xmrig | fbde8320f7ae3b43042912f50ffaa3660358ca518a97229394abe2582ee04254

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
Size

1.9MB
MD5

3b2af56a471d28dd702db1fc66d02a01
SHA1

5d1be33159ffa4217be6ee0ab47a87b341e4a62b
SHA256

fbde8320f7ae3b43042912f50ffaa3660358ca518a97229394abe2582ee04254
SHA512

8d2c0cb58a2072d549787a63e59b7e09d66c6b85b1e2bbea854d536e4eb44f2c21f196dd9bb3a55f1dbeb6374437622eea54794e60a78db17f9267c8866b888e
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafQ:NABx

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral1/memory/2132-13-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/2620-72-0x000000013F070000-0x000000013F462000-memory.dmp	xmrig
behavioral1/memory/2864-110-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2316-112-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig
behavioral1/memory/1228-98-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/2460-83-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2388-81-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/1728-79-0x0000000003450000-0x0000000003842000-memory.dmp	xmrig
behavioral1/memory/2152-78-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2936-76-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2556-69-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/2316-5070-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig
behavioral1/memory/2152-5185-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2556-5202-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/2132-5207-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/2864-5254-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2388-5237-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/2460-5286-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2620-5287-0x000000013F070000-0x000000013F462000-memory.dmp	xmrig
behavioral1/memory/2548-5289-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/1728-9809-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1608	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2132	IbWNUFc.exe
2548	rGZfLMJ.exe
2556	ijqGzRG.exe
2620	bLrQvuQ.exe
2936	HSTFiUW.exe
2152	SRYPqpZ.exe
2388	DFKvony.exe
2460	NNMVCcX.exe
2864	WyEMnXW.exe
1228	QHttHwK.exe
2316	QqQRfkt.exe
1300	haZVzGl.exe
356	smOSLDQ.exe
2368	jwrFTJb.exe
2860	umphYbB.exe
2828	OiCsWHG.exe
1936	AkggnZb.exe
2240	ydQVtXx.exe
1700	MrIFWtp.exe
336	dzxMyGJ.exe
1176	XSFabGn.exe
2276	uVICnQt.exe
1772	brxjnLI.exe
1348	ChflXFc.exe
2024	DcLkOUJ.exe
2004	wrTOPMa.exe
2900	jMGEaAh.exe
2244	zAdQTVk.exe
2064	TutQhXG.exe
772	rtNmULq.exe
572	knjlaGz.exe
1768	JYmrETl.exe
2108	DujFEVP.exe
608	ZRgXspp.exe
1504	KzQjnlI.exe
1472	iBxIwzD.exe
1304	LReknbg.exe
1888	usiynHb.exe
848	oXFsWuS.exe
1588	NQmdeJg.exe
2824	MpRqTgI.exe
1852	uWlFjCZ.exe
2248	vpFxSwL.exe
884	sxblCxt.exe
2804	UsTCkIX.exe
2348	mQuGdye.exe
1516	tSdhflm.exe
2592	NVIyUPn.exe
2684	hHSCBaR.exe
2392	buEEpIC.exe
2084	hhEBmSA.exe
2968	uAXzqIG.exe
1336	AnetukW.exe
1236	FpQcTnw.exe
2788	UEyFDDq.exe
2080	jyzbpRB.exe
2420	dFcyNfD.exe
1660	CQCmhAc.exe
2364	VKxrIUx.exe
2324	ivakNti.exe
2700	WGTHsZA.exe
1340	YmXtnDd.exe
2976	ZZkFtML.exe
2500	zBdwQxW.exe

Loads dropped DLL 64 IoCs

pid	Process
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1728-0-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/files/0x000c00000001480e-6.dat	upx
behavioral1/memory/2132-13-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/files/0x0030000000014eb9-14.dat	upx
behavioral1/files/0x001800000000558a-22.dat	upx
behavioral1/memory/2548-19-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/files/0x0007000000015645-34.dat	upx
behavioral1/files/0x00080000000155f6-29.dat	upx
behavioral1/files/0x0008000000015c4c-46.dat	upx
behavioral1/files/0x000700000001564d-40.dat	upx
behavioral1/files/0x0007000000015d24-51.dat	upx
behavioral1/files/0x0006000000015d44-52.dat	upx
behavioral1/files/0x0006000000015e09-67.dat	upx
behavioral1/files/0x0006000000015d4c-59.dat	upx
behavioral1/memory/2620-72-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/files/0x00060000000162c9-104.dat	upx
behavioral1/memory/2864-110-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/files/0x0006000000016c3a-144.dat	upx
behavioral1/files/0x0006000000016ce4-163.dat	upx
behavioral1/files/0x0006000000016cfd-174.dat	upx
behavioral1/files/0x0006000000016476-179.dat	upx
behavioral1/files/0x000600000001654a-181.dat	upx
behavioral1/files/0x0006000000016c1d-139.dat	upx
behavioral1/files/0x0006000000016813-186.dat	upx
behavioral1/files/0x0006000000016c42-190.dat	upx
behavioral1/files/0x0006000000016d05-182.dat	upx
behavioral1/files/0x0006000000015fa7-170.dat	upx
behavioral1/files/0x0006000000016cf5-165.dat	upx
behavioral1/files/0x0006000000016cb2-157.dat	upx
behavioral1/files/0x003000000001502c-125.dat	upx
behavioral1/files/0x00060000000161b3-101.dat	upx
behavioral1/files/0x0006000000015f3c-95.dat	upx
behavioral1/files/0x0006000000015e6d-84.dat	upx
behavioral1/files/0x0006000000016d0e-194.dat	upx
behavioral1/files/0x0006000000016c8c-155.dat	upx
behavioral1/files/0x0006000000016a6f-137.dat	upx
behavioral1/files/0x00060000000165f0-130.dat	upx
behavioral1/memory/2316-112-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/memory/1228-98-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/files/0x00060000000160cc-97.dat	upx
behavioral1/memory/2460-83-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/2388-81-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/memory/2152-78-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2936-76-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/memory/2556-69-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/memory/2316-5070-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/memory/2152-5185-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2556-5202-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/memory/2132-5207-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/memory/2864-5254-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2388-5237-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/memory/2460-5286-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/2620-5287-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/memory/2548-5289-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/1728-9809-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZxHPJIH.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\aKGLPeq.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\MhBIAJE.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\KJBmuij.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\ioZZLfH.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\ktEfzYJ.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\jPolNZc.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\uRfdCsG.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\StEDxTe.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\HxVvUAv.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\YERyLVg.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\kYzTxEq.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\KOPMnjV.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\DXLAxTt.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\kkLUXuU.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\jvPuXWg.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\rSWREuQ.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\AwReoCh.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\SOcSOXd.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\VPQCuhl.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\zZquRWn.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\zxXqwiZ.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\IgAFAyM.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\DgFYdXL.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\tfNbWfz.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\pjrviWD.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\gVmFHqy.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\FyJOeXA.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\LANjlOs.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\jUrZSVn.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\YsUbhbu.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\PbJkBnB.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\fzLWqDL.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\mfKCoGd.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\tJKOzds.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\MmcPpjA.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\GzRECPt.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\fqyJrHn.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\bSZvSbR.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\wISwIHx.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\dYresQm.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\xjhNHPg.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\VOlyXqv.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\gwBcphV.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\NlQsuNf.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\egWtjhB.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\YDXlrzK.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\ozpDhCV.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\ZCddmOz.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\bezSqof.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\FpmbOgW.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\jCpbGRB.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\DFGUcYZ.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\fEDNCMn.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\kBUtnTx.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\URYAaLE.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\AHojAav.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\lokytCl.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\oXFsWuS.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\XpKXxbZ.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\KSLwkQX.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\wISpFDN.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\akrVFvm.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
File created	C:\Windows\System\vfIfNZh.exe	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1608	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
Token: SeDebugPrivilege	1608	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1608	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	29
PID 1728 wrote to memory of 1608	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	29
PID 1728 wrote to memory of 1608	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	29
PID 1728 wrote to memory of 2132	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	30
PID 1728 wrote to memory of 2132	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	30
PID 1728 wrote to memory of 2132	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	30
PID 1728 wrote to memory of 2548	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	31
PID 1728 wrote to memory of 2548	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	31
PID 1728 wrote to memory of 2548	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	31
PID 1728 wrote to memory of 2556	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	32
PID 1728 wrote to memory of 2556	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	32
PID 1728 wrote to memory of 2556	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	32
PID 1728 wrote to memory of 2620	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	33
PID 1728 wrote to memory of 2620	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	33
PID 1728 wrote to memory of 2620	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	33
PID 1728 wrote to memory of 2936	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	34
PID 1728 wrote to memory of 2936	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	34
