xmrig | 5edc833c205a6cdf10d0438297c315cf1ccb35762b4169350bd9575c22669c84

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
Size

2.1MB
MD5

092375bbd586fb216c6ccb8e8a74f7ee
SHA1

ad58fa4b97390904611cf31fa539a6e867d6ed1c
SHA256

5edc833c205a6cdf10d0438297c315cf1ccb35762b4169350bd9575c22669c84
SHA512

35101cc50a4e440909a7e853f02ed7984153b12f057fa031804821c983266194e9b62f03d920d792c6ebafb437b93247d1f5521442fcf5aacf475af08378bbd3
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr8:NABz

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/2244-41-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2428-48-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2244-46-0x0000000002DF0000-0x00000000031E2000-memory.dmp	xmrig
behavioral1/memory/2680-37-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/1932-30-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2536-22-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/1728-85-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/2392-74-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2244-82-0x0000000003170000-0x0000000003562000-memory.dmp	xmrig
behavioral1/memory/2536-80-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/1156-73-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2640-20-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/3016-9-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/3016-2415-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2392-2434-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2680-2433-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/1932-2480-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2520-2481-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2536-2503-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/1184-2504-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/1156-2502-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/1728-2432-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/2640-2431-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2428-2430-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3016	yrsEVNm.exe
2640	SesOzOi.exe
2536	tqsjrWm.exe
1932	vTmQUbC.exe
2680	zaNDaPO.exe
2428	mIpIlGu.exe
2520	lkVdMHw.exe
1184	ftlqkzJ.exe
2392	dHMYYep.exe
1156	xQCuYjF.exe
1728	kmjJgRy.exe
1676	cHbOhAe.exe
936	pFSDWBQ.exe
1008	QPdptRQ.exe
2384	phbaZIB.exe
1924	CnPqjyt.exe
2004	QnHNPxA.exe
2356	ICBuesP.exe
2216	TjWHlRz.exe
1812	iLXCVDE.exe
844	UotEbYD.exe
2212	ADpMXLV.exe
1428	CcRrdka.exe
2928	stpzSiF.exe
1916	GvErwXv.exe
1820	jnPllzv.exe
2776	yFKboHH.exe
2988	sQhmPLr.exe
2040	JGdKQCF.exe
2972	cfoMevp.exe
2012	JyaaLpQ.exe
2136	GgAPwQY.exe
1800	FplaUTU.exe
1776	pTRePTM.exe
1864	BxuBNcS.exe
1852	YftcnYD.exe
2964	ZQUkphN.exe
1352	WHubXVk.exe
1144	wIXyaKd.exe
948	BXnIXeS.exe
1312	bWoiDDY.exe
2272	IbEMGjL.exe
2268	RPGOauS.exe
884	vRkUnIm.exe
624	qkScetY.exe
2748	UJAdCbI.exe
2904	srOvzZZ.exe
2160	XUQmskU.exe
1688	nDOnEuL.exe
1760	ZgDWMMd.exe
3028	UJOyuDL.exe
1264	vCNLaXO.exe
2088	WOdhnOV.exe
876	xRSqmrC.exe
1740	RtdnoJO.exe
2168	wXvDIAo.exe
1148	UjWKcNv.exe
2032	pQLRLeH.exe
1564	JFoeXfK.exe
2208	MTHMoRs.exe
2500	xFVDXWq.exe
2548	TVAVAiq.exe
2684	rHiOeEa.exe
1964	aJEDCKm.exe

Loads dropped DLL 64 IoCs

pid	Process
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2244-61-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/1184-59-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/files/0x0007000000015c3c-58.dat	upx
behavioral1/files/0x0006000000016c23-60.dat	upx
behavioral1/memory/2520-57-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2244-41-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/files/0x0007000000014b6d-38.dat	upx
behavioral1/memory/2428-48-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/files/0x0007000000014c67-45.dat	upx
behavioral1/memory/2680-37-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/files/0x0007000000014aec-34.dat	upx
behavioral1/memory/1932-30-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/files/0x0009000000014a94-27.dat	upx
behavioral1/memory/2536-22-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/files/0x002e000000014698-11.dat	upx
behavioral1/files/0x000f0000000006fd-69.dat	upx
behavioral1/files/0x0006000000016ccf-88.dat	upx
behavioral1/files/0x0006000000016cd4-99.dat	upx
behavioral1/files/0x0006000000016ca9-98.dat	upx
behavioral1/memory/1728-85-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/files/0x0006000000016d11-113.dat	upx
behavioral1/files/0x0006000000016d01-114.dat	upx
behavioral1/files/0x0006000000016d4f-135.dat	upx
behavioral1/files/0x0006000000016d4a-132.dat	upx
behavioral1/files/0x0006000000016d41-128.dat	upx
behavioral1/files/0x0006000000016d36-124.dat	upx
behavioral1/files/0x0006000000016d24-120.dat	upx
behavioral1/files/0x0006000000016cf0-107.dat	upx
behavioral1/memory/2392-74-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2536-80-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/files/0x0007000000016c90-79.dat	upx
behavioral1/memory/1156-73-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/files/0x000600000001704f-165.dat	upx
behavioral1/files/0x0006000000017090-169.dat	upx
behavioral1/files/0x000500000001868c-173.dat	upx
behavioral1/files/0x0005000000018698-177.dat	upx
behavioral1/files/0x0006000000018ae2-185.dat	upx
behavioral1/files/0x00050000000186a0-181.dat	upx
behavioral1/files/0x0006000000016e56-161.dat	upx
behavioral1/files/0x0006000000016d84-149.dat	upx
behavioral1/files/0x0006000000016d89-155.dat	upx
behavioral1/files/0x0006000000016d55-147.dat	upx
behavioral1/memory/2640-20-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/files/0x000e000000014738-17.dat	upx
behavioral1/memory/3016-9-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/2244-7-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/files/0x000c00000001445e-6.dat	upx
behavioral1/memory/2244-0-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/3016-2415-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/2392-2434-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2680-2433-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/1932-2480-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2520-2481-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2536-2503-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/1184-2504-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/1156-2502-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/memory/1728-2432-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/memory/2640-2431-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/2428-2430-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\cTZhnmj.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\EXMJLsZ.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\YZiNITT.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\GkXYoqG.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\CWcBqCI.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\admNZrk.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\UQwAHJE.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\VynNyXG.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\BpjUXGg.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\AMvybke.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\RPGOauS.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\ZWRavUT.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\LOboBST.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\QWIeNrj.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\gqXzeLq.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\oXkhier.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\qVKAxrl.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\GfZlSGJ.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\sQhmPLr.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\tHbnfsh.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\OwHKdvN.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\sRETOtw.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\zjaGYdt.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\EBbTQWG.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\MUicfwu.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\vCWTuWh.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\vctqhbg.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\DeCFBmc.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\QXLRDIW.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\wZBSPTY.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\JapuKjV.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\UWDdOfZ.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\RhqLbHL.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\AiobUPk.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\MAicuDv.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\lIhFvXS.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\eMtEyrp.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\hmrdMMG.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\EGczHae.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\cHbOhAe.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\FHncIFI.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\ixTlFUX.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\xRmpcFy.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\jFuKFzv.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\iGQDBMh.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\cfdykUY.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\NMYTgiX.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\dttCeCN.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\ChZpNdx.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\ZJxKHaK.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\RKfzBNK.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\ULbkepH.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\AdFaCho.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\YnQoflG.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\zDLUyPw.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\GLlOWfq.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\fNCaqMA.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\WoKGUFc.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\pQLRLeH.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\TZRrTgj.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\OThDrVT.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\LwDMrmN.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\rCWDrMk.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
File created	C:\Windows\System\wmFKlXk.exe	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2892	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
Token: SeDebugPrivilege	2892	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2892	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	29
PID 2244 wrote to memory of 2892	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	29
PID 2244 wrote to memory of 2892	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	29
PID 2244 wrote to memory of 3016	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	30
PID 2244 wrote to memory of 3016	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	30
PID 2244 wrote to memory of 3016	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	30
PID 2244 wrote to memory of 2536	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	31
PID 2244 wrote to memory of 2536	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	31
PID 2244 wrote to memory of 2536	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	31
PID 2244 wrote to memory of 2640	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	32
PID 2244 wrote to memory of 2640	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	32
PID 2244 wrote to memory of 2640	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	32
PID 2244 wrote to memory of 1932	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	33
PID 2244 wrote to memory of 1932	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	33
PID 2244 wrote to memory of 1932	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	33
PID 2244 wrote to memory of 2680	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	34
PID 2244 wrote to memory of 2680	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	34
PID 2244 wrote to memory of 2680	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	34
PID 2244 wrote to memory of 2520	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	35
PID 2244 wrote to memory of 2520	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	35
PID 2244 wrote to memory of 2520	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	35
PID 2244 wrote to memory of 2428	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	36
PID 2244 wrote to memory of 2428	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	36
PID 2244 wrote to memory of 2428	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	36
PID 2244 wrote to memory of 1184	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	37
PID 2244 wrote to memory of 1184	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	37
PID 2244 wrote to memory of 1184	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	37
PID 2244 wrote to memory of 2392	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	38
PID 2244 wrote to memory of 2392	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	38
PID 2244 wrote to memory of 2392	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	38
PID 2244 wrote to memory of 1156	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	39
PID 2244 wrote to memory of 1156	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	39
PID 2244 wrote to memory of 1156	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	39
PID 2244 wrote to memory of 1728	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	40
PID 2244 wrote to memory of 1728	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	40
PID 2244 wrote to memory of 1728	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	40
PID 2244 wrote to memory of 936	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	41
PID 2244 wrote to memory of 936	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	41
PID 2244 wrote to memory of 936	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	41
PID 2244 wrote to memory of 1676	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	42
PID 2244 wrote to memory of 1676	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	42
PID 2244 wrote to memory of 1676	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	42
PID 2244 wrote to memory of 1008	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	43
PID 2244 wrote to memory of 1008	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	43
PID 2244 wrote to memory of 1008	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	43
PID 2244 wrote to memory of 2384	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	44
PID 2244 wrote to memory of 2384	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	44
PID 2244 wrote to memory of 2384	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	44
PID 2244 wrote to memory of 1924	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	45
PID 2244 wrote to memory of 1924	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	45
PID 2244 wrote to memory of 1924	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	45
PID 2244 wrote to memory of 2004	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	46
PID 2244 wrote to memory of 2004	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	46
PID 2244 wrote to memory of 2004	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	46
PID 2244 wrote to memory of 2356	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	47
PID 2244 wrote to memory of 2356	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	47
PID 2244 wrote to memory of 2356	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	47
PID 2244 wrote to memory of 2216	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	48
PID 2244 wrote to memory of 2216	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	48
PID 2244 wrote to memory of 2216	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	48
PID 2244 wrote to memory of 1812	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	49
PID 2244 wrote to memory of 1812	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	49
PID 2244 wrote to memory of 1812	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	49
PID 2244 wrote to memory of 844	2244	092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe	50

