac

Download Submit
C:\Windows\system\VwMQySf.exe

Filesize
2.2MB

MD5
2b3b9d2bcee53aecc0b37cb18ea0ef45

SHA1
6f11860e655e3cccb565bc488c49a8d3b59361b8

SHA256
59953b58c79433eae76b9d29cf7f5a703ce12bbb7595f3a59a88ae96c8351994

SHA512
be94824a41d3fd7e8fc6de91e3ba98e38363abc3560ee2ed5d16d62e64682206d40ce3787828fec6658e8b2893ba154c1f0b96f2f4210145363d9831e425bfc3

Download Submit
C:\Windows\system\WzLmezN.exe

Filesize
2.2MB

MD5
53e4f0b1c3d183490bd7bb8299a0c253

SHA1
0a61318fe885ded336ee7f656719db34a292d2bf

SHA256
83f61324562fc053d2d222574c5d861fb63c80f3a2f4e2d14502034ce05d7f00

SHA512
463a6b917e2b5c03fdfb6c06cdc2cd9b143ac390aead0d9c0762b1528eaba279d19ee4b5fe2ff1136a25f755357ad875a210170df0aee329f3bd7ff705775522

Download Submit
C:\Windows\system\akcChKq.exe

Filesize
2.2MB

MD5
d391db4263377dbd992cd3138da44a4d

SHA1
95931d2045516e3673a5db53df67aedc150c1b8e

SHA256
83613a93b2d34d12d97afbaa896bbb7349676c4fd0b0f6b49eca4469dee07aa9

SHA512
dc6efc1a065ea6d6a4b633de82ad08a7ba102c5f7ad7b2e1c3d5ad85cfdb61bf0d60ea979be413a9301a6db4fb5b835f7de31e0f1e917aeda60385ac4bf31f36

Download Submit
C:\Windows\system\cjDEuHz.exe

Filesize
2.2MB

MD5
b97ac887c3bab4d9134aa38fcf6224aa

SHA1
2f146536ac875d119f2e35b1d632c58a38869c29

SHA256
ed98dc0720cc0f8ac2873b8e0185c1b9b3a5db2e516da7cdf635187b84c445e7

SHA512
b8f33fe0b39a82f1caeaf56b803339f67fac920b69dc0166d753e0f596358d1ffc40d8e9c840746640e420f8353646e9132403d182a5cee888631d4bff8ec034

Download Submit
C:\Windows\system\dpAmfrN.exe

Filesize
2.2MB

MD5
c23143b0caec1889dd0e418a27d72cfc

SHA1
dbf35b4e622d0dc7ab60c5b059295a8f9ebef381

SHA256
d225de6d82003b63f6fc2d76b560aab6f92fc8d298f0a750f15347d7adb65171

SHA512
013ab22e95e05db124faf35815327f1919213685251f8c81024d0230565141cee64605537ee6218a6bcf733e14f6a01a83ea8bcf271e24ee6f0bd7e04e4ee538

Download Submit
C:\Windows\system\fjpOMiQ.exe

Filesize
2.2MB

MD5
ff9c5c54518e9aae37692beeaa866f1f

SHA1
04c4708a1d1ecf32992a6386d1a69500029984c1

SHA256
b6827612a5c0f37d56a91bf221a3fb2e7197337ff5613dfa07b6475ea80913b3

SHA512
9fb698b96f68c32471cec533d22b6ddd5199d46c590a4d93f16fb15d67f520139d1d725e71765d9460060b2179f85c2ee148357dfa6c73b807fb899264e17d1a

Download Submit
C:\Windows\system\hznBiha.exe

Filesize
2.2MB

MD5
2c38419388c46932854a1603056d9ceb

SHA1
9863ced6bef34d3ca1b0a0d60ceecfb062391e52

SHA256
fcde54008d584816f0596bc06500f8b3d6d86e655ee3561635ec0643b4b2dfd1

SHA512
38c0699d7478760e01d81f32cd09c2c5ec58bc0654e1984327cbfddd5013f03669c205318146fa33f19140e52ddd25a3661e0eb787f8dc922bbc5f86b2aacacf