PID 1728 wrote to memory of 2936	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	34
PID 1728 wrote to memory of 2152	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	35
PID 1728 wrote to memory of 2152	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	35
PID 1728 wrote to memory of 2152	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	35
PID 1728 wrote to memory of 2388	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	36
PID 1728 wrote to memory of 2388	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	36
PID 1728 wrote to memory of 2388	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	36
PID 1728 wrote to memory of 2460	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	37
PID 1728 wrote to memory of 2460	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	37
PID 1728 wrote to memory of 2460	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	37
PID 1728 wrote to memory of 2864	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	38
PID 1728 wrote to memory of 2864	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	38
PID 1728 wrote to memory of 2864	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	38
PID 1728 wrote to memory of 2316	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	39
PID 1728 wrote to memory of 2316	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	39
PID 1728 wrote to memory of 2316	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	39
PID 1728 wrote to memory of 1228	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	40
PID 1728 wrote to memory of 1228	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	40
PID 1728 wrote to memory of 1228	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	40
PID 1728 wrote to memory of 2860	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	41
PID 1728 wrote to memory of 2860	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	41
PID 1728 wrote to memory of 2860	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	41
PID 1728 wrote to memory of 1300	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	42
PID 1728 wrote to memory of 1300	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	42
PID 1728 wrote to memory of 1300	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	42
PID 1728 wrote to memory of 2276	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	43
PID 1728 wrote to memory of 2276	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	43
PID 1728 wrote to memory of 2276	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	43
PID 1728 wrote to memory of 356	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	44
PID 1728 wrote to memory of 356	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	44
PID 1728 wrote to memory of 356	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	44
PID 1728 wrote to memory of 1348	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	45
PID 1728 wrote to memory of 1348	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	45
PID 1728 wrote to memory of 1348	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	45
PID 1728 wrote to memory of 2368	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	46
PID 1728 wrote to memory of 2368	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	46
PID 1728 wrote to memory of 2368	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	46
PID 1728 wrote to memory of 2024	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	47
PID 1728 wrote to memory of 2024	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	47
PID 1728 wrote to memory of 2024	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	47
PID 1728 wrote to memory of 2828	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	48
PID 1728 wrote to memory of 2828	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	48
PID 1728 wrote to memory of 2828	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	48
PID 1728 wrote to memory of 2004	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	49
PID 1728 wrote to memory of 2004	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	49
PID 1728 wrote to memory of 2004	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	49
PID 1728 wrote to memory of 1936	1728	3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3b2af56a471d28dd702db1fc66d02a01_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1608
- C:\Windows\System\IbWNUFc.exe
  C:\Windows\System\IbWNUFc.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\rGZfLMJ.exe
  C:\Windows\System\rGZfLMJ.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\ijqGzRG.exe
  C:\Windows\System\ijqGzRG.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\bLrQvuQ.exe
  C:\Windows\System\bLrQvuQ.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\HSTFiUW.exe
  C:\Windows\System\HSTFiUW.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\SRYPqpZ.exe
  C:\Windows\System\SRYPqpZ.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\DFKvony.exe
  C:\Windows\System\DFKvony.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\NNMVCcX.exe
  C:\Windows\System\NNMVCcX.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\WyEMnXW.exe
  C:\Windows\System\WyEMnXW.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\QqQRfkt.exe
  C:\Windows\System\QqQRfkt.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\QHttHwK.exe
  C:\Windows\System\QHttHwK.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\umphYbB.exe
  C:\Windows\System\umphYbB.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\haZVzGl.exe
  C:\Windows\System\haZVzGl.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\uVICnQt.exe
  C:\Windows\System\uVICnQt.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\smOSLDQ.exe
  C:\Windows\System\smOSLDQ.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\ChflXFc.exe
  C:\Windows\System\ChflXFc.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\jwrFTJb.exe
  C:\Windows\System\jwrFTJb.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\DcLkOUJ.exe
  C:\Windows\System\DcLkOUJ.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\OiCsWHG.exe
  C:\Windows\System\OiCsWHG.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\wrTOPMa.exe
  C:\Windows\System\wrTOPMa.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\AkggnZb.exe
  C:\Windows\System\AkggnZb.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\jMGEaAh.exe
  C:\Windows\System\jMGEaAh.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\ydQVtXx.exe
  C:\Windows\System\ydQVtXx.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\zAdQTVk.exe
  C:\Windows\System\zAdQTVk.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\MrIFWtp.exe
  C:\Windows\System\MrIFWtp.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\TutQhXG.exe
  C:\Windows\System\TutQhXG.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\dzxMyGJ.exe
  C:\Windows\System\dzxMyGJ.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\knjlaGz.exe
  C:\Windows\System\knjlaGz.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\XSFabGn.exe
  C:\Windows\System\XSFabGn.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\JYmrETl.exe
  C:\Windows\System\JYmrETl.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\brxjnLI.exe
  C:\Windows\System\brxjnLI.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\DujFEVP.exe
  C:\Windows\System\DujFEVP.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\rtNmULq.exe
  C:\Windows\System\rtNmULq.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\ZRgXspp.exe
  C:\Windows\System\ZRgXspp.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\KzQjnlI.exe
  C:\Windows\System\KzQjnlI.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\iBxIwzD.exe
  C:\Windows\System\iBxIwzD.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\LReknbg.exe
  C:\Windows\System\LReknbg.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\MAuNDok.exe
  C:\Windows\System\MAuNDok.exe
  2⤵
  PID:1708
- C:\Windows\System\usiynHb.exe
  C:\Windows\System\usiynHb.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\zMRVzkv.exe
  C:\Windows\System\zMRVzkv.exe
  2⤵
  PID:400
- C:\Windows\System\oXFsWuS.exe
  C:\Windows\System\oXFsWuS.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\sZkBAdX.exe
  C:\Windows\System\sZkBAdX.exe
  2⤵
  PID:348
- C:\Windows\System\NQmdeJg.exe
  C:\Windows\System\NQmdeJg.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\JZeCrVD.exe
  C:\Windows\System\JZeCrVD.exe
  2⤵
  PID:2124
- C:\Windows\System\MpRqTgI.exe
  C:\Windows\System\MpRqTgI.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\CehCgXr.exe
  C:\Windows\System\CehCgXr.exe
  2⤵
  PID:320
- C:\Windows\System\uWlFjCZ.exe
  C:\Windows\System\uWlFjCZ.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\PvPSPHJ.exe
  C:\Windows\System\PvPSPHJ.exe
  2⤵
  PID:2100
- C:\Windows\System\vpFxSwL.exe
  C:\Windows\System\vpFxSwL.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\bxbXiTh.exe
  C:\Windows\System\bxbXiTh.exe
  2⤵
  PID:876
- C:\Windows\System\sxblCxt.exe
  C:\Windows\System\sxblCxt.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\utJOjMU.exe
  C:\Windows\System\utJOjMU.exe
  2⤵
  PID:2296
- C:\Windows\System\UsTCkIX.exe
  C:\Windows\System\UsTCkIX.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\yKPVVYi.exe
  C:\Windows\System\yKPVVYi.exe
  2⤵
  PID:1704
- C:\Windows\System\mQuGdye.exe
  C:\Windows\System\mQuGdye.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\ThLDmno.exe
  C:\Windows\System\ThLDmno.exe
  2⤵
  PID:1528
- C:\Windows\System\tSdhflm.exe
  C:\Windows\System\tSdhflm.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\arLKscc.exe
  C:\Windows\System\arLKscc.exe
  2⤵
  PID:2536
- C:\Windows\System\NVIyUPn.exe
  C:\Windows\System\NVIyUPn.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\BDIHolD.exe
  C:\Windows\System\BDIHolD.exe
  2⤵
  PID:2704
- C:\Windows\System\hHSCBaR.exe
  C:\Windows\System\hHSCBaR.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\dplpeUb.exe
  C:\Windows\System\dplpeUb.exe
  2⤵
  PID:2560
- C:\Windows\System\buEEpIC.exe
  C:\Windows\System\buEEpIC.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\jVuRQNV.exe
  C:\Windows\System\jVuRQNV.exe
  2⤵
  PID:2320
- C:\Windows\System\hhEBmSA.exe
  C:\Windows\System\hhEBmSA.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\QhvqwCh.exe
  C:\Windows\System\QhvqwCh.exe
  2⤵
  PID:1952
- C:\Windows\System\uAXzqIG.exe
  C:\Windows\System\uAXzqIG.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\yqWGaxq.exe
  C:\Windows\System\yqWGaxq.exe
  2⤵
  PID:1352
- C:\Windows\System\AnetukW.exe
  C:\Windows\System\AnetukW.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\XevtJcz.exe
  C:\Windows\System\XevtJcz.exe
  2⤵
  PID:1652
- C:\Windows\System\FpQcTnw.exe
  C:\Windows\System\FpQcTnw.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\TanPgqd.exe
  C:\Windows\System\TanPgqd.exe
  2⤵
  PID:1508
- C:\Windows\System\UEyFDDq.exe
  C:\Windows\System\UEyFDDq.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\PPJWSQj.exe
  C:\Windows\System\PPJWSQj.exe
  2⤵
  PID:2428
- C:\Windows\System\jyzbpRB.exe
  C:\Windows\System\jyzbpRB.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\vxmAOgo.exe
  C:\Windows\System\vxmAOgo.exe
  2⤵
  PID:1600
- C:\Windows\System\dFcyNfD.exe
  C:\Windows\System\dFcyNfD.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\PUPwbMm.exe
  C:\Windows\System\PUPwbMm.exe
  2⤵
  PID:1680
- C:\Windows\System\CQCmhAc.exe
  C:\Windows\System\CQCmhAc.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\WPBvqDH.exe
  C:\Windows\System\WPBvqDH.exe
  2⤵
  PID:2808
- C:\Windows\System\VKxrIUx.exe
  C:\Windows\System\VKxrIUx.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\jtOEJDY.exe
  C:\Windows\System\jtOEJDY.exe
  2⤵
  PID:1420
- C:\Windows\System\ivakNti.exe
  C:\Windows\System\ivakNti.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\KMFwmfE.exe
  C:\Windows\System\KMFwmfE.exe
  2⤵
  PID:2184
- C:\Windows\System\WGTHsZA.exe