C:\Windows\System32\fixmxn.exe
"C:\Windows\System32\fixmxn.exe"
1⤵
PID:1540

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1708

C:\Users\Admin\AppData\Local\Temp\092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\092375bbd586fb216c6ccb8e8a74f7ee_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\System\yrsEVNm.exe
  C:\Windows\System\yrsEVNm.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\tqsjrWm.exe
  C:\Windows\System\tqsjrWm.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\SesOzOi.exe
  C:\Windows\System\SesOzOi.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\vTmQUbC.exe
  C:\Windows\System\vTmQUbC.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\zaNDaPO.exe
  C:\Windows\System\zaNDaPO.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\lkVdMHw.exe
  C:\Windows\System\lkVdMHw.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\mIpIlGu.exe
  C:\Windows\System\mIpIlGu.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\ftlqkzJ.exe
  C:\Windows\System\ftlqkzJ.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\dHMYYep.exe
  C:\Windows\System\dHMYYep.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\xQCuYjF.exe
  C:\Windows\System\xQCuYjF.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\kmjJgRy.exe
  C:\Windows\System\kmjJgRy.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\pFSDWBQ.exe
  C:\Windows\System\pFSDWBQ.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\cHbOhAe.exe
  C:\Windows\System\cHbOhAe.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\QPdptRQ.exe
  C:\Windows\System\QPdptRQ.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\phbaZIB.exe
  C:\Windows\System\phbaZIB.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\CnPqjyt.exe
  C:\Windows\System\CnPqjyt.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\QnHNPxA.exe
  C:\Windows\System\QnHNPxA.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\ICBuesP.exe
  C:\Windows\System\ICBuesP.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\TjWHlRz.exe
  C:\Windows\System\TjWHlRz.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\iLXCVDE.exe
  C:\Windows\System\iLXCVDE.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\UotEbYD.exe
  C:\Windows\System\UotEbYD.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\ADpMXLV.exe
  C:\Windows\System\ADpMXLV.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\CcRrdka.exe
  C:\Windows\System\CcRrdka.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\GvErwXv.exe
  C:\Windows\System\GvErwXv.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\stpzSiF.exe
  C:\Windows\System\stpzSiF.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\jnPllzv.exe
  C:\Windows\System\jnPllzv.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\yFKboHH.exe
  C:\Windows\System\yFKboHH.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\sQhmPLr.exe
  C:\Windows\System\sQhmPLr.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\JGdKQCF.exe
  C:\Windows\System\JGdKQCF.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\cfoMevp.exe
  C:\Windows\System\cfoMevp.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\JyaaLpQ.exe
  C:\Windows\System\JyaaLpQ.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\GgAPwQY.exe
  C:\Windows\System\GgAPwQY.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\FplaUTU.exe
  C:\Windows\System\FplaUTU.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\pTRePTM.exe
  C:\Windows\System\pTRePTM.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\BxuBNcS.exe
  C:\Windows\System\BxuBNcS.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\YftcnYD.exe
  C:\Windows\System\YftcnYD.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\ZQUkphN.exe
  C:\Windows\System\ZQUkphN.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\WHubXVk.exe
  C:\Windows\System\WHubXVk.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\wIXyaKd.exe
  C:\Windows\System\wIXyaKd.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\BXnIXeS.exe
  C:\Windows\System\BXnIXeS.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\bWoiDDY.exe
  C:\Windows\System\bWoiDDY.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\IbEMGjL.exe
  C:\Windows\System\IbEMGjL.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\RPGOauS.exe
  C:\Windows\System\RPGOauS.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\vRkUnIm.exe
  C:\Windows\System\vRkUnIm.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\qkScetY.exe
  C:\Windows\System\qkScetY.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\UJAdCbI.exe
  C:\Windows\System\UJAdCbI.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\srOvzZZ.exe
  C:\Windows\System\srOvzZZ.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\XUQmskU.exe
  C:\Windows\System\XUQmskU.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\nDOnEuL.exe
  C:\Windows\System\nDOnEuL.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\ZgDWMMd.exe
  C:\Windows\System\ZgDWMMd.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\UJOyuDL.exe
  C:\Windows\System\UJOyuDL.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\vCNLaXO.exe
  C:\Windows\System\vCNLaXO.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\WOdhnOV.exe
  C:\Windows\System\WOdhnOV.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\xRSqmrC.exe
  C:\Windows\System\xRSqmrC.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\RtdnoJO.exe
  C:\Windows\System\RtdnoJO.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\wXvDIAo.exe
  C:\Windows\System\wXvDIAo.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\UjWKcNv.exe
  C:\Windows\System\UjWKcNv.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\pQLRLeH.exe
  C:\Windows\System\pQLRLeH.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\JFoeXfK.exe
  C:\Windows\System\JFoeXfK.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\MTHMoRs.exe
  C:\Windows\System\MTHMoRs.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\xFVDXWq.exe
  C:\Windows\System\xFVDXWq.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\TVAVAiq.exe
  C:\Windows\System\TVAVAiq.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\rHiOeEa.exe
  C:\Windows\System\rHiOeEa.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\aJEDCKm.exe
  C:\Windows\System\aJEDCKm.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\JtLNSrN.exe
  C:\Windows\System\JtLNSrN.exe
  2⤵
  PID:2544
- C:\Windows\System\rlpyEzv.exe
  C:\Windows\System\rlpyEzv.exe
  2⤵
  PID:2472
- C:\Windows\System\aKuOXEr.exe
  C:\Windows\System\aKuOXEr.exe
  2⤵
  PID:328
- C:\Windows\System\QVsMVfK.exe
  C:\Windows\System\QVsMVfK.exe
  2⤵
  PID:340
- C:\Windows\System\ZWRavUT.exe
  C:\Windows\System\ZWRavUT.exe
  2⤵
  PID:2648
- C:\Windows\System\MsKdHMj.exe
  C:\Windows\System\MsKdHMj.exe
  2⤵
  PID:2848
- C:\Windows\System\VxsAQTo.exe
  C:\Windows\System\VxsAQTo.exe
  2⤵
  PID:2080
- C:\Windows\System\mkGiMAy.exe
  C:\Windows\System\mkGiMAy.exe
  2⤵
  PID:1360
- C:\Windows\System\CLpGNCG.exe
  C:\Windows\System\CLpGNCG.exe
  2⤵
  PID:1720
- C:\Windows\System\KVdstjT.exe
  C:\Windows\System\KVdstjT.exe
  2⤵
  PID:1644
- C:\Windows\System\LpOfQoC.exe
  C:\Windows\System\LpOfQoC.exe
  2⤵
  PID:1768
- C:\Windows\System\keiFtsh.exe
  C:\Windows\System\keiFtsh.exe
  2⤵
  PID:2496
- C:\Windows\System\zKzNowS.exe
  C:\Windows\System\zKzNowS.exe
  2⤵
  PID:2708
- C:\Windows\System\YMzyGUT.exe
  C:\Windows\System\YMzyGUT.exe
  2⤵
  PID:2416
- C:\Windows\System\YBTaeZq.exe
  C:\Windows\System\YBTaeZq.exe
  2⤵
  PID:1280
- C:\Windows\System\WVPtpNo.exe
  C:\Windows\System\WVPtpNo.exe
  2⤵
  PID:2484
- C:\Windows\System\DbHscaj.exe
  C:\Windows\System\DbHscaj.exe
  2⤵
  PID:1828
- C:\Windows\System\KTyKIdy.exe
  C:\Windows\System\KTyKIdy.exe
  2⤵
  PID:748
- C:\Windows\System\UcqIJlb.exe
  C:\Windows\System\UcqIJlb.exe
  2⤵
  PID:2220
- C:\Windows\System\SJoWfcB.exe
  C:\Windows\System\SJoWfcB.exe
  2⤵
  PID:2316
- C:\Windows\System\wavssgd.exe
  C:\Windows\System\wavssgd.exe
  2⤵
  PID:1588
- C:\Windows\System\AlGmpED.exe
  C:\Windows\System\AlGmpED.exe
  2⤵
  PID:1512
- C:\Windows\System\zcmqlxd.exe
  C:\Windows\System\zcmqlxd.exe
  2⤵
  PID:1592
- C:\Windows\System\YJkstjh.exe
  C:\Windows\System\YJkstjh.exe
  2⤵
  PID:796
- C:\Windows\System\CYFNvdD.exe
  C:\Windows\System\CYFNvdD.exe
  2⤵
  PID:1984
- C:\Windows\System\VvdWIbT.exe
  C:\Windows\System\VvdWIbT.exe
  2⤵
  PID:2008
- C:\Windows\System\MsSofqH.exe
  C:\Windows\System\MsSofqH.exe
  2⤵
  PID:1940
- C:\Windows\System\tlyzXzI.exe
  C:\Windows\System\tlyzXzI.exe
  2⤵
  PID:1032
- C:\Windows\System\EQgXRiX.exe
  C:\Windows\System\EQgXRiX.exe
  2⤵
  PID:1992
- C:\Windows\System\GDXzHeE.exe
  C:\Windows\System\GDXzHeE.exe
  2⤵
  PID:1816
- C:\Windows\System\tBiffkp.exe
  C:\Windows\System\tBiffkp.exe
  2⤵
  PID:2320
- C:\Windows\System\gnuDvxU.exe
  C:\Windows\System\gnuDvxU.exe
  2⤵
  PID:2780
- C:\Windows\System\PCcROpc.exe
  C:\Windows\System\PCcROpc.exe
  2⤵
  PID:2396
- C:\Windows\System\cVjzYVa.exe
  C:\Windows\System\cVjzYVa.exe
  2⤵
  PID:1500
- C:\Windows\System\VktImPo.exe
  C:\Windows\System\VktImPo.exe
  2⤵
  PID:2152
- C:\Windows\System\owvFcrj.exe
  C:\Windows\System\owvFcrj.exe
  2⤵
  PID:1656
- C:\Windows\System\eSnfQdB.exe
  C:\Windows\System\eSnfQdB.exe
  2⤵
  PID:2000
- C:\Windows\System\hKiBtiX.exe
  C:\Windows\System\hKiBtiX.exe
  2⤵
  PID:968
- C:\Windows\System\pyAWfBd.exe
  C:\Windows\System\pyAWfBd.exe
  2⤵
  PID:1004
- C:\Windows\System\sKcCIzw.exe
  C:\Windows\System\sKcCIzw.exe
  2⤵
  PID:1420
- C:\Windows\System\lezkChz.exe
  C:\Windows\System\lezkChz.exe
  2⤵
  PID:2120
- C:\Windows\System\AdFaCho.exe
  C:\Windows\System\AdFaCho.exe
  2⤵
  PID:2336
- C:\Windows\System\RsHcRfa.exe
  C:\Windows\System\RsHcRfa.exe
  2⤵
  PID:2488
- C:\Windows\System\zoxaQpl.exe
  C:\Windows\System\zoxaQpl.exe
  2⤵
  PID:2888
- C:\Windows\System\GbSeriJ.exe
  C:\Windows\System\GbSeriJ.exe
  2⤵
  PID:2608
- C:\Windows\System\JWvlxIR.exe
  C:\Windows\System\JWvlxIR.exe
  2⤵
  PID:1980
- C:\Windows\System\qOxMchA.exe
  C:\Windows\System\qOxMchA.exe
  2⤵
  PID:2420
- C:\Windows\System\FwSRZKG.exe
  C:\Windows\System\FwSRZKG.exe
  2⤵
  PID:1972
- C:\Windows\System\FWebIyH.exe
  C:\Windows\System\FWebIyH.exe
  2⤵
  PID:2480
- C:\Windows\System\KVQVqpB.exe
  C:\Windows\System\KVQVqpB.exe
  2⤵
  PID:1548
- C:\Windows\System\kKeZakt.exe
  C:\Windows\System\kKeZakt.exe
  2⤵
  PID:2516
- C:\Windows\System\OXZvMIM.exe
  C:\Windows\System\OXZvMIM.exe
  2⤵
  PID:1252
- C:\Windows\System\kqVZrVK.exe
  C:\Windows\System\kqVZrVK.exe
  2⤵
  PID:580
- C:\Windows\System\QSnFYQF.exe
  C:\Windows\System\QSnFYQF.exe
  2⤵
  PID:1868
- C:\Windows\System\OBMyxrf.exe
  C:\Windows\System\OBMyxrf.exe
  2⤵
  PID:1920
- C:\Windows\System\CeMLrRA.exe
  C:\Windows\System\CeMLrRA.exe
  2⤵
  PID:2364
- C:\Windows\System\rTWfDPv.exe
  C:\Windows\System\rTWfDPv.exe
  2⤵
  PID:2224
- C:\Windows\System\lSEDZJj.exe
  C:\Windows\System\lSEDZJj.exe
  2⤵
  PID:2444
- C:\Windows\System\mWerkBR.exe
  C:\Windows\System\mWerkBR.exe
  2⤵
  PID:764
- C:\Windows\System\JBKkFLb.exe
  C:\Windows\System\JBKkFLb.exe
  2⤵
  PID:2568
- C:\Windows\System\kPgShmC.exe
  C:\Windows\System\kPgShmC.exe
  2⤵
  PID:2148
- C:\Windows\System\CKxUHfI.exe
  C:\Windows\System\CKxUHfI.exe
  2⤵
  PID:1784
- C:\Windows\System\ygSFyXX.exe
  C:\Windows\System\ygSFyXX.exe
  2⤵
  PID:540
- C:\Windows\System\HOsPIaF.exe
  C:\Windows\System\HOsPIaF.exe
  2⤵
  PID:1504
- C:\Windows\System\mkBRsUK.exe
  C:\Windows\System\mkBRsUK.exe
  2⤵
  PID:1624
- C:\Windows\System\CqLxKlH.exe
  C:\Windows\System\CqLxKlH.exe
  2⤵
  PID:1752
- C:\Windows\System\SZlfRZC.exe
  C:\Windows\System\SZlfRZC.exe
  2⤵
  PID:1508
- C:\Windows\System\vttWpOS.exe
  C:\Windows\System\vttWpOS.exe
  2⤵
  PID:324
- C:\Windows\System\LmexRLn.exe
  C:\Windows\System\LmexRLn.exe
  2⤵
  PID:1468
- C:\Windows\System\FBhsCSm.exe
  C:\Windows\System\FBhsCSm.exe
  2⤵
  PID:2240
- C:\Windows\System\DnTwHsE.exe
  C:\Windows\System\DnTwHsE.exe
  2⤵
  PID:2096
- C:\Windows\System\iMLyPXG.exe
  C:\Windows\System\iMLyPXG.exe
  2⤵
  PID:1332
- C:\Windows\System\JQaLeag.exe
  C:\Windows\System\JQaLeag.exe
  2⤵
  PID:1848
- C:\Windows\System\cBEXAYv.exe
  C:\Windows\System\cBEXAYv.exe
  2⤵
  PID:964
- C:\Windows\System\RgKNuUm.exe
  C:\Windows\System\RgKNuUm.exe
  2⤵
  PID:2024
- C:\Windows\System\QRkvkgi.exe
  C:\Windows\System\QRkvkgi.exe
  2⤵
  PID:1572
- C:\Windows\System\zJYwyGp.exe
  C:\Windows\System\zJYwyGp.exe
  2⤵
  PID:2692
- C:\Windows\System\bibWrjT.exe
  C:\Windows\System\bibWrjT.exe
  2⤵
  PID:2196
- C:\Windows\System\KHVNWqN.exe
  C:\Windows\System\KHVNWqN.exe
  2⤵
  PID:3024
- C:\Windows\System\SyLMmlW.exe
  C:\Windows\System\SyLMmlW.exe
  2⤵
  PID:2840
- C:\Windows\System\VpKNFWP.exe
  C:\Windows\System\VpKNFWP.exe
  2⤵
  PID:2176
- C:\Windows\System\jnDLQDD.exe
  C:\Windows\System\jnDLQDD.exe
  2⤵
  PID:2132
- C:\Windows\System\VQOtzjK.exe
  C:\Windows\System\VQOtzjK.exe
  2⤵
  PID:924
- C:\Windows\System\gNcYkQf.exe
  C:\Windows\System\gNcYkQf.exe
  2⤵
  PID:1552
- C:\Windows\System\UkDcTBO.exe
  C:\Windows\System\UkDcTBO.exe
  2⤵
  PID:2380
- C:\Windows\System\aBybSoS.exe
  C:\Windows\System\aBybSoS.exe
  2⤵
  PID:2948
- C:\Windows\System\eBbPwRd.exe
  C:\Windows\System\eBbPwRd.exe
  2⤵
  PID:1708
- C:\Windows\System\HsFvBdf.exe
  C:\Windows\System\HsFvBdf.exe
  2⤵
  PID:2864
- C:\Windows\System\jJvUsZR.exe
  C:\Windows\System\jJvUsZR.exe
  2⤵
  PID:2456
- C:\Windows\System\avJMKwm.exe
  C:\Windows\System\avJMKwm.exe
  2⤵
  PID:2724
- C:\Windows\System\XjGtbDR.exe
  C:\Windows\System\XjGtbDR.exe
  2⤵
  PID:860
- C:\Windows\System\fjXjmWi.exe
  C:\Windows\System\fjXjmWi.exe
  2⤵
  PID:1392
- C:\Windows\System\fNotAfP.exe
  C:\Windows\System\fNotAfP.exe
  2⤵
  PID:1128
- C:\Windows\System\ypFRwIB.exe
  C:\Windows\System\ypFRwIB.exe
