xmrig | d64c489a730c4411e9d427c29e19d9906d248e39f011fcc2341fced78ca8e5c9

Analysis

max time kernel
29s
max time network
31s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
Size

1.9MB
MD5

06fe910c97da930b889f6e491f167554
SHA1

a34d449f144277b9702283e7ba944a9de6f25231
SHA256

d64c489a730c4411e9d427c29e19d9906d248e39f011fcc2341fced78ca8e5c9
SHA512

30c079961ce389f8bfe1c9cb86332d9ef2da3157f094cfeb48d573b3f3ea3596218e0fc40e9a13dca3600eced9b44459a830387b2e8008a41ebd5f5b370846bc
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl/B:NABi

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/3016-9-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2624-19-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2600-109-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2532-107-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2432-105-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2596-103-0x000000013FE30000-0x0000000140222000-memory.dmp	xmrig
behavioral1/memory/2584-101-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2796-99-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/2724-97-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3016	QfqNRXr.exe
2624	VfzmliP.exe
2724	wdEbSOb.exe
2796	QuzvUKW.exe
2584	MypSfKl.exe
2596	YdqnOzC.exe
2432	UkyZvqR.exe
2532	ccTpwxj.exe
2600	VrOIQRx.exe
2916	oflxYQY.exe
1736	JfdSutU.exe
2692	nuTxflk.exe
2788	ADOiLmE.exe
2776	swIBaAh.exe
2808	virnFPt.exe
2936	QQeybiY.exe
2680	kAwpBYn.exe
1848	jobXMSI.exe
1584	htPHHpW.exe
2228	hBaDCBF.exe
2480	AglZNun.exe
1608	qKKOcAY.exe
2244	KEJlgyj.exe
792	OBwhuaN.exe
1392	siEaMrC.exe
1720	NWgcIjR.exe
912	orCoUaw.exe
412	CbIvGqA.exe
2168	LPKanNv.exe
1704	kFQkocM.exe
1580	LIutYur.exe
984	AmRrSlW.exe
1644	xytYRxT.exe
948	bxJOhlj.exe
2984	FXttBjz.exe
1972	WeKyJgI.exe
1688	HChLlcQ.exe
1636	vDJTyxf.exe
1976	dQuOQhb.exe
1944	vkyqTlE.exe
280	orbiFyL.exe
1524	WMnrOKh.exe
2636	krTuCfE.exe
2756	XpNfcRu.exe
2428	PZTbtYH.exe
2660	MXNnVln.exe
2804	vyyrQKt.exe
1464	AGXcxYE.exe
2748	sWgFOPd.exe
1120	SyImGqY.exe
1220	tLvaPmH.exe
1212	cqBLnwe.exe
1652	FnfNxSw.exe
1520	qfJNXwP.exe
2912	dKDohJh.exe
1072	WnUYFVV.exe
892	eDUXKaO.exe
3108	ZehpvSD.exe
3144	ipvAMTX.exe
1540	TzrEewW.exe
1680	KKkDrji.exe
2084	unudkde.exe
2396	HiitWCF.exe
336	mHSgzaL.exe