  C:\Windows\System\WGTHsZA.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\tYKcbsR.exe
  C:\Windows\System\tYKcbsR.exe
  2⤵
  PID:2532
- C:\Windows\System\YmXtnDd.exe
  C:\Windows\System\YmXtnDd.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\nHpznYY.exe
  C:\Windows\System\nHpznYY.exe
  2⤵
  PID:2408
- C:\Windows\System\ZZkFtML.exe
  C:\Windows\System\ZZkFtML.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\RnoSPkb.exe
  C:\Windows\System\RnoSPkb.exe
  2⤵
  PID:2344
- C:\Windows\System\zBdwQxW.exe
  C:\Windows\System\zBdwQxW.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\seSXHyg.exe
  C:\Windows\System\seSXHyg.exe
  2⤵
  PID:1564
- C:\Windows\System\NrhrrAL.exe
  C:\Windows\System\NrhrrAL.exe
  2⤵
  PID:3084
- C:\Windows\System\BcfEvew.exe
  C:\Windows\System\BcfEvew.exe
  2⤵
  PID:3100
- C:\Windows\System\PBqNbvZ.exe
  C:\Windows\System\PBqNbvZ.exe
  2⤵
  PID:3116
- C:\Windows\System\fVFTsXr.exe
  C:\Windows\System\fVFTsXr.exe
  2⤵
  PID:3132
- C:\Windows\System\gQacpOr.exe
  C:\Windows\System\gQacpOr.exe
  2⤵
  PID:3148
- C:\Windows\System\VCmdMun.exe
  C:\Windows\System\VCmdMun.exe
  2⤵
  PID:3164
- C:\Windows\System\kyajxgl.exe
  C:\Windows\System\kyajxgl.exe
  2⤵
  PID:3180
- C:\Windows\System\aWHNFQm.exe
  C:\Windows\System\aWHNFQm.exe
  2⤵
  PID:3196
- C:\Windows\System\ImUUwhQ.exe
  C:\Windows\System\ImUUwhQ.exe
  2⤵
  PID:3212
- C:\Windows\System\mLENEpz.exe
  C:\Windows\System\mLENEpz.exe
  2⤵
  PID:3228
- C:\Windows\System\QgUvuHI.exe
  C:\Windows\System\QgUvuHI.exe
  2⤵
  PID:3244
- C:\Windows\System\TXALIqy.exe
  C:\Windows\System\TXALIqy.exe
  2⤵
  PID:3260
- C:\Windows\System\FApQyiw.exe
  C:\Windows\System\FApQyiw.exe
  2⤵
  PID:3276
- C:\Windows\System\wvfHbjB.exe
  C:\Windows\System\wvfHbjB.exe
  2⤵
  PID:3292
- C:\Windows\System\ALDsVgq.exe
  C:\Windows\System\ALDsVgq.exe
  2⤵
  PID:3308
- C:\Windows\System\tnVhRyA.exe
  C:\Windows\System\tnVhRyA.exe
  2⤵
  PID:3324
- C:\Windows\System\eeAVMBv.exe
  C:\Windows\System\eeAVMBv.exe
  2⤵
  PID:3340
- C:\Windows\System\KdGgDIC.exe
  C:\Windows\System\KdGgDIC.exe
  2⤵
  PID:3356
- C:\Windows\System\Zmgrrxx.exe
  C:\Windows\System\Zmgrrxx.exe
  2⤵
  PID:3376
- C:\Windows\System\GJbpfHn.exe
  C:\Windows\System\GJbpfHn.exe
  2⤵
  PID:3392
- C:\Windows\System\CcqpkuJ.exe
  C:\Windows\System\CcqpkuJ.exe
  2⤵
  PID:3408
- C:\Windows\System\tcienFV.exe
  C:\Windows\System\tcienFV.exe
  2⤵
  PID:3424
- C:\Windows\System\ukbYgnJ.exe
  C:\Windows\System\ukbYgnJ.exe
  2⤵
  PID:3440
- C:\Windows\System\VoaSgli.exe
  C:\Windows\System\VoaSgli.exe
  2⤵
  PID:3456
- C:\Windows\System\WXIWSTP.exe
  C:\Windows\System\WXIWSTP.exe
  2⤵
  PID:3472
- C:\Windows\System\GQSTozq.exe
  C:\Windows\System\GQSTozq.exe
  2⤵
  PID:3488
- C:\Windows\System\SwyufGd.exe
  C:\Windows\System\SwyufGd.exe
  2⤵
  PID:3548
- C:\Windows\System\BzEqtBR.exe
  C:\Windows\System\BzEqtBR.exe
  2⤵
  PID:3568
- C:\Windows\System\UvGNWwv.exe
  C:\Windows\System\UvGNWwv.exe
  2⤵
  PID:3748
- C:\Windows\System\owYKnnN.exe
  C:\Windows\System\owYKnnN.exe
  2⤵
  PID:3780
- C:\Windows\System\vYeTvPI.exe
  C:\Windows\System\vYeTvPI.exe
  2⤵
  PID:3804
- C:\Windows\System\QexlRFL.exe
  C:\Windows\System\QexlRFL.exe
  2⤵
  PID:3840
- C:\Windows\System\YeKytgD.exe
  C:\Windows\System\YeKytgD.exe
  2⤵
  PID:3944
- C:\Windows\System\oxUyUss.exe
  C:\Windows\System\oxUyUss.exe
  2⤵
  PID:3980
- C:\Windows\System\DugEniD.exe
  C:\Windows\System\DugEniD.exe
  2⤵
  PID:4004
- C:\Windows\System\HkHwpwc.exe
  C:\Windows\System\HkHwpwc.exe
  2⤵
  PID:4024
- C:\Windows\System\gSoFUYW.exe
  C:\Windows\System\gSoFUYW.exe
  2⤵
  PID:4044
- C:\Windows\System\qhJLSOh.exe
  C:\Windows\System\qhJLSOh.exe
  2⤵
  PID:4064
- C:\Windows\System\StxPuLJ.exe
  C:\Windows\System\StxPuLJ.exe
  2⤵
  PID:4084
- C:\Windows\System\GNAwJcB.exe
  C:\Windows\System\GNAwJcB.exe
  2⤵
  PID:2652
- C:\Windows\System\lCZqrot.exe
  C:\Windows\System\lCZqrot.exe
  2⤵
  PID:3128
- C:\Windows\System\lGdvnHi.exe
  C:\Windows\System\lGdvnHi.exe
  2⤵
  PID:2484
- C:\Windows\System\OZfuFIz.exe
  C:\Windows\System\OZfuFIz.exe
  2⤵
  PID:3284
- C:\Windows\System\VQjsHoK.exe
  C:\Windows\System\VQjsHoK.exe
  2⤵
  PID:700
- C:\Windows\System\sAoazLf.exe
  C:\Windows\System\sAoazLf.exe
  2⤵
  PID:3016
- C:\Windows\System\CKiByCo.exe
  C:\Windows\System\CKiByCo.exe
  2⤵
  PID:1908
- C:\Windows\System\iKWgSif.exe
  C:\Windows\System\iKWgSif.exe
  2⤵
  PID:1824
- C:\Windows\System\COnuAGg.exe
  C:\Windows\System\COnuAGg.exe
  2⤵
  PID:828
- C:\Windows\System\QBUsNkE.exe
  C:\Windows\System\QBUsNkE.exe
  2⤵
  PID:1688
- C:\Windows\System\uXlSGSX.exe
  C:\Windows\System\uXlSGSX.exe
  2⤵
  PID:560
- C:\Windows\System\mRBijmY.exe
  C:\Windows\System\mRBijmY.exe
  2⤵
  PID:872
- C:\Windows\System\hJrEfAp.exe
  C:\Windows\System\hJrEfAp.exe
  2⤵
  PID:2816
- C:\Windows\System\Raetocf.exe
  C:\Windows\System\Raetocf.exe
  2⤵
  PID:2664
- C:\Windows\System\arFupoZ.exe
  C:\Windows\System\arFupoZ.exe
  2⤵
  PID:1004
- C:\Windows\System\RJjiCbE.exe
  C:\Windows\System\RJjiCbE.exe
  2⤵
  PID:1036
- C:\Windows\System\uxxHNGm.exe
  C:\Windows\System\uxxHNGm.exe
  2⤵
  PID:1944
- C:\Windows\System\givAfFD.exe
  C:\Windows\System\givAfFD.exe
  2⤵
  PID:2644
- C:\Windows\System\pUVpXuZ.exe
  C:\Windows\System\pUVpXuZ.exe
  2⤵
  PID:3388
- C:\Windows\System\yStGorO.exe
  C:\Windows\System\yStGorO.exe
  2⤵
  PID:2996
- C:\Windows\System\zrWgNzm.exe
  C:\Windows\System\zrWgNzm.exe
  2⤵
  PID:3448
- C:\Windows\System\XbTJEUm.exe
  C:\Windows\System\XbTJEUm.exe
  2⤵
  PID:3556
- C:\Windows\System\TxMrDdi.exe
  C:\Windows\System\TxMrDdi.exe
  2⤵
  PID:3144
- C:\Windows\System\xRNHEnL.exe
  C:\Windows\System\xRNHEnL.exe
  2⤵
  PID:3768
- C:\Windows\System\udwpgTS.exe
  C:\Windows\System\udwpgTS.exe
  2⤵
  PID:3760
- C:\Windows\System\GFxGOKd.exe
  C:\Windows\System\GFxGOKd.exe
  2⤵
  PID:3812
- C:\Windows\System\yAPBFDo.exe
  C:\Windows\System\yAPBFDo.exe
  2⤵
  PID:2912
- C:\Windows\System\YCqLTXu.exe
  C:\Windows\System\YCqLTXu.exe
  2⤵
  PID:3020
- C:\Windows\System\DccTLMB.exe
  C:\Windows\System\DccTLMB.exe
  2⤵
  PID:2776
- C:\Windows\System\UOavVKI.exe
  C:\Windows\System\UOavVKI.exe
  2⤵
  PID:332
- C:\Windows\System\YIUNFSL.exe
  C:\Windows\System\YIUNFSL.exe
  2⤵
  PID:3832
- C:\Windows\System\VGoNJuh.exe
  C:\Windows\System\VGoNJuh.exe
  2⤵
  PID:3836
- C:\Windows\System\PqQFGGx.exe
  C:\Windows\System\PqQFGGx.exe
  2⤵
  PID:3404
- C:\Windows\System\BtiPefG.exe
  C:\Windows\System\BtiPefG.exe
  2⤵
  PID:1140
- C:\Windows\System\JEVKwnO.exe
  C:\Windows\System\JEVKwnO.exe
  2⤵
  PID:3208
- C:\Windows\System\TjZgkRZ.exe
  C:\Windows\System\TjZgkRZ.exe
  2⤵
  PID:3272
- C:\Windows\System\ugAvWjM.exe
  C:\Windows\System\ugAvWjM.exe
  2⤵
  PID:3336
- C:\Windows\System\gEjRGnq.exe
  C:\Windows\System\gEjRGnq.exe
  2⤵
  PID:3972
- C:\Windows\System\qrHUQbh.exe
  C:\Windows\System\qrHUQbh.exe
  2⤵
  PID:3848
- C:\Windows\System\bEgaGWL.exe
  C:\Windows\System\bEgaGWL.exe
  2⤵
  PID:3436
- C:\Windows\System\DEHbLNS.exe
  C:\Windows\System\DEHbLNS.exe
  2⤵
  PID:3876
- C:\Windows\System\GAoazyG.exe
  C:\Windows\System\GAoazyG.exe
  2⤵
  PID:3892
- C:\Windows\System\YgZynqK.exe
  C:\Windows\System\YgZynqK.exe
  2⤵
  PID:3908
- C:\Windows\System\xdXhrWJ.exe
  C:\Windows\System\xdXhrWJ.exe
  2⤵
  PID:3924
- C:\Windows\System\FMwOZew.exe
  C:\Windows\System\FMwOZew.exe
  2⤵
  PID:3516
- C:\Windows\System\PqfVqpY.exe
  C:\Windows\System\PqfVqpY.exe
  2⤵
  PID:3532
- C:\Windows\System\ORCDHOH.exe
  C:\Windows\System\ORCDHOH.exe
  2⤵
  PID:3544
- C:\Windows\System\jtdhAUd.exe
  C:\Windows\System\jtdhAUd.exe
  2⤵
  PID:2964
- C:\Windows\System\mKCagzY.exe
  C:\Windows\System\mKCagzY.exe
  2⤵
  PID:3584
- C:\Windows\System\MLKAuwR.exe
  C:\Windows\System\MLKAuwR.exe
  2⤵
  PID:3604
- C:\Windows\System\OZQRWge.exe
  C:\Windows\System\OZQRWge.exe
  2⤵
  PID:3620
- C:\Windows\System\kUwDEPs.exe
  C:\Windows\System\kUwDEPs.exe
  2⤵
  PID:3636
- C:\Windows\System\GGJCOHI.exe
  C:\Windows\System\GGJCOHI.exe
  2⤵
  PID:3652
- C:\Windows\System\ZkLVlpI.exe
  C:\Windows\System\ZkLVlpI.exe
  2⤵
  PID:3668
- C:\Windows\System\SySzvdA.exe
  C:\Windows\System\SySzvdA.exe
  2⤵
  PID:3684
- C:\Windows\System\NIhzvPL.exe
  C:\Windows\System\NIhzvPL.exe
  2⤵
  PID:3704
- C:\Windows\System\tYkGVHr.exe
  C:\Windows\System\tYkGVHr.exe
  2⤵
  PID:3720
- C:\Windows\System\irTnWFu.exe
  C:\Windows\System\irTnWFu.exe
  2⤵
  PID:3732
- C:\Windows\System\QsoguFq.exe
  C:\Windows\System\QsoguFq.exe
  2⤵
  PID:3788
- C:\Windows\System\dgbghpl.exe
  C:\Windows\System\dgbghpl.exe
  2⤵
  PID:3956
- C:\Windows\System\vFkIwTy.exe
  C:\Windows\System\vFkIwTy.exe
  2⤵
  PID:3936
- C:\Windows\System\QNrVmHH.exe
  C:\Windows\System\QNrVmHH.exe
  2⤵
  PID:1384
- C:\Windows\System\mKAnOuT.exe
  C:\Windows\System\mKAnOuT.exe
  2⤵
  PID:4012
- C:\Windows\System\JEfYwle.exe
  C:\Windows\System\JEfYwle.exe
  2⤵
  PID:1972
- C:\Windows\System\oXsnbBw.exe
  C:\Windows\System\oXsnbBw.exe
  2⤵
  PID:4016
- C:\Windows\System\NVFKGbq.exe
  C:\Windows\System\NVFKGbq.exe
  2⤵
  PID:4052
- C:\Windows\System\BRNCyom.exe
  C:\Windows\System\BRNCyom.exe
  2⤵
  PID:4072
- C:\Windows\System\wneHPCe.exe
  C:\Windows\System\wneHPCe.exe
  2⤵
  PID:2680
- C:\Windows\System\rPPvQol.exe
  C:\Windows\System\rPPvQol.exe
  2⤵
  PID:3160
- C:\Windows\System\ezEfXBI.exe
  C:\Windows\System\ezEfXBI.exe
  2⤵
  PID:2872
- C:\Windows\System\xCkykkM.exe
  C:\Windows\System\xCkykkM.exe
  2⤵
  PID:792
- C:\Windows\System\EjNrzdD.exe
  C:\Windows\System\EjNrzdD.exe
  2⤵
  PID:1912
- C:\Windows\System\bjBhFhw.exe
  C:\Windows\System\bjBhFhw.exe
  2⤵
  PID:1672
- C:\Windows\System\KSQIvTM.exe
  C:\Windows\System\KSQIvTM.exe
  2⤵
  PID:2236
- C:\Windows\System\PYyopgR.exe
  C:\Windows\System\PYyopgR.exe
  2⤵
  PID:680
- C:\Windows\System\vZirttk.exe
  C:\Windows\System\vZirttk.exe
  2⤵
  PID:632
- C:\Windows\System\DdqKdsZ.exe
  C:\Windows\System\DdqKdsZ.exe
  2⤵
  PID:2896
- C:\Windows\System\LKBkUlW.exe
  C:\Windows\System\LKBkUlW.exe
  2⤵
  PID:2252
- C:\Windows\System\halRcBQ.exe
  C:\Windows\System\halRcBQ.exe
  2⤵
  PID:2448
- C:\Windows\System\okwmdXR.exe
  C:\Windows\System\okwmdXR.exe
  2⤵
  PID:2908
- C:\Windows\System\TMgRXHg.exe
  C:\Windows\System\TMgRXHg.exe
  2⤵
  PID:2104
- C:\Windows\System\ReLwYcl.exe
  C:\Windows\System\ReLwYcl.exe
  2⤵
  PID:2120
- C:\Windows\System\ufalABa.exe
  C:\Windows\System\ufalABa.exe
  2⤵
  PID:3320
- C:\Windows\System\zWdSBFz.exe
  C:\Windows\System\zWdSBFz.exe
  2⤵
  PID:1012
- C:\Windows\System\XJHnMAr.exe
  C:\Windows\System\XJHnMAr.exe
  2⤵
  PID:1500
- C:\Windows\System\zTRBWZp.exe
  C:\Windows\System\zTRBWZp.exe
  2⤵
  PID:3076
- C:\Windows\System\xQwSQZM.exe
  C:\Windows\System\xQwSQZM.exe
  2⤵
  PID:3452
- C:\Windows\System\LRfHdcx.exe
  C:\Windows\System\LRfHdcx.exe
  2⤵
  PID:3480
- C:\Windows\System\pOBmUto.exe
  C:\Windows\System\pOBmUto.exe
  2⤵
  PID:2640
- C:\Windows\System\acCnmCm.exe
  C:\Windows\System\acCnmCm.exe
  2⤵
  PID:2496
- C:\Windows\System\ZuJOrcI.exe
  C:\Windows\System\ZuJOrcI.exe
  2⤵
  PID:2204
- C:\Windows\System\XSAOPxA.exe
  C:\Windows\System\XSAOPxA.exe
  2⤵
  PID:1280
- C:\Windows\System\uRfdCsG.exe
  C:\Windows\System\uRfdCsG.exe
  2⤵
  PID:412
- C:\Windows\System\ZYwJVMq.exe
  C:\Windows\System\ZYwJVMq.exe
  2⤵
  PID:1856
- C:\Windows\System\OsXfYiT.exe
  C:\Windows\System\OsXfYiT.exe
  2⤵
  PID:2992
- C:\Windows\System\yzqmqXP.exe
  C:\Windows\System\yzqmqXP.exe
  2⤵
  PID:112
- C:\Windows\System\xSIBCtc.exe
  C:\Windows\System\xSIBCtc.exe
  2⤵
  PID:1696
- C:\Windows\System\tdYgSHa.exe
  C:\Windows\System\tdYgSHa.exe
  2⤵
  PID:3828
- C:\Windows\System\CNBuAGC.exe
  C:\Windows\System\CNBuAGC.exe
  2⤵
  PID:2988
- C:\Windows\System\YZlSGIG.exe
  C:\Windows\System\YZlSGIG.exe
  2⤵
  PID:3816
- C:\Windows\System\KBtpFHl.exe
  C:\Windows\System\KBtpFHl.exe
  2⤵
  PID:1196
- C:\Windows\System\tfMCpJi.exe
  C:\Windows\System\tfMCpJi.exe
  2⤵
  PID:3188
- C:\Windows\System\xPPiDrE.exe