  2⤵
  PID:2324
- C:\Windows\System\TZRrTgj.exe
  C:\Windows\System\TZRrTgj.exe
  2⤵
  PID:2560
- C:\Windows\System\KyUQIEX.exe
  C:\Windows\System\KyUQIEX.exe
  2⤵
  PID:3008
- C:\Windows\System\zkaSUiq.exe
  C:\Windows\System\zkaSUiq.exe
  2⤵
  PID:2060
- C:\Windows\System\KyRscEk.exe
  C:\Windows\System\KyRscEk.exe
  2⤵
  PID:2352
- C:\Windows\System\BvcjppB.exe
  C:\Windows\System\BvcjppB.exe
  2⤵
  PID:1600
- C:\Windows\System\aOoMFHg.exe
  C:\Windows\System\aOoMFHg.exe
  2⤵
  PID:1860
- C:\Windows\System\mzaXCjF.exe
  C:\Windows\System\mzaXCjF.exe
  2⤵
  PID:664
- C:\Windows\System\FGxZQHQ.exe
  C:\Windows\System\FGxZQHQ.exe
  2⤵
  PID:868
- C:\Windows\System\foohtbj.exe
  C:\Windows\System\foohtbj.exe
  2⤵
  PID:2792
- C:\Windows\System\bZDpIfu.exe
  C:\Windows\System\bZDpIfu.exe
  2⤵
  PID:3012
- C:\Windows\System\BIxopWv.exe
  C:\Windows\System\BIxopWv.exe
  2⤵
  PID:1248
- C:\Windows\System\QfjVQNs.exe
  C:\Windows\System\QfjVQNs.exe
  2⤵
  PID:2756
- C:\Windows\System\aVCeyTa.exe
  C:\Windows\System\aVCeyTa.exe
  2⤵
  PID:1632
- C:\Windows\System\VfOTmLN.exe
  C:\Windows\System\VfOTmLN.exe
  2⤵
  PID:2360
- C:\Windows\System\WhcYBxu.exe
  C:\Windows\System\WhcYBxu.exe
  2⤵
  PID:680
- C:\Windows\System\FNxIYoo.exe
  C:\Windows\System\FNxIYoo.exe
  2⤵
  PID:2156
- C:\Windows\System\PLDAFCT.exe
  C:\Windows\System\PLDAFCT.exe
  2⤵
  PID:2728
- C:\Windows\System\jyxZIxw.exe
  C:\Windows\System\jyxZIxw.exe
  2⤵
  PID:1048
- C:\Windows\System\KXNiBOb.exe
  C:\Windows\System\KXNiBOb.exe
  2⤵
  PID:1028
- C:\Windows\System\QqmJTws.exe
  C:\Windows\System\QqmJTws.exe
  2⤵
  PID:1952
- C:\Windows\System\llTMhTm.exe
  C:\Windows\System\llTMhTm.exe
  2⤵
  PID:3104
- C:\Windows\System\fqUTdUK.exe
  C:\Windows\System\fqUTdUK.exe
  2⤵
  PID:3120
- C:\Windows\System\DhDNZNH.exe
  C:\Windows\System\DhDNZNH.exe
  2⤵
  PID:3140
- C:\Windows\System\VULvNIM.exe
  C:\Windows\System\VULvNIM.exe
  2⤵
  PID:3164
- C:\Windows\System\XkavKdt.exe
  C:\Windows\System\XkavKdt.exe
  2⤵
  PID:3180
- C:\Windows\System\pMVkYjP.exe
  C:\Windows\System\pMVkYjP.exe
  2⤵
  PID:3216
- C:\Windows\System\xEmWCYw.exe
  C:\Windows\System\xEmWCYw.exe
  2⤵
  PID:3236
- C:\Windows\System\RUDZCpG.exe
  C:\Windows\System\RUDZCpG.exe
  2⤵
  PID:3252
- C:\Windows\System\SfRhgIb.exe
  C:\Windows\System\SfRhgIb.exe
  2⤵
  PID:3268
- C:\Windows\System\dwkseUI.exe
  C:\Windows\System\dwkseUI.exe
  2⤵
  PID:3284
- C:\Windows\System\vMRWdwE.exe
  C:\Windows\System\vMRWdwE.exe
  2⤵
  PID:3300
- C:\Windows\System\vApyOzv.exe
  C:\Windows\System\vApyOzv.exe
  2⤵
  PID:3316
- C:\Windows\System\HcZjOaW.exe
  C:\Windows\System\HcZjOaW.exe
  2⤵
  PID:3332
- C:\Windows\System\brKJQjk.exe
  C:\Windows\System\brKJQjk.exe
  2⤵
  PID:3376
- C:\Windows\System\hJDfSJI.exe
  C:\Windows\System\hJDfSJI.exe
  2⤵
  PID:3392
- C:\Windows\System\FkGMWZa.exe
  C:\Windows\System\FkGMWZa.exe
  2⤵
  PID:3408
- C:\Windows\System\SEuISTt.exe
  C:\Windows\System\SEuISTt.exe
  2⤵
  PID:3424
- C:\Windows\System\RumTKJw.exe
  C:\Windows\System\RumTKJw.exe
  2⤵
  PID:3444
- C:\Windows\System\SiMROcy.exe
  C:\Windows\System\SiMROcy.exe
  2⤵
  PID:3464
- C:\Windows\System\NYACxGD.exe
  C:\Windows\System\NYACxGD.exe
  2⤵
  PID:3480
- C:\Windows\System\OrhtDgg.exe
  C:\Windows\System\OrhtDgg.exe
  2⤵
  PID:3496
- C:\Windows\System\luibjfx.exe
  C:\Windows\System\luibjfx.exe
  2⤵
  PID:3512
- C:\Windows\System\OThDrVT.exe
  C:\Windows\System\OThDrVT.exe
  2⤵
  PID:3532
- C:\Windows\System\ughCFGT.exe
  C:\Windows\System\ughCFGT.exe
  2⤵
  PID:3548
- C:\Windows\System\wODLySl.exe
  C:\Windows\System\wODLySl.exe
  2⤵
  PID:3564
- C:\Windows\System\bCyvcmZ.exe
  C:\Windows\System\bCyvcmZ.exe
  2⤵
  PID:3584
- C:\Windows\System\oHOMmCo.exe
  C:\Windows\System\oHOMmCo.exe
  2⤵
  PID:3600
- C:\Windows\System\HWjIoVI.exe
  C:\Windows\System\HWjIoVI.exe
  2⤵
  PID:3620
- C:\Windows\System\BjXqvmN.exe
  C:\Windows\System\BjXqvmN.exe
  2⤵
  PID:3636
- C:\Windows\System\HSVBsQM.exe
  C:\Windows\System\HSVBsQM.exe
  2⤵
  PID:3656
- C:\Windows\System\lkVBuio.exe
  C:\Windows\System\lkVBuio.exe
  2⤵
  PID:3672
- C:\Windows\System\VYexqes.exe
  C:\Windows\System\VYexqes.exe
  2⤵
  PID:3688
- C:\Windows\System\OTUKGGx.exe
  C:\Windows\System\OTUKGGx.exe
  2⤵
  PID:3712
- C:\Windows\System\kzrEuce.exe
  C:\Windows\System\kzrEuce.exe
  2⤵
  PID:3728
- C:\Windows\System\pVnJwsG.exe
  C:\Windows\System\pVnJwsG.exe
  2⤵
  PID:3744
- C:\Windows\System\GDmKwUD.exe
  C:\Windows\System\GDmKwUD.exe
  2⤵
  PID:3764
- C:\Windows\System\fsGAQNS.exe
  C:\Windows\System\fsGAQNS.exe
  2⤵
  PID:3780
- C:\Windows\System\BJHCPEA.exe
  C:\Windows\System\BJHCPEA.exe
  2⤵
  PID:3796
- C:\Windows\System\aMYTlgI.exe
  C:\Windows\System\aMYTlgI.exe
  2⤵
  PID:3880
- C:\Windows\System\kiibprV.exe
  C:\Windows\System\kiibprV.exe
  2⤵
  PID:3896
- C:\Windows\System\lpEnClD.exe
  C:\Windows\System\lpEnClD.exe
  2⤵
  PID:3912
- C:\Windows\System\jnPKiEt.exe
  C:\Windows\System\jnPKiEt.exe
  2⤵
  PID:3928
- C:\Windows\System\TKebFeX.exe
  C:\Windows\System\TKebFeX.exe
  2⤵
  PID:3944
- C:\Windows\System\EobmpKn.exe
  C:\Windows\System\EobmpKn.exe
  2⤵
  PID:3960
- C:\Windows\System\nfgifTz.exe
  C:\Windows\System\nfgifTz.exe
  2⤵
  PID:3976
- C:\Windows\System\BgUVDgp.exe
  C:\Windows\System\BgUVDgp.exe
  2⤵
  PID:3992
- C:\Windows\System\mIzdKrY.exe
  C:\Windows\System\mIzdKrY.exe
  2⤵
  PID:4012
- C:\Windows\System\ZLVyRhM.exe
  C:\Windows\System\ZLVyRhM.exe
  2⤵
  PID:4032
- C:\Windows\System\VixDOHJ.exe
  C:\Windows\System\VixDOHJ.exe
  2⤵
  PID:4072
- C:\Windows\System\zqPrhmz.exe
  C:\Windows\System\zqPrhmz.exe
  2⤵
  PID:2504
- C:\Windows\System\Klbveej.exe
  C:\Windows\System\Klbveej.exe
  2⤵
  PID:2164
- C:\Windows\System\ooDILsp.exe
  C:\Windows\System\ooDILsp.exe
  2⤵
  PID:2332
- C:\Windows\System\EBwZitH.exe
  C:\Windows\System\EBwZitH.exe
  2⤵
  PID:3084
- C:\Windows\System\XoGkRTP.exe
  C:\Windows\System\XoGkRTP.exe
  2⤵
  PID:3112
- C:\Windows\System\UsOUEXd.exe
  C:\Windows\System\UsOUEXd.exe
  2⤵
  PID:1516
- C:\Windows\System\YZiNITT.exe
  C:\Windows\System\YZiNITT.exe
  2⤵
  PID:3160
- C:\Windows\System\TlaFevY.exe
  C:\Windows\System\TlaFevY.exe
  2⤵
  PID:2260
- C:\Windows\System\FRxurLj.exe
  C:\Windows\System\FRxurLj.exe
  2⤵
  PID:3200
- C:\Windows\System\rfviytC.exe
  C:\Windows\System\rfviytC.exe
  2⤵
  PID:3172
- C:\Windows\System\mSKtvkU.exe
  C:\Windows\System\mSKtvkU.exe
  2⤵
  PID:3280
- C:\Windows\System\iNpzFOs.exe
  C:\Windows\System\iNpzFOs.exe
  2⤵
  PID:3356
- C:\Windows\System\dttCeCN.exe
  C:\Windows\System\dttCeCN.exe
  2⤵
  PID:3228
- C:\Windows\System\xFenCSJ.exe
  C:\Windows\System\xFenCSJ.exe
  2⤵
  PID:3328
- C:\Windows\System\GqJlyFP.exe
  C:\Windows\System\GqJlyFP.exe
  2⤵
  PID:3440
- C:\Windows\System\upZQWrq.exe
  C:\Windows\System\upZQWrq.exe
  2⤵
  PID:3472
- C:\Windows\System\uaHkXoy.exe
  C:\Windows\System\uaHkXoy.exe
  2⤵
  PID:3540
- C:\Windows\System\tomfVfy.exe
  C:\Windows\System\tomfVfy.exe
  2⤵
  PID:3492
- C:\Windows\System\cQmAbXF.exe
  C:\Windows\System\cQmAbXF.exe
  2⤵
  PID:3576
- C:\Windows\System\hUHSYjh.exe
  C:\Windows\System\hUHSYjh.exe
  2⤵
  PID:3616
- C:\Windows\System\ElcxnkS.exe
  C:\Windows\System\ElcxnkS.exe
  2⤵
  PID:3684
- C:\Windows\System\NjFgFJe.exe
  C:\Windows\System\NjFgFJe.exe
  2⤵
  PID:3792
- C:\Windows\System\ZVSgwrX.exe
  C:\Windows\System\ZVSgwrX.exe
  2⤵
  PID:3528
- C:\Windows\System\LbVHuaA.exe
  C:\Windows\System\LbVHuaA.exe
  2⤵
  PID:3708
- C:\Windows\System\nNNmUcV.exe
  C:\Windows\System\nNNmUcV.exe
  2⤵
  PID:3808
- C:\Windows\System\CBfvDwu.exe
  C:\Windows\System\CBfvDwu.exe
  2⤵
  PID:3832
- C:\Windows\System\WkgidHX.exe
  C:\Windows\System\WkgidHX.exe
  2⤵
  PID:3592
- C:\Windows\System\aILvdxe.exe
  C:\Windows\System\aILvdxe.exe
  2⤵
  PID:3696
- C:\Windows\System\DPUqebK.exe
  C:\Windows\System\DPUqebK.exe
  2⤵
  PID:3888
- C:\Windows\System\GkXYoqG.exe
  C:\Windows\System\GkXYoqG.exe
  2⤵
  PID:3804
- C:\Windows\System\UVihxfQ.exe
  C:\Windows\System\UVihxfQ.exe
  2⤵
  PID:3892
- C:\Windows\System\OinOYWn.exe
  C:\Windows\System\OinOYWn.exe
  2⤵
  PID:3860
- C:\Windows\System\oYhzbwz.exe
  C:\Windows\System\oYhzbwz.exe
  2⤵
  PID:3972
- C:\Windows\System\QdrNBGw.exe
  C:\Windows\System\QdrNBGw.exe
  2⤵
  PID:4000
- C:\Windows\System\GhqyMHB.exe
  C:\Windows\System\GhqyMHB.exe
  2⤵
  PID:4056
- C:\Windows\System\UMFtiLC.exe
  C:\Windows\System\UMFtiLC.exe
  2⤵
  PID:4044
- C:\Windows\System\tpqJOlr.exe
  C:\Windows\System\tpqJOlr.exe
  2⤵
  PID:3156
- C:\Windows\System\NIsOkAf.exe
  C:\Windows\System\NIsOkAf.exe
  2⤵
  PID:2552
- C:\Windows\System\EonuYqO.exe
  C:\Windows\System\EonuYqO.exe
  2⤵
  PID:4092
- C:\Windows\System\zMWfhev.exe
  C:\Windows\System\zMWfhev.exe
  2⤵
  PID:3212
- C:\Windows\System\cEvlgpZ.exe
  C:\Windows\System\cEvlgpZ.exe
  2⤵
  PID:3224
- C:\Windows\System\opZRnnJ.exe
  C:\Windows\System\opZRnnJ.exe
  2⤵
  PID:940
- C:\Windows\System\CUakeqT.exe
  C:\Windows\System\CUakeqT.exe
  2⤵
  PID:3092
- C:\Windows\System\LQIeUWm.exe
  C:\Windows\System\LQIeUWm.exe
  2⤵
  PID:3352
- C:\Windows\System\vOMCJbk.exe
  C:\Windows\System\vOMCJbk.exe
  2⤵
  PID:3204
- C:\Windows\System\GNGHvhC.exe
  C:\Windows\System\GNGHvhC.exe
  2⤵
  PID:3404
- C:\Windows\System\fMxkKro.exe
  C:\Windows\System\fMxkKro.exe
  2⤵
  PID:3384
- C:\Windows\System\bSTckDO.exe
  C:\Windows\System\bSTckDO.exe
  2⤵
  PID:3572
- C:\Windows\System\yelLEAO.exe
  C:\Windows\System\yelLEAO.exe
  2⤵
  PID:3648
- C:\Windows\System\VCtXEAw.exe
  C:\Windows\System\VCtXEAw.exe
  2⤵
  PID:3608
- C:\Windows\System\UWoAGrE.exe
  C:\Windows\System\UWoAGrE.exe
  2⤵
  PID:3736
- C:\Windows\System\TlFbzgb.exe
  C:\Windows\System\TlFbzgb.exe
  2⤵
  PID:3856
- C:\Windows\System\QjzmPFk.exe
  C:\Windows\System\QjzmPFk.exe
  2⤵
  PID:1540
- C:\Windows\System\aolUqLp.exe
  C:\Windows\System\aolUqLp.exe
  2⤵
  PID:3984
- C:\Windows\System\PlgSrMy.exe
  C:\Windows\System\PlgSrMy.exe
  2⤵
  PID:3740
- C:\Windows\System\kbGSbNP.exe
  C:\Windows\System\kbGSbNP.exe
  2⤵
  PID:4068
- C:\Windows\System\GJFnJDl.exe
  C:\Windows\System\GJFnJDl.exe
  2⤵
  PID:3368
- C:\Windows\System\avYmEmX.exe
  C:\Windows\System\avYmEmX.exe
  2⤵
  PID:3372
- C:\Windows\System\sZcdmYt.exe
  C:\Windows\System\sZcdmYt.exe
  2⤵
  PID:3416
- C:\Windows\System\BLKYGGf.exe
  C:\Windows\System\BLKYGGf.exe
  2⤵
  PID:3876
- C:\Windows\System\LOynkSa.exe
  C:\Windows\System\LOynkSa.exe
  2⤵
  PID:1272
- C:\Windows\System\yZLzcbz.exe
  C:\Windows\System\yZLzcbz.exe
  2⤵
  PID:2732
- C:\Windows\System\kUSxlEs.exe
  C:\Windows\System\kUSxlEs.exe
  2⤵
  PID:3556
- C:\Windows\System\dwvDqwd.exe
  C:\Windows\System\dwvDqwd.exe
  2⤵
  PID:3488
- C:\Windows\System\ywiAeki.exe
  C:\Windows\System\ywiAeki.exe
  2⤵
  PID:3756
- C:\Windows\System\TqpMwjp.exe
  C:\Windows\System\TqpMwjp.exe
  2⤵
  PID:4060
- C:\Windows\System\YHgBCAA.exe
  C:\Windows\System\YHgBCAA.exe
  2⤵
  PID:3848
- C:\Windows\System\HfSlYCf.exe
  C:\Windows\System\HfSlYCf.exe
  2⤵
  PID:4004
- C:\Windows\System\LOboBST.exe
  C:\Windows\System\LOboBST.exe
  2⤵
  PID:3152
- C:\Windows\System\AuPFPwE.exe
  C:\Windows\System\AuPFPwE.exe
  2⤵
  PID:3344
- C:\Windows\System\IGXSaOq.exe
  C:\Windows\System\IGXSaOq.exe
  2⤵
  PID:3324
- C:\Windows\System\EJDNzaF.exe
  C:\Windows\System\EJDNzaF.exe
  2⤵
  PID:3668
- C:\Windows\System\HwYstMx.exe
  C:\Windows\System\HwYstMx.exe
  2⤵
  PID:3312
- C:\Windows\System\DECmNXt.exe
  C:\Windows\System\DECmNXt.exe
  2⤵
  PID:3940
- C:\Windows\System\WMfZfwJ.exe
  C:\Windows\System\WMfZfwJ.exe
  2⤵
  PID:3456
- C:\Windows\System\SdlQmRh.exe
  C:\Windows\System\SdlQmRh.exe
  2⤵
  PID:4020
- C:\Windows\System\cjqXNIZ.exe
  C:\Windows\System\cjqXNIZ.exe
  2⤵
  PID:2984
- C:\Windows\System\upnSbVz.exe
  C:\Windows\System\upnSbVz.exe
  2⤵
  PID:3132
- C:\Windows\System\wZBSPTY.exe
  C:\Windows\System\wZBSPTY.exe
  2⤵
  PID:3148
- C:\Windows\System\fIxwFIF.exe
  C:\Windows\System\fIxwFIF.exe
  2⤵
  PID:3956
- C:\Windows\System\bIcpNIr.exe
  C:\Windows\System\bIcpNIr.exe
  2⤵
  PID:2236
- C:\Windows\System\EHGpfup.exe
  C:\Windows\System\EHGpfup.exe
  2⤵
  PID:4112
- C:\Windows\System\yicDiGv.exe
  C:\Windows\System\yicDiGv.exe
  2⤵
  PID:4128
- C:\Windows\System\ZprhOAV.exe
  C:\Windows\System\ZprhOAV.exe
  2⤵
  PID:4144
- C:\Windows\System\uqYQUeY.exe
  C:\Windows\System\uqYQUeY.exe
  2⤵
  PID:4164
- C:\Windows\System\DwfcMtl.exe
  C:\Windows\System\DwfcMtl.exe
  2⤵
  PID:4188
- C:\Windows\System\hqXwFex.exe
  C:\Windows\System\hqXwFex.exe
  2⤵
  PID:4208
- C:\Windows\System\EnOCxEU.exe
  C:\Windows\System\EnOCxEU.exe
  2⤵
  PID:4224
- C:\Windows\System\mzyKWAo.exe
  C:\Windows\System\mzyKWAo.exe
  2⤵
  PID:4240
- C:\Windows\System\OBOEcFm.exe
  C:\Windows\System\OBOEcFm.exe
  2⤵
  PID:4256
- C:\Windows\System\geWtVuh.exe
  C:\Windows\System\geWtVuh.exe
  2⤵
  PID:4272
- C:\Windows\System\EHQSpYH.exe
  C:\Windows\System\EHQSpYH.exe
  2⤵
  PID:4288
- C:\Windows\System\kXAFuMS.exe
  C:\Windows\System\kXAFuMS.exe
  2⤵
  PID:4312
- C:\Windows\System\dcjrOGW.exe
  C:\Windows\System\dcjrOGW.exe
  2⤵
  PID:4328
- C:\Windows\System\GKomenx.exe
  C:\Windows\System\GKomenx.exe
  2⤵
  PID:4348
- C:\Windows\System\SkatIPs.exe
  C:\Windows\System\SkatIPs.exe
  2⤵
  PID:4364
- C:\Windows\System\uVbZEvQ.exe
  C:\Windows\System\uVbZEvQ.exe
  2⤵
  PID:4380
- C:\Windows\System\zzIvuqK.exe
  C:\Windows\System\zzIvuqK.exe
  2⤵
  PID:4396
- C:\Windows\System\OfnhzDZ.exe
  C:\Windows\System\OfnhzDZ.exe
  2⤵
  PID:4416
- C:\Windows\System\MvtQWWF.exe
  C:\Windows\System\MvtQWWF.exe
  2⤵
  PID:4432
- C:\Windows\System\tHbnfsh.exe
  C:\Windows\System\tHbnfsh.exe
  2⤵
  PID:4448
- C:\Windows\System\XSWnmic.exe
  C:\Windows\System\XSWnmic.exe
  2⤵
  PID:4464
- C:\Windows\System\rmaTVgr.exe
  C:\Windows\System\rmaTVgr.exe
  2⤵
  PID:4484
- C:\Windows\System\aGJPNvg.exe