Loads dropped DLL 64 IoCs

pid	Process
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2964-1-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/files/0x000c00000001444f-5.dat	upx
behavioral1/memory/3016-9-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/files/0x0035000000014701-10.dat	upx
behavioral1/memory/2624-19-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/files/0x000d000000014983-12.dat	upx
behavioral1/files/0x001400000000549e-30.dat	upx
behavioral1/files/0x0009000000015136-46.dat	upx
behavioral1/files/0x0006000000015cc1-61.dat	upx
behavioral1/files/0x0006000000015cca-65.dat	upx
behavioral1/files/0x0006000000015cec-74.dat	upx
behavioral1/files/0x0006000000015cdb-69.dat	upx
behavioral1/files/0x0006000000015cf7-76.dat	upx
behavioral1/files/0x0006000000015d06-114.dat	upx
behavioral1/files/0x00060000000160f8-135.dat	upx
behavioral1/files/0x0006000000016411-147.dat	upx
behavioral1/files/0x0006000000016a45-162.dat	upx
behavioral1/files/0x0006000000016ced-188.dat	upx
behavioral1/files/0x0006000000015d5d-116.dat	upx
behavioral1/files/0x0006000000016ce1-185.dat	upx
behavioral1/files/0x0006000000016cab-178.dat	upx
behavioral1/files/0x0006000000016c2e-171.dat	upx
behavioral1/files/0x0006000000016c17-164.dat	upx
behavioral1/files/0x00060000000167ef-157.dat	upx
behavioral1/files/0x0006000000016525-149.dat	upx
behavioral1/memory/2600-109-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2532-107-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/2432-105-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/files/0x0006000000016277-140.dat	upx
behavioral1/files/0x0006000000016056-131.dat	upx
behavioral1/files/0x0006000000015f1b-123.dat	upx
behavioral1/memory/2596-103-0x000000013FE30000-0x0000000140222000-memory.dmp	upx
behavioral1/memory/2584-101-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2796-99-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/memory/2724-97-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/files/0x0006000000016cc9-183.dat	upx
behavioral1/files/0x0006000000016c7a-176.dat	upx
behavioral1/files/0x0006000000016c26-169.dat	upx
behavioral1/files/0x0006000000016597-155.dat	upx
behavioral1/files/0x0006000000015f9e-130.dat	upx
behavioral1/files/0x0006000000015d6e-121.dat	upx
behavioral1/files/0x0006000000015cb9-57.dat	upx
behavioral1/files/0x0006000000015cad-53.dat	upx
behavioral1/files/0x0007000000015ca5-49.dat	upx
behavioral1/files/0x0007000000014e5a-42.dat	upx
behavioral1/files/0x0007000000014c25-37.dat	upx
behavioral1/files/0x0008000000014b12-34.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LKTdYGs.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\CRUVAPE.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\QkyWGgS.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\qKKOcAY.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\rqOEOAD.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\BxgVPwa.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\HChLlcQ.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\FUXMSgU.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\mMOpYxX.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\huEbeIf.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\DVTReDL.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\KKkDrji.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\oiWDtWe.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\xFHIbwL.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\hYuKEJL.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\tftFKeH.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\miGeBSK.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\FnfNxSw.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\rCGMBCU.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\JLrMPiL.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\hXcVqCE.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\VKxNuaf.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\vrsigMe.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\XBwtJdJ.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\unudkde.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\bqIfrZL.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\jvFJYRZ.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\TFzJNDW.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\LtotOog.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\mbQmObd.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\TRxdJlF.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\XrAnNZZ.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\GseUKvQ.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\VrOIQRx.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\ghUjMRZ.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\vIUIliM.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\eqWYQUj.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\hKBwVnt.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\ynisHOC.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\nUOklxN.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\tUZrJAe.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\SVxhdzm.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\zlLVmcR.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\MSDFWDM.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\yKEIJJR.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\eDUXKaO.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\NojCQtr.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\LFAoNoU.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\eumamED.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\djOLdML.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\lPDmZem.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\htPHHpW.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\qiwvbpQ.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\xBgcEeG.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\DNIqxoA.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\PBnXXlI.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\ecjdqYA.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\LaKmdyr.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\rVQyVSh.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\BGwuzUM.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\yBTJFqh.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\ljrINiz.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\qwlYSvm.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\zStGGvd.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2044	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
Token: SeDebugPrivilege	2044	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2044	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	29
PID 2964 wrote to memory of 2044	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	29
PID 2964 wrote to memory of 2044	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	29
PID 2964 wrote to memory of 3016	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	30
PID 2964 wrote to memory of 3016	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	30
PID 2964 wrote to memory of 3016	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	30
PID 2964 wrote to memory of 2624	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	31
PID 2964 wrote to memory of 2624	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	31
PID 2964 wrote to memory of 2624	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	31
PID 2964 wrote to memory of 2724	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2724	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2724	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2796	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	33
PID 2964 wrote to memory of 2796	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	33
PID 2964 wrote to memory of 2796	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	33
PID 2964 wrote to memory of 2584	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	34
PID 2964 wrote to memory of 2584	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	34
PID 2964 wrote to memory of 2584	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	34
PID 2964 wrote to memory of 2596	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	35
PID 2964 wrote to memory of 2596	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	35
PID 2964 wrote to memory of 2596	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	35
PID 2964 wrote to memory of 2432	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	36
PID 2964 wrote to memory of 2432	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	36
PID 2964 wrote to memory of 2432	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	36
PID 2964 wrote to memory of 2532	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	37
PID 2964 wrote to memory of 2532	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	37
PID 2964 wrote to memory of 2532	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	37
PID 2964 wrote to memory of 2600	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	38
PID 2964 wrote to memory of 2600	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	38
PID 2964 wrote to memory of 2600	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	38
PID 2964 wrote to memory of 2916	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	39
PID 2964 wrote to memory of 2916	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	39
PID 2964 wrote to memory of 2916	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	39
PID 2964 wrote to memory of 1736	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	40
PID 2964 wrote to memory of 1736	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	40
PID 2964 wrote to memory of 1736	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	40
PID 2964 wrote to memory of 2692	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	41
PID 2964 wrote to memory of 2692	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	41
PID 2964 wrote to memory of 2692	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	41
PID 2964 wrote to memory of 2788	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	42
PID 2964 wrote to memory of 2788	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	42
PID 2964 wrote to memory of 2788	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	42
PID 2964 wrote to memory of 2776	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	43
PID 2964 wrote to memory of 2776	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	43
PID 2964 wrote to memory of 2776	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	43
PID 2964 wrote to memory of 2808	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	44
PID 2964 wrote to memory of 2808	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	44
PID 2964 wrote to memory of 2808	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	44
PID 2964 wrote to memory of 2936	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	45
PID 2964 wrote to memory of 2936	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	45
PID 2964 wrote to memory of 2936	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	45
PID 2964 wrote to memory of 2680	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	46
PID 2964 wrote to memory of 2680	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	46
PID 2964 wrote to memory of 2680	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	46
PID 2964 wrote to memory of 2480	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	47
PID 2964 wrote to memory of 2480	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	47
PID 2964 wrote to memory of 2480	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	47
PID 2964 wrote to memory of 1848	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	48
PID 2964 wrote to memory of 1848	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	48
PID 2964 wrote to memory of 1848	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	48
PID 2964 wrote to memory of 1540	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	49
PID 2964 wrote to memory of 1540	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	49
PID 2964 wrote to memory of 1540	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	49
PID 2964 wrote to memory of 1584	2964	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06fe910c97da930b889f6e491f167554_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2044
- C:\Windows\System\QfqNRXr.exe
  C:\Windows\System\QfqNRXr.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\VfzmliP.exe
  C:\Windows\System\VfzmliP.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\wdEbSOb.exe
  C:\Windows\System\wdEbSOb.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\QuzvUKW.exe
  C:\Windows\System\QuzvUKW.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\MypSfKl.exe
  C:\Windows\System\MypSfKl.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\YdqnOzC.exe
  C:\Windows\System\YdqnOzC.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\UkyZvqR.exe
  C:\Windows\System\UkyZvqR.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\ccTpwxj.exe
  C:\Windows\System\ccTpwxj.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\VrOIQRx.exe
  C:\Windows\System\VrOIQRx.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\oflxYQY.exe
  C:\Windows\System\oflxYQY.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\JfdSutU.exe
  C:\Windows\System\JfdSutU.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\nuTxflk.exe
  C:\Windows\System\nuTxflk.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\ADOiLmE.exe
  C:\Windows\System\ADOiLmE.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\swIBaAh.exe
  C:\Windows\System\swIBaAh.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\virnFPt.exe
  C:\Windows\System\virnFPt.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\QQeybiY.exe
  C:\Windows\System\QQeybiY.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\kAwpBYn.exe
  C:\Windows\System\kAwpBYn.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\AglZNun.exe
  C:\Windows\System\AglZNun.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\jobXMSI.exe
  C:\Windows\System\jobXMSI.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\TzrEewW.exe
  C:\Windows\System\TzrEewW.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\htPHHpW.exe
  C:\Windows\System\htPHHpW.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\KKkDrji.exe
  C:\Windows\System\KKkDrji.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\hBaDCBF.exe
  C:\Windows\System\hBaDCBF.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\unudkde.exe
  C:\Windows\System\unudkde.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\qKKOcAY.exe
  C:\Windows\System\qKKOcAY.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\HiitWCF.exe
  C:\Windows\System\HiitWCF.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\KEJlgyj.exe
  C:\Windows\System\KEJlgyj.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\mHSgzaL.exe
  C:\Windows\System\mHSgzaL.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\OBwhuaN.exe
  C:\Windows\System\OBwhuaN.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\UVJWuTp.exe
  C:\Windows\System\UVJWuTp.exe
  2⤵
  PID:1400
- C:\Windows\System\siEaMrC.exe
  C:\Windows\System\siEaMrC.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\AlbSkrk.exe
  C:\Windows\System\AlbSkrk.exe
  2⤵
  PID:2900
- C:\Windows\System\NWgcIjR.exe
  C:\Windows\System\NWgcIjR.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\hPpdgvH.exe
  C:\Windows\System\hPpdgvH.exe
  2⤵
  PID:2384
- C:\Windows\System\orCoUaw.exe
  C:\Windows\System\orCoUaw.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\KrBfass.exe
  C:\Windows\System\KrBfass.exe
  2⤵
  PID:2104
- C:\Windows\System\CbIvGqA.exe
  C:\Windows\System\CbIvGqA.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\gTxUdIP.exe
  C:\Windows\System\gTxUdIP.exe
  2⤵
  PID:3040
- C:\Windows\System\LPKanNv.exe
  C:\Windows\System\LPKanNv.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\vRTFogn.exe
  C:\Windows\System\vRTFogn.exe
  2⤵
  PID:1840
- C:\Windows\System\kFQkocM.exe
  C:\Windows\System\kFQkocM.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\qiwvbpQ.exe
  C:\Windows\System\qiwvbpQ.exe
  2⤵
  PID:2848
- C:\Windows\System\LIutYur.exe
  C:\Windows\System\LIutYur.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\jOnCzmS.exe
  C:\Windows\System\jOnCzmS.exe
  2⤵
  PID:1284
- C:\Windows\System\AmRrSlW.exe
  C:\Windows\System\AmRrSlW.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\zVgMsvS.exe
  C:\Windows\System\zVgMsvS.exe
  2⤵
  PID:1044
- C:\Windows\System\xytYRxT.exe
  C:\Windows\System\xytYRxT.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\phnaUij.exe
  C:\Windows\System\phnaUij.exe
  2⤵
  PID:992
- C:\Windows\System\bxJOhlj.exe
  C:\Windows\System\bxJOhlj.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\lZdnpeo.exe
  C:\Windows\System\lZdnpeo.exe
  2⤵
  PID:1008
- C:\Windows\System\FXttBjz.exe
  C:\Windows\System\FXttBjz.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\LGCsesR.exe
  C:\Windows\System\LGCsesR.exe
  2⤵
  PID:1740
- C:\Windows\System\WeKyJgI.exe
  C:\Windows\System\WeKyJgI.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\qaDiqBq.exe
  C:\Windows\System\qaDiqBq.exe
  2⤵
  PID:2864
- C:\Windows\System\HChLlcQ.exe
  C:\Windows\System\HChLlcQ.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\ZpSmiAj.exe
  C:\Windows\System\ZpSmiAj.exe
  2⤵
  PID:328
- C:\Windows\System\vDJTyxf.exe
  C:\Windows\System\vDJTyxf.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\fHBsTtX.exe
  C:\Windows\System\fHBsTtX.exe
  2⤵
  PID:624
- C:\Windows\System\dQuOQhb.exe
  C:\Windows\System\dQuOQhb.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\UzUSwCw.exe
  C:\Windows\System\UzUSwCw.exe
  2⤵
  PID:876
- C:\Windows\System\vkyqTlE.exe
  C:\Windows\System\vkyqTlE.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\XXxrDzb.exe
  C:\Windows\System\XXxrDzb.exe
  2⤵
  PID:2068
- C:\Windows\System\orbiFyL.exe
  C:\Windows\System\orbiFyL.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\HSEkoeW.exe
  C:\Windows\System\HSEkoeW.exe
  2⤵
  PID:2620
- C:\Windows\System\WMnrOKh.exe
  C:\Windows\System\WMnrOKh.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\lxFQXIN.exe
  C:\Windows\System\lxFQXIN.exe
  2⤵
  PID:1632
- C:\Windows\System\krTuCfE.exe
  C:\Windows\System\krTuCfE.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\vcJRbUN.exe
  C:\Windows\System\vcJRbUN.exe
  2⤵
  PID:2016
- C:\Windows\System\XpNfcRu.exe
  C:\Windows\System\XpNfcRu.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\WqFWDkn.exe
  C:\Windows\System\WqFWDkn.exe
  2⤵
  PID:2652
- C:\Windows\System\PZTbtYH.exe
  C:\Windows\System\PZTbtYH.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\irogeGY.exe
  C:\Windows\System\irogeGY.exe
  2⤵
  PID:2956
- C:\Windows\System\MXNnVln.exe
  C:\Windows\System\MXNnVln.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\hPraTDN.exe
  C:\Windows\System\hPraTDN.exe
