xmrig | 02bf20d1697c9edd149a51162d84df603a877c252fd890d5100445c6d68acfba

Analysis

max time kernel
61s
max time network
60s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
Size

2.1MB
MD5

044a3c19b41e75c894ba87dab46d3a27
SHA1

17bf168f3a54d4f9e4153540bd96c5819e8857c1
SHA256

02bf20d1697c9edd149a51162d84df603a877c252fd890d5100445c6d68acfba
SHA512

4f06119e03b7be8fb5b2441141b261a0b521ef46ea1bdfe9750dd7a2e8e6cba128ca023cbf6770b6694177cfca3545101ae6b42db23844a009fa2d3a05567c0e
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM4Us:NABm

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 17 IoCs

miner

resource	yara_rule
behavioral1/memory/2632-33-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/2992-32-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2828-46-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	xmrig
behavioral1/memory/2436-63-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/3048-674-0x000000013F020000-0x000000013F412000-memory.dmp	xmrig
behavioral1/memory/2512-221-0x000000013FB80000-0x000000013FF72000-memory.dmp	xmrig
behavioral1/memory/2464-86-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/1800-76-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2512-70-0x0000000003640000-0x0000000003A32000-memory.dmp	xmrig
behavioral1/memory/1068-16-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/1068-3319-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/3048-3352-0x000000013F020000-0x000000013F412000-memory.dmp	xmrig
behavioral1/memory/1800-3446-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2436-3483-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/2364-3591-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/2992-3617-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2600-3615-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1068	PVGaRnZ.exe
3048	ovZfRGV.exe
2992	EDRPJIr.exe
2632	yOCGxIF.exe
2828	SjlGEwa.exe
2600	pqBHYVr.exe
2436	bJgwjtE.exe
2364	vSUuyvs.exe
1800	PdkEkgD.exe
2464	AWeqWVv.exe
2684	zMyPkmF.exe
2044	BIVyzQJ.exe
2608	KjkjHNs.exe
1824	UAvZcpd.exe
1808	kZzNCVY.exe
2008	WvUuEKX.exe
1696	jslSApI.exe
2228	pgqqzqD.exe
2408	fXqnuOm.exe
1544	uCHqWwP.exe
1428	jLOTPoZ.exe
640	yMRmpMx.exe
2292	QzoiJcD.exe
2280	ZBqLgPb.exe
1156	FjHppQN.exe
1404	jtwadlh.exe
1040	iKwbENw.exe
2860	gLUGxqx.exe
2300	YamOmaw.exe
1488	JqEzUCP.exe
560	wIwSnrK.exe
1920	vWbtIBv.exe
2388	FSmAxbT.exe
880	SSaHeNq.exe
400	HrGeode.exe
1796	DsxiWXN.exe
3024	tSIeSAp.exe
3044	UDKqcfi.exe
1752	QFCpIVh.exe
1360	KrHzUws.exe
1648	lyovoqp.exe
1764	gSSWGqN.exe
1380	IAlyQTi.exe
936	sXUFBng.exe
1032	liTWKuo.exe
1056	NRUYJvz.exe
1016	CCvbXmk.exe
916	CofewDP.exe
2120	GMiGKvW.exe
2012	BiPKXmB.exe
1136	NYMDBRE.exe
2976	wAPVCvs.exe
664	HagFckz.exe
2100	FwfPidJ.exe
2088	GczbhdI.exe
3016	JQfopNf.exe
888	JantkKl.exe
2944	DBXbTGn.exe
2188	zRvBlIl.exe
1724	JWnmfnY.exe
2572	gfQBbpH.exe
1592	XknvkOC.exe
1588	zXMnuPa.exe
1684	InZIvXy.exe