Download Submit
C:\Windows\system\idvdyfL.exe

Filesize
2.2MB

MD5
5d9fe23aed7282a44254349cb70152df

SHA1
7a2ba97e3f42e4c9215e683a9d17842ee19ac6b9

SHA256
cba1232ba3b6067550c5edf6457fc61064366014137d1d8400cd53fc4dde09f7

SHA512
5cb6a2dfcf2f4a38def69427aab1229399c5b01f0d4673111037c6b88a17b9d458beec1c38224ffac45112eb005b006afc7471612651aad004dbbf3f41050385

Download Submit
C:\Windows\system\kmYDrRb.exe

Filesize
2.2MB

MD5
531fc9b4555bd9319c77f6b21b532266

SHA1
c6b830bcde543505e2000b2666c8fed3ff748ded

SHA256
f0328b3955ccd64ca89b45d233f26fb4108a3e73d635084a59a9372e3a1110ee

SHA512
d00a0d855855240115f410696daa3d72ea060c6501135fd6bcd8e7b73618b1a28368236dc59bbdecb897ac95b292b8ce82f916328754d13c4b37bf8b501dcc48

Download Submit
C:\Windows\system\kuxgzkg.exe

Filesize
2.2MB

MD5
ddf928d5acdc5c0484d3fdf99e44d120

SHA1
84b1a41d15c6f288cd857f72b3d46d889af412c0

SHA256
569e5f066da1ae5e6aa89a4464789d62da95b24e3bdea80a05557cd4d3f58561

SHA512
2df13ddf38d01855aa749abf05e765fda58d94540a4a6f5fac5b4620f44f0c34b006dbe39813612e1ba4aca6b465676661b32bef8417a10906a49a1c4cf8d265

Download Submit
C:\Windows\system\mDzrjoc.exe

Filesize
2.2MB

MD5
dd0993cc6e414c44a9776c2728bbcbe3

SHA1
698a808a03ef118c37c957167dd703fec273fe70

SHA256
090647a57d5a4d154dfe79f3b44d351d235544ab5941f15559dcd1ac3a756919

SHA512
c867a8f5438813213dee64eb870b94fd383daeb0e2d99e319046f8d7fa8b1da28c682292af3f441ec457c3d28453575d81b3d03a6b0084203ff45e7604641d67

Download Submit
C:\Windows\system\nkWakJZ.exe

Filesize
2.2MB

MD5
332e6805c4ac6f526957868fa0bc5f8a

SHA1
662fb19b678e843fe85174a16e58a45582f61bc4

SHA256
07faddd48b6edac63b5c9847ee32acd2ac2089de7ab162a839309a3b85ed7828

SHA512
76683e32597cbdbdb517cbc5925990d679162780882f87d3ec0e420626432398c875727ab23752bb58d42348d5b26e34ea16e70e73f1b815a451862ee38775d1

Download Submit
C:\Windows\system\qshHsso.exe

Filesize
2.2MB

MD5
88785c7322043cd6d0aabcb4c5520565

SHA1
c7adb555fe36a5dea40d1c6ad77b0dcf6da124c9

SHA256
1239696cae7e10efc43b17dfac883adea9f1169d08b222b5dfdb4ff1f1b1f84b

SHA512
eebaefa2ef9a46dceddd4efb64bde65deec57775dccf309c67df19bd2077b3d7d49716c0df343fcd753cc0607560b1502510043ac70c85ccf72a2027e4fd913f

Download Submit
C:\Windows\system\vJwmfxu.exe

Filesize
2.2MB

MD5
56c378ded472d4f7387b43af4d489ff4

SHA1
c7bb5f26265056ce49a99df7e53d8c6337c4c2b4

SHA256
00634a624b749be9813de85e1541186fb099b677b5b8a4fb01d3574f5514a5d4

SHA512
685a4142e49f34e9c55d37129723eee4409de93e4bb479d8a5876f617b8619abcac4095f76deddd7bce5a8469ffc7db5e1ae413c00d5f833621c3cca617b05fb