  2⤵
  PID:2448
- C:\Windows\System\vyyrQKt.exe
  C:\Windows\System\vyyrQKt.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\tUZrJAe.exe
  C:\Windows\System\tUZrJAe.exe
  2⤵
  PID:108
- C:\Windows\System\AGXcxYE.exe
  C:\Windows\System\AGXcxYE.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\miUwbem.exe
  C:\Windows\System\miUwbem.exe
  2⤵
  PID:2260
- C:\Windows\System\sWgFOPd.exe
  C:\Windows\System\sWgFOPd.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\ypjimcr.exe
  C:\Windows\System\ypjimcr.exe
  2⤵
  PID:576
- C:\Windows\System\SyImGqY.exe
  C:\Windows\System\SyImGqY.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\YpisfJp.exe
  C:\Windows\System\YpisfJp.exe
  2⤵
  PID:1180
- C:\Windows\System\tLvaPmH.exe
  C:\Windows\System\tLvaPmH.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\gbyPcnf.exe
  C:\Windows\System\gbyPcnf.exe
  2⤵
  PID:2556
- C:\Windows\System\cqBLnwe.exe
  C:\Windows\System\cqBLnwe.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\oUiQoTr.exe
  C:\Windows\System\oUiQoTr.exe
  2⤵
  PID:2328
- C:\Windows\System\FnfNxSw.exe
  C:\Windows\System\FnfNxSw.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\whjGcjf.exe
  C:\Windows\System\whjGcjf.exe
  2⤵
  PID:2264
- C:\Windows\System\qfJNXwP.exe
  C:\Windows\System\qfJNXwP.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\ORlbrbE.exe
  C:\Windows\System\ORlbrbE.exe
  2⤵
  PID:2436
- C:\Windows\System\dKDohJh.exe
  C:\Windows\System\dKDohJh.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\ZrQeWIB.exe
  C:\Windows\System\ZrQeWIB.exe
  2⤵
  PID:2800
- C:\Windows\System\WnUYFVV.exe
  C:\Windows\System\WnUYFVV.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\zQqBIEP.exe
  C:\Windows\System\zQqBIEP.exe
  2⤵
  PID:1768
- C:\Windows\System\eDUXKaO.exe
  C:\Windows\System\eDUXKaO.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\JwPdPtu.exe
  C:\Windows\System\JwPdPtu.exe
  2⤵
  PID:3092
- C:\Windows\System\ZehpvSD.exe
  C:\Windows\System\ZehpvSD.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\RNAktOn.exe
  C:\Windows\System\RNAktOn.exe
  2⤵
  PID:3128
- C:\Windows\System\ipvAMTX.exe
  C:\Windows\System\ipvAMTX.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\XnDhomF.exe
  C:\Windows\System\XnDhomF.exe
  2⤵
  PID:3160
- C:\Windows\System\qkzmcAd.exe
  C:\Windows\System\qkzmcAd.exe
  2⤵
  PID:3468
- C:\Windows\System\AHESFxi.exe
  C:\Windows\System\AHESFxi.exe
  2⤵
  PID:3500
- C:\Windows\System\FMNFSIJ.exe
  C:\Windows\System\FMNFSIJ.exe
  2⤵
  PID:3516
- C:\Windows\System\DYetCla.exe
  C:\Windows\System\DYetCla.exe
  2⤵
  PID:3532
- C:\Windows\System\DRVImVh.exe
  C:\Windows\System\DRVImVh.exe
  2⤵
  PID:3580
- C:\Windows\System\APeKkOG.exe
  C:\Windows\System\APeKkOG.exe
  2⤵
  PID:3600
- C:\Windows\System\xxLoANY.exe
  C:\Windows\System\xxLoANY.exe
  2⤵
  PID:3624
- C:\Windows\System\ZNjxdXH.exe
  C:\Windows\System\ZNjxdXH.exe
  2⤵
  PID:3668
- C:\Windows\System\jIHJMbx.exe
  C:\Windows\System\jIHJMbx.exe
  2⤵
  PID:3740
- C:\Windows\System\AwPESHm.exe
  C:\Windows\System\AwPESHm.exe
  2⤵
  PID:3760
- C:\Windows\System\cJHxpdp.exe
  C:\Windows\System\cJHxpdp.exe
  2⤵
  PID:3776
- C:\Windows\System\IwkHxDf.exe
  C:\Windows\System\IwkHxDf.exe
  2⤵
  PID:3792
- C:\Windows\System\GBWZsWy.exe
  C:\Windows\System\GBWZsWy.exe
  2⤵
  PID:3808
- C:\Windows\System\NWcDzvg.exe
  C:\Windows\System\NWcDzvg.exe
  2⤵
  PID:3824
- C:\Windows\System\OSvsfHc.exe
  C:\Windows\System\OSvsfHc.exe
  2⤵
  PID:3840
- C:\Windows\System\eAqGjGP.exe
  C:\Windows\System\eAqGjGP.exe
  2⤵
  PID:3864
- C:\Windows\System\lNYVrKE.exe
  C:\Windows\System\lNYVrKE.exe
  2⤵
  PID:3888
- C:\Windows\System\uWuSydl.exe
  C:\Windows\System\uWuSydl.exe
  2⤵
  PID:3920
- C:\Windows\System\DREeGDS.exe
  C:\Windows\System\DREeGDS.exe
  2⤵
  PID:3936
- C:\Windows\System\uiMbROq.exe
  C:\Windows\System\uiMbROq.exe
  2⤵
  PID:3952
- C:\Windows\System\jNfPWrl.exe
  C:\Windows\System\jNfPWrl.exe
  2⤵
  PID:3968
- C:\Windows\System\bUbJSAm.exe
  C:\Windows\System\bUbJSAm.exe
  2⤵
  PID:3984
- C:\Windows\System\FsvTHyK.exe
  C:\Windows\System\FsvTHyK.exe
  2⤵
  PID:4000
- C:\Windows\System\afslIyB.exe
  C:\Windows\System\afslIyB.exe
  2⤵
  PID:4016
- C:\Windows\System\DRYsxNz.exe
  C:\Windows\System\DRYsxNz.exe
  2⤵
  PID:4032
- C:\Windows\System\ZHvLyic.exe
  C:\Windows\System\ZHvLyic.exe
  2⤵
  PID:4048
- C:\Windows\System\DiPVWNo.exe
  C:\Windows\System\DiPVWNo.exe
  2⤵
  PID:4064
- C:\Windows\System\dzsppHQ.exe
  C:\Windows\System\dzsppHQ.exe
  2⤵
  PID:1504
- C:\Windows\System\owlwgQR.exe
  C:\Windows\System\owlwgQR.exe
  2⤵
  PID:1100
- C:\Windows\System\rzBrggM.exe
  C:\Windows\System\rzBrggM.exe
  2⤵
  PID:3120
- C:\Windows\System\dVpWawd.exe
  C:\Windows\System\dVpWawd.exe
  2⤵
  PID:1860
- C:\Windows\System\OOLdUlL.exe
  C:\Windows\System\OOLdUlL.exe
  2⤵
  PID:1696
- C:\Windows\System\jUoosKb.exe
  C:\Windows\System\jUoosKb.exe
  2⤵
  PID:2388
- C:\Windows\System\IEtHtAv.exe
  C:\Windows\System\IEtHtAv.exe
  2⤵
  PID:352
- C:\Windows\System\RyoMpEI.exe
  C:\Windows\System\RyoMpEI.exe
  2⤵
  PID:1244
- C:\Windows\System\tNIYAbS.exe
  C:\Windows\System\tNIYAbS.exe
  2⤵
  PID:2088
- C:\Windows\System\ujJccUM.exe
  C:\Windows\System\ujJccUM.exe
  2⤵
  PID:988
- C:\Windows\System\ciwHSvP.exe
  C:\Windows\System\ciwHSvP.exe
  2⤵
  PID:1700
- C:\Windows\System\eAakPYO.exe
  C:\Windows\System\eAakPYO.exe
  2⤵
  PID:3036
- C:\Windows\System\WYzsQGm.exe
  C:\Windows\System\WYzsQGm.exe
  2⤵
  PID:1536
- C:\Windows\System\OsGJPPc.exe
  C:\Windows\System\OsGJPPc.exe
  2⤵
  PID:2648
- C:\Windows\System\nNJJhum.exe
  C:\Windows\System\nNJJhum.exe
  2⤵
  PID:1280
- C:\Windows\System\tUuZhXd.exe
  C:\Windows\System\tUuZhXd.exe
  2⤵
  PID:2712
- C:\Windows\System\OaDJtnS.exe
  C:\Windows\System\OaDJtnS.exe
  2⤵
  PID:2608
- C:\Windows\System\UucYozw.exe
  C:\Windows\System\UucYozw.exe
  2⤵
  PID:3644
- C:\Windows\System\rCGMBCU.exe
  C:\Windows\System\rCGMBCU.exe
  2⤵
  PID:3660
- C:\Windows\System\EZPElHS.exe
  C:\Windows\System\EZPElHS.exe
  2⤵
  PID:2400
- C:\Windows\System\RLiMDdX.exe
  C:\Windows\System\RLiMDdX.exe
  2⤵
  PID:2196
- C:\Windows\System\YjLYPdH.exe
  C:\Windows\System\YjLYPdH.exe
  2⤵
  PID:1560
- C:\Windows\System\uKpYySX.exe
  C:\Windows\System\uKpYySX.exe
  2⤵
  PID:2300
- C:\Windows\System\AeIpPGJ.exe
  C:\Windows\System\AeIpPGJ.exe
  2⤵
  PID:2408
- C:\Windows\System\INrPKVU.exe
  C:\Windows\System\INrPKVU.exe
  2⤵
  PID:2780
- C:\Windows\System\VNFVXfU.exe
  C:\Windows\System\VNFVXfU.exe
  2⤵
  PID:2392
- C:\Windows\System\GwDiHlW.exe
  C:\Windows\System\GwDiHlW.exe
  2⤵
  PID:2116
- C:\Windows\System\KULTtxL.exe
  C:\Windows\System\KULTtxL.exe
  2⤵
  PID:2376
- C:\Windows\System\XofKzSl.exe
  C:\Windows\System\XofKzSl.exe
  2⤵
  PID:3100
- C:\Windows\System\RwQrwyW.exe
  C:\Windows\System\RwQrwyW.exe
  2⤵
  PID:3168
- C:\Windows\System\uQjeLhP.exe
  C:\Windows\System\uQjeLhP.exe
  2⤵
  PID:3204
- C:\Windows\System\TRxdJlF.exe
  C:\Windows\System\TRxdJlF.exe
  2⤵
  PID:3228
- C:\Windows\System\knSxetZ.exe
  C:\Windows\System\knSxetZ.exe
  2⤵
  PID:3244
- C:\Windows\System\twjQMzR.exe
  C:\Windows\System\twjQMzR.exe
  2⤵
  PID:3284
- C:\Windows\System\BiVySms.exe
  C:\Windows\System\BiVySms.exe
  2⤵
  PID:3300
- C:\Windows\System\iqGwrme.exe
  C:\Windows\System\iqGwrme.exe
  2⤵
  PID:3316
- C:\Windows\System\MUSMseg.exe
  C:\Windows\System\MUSMseg.exe
  2⤵
  PID:3336
- C:\Windows\System\PgxRGnr.exe
  C:\Windows\System\PgxRGnr.exe
  2⤵
  PID:3348
- C:\Windows\System\jfoGChg.exe
  C:\Windows\System\jfoGChg.exe
  2⤵
  PID:3364
- C:\Windows\System\DTIHbaR.exe
  C:\Windows\System\DTIHbaR.exe
  2⤵
  PID:3380
- C:\Windows\System\dhTBUfK.exe
  C:\Windows\System\dhTBUfK.exe
  2⤵
  PID:3400
- C:\Windows\System\eCHbyKp.exe
  C:\Windows\System\eCHbyKp.exe
  2⤵
  PID:3420
- C:\Windows\System\ATidhQs.exe
  C:\Windows\System\ATidhQs.exe
  2⤵
  PID:3456
- C:\Windows\System\aESEQpi.exe
  C:\Windows\System\aESEQpi.exe
  2⤵
  PID:3512
- C:\Windows\System\aZEXFSi.exe
  C:\Windows\System\aZEXFSi.exe
  2⤵
  PID:3552
- C:\Windows\System\AWMClrj.exe
  C:\Windows\System\AWMClrj.exe
  2⤵
  PID:3576
- C:\Windows\System\GHWGJRF.exe
  C:\Windows\System\GHWGJRF.exe
  2⤵
  PID:3752
- C:\Windows\System\XJZIXsZ.exe
  C:\Windows\System\XJZIXsZ.exe
  2⤵
  PID:3860
- C:\Windows\System\QKrhVtj.exe
  C:\Windows\System\QKrhVtj.exe
  2⤵
  PID:3612
- C:\Windows\System\qXPjevf.exe
  C:\Windows\System\qXPjevf.exe
  2⤵
  PID:2992
- C:\Windows\System\uGVLpIO.exe
  C:\Windows\System\uGVLpIO.exe
  2⤵
  PID:3692
- C:\Windows\System\ocvHphB.exe
  C:\Windows\System\ocvHphB.exe
  2⤵
  PID:3700
- C:\Windows\System\hIKZUYg.exe
  C:\Windows\System\hIKZUYg.exe
  2⤵
  PID:3716
- C:\Windows\System\WPFMBZh.exe
  C:\Windows\System\WPFMBZh.exe
  2⤵
  PID:3900
- C:\Windows\System\CXpNcYS.exe
  C:\Windows\System\CXpNcYS.exe
  2⤵
  PID:3904
- C:\Windows\System\SQLjgZr.exe
  C:\Windows\System\SQLjgZr.exe
  2⤵
  PID:3928
- C:\Windows\System\dWpfcJq.exe
  C:\Windows\System\dWpfcJq.exe
  2⤵
  PID:4084
- C:\Windows\System\GchwrjB.exe
  C:\Windows\System\GchwrjB.exe
  2⤵
  PID:3976
- C:\Windows\System\ghUjMRZ.exe
  C:\Windows\System\ghUjMRZ.exe
  2⤵
  PID:4040
- C:\Windows\System\fgjlBdh.exe
  C:\Windows\System\fgjlBdh.exe
  2⤵
  PID:4080
- C:\Windows\System\kZcKKdp.exe
  C:\Windows\System\kZcKKdp.exe
  2⤵
  PID:4092
- C:\Windows\System\IiArMqC.exe
  C:\Windows\System\IiArMqC.exe
  2⤵
  PID:1912
- C:\Windows\System\gEvtjEo.exe
  C:\Windows\System\gEvtjEo.exe
  2⤵
  PID:2268
- C:\Windows\System\ZKYHMLF.exe
  C:\Windows\System\ZKYHMLF.exe
  2⤵
  PID:1456
- C:\Windows\System\JfqDCFf.exe
  C:\Windows\System\JfqDCFf.exe
  2⤵
  PID:2844
- C:\Windows\System\NojCQtr.exe
  C:\Windows\System\NojCQtr.exe
  2⤵
  PID:788
- C:\Windows\System\DsgmJxg.exe
  C:\Windows\System\DsgmJxg.exe
  2⤵
  PID:1124
- C:\Windows\System\bWBCFbW.exe
  C:\Windows\System\bWBCFbW.exe
  2⤵
  PID:3884
- C:\Windows\System\RBukLFn.exe
  C:\Windows\System\RBukLFn.exe
  2⤵
  PID:3804
- C:\Windows\System\VaJBznR.exe
  C:\Windows\System\VaJBznR.exe
  2⤵
  PID:4024
- C:\Windows\System\CLVjJMe.exe
  C:\Windows\System\CLVjJMe.exe
  2⤵
  PID:776
- C:\Windows\System\vxiPXsT.exe
  C:\Windows\System\vxiPXsT.exe
  2⤵
  PID:2612
- C:\Windows\System\amvQKJc.exe
  C:\Windows\System\amvQKJc.exe
  2⤵
  PID:1596
- C:\Windows\System\xZFIpjn.exe
  C:\Windows\System\xZFIpjn.exe
  2⤵
  PID:1884
- C:\Windows\System\ZooAYkR.exe
  C:\Windows\System\ZooAYkR.exe
  2⤵
  PID:2488
- C:\Windows\System\zmgCsPQ.exe
  C:\Windows\System\zmgCsPQ.exe
  2⤵
  PID:2704
- C:\Windows\System\HNKLtrM.exe
  C:\Windows\System\HNKLtrM.exe
  2⤵
  PID:2096
- C:\Windows\System\SWFPEAq.exe
  C:\Windows\System\SWFPEAq.exe
  2⤵
  PID:1904
- C:\Windows\System\MRitZWg.exe
  C:\Windows\System\MRitZWg.exe
  2⤵
  PID:3492
- C:\Windows\System\aHQzaez.exe
  C:\Windows\System\aHQzaez.exe
  2⤵
  PID:4028
- C:\Windows\System\jiSVnsb.exe
  C:\Windows\System\jiSVnsb.exe
  2⤵
  PID:3960
- C:\Windows\System\heFpdPq.exe
  C:\Windows\System\heFpdPq.exe
  2⤵
  PID:1864
- C:\Windows\System\Hthwfgs.exe
  C:\Windows\System\Hthwfgs.exe
  2⤵
  PID:3664
- C:\Windows\System\lLEvzpu.exe
  C:\Windows\System\lLEvzpu.exe
  2⤵
  PID:2184
- C:\Windows\System\WRePQyN.exe
  C:\Windows\System\WRePQyN.exe
  2⤵
  PID:2072
- C:\Windows\System\BSCJLTk.exe
  C:\Windows\System\BSCJLTk.exe
  2⤵
  PID:2664
- C:\Windows\System\rxsyvFN.exe
  C:\Windows\System\rxsyvFN.exe
  2⤵
  PID:1692
- C:\Windows\System\jTykWGl.exe
  C:\Windows\System\jTykWGl.exe
  2⤵
  PID:3944
- C:\Windows\System\RFRQFZL.exe
  C:\Windows\System\RFRQFZL.exe
  2⤵
  PID:3088
- C:\Windows\System\wAiYZho.exe
  C:\Windows\System\wAiYZho.exe
  2⤵
  PID:1724
- C:\Windows\System\ACXuHsq.exe
  C:\Windows\System\ACXuHsq.exe
  2⤵
  PID:3684
- C:\Windows\System\oiWDtWe.exe
  C:\Windows\System\oiWDtWe.exe
  2⤵
  PID:3736
- C:\Windows\System\xaeZRfg.exe
  C:\Windows\System\xaeZRfg.exe
  2⤵
  PID:2940
- C:\Windows\System\NcKdukD.exe
  C:\Windows\System\NcKdukD.exe
  2⤵
  PID:1228
- C:\Windows\System\IGcABEz.exe
  C:\Windows\System\IGcABEz.exe
  2⤵
  PID:3832
- C:\Windows\System\LImaCfL.exe
  C:\Windows\System\LImaCfL.exe
  2⤵
  PID:1664
- C:\Windows\System\ZkTwMtU.exe
  C:\Windows\System\ZkTwMtU.exe
  2⤵
  PID:3648
- C:\Windows\System\EvtJnwx.exe
  C:\Windows\System\EvtJnwx.exe
  2⤵
  PID:3992
- C:\Windows\System\wLhNXPC.exe
  C:\Windows\System\wLhNXPC.exe
  2⤵
  PID:2924
- C:\Windows\System\XXzjSVG.exe
  C:\Windows\System\XXzjSVG.exe
  2⤵
  PID:1012
- C:\Windows\System\NaFlpiW.exe
  C:\Windows\System\NaFlpiW.exe
  2⤵
  PID:3200
- C:\Windows\System\GgOEkbN.exe
  C:\Windows\System\GgOEkbN.exe
  2⤵
  PID:3324
- C:\Windows\System\LFAoNoU.exe
  C:\Windows\System\LFAoNoU.exe
  2⤵
  PID:3360
- C:\Windows\System\NaEnJXg.exe
  C:\Windows\System\NaEnJXg.exe
  2⤵
  PID:3544
- C:\Windows\System\xOXlFGO.exe
  C:\Windows\System\xOXlFGO.exe
  2⤵
  PID:3748
- C:\Windows\System\oFqPgSU.exe
  C:\Windows\System\oFqPgSU.exe
  2⤵
  PID:3256
- C:\Windows\System\FvpAQYC.exe
  C:\Windows\System\FvpAQYC.exe
  2⤵
  PID:3464
- C:\Windows\System\DTgrkzQ.exe
  C:\Windows\System\DTgrkzQ.exe
  2⤵
  PID:3788
- C:\Windows\System\WrBbvVY.exe
  C:\Windows\System\WrBbvVY.exe
  2⤵
  PID:3596
- C:\Windows\System\DzAgjor.exe
  C:\Windows\System\DzAgjor.exe
  2⤵
  PID:3856
- C:\Windows\System\rwxSyOH.exe
  C:\Windows\System\rwxSyOH.exe
  2⤵
  PID:3588
- C:\Windows\System\RKztKLx.exe
  C:\Windows\System\RKztKLx.exe
  2⤵
  PID:3616
- C:\Windows\System\mwRTtwr.exe
  C:\Windows\System\mwRTtwr.exe
  2⤵
  PID:2668
- C:\Windows\System\RSgzlKa.exe
  C:\Windows\System\RSgzlKa.exe
  2⤵
  PID:3876
- C:\Windows\System\xpVnHrs.exe
  C:\Windows\System\xpVnHrs.exe
  2⤵
  PID:2040
- C:\Windows\System\EBeaLcM.exe
  C:\Windows\System\EBeaLcM.exe
  2⤵
  PID:2124
- C:\Windows\System\DwSfwNP.exe
  C:\Windows\System\DwSfwNP.exe
  2⤵
  PID:3308
- C:\Windows\System\hIQHOiC.exe
  C:\Windows\System\hIQHOiC.exe
  2⤵
  PID:3404
- C:\Windows\System\FRwinGG.exe
  C:\Windows\System\FRwinGG.exe
  2⤵
  PID:2348
- C:\Windows\System\EFYrQef.exe
  C:\Windows\System\EFYrQef.exe
  2⤵
  PID:2572
- C:\Windows\System\JBEVqqu.exe
  C:\Windows\System\JBEVqqu.exe
  2⤵
  PID:2440
- C:\Windows\System\NkUouPl.exe
  C:\Windows\System\NkUouPl.exe
  2⤵
  PID:3388
- C:\Windows\System\rcbwivF.exe
  C:\Windows\System\rcbwivF.exe
  2⤵
  PID:3412
- C:\Windows\System\CSpGmFw.exe
  C:\Windows\System\CSpGmFw.exe
  2⤵
  PID:3224
- C:\Windows\System\hDyWZTE.exe
  C:\Windows\System\hDyWZTE.exe
  2⤵
  PID:1600
- C:\Windows\System\fefOCoC.exe
  C:\Windows\System\fefOCoC.exe
  2⤵
  PID:908
- C:\Windows\System\OCXgxhn.exe
  C:\Windows\System\OCXgxhn.exe
  2⤵
  PID:1616
- C:\Windows\System\UsGWIMg.exe
  C:\Windows\System\UsGWIMg.exe
  2⤵
  PID:4208
- C:\Windows\System\LGiVWlb.exe
  C:\Windows\System\LGiVWlb.exe
  2⤵
  PID:4228
- C:\Windows\System\ilFihxF.exe
  C:\Windows\System\ilFihxF.exe
  2⤵
  PID:4244
- C:\Windows\System\EwthpeI.exe
  C:\Windows\System\EwthpeI.exe
  2⤵
  PID:4260
- C:\Windows\System\TWgxYrJ.exe
  C:\Windows\System\TWgxYrJ.exe
  2⤵
  PID:4288
- C:\Windows\System\TCucXda.exe
  C:\Windows\System\TCucXda.exe
  2⤵
  PID:4304
- C:\Windows\System\NqdqvqU.exe
  C:\Windows\System\NqdqvqU.exe
  2⤵
  PID:4392
- C:\Windows\System\PTpgfrE.exe
  C:\Windows\System\PTpgfrE.exe
  2⤵
  PID:4408
- C:\Windows\System\oJwwyDd.exe
  C:\Windows\System\oJwwyDd.exe
  2⤵
  PID:4424
- C:\Windows\System\BGoAPZa.exe
  C:\Windows\System\BGoAPZa.exe
  2⤵
  PID:4440
- C:\Windows\System\WxOdvsJ.exe
  C:\Windows\System\WxOdvsJ.exe
  2⤵
  PID:4456
- C:\Windows\System\nFyxyik.exe
  C:\Windows\System\nFyxyik.exe
  2⤵
  PID:4472
- C:\Windows\System\qaRwuaz.exe
  C:\Windows\System\qaRwuaz.exe
  2⤵
  PID:4488
- C:\Windows\System\MjdMEDx.exe
  C:\Windows\System\MjdMEDx.exe
  2⤵
  PID:4504
- C:\Windows\System\bSZBZhs.exe
  C:\Windows\System\bSZBZhs.exe
  2⤵
  PID:4520
- C:\Windows\System\ZqEmbVZ.exe
  C:\Windows\System\ZqEmbVZ.exe
  2⤵
  PID:4536
- C:\Windows\System\OvTTcIf.exe
  C:\Windows\System\OvTTcIf.exe
  2⤵
  PID:4552
- C:\Windows\System\iETZNpc.exe
  C:\Windows\System\iETZNpc.exe
  2⤵
  PID:4568
- C:\Windows\System\iUjkCeP.exe
  C:\Windows\System\iUjkCeP.exe
  2⤵
  PID:4584
- C:\Windows\System\EoScljg.exe
  C:\Windows\System\EoScljg.exe
  2⤵
  PID:4600
- C:\Windows\System\YDFWJkq.exe
  C:\Windows\System\YDFWJkq.exe
  2⤵
  PID:4616
- C:\Windows\System\KUnYOPq.exe
  C:\Windows\System\KUnYOPq.exe
  2⤵
  PID:4632
- C:\Windows\System\xdtimGd.exe
  C:\Windows\System\xdtimGd.exe
  2⤵
  PID:4648
- C:\Windows\System\sewpBaP.exe
  C:\Windows\System\sewpBaP.exe
  2⤵
  PID:4736
- C:\Windows\System\xEllOEo.exe
  C:\Windows\System\xEllOEo.exe
  2⤵
  PID:4752
- C:\Windows\System\EkCtDSx.exe
  C:\Windows\System\EkCtDSx.exe
  2⤵
  PID:4772
- C:\Windows\System\ftnBJif.exe
  C:\Windows\System\ftnBJif.exe
  2⤵
  PID:4796
- C:\Windows\System\IPWprNS.exe
  C:\Windows\System\IPWprNS.exe
  2⤵
  PID:4812
- C:\Windows\System\YCYrgIW.exe
  C:\Windows\System\YCYrgIW.exe
  2⤵
  PID:4832
- C:\Windows\System\SVxhdzm.exe
  C:\Windows\System\SVxhdzm.exe
  2⤵
  PID:4860
- C:\Windows\System\LrywkaZ.exe
  C:\Windows\System\LrywkaZ.exe
  2⤵
  PID:4876
- C:\Windows\System\RsWFIzM.exe
  C:\Windows\System\RsWFIzM.exe
  2⤵
  PID:4892
- C:\Windows\System\fwMMxXb.exe
  C:\Windows\System\fwMMxXb.exe
  2⤵
  PID:4908
- C:\Windows\System\nxDEWfE.exe
  C:\Windows\System\nxDEWfE.exe
  2⤵
  PID:4928
- C:\Windows\System\LyIdPIT.exe
  C:\Windows\System\LyIdPIT.exe
  2⤵
  PID:4944
- C:\Windows\System\EqQMouE.exe
  C:\Windows\System\EqQMouE.exe
  2⤵
  PID:4964
- C:\Windows\System\DCfflaK.exe
  C:\Windows\System\DCfflaK.exe
  2⤵
  PID:4984
- C:\Windows\System\dBtRgZS.exe
  C:\Windows\System\dBtRgZS.exe
  2⤵
  PID:5000
- C:\Windows\System\LeJTlsc.exe
  C:\Windows\System\LeJTlsc.exe
  2⤵
  PID:5020
- C:\Windows\System\qwVZpDC.exe
  C:\Windows\System\qwVZpDC.exe
  2⤵
  PID:5036
- C:\Windows\System\SHlGpwJ.exe
  C:\Windows\System\SHlGpwJ.exe
  2⤵
  PID:5060
- C:\Windows\System\SRipiCL.exe
  C:\Windows\System\SRipiCL.exe
  2⤵
  PID:5076
- C:\Windows\System\FZBRDdN.exe
  C:\Windows\System\FZBRDdN.exe
  2⤵
  PID:5092
- C:\Windows\System\MierAZy.exe
  C:\Windows\System\MierAZy.exe
  2⤵
  PID:5108
- C:\Windows\System\bqIfrZL.exe
  C:\Windows\System\bqIfrZL.exe
  2⤵
  PID:1208
- C:\Windows\System\DZTpiCU.exe
  C:\Windows\System\DZTpiCU.exe
  2⤵
  PID:2220
- C:\Windows\System\LzCmTGf.exe
  C:\Windows\System\LzCmTGf.exe
  2⤵
  PID:1568
- C:\Windows\System\DVOAsSz.exe
  C:\Windows\System\DVOAsSz.exe
  2⤵
  PID:1424
- C:\Windows\System\nZKkjIb.exe
  C:\Windows\System\nZKkjIb.exe
  2⤵
  PID:1640
- C:\Windows\System\SYtENsV.exe
  C:\Windows\System\SYtENsV.exe
  2⤵
  PID:3848
- C:\Windows\System\cWuhlFE.exe
  C:\Windows\System\cWuhlFE.exe
  2⤵
  PID:2008
- C:\Windows\System\hnrjQCy.exe
  C:\Windows\System\hnrjQCy.exe
  2⤵
  PID:3372
- C:\Windows\System\tJQZlLK.exe
  C:\Windows\System\tJQZlLK.exe
  2⤵
  PID:2904
- C:\Windows\System\plXrxsJ.exe
  C:\Windows\System\plXrxsJ.exe
  2⤵
  PID:2080
- C:\Windows\System\BEOCLvM.exe
  C:\Windows\System\BEOCLvM.exe
  2⤵
  PID:4108
- C:\Windows\System\wQwxIbQ.exe