Loads dropped DLL 64 IoCs

pid	Process
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2512-0-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/files/0x000c000000014f71-3.dat	upx
behavioral1/memory/3048-18-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/memory/2632-33-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/files/0x0007000000015ce1-34.dat	upx
behavioral1/memory/2992-32-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/files/0x0007000000015cd5-26.dat	upx
behavioral1/files/0x003500000001567f-24.dat	upx
behavioral1/memory/2828-46-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	upx
behavioral1/memory/2436-63-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/files/0x0006000000016a9a-103.dat	upx
behavioral1/files/0x0006000000016c6b-115.dat	upx
behavioral1/memory/3048-674-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/memory/2512-221-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/files/0x0006000000016eb2-167.dat	upx
behavioral1/files/0x0006000000016e94-163.dat	upx
behavioral1/files/0x0006000000016dbf-159.dat	upx
behavioral1/files/0x0006000000016dbb-155.dat	upx
behavioral1/files/0x0006000000016da7-151.dat	upx
behavioral1/files/0x0006000000016d90-147.dat	upx
behavioral1/files/0x0006000000016d7e-143.dat	upx
behavioral1/files/0x0006000000016d3a-139.dat	upx
behavioral1/files/0x0006000000016d26-135.dat	upx
behavioral1/files/0x0006000000016d1e-131.dat	upx
behavioral1/files/0x0006000000016d0d-127.dat	upx
behavioral1/files/0x0006000000016ce4-123.dat	upx
behavioral1/files/0x0006000000016cb7-120.dat	upx
behavioral1/files/0x0006000000016c63-111.dat	upx
behavioral1/files/0x0006000000016c4a-107.dat	upx
behavioral1/files/0x0006000000016843-99.dat	upx
behavioral1/files/0x000600000001661c-96.dat	upx
behavioral1/files/0x00060000000164b2-94.dat	upx
behavioral1/files/0x00060000000161e7-60.dat	upx
behavioral1/memory/2684-90-0x000000013F440000-0x000000013F832000-memory.dmp	upx
behavioral1/files/0x0006000000016572-87.dat	upx
behavioral1/memory/2464-86-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/memory/1800-76-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2364-75-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/files/0x003500000001568c-74.dat	upx
behavioral1/files/0x000600000001630b-69.dat	upx
behavioral1/files/0x0009000000015d56-68.dat	upx
behavioral1/files/0x0008000000015d07-50.dat	upx
behavioral1/files/0x0007000000004e76-42.dat	upx
behavioral1/memory/2600-47-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/memory/1068-16-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/files/0x0008000000015cba-15.dat	upx
behavioral1/memory/1068-3319-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/memory/3048-3352-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/memory/1800-3446-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2436-3483-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/memory/2364-3591-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/memory/2992-3617-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2600-3615-0x000000013F210000-0x000000013F602000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vLKTeZC.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\FdDcrkc.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\JbNocaI.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\lFvodga.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\nFbuqCL.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\rMQdWEW.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\UDKqcfi.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\TkcpjHh.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\bofTeem.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\KvkvtTq.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\BrvvVru.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\SnywYDJ.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\pgqqzqD.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\kdDfrbx.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\iaAwvUV.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\GieqRtB.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\JXgXUzY.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\cqCJjFn.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\wAPVCvs.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\nSAnDFX.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\YATmDWq.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\iRuMSLR.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\KGDghaC.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\gozegFW.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\NQnFvqV.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\UKkFyAY.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\FwfPidJ.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\GlNliSO.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\sGPilfb.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\wVSIMkA.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\JantkKl.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\zBeYmxk.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\frMYQnK.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\IqtUJll.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\DUTEGVl.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\mZcBdFS.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\uATQYuv.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\lqdOCZL.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\mwzwHCN.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\YSIFYpI.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\gtrLMjj.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\JySrxpw.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\mmMFntc.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\CFeXbLW.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\BIVyzQJ.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\UxgwJyk.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\MlvVaBW.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\iJzmRyh.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\RHXxsXe.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\GwWYtSs.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\liLjowI.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\EXtbylq.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\MKnnlVN.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\rxeCHDx.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\wXLhxYc.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\OdMvQDE.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\UcWyBgb.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\ajvZumb.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\jLnILNC.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\GJhYBXX.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\HrGeode.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\gzmJfYP.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\XlcOEas.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
File created	C:\Windows\System\QvAdNdb.exe	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2104	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
Token: SeDebugPrivilege	2104	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2104	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	29
PID 2512 wrote to memory of 2104	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	29
PID 2512 wrote to memory of 2104	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	29
PID 2512 wrote to memory of 1068	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	30
PID 2512 wrote to memory of 1068	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	30
PID 2512 wrote to memory of 1068	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	30
PID 2512 wrote to memory of 2992	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	31
PID 2512 wrote to memory of 2992	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	31
PID 2512 wrote to memory of 2992	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	31
PID 2512 wrote to memory of 3048	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	32
PID 2512 wrote to memory of 3048	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	32
PID 2512 wrote to memory of 3048	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	32
PID 2512 wrote to memory of 2632	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	33
PID 2512 wrote to memory of 2632	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	33
PID 2512 wrote to memory of 2632	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	33
PID 2512 wrote to memory of 2828	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	34
PID 2512 wrote to memory of 2828	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	34
PID 2512 wrote to memory of 2828	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	34
PID 2512 wrote to memory of 2600	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	35
PID 2512 wrote to memory of 2600	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	35
PID 2512 wrote to memory of 2600	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	35
PID 2512 wrote to memory of 2436	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	36
PID 2512 wrote to memory of 2436	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	36
PID 2512 wrote to memory of 2436	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	36
PID 2512 wrote to memory of 2464	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	37
PID 2512 wrote to memory of 2464	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	37
PID 2512 wrote to memory of 2464	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	37
PID 2512 wrote to memory of 2364	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	38
PID 2512 wrote to memory of 2364	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	38
PID 2512 wrote to memory of 2364	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	38
PID 2512 wrote to memory of 2044	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	39
PID 2512 wrote to memory of 2044	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	39
PID 2512 wrote to memory of 2044	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	39
PID 2512 wrote to memory of 1800	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	40
PID 2512 wrote to memory of 1800	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	40
PID 2512 wrote to memory of 1800	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	40
PID 2512 wrote to memory of 2608	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	41
PID 2512 wrote to memory of 2608	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	41
PID 2512 wrote to memory of 2608	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	41
PID 2512 wrote to memory of 2684	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	42
PID 2512 wrote to memory of 2684	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	42
PID 2512 wrote to memory of 2684	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	42
PID 2512 wrote to memory of 1824	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	43
PID 2512 wrote to memory of 1824	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	43
PID 2512 wrote to memory of 1824	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	43
PID 2512 wrote to memory of 1808	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	44
PID 2512 wrote to memory of 1808	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	44
PID 2512 wrote to memory of 1808	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	44
PID 2512 wrote to memory of 2008	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	45
PID 2512 wrote to memory of 2008	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	45
PID 2512 wrote to memory of 2008	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	45
PID 2512 wrote to memory of 1696	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	46
PID 2512 wrote to memory of 1696	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	46
PID 2512 wrote to memory of 1696	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	46
PID 2512 wrote to memory of 2228	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	47
PID 2512 wrote to memory of 2228	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	47
PID 2512 wrote to memory of 2228	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	47
PID 2512 wrote to memory of 2408	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	48
PID 2512 wrote to memory of 2408	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	48
PID 2512 wrote to memory of 2408	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	48
PID 2512 wrote to memory of 1544	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	49
PID 2512 wrote to memory of 1544	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	49
PID 2512 wrote to memory of 1544	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	49
PID 2512 wrote to memory of 1428	2512	044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\044a3c19b41e75c894ba87dab46d3a27_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2104
- C:\Windows\System\PVGaRnZ.exe
  C:\Windows\System\PVGaRnZ.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\EDRPJIr.exe
  C:\Windows\System\EDRPJIr.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\ovZfRGV.exe
  C:\Windows\System\ovZfRGV.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\yOCGxIF.exe
  C:\Windows\System\yOCGxIF.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\SjlGEwa.exe
  C:\Windows\System\SjlGEwa.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\pqBHYVr.exe
  C:\Windows\System\pqBHYVr.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\bJgwjtE.exe
  C:\Windows\System\bJgwjtE.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\AWeqWVv.exe
  C:\Windows\System\AWeqWVv.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\vSUuyvs.exe
  C:\Windows\System\vSUuyvs.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\BIVyzQJ.exe
  C:\Windows\System\BIVyzQJ.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\PdkEkgD.exe
  C:\Windows\System\PdkEkgD.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\KjkjHNs.exe
  C:\Windows\System\KjkjHNs.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\zMyPkmF.exe
  C:\Windows\System\zMyPkmF.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\UAvZcpd.exe
  C:\Windows\System\UAvZcpd.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\kZzNCVY.exe
  C:\Windows\System\kZzNCVY.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\WvUuEKX.exe
  C:\Windows\System\WvUuEKX.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\jslSApI.exe
  C:\Windows\System\jslSApI.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\pgqqzqD.exe
  C:\Windows\System\pgqqzqD.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\fXqnuOm.exe
  C:\Windows\System\fXqnuOm.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\uCHqWwP.exe
  C:\Windows\System\uCHqWwP.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\jLOTPoZ.exe
  C:\Windows\System\jLOTPoZ.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\yMRmpMx.exe
  C:\Windows\System\yMRmpMx.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\QzoiJcD.exe
  C:\Windows\System\QzoiJcD.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\ZBqLgPb.exe
  C:\Windows\System\ZBqLgPb.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\FjHppQN.exe
  C:\Windows\System\FjHppQN.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\jtwadlh.exe
  C:\Windows\System\jtwadlh.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\iKwbENw.exe
  C:\Windows\System\iKwbENw.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\gLUGxqx.exe
  C:\Windows\System\gLUGxqx.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\YamOmaw.exe
  C:\Windows\System\YamOmaw.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\JqEzUCP.exe
  C:\Windows\System\JqEzUCP.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\wIwSnrK.exe