  C:\Windows\System\aGJPNvg.exe
  2⤵
  PID:4508
- C:\Windows\System\Ewrvbbm.exe
  C:\Windows\System\Ewrvbbm.exe
  2⤵
  PID:4524
- C:\Windows\System\wymfnht.exe
  C:\Windows\System\wymfnht.exe
  2⤵
  PID:4540
- C:\Windows\System\zvEEfsD.exe
  C:\Windows\System\zvEEfsD.exe
  2⤵
  PID:4556
- C:\Windows\System\fPUAJJU.exe
  C:\Windows\System\fPUAJJU.exe
  2⤵
  PID:4576
- C:\Windows\System\smsHoEE.exe
  C:\Windows\System\smsHoEE.exe
  2⤵
  PID:4612
- C:\Windows\System\WweMwNl.exe
  C:\Windows\System\WweMwNl.exe
  2⤵
  PID:4628
- C:\Windows\System\pXafIej.exe
  C:\Windows\System\pXafIej.exe
  2⤵
  PID:4648
- C:\Windows\System\gJTrYOv.exe
  C:\Windows\System\gJTrYOv.exe
  2⤵
  PID:4664
- C:\Windows\System\uCGVGPY.exe
  C:\Windows\System\uCGVGPY.exe
  2⤵
  PID:4684
- C:\Windows\System\OfjxhPb.exe
  C:\Windows\System\OfjxhPb.exe
  2⤵
  PID:4704
- C:\Windows\System\UuGoZCr.exe
  C:\Windows\System\UuGoZCr.exe
  2⤵
  PID:4724
- C:\Windows\System\MjiUjrL.exe
  C:\Windows\System\MjiUjrL.exe
  2⤵
  PID:4752
- C:\Windows\System\fUPqiEQ.exe
  C:\Windows\System\fUPqiEQ.exe
  2⤵
  PID:4768
- C:\Windows\System\hhUAUVO.exe
  C:\Windows\System\hhUAUVO.exe
  2⤵
  PID:4792
- C:\Windows\System\VkjOvmP.exe
  C:\Windows\System\VkjOvmP.exe
  2⤵
  PID:4808
- C:\Windows\System\HNelKjz.exe
  C:\Windows\System\HNelKjz.exe
  2⤵
  PID:4824
- C:\Windows\System\LMrThZP.exe
  C:\Windows\System\LMrThZP.exe
  2⤵
  PID:4840
- C:\Windows\System\RLsaecl.exe
  C:\Windows\System\RLsaecl.exe
  2⤵
  PID:4892
- C:\Windows\System\mvzHURR.exe
  C:\Windows\System\mvzHURR.exe
  2⤵
  PID:4912
- C:\Windows\System\eMCMTEg.exe
  C:\Windows\System\eMCMTEg.exe
  2⤵
  PID:4928
- C:\Windows\System\qEEakin.exe
  C:\Windows\System\qEEakin.exe
  2⤵
  PID:4944
- C:\Windows\System\gkWEmbU.exe
  C:\Windows\System\gkWEmbU.exe
  2⤵
  PID:4960
- C:\Windows\System\fZAczQD.exe
  C:\Windows\System\fZAczQD.exe
  2⤵
  PID:4976
- C:\Windows\System\pqrsjqz.exe
  C:\Windows\System\pqrsjqz.exe
  2⤵
  PID:4992
- C:\Windows\System\GDUDkTf.exe
  C:\Windows\System\GDUDkTf.exe
  2⤵
  PID:5012
- C:\Windows\System\zSUBUiS.exe
  C:\Windows\System\zSUBUiS.exe
  2⤵
  PID:5028
- C:\Windows\System\nYllBAM.exe
  C:\Windows\System\nYllBAM.exe
  2⤵
  PID:5048
- C:\Windows\System\EfrDWLw.exe
  C:\Windows\System\EfrDWLw.exe
  2⤵
  PID:5064
- C:\Windows\System\DcoNzyu.exe
  C:\Windows\System\DcoNzyu.exe
  2⤵
  PID:5084
- C:\Windows\System\atOSDYY.exe
  C:\Windows\System\atOSDYY.exe
  2⤵
  PID:5104
- C:\Windows\System\kaYjmSz.exe
  C:\Windows\System\kaYjmSz.exe
  2⤵
  PID:4024
- C:\Windows\System\VUZtrea.exe
  C:\Windows\System\VUZtrea.exe
  2⤵
  PID:4084
- C:\Windows\System\roxhLsx.exe
  C:\Windows\System\roxhLsx.exe
  2⤵
  PID:4200
- C:\Windows\System\fWjBaOr.exe
  C:\Windows\System\fWjBaOr.exe
  2⤵
  PID:4180
- C:\Windows\System\UgacefH.exe
  C:\Windows\System\UgacefH.exe
  2⤵
  PID:4108
- C:\Windows\System\NnxwwVQ.exe
  C:\Windows\System\NnxwwVQ.exe
  2⤵
  PID:4304
- C:\Windows\System\zIdBXsE.exe
  C:\Windows\System\zIdBXsE.exe
  2⤵
  PID:4344
- C:\Windows\System\ZrDtkEX.exe
  C:\Windows\System\ZrDtkEX.exe
  2⤵
  PID:4252
- C:\Windows\System\SVnLDCx.exe
  C:\Windows\System\SVnLDCx.exe
  2⤵
  PID:4356
- C:\Windows\System\xThleAc.exe
  C:\Windows\System\xThleAc.exe
  2⤵
  PID:4284
- C:\Windows\System\CohcznF.exe
  C:\Windows\System\CohcznF.exe
  2⤵
  PID:4360
- C:\Windows\System\nhQwQrm.exe
  C:\Windows\System\nhQwQrm.exe
  2⤵
  PID:4548
- C:\Windows\System\dGVkoxC.exe
  C:\Windows\System\dGVkoxC.exe
  2⤵
  PID:4492
- C:\Windows\System\QIGRIlT.exe
  C:\Windows\System\QIGRIlT.exe
  2⤵
  PID:4600
- C:\Windows\System\tXxGgBs.exe
  C:\Windows\System\tXxGgBs.exe
  2⤵
  PID:4572
- C:\Windows\System\XXsDElR.exe
  C:\Windows\System\XXsDElR.exe
  2⤵
  PID:4644
- C:\Windows\System\VfZMUzJ.exe
  C:\Windows\System\VfZMUzJ.exe
  2⤵
  PID:4536
- C:\Windows\System\JKNKPFU.exe
  C:\Windows\System\JKNKPFU.exe
  2⤵
  PID:4712
- C:\Windows\System\YLFFsEE.exe
  C:\Windows\System\YLFFsEE.exe
  2⤵
  PID:4656
- C:\Windows\System\VpGSaAe.exe
  C:\Windows\System\VpGSaAe.exe
  2⤵
  PID:4700
- C:\Windows\System\zhMyUNf.exe
  C:\Windows\System\zhMyUNf.exe
  2⤵
  PID:4760
- C:\Windows\System\LXIvOeR.exe
  C:\Windows\System\LXIvOeR.exe
  2⤵
  PID:4744
- C:\Windows\System\IiZwAKm.exe
  C:\Windows\System\IiZwAKm.exe
  2⤵
  PID:4820
- C:\Windows\System\vuWdoaD.exe
  C:\Windows\System\vuWdoaD.exe
  2⤵
  PID:4864
- C:\Windows\System\KyDzwMZ.exe
  C:\Windows\System\KyDzwMZ.exe
  2⤵
  PID:4832
- C:\Windows\System\GeWETqc.exe
  C:\Windows\System\GeWETqc.exe
  2⤵
  PID:4908
- C:\Windows\System\eHtehZp.exe
  C:\Windows\System\eHtehZp.exe
  2⤵
  PID:4972
- C:\Windows\System\ZOtQlPu.exe
  C:\Windows\System\ZOtQlPu.exe
  2⤵
  PID:4888
- C:\Windows\System\MjHWSrN.exe
  C:\Windows\System\MjHWSrN.exe
  2⤵
  PID:4956
- C:\Windows\System\eDAKCJB.exe
  C:\Windows\System\eDAKCJB.exe
  2⤵
  PID:5076
- C:\Windows\System\gZKmJtd.exe
  C:\Windows\System\gZKmJtd.exe
  2⤵
  PID:4952
- C:\Windows\System\WSjmXUz.exe
  C:\Windows\System\WSjmXUz.exe
  2⤵
  PID:4336
- C:\Windows\System\NpCdUEk.exe
  C:\Windows\System\NpCdUEk.exe
  2⤵
  PID:4296
- C:\Windows\System\dDyvcOU.exe
  C:\Windows\System\dDyvcOU.exe
  2⤵
  PID:4248
- C:\Windows\System\ddmjTlA.exe
  C:\Windows\System\ddmjTlA.exe
  2⤵
  PID:4480
- C:\Windows\System\lHfxpWR.exe
  C:\Windows\System\lHfxpWR.exe
  2⤵
  PID:4472
- C:\Windows\System\GkNSEVH.exe
  C:\Windows\System\GkNSEVH.exe
  2⤵
  PID:4636
- C:\Windows\System\BzPSWsw.exe
  C:\Windows\System\BzPSWsw.exe
  2⤵
  PID:4776
- C:\Windows\System\gCRxAzm.exe
  C:\Windows\System\gCRxAzm.exe
  2⤵
  PID:4860
- C:\Windows\System\oIuEZbN.exe
  C:\Windows\System\oIuEZbN.exe
  2⤵
  PID:4720
- C:\Windows\System\rGQbkLF.exe
  C:\Windows\System\rGQbkLF.exe
  2⤵
  PID:4504
- C:\Windows\System\BIEjymX.exe
  C:\Windows\System\BIEjymX.exe
  2⤵
  PID:5092
- C:\Windows\System\IVaCgWG.exe
  C:\Windows\System\IVaCgWG.exe
  2⤵
  PID:4988
- C:\Windows\System\SLPsJSU.exe
  C:\Windows\System\SLPsJSU.exe
  2⤵
  PID:5024
- C:\Windows\System\nwLnDxi.exe
  C:\Windows\System\nwLnDxi.exe
  2⤵
  PID:4196
- C:\Windows\System\AfzoPSX.exe
  C:\Windows\System\AfzoPSX.exe
  2⤵
  PID:3852
- C:\Windows\System\CNNbahi.exe
  C:\Windows\System\CNNbahi.exe
  2⤵
  PID:4900
- C:\Windows\System\OwHKdvN.exe
  C:\Windows\System\OwHKdvN.exe
  2⤵
  PID:4172
- C:\Windows\System\PHUCgum.exe
  C:\Windows\System\PHUCgum.exe
  2⤵
  PID:3276
- C:\Windows\System\WyfQvGu.exe
  C:\Windows\System\WyfQvGu.exe
  2⤵
  PID:4184
- C:\Windows\System\SpEudDR.exe
  C:\Windows\System\SpEudDR.exe
  2⤵
  PID:5004
- C:\Windows\System\tzBuBwi.exe
  C:\Windows\System\tzBuBwi.exe
  2⤵
  PID:4920
- C:\Windows\System\nwCkRea.exe
  C:\Windows\System\nwCkRea.exe
  2⤵
  PID:1020
- C:\Windows\System\gLKLTyX.exe
  C:\Windows\System\gLKLTyX.exe
  2⤵
  PID:4696
- C:\Windows\System\YaLSpMW.exe
  C:\Windows\System\YaLSpMW.exe
  2⤵
  PID:4236
- C:\Windows\System\JplnIjh.exe
  C:\Windows\System\JplnIjh.exe
  2⤵
  PID:4156
- C:\Windows\System\GVXwDKR.exe
  C:\Windows\System\GVXwDKR.exe
  2⤵
  PID:4496
- C:\Windows\System\lzHKHBV.exe
  C:\Windows\System\lzHKHBV.exe
  2⤵
  PID:4520
- C:\Windows\System\NcZFJdV.exe
  C:\Windows\System\NcZFJdV.exe
  2⤵
  PID:3508
- C:\Windows\System\AmYgqaS.exe
  C:\Windows\System\AmYgqaS.exe
  2⤵
  PID:5112
- C:\Windows\System\cfAwVLh.exe
  C:\Windows\System\cfAwVLh.exe
  2⤵
  PID:4152
- C:\Windows\System\noMEgEf.exe
  C:\Windows\System\noMEgEf.exe
  2⤵
  PID:4104
- C:\Windows\System\OOTObAM.exe
  C:\Windows\System\OOTObAM.exe
  2⤵
  PID:5080
- C:\Windows\System\PpVZeMV.exe
  C:\Windows\System\PpVZeMV.exe
  2⤵
  PID:4476
- C:\Windows\System\FHncIFI.exe
  C:\Windows\System\FHncIFI.exe
  2⤵
  PID:5128
- C:\Windows\System\GXoaQTy.exe
  C:\Windows\System\GXoaQTy.exe
  2⤵
  PID:5148
- C:\Windows\System\WLWMpDp.exe
  C:\Windows\System\WLWMpDp.exe
  2⤵
  PID:5164
- C:\Windows\System\wmFKlXk.exe
  C:\Windows\System\wmFKlXk.exe
  2⤵
  PID:5184
- C:\Windows\System\smFhidf.exe
  C:\Windows\System\smFhidf.exe
  2⤵
  PID:5200
- C:\Windows\System\mqzalXA.exe
  C:\Windows\System\mqzalXA.exe
  2⤵
  PID:5216
- C:\Windows\System\RKZYTuq.exe
  C:\Windows\System\RKZYTuq.exe
  2⤵
  PID:5232
- C:\Windows\System\yaSWWvs.exe
  C:\Windows\System\yaSWWvs.exe
  2⤵
  PID:5248
- C:\Windows\System\YQZBAEg.exe
  C:\Windows\System\YQZBAEg.exe
  2⤵
  PID:5268
- C:\Windows\System\CBvnldd.exe
  C:\Windows\System\CBvnldd.exe
  2⤵
  PID:5284
- C:\Windows\System\stxeuKw.exe
  C:\Windows\System\stxeuKw.exe
  2⤵
  PID:5300
- C:\Windows\System\psqLLpD.exe
  C:\Windows\System\psqLLpD.exe
  2⤵
  PID:5316
- C:\Windows\System\SLCJmkS.exe
  C:\Windows\System\SLCJmkS.exe
  2⤵
  PID:5340
- C:\Windows\System\QBIZtqy.exe
  C:\Windows\System\QBIZtqy.exe
  2⤵
  PID:5356
- C:\Windows\System\IIraFuk.exe
  C:\Windows\System\IIraFuk.exe
  2⤵
  PID:5372
- C:\Windows\System\lvYRHxO.exe
  C:\Windows\System\lvYRHxO.exe
  2⤵
  PID:5388
- C:\Windows\System\uTsBpKQ.exe
  C:\Windows\System\uTsBpKQ.exe
  2⤵
  PID:5408
- C:\Windows\System\uFkOIPS.exe
  C:\Windows\System\uFkOIPS.exe
  2⤵
  PID:5424
- C:\Windows\System\oNgvesB.exe
  C:\Windows\System\oNgvesB.exe
  2⤵
  PID:5472
- C:\Windows\System\xhHpLwF.exe
  C:\Windows\System\xhHpLwF.exe
  2⤵
  PID:5496
- C:\Windows\System\tmQucEr.exe
  C:\Windows\System\tmQucEr.exe
  2⤵
  PID:5512
- C:\Windows\System\ddszKsc.exe
  C:\Windows\System\ddszKsc.exe
  2⤵
  PID:5528
- C:\Windows\System\lanoleR.exe
  C:\Windows\System\lanoleR.exe
  2⤵
  PID:5544
- C:\Windows\System\jFIqqdK.exe
  C:\Windows\System\jFIqqdK.exe
  2⤵
  PID:5560
- C:\Windows\System\lqKtNON.exe
  C:\Windows\System\lqKtNON.exe
  2⤵
  PID:5576
- C:\Windows\System\fXWEIzX.exe
  C:\Windows\System\fXWEIzX.exe
  2⤵
  PID:5596
- C:\Windows\System\IamdKqD.exe
  C:\Windows\System\IamdKqD.exe
  2⤵
  PID:5612
- C:\Windows\System\csIXaue.exe
  C:\Windows\System\csIXaue.exe
  2⤵
  PID:5636
- C:\Windows\System\IQmatqy.exe
  C:\Windows\System\IQmatqy.exe
  2⤵
  PID:5656
- C:\Windows\System\CJKeWUS.exe
  C:\Windows\System\CJKeWUS.exe
  2⤵
  PID:5716
- C:\Windows\System\xyZlyfJ.exe
  C:\Windows\System\xyZlyfJ.exe
  2⤵
  PID:5732
- C:\Windows\System\UvXVhKq.exe
  C:\Windows\System\UvXVhKq.exe
  2⤵
  PID:5748
- C:\Windows\System\PLLTqFk.exe
  C:\Windows\System\PLLTqFk.exe
  2⤵
  PID:5772
- C:\Windows\System\wkPNYKf.exe
  C:\Windows\System\wkPNYKf.exe
  2⤵
  PID:5792
- C:\Windows\System\tMhRPmE.exe
  C:\Windows\System\tMhRPmE.exe
  2⤵
  PID:5808
- C:\Windows\System\doOcecU.exe
  C:\Windows\System\doOcecU.exe
  2⤵
  PID:5828
- C:\Windows\System\zquKKNZ.exe
  C:\Windows\System\zquKKNZ.exe
  2⤵
  PID:5844
- C:\Windows\System\VRZJTXg.exe
  C:\Windows\System\VRZJTXg.exe
  2⤵
  PID:5860
- C:\Windows\System\FxbwHsQ.exe
  C:\Windows\System\FxbwHsQ.exe
  2⤵
  PID:5880
- C:\Windows\System\xqxfDyH.exe
  C:\Windows\System\xqxfDyH.exe
  2⤵
  PID:5896
- C:\Windows\System\JZHPnRi.exe
  C:\Windows\System\JZHPnRi.exe
  2⤵
  PID:5912
- C:\Windows\System\zKeHuwK.exe
  C:\Windows\System\zKeHuwK.exe
  2⤵
  PID:5928
- C:\Windows\System\xlilHpe.exe
  C:\Windows\System\xlilHpe.exe
  2⤵
  PID:5952
- C:\Windows\System\LbIsCEQ.exe
  C:\Windows\System\LbIsCEQ.exe
  2⤵
  PID:5968
- C:\Windows\System\HIjhRzv.exe
  C:\Windows\System\HIjhRzv.exe
  2⤵
  PID:5988
- C:\Windows\System\xdDDXVw.exe
  C:\Windows\System\xdDDXVw.exe
  2⤵
  PID:6004
- C:\Windows\System\pxDRYPT.exe
  C:\Windows\System\pxDRYPT.exe
  2⤵
  PID:6020
- C:\Windows\System\CFdPPop.exe
  C:\Windows\System\CFdPPop.exe
  2⤵
  PID:6036
- C:\Windows\System\uJhoUIN.exe
  C:\Windows\System\uJhoUIN.exe
  2⤵
  PID:6056
- C:\Windows\System\WXxxyHk.exe
  C:\Windows\System\WXxxyHk.exe
  2⤵
  PID:6072
- C:\Windows\System\rDILNAp.exe
  C:\Windows\System\rDILNAp.exe
  2⤵
  PID:6088
- C:\Windows\System\wTKbfFX.exe
  C:\Windows\System\wTKbfFX.exe
  2⤵
  PID:6104
- C:\Windows\System\VRQbPqM.exe
  C:\Windows\System\VRQbPqM.exe
  2⤵
  PID:6120
- C:\Windows\System\RMlMPAD.exe
  C:\Windows\System\RMlMPAD.exe
  2⤵
  PID:5136
- C:\Windows\System\DHUSwCF.exe
  C:\Windows\System\DHUSwCF.exe
  2⤵
  PID:4968
- C:\Windows\System\cbqWzSo.exe
  C:\Windows\System\cbqWzSo.exe
  2⤵
  PID:5176
- C:\Windows\System\pBYktJq.exe
  C:\Windows\System\pBYktJq.exe
  2⤵
  PID:5212
- C:\Windows\System\mMswVXO.exe
  C:\Windows\System\mMswVXO.exe
  2⤵
  PID:5276
- C:\Windows\System\mmSKSSA.exe
  C:\Windows\System\mmSKSSA.exe
  2⤵
  PID:5192
- C:\Windows\System\JapuKjV.exe
  C:\Windows\System\JapuKjV.exe
  2⤵
  PID:5124
- C:\Windows\System\rnvVQfj.exe
  C:\Windows\System\rnvVQfj.exe
  2⤵
  PID:5156
- C:\Windows\System\MvMEGgS.exe
  C:\Windows\System\MvMEGgS.exe
  2⤵
  PID:5352
- C:\Windows\System\rnrIxzl.exe
  C:\Windows\System\rnrIxzl.exe
  2⤵
  PID:5292
- C:\Windows\System\iwiiKfv.exe
  C:\Windows\System\iwiiKfv.exe
  2⤵
  PID:5332
- C:\Windows\System\diqjhdv.exe
  C:\Windows\System\diqjhdv.exe
  2⤵
  PID:5420
- C:\Windows\System\XiQsUCJ.exe
  C:\Windows\System\XiQsUCJ.exe
  2⤵
  PID:4876
- C:\Windows\System\maCqzWD.exe
  C:\Windows\System\maCqzWD.exe
  2⤵
  PID:5456
- C:\Windows\System\hPAvSSY.exe
  C:\Windows\System\hPAvSSY.exe
  2⤵
  PID:5468
- C:\Windows\System\ixTlFUX.exe
  C:\Windows\System\ixTlFUX.exe
  2⤵
  PID:5556
- C:\Windows\System\ODVrySB.exe
  C:\Windows\System\ODVrySB.exe
  2⤵
  PID:5620
- C:\Windows\System\cPtjFds.exe
  C:\Windows\System\cPtjFds.exe
  2⤵
  PID:5504
- C:\Windows\System\pChKvNy.exe
  C:\Windows\System\pChKvNy.exe
  2⤵
  PID:5540
- C:\Windows\System\quhYYOP.exe
  C:\Windows\System\quhYYOP.exe
  2⤵
  PID:5668
- C:\Windows\System\wjlaSkt.exe
  C:\Windows\System\wjlaSkt.exe
  2⤵
  PID:5652
- C:\Windows\System\HMAewQg.exe
  C:\Windows\System\HMAewQg.exe
  2⤵
  PID:5696
- C:\Windows\System\AVWjbyf.exe
  C:\Windows\System\AVWjbyf.exe
  2⤵
  PID:5724
- C:\Windows\System\uRVoZqQ.exe
  C:\Windows\System\uRVoZqQ.exe
  2⤵
  PID:5800
- C:\Windows\System\vXObgaO.exe
  C:\Windows\System\vXObgaO.exe
  2⤵
  PID:5740