  C:\Windows\System\wQwxIbQ.exe
  2⤵
  PID:4128
- C:\Windows\System\CnhdNOh.exe
  C:\Windows\System\CnhdNOh.exe
  2⤵
  PID:4144
- C:\Windows\System\eQGOIzc.exe
  C:\Windows\System\eQGOIzc.exe
  2⤵
  PID:4164
- C:\Windows\System\rZjWzGK.exe
  C:\Windows\System\rZjWzGK.exe
  2⤵
  PID:3028
- C:\Windows\System\jKKtjux.exe
  C:\Windows\System\jKKtjux.exe
  2⤵
  PID:4184
- C:\Windows\System\vgCgHhA.exe
  C:\Windows\System\vgCgHhA.exe
  2⤵
  PID:2764
- C:\Windows\System\XrAnNZZ.exe
  C:\Windows\System\XrAnNZZ.exe
  2⤵
  PID:3356
- C:\Windows\System\gZFdEza.exe
  C:\Windows\System\gZFdEza.exe
  2⤵
  PID:4224
- C:\Windows\System\fNjeVJM.exe
  C:\Windows\System\fNjeVJM.exe
  2⤵
  PID:2920
- C:\Windows\System\encsxsN.exe
  C:\Windows\System\encsxsN.exe
  2⤵
  PID:4240
- C:\Windows\System\uMRnSdg.exe
  C:\Windows\System\uMRnSdg.exe
  2⤵
  PID:4272
- C:\Windows\System\jvFJYRZ.exe
  C:\Windows\System\jvFJYRZ.exe
  2⤵
  PID:4316
- C:\Windows\System\THKgeVQ.exe
  C:\Windows\System\THKgeVQ.exe
  2⤵
  PID:2884
- C:\Windows\System\pBNVGlT.exe
  C:\Windows\System\pBNVGlT.exe
  2⤵
  PID:4332
- C:\Windows\System\NoenEjs.exe
  C:\Windows\System\NoenEjs.exe
  2⤵
  PID:2728
- C:\Windows\System\fijXGaX.exe
  C:\Windows\System\fijXGaX.exe
  2⤵
  PID:4372
- C:\Windows\System\HQDzWBQ.exe
  C:\Windows\System\HQDzWBQ.exe
  2⤵
  PID:4364
- C:\Windows\System\uSHXHhG.exe
  C:\Windows\System\uSHXHhG.exe
  2⤵
  PID:4384
- C:\Windows\System\xBgcEeG.exe
  C:\Windows\System\xBgcEeG.exe
  2⤵
  PID:4416
- C:\Windows\System\spscDZZ.exe
  C:\Windows\System\spscDZZ.exe
  2⤵
  PID:4468
- C:\Windows\System\SiwJPsG.exe
  C:\Windows\System\SiwJPsG.exe
  2⤵
  PID:4560
- C:\Windows\System\ImKPEOB.exe
  C:\Windows\System\ImKPEOB.exe
  2⤵
  PID:4644
- C:\Windows\System\WqdLGsW.exe
  C:\Windows\System\WqdLGsW.exe
  2⤵
  PID:4664
- C:\Windows\System\xpfZeDt.exe
  C:\Windows\System\xpfZeDt.exe
  2⤵
  PID:4680
- C:\Windows\System\mMOpYxX.exe
  C:\Windows\System\mMOpYxX.exe
  2⤵
  PID:4700
- C:\Windows\System\XmbNbsh.exe
  C:\Windows\System\XmbNbsh.exe
  2⤵
  PID:4712
- C:\Windows\System\vquZOcH.exe
  C:\Windows\System\vquZOcH.exe
  2⤵
  PID:604
- C:\Windows\System\HCZYqPt.exe
  C:\Windows\System\HCZYqPt.exe
  2⤵
  PID:4744
- C:\Windows\System\cHoFflv.exe
  C:\Windows\System\cHoFflv.exe
  2⤵
  PID:4780
- C:\Windows\System\KgYjSqp.exe
  C:\Windows\System\KgYjSqp.exe
  2⤵
  PID:4808
- C:\Windows\System\tDyMVKs.exe
  C:\Windows\System\tDyMVKs.exe
  2⤵
  PID:4828
- C:\Windows\System\pPZDoTG.exe
  C:\Windows\System\pPZDoTG.exe
  2⤵
  PID:2420
- C:\Windows\System\jSAPput.exe
  C:\Windows\System\jSAPput.exe
  2⤵
  PID:1672
- C:\Windows\System\oKdCNEp.exe
  C:\Windows\System\oKdCNEp.exe
  2⤵
  PID:380
- C:\Windows\System\BaBITzo.exe
  C:\Windows\System\BaBITzo.exe
  2⤵
  PID:4884
- C:\Windows\System\lDfQqnT.exe
  C:\Windows\System\lDfQqnT.exe
  2⤵
  PID:4936
- C:\Windows\System\StgHTge.exe
  C:\Windows\System\StgHTge.exe
  2⤵
  PID:4924
- C:\Windows\System\Xuecimr.exe
  C:\Windows\System\Xuecimr.exe
  2⤵
  PID:4940
- C:\Windows\System\GihPZiw.exe
  C:\Windows\System\GihPZiw.exe
  2⤵
  PID:5016
- C:\Windows\System\jkFMUZV.exe
  C:\Windows\System\jkFMUZV.exe
  2⤵
  PID:5048
- C:\Windows\System\TFzJNDW.exe
  C:\Windows\System\TFzJNDW.exe
  2⤵
  PID:4996
- C:\Windows\System\LkmkgyN.exe
  C:\Windows\System\LkmkgyN.exe
  2⤵
  PID:3524
- C:\Windows\System\CfQSVLF.exe
  C:\Windows\System\CfQSVLF.exe
  2⤵
  PID:3428
- C:\Windows\System\BFSUEpv.exe
  C:\Windows\System\BFSUEpv.exe
  2⤵
  PID:5028
- C:\Windows\System\jFyYngQ.exe
  C:\Windows\System\jFyYngQ.exe
  2⤵
  PID:3140
- C:\Windows\System\guiLIHt.exe
  C:\Windows\System\guiLIHt.exe
  2⤵
  PID:3292
- C:\Windows\System\xUrGRmE.exe
  C:\Windows\System\xUrGRmE.exe
  2⤵
  PID:4172
- C:\Windows\System\MALfLgc.exe
  C:\Windows\System\MALfLgc.exe
  2⤵
  PID:2256
- C:\Windows\System\TcCOTjF.exe
  C:\Windows\System\TcCOTjF.exe
  2⤵
  PID:4136
- C:\Windows\System\pMXxjgd.exe
  C:\Windows\System\pMXxjgd.exe
  2⤵
  PID:4236
- C:\Windows\System\mddKwAt.exe
  C:\Windows\System\mddKwAt.exe
  2⤵
  PID:4280
- C:\Windows\System\FUSrbrF.exe
  C:\Windows\System\FUSrbrF.exe
  2⤵
  PID:1896
- C:\Windows\System\ofzLuVH.exe
  C:\Windows\System\ofzLuVH.exe
  2⤵
  PID:4300
- C:\Windows\System\jtFpnDv.exe
  C:\Windows\System\jtFpnDv.exe
  2⤵
  PID:1936
- C:\Windows\System\RnjEomE.exe
  C:\Windows\System\RnjEomE.exe
  2⤵
  PID:2744
- C:\Windows\System\UMrdsqu.exe
  C:\Windows\System\UMrdsqu.exe
  2⤵
  PID:1224
- C:\Windows\System\xkCRqVb.exe
  C:\Windows\System\xkCRqVb.exe
  2⤵
  PID:1924
- C:\Windows\System\TXkeFBn.exe
  C:\Windows\System\TXkeFBn.exe
  2⤵
  PID:4496
- C:\Windows\System\GrVxQbB.exe
  C:\Windows\System\GrVxQbB.exe
  2⤵
  PID:4596
- C:\Windows\System\zBQPFnh.exe
  C:\Windows\System\zBQPFnh.exe
  2⤵
  PID:4544
- C:\Windows\System\YNhwelu.exe
  C:\Windows\System\YNhwelu.exe
  2⤵
  PID:768
- C:\Windows\System\zopaUTm.exe
  C:\Windows\System\zopaUTm.exe
  2⤵
  PID:4608
- C:\Windows\System\PMaSQOL.exe
  C:\Windows\System\PMaSQOL.exe
  2⤵
  PID:4452
- C:\Windows\System\mgZKyzB.exe
  C:\Windows\System\mgZKyzB.exe
  2⤵
  PID:4724
- C:\Windows\System\QGyEMdR.exe
  C:\Windows\System\QGyEMdR.exe
  2⤵
  PID:4704
- C:\Windows\System\WKfPKKl.exe
  C:\Windows\System\WKfPKKl.exe
  2⤵
  PID:2200
- C:\Windows\System\ZbUuVQX.exe
  C:\Windows\System\ZbUuVQX.exe
  2⤵
  PID:4688
- C:\Windows\System\xoynQiG.exe
  C:\Windows\System\xoynQiG.exe
  2⤵
  PID:4764
- C:\Windows\System\KhmqcrR.exe
  C:\Windows\System\KhmqcrR.exe
  2⤵
  PID:5056
- C:\Windows\System\kEmjwpo.exe
  C:\Windows\System\kEmjwpo.exe
  2⤵
  PID:2736
- C:\Windows\System\KjOwxUb.exe
  C:\Windows\System\KjOwxUb.exe
  2⤵
  PID:4848
- C:\Windows\System\wNsCqBX.exe
  C:\Windows\System\wNsCqBX.exe
  2⤵
  PID:4824
- C:\Windows\System\vDbYcMJ.exe
  C:\Windows\System\vDbYcMJ.exe
  2⤵
  PID:1668
- C:\Windows\System\LNXBBmt.exe
  C:\Windows\System\LNXBBmt.exe
  2⤵
  PID:4872
- C:\Windows\System\bjdJtoz.exe
  C:\Windows\System\bjdJtoz.exe
  2⤵
  PID:3712
- C:\Windows\System\HRELtRC.exe
  C:\Windows\System\HRELtRC.exe
  2⤵
  PID:3252
- C:\Windows\System\VjJeELL.exe
  C:\Windows\System\VjJeELL.exe
  2⤵
  PID:4376
- C:\Windows\System\DrfAUZQ.exe
  C:\Windows\System\DrfAUZQ.exe
  2⤵
  PID:3376
- C:\Windows\System\yWcwYHb.exe
  C:\Windows\System\yWcwYHb.exe
  2⤵
  PID:3296
- C:\Windows\System\UHNBzBG.exe
  C:\Windows\System\UHNBzBG.exe
  2⤵
  PID:1408
- C:\Windows\System\yBTJFqh.exe
  C:\Windows\System\yBTJFqh.exe
  2⤵
  PID:4176
- C:\Windows\System\SzGZYEd.exe
  C:\Windows\System\SzGZYEd.exe
  2⤵
  PID:4216
- C:\Windows\System\BSiSZlI.exe
  C:\Windows\System\BSiSZlI.exe
  2⤵
  PID:4324
- C:\Windows\System\wtesYaw.exe
  C:\Windows\System\wtesYaw.exe
  2⤵
  PID:2988
- C:\Windows\System\AQPzEmG.exe
  C:\Windows\System\AQPzEmG.exe
  2⤵
  PID:588
- C:\Windows\System\DuGMtxn.exe
  C:\Windows\System\DuGMtxn.exe
  2⤵
  PID:1984
- C:\Windows\System\zlLVmcR.exe
  C:\Windows\System\zlLVmcR.exe
  2⤵
  PID:4388
- C:\Windows\System\hMyjzMb.exe
  C:\Windows\System\hMyjzMb.exe
  2⤵
  PID:3632
- C:\Windows\System\VOKhFBE.exe
  C:\Windows\System\VOKhFBE.exe
  2⤵
  PID:4284
- C:\Windows\System\NXldgcs.exe
  C:\Windows\System\NXldgcs.exe
  2⤵
  PID:4480
- C:\Windows\System\beRAfKx.exe
  C:\Windows\System\beRAfKx.exe
  2⤵
  PID:1628
- C:\Windows\System\ILoMXJf.exe
  C:\Windows\System\ILoMXJf.exe
  2⤵
  PID:4672
- C:\Windows\System\iSWIIux.exe
  C:\Windows\System\iSWIIux.exe
  2⤵
  PID:4768
- C:\Windows\System\RpagAUX.exe
  C:\Windows\System\RpagAUX.exe
  2⤵
  PID:5068
- C:\Windows\System\AUWlvDX.exe
  C:\Windows\System\AUWlvDX.exe
  2⤵
  PID:1880
- C:\Windows\System\JqeTKLZ.exe
  C:\Windows\System\JqeTKLZ.exe
  2⤵
  PID:2004
- C:\Windows\System\lGEIlnF.exe
  C:\Windows\System\lGEIlnF.exe
  2⤵
  PID:688
- C:\Windows\System\qHbEfzN.exe
  C:\Windows\System\qHbEfzN.exe
  2⤵
  PID:2568
- C:\Windows\System\jZjROCM.exe
  C:\Windows\System\jZjROCM.exe
  2⤵
  PID:5072
- C:\Windows\System\gmDIptQ.exe
  C:\Windows\System\gmDIptQ.exe
  2⤵
  PID:5088
- C:\Windows\System\dAjOGEX.exe
  C:\Windows\System\dAjOGEX.exe
  2⤵
  PID:4160
- C:\Windows\System\kHKFaoy.exe
  C:\Windows\System\kHKFaoy.exe
  2⤵
  PID:4012
- C:\Windows\System\vnDenoX.exe
  C:\Windows\System\vnDenoX.exe
  2⤵
  PID:4400
- C:\Windows\System\MkFhTtD.exe
  C:\Windows\System\MkFhTtD.exe
  2⤵
  PID:2792
- C:\Windows\System\KQWUrqU.exe
  C:\Windows\System\KQWUrqU.exe
  2⤵
  PID:3344
- C:\Windows\System\ljrINiz.exe
  C:\Windows\System\ljrINiz.exe
  2⤵
  PID:4352
- C:\Windows\System\UhsGsqJ.exe
  C:\Windows\System\UhsGsqJ.exe
  2⤵
  PID:4592
- C:\Windows\System\sDuHjCr.exe
  C:\Windows\System\sDuHjCr.exe
  2⤵
  PID:4380
- C:\Windows\System\ZWUQNfd.exe
  C:\Windows\System\ZWUQNfd.exe
  2⤵
  PID:5044
- C:\Windows\System\ILfWCtX.exe
  C:\Windows\System\ILfWCtX.exe
  2⤵
  PID:4116
- C:\Windows\System\JwveyWg.exe
  C:\Windows\System\JwveyWg.exe
  2⤵
  PID:4976
- C:\Windows\System\edtUXFg.exe
  C:\Windows\System\edtUXFg.exe
  2⤵
  PID:5012
- C:\Windows\System\srgAaGT.exe
  C:\Windows\System\srgAaGT.exe
  2⤵
  PID:4180
- C:\Windows\System\BiymcOD.exe
  C:\Windows\System\BiymcOD.exe
  2⤵
  PID:1916
- C:\Windows\System\TDyVSJj.exe
  C:\Windows\System\TDyVSJj.exe
  2⤵
  PID:1352
- C:\Windows\System\fEduiCW.exe
  C:\Windows\System\fEduiCW.exe
  2⤵
  PID:3212
- C:\Windows\System\bTwzFSb.exe
  C:\Windows\System\bTwzFSb.exe
  2⤵
  PID:4340
- C:\Windows\System\qCAQSvZ.exe
  C:\Windows\System\qCAQSvZ.exe
  2⤵
  PID:1592
- C:\Windows\System\cFGSwuF.exe
  C:\Windows\System\cFGSwuF.exe
  2⤵
  PID:5136
- C:\Windows\System\jIAIOEs.exe
  C:\Windows\System\jIAIOEs.exe
  2⤵
  PID:5152
- C:\Windows\System\WJKtCVC.exe
  C:\Windows\System\WJKtCVC.exe
  2⤵
  PID:5168
- C:\Windows\System\KiypMvx.exe
  C:\Windows\System\KiypMvx.exe
  2⤵
  PID:5184
- C:\Windows\System\cyVbbwZ.exe
  C:\Windows\System\cyVbbwZ.exe
  2⤵
  PID:5200
- C:\Windows\System\vhYbKtt.exe
  C:\Windows\System\vhYbKtt.exe
  2⤵
  PID:5220
- C:\Windows\System\FLozTzm.exe
  C:\Windows\System\FLozTzm.exe
  2⤵
  PID:5236
- C:\Windows\System\YsXGVBl.exe
  C:\Windows\System\YsXGVBl.exe
  2⤵
  PID:5252
- C:\Windows\System\CaFxoSS.exe
  C:\Windows\System\CaFxoSS.exe
  2⤵
  PID:5268
- C:\Windows\System\EGTVOGd.exe
  C:\Windows\System\EGTVOGd.exe
  2⤵
  PID:5284
- C:\Windows\System\KKQmtIA.exe
  C:\Windows\System\KKQmtIA.exe
  2⤵
  PID:5300
- C:\Windows\System\XSWkjNc.exe
  C:\Windows\System\XSWkjNc.exe
  2⤵
  PID:5320
- C:\Windows\System\DeMpJZq.exe
  C:\Windows\System\DeMpJZq.exe
  2⤵
  PID:5336
- C:\Windows\System\lNxMpYA.exe
  C:\Windows\System\lNxMpYA.exe
  2⤵
  PID:5352
- C:\Windows\System\uBQghKa.exe
  C:\Windows\System\uBQghKa.exe
  2⤵
  PID:5368
- C:\Windows\System\ciCNYVT.exe
  C:\Windows\System\ciCNYVT.exe
  2⤵
  PID:5384
- C:\Windows\System\qcVXOFk.exe
  C:\Windows\System\qcVXOFk.exe
  2⤵
  PID:5400
- C:\Windows\System\xKGBZfl.exe
  C:\Windows\System\xKGBZfl.exe
  2⤵
  PID:5416
- C:\Windows\System\MsDuNaQ.exe
  C:\Windows\System\MsDuNaQ.exe
  2⤵
  PID:5432
- C:\Windows\System\ZmcroNX.exe
  C:\Windows\System\ZmcroNX.exe
  2⤵
  PID:5448
- C:\Windows\System\zzRgPto.exe
  C:\Windows\System\zzRgPto.exe
  2⤵
  PID:5464
- C:\Windows\System\dTGHJzg.exe
  C:\Windows\System\dTGHJzg.exe
  2⤵
  PID:5484
- C:\Windows\System\mogmWOr.exe
  C:\Windows\System\mogmWOr.exe
  2⤵
  PID:5500
- C:\Windows\System\UrFXwyn.exe
  C:\Windows\System\UrFXwyn.exe
  2⤵
  PID:5516
- C:\Windows\System\LUMOydj.exe
  C:\Windows\System\LUMOydj.exe
  2⤵
  PID:5532
- C:\Windows\System\wKDQyeY.exe
  C:\Windows\System\wKDQyeY.exe
  2⤵
  PID:5548
- C:\Windows\System\jYrABqb.exe
  C:\Windows\System\jYrABqb.exe
  2⤵
  PID:5564
- C:\Windows\System\WRvRtzS.exe
  C:\Windows\System\WRvRtzS.exe
  2⤵
  PID:5580
- C:\Windows\System\BVJewEG.exe
  C:\Windows\System\BVJewEG.exe
  2⤵
  PID:5596
- C:\Windows\System\THQyBfw.exe
  C:\Windows\System\THQyBfw.exe
  2⤵
  PID:5612
- C:\Windows\System\EuLhUhq.exe
  C:\Windows\System\EuLhUhq.exe
  2⤵
  PID:5628
- C:\Windows\System\vIUIliM.exe
  C:\Windows\System\vIUIliM.exe
  2⤵
  PID:5644
- C:\Windows\System\dDYHuBN.exe
  C:\Windows\System\dDYHuBN.exe
  2⤵
  PID:5660
- C:\Windows\System\VJundMs.exe
  C:\Windows\System\VJundMs.exe
  2⤵
  PID:5676
- C:\Windows\System\MJTkswN.exe
  C:\Windows\System\MJTkswN.exe
  2⤵
  PID:5692
- C:\Windows\System\wjrxREr.exe
  C:\Windows\System\wjrxREr.exe
  2⤵
  PID:5708
- C:\Windows\System\DjVVFuO.exe
  C:\Windows\System\DjVVFuO.exe
  2⤵
  PID:5728
- C:\Windows\System\HDVlfjx.exe
  C:\Windows\System\HDVlfjx.exe
  2⤵
  PID:5744
- C:\Windows\System\lMCkktb.exe
  C:\Windows\System\lMCkktb.exe
  2⤵
  PID:5760
- C:\Windows\System\wHxvLaw.exe
  C:\Windows\System\wHxvLaw.exe
  2⤵
  PID:5776
- C:\Windows\System\osAOtFi.exe
  C:\Windows\System\osAOtFi.exe
  2⤵
  PID:5792
- C:\Windows\System\FGMuNBy.exe
  C:\Windows\System\FGMuNBy.exe
  2⤵
  PID:5808
- C:\Windows\System\WXUTaPj.exe
  C:\Windows\System\WXUTaPj.exe
  2⤵
  PID:5824
- C:\Windows\System\KTQtkAW.exe
  C:\Windows\System\KTQtkAW.exe
  2⤵
  PID:5840
- C:\Windows\System\pRehiBi.exe
  C:\Windows\System\pRehiBi.exe
  2⤵
  PID:5856
- C:\Windows\System\sYWzEFC.exe
  C:\Windows\System\sYWzEFC.exe
  2⤵
  PID:5872
- C:\Windows\System\Kqojgyl.exe
  C:\Windows\System\Kqojgyl.exe
  2⤵
  PID:5912
- C:\Windows\System\oGQcytj.exe
  C:\Windows\System\oGQcytj.exe
  2⤵
  PID:6024
- C:\Windows\System\yszKjuL.exe
  C:\Windows\System\yszKjuL.exe
  2⤵
  PID:6048
- C:\Windows\System\oqBEKFx.exe
  C:\Windows\System\oqBEKFx.exe
  2⤵
  PID:6072
- C:\Windows\System\pHylKEo.exe
  C:\Windows\System\pHylKEo.exe
  2⤵
  PID:6092
- C:\Windows\System\sxeJuzt.exe
  C:\Windows\System\sxeJuzt.exe
  2⤵
  PID:6108
- C:\Windows\System\idZYxfz.exe
  C:\Windows\System\idZYxfz.exe
  2⤵
  PID:6124
- C:\Windows\System\pgUmTsP.exe
  C:\Windows\System\pgUmTsP.exe
  2⤵
  PID:5128
- C:\Windows\System\NXQkXrI.exe
  C:\Windows\System\NXQkXrI.exe
  2⤵
  PID:5192
- C:\Windows\System\bihsCVX.exe
  C:\Windows\System\bihsCVX.exe
  2⤵
  PID:2644
- C:\Windows\System\noSZivs.exe
  C:\Windows\System\noSZivs.exe
  2⤵
  PID:2312
- C:\Windows\System\oPozccK.exe
  C:\Windows\System\oPozccK.exe
  2⤵
  PID:5144
- C:\Windows\System\gLzBDDh.exe
  C:\Windows\System\gLzBDDh.exe
  2⤵
  PID:4960
- C:\Windows\System\HbpqoWC.exe
  C:\Windows\System\HbpqoWC.exe
  2⤵
  PID:5232
- C:\Windows\System\gbnKexw.exe
  C:\Windows\System\gbnKexw.exe
  2⤵
  PID:5296
- C:\Windows\System\zlSeNCz.exe
  C:\Windows\System\zlSeNCz.exe
  2⤵
  PID:5360
- C:\Windows\System\jPAjXAA.exe
  C:\Windows\System\jPAjXAA.exe
  2⤵
  PID:5396
- C:\Windows\System\VMsUmmJ.exe
  C:\Windows\System\VMsUmmJ.exe
  2⤵
  PID:5472
- C:\Windows\System\RCIoLXb.exe
  C:\Windows\System\RCIoLXb.exe
  2⤵
  PID:5316
- C:\Windows\System\nVHApKo.exe
  C:\Windows\System\nVHApKo.exe
  2⤵
  PID:5576
- C:\Windows\System\PTHusoM.exe
  C:\Windows\System\PTHusoM.exe
  2⤵
  PID:5852
- C:\Windows\System\HcjzGfQ.exe
  C:\Windows\System\HcjzGfQ.exe
  2⤵
  PID:5540
- C:\Windows\System\GRFTBEv.exe
  C:\Windows\System\GRFTBEv.exe
  2⤵
  PID:5412
- C:\Windows\System\EFWISMa.exe
  C:\Windows\System\EFWISMa.exe
  2⤵
  PID:5572
- C:\Windows\System\vhpOTOS.exe
  C:\Windows\System\vhpOTOS.exe
  2⤵
  PID:5864
- C:\Windows\System\BAqUzfb.exe
  C:\Windows\System\BAqUzfb.exe
  2⤵
  PID:5700
- C:\Windows\System\vwThsGm.exe
  C:\Windows\System\vwThsGm.exe
  2⤵
  PID:5768
- C:\Windows\System\KwheAsT.exe
  C:\Windows\System\KwheAsT.exe
  2⤵
  PID:5832
- C:\Windows\System\XXHanRW.exe
  C:\Windows\System\XXHanRW.exe
  2⤵
  PID:5884
- C:\Windows\System\lOEOkan.exe
  C:\Windows\System\lOEOkan.exe
  2⤵
  PID:5904
- C:\Windows\System\oiupiZs.exe
  C:\Windows\System\oiupiZs.exe
  2⤵
  PID:5928
- C:\Windows\System\mdfSFWa.exe
  C:\Windows\System\mdfSFWa.exe
  2⤵
  PID:5980
- C:\Windows\System\rpFGNGs.exe
  C:\Windows\System\rpFGNGs.exe
  2⤵
  PID:5952
- C:\Windows\System\MCdptEw.exe
  C:\Windows\System\MCdptEw.exe
  2⤵
  PID:5972
- C:\Windows\System\nwDCHYD.exe
  C:\Windows\System\nwDCHYD.exe
  2⤵
  PID:5992
- C:\Windows\System\xUNdCtG.exe
  C:\Windows\System\xUNdCtG.exe
  2⤵
  PID:6008
- C:\Windows\System\NunqjYK.exe
  C:\Windows\System\NunqjYK.exe
  2⤵
  PID:6044
- C:\Windows\System\BxzpuBN.exe
  C:\Windows\System\BxzpuBN.exe
  2⤵
  PID:6084
- C:\Windows\System\vBPhXyQ.exe
  C:\Windows\System\vBPhXyQ.exe
  2⤵
  PID:5164
- C:\Windows\System\lraqAJS.exe
  C:\Windows\System\lraqAJS.exe
  2⤵
  PID:5180
- C:\Windows\System\McqaXnM.exe
  C:\Windows\System\McqaXnM.exe
  2⤵
  PID:5392
- C:\Windows\System\FEHovGZ.exe
  C:\Windows\System\FEHovGZ.exe
  2⤵
  PID:6064
- C:\Windows\System\hZqHEEk.exe
  C:\Windows\System\hZqHEEk.exe
  2⤵
  PID:6132
- C:\Windows\System\bDPuqpk.exe
  C:\Windows\System\bDPuqpk.exe
  2⤵
  PID:3136
- C:\Windows\System\XIImDqw.exe
  C:\Windows\System\XIImDqw.exe
  2⤵
  PID:5328
- C:\Windows\System\PVPiMvf.exe
  C:\Windows\System\PVPiMvf.exe
  2⤵
  PID:5428
- C:\Windows\System\aNgYdOn.exe
  C:\Windows\System\aNgYdOn.exe
  2⤵
  PID:5524
- C:\Windows\System\nJoXJSC.exe
  C:\Windows\System\nJoXJSC.exe
  2⤵
  PID:5248
- C:\Windows\System\RPXMEGP.exe
  C:\Windows\System\RPXMEGP.exe
  2⤵
  PID:5620
- C:\Windows\System\maytCfU.exe
  C:\Windows\System\maytCfU.exe
  2⤵
  PID:5684
- C:\Windows\System\BorGNDd.exe
  C:\Windows\System\BorGNDd.exe
  2⤵
  PID:5756
- C:\Windows\System\MCHAJbI.exe
  C:\Windows\System\MCHAJbI.exe
  2⤵
  PID:5724
- C:\Windows\System\XegUFLM.exe
  C:\Windows\System\XegUFLM.exe
  2⤵
  PID:5308
- C:\Windows\System\qHiyJmq.exe
  C:\Windows\System\qHiyJmq.exe
  2⤵
  PID:5668
- C:\Windows\System\OJhFqCh.exe
  C:\Windows\System\OJhFqCh.exe
  2⤵
  PID:5820
- C:\Windows\System\fvxRTnY.exe
  C:\Windows\System\fvxRTnY.exe
  2⤵
  PID:5736
- C:\Windows\System\qRxjkJG.exe
  C:\Windows\System\qRxjkJG.exe
  2⤵
  PID:5924
- C:\Windows\System\zfQNUjj.exe
  C:\Windows\System\zfQNUjj.exe
  2⤵
  PID:5948
- C:\Windows\System\OzlYXRu.exe
  C:\Windows\System\OzlYXRu.exe
  2⤵
  PID:5944
- C:\Windows\System\wTKiFzh.exe
  C:\Windows\System\wTKiFzh.exe
  2⤵
  PID:6104
- C:\Windows\System\bABchqN.exe
  C:\Windows\System\bABchqN.exe
  2⤵
  PID:5208
- C:\Windows\System\UHzTMFX.exe
  C:\Windows\System\UHzTMFX.exe
  2⤵
  PID:5688
- C:\Windows\System\WOeCMvf.exe
  C:\Windows\System\WOeCMvf.exe
  2⤵
  PID:5940
- C:\Windows\System\uGPHKWl.exe
  C:\Windows\System\uGPHKWl.exe
  2⤵
  PID:6004
- C:\Windows\System\huEbeIf.exe
  C:\Windows\System\huEbeIf.exe
  2⤵
  PID:5176
- C:\Windows\System\YuOptqk.exe
  C:\Windows\System\YuOptqk.exe
  2⤵
  PID:4532
- C:\Windows\System\OcClMJg.exe
  C:\Windows\System\OcClMJg.exe
  2⤵
  PID:5556
- C:\Windows\System\MtFOcFh.exe
  C:\Windows\System\MtFOcFh.exe
  2⤵
  PID:5656
- C:\Windows\System\sAeAXCe.exe
  C:\Windows\System\sAeAXCe.exe
  2⤵
  PID:5408
- C:\Windows\System\VKxNuaf.exe
  C:\Windows\System\VKxNuaf.exe
  2⤵
  PID:5276
- C:\Windows\System\XJaEwzM.exe
  C:\Windows\System\XJaEwzM.exe
  2⤵
  PID:5848
- C:\Windows\System\gUKWNio.exe
  C:\Windows\System\gUKWNio.exe
  2⤵
  PID:6100
- C:\Windows\System\rfeRMED.exe
  C:\Windows\System\rfeRMED.exe
  2⤵
  PID:5280
- C:\Windows\System\BZjMblO.exe
  C:\Windows\System\BZjMblO.exe
  2⤵
  PID:5960
- C:\Windows\System\WTgZNEa.exe