Download Submit
C:\Windows\system\wDQHrUj.exe

Filesize
2.2MB

MD5
1ffc93db99a3e1d89506673552cb94f5

SHA1
1ca07209965ede075d93984b968d06abac1f2bc1

SHA256
69734cc9cc555e99cfbcf9a84c12ee11c78b88f935150478905c9fd93a9c7264

SHA512
ba65261a999812005effe7539fc8d269ba3ad82a50cea899f8ba8af77b2b2711260639bbfae154ef9183f1fe3e8365637e99cfa80e367c87d127d6fb1464897a

Download Submit
C:\Windows\system\xDIaJBf.exe

Filesize
2.2MB

MD5
787c6643c731bc810812a74637847fe6

SHA1
3fefb17c46a4ebc548df821a3da7c8ad77379cfb

SHA256
5f1cb7c9787f1080de946f1726c58438e424a041c3e9e0b0c8017111423ae07c

SHA512
cc61170caa7073f446ac30337f9d773c5a01154f2da521a6728703a96f9b04c58c9787e2574672527c3cbf44f6ccde54fdcd409c47136b57dcf63515363e7672

Download Submit
C:\Windows\system\ykXkUZl.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
\Windows\system\AespRhg.exe

Filesize
2.2MB

MD5
02c0119dc27a90b5c1ea7665c7ed71da

SHA1
f27a73e6dcbe553152cc9cad8e36f06ef05e175f

SHA256
89c5176fc98a6e01a38123883fcaea56ffe99434c448155a4c55ee6be323e336

SHA512
3efb6c3758787607dd83da0c754fc9907b7fb2e4a76d3322b3295623454f4f7bd299beac7ddd2ed3b0a483ad290fa59c47560939898f51cefb4e397feef7459d

Download Submit
\Windows\system\DrEvvgU.exe

Filesize
2.2MB

MD5
192cf47ac1a26d4cccbdbc8877d3b739

SHA1
090cf38a68c6538c1076bc0df1b13d5474883a5b

SHA256
a9f6407bb160f1d4e45ca483b6247a0de8bc9994061213cfb5e3db4a5c78fa14

SHA512
f79db11e91c688beb21107ec64a87702d45c9906c80188d284a914849b42a46e085c20c684574d96bf98d09fc7cda13e77a075fcc133f125f1a339b38a824d44

Download Submit
\Windows\system\LdTfXGJ.exe

Filesize
2.2MB

MD5
be62161c57fd1e14cbe61cb470b4964f

SHA1
9ee3453bdbbf9971aede7e7369729bbe3dbf6587

SHA256
4bd090e8f906c80201f30b842042cb7674ee7d3cf5de44132f1f9fb76c04d0fc

SHA512
7672f126d62e7890a45846676ec34b24882e044609a67529405bdff68eb14d701ad73c1c017c66991b0c2bdeddfcfa02633c2c62c82d2bafedb8fdf8c5034d16

Download Submit
\Windows\system\RCGIUej.exe

Filesize
2.2MB

MD5
6b5df0f286f2639a2360b2a6ca6190f8

SHA1
ac780c5166b32178f647efd08f340f2d744e6e69

SHA256
04e9a90e009614210678501edd1bc994b755323b121676e97b4d6dee580c5153

SHA512
a29d26da94937e93db434ee7acd8509dfea946fc9a7cb33be37f2d1a69d23d4d6456fbdc01cc7692eed07bac5883e73d04f903d8d535ea81dcb6cb8ac173cae5

Download Submit
\Windows\system\RpBBFjl.exe

Filesize
2.2MB

MD5
608b25bc19446b74d9800e7712ca7edc

SHA1
e4fb263f30dd2a9588199b5d39681352fee08611

SHA256
bf146f6928634be8db24885c2e6ae1c56f20db617c10358f508420abccc69c7d

SHA512
04e774b9f33d703775ecaee97e3d7f689b1c5aa0337045739549c8124c93390834b7c4023c7c2a994a8608b59a7b8dde4a88b60468bb5d51f7532d1782661f37