  C:\Windows\System\wIwSnrK.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\vWbtIBv.exe
  C:\Windows\System\vWbtIBv.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\FSmAxbT.exe
  C:\Windows\System\FSmAxbT.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\SSaHeNq.exe
  C:\Windows\System\SSaHeNq.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\HrGeode.exe
  C:\Windows\System\HrGeode.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\DsxiWXN.exe
  C:\Windows\System\DsxiWXN.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\tSIeSAp.exe
  C:\Windows\System\tSIeSAp.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\UDKqcfi.exe
  C:\Windows\System\UDKqcfi.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\QFCpIVh.exe
  C:\Windows\System\QFCpIVh.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\KrHzUws.exe
  C:\Windows\System\KrHzUws.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\lyovoqp.exe
  C:\Windows\System\lyovoqp.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\gSSWGqN.exe
  C:\Windows\System\gSSWGqN.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\IAlyQTi.exe
  C:\Windows\System\IAlyQTi.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\sXUFBng.exe
  C:\Windows\System\sXUFBng.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\liTWKuo.exe
  C:\Windows\System\liTWKuo.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\NRUYJvz.exe
  C:\Windows\System\NRUYJvz.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\CCvbXmk.exe
  C:\Windows\System\CCvbXmk.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\CofewDP.exe
  C:\Windows\System\CofewDP.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\GMiGKvW.exe
  C:\Windows\System\GMiGKvW.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\BiPKXmB.exe
  C:\Windows\System\BiPKXmB.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\NYMDBRE.exe
  C:\Windows\System\NYMDBRE.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\wAPVCvs.exe
  C:\Windows\System\wAPVCvs.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\HagFckz.exe
  C:\Windows\System\HagFckz.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\FwfPidJ.exe
  C:\Windows\System\FwfPidJ.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\GczbhdI.exe
  C:\Windows\System\GczbhdI.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\JQfopNf.exe
  C:\Windows\System\JQfopNf.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\JantkKl.exe
  C:\Windows\System\JantkKl.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\DBXbTGn.exe
  C:\Windows\System\DBXbTGn.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\zRvBlIl.exe
  C:\Windows\System\zRvBlIl.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\JWnmfnY.exe
  C:\Windows\System\JWnmfnY.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\gfQBbpH.exe
  C:\Windows\System\gfQBbpH.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\XknvkOC.exe
  C:\Windows\System\XknvkOC.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\zXMnuPa.exe
  C:\Windows\System\zXMnuPa.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\InZIvXy.exe
  C:\Windows\System\InZIvXy.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\GBhTStF.exe
  C:\Windows\System\GBhTStF.exe
  2⤵
  PID:2556
- C:\Windows\System\EnssqlQ.exe
  C:\Windows\System\EnssqlQ.exe
  2⤵
  PID:2660
- C:\Windows\System\fOwPyzD.exe
  C:\Windows\System\fOwPyzD.exe
  2⤵
  PID:2520
- C:\Windows\System\RXmjzeu.exe
  C:\Windows\System\RXmjzeu.exe
  2⤵
  PID:2480
- C:\Windows\System\YnWvKhy.exe
  C:\Windows\System\YnWvKhy.exe
  2⤵
  PID:2964
- C:\Windows\System\IremgHP.exe
  C:\Windows\System\IremgHP.exe
  2⤵
  PID:2552
- C:\Windows\System\KvkvtTq.exe
  C:\Windows\System\KvkvtTq.exe
  2⤵
  PID:2368
- C:\Windows\System\GkjwMVO.exe
  C:\Windows\System\GkjwMVO.exe
  2⤵
  PID:2792
- C:\Windows\System\OdMvQDE.exe
  C:\Windows\System\OdMvQDE.exe
  2⤵
  PID:500
- C:\Windows\System\eDJVeIJ.exe
  C:\Windows\System\eDJVeIJ.exe
  2⤵
  PID:2808
- C:\Windows\System\zBeYmxk.exe
  C:\Windows\System\zBeYmxk.exe
  2⤵
  PID:1744
- C:\Windows\System\rcdGCHJ.exe
  C:\Windows\System\rcdGCHJ.exe
  2⤵
  PID:1344
- C:\Windows\System\MnGjTCf.exe
  C:\Windows\System\MnGjTCf.exe
  2⤵
  PID:2928
- C:\Windows\System\paciHVE.exe
  C:\Windows\System\paciHVE.exe
  2⤵
  PID:2536
- C:\Windows\System\QrzRqQC.exe
  C:\Windows\System\QrzRqQC.exe
  2⤵
  PID:1164
- C:\Windows\System\fjTpdIc.exe
  C:\Windows\System\fjTpdIc.exe
  2⤵
  PID:2260
- C:\Windows\System\tYXVLaS.exe
  C:\Windows\System\tYXVLaS.exe
  2⤵
  PID:2844
- C:\Windows\System\rwLmoTk.exe
  C:\Windows\System\rwLmoTk.exe
  2⤵
  PID:780
- C:\Windows\System\ykkbJtr.exe
  C:\Windows\System\ykkbJtr.exe
  2⤵
  PID:1860
- C:\Windows\System\exgXsvE.exe
  C:\Windows\System\exgXsvE.exe
  2⤵
  PID:1784
- C:\Windows\System\OxYZkXt.exe
  C:\Windows\System\OxYZkXt.exe
  2⤵
  PID:704
- C:\Windows\System\EYNnqur.exe
  C:\Windows\System\EYNnqur.exe
  2⤵
  PID:2180
- C:\Windows\System\nEoPuqU.exe
  C:\Windows\System\nEoPuqU.exe
  2⤵
  PID:2416
- C:\Windows\System\BmhvFzK.exe
  C:\Windows\System\BmhvFzK.exe
  2⤵
  PID:2144
- C:\Windows\System\XuMVONU.exe
  C:\Windows\System\XuMVONU.exe
  2⤵
  PID:812
- C:\Windows\System\ecetWdk.exe
  C:\Windows\System\ecetWdk.exe
  2⤵
  PID:2336
- C:\Windows\System\lGFaurn.exe
  C:\Windows\System\lGFaurn.exe
  2⤵
  PID:900
- C:\Windows\System\qkVwukN.exe
  C:\Windows\System\qkVwukN.exe
  2⤵
  PID:580
- C:\Windows\System\LZEEspz.exe
  C:\Windows\System\LZEEspz.exe
  2⤵
  PID:2164
- C:\Windows\System\KcGnuzN.exe
  C:\Windows\System\KcGnuzN.exe
  2⤵
  PID:2968
- C:\Windows\System\ApHZFJe.exe
  C:\Windows\System\ApHZFJe.exe
  2⤵
  PID:860
- C:\Windows\System\gtrLMjj.exe
  C:\Windows\System\gtrLMjj.exe
  2⤵
  PID:1536
- C:\Windows\System\lCKvAtd.exe
  C:\Windows\System\lCKvAtd.exe
  2⤵
  PID:2348
- C:\Windows\System\rvHflEF.exe
  C:\Windows\System\rvHflEF.exe
  2⤵
  PID:2024
- C:\Windows\System\gzmJfYP.exe
  C:\Windows\System\gzmJfYP.exe
  2⤵
  PID:2960
- C:\Windows\System\ylxqFiD.exe
  C:\Windows\System\ylxqFiD.exe
  2⤵
  PID:3080
- C:\Windows\System\mFAQVgW.exe
  C:\Windows\System\mFAQVgW.exe
  2⤵
  PID:3096
- C:\Windows\System\vIsPQmo.exe
  C:\Windows\System\vIsPQmo.exe
  2⤵
  PID:3120
- C:\Windows\System\lRwgtqD.exe
  C:\Windows\System\lRwgtqD.exe
  2⤵
  PID:3140
- C:\Windows\System\xOeFQGF.exe
  C:\Windows\System\xOeFQGF.exe
  2⤵
  PID:3160
- C:\Windows\System\mubFGwJ.exe
  C:\Windows\System\mubFGwJ.exe
  2⤵
  PID:3180
- C:\Windows\System\sHZiuRS.exe
  C:\Windows\System\sHZiuRS.exe
  2⤵
  PID:3212
- C:\Windows\System\WTjTiwQ.exe
  C:\Windows\System\WTjTiwQ.exe
  2⤵
  PID:3264
- C:\Windows\System\MVrUSsx.exe
  C:\Windows\System\MVrUSsx.exe
  2⤵
  PID:3284
- C:\Windows\System\oiZluYt.exe
  C:\Windows\System\oiZluYt.exe
  2⤵
  PID:3304
- C:\Windows\System\wBseHim.exe
  C:\Windows\System\wBseHim.exe
  2⤵
  PID:3324
- C:\Windows\System\HMPOQhX.exe
  C:\Windows\System\HMPOQhX.exe
  2⤵
  PID:3344
- C:\Windows\System\JySrxpw.exe
  C:\Windows\System\JySrxpw.exe
  2⤵
  PID:3364
- C:\Windows\System\BHRPuNx.exe
  C:\Windows\System\BHRPuNx.exe
  2⤵
  PID:3384
- C:\Windows\System\guNVqxR.exe
  C:\Windows\System\guNVqxR.exe
  2⤵
  PID:3404
- C:\Windows\System\dpErOdb.exe
  C:\Windows\System\dpErOdb.exe
  2⤵
  PID:3424
- C:\Windows\System\oxdZlgn.exe
  C:\Windows\System\oxdZlgn.exe
  2⤵
  PID:3444
- C:\Windows\System\lLxUxeL.exe
  C:\Windows\System\lLxUxeL.exe
  2⤵
  PID:3464
- C:\Windows\System\jrsaRoI.exe
  C:\Windows\System\jrsaRoI.exe
  2⤵
  PID:3484
- C:\Windows\System\znBJQrZ.exe
  C:\Windows\System\znBJQrZ.exe
  2⤵
  PID:3504
- C:\Windows\System\KHkshft.exe
  C:\Windows\System\KHkshft.exe
  2⤵
  PID:3524
- C:\Windows\System\KCuNApY.exe
  C:\Windows\System\KCuNApY.exe
  2⤵
  PID:3544
- C:\Windows\System\ZHNHHiG.exe
  C:\Windows\System\ZHNHHiG.exe
  2⤵
  PID:3564
- C:\Windows\System\AzEyMmV.exe
  C:\Windows\System\AzEyMmV.exe
  2⤵
  PID:3584
- C:\Windows\System\FdDcrkc.exe
  C:\Windows\System\FdDcrkc.exe
  2⤵
  PID:3604
- C:\Windows\System\EyzqvWp.exe
  C:\Windows\System\EyzqvWp.exe
  2⤵
  PID:3624
- C:\Windows\System\ukXsghb.exe
  C:\Windows\System\ukXsghb.exe
  2⤵
  PID:3644
- C:\Windows\System\ekMQcFW.exe
  C:\Windows\System\ekMQcFW.exe
  2⤵
  PID:3660
- C:\Windows\System\kgRqvce.exe
  C:\Windows\System\kgRqvce.exe
  2⤵
  PID:3680
- C:\Windows\System\KJpAukQ.exe
  C:\Windows\System\KJpAukQ.exe
  2⤵
  PID:3700
- C:\Windows\System\LhOTcpS.exe
  C:\Windows\System\LhOTcpS.exe
  2⤵
  PID:3720
- C:\Windows\System\xTNFKXC.exe
  C:\Windows\System\xTNFKXC.exe
  2⤵
  PID:3740
- C:\Windows\System\gozegFW.exe
  C:\Windows\System\gozegFW.exe
  2⤵
  PID:3760
- C:\Windows\System\UcWyBgb.exe
  C:\Windows\System\UcWyBgb.exe
  2⤵
  PID:3776
- C:\Windows\System\bzQlRfN.exe
  C:\Windows\System\bzQlRfN.exe
  2⤵
  PID:3800
- C:\Windows\System\JEtugrc.exe
  C:\Windows\System\JEtugrc.exe
  2⤵
  PID:3820
- C:\Windows\System\PoIRlhi.exe
  C:\Windows\System\PoIRlhi.exe
  2⤵
  PID:3840
- C:\Windows\System\VTGMVNE.exe
  C:\Windows\System\VTGMVNE.exe
  2⤵
  PID:3860
- C:\Windows\System\ZzbOijc.exe
  C:\Windows\System\ZzbOijc.exe
  2⤵
  PID:3880
- C:\Windows\System\RiDegFL.exe
  C:\Windows\System\RiDegFL.exe
  2⤵
  PID:3896
- C:\Windows\System\hsbamfp.exe
  C:\Windows\System\hsbamfp.exe
  2⤵
  PID:3920
- C:\Windows\System\QvAdNdb.exe
  C:\Windows\System\QvAdNdb.exe
  2⤵
  PID:3936
- C:\Windows\System\yweEALu.exe
  C:\Windows\System\yweEALu.exe
  2⤵
  PID:3960
- C:\Windows\System\RADuEoS.exe
  C:\Windows\System\RADuEoS.exe
  2⤵
  PID:3976
- C:\Windows\System\xZmHOiR.exe
  C:\Windows\System\xZmHOiR.exe
  2⤵
  PID:4000
- C:\Windows\System\ELjxEoj.exe
  C:\Windows\System\ELjxEoj.exe
  2⤵
  PID:4016
- C:\Windows\System\jdDsKTG.exe
  C:\Windows\System\jdDsKTG.exe
  2⤵
  PID:4036
- C:\Windows\System\nHFewfA.exe
  C:\Windows\System\nHFewfA.exe
  2⤵
  PID:4064
- C:\Windows\System\eeiqcFc.exe
  C:\Windows\System\eeiqcFc.exe
  2⤵
  PID:4084
- C:\Windows\System\uFEiGGJ.exe
  C:\Windows\System\uFEiGGJ.exe
  2⤵
  PID:2588
- C:\Windows\System\ajvZumb.exe
  C:\Windows\System\ajvZumb.exe
  2⤵
  PID:2544
- C:\Windows\System\ylCpgyl.exe
  C:\Windows\System\ylCpgyl.exe
  2⤵
  PID:1568
- C:\Windows\System\DZPSvbb.exe
  C:\Windows\System\DZPSvbb.exe
  2⤵
  PID:1948
- C:\Windows\System\WoqRRTn.exe
  C:\Windows\System\WoqRRTn.exe
  2⤵
  PID:1816
- C:\Windows\System\gUoeKZb.exe
  C:\Windows\System\gUoeKZb.exe
  2⤵
  PID:632
- C:\Windows\System\RUJEptr.exe
  C:\Windows\System\RUJEptr.exe
  2⤵
  PID:1768
- C:\Windows\System\ftzvFws.exe
  C:\Windows\System\ftzvFws.exe
  2⤵
  PID:3112
- C:\Windows\System\oZUMDML.exe
  C:\Windows\System\oZUMDML.exe
  2⤵
  PID:3188
- C:\Windows\System\bRFEypq.exe
  C:\Windows\System\bRFEypq.exe
  2⤵
  PID:1088
- C:\Windows\System\PFzkkAU.exe
  C:\Windows\System\PFzkkAU.exe
  2⤵
  PID:956
- C:\Windows\System\nRSuMoU.exe
  C:\Windows\System\nRSuMoU.exe
  2⤵
  PID:1524
- C:\Windows\System\MKnnlVN.exe
  C:\Windows\System\MKnnlVN.exe
  2⤵
  PID:2036
- C:\Windows\System\DlbxpSG.exe
  C:\Windows\System\DlbxpSG.exe
  2⤵
  PID:1248
- C:\Windows\System\fVVLtKd.exe
  C:\Windows\System\fVVLtKd.exe
  2⤵
  PID:1580
- C:\Windows\System\kdDfrbx.exe
  C:\Windows\System\kdDfrbx.exe
  2⤵
  PID:2020
- C:\Windows\System\KZXdvHv.exe
  C:\Windows\System\KZXdvHv.exe
  2⤵
  PID:2668
- C:\Windows\System\eUKxnvk.exe
  C:\Windows\System\eUKxnvk.exe
  2⤵
  PID:3224
- C:\Windows\System\eAsjTtN.exe
  C:\Windows\System\eAsjTtN.exe
  2⤵
  PID:3232
- C:\Windows\System\LywwwgM.exe
  C:\Windows\System\LywwwgM.exe
  2⤵
  PID:3172
- C:\Windows\System\DXQqdJd.exe
  C:\Windows\System\DXQqdJd.exe
  2⤵
  PID:3092
- C:\Windows\System\zWnxZMR.exe
  C:\Windows\System\zWnxZMR.exe
  2⤵
  PID:1036
- C:\Windows\System\jOAeUpM.exe
  C:\Windows\System\jOAeUpM.exe
  2⤵
  PID:3260
- C:\Windows\System\fEwcOfB.exe
  C:\Windows\System\fEwcOfB.exe
  2⤵
  PID:2076
- C:\Windows\System\IPFiHII.exe
  C:\Windows\System\IPFiHII.exe
  2⤵
  PID:3356
- C:\Windows\System\jtptHnc.exe
  C:\Windows\System\jtptHnc.exe
  2⤵
  PID:3392
- C:\Windows\System\LBsxLeI.exe
  C:\Windows\System\LBsxLeI.exe
  2⤵
  PID:3372
- C:\Windows\System\HbQaOnq.exe
  C:\Windows\System\HbQaOnq.exe
  2⤵
  PID:3380
- C:\Windows\System\raZBpAg.exe
  C:\Windows\System\raZBpAg.exe
  2⤵
  PID:3436
- C:\Windows\System\BkDyuHy.exe
  C:\Windows\System\BkDyuHy.exe
  2⤵
  PID:3452
- C:\Windows\System\khumTNf.exe
  C:\Windows\System\khumTNf.exe
  2⤵
  PID:3512
- C:\Windows\System\QPImSqg.exe
  C:\Windows\System\QPImSqg.exe
  2⤵
  PID:3460
- C:\Windows\System\RWVvONg.exe
  C:\Windows\System\RWVvONg.exe
  2⤵
  PID:3552
- C:\Windows\System\BneKhcS.exe
  C:\Windows\System\BneKhcS.exe
  2⤵
  PID:3560
- C:\Windows\System\IqtUJll.exe
  C:\Windows\System\IqtUJll.exe
  2⤵
  PID:1940
- C:\Windows\System\tXIedlc.exe
  C:\Windows\System\tXIedlc.exe
  2⤵
  PID:3572
- C:\Windows\System\LKrqOCe.exe
  C:\Windows\System\LKrqOCe.exe
  2⤵
  PID:2420
- C:\Windows\System\ubChsKe.exe
  C:\Windows\System\ubChsKe.exe
  2⤵
  PID:3580
- C:\Windows\System\TkcpjHh.exe
  C:\Windows\System\TkcpjHh.exe
  2⤵
  PID:3616
- C:\Windows\System\BrvvVru.exe
  C:\Windows\System\BrvvVru.exe
  2⤵
  PID:3756
- C:\Windows\System\ujVuIjH.exe
  C:\Windows\System\ujVuIjH.exe
  2⤵
  PID:3788
- C:\Windows\System\RfAdHOM.exe
  C:\Windows\System\RfAdHOM.exe
  2⤵
  PID:3656
- C:\Windows\System\CcsddFy.exe
  C:\Windows\System\CcsddFy.exe
  2⤵
  PID:2716
- C:\Windows\System\qXYXDpr.exe
  C:\Windows\System\qXYXDpr.exe
  2⤵
  PID:2664
- C:\Windows\System\dRzqIZD.exe
  C:\Windows\System\dRzqIZD.exe
  2⤵
  PID:3872
- C:\Windows\System\voQRqdp.exe
  C:\Windows\System\voQRqdp.exe
  2⤵
  PID:3916
- C:\Windows\System\tKZHjPS.exe
  C:\Windows\System\tKZHjPS.exe
  2⤵
  PID:2524
- C:\Windows\System\DxhRSjp.exe
  C:\Windows\System\DxhRSjp.exe
  2⤵
  PID:3912
- C:\Windows\System\ToQkXcG.exe
  C:\Windows\System\ToQkXcG.exe
  2⤵
  PID:3952
- C:\Windows\System\qDDxZlz.exe
  C:\Windows\System\qDDxZlz.exe
  2⤵
  PID:3984
- C:\Windows\System\pQwhiIp.exe
  C:\Windows\System\pQwhiIp.exe
  2⤵
  PID:3852
- C:\Windows\System\eBDsfEn.exe
  C:\Windows\System\eBDsfEn.exe
  2⤵
  PID:2776
- C:\Windows\System\QRROHIH.exe
  C:\Windows\System\QRROHIH.exe
  2⤵
  PID:4032
- C:\Windows\System\aFtWZCP.exe
  C:\Windows\System\aFtWZCP.exe
  2⤵
  PID:3972
- C:\Windows\System\lcovGuf.exe
  C:\Windows\System\lcovGuf.exe
  2⤵
  PID:4044
- C:\Windows\System\PsKCloU.exe
  C:\Windows\System\PsKCloU.exe
  2⤵
  PID:3968
- C:\Windows\System\hdetovI.exe
  C:\Windows\System\hdetovI.exe
  2⤵
  PID:4080
- C:\Windows\System\YVebQGY.exe
  C:\Windows\System\YVebQGY.exe
  2⤵
  PID:2592
- C:\Windows\System\pdFbkVW.exe
  C:\Windows\System\pdFbkVW.exe
  2⤵
  PID:2268
- C:\Windows\System\GIworso.exe
  C:\Windows\System\GIworso.exe
  2⤵
  PID:2160
- C:\Windows\System\XFcFcND.exe
  C:\Windows\System\XFcFcND.exe
  2⤵
  PID:1280
- C:\Windows\System\acKkwXm.exe
  C:\Windows\System\acKkwXm.exe
  2⤵
  PID:2256
- C:\Windows\System\DvmIfRT.exe
  C:\Windows\System\DvmIfRT.exe
  2⤵
  PID:3056
- C:\Windows\System\ioGNXrb.exe
  C:\Windows\System\ioGNXrb.exe
  2⤵
  PID:1980
- C:\Windows\System\ZLsKjon.exe
  C:\Windows\System\ZLsKjon.exe
  2⤵
  PID:1328
- C:\Windows\System\cCxzzfT.exe
  C:\Windows\System\cCxzzfT.exe
  2⤵
  PID:2312
- C:\Windows\System\pmYoIYw.exe
  C:\Windows\System\pmYoIYw.exe
  2⤵
  PID:620
- C:\Windows\System\XupkRiY.exe
  C:\Windows\System\XupkRiY.exe
  2⤵
  PID:3156
- C:\Windows\System\pyJyWeJ.exe
  C:\Windows\System\pyJyWeJ.exe
  2⤵
  PID:876
- C:\Windows\System\DPgBDJb.exe
  C:\Windows\System\DPgBDJb.exe
  2⤵
  PID:3064
- C:\Windows\System\DfcpVuY.exe
  C:\Windows\System\DfcpVuY.exe
  2⤵
  PID:2196
- C:\Windows\System\lhfWCeG.exe
  C:\Windows\System\lhfWCeG.exe
  2⤵
  PID:2584
- C:\Windows\System\jeEktCM.exe
  C:\Windows\System\jeEktCM.exe
  2⤵
  PID:2816
- C:\Windows\System\dSpWsMa.exe
  C:\Windows\System\dSpWsMa.exe
  2⤵
  PID:2796
- C:\Windows\System\LtczOJV.exe
  C:\Windows\System\LtczOJV.exe
  2⤵
  PID:2440
- C:\Windows\System\gipFAkR.exe
  C:\Windows\System\gipFAkR.exe
  2⤵
  PID:1716
- C:\Windows\System\kmRTkDp.exe