- C:\Windows\System\foeephn.exe
  C:\Windows\System\foeephn.exe
  2⤵
  PID:5852
- C:\Windows\System\hcEpnYN.exe
  C:\Windows\System\hcEpnYN.exe
  2⤵
  PID:5784
- C:\Windows\System\OPsigzu.exe
  C:\Windows\System\OPsigzu.exe
  2⤵
  PID:5876
- C:\Windows\System\MENiuao.exe
  C:\Windows\System\MENiuao.exe
  2⤵
  PID:5944
- C:\Windows\System\WEhMQLP.exe
  C:\Windows\System\WEhMQLP.exe
  2⤵
  PID:6012
- C:\Windows\System\MAicuDv.exe
  C:\Windows\System\MAicuDv.exe
  2⤵
  PID:5924
- C:\Windows\System\kdoAUKT.exe
  C:\Windows\System\kdoAUKT.exe
  2⤵
  PID:5920
- C:\Windows\System\pYaCaZM.exe
  C:\Windows\System\pYaCaZM.exe
  2⤵
  PID:6084
- C:\Windows\System\iwyYfMk.exe
  C:\Windows\System\iwyYfMk.exe
  2⤵
  PID:6068
- C:\Windows\System\IqNCRQZ.exe
  C:\Windows\System\IqNCRQZ.exe
  2⤵
  PID:6096
- C:\Windows\System\YJfcQvD.exe
  C:\Windows\System\YJfcQvD.exe
  2⤵
  PID:6116
- C:\Windows\System\nkQRCRB.exe
  C:\Windows\System\nkQRCRB.exe
  2⤵
  PID:4088
- C:\Windows\System\UYVXcEn.exe
  C:\Windows\System\UYVXcEn.exe
  2⤵
  PID:5060
- C:\Windows\System\zhkGxKE.exe
  C:\Windows\System\zhkGxKE.exe
  2⤵
  PID:4564
- C:\Windows\System\CHYxhFd.exe
  C:\Windows\System\CHYxhFd.exe
  2⤵
  PID:4320
- C:\Windows\System\YJoJKqM.exe
  C:\Windows\System\YJoJKqM.exe
  2⤵
  PID:4340
- C:\Windows\System\FvZyikM.exe
  C:\Windows\System\FvZyikM.exe
  2⤵
  PID:5256
- C:\Windows\System\gmuWyHb.exe
  C:\Windows\System\gmuWyHb.exe
  2⤵
  PID:5416
- C:\Windows\System\mpxdBME.exe
  C:\Windows\System\mpxdBME.exe
  2⤵
  PID:5452
- C:\Windows\System\PdmfrQe.exe
  C:\Windows\System\PdmfrQe.exe
  2⤵
  PID:5768
- C:\Windows\System\OlaCDrc.exe
  C:\Windows\System\OlaCDrc.exe
  2⤵
  PID:5632
- C:\Windows\System\qEZDsPC.exe
  C:\Windows\System\qEZDsPC.exe
  2⤵
  PID:5700
- C:\Windows\System\iadWoJw.exe
  C:\Windows\System\iadWoJw.exe
  2⤵
  PID:5888
- C:\Windows\System\wdvIxxG.exe
  C:\Windows\System\wdvIxxG.exe
  2⤵
  PID:6032
- C:\Windows\System\yLLoFWZ.exe
  C:\Windows\System\yLLoFWZ.exe
  2⤵
  PID:3524
- C:\Windows\System\XiifAch.exe
  C:\Windows\System\XiifAch.exe
  2⤵
  PID:6128
- C:\Windows\System\XUzonJb.exe
  C:\Windows\System\XUzonJb.exe
  2⤵
  PID:6000
- C:\Windows\System\kIZkVcU.exe
  C:\Windows\System\kIZkVcU.exe
  2⤵
  PID:6136
- C:\Windows\System\QWIeNrj.exe
  C:\Windows\System\QWIeNrj.exe
  2⤵
  PID:5144
- C:\Windows\System\seKcafU.exe
  C:\Windows\System\seKcafU.exe
  2⤵
  PID:5364
- C:\Windows\System\ymeJIht.exe
  C:\Windows\System\ymeJIht.exe
  2⤵
  PID:5072
- C:\Windows\System\pYiFjPz.exe
  C:\Windows\System\pYiFjPz.exe
  2⤵
  PID:4392
- C:\Windows\System\shfLVGk.exe
  C:\Windows\System\shfLVGk.exe
  2⤵
  PID:5824
- C:\Windows\System\HIGvVhS.exe
  C:\Windows\System\HIGvVhS.exe
  2⤵
  PID:5584
- C:\Windows\System\sKwJnnj.exe
  C:\Windows\System\sKwJnnj.exe
  2⤵
  PID:5628
- C:\Windows\System\xrECrBy.exe
  C:\Windows\System\xrECrBy.exe
  2⤵
  PID:5688
- C:\Windows\System\mbTGxhN.exe
  C:\Windows\System\mbTGxhN.exe
  2⤵
  PID:5760
- C:\Windows\System\MGFVXoW.exe
  C:\Windows\System\MGFVXoW.exe
  2⤵
  PID:5840
- C:\Windows\System\admNZrk.exe
  C:\Windows\System\admNZrk.exe
  2⤵
  PID:6112
- C:\Windows\System\UKbEblY.exe
  C:\Windows\System\UKbEblY.exe
  2⤵
  PID:5308
- C:\Windows\System\GLlOWfq.exe
  C:\Windows\System\GLlOWfq.exe
  2⤵
  PID:5872
- C:\Windows\System\VTjeNRY.exe
  C:\Windows\System\VTjeNRY.exe
  2⤵
  PID:5764
- C:\Windows\System\JEllFyu.exe
  C:\Windows\System\JEllFyu.exe
  2⤵
  PID:6132
- C:\Windows\System\DFLLRhV.exe
  C:\Windows\System\DFLLRhV.exe
  2⤵
  PID:5836
- C:\Windows\System\BehBYTk.exe
  C:\Windows\System\BehBYTk.exe
  2⤵
  PID:5984
- C:\Windows\System\OxEyEzD.exe
  C:\Windows\System\OxEyEzD.exe
  2⤵
  PID:5624
- C:\Windows\System\ZRBdQJm.exe
  C:\Windows\System\ZRBdQJm.exe
  2⤵
  PID:4324
- C:\Windows\System\zYyWwMX.exe
  C:\Windows\System\zYyWwMX.exe
  2⤵
  PID:5572
- C:\Windows\System\zgQyFIN.exe
  C:\Windows\System\zgQyFIN.exe
  2⤵
  PID:6156
- C:\Windows\System\jHvCqSS.exe
  C:\Windows\System\jHvCqSS.exe
  2⤵
  PID:6176
- C:\Windows\System\CeHuMmO.exe
  C:\Windows\System\CeHuMmO.exe
  2⤵
  PID:6192
- C:\Windows\System\EEKOuLb.exe
  C:\Windows\System\EEKOuLb.exe
  2⤵
  PID:6208
- C:\Windows\System\tERiNlO.exe
  C:\Windows\System\tERiNlO.exe
  2⤵
  PID:6224
- C:\Windows\System\tHNlWbM.exe
  C:\Windows\System\tHNlWbM.exe
  2⤵
  PID:6252
- C:\Windows\System\qSwUBmx.exe
  C:\Windows\System\qSwUBmx.exe
  2⤵
  PID:6268
- C:\Windows\System\zKaPMwX.exe
  C:\Windows\System\zKaPMwX.exe
  2⤵
  PID:6288
- C:\Windows\System\DDzztyM.exe
  C:\Windows\System\DDzztyM.exe
  2⤵
  PID:6304
- C:\Windows\System\mNmEleh.exe
  C:\Windows\System\mNmEleh.exe
  2⤵
  PID:6320
- C:\Windows\System\VRyTpXR.exe
  C:\Windows\System\VRyTpXR.exe
  2⤵
  PID:6336
- C:\Windows\System\JQtlqQt.exe
  C:\Windows\System\JQtlqQt.exe
  2⤵
  PID:6352
- C:\Windows\System\tIKxKaC.exe
  C:\Windows\System\tIKxKaC.exe
  2⤵
  PID:6368
- C:\Windows\System\jaaHafG.exe
  C:\Windows\System\jaaHafG.exe
  2⤵
  PID:6388
- C:\Windows\System\UmctvDS.exe
  C:\Windows\System\UmctvDS.exe
  2⤵
  PID:6412
- C:\Windows\System\MbTAeqL.exe
  C:\Windows\System\MbTAeqL.exe
  2⤵
  PID:6432
- C:\Windows\System\bQuCmCJ.exe
  C:\Windows\System\bQuCmCJ.exe
  2⤵
  PID:6448
- C:\Windows\System\vsqMPXw.exe
  C:\Windows\System\vsqMPXw.exe
  2⤵
  PID:6464
- C:\Windows\System\fixJZIU.exe
  C:\Windows\System\fixJZIU.exe
  2⤵
  PID:6480
- C:\Windows\System\RSTECUh.exe
  C:\Windows\System\RSTECUh.exe
  2⤵
  PID:6496
- C:\Windows\System\GpaPiSn.exe
  C:\Windows\System\GpaPiSn.exe
  2⤵
  PID:6516
- C:\Windows\System\QjJIfWc.exe
  C:\Windows\System\QjJIfWc.exe
  2⤵
  PID:6536
- C:\Windows\System\uhaijAR.exe
  C:\Windows\System\uhaijAR.exe
  2⤵
  PID:6552
- C:\Windows\System\etYzjeW.exe
  C:\Windows\System\etYzjeW.exe
  2⤵
  PID:6568
- C:\Windows\System\fPKNALp.exe
  C:\Windows\System\fPKNALp.exe
  2⤵
  PID:6588
- C:\Windows\System\wBlrrXh.exe
  C:\Windows\System\wBlrrXh.exe
  2⤵
  PID:6604
- C:\Windows\System\TAtIOJB.exe
  C:\Windows\System\TAtIOJB.exe
  2⤵
  PID:6628
- C:\Windows\System\cIviLAb.exe
  C:\Windows\System\cIviLAb.exe
  2⤵
  PID:6644
- C:\Windows\System\OuMQJBI.exe
  C:\Windows\System\OuMQJBI.exe
  2⤵
  PID:6664
- C:\Windows\System\KCRuvJq.exe
  C:\Windows\System\KCRuvJq.exe
  2⤵
  PID:6680
- C:\Windows\System\OAleFgF.exe
  C:\Windows\System\OAleFgF.exe
  2⤵
  PID:6696
- C:\Windows\System\hKsCDoj.exe
  C:\Windows\System\hKsCDoj.exe
  2⤵
  PID:6712
- C:\Windows\System\lEfirue.exe
  C:\Windows\System\lEfirue.exe
  2⤵
  PID:6728
- C:\Windows\System\yTtdEct.exe
  C:\Windows\System\yTtdEct.exe
  2⤵
  PID:6744
- C:\Windows\System\xSlwvoW.exe
  C:\Windows\System\xSlwvoW.exe
  2⤵
  PID:6760
- C:\Windows\System\bFWdUAz.exe
  C:\Windows\System\bFWdUAz.exe
  2⤵
  PID:6776
- C:\Windows\System\KHDesgK.exe
  C:\Windows\System\KHDesgK.exe
  2⤵
  PID:6792
- C:\Windows\System\nYyXsgq.exe
  C:\Windows\System\nYyXsgq.exe
  2⤵
  PID:6824
- C:\Windows\System\HAErKhE.exe
  C:\Windows\System\HAErKhE.exe
  2⤵
  PID:6844
- C:\Windows\System\UWDdOfZ.exe
  C:\Windows\System\UWDdOfZ.exe
  2⤵
  PID:6860
- C:\Windows\System\fmDMEyF.exe
  C:\Windows\System\fmDMEyF.exe
  2⤵
  PID:6876
- C:\Windows\System\nPjrahx.exe
  C:\Windows\System\nPjrahx.exe
  2⤵
  PID:6892
- C:\Windows\System\mukROum.exe
  C:\Windows\System\mukROum.exe
  2⤵
  PID:6912
- C:\Windows\System\ChZpNdx.exe
  C:\Windows\System\ChZpNdx.exe
  2⤵
  PID:6928
- C:\Windows\System\UeSnMdd.exe
  C:\Windows\System\UeSnMdd.exe
  2⤵
  PID:6948
- C:\Windows\System\hhGdYTC.exe
  C:\Windows\System\hhGdYTC.exe
  2⤵
  PID:6964
- C:\Windows\System\jxgwniY.exe
  C:\Windows\System\jxgwniY.exe
  2⤵
  PID:6988
- C:\Windows\System\fdsxTge.exe
  C:\Windows\System\fdsxTge.exe
  2⤵
  PID:7004
- C:\Windows\System\LgoeYPE.exe
  C:\Windows\System\LgoeYPE.exe
  2⤵
  PID:7024
- C:\Windows\System\KAyViKc.exe
  C:\Windows\System\KAyViKc.exe
  2⤵
  PID:7040
- C:\Windows\System\LEvwbsk.exe
  C:\Windows\System\LEvwbsk.exe
  2⤵
  PID:7056
- C:\Windows\System\YnQoflG.exe
  C:\Windows\System\YnQoflG.exe
  2⤵
  PID:7072
- C:\Windows\System\TBKBaxL.exe
  C:\Windows\System\TBKBaxL.exe
  2⤵
  PID:7088
- C:\Windows\System\gRGvdpR.exe
  C:\Windows\System\gRGvdpR.exe
  2⤵
  PID:7108
- C:\Windows\System\JeyCDCA.exe
  C:\Windows\System\JeyCDCA.exe
  2⤵
  PID:7132
- C:\Windows\System\lttfICW.exe
  C:\Windows\System\lttfICW.exe
  2⤵
  PID:7148
- C:\Windows\System\RPwrmpr.exe
  C:\Windows\System\RPwrmpr.exe
  2⤵
  PID:7164
- C:\Windows\System\kJvNAvF.exe
  C:\Windows\System\kJvNAvF.exe
  2⤵
  PID:6184
- C:\Windows\System\czoHXtZ.exe
  C:\Windows\System\czoHXtZ.exe
  2⤵
  PID:5936
- C:\Windows\System\rBqKDKM.exe
  C:\Windows\System\rBqKDKM.exe
  2⤵
  PID:6264
- C:\Windows\System\TMXfZQp.exe
  C:\Windows\System\TMXfZQp.exe
  2⤵
  PID:6236
- C:\Windows\System\nUDyJox.exe
  C:\Windows\System\nUDyJox.exe
  2⤵
  PID:6328
- C:\Windows\System\MUicfwu.exe
  C:\Windows\System\MUicfwu.exe
  2⤵
  PID:5096
- C:\Windows\System\lCUGeYN.exe
  C:\Windows\System\lCUGeYN.exe
  2⤵
  PID:6200
- C:\Windows\System\LouZXrB.exe
  C:\Windows\System\LouZXrB.exe
  2⤵
  PID:6364
- C:\Windows\System\CJHVWhP.exe
  C:\Windows\System\CJHVWhP.exe
  2⤵
  PID:6280
- C:\Windows\System\TxBtkVY.exe
  C:\Windows\System\TxBtkVY.exe
  2⤵
  PID:6408
- C:\Windows\System\CWcBqCI.exe
  C:\Windows\System\CWcBqCI.exe
  2⤵
  PID:6348
- C:\Windows\System\KbPtrEH.exe
  C:\Windows\System\KbPtrEH.exe
  2⤵
  PID:6472
- C:\Windows\System\irKLvFS.exe
  C:\Windows\System\irKLvFS.exe
  2⤵
  PID:6512
- C:\Windows\System\FssVhHn.exe
  C:\Windows\System\FssVhHn.exe
  2⤵
  PID:6548
- C:\Windows\System\GKmZFeS.exe
  C:\Windows\System\GKmZFeS.exe
  2⤵
  PID:6460
- C:\Windows\System\aryDQpU.exe
  C:\Windows\System\aryDQpU.exe
  2⤵
  PID:6532
- C:\Windows\System\GFDJfEJ.exe
  C:\Windows\System\GFDJfEJ.exe
  2⤵
  PID:6612
- C:\Windows\System\TroPNNy.exe
  C:\Windows\System\TroPNNy.exe
  2⤵
  PID:6652
- C:\Windows\System\vSOcrWA.exe
  C:\Windows\System\vSOcrWA.exe
  2⤵
  PID:6720
- C:\Windows\System\VCErNUs.exe
  C:\Windows\System\VCErNUs.exe
  2⤵
  PID:6784
- C:\Windows\System\fnMMLjQ.exe
  C:\Windows\System\fnMMLjQ.exe
  2⤵
  PID:6640
- C:\Windows\System\kPSSeZe.exe
  C:\Windows\System\kPSSeZe.exe
  2⤵
  PID:6672
- C:\Windows\System\rJibsFh.exe
  C:\Windows\System\rJibsFh.exe
  2⤵
  PID:6740
- C:\Windows\System\WbojKsf.exe
  C:\Windows\System\WbojKsf.exe
  2⤵
  PID:6840
- C:\Windows\System\YxAJvGd.exe
  C:\Windows\System\YxAJvGd.exe
  2⤵
  PID:6900
- C:\Windows\System\sKbLwMN.exe
  C:\Windows\System\sKbLwMN.exe
  2⤵
  PID:6820
- C:\Windows\System\jwdmFeR.exe
  C:\Windows\System\jwdmFeR.exe
  2⤵
  PID:6920
- C:\Windows\System\BPahIoX.exe
  C:\Windows\System\BPahIoX.exe
  2⤵
  PID:6852
- C:\Windows\System\cuCtOIh.exe
  C:\Windows\System\cuCtOIh.exe
  2⤵
  PID:7016
- C:\Windows\System\KbUJXtc.exe
  C:\Windows\System\KbUJXtc.exe
  2⤵
  PID:7052
- C:\Windows\System\WnJPLbI.exe
  C:\Windows\System\WnJPLbI.exe
  2⤵
  PID:7128
- C:\Windows\System\ARzWbId.exe
  C:\Windows\System\ARzWbId.exe
  2⤵
  PID:7160
- C:\Windows\System\qWEgSVD.exe
  C:\Windows\System\qWEgSVD.exe
  2⤵
  PID:7144
- C:\Windows\System\jPIkxwW.exe
  C:\Windows\System\jPIkxwW.exe
  2⤵
  PID:7068
- C:\Windows\System\tgowqGr.exe
  C:\Windows\System\tgowqGr.exe
  2⤵
  PID:6216
- C:\Windows\System\XbiTfdl.exe
  C:\Windows\System\XbiTfdl.exe
  2⤵
  PID:6232
- C:\Windows\System\mXPauJX.exe
  C:\Windows\System\mXPauJX.exe
  2⤵
  PID:6504
- C:\Windows\System\RSKCgyG.exe
  C:\Windows\System\RSKCgyG.exe
  2⤵
  PID:6384
- C:\Windows\System\XBLWTBg.exe
  C:\Windows\System\XBLWTBg.exe
  2⤵
  PID:6544
- C:\Windows\System\pkWQmVT.exe
  C:\Windows\System\pkWQmVT.exe
  2⤵
  PID:5820
- C:\Windows\System\edufKUI.exe
  C:\Windows\System\edufKUI.exe
  2⤵
  PID:6260
- C:\Windows\System\nrREfOn.exe
  C:\Windows\System\nrREfOn.exe
  2⤵
  PID:6636
- C:\Windows\System\etbQLVM.exe
  C:\Windows\System\etbQLVM.exe
  2⤵
  PID:6164
- C:\Windows\System\gvyAEgQ.exe
  C:\Windows\System\gvyAEgQ.exe
  2⤵
  PID:6316
- C:\Windows\System\MvIIbnv.exe
  C:\Windows\System\MvIIbnv.exe
  2⤵
  PID:6440
- C:\Windows\System\XLZooFd.exe
  C:\Windows\System\XLZooFd.exe
  2⤵
  PID:6424
- C:\Windows\System\ulbAgVE.exe
  C:\Windows\System\ulbAgVE.exe
  2⤵
  PID:6688
- C:\Windows\System\csdxdzt.exe
  C:\Windows\System\csdxdzt.exe
  2⤵
  PID:6940
- C:\Windows\System\OeYlvmC.exe
  C:\Windows\System\OeYlvmC.exe
  2⤵
  PID:6708
- C:\Windows\System\Mbnczdd.exe
  C:\Windows\System\Mbnczdd.exe
  2⤵
  PID:6884
- C:\Windows\System\AazvEjJ.exe
  C:\Windows\System\AazvEjJ.exe
  2⤵
  PID:7036
- C:\Windows\System\HLTWKao.exe
  C:\Windows\System\HLTWKao.exe
  2⤵
  PID:6996
- C:\Windows\System\HkyOQaM.exe
  C:\Windows\System\HkyOQaM.exe
  2⤵
  PID:6560
- C:\Windows\System\WiRadvw.exe
  C:\Windows\System\WiRadvw.exe
  2⤵
  PID:7140
- C:\Windows\System\bftXsuz.exe
  C:\Windows\System\bftXsuz.exe
  2⤵
  PID:6360
- C:\Windows\System\XbWKhGf.exe
  C:\Windows\System\XbWKhGf.exe
  2⤵
  PID:6488
- C:\Windows\System\AeVCgjr.exe
  C:\Windows\System\AeVCgjr.exe
  2⤵
  PID:6976
- C:\Windows\System\OAsnBaF.exe
  C:\Windows\System\OAsnBaF.exe
  2⤵
  PID:6868
- C:\Windows\System\ofWegLR.exe
  C:\Windows\System\ofWegLR.exe
  2⤵
  PID:6888
- C:\Windows\System\LEfeGCy.exe
  C:\Windows\System\LEfeGCy.exe
  2⤵
  PID:7120
- C:\Windows\System\YLXipnD.exe
  C:\Windows\System\YLXipnD.exe
  2⤵
  PID:7104
- C:\Windows\System\qZlJRqW.exe
  C:\Windows\System\qZlJRqW.exe
  2⤵
  PID:6580
- C:\Windows\System\wLtEhCt.exe
  C:\Windows\System\wLtEhCt.exe
  2⤵
  PID:7064
- C:\Windows\System\wLAFItX.exe
  C:\Windows\System\wLAFItX.exe
  2⤵
  PID:6276
- C:\Windows\System\xAFnHRj.exe
  C:\Windows\System\xAFnHRj.exe
  2⤵
  PID:6564
- C:\Windows\System\UJLpLOX.exe
  C:\Windows\System\UJLpLOX.exe
  2⤵
  PID:6444
- C:\Windows\System\wVrfvkC.exe
  C:\Windows\System\wVrfvkC.exe
  2⤵
  PID:7180
- C:\Windows\System\uTJETcg.exe
  C:\Windows\System\uTJETcg.exe