  C:\Windows\System\WTgZNEa.exe
  2⤵
  PID:5800
- C:\Windows\System\NvoDfDY.exe
  C:\Windows\System\NvoDfDY.exe
  2⤵
  PID:2416
- C:\Windows\System\ocSrBck.exe
  C:\Windows\System\ocSrBck.exe
  2⤵
  PID:5784
- C:\Windows\System\jbqPTuJ.exe
  C:\Windows\System\jbqPTuJ.exe
  2⤵
  PID:5228
- C:\Windows\System\wzNEkds.exe
  C:\Windows\System\wzNEkds.exe
  2⤵
  PID:6148
- C:\Windows\System\AImmXPt.exe
  C:\Windows\System\AImmXPt.exe
  2⤵
  PID:6164
- C:\Windows\System\hlnDtfd.exe
  C:\Windows\System\hlnDtfd.exe
  2⤵
  PID:6184
- C:\Windows\System\wDsbsAc.exe
  C:\Windows\System\wDsbsAc.exe
  2⤵
  PID:6200
- C:\Windows\System\gHNDjeG.exe
  C:\Windows\System\gHNDjeG.exe
  2⤵
  PID:6216
- C:\Windows\System\ajODGDj.exe
  C:\Windows\System\ajODGDj.exe
  2⤵
  PID:6232
- C:\Windows\System\YCFObWk.exe
  C:\Windows\System\YCFObWk.exe
  2⤵
  PID:6248
- C:\Windows\System\RsuxNLc.exe
  C:\Windows\System\RsuxNLc.exe
  2⤵
  PID:6264
- C:\Windows\System\TaZGYzE.exe
  C:\Windows\System\TaZGYzE.exe
  2⤵
  PID:6280
- C:\Windows\System\XcLAGcL.exe
  C:\Windows\System\XcLAGcL.exe
  2⤵
  PID:6296
- C:\Windows\System\zmqmruM.exe
  C:\Windows\System\zmqmruM.exe
  2⤵
  PID:6312
- C:\Windows\System\WuWduzj.exe
  C:\Windows\System\WuWduzj.exe
  2⤵
  PID:6328
- C:\Windows\System\xFHIbwL.exe
  C:\Windows\System\xFHIbwL.exe
  2⤵
  PID:6344
- C:\Windows\System\PkEhDug.exe
  C:\Windows\System\PkEhDug.exe
  2⤵
  PID:6360
- C:\Windows\System\TiPRLCf.exe
  C:\Windows\System\TiPRLCf.exe
  2⤵
  PID:6376
- C:\Windows\System\pRNExQS.exe
  C:\Windows\System\pRNExQS.exe
  2⤵
  PID:6392
- C:\Windows\System\FUcMZRc.exe
  C:\Windows\System\FUcMZRc.exe
  2⤵
  PID:6408
- C:\Windows\System\hIcclOV.exe
  C:\Windows\System\hIcclOV.exe
  2⤵
  PID:6424
- C:\Windows\System\DrMIpEr.exe
  C:\Windows\System\DrMIpEr.exe
  2⤵
  PID:6440
- C:\Windows\System\UmyvEOH.exe
  C:\Windows\System\UmyvEOH.exe
  2⤵
  PID:6456
- C:\Windows\System\OwfaDQi.exe
  C:\Windows\System\OwfaDQi.exe
  2⤵
  PID:6472
- C:\Windows\System\RQEXQJq.exe
  C:\Windows\System\RQEXQJq.exe
  2⤵
  PID:6492
- C:\Windows\System\ZlQozZe.exe
  C:\Windows\System\ZlQozZe.exe
  2⤵
  PID:6508
- C:\Windows\System\vAEMBCE.exe
  C:\Windows\System\vAEMBCE.exe
  2⤵
  PID:6524
- C:\Windows\System\iokAkaj.exe
  C:\Windows\System\iokAkaj.exe
  2⤵
  PID:6540
- C:\Windows\System\OTQejIl.exe
  C:\Windows\System\OTQejIl.exe
  2⤵
  PID:6556
- C:\Windows\System\tAarwBN.exe
  C:\Windows\System\tAarwBN.exe
  2⤵
  PID:6572
- C:\Windows\System\NuqrbhF.exe
  C:\Windows\System\NuqrbhF.exe
  2⤵
  PID:6588
- C:\Windows\System\BmHVtEm.exe
  C:\Windows\System\BmHVtEm.exe
  2⤵
  PID:6604
- C:\Windows\System\qRPGvPW.exe
  C:\Windows\System\qRPGvPW.exe
  2⤵
  PID:6620
- C:\Windows\System\eumamED.exe
  C:\Windows\System\eumamED.exe
  2⤵
  PID:6636
- C:\Windows\System\dNpSYUl.exe
  C:\Windows\System\dNpSYUl.exe
  2⤵
  PID:6652
- C:\Windows\System\GBFQvjW.exe
  C:\Windows\System\GBFQvjW.exe
  2⤵
  PID:6668
- C:\Windows\System\aKzZNmE.exe
  C:\Windows\System\aKzZNmE.exe
  2⤵
  PID:6684
- C:\Windows\System\EUpiYvx.exe
  C:\Windows\System\EUpiYvx.exe
  2⤵
  PID:6700
- C:\Windows\System\MqAtAmC.exe
  C:\Windows\System\MqAtAmC.exe
  2⤵
  PID:6716
- C:\Windows\System\KkNUkSm.exe
  C:\Windows\System\KkNUkSm.exe
  2⤵
  PID:6732
- C:\Windows\System\rhMkTCq.exe
  C:\Windows\System\rhMkTCq.exe
  2⤵
  PID:6748
- C:\Windows\System\FbmzDYe.exe
  C:\Windows\System\FbmzDYe.exe
  2⤵
  PID:6764
- C:\Windows\System\RxtyBWy.exe
  C:\Windows\System\RxtyBWy.exe
  2⤵
  PID:6780
- C:\Windows\System\hYuKEJL.exe
  C:\Windows\System\hYuKEJL.exe
  2⤵
  PID:6796
- C:\Windows\System\UVzevEH.exe
  C:\Windows\System\UVzevEH.exe
  2⤵
  PID:6812
- C:\Windows\System\tOHHISC.exe
  C:\Windows\System\tOHHISC.exe
  2⤵
  PID:6828
- C:\Windows\System\NfYFWfZ.exe
  C:\Windows\System\NfYFWfZ.exe
  2⤵
  PID:6844
- C:\Windows\System\dxFOAxD.exe
  C:\Windows\System\dxFOAxD.exe
  2⤵
  PID:6860
- C:\Windows\System\nhRoPkr.exe
  C:\Windows\System\nhRoPkr.exe
  2⤵
  PID:6876
- C:\Windows\System\EjzcmEA.exe
  C:\Windows\System\EjzcmEA.exe
  2⤵
  PID:6892
- C:\Windows\System\HxJIpvJ.exe
  C:\Windows\System\HxJIpvJ.exe
  2⤵
  PID:6908
- C:\Windows\System\ncyaccb.exe
  C:\Windows\System\ncyaccb.exe
  2⤵
  PID:6928
- C:\Windows\System\mCzLAUs.exe
  C:\Windows\System\mCzLAUs.exe
  2⤵
  PID:6944
- C:\Windows\System\xGnrgIS.exe
  C:\Windows\System\xGnrgIS.exe
  2⤵
  PID:6960
- C:\Windows\System\UKZMdRH.exe
  C:\Windows\System\UKZMdRH.exe
  2⤵
  PID:6976
- C:\Windows\System\ILoEEtt.exe
  C:\Windows\System\ILoEEtt.exe
  2⤵
  PID:6992
- C:\Windows\System\MVjdTbk.exe
  C:\Windows\System\MVjdTbk.exe
  2⤵
  PID:7008
- C:\Windows\System\eeLtyiE.exe
  C:\Windows\System\eeLtyiE.exe
  2⤵
  PID:7024
- C:\Windows\System\PuCqGRf.exe
  C:\Windows\System\PuCqGRf.exe
  2⤵
  PID:7040
- C:\Windows\System\oCVGsDM.exe
  C:\Windows\System\oCVGsDM.exe
  2⤵
  PID:7056
- C:\Windows\System\cjGucSO.exe
  C:\Windows\System\cjGucSO.exe
  2⤵
  PID:7072
- C:\Windows\System\qCUZdSz.exe
  C:\Windows\System\qCUZdSz.exe
  2⤵
  PID:7088
- C:\Windows\System\suOHmjn.exe
  C:\Windows\System\suOHmjn.exe
  2⤵
  PID:7104
- C:\Windows\System\zNcZpjA.exe
  C:\Windows\System\zNcZpjA.exe
  2⤵
  PID:7120
- C:\Windows\System\qzEmLRY.exe
  C:\Windows\System\qzEmLRY.exe
  2⤵
  PID:7136
- C:\Windows\System\rqOEOAD.exe
  C:\Windows\System\rqOEOAD.exe
  2⤵
  PID:7152
- C:\Windows\System\RPRUaoe.exe
  C:\Windows\System\RPRUaoe.exe
  2⤵
  PID:6140
- C:\Windows\System\jsnmrsf.exe
  C:\Windows\System\jsnmrsf.exe
  2⤵
  PID:5456
- C:\Windows\System\vWkaEab.exe
  C:\Windows\System\vWkaEab.exe
  2⤵
  PID:6016
- C:\Windows\System\dfckKnj.exe
  C:\Windows\System\dfckKnj.exe
  2⤵
  PID:6208
- C:\Windows\System\LXlffWG.exe
  C:\Windows\System\LXlffWG.exe
  2⤵
  PID:6244
- C:\Windows\System\gbwVeiJ.exe
  C:\Windows\System\gbwVeiJ.exe
  2⤵
  PID:6160
- C:\Windows\System\lHNQEns.exe
  C:\Windows\System\lHNQEns.exe
  2⤵
  PID:6224
- C:\Windows\System\AeTMUvg.exe
  C:\Windows\System\AeTMUvg.exe
  2⤵
  PID:6032
- C:\Windows\System\dQTkbtt.exe
  C:\Windows\System\dQTkbtt.exe
  2⤵
  PID:6260
- C:\Windows\System\MkfWNGL.exe
  C:\Windows\System\MkfWNGL.exe
  2⤵
  PID:6288
- C:\Windows\System\TCHppNs.exe
  C:\Windows\System\TCHppNs.exe
  2⤵
  PID:6324
- C:\Windows\System\BplmfsZ.exe
  C:\Windows\System\BplmfsZ.exe
  2⤵
  PID:6372
- C:\Windows\System\CWOYgqL.exe
  C:\Windows\System\CWOYgqL.exe
  2⤵
  PID:6292
- C:\Windows\System\mkiIyQo.exe
  C:\Windows\System\mkiIyQo.exe
  2⤵
  PID:6416
- C:\Windows\System\QYXvEnv.exe
  C:\Windows\System\QYXvEnv.exe
  2⤵
  PID:6436
- C:\Windows\System\QtDxlCO.exe
  C:\Windows\System\QtDxlCO.exe
  2⤵
  PID:6500
- C:\Windows\System\bHAVNrn.exe
  C:\Windows\System\bHAVNrn.exe
  2⤵
  PID:6536
- C:\Windows\System\CmeQizb.exe
  C:\Windows\System\CmeQizb.exe
  2⤵
  PID:6600
- C:\Windows\System\tKDWRKZ.exe
  C:\Windows\System\tKDWRKZ.exe
  2⤵
  PID:6632
- C:\Windows\System\gMmXMKW.exe
  C:\Windows\System\gMmXMKW.exe
  2⤵
  PID:6692
- C:\Windows\System\Hfjntvi.exe
  C:\Windows\System\Hfjntvi.exe
  2⤵
  PID:6756
- C:\Windows\System\faKdvFN.exe
  C:\Windows\System\faKdvFN.exe
  2⤵
  PID:6548
- C:\Windows\System\xYTcoVc.exe
  C:\Windows\System\xYTcoVc.exe
  2⤵
  PID:6760
- C:\Windows\System\KRBERps.exe
  C:\Windows\System\KRBERps.exe
  2⤵
  PID:6616
- C:\Windows\System\aBtWKof.exe
  C:\Windows\System\aBtWKof.exe
  2⤵
  PID:6836
- C:\Windows\System\JobljpE.exe
  C:\Windows\System\JobljpE.exe
  2⤵
  PID:6776
- C:\Windows\System\RRahFll.exe
  C:\Windows\System\RRahFll.exe
  2⤵
  PID:6840
- C:\Windows\System\vzoLdjn.exe
  C:\Windows\System\vzoLdjn.exe
  2⤵
  PID:6788
- C:\Windows\System\hNxAlLk.exe
  C:\Windows\System\hNxAlLk.exe
  2⤵
  PID:6824
- C:\Windows\System\PBnXXlI.exe
  C:\Windows\System\PBnXXlI.exe
  2⤵
  PID:6920
- C:\Windows\System\VIToPkE.exe
  C:\Windows\System\VIToPkE.exe
  2⤵
  PID:6984
- C:\Windows\System\eBcjLOh.exe
  C:\Windows\System\eBcjLOh.exe
  2⤵
  PID:7016
- C:\Windows\System\RESzHuP.exe
  C:\Windows\System\RESzHuP.exe
  2⤵
  PID:7080
- C:\Windows\System\dvFunjP.exe
  C:\Windows\System\dvFunjP.exe
  2⤵
  PID:7144
- C:\Windows\System\yNZTlPf.exe
  C:\Windows\System\yNZTlPf.exe
  2⤵
  PID:7000
- C:\Windows\System\wzSofSr.exe
  C:\Windows\System\wzSofSr.exe
  2⤵
  PID:560
- C:\Windows\System\HnfzkND.exe
  C:\Windows\System\HnfzkND.exe
  2⤵
  PID:7032
- C:\Windows\System\lzCLriw.exe
  C:\Windows\System\lzCLriw.exe
  2⤵
  PID:5636
- C:\Windows\System\uBieGzr.exe
  C:\Windows\System\uBieGzr.exe
  2⤵
  PID:7096
- C:\Windows\System\zmUkzBO.exe
  C:\Windows\System\zmUkzBO.exe
  2⤵
  PID:6388
- C:\Windows\System\ObeTBKH.exe
  C:\Windows\System\ObeTBKH.exe
  2⤵
  PID:6504
- C:\Windows\System\UEgiPLQ.exe
  C:\Windows\System\UEgiPLQ.exe
  2⤵
  PID:6664
- C:\Windows\System\wiwjyZb.exe
  C:\Windows\System\wiwjyZb.exe
  2⤵
  PID:7160
- C:\Windows\System\yBHqMke.exe
  C:\Windows\System\yBHqMke.exe
  2⤵
  PID:6516
- C:\Windows\System\TxdaLGV.exe
  C:\Windows\System\TxdaLGV.exe
  2⤵
  PID:6240
- C:\Windows\System\SjvwhbZ.exe
  C:\Windows\System\SjvwhbZ.exe
  2⤵
  PID:5364
- C:\Windows\System\atVFjxg.exe
  C:\Windows\System\atVFjxg.exe
  2⤵
  PID:6352
- C:\Windows\System\YDSVwiH.exe
  C:\Windows\System\YDSVwiH.exe
  2⤵
  PID:6772
- C:\Windows\System\LvWChPj.exe
  C:\Windows\System\LvWChPj.exe
  2⤵
  PID:6900
- C:\Windows\System\PLbjKot.exe
  C:\Windows\System\PLbjKot.exe
  2⤵
  PID:6580
- C:\Windows\System\TeFPtfQ.exe
  C:\Windows\System\TeFPtfQ.exe
  2⤵
  PID:6872
- C:\Windows\System\bthgxRC.exe
  C:\Windows\System\bthgxRC.exe
  2⤵
  PID:6956
- C:\Windows\System\LtotOog.exe
  C:\Windows\System\LtotOog.exe
  2⤵
  PID:7148
- C:\Windows\System\nJUwbjG.exe
  C:\Windows\System\nJUwbjG.exe
  2⤵
  PID:6972
- C:\Windows\System\UChfcMV.exe
  C:\Windows\System\UChfcMV.exe
  2⤵
  PID:6272
- C:\Windows\System\ktBxrtE.exe
  C:\Windows\System\ktBxrtE.exe
  2⤵
  PID:6356
- C:\Windows\System\DddCudO.exe
  C:\Windows\System\DddCudO.exe
  2⤵
  PID:5196
- C:\Windows\System\BJLquSO.exe
  C:\Windows\System\BJLquSO.exe
  2⤵
  PID:6176
- C:\Windows\System\udIVKYw.exe
  C:\Windows\System\udIVKYw.exe
  2⤵
  PID:6628
- C:\Windows\System\vJDqltn.exe
  C:\Windows\System\vJDqltn.exe
  2⤵
  PID:6952
- C:\Windows\System\BAOPHZL.exe
  C:\Windows\System\BAOPHZL.exe
  2⤵
  PID:7048
- C:\Windows\System\hmTwjPq.exe
  C:\Windows\System\hmTwjPq.exe
  2⤵
  PID:6676
- C:\Windows\System\nBUgCim.exe
  C:\Windows\System\nBUgCim.exe
  2⤵
  PID:6256
- C:\Windows\System\uajvXUE.exe
  C:\Windows\System\uajvXUE.exe
  2⤵
  PID:7112
- C:\Windows\System\MRvZNva.exe
  C:\Windows\System\MRvZNva.exe
  2⤵
  PID:6724
- C:\Windows\System\zDLZUmz.exe
  C:\Windows\System\zDLZUmz.exe
  2⤵
  PID:6488
- C:\Windows\System\swGSKlu.exe
  C:\Windows\System\swGSKlu.exe
  2⤵
  PID:6868
- C:\Windows\System\GMEUDga.exe
  C:\Windows\System\GMEUDga.exe
  2⤵
  PID:6936
- C:\Windows\System\JAHqkOS.exe
  C:\Windows\System\JAHqkOS.exe
  2⤵
  PID:6940
- C:\Windows\System\KGyocbV.exe
  C:\Windows\System\KGyocbV.exe
  2⤵
  PID:7184
- C:\Windows\System\bvtXxiJ.exe
  C:\Windows\System\bvtXxiJ.exe
  2⤵
  PID:7200
- C:\Windows\System\jbKcXDN.exe
  C:\Windows\System\jbKcXDN.exe
  2⤵
  PID:7216
- C:\Windows\System\vrsigMe.exe
  C:\Windows\System\vrsigMe.exe
  2⤵
  PID:7232
- C:\Windows\System\BGtpzfJ.exe
  C:\Windows\System\BGtpzfJ.exe
  2⤵
  PID:7248
- C:\Windows\System\ZjBiosr.exe
  C:\Windows\System\ZjBiosr.exe
  2⤵
  PID:7264
- C:\Windows\System\wUOpeTg.exe
  C:\Windows\System\wUOpeTg.exe
  2⤵
  PID:7280
- C:\Windows\System\WuztHlM.exe
  C:\Windows\System\WuztHlM.exe
  2⤵
  PID:7296
- C:\Windows\System\vLLEhkK.exe
  C:\Windows\System\vLLEhkK.exe
  2⤵
  PID:7312
- C:\Windows\System\JSDTzei.exe
  C:\Windows\System\JSDTzei.exe
  2⤵
  PID:7328
- C:\Windows\System\MizLUJI.exe
  C:\Windows\System\MizLUJI.exe
  2⤵
  PID:7344
- C:\Windows\System\TYyLoPj.exe
  C:\Windows\System\TYyLoPj.exe
  2⤵
  PID:7360
- C:\Windows\System\yuSbkJN.exe
  C:\Windows\System\yuSbkJN.exe
  2⤵
  PID:7376
- C:\Windows\System\TfhckcR.exe
  C:\Windows\System\TfhckcR.exe
  2⤵
  PID:7392
- C:\Windows\System\atPdbeq.exe
  C:\Windows\System\atPdbeq.exe
  2⤵
  PID:7408
- C:\Windows\System\CSFqozK.exe
  C:\Windows\System\CSFqozK.exe
  2⤵
  PID:7424
- C:\Windows\System\dQkBqvt.exe
  C:\Windows\System\dQkBqvt.exe
  2⤵
  PID:7440
- C:\Windows\System\IGbKOMJ.exe
  C:\Windows\System\IGbKOMJ.exe
  2⤵
  PID:7456
- C:\Windows\System\dnPvkUa.exe
  C:\Windows\System\dnPvkUa.exe
  2⤵
  PID:7472
- C:\Windows\System\TqkdAnU.exe
  C:\Windows\System\TqkdAnU.exe
  2⤵
  PID:7488
- C:\Windows\System\PlqUEAL.exe
  C:\Windows\System\PlqUEAL.exe
  2⤵
  PID:7504
- C:\Windows\System\OzFFPrK.exe
  C:\Windows\System\OzFFPrK.exe
  2⤵
  PID:7520
- C:\Windows\System\OkNcpDW.exe
  C:\Windows\System\OkNcpDW.exe
  2⤵
  PID:7536
- C:\Windows\System\NKdHgVp.exe
  C:\Windows\System\NKdHgVp.exe
  2⤵
  PID:7552
- C:\Windows\System\yMdxfwv.exe
  C:\Windows\System\yMdxfwv.exe
  2⤵
  PID:7568
- C:\Windows\System\YYMsYlv.exe
  C:\Windows\System\YYMsYlv.exe
  2⤵
  PID:7584
- C:\Windows\System\MNzvuWt.exe
  C:\Windows\System\MNzvuWt.exe
  2⤵
  PID:7600
- C:\Windows\System\reWYKqS.exe
  C:\Windows\System\reWYKqS.exe
  2⤵
  PID:7616
- C:\Windows\System\ICzKdbj.exe
  C:\Windows\System\ICzKdbj.exe
  2⤵
  PID:7636
- C:\Windows\System\vEOlchG.exe
  C:\Windows\System\vEOlchG.exe
  2⤵
  PID:7652
- C:\Windows\System\mdpPqGC.exe
  C:\Windows\System\mdpPqGC.exe
  2⤵
  PID:7668
- C:\Windows\System\BBzSuzn.exe
  C:\Windows\System\BBzSuzn.exe
  2⤵
  PID:7684
- C:\Windows\System\aalhdjS.exe
  C:\Windows\System\aalhdjS.exe
  2⤵
  PID:7700
- C:\Windows\System\gCQHTEO.exe
  C:\Windows\System\gCQHTEO.exe
  2⤵
  PID:7716
- C:\Windows\System\lmErwxl.exe
  C:\Windows\System\lmErwxl.exe
  2⤵
  PID:7732
- C:\Windows\System\IzpLobc.exe
  C:\Windows\System\IzpLobc.exe
  2⤵
  PID:7748
- C:\Windows\System\eqWYQUj.exe
  C:\Windows\System\eqWYQUj.exe
  2⤵
  PID:7764
- C:\Windows\System\ljbzNos.exe
  C:\Windows\System\ljbzNos.exe
  2⤵
  PID:7780
- C:\Windows\System\UAyKXTv.exe
  C:\Windows\System\UAyKXTv.exe
  2⤵
  PID:7796
- C:\Windows\System\RwKqUgA.exe
  C:\Windows\System\RwKqUgA.exe
  2⤵
  PID:7812
- C:\Windows\System\hHYySOj.exe
  C:\Windows\System\hHYySOj.exe
  2⤵
  PID:7828
- C:\Windows\System\EdhIoMI.exe
  C:\Windows\System\EdhIoMI.exe
  2⤵
  PID:7844
- C:\Windows\System\ogpEMus.exe
  C:\Windows\System\ogpEMus.exe
  2⤵
  PID:7860
- C:\Windows\System\ZcFgEcP.exe
  C:\Windows\System\ZcFgEcP.exe
  2⤵
  PID:7876
- C:\Windows\System\XTZLRXe.exe
  C:\Windows\System\XTZLRXe.exe
  2⤵
  PID:7892
- C:\Windows\System\itqXiUY.exe
  C:\Windows\System\itqXiUY.exe
  2⤵
  PID:7908
- C:\Windows\System\qwlYSvm.exe
  C:\Windows\System\qwlYSvm.exe
  2⤵
  PID:7924
- C:\Windows\System\BQgFxWM.exe
  C:\Windows\System\BQgFxWM.exe
  2⤵
  PID:7940
- C:\Windows\System\QaTknaN.exe
  C:\Windows\System\QaTknaN.exe
  2⤵
  PID:7956
- C:\Windows\System\PVPTSNB.exe
  C:\Windows\System\PVPTSNB.exe
  2⤵
  PID:7972
- C:\Windows\System\FRfeEoS.exe
  C:\Windows\System\FRfeEoS.exe
  2⤵
  PID:7988
- C:\Windows\System\tkYDxTz.exe
  C:\Windows\System\tkYDxTz.exe
  2⤵
  PID:8004
- C:\Windows\System\NFDYuYX.exe
  C:\Windows\System\NFDYuYX.exe
  2⤵
  PID:8020
- C:\Windows\System\drJZcef.exe
  C:\Windows\System\drJZcef.exe
  2⤵
  PID:8036
- C:\Windows\System\NmiTpmo.exe
  C:\Windows\System\NmiTpmo.exe
  2⤵
  PID:8052
- C:\Windows\System\jjrpdCG.exe
  C:\Windows\System\jjrpdCG.exe
  2⤵
  PID:8068
- C:\Windows\System\FvUIuYJ.exe
  C:\Windows\System\FvUIuYJ.exe
  2⤵
  PID:8084
- C:\Windows\System\TLSThKD.exe
  C:\Windows\System\TLSThKD.exe
  2⤵
  PID:8100
- C:\Windows\System\BaosPCE.exe
  C:\Windows\System\BaosPCE.exe
  2⤵
  PID:8116
- C:\Windows\System\AjgSULA.exe
  C:\Windows\System\AjgSULA.exe
  2⤵
  PID:8132
- C:\Windows\System\OiqyeXr.exe
  C:\Windows\System\OiqyeXr.exe
  2⤵
  PID:8148
- C:\Windows\System\uMZSHWW.exe
  C:\Windows\System\uMZSHWW.exe
  2⤵
  PID:8164
- C:\Windows\System\BsXRAPd.exe
  C:\Windows\System\BsXRAPd.exe
  2⤵
  PID:8180
- C:\Windows\System\ObtvrGd.exe
  C:\Windows\System\ObtvrGd.exe
  2⤵
  PID:7180
- C:\Windows\System\JozLSVu.exe
  C:\Windows\System\JozLSVu.exe
  2⤵
  PID:7244
- C:\Windows\System\lxGxSpD.exe
  C:\Windows\System\lxGxSpD.exe
  2⤵
  PID:7304
- C:\Windows\System\ztdCjvZ.exe
  C:\Windows\System\ztdCjvZ.exe
  2⤵
  PID:6020
- C:\Windows\System\uqjtxEb.exe
  C:\Windows\System\uqjtxEb.exe
  2⤵
  PID:6888
- C:\Windows\System\FmLejYi.exe
  C:\Windows\System\FmLejYi.exe
  2⤵
  PID:7192
- C:\Windows\System\tHmbLbi.exe
  C:\Windows\System\tHmbLbi.exe
  2⤵
  PID:7260
- C:\Windows\System\NvzFpKX.exe
  C:\Windows\System\NvzFpKX.exe
  2⤵
  PID:7324
- C:\Windows\System\tnJIbzd.exe
  C:\Windows\System\tnJIbzd.exe
  2⤵
  PID:7404
- C:\Windows\System\rCjMYRw.exe
  C:\Windows\System\rCjMYRw.exe
  2⤵
  PID:7400
- C:\Windows\System\pBzEvBO.exe
  C:\Windows\System\pBzEvBO.exe
  2⤵
  PID:7496
- C:\Windows\System\PHNcNzc.exe
  C:\Windows\System\PHNcNzc.exe
  2⤵
  PID:7356
- C:\Windows\System\oZjpgVJ.exe
  C:\Windows\System\oZjpgVJ.exe
  2⤵
  PID:7596
- C:\Windows\System\SbhgMWF.exe
  C:\Windows\System\SbhgMWF.exe
  2⤵
  PID:7660
- C:\Windows\System\jHFyvPe.exe
  C:\Windows\System\jHFyvPe.exe
  2⤵
  PID:7724
- C:\Windows\System\jFuIayq.exe
  C:\Windows\System\jFuIayq.exe
  2⤵
  PID:7788
- C:\Windows\System\lSPuIHu.exe
  C:\Windows\System\lSPuIHu.exe
  2⤵
  PID:7820
- C:\Windows\System\RAYJVLC.exe
  C:\Windows\System\RAYJVLC.exe
  2⤵
  PID:7416
- C:\Windows\System\TFILZeY.exe
  C:\Windows\System\TFILZeY.exe
  2⤵
  PID:7676
- C:\Windows\System\smWXNem.exe
  C:\Windows\System\smWXNem.exe
  2⤵
  PID:7484
- C:\Windows\System\hKBwVnt.exe
  C:\Windows\System\hKBwVnt.exe
  2⤵
  PID:7576
- C:\Windows\System\tAyefpW.exe
  C:\Windows\System\tAyefpW.exe
  2⤵
  PID:7708
- C:\Windows\System\sgopRlH.exe
  C:\Windows\System\sgopRlH.exe
  2⤵
  PID:7772
- C:\Windows\System\jZdpZdh.exe
  C:\Windows\System\jZdpZdh.exe
  2⤵
  PID:7836
- C:\Windows\System\YjythdF.exe
  C:\Windows\System\YjythdF.exe
  2⤵
  PID:7872
- C:\Windows\System\vimHTsy.exe
  C:\Windows\System\vimHTsy.exe
  2⤵
  PID:7920
- C:\Windows\System\WpeLqVK.exe
  C:\Windows\System\WpeLqVK.exe
  2⤵
  PID:7900
- C:\Windows\System\vWeRWGQ.exe
  C:\Windows\System\vWeRWGQ.exe
  2⤵
  PID:7968
- C:\Windows\System\vbcdAGm.exe
  C:\Windows\System\vbcdAGm.exe
  2⤵
  PID:8044
- C:\Windows\System\LytJsFS.exe
  C:\Windows\System\LytJsFS.exe
  2⤵
  PID:8032
- C:\Windows\System\uLBwKwa.exe
  C:\Windows\System\uLBwKwa.exe
  2⤵
  PID:8108
- C:\Windows\System\ynLptHS.exe
  C:\Windows\System\ynLptHS.exe
  2⤵
  PID:8064
- C:\Windows\System\KAcUuot.exe
  C:\Windows\System\KAcUuot.exe
  2⤵
  PID:8092
- C:\Windows\System\oLbgrep.exe
  C:\Windows\System\oLbgrep.exe
  2⤵
  PID:6192
- C:\Windows\System\ecjdqYA.exe
  C:\Windows\System\ecjdqYA.exe
  2⤵
  PID:7320
- C:\Windows\System\KrPwcgf.exe
  C:\Windows\System\KrPwcgf.exe
  2⤵
  PID:7532
- C:\Windows\System\cXHYLii.exe
  C:\Windows\System\cXHYLii.exe
  2⤵
  PID:8160
- C:\Windows\System\skdUHgl.exe
  C:\Windows\System\skdUHgl.exe
  2⤵
  PID:7852
- C:\Windows\System\bfVMLEZ.exe
  C:\Windows\System\bfVMLEZ.exe
  2⤵
  PID:7608