  C:\Windows\System\kmRTkDp.exe
  2⤵
  PID:1660
- C:\Windows\System\hFJmpcg.exe
  C:\Windows\System\hFJmpcg.exe
  2⤵
  PID:3136
- C:\Windows\System\sZHkQkf.exe
  C:\Windows\System\sZHkQkf.exe
  2⤵
  PID:3280
- C:\Windows\System\QmNUbhe.exe
  C:\Windows\System\QmNUbhe.exe
  2⤵
  PID:3300
- C:\Windows\System\XLxsdmq.exe
  C:\Windows\System\XLxsdmq.exe
  2⤵
  PID:3420
- C:\Windows\System\VEOrEyD.exe
  C:\Windows\System\VEOrEyD.exe
  2⤵
  PID:3520
- C:\Windows\System\MaNLABd.exe
  C:\Windows\System\MaNLABd.exe
  2⤵
  PID:3496
- C:\Windows\System\TdlzEdg.exe
  C:\Windows\System\TdlzEdg.exe
  2⤵
  PID:3640
- C:\Windows\System\cKJdLXD.exe
  C:\Windows\System\cKJdLXD.exe
  2⤵
  PID:3708
- C:\Windows\System\zzJitDN.exe
  C:\Windows\System\zzJitDN.exe
  2⤵
  PID:3752
- C:\Windows\System\GYoEexs.exe
  C:\Windows\System\GYoEexs.exe
  2⤵
  PID:3652
- C:\Windows\System\LSldkXM.exe
  C:\Windows\System\LSldkXM.exe
  2⤵
  PID:3832
- C:\Windows\System\eioGApz.exe
  C:\Windows\System\eioGApz.exe
  2⤵
  PID:3816
- C:\Windows\System\DUTEGVl.exe
  C:\Windows\System\DUTEGVl.exe
  2⤵
  PID:2832
- C:\Windows\System\IqOtcNy.exe
  C:\Windows\System\IqOtcNy.exe
  2⤵
  PID:3932
- C:\Windows\System\rlBAYZS.exe
  C:\Windows\System\rlBAYZS.exe
  2⤵
  PID:4008
- C:\Windows\System\CEzoZJx.exe
  C:\Windows\System\CEzoZJx.exe
  2⤵
  PID:4092
- C:\Windows\System\dQjKetM.exe
  C:\Windows\System\dQjKetM.exe
  2⤵
  PID:2936
- C:\Windows\System\QZonAJs.exe
  C:\Windows\System\QZonAJs.exe
  2⤵
  PID:1984
- C:\Windows\System\wkEjOlx.exe
  C:\Windows\System\wkEjOlx.exe
  2⤵
  PID:2504
- C:\Windows\System\frMYQnK.exe
  C:\Windows\System\frMYQnK.exe
  2⤵
  PID:3256
- C:\Windows\System\fxhyPSX.exe
  C:\Windows\System\fxhyPSX.exe
  2⤵
  PID:1812
- C:\Windows\System\JxzTgWF.exe
  C:\Windows\System\JxzTgWF.exe
  2⤵
  PID:3220
- C:\Windows\System\GwWYtSs.exe
  C:\Windows\System\GwWYtSs.exe
  2⤵
  PID:1748
- C:\Windows\System\UOxzmAb.exe
  C:\Windows\System\UOxzmAb.exe
  2⤵
  PID:3272
- C:\Windows\System\FIeWoqL.exe
  C:\Windows\System\FIeWoqL.exe
  2⤵
  PID:2444
- C:\Windows\System\JpfLygf.exe
  C:\Windows\System\JpfLygf.exe
  2⤵
  PID:1492
- C:\Windows\System\QdVPVkI.exe
  C:\Windows\System\QdVPVkI.exe
  2⤵
  PID:1596
- C:\Windows\System\aeWZgLu.exe
  C:\Windows\System\aeWZgLu.exe
  2⤵
  PID:2000
- C:\Windows\System\liLjowI.exe
  C:\Windows\System\liLjowI.exe
  2⤵
  PID:2740
- C:\Windows\System\ZnavgvN.exe
  C:\Windows\System\ZnavgvN.exe
  2⤵
  PID:2692
- C:\Windows\System\iDSnzFu.exe
  C:\Windows\System\iDSnzFu.exe
  2⤵
  PID:4136
- C:\Windows\System\VklxATw.exe
  C:\Windows\System\VklxATw.exe
  2⤵
  PID:4152
- C:\Windows\System\yVItsxu.exe
  C:\Windows\System\yVItsxu.exe
  2⤵
  PID:4168
- C:\Windows\System\HSZXAvk.exe
  C:\Windows\System\HSZXAvk.exe
  2⤵
  PID:4184
- C:\Windows\System\OZAYzmI.exe
  C:\Windows\System\OZAYzmI.exe
  2⤵
  PID:4200
- C:\Windows\System\vVqRGDt.exe
  C:\Windows\System\vVqRGDt.exe
  2⤵
  PID:4216
- C:\Windows\System\ibHazNY.exe
  C:\Windows\System\ibHazNY.exe
  2⤵
  PID:4232
- C:\Windows\System\AZbtKPF.exe
  C:\Windows\System\AZbtKPF.exe
  2⤵
  PID:4248
- C:\Windows\System\XYmCCbK.exe
  C:\Windows\System\XYmCCbK.exe
  2⤵
  PID:4264
- C:\Windows\System\LmtFEJd.exe
  C:\Windows\System\LmtFEJd.exe
  2⤵
  PID:4280
- C:\Windows\System\dYydBQD.exe
  C:\Windows\System\dYydBQD.exe
  2⤵
  PID:4296
- C:\Windows\System\XlcOEas.exe
  C:\Windows\System\XlcOEas.exe
  2⤵
  PID:4312
- C:\Windows\System\NIWHqTT.exe
  C:\Windows\System\NIWHqTT.exe
  2⤵
  PID:4328
- C:\Windows\System\JljwqJN.exe
  C:\Windows\System\JljwqJN.exe
  2⤵
  PID:4344
- C:\Windows\System\pOvSVjF.exe
  C:\Windows\System\pOvSVjF.exe
  2⤵
  PID:4360
- C:\Windows\System\mmMFntc.exe
  C:\Windows\System\mmMFntc.exe
  2⤵
  PID:4376
- C:\Windows\System\dJcfkRP.exe
  C:\Windows\System\dJcfkRP.exe
  2⤵
  PID:4440
- C:\Windows\System\dcWqlWW.exe
  C:\Windows\System\dcWqlWW.exe
  2⤵
  PID:4456
- C:\Windows\System\mgQTGPv.exe
  C:\Windows\System\mgQTGPv.exe
  2⤵
  PID:4556
- C:\Windows\System\kFZJOWb.exe
  C:\Windows\System\kFZJOWb.exe
  2⤵
  PID:4572
- C:\Windows\System\GpatLEd.exe
  C:\Windows\System\GpatLEd.exe
  2⤵
  PID:4588
- C:\Windows\System\iayINuu.exe
  C:\Windows\System\iayINuu.exe
  2⤵
  PID:4616
- C:\Windows\System\GlNliSO.exe
  C:\Windows\System\GlNliSO.exe
  2⤵
  PID:4632
- C:\Windows\System\ZmgfSHX.exe
  C:\Windows\System\ZmgfSHX.exe
  2⤵
  PID:4648
- C:\Windows\System\uBJtjRr.exe
  C:\Windows\System\uBJtjRr.exe
  2⤵
  PID:4664
- C:\Windows\System\ofZcpoi.exe
  C:\Windows\System\ofZcpoi.exe
  2⤵
  PID:4684
- C:\Windows\System\RPkQgEp.exe
  C:\Windows\System\RPkQgEp.exe
  2⤵
  PID:4700
- C:\Windows\System\wnzYoaG.exe
  C:\Windows\System\wnzYoaG.exe
  2⤵
  PID:4716
- C:\Windows\System\DkLCyxs.exe
  C:\Windows\System\DkLCyxs.exe
  2⤵
  PID:4736
- C:\Windows\System\glvVcwG.exe
  C:\Windows\System\glvVcwG.exe
  2⤵
  PID:4752
- C:\Windows\System\mvKBIqi.exe
  C:\Windows\System\mvKBIqi.exe
  2⤵
  PID:4768
- C:\Windows\System\yAiHiwJ.exe
  C:\Windows\System\yAiHiwJ.exe
  2⤵
  PID:4788
- C:\Windows\System\UuyKpIQ.exe
  C:\Windows\System\UuyKpIQ.exe
  2⤵
  PID:4804
- C:\Windows\System\UxgwJyk.exe
  C:\Windows\System\UxgwJyk.exe
  2⤵
  PID:4820
- C:\Windows\System\gzLCtBP.exe
  C:\Windows\System\gzLCtBP.exe
  2⤵
  PID:4836
- C:\Windows\System\nSAnDFX.exe
  C:\Windows\System\nSAnDFX.exe
  2⤵
  PID:4856
- C:\Windows\System\TZdSYRK.exe
  C:\Windows\System\TZdSYRK.exe
  2⤵
  PID:4872
- C:\Windows\System\nfPqUlu.exe
  C:\Windows\System\nfPqUlu.exe
  2⤵
  PID:4888
- C:\Windows\System\YATmDWq.exe
  C:\Windows\System\YATmDWq.exe
  2⤵
  PID:4904
- C:\Windows\System\RonUnKR.exe
  C:\Windows\System\RonUnKR.exe
  2⤵
  PID:4972
- C:\Windows\System\VMtUYmN.exe
  C:\Windows\System\VMtUYmN.exe
  2⤵
  PID:4992
- C:\Windows\System\hiMwKGR.exe
  C:\Windows\System\hiMwKGR.exe
  2⤵
  PID:5012
- C:\Windows\System\lBFqNdF.exe
  C:\Windows\System\lBFqNdF.exe
  2⤵
  PID:5040
- C:\Windows\System\bLntwQN.exe
  C:\Windows\System\bLntwQN.exe
  2⤵
  PID:5056
- C:\Windows\System\vboSgtG.exe
  C:\Windows\System\vboSgtG.exe
  2⤵
  PID:5072
- C:\Windows\System\frjsUVz.exe
  C:\Windows\System\frjsUVz.exe
  2⤵
  PID:5088
- C:\Windows\System\GTaTaNC.exe
  C:\Windows\System\GTaTaNC.exe
  2⤵
  PID:5104
- C:\Windows\System\syCxMRS.exe
  C:\Windows\System\syCxMRS.exe
  2⤵
  PID:3676
- C:\Windows\System\dBpNtyG.exe
  C:\Windows\System\dBpNtyG.exe
  2⤵
  PID:3908
- C:\Windows\System\tCZPkYi.exe
  C:\Windows\System\tCZPkYi.exe
  2⤵
  PID:3736
- C:\Windows\System\qBTEGqz.exe
  C:\Windows\System\qBTEGqz.exe
  2⤵
  PID:3992
- C:\Windows\System\HkhDhla.exe
  C:\Windows\System\HkhDhla.exe
  2⤵
  PID:1996
- C:\Windows\System\wpdtTjJ.exe
  C:\Windows\System\wpdtTjJ.exe
  2⤵
  PID:2720
- C:\Windows\System\fFmrFpJ.exe
  C:\Windows\System\fFmrFpJ.exe
  2⤵
  PID:2636
- C:\Windows\System\mQJjMGH.exe
  C:\Windows\System\mQJjMGH.exe
  2⤵
  PID:3228
- C:\Windows\System\HDFaOEH.exe
  C:\Windows\System\HDFaOEH.exe
  2⤵
  PID:3596
- C:\Windows\System\WLgPlnF.exe
  C:\Windows\System\WLgPlnF.exe
  2⤵
  PID:3692
- C:\Windows\System\ZpzVogk.exe
  C:\Windows\System\ZpzVogk.exe
  2⤵
  PID:4072
- C:\Windows\System\WfKmdZp.exe
  C:\Windows\System\WfKmdZp.exe
  2⤵
  PID:2772
- C:\Windows\System\ZRhnJRV.exe
  C:\Windows\System\ZRhnJRV.exe
  2⤵
  PID:3340
- C:\Windows\System\IWwXEiN.exe
  C:\Windows\System\IWwXEiN.exe
  2⤵
  PID:696
- C:\Windows\System\sGPilfb.exe
  C:\Windows\System\sGPilfb.exe
  2⤵
  PID:576
- C:\Windows\System\YpamDxv.exe
  C:\Windows\System\YpamDxv.exe
  2⤵
  PID:4160
- C:\Windows\System\xHQhprn.exe
  C:\Windows\System\xHQhprn.exe
  2⤵
  PID:4176
- C:\Windows\System\VazFAxN.exe
  C:\Windows\System\VazFAxN.exe
  2⤵
  PID:1288
- C:\Windows\System\pTxluTt.exe
  C:\Windows\System\pTxluTt.exe
  2⤵
  PID:2696
- C:\Windows\System\fQfRuYL.exe
  C:\Windows\System\fQfRuYL.exe
  2⤵
  PID:1604
- C:\Windows\System\PcQxdWO.exe
  C:\Windows\System\PcQxdWO.exe
  2⤵
  PID:4336
- C:\Windows\System\tAFYeGN.exe
  C:\Windows\System\tAFYeGN.exe
  2⤵
  PID:4240
- C:\Windows\System\GDTQMle.exe
  C:\Windows\System\GDTQMle.exe
  2⤵
  PID:4388
- C:\Windows\System\tiRTXqc.exe
  C:\Windows\System\tiRTXqc.exe
  2⤵
  PID:4288
- C:\Windows\System\TBUukbw.exe
  C:\Windows\System\TBUukbw.exe
  2⤵
  PID:4412
- C:\Windows\System\iVLikWR.exe
  C:\Windows\System\iVLikWR.exe
  2⤵
  PID:4424
- C:\Windows\System\GwuAanz.exe
  C:\Windows\System\GwuAanz.exe
  2⤵
  PID:4448
- C:\Windows\System\DNyKhqc.exe
  C:\Windows\System\DNyKhqc.exe
  2⤵
  PID:4476
- C:\Windows\System\jLnILNC.exe
  C:\Windows\System\jLnILNC.exe
  2⤵
  PID:4492
- C:\Windows\System\fnbpBsx.exe
  C:\Windows\System\fnbpBsx.exe
  2⤵
  PID:2628
- C:\Windows\System\SjEWZnk.exe
  C:\Windows\System\SjEWZnk.exe
  2⤵
  PID:4524
- C:\Windows\System\XaNudiA.exe
  C:\Windows\System\XaNudiA.exe
  2⤵
  PID:4540
- C:\Windows\System\rmEwrdS.exe
  C:\Windows\System\rmEwrdS.exe
  2⤵
  PID:4568
- C:\Windows\System\uQgdSSc.exe
  C:\Windows\System\uQgdSSc.exe
  2⤵
  PID:2432
- C:\Windows\System\YVJslmV.exe
  C:\Windows\System\YVJslmV.exe
  2⤵
  PID:4628
- C:\Windows\System\BaRNMao.exe
  C:\Windows\System\BaRNMao.exe
  2⤵
  PID:4640
- C:\Windows\System\ckrUBoX.exe
  C:\Windows\System\ckrUBoX.exe
  2⤵
  PID:4724
- C:\Windows\System\etMpZyD.exe
  C:\Windows\System\etMpZyD.exe
  2⤵
  PID:4780
- C:\Windows\System\CfARaMd.exe
  C:\Windows\System\CfARaMd.exe
  2⤵
  PID:4748
- C:\Windows\System\JbNocaI.exe
  C:\Windows\System\JbNocaI.exe
  2⤵
  PID:4676
- C:\Windows\System\wehffYV.exe
  C:\Windows\System\wehffYV.exe
  2⤵
  PID:4816
- C:\Windows\System\mNIgODW.exe
  C:\Windows\System\mNIgODW.exe
  2⤵
  PID:5020
- C:\Windows\System\bofTeem.exe
  C:\Windows\System\bofTeem.exe
  2⤵
  PID:2784
- C:\Windows\System\hwDRYPQ.exe
  C:\Windows\System\hwDRYPQ.exe
  2⤵
  PID:1284
- C:\Windows\System\bSgZfXB.exe
  C:\Windows\System\bSgZfXB.exe
  2⤵
  PID:5052
- C:\Windows\System\tYBnzew.exe
  C:\Windows\System\tYBnzew.exe
  2⤵
  PID:3892
- C:\Windows\System\HWdOnet.exe
  C:\Windows\System\HWdOnet.exe
  2⤵
  PID:1692
- C:\Windows\System\EsAkOFk.exe
  C:\Windows\System\EsAkOFk.exe
  2⤵
  PID:2496
- C:\Windows\System\CzRAgod.exe
  C:\Windows\System\CzRAgod.exe
  2⤵
  PID:3732
- C:\Windows\System\dzPNFQk.exe
  C:\Windows\System\dzPNFQk.exe
  2⤵
  PID:4980
- C:\Windows\System\AcUCQTa.exe
  C:\Windows\System\AcUCQTa.exe
  2⤵
  PID:992
- C:\Windows\System\WToxhOb.exe
  C:\Windows\System\WToxhOb.exe
  2⤵
  PID:736
- C:\Windows\System\sFwFeuF.exe
  C:\Windows\System\sFwFeuF.exe
  2⤵
  PID:3480
- C:\Windows\System\exyoIGh.exe
  C:\Windows\System\exyoIGh.exe
  2⤵
  PID:3996
- C:\Windows\System\RUoXCQD.exe
  C:\Windows\System\RUoXCQD.exe
  2⤵
  PID:360
- C:\Windows\System\UPltAIA.exe
  C:\Windows\System\UPltAIA.exe
  2⤵
  PID:3376
- C:\Windows\System\jCOFkuj.exe
  C:\Windows\System\jCOFkuj.exe
  2⤵
  PID:2168
- C:\Windows\System\dWgcpDD.exe
  C:\Windows\System\dWgcpDD.exe
  2⤵
  PID:4196
- C:\Windows\System\mZTrQoa.exe
  C:\Windows\System\mZTrQoa.exe
  2⤵
  PID:2108
- C:\Windows\System\GJhYBXX.exe
  C:\Windows\System\GJhYBXX.exe
  2⤵
  PID:4224
- C:\Windows\System\fEqwfgc.exe
  C:\Windows\System\fEqwfgc.exe
  2⤵
  PID:4340
- C:\Windows\System\XIkAqcn.exe
  C:\Windows\System\XIkAqcn.exe
  2⤵
  PID:4260
- C:\Windows\System\eZJaxkV.exe
  C:\Windows\System\eZJaxkV.exe
  2⤵
  PID:4356
- C:\Windows\System\KByLtil.exe
  C:\Windows\System\KByLtil.exe
  2⤵
  PID:4404
- C:\Windows\System\ZWmKduB.exe
  C:\Windows\System\ZWmKduB.exe
  2⤵
  PID:2680
- C:\Windows\System\paJkvCj.exe
  C:\Windows\System\paJkvCj.exe
  2⤵
  PID:4480
- C:\Windows\System\ggkrtYe.exe
  C:\Windows\System\ggkrtYe.exe
  2⤵
  PID:4520
- C:\Windows\System\mEeyKTH.exe
  C:\Windows\System\mEeyKTH.exe
  2⤵
  PID:4580
- C:\Windows\System\YwZRWYa.exe
  C:\Windows\System\YwZRWYa.exe
  2⤵
  PID:4600
- C:\Windows\System\stzIyiw.exe
  C:\Windows\System\stzIyiw.exe
  2⤵
  PID:4692
- C:\Windows\System\akIizSm.exe
  C:\Windows\System\akIizSm.exe
  2⤵
  PID:4680
- C:\Windows\System\YiahLPv.exe
  C:\Windows\System\YiahLPv.exe
  2⤵
  PID:4848
- C:\Windows\System\JMQfykB.exe
  C:\Windows\System\JMQfykB.exe
  2⤵
  PID:4932
- C:\Windows\System\DgRiNXT.exe
  C:\Windows\System\DgRiNXT.exe
  2⤵
  PID:4912
- C:\Windows\System\uATQYuv.exe
  C:\Windows\System\uATQYuv.exe
  2⤵
  PID:4968
- C:\Windows\System\RjcIecs.exe
  C:\Windows\System\RjcIecs.exe
  2⤵
  PID:4884
- C:\Windows\System\GieqRtB.exe
  C:\Windows\System\GieqRtB.exe
  2⤵
  PID:4960
- C:\Windows\System\ZcEYImF.exe
  C:\Windows\System\ZcEYImF.exe
  2⤵
  PID:5024
- C:\Windows\System\Fnqeyyt.exe
  C:\Windows\System\Fnqeyyt.exe
  2⤵
  PID:3784
- C:\Windows\System\IDPaYux.exe
  C:\Windows\System\IDPaYux.exe
  2⤵
  PID:1028
- C:\Windows\System\ROYAkIc.exe
  C:\Windows\System\ROYAkIc.exe
  2⤵
  PID:2084
- C:\Windows\System\VRbGEBq.exe
  C:\Windows\System\VRbGEBq.exe
  2⤵
  PID:3108
- C:\Windows\System\dquJrVJ.exe
  C:\Windows\System\dquJrVJ.exe
  2⤵
  PID:868
- C:\Windows\System\KcaqwLi.exe
  C:\Windows\System\KcaqwLi.exe
  2⤵
  PID:3472
- C:\Windows\System\KMFWuNe.exe
  C:\Windows\System\KMFWuNe.exe
  2⤵
  PID:3712
- C:\Windows\System\RcWxfNW.exe
  C:\Windows\System\RcWxfNW.exe
  2⤵
  PID:2896
- C:\Windows\System\DbcKHcD.exe
  C:\Windows\System\DbcKHcD.exe
  2⤵
  PID:2812
- C:\Windows\System\lxrAWJc.exe
  C:\Windows\System\lxrAWJc.exe
  2⤵
  PID:4180
- C:\Windows\System\TYpMARu.exe
  C:\Windows\System\TYpMARu.exe
  2⤵
  PID:1520
- C:\Windows\System\bfctyQq.exe
  C:\Windows\System\bfctyQq.exe
  2⤵
  PID:4428
- C:\Windows\System\pwUszvL.exe
  C:\Windows\System\pwUszvL.exe
  2⤵
  PID:4472
- C:\Windows\System\qwNmJIH.exe
  C:\Windows\System\qwNmJIH.exe
  2⤵
  PID:4320
- C:\Windows\System\SmQFpcZ.exe
  C:\Windows\System\SmQFpcZ.exe
  2⤵
  PID:4548
- C:\Windows\System\xKSzuyi.exe
  C:\Windows\System\xKSzuyi.exe
  2⤵
  PID:2712
- C:\Windows\System\aKXXEZV.exe
  C:\Windows\System\aKXXEZV.exe
  2⤵
  PID:4644
- C:\Windows\System\czETLyf.exe
  C:\Windows\System\czETLyf.exe
  2⤵
  PID:4696
- C:\Windows\System\IaNbqkv.exe
  C:\Windows\System\IaNbqkv.exe
  2⤵
  PID:4708
- C:\Windows\System\Vgvaoza.exe
  C:\Windows\System\Vgvaoza.exe
  2⤵
  PID:4712
- C:\Windows\System\XvZeTPO.exe
  C:\Windows\System\XvZeTPO.exe
  2⤵
  PID:4964
- C:\Windows\System\lqdOCZL.exe
  C:\Windows\System\lqdOCZL.exe
  2⤵
  PID:2476
- C:\Windows\System\KJRuscF.exe
  C:\Windows\System\KJRuscF.exe
  2⤵
  PID:3536
- C:\Windows\System\nFbuqCL.exe
  C:\Windows\System\nFbuqCL.exe
  2⤵
  PID:1968
- C:\Windows\System\ThdBIty.exe
  C:\Windows\System\ThdBIty.exe
  2⤵
  PID:3748
- C:\Windows\System\jJXsoZt.exe
  C:\Windows\System\jJXsoZt.exe
  2⤵
  PID:4532
- C:\Windows\System\sGjkaGa.exe
  C:\Windows\System\sGjkaGa.exe
  2⤵
  PID:4776
- C:\Windows\System\lWbpMen.exe
  C:\Windows\System\lWbpMen.exe
  2⤵
  PID:2212
- C:\Windows\System\GFZWBbN.exe
  C:\Windows\System\GFZWBbN.exe
  2⤵
  PID:2460
- C:\Windows\System\rbBQJyn.exe
  C:\Windows\System\rbBQJyn.exe
  2⤵
  PID:4372
- C:\Windows\System\guBWfHG.exe
  C:\Windows\System\guBWfHG.exe
  2⤵
  PID:4612
- C:\Windows\System\niksnBs.exe
  C:\Windows\System\niksnBs.exe
  2⤵
  PID:2672
- C:\Windows\System\ZdCBege.exe
  C:\Windows\System\ZdCBege.exe
  2⤵
  PID:4852
- C:\Windows\System\GArcudu.exe
  C:\Windows\System\GArcudu.exe
  2⤵
  PID:4956
- C:\Windows\System\OeJCIGU.exe
  C:\Windows\System\OeJCIGU.exe
  2⤵
  PID:5096
- C:\Windows\System\RtPYuXW.exe
  C:\Windows\System\RtPYuXW.exe
  2⤵
  PID:2956
- C:\Windows\System\sOupKRg.exe
  C:\Windows\System\sOupKRg.exe
  2⤵
  PID:1444
- C:\Windows\System\fsciJDo.exe
  C:\Windows\System\fsciJDo.exe
  2⤵
  PID:5124
- C:\Windows\System\Qtvdavf.exe
  C:\Windows\System\Qtvdavf.exe
  2⤵
  PID:5144
- C:\Windows\System\GIAfXyr.exe
  C:\Windows\System\GIAfXyr.exe
  2⤵
  PID:5160
- C:\Windows\System\EjzOFWi.exe
  C:\Windows\System\EjzOFWi.exe
  2⤵
  PID:5176
- C:\Windows\System\zVUNYUZ.exe
  C:\Windows\System\zVUNYUZ.exe
  2⤵
  PID:5192
- C:\Windows\System\ADSDPSl.exe
  C:\Windows\System\ADSDPSl.exe
  2⤵
  PID:5212
- C:\Windows\System\TFXKlDm.exe
  C:\Windows\System\TFXKlDm.exe
  2⤵
  PID:5228