Download Submit
\Windows\system\SELhrJa.exe

Filesize
2.2MB

MD5
a402ac4c42330ac0af6ef88b0b540626

SHA1
5f72b245bd911d2d44468b840a42ee384e1067bd

SHA256
9e9c9e404b6eb93758353ba8c2dacfa8dc158a009164c18619a91583e6cbb70b

SHA512
e59c71b8241be51efb80658e654556a0be13bdbaebe3ee92e063618881807b1fe0228c874ba4ad388deac1d2baf63b224dec98e78215b9c82efba62d7908a124

Download Submit
\Windows\system\bbSbflz.exe

Filesize
2.2MB

MD5
79007b1084241045188287c430eb4c06

SHA1
2ff57da39fb30aae23c857588d4ac70a20612c31

SHA256
09c20cced24fd0da5d323210a8d549e08f84fff83651ff3b0dbb0269472065dc

SHA512
f7c7b4e1c4e153ce26561618fa7b1b2a61d111bac090bedc38c51db7136d049be579044c158bc537f2d49035b8ec77e4f7935950a1b34ecc30f95b2f27d7f0a9

Download Submit
\Windows\system\higTqyF.exe

Filesize
2.2MB

MD5
7fb0948a860ed966cbc0a00ba1aaa18c

SHA1
daaef7a83112d91862c4224569348d4f30c4ef92

SHA256
69100474457347594080de9668474db90378ce1d7a61730fc3570a48e4c29ec6

SHA512
992a46f2f160f589b2084f43405628ae316990609c0e4801a84cbaa1bca9d5b5dc3123e17d899f626eee949e66212fa44b000ffbd02b3065732dd66e0e369c74

Download Submit
\Windows\system\mnTpTeo.exe

Filesize
2.2MB

MD5
6b90e4f5cb315087291b6fe9cc7671d8

SHA1
90af4fc6cf5796bc6db62fb18635ce015dca5d41

SHA256
b406af5fe64326a0b83290c867e0df8e7a572ca1f8790ea7bae4b2fdb03adab7

SHA512
580bdd5804cced853721454ee15f312c99741f00da4a1183210504999093d11446056a500525a1a15fdc5c01b48bcd86eae3125d862af55a4e96117460bc7943

Download Submit
\Windows\system\zcItOuP.exe

Filesize
1.1MB

MD5
d8da40f27ae4d81866316e9b078d4eb7

SHA1
be334525d900ff63c86dce95c86f3ae21fb82ee5

SHA256
c621317af75737dc842d5fee99c0441c4efb47ffa5321ac820e23508d2156030

SHA512
bb502234ebbe948ce77bd99e7582835a05158443cfd498fc7ba6806252a70ab79145fb6c67f8824885d7195c3926550cb60ba324240c8316500a63999426df0c

Download Submit
memory/2364-220-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2364-6-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2364-204-0x0000000003040000-0x0000000003432000-memory.dmp

Filesize
3.9MB

Download
memory/2364-217-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-209-0x0000000003040000-0x0000000003432000-memory.dmp

Filesize
3.9MB

Download
memory/2364-219-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2364-208-0x0000000003040000-0x0000000003432000-memory.dmp

Filesize
3.9MB

Download
memory/2364-0-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2364-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2364-214-0x0000000003040000-0x0000000003432000-memory.dmp

Filesize
3.9MB

Download
memory/2364-215-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2364-11-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2364-202-0x0000000003040000-0x0000000003432000-memory.dmp

Filesize
3.9MB

Download
memory/2364-222-0x0000000003040000-0x0000000003432000-memory.dmp

Filesize
3.9MB

Download
memory/2372-199-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2372-195-0x0000000002330000-0x0000000002338000-memory.dmp

Filesize
32KB

Download
memory/2372-198-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2372-31-0x000007FEF5F9E000-0x000007FEF5F9F000-memory.dmp

Filesize
4KB

Download
memory/2372-221-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2372-193-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/2372-405-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2448-213-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2484-207-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2488-212-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2544-200-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2592-205-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2640-218-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2656-201-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2752-216-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/3016-28-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download