  C:\Windows\System\xPPiDrE.exe
  2⤵
  PID:2720
- C:\Windows\System\dOFOdbr.exe
  C:\Windows\System\dOFOdbr.exe
  2⤵
  PID:3176
- C:\Windows\System\XUXuIhB.exe
  C:\Windows\System\XUXuIhB.exe
  2⤵
  PID:3304
- C:\Windows\System\jkYVYla.exe
  C:\Windows\System\jkYVYla.exe
  2⤵
  PID:1560
- C:\Windows\System\fxrEpZm.exe
  C:\Windows\System\fxrEpZm.exe
  2⤵
  PID:3988
- C:\Windows\System\MrLXaEC.exe
  C:\Windows\System\MrLXaEC.exe
  2⤵
  PID:3872
- C:\Windows\System\IgtiswE.exe
  C:\Windows\System\IgtiswE.exe
  2⤵
  PID:3504
- C:\Windows\System\xrFBocP.exe
  C:\Windows\System\xrFBocP.exe
  2⤵
  PID:3580
- C:\Windows\System\GrilEmI.exe
  C:\Windows\System\GrilEmI.exe
  2⤵
  PID:3680
- C:\Windows\System\ImiEhoX.exe
  C:\Windows\System\ImiEhoX.exe
  2⤵
  PID:3868
- C:\Windows\System\obsrEjX.exe
  C:\Windows\System\obsrEjX.exe
  2⤵
  PID:3992
- C:\Windows\System\hgxYTgP.exe
  C:\Windows\System\hgxYTgP.exe
  2⤵
  PID:3124
- C:\Windows\System\JdFsMVL.exe
  C:\Windows\System\JdFsMVL.exe
  2⤵
  PID:2468
- C:\Windows\System\TrSzQBH.exe
  C:\Windows\System\TrSzQBH.exe
  2⤵
  PID:1428
- C:\Windows\System\gRCEAov.exe
  C:\Windows\System\gRCEAov.exe
  2⤵
  PID:1512
- C:\Windows\System\gIVRTKt.exe
  C:\Windows\System\gIVRTKt.exe
  2⤵
  PID:2528
- C:\Windows\System\bSZvSbR.exe
  C:\Windows\System\bSZvSbR.exe
  2⤵
  PID:3416
- C:\Windows\System\GJFwtCd.exe
  C:\Windows\System\GJFwtCd.exe
  2⤵
  PID:2624
- C:\Windows\System\PRiYpWL.exe
  C:\Windows\System\PRiYpWL.exe
  2⤵
  PID:2176
- C:\Windows\System\BYUXlpt.exe
  C:\Windows\System\BYUXlpt.exe
  2⤵
  PID:2692
- C:\Windows\System\SeUBQgZ.exe
  C:\Windows\System\SeUBQgZ.exe
  2⤵
  PID:3080
- C:\Windows\System\tGwYuRH.exe
  C:\Windows\System\tGwYuRH.exe
  2⤵
  PID:3372
- C:\Windows\System\yeZLhIW.exe
  C:\Windows\System\yeZLhIW.exe
  2⤵
  PID:1784
- C:\Windows\System\SsASkfC.exe
  C:\Windows\System\SsASkfC.exe
  2⤵
  PID:2436
- C:\Windows\System\Dcvgjtv.exe
  C:\Windows\System\Dcvgjtv.exe
  2⤵
  PID:2164
- C:\Windows\System\oYykUOa.exe
  C:\Windows\System\oYykUOa.exe
  2⤵
  PID:1096
- C:\Windows\System\LYbtVLN.exe
  C:\Windows\System\LYbtVLN.exe
  2⤵
  PID:3660
- C:\Windows\System\RuOwLOO.exe
  C:\Windows\System\RuOwLOO.exe
  2⤵
  PID:3800
- C:\Windows\System\nngksRS.exe
  C:\Windows\System\nngksRS.exe
  2⤵
  PID:840
- C:\Windows\System\zFLxNGS.exe
  C:\Windows\System\zFLxNGS.exe
  2⤵
  PID:4036
- C:\Windows\System\UzAkqIL.exe
  C:\Windows\System\UzAkqIL.exe
  2⤵
  PID:3964
- C:\Windows\System\BGigCEJ.exe
  C:\Windows\System\BGigCEJ.exe
  2⤵
  PID:3696
- C:\Windows\System\PCfGMmG.exe
  C:\Windows\System\PCfGMmG.exe
  2⤵
  PID:2028
- C:\Windows\System\yhFsLgG.exe
  C:\Windows\System\yhFsLgG.exe
  2⤵
  PID:2544
- C:\Windows\System\anrwOxJ.exe
  C:\Windows\System\anrwOxJ.exe
  2⤵
  PID:984
- C:\Windows\System\kbsqGGa.exe
  C:\Windows\System\kbsqGGa.exe
  2⤵
  PID:2160
- C:\Windows\System\dZNmgMI.exe
  C:\Windows\System\dZNmgMI.exe
  2⤵
  PID:2512
- C:\Windows\System\eFqDKCy.exe
  C:\Windows\System\eFqDKCy.exe
  2⤵
  PID:2524
- C:\Windows\System\mVGqRII.exe
  C:\Windows\System\mVGqRII.exe
  2⤵
  PID:3092
- C:\Windows\System\mtbqrjO.exe
  C:\Windows\System\mtbqrjO.exe
  2⤵
  PID:2172
- C:\Windows\System\XjFfcRL.exe
  C:\Windows\System\XjFfcRL.exe
  2⤵
  PID:2520
- C:\Windows\System\ncjgZnw.exe
  C:\Windows\System\ncjgZnw.exe
  2⤵
  PID:2060
- C:\Windows\System\OzWwtNb.exe
  C:\Windows\System\OzWwtNb.exe
  2⤵
  PID:3536
- C:\Windows\System\ScklGOS.exe
  C:\Windows\System\ScklGOS.exe
  2⤵
  PID:904
- C:\Windows\System\itdSzhj.exe
  C:\Windows\System\itdSzhj.exe
  2⤵
  PID:2564
- C:\Windows\System\NNfrugd.exe
  C:\Windows\System\NNfrugd.exe
  2⤵
  PID:2232
- C:\Windows\System\qrtpddn.exe
  C:\Windows\System\qrtpddn.exe
  2⤵
  PID:1896
- C:\Windows\System\JqBFcDJ.exe
  C:\Windows\System\JqBFcDJ.exe
  2⤵
  PID:3664
- C:\Windows\System\eUdPzoR.exe
  C:\Windows\System\eUdPzoR.exe
  2⤵
  PID:3524
- C:\Windows\System\QWdKrEH.exe
  C:\Windows\System\QWdKrEH.exe
  2⤵
  PID:3724
- C:\Windows\System\qDsgoJX.exe
  C:\Windows\System\qDsgoJX.exe
  2⤵
  PID:1776
- C:\Windows\System\qgsRPKi.exe
  C:\Windows\System\qgsRPKi.exe
  2⤵
  PID:3576
- C:\Windows\System\WQGcdfx.exe
  C:\Windows\System\WQGcdfx.exe
  2⤵
  PID:1124
- C:\Windows\System\rZsEmvi.exe
  C:\Windows\System\rZsEmvi.exe
  2⤵
  PID:3960
- C:\Windows\System\SDzNorO.exe
  C:\Windows\System\SDzNorO.exe
  2⤵
  PID:3628
- C:\Windows\System\fMwTgnh.exe
  C:\Windows\System\fMwTgnh.exe
  2⤵
  PID:536
- C:\Windows\System\NZPQsEB.exe
  C:\Windows\System\NZPQsEB.exe
  2⤵
  PID:4000
- C:\Windows\System\bCitkYw.exe
  C:\Windows\System\bCitkYw.exe
  2⤵
  PID:2612
- C:\Windows\System\akyyhOB.exe
  C:\Windows\System\akyyhOB.exe
  2⤵
  PID:2356
- C:\Windows\System\ZWHPsTK.exe
  C:\Windows\System\ZWHPsTK.exe
  2⤵
  PID:1836
- C:\Windows\System\ZYjHEir.exe
  C:\Windows\System\ZYjHEir.exe
  2⤵
  PID:3240
- C:\Windows\System\arrDbMY.exe
  C:\Windows\System\arrDbMY.exe
  2⤵
  PID:3520
- C:\Windows\System\JYyRnHw.exe
  C:\Windows\System\JYyRnHw.exe
  2⤵
  PID:3600
- C:\Windows\System\DpsoARa.exe
  C:\Windows\System\DpsoARa.exe
  2⤵
  PID:1524
- C:\Windows\System\bMYCnhW.exe
  C:\Windows\System\bMYCnhW.exe
  2⤵
  PID:3920
- C:\Windows\System\zkLUZvZ.exe
  C:\Windows\System\zkLUZvZ.exe
  2⤵
  PID:3756
- C:\Windows\System\MQmRBhk.exe
  C:\Windows\System\MQmRBhk.exe
  2⤵
  PID:4092
- C:\Windows\System\jIhzGLK.exe
  C:\Windows\System\jIhzGLK.exe
  2⤵
  PID:4040
- C:\Windows\System\UtfTklD.exe
  C:\Windows\System\UtfTklD.exe
  2⤵
  PID:3056
- C:\Windows\System\DwzOezn.exe
  C:\Windows\System\DwzOezn.exe
  2⤵
  PID:4108
- C:\Windows\System\apzPZFG.exe
  C:\Windows\System\apzPZFG.exe
  2⤵
  PID:4124
- C:\Windows\System\VHDalND.exe
  C:\Windows\System\VHDalND.exe
  2⤵
  PID:4144
- C:\Windows\System\eubuftY.exe
  C:\Windows\System\eubuftY.exe
  2⤵
  PID:4160
- C:\Windows\System\dtVVokk.exe
  C:\Windows\System\dtVVokk.exe
  2⤵
  PID:4184
- C:\Windows\System\zTJAILS.exe
  C:\Windows\System\zTJAILS.exe
  2⤵
  PID:4200
- C:\Windows\System\xmkbKIL.exe
  C:\Windows\System\xmkbKIL.exe
  2⤵
  PID:4216
- C:\Windows\System\BlLqWoF.exe
  C:\Windows\System\BlLqWoF.exe
  2⤵
  PID:4232
- C:\Windows\System\sChQBJY.exe
  C:\Windows\System\sChQBJY.exe
  2⤵
  PID:4248
- C:\Windows\System\YntVAdQ.exe
  C:\Windows\System\YntVAdQ.exe
  2⤵
  PID:4264
- C:\Windows\System\ZnLlJhb.exe
  C:\Windows\System\ZnLlJhb.exe
  2⤵
  PID:4280
- C:\Windows\System\wfYxVTZ.exe
  C:\Windows\System\wfYxVTZ.exe
  2⤵
  PID:4300
- C:\Windows\System\nfdUQcS.exe
  C:\Windows\System\nfdUQcS.exe
  2⤵
  PID:4316
- C:\Windows\System\OJumtWt.exe
  C:\Windows\System\OJumtWt.exe
  2⤵
  PID:4332
- C:\Windows\System\vTmtJgi.exe
  C:\Windows\System\vTmtJgi.exe
  2⤵
  PID:4348
- C:\Windows\System\JzmutbI.exe
  C:\Windows\System\JzmutbI.exe
  2⤵
  PID:4364
- C:\Windows\System\qzQZrPd.exe
  C:\Windows\System\qzQZrPd.exe
  2⤵
  PID:4380
- C:\Windows\System\ZUHMfVF.exe
  C:\Windows\System\ZUHMfVF.exe
  2⤵
  PID:4396
- C:\Windows\System\dPcqdMF.exe
  C:\Windows\System\dPcqdMF.exe
  2⤵
  PID:4412
- C:\Windows\System\fbPraLb.exe
  C:\Windows\System\fbPraLb.exe
  2⤵
  PID:4428
- C:\Windows\System\XluBamM.exe
  C:\Windows\System\XluBamM.exe
  2⤵
  PID:4444
- C:\Windows\System\RwFAaGd.exe
  C:\Windows\System\RwFAaGd.exe
  2⤵
  PID:4460
- C:\Windows\System\MbEMJfp.exe
  C:\Windows\System\MbEMJfp.exe
  2⤵
  PID:4476
- C:\Windows\System\yBCXRgP.exe
  C:\Windows\System\yBCXRgP.exe
  2⤵
  PID:4492
- C:\Windows\System\cmOWiTe.exe
  C:\Windows\System\cmOWiTe.exe
  2⤵
  PID:4508
- C:\Windows\System\YkuPzPc.exe
  C:\Windows\System\YkuPzPc.exe
  2⤵
  PID:4524
- C:\Windows\System\uQvdZAI.exe
  C:\Windows\System\uQvdZAI.exe
  2⤵
  PID:4540
- C:\Windows\System\JlHDRqL.exe
  C:\Windows\System\JlHDRqL.exe
  2⤵
  PID:4556
- C:\Windows\System\cMVHvVg.exe
  C:\Windows\System\cMVHvVg.exe
  2⤵
  PID:4572
- C:\Windows\System\qWXvfSq.exe
  C:\Windows\System\qWXvfSq.exe
  2⤵
  PID:4588
- C:\Windows\System\uLWvXoG.exe
  C:\Windows\System\uLWvXoG.exe
  2⤵
  PID:4604
- C:\Windows\System\JhyJGNv.exe
  C:\Windows\System\JhyJGNv.exe
  2⤵
  PID:4620
- C:\Windows\System\fXZrDfT.exe
  C:\Windows\System\fXZrDfT.exe
  2⤵
  PID:4636
- C:\Windows\System\UTGpzSW.exe
  C:\Windows\System\UTGpzSW.exe
  2⤵
  PID:4652
- C:\Windows\System\HbAdKLa.exe
  C:\Windows\System\HbAdKLa.exe
  2⤵
  PID:4668
- C:\Windows\System\BQHzlnD.exe
  C:\Windows\System\BQHzlnD.exe
  2⤵
  PID:4684
- C:\Windows\System\WBxEPmq.exe
  C:\Windows\System\WBxEPmq.exe
  2⤵
  PID:4700
- C:\Windows\System\nsGKuxb.exe
  C:\Windows\System\nsGKuxb.exe
  2⤵
  PID:4716
- C:\Windows\System\TLWZqDB.exe
  C:\Windows\System\TLWZqDB.exe
  2⤵
  PID:4732
- C:\Windows\System\KevKjGN.exe
  C:\Windows\System\KevKjGN.exe
  2⤵
  PID:4748
- C:\Windows\System\wekkyQg.exe
  C:\Windows\System\wekkyQg.exe
  2⤵
  PID:4764
- C:\Windows\System\gPopsAF.exe
  C:\Windows\System\gPopsAF.exe
  2⤵
  PID:4780
- C:\Windows\System\oBbhejN.exe
  C:\Windows\System\oBbhejN.exe
  2⤵
  PID:4796
- C:\Windows\System\fGaCYGh.exe
  C:\Windows\System\fGaCYGh.exe
  2⤵
  PID:4812
- C:\Windows\System\kNTqQYn.exe
  C:\Windows\System\kNTqQYn.exe
  2⤵
  PID:4828
- C:\Windows\System\UviOIqv.exe
  C:\Windows\System\UviOIqv.exe
  2⤵
  PID:4844
- C:\Windows\System\mNrrjdg.exe
  C:\Windows\System\mNrrjdg.exe
  2⤵
  PID:4860
- C:\Windows\System\MNJZyDm.exe
  C:\Windows\System\MNJZyDm.exe
  2⤵
  PID:4876
- C:\Windows\System\dzYzlvp.exe
  C:\Windows\System\dzYzlvp.exe
  2⤵
  PID:4904
- C:\Windows\System\wmTXTOg.exe
  C:\Windows\System\wmTXTOg.exe
  2⤵
  PID:4920
- C:\Windows\System\ockeryE.exe
  C:\Windows\System\ockeryE.exe
  2⤵
  PID:4936
- C:\Windows\System\yyPKeuZ.exe
  C:\Windows\System\yyPKeuZ.exe
  2⤵
  PID:4952
- C:\Windows\System\TlydRwY.exe
  C:\Windows\System\TlydRwY.exe
  2⤵
  PID:4968
- C:\Windows\System\IujLxHi.exe
  C:\Windows\System\IujLxHi.exe
  2⤵
  PID:4984
- C:\Windows\System\kkLUXuU.exe
  C:\Windows\System\kkLUXuU.exe
  2⤵
  PID:5000
- C:\Windows\System\xXcUToE.exe
  C:\Windows\System\xXcUToE.exe
  2⤵
  PID:5016
- C:\Windows\System\eTQpsFH.exe
  C:\Windows\System\eTQpsFH.exe
  2⤵
  PID:5032
- C:\Windows\System\LgwjWJi.exe
  C:\Windows\System\LgwjWJi.exe
  2⤵
  PID:5048
- C:\Windows\System\aPDBPCW.exe
  C:\Windows\System\aPDBPCW.exe
  2⤵
  PID:5064
- C:\Windows\System\YrKVpXO.exe
  C:\Windows\System\YrKVpXO.exe
  2⤵
  PID:5084
- C:\Windows\System\FUKNHGu.exe
  C:\Windows\System\FUKNHGu.exe
  2⤵
  PID:5100
- C:\Windows\System\nfPkVrw.exe
  C:\Windows\System\nfPkVrw.exe
  2⤵
  PID:5116
- C:\Windows\System\iunDVpk.exe
  C:\Windows\System\iunDVpk.exe
  2⤵
  PID:2432
- C:\Windows\System\HdmNGSp.exe
  C:\Windows\System\HdmNGSp.exe
  2⤵
  PID:4132
- C:\Windows\System\VkRocTJ.exe
  C:\Windows\System\VkRocTJ.exe
  2⤵
  PID:4168
- C:\Windows\System\jzmDnxL.exe
  C:\Windows\System\jzmDnxL.exe
  2⤵
  PID:3036
- C:\Windows\System\fzLWqDL.exe
  C:\Windows\System\fzLWqDL.exe
  2⤵
  PID:4408
- C:\Windows\System\myYtjQu.exe
  C:\Windows\System\myYtjQu.exe
  2⤵
  PID:4676
- C:\Windows\System\RRkwFOf.exe
  C:\Windows\System\RRkwFOf.exe
  2⤵
  PID:4644
- C:\Windows\System\xbBoHhW.exe
  C:\Windows\System\xbBoHhW.exe
  2⤵
  PID:4744
- C:\Windows\System\iCATLyl.exe
  C:\Windows\System\iCATLyl.exe
  2⤵
  PID:2400
- C:\Windows\System\CEhNjks.exe
  C:\Windows\System\CEhNjks.exe
  2⤵
  PID:4900
- C:\Windows\System\efEBZJt.exe
  C:\Windows\System\efEBZJt.exe
  2⤵
  PID:5060
- C:\Windows\System\VRwIpkf.exe
  C:\Windows\System\VRwIpkf.exe
  2⤵
  PID:4916
- C:\Windows\System\PprJjlO.exe
  C:\Windows\System\PprJjlO.exe
  2⤵
  PID:5044
- C:\Windows\System\lBwBjXA.exe
  C:\Windows\System\lBwBjXA.exe
  2⤵
  PID:4136
- C:\Windows\System\rKaiWBm.exe
  C:\Windows\System\rKaiWBm.exe
  2⤵
  PID:4116
- C:\Windows\System\MRGsJfS.exe
  C:\Windows\System\MRGsJfS.exe
  2⤵
  PID:4536
- C:\Windows\System\QHttfXl.exe
  C:\Windows\System\QHttfXl.exe
  2⤵
  PID:4628
- C:\Windows\System\qgHIaMD.exe
  C:\Windows\System\qgHIaMD.exe
  2⤵
  PID:4696
- C:\Windows\System\NzLCIRR.exe
  C:\Windows\System\NzLCIRR.exe
  2⤵