- C:\Windows\System\PfkzUHm.exe
  C:\Windows\System\PfkzUHm.exe
  2⤵
  PID:5244
- C:\Windows\System\ojwStcL.exe
  C:\Windows\System\ojwStcL.exe
  2⤵
  PID:5264
- C:\Windows\System\ICXyBXc.exe
  C:\Windows\System\ICXyBXc.exe
  2⤵
  PID:5352
- C:\Windows\System\bhduyFU.exe
  C:\Windows\System\bhduyFU.exe
  2⤵
  PID:5368
- C:\Windows\System\LZOtmUT.exe
  C:\Windows\System\LZOtmUT.exe
  2⤵
  PID:5384
- C:\Windows\System\yzggWVP.exe
  C:\Windows\System\yzggWVP.exe
  2⤵
  PID:5400
- C:\Windows\System\mGYUpaY.exe
  C:\Windows\System\mGYUpaY.exe
  2⤵
  PID:5416
- C:\Windows\System\jNrehbC.exe
  C:\Windows\System\jNrehbC.exe
  2⤵
  PID:5432
- C:\Windows\System\TtBEvax.exe
  C:\Windows\System\TtBEvax.exe
  2⤵
  PID:5456
- C:\Windows\System\jQghzEZ.exe
  C:\Windows\System\jQghzEZ.exe
  2⤵
  PID:5472
- C:\Windows\System\vCsWPqa.exe
  C:\Windows\System\vCsWPqa.exe
  2⤵
  PID:5500
- C:\Windows\System\lhfHsuK.exe
  C:\Windows\System\lhfHsuK.exe
  2⤵
  PID:5516
- C:\Windows\System\uGgmtnf.exe
  C:\Windows\System\uGgmtnf.exe
  2⤵
  PID:5540
- C:\Windows\System\nsdTEKh.exe
  C:\Windows\System\nsdTEKh.exe
  2⤵
  PID:5556
- C:\Windows\System\GOJPLNB.exe
  C:\Windows\System\GOJPLNB.exe
  2⤵
  PID:5572
- C:\Windows\System\jLRzifr.exe
  C:\Windows\System\jLRzifr.exe
  2⤵
  PID:5604
- C:\Windows\System\cCcDuRe.exe
  C:\Windows\System\cCcDuRe.exe
  2⤵
  PID:5624
- C:\Windows\System\KhuxDyF.exe
  C:\Windows\System\KhuxDyF.exe
  2⤵
  PID:5640
- C:\Windows\System\ORewMdu.exe
  C:\Windows\System\ORewMdu.exe
  2⤵
  PID:5672
- C:\Windows\System\FIyCDDA.exe
  C:\Windows\System\FIyCDDA.exe
  2⤵
  PID:5688
- C:\Windows\System\rnxwPyE.exe
  C:\Windows\System\rnxwPyE.exe
  2⤵
  PID:5704
- C:\Windows\System\ANxKkGi.exe
  C:\Windows\System\ANxKkGi.exe
  2⤵
  PID:5720
- C:\Windows\System\VgVsJTs.exe
  C:\Windows\System\VgVsJTs.exe
  2⤵
  PID:5736
- C:\Windows\System\sbSidso.exe
  C:\Windows\System\sbSidso.exe
  2⤵
  PID:5756
- C:\Windows\System\ZUYNxEX.exe
  C:\Windows\System\ZUYNxEX.exe
  2⤵
  PID:5772
- C:\Windows\System\vWMLqee.exe
  C:\Windows\System\vWMLqee.exe
  2⤵
  PID:5788
- C:\Windows\System\yxuiAMH.exe
  C:\Windows\System\yxuiAMH.exe
  2⤵
  PID:5804
- C:\Windows\System\EXtbylq.exe
  C:\Windows\System\EXtbylq.exe
  2⤵
  PID:5824
- C:\Windows\System\aJXbWGy.exe
  C:\Windows\System\aJXbWGy.exe
  2⤵
  PID:5840
- C:\Windows\System\gcvHeRa.exe
  C:\Windows\System\gcvHeRa.exe
  2⤵
  PID:5856
- C:\Windows\System\zsMKKRw.exe
  C:\Windows\System\zsMKKRw.exe
  2⤵
  PID:5872
- C:\Windows\System\SzYDder.exe
  C:\Windows\System\SzYDder.exe
  2⤵
  PID:5892
- C:\Windows\System\MlvVaBW.exe
  C:\Windows\System\MlvVaBW.exe
  2⤵
  PID:5908
- C:\Windows\System\cZwUZRW.exe
  C:\Windows\System\cZwUZRW.exe
  2⤵
  PID:5928
- C:\Windows\System\SnywYDJ.exe
  C:\Windows\System\SnywYDJ.exe
  2⤵
  PID:5944
- C:\Windows\System\DxdiNyO.exe
  C:\Windows\System\DxdiNyO.exe
  2⤵
  PID:5964
- C:\Windows\System\wiNWjKm.exe
  C:\Windows\System\wiNWjKm.exe
  2⤵
  PID:5980
- C:\Windows\System\iaAwvUV.exe
  C:\Windows\System\iaAwvUV.exe
  2⤵
  PID:5996
- C:\Windows\System\BFzDvkX.exe
  C:\Windows\System\BFzDvkX.exe
  2⤵
  PID:6016
- C:\Windows\System\yahZNLx.exe
  C:\Windows\System\yahZNLx.exe
  2⤵
  PID:6032
- C:\Windows\System\SUWBPNb.exe
  C:\Windows\System\SUWBPNb.exe
  2⤵
  PID:6048
- C:\Windows\System\EvtZEUX.exe
  C:\Windows\System\EvtZEUX.exe
  2⤵
  PID:6068
- C:\Windows\System\OTKGfRV.exe
  C:\Windows\System\OTKGfRV.exe
  2⤵
  PID:6084
- C:\Windows\System\DpXwhTP.exe
  C:\Windows\System\DpXwhTP.exe
  2⤵
  PID:6100
- C:\Windows\System\qVRfeZZ.exe
  C:\Windows\System\qVRfeZZ.exe
  2⤵
  PID:6116
- C:\Windows\System\CaCBCox.exe
  C:\Windows\System\CaCBCox.exe
  2⤵
  PID:6136
- C:\Windows\System\wJatKzq.exe
  C:\Windows\System\wJatKzq.exe
  2⤵
  PID:308
- C:\Windows\System\uVhyPIJ.exe
  C:\Windows\System\uVhyPIJ.exe
  2⤵
  PID:4868
- C:\Windows\System\mBBhztX.exe
  C:\Windows\System\mBBhztX.exe
  2⤵
  PID:760
- C:\Windows\System\MwWmPQw.exe
  C:\Windows\System\MwWmPQw.exe
  2⤵
  PID:5004
- C:\Windows\System\XrNJKbb.exe
  C:\Windows\System\XrNJKbb.exe
  2⤵
  PID:5220
- C:\Windows\System\GRDGVVT.exe
  C:\Windows\System\GRDGVVT.exe
  2⤵
  PID:5140
- C:\Windows\System\IVuzxhv.exe
  C:\Windows\System\IVuzxhv.exe
  2⤵
  PID:5236
- C:\Windows\System\XLHMRMP.exe
  C:\Windows\System\XLHMRMP.exe
  2⤵
  PID:4920
- C:\Windows\System\mwzwHCN.exe
  C:\Windows\System\mwzwHCN.exe
  2⤵
  PID:5288
- C:\Windows\System\DitZTbs.exe
  C:\Windows\System\DitZTbs.exe
  2⤵
  PID:5304
- C:\Windows\System\IosUpBk.exe
  C:\Windows\System\IosUpBk.exe
  2⤵
  PID:5324
- C:\Windows\System\dPgxWkK.exe
  C:\Windows\System\dPgxWkK.exe
  2⤵
  PID:5316
- C:\Windows\System\VXasJXW.exe
  C:\Windows\System\VXasJXW.exe
  2⤵
  PID:5328
- C:\Windows\System\JrUnvGB.exe
  C:\Windows\System\JrUnvGB.exe
  2⤵
  PID:5360
- C:\Windows\System\qsiMwvt.exe
  C:\Windows\System\qsiMwvt.exe
  2⤵
  PID:5428
- C:\Windows\System\bMEGBZx.exe
  C:\Windows\System\bMEGBZx.exe
  2⤵
  PID:5408
- C:\Windows\System\mZcBdFS.exe
  C:\Windows\System\mZcBdFS.exe
  2⤵
  PID:5412
- C:\Windows\System\vWkraPC.exe
  C:\Windows\System\vWkraPC.exe
  2⤵
  PID:5468
- C:\Windows\System\dhqwCvl.exe
  C:\Windows\System\dhqwCvl.exe
  2⤵
  PID:5484
- C:\Windows\System\NiSZVej.exe
  C:\Windows\System\NiSZVej.exe
  2⤵
  PID:5496
- C:\Windows\System\kSQzARw.exe
  C:\Windows\System\kSQzARw.exe
  2⤵
  PID:5524
- C:\Windows\System\gGrtkAv.exe
  C:\Windows\System\gGrtkAv.exe
  2⤵
  PID:5528
- C:\Windows\System\WWuowDz.exe
  C:\Windows\System\WWuowDz.exe
  2⤵
  PID:5612
- C:\Windows\System\iJzmRyh.exe
  C:\Windows\System\iJzmRyh.exe
  2⤵
  PID:5616
- C:\Windows\System\rxeCHDx.exe
  C:\Windows\System\rxeCHDx.exe
  2⤵
  PID:5660
- C:\Windows\System\bGJHyPd.exe
  C:\Windows\System\bGJHyPd.exe
  2⤵
  PID:5684
- C:\Windows\System\qGrtJxz.exe
  C:\Windows\System\qGrtJxz.exe
  2⤵
  PID:5752
- C:\Windows\System\TbdInkb.exe
  C:\Windows\System\TbdInkb.exe
  2⤵
  PID:5816
- C:\Windows\System\UNKmoww.exe
  C:\Windows\System\UNKmoww.exe
  2⤵
  PID:5852
- C:\Windows\System\WBXHssH.exe
  C:\Windows\System\WBXHssH.exe
  2⤵
  PID:5916
- C:\Windows\System\MVwSvoi.exe
  C:\Windows\System\MVwSvoi.exe
  2⤵
  PID:6064
- C:\Windows\System\lVkCnXH.exe
  C:\Windows\System\lVkCnXH.exe
  2⤵
  PID:6132
- C:\Windows\System\EvSFzIx.exe
  C:\Windows\System\EvSFzIx.exe
  2⤵
  PID:6028
- C:\Windows\System\VLxOfbL.exe
  C:\Windows\System\VLxOfbL.exe
  2⤵
  PID:5700
- C:\Windows\System\ZoXjruU.exe
  C:\Windows\System\ZoXjruU.exe
  2⤵
  PID:5768
- C:\Windows\System\xJSUAwq.exe
  C:\Windows\System\xJSUAwq.exe
  2⤵
  PID:5000
- C:\Windows\System\wVSIMkA.exe
  C:\Windows\System\wVSIMkA.exe
  2⤵
  PID:5832
- C:\Windows\System\pJIAwnn.exe
  C:\Windows\System\pJIAwnn.exe
  2⤵
  PID:5936
- C:\Windows\System\wXLhxYc.exe
  C:\Windows\System\wXLhxYc.exe
  2⤵
  PID:5200
- C:\Windows\System\IHYyFfX.exe
  C:\Windows\System\IHYyFfX.exe
  2⤵
  PID:5344
- C:\Windows\System\tSbNhfU.exe
  C:\Windows\System\tSbNhfU.exe
  2⤵
  PID:6012
- C:\Windows\System\FyxEePr.exe
  C:\Windows\System\FyxEePr.exe
  2⤵
  PID:5340
- C:\Windows\System\NSXbyNt.exe
  C:\Windows\System\NSXbyNt.exe
  2⤵
  PID:5580
- C:\Windows\System\vKUaQsm.exe
  C:\Windows\System\vKUaQsm.exe
  2⤵
  PID:3060
- C:\Windows\System\NAmEReR.exe
  C:\Windows\System\NAmEReR.exe
  2⤵
  PID:4952
- C:\Windows\System\ApxtAKV.exe
  C:\Windows\System\ApxtAKV.exe
  2⤵
  PID:6080
- C:\Windows\System\bURWVLi.exe
  C:\Windows\System\bURWVLi.exe
  2⤵
  PID:5592
- C:\Windows\System\oWcSxvc.exe
  C:\Windows\System\oWcSxvc.exe
  2⤵
  PID:5548
- C:\Windows\System\vqgsvaU.exe
  C:\Windows\System\vqgsvaU.exe
  2⤵
  PID:5596
- C:\Windows\System\PErzbMO.exe
  C:\Windows\System\PErzbMO.exe
  2⤵
  PID:2700
- C:\Windows\System\wNYeXkZ.exe
  C:\Windows\System\wNYeXkZ.exe
  2⤵
  PID:3360
- C:\Windows\System\ITNdByP.exe
  C:\Windows\System\ITNdByP.exe
  2⤵
  PID:5280
- C:\Windows\System\VyKaWBS.exe
  C:\Windows\System\VyKaWBS.exe
  2⤵
  PID:4144
- C:\Windows\System\FPClTDl.exe
  C:\Windows\System\FPClTDl.exe
  2⤵
  PID:5552
- C:\Windows\System\wRvMXiQ.exe
  C:\Windows\System\wRvMXiQ.exe
  2⤵
  PID:5636
- C:\Windows\System\MiFStbe.exe
  C:\Windows\System\MiFStbe.exe
  2⤵
  PID:5680
- C:\Windows\System\GQOYuWy.exe
  C:\Windows\System\GQOYuWy.exe
  2⤵
  PID:5888
- C:\Windows\System\CFeXbLW.exe
  C:\Windows\System\CFeXbLW.exe
  2⤵
  PID:5696
- C:\Windows\System\SpkABuf.exe
  C:\Windows\System\SpkABuf.exe
  2⤵
  PID:5952
- C:\Windows\System\FGHafWw.exe
  C:\Windows\System\FGHafWw.exe
  2⤵
  PID:5716
- C:\Windows\System\IoCdnlZ.exe
  C:\Windows\System\IoCdnlZ.exe
  2⤵
  PID:5764
- C:\Windows\System\UhMiuGa.exe
  C:\Windows\System\UhMiuGa.exe
  2⤵
  PID:6024
- C:\Windows\System\sPZAIyU.exe
  C:\Windows\System\sPZAIyU.exe
  2⤵
  PID:5868
- C:\Windows\System\RnWqOiA.exe
  C:\Windows\System\RnWqOiA.exe
  2⤵
  PID:4536
- C:\Windows\System\gPCDFsF.exe
  C:\Windows\System\gPCDFsF.exe
  2⤵
  PID:5336
- C:\Windows\System\QGGlNNQ.exe
  C:\Windows\System\QGGlNNQ.exe
  2⤵
  PID:3540
- C:\Windows\System\FpmyTRs.exe
  C:\Windows\System\FpmyTRs.exe
  2⤵
  PID:5156
- C:\Windows\System\OGKToCW.exe
  C:\Windows\System\OGKToCW.exe
  2⤵
  PID:5380
- C:\Windows\System\cGYOuCq.exe
  C:\Windows\System\cGYOuCq.exe
  2⤵
  PID:3948
- C:\Windows\System\wHshkfg.exe
  C:\Windows\System\wHshkfg.exe
  2⤵
  PID:4844
- C:\Windows\System\yeyjFlq.exe
  C:\Windows\System\yeyjFlq.exe
  2⤵
  PID:5976
- C:\Windows\System\WDRdlLn.exe
  C:\Windows\System\WDRdlLn.exe
  2⤵
  PID:5464
- C:\Windows\System\KayiffG.exe
  C:\Windows\System\KayiffG.exe
  2⤵
  PID:6004
- C:\Windows\System\PrnMYtA.exe
  C:\Windows\System\PrnMYtA.exe
  2⤵
  PID:4308
- C:\Windows\System\oeMbvzj.exe
  C:\Windows\System\oeMbvzj.exe
  2⤵
  PID:5960
- C:\Windows\System\ZHWoaoK.exe
  C:\Windows\System\ZHWoaoK.exe
  2⤵
  PID:5784
- C:\Windows\System\xbXSADX.exe
  C:\Windows\System\xbXSADX.exe
  2⤵
  PID:5836
- C:\Windows\System\VxowxJN.exe
  C:\Windows\System\VxowxJN.exe
  2⤵
  PID:5748
- C:\Windows\System\PeUYvhW.exe
  C:\Windows\System\PeUYvhW.exe
  2⤵
  PID:4468
- C:\Windows\System\nuyPJkI.exe
  C:\Windows\System\nuyPJkI.exe
  2⤵
  PID:6124
- C:\Windows\System\EJOckxO.exe
  C:\Windows\System\EJOckxO.exe
  2⤵
  PID:4764
- C:\Windows\System\eAVjaKj.exe
  C:\Windows\System\eAVjaKj.exe
  2⤵
  PID:4488
- C:\Windows\System\SPRyyhX.exe
  C:\Windows\System\SPRyyhX.exe
  2⤵
  PID:5900
- C:\Windows\System\wDzIFak.exe
  C:\Windows\System\wDzIFak.exe
  2⤵
  PID:5632
- C:\Windows\System\pscKvfq.exe
  C:\Windows\System\pscKvfq.exe
  2⤵
  PID:6160
- C:\Windows\System\wWWxVEO.exe
  C:\Windows\System\wWWxVEO.exe
  2⤵
  PID:6176
- C:\Windows\System\PhtFFRM.exe
  C:\Windows\System\PhtFFRM.exe
  2⤵
  PID:6192
- C:\Windows\System\eCKMeEC.exe
  C:\Windows\System\eCKMeEC.exe
  2⤵
  PID:6212
- C:\Windows\System\wsGFvpm.exe
  C:\Windows\System\wsGFvpm.exe
  2⤵
  PID:6232
- C:\Windows\System\CwmiseW.exe
  C:\Windows\System\CwmiseW.exe
  2⤵
  PID:6248
- C:\Windows\System\tfSbsCF.exe
  C:\Windows\System\tfSbsCF.exe
  2⤵
  PID:6264
- C:\Windows\System\pqRBQwj.exe
  C:\Windows\System\pqRBQwj.exe
  2⤵
  PID:6292
- C:\Windows\System\HWAoOub.exe
  C:\Windows\System\HWAoOub.exe
  2⤵
  PID:6308
- C:\Windows\System\yIhkmsv.exe
  C:\Windows\System\yIhkmsv.exe
  2⤵
  PID:6324
- C:\Windows\System\lFvodga.exe
  C:\Windows\System\lFvodga.exe
  2⤵
  PID:6340
- C:\Windows\System\weZtQtE.exe
  C:\Windows\System\weZtQtE.exe
  2⤵
  PID:6376
- C:\Windows\System\inJDxUA.exe
  C:\Windows\System\inJDxUA.exe
  2⤵
  PID:6404
- C:\Windows\System\NQnFvqV.exe
  C:\Windows\System\NQnFvqV.exe
  2⤵
  PID:6420
- C:\Windows\System\TWiQKdd.exe
  C:\Windows\System\TWiQKdd.exe
  2⤵
  PID:6436
- C:\Windows\System\nCyWdqJ.exe
  C:\Windows\System\nCyWdqJ.exe
  2⤵
  PID:6452
- C:\Windows\System\JXgXUzY.exe
  C:\Windows\System\JXgXUzY.exe
  2⤵
  PID:6468
- C:\Windows\System\GhIbzLg.exe
  C:\Windows\System\GhIbzLg.exe
  2⤵
  PID:6484
- C:\Windows\System\aeLBavV.exe
  C:\Windows\System\aeLBavV.exe
  2⤵
  PID:6500
- C:\Windows\System\oIQwRRO.exe
  C:\Windows\System\oIQwRRO.exe
  2⤵
  PID:6516
- C:\Windows\System\xwCCqdO.exe
  C:\Windows\System\xwCCqdO.exe
  2⤵
  PID:6532
- C:\Windows\System\cqCJjFn.exe
  C:\Windows\System\cqCJjFn.exe
  2⤵
  PID:6548
- C:\Windows\System\RHXxsXe.exe
  C:\Windows\System\RHXxsXe.exe
  2⤵
  PID:6564
- C:\Windows\System\wjQDDWA.exe
  C:\Windows\System\wjQDDWA.exe
  2⤵
  PID:6580
- C:\Windows\System\xYNBTso.exe
  C:\Windows\System\xYNBTso.exe
  2⤵
  PID:6596
- C:\Windows\System\kXCbXNT.exe
  C:\Windows\System\kXCbXNT.exe
  2⤵
  PID:6612
- C:\Windows\System\eZLEUEf.exe
  C:\Windows\System\eZLEUEf.exe
  2⤵
  PID:6628
- C:\Windows\System\UYutxnI.exe
  C:\Windows\System\UYutxnI.exe
  2⤵
  PID:6644
- C:\Windows\System\nxZMNtA.exe
  C:\Windows\System\nxZMNtA.exe
  2⤵
  PID:6660
- C:\Windows\System\boyOWdK.exe
  C:\Windows\System\boyOWdK.exe
  2⤵
  PID:6676
- C:\Windows\System\TwVgixD.exe
  C:\Windows\System\TwVgixD.exe
  2⤵
  PID:6692
- C:\Windows\System\OyiJleN.exe
  C:\Windows\System\OyiJleN.exe
  2⤵
  PID:6708
- C:\Windows\System\JqFLpHh.exe
  C:\Windows\System\JqFLpHh.exe
  2⤵
  PID:6724
- C:\Windows\System\khAVuev.exe
  C:\Windows\System\khAVuev.exe
  2⤵
  PID:6740
- C:\Windows\System\KRkMyjc.exe
  C:\Windows\System\KRkMyjc.exe
  2⤵
  PID:6756
- C:\Windows\System\fNfodsn.exe
  C:\Windows\System\fNfodsn.exe
  2⤵
  PID:6772
- C:\Windows\System\bnrBfBg.exe
  C:\Windows\System\bnrBfBg.exe
  2⤵
  PID:6788
- C:\Windows\System\POzMVOT.exe
  C:\Windows\System\POzMVOT.exe
  2⤵
  PID:6804
- C:\Windows\System\pVEQJfR.exe
  C:\Windows\System\pVEQJfR.exe
  2⤵
  PID:6820
- C:\Windows\System\Mjlzlnj.exe
  C:\Windows\System\Mjlzlnj.exe
  2⤵
  PID:6836
- C:\Windows\System\MmdrSdW.exe
  C:\Windows\System\MmdrSdW.exe
  2⤵
  PID:6852
- C:\Windows\System\dcihtyX.exe
  C:\Windows\System\dcihtyX.exe
  2⤵
  PID:6868
- C:\Windows\System\QrLTyeo.exe
  C:\Windows\System\QrLTyeo.exe
  2⤵
  PID:6884
- C:\Windows\System\UgYsgBb.exe
  C:\Windows\System\UgYsgBb.exe
  2⤵
  PID:6900
- C:\Windows\System\UKkFyAY.exe
  C:\Windows\System\UKkFyAY.exe
  2⤵
  PID:6916
- C:\Windows\System\NJCCAyE.exe
  C:\Windows\System\NJCCAyE.exe
  2⤵
  PID:6936
- C:\Windows\System\pAHncil.exe
  C:\Windows\System\pAHncil.exe
  2⤵
  PID:6952
- C:\Windows\System\vSGiNDq.exe
  C:\Windows\System\vSGiNDq.exe
  2⤵
  PID:6968
- C:\Windows\System\vLKTeZC.exe
  C:\Windows\System\vLKTeZC.exe
  2⤵
  PID:6988
- C:\Windows\System\PdWgCHN.exe
  C:\Windows\System\PdWgCHN.exe
  2⤵
  PID:7004
- C:\Windows\System\FKQaoVa.exe
  C:\Windows\System\FKQaoVa.exe
  2⤵
  PID:7020
- C:\Windows\System\MKgCIlO.exe
  C:\Windows\System\MKgCIlO.exe
  2⤵
  PID:7036
- C:\Windows\System\bQhimeS.exe
  C:\Windows\System\bQhimeS.exe
  2⤵
  PID:7052
- C:\Windows\System\dzVSpvU.exe
  C:\Windows\System\dzVSpvU.exe
  2⤵
  PID:7068
- C:\Windows\System\xDYbCGy.exe
  C:\Windows\System\xDYbCGy.exe
  2⤵
  PID:7084
- C:\Windows\System\YpcVPPS.exe
  C:\Windows\System\YpcVPPS.exe
  2⤵
  PID:7100
- C:\Windows\System\zkEOsvt.exe
  C:\Windows\System\zkEOsvt.exe
  2⤵
  PID:7116
- C:\Windows\System\VzOxuJZ.exe
  C:\Windows\System\VzOxuJZ.exe
  2⤵
  PID:7132
- C:\Windows\System\NKtbOKT.exe
  C:\Windows\System\NKtbOKT.exe
  2⤵
  PID:7152
- C:\Windows\System\rMQdWEW.exe
  C:\Windows\System\rMQdWEW.exe
  2⤵
  PID:5132
- C:\Windows\System\iRuMSLR.exe
  C:\Windows\System\iRuMSLR.exe
  2⤵
  PID:5284
- C:\Windows\System\GwhxrFq.exe
  C:\Windows\System\GwhxrFq.exe
  2⤵
  PID:5652
- C:\Windows\System\optUQFg.exe
  C:\Windows\System\optUQFg.exe
  2⤵
  PID:5392
- C:\Windows\System\xlPNtHD.exe
  C:\Windows\System\xlPNtHD.exe
  2⤵
  PID:6184
- C:\Windows\System\dXiYGZK.exe
  C:\Windows\System\dXiYGZK.exe
  2⤵
  PID:6204
- C:\Windows\System\FhjtLWU.exe
  C:\Windows\System\FhjtLWU.exe
  2⤵
  PID:6244
- C:\Windows\System\uizdmHm.exe
  C:\Windows\System\uizdmHm.exe
  2⤵
  PID:6276
- C:\Windows\System\eLLPVEO.exe
  C:\Windows\System\eLLPVEO.exe
  2⤵
  PID:6256
- C:\Windows\System\KGDghaC.exe
  C:\Windows\System\KGDghaC.exe
  2⤵
  PID:6320
- C:\Windows\System\KYeAKWE.exe
  C:\Windows\System\KYeAKWE.exe