  2⤵
  PID:7196
- C:\Windows\System\xnIGzPN.exe
  C:\Windows\System\xnIGzPN.exe
  2⤵
  PID:7212
- C:\Windows\System\VCmlbWz.exe
  C:\Windows\System\VCmlbWz.exe
  2⤵
  PID:7228
- C:\Windows\System\oqFetro.exe
  C:\Windows\System\oqFetro.exe
  2⤵
  PID:7244
- C:\Windows\System\kYllUPw.exe
  C:\Windows\System\kYllUPw.exe
  2⤵
  PID:7272
- C:\Windows\System\zsmjyHM.exe
  C:\Windows\System\zsmjyHM.exe
  2⤵
  PID:7288
- C:\Windows\System\DEAKXWN.exe
  C:\Windows\System\DEAKXWN.exe
  2⤵
  PID:7304
- C:\Windows\System\nwwQoGM.exe
  C:\Windows\System\nwwQoGM.exe
  2⤵
  PID:7320
- C:\Windows\System\oAQjuCs.exe
  C:\Windows\System\oAQjuCs.exe
  2⤵
  PID:7336
- C:\Windows\System\HalWjco.exe
  C:\Windows\System\HalWjco.exe
  2⤵
  PID:7356
- C:\Windows\System\pUbhxtf.exe
  C:\Windows\System\pUbhxtf.exe
  2⤵
  PID:7372
- C:\Windows\System\ogJavrP.exe
  C:\Windows\System\ogJavrP.exe
  2⤵
  PID:7388
- C:\Windows\System\CrmAQVL.exe
  C:\Windows\System\CrmAQVL.exe
  2⤵
  PID:7404
- C:\Windows\System\TOOkEFf.exe
  C:\Windows\System\TOOkEFf.exe
  2⤵
  PID:7420
- C:\Windows\System\SsXYjJi.exe
  C:\Windows\System\SsXYjJi.exe
  2⤵
  PID:7448
- C:\Windows\System\JmghjhG.exe
  C:\Windows\System\JmghjhG.exe
  2⤵
  PID:7468
- C:\Windows\System\DqcrkVE.exe
  C:\Windows\System\DqcrkVE.exe
  2⤵
  PID:7484
- C:\Windows\System\CEHeWEp.exe
  C:\Windows\System\CEHeWEp.exe
  2⤵
  PID:7500
- C:\Windows\System\qPvFtaS.exe
  C:\Windows\System\qPvFtaS.exe
  2⤵
  PID:7520
- C:\Windows\System\oIlBXhc.exe
  C:\Windows\System\oIlBXhc.exe
  2⤵
  PID:7536
- C:\Windows\System\CKmNovb.exe
  C:\Windows\System\CKmNovb.exe
  2⤵
  PID:7552
- C:\Windows\System\rnxRbkj.exe
  C:\Windows\System\rnxRbkj.exe
  2⤵
  PID:7572
- C:\Windows\System\hISLClB.exe
  C:\Windows\System\hISLClB.exe
  2⤵
  PID:7592
- C:\Windows\System\gBpcKXg.exe
  C:\Windows\System\gBpcKXg.exe
  2⤵
  PID:7608
- C:\Windows\System\hHZFzWF.exe
  C:\Windows\System\hHZFzWF.exe
  2⤵
  PID:7624
- C:\Windows\System\YQYqrnM.exe
  C:\Windows\System\YQYqrnM.exe
  2⤵
  PID:7640
- C:\Windows\System\ofFwcTA.exe
  C:\Windows\System\ofFwcTA.exe
  2⤵
  PID:7676
- C:\Windows\System\psdmEDU.exe
  C:\Windows\System\psdmEDU.exe
  2⤵
  PID:7692
- C:\Windows\System\SHWQAnt.exe
  C:\Windows\System\SHWQAnt.exe
  2⤵
  PID:7708
- C:\Windows\System\Lgvvdje.exe
  C:\Windows\System\Lgvvdje.exe
  2⤵
  PID:7724
- C:\Windows\System\DGdAqpO.exe
  C:\Windows\System\DGdAqpO.exe
  2⤵
  PID:7740
- C:\Windows\System\GEZqYRX.exe
  C:\Windows\System\GEZqYRX.exe
  2⤵
  PID:7756
- C:\Windows\System\NdsBJVg.exe
  C:\Windows\System\NdsBJVg.exe
  2⤵
  PID:7772
- C:\Windows\System\xIWPICv.exe
  C:\Windows\System\xIWPICv.exe
  2⤵
  PID:7788
- C:\Windows\System\RmCJgEf.exe
  C:\Windows\System\RmCJgEf.exe
  2⤵
  PID:7820
- C:\Windows\System\oqWxXex.exe
  C:\Windows\System\oqWxXex.exe
  2⤵
  PID:7836
- C:\Windows\System\qQROIiz.exe
  C:\Windows\System\qQROIiz.exe
  2⤵
  PID:7852
- C:\Windows\System\AZjooxk.exe
  C:\Windows\System\AZjooxk.exe
  2⤵
  PID:7868
- C:\Windows\System\SoDZlmg.exe
  C:\Windows\System\SoDZlmg.exe
  2⤵
  PID:7884
- C:\Windows\System\OAOsAoo.exe
  C:\Windows\System\OAOsAoo.exe
  2⤵
  PID:7912
- C:\Windows\System\oxhtZUM.exe
  C:\Windows\System\oxhtZUM.exe
  2⤵
  PID:7936
- C:\Windows\System\NPXBgcC.exe
  C:\Windows\System\NPXBgcC.exe
  2⤵
  PID:7952
- C:\Windows\System\YoaXSkg.exe
  C:\Windows\System\YoaXSkg.exe
  2⤵
  PID:7968
- C:\Windows\System\vCWTuWh.exe
  C:\Windows\System\vCWTuWh.exe
  2⤵
  PID:7984
- C:\Windows\System\uJLeRiX.exe
  C:\Windows\System\uJLeRiX.exe
  2⤵
  PID:8000
- C:\Windows\System\fmfuxro.exe
  C:\Windows\System\fmfuxro.exe
  2⤵
  PID:8076
- C:\Windows\System\zpWfmJG.exe
  C:\Windows\System\zpWfmJG.exe
  2⤵
  PID:8092
- C:\Windows\System\KvOJUop.exe
  C:\Windows\System\KvOJUop.exe
  2⤵
  PID:8108
- C:\Windows\System\UFTHVfA.exe
  C:\Windows\System\UFTHVfA.exe
  2⤵
  PID:8124
- C:\Windows\System\UXHwiSF.exe
  C:\Windows\System\UXHwiSF.exe
  2⤵
  PID:8148
- C:\Windows\System\XsCOgsh.exe
  C:\Windows\System\XsCOgsh.exe
  2⤵
  PID:8164
- C:\Windows\System\dbeNMKF.exe
  C:\Windows\System\dbeNMKF.exe
  2⤵
  PID:8180
- C:\Windows\System\KeRuoLN.exe
  C:\Windows\System\KeRuoLN.exe
  2⤵
  PID:6584
- C:\Windows\System\klXpnjU.exe
  C:\Windows\System\klXpnjU.exe
  2⤵
  PID:6804
- C:\Windows\System\plSzCmI.exe
  C:\Windows\System\plSzCmI.exe
  2⤵
  PID:7220
- C:\Windows\System\MyYZgWs.exe
  C:\Windows\System\MyYZgWs.exe
  2⤵
  PID:6404
- C:\Windows\System\UJghTZq.exe
  C:\Windows\System\UJghTZq.exe
  2⤵
  PID:7176
- C:\Windows\System\IpJhrPY.exe
  C:\Windows\System\IpJhrPY.exe
  2⤵
  PID:7328
- C:\Windows\System\hhsjLds.exe
  C:\Windows\System\hhsjLds.exe
  2⤵
  PID:6944
- C:\Windows\System\tadMRiJ.exe
  C:\Windows\System\tadMRiJ.exe
  2⤵
  PID:7380
- C:\Windows\System\IXJAkLS.exe
  C:\Windows\System\IXJAkLS.exe
  2⤵
  PID:7344
- C:\Windows\System\YZfAKbG.exe
  C:\Windows\System\YZfAKbG.exe
  2⤵
  PID:7412
- C:\Windows\System\gMEkKIh.exe
  C:\Windows\System\gMEkKIh.exe
  2⤵
  PID:7364
- C:\Windows\System\FNhvxcI.exe
  C:\Windows\System\FNhvxcI.exe
  2⤵
  PID:7428
- C:\Windows\System\coubxkP.exe
  C:\Windows\System\coubxkP.exe
  2⤵
  PID:7464
- C:\Windows\System\GFqcwjR.exe
  C:\Windows\System\GFqcwjR.exe
  2⤵
  PID:7632
- C:\Windows\System\lIhFvXS.exe
  C:\Windows\System\lIhFvXS.exe
  2⤵
  PID:7564
- C:\Windows\System\iLhYDWI.exe
  C:\Windows\System\iLhYDWI.exe
  2⤵
  PID:7652
- C:\Windows\System\ccOCCJh.exe
  C:\Windows\System\ccOCCJh.exe
  2⤵
  PID:7700
- C:\Windows\System\ChUbyhP.exe
  C:\Windows\System\ChUbyhP.exe
  2⤵
  PID:7764
- C:\Windows\System\oClCYVh.exe
  C:\Windows\System\oClCYVh.exe
  2⤵
  PID:7684
- C:\Windows\System\BpVUUzz.exe
  C:\Windows\System\BpVUUzz.exe
  2⤵
  PID:7812
- C:\Windows\System\uKpnZbi.exe
  C:\Windows\System\uKpnZbi.exe
  2⤵
  PID:7720
- C:\Windows\System\BhkmVpd.exe
  C:\Windows\System\BhkmVpd.exe
  2⤵
  PID:7860
- C:\Windows\System\wuaHaOw.exe
  C:\Windows\System\wuaHaOw.exe
  2⤵
  PID:7844
- C:\Windows\System\oPwiJMM.exe
  C:\Windows\System\oPwiJMM.exe
  2⤵
  PID:7264
- C:\Windows\System\xPAWTXF.exe
  C:\Windows\System\xPAWTXF.exe
  2⤵
  PID:7996
- C:\Windows\System\bmhzqGd.exe
  C:\Windows\System\bmhzqGd.exe
  2⤵
  PID:8088
- C:\Windows\System\NJvFbWV.exe
  C:\Windows\System\NJvFbWV.exe
  2⤵
  PID:8160
- C:\Windows\System\rPHpdaf.exe
  C:\Windows\System\rPHpdaf.exe
  2⤵
  PID:8188
- C:\Windows\System\LvsmLiF.exe
  C:\Windows\System\LvsmLiF.exe
  2⤵
  PID:7896
- C:\Windows\System\JsLtUTy.exe
  C:\Windows\System\JsLtUTy.exe
  2⤵
  PID:7976
- C:\Windows\System\igPyUyM.exe
  C:\Windows\System\igPyUyM.exe
  2⤵
  PID:8032
- C:\Windows\System\rFbqJnF.exe
  C:\Windows\System\rFbqJnF.exe
  2⤵
  PID:8052
- C:\Windows\System\BlaQUxf.exe
  C:\Windows\System\BlaQUxf.exe
  2⤵
  PID:8100
- C:\Windows\System\XLZUPSS.exe
  C:\Windows\System\XLZUPSS.exe
  2⤵
  PID:8132
- C:\Windows\System\uznTFwf.exe
  C:\Windows\System\uznTFwf.exe
  2⤵
  PID:6204
- C:\Windows\System\GSKokRa.exe
  C:\Windows\System\GSKokRa.exe
  2⤵
  PID:6984
- C:\Windows\System\IJfsiYf.exe
  C:\Windows\System\IJfsiYf.exe
  2⤵
  PID:7316
- C:\Windows\System\gqXzeLq.exe
  C:\Windows\System\gqXzeLq.exe
  2⤵
  PID:7440
- C:\Windows\System\QwNhsbJ.exe
  C:\Windows\System\QwNhsbJ.exe
  2⤵
  PID:7476
- C:\Windows\System\lZQPtHp.exe
  C:\Windows\System\lZQPtHp.exe
  2⤵
  PID:7516
- C:\Windows\System\XMlzvbY.exe
  C:\Windows\System\XMlzvbY.exe
  2⤵
  PID:7580
- C:\Windows\System\pDUlYpN.exe
  C:\Windows\System\pDUlYpN.exe
  2⤵
  PID:7656
- C:\Windows\System\rAyiiQh.exe
  C:\Windows\System\rAyiiQh.exe
  2⤵
  PID:7808
- C:\Windows\System\PzURbVC.exe
  C:\Windows\System\PzURbVC.exe
  2⤵
  PID:7736
- C:\Windows\System\apgGLxk.exe
  C:\Windows\System\apgGLxk.exe
  2⤵
  PID:7460
- C:\Windows\System\wYigMpe.exe
  C:\Windows\System\wYigMpe.exe
  2⤵
  PID:7800
- C:\Windows\System\cQkOcND.exe
  C:\Windows\System\cQkOcND.exe
  2⤵
  PID:7544
- C:\Windows\System\iccyYeU.exe
  C:\Windows\System\iccyYeU.exe
  2⤵
  PID:7352
- C:\Windows\System\ngyojpm.exe
  C:\Windows\System\ngyojpm.exe
  2⤵
  PID:7876
- C:\Windows\System\Ejmnfop.exe
  C:\Windows\System\Ejmnfop.exe
  2⤵
  PID:7172
- C:\Windows\System\KYKWRTo.exe
  C:\Windows\System\KYKWRTo.exe
  2⤵
  PID:7300
- C:\Windows\System\inNQwEf.exe
  C:\Windows\System\inNQwEf.exe
  2⤵
  PID:7688
- C:\Windows\System\aMfBZcx.exe
  C:\Windows\System\aMfBZcx.exe
  2⤵
  PID:8208
- C:\Windows\System\qZPrmyU.exe
  C:\Windows\System\qZPrmyU.exe
  2⤵
  PID:8228
- C:\Windows\System\kWqRYmn.exe
  C:\Windows\System\kWqRYmn.exe
  2⤵
  PID:8260
- C:\Windows\System\GADLcDH.exe
  C:\Windows\System\GADLcDH.exe
  2⤵
  PID:8284
- C:\Windows\System\zDLUyPw.exe
  C:\Windows\System\zDLUyPw.exe
  2⤵
  PID:8304
- C:\Windows\System\ZENWjYH.exe
  C:\Windows\System\ZENWjYH.exe
  2⤵
  PID:8336
- C:\Windows\System\OaXurcj.exe
  C:\Windows\System\OaXurcj.exe
  2⤵
  PID:8352
- C:\Windows\System\cTZhnmj.exe
  C:\Windows\System\cTZhnmj.exe
  2⤵
  PID:8492
- C:\Windows\System\fFSDcky.exe
  C:\Windows\System\fFSDcky.exe
  2⤵
  PID:8564
- C:\Windows\System\ioWjXfV.exe
  C:\Windows\System\ioWjXfV.exe
  2⤵
  PID:8604
- C:\Windows\System\aURNXIg.exe
  C:\Windows\System\aURNXIg.exe
  2⤵
  PID:8728
- C:\Windows\System\hhNBpvg.exe
  C:\Windows\System\hhNBpvg.exe
  2⤵
  PID:8780
- C:\Windows\System\CJlLNRO.exe
  C:\Windows\System\CJlLNRO.exe
  2⤵
  PID:8796
- C:\Windows\System\KqFjVCJ.exe
  C:\Windows\System\KqFjVCJ.exe
  2⤵
  PID:8816
- C:\Windows\System\spNvgIX.exe
  C:\Windows\System\spNvgIX.exe
  2⤵
  PID:8832
- C:\Windows\System\MNAYWLm.exe
  C:\Windows\System\MNAYWLm.exe
  2⤵
  PID:8848
- C:\Windows\System\UQwAHJE.exe
  C:\Windows\System\UQwAHJE.exe
  2⤵
  PID:8864
- C:\Windows\System\NDddUYA.exe
  C:\Windows\System\NDddUYA.exe
  2⤵
  PID:8964
- C:\Windows\System\aPGrhHI.exe
  C:\Windows\System\aPGrhHI.exe
  2⤵
  PID:9000
- C:\Windows\System\YaTLiaC.exe
  C:\Windows\System\YaTLiaC.exe
  2⤵
  PID:7508
- C:\Windows\System\DefTaqV.exe
  C:\Windows\System\DefTaqV.exe
  2⤵
  PID:8752
- C:\Windows\System\xXlDxpz.exe
  C:\Windows\System\xXlDxpz.exe
  2⤵
  PID:8792
- C:\Windows\System\gyuUynp.exe
  C:\Windows\System\gyuUynp.exe
  2⤵
  PID:8804
- C:\Windows\System\WoABVtY.exe
  C:\Windows\System\WoABVtY.exe
  2⤵
  PID:8812
- C:\Windows\System\Xvatrgk.exe
  C:\Windows\System\Xvatrgk.exe
  2⤵
  PID:8880
- C:\Windows\System\YHMZDFM.exe
  C:\Windows\System\YHMZDFM.exe
  2⤵
  PID:8892
- C:\Windows\System\TVDfzRW.exe
  C:\Windows\System\TVDfzRW.exe
  2⤵
  PID:8908
- C:\Windows\System\aOlUuYJ.exe
  C:\Windows\System\aOlUuYJ.exe
  2⤵
  PID:8932
- C:\Windows\System\hHjKrlq.exe
  C:\Windows\System\hHjKrlq.exe
  2⤵
  PID:8316
- C:\Windows\System\rzRauXi.exe
  C:\Windows\System\rzRauXi.exe
  2⤵
  PID:8412
- C:\Windows\System\OkesnBI.exe
  C:\Windows\System\OkesnBI.exe
  2⤵
  PID:7396
- C:\Windows\System\vqHBnPC.exe
  C:\Windows\System\vqHBnPC.exe
  2⤵
  PID:7732
- C:\Windows\System\puMGfti.exe
  C:\Windows\System\puMGfti.exe
  2⤵
  PID:7752
- C:\Windows\System\GstuhMI.exe
  C:\Windows\System\GstuhMI.exe
  2⤵
  PID:8292
- C:\Windows\System\cpDYaOS.exe
  C:\Windows\System\cpDYaOS.exe
  2⤵
  PID:8328
- C:\Windows\System\qQhkjlT.exe
  C:\Windows\System\qQhkjlT.exe
  2⤵
  PID:8520
- C:\Windows\System\MCqAvDa.exe
  C:\Windows\System\MCqAvDa.exe
  2⤵
  PID:8684
- C:\Windows\System\tWbrkOp.exe
  C:\Windows\System\tWbrkOp.exe
  2⤵
  PID:8708
- C:\Windows\System\gyYWFZY.exe
  C:\Windows\System\gyYWFZY.exe
  2⤵
  PID:8972
- C:\Windows\System\trgThhL.exe
  C:\Windows\System\trgThhL.exe
  2⤵
  PID:8596
- C:\Windows\System\lCmfGKX.exe
  C:\Windows\System\lCmfGKX.exe
  2⤵
  PID:8756
- C:\Windows\System\JgUATjN.exe
  C:\Windows\System\JgUATjN.exe
  2⤵
  PID:8996
- C:\Windows\System\knaeHCj.exe
  C:\Windows\System\knaeHCj.exe
  2⤵
  PID:9012
- C:\Windows\System\UnMxsWK.exe
  C:\Windows\System\UnMxsWK.exe
  2⤵
  PID:9032
- C:\Windows\System\xvXvaEB.exe
  C:\Windows\System\xvXvaEB.exe
  2⤵
  PID:9048
- C:\Windows\System\WRYGkgq.exe
  C:\Windows\System\WRYGkgq.exe
  2⤵
  PID:628
- C:\Windows\System\rhFLzNJ.exe
  C:\Windows\System\rhFLzNJ.exe
  2⤵
  PID:7400
- C:\Windows\System\QjhHVVb.exe
  C:\Windows\System\QjhHVVb.exe
  2⤵
  PID:8312
- C:\Windows\System\oldhIdL.exe
  C:\Windows\System\oldhIdL.exe
  2⤵
  PID:8920
- C:\Windows\System\xkDaYuA.exe
  C:\Windows\System\xkDaYuA.exe
  2⤵
  PID:8840
- C:\Windows\System\umJJcYs.exe
  C:\Windows\System\umJJcYs.exe
  2⤵
  PID:7456
- C:\Windows\System\PNyfGLS.exe
  C:\Windows\System\PNyfGLS.exe
  2⤵
  PID:8480
- C:\Windows\System\gZaDopt.exe
  C:\Windows\System\gZaDopt.exe
  2⤵
  PID:7312
- C:\Windows\System\ZJxKHaK.exe
  C:\Windows\System\ZJxKHaK.exe
  2⤵
  PID:7960
- C:\Windows\System\HldYkFX.exe
  C:\Windows\System\HldYkFX.exe
  2⤵
  PID:8104
- C:\Windows\System\MmjlETL.exe
  C:\Windows\System\MmjlETL.exe
  2⤵
  PID:8200
- C:\Windows\System\UKzNhxO.exe
  C:\Windows\System\UKzNhxO.exe
  2⤵
  PID:8396
- C:\Windows\System\ozcnCuN.exe
  C:\Windows\System\ozcnCuN.exe
  2⤵
  PID:8392
- C:\Windows\System\tnGuMGL.exe
  C:\Windows\System\tnGuMGL.exe
  2⤵
  PID:8424
- C:\Windows\System\vctqhbg.exe
  C:\Windows\System\vctqhbg.exe
  2⤵
  PID:8252
- C:\Windows\System\PLEYpxl.exe
  C:\Windows\System\PLEYpxl.exe
  2⤵
  PID:8736
- C:\Windows\System\DuRdxoX.exe
  C:\Windows\System\DuRdxoX.exe
  2⤵
  PID:8628
- C:\Windows\System\JYtMjKL.exe
  C:\Windows\System\JYtMjKL.exe
  2⤵
  PID:8172
- C:\Windows\System\iqZdFPx.exe
  C:\Windows\System\iqZdFPx.exe
  2⤵
  PID:7928
- C:\Windows\System\mZEfann.exe
  C:\Windows\System\mZEfann.exe
  2⤵
  PID:8500
- C:\Windows\System\QIhSTRe.exe
  C:\Windows\System\QIhSTRe.exe
  2⤵
  PID:8512
- C:\Windows\System\yrtZfNk.exe
  C:\Windows\System\yrtZfNk.exe
  2⤵
  PID:8324
- C:\Windows\System\vocrybT.exe
  C:\Windows\System\vocrybT.exe
  2⤵
  PID:8064
- C:\Windows\System\pboqyRJ.exe
  C:\Windows\System\pboqyRJ.exe
  2⤵
  PID:8380
- C:\Windows\System\GovcpUb.exe