  PID:4756
- C:\Windows\System\MkyUrVb.exe
  C:\Windows\System\MkyUrVb.exe
  2⤵
  PID:4488
- C:\Windows\System\CkzDuGU.exe
  C:\Windows\System\CkzDuGU.exe
  2⤵
  PID:4788
- C:\Windows\System\XrUVHtw.exe
  C:\Windows\System\XrUVHtw.exe
  2⤵
  PID:4392
- C:\Windows\System\NXCldZp.exe
  C:\Windows\System\NXCldZp.exe
  2⤵
  PID:4824
- C:\Windows\System\HnlfQOa.exe
  C:\Windows\System\HnlfQOa.exe
  2⤵
  PID:4868
- C:\Windows\System\wSimdLG.exe
  C:\Windows\System\wSimdLG.exe
  2⤵
  PID:4932
- C:\Windows\System\vVqRSAV.exe
  C:\Windows\System\vVqRSAV.exe
  2⤵
  PID:4912
- C:\Windows\System\TCIsbUD.exe
  C:\Windows\System\TCIsbUD.exe
  2⤵
  PID:4980
- C:\Windows\System\RrEwURb.exe
  C:\Windows\System\RrEwURb.exe
  2⤵
  PID:3432
- C:\Windows\System\EJbbzVT.exe
  C:\Windows\System\EJbbzVT.exe
  2⤵
  PID:4076
- C:\Windows\System\mAfPjBW.exe
  C:\Windows\System\mAfPjBW.exe
  2⤵
  PID:5112
- C:\Windows\System\xhqRyOw.exe
  C:\Windows\System\xhqRyOw.exe
  2⤵
  PID:344
- C:\Windows\System\kJuirZw.exe
  C:\Windows\System\kJuirZw.exe
  2⤵
  PID:4156
- C:\Windows\System\IbACtZm.exe
  C:\Windows\System\IbACtZm.exe
  2⤵
  PID:4376
- C:\Windows\System\eMvTwWb.exe
  C:\Windows\System\eMvTwWb.exe
  2⤵
  PID:4468
- C:\Windows\System\hhSQIya.exe
  C:\Windows\System\hhSQIya.exe
  2⤵
  PID:4596
- C:\Windows\System\RWnaKsy.exe
  C:\Windows\System\RWnaKsy.exe
  2⤵
  PID:4664
- C:\Windows\System\BYPzxvm.exe
  C:\Windows\System\BYPzxvm.exe
  2⤵
  PID:4552
- C:\Windows\System\fzoFwZr.exe
  C:\Windows\System\fzoFwZr.exe
  2⤵
  PID:4424
- C:\Windows\System\Uctuiwv.exe
  C:\Windows\System\Uctuiwv.exe
  2⤵
  PID:4896
- C:\Windows\System\RlRNHJk.exe
  C:\Windows\System\RlRNHJk.exe
  2⤵
  PID:4616
- C:\Windows\System\vTUvrvf.exe
  C:\Windows\System\vTUvrvf.exe
  2⤵
  PID:4884
- C:\Windows\System\lOQTWgw.exe
  C:\Windows\System\lOQTWgw.exe
  2⤵
  PID:5056
- C:\Windows\System\ZbwwSBj.exe
  C:\Windows\System\ZbwwSBj.exe
  2⤵
  PID:4992
- C:\Windows\System\awbqkva.exe
  C:\Windows\System\awbqkva.exe
  2⤵
  PID:4212
- C:\Windows\System\ZPxpDzm.exe
  C:\Windows\System\ZPxpDzm.exe
  2⤵
  PID:4344
- C:\Windows\System\bYIXKHT.exe
  C:\Windows\System\bYIXKHT.exe
  2⤵
  PID:4520
- C:\Windows\System\YNmVCSG.exe
  C:\Windows\System\YNmVCSG.exe
  2⤵
  PID:4584
- C:\Windows\System\dyekfzP.exe
  C:\Windows\System\dyekfzP.exe
  2⤵
  PID:4960
- C:\Windows\System\xoayjel.exe
  C:\Windows\System\xoayjel.exe
  2⤵
  PID:4708
- C:\Windows\System\ocDXLFo.exe
  C:\Windows\System\ocDXLFo.exe
  2⤵
  PID:5096
- C:\Windows\System\NBiFEMh.exe
  C:\Windows\System\NBiFEMh.exe
  2⤵
  PID:4296
- C:\Windows\System\baMzjTF.exe
  C:\Windows\System\baMzjTF.exe
  2⤵
  PID:4600
- C:\Windows\System\tnqoRHE.exe
  C:\Windows\System\tnqoRHE.exe
  2⤵
  PID:4804
- C:\Windows\System\UhcnmjQ.exe
  C:\Windows\System\UhcnmjQ.exe
  2⤵
  PID:4944
- C:\Windows\System\LWyUrWy.exe
  C:\Windows\System\LWyUrWy.exe
  2⤵
  PID:2844
- C:\Windows\System\rOCMYKb.exe
  C:\Windows\System\rOCMYKb.exe
  2⤵
  PID:3740
- C:\Windows\System\Tswjkgc.exe
  C:\Windows\System\Tswjkgc.exe
  2⤵
  PID:4324
- C:\Windows\System\XlUQaqu.exe
  C:\Windows\System\XlUQaqu.exe
  2⤵
  PID:4240
- C:\Windows\System\ITDXdID.exe
  C:\Windows\System\ITDXdID.exe
  2⤵
  PID:5080
- C:\Windows\System\JVejyDL.exe
  C:\Windows\System\JVejyDL.exe
  2⤵
  PID:4440
- C:\Windows\System\wzcOVbQ.exe
  C:\Windows\System\wzcOVbQ.exe
  2⤵
  PID:5136
- C:\Windows\System\KnsVQwc.exe
  C:\Windows\System\KnsVQwc.exe
  2⤵
  PID:5152
- C:\Windows\System\mtlrGpV.exe
  C:\Windows\System\mtlrGpV.exe
  2⤵
  PID:5168
- C:\Windows\System\skffhek.exe
  C:\Windows\System\skffhek.exe
  2⤵
  PID:5188
- C:\Windows\System\uNFAfBU.exe
  C:\Windows\System\uNFAfBU.exe
  2⤵
  PID:5208
- C:\Windows\System\ffUwMlr.exe
  C:\Windows\System\ffUwMlr.exe
  2⤵
  PID:5224
- C:\Windows\System\szNfrww.exe
  C:\Windows\System\szNfrww.exe
  2⤵
  PID:5240
- C:\Windows\System\lLZRbcv.exe
  C:\Windows\System\lLZRbcv.exe
  2⤵
  PID:5256
- C:\Windows\System\yNRbyCo.exe
  C:\Windows\System\yNRbyCo.exe
  2⤵
  PID:5276
- C:\Windows\System\eDKntJP.exe
  C:\Windows\System\eDKntJP.exe
  2⤵
  PID:5292
- C:\Windows\System\dOgCrgB.exe
  C:\Windows\System\dOgCrgB.exe
  2⤵
  PID:5308
- C:\Windows\System\AdTtyUv.exe
  C:\Windows\System\AdTtyUv.exe
  2⤵
  PID:5324
- C:\Windows\System\yPhOdYi.exe
  C:\Windows\System\yPhOdYi.exe
  2⤵
  PID:5352
- C:\Windows\System\StVkEIH.exe
  C:\Windows\System\StVkEIH.exe
  2⤵
  PID:5380
- C:\Windows\System\mvxiMja.exe
  C:\Windows\System\mvxiMja.exe
  2⤵
  PID:5408
- C:\Windows\System\tAXJciR.exe
  C:\Windows\System\tAXJciR.exe
  2⤵
  PID:5428
- C:\Windows\System\zeiWMmC.exe
  C:\Windows\System\zeiWMmC.exe
  2⤵
  PID:5444
- C:\Windows\System\ZgADJVp.exe
  C:\Windows\System\ZgADJVp.exe
  2⤵
  PID:5460
- C:\Windows\System\HaMFMxc.exe
  C:\Windows\System\HaMFMxc.exe
  2⤵
  PID:5480
- C:\Windows\System\nffqION.exe
  C:\Windows\System\nffqION.exe
  2⤵
  PID:5500
- C:\Windows\System\VQtIDkU.exe
  C:\Windows\System\VQtIDkU.exe
  2⤵
  PID:5516
- C:\Windows\System\xvqNHyo.exe
  C:\Windows\System\xvqNHyo.exe
  2⤵
  PID:5584
- C:\Windows\System\lSMmsxJ.exe
  C:\Windows\System\lSMmsxJ.exe
  2⤵
  PID:5604
- C:\Windows\System\WFBRgMf.exe
  C:\Windows\System\WFBRgMf.exe
  2⤵
  PID:5624
- C:\Windows\System\tEAjmRU.exe
  C:\Windows\System\tEAjmRU.exe
  2⤵
  PID:5640
- C:\Windows\System\yUdpRNx.exe
  C:\Windows\System\yUdpRNx.exe
  2⤵
  PID:5660
- C:\Windows\System\vqjXiPt.exe
  C:\Windows\System\vqjXiPt.exe
  2⤵
  PID:5680
- C:\Windows\System\AdcuwTQ.exe
  C:\Windows\System\AdcuwTQ.exe
  2⤵
  PID:5696
- C:\Windows\System\XqtKDnW.exe
  C:\Windows\System\XqtKDnW.exe
  2⤵
  PID:5716
- C:\Windows\System\isJsbZP.exe
  C:\Windows\System\isJsbZP.exe
  2⤵
  PID:5736
- C:\Windows\System\MCRyjjR.exe
  C:\Windows\System\MCRyjjR.exe
  2⤵
  PID:5752
- C:\Windows\System\NSOkALx.exe
  C:\Windows\System\NSOkALx.exe
  2⤵
  PID:5768
- C:\Windows\System\MZhQBgm.exe
  C:\Windows\System\MZhQBgm.exe
  2⤵
  PID:5820
- C:\Windows\System\vsXRosM.exe
  C:\Windows\System\vsXRosM.exe
  2⤵
  PID:5840
- C:\Windows\System\GuYgWem.exe
  C:\Windows\System\GuYgWem.exe
  2⤵
  PID:5860
- C:\Windows\System\fWvRjQf.exe
  C:\Windows\System\fWvRjQf.exe
  2⤵
  PID:5876
- C:\Windows\System\REmiNxI.exe
  C:\Windows\System\REmiNxI.exe
  2⤵
  PID:5892
- C:\Windows\System\NKGKxRU.exe
  C:\Windows\System\NKGKxRU.exe
  2⤵
  PID:5908
- C:\Windows\System\VCGRkOZ.exe
  C:\Windows\System\VCGRkOZ.exe
  2⤵
  PID:5924
- C:\Windows\System\yKBJjFJ.exe
  C:\Windows\System\yKBJjFJ.exe
  2⤵
  PID:5940
- C:\Windows\System\dcFGvNQ.exe
  C:\Windows\System\dcFGvNQ.exe
  2⤵
  PID:5956
- C:\Windows\System\oWXKxbF.exe
  C:\Windows\System\oWXKxbF.exe
  2⤵
  PID:5972
- C:\Windows\System\RXJPnVG.exe
  C:\Windows\System\RXJPnVG.exe
  2⤵
  PID:5992
- C:\Windows\System\hxfEgHB.exe
  C:\Windows\System\hxfEgHB.exe
  2⤵
  PID:6008
- C:\Windows\System\WUHuamv.exe
  C:\Windows\System\WUHuamv.exe
  2⤵
  PID:6024
- C:\Windows\System\BFwsZgv.exe
  C:\Windows\System\BFwsZgv.exe
  2⤵
  PID:6044
- C:\Windows\System\EXbSZXL.exe
  C:\Windows\System\EXbSZXL.exe
  2⤵
  PID:6068
- C:\Windows\System\gSDGCBq.exe
  C:\Windows\System\gSDGCBq.exe
  2⤵
  PID:6084
- C:\Windows\System\koxiwNQ.exe
  C:\Windows\System\koxiwNQ.exe
  2⤵
  PID:6100
- C:\Windows\System\LQniOXQ.exe
  C:\Windows\System\LQniOXQ.exe
  2⤵
  PID:6116
- C:\Windows\System\wimeNQn.exe
  C:\Windows\System\wimeNQn.exe
  2⤵
  PID:6132
- C:\Windows\System\qMxWWqo.exe
  C:\Windows\System\qMxWWqo.exe
  2⤵
  PID:5076
- C:\Windows\System\EDOLiTJ.exe
  C:\Windows\System\EDOLiTJ.exe
  2⤵
  PID:2576
- C:\Windows\System\trLkHPj.exe
  C:\Windows\System\trLkHPj.exe
  2⤵
  PID:4452
- C:\Windows\System\amakqah.exe
  C:\Windows\System\amakqah.exe
  2⤵
  PID:4852
- C:\Windows\System\FneBSwZ.exe
  C:\Windows\System\FneBSwZ.exe
  2⤵
  PID:2144
- C:\Windows\System\xpafstd.exe
  C:\Windows\System\xpafstd.exe
  2⤵
  PID:5268
- C:\Windows\System\xBWWHnS.exe
  C:\Windows\System\xBWWHnS.exe
  2⤵
  PID:5364
- C:\Windows\System\ToLJSoL.exe
  C:\Windows\System\ToLJSoL.exe
  2⤵
  PID:5392
- C:\Windows\System\lmhByGt.exe
  C:\Windows\System\lmhByGt.exe
  2⤵
  PID:5568
- C:\Windows\System\iwlwnlj.exe
  C:\Windows\System\iwlwnlj.exe
  2⤵
  PID:5596
- C:\Windows\System\qWeJNyc.exe
  C:\Windows\System\qWeJNyc.exe
  2⤵
  PID:5672
- C:\Windows\System\zGqRdLj.exe
  C:\Windows\System\zGqRdLj.exe
  2⤵
  PID:5712
- C:\Windows\System\TDRilQW.exe
  C:\Windows\System\TDRilQW.exe
  2⤵
  PID:6016
- C:\Windows\System\bTfobKO.exe
  C:\Windows\System\bTfobKO.exe
  2⤵
  PID:5264
- C:\Windows\System\zobcFQm.exe
  C:\Windows\System\zobcFQm.exe
  2⤵
  PID:5616
- C:\Windows\System\DMBPjKf.exe
  C:\Windows\System\DMBPjKf.exe
  2⤵
  PID:5652
- C:\Windows\System\mxOeNrx.exe
  C:\Windows\System\mxOeNrx.exe
  2⤵
  PID:5724
- C:\Windows\System\gFEktpT.exe
  C:\Windows\System\gFEktpT.exe
  2⤵
  PID:5828
- C:\Windows\System\pFQmlUS.exe
  C:\Windows\System\pFQmlUS.exe
  2⤵
  PID:5180
- C:\Windows\System\tWEChHk.exe
  C:\Windows\System\tWEChHk.exe
  2⤵
  PID:5900
- C:\Windows\System\mrJJpPF.exe
  C:\Windows\System\mrJJpPF.exe
  2⤵
  PID:5964
- C:\Windows\System\LDSUiLq.exe
  C:\Windows\System\LDSUiLq.exe
  2⤵
  PID:6036
- C:\Windows\System\BtVeRuS.exe
  C:\Windows\System\BtVeRuS.exe
  2⤵
  PID:4580
- C:\Windows\System\dUwpToa.exe
  C:\Windows\System\dUwpToa.exe
  2⤵
  PID:2292
- C:\Windows\System\QHkedYE.exe
  C:\Windows\System\QHkedYE.exe
  2⤵
  PID:5252
- C:\Windows\System\FYKXtpO.exe
  C:\Windows\System\FYKXtpO.exe
  2⤵
  PID:5320
- C:\Windows\System\iKQTkyy.exe
  C:\Windows\System\iKQTkyy.exe
  2⤵
  PID:5376
- C:\Windows\System\YjRrsmJ.exe
  C:\Windows\System\YjRrsmJ.exe
  2⤵
  PID:5388
- C:\Windows\System\hgDgNkq.exe
  C:\Windows\System\hgDgNkq.exe
  2⤵
  PID:6096
- C:\Windows\System\EzjCRIu.exe
  C:\Windows\System\EzjCRIu.exe
  2⤵
  PID:5360
- C:\Windows\System\pYtYiLx.exe
  C:\Windows\System\pYtYiLx.exe
  2⤵
  PID:4680
- C:\Windows\System\LECrxgw.exe
  C:\Windows\System\LECrxgw.exe
  2⤵
  PID:6108
- C:\Windows\System\HBcEiVw.exe
  C:\Windows\System\HBcEiVw.exe
  2⤵
  PID:5440
- C:\Windows\System\iSpwwFQ.exe
  C:\Windows\System\iSpwwFQ.exe
  2⤵
  PID:4372
- C:\Windows\System\daonbUR.exe
  C:\Windows\System\daonbUR.exe
  2⤵
  PID:5476
- C:\Windows\System\fYgvolx.exe
  C:\Windows\System\fYgvolx.exe
  2⤵
  PID:5488
- C:\Windows\System\AWNofea.exe
  C:\Windows\System\AWNofea.exe
  2⤵
  PID:5592
- C:\Windows\System\lgwYeix.exe
  C:\Windows\System\lgwYeix.exe
  2⤵
  PID:5540
- C:\Windows\System\xbfmZwI.exe
  C:\Windows\System\xbfmZwI.exe
  2⤵
  PID:5528
- C:\Windows\System\YjIDoJH.exe
  C:\Windows\System\YjIDoJH.exe
  2⤵
  PID:5580
- C:\Windows\System\uiJJFyb.exe
  C:\Windows\System\uiJJFyb.exe
  2⤵
  PID:5636
- C:\Windows\System\BnoVquU.exe
  C:\Windows\System\BnoVquU.exe
  2⤵
  PID:5792
- C:\Windows\System\ynHrgEa.exe
  C:\Windows\System\ynHrgEa.exe
  2⤵
  PID:5804
- C:\Windows\System\eAJwbXI.exe
  C:\Windows\System\eAJwbXI.exe
  2⤵
  PID:5848
- C:\Windows\System\ULeZRvO.exe
  C:\Windows\System\ULeZRvO.exe
  2⤵
  PID:5856
- C:\Windows\System\CkeWfni.exe
  C:\Windows\System\CkeWfni.exe
  2⤵
  PID:5920
- C:\Windows\System\UJccyxN.exe
  C:\Windows\System\UJccyxN.exe
  2⤵
  PID:5748
- C:\Windows\System\nhqGsVQ.exe
  C:\Windows\System\nhqGsVQ.exe
  2⤵
  PID:5612
- C:\Windows\System\UaYkjBj.exe
  C:\Windows\System\UaYkjBj.exe
  2⤵
  PID:4120
- C:\Windows\System\VWdNjBE.exe
  C:\Windows\System\VWdNjBE.exe
  2⤵
  PID:5332
- C:\Windows\System\SwTdypF.exe
  C:\Windows\System\SwTdypF.exe
  2⤵
  PID:5368
- C:\Windows\System\zCRawbV.exe
  C:\Windows\System\zCRawbV.exe
  2⤵
  PID:5436
- C:\Windows\System\rnnSBtr.exe
  C:\Windows\System\rnnSBtr.exe
  2⤵
  PID:5512
- C:\Windows\System\zvCBJcG.exe
  C:\Windows\System\zvCBJcG.exe
  2⤵
  PID:5788
- C:\Windows\System\hjigYva.exe
  C:\Windows\System\hjigYva.exe
  2⤵
  PID:5888
- C:\Windows\System\nExpqpE.exe
  C:\Windows\System\nExpqpE.exe
  2⤵
  PID:5564
- C:\Windows\System\qMffcpS.exe
  C:\Windows\System\qMffcpS.exe
  2⤵
  PID:5952