  2⤵
  PID:6336
- C:\Windows\System\NbiphpJ.exe
  C:\Windows\System\NbiphpJ.exe
  2⤵
  PID:6368
- C:\Windows\System\VUEEAMc.exe
  C:\Windows\System\VUEEAMc.exe
  2⤵
  PID:6392
- C:\Windows\System\IRopwsP.exe
  C:\Windows\System\IRopwsP.exe
  2⤵
  PID:6444
- C:\Windows\System\zDoJuFK.exe
  C:\Windows\System\zDoJuFK.exe
  2⤵
  PID:6508
- C:\Windows\System\InRRrcj.exe
  C:\Windows\System\InRRrcj.exe
  2⤵
  PID:6572
- C:\Windows\System\HCvtPpI.exe
  C:\Windows\System\HCvtPpI.exe
  2⤵
  PID:6636
- C:\Windows\System\UPVSxKe.exe
  C:\Windows\System\UPVSxKe.exe
  2⤵
  PID:6432
- C:\Windows\System\LshRQtA.exe
  C:\Windows\System\LshRQtA.exe
  2⤵
  PID:6464
- C:\Windows\System\wQadORJ.exe
  C:\Windows\System\wQadORJ.exe
  2⤵
  PID:6732
- C:\Windows\System\WxhbTDd.exe
  C:\Windows\System\WxhbTDd.exe
  2⤵
  PID:6768
- C:\Windows\System\DvCtwuI.exe
  C:\Windows\System\DvCtwuI.exe
  2⤵
  PID:6556
- C:\Windows\System\qAUTUah.exe
  C:\Windows\System\qAUTUah.exe
  2⤵
  PID:6592
- C:\Windows\System\feMvDhf.exe
  C:\Windows\System\feMvDhf.exe
  2⤵
  PID:6652
- C:\Windows\System\oxpSbaR.exe
  C:\Windows\System\oxpSbaR.exe
  2⤵
  PID:6720
- C:\Windows\System\eJjjeFs.exe
  C:\Windows\System\eJjjeFs.exe
  2⤵
  PID:6784
- C:\Windows\System\dhrwkoU.exe
  C:\Windows\System\dhrwkoU.exe
  2⤵
  PID:6844
- C:\Windows\System\GYMzlzf.exe
  C:\Windows\System\GYMzlzf.exe
  2⤵
  PID:6352
- C:\Windows\System\wqTomfw.exe
  C:\Windows\System\wqTomfw.exe
  2⤵
  PID:6896
- C:\Windows\System\YSIFYpI.exe
  C:\Windows\System\YSIFYpI.exe
  2⤵
  PID:6928
- C:\Windows\System\kNcjBaU.exe
  C:\Windows\System\kNcjBaU.exe
  2⤵
  PID:6944
- C:\Windows\System\HgAkjNB.exe
  C:\Windows\System\HgAkjNB.exe
  2⤵
  PID:7000
- C:\Windows\System\MhdCcIM.exe
  C:\Windows\System\MhdCcIM.exe
  2⤵
  PID:7064
- C:\Windows\System\jfLMaeu.exe
  C:\Windows\System\jfLMaeu.exe
  2⤵
  PID:7128
- C:\Windows\System\sAbPJaf.exe
  C:\Windows\System\sAbPJaf.exe
  2⤵
  PID:7016
- C:\Windows\System\vsIawYz.exe
  C:\Windows\System\vsIawYz.exe
  2⤵
  PID:6156
- C:\Windows\System\OnZPqbE.exe
  C:\Windows\System\OnZPqbE.exe
  2⤵
  PID:7080
- C:\Windows\System\AUbecBs.exe
  C:\Windows\System\AUbecBs.exe
  2⤵
  PID:7144
- C:\Windows\System\rnPeoTg.exe
  C:\Windows\System\rnPeoTg.exe
  2⤵
  PID:6220
- C:\Windows\System\DqknWXU.exe
  C:\Windows\System\DqknWXU.exe
  2⤵
  PID:6168
- C:\Windows\System\NUTbrzi.exe
  C:\Windows\System\NUTbrzi.exe
  2⤵
  PID:6272
- C:\Windows\System\stwbeKm.exe
  C:\Windows\System\stwbeKm.exe
  2⤵
  PID:6360
- C:\Windows\System\fpqbwRJ.exe
  C:\Windows\System\fpqbwRJ.exe
  2⤵
  PID:6304
- C:\Windows\System\dxodzXn.exe
  C:\Windows\System\dxodzXn.exe
  2⤵
  PID:6476
- C:\Windows\System\xdmiwBu.exe
  C:\Windows\System\xdmiwBu.exe
  2⤵
  PID:6608
- C:\Windows\System\TVzvSsJ.exe
  C:\Windows\System\TVzvSsJ.exe
  2⤵
  PID:6764
- C:\Windows\System\GyRMSBM.exe
  C:\Windows\System\GyRMSBM.exe
  2⤵
  PID:6688
- C:\Windows\System\aAsdUGi.exe
  C:\Windows\System\aAsdUGi.exe
  2⤵
  PID:6544
- C:\Windows\System\DJGiwFc.exe
  C:\Windows\System\DJGiwFc.exe
  2⤵
  PID:6700
- C:\Windows\System\oMORyFB.exe
  C:\Windows\System\oMORyFB.exe
  2⤵
  PID:6528
- C:\Windows\System\hpliDTi.exe
  C:\Windows\System\hpliDTi.exe
  2⤵
  PID:6880
- C:\Windows\System\lQqAYBF.exe
  C:\Windows\System\lQqAYBF.exe
  2⤵
  PID:6964
- C:\Windows\System\hgkEToG.exe
  C:\Windows\System\hgkEToG.exe
  2⤵
  PID:6976
- C:\Windows\System\surZqzT.exe
  C:\Windows\System\surZqzT.exe
  2⤵
  PID:5564
- C:\Windows\System\RCKUvQG.exe
  C:\Windows\System\RCKUvQG.exe
  2⤵
  PID:6172
- C:\Windows\System\bXyggdv.exe
  C:\Windows\System\bXyggdv.exe
  2⤵
  PID:6984
- C:\Windows\System\qkzJlMI.exe
  C:\Windows\System\qkzJlMI.exe
  2⤵
  PID:6152
- C:\Windows\System\DRKCKCK.exe
  C:\Windows\System\DRKCKCK.exe
  2⤵
  PID:6260
- C:\Windows\System\xURTOpC.exe
  C:\Windows\System\xURTOpC.exe
  2⤵
  PID:6604
- C:\Windows\System\RUKsAvI.exe
  C:\Windows\System\RUKsAvI.exe
  2⤵
  PID:6460
- C:\Windows\System\kdQgMeA.exe
  C:\Windows\System\kdQgMeA.exe
  2⤵
  PID:6816
- C:\Windows\System\CTwBIKX.exe
  C:\Windows\System\CTwBIKX.exe
  2⤵
  PID:6828
- C:\Windows\System\JdMyweY.exe
  C:\Windows\System\JdMyweY.exe
  2⤵
  PID:6932
- C:\Windows\System\BPOhGSG.exe
  C:\Windows\System\BPOhGSG.exe
  2⤵
  PID:7096
- C:\Windows\System\rxoYueH.exe
  C:\Windows\System\rxoYueH.exe
  2⤵
  PID:7112
- C:\Windows\System\QdOIaeA.exe
  C:\Windows\System\QdOIaeA.exe
  2⤵
  PID:6480
- C:\Windows\System\hVUqcwp.exe
  C:\Windows\System\hVUqcwp.exe
  2⤵
  PID:6356
- C:\Windows\System\iWeOhWx.exe
  C:\Windows\System\iWeOhWx.exe
  2⤵
  PID:6876
- C:\Windows\System\wlqlOfS.exe
  C:\Windows\System\wlqlOfS.exe
  2⤵
  PID:7060
- C:\Windows\System\TsgtpHu.exe
  C:\Windows\System\TsgtpHu.exe
  2⤵
  PID:6924
- C:\Windows\System\CdsekJc.exe
  C:\Windows\System\CdsekJc.exe
  2⤵
  PID:7172
- C:\Windows\System\AlpTsBJ.exe
  C:\Windows\System\AlpTsBJ.exe
  2⤵
  PID:7188
- C:\Windows\System\vzhGOVV.exe
  C:\Windows\System\vzhGOVV.exe
  2⤵
  PID:7208
- C:\Windows\System\TUBMlnd.exe
  C:\Windows\System\TUBMlnd.exe
  2⤵
  PID:7224
- C:\Windows\System\lJFERYr.exe
  C:\Windows\System\lJFERYr.exe
  2⤵
  PID:7240
- C:\Windows\System\cLroItQ.exe
  C:\Windows\System\cLroItQ.exe
  2⤵
  PID:7256
- C:\Windows\System\HDTnNry.exe
  C:\Windows\System\HDTnNry.exe
  2⤵
  PID:7272
- C:\Windows\System\QpYJtNo.exe
  C:\Windows\System\QpYJtNo.exe
  2⤵
  PID:7288
- C:\Windows\System\QqgPgUt.exe
  C:\Windows\System\QqgPgUt.exe
  2⤵
  PID:7304
- C:\Windows\System\ljmEujh.exe
  C:\Windows\System\ljmEujh.exe
  2⤵
  PID:7320
- C:\Windows\System\qnWiMuj.exe
  C:\Windows\System\qnWiMuj.exe
  2⤵
  PID:7340
- C:\Windows\System\irqJnGr.exe
  C:\Windows\System\irqJnGr.exe
  2⤵
  PID:7356
- C:\Windows\System\PxJtBwb.exe
  C:\Windows\System\PxJtBwb.exe
  2⤵
  PID:7372
- C:\Windows\System\idYTBrQ.exe
  C:\Windows\System\idYTBrQ.exe
  2⤵
  PID:7388
- C:\Windows\System\oJPiQQl.exe
  C:\Windows\System\oJPiQQl.exe
  2⤵
  PID:7404
- C:\Windows\System\zYHJEox.exe
  C:\Windows\System\zYHJEox.exe
  2⤵
  PID:7420
- C:\Windows\System\zHSnvpE.exe
  C:\Windows\System\zHSnvpE.exe
  2⤵
  PID:7436
- C:\Windows\System\CwrUFzz.exe
  C:\Windows\System\CwrUFzz.exe
  2⤵
  PID:7452
- C:\Windows\System\xZPkCoT.exe
  C:\Windows\System\xZPkCoT.exe
  2⤵
  PID:7468
- C:\Windows\System\WGslXKs.exe
  C:\Windows\System\WGslXKs.exe
  2⤵
  PID:7484
- C:\Windows\System\cBLuShu.exe
  C:\Windows\System\cBLuShu.exe
  2⤵
  PID:7500
- C:\Windows\System\DdHykJC.exe
  C:\Windows\System\DdHykJC.exe
  2⤵
  PID:7516
- C:\Windows\System\VGSzdYU.exe
  C:\Windows\System\VGSzdYU.exe
  2⤵
  PID:7532
- C:\Windows\System\RmpHuGC.exe
  C:\Windows\System\RmpHuGC.exe
  2⤵
  PID:7548
- C:\Windows\System\QzbfQNI.exe
  C:\Windows\System\QzbfQNI.exe
  2⤵
  PID:7564
- C:\Windows\System\rcbvGtF.exe
  C:\Windows\System\rcbvGtF.exe
  2⤵
  PID:7580
- C:\Windows\System\gihnprT.exe
  C:\Windows\System\gihnprT.exe
  2⤵
  PID:7596
- C:\Windows\System\TJPcVYk.exe
  C:\Windows\System\TJPcVYk.exe
  2⤵
  PID:7612
- C:\Windows\System\QXrQsqF.exe
  C:\Windows\System\QXrQsqF.exe
  2⤵
  PID:7628
- C:\Windows\System\vHMFDsr.exe
  C:\Windows\System\vHMFDsr.exe
  2⤵
  PID:7644
- C:\Windows\System\cyociOg.exe
  C:\Windows\System\cyociOg.exe
  2⤵
  PID:7660
- C:\Windows\System\ZsRkrSd.exe
  C:\Windows\System\ZsRkrSd.exe
  2⤵
  PID:7676
- C:\Windows\System\xErTTZZ.exe
  C:\Windows\System\xErTTZZ.exe
  2⤵
  PID:7692
- C:\Windows\System\BdCpxiW.exe
  C:\Windows\System\BdCpxiW.exe
  2⤵
  PID:7708
- C:\Windows\System\PWbXvvd.exe
  C:\Windows\System\PWbXvvd.exe
  2⤵
  PID:7724
- C:\Windows\System\yHjhXha.exe
  C:\Windows\System\yHjhXha.exe
  2⤵
  PID:7740
- C:\Windows\System\YlRxWoJ.exe
  C:\Windows\System\YlRxWoJ.exe
  2⤵
  PID:7756
- C:\Windows\System\sZmOgwA.exe
  C:\Windows\System\sZmOgwA.exe
  2⤵
  PID:7820
- C:\Windows\System\QlGrzKL.exe
  C:\Windows\System\QlGrzKL.exe
  2⤵
  PID:7840
- C:\Windows\System\zCEGWPs.exe
  C:\Windows\System\zCEGWPs.exe
  2⤵
  PID:7856
- C:\Windows\System\DhKghkY.exe
  C:\Windows\System\DhKghkY.exe
  2⤵
  PID:7872
- C:\Windows\System\NGRSTZo.exe
  C:\Windows\System\NGRSTZo.exe
  2⤵
  PID:7888
- C:\Windows\System\OZJVHch.exe
  C:\Windows\System\OZJVHch.exe
  2⤵
  PID:7904
- C:\Windows\System\UZGUnTi.exe
  C:\Windows\System\UZGUnTi.exe
  2⤵
  PID:7920
- C:\Windows\System\uzLRiPw.exe
  C:\Windows\System\uzLRiPw.exe
  2⤵
  PID:7936
- C:\Windows\System\FCrmSWD.exe
  C:\Windows\System\FCrmSWD.exe
  2⤵
  PID:7952
- C:\Windows\System\uzaxQxr.exe
  C:\Windows\System\uzaxQxr.exe
  2⤵
  PID:7968
- C:\Windows\System\IGUXGJh.exe
  C:\Windows\System\IGUXGJh.exe
  2⤵
  PID:7984
- C:\Windows\System\cHiohHR.exe
  C:\Windows\System\cHiohHR.exe
  2⤵
  PID:8000
- C:\Windows\System\jJasLZp.exe
  C:\Windows\System\jJasLZp.exe
  2⤵
  PID:8016
- C:\Windows\System\gOgIEph.exe
  C:\Windows\System\gOgIEph.exe
  2⤵
  PID:8036
- C:\Windows\System\YWgeNYE.exe
  C:\Windows\System\YWgeNYE.exe
  2⤵
  PID:8052
- C:\Windows\System\rjkiLrl.exe
  C:\Windows\System\rjkiLrl.exe
  2⤵
  PID:8068
- C:\Windows\System\mkdOABR.exe
  C:\Windows\System\mkdOABR.exe
  2⤵
  PID:8084
- C:\Windows\System\fSUvUZb.exe
  C:\Windows\System\fSUvUZb.exe
  2⤵
  PID:8100
- C:\Windows\System\ArnrcxD.exe
  C:\Windows\System\ArnrcxD.exe
  2⤵
  PID:8116
- C:\Windows\System\huooFFp.exe
  C:\Windows\System\huooFFp.exe
  2⤵
  PID:8132
- C:\Windows\System\wipqRCW.exe
  C:\Windows\System\wipqRCW.exe
  2⤵
  PID:8148
- C:\Windows\System\zmtnAGs.exe
  C:\Windows\System\zmtnAGs.exe
  2⤵
  PID:8164
- C:\Windows\System\HtkprDl.exe
  C:\Windows\System\HtkprDl.exe
  2⤵
  PID:8180
- C:\Windows\System\mQGxVuy.exe
  C:\Windows\System\mQGxVuy.exe
  2⤵
  PID:7140
- C:\Windows\System\gSpuDJo.exe
  C:\Windows\System\gSpuDJo.exe
  2⤵
  PID:7196
- C:\Windows\System\SPgPzSX.exe
  C:\Windows\System\SPgPzSX.exe
  2⤵
  PID:7184
- C:\Windows\System\DamoEYz.exe
  C:\Windows\System\DamoEYz.exe
  2⤵
  PID:7232
- C:\Windows\System\uAPQbbk.exe
  C:\Windows\System\uAPQbbk.exe
  2⤵
  PID:7296
- C:\Windows\System\bhdQWzK.exe
  C:\Windows\System\bhdQWzK.exe
  2⤵
  PID:7368
- C:\Windows\System\PbteCNj.exe
  C:\Windows\System\PbteCNj.exe
  2⤵
  PID:7220
- C:\Windows\System\NGxlPbX.exe
  C:\Windows\System\NGxlPbX.exe
  2⤵
  PID:7464
- C:\Windows\System\OQvjHTz.exe
  C:\Windows\System\OQvjHTz.exe
  2⤵
  PID:7348
- C:\Windows\System\IShsWjP.exe
  C:\Windows\System\IShsWjP.exe
  2⤵
  PID:7280
- C:\Windows\System\LzoTuCZ.exe
  C:\Windows\System\LzoTuCZ.exe
  2⤵
  PID:7380
- C:\Windows\System\RXTzLOm.exe
  C:\Windows\System\RXTzLOm.exe
  2⤵
  PID:7444
- C:\Windows\System\NcpRYlX.exe
  C:\Windows\System\NcpRYlX.exe
  2⤵
  PID:7528
- C:\Windows\System\MRWqcCg.exe
  C:\Windows\System\MRWqcCg.exe
  2⤵
  PID:7588
- C:\Windows\System\SuiUwJN.exe
  C:\Windows\System\SuiUwJN.exe
  2⤵
  PID:7572
- C:\Windows\System\xbwNcMf.exe
  C:\Windows\System\xbwNcMf.exe
  2⤵
  PID:7652
- C:\Windows\System\BrxTmyQ.exe
  C:\Windows\System\BrxTmyQ.exe
  2⤵
  PID:7716
- C:\Windows\System\IFbWWau.exe
  C:\Windows\System\IFbWWau.exe
  2⤵
  PID:7792
- C:\Windows\System\UPgYysj.exe
  C:\Windows\System\UPgYysj.exe
  2⤵
  PID:7808
- C:\Windows\System\GPyIAqE.exe
  C:\Windows\System\GPyIAqE.exe
  2⤵
  PID:7832
- C:\Windows\System\EeJfMvz.exe
  C:\Windows\System\EeJfMvz.exe
  2⤵
  PID:7896
- C:\Windows\System\bTxwLMX.exe
  C:\Windows\System\bTxwLMX.exe
  2⤵
  PID:7928
- C:\Windows\System\xVDHcjH.exe
  C:\Windows\System\xVDHcjH.exe
  2⤵
  PID:7992
- C:\Windows\System\DfmgDVk.exe
  C:\Windows\System\DfmgDVk.exe
  2⤵
  PID:7852
- C:\Windows\System\NmmrzHy.exe
  C:\Windows\System\NmmrzHy.exe
  2⤵
  PID:8060
- C:\Windows\System\DJeGlMY.exe
  C:\Windows\System\DJeGlMY.exe
  2⤵
  PID:8124
- C:\Windows\System\FUbwrlV.exe
  C:\Windows\System\FUbwrlV.exe
  2⤵
  PID:7980
- C:\Windows\System\sHqYgHA.exe
  C:\Windows\System\sHqYgHA.exe
  2⤵
  PID:8008
- C:\Windows\System\oELTulU.exe
  C:\Windows\System\oELTulU.exe
  2⤵
  PID:8044
- C:\Windows\System\wSOtexl.exe
  C:\Windows\System\wSOtexl.exe
  2⤵
  PID:8112
- C:\Windows\System\gvLIUnt.exe
  C:\Windows\System\gvLIUnt.exe
  2⤵
  PID:8648
- C:\Windows\System\wmryyMB.exe
  C:\Windows\System\wmryyMB.exe
  2⤵
  PID:8696
- C:\Windows\System\WHzODKV.exe
  C:\Windows\System\WHzODKV.exe
  2⤵
  PID:8712
- C:\Windows\System\bRdtlOi.exe
  C:\Windows\System\bRdtlOi.exe
  2⤵
  PID:8728
- C:\Windows\System\EXakXue.exe
  C:\Windows\System\EXakXue.exe
  2⤵
  PID:8744
- C:\Windows\System\cVWwGXT.exe
  C:\Windows\System\cVWwGXT.exe
  2⤵
  PID:8760
- C:\Windows\System\YJsNZdg.exe
  C:\Windows\System\YJsNZdg.exe
  2⤵
  PID:8776
- C:\Windows\System\qadtVaJ.exe
  C:\Windows\System\qadtVaJ.exe
  2⤵
  PID:8792
- C:\Windows\System\eglzepy.exe
  C:\Windows\System\eglzepy.exe
  2⤵
  PID:8812
- C:\Windows\System\wBzAatu.exe
  C:\Windows\System\wBzAatu.exe
  2⤵
  PID:8828
- C:\Windows\System\oPapQyG.exe
  C:\Windows\System\oPapQyG.exe
  2⤵
  PID:8848
- C:\Windows\System\cQlsOrh.exe
  C:\Windows\System\cQlsOrh.exe
  2⤵
  PID:8984
- C:\Windows\System\dyZziCo.exe
  C:\Windows\System\dyZziCo.exe
  2⤵
  PID:9008
- C:\Windows\System\mhsXWet.exe
  C:\Windows\System\mhsXWet.exe
  2⤵
  PID:9024
- C:\Windows\System\QvkNuug.exe
  C:\Windows\System\QvkNuug.exe
  2⤵
  PID:9040
- C:\Windows\System\IqZJhMs.exe
  C:\Windows\System\IqZJhMs.exe
  2⤵
  PID:9056
- C:\Windows\System\JweRbUR.exe
  C:\Windows\System\JweRbUR.exe
  2⤵
  PID:9072
- C:\Windows\System\lTihOwi.exe
  C:\Windows\System\lTihOwi.exe
  2⤵
  PID:9088
- C:\Windows\System\FWULZvw.exe
  C:\Windows\System\FWULZvw.exe
  2⤵
  PID:9104
- C:\Windows\System\VBUdioN.exe
  C:\Windows\System\VBUdioN.exe
  2⤵
  PID:9120
- C:\Windows\System\xIrUipy.exe
  C:\Windows\System\xIrUipy.exe
  2⤵
  PID:9148
- C:\Windows\System\tbzryfo.exe
  C:\Windows\System\tbzryfo.exe
  2⤵
  PID:9172
- C:\Windows\System\vogddHv.exe
  C:\Windows\System\vogddHv.exe
  2⤵
  PID:9188
- C:\Windows\System\ZeaXLYw.exe
  C:\Windows\System\ZeaXLYw.exe
  2⤵
  PID:9204
- C:\Windows\System\DcGPFna.exe
  C:\Windows\System\DcGPFna.exe
  2⤵
  PID:6716
- C:\Windows\System\sWzXaYJ.exe
  C:\Windows\System\sWzXaYJ.exe
  2⤵
  PID:7328
- C:\Windows\System\zvncFgV.exe
  C:\Windows\System\zvncFgV.exe
  2⤵
  PID:7784
- C:\Windows\System\jEJsaeN.exe
  C:\Windows\System\jEJsaeN.exe
  2⤵
  PID:7868
- C:\Windows\System\YhPLdIr.exe
  C:\Windows\System\YhPLdIr.exe
  2⤵
  PID:7916
- C:\Windows\System\JhRXEvE.exe
  C:\Windows\System\JhRXEvE.exe
  2⤵
  PID:8024
- C:\Windows\System\ZTFXYyG.exe
  C:\Windows\System\ZTFXYyG.exe
  2⤵
  PID:8080
- C:\Windows\System\UjYAlyj.exe
  C:\Windows\System\UjYAlyj.exe
  2⤵
  PID:8196
- C:\Windows\System\HyjjQXT.exe
  C:\Windows\System\HyjjQXT.exe
  2⤵
  PID:8212
- C:\Windows\System\BkrCrKm.exe
  C:\Windows\System\BkrCrKm.exe
  2⤵
  PID:8228
- C:\Windows\System\BprfasM.exe
  C:\Windows\System\BprfasM.exe
  2⤵
  PID:8248
- C:\Windows\System\KroCcGT.exe
  C:\Windows\System\KroCcGT.exe
  2⤵
  PID:8264
- C:\Windows\System\dKSYHNN.exe
  C:\Windows\System\dKSYHNN.exe
  2⤵
  PID:8280
- C:\Windows\System\pyaNnQp.exe
  C:\Windows\System\pyaNnQp.exe
  2⤵
  PID:8296
- C:\Windows\System\XKHunZs.exe
  C:\Windows\System\XKHunZs.exe
  2⤵
  PID:8312
- C:\Windows\System\petTfsP.exe
  C:\Windows\System\petTfsP.exe
  2⤵
  PID:8328
- C:\Windows\System\YzlfLdE.exe
  C:\Windows\System\YzlfLdE.exe
  2⤵
  PID:8372
- C:\Windows\System\qPJaUwI.exe
  C:\Windows\System\qPJaUwI.exe
  2⤵
  PID:8404
- C:\Windows\System\UVURqtE.exe
  C:\Windows\System\UVURqtE.exe
  2⤵
  PID:8424
- C:\Windows\System\MBlslTt.exe
  C:\Windows\System\MBlslTt.exe
  2⤵
  PID:8440
- C:\Windows\System\CexDTwl.exe
  C:\Windows\System\CexDTwl.exe
  2⤵
  PID:8464
- C:\Windows\System\lTAAtCa.exe
  C:\Windows\System\lTAAtCa.exe
  2⤵
  PID:8480
- C:\Windows\System\TWvwfnf.exe
  C:\Windows\System\TWvwfnf.exe
  2⤵
  PID:8500
- C:\Windows\System\VgxbjNo.exe
  C:\Windows\System\VgxbjNo.exe
  2⤵
  PID:8520
- C:\Windows\System\xOjRRSz.exe
  C:\Windows\System\xOjRRSz.exe
  2⤵
  PID:8576
- C:\Windows\System\baYiGny.exe
  C:\Windows\System\baYiGny.exe
  2⤵
  PID:8592
- C:\Windows\System\yPEocPv.exe