- C:\Windows\System\DNIqxoA.exe
  C:\Windows\System\DNIqxoA.exe
  2⤵
  PID:7804
- C:\Windows\System\CAYEwhG.exe
  C:\Windows\System\CAYEwhG.exe
  2⤵
  PID:8156
- C:\Windows\System\BHHgyet.exe
  C:\Windows\System\BHHgyet.exe
  2⤵
  PID:7564
- C:\Windows\System\ynisHOC.exe
  C:\Windows\System\ynisHOC.exe
  2⤵
  PID:7224
- C:\Windows\System\DnoWqyI.exe
  C:\Windows\System\DnoWqyI.exe
  2⤵
  PID:7592
- C:\Windows\System\ZIbCDCq.exe
  C:\Windows\System\ZIbCDCq.exe
  2⤵
  PID:7792
- C:\Windows\System\LhTpaxK.exe
  C:\Windows\System\LhTpaxK.exe
  2⤵
  PID:7544
- C:\Windows\System\WzGcPFB.exe
  C:\Windows\System\WzGcPFB.exe
  2⤵
  PID:7868
- C:\Windows\System\DVTReDL.exe
  C:\Windows\System\DVTReDL.exe
  2⤵
  PID:7964
- C:\Windows\System\QAhuymD.exe
  C:\Windows\System\QAhuymD.exe
  2⤵
  PID:8028
- C:\Windows\System\DSdAqmI.exe
  C:\Windows\System\DSdAqmI.exe
  2⤵
  PID:7240
- C:\Windows\System\FUXMSgU.exe
  C:\Windows\System\FUXMSgU.exe
  2⤵
  PID:8016
- C:\Windows\System\umqCceo.exe
  C:\Windows\System\umqCceo.exe
  2⤵
  PID:6228
- C:\Windows\System\cRBoUao.exe
  C:\Windows\System\cRBoUao.exe
  2⤵
  PID:8176
- C:\Windows\System\ZKfBngr.exe
  C:\Windows\System\ZKfBngr.exe
  2⤵
  PID:7632
- C:\Windows\System\eXBJply.exe
  C:\Windows\System\eXBJply.exe
  2⤵
  PID:7884
- C:\Windows\System\NujUpvm.exe
  C:\Windows\System\NujUpvm.exe
  2⤵
  PID:7176
- C:\Windows\System\YfcyNSj.exe
  C:\Windows\System\YfcyNSj.exe
  2⤵
  PID:7388
- C:\Windows\System\LmoRYaJ.exe
  C:\Windows\System\LmoRYaJ.exe
  2⤵
  PID:7984
- C:\Windows\System\rHoETBP.exe
  C:\Windows\System\rHoETBP.exe
  2⤵
  PID:7372
- C:\Windows\System\PoubILO.exe
  C:\Windows\System\PoubILO.exe
  2⤵
  PID:7932
- C:\Windows\System\fzonWEy.exe
  C:\Windows\System\fzonWEy.exe
  2⤵
  PID:7760
- C:\Windows\System\EPHGeDB.exe
  C:\Windows\System\EPHGeDB.exe
  2⤵
  PID:7452
- C:\Windows\System\Kkcmnfe.exe
  C:\Windows\System\Kkcmnfe.exe
  2⤵
  PID:8000
- C:\Windows\System\hjspYiB.exe
  C:\Windows\System\hjspYiB.exe
  2⤵
  PID:7648
- C:\Windows\System\kGcmfwq.exe
  C:\Windows\System\kGcmfwq.exe
  2⤵
  PID:8204
- C:\Windows\System\KNSqkAD.exe
  C:\Windows\System\KNSqkAD.exe
  2⤵
  PID:8220
- C:\Windows\System\fHHUWOh.exe
  C:\Windows\System\fHHUWOh.exe
  2⤵
  PID:8236
- C:\Windows\System\iFGOhBY.exe
  C:\Windows\System\iFGOhBY.exe
  2⤵
  PID:8252
- C:\Windows\System\SrYQyFy.exe
  C:\Windows\System\SrYQyFy.exe
  2⤵
  PID:8268
- C:\Windows\System\tYCpdcF.exe
  C:\Windows\System\tYCpdcF.exe
  2⤵
  PID:8284
- C:\Windows\System\zyqABcV.exe
  C:\Windows\System\zyqABcV.exe
  2⤵
  PID:8304
- C:\Windows\System\fgdNcTr.exe
  C:\Windows\System\fgdNcTr.exe
  2⤵
  PID:8320
- C:\Windows\System\MSDFWDM.exe
  C:\Windows\System\MSDFWDM.exe
  2⤵
  PID:8336
- C:\Windows\System\wXWEqMb.exe
  C:\Windows\System\wXWEqMb.exe
  2⤵
  PID:8352
- C:\Windows\System\ZphcZzK.exe
  C:\Windows\System\ZphcZzK.exe
  2⤵
  PID:8368
- C:\Windows\System\bSvbHgz.exe
  C:\Windows\System\bSvbHgz.exe
  2⤵
  PID:8384
- C:\Windows\System\iMiPTLv.exe
  C:\Windows\System\iMiPTLv.exe
  2⤵
  PID:8400
- C:\Windows\System\iZeveOg.exe
  C:\Windows\System\iZeveOg.exe
  2⤵
  PID:8416
- C:\Windows\System\cjoAWbb.exe
  C:\Windows\System\cjoAWbb.exe
  2⤵
  PID:8432
- C:\Windows\System\pswXYcH.exe
  C:\Windows\System\pswXYcH.exe
  2⤵
  PID:8448
- C:\Windows\System\fPWRhRE.exe
  C:\Windows\System\fPWRhRE.exe
  2⤵
  PID:8464
- C:\Windows\System\TEjRgvL.exe
  C:\Windows\System\TEjRgvL.exe
  2⤵
  PID:8480
- C:\Windows\System\ylSWWvi.exe
  C:\Windows\System\ylSWWvi.exe
  2⤵
  PID:8496
- C:\Windows\System\HJRibrk.exe
  C:\Windows\System\HJRibrk.exe
  2⤵
  PID:8512
- C:\Windows\System\qxtDWsS.exe
  C:\Windows\System\qxtDWsS.exe
  2⤵
  PID:8528
- C:\Windows\System\bPqlrKr.exe
  C:\Windows\System\bPqlrKr.exe
  2⤵
  PID:8544
- C:\Windows\System\QENtmJN.exe
  C:\Windows\System\QENtmJN.exe
  2⤵
  PID:8560
- C:\Windows\System\KJQmoLp.exe
  C:\Windows\System\KJQmoLp.exe
  2⤵
  PID:8580
- C:\Windows\System\DWvIspw.exe
  C:\Windows\System\DWvIspw.exe
  2⤵
  PID:8600
- C:\Windows\System\FrpNDMD.exe
  C:\Windows\System\FrpNDMD.exe
  2⤵
  PID:8620
- C:\Windows\System\IcoXnMf.exe
  C:\Windows\System\IcoXnMf.exe
  2⤵
  PID:8636
- C:\Windows\System\FIWiMtW.exe
  C:\Windows\System\FIWiMtW.exe
  2⤵
  PID:8652
- C:\Windows\System\knwKGwu.exe
  C:\Windows\System\knwKGwu.exe
  2⤵
  PID:8668
- C:\Windows\System\ykkZljc.exe
  C:\Windows\System\ykkZljc.exe
  2⤵
  PID:8684
- C:\Windows\System\LcySNAi.exe
  C:\Windows\System\LcySNAi.exe
  2⤵
  PID:8700
- C:\Windows\System\HDbovJi.exe
  C:\Windows\System\HDbovJi.exe
  2⤵
  PID:8724
- C:\Windows\System\LENNnJi.exe
  C:\Windows\System\LENNnJi.exe
  2⤵
  PID:8740
- C:\Windows\System\wkgvRuU.exe
  C:\Windows\System\wkgvRuU.exe
  2⤵
  PID:8756
- C:\Windows\System\zrrFaXp.exe
  C:\Windows\System\zrrFaXp.exe
  2⤵
  PID:8772
- C:\Windows\System\XhcDkej.exe
  C:\Windows\System\XhcDkej.exe
  2⤵
  PID:8788
- C:\Windows\System\VeMJeVR.exe
  C:\Windows\System\VeMJeVR.exe
  2⤵
  PID:8804
- C:\Windows\System\WkMGjji.exe
  C:\Windows\System\WkMGjji.exe
  2⤵
  PID:8820
- C:\Windows\System\LaKmdyr.exe
  C:\Windows\System\LaKmdyr.exe
  2⤵
  PID:8916
- C:\Windows\System\AqwSsRe.exe
  C:\Windows\System\AqwSsRe.exe
  2⤵
  PID:8932
- C:\Windows\System\HRmJxGC.exe
  C:\Windows\System\HRmJxGC.exe
  2⤵
  PID:8948
- C:\Windows\System\zStGGvd.exe
  C:\Windows\System\zStGGvd.exe
  2⤵
  PID:8964
- C:\Windows\System\wVbTkMH.exe
  C:\Windows\System\wVbTkMH.exe
  2⤵
  PID:8980
- C:\Windows\System\qiQyZRi.exe
  C:\Windows\System\qiQyZRi.exe
  2⤵
  PID:8996
- C:\Windows\System\jHrhqNb.exe
  C:\Windows\System\jHrhqNb.exe
  2⤵
  PID:9012
- C:\Windows\System\WvudgrM.exe
  C:\Windows\System\WvudgrM.exe
  2⤵
  PID:9032
- C:\Windows\System\FkskPsL.exe
  C:\Windows\System\FkskPsL.exe
  2⤵
  PID:9048
- C:\Windows\System\WlYeyfM.exe
  C:\Windows\System\WlYeyfM.exe
  2⤵
  PID:9064
- C:\Windows\System\KVmCJfx.exe
  C:\Windows\System\KVmCJfx.exe
  2⤵
  PID:9080
- C:\Windows\System\riRsYzY.exe
  C:\Windows\System\riRsYzY.exe
  2⤵
  PID:9096
- C:\Windows\System\AcmIMHl.exe
  C:\Windows\System\AcmIMHl.exe
  2⤵
  PID:9112
- C:\Windows\System\HQqgxXn.exe
  C:\Windows\System\HQqgxXn.exe
  2⤵
  PID:9128
- C:\Windows\System\JiwNWqW.exe
  C:\Windows\System\JiwNWqW.exe
  2⤵
  PID:9144
- C:\Windows\System\UkzPyhN.exe
  C:\Windows\System\UkzPyhN.exe
  2⤵
  PID:9164
- C:\Windows\System\lHEVOOC.exe
  C:\Windows\System\lHEVOOC.exe
  2⤵
  PID:8280
- C:\Windows\System\LKTdYGs.exe
  C:\Windows\System\LKTdYGs.exe
  2⤵
  PID:8348
- C:\Windows\System\xoJJqlz.exe
  C:\Windows\System\xoJJqlz.exe
  2⤵
  PID:8440
- C:\Windows\System\OJflGqy.exe
  C:\Windows\System\OJflGqy.exe
  2⤵
  PID:8504
- C:\Windows\System\HgzcaMd.exe
  C:\Windows\System\HgzcaMd.exe
  2⤵
  PID:8568
- C:\Windows\System\JOkdWMb.exe
  C:\Windows\System\JOkdWMb.exe
  2⤵
  PID:8552
- C:\Windows\System\SzCYUGI.exe
  C:\Windows\System\SzCYUGI.exe
  2⤵
  PID:8428
- C:\Windows\System\jlALESi.exe
  C:\Windows\System\jlALESi.exe
  2⤵
  PID:8524
- C:\Windows\System\MrhTHSb.exe
  C:\Windows\System\MrhTHSb.exe
  2⤵
  PID:8300
- C:\Windows\System\jtUukve.exe
  C:\Windows\System\jtUukve.exe
  2⤵
  PID:8424
- C:\Windows\System\JPLvJyK.exe
  C:\Windows\System\JPLvJyK.exe
  2⤵
  PID:7916
- C:\Windows\System\tVYtOMp.exe
  C:\Windows\System\tVYtOMp.exe
  2⤵
  PID:8680
- C:\Windows\System\ATpRLeJ.exe
  C:\Windows\System\ATpRLeJ.exe
  2⤵
  PID:8648
- C:\Windows\System\IxqsZTe.exe
  C:\Windows\System\IxqsZTe.exe
  2⤵
  PID:8632
- C:\Windows\System\ZzUjzfY.exe
  C:\Windows\System\ZzUjzfY.exe
  2⤵
  PID:8696
- C:\Windows\System\gCuqkaP.exe
  C:\Windows\System\gCuqkaP.exe
  2⤵
  PID:8752
- C:\Windows\System\eFopLuJ.exe
  C:\Windows\System\eFopLuJ.exe
  2⤵
  PID:8812
- C:\Windows\System\LcTtqNn.exe
  C:\Windows\System\LcTtqNn.exe
  2⤵
  PID:8796
- C:\Windows\System\DhSohzp.exe
  C:\Windows\System\DhSohzp.exe
  2⤵
  PID:8836
- C:\Windows\System\PbMZTPL.exe
  C:\Windows\System\PbMZTPL.exe
  2⤵
  PID:8852
- C:\Windows\System\ArCmslU.exe
  C:\Windows\System\ArCmslU.exe
  2⤵
  PID:8868
- C:\Windows\System\dKxPDAg.exe
  C:\Windows\System\dKxPDAg.exe
  2⤵
  PID:8572
- C:\Windows\System\nXTKtXa.exe
  C:\Windows\System\nXTKtXa.exe
  2⤵
  PID:8904
- C:\Windows\System\FYDsFFZ.exe
  C:\Windows\System\FYDsFFZ.exe
  2⤵
  PID:9156
- C:\Windows\System\btajQAZ.exe
  C:\Windows\System\btajQAZ.exe
  2⤵
  PID:8972
- C:\Windows\System\YGEqObh.exe
  C:\Windows\System\YGEqObh.exe
  2⤵
  PID:8940
- C:\Windows\System\FwqZNfp.exe
  C:\Windows\System\FwqZNfp.exe
  2⤵
  PID:9076
- C:\Windows\System\enghyAl.exe
  C:\Windows\System\enghyAl.exe
  2⤵
  PID:9172
- C:\Windows\System\AWcjYgT.exe
  C:\Windows\System\AWcjYgT.exe
  2⤵
  PID:9208
- C:\Windows\System\SSJTTUJ.exe
  C:\Windows\System\SSJTTUJ.exe
  2⤵
  PID:9204
- C:\Windows\System\nYwGqLE.exe
  C:\Windows\System\nYwGqLE.exe
  2⤵
  PID:7340
- C:\Windows\System\UjjDgBa.exe
  C:\Windows\System\UjjDgBa.exe
  2⤵
  PID:7436
- C:\Windows\System\xYBiHaL.exe
  C:\Windows\System\xYBiHaL.exe
  2⤵
  PID:8216
- C:\Windows\System\DAhzvuO.exe
  C:\Windows\System\DAhzvuO.exe
  2⤵
  PID:8380
- C:\Windows\System\CyhSUgd.exe
  C:\Windows\System\CyhSUgd.exe
  2⤵
  PID:8476
- C:\Windows\System\JLrMPiL.exe
  C:\Windows\System\JLrMPiL.exe
  2⤵
  PID:8196
- C:\Windows\System\prjuYRL.exe
  C:\Windows\System\prjuYRL.exe
  2⤵
  PID:8392
- C:\Windows\System\rDLoTzu.exe
  C:\Windows\System\rDLoTzu.exe
  2⤵
  PID:8720
- C:\Windows\System\bfwAbLH.exe
  C:\Windows\System\bfwAbLH.exe
  2⤵
  PID:8344
- C:\Windows\System\QmjYYkY.exe
  C:\Windows\System\QmjYYkY.exe
  2⤵
  PID:8768
- C:\Windows\System\NUrsHaI.exe
  C:\Windows\System\NUrsHaI.exe
  2⤵
  PID:8844
- C:\Windows\System\eXHfMgX.exe
  C:\Windows\System\eXHfMgX.exe
  2⤵
  PID:8864
- C:\Windows\System\shfHmcR.exe
  C:\Windows\System\shfHmcR.exe
  2⤵
  PID:8780
- C:\Windows\System\GozWCed.exe
  C:\Windows\System\GozWCed.exe
  2⤵
  PID:7336
- C:\Windows\System\okXwUpI.exe
  C:\Windows\System\okXwUpI.exe
  2⤵
  PID:8828
- C:\Windows\System\LwlBLPy.exe
  C:\Windows\System\LwlBLPy.exe
  2⤵
  PID:8876
- C:\Windows\System\NIgykuw.exe
  C:\Windows\System\NIgykuw.exe
  2⤵
  PID:8908
- C:\Windows\System\rVQyVSh.exe
  C:\Windows\System\rVQyVSh.exe
  2⤵
  PID:8960
- C:\Windows\System\FkavfYp.exe
  C:\Windows\System\FkavfYp.exe
  2⤵
  PID:9024
- C:\Windows\System\zKzaGMZ.exe
  C:\Windows\System\zKzaGMZ.exe
  2⤵
  PID:9092
- C:\Windows\System\vDlrANV.exe
  C:\Windows\System\vDlrANV.exe
  2⤵
  PID:9040
- C:\Windows\System\nUOklxN.exe
  C:\Windows\System\nUOklxN.exe
  2⤵
  PID:9120
- C:\Windows\System\VReNyVC.exe
  C:\Windows\System\VReNyVC.exe
  2⤵
  PID:9108
- C:\Windows\System\FbVIqeD.exe
  C:\Windows\System\FbVIqeD.exe
  2⤵
  PID:8316
- C:\Windows\System\SxGbBNI.exe
  C:\Windows\System\SxGbBNI.exe
  2⤵
  PID:8172
- C:\Windows\System\RjRvkHt.exe
  C:\Windows\System\RjRvkHt.exe
  2⤵
  PID:8492
- C:\Windows\System\QAJVPgF.exe
  C:\Windows\System\QAJVPgF.exe
  2⤵
  PID:9200
- C:\Windows\System\GhUnehO.exe
  C:\Windows\System\GhUnehO.exe
  2⤵
  PID:8732
- C:\Windows\System\okYUlyt.exe
  C:\Windows\System\okYUlyt.exe
  2⤵
  PID:8540
- C:\Windows\System\ZEAceps.exe
  C:\Windows\System\ZEAceps.exe
  2⤵
  PID:8892
- C:\Windows\System\yejyjJt.exe
  C:\Windows\System\yejyjJt.exe
  2⤵
  PID:8888
- C:\Windows\System\gYOQoLm.exe
  C:\Windows\System\gYOQoLm.exe
  2⤵
  PID:8612
- C:\Windows\System\UeWyFnM.exe
  C:\Windows\System\UeWyFnM.exe
  2⤵
  PID:8992
- C:\Windows\System\frlEKwe.exe
  C:\Windows\System\frlEKwe.exe
  2⤵
  PID:8060
- C:\Windows\System\xilCDPD.exe
  C:\Windows\System\xilCDPD.exe
  2⤵
  PID:9020
- C:\Windows\System\CdFCbGL.exe
  C:\Windows\System\CdFCbGL.exe
  2⤵
  PID:8276
- C:\Windows\System\BXXFFQC.exe
  C:\Windows\System\BXXFFQC.exe
  2⤵
  PID:8364
- C:\Windows\System\TDpRjSD.exe
  C:\Windows\System\TDpRjSD.exe
  2⤵
  PID:9056
- C:\Windows\System\WiSlKJO.exe
  C:\Windows\System\WiSlKJO.exe
  2⤵
  PID:8748
- C:\Windows\System\nevILTC.exe
  C:\Windows\System\nevILTC.exe
  2⤵
  PID:9008
- C:\Windows\System\smrNNeP.exe
  C:\Windows\System\smrNNeP.exe
  2⤵
  PID:1496
- C:\Windows\System\YUBLIMm.exe
  C:\Windows\System\YUBLIMm.exe
  2⤵
  PID:8900
- C:\Windows\System\zVIDzWU.exe
  C:\Windows\System\zVIDzWU.exe
  2⤵
  PID:8248
- C:\Windows\System\DOrrANX.exe
  C:\Windows\System\DOrrANX.exe
  2⤵
  PID:8472
- C:\Windows\System\pJXjMvV.exe
  C:\Windows\System\pJXjMvV.exe
  2⤵
  PID:9224
- C:\Windows\System\WUgYvZz.exe
  C:\Windows\System\WUgYvZz.exe
  2⤵
  PID:9276
- C:\Windows\System\NQUlpGf.exe
  C:\Windows\System\NQUlpGf.exe
  2⤵
  PID:9296
- C:\Windows\System\bTQFWIy.exe
  C:\Windows\System\bTQFWIy.exe
  2⤵
  PID:9312
- C:\Windows\System\BnrqDGE.exe
  C:\Windows\System\BnrqDGE.exe
  2⤵
  PID:9328
- C:\Windows\System\DNfRpMY.exe
  C:\Windows\System\DNfRpMY.exe
  2⤵
  PID:9348
- C:\Windows\System\qiIXdVS.exe
  C:\Windows\System\qiIXdVS.exe
  2⤵
  PID:9472
- C:\Windows\System\VwbJgZw.exe
  C:\Windows\System\VwbJgZw.exe
  2⤵
  PID:9492
- C:\Windows\System\hylZfuG.exe
  C:\Windows\System\hylZfuG.exe
  2⤵
  PID:9512
- C:\Windows\System\HHoVIUX.exe
  C:\Windows\System\HHoVIUX.exe
  2⤵
  PID:9528
- C:\Windows\System\rBhuClF.exe
  C:\Windows\System\rBhuClF.exe
  2⤵
  PID:9544
- C:\Windows\System\AnQOdnt.exe
  C:\Windows\System\AnQOdnt.exe
  2⤵
  PID:9560
- C:\Windows\System\lskYcTd.exe
  C:\Windows\System\lskYcTd.exe
  2⤵
  PID:9576
- C:\Windows\System\YsZPtHR.exe
  C:\Windows\System\YsZPtHR.exe
  2⤵
  PID:9592
- C:\Windows\System\EDGteOY.exe
  C:\Windows\System\EDGteOY.exe
  2⤵
  PID:9608
- C:\Windows\System\NfoFDHj.exe
  C:\Windows\System\NfoFDHj.exe
  2⤵
  PID:9624
- C:\Windows\System\GseUKvQ.exe
  C:\Windows\System\GseUKvQ.exe
  2⤵
  PID:9640
- C:\Windows\System\CRUVAPE.exe
  C:\Windows\System\CRUVAPE.exe
  2⤵
  PID:9656
- C:\Windows\System\WYbWILi.exe
  C:\Windows\System\WYbWILi.exe
  2⤵
  PID:9672
- C:\Windows\System\wElOJPR.exe
  C:\Windows\System\wElOJPR.exe
  2⤵
  PID:9688
- C:\Windows\System\XBiZSuz.exe
  C:\Windows\System\XBiZSuz.exe
  2⤵
  PID:9704
- C:\Windows\System\ZNBnrkU.exe
  C:\Windows\System\ZNBnrkU.exe
  2⤵
  PID:9720
- C:\Windows\System\ASTuLwW.exe
  C:\Windows\System\ASTuLwW.exe
  2⤵
  PID:9736
- C:\Windows\System\tftFKeH.exe
  C:\Windows\System\tftFKeH.exe
  2⤵
  PID:9752
- C:\Windows\System\wrcGGpF.exe
  C:\Windows\System\wrcGGpF.exe
  2⤵
  PID:9768
- C:\Windows\System\DDIGelZ.exe
  C:\Windows\System\DDIGelZ.exe
  2⤵
  PID:9784
- C:\Windows\System\SAvKEbl.exe
  C:\Windows\System\SAvKEbl.exe
  2⤵
  PID:9808
- C:\Windows\System\YMcsVwB.exe
  C:\Windows\System\YMcsVwB.exe
  2⤵
  PID:9832
- C:\Windows\System\XVSdsnR.exe
  C:\Windows\System\XVSdsnR.exe
  2⤵
  PID:9864
- C:\Windows\System\NaDgoMP.exe
  C:\Windows\System\NaDgoMP.exe
  2⤵
  PID:9880
- C:\Windows\System\BAafxsl.exe
  C:\Windows\System\BAafxsl.exe
  2⤵
  PID:9896
- C:\Windows\System\bSYausJ.exe
  C:\Windows\System\bSYausJ.exe
  2⤵
  PID:9912
- C:\Windows\System\cXBvifD.exe
  C:\Windows\System\cXBvifD.exe
  2⤵
  PID:9928
- C:\Windows\System\hTkRPoR.exe
  C:\Windows\System\hTkRPoR.exe
  2⤵
  PID:9944
- C:\Windows\System\JBQljme.exe
  C:\Windows\System\JBQljme.exe
  2⤵
  PID:9960
- C:\Windows\System\jEzITov.exe
  C:\Windows\System\jEzITov.exe
  2⤵
  PID:9976
- C:\Windows\System\ptifegE.exe
  C:\Windows\System\ptifegE.exe
  2⤵
  PID:9992
- C:\Windows\System\UXFYJDr.exe
  C:\Windows\System\UXFYJDr.exe
  2⤵
  PID:10008
- C:\Windows\System\dJgkUDQ.exe
  C:\Windows\System\dJgkUDQ.exe
  2⤵
  PID:10024
- C:\Windows\System\sREDbIU.exe
  C:\Windows\System\sREDbIU.exe
  2⤵
  PID:10040
- C:\Windows\System\PCVnIQP.exe
  C:\Windows\System\PCVnIQP.exe
  2⤵
  PID:10056
- C:\Windows\System\AplzAkJ.exe
  C:\Windows\System\AplzAkJ.exe
  2⤵
  PID:10072
- C:\Windows\System\mWkkClQ.exe
  C:\Windows\System\mWkkClQ.exe
  2⤵
  PID:10092
- C:\Windows\System\TIfQhrG.exe
  C:\Windows\System\TIfQhrG.exe
  2⤵
  PID:10108
- C:\Windows\System\naQljCO.exe
  C:\Windows\System\naQljCO.exe
  2⤵
  PID:10124
- C:\Windows\System\ccZrdPc.exe
  C:\Windows\System\ccZrdPc.exe
  2⤵
  PID:10140
- C:\Windows\System\KXhVrMw.exe
  C:\Windows\System\KXhVrMw.exe
  2⤵
  PID:10156
- C:\Windows\System\sfLAxvx.exe
  C:\Windows\System\sfLAxvx.exe
  2⤵
  PID:10172
- C:\Windows\System\pkbjDAP.exe
  C:\Windows\System\pkbjDAP.exe
  2⤵
  PID:10188
- C:\Windows\System\hOtEsQd.exe
  C:\Windows\System\hOtEsQd.exe
  2⤵
  PID:10204
- C:\Windows\System\PhwjoeQ.exe
  C:\Windows\System\PhwjoeQ.exe
  2⤵
  PID:10220
- C:\Windows\System\wIbCpaz.exe
  C:\Windows\System\wIbCpaz.exe
  2⤵
  PID:10236
- C:\Windows\System\sFrjSBX.exe
  C:\Windows\System\sFrjSBX.exe
  2⤵
  PID:8332
- C:\Windows\System\urbvkGO.exe
  C:\Windows\System\urbvkGO.exe
  2⤵
  PID:6660
- C:\Windows\System\fIgKrqU.exe
  C:\Windows\System\fIgKrqU.exe
  2⤵
  PID:9240
- C:\Windows\System\XGHPdTK.exe
  C:\Windows\System\XGHPdTK.exe
  2⤵
  PID:9264
- C:\Windows\System\tGuAiFj.exe
  C:\Windows\System\tGuAiFj.exe
  2⤵
  PID:9308
- C:\Windows\System\OzBCgEl.exe
  C:\Windows\System\OzBCgEl.exe
  2⤵
  PID:9344
- C:\Windows\System\NBKthCe.exe
  C:\Windows\System\NBKthCe.exe
  2⤵
  PID:9356
- C:\Windows\System\QPnVlWV.exe
  C:\Windows\System\QPnVlWV.exe
  2⤵
  PID:9364
- C:\Windows\System\DEWPimv.exe
  C:\Windows\System\DEWPimv.exe
  2⤵
  PID:9376
- C:\Windows\System\awjxVKE.exe
  C:\Windows\System\awjxVKE.exe
  2⤵
  PID:9396
- C:\Windows\System\wmLYvjS.exe
  C:\Windows\System\wmLYvjS.exe
  2⤵
  PID:9412
- C:\Windows\System\QrEQPnZ.exe
  C:\Windows\System\QrEQPnZ.exe
  2⤵
  PID:9428
- C:\Windows\System\NgEoWzn.exe
  C:\Windows\System\NgEoWzn.exe
  2⤵
  PID:9444
- C:\Windows\System\UvbvbUW.exe
  C:\Windows\System\UvbvbUW.exe
  2⤵
  PID:9464
- C:\Windows\System\JGrzGpE.exe
  C:\Windows\System\JGrzGpE.exe
  2⤵
  PID:9480
- C:\Windows\System\JCqTBEd.exe
  C:\Windows\System\JCqTBEd.exe
  2⤵
  PID:9552
- C:\Windows\System\mukGGjA.exe
  C:\Windows\System\mukGGjA.exe
  2⤵
  PID:9620
- C:\Windows\System\OewPjyr.exe
  C:\Windows\System\OewPjyr.exe
  2⤵
  PID:9684
- C:\Windows\System\QDMEeJU.exe
  C:\Windows\System\QDMEeJU.exe
  2⤵
  PID:9744
- C:\Windows\System\MKKmRRm.exe
  C:\Windows\System\MKKmRRm.exe
  2⤵
  PID:9816
- C:\Windows\System\PAhZupJ.exe
  C:\Windows\System\PAhZupJ.exe
  2⤵
  PID:9604
- C:\Windows\System\ZZetZWM.exe
  C:\Windows\System\ZZetZWM.exe
  2⤵
  PID:9728
- C:\Windows\System\yoApIQA.exe
  C:\Windows\System\yoApIQA.exe
  2⤵
  PID:9796
- C:\Windows\System\aGcLQWU.exe
  C:\Windows\System\aGcLQWU.exe
  2⤵
  PID:9508
- C:\Windows\System\ctPryth.exe
  C:\Windows\System\ctPryth.exe
  2⤵
  PID:9572
- C:\Windows\System\CSrsMYY.exe
  C:\Windows\System\CSrsMYY.exe
  2⤵
  PID:9760
- C:\Windows\System\ekBUHKX.exe
  C:\Windows\System\ekBUHKX.exe
  2⤵
  PID:9820
- C:\Windows\System\YLBoUMi.exe
  C:\Windows\System\YLBoUMi.exe
  2⤵
  PID:9888
- C:\Windows\System\HwHdUHG.exe
  C:\Windows\System\HwHdUHG.exe
  2⤵
  PID:9904
- C:\Windows\System\hvvZuXL.exe
  C:\Windows\System\hvvZuXL.exe
  2⤵
  PID:9968
- C:\Windows\System\HEWIumA.exe
  C:\Windows\System\HEWIumA.exe
  2⤵
  PID:9988
- C:\Windows\System\qbaPYeo.exe
  C:\Windows\System\qbaPYeo.exe
  2⤵
  PID:9380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ADOiLmE.exe