- C:\Windows\System\WnvkfNm.exe
  C:\Windows\System\WnvkfNm.exe
  2⤵
  PID:5980
- C:\Windows\System\OcaZvcv.exe
  C:\Windows\System\OcaZvcv.exe
  2⤵
  PID:4856
- C:\Windows\System\lSUbQef.exe
  C:\Windows\System\lSUbQef.exe
  2⤵
  PID:5300
- C:\Windows\System\ChAQVCE.exe
  C:\Windows\System\ChAQVCE.exe
  2⤵
  PID:5316
- C:\Windows\System\AQjvZcm.exe
  C:\Windows\System\AQjvZcm.exe
  2⤵
  PID:5204
- C:\Windows\System\uUjgrej.exe
  C:\Windows\System\uUjgrej.exe
  2⤵
  PID:5108
- C:\Windows\System\AsfZfpz.exe
  C:\Windows\System\AsfZfpz.exe
  2⤵
  PID:5524
- C:\Windows\System\qVDZtaW.exe
  C:\Windows\System\qVDZtaW.exe
  2⤵
  PID:5932
- C:\Windows\System\vAeLKgz.exe
  C:\Windows\System\vAeLKgz.exe
  2⤵
  PID:5272
- C:\Windows\System\MlTiXOi.exe
  C:\Windows\System\MlTiXOi.exe
  2⤵
  PID:5576
- C:\Windows\System\pBdrgZK.exe
  C:\Windows\System\pBdrgZK.exe
  2⤵
  PID:5692
- C:\Windows\System\fqwqGQn.exe
  C:\Windows\System\fqwqGQn.exe
  2⤵
  PID:6032
- C:\Windows\System\GWJuVMC.exe
  C:\Windows\System\GWJuVMC.exe
  2⤵
  PID:5124
- C:\Windows\System\WKkPeSy.exe
  C:\Windows\System\WKkPeSy.exe
  2⤵
  PID:5496
- C:\Windows\System\CTFEXZr.exe
  C:\Windows\System\CTFEXZr.exe
  2⤵
  PID:5708
- C:\Windows\System\QZNKgHc.exe
  C:\Windows\System\QZNKgHc.exe
  2⤵
  PID:5988
- C:\Windows\System\QyOYnxB.exe
  C:\Windows\System\QyOYnxB.exe
  2⤵
  PID:5764
- C:\Windows\System\DLnWLTk.exe
  C:\Windows\System\DLnWLTk.exe
  2⤵
  PID:5148
- C:\Windows\System\sEOXZwn.exe
  C:\Windows\System\sEOXZwn.exe
  2⤵
  PID:5340
- C:\Windows\System\ESxGNww.exe
  C:\Windows\System\ESxGNww.exe
  2⤵
  PID:5176
- C:\Windows\System\nlupZGo.exe
  C:\Windows\System\nlupZGo.exe
  2⤵
  PID:5984
- C:\Windows\System\LKXdIvO.exe
  C:\Windows\System\LKXdIvO.exe
  2⤵
  PID:5344
- C:\Windows\System\PnuOyDk.exe
  C:\Windows\System\PnuOyDk.exe
  2⤵
  PID:6140
- C:\Windows\System\ChsiZoH.exe
  C:\Windows\System\ChsiZoH.exe
  2⤵
  PID:6160
- C:\Windows\System\vqnSGkJ.exe
  C:\Windows\System\vqnSGkJ.exe
  2⤵
  PID:6176
- C:\Windows\System\JWLhGZV.exe
  C:\Windows\System\JWLhGZV.exe
  2⤵
  PID:6192
- C:\Windows\System\nvaxKGw.exe
  C:\Windows\System\nvaxKGw.exe
  2⤵
  PID:6208
- C:\Windows\System\aVxzIwG.exe
  C:\Windows\System\aVxzIwG.exe
  2⤵
  PID:6224
- C:\Windows\System\NAyFCsM.exe
  C:\Windows\System\NAyFCsM.exe
  2⤵
  PID:6244
- C:\Windows\System\oQRLGKY.exe
  C:\Windows\System\oQRLGKY.exe
  2⤵
  PID:6260
- C:\Windows\System\EvVThgt.exe
  C:\Windows\System\EvVThgt.exe
  2⤵
  PID:6276
- C:\Windows\System\LbDHndG.exe
  C:\Windows\System\LbDHndG.exe
  2⤵
  PID:6296
- C:\Windows\System\wLEqLRJ.exe
  C:\Windows\System\wLEqLRJ.exe
  2⤵
  PID:6312
- C:\Windows\System\xeGWxln.exe
  C:\Windows\System\xeGWxln.exe
  2⤵
  PID:6332
- C:\Windows\System\nuLsHlT.exe
  C:\Windows\System\nuLsHlT.exe
  2⤵
  PID:6352
- C:\Windows\System\oqoBjhm.exe
  C:\Windows\System\oqoBjhm.exe
  2⤵
  PID:6368
- C:\Windows\System\PyDHpzi.exe
  C:\Windows\System\PyDHpzi.exe
  2⤵
  PID:6384
- C:\Windows\System\wZbSUQc.exe
  C:\Windows\System\wZbSUQc.exe
  2⤵
  PID:6400
- C:\Windows\System\iaxcHPY.exe
  C:\Windows\System\iaxcHPY.exe
  2⤵
  PID:6416
- C:\Windows\System\aGrLNKU.exe
  C:\Windows\System\aGrLNKU.exe
  2⤵
  PID:6432
- C:\Windows\System\qZhnToQ.exe
  C:\Windows\System\qZhnToQ.exe
  2⤵
  PID:6448
- C:\Windows\System\TXwBPkW.exe
  C:\Windows\System\TXwBPkW.exe
  2⤵
  PID:6464
- C:\Windows\System\XRToYvW.exe
  C:\Windows\System\XRToYvW.exe
  2⤵
  PID:6480
- C:\Windows\System\NZimAcE.exe
  C:\Windows\System\NZimAcE.exe
  2⤵
  PID:6496
- C:\Windows\System\HrbtqsX.exe
  C:\Windows\System\HrbtqsX.exe
  2⤵
  PID:6516
- C:\Windows\System\oDeqfPC.exe
  C:\Windows\System\oDeqfPC.exe
  2⤵
  PID:6532
- C:\Windows\System\hgmJkhY.exe
  C:\Windows\System\hgmJkhY.exe
  2⤵
  PID:6548
- C:\Windows\System\CbdMdVy.exe
  C:\Windows\System\CbdMdVy.exe
  2⤵
  PID:6564
- C:\Windows\System\bhIhffx.exe
  C:\Windows\System\bhIhffx.exe
  2⤵
  PID:6580
- C:\Windows\System\gpnTMTZ.exe
  C:\Windows\System\gpnTMTZ.exe
  2⤵
  PID:6600
- C:\Windows\System\BNbHnVv.exe
  C:\Windows\System\BNbHnVv.exe
  2⤵
  PID:6620
- C:\Windows\System\cNWxwKB.exe
  C:\Windows\System\cNWxwKB.exe
  2⤵
  PID:6648
- C:\Windows\System\uOObwIb.exe
  C:\Windows\System\uOObwIb.exe
  2⤵
  PID:6668
- C:\Windows\System\wsKqdmg.exe
  C:\Windows\System\wsKqdmg.exe
  2⤵
  PID:6684
- C:\Windows\System\XtdxrnA.exe
  C:\Windows\System\XtdxrnA.exe
  2⤵
  PID:6700
- C:\Windows\System\XmCfWfG.exe
  C:\Windows\System\XmCfWfG.exe
  2⤵
  PID:6720
- C:\Windows\System\uCNWmvH.exe
  C:\Windows\System\uCNWmvH.exe
  2⤵
  PID:6736
- C:\Windows\System\IoXEfzD.exe
  C:\Windows\System\IoXEfzD.exe
  2⤵
  PID:6752
- C:\Windows\System\CxSXwpF.exe
  C:\Windows\System\CxSXwpF.exe
  2⤵
  PID:6768
- C:\Windows\System\nttxlYf.exe
  C:\Windows\System\nttxlYf.exe
  2⤵
  PID:6784
- C:\Windows\System\CylcaEl.exe
  C:\Windows\System\CylcaEl.exe
  2⤵
  PID:6800
- C:\Windows\System\ZNxEoyh.exe
  C:\Windows\System\ZNxEoyh.exe
  2⤵
  PID:6816
- C:\Windows\System\IxjWzod.exe
  C:\Windows\System\IxjWzod.exe
  2⤵
  PID:6832
- C:\Windows\System\mbRikJZ.exe
  C:\Windows\System\mbRikJZ.exe
  2⤵
  PID:6860
- C:\Windows\System\pSzMJuc.exe
  C:\Windows\System\pSzMJuc.exe
  2⤵
  PID:6876
- C:\Windows\System\CJfKhqM.exe
  C:\Windows\System\CJfKhqM.exe
  2⤵
  PID:6892
- C:\Windows\System\TFgQHbl.exe
  C:\Windows\System\TFgQHbl.exe
  2⤵
  PID:6908
- C:\Windows\System\zptQqXw.exe
  C:\Windows\System\zptQqXw.exe
  2⤵
  PID:6928
- C:\Windows\System\evZnNDZ.exe
  C:\Windows\System\evZnNDZ.exe
  2⤵
  PID:6948
- C:\Windows\System\OCbDyhN.exe
  C:\Windows\System\OCbDyhN.exe
  2⤵
  PID:6964
- C:\Windows\System\jjUSVFC.exe
  C:\Windows\System\jjUSVFC.exe
  2⤵
  PID:6980
- C:\Windows\System\jCHnXHI.exe
  C:\Windows\System\jCHnXHI.exe
  2⤵
  PID:7000
- C:\Windows\System\JKPwkLs.exe
  C:\Windows\System\JKPwkLs.exe
  2⤵
  PID:7016
- C:\Windows\System\dfxEjnm.exe
  C:\Windows\System\dfxEjnm.exe
  2⤵
  PID:7036
- C:\Windows\System\OsnSteP.exe
  C:\Windows\System\OsnSteP.exe
  2⤵
  PID:7060
- C:\Windows\System\oVDRbTI.exe
  C:\Windows\System\oVDRbTI.exe
  2⤵
  PID:7080
- C:\Windows\System\JWjxbks.exe
  C:\Windows\System\JWjxbks.exe
  2⤵
  PID:7096
- C:\Windows\System\qYXCCUC.exe
  C:\Windows\System\qYXCCUC.exe
  2⤵
  PID:7112
- C:\Windows\System\NfclWhV.exe
  C:\Windows\System\NfclWhV.exe
  2⤵
  PID:7128
- C:\Windows\System\UnFHGhc.exe
  C:\Windows\System\UnFHGhc.exe
  2⤵
  PID:7144
- C:\Windows\System\GJtlgQJ.exe
  C:\Windows\System\GJtlgQJ.exe
  2⤵
  PID:7160
- C:\Windows\System\mqOgdxf.exe
  C:\Windows\System\mqOgdxf.exe
  2⤵
  PID:6168
- C:\Windows\System\mtKupmR.exe
  C:\Windows\System\mtKupmR.exe
  2⤵
  PID:6232
- C:\Windows\System\GTdxKPY.exe
  C:\Windows\System\GTdxKPY.exe
  2⤵
  PID:6272
- C:\Windows\System\hjWzCbX.exe
  C:\Windows\System\hjWzCbX.exe
  2⤵
  PID:6344
- C:\Windows\System\nlbUxmY.exe
  C:\Windows\System\nlbUxmY.exe
  2⤵
  PID:6408
- C:\Windows\System\frrjmHn.exe
  C:\Windows\System\frrjmHn.exe
  2⤵
  PID:6504
- C:\Windows\System\fxkRYKh.exe
  C:\Windows\System\fxkRYKh.exe
  2⤵
  PID:6544
- C:\Windows\System\hMHKgWq.exe
  C:\Windows\System\hMHKgWq.exe
  2⤵
  PID:6616
- C:\Windows\System\mesYOLl.exe
  C:\Windows\System\mesYOLl.exe
  2⤵
  PID:6696
- C:\Windows\System\zcrwozA.exe
  C:\Windows\System\zcrwozA.exe
  2⤵
  PID:7008
- C:\Windows\System\HAbrNtq.exe
  C:\Windows\System\HAbrNtq.exe
  2⤵
  PID:6936
- C:\Windows\System\mAJGJXf.exe
  C:\Windows\System\mAJGJXf.exe
  2⤵
  PID:7056
- C:\Windows\System\ONZbNVR.exe
  C:\Windows\System\ONZbNVR.exe
  2⤵
  PID:5648
- C:\Windows\System\GPrfAjb.exe
  C:\Windows\System\GPrfAjb.exe
  2⤵
  PID:6188
- C:\Windows\System\fvdtEkp.exe
  C:\Windows\System\fvdtEkp.exe
  2⤵
  PID:6256
- C:\Windows\System\PbTXqga.exe
  C:\Windows\System\PbTXqga.exe
  2⤵
  PID:6320
- C:\Windows\System\pBOdMGY.exe
  C:\Windows\System\pBOdMGY.exe
  2⤵
  PID:6364
- C:\Windows\System\grNGRSD.exe
  C:\Windows\System\grNGRSD.exe
  2⤵
  PID:6428
- C:\Windows\System\rxOUncg.exe
  C:\Windows\System\rxOUncg.exe
  2⤵
  PID:6492
- C:\Windows\System\UVFIRMv.exe
  C:\Windows\System\UVFIRMv.exe
  2⤵
  PID:6560
- C:\Windows\System\fcFfwMJ.exe
  C:\Windows\System\fcFfwMJ.exe
  2⤵
  PID:6628
- C:\Windows\System\ViwSiAq.exe
  C:\Windows\System\ViwSiAq.exe
  2⤵
  PID:6676
- C:\Windows\System\tekxbXE.exe
  C:\Windows\System\tekxbXE.exe
  2⤵
  PID:6744
- C:\Windows\System\WuPrUzi.exe
  C:\Windows\System\WuPrUzi.exe
  2⤵
  PID:6844
- C:\Windows\System\nAXTuZd.exe
  C:\Windows\System\nAXTuZd.exe
  2⤵
  PID:6884
- C:\Windows\System\RWsFXCQ.exe
  C:\Windows\System\RWsFXCQ.exe
  2⤵
  PID:6924
- C:\Windows\System\DhvWDYM.exe
  C:\Windows\System\DhvWDYM.exe
  2⤵
  PID:6992
- C:\Windows\System\nUkqxjB.exe
  C:\Windows\System\nUkqxjB.exe
  2⤵
  PID:7032
- C:\Windows\System\evVMKxC.exe
  C:\Windows\System\evVMKxC.exe
  2⤵
  PID:7076
- C:\Windows\System\mHhNGZD.exe
  C:\Windows\System\mHhNGZD.exe
  2⤵
  PID:7124
- C:\Windows\System\DOELYGq.exe
  C:\Windows\System\DOELYGq.exe
  2⤵
  PID:5424
- C:\Windows\System\VkdUCQd.exe
  C:\Windows\System\VkdUCQd.exe
  2⤵
  PID:6204
- C:\Windows\System\cqdCTPZ.exe
  C:\Windows\System\cqdCTPZ.exe
  2⤵
  PID:6476
- C:\Windows\System\vCvpnLm.exe
  C:\Windows\System\vCvpnLm.exe
  2⤵
  PID:6268
- C:\Windows\System\ucajEZX.exe
  C:\Windows\System\ucajEZX.exe
  2⤵
  PID:6576
- C:\Windows\System\LUoFhhh.exe
  C:\Windows\System\LUoFhhh.exe
  2⤵
  PID:6380
- C:\Windows\System\EUNfqqq.exe
  C:\Windows\System\EUNfqqq.exe
  2⤵
  PID:6828
- C:\Windows\System\vytHpRe.exe
  C:\Windows\System\vytHpRe.exe
  2⤵
  PID:6900
- C:\Windows\System\LxcrpuX.exe
  C:\Windows\System\LxcrpuX.exe
  2⤵
  PID:6776
- C:\Windows\System\qXiKrhh.exe
  C:\Windows\System\qXiKrhh.exe
  2⤵
  PID:7088
- C:\Windows\System\koiXQZl.exe
  C:\Windows\System\koiXQZl.exe
  2⤵
  PID:6220
- C:\Windows\System\ivVcnsa.exe
  C:\Windows\System\ivVcnsa.exe
  2⤵
  PID:6644
- C:\Windows\System\ogduziu.exe
  C:\Windows\System\ogduziu.exe
  2⤵
  PID:6916
- C:\Windows\System\vjLHvtg.exe
  C:\Windows\System\vjLHvtg.exe
  2⤵
  PID:7108
- C:\Windows\System\NUWDdtj.exe
  C:\Windows\System\NUWDdtj.exe
  2⤵
  PID:7140
- C:\Windows\System\kYxhtXk.exe
  C:\Windows\System\kYxhtXk.exe
  2⤵
  PID:5336
- C:\Windows\System\GQPmMiz.exe
  C:\Windows\System\GQPmMiz.exe
  2⤵
  PID:7012
- C:\Windows\System\obvPxDt.exe
  C:\Windows\System\obvPxDt.exe
  2⤵
  PID:6692
- C:\Windows\System\rGqQfpt.exe
  C:\Windows\System\rGqQfpt.exe
  2⤵
  PID:6868
- C:\Windows\System\ueiFNku.exe
  C:\Windows\System\ueiFNku.exe
  2⤵
  PID:6972
- C:\Windows\System\QumXVeM.exe
  C:\Windows\System\QumXVeM.exe
  2⤵
  PID:6156
- C:\Windows\System\hNFYRoh.exe
  C:\Windows\System\hNFYRoh.exe
  2⤵
  PID:6556
- C:\Windows\System\NFbVTDp.exe
  C:\Windows\System\NFbVTDp.exe
  2⤵
  PID:6460
- C:\Windows\System\ePuGeon.exe
  C:\Windows\System\ePuGeon.exe
  2⤵
  PID:6940
- C:\Windows\System\pxWOIKi.exe
  C:\Windows\System\pxWOIKi.exe
  2⤵
  PID:6840
- C:\Windows\System\fJpsLtr.exe
  C:\Windows\System\fJpsLtr.exe
  2⤵
  PID:6780
- C:\Windows\System\MzJGKEz.exe
  C:\Windows\System\MzJGKEz.exe
  2⤵
  PID:5852
- C:\Windows\System\ECIxOPJ.exe
  C:\Windows\System\ECIxOPJ.exe
  2⤵
  PID:7120
- C:\Windows\System\JuHxyhP.exe
  C:\Windows\System\JuHxyhP.exe
  2⤵
  PID:6872
- C:\Windows\System\tNQQACq.exe
  C:\Windows\System\tNQQACq.exe
  2⤵
  PID:6636
- C:\Windows\System\ukGLAJX.exe
  C:\Windows\System\ukGLAJX.exe
  2⤵
  PID:6808
- C:\Windows\System\TcnBTAW.exe
  C:\Windows\System\TcnBTAW.exe
  2⤵
  PID:6856
- C:\Windows\System\WgfIUkQ.exe
  C:\Windows\System\WgfIUkQ.exe
  2⤵
  PID:6960
- C:\Windows\System\wEMJQPQ.exe
  C:\Windows\System\wEMJQPQ.exe
  2⤵
  PID:6444
- C:\Windows\System\aQYVuog.exe
  C:\Windows\System\aQYVuog.exe
  2⤵
  PID:6732
- C:\Windows\System\OlAMYsH.exe
  C:\Windows\System\OlAMYsH.exe
  2⤵
  PID:6760
- C:\Windows\System\GMmaNdf.exe
  C:\Windows\System\GMmaNdf.exe
  2⤵
  PID:6148
- C:\Windows\System\NUaZrSr.exe
  C:\Windows\System\NUaZrSr.exe
  2⤵
  PID:7184
- C:\Windows\System\rVklPHa.exe