  C:\Windows\System\yPEocPv.exe
  2⤵
  PID:8608
- C:\Windows\System\OtGFGDs.exe
  C:\Windows\System\OtGFGDs.exe
  2⤵
  PID:8624
- C:\Windows\System\hXtpkQP.exe
  C:\Windows\System\hXtpkQP.exe
  2⤵
  PID:8640
- C:\Windows\System\eXRVsMg.exe
  C:\Windows\System\eXRVsMg.exe
  2⤵
  PID:8672
- C:\Windows\System\BptNIqB.exe
  C:\Windows\System\BptNIqB.exe
  2⤵
  PID:7752
- C:\Windows\System\WYmatBd.exe
  C:\Windows\System\WYmatBd.exe
  2⤵
  PID:8736
- C:\Windows\System\SVvrRwL.exe
  C:\Windows\System\SVvrRwL.exe
  2⤵
  PID:8820
- C:\Windows\System\MPWgtFv.exe
  C:\Windows\System\MPWgtFv.exe
  2⤵
  PID:8740
- C:\Windows\System\pBIuAUm.exe
  C:\Windows\System\pBIuAUm.exe
  2⤵
  PID:8808
- C:\Windows\System\QtfzQxe.exe
  C:\Windows\System\QtfzQxe.exe
  2⤵
  PID:8876
- C:\Windows\System\PAXsvNk.exe
  C:\Windows\System\PAXsvNk.exe
  2⤵
  PID:8908
- C:\Windows\System\JSRvyLE.exe
  C:\Windows\System\JSRvyLE.exe
  2⤵
  PID:8692
- C:\Windows\System\MMVwKqW.exe
  C:\Windows\System\MMVwKqW.exe
  2⤵
  PID:8900
- C:\Windows\System\YlwpuVv.exe
  C:\Windows\System\YlwpuVv.exe
  2⤵
  PID:8916
- C:\Windows\System\ZnFuBRy.exe
  C:\Windows\System\ZnFuBRy.exe
  2⤵
  PID:8960
- C:\Windows\System\QbxjlNG.exe
  C:\Windows\System\QbxjlNG.exe
  2⤵
  PID:8928
- C:\Windows\System\mIyUvax.exe
  C:\Windows\System\mIyUvax.exe
  2⤵
  PID:8976
- C:\Windows\System\jbLtEdB.exe
  C:\Windows\System\jbLtEdB.exe
  2⤵
  PID:9064
- C:\Windows\System\bNvSQNs.exe
  C:\Windows\System\bNvSQNs.exe
  2⤵
  PID:9184
- C:\Windows\System\toqDSkO.exe
  C:\Windows\System\toqDSkO.exe
  2⤵
  PID:9164
- C:\Windows\System\rxfHJXj.exe
  C:\Windows\System\rxfHJXj.exe
  2⤵
  PID:9084
- C:\Windows\System\wBuYpwl.exe
  C:\Windows\System\wBuYpwl.exe
  2⤵
  PID:9196
- C:\Windows\System\MBcUjhv.exe
  C:\Windows\System\MBcUjhv.exe
  2⤵
  PID:7748
- C:\Windows\System\ZSUIIXl.exe
  C:\Windows\System\ZSUIIXl.exe
  2⤵
  PID:6428
- C:\Windows\System\mLHYzUP.exe
  C:\Windows\System\mLHYzUP.exe
  2⤵
  PID:7252
- C:\Windows\System\MPZfrzQ.exe
  C:\Windows\System\MPZfrzQ.exe
  2⤵
  PID:8108
- C:\Windows\System\lFzyprr.exe
  C:\Windows\System\lFzyprr.exe
  2⤵
  PID:7592
- C:\Windows\System\axcgqMX.exe
  C:\Windows\System\axcgqMX.exe
  2⤵
  PID:7672
- C:\Windows\System\dEGuOhO.exe
  C:\Windows\System\dEGuOhO.exe
  2⤵
  PID:7620
- C:\Windows\System\IQEvsKh.exe
  C:\Windows\System\IQEvsKh.exe
  2⤵
  PID:7636
- C:\Windows\System\pzcdGxo.exe
  C:\Windows\System\pzcdGxo.exe
  2⤵
  PID:7736
- C:\Windows\System\VosOsxN.exe
  C:\Windows\System\VosOsxN.exe
  2⤵
  PID:7772
- C:\Windows\System\fnJzRTF.exe
  C:\Windows\System\fnJzRTF.exe
  2⤵
  PID:7964
- C:\Windows\System\trWdYMm.exe
  C:\Windows\System\trWdYMm.exe
  2⤵
  PID:8204
- C:\Windows\System\GnzWMhW.exe
  C:\Windows\System\GnzWMhW.exe
  2⤵
  PID:8308
- C:\Windows\System\VrmGbBU.exe
  C:\Windows\System\VrmGbBU.exe
  2⤵
  PID:8092
- C:\Windows\System\mMOjgxl.exe
  C:\Windows\System\mMOjgxl.exe
  2⤵
  PID:8356
- C:\Windows\System\ODdtnnw.exe
  C:\Windows\System\ODdtnnw.exe
  2⤵
  PID:8376
- C:\Windows\System\KudTMrd.exe
  C:\Windows\System\KudTMrd.exe
  2⤵
  PID:8256
- C:\Windows\System\hCLxhRG.exe
  C:\Windows\System\hCLxhRG.exe
  2⤵
  PID:8292
- C:\Windows\System\aJgBSVm.exe
  C:\Windows\System\aJgBSVm.exe
  2⤵
  PID:8396
- C:\Windows\System\gQvXfrM.exe
  C:\Windows\System\gQvXfrM.exe
  2⤵
  PID:8452
- C:\Windows\System\XBlvnyM.exe
  C:\Windows\System\XBlvnyM.exe
  2⤵
  PID:8492
- C:\Windows\System\PZuqAqP.exe
  C:\Windows\System\PZuqAqP.exe
  2⤵
  PID:8512
- C:\Windows\System\BzjLthf.exe
  C:\Windows\System\BzjLthf.exe
  2⤵
  PID:8436
- C:\Windows\System\PtRKIyJ.exe
  C:\Windows\System\PtRKIyJ.exe
  2⤵
  PID:8544
- C:\Windows\System\sKabKum.exe
  C:\Windows\System\sKabKum.exe
  2⤵
  PID:8560
- C:\Windows\System\knjppSN.exe
  C:\Windows\System\knjppSN.exe
  2⤵
  PID:8636
- C:\Windows\System\yQzEQhf.exe
  C:\Windows\System\yQzEQhf.exe
  2⤵
  PID:8588
- C:\Windows\System\AfNWukE.exe
  C:\Windows\System\AfNWukE.exe
  2⤵
  PID:8660
- C:\Windows\System\yjjzEgc.exe
  C:\Windows\System\yjjzEgc.exe
  2⤵
  PID:8680
- C:\Windows\System\JkBOChB.exe
  C:\Windows\System\JkBOChB.exe
  2⤵
  PID:8772
- C:\Windows\System\cxMJXmW.exe
  C:\Windows\System\cxMJXmW.exe
  2⤵
  PID:8884
- C:\Windows\System\UZsyxUa.exe
  C:\Windows\System\UZsyxUa.exe
  2⤵
  PID:8708
- C:\Windows\System\oKKIXMg.exe
  C:\Windows\System\oKKIXMg.exe
  2⤵
  PID:8720
- C:\Windows\System\IMPUCnY.exe
  C:\Windows\System\IMPUCnY.exe
  2⤵
  PID:9032
- C:\Windows\System\KYkdgLn.exe
  C:\Windows\System\KYkdgLn.exe
  2⤵
  PID:8752
- C:\Windows\System\IkpxXoS.exe
  C:\Windows\System\IkpxXoS.exe
  2⤵
  PID:9128
- C:\Windows\System\mqNJYSi.exe
  C:\Windows\System\mqNJYSi.exe
  2⤵
  PID:9004
- C:\Windows\System\GQhPUee.exe
  C:\Windows\System\GQhPUee.exe
  2⤵
  PID:7496
- C:\Windows\System\ojGIvPX.exe
  C:\Windows\System\ojGIvPX.exe
  2⤵
  PID:7460
- C:\Windows\System\gwQmFcC.exe
  C:\Windows\System\gwQmFcC.exe
  2⤵
  PID:7364
- C:\Windows\System\wFJMJpn.exe
  C:\Windows\System\wFJMJpn.exe
  2⤵
  PID:7640
- C:\Windows\System\aoUvPnl.exe
  C:\Windows\System\aoUvPnl.exe
  2⤵
  PID:7604
- C:\Windows\System\oRyThVy.exe
  C:\Windows\System\oRyThVy.exe
  2⤵
  PID:7864
- C:\Windows\System\ptrtnuo.exe
  C:\Windows\System\ptrtnuo.exe
  2⤵
  PID:8244
- C:\Windows\System\FkwoykH.exe
  C:\Windows\System\FkwoykH.exe
  2⤵
  PID:7828
- C:\Windows\System\BFoFdld.exe
  C:\Windows\System\BFoFdld.exe
  2⤵
  PID:8208
- C:\Windows\System\yfWbJvC.exe
  C:\Windows\System\yfWbJvC.exe
  2⤵
  PID:8460
- C:\Windows\System\XvHLLto.exe
  C:\Windows\System\XvHLLto.exe
  2⤵
  PID:8508
- C:\Windows\System\fYBfvvX.exe
  C:\Windows\System\fYBfvvX.exe
  2⤵
  PID:8604
- C:\Windows\System\FvPAVjR.exe
  C:\Windows\System\FvPAVjR.exe
  2⤵
  PID:8400
- C:\Windows\System\KGlwqUI.exe
  C:\Windows\System\KGlwqUI.exe
  2⤵
  PID:8348
- C:\Windows\System\dRJMGgD.exe
  C:\Windows\System\dRJMGgD.exe
  2⤵
  PID:8388
- C:\Windows\System\XVLzSxP.exe
  C:\Windows\System\XVLzSxP.exe
  2⤵
  PID:8532
- C:\Windows\System\VvgJVbh.exe
  C:\Windows\System\VvgJVbh.exe
  2⤵
  PID:8620
- C:\Windows\System\gNzyYts.exe
  C:\Windows\System\gNzyYts.exe
  2⤵
  PID:8844
- C:\Windows\System\eKqglQN.exe
  C:\Windows\System\eKqglQN.exe
  2⤵
  PID:8584
- C:\Windows\System\RnZxYFK.exe
  C:\Windows\System\RnZxYFK.exe
  2⤵
  PID:8868
- C:\Windows\System\VIbSWMp.exe
  C:\Windows\System\VIbSWMp.exe
  2⤵
  PID:1008
- C:\Windows\System\obHcilz.exe
  C:\Windows\System\obHcilz.exe
  2⤵
  PID:8936
- C:\Windows\System\LBOCqay.exe
  C:\Windows\System\LBOCqay.exe
  2⤵
  PID:9132
- C:\Windows\System\HNQzBkY.exe
  C:\Windows\System\HNQzBkY.exe
  2⤵
  PID:6780
- C:\Windows\System\tlhRlEy.exe
  C:\Windows\System\tlhRlEy.exe
  2⤵
  PID:9200
- C:\Windows\System\HtqODKh.exe
  C:\Windows\System\HtqODKh.exe
  2⤵
  PID:9080
- C:\Windows\System\pFqtxDu.exe
  C:\Windows\System\pFqtxDu.exe
  2⤵
  PID:7236
- C:\Windows\System\vWUqdWz.exe
  C:\Windows\System\vWUqdWz.exe
  2⤵
  PID:7180
- C:\Windows\System\bXeUQnH.exe
  C:\Windows\System\bXeUQnH.exe
  2⤵
  PID:7776
- C:\Windows\System\mgnBhBa.exe
  C:\Windows\System\mgnBhBa.exe
  2⤵
  PID:7336
- C:\Windows\System\oRSiKFe.exe
  C:\Windows\System\oRSiKFe.exe
  2⤵
  PID:7944
- C:\Windows\System\uidwMzX.exe
  C:\Windows\System\uidwMzX.exe
  2⤵
  PID:8260
- C:\Windows\System\BrumKqe.exe
  C:\Windows\System\BrumKqe.exe
  2⤵
  PID:8336
- C:\Windows\System\nCyonmX.exe
  C:\Windows\System\nCyonmX.exe
  2⤵
  PID:8236
- C:\Windows\System\SsqgvVT.exe
  C:\Windows\System\SsqgvVT.exe
  2⤵
  PID:8548
- C:\Windows\System\smnuHsm.exe
  C:\Windows\System\smnuHsm.exe
  2⤵
  PID:8688
- C:\Windows\System\egvPHVL.exe
  C:\Windows\System\egvPHVL.exe
  2⤵
  PID:8952
- C:\Windows\System\qeEdceO.exe
  C:\Windows\System\qeEdceO.exe
  2⤵
  PID:9220
- C:\Windows\System\ZBCpxxy.exe
  C:\Windows\System\ZBCpxxy.exe
  2⤵
  PID:9284
- C:\Windows\System\JXKvSly.exe
  C:\Windows\System\JXKvSly.exe
  2⤵
  PID:9300
- C:\Windows\System\nQvnriJ.exe
  C:\Windows\System\nQvnriJ.exe
  2⤵
  PID:9316
- C:\Windows\System\dMWZwtF.exe
  C:\Windows\System\dMWZwtF.exe
  2⤵
  PID:9332
- C:\Windows\System\YfDNHdx.exe
  C:\Windows\System\YfDNHdx.exe
  2⤵
  PID:9352
- C:\Windows\System\ZDSkFNk.exe
  C:\Windows\System\ZDSkFNk.exe
  2⤵
  PID:9368
- C:\Windows\System\mitEmcO.exe
  C:\Windows\System\mitEmcO.exe
  2⤵
  PID:9384
- C:\Windows\System\zRxYIdM.exe
  C:\Windows\System\zRxYIdM.exe
  2⤵
  PID:9404
- C:\Windows\System\xLtCVzK.exe
  C:\Windows\System\xLtCVzK.exe
  2⤵
  PID:9420
- C:\Windows\System\QTGxowO.exe
  C:\Windows\System\QTGxowO.exe
  2⤵
  PID:9436
- C:\Windows\System\HfrjQbq.exe
  C:\Windows\System\HfrjQbq.exe
  2⤵
  PID:9452
- C:\Windows\System\qwWnoNq.exe
  C:\Windows\System\qwWnoNq.exe
  2⤵
  PID:9468
- C:\Windows\System\odOyAZI.exe
  C:\Windows\System\odOyAZI.exe
  2⤵
  PID:9496
- C:\Windows\System\QSSkHLs.exe
  C:\Windows\System\QSSkHLs.exe
  2⤵
  PID:9536
- C:\Windows\System\jJlvGMQ.exe
  C:\Windows\System\jJlvGMQ.exe
  2⤵
  PID:9552
- C:\Windows\System\BgiTVmj.exe
  C:\Windows\System\BgiTVmj.exe
  2⤵
  PID:9568
- C:\Windows\System\OaLbDQt.exe
  C:\Windows\System\OaLbDQt.exe
  2⤵
  PID:9628
- C:\Windows\System\eKytBrQ.exe
  C:\Windows\System\eKytBrQ.exe
  2⤵
  PID:9652
- C:\Windows\System\IfgdKpC.exe
  C:\Windows\System\IfgdKpC.exe
  2⤵
  PID:9668
- C:\Windows\System\yCeosEf.exe
  C:\Windows\System\yCeosEf.exe
  2⤵
  PID:9684
- C:\Windows\System\iyViXdR.exe
  C:\Windows\System\iyViXdR.exe
  2⤵
  PID:9700
- C:\Windows\System\JJpmdUw.exe
  C:\Windows\System\JJpmdUw.exe
  2⤵
  PID:9716
- C:\Windows\System\CpdLDzo.exe
  C:\Windows\System\CpdLDzo.exe
  2⤵
  PID:9732
- C:\Windows\System\JgEsnEK.exe
  C:\Windows\System\JgEsnEK.exe
  2⤵
  PID:9748
- C:\Windows\System\wSTuDHa.exe
  C:\Windows\System\wSTuDHa.exe
  2⤵
  PID:9764
- C:\Windows\System\hvnSxUB.exe
  C:\Windows\System\hvnSxUB.exe
  2⤵
  PID:9780
- C:\Windows\System\qLeRemw.exe
  C:\Windows\System\qLeRemw.exe
  2⤵
  PID:9796
- C:\Windows\System\loeUOgS.exe
  C:\Windows\System\loeUOgS.exe
  2⤵
  PID:9812
- C:\Windows\System\ejlMEGc.exe
  C:\Windows\System\ejlMEGc.exe
  2⤵
  PID:9828
- C:\Windows\System\AktTDAn.exe
  C:\Windows\System\AktTDAn.exe
  2⤵
  PID:9844
- C:\Windows\System\hLKRaCK.exe
  C:\Windows\System\hLKRaCK.exe
  2⤵
  PID:9860
- C:\Windows\System\lhntqSu.exe
  C:\Windows\System\lhntqSu.exe
  2⤵
  PID:9876
- C:\Windows\System\DRhtyGA.exe
  C:\Windows\System\DRhtyGA.exe
  2⤵
  PID:9896
- C:\Windows\System\wDjGwIk.exe
  C:\Windows\System\wDjGwIk.exe
  2⤵
  PID:9980
- C:\Windows\System\aJhsBSP.exe
  C:\Windows\System\aJhsBSP.exe
  2⤵
  PID:10024
- C:\Windows\System\btlthxe.exe
  C:\Windows\System\btlthxe.exe
  2⤵
  PID:10040
- C:\Windows\System\jbziVCg.exe
  C:\Windows\System\jbziVCg.exe
  2⤵
  PID:10060
- C:\Windows\System\zfspDkp.exe
  C:\Windows\System\zfspDkp.exe
  2⤵
  PID:10076
- C:\Windows\System\JjtdQLP.exe
  C:\Windows\System\JjtdQLP.exe
  2⤵
  PID:10092
- C:\Windows\System\qABdQwb.exe
  C:\Windows\System\qABdQwb.exe
  2⤵
  PID:10108
- C:\Windows\System\qsgupgG.exe
  C:\Windows\System\qsgupgG.exe
  2⤵
  PID:10164
- C:\Windows\System\hcGEdFM.exe
  C:\Windows\System\hcGEdFM.exe
  2⤵
  PID:10180
- C:\Windows\System\eNeGrHn.exe
  C:\Windows\System\eNeGrHn.exe
  2⤵
  PID:10196
- C:\Windows\System\ptXhtWd.exe
  C:\Windows\System\ptXhtWd.exe
  2⤵
  PID:10220
- C:\Windows\System\GNOZZDZ.exe
  C:\Windows\System\GNOZZDZ.exe
  2⤵
  PID:9016
- C:\Windows\System\erpoCeO.exe
  C:\Windows\System\erpoCeO.exe
  2⤵
  PID:8644
- C:\Windows\System\NkPJVVD.exe
  C:\Windows\System\NkPJVVD.exe
  2⤵
  PID:8524
- C:\Windows\System\owwLpgx.exe
  C:\Windows\System\owwLpgx.exe
  2⤵
  PID:8892
- C:\Windows\System\wiSLGVe.exe
  C:\Windows\System\wiSLGVe.exe
  2⤵
  PID:8572
- C:\Windows\System\aKjniiM.exe
  C:\Windows\System\aKjniiM.exe
  2⤵
  PID:9156
- C:\Windows\System\ivjJFrM.exe
  C:\Windows\System\ivjJFrM.exe
  2⤵
  PID:7560
- C:\Windows\System\aZXKoni.exe
  C:\Windows\System\aZXKoni.exe
  2⤵
  PID:7332
- C:\Windows\System\omuRVxA.exe
  C:\Windows\System\omuRVxA.exe
  2⤵
  PID:8724
- C:\Windows\System\KnFgKBa.exe
  C:\Windows\System\KnFgKBa.exe
  2⤵
  PID:9232
- C:\Windows\System\dHJFNsY.exe
  C:\Windows\System\dHJFNsY.exe
  2⤵
  PID:9296
- C:\Windows\System\lHGqUiW.exe
  C:\Windows\System\lHGqUiW.exe
  2⤵
  PID:9252
- C:\Windows\System\QToqvFs.exe
  C:\Windows\System\QToqvFs.exe
  2⤵
  PID:9392
- C:\Windows\System\WxNAzuY.exe
  C:\Windows\System\WxNAzuY.exe
  2⤵
  PID:9260
- C:\Windows\System\ivEMjDy.exe
  C:\Windows\System\ivEMjDy.exe
  2⤵
  PID:9560
- C:\Windows\System\MWDXDAg.exe
  C:\Windows\System\MWDXDAg.exe
  2⤵
  PID:9520
- C:\Windows\System\fdznyWa.exe
  C:\Windows\System\fdznyWa.exe
  2⤵
  PID:9508
- C:\Windows\System\AhLYuVz.exe
  C:\Windows\System\AhLYuVz.exe
  2⤵
  PID:9312
- C:\Windows\System\akjyFuU.exe
  C:\Windows\System\akjyFuU.exe
  2⤵
  PID:9380
- C:\Windows\System\EGnXwpp.exe
  C:\Windows\System\EGnXwpp.exe
  2⤵
  PID:9480
- C:\Windows\System\SqyFrAN.exe
  C:\Windows\System\SqyFrAN.exe
  2⤵
  PID:9492
- C:\Windows\System\adEqosg.exe
  C:\Windows\System\adEqosg.exe
  2⤵
  PID:9584
- C:\Windows\System\visvAqc.exe
  C:\Windows\System\visvAqc.exe
  2⤵
  PID:9600
- C:\Windows\System\tszcHGx.exe
  C:\Windows\System\tszcHGx.exe
  2⤵
  PID:9640
- C:\Windows\System\MUBkbnw.exe
  C:\Windows\System\MUBkbnw.exe
  2⤵
  PID:9580
- C:\Windows\System\fszlxEK.exe
  C:\Windows\System\fszlxEK.exe
  2⤵
  PID:9740
- C:\Windows\System\PhfzuNA.exe
  C:\Windows\System\PhfzuNA.exe
  2⤵
  PID:9808
- C:\Windows\System\JSdSSFT.exe
  C:\Windows\System\JSdSSFT.exe
  2⤵
  PID:9692
- C:\Windows\System\ySpqlwz.exe
  C:\Windows\System\ySpqlwz.exe
  2⤵
  PID:9788
- C:\Windows\System\PPiKpxt.exe
  C:\Windows\System\PPiKpxt.exe
  2⤵
  PID:9868
- C:\Windows\System\OqejJJC.exe
  C:\Windows\System\OqejJJC.exe
  2⤵
  PID:9884
- C:\Windows\System\GvGcBmg.exe
  C:\Windows\System\GvGcBmg.exe
  2⤵
  PID:9892
- C:\Windows\System\jDCBksZ.exe
  C:\Windows\System\jDCBksZ.exe
  2⤵
  PID:9928
- C:\Windows\System\dyzupdh.exe
  C:\Windows\System\dyzupdh.exe
  2⤵
  PID:9952
- C:\Windows\System\lTjPsou.exe
  C:\Windows\System\lTjPsou.exe
  2⤵
  PID:9964
- C:\Windows\System\axZVHDY.exe
  C:\Windows\System\axZVHDY.exe
  2⤵
  PID:9976
- C:\Windows\System\BNZVeKh.exe
  C:\Windows\System\BNZVeKh.exe
  2⤵
  PID:10032
- C:\Windows\System\cidmuJh.exe
  C:\Windows\System\cidmuJh.exe
  2⤵
  PID:10004
- C:\Windows\System\oAxuSUQ.exe
  C:\Windows\System\oAxuSUQ.exe
  2⤵
  PID:10072
- C:\Windows\System\vMlYrEU.exe
  C:\Windows\System\vMlYrEU.exe
  2⤵
  PID:10104
- C:\Windows\System\mdmyaka.exe
  C:\Windows\System\mdmyaka.exe
  2⤵
  PID:10120
- C:\Windows\System\ioMsNVu.exe
  C:\Windows\System\ioMsNVu.exe
  2⤵
  PID:10136
- C:\Windows\System\gpRWOxW.exe
  C:\Windows\System\gpRWOxW.exe
  2⤵
  PID:10160
- C:\Windows\System\WpbKKJX.exe
  C:\Windows\System\WpbKKJX.exe
  2⤵
  PID:10188
- C:\Windows\System\YweZZDR.exe
  C:\Windows\System\YweZZDR.exe
  2⤵
  PID:9136
- C:\Windows\System\SWqpTdV.exe
  C:\Windows\System\SWqpTdV.exe
  2⤵
  PID:7608
- C:\Windows\System\wDhuwBy.exe
  C:\Windows\System\wDhuwBy.exe
  2⤵
  PID:7512
- C:\Windows\System\LlgJnQc.exe
  C:\Windows\System\LlgJnQc.exe
  2⤵
  PID:8320
- C:\Windows\System\ZzuJHjw.exe
  C:\Windows\System\ZzuJHjw.exe
  2⤵
  PID:9244
- C:\Windows\System\MqBHXOq.exe
  C:\Windows\System\MqBHXOq.exe
  2⤵
  PID:8364
- C:\Windows\System\vRwoeSP.exe
  C:\Windows\System\vRwoeSP.exe
  2⤵
  PID:9504
- C:\Windows\System\AaUKQbc.exe
  C:\Windows\System\AaUKQbc.exe
  2⤵
  PID:9276
- C:\Windows\System\lIUKAoX.exe
  C:\Windows\System\lIUKAoX.exe
  2⤵
  PID:9256
- C:\Windows\System\UYgaibb.exe
  C:\Windows\System\UYgaibb.exe
  2⤵
  PID:9532
- C:\Windows\System\VbVhiau.exe
  C:\Windows\System\VbVhiau.exe
  2⤵
  PID:9488
- C:\Windows\System\tuMdvWJ.exe
  C:\Windows\System\tuMdvWJ.exe
  2⤵
  PID:9576
- C:\Windows\System\YFlBfZN.exe
  C:\Windows\System\YFlBfZN.exe
  2⤵
  PID:9596
- C:\Windows\System\oZgWOqu.exe
  C:\Windows\System\oZgWOqu.exe
  2⤵
  PID:9620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AWeqWVv.exe