Filesize
1.9MB

MD5
5f9f98a464d633326f665f4de0e0b304

SHA1
f0b65c0e99f7d2b3c4ef8d4a33eb8b6375cd9230

SHA256
b283318831f9db6e5485c01585b7efd5e01439d63416d785bfd6dfc181079ce8

SHA512
a6fe7f260e4df2d30c112c8d156c2e40abc5e8712abbef0841a1323883599a6c8769837d61fdfca96201b1ddde45b808350e36c0ea5afce509ebb9ab84d8f842

Download Submit
C:\Windows\system\JfdSutU.exe

Filesize
1.9MB

MD5
832a9e02c85efbc567f3c5d74ed8e0d2

SHA1
6c19a86c2e79c33240dc39c4dc13797726101166

SHA256
05ef746c705ea049c9a289d97708131b0e46112b5a319d3351dc0be6a6996379

SHA512
be704c5c2c7364e3602641d20a75190c9608166ec3e1a67ee8c88aab5921565ff52de21ceed359efd78cb9aecc760f7845b50c743ac56d223f5415d715da4b35

Download Submit
C:\Windows\system\KEJlgyj.exe

Filesize
1.9MB

MD5
224b2bef5151dbc0d6b96155a78a5290

SHA1
a485e89a24cd2802849f270de96744ea37b88f49

SHA256
8d55ef66c000737d3e2e1d479767928359e79fffc4e2b87c6159ceaf04511acb

SHA512
a6bdfb8cc64b51c3354ea39f00250e8359e090cbf339de504f9df9735b4cae57993d1e5f736651d6d1cccf520a9f7cb7400d4b522518e846648217843c43047f