  C:\Windows\System\rVklPHa.exe
  2⤵
  PID:7200
- C:\Windows\System\DtJCQlt.exe
  C:\Windows\System\DtJCQlt.exe
  2⤵
  PID:7216
- C:\Windows\System\yzyhuCI.exe
  C:\Windows\System\yzyhuCI.exe
  2⤵
  PID:7236
- C:\Windows\System\vzEYkHl.exe
  C:\Windows\System\vzEYkHl.exe
  2⤵
  PID:7252
- C:\Windows\System\RVhvPeC.exe
  C:\Windows\System\RVhvPeC.exe
  2⤵
  PID:7268
- C:\Windows\System\csOfxpO.exe
  C:\Windows\System\csOfxpO.exe
  2⤵
  PID:7284
- C:\Windows\System\GIEZYVw.exe
  C:\Windows\System\GIEZYVw.exe
  2⤵
  PID:7300
- C:\Windows\System\HbObkqn.exe
  C:\Windows\System\HbObkqn.exe
  2⤵
  PID:7316
- C:\Windows\System\EjxFRvA.exe
  C:\Windows\System\EjxFRvA.exe
  2⤵
  PID:7332
- C:\Windows\System\RVZFptz.exe
  C:\Windows\System\RVZFptz.exe
  2⤵
  PID:7348
- C:\Windows\System\EeCySLs.exe
  C:\Windows\System\EeCySLs.exe
  2⤵
  PID:7364
- C:\Windows\System\ykaybDR.exe
  C:\Windows\System\ykaybDR.exe
  2⤵
  PID:7380
- C:\Windows\System\rskBkbJ.exe
  C:\Windows\System\rskBkbJ.exe
  2⤵
  PID:7396
- C:\Windows\System\eQMbjxX.exe
  C:\Windows\System\eQMbjxX.exe
  2⤵
  PID:7412
- C:\Windows\System\hhIpAPx.exe
  C:\Windows\System\hhIpAPx.exe
  2⤵
  PID:7432
- C:\Windows\System\CzLBNlN.exe
  C:\Windows\System\CzLBNlN.exe
  2⤵
  PID:7448
- C:\Windows\System\iHQpdMZ.exe
  C:\Windows\System\iHQpdMZ.exe
  2⤵
  PID:7468
- C:\Windows\System\EDAmIZa.exe
  C:\Windows\System\EDAmIZa.exe
  2⤵
  PID:7484
- C:\Windows\System\PplMYui.exe
  C:\Windows\System\PplMYui.exe
  2⤵
  PID:7500
- C:\Windows\System\CXROmtD.exe
  C:\Windows\System\CXROmtD.exe
  2⤵
  PID:7516
- C:\Windows\System\MAhpyME.exe
  C:\Windows\System\MAhpyME.exe
  2⤵
  PID:7532
- C:\Windows\System\YJnSGqm.exe
  C:\Windows\System\YJnSGqm.exe
  2⤵
  PID:7580
- C:\Windows\System\zLZUfIP.exe
  C:\Windows\System\zLZUfIP.exe
  2⤵
  PID:7596
- C:\Windows\System\sBzrIWY.exe
  C:\Windows\System\sBzrIWY.exe
  2⤵
  PID:7612
- C:\Windows\System\wdURHdZ.exe
  C:\Windows\System\wdURHdZ.exe
  2⤵
  PID:7632
- C:\Windows\System\WuYkpIZ.exe
  C:\Windows\System\WuYkpIZ.exe
  2⤵
  PID:7648
- C:\Windows\System\qxdmkry.exe
  C:\Windows\System\qxdmkry.exe
  2⤵
  PID:7664
- C:\Windows\System\GVSpiIv.exe
  C:\Windows\System\GVSpiIv.exe
  2⤵
  PID:7688
- C:\Windows\System\Bejtbxq.exe
  C:\Windows\System\Bejtbxq.exe
  2⤵
  PID:7704
- C:\Windows\System\SmnneKK.exe
  C:\Windows\System\SmnneKK.exe
  2⤵
  PID:7720
- C:\Windows\System\dIDOGjr.exe
  C:\Windows\System\dIDOGjr.exe
  2⤵
  PID:7740
- C:\Windows\System\BQpbuEX.exe
  C:\Windows\System\BQpbuEX.exe
  2⤵
  PID:7756
- C:\Windows\System\QMURdBz.exe
  C:\Windows\System\QMURdBz.exe
  2⤵
  PID:7772
- C:\Windows\System\ekVPHJQ.exe
  C:\Windows\System\ekVPHJQ.exe
  2⤵
  PID:7792
- C:\Windows\System\BPvfXmU.exe
  C:\Windows\System\BPvfXmU.exe
  2⤵
  PID:7808
- C:\Windows\System\NozbqFp.exe
  C:\Windows\System\NozbqFp.exe
  2⤵
  PID:7824
- C:\Windows\System\iSouUVA.exe
  C:\Windows\System\iSouUVA.exe
  2⤵
  PID:7840
- C:\Windows\System\xtwtREH.exe
  C:\Windows\System\xtwtREH.exe
  2⤵
  PID:7856
- C:\Windows\System\vBhFvIn.exe
  C:\Windows\System\vBhFvIn.exe
  2⤵
  PID:7872
- C:\Windows\System\yYLagDA.exe
  C:\Windows\System\yYLagDA.exe
  2⤵
  PID:7888
- C:\Windows\System\xwXAliE.exe
  C:\Windows\System\xwXAliE.exe
  2⤵
  PID:7904
- C:\Windows\System\oELCgcy.exe
  C:\Windows\System\oELCgcy.exe
  2⤵
  PID:7920
- C:\Windows\System\JdTRbwP.exe
  C:\Windows\System\JdTRbwP.exe
  2⤵
  PID:7940
- C:\Windows\System\CIpfmLw.exe
  C:\Windows\System\CIpfmLw.exe
  2⤵
  PID:7956
- C:\Windows\System\ZKcpUYr.exe
  C:\Windows\System\ZKcpUYr.exe
  2⤵
  PID:7972
- C:\Windows\System\smfDrzt.exe
  C:\Windows\System\smfDrzt.exe
  2⤵
  PID:7988
- C:\Windows\System\AgVPhgK.exe
  C:\Windows\System\AgVPhgK.exe
  2⤵
  PID:8004
- C:\Windows\System\OCnpAWB.exe
  C:\Windows\System\OCnpAWB.exe
  2⤵
  PID:8020
- C:\Windows\System\TZIgpbp.exe
  C:\Windows\System\TZIgpbp.exe
  2⤵
  PID:8044
- C:\Windows\System\UYAfYWb.exe
  C:\Windows\System\UYAfYWb.exe
  2⤵
  PID:8060
- C:\Windows\System\GMogCdi.exe
  C:\Windows\System\GMogCdi.exe
  2⤵
  PID:8076
- C:\Windows\System\IVbqwDN.exe
  C:\Windows\System\IVbqwDN.exe
  2⤵
  PID:8096
- C:\Windows\System\gvMYNXE.exe
  C:\Windows\System\gvMYNXE.exe
  2⤵
  PID:8116
- C:\Windows\System\UHbdvqc.exe
  C:\Windows\System\UHbdvqc.exe
  2⤵
  PID:8132
- C:\Windows\System\SkjofqZ.exe
  C:\Windows\System\SkjofqZ.exe
  2⤵
  PID:8148
- C:\Windows\System\nkTIokt.exe
  C:\Windows\System\nkTIokt.exe
  2⤵
  PID:8164
- C:\Windows\System\CwbysOf.exe
  C:\Windows\System\CwbysOf.exe
  2⤵
  PID:8184
- C:\Windows\System\xiSKNXu.exe
  C:\Windows\System\xiSKNXu.exe
  2⤵
  PID:5884
- C:\Windows\System\yYsadkh.exe
  C:\Windows\System\yYsadkh.exe
  2⤵
  PID:7176
- C:\Windows\System\xZvrRVq.exe
  C:\Windows\System\xZvrRVq.exe
  2⤵
  PID:7244
- C:\Windows\System\wmdGMEd.exe
  C:\Windows\System\wmdGMEd.exe
  2⤵
  PID:7308
- C:\Windows\System\YIEbzct.exe
  C:\Windows\System\YIEbzct.exe
  2⤵
  PID:7372
- C:\Windows\System\aLDZqid.exe
  C:\Windows\System\aLDZqid.exe
  2⤵
  PID:7444
- C:\Windows\System\LkwDLJP.exe
  C:\Windows\System\LkwDLJP.exe
  2⤵
  PID:6988
- C:\Windows\System\GmVVanZ.exe
  C:\Windows\System\GmVVanZ.exe
  2⤵
  PID:6152
- C:\Windows\System\azIvHjG.exe
  C:\Windows\System\azIvHjG.exe
  2⤵
  PID:6292
- C:\Windows\System\fYrZJuk.exe
  C:\Windows\System\fYrZJuk.exe
  2⤵
  PID:7192
- C:\Windows\System\ovRNVLL.exe
  C:\Windows\System\ovRNVLL.exe
  2⤵
  PID:7232
- C:\Windows\System\pjrviWD.exe
  C:\Windows\System\pjrviWD.exe
  2⤵
  PID:7292
- C:\Windows\System\YzkihUn.exe
  C:\Windows\System\YzkihUn.exe
  2⤵
  PID:7392
- C:\Windows\System\SRrmYnE.exe
  C:\Windows\System\SRrmYnE.exe
  2⤵
  PID:7456
- C:\Windows\System\vBmQvrH.exe
  C:\Windows\System\vBmQvrH.exe
  2⤵
  PID:7508
- C:\Windows\System\ZJqULwu.exe
  C:\Windows\System\ZJqULwu.exe
  2⤵
  PID:7548
- C:\Windows\System\TPkxbab.exe
  C:\Windows\System\TPkxbab.exe
  2⤵
  PID:7480
- C:\Windows\System\zUJHjAA.exe
  C:\Windows\System\zUJHjAA.exe
  2⤵
  PID:7608
- C:\Windows\System\kHJAJAo.exe
  C:\Windows\System\kHJAJAo.exe
  2⤵
  PID:7564
- C:\Windows\System\ShGwnFX.exe
  C:\Windows\System\ShGwnFX.exe
  2⤵
  PID:7716
- C:\Windows\System\KcqdVwA.exe
  C:\Windows\System\KcqdVwA.exe
  2⤵
  PID:7788
- C:\Windows\System\cxmxPRc.exe
  C:\Windows\System\cxmxPRc.exe
  2⤵
  PID:7852
- C:\Windows\System\OEeuAYQ.exe
  C:\Windows\System\OEeuAYQ.exe
  2⤵
  PID:7916
- C:\Windows\System\IwsCcmE.exe
  C:\Windows\System\IwsCcmE.exe
  2⤵
  PID:8012
- C:\Windows\System\eZdhzkx.exe
  C:\Windows\System\eZdhzkx.exe
  2⤵
  PID:8084
- C:\Windows\System\OPsThKH.exe
  C:\Windows\System\OPsThKH.exe
  2⤵
  PID:8128
- C:\Windows\System\hCbHaae.exe
  C:\Windows\System\hCbHaae.exe
  2⤵
  PID:7732
- C:\Windows\System\DfSbQXP.exe
  C:\Windows\System\DfSbQXP.exe
  2⤵
  PID:7136
- C:\Windows\System\gsCwsTW.exe
  C:\Windows\System\gsCwsTW.exe
  2⤵
  PID:7340
- C:\Windows\System\IdAsEqM.exe
  C:\Windows\System\IdAsEqM.exe
  2⤵
  PID:6716
- C:\Windows\System\HxyBenL.exe
  C:\Windows\System\HxyBenL.exe
  2⤵
  PID:7736
- C:\Windows\System\ZkZTKlb.exe
  C:\Windows\System\ZkZTKlb.exe
  2⤵
  PID:7868
- C:\Windows\System\urYAGuy.exe
  C:\Windows\System\urYAGuy.exe
  2⤵
  PID:7900
- C:\Windows\System\ijBizqD.exe
  C:\Windows\System\ijBizqD.exe
  2⤵
  PID:7228
- C:\Windows\System\XqIAAEw.exe
  C:\Windows\System\XqIAAEw.exe
  2⤵
  PID:7620
- C:\Windows\System\UtPpqIL.exe
  C:\Windows\System\UtPpqIL.exe
  2⤵
  PID:7700
- C:\Windows\System\atNmYzz.exe
  C:\Windows\System\atNmYzz.exe
  2⤵
  PID:7832
- C:\Windows\System\rBdExrK.exe
  C:\Windows\System\rBdExrK.exe
  2⤵
  PID:7464
- C:\Windows\System\ewAxKQV.exe
  C:\Windows\System\ewAxKQV.exe
  2⤵
  PID:7996
- C:\Windows\System\reHFuny.exe
  C:\Windows\System\reHFuny.exe
  2⤵
  PID:8040
- C:\Windows\System\evCRIpv.exe
  C:\Windows\System\evCRIpv.exe
  2⤵
  PID:7556
- C:\Windows\System\wgijCbS.exe
  C:\Windows\System\wgijCbS.exe
  2⤵
  PID:8108
- C:\Windows\System\EHAeqll.exe
  C:\Windows\System\EHAeqll.exe
  2⤵
  PID:8144
- C:\Windows\System\tIoJHpw.exe
  C:\Windows\System\tIoJHpw.exe
  2⤵
  PID:7280
- C:\Windows\System\pBRCIii.exe
  C:\Windows\System\pBRCIii.exe
  2⤵
  PID:8056
- C:\Windows\System\yHKTYcv.exe
  C:\Windows\System\yHKTYcv.exe
  2⤵
  PID:7440
- C:\Windows\System\OcOFNKQ.exe
  C:\Windows\System\OcOFNKQ.exe
  2⤵
  PID:7212
- C:\Windows\System\RuormHr.exe
  C:\Windows\System\RuormHr.exe
  2⤵
  PID:7660
- C:\Windows\System\Mpqtupi.exe
  C:\Windows\System\Mpqtupi.exe
  2⤵
  PID:7540
- C:\Windows\System\tIhFajD.exe
  C:\Windows\System\tIhFajD.exe
  2⤵
  PID:7820
- C:\Windows\System\oPTpmWB.exe
  C:\Windows\System\oPTpmWB.exe
  2⤵
  PID:7864
- C:\Windows\System\xFFXpta.exe
  C:\Windows\System\xFFXpta.exe
  2⤵
  PID:7544
- C:\Windows\System\DiXgJvc.exe
  C:\Windows\System\DiXgJvc.exe
  2⤵
  PID:7588
- C:\Windows\System\UocSXqn.exe
  C:\Windows\System\UocSXqn.exe
  2⤵
  PID:7496
- C:\Windows\System\RjsyHqK.exe
  C:\Windows\System\RjsyHqK.exe
  2⤵
  PID:7964
- C:\Windows\System\NzKexPq.exe
  C:\Windows\System\NzKexPq.exe
  2⤵
  PID:7936
- C:\Windows\System\mjLzobd.exe
  C:\Windows\System\mjLzobd.exe
  2⤵
  PID:7784
- C:\Windows\System\wWQjHtm.exe
  C:\Windows\System\wWQjHtm.exe
  2⤵
  PID:8052
- C:\Windows\System\lWiyjPq.exe
  C:\Windows\System\lWiyjPq.exe
  2⤵
  PID:6944
- C:\Windows\System\pZuvUPy.exe
  C:\Windows\System\pZuvUPy.exe
  2⤵
  PID:7896
- C:\Windows\System\BYoIzeH.exe
  C:\Windows\System\BYoIzeH.exe
  2⤵
  PID:8000
- C:\Windows\System\OroJmqG.exe
  C:\Windows\System\OroJmqG.exe
  2⤵
  PID:8104
- C:\Windows\System\DtFjpsx.exe
  C:\Windows\System\DtFjpsx.exe
  2⤵
  PID:7408
- C:\Windows\System\BiDDtlm.exe
  C:\Windows\System\BiDDtlm.exe
  2⤵
  PID:7656
- C:\Windows\System\naXGQAU.exe
  C:\Windows\System\naXGQAU.exe
  2⤵
  PID:7388
- C:\Windows\System\DovPRFm.exe
  C:\Windows\System\DovPRFm.exe
  2⤵
  PID:7428
- C:\Windows\System\qEfzjNW.exe
  C:\Windows\System\qEfzjNW.exe
  2⤵
  PID:7848
- C:\Windows\System\MnMwctm.exe
  C:\Windows\System\MnMwctm.exe
  2⤵
  PID:7912
- C:\Windows\System\QTgxRys.exe
  C:\Windows\System\QTgxRys.exe
  2⤵
  PID:8036
- C:\Windows\System\OzByIPp.exe
  C:\Windows\System\OzByIPp.exe
  2⤵
  PID:6764
- C:\Windows\System\qwBNfps.exe
  C:\Windows\System\qwBNfps.exe
  2⤵
  PID:7644
- C:\Windows\System\dVfeAfI.exe
  C:\Windows\System\dVfeAfI.exe
  2⤵
  PID:7980
- C:\Windows\System\dDLewFF.exe
  C:\Windows\System\dDLewFF.exe
  2⤵
  PID:8204
- C:\Windows\System\pFDkWMk.exe
  C:\Windows\System\pFDkWMk.exe
  2⤵
  PID:8220
- C:\Windows\System\dZTXArr.exe
  C:\Windows\System\dZTXArr.exe
  2⤵
  PID:8236
- C:\Windows\System\zJtmabF.exe
  C:\Windows\System\zJtmabF.exe
  2⤵
  PID:8252
- C:\Windows\System\cNQCZfa.exe
  C:\Windows\System\cNQCZfa.exe
  2⤵
  PID:8268
- C:\Windows\System\pDeYGFA.exe
  C:\Windows\System\pDeYGFA.exe
  2⤵
  PID:8284
- C:\Windows\System\groOtRU.exe
  C:\Windows\System\groOtRU.exe
  2⤵
  PID:8300
- C:\Windows\System\vVIqTYn.exe
  C:\Windows\System\vVIqTYn.exe
  2⤵
  PID:8316
- C:\Windows\System\knvLvGI.exe
  C:\Windows\System\knvLvGI.exe
  2⤵
  PID:8332
- C:\Windows\System\UJnRfFx.exe
  C:\Windows\System\UJnRfFx.exe
  2⤵
  PID:8348
- C:\Windows\System\mGqzVMp.exe
  C:\Windows\System\mGqzVMp.exe
  2⤵
  PID:8364
- C:\Windows\System\rpOQBRS.exe
  C:\Windows\System\rpOQBRS.exe
  2⤵
  PID:8380
- C:\Windows\System\QETeWUx.exe
  C:\Windows\System\QETeWUx.exe
  2⤵
  PID:8396
- C:\Windows\System\xEeKYTG.exe
  C:\Windows\System\xEeKYTG.exe
  2⤵
  PID:8412
- C:\Windows\System\bMpTjAz.exe
  C:\Windows\System\bMpTjAz.exe
  2⤵
  PID:8428
- C:\Windows\System\WCMdtfN.exe
  C:\Windows\System\WCMdtfN.exe
  2⤵
  PID:8444
- C:\Windows\System\wwWNnPL.exe
  C:\Windows\System\wwWNnPL.exe
  2⤵
  PID:8460
- C:\Windows\System\vQNeynG.exe
  C:\Windows\System\vQNeynG.exe
  2⤵
  PID:8476
- C:\Windows\System\keOKvmk.exe
  C:\Windows\System\keOKvmk.exe
  2⤵
  PID:8492
- C:\Windows\System\XFtCXrX.exe
  C:\Windows\System\XFtCXrX.exe
  2⤵
  PID:8508
- C:\Windows\System\uyLtWZR.exe
  C:\Windows\System\uyLtWZR.exe