Filesize
2.1MB

MD5
94e9cf6fee40e0b943fb204b7cd35c15

SHA1
5c4b6ad0167d56c35bbc06213892176b34a10926

SHA256
c79966b60687a5cfab6f8e0296e745ac42cadf8d459b2f2b81b45ebcea3f0ca2

SHA512
05a09f13c5842edccfbbc4d78f403c9c6ef5d8354c5582096e4b8c9bd307f032707b3c58d1381578ecc8550c35713c6fff6f495d0865a6e9dae5c4fb8d55e9c7

Download Submit
C:\Windows\system\EDRPJIr.exe

Filesize
2.1MB

MD5
0f6bcaba281f02a6aa4ff46ffd33a7d6

SHA1
3749e7f6c57238657a62bccf1a0e96afca91109b

SHA256
8218a9561089a841e47cae343aacfaf8bef2e01a7924f4ecae15788992ec09d2

SHA512
c685ce93f7db31656d2d20c1b7fcc76610945d84823e319ac7be717d05c271cca5ca44339e84a86aee4c353e450eb3a6b00972057bdf8ff5074f1c816568f11b

Download Submit
C:\Windows\system\FjHppQN.exe

Filesize
2.1MB

MD5
7b8d74cd04dcb786b8cb394b0a335e05

SHA1
5c00c0d24825b82008459d250b220491ab387932

SHA256
c5d3c8926d28ef2abbaa74e67a6bfcfc1f11fae2753d481b62d45ef604f1fc31

SHA512
666bee8160bbb1e5f48f7f2f73e866bc3b0ca8dd42c8f0fd31dcc411391c4392cdbfc32ce6174b1eca632618026e862391f24009ec4bbf62485b45be5c04715d

Download Submit
C:\Windows\system\JqEzUCP.exe

Filesize
2.1MB

MD5
5f2a25e3577117069a93d298b6381534

SHA1
01d3ff26a5956b68b6da3435b7a648b4a8160407

SHA256
7912367b1ba8f524dc77500e37394834d194306645dc330635f062c51de27dbe

SHA512
910744eb6a328e15a21f3cc4bff9ef2930a97e0a39a4b02d832e21a123c7bd4eb846da8cba40099c6baecda62b7dbad903266052ae3da8f91e20ac3cb55abae0

Download Submit
C:\Windows\system\KjkjHNs.exe

Filesize
2.1MB

MD5
6ee280a95dc0f10f8f8bbf8682bad9b7

SHA1
b6f5ba522eb6d468b3826c04082c9a1f3ef1c746

SHA256
2c43782a3ef8163c6be852c345b00c918da25aab7c8ea876369d751496264a61

SHA512
a467f838849307ca7918262d2e6447ea5da9661b5bc914258ecfbef8cfb2b0a6c987d5f98d316291038c659df1a588364129ed03689944aeab853fc66e582b47

Download Submit
C:\Windows\system\PdkEkgD.exe

Filesize
2.1MB

MD5
a785a2e7753aea0c62e93b75ebd68785

SHA1
7f1491fa5e0bffe722f92409da4e79a9009fc872

SHA256
30de220c220f7dde3b2345767439b735f8fe7a10a860500580099f50063ff147

SHA512
cfbf008889de73fd2a246b04c690f1deb092f17ff9413560afda459d7570810bf8c4c1979a27425ccb7307f67dc413b973ed2d2735a254beaa40473f23f0bfbf

Download Submit
C:\Windows\system\QzoiJcD.exe

Filesize
2.1MB

MD5
a68a23d0b2ffbcf8767777f0745c0be5

SHA1
625f9c48ad0c5ed10ee5aef237989431940985b8

SHA256
b52c00001122d1b18d31fe042b2dffe2f295e64e9f285668320cfff0e0c9a5ce

SHA512
20c78cda257f3d165b7f39e47650e27e5e5bc58d528ba573e180fd3364117ee959a750de59fec14097ffc7dc52ae8489fc0e6e14f2d3d08ca563bb18b284d090

Download Submit
C:\Windows\system\UAvZcpd.exe

Filesize
2.1MB

MD5
b9c5d1ea070f8949859efb3a33e80dbd

SHA1
b874be8a13b6ca4b4da62d1300e55313cf0b5a3f

SHA256
a15169d9c2e34958b28cb9ca700b3e0d07c6ef0740ffdb7dbea5d67d42083f6f

SHA512
ebb971a9783a0f6e122c7a47c2e6ee3dac72a44e4da5bd193fbb0252af852dd377aae289b1f38dceb04d242fdb2a417cae9f3be8939a6a7a919c85c82fc58233

Download Submit
C:\Windows\system\WvUuEKX.exe

Filesize
2.1MB

MD5
d3719624278e7951ae252457e2e76d4b

SHA1
06d3d570083e42e8cc4613d3e8fd433efab22870

SHA256
ee0909a0f9e211178e103f301ff89a7ef50e304de958b8f5d8d73044bb2b919e

SHA512
8a215fd25a557672908c2b11dcbe7e0817c1f6588c34e9e71678b38442108dbbfb689e5ec1949efc3f0f896b7b8211f19cb66a38bf77306d7ee578209f28aa02

Download Submit
C:\Windows\system\YamOmaw.exe

Filesize
2.1MB

MD5
af271f09e29700155991c1daafc84086

SHA1
1985932c5c54c7c84fc7c6de81fc8a26bc2b6fa3

SHA256
b0eb277ea7596a24cb606974285209510d2bcf3974a05a7a790762c27e31cfce

SHA512
2fc33cf247c6d4815c55f4437dd46bb88d199e56de07f18ed52845bea94dc96b9e8d208872e266de94092c794a620a62e89f1075512c1e0c6bd71c3d869ce60b

Download Submit
C:\Windows\system\ZBqLgPb.exe

Filesize
2.1MB

MD5
5e6b727576247531bfd1ac12e8e85a70

SHA1
ae60c34ce280a6d83f203dfa4373d3f036d6f7e2

SHA256
b915604a4d55da8b2d5117902637e2dadf6bd9486812aedc80a093857800f875

SHA512
8c375de9a8abacdf0d68a4615ac3e1a10d75bdb255bc1334f0efe384cfe0b1bc124c48be870078a0a42fed7b921408873fb0a304d3c56d93c92f7d9ea8a63c25

Download Submit
C:\Windows\system\bJgwjtE.exe

Filesize
2.1MB

MD5
62b1f17a4082c6eb161f30fe4d7f1bad

SHA1
e86e4d4686431bb9e9275e03f0f78c2576277b28

SHA256
b441ece342965d3f8ca8ec785a257bd87824a84cf61629eaf4b80043e62366bf

SHA512
08c06df9081e6fecf32343c31eeb3b00474c25f9c6fdc8a61201e09156710439614b339baaf8f3591db87ab70c36fd075245701f040441615e03cafb016ddb2d

Download Submit
C:\Windows\system\fXqnuOm.exe

Filesize
2.1MB

MD5
ee9b30150a411e26ade34959b67fab9d

SHA1
9b8b0a4e8c760443c9b6077fda8c526a300bedf0

SHA256
5fa40b56caeea344d5e98120f82f4b65fac95eea4254d6aee5b4b6a133505611

SHA512
4c71d521fece27c479006a7e4529d7f81ae8e9aa92c18e07e1b0cc8f21761ca0c34a267e5165fd6a632e947ea295c8d69902a385662eabe59c5bd56573836b03

Download Submit
C:\Windows\system\gLUGxqx.exe

Filesize
2.1MB

MD5
fd3324508164502732179e50d9514000

SHA1
49d08898a60ca247ffbd664f00334fad59cb4ef7

SHA256
901390f48ee881314cc158b8877e8fa577c4c067c0762a97beba0eadb3d3b75c

SHA512
2185aea87c91105e70b789cba5e65921ec0fa1b9362656dba13025501047e661cb04ca116a8b898cf95058248381c93ca5d5bf052997dd3ce59a54ab4fb23f0e

Download Submit
C:\Windows\system\iKwbENw.exe

Filesize
2.1MB

MD5
818c22e73ed8395c04462dc7fd50b3ec

SHA1
9f1f2edeb762d77c57792502c576d022fbd02340

SHA256
aa0089765e8bf68f8183d7f513d369848a12c284f526173de76f66ac81e9bda6

SHA512
d472d8289a1198998dc0e95c19d901acd476cb5d94366d6e800b7c55b6399ac2dcebaf1fb93ba9a75525db5443c2d038c24364239f13d879eabf18d5bdcb3639

Download Submit
C:\Windows\system\jLOTPoZ.exe

Filesize
2.1MB

MD5
e6ba35d476cf836354022e1e8cf7a079

SHA1
b1033c0e261eecfc5aba0b1d04ab6e5f3aab8475

SHA256
f9a3592061635c3421fdd8f94333263d87e22cc09a2b8fff7011eae8bd2f638c

SHA512
0b29a46ea7be3f5bc038d03883a2f98d10a68ad735f130123b9dbe11a727b388a77e71566bc117eac32a6ba9230e013bff224b528fb2fbb9c5e85edfbb0133cb

Download Submit
C:\Windows\system\jslSApI.exe

Filesize
2.1MB

MD5
f48d81bcc0579eaf75ff794a3a55c445

SHA1
a8b2797397591f021feb4af5fdccd317485b0cbd

SHA256
3feae81598a45d84a3ed6d2e52db6265ed07977d52a6644441cd569f6ffca631

SHA512
f4a114d94495a905c8d55753315cba55bdb8f76fe2cb2822cf1d6d6c618c30b06d3b5c086a5ba8b948ed8862cc20bd4d38637e36a2bab7dcaf0835786f34dce1

Download Submit
C:\Windows\system\jtwadlh.exe

Filesize
2.1MB

MD5
5ae6b6e25636000612bfc27d6d9e8f30

SHA1
f74582b9f4c4821c41524f7d020f68d1dc3eb4f9

SHA256
e354fa054b0a9e7a802e228f55e9876635427d3f25f6b146ddbf7e6bbf66d908

SHA512
43995c8d5f4b5c1a9abb2db7277cc11a269d5054023a416afcce783bb044d3d637e1c3180921b198285d536d0168279b38a915893d5403af6062943fe9dffce8

Download Submit
C:\Windows\system\kZzNCVY.exe

Filesize
2.1MB

MD5
6b04c9d47c69aaa67e202da03b777263

SHA1
8b49444a1f501cdd3cc37bd0cb10c4ea6111621c

SHA256
fff12809dc7314585ecd94d1c70f7a025a1c659b1b5181827dbf69f5492055cd

SHA512
9c8a6f31288a5b73d4744467197a5b22b25d12cd56521fc271f7060ed728ebecdbe653cbaa2b11b91c280778f5ca38d700447fbbea661e17be613320554b2232

Download Submit
C:\Windows\system\ovZfRGV.exe

Filesize
2.1MB

MD5
a28747411841dbed59001ca2ef185afb

SHA1
53734d58fc465768a79e14fab66df1fb548015fb

SHA256
426a3480a6a2dd6df8eb722e1576f944ce726b92024e3794da16a85d2b90bfa3

SHA512
e751a6c459fe49d47eadf0a38c5d001c6f7d5ee039ad9581496c9db0c147fa5ba8dfbc2cbd05b47041a02b89ddfe9ecda6077c51f5d763c55de8ef3d2e21c4ca

Download Submit
C:\Windows\system\pgqqzqD.exe

Filesize
2.1MB

MD5
02ccb576b238ddcb378ee889ef6aeef8

SHA1
f97760ec5c647050747a84f20904824b9ccddb9d

SHA256
167d87f105840102b71a25faaca9e46b6f774ec385a7d2ee3459f6efa0dd057a

SHA512
dbba225634c9a077145062a09e4ec3d93ccfb8eedb3424558392cda717eb21d51e80aa918efa1d93e8491eab73983fce1826fc6d55bc72792428f3d567db730a

Download Submit
C:\Windows\system\uCHqWwP.exe

Filesize
2.1MB

MD5
6037b5fa2253511a9567a6128b7a4c0e

SHA1
728b9ef20ba8d14a066ceed89cd58f4daa2072eb

SHA256
96527fdc642eecce64d1a318dcf21bd494b18e4dfd5f65cee5e6a378dc06ddab

SHA512
dcc023ab77af9a16ebaaab954d2333f0614e8386e5386db99a575a69763ea8c060867ba13c9f935297de12d5c51cfd3efeea99183a1fbbced1af67883a050ae8

Download Submit
C:\Windows\system\vSUuyvs.exe

Filesize
2.1MB

MD5
5db1ee181e15422a20529e61dbe6467b

SHA1
c2138fee3cc3bec46a7ba502e05bbd5b324d96ac

SHA256
80affa71637b16d1b091f67b9affc8d81871bf837099a4a501f447b43e3b331b

SHA512
f3f9d0234499d11f30afedd9aeca9a1e08b39c8140463e46403957c12d2ec6f4286529abe1169d1b8500a4851cc5da1424e2f21b94edeb3a8d8c4eefdc71a8e8

Download Submit
C:\Windows\system\vWbtIBv.exe

Filesize
2.1MB

MD5
873658d0e14c99ee98c721e26ec86002

SHA1
a03d2b6e64c252195cc464eb5b5f25c619906f48

SHA256
f9ecfe0e9a05831ab69946b3034c5b1bbd7694c327982e94a539989cda6ba496

SHA512
e1c7da0c67cf44f2733eb7c00d7d0c77805644441f7a83721b97e4f3d8d9a315bef2e5c5a57b0e96b4705603639031b45bd25e7de279262d40a00c868f20ff99

Download Submit
C:\Windows\system\wIwSnrK.exe

Filesize
2.1MB

MD5
498901e26deb8dc7d3342fa992b86cbf

SHA1
6523b9be02751d8f21e9e9add17ffa6936ded495

SHA256
7c3898dbfa55a89a298bfc9964c00081b43962de74d968838a8172a286357faa

SHA512
faa04442ff14bd2678faf918c9e78748006a07f43a95ef3cd1d7627307a0a304dee573851e1907a0f3cae953cd613be18d0cd4babd01ca10986bd65cb26da777

Download Submit
C:\Windows\system\yMRmpMx.exe

Filesize
2.1MB

MD5
080e1fd0e0e8c5e2004b88a5ff12d949

SHA1
85a1c16808510557bfb339a69a5e73b9f27bea60

SHA256
332c3fee9d177ae1fd0fd632cab526ff25877539191daacc02605f23617910bd

SHA512
26efb9ddbdc4f3023576b920701e28b97b8576754c2eac3ff304ebba1f4bb13b410bf1f2b35995827c1f0b15ea85331da87d244521c22f347511b812b3af9589

Download Submit
C:\Windows\system\yOCGxIF.exe

Filesize
2.1MB

MD5
d1609f74fed2650db1f168f6e74669a4

SHA1
69880a44ad594020b5ea4c284e5ddd1e18b7d81f

SHA256
a04a0ee3840e14a7609f2e0b0da5ac9d742ecb42ffc824a68d0e333e1bb50f7d

SHA512
d884eb2d61a220f368d84fec8799c3a2b817afa848e3bea9ee2518b25155781c5ced77825e7bf97b2dcbc06bed0dece51b176f28064e7469cc8c53c885256a02

Download Submit
C:\Windows\system\zMyPkmF.exe

Filesize
2.1MB

MD5
c1b5322e1513722cbc228e77fd1e23f5

SHA1
867524f9fc33029c0695bb45bf6b5cfff8e7f3c1

SHA256
c4de908b96822c9d5e34f72a39e435fc0fd45053f63072dd6b14642018a31a07

SHA512
a14f835926261cd9205a415c690b2409f0c19ad45ed456aa5ce22f1590a57e567c914e6d4d3457ed44baab52d4743876e0ea3278ff4794b7142cac3341062b9e

Download Submit
\Windows\system\BIVyzQJ.exe

Filesize
2.1MB

MD5
b670c9cc5b048cf0598a50b7e45859d5

SHA1
80baf110e2889b830f9e226647085cea7213ff2b

SHA256
d2160088f0051d81ac9392f7589317996472372cbe59c1be0f8903397737e58f

SHA512
4c8e60721158d52661c4bc453dff376a51e92aabbe508b6a467fa2e92388989e5d10e81fcf82ed8cc584199c8ed5eac4eb5125fe7fdeec3fbf61a2a6b4e2bb4c

Download Submit
\Windows\system\PVGaRnZ.exe

Filesize
2.1MB

MD5
98a2399dad08561a8016d343cfc51682

SHA1
30cb2c5cf69a9106a2793293b3707afb8776f953

SHA256
6f0f0c899307b1cec69677c4180855e27ec33e7f163c1f2bc00b4e7f6b8ca2b8

SHA512
0578a795620aec40921b6fe5e4d7c1553b79cb4a41dfb2d05102c3e2c7518c06f66221ebfbe5dcbde2d47531e561471e2577cf622caf6c3bc7f8f23c368cc995

Download Submit
\Windows\system\SjlGEwa.exe

Filesize
2.1MB

MD5
e367b01dfdf9c28bf36afdee1a9f18a1

SHA1
28bc1a537c05d5f3917f779bdb1726d7d469cbc3

SHA256
7436f3ef577323ea7a79f50cf8919303b3e0c2ac8dbfce679e171b420dd6deed

SHA512
b92c1d299bbc597ba1d4a0e1a473d359dc921866f5263513049978b9314c031b971a725a6480c63a043ea6ec68d0c06920eba03fc5218a5b4ab7fd8493f74ed3

Download Submit
\Windows\system\pqBHYVr.exe

Filesize
2.1MB

MD5
8bdd49de05c79b47e190305a7b30bbff

SHA1
90ceb4113f82ed1cd506113d4e2575b20b2e0eda

SHA256
9fa61cce1de94735a860ad3870c64aef3113095f08c179934ebcb40babcd4bd3

SHA512
e85ac5355fe7b50ccfd9ca0bdc3860b1d16828b305637291a41b101ef9a106feae3ac9cf3be0c04441f7e1cda17826bd02fc8b2f33147cdb028afa4bc9a7500c

Download Submit
memory/1068-3319-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/1068-16-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/1800-76-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/1800-3446-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2104-37-0x0000000002850000-0x0000000002858000-memory.dmp

Filesize
32KB

Download
memory/2104-36-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/2364-3591-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-75-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2436-3483-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2436-63-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-86-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2512-1-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/2512-89-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2512-82-0x0000000003640000-0x0000000003A32000-memory.dmp

Filesize
3.9MB

Download
memory/2512-10-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2512-88-0x0000000003640000-0x0000000003A32000-memory.dmp

Filesize
3.9MB

Download
memory/2512-35-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-71-0x0000000003640000-0x0000000003A32000-memory.dmp

Filesize
3.9MB

Download
memory/2512-70-0x0000000003640000-0x0000000003A32000-memory.dmp

Filesize
3.9MB

Download
memory/2512-19-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-221-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2512-59-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2512-80-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-23-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2512-0-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2600-47-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2600-3615-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2632-33-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2684-90-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2828-46-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-32-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-3617-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/3048-3352-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/3048-674-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/3048-18-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download