Download Submit
C:\Windows\system\MypSfKl.exe

Filesize
1.9MB

MD5
b93a14f0218807f70ffb4b28ec2c6863

SHA1
528806413b7174af1a555a41191d5e49c85d57f6

SHA256
189959bf3fcc4b5559c28d29f9d0280f856810c3de487f89bcf34cbe9e4854af

SHA512
736140a80ebde30c94b31020608b60a11d743e46abdf1389eeed343af8bdf6236bc8b7982e51542c5eb0a507b26f91b9c115c2bb290d064f1ef92f536783f946

Download Submit
C:\Windows\system\NWgcIjR.exe

Filesize
1.9MB

MD5
3754506bbd6b0c7a6b6b0bba982101a4

SHA1
1855c42172e1d58c19377af1fea98e7c69021c7a

SHA256
71178d117d5ecb22caa9ee1e81378a7ce3d0f68178ed4284f9fc63028cbf4b4b

SHA512
c74766d34b486eae708696afb19830e65985e3d923fc34569af1e9382ed10863948c30324a22a230d8a1419cb6078d7b8266a89e4f2c353ad11e08a09823f79b

Download Submit
C:\Windows\system\OBwhuaN.exe

Filesize
1.9MB

MD5
e75ce9587913f308787079b57f842aa2

SHA1
e6c354ab1953fe48e4cc39f45b01f77b7fb1c127

SHA256
8091533e421d78b100fa144c7d19de53805c990d7d5d2e4fb726f177f1df6d31

SHA512
1dda63fc95c4b4f90d80a86e414e47ca3b135f05db7398f3988a50c8ef7a02a48e8a0cc763215fe5e90c90774593096610be8f3b78c5ade20ca6692c48ae52fa

Download Submit
C:\Windows\system\QfqNRXr.exe

Filesize
1.9MB

MD5
5b31b661ec14ea19bf83f38c89e97dfc

SHA1
6fd4b2320465616928c4ff5a644fafcd66a098a2

SHA256
bd0a5b13deb1fc549a973d9ecd7c17b15d4e6f33620868ec023f05bf6f2c0883

SHA512
d6d9ea0069dd88b474ffd8dcc1a883fb4a63b8ac78020fb9a0e5446bbc3e6953964e77c821a539bbdb555cdaabf578ec14e817fe9fbb40c393258fe8d99cae4f

Download Submit
C:\Windows\system\QuzvUKW.exe

Filesize
1.9MB

MD5
53ec0d242a959535252ebefe9e34458b

SHA1
de079bab52de3bb4de47662b9b4e6672ab5063ef

SHA256
143cf0da13009bfaa21de809e716d17c0ecdf1bd54614cb0f0f24e7bd0893b2d

SHA512
dce053d576592ccc393bf00e3ddabb874df1ac47417e0fe0bfc82e5462225224290e9c42c921b7dce47bfff07f88b1c6d2e10f53613c1c2b2863658f596ea728

Download Submit
C:\Windows\system\UkyZvqR.exe

Filesize
1.9MB

MD5
7fde0a7675270558fa1b540aa42a79eb

SHA1
4d33a5056e3b11c7091ca8a896e85bb683fe0d5f

SHA256
c7bbddb30bf6f84a320e5ecb8ee13e17181f1a414a9c17b7bf12b725ee9cb23b

SHA512
81b3b25ace79b02493263bc5c8608db5d9383151f6cbd4526b39e9cfe0671be70a403e7d71e1551234240bfb940bd0ada4389f2ae5fa94ce07bbe63b1d091299

Download Submit
C:\Windows\system\VrOIQRx.exe

Filesize
1.9MB

MD5
437fa37b3103a16aabb085dc0bd206e4

SHA1
a8302d05a90c8b91dee6d90a43d96f0c9d388ddc

SHA256
734df6967c8095561b8350b261dd840c2d628f5ce9b0fca7b57c8317fa3fdc49

SHA512
b08be382c2775efdc64f29c14a73612f6e9a28c6d21f28ceca88aff6f7d333921adcde79f536397e91814df6655414c7e769ddcf87ab7581e0015cc7254f5fb6

Download Submit
C:\Windows\system\YdqnOzC.exe

Filesize
1.9MB

MD5
3f2cb5081ed4afc1eece01a5e5d4607a

SHA1
661edaaa973822e7ff5c8b4e9f3d01fd0d2c760a

SHA256
71090649e186cf2fcce4d6a1a6a4f13b47a675604bfdb3910c54ec6a786e5223

SHA512
e763fff7d07178ee0977b08b49595faaeb9cfc083774ca889498c7bceed9190713765989e2bda633886925add3fc2435a815754713d20d9026d11c2ea2e9e217

Download Submit
C:\Windows\system\ccTpwxj.exe

Filesize
1.9MB

MD5
592692600ced7fcb88936b2e7c5446f7

SHA1
ab6f901f8942c67dcf909c332c870f30e8be4702

SHA256
8036b8ab102d35c8b30bf7b407f1108187106392cc9925f32d9555043c64a302

SHA512
258309e2575a6a8e52500d994c9a5b3873638178c47e88b84e08af0f2852bca97a30a638accf7c22c82d1274dd2254184b2e2da135ac0665c22306d58f8880c9

Download Submit
C:\Windows\system\htPHHpW.exe

Filesize
1.9MB

MD5
dc56e111a2c576c3074e7b5f96301041

SHA1
b30c3c60cbcd226f9ede54977c5255a9074e7a24

SHA256
89d0d697c5e1b6f180eb1ba7f300d6b4ef6a43185fe8ab848859ccd9d2798c9e

SHA512
c18c7e6da3df460c31411a1d59b8fd27b3281d00d84cfb9d234632fdae82407fa10c1c8851c6efd7de4113d4a4b60dc470ebc89b0c6bd1028a85c119ae8167e3

Download Submit
C:\Windows\system\jobXMSI.exe

Filesize
1.9MB

MD5
dbd2f75830c4623a564c36dadacbf083

SHA1
8ce14e59355802f7f86efd555e8cc0ca977bd0d5

SHA256
eec5142051c41d870eb392a69e9f9308bff391480d1ef7d71545f6e07acdab18

SHA512
4ceafcb3a3d1f7a0799c5596f12ed7e541e5abd098683928050db831b832b2a10e87830a2ea42054cdbd0931e033ae58201ac9eb7b26e0bf83c5cd9303aae70e

Download Submit
C:\Windows\system\kAwpBYn.exe

Filesize
1.9MB

MD5
441a33f289611ed9bc728c54d5e8b2ef

SHA1
4294d6179be02f92488a5084c4eaf555b478d4b4

SHA256
9305af72751b16d0989ec226ea66cbff94d1a85cb9585f044a1c707340daa3a1

SHA512
7ae74b3060942cf1e179e19bfa2b296c4f30d0366cee6817eddaf696ea2f8a6d3c5cb2c801c32ce744d711d57e7930a7f85db8d7f2ef93ee303e686743fb26f3

Download Submit
C:\Windows\system\nuTxflk.exe

Filesize
1.9MB

MD5
b5faa39fc085a6bc5f1fc610bdb01bed

SHA1
7a222aeeaa5bdfd11c1e223529205962c60a3591

SHA256
61274eff0434e0810a8bdb0071a462a2985a55cb2ced671aaf0d310d91f2c7d2

SHA512
d193075ce2b4cd061603b05767b3264277a0fe261251b0f98b701f294a3679eb8fa3a6700721748ad0a7cfc85c8ef0ed202f23b6b15916bceee58b03103debf2

Download Submit
C:\Windows\system\oflxYQY.exe

Filesize
1.9MB

MD5
665e9975c14d4e5b4c888c6994a0205e

SHA1
505e6b32dd5f206f638af5f2437aa0c3d7b5008e

SHA256
e45eccd1378101bdcc7fd837f94a3fa2fffc9cf3a6bfe58dde522325a73efdd8

SHA512
3176bb5827130845a5ad23146896bdc43eba55ff6f9920d6df13423835ccda5f0237c5813703bc112aea809d5f42755fe867eb3ac21d0e75b3d884c42422c004

Download Submit
C:\Windows\system\orCoUaw.exe

Filesize
1.9MB

MD5
1eb132acd2fd0906e4312a50c3078015

SHA1
5328d60be6278d36d3edd0fa4d74fa18622de77c

SHA256
53ec81b01f2daeca758103500d93b7a9e0c7933f77eb880f756c79271cdcc7f3

SHA512
c1067a46a6de2bf975016e022c6a82375ab24aa338cc0657f4827b52da58c61a27e915baf0cabd69bb34103fc1fecab90a9e7b66deb231aa063db846c0fd2128

Download Submit
C:\Windows\system\qKKOcAY.exe

Filesize
1.9MB

MD5
78b7b22b3c63913c18b89dfa129d0c12

SHA1
6e1ee7cb3b8e02f97884436425f801369735f34a

SHA256
63fe70f0c176d388d3b456bb1e0a1939a83bb6e7d693d862a510d80f14349761

SHA512
5f8a1a9a69c449ba8fdf5586076b6d1be0b8d7849b3722756fe5f6dcb0b6d78ec3621f692cfd1f767bf9c2c26461340b85894333ee5e5a94bafee77156b9bea6

Download Submit
C:\Windows\system\siEaMrC.exe

Filesize
1.9MB

MD5
f04ac75e20d4612e00acd886355efd3a

SHA1
207f1172342c5ec0b5fb3e7736ebd4d3e44e8985

SHA256
47c4df2556bc54d00cabb87585720643a54fadb4b53df5a1f989702e777e62cf

SHA512
1bdb77c2f59077cedaf02c257170b83a8361413459b09983b65f3acb16fc75aa89098db83ff831bd78446e55e9f6608cb3fd323c7ab8ade36d75a5b3fed3391b

Download Submit
C:\Windows\system\swIBaAh.exe

Filesize
1.9MB

MD5
34f620840920392fc88e5118495de127

SHA1
6536314da5e697008a1583184551e878bd4bd693

SHA256
6d56599767502a035f34c1be60adbee16827afe985c34551bcbe3a3317385e18

SHA512
554a42fb9545eb1cdd2c1094083a69b6be639af79a67e13c6fa62b51b140a10b6418cdb5367344c4ec748d3e83b2b3b47cb763f093b5bb9ad15ef55f2fa911ce

Download Submit
C:\Windows\system\virnFPt.exe

Filesize
1.9MB

MD5
42b6627d51e8d4bddbb153c0aa56270c

SHA1
d50d0f22956fe70309d3c868f47db435743cec99

SHA256
ed946519165e8f73b67eb9089bc9d6aae828168a507b1fb05e20664d531eca92

SHA512
a8a4f096e2bc8da6443bfe5e9eb67c38fdaa0c3bcbed1ae233ac8a1fd3366f739d481387ec022124a07543633cbf3cfc93723166b2c9eda9dcdadcedf978c365

Download Submit
C:\Windows\system\wdEbSOb.exe

Filesize
1.9MB

MD5
cea0a799cee4e2397ebcc3b0aea239d6

SHA1
8a3715ec8dadd41570050d07026bfedaf4b276e6

SHA256
ae7c51e3fff85f9664f0380b84e45a5c12c56fc3df7010641426026efa1194f9

SHA512
139d03290b86819ef2f4daf9b9185243d6451aa883d64092b2cce2287bd0335e13d2d2de67f539d86c65fd294b1af90d58f79c46a97e34266a577942328cb02a

Download Submit
\Windows\system\AglZNun.exe

Filesize
1.9MB

MD5
a1ac721cbbffb64d7b38a3fc76b44fdd

SHA1
643b260042f9f063cb9db6580e89f1ecdc8e265e

SHA256
0d777761dc83a06fb5ac0dbde1fb05fa5556f054893ba5dc3d83344b6aedac27

SHA512
bd74f19e24c55162ada0c4cac2c2098cee07f10417c7d4dc8d7d41a88f627b80eb0b7b25e3b2d9176457d436e4f08b21be1615ae7ee4b04707122d550ebd6b03

Download Submit
\Windows\system\AlbSkrk.exe

Filesize
1.9MB

MD5
e16450e86ffb8ad111098b785daf1fa4

SHA1
89b62d299893a8f8288410d69cd9114ef4a37bd1

SHA256
14a8192f43a33ae42ef52f4c2075cf5e6ee67d8117db7aecbe60d312dc183166

SHA512
0cd0e044560f6cd098ced371baaf4358a83f4f095ac65fdedd667bea22a0dbd7331e791151f2ed8c0685981f91d96d2fc017955cdc104ed8186a245452dbc8a7

Download Submit
\Windows\system\CbIvGqA.exe

Filesize
1.9MB

MD5
844f23e15ce6d37a3ff05b9331795529

SHA1
f17d9a77223dfd7b80c674976af5eb43dc7ece7a

SHA256
57bf57ab3f617bb1f00f5c0bde37eaa47dcdc506f8a8a346f4b46dbe838cbd64

SHA512
bba0dd13b71b2540d3d17376bda4936d0d14c57a121c9e8a920dabff27f3954418a61ad352c12a9be25574b17061b801b35bf93e631acaec622729443c98b559

Download Submit
\Windows\system\HiitWCF.exe

Filesize
1.9MB

MD5
8d454c5f86c41e43c81672a76b62da3b

SHA1
5c5264b9d9e7d4e4a467530bd7b4796b5a426f51

SHA256
bbc2c05d4ba0ddaf890e3b2489c56d65ba6497ae944d49a60321540c92a01c47

SHA512
5c1735351452f5dfcb68c14ba1fe546d7978435aa50b151c4deb75d98d1a2921d6718774554330fe2e44390ef916dd6f3729518722318cd7e9b055071f628a2d

Download Submit
\Windows\system\KKkDrji.exe

Filesize
1.9MB

MD5
396313b9b430eeb62677f404460d4e43

SHA1
cd0b1f9a82f7cd168d1c68085f6e2de46f9231a8

SHA256
ee36a8ab9039fee17a2c101add98d704d0f3ef3a16450cee1c9c2ee55612ddea

SHA512
00731a3b2f29c81354bca7de167dbfb0146f2f93aa9457ba6a496421b3494afba3a592baf21c59ca3b15f47b39ccce661e5d24a9fa00d1b027c3de80def21743

Download Submit
\Windows\system\KrBfass.exe

Filesize
1.9MB

MD5
1b7743cd2d78c9228938e7825e39152f

SHA1
f583801dcb822a1406ae37c7042cfe6b36890ad0

SHA256
e1834f5b878058ebfd3c1a4321e02e1bfae0901f8300296d5697dd6c3297cd9a

SHA512
512dbb6669033658c794b1fdf8de703ff91b2d0afb3888a588bdb35c5c60bdb3e909787f2b8748e54c06b4073dd3e96e0834b250a5787de1754a67fb594a5d15

Download Submit
\Windows\system\QQeybiY.exe

Filesize
1.9MB

MD5
1dcd2087053206c330345aa377dc1400

SHA1
4f863f125bdb70e4a329bb74bc467e93110b5db6

SHA256
c7d6506e043ff9fbf0ac1d7c778266e9f47a7d1a7bc8b1079b3d6f2e1f649020

SHA512
5f51d2a47a9411749df485fa21a0a80b526e44ceb025f0cf629a04abb271ec3ca45bd5358d1f2f1d6e397ba3f28e05b9b37e67f685ac94462d3d545ab5e2555a

Download Submit
\Windows\system\TzrEewW.exe

Filesize
1.9MB

MD5
0bdfac48ebfb44ba996078cd8304fe33

SHA1
132e9e08285430affed5af22bc15e668f6741700

SHA256
8c7f6cbc462473d9efb4a5bdde5ebb64d4c38ceff17228e0c68ef053c93bbdec

SHA512
c3a42d5addd057078053f6871a55fcca6f01532b63e82282ca15002a276aadd79df7bbba8a48984f2493218866f2c9a2c51654ee02678d89ad90cf5d9f79c7b9

Download Submit
\Windows\system\UVJWuTp.exe

Filesize
1.9MB

MD5
78ccaefbe37d431dca7520b262c23c53

SHA1
ffd241dba5d43bed77f24a76ff0195d12e5f2cdd

SHA256
4d335e99b7e8c1080bf0cb5127ca8c92f74c06eeae7a4fe8341d8c2d37fa7b0e

SHA512
53193c1ee3a3c9f9c5ecc951bc23e2c7e37869e30259851788176f64dd32778836eb46e670c5844894ff59955c9a6713e8e19cf486a5a8393e8fd32033c3a624

Download Submit
\Windows\system\VfzmliP.exe

Filesize
1.9MB

MD5
9ed80b522df42d3b4032e08020c91129

SHA1
6065f6adb2351d34668a1a9c8a066c44c008a970

SHA256
4442fc6321fc8841a8b96d10a1a581152ca73ac11f9b1405d39ad2a749d053bf

SHA512
9a62a6aa06f0a1784c85123629e307a5e079c3e46ed17d634a16f4ab3215f5381c143ec03300930c64017a1ad28a8c9cd78b58bf978e1c34fd42ce34c567d4d3

Download Submit
\Windows\system\hBaDCBF.exe

Filesize
1.9MB

MD5
c6fbdcf85e29f8b472200f33c5ee8c80

SHA1
d62d153ba286e6f101fb8c8f53ca93f0fd07ffda

SHA256
5b3e480931014a5d520dd6d7f1ab48382157e2b3f27ca99ffdeffd196e89e7d1

SHA512
3aa9dafefc41a05153c40754b14fa1107c01465397cd356132ca9c394e5e5a6274336721d6416ed6cb133518f396c4ec998d850e18525d09601ec4ce7087fa8b

Download Submit
\Windows\system\hPpdgvH.exe

Filesize
1.9MB

MD5
d97ff7a8c462cbfbb7d737d6ac554769

SHA1
d37fed906d19a2b7f7f6085e9226ed6a4bf7e264

SHA256
9b60f6267bb400306e4531f848cc25443fb9f2db4da22c247669db250a373176

SHA512
705b023749550e1688f1ccddbded0060c02ab6f5dd991468c26d494b6060fca1cdb8920b2d5c2efe7e0aabc6985e7164d9fbcce8fe291e9ef93d9372553738fc

Download Submit
\Windows\system\mHSgzaL.exe

Filesize
1.9MB

MD5
c98d2492dcb6c4d598c20bcd06c104ac

SHA1
9ebcef9a1e97c74edb1891c46c989f6f653567e3

SHA256
522ebc676137cbf4b82c9a2ece003c00949c7ec6b31dbb3dd18b88f70f748460

SHA512
9a0a8f2502ea8b774370f71e1c853ade4c7c19caa999d7e58aea42e11fd57c645da84849ccdc0bf95172c6a9b8b03d7d7ceba39772761f5a3a8004f8d43d2ccb

Download Submit
\Windows\system\unudkde.exe

Filesize
1.9MB

MD5
3ccc4f9323b9ba6e33ce2881cf202cdd

SHA1
9504890e0ca04cc151e03c10b8162f6db6de7b29

SHA256
e72f54027d3ac19cf3bfb3a262a2fb8efac277a9bfbafe84a587809e700fa40e

SHA512
31fc7fa479c8bcd005a8ad8816b5e7f92bd41276ba28574d04b409a16251caa03104e80965cf7181b62a9c8e26b99745a46482fda31aac058be300d19562b289

Download Submit
memory/2044-21-0x0000000002BA0000-0x0000000002C20000-memory.dmp

Filesize
512KB

Download
memory/2044-95-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2044-388-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2044-96-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2044-73-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/2044-80-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2044-22-0x0000000002BA0000-0x0000000002C20000-memory.dmp

Filesize
512KB

Download
memory/2432-105-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-107-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-101-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2596-103-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2600-109-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2624-19-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-97-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2796-99-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2964-108-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2964-1-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-100-0x0000000003770000-0x0000000003B62000-memory.dmp

Filesize
3.9MB

Download
memory/2964-102-0x0000000003770000-0x0000000003B62000-memory.dmp

Filesize
3.9MB

Download
memory/2964-104-0x0000000003770000-0x0000000003B62000-memory.dmp

Filesize
3.9MB

Download
memory/2964-106-0x0000000003770000-0x0000000003B62000-memory.dmp

Filesize
3.9MB

Download
memory/2964-98-0x0000000003770000-0x0000000003B62000-memory.dmp

Filesize
3.9MB

Download
memory/2964-110-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-111-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2964-18-0x0000000002D60000-0x0000000003152000-memory.dmp

Filesize
3.9MB

Download
memory/2964-8-0x0000000002D60000-0x0000000003152000-memory.dmp

Filesize
3.9MB

Download
memory/2964-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/3016-9-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download