  C:\Windows\System\GovcpUb.exe
  2⤵
  PID:8676
- C:\Windows\System\NilSSHf.exe
  C:\Windows\System\NilSSHf.exe
  2⤵
  PID:8692
- C:\Windows\System\ODCUIlJ.exe
  C:\Windows\System\ODCUIlJ.exe
  2⤵
  PID:8548
- C:\Windows\System\ZnQijYk.exe
  C:\Windows\System\ZnQijYk.exe
  2⤵
  PID:8632
- C:\Windows\System\HSKiFGA.exe
  C:\Windows\System\HSKiFGA.exe
  2⤵
  PID:8664
- C:\Windows\System\nFQiSIH.exe
  C:\Windows\System\nFQiSIH.exe
  2⤵
  PID:8624
- C:\Windows\System\UcELyzU.exe
  C:\Windows\System\UcELyzU.exe
  2⤵
  PID:8876
- C:\Windows\System\SXKEoRC.exe
  C:\Windows\System\SXKEoRC.exe
  2⤵
  PID:8940
- C:\Windows\System\JZBYvSc.exe
  C:\Windows\System\JZBYvSc.exe
  2⤵
  PID:8960
- C:\Windows\System\rxhkRfA.exe
  C:\Windows\System\rxhkRfA.exe
  2⤵
  PID:8988
- C:\Windows\System\fYtVqCr.exe
  C:\Windows\System\fYtVqCr.exe
  2⤵
  PID:9020
- C:\Windows\System\lIbNsgW.exe
  C:\Windows\System\lIbNsgW.exe
  2⤵
  PID:9072
- C:\Windows\System\ZgBCyzL.exe
  C:\Windows\System\ZgBCyzL.exe
  2⤵
  PID:2292
- C:\Windows\System\VSXuQlJ.exe
  C:\Windows\System\VSXuQlJ.exe
  2⤵
  PID:8644
- C:\Windows\System\SddMDRZ.exe
  C:\Windows\System\SddMDRZ.exe
  2⤵
  PID:9060
- C:\Windows\System\nlmfOyi.exe
  C:\Windows\System\nlmfOyi.exe
  2⤵
  PID:2532
- C:\Windows\System\dPdZgqI.exe
  C:\Windows\System\dPdZgqI.exe
  2⤵
  PID:1680
- C:\Windows\System\onVcNwN.exe
  C:\Windows\System\onVcNwN.exe
  2⤵
  PID:9180
- C:\Windows\System\IqMHAoE.exe
  C:\Windows\System\IqMHAoE.exe
  2⤵
  PID:7384
- C:\Windows\System\xfpZdry.exe
  C:\Windows\System\xfpZdry.exe
  2⤵
  PID:8220
- C:\Windows\System\xtgUgYq.exe
  C:\Windows\System\xtgUgYq.exe
  2⤵
  PID:7832
- C:\Windows\System\ibBxLay.exe
  C:\Windows\System\ibBxLay.exe
  2⤵
  PID:8072
- C:\Windows\System\crfUNmw.exe
  C:\Windows\System\crfUNmw.exe
  2⤵
  PID:8364
- C:\Windows\System\qeWcVWG.exe
  C:\Windows\System\qeWcVWG.exe
  2⤵
  PID:9124
- C:\Windows\System\nXyvfMH.exe
  C:\Windows\System\nXyvfMH.exe
  2⤵
  PID:7784
- C:\Windows\System\PqIqxWf.exe
  C:\Windows\System\PqIqxWf.exe
  2⤵
  PID:7648
- C:\Windows\System\xbGGjEM.exe
  C:\Windows\System\xbGGjEM.exe
  2⤵
  PID:8236
- C:\Windows\System\uMnMmmu.exe
  C:\Windows\System\uMnMmmu.exe
  2⤵
  PID:9100
- C:\Windows\System\HKrTDFz.exe
  C:\Windows\System\HKrTDFz.exe
  2⤵
  PID:8612
- C:\Windows\System\zecMGyF.exe
  C:\Windows\System\zecMGyF.exe
  2⤵
  PID:8388
- C:\Windows\System\hTapBhf.exe
  C:\Windows\System\hTapBhf.exe
  2⤵
  PID:8344
- C:\Windows\System\wUWzeQa.exe
  C:\Windows\System\wUWzeQa.exe
  2⤵
  PID:8716
- C:\Windows\System\NFsDTOG.exe
  C:\Windows\System\NFsDTOG.exe
  2⤵
  PID:8672
- C:\Windows\System\ziqdaOV.exe
  C:\Windows\System\ziqdaOV.exe
  2⤵
  PID:8432
- C:\Windows\System\nHJJvyq.exe
  C:\Windows\System\nHJJvyq.exe
  2⤵
  PID:8120
- C:\Windows\System\pHQIhKS.exe
  C:\Windows\System\pHQIhKS.exe
  2⤵
  PID:9040
- C:\Windows\System\BbSnJBg.exe
  C:\Windows\System\BbSnJBg.exe
  2⤵
  PID:8656
- C:\Windows\System\oXkhier.exe
  C:\Windows\System\oXkhier.exe
  2⤵
  PID:8472
- C:\Windows\System\AXoHvcx.exe
  C:\Windows\System\AXoHvcx.exe
  2⤵
  PID:9044
- C:\Windows\System\lZFjfwH.exe
  C:\Windows\System\lZFjfwH.exe
  2⤵
  PID:8640
- C:\Windows\System\LZeykdr.exe
  C:\Windows\System\LZeykdr.exe
  2⤵
  PID:8592
- C:\Windows\System\ICXkXjX.exe
  C:\Windows\System\ICXkXjX.exe
  2⤵
  PID:8992
- C:\Windows\System\CsIgQeY.exe
  C:\Windows\System\CsIgQeY.exe
  2⤵
  PID:8744
- C:\Windows\System\TKtWXik.exe
  C:\Windows\System\TKtWXik.exe
  2⤵
  PID:8904
- C:\Windows\System\ptIxvSF.exe
  C:\Windows\System\ptIxvSF.exe
  2⤵
  PID:8936
- C:\Windows\System\jHTfREL.exe
  C:\Windows\System\jHTfREL.exe
  2⤵
  PID:7944
- C:\Windows\System\sKkZLKF.exe
  C:\Windows\System\sKkZLKF.exe
  2⤵
  PID:9112
- C:\Windows\System\mtAroBm.exe
  C:\Windows\System\mtAroBm.exe
  2⤵
  PID:9156
- C:\Windows\System\szZNOHo.exe
  C:\Windows\System\szZNOHo.exe
  2⤵
  PID:8444
- C:\Windows\System\DrsyPbM.exe
  C:\Windows\System\DrsyPbM.exe
  2⤵
  PID:8044
- C:\Windows\System\txYRQTw.exe
  C:\Windows\System\txYRQTw.exe
  2⤵
  PID:8376
- C:\Windows\System\xBinXUs.exe
  C:\Windows\System\xBinXUs.exe
  2⤵
  PID:8048
- C:\Windows\System\cHqhqUO.exe
  C:\Windows\System\cHqhqUO.exe
  2⤵
  PID:9176
- C:\Windows\System\QYbIpzs.exe
  C:\Windows\System\QYbIpzs.exe
  2⤵
  PID:8300
- C:\Windows\System\iSdVevp.exe
  C:\Windows\System\iSdVevp.exe
  2⤵
  PID:7296
- C:\Windows\System\QWsANnm.exe
  C:\Windows\System\QWsANnm.exe
  2⤵
  PID:8452
- C:\Windows\System\vXbagXT.exe
  C:\Windows\System\vXbagXT.exe
  2⤵
  PID:8248
- C:\Windows\System\UvTugqh.exe
  C:\Windows\System\UvTugqh.exe
  2⤵
  PID:8872
- C:\Windows\System\WMbPZCm.exe
  C:\Windows\System\WMbPZCm.exe
  2⤵
  PID:8588
- C:\Windows\System\AfJEjlT.exe
  C:\Windows\System\AfJEjlT.exe
  2⤵
  PID:8944
- C:\Windows\System\VynNyXG.exe
  C:\Windows\System\VynNyXG.exe
  2⤵
  PID:8660
- C:\Windows\System\SUXwlLm.exe
  C:\Windows\System\SUXwlLm.exe
  2⤵
  PID:8896
- C:\Windows\System\mxFpMvD.exe
  C:\Windows\System\mxFpMvD.exe
  2⤵
  PID:9084
- C:\Windows\System\CACmYRp.exe
  C:\Windows\System\CACmYRp.exe
  2⤵
  PID:9120
- C:\Windows\System\VBLNwoh.exe
  C:\Windows\System\VBLNwoh.exe
  2⤵
  PID:9076
- C:\Windows\System\IakDLxu.exe
  C:\Windows\System\IakDLxu.exe
  2⤵
  PID:8416
- C:\Windows\System\xCURLTG.exe
  C:\Windows\System\xCURLTG.exe
  2⤵
  PID:9172
- C:\Windows\System\YqqUSkw.exe
  C:\Windows\System\YqqUSkw.exe
  2⤵
  PID:8652
- C:\Windows\System\ZTXqWja.exe
  C:\Windows\System\ZTXqWja.exe
  2⤵
  PID:8984
- C:\Windows\System\fNCaqMA.exe
  C:\Windows\System\fNCaqMA.exe
  2⤵
  PID:8036
- C:\Windows\System\gtOwDPd.exe
  C:\Windows\System\gtOwDPd.exe
  2⤵
  PID:9160
- C:\Windows\System\SUtaleZ.exe
  C:\Windows\System\SUtaleZ.exe
  2⤵
  PID:8268
- C:\Windows\System\QBFDStP.exe
  C:\Windows\System\QBFDStP.exe
  2⤵
  PID:8560
- C:\Windows\System\ngPRkUJ.exe
  C:\Windows\System\ngPRkUJ.exe
  2⤵
  PID:9056
- C:\Windows\System\AybpcWy.exe
  C:\Windows\System\AybpcWy.exe
  2⤵
  PID:8620
- C:\Windows\System\BSpgxWB.exe
  C:\Windows\System\BSpgxWB.exe
  2⤵
  PID:8576
- C:\Windows\System\FVzTzce.exe
  C:\Windows\System\FVzTzce.exe
  2⤵
  PID:8976
- C:\Windows\System\HoCQmPT.exe
  C:\Windows\System\HoCQmPT.exe
  2⤵
  PID:9136
- C:\Windows\System\ZoKHFgE.exe
  C:\Windows\System\ZoKHFgE.exe
  2⤵
  PID:8224
- C:\Windows\System\yDnPJhG.exe
  C:\Windows\System\yDnPJhG.exe
  2⤵
  PID:9228
- C:\Windows\System\KZINjav.exe
  C:\Windows\System\KZINjav.exe
  2⤵
  PID:9244
- C:\Windows\System\UQqNmPk.exe
  C:\Windows\System\UQqNmPk.exe
  2⤵
  PID:9260
- C:\Windows\System\xRmpcFy.exe
  C:\Windows\System\xRmpcFy.exe
  2⤵
  PID:9276
- C:\Windows\System\BpjUXGg.exe
  C:\Windows\System\BpjUXGg.exe
  2⤵
  PID:9292
- C:\Windows\System\fWufbez.exe
  C:\Windows\System\fWufbez.exe
  2⤵
  PID:9308
- C:\Windows\System\YyyAgOU.exe
  C:\Windows\System\YyyAgOU.exe
  2⤵
  PID:9324
- C:\Windows\System\clZtYQX.exe
  C:\Windows\System\clZtYQX.exe
  2⤵
  PID:9340
- C:\Windows\System\vhuWuBt.exe
  C:\Windows\System\vhuWuBt.exe
  2⤵
  PID:9356
- C:\Windows\System\UxZLDFp.exe
  C:\Windows\System\UxZLDFp.exe
  2⤵
  PID:9552
- C:\Windows\System\UDcBwCU.exe
  C:\Windows\System\UDcBwCU.exe
  2⤵
  PID:9572
- C:\Windows\System\zvOQCiE.exe
  C:\Windows\System\zvOQCiE.exe
  2⤵
  PID:9588
- C:\Windows\System\JDVstCI.exe
  C:\Windows\System\JDVstCI.exe
  2⤵
  PID:9604
- C:\Windows\System\hUGUnbu.exe
  C:\Windows\System\hUGUnbu.exe
  2⤵
  PID:9620
- C:\Windows\System\MlzqvGd.exe
  C:\Windows\System\MlzqvGd.exe
  2⤵
  PID:9640
- C:\Windows\System\oTpkfpj.exe
  C:\Windows\System\oTpkfpj.exe
  2⤵
  PID:9656
- C:\Windows\System\sbeqTWV.exe
  C:\Windows\System\sbeqTWV.exe
  2⤵
  PID:9672
- C:\Windows\System\jpAdVlo.exe
  C:\Windows\System\jpAdVlo.exe
  2⤵
  PID:9688
- C:\Windows\System\aGCMEwO.exe
  C:\Windows\System\aGCMEwO.exe
  2⤵
  PID:9704
- C:\Windows\System\WmwwzEx.exe
  C:\Windows\System\WmwwzEx.exe
  2⤵
  PID:9720
- C:\Windows\System\IptSoKK.exe
  C:\Windows\System\IptSoKK.exe
  2⤵
  PID:9736
- C:\Windows\System\cuCkMQS.exe
  C:\Windows\System\cuCkMQS.exe
  2⤵
  PID:9752
- C:\Windows\System\zJROdGo.exe
  C:\Windows\System\zJROdGo.exe
  2⤵
  PID:9768
- C:\Windows\System\xZMPuBl.exe
  C:\Windows\System\xZMPuBl.exe
  2⤵
  PID:9784
- C:\Windows\System\tCEfxWA.exe
  C:\Windows\System\tCEfxWA.exe
  2⤵
  PID:9804
- C:\Windows\System\uWbQphR.exe
  C:\Windows\System\uWbQphR.exe
  2⤵
  PID:9820
- C:\Windows\System\CbPudGf.exe
  C:\Windows\System\CbPudGf.exe
  2⤵
  PID:9836
- C:\Windows\System\wQMpOBn.exe
  C:\Windows\System\wQMpOBn.exe
  2⤵
  PID:9852
- C:\Windows\System\ksNcSSy.exe
  C:\Windows\System\ksNcSSy.exe
  2⤵
  PID:9868
- C:\Windows\System\qVKAxrl.exe
  C:\Windows\System\qVKAxrl.exe
  2⤵
  PID:9884
- C:\Windows\System\RdxQNHk.exe
  C:\Windows\System\RdxQNHk.exe
  2⤵
  PID:9900
- C:\Windows\System\mswOQNy.exe
  C:\Windows\System\mswOQNy.exe
  2⤵
  PID:9916
- C:\Windows\System\YSTbdyG.exe
  C:\Windows\System\YSTbdyG.exe
  2⤵
  PID:9932
- C:\Windows\System\gsvqqjg.exe
  C:\Windows\System\gsvqqjg.exe
  2⤵
  PID:9948
- C:\Windows\System\bYhNpel.exe
  C:\Windows\System\bYhNpel.exe
  2⤵
  PID:10096
- C:\Windows\System\rrueKFd.exe
  C:\Windows\System\rrueKFd.exe
  2⤵
  PID:10124
- C:\Windows\System\USYzlqH.exe
  C:\Windows\System\USYzlqH.exe
  2⤵
  PID:10168
- C:\Windows\System\IGmJYMr.exe
  C:\Windows\System\IGmJYMr.exe
  2⤵
  PID:9220
- C:\Windows\System\dygJxzr.exe
  C:\Windows\System\dygJxzr.exe
  2⤵
  PID:9288
- C:\Windows\System\HFMmXeb.exe
  C:\Windows\System\HFMmXeb.exe
  2⤵
  PID:9352
- C:\Windows\System\hYQoDXf.exe
  C:\Windows\System\hYQoDXf.exe
  2⤵
  PID:1188
- C:\Windows\System\OKkRONj.exe
  C:\Windows\System\OKkRONj.exe
  2⤵
  PID:8700
- C:\Windows\System\kCVVGFq.exe
  C:\Windows\System\kCVVGFq.exe
  2⤵
  PID:9204
- C:\Windows\System\qmORHAi.exe
  C:\Windows\System\qmORHAi.exe
  2⤵
  PID:9336
- C:\Windows\System\xDojwEn.exe
  C:\Windows\System\xDojwEn.exe
  2⤵
  PID:9376
- C:\Windows\System\jHXwsiq.exe
  C:\Windows\System\jHXwsiq.exe
  2⤵
  PID:9564
- C:\Windows\System\YYRWcIo.exe
  C:\Windows\System\YYRWcIo.exe
  2⤵
  PID:9392
- C:\Windows\System\fUMKizQ.exe
  C:\Windows\System\fUMKizQ.exe
  2⤵
  PID:9420
- C:\Windows\System\ksiZgbY.exe
  C:\Windows\System\ksiZgbY.exe
  2⤵
  PID:7188
- C:\Windows\System\DYbkOHz.exe
  C:\Windows\System\DYbkOHz.exe
  2⤵
  PID:9596
- C:\Windows\System\LSwoHAN.exe
  C:\Windows\System\LSwoHAN.exe
  2⤵
  PID:9636
- C:\Windows\System\jRzGVRW.exe
  C:\Windows\System\jRzGVRW.exe
  2⤵
  PID:9468
- C:\Windows\System\pPaoKAc.exe
  C:\Windows\System\pPaoKAc.exe
  2⤵
  PID:9452
- C:\Windows\System\nclncBX.exe
  C:\Windows\System\nclncBX.exe
  2⤵
  PID:9476
- C:\Windows\System\wSbdtTN.exe
  C:\Windows\System\wSbdtTN.exe
  2⤵
  PID:9492
- C:\Windows\System\fYugIaD.exe
  C:\Windows\System\fYugIaD.exe
  2⤵
  PID:9504
- C:\Windows\System\OiBJRVI.exe
  C:\Windows\System\OiBJRVI.exe
  2⤵
  PID:9528
- C:\Windows\System\ErktcDI.exe
  C:\Windows\System\ErktcDI.exe
  2⤵
  PID:9548
- C:\Windows\System\uDRAJSh.exe
  C:\Windows\System\uDRAJSh.exe
  2⤵
  PID:9648
- C:\Windows\System\sYObksy.exe
  C:\Windows\System\sYObksy.exe
  2⤵
  PID:9696
- C:\Windows\System\LBOqqhe.exe
  C:\Windows\System\LBOqqhe.exe
  2⤵
  PID:9732
- C:\Windows\System\KiWNZeH.exe
  C:\Windows\System\KiWNZeH.exe
  2⤵
  PID:9796
- C:\Windows\System\WWSsdVS.exe
  C:\Windows\System\WWSsdVS.exe
  2⤵
  PID:9832
- C:\Windows\System\PKySGjZ.exe
  C:\Windows\System\PKySGjZ.exe
  2⤵
  PID:9896
- C:\Windows\System\aZEwVdW.exe
  C:\Windows\System\aZEwVdW.exe
  2⤵
  PID:9716
- C:\Windows\System\KAjMaKz.exe
  C:\Windows\System\KAjMaKz.exe
  2⤵
  PID:9780
- C:\Windows\System\gdnLVkC.exe
  C:\Windows\System\gdnLVkC.exe
  2⤵
  PID:9880
- C:\Windows\System\GrkNbvU.exe
  C:\Windows\System\GrkNbvU.exe
  2⤵
  PID:9956
- C:\Windows\System\HEYuBhM.exe
  C:\Windows\System\HEYuBhM.exe
  2⤵
  PID:9944
- C:\Windows\System\xmsHkwf.exe
  C:\Windows\System\xmsHkwf.exe
  2⤵
  PID:10104
- C:\Windows\System\AMpTUib.exe
  C:\Windows\System\AMpTUib.exe
  2⤵
  PID:9440
- C:\Windows\System\apVGbxw.exe
  C:\Windows\System\apVGbxw.exe
  2⤵
  PID:10212
- C:\Windows\System\YjbppxQ.exe
  C:\Windows\System\YjbppxQ.exe
  2⤵
  PID:9972
- C:\Windows\System\kokicZU.exe
  C:\Windows\System\kokicZU.exe
  2⤵
  PID:9988
- C:\Windows\System\eMtEyrp.exe
  C:\Windows\System\eMtEyrp.exe
  2⤵
  PID:10004
- C:\Windows\System\aSLDHGU.exe
  C:\Windows\System\aSLDHGU.exe
  2⤵
  PID:10020
- C:\Windows\System\vQGDIeL.exe
  C:\Windows\System\vQGDIeL.exe
  2⤵
  PID:10036
- C:\Windows\System\jFuKFzv.exe
  C:\Windows\System\jFuKFzv.exe
  2⤵
  PID:10056
- C:\Windows\System\TZabUhf.exe
  C:\Windows\System\TZabUhf.exe
  2⤵
  PID:10072
- C:\Windows\System\cVQqhMZ.exe
  C:\Windows\System\cVQqhMZ.exe
  2⤵
  PID:10088
- C:\Windows\System\kYUrOPI.exe
  C:\Windows\System\kYUrOPI.exe
  2⤵
  PID:10140
- C:\Windows\System\TrfmHoP.exe
  C:\Windows\System\TrfmHoP.exe
  2⤵
  PID:10156
- C:\Windows\System\pqWUUMW.exe
  C:\Windows\System\pqWUUMW.exe
  2⤵
  PID:9284
- C:\Windows\System\ExnXxna.exe
  C:\Windows\System\ExnXxna.exe
  2⤵
  PID:9188
- C:\Windows\System\clRUvOD.exe
  C:\Windows\System\clRUvOD.exe
  2⤵
  PID:10184
- C:\Windows\System\YhyRuKL.exe
  C:\Windows\System\YhyRuKL.exe
  2⤵
  PID:10216
- C:\Windows\System\nNSutJn.exe
  C:\Windows\System\nNSutJn.exe
  2⤵
  PID:9372
- C:\Windows\System\VAqzJiR.exe
  C:\Windows\System\VAqzJiR.exe
  2⤵
  PID:8368
- C:\Windows\System\ZbUguyo.exe
  C:\Windows\System\ZbUguyo.exe
  2⤵
  PID:8272
- C:\Windows\System\IYseJeF.exe
  C:\Windows\System\IYseJeF.exe
  2⤵
  PID:9212
- C:\Windows\System\fUIllgy.exe
  C:\Windows\System\fUIllgy.exe
  2⤵
  PID:10228
- C:\Windows\System\mPmHtSq.exe
  C:\Windows\System\mPmHtSq.exe
  2⤵
  PID:9272
- C:\Windows\System\fpvmpKp.exe
  C:\Windows\System\fpvmpKp.exe
  2⤵
  PID:9332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CcRrdka.exe

Filesize
2.1MB

MD5
907fb8f3a46ba29e6927a5c9a105c7c4

SHA1
8f391cda79b6cc4b529bb18a127aa141a5e2828c

SHA256
238bb4dd938f878948ecb0237cf5f48f4604e2a30edcc816204fe3223a944c96

SHA512
c141130fedb0b36d6c0defb79770eedb53d721324e9daf6ea5ee107617a88b53e895d1325da8b7cf3968132cd6ee5801c448a63963db478d8b952a281733d5d1

Download Submit
C:\Windows\system\CnPqjyt.exe

Filesize
2.1MB

MD5
b24fb702a57fef3e43e61df2ea3b2993

SHA1
8f20bb95401f314bb1406cdbed0b37c938884517

SHA256
ef40c8395119e78e1ea5e2ed2147cce124617c37d4bc2d4e047826198ffbd824

SHA512
7988f8ab11dcf7ff49bfb3c56e3ef8b10e6e1512ebd8909199ca1b94d6caa47ff3bce3b487e0bf9257851b3066d3f2d34e6013a8da0a488eedb2925af25bfc70

Download Submit
C:\Windows\system\GgAPwQY.exe

Filesize
2.1MB

MD5
6439576da11707f990f68c3a415d32b0

SHA1
828a04501afdd71ffab8e530c1dbd7bc9022fbc2

SHA256
4861f5e8e75266dee9016d26b09e5b59efc24debdd1deee64df2b3c2c974f61d

SHA512
fffb93481dc816263730f0769d9f3447f4f9a45c62ee8bedb0c0bd2ce1f21d93b2c4de504ee37c1878076a3f1eb302f905aba02a71620876a7ef69c450633fdc

Download Submit
C:\Windows\system\ICBuesP.exe

Filesize
2.1MB

MD5
c09c33958fc1974bb351d7f899354697

SHA1
664607d1dfbe6640e2b754e10e65e35721d66651

SHA256
2b45b21232a8ebf372a460f6df1de5632cc921a29a8270022b63826b49390c22

SHA512
2063c10c798e559d6e6489843b156557f18cf4a8bdb9e2f053f8b9dc79b059e1b61e693ccb0fa228195d41e0697c0e1ad0fef395f4f6794468d6839184556df7

Download Submit
C:\Windows\system\JGdKQCF.exe

Filesize
2.1MB

MD5
aa38e24261fc263839eab38f263a2f22

SHA1
40bae82194143c7883a3f310926cbf81c89b6463

SHA256
248087f8bc6cd7cf71f64646fd3eaf58aacdfadc015f94e285a77fa26ea52549

SHA512
9511063920fe0379eb71b9cd71bc488a3654e4d3c072d9dffe3d6a7ab1d4689e4efef3d7099d08de945ad3cafabf6354d2162590d8cc1a66e334c568be2004f3

Download Submit
C:\Windows\system\JyaaLpQ.exe

Filesize
2.1MB

MD5
b21448ac022440164ddaf63e80ad2d63

SHA1
23dad26d4890318c654bd119dece32c4d2e483df

SHA256
8f1307912cc4792b19fb2eed8189637a523aa5c24c4defc8e3c2db344249f451

SHA512
e987c2613268dc81c70cd0ef1cbbdc2f9b303713e4c4ed385f89574f1447b78eb02b787567b96ba84a53b3e1b7b3ebce22c4dcc61532ae663e460f61c15eb8eb

Download Submit
C:\Windows\system\QPdptRQ.exe

Filesize
2.1MB

MD5
0766af8368a300cd158c4df48f6ff9f4

SHA1
29f5f8ff5168c683d6a7b638fcb917e561afd814

SHA256
2051fe051c5686d8fd1ae658f6a89d80b0183d29ec26ba33a568dd6cb1539671

SHA512
f7b623ebf74770f81d4c171009f3b69866d44b86b3611866bf73d28bcb7af6468e5134e1b02cf893db5e50af3b8cf4d80aa12b5ae4ba64e813713a862e3142ec

Download Submit
C:\Windows\system\SesOzOi.exe

Filesize
2.1MB

MD5
b2af3bfc6f2ae89373099fcf8797dc93

SHA1
86fad09c86ccf43f7608f6e70b468f22ebb2c9b6

SHA256
6d792bf47fae8c56eeb8cf099c09a122c2c58b9326d3c52ffc342f166f72616a

SHA512
ddde13f216b2a11e69708cf21b61f1eedfaa0383abc39606b9a2439bf35511c1e96b468a87d561567fb0e8a3181ee1d3a7b8af96f83da015d6496a0357df25c7

Download Submit
C:\Windows\system\TjWHlRz.exe

Filesize
2.1MB

MD5
9bda613f9c2b0c2dfe654f70e8520714

SHA1
ee2366b365d0d5c78a9d4cefa16b41100a0c5eed

SHA256
d23e7bf7295d71fbdc1000b6b3c326ae64433ea04856053b2bedf30aa9611a86

SHA512
09eb3e57df6e51d3a215b4abb0e96e7ecbe2a2d1d7c697360cf1bfb5842e5aeed19cfbf71f45a82e1383a5521f280cf813e4fe68b4331ebb50970a4cdd4a0ec8

Download Submit
C:\Windows\system\UotEbYD.exe

Filesize
2.1MB

MD5
c1f1841cebf587fcfe73043018c4aea1

SHA1
e9a10678bacf65f203588c81d3752ca8859def9f

SHA256
55c787f728b792b332de6186e115cb4ce878c88b8683f62776784ad44355fc85

SHA512
c78cfb37eab333cb2ac51280bc0ffb94c5fdb0156ec35508b6507e0fe05d442f05b386e2455610e93c719832d7bd817a4edb97363f02922fb6e27bc4f3c569e7

Download Submit
C:\Windows\system\cfoMevp.exe

Filesize
2.1MB

MD5
a613429eaad538e9f9bd1bde2090b8ea

SHA1
d4bead3014a50f9bfc444e031312fea6580232f3

SHA256
ee22b204f5c425d120cfa42fd421d0fdd407dd3396350d4468dc1f5f843a3b77

SHA512
60af22a057e74c1580c0e88664376f3143482eaed9982e6bbd0b9243f4249cecea9a944405a81875a1e539d0564db7e6104adb187414d9aa725122968b1c6fac

Download Submit
C:\Windows\system\ftlqkzJ.exe

Filesize
2.1MB

MD5
516ef5dade2c18f910b313ef9ab38a81

SHA1
dcbbf4a021d869298f436da575b571cc3707d696

SHA256
96ef8cd3ad477a3cc11c7defa183b16601af9eaf3ce3d6f0002061f0e6a65f0f

SHA512
129d10f7fc86f3fc479758c9bbb98489dcaf09ce1ffe01982b51a13aab7df17d216acab08e8e077dacf865975fca622fe6948f01031753417b4f37851b65bec9

Download Submit
C:\Windows\system\iLXCVDE.exe

Filesize
2.1MB

MD5
46edb5678f0b3446a1f4253d42394235

SHA1
5d60c13a2dd093cb799c8d6de0e2ec383ba12e76

SHA256
f4923b7819284ab65ba2872aa41127ee585808841812d22a59f0c21f92dd0aaa

SHA512
8381b5f7887a329a7639a495ff69065c6c7e56d55a7b4e342c90772cfd29b1c93d62da01820d71323a25d849e41b9026c484fcddea673c5cb4658ad7ba0eec8b

Download Submit
C:\Windows\system\jnPllzv.exe

Filesize
2.1MB

MD5
5bd3cca4f2cd7f26cd8238c15f77213d

SHA1
fb8ed8b5503c72199be3b2523e0a08b27de3b25f

SHA256
2c3478da8ca019107615546cb1b2b757c7a6f3222ad5b471f373ec267a037eed

SHA512
0d22d94ed3ec4d9466d79766e7da43b0289ea059f49df37ccd2693234d9897e925f61997df89cbadd1d2f41fd0b1fd3f62483e8df3befbd4c431d4d243294552

Download Submit
C:\Windows\system\kmjJgRy.exe

Filesize
2.1MB

MD5
5dd787336357f866c0faf50e7d21dadc

SHA1
5e936eed5912ee060da7f3d6707843a9f425ae93

SHA256
fe6a192238edef35f7e72b11e35981eb17522bc37f883c18b2c07064e70a5edd

SHA512
fcc29f760226b360372c40588773954a3e0b76a771c48f626db3f99aba92c99562bdee4be8dd01fc128ac62b8ae787939cd480dc2ca6dfd6fb90f4910823bf74

Download Submit
C:\Windows\system\mIpIlGu.exe

Filesize
2.1MB

MD5
17286624a2c38552cd07240bae271361

SHA1
4cd171ffe2764cebfb89521032a704d1f9b8fa97

SHA256
ef6a2b4d278dc3009d0cc3c47c776ea3826867029ca4752b425fc45041e04bfb

SHA512
c599d04f6ad64bdbb4c4c1276576c44708b4cb56378e7bac228d2394618f16b2db721bedc2f342501516432937f81913d8e1e6c7a070d7fde861cc7a2c08d60b

Download Submit
C:\Windows\system\pFSDWBQ.exe

Filesize
2.1MB

MD5
a993c57ec871557cdcbaf17e38439b4f

SHA1
1af4c6ee80a02ea291bb6f5086ea9902f97d8f3e

SHA256
cb52869cc1e4defd975ad86fe8367ca1b3ea90e511d44c7db350fe85ec4f6570

SHA512
b3d335a6f8fd02358182977f8f209cfa1183385917a4a62fe5789938731e125600543c4427c7e2724c842aa524eabb3af4b7273516ef126070bb2ac5eb679510

Download Submit
C:\Windows\system\phbaZIB.exe

Filesize
2.1MB

MD5
42d8daa0b4e108572d462cf53923dfcc

SHA1
12fb9990f64fced4dbc411ca7a3a0501f646dc9e

SHA256
cf78f7df78f2b0c0d4cd4ea700a513e4a79c68fbe507fd2a942275e3a2e666dd

SHA512
72034f9dca33f715f3d4fb8a1ae191d1b2394f208a76d6a442fa00c3b78aaac25cc44c0c59c5f22197e3660a2ac7e7a0d04f1b14a31cfec47d4255c714c0cd7b

Download Submit
C:\Windows\system\sQhmPLr.exe

Filesize
2.1MB

MD5
d5cd2e0c27215d951697eccaddebb67d

SHA1
6c7505fbcfe59d716098299eb5b0a36fc1f1e617

SHA256
9d449f3b19c0670180f1cd9eae1e30a37a6edd10a7a9cce0edcb8af0d3c2c1e1

SHA512
170c63c2d4ce5c960570891f180dc495061fa4fd409743b6f9c6046844dfb154696463c1931e06777290951317f90a4e1939afbd84248ea7eb8ab099bd0ee7a4

Download Submit
C:\Windows\system\stpzSiF.exe

Filesize
2.1MB

MD5
add02448583c4fb47d4ba32ac843cca5

SHA1
06f49a42225080d8cc59f55d5e2409b3e7d3136b

SHA256
44b30f3568defbe36969f1a08fadc282638d8436847aee7c187fa88a743741d8

SHA512
9a6e13ee495f78aec70372e4b88aaa55fd793160c16af15c35c934448815d9fff2238dbbb555dd89a15a86e6be8ed6e12bb576c1e9354f18c085da4abbd804ae

Download Submit
C:\Windows\system\tqsjrWm.exe

Filesize
2.1MB

MD5
281f7aa86339d382fbf6d454dcf7d38e

SHA1
120ad6257f36f93872ab178d6a4798bb83d69576

SHA256
72465d7c4f348bfd792f87653e4fa047ff52d4860b6df39c3df133dd6ec6e22a

SHA512
8ecfe53abddfd6d66a677018843ade1bc9306498668bef8d48c8403a5cf881fb62e1918680ba99c41a72ef268085de712c6e318b3535cb815ada304fcb3e00f6

Download Submit
C:\Windows\system\vTmQUbC.exe

Filesize
2.1MB

MD5
0fe7a4829076b72d1ba3abae19fd840b

SHA1
575a1fb94fdbe0eb44ef73918df1c339e1bd564d

SHA256
0ec1ce88148c69678aee61f5c004daf492f73d77dc2499d6181eab476a3ad07b

SHA512
17fcc9c66ce971ef6cff9657ab39e5b75988e33c2186738495a242377d0fc5ce7c1d6d5641ee44d0af833b72afb7cb584c440a39c90bbed36a4ef0f4e25ac305

Download Submit
C:\Windows\system\xQCuYjF.exe

Filesize
2.1MB

MD5
9d55f7d8a8cf4dc5968719cd9ef60992

SHA1
4cf4bcf8d19c90e5bbdb858fe38482bc18799156

SHA256
3fc8527d9a29ca0f0ca4c24c905ce54d2f663c873440e25d32d998dae1181e15

SHA512
93978390890900bf1f7e95cead31fe54e71ddbb899c65070b762be4274eab7f389e6c40575addd302ae50d315c18f60e10b462c5b270b9f16a2d2e3911c58d50

Download Submit
C:\Windows\system\yFKboHH.exe

Filesize
2.1MB

MD5
3d98118922133a99158ab4b58200c28c

SHA1
1c9daf888191be6d46a61c2246246b868e44b3dd

SHA256
527d3b42139088e97bb4f563ec591bb7ed0ddc927e580d0b7e6b0ccf49257475

SHA512
bcb3bd05ba065b119706680c82fd5f8716378914ab9a05c246e2be56442d0c4705c30455fb987bc0670c08c79fcc54f1927f9991d0aa957b7aa5719e4998313d

Download Submit
C:\Windows\system\yrsEVNm.exe

Filesize
2.1MB

MD5
44d5363657b5a2b509e6339909537578

SHA1
5adb7270a8533bff54970ce84f20bd9725c1cfc2

SHA256
a4e95d63b1bd48fd0df432fccc456500c76a333d298378b5b044a57437f998fe

SHA512
1a13e6b4f806398133167712b1c4c50a5b79e45ab241d15667e2f67bc35d2175fcb5f23b9427da778237cf154d8013bb7b4418c032d9260f06d712921d004188

Download Submit
C:\Windows\system\zaNDaPO.exe

Filesize
2.1MB

MD5
4b9602c2b9ff12bc54a834a29e227e44

SHA1
36e6cb97010241442cdf48df15c5d2a6b0bd905c

SHA256
1d617cdbc61c09422999eab324250c71aea55cbcf04f4f7f1873863dbf31ca6a

SHA512
f5b867c7dad0bddc8f3b437a3eb80cf00743c7857b3ce7ce41d1b9d357daaaf168fbdd8fe3b7ffe957729cc5ad4fb804163e0cad33e8c94e68aa062541368d8d

Download Submit
\Windows\system\ADpMXLV.exe

Filesize
2.1MB

MD5
057d74da811773ae86e9ef8e072f7702

SHA1
310fe9da4b964e9c025c44152a2560d4be92ce44

SHA256
6c8845b6b4e9529b4468bca673026a65b0b8f661ae000cf1da20e210a0368092

SHA512
acee0ceceba9644b3ab60dbdbe17273f1dc0eb33b054839643c246f4e4254f5d3bc1f234947fac5da9d9cdceab67ba9411e1e3a2eddeb5b7da0ecae9142f1072

Download Submit
\Windows\system\GvErwXv.exe

Filesize
2.1MB

MD5
772df0c09eb570baf54731eb5bccaaac

SHA1
034fa24faae0311528531d928d636a308a3ab176

SHA256
89e3fa60f6140657eee631bf4cc63ac057ae715e680f26e86c1c4f3a30b3b657

SHA512
73f0934fed742477b63aa9c2c39dd9da03f1937e14e23ede155826c98a38563a08b58f649f03b7e3704973a0df18124cf55ea33cb814fb433b3101035ac0f561

Download Submit
\Windows\system\QnHNPxA.exe

Filesize
2.1MB

MD5
edcc71c252977d0d18c0dbd0bea5e7d2

SHA1
c59e40b530707992f170b8045a959ee3a1ea175f

SHA256
e3d2d621ed5d586e88f5e9cd59fb2cc895b697b4ba32b64ee4948409c2ccd87b

SHA512
9eaabb74ab98f1b3a61af7e9c03ef6aefaf9fca44d11b5588b5b599081a1967e665ac987e3d3268d593425b8cb84a15150f1791061c9841239605ba787a965fa

Download Submit
\Windows\system\cHbOhAe.exe

Filesize
2.1MB

MD5
4d322aaa83122bc624668229541d35aa

SHA1
af9655dbe7c9f8e5d77e3836db9f2bc9a45a21ec

SHA256
a1217a3f5958de7a91f403b0f45e10ec1ba7c5384e6f2712626741b6240f079a

SHA512
ff35f4ba1eec6ee798aeb14e941b1e9674b50b5ed7cc059b834bc4fd8e97ff662336ac7d01e10b157a0dd623ee2fa1464743f791fd0fdefe1d87a5e51b0a6c19

Download Submit
\Windows\system\dHMYYep.exe

Filesize
2.1MB

MD5
15225926a7245b3378d98f13e2be8f11

SHA1
c724970cacf389f71ec05abc42fe5d7d43d89866

SHA256
bedad5a84bbe658b8a5ab221485407ed6d78bc345bcb26c066c63a4af466c18d

SHA512
da52e0283c4615b31f76377b9465e280ca6a14878f1cc02bf511982e278fa77c7c824e24509786fd9826df5fdb6f5f3e2ce0fa6e5d154b6c312d1e7110780788

Download Submit
\Windows\system\lkVdMHw.exe

Filesize
2.1MB

MD5
ff5eb0c09fe984f26ad4710cd5cd55c5

SHA1
c4974e4ffa2cc6e899e108e55c7ea963b99e6638

SHA256
b325bb545e161038ad68797345b8aae44e11cd7b59eeb2304eb2c2bafc1643f7

SHA512
b1261aa1a918695a87a19fdbb1c1cabff374453fbe572ff8e341c896b812299d39e97cf22dc6ed6bf3bc7b8ef1389ee86aba5a2ae04e16e9a580d47a311247fa

Download Submit
memory/1156-2502-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/1156-73-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/1184-2504-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/1184-59-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/1728-2432-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/1728-85-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/1932-2480-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/1932-30-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-571-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-16-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-82-0x0000000003170000-0x0000000003562000-memory.dmp

Filesize
3.9MB

Download
memory/2244-3384-0x0000000003170000-0x0000000003562000-memory.dmp

Filesize
3.9MB

Download
memory/2244-36-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2244-75-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2244-46-0x0000000002DF0000-0x00000000031E2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-93-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2244-87-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-89-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2244-41-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2244-29-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-0-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2244-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2244-95-0x0000000002DF0000-0x00000000031E2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-19-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2244-61-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2244-7-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-2434-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2392-74-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2428-2430-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2428-48-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-57-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2520-2481-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2536-22-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-2503-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-80-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-2431-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2640-20-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2680-2433-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2680-37-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2892-103-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/2892-102-0x000000001B200000-0x000000001B4E2000-memory.dmp

Filesize
2.9MB

Download
memory/3016-2415-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/3016-9-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download