  2⤵
  PID:8524
- C:\Windows\System\gkzmroA.exe
  C:\Windows\System\gkzmroA.exe
  2⤵
  PID:8540
- C:\Windows\System\LkvmQij.exe
  C:\Windows\System\LkvmQij.exe
  2⤵
  PID:8560
- C:\Windows\System\StqzSlz.exe
  C:\Windows\System\StqzSlz.exe
  2⤵
  PID:8576
- C:\Windows\System\RdFvUne.exe
  C:\Windows\System\RdFvUne.exe
  2⤵
  PID:8592
- C:\Windows\System\VIwWxqx.exe
  C:\Windows\System\VIwWxqx.exe
  2⤵
  PID:8612
- C:\Windows\System\EpGBDmU.exe
  C:\Windows\System\EpGBDmU.exe
  2⤵
  PID:8628
- C:\Windows\System\EfJsEwt.exe
  C:\Windows\System\EfJsEwt.exe
  2⤵
  PID:8644
- C:\Windows\System\MnpxbhR.exe
  C:\Windows\System\MnpxbhR.exe
  2⤵
  PID:8660
- C:\Windows\System\dUAMzXf.exe
  C:\Windows\System\dUAMzXf.exe
  2⤵
  PID:8676
- C:\Windows\System\oLCPClx.exe
  C:\Windows\System\oLCPClx.exe
  2⤵
  PID:8692
- C:\Windows\System\iNUYQgg.exe
  C:\Windows\System\iNUYQgg.exe
  2⤵
  PID:8708
- C:\Windows\System\QYPZqrK.exe
  C:\Windows\System\QYPZqrK.exe
  2⤵
  PID:8728
- C:\Windows\System\uYryrqd.exe
  C:\Windows\System\uYryrqd.exe
  2⤵
  PID:8744
- C:\Windows\System\zbnMIMi.exe
  C:\Windows\System\zbnMIMi.exe
  2⤵
  PID:8760
- C:\Windows\System\CdGJebc.exe
  C:\Windows\System\CdGJebc.exe
  2⤵
  PID:8780
- C:\Windows\System\ypRoyUc.exe
  C:\Windows\System\ypRoyUc.exe
  2⤵
  PID:8796
- C:\Windows\System\JhjPycK.exe
  C:\Windows\System\JhjPycK.exe
  2⤵
  PID:8812
- C:\Windows\System\APsJFPJ.exe
  C:\Windows\System\APsJFPJ.exe
  2⤵
  PID:8828
- C:\Windows\System\wISwIHx.exe
  C:\Windows\System\wISwIHx.exe
  2⤵
  PID:8844
- C:\Windows\System\zkuSIlp.exe
  C:\Windows\System\zkuSIlp.exe
  2⤵
  PID:8860
- C:\Windows\System\yvrwQrA.exe
  C:\Windows\System\yvrwQrA.exe
  2⤵
  PID:8876
- C:\Windows\System\NTSKasB.exe
  C:\Windows\System\NTSKasB.exe
  2⤵
  PID:8892
- C:\Windows\System\nHcIxwB.exe
  C:\Windows\System\nHcIxwB.exe
  2⤵
  PID:8908
- C:\Windows\System\fRxuyYf.exe
  C:\Windows\System\fRxuyYf.exe
  2⤵
  PID:8928
- C:\Windows\System\UAbmTHe.exe
  C:\Windows\System\UAbmTHe.exe
  2⤵
  PID:8944
- C:\Windows\System\hiUgyaf.exe
  C:\Windows\System\hiUgyaf.exe
  2⤵
  PID:8960
- C:\Windows\System\PxFuOyL.exe
  C:\Windows\System\PxFuOyL.exe
  2⤵
  PID:8976
- C:\Windows\System\AvPVVgP.exe
  C:\Windows\System\AvPVVgP.exe
  2⤵
  PID:8996
- C:\Windows\System\nfjevXS.exe
  C:\Windows\System\nfjevXS.exe
  2⤵
  PID:9016
- C:\Windows\System\KNVATnd.exe
  C:\Windows\System\KNVATnd.exe
  2⤵
  PID:9032
- C:\Windows\System\IjWlSMQ.exe
  C:\Windows\System\IjWlSMQ.exe
  2⤵
  PID:9048
- C:\Windows\System\snNonCr.exe
  C:\Windows\System\snNonCr.exe
  2⤵
  PID:9064
- C:\Windows\System\ufdVGRF.exe
  C:\Windows\System\ufdVGRF.exe
  2⤵
  PID:9080
- C:\Windows\System\kydvlpd.exe
  C:\Windows\System\kydvlpd.exe
  2⤵
  PID:9096
- C:\Windows\System\EtFPYkY.exe
  C:\Windows\System\EtFPYkY.exe
  2⤵
  PID:9112
- C:\Windows\System\gOYoyZg.exe
  C:\Windows\System\gOYoyZg.exe
  2⤵
  PID:9132
- C:\Windows\System\KehhyIQ.exe
  C:\Windows\System\KehhyIQ.exe
  2⤵
  PID:9148
- C:\Windows\System\qzwJbpR.exe
  C:\Windows\System\qzwJbpR.exe
  2⤵
  PID:9164
- C:\Windows\System\ZzmCBXl.exe
  C:\Windows\System\ZzmCBXl.exe
  2⤵
  PID:9180
- C:\Windows\System\pQiIUEg.exe
  C:\Windows\System\pQiIUEg.exe
  2⤵
  PID:9196
- C:\Windows\System\ugAJYSI.exe
  C:\Windows\System\ugAJYSI.exe
  2⤵
  PID:8196
- C:\Windows\System\HewkXry.exe
  C:\Windows\System\HewkXry.exe
  2⤵
  PID:7712
- C:\Windows\System\coWmvuh.exe
  C:\Windows\System\coWmvuh.exe
  2⤵
  PID:8308
- C:\Windows\System\oQibPNf.exe
  C:\Windows\System\oQibPNf.exe
  2⤵
  PID:8388
- C:\Windows\System\pkmwkjh.exe
  C:\Windows\System\pkmwkjh.exe
  2⤵
  PID:8424
- C:\Windows\System\GDukBti.exe
  C:\Windows\System\GDukBti.exe
  2⤵
  PID:8280
- C:\Windows\System\PNlxthU.exe
  C:\Windows\System\PNlxthU.exe
  2⤵
  PID:8488
- C:\Windows\System\rOrZFxN.exe
  C:\Windows\System\rOrZFxN.exe
  2⤵
  PID:8468
- C:\Windows\System\EaVBlDC.exe
  C:\Windows\System\EaVBlDC.exe
  2⤵
  PID:8436
- C:\Windows\System\yDhLjIN.exe
  C:\Windows\System\yDhLjIN.exe
  2⤵
  PID:8504
- C:\Windows\System\HCfuQci.exe
  C:\Windows\System\HCfuQci.exe
  2⤵
  PID:8500
- C:\Windows\System\eYznRiB.exe
  C:\Windows\System\eYznRiB.exe
  2⤵
  PID:8620
- C:\Windows\System\LxULEEy.exe
  C:\Windows\System\LxULEEy.exe
  2⤵
  PID:8656
- C:\Windows\System\nvjdyQw.exe
  C:\Windows\System\nvjdyQw.exe
  2⤵
  PID:8720
- C:\Windows\System\WlscAyy.exe
  C:\Windows\System\WlscAyy.exe
  2⤵
  PID:8788
- C:\Windows\System\AeDsrWP.exe
  C:\Windows\System\AeDsrWP.exe
  2⤵
  PID:8700
- C:\Windows\System\HLeaPry.exe
  C:\Windows\System\HLeaPry.exe
  2⤵
  PID:8704
- C:\Windows\System\OryYJlr.exe
  C:\Windows\System\OryYJlr.exe
  2⤵
  PID:8668
- C:\Windows\System\wIBKPMZ.exe
  C:\Windows\System\wIBKPMZ.exe
  2⤵
  PID:8956
- C:\Windows\System\twIAVtk.exe
  C:\Windows\System\twIAVtk.exe
  2⤵
  PID:8804
- C:\Windows\System\ZhldXFU.exe
  C:\Windows\System\ZhldXFU.exe
  2⤵
  PID:8872
- C:\Windows\System\HniLiBF.exe
  C:\Windows\System\HniLiBF.exe
  2⤵
  PID:8772
- C:\Windows\System\RmmYJFk.exe
  C:\Windows\System\RmmYJFk.exe
  2⤵
  PID:8900
- C:\Windows\System\uDubMFl.exe
  C:\Windows\System\uDubMFl.exe
  2⤵
  PID:8968
- C:\Windows\System\DtTWwNT.exe
  C:\Windows\System\DtTWwNT.exe
  2⤵
  PID:9024
- C:\Windows\System\VLOYGVc.exe
  C:\Windows\System\VLOYGVc.exe
  2⤵
  PID:9088
- C:\Windows\System\TKrOMzC.exe
  C:\Windows\System\TKrOMzC.exe
  2⤵
  PID:9012
- C:\Windows\System\ooqksLM.exe
  C:\Windows\System\ooqksLM.exe
  2⤵
  PID:9128
- C:\Windows\System\AMRdHfz.exe
  C:\Windows\System\AMRdHfz.exe
  2⤵
  PID:9144
- C:\Windows\System\UNZsgDq.exe
  C:\Windows\System\UNZsgDq.exe
  2⤵
  PID:9212
- C:\Windows\System\GZPEKlc.exe
  C:\Windows\System\GZPEKlc.exe
  2⤵
  PID:8228
- C:\Windows\System\ckJcQjv.exe
  C:\Windows\System\ckJcQjv.exe
  2⤵
  PID:9204
- C:\Windows\System\aTfLlXc.exe
  C:\Windows\System\aTfLlXc.exe
  2⤵
  PID:8292
- C:\Windows\System\PBTmtHV.exe
  C:\Windows\System\PBTmtHV.exe
  2⤵
  PID:8324
- C:\Windows\System\ImREgxw.exe
  C:\Windows\System\ImREgxw.exe
  2⤵
  PID:9160
- C:\Windows\System\fxdgBVf.exe
  C:\Windows\System\fxdgBVf.exe
  2⤵
  PID:9192
- C:\Windows\System\ATrzNFQ.exe
  C:\Windows\System\ATrzNFQ.exe
  2⤵
  PID:8548
- C:\Windows\System\eteIoCK.exe
  C:\Windows\System\eteIoCK.exe
  2⤵
  PID:8376
- C:\Windows\System\dhcEled.exe
  C:\Windows\System\dhcEled.exe
  2⤵
  PID:8820
- C:\Windows\System\OIvGLMs.exe
  C:\Windows\System\OIvGLMs.exe
  2⤵
  PID:8484
- C:\Windows\System\khxQmOL.exe
  C:\Windows\System\khxQmOL.exe
  2⤵
  PID:8988
- C:\Windows\System\rpUBcsH.exe
  C:\Windows\System\rpUBcsH.exe
  2⤵
  PID:8456
- C:\Windows\System\SEFHUCG.exe
  C:\Windows\System\SEFHUCG.exe
  2⤵
  PID:8652
- C:\Windows\System\nbWhpwT.exe
  C:\Windows\System\nbWhpwT.exe
  2⤵
  PID:8608
- C:\Windows\System\NdvIiEl.exe
  C:\Windows\System\NdvIiEl.exe
  2⤵
  PID:8636
- C:\Windows\System\WwxFRNQ.exe
  C:\Windows\System\WwxFRNQ.exe
  2⤵
  PID:8940
- C:\Windows\System\rwCiRLR.exe
  C:\Windows\System\rwCiRLR.exe
  2⤵
  PID:9008
- C:\Windows\System\BnygLOU.exe
  C:\Windows\System\BnygLOU.exe
  2⤵
  PID:9072
- C:\Windows\System\LisZETU.exe
  C:\Windows\System\LisZETU.exe
  2⤵
  PID:9140
- C:\Windows\System\zxiZpzm.exe
  C:\Windows\System\zxiZpzm.exe
  2⤵
  PID:8452
- C:\Windows\System\gwIQJUG.exe
  C:\Windows\System\gwIQJUG.exe
  2⤵
  PID:8032
- C:\Windows\System\RLjgwgW.exe
  C:\Windows\System\RLjgwgW.exe
  2⤵
  PID:8072
- C:\Windows\System\crYBMmY.exe
  C:\Windows\System\crYBMmY.exe
  2⤵
  PID:9156
- C:\Windows\System\awtghqH.exe
  C:\Windows\System\awtghqH.exe
  2⤵
  PID:8604
- C:\Windows\System\hURwDiX.exe
  C:\Windows\System\hURwDiX.exe
  2⤵
  PID:8920
- C:\Windows\System\VyAHGoE.exe
  C:\Windows\System\VyAHGoE.exe
  2⤵
  PID:8756
- C:\Windows\System\hkvCzAX.exe
  C:\Windows\System\hkvCzAX.exe
  2⤵
  PID:8868
- C:\Windows\System\LOgmEjW.exe
  C:\Windows\System\LOgmEjW.exe
  2⤵
  PID:9060
- C:\Windows\System\bovtpKk.exe
  C:\Windows\System\bovtpKk.exe
  2⤵
  PID:9104
- C:\Windows\System\tYBgwBg.exe
  C:\Windows\System\tYBgwBg.exe
  2⤵
  PID:8740
- C:\Windows\System\DcBLuQK.exe
  C:\Windows\System\DcBLuQK.exe
  2⤵
  PID:8952
- C:\Windows\System\unmdhYD.exe
  C:\Windows\System\unmdhYD.exe
  2⤵
  PID:9220
- C:\Windows\System\EuXMJPg.exe
  C:\Windows\System\EuXMJPg.exe
  2⤵
  PID:9236
- C:\Windows\System\XpKXxbZ.exe
  C:\Windows\System\XpKXxbZ.exe
  2⤵
  PID:9252
- C:\Windows\System\NaMSqNC.exe
  C:\Windows\System\NaMSqNC.exe
  2⤵
  PID:9268
- C:\Windows\System\FbeeWeM.exe
  C:\Windows\System\FbeeWeM.exe
  2⤵
  PID:9284
- C:\Windows\System\iJZDPkR.exe
  C:\Windows\System\iJZDPkR.exe
  2⤵
  PID:9300
- C:\Windows\System\uSPafIv.exe
  C:\Windows\System\uSPafIv.exe
  2⤵
  PID:9316
- C:\Windows\System\jjbBRLu.exe
  C:\Windows\System\jjbBRLu.exe
  2⤵
  PID:9332
- C:\Windows\System\KHxnnTA.exe
  C:\Windows\System\KHxnnTA.exe
  2⤵
  PID:9348
- C:\Windows\System\EpXhcBT.exe
  C:\Windows\System\EpXhcBT.exe
  2⤵
  PID:9364
- C:\Windows\System\jOJtpzt.exe
  C:\Windows\System\jOJtpzt.exe
  2⤵
  PID:9380
- C:\Windows\System\WuFsCna.exe
  C:\Windows\System\WuFsCna.exe
  2⤵
  PID:9396
- C:\Windows\System\bvRpIcP.exe
  C:\Windows\System\bvRpIcP.exe
  2⤵
  PID:9412
- C:\Windows\System\YICRTCU.exe
  C:\Windows\System\YICRTCU.exe
  2⤵
  PID:9428
- C:\Windows\System\OGEdYkA.exe
  C:\Windows\System\OGEdYkA.exe
  2⤵
  PID:9448
- C:\Windows\System\fxHVLAT.exe
  C:\Windows\System\fxHVLAT.exe
  2⤵
  PID:9468
- C:\Windows\System\gQotGTy.exe
  C:\Windows\System\gQotGTy.exe
  2⤵
  PID:9484
- C:\Windows\System\GwRnpLK.exe
  C:\Windows\System\GwRnpLK.exe
  2⤵
  PID:9500
- C:\Windows\System\hbVqMsO.exe
  C:\Windows\System\hbVqMsO.exe
  2⤵
  PID:9516
- C:\Windows\System\IvCwbqe.exe
  C:\Windows\System\IvCwbqe.exe
  2⤵
  PID:9532
- C:\Windows\System\DFmaAHr.exe
  C:\Windows\System\DFmaAHr.exe
  2⤵
  PID:9548
- C:\Windows\System\hwOprEv.exe
  C:\Windows\System\hwOprEv.exe
  2⤵
  PID:9564
- C:\Windows\System\GVrtNiH.exe
  C:\Windows\System\GVrtNiH.exe
  2⤵
  PID:9580
- C:\Windows\System\dgQEnZI.exe
  C:\Windows\System\dgQEnZI.exe
  2⤵
  PID:9692
- C:\Windows\System\ttOyDUA.exe
  C:\Windows\System\ttOyDUA.exe
  2⤵
  PID:9712
- C:\Windows\System\hfzLakp.exe
  C:\Windows\System\hfzLakp.exe
  2⤵
  PID:9728
- C:\Windows\System\MXhdCVO.exe
  C:\Windows\System\MXhdCVO.exe
  2⤵
  PID:9748
- C:\Windows\System\jffkfNs.exe
  C:\Windows\System\jffkfNs.exe
  2⤵
  PID:9780
- C:\Windows\System\Vctertp.exe
  C:\Windows\System\Vctertp.exe
  2⤵
  PID:9804
- C:\Windows\System\QAmvLgD.exe
  C:\Windows\System\QAmvLgD.exe
  2⤵
  PID:9820
- C:\Windows\System\XkUziqA.exe
  C:\Windows\System\XkUziqA.exe
  2⤵
  PID:9836
- C:\Windows\System\KXJFpxa.exe
  C:\Windows\System\KXJFpxa.exe
  2⤵
  PID:9852
- C:\Windows\System\kCttzgn.exe
  C:\Windows\System\kCttzgn.exe
  2⤵
  PID:9872
- C:\Windows\System\ahDcIHn.exe
  C:\Windows\System\ahDcIHn.exe
  2⤵
  PID:9888
- C:\Windows\System\ygebqba.exe
  C:\Windows\System\ygebqba.exe
  2⤵
  PID:9908
- C:\Windows\System\fEHbCFH.exe
  C:\Windows\System\fEHbCFH.exe
  2⤵
  PID:9932
- C:\Windows\System\AuCAEjx.exe
  C:\Windows\System\AuCAEjx.exe
  2⤵
  PID:9948
- C:\Windows\System\CPKHRwP.exe
  C:\Windows\System\CPKHRwP.exe
  2⤵
  PID:9964
- C:\Windows\System\dcEciyn.exe
  C:\Windows\System\dcEciyn.exe
  2⤵
  PID:9980
- C:\Windows\System\lBCXSSf.exe
  C:\Windows\System\lBCXSSf.exe
  2⤵
  PID:9996
- C:\Windows\System\gjVltfV.exe
  C:\Windows\System\gjVltfV.exe
  2⤵
  PID:10012
- C:\Windows\System\xcQsUee.exe
  C:\Windows\System\xcQsUee.exe
  2⤵
  PID:10028
- C:\Windows\System\PNYrNpE.exe
  C:\Windows\System\PNYrNpE.exe
  2⤵
  PID:10048
- C:\Windows\System\KSLwkQX.exe
  C:\Windows\System\KSLwkQX.exe
  2⤵
  PID:10064
- C:\Windows\System\dGzUUPe.exe
  C:\Windows\System\dGzUUPe.exe
  2⤵
  PID:10080
- C:\Windows\System\IgZIqoR.exe
  C:\Windows\System\IgZIqoR.exe
  2⤵
  PID:10104
- C:\Windows\System\VIPnPOD.exe
  C:\Windows\System\VIPnPOD.exe
  2⤵
  PID:10120
- C:\Windows\System\OeBsQLr.exe
  C:\Windows\System\OeBsQLr.exe
  2⤵
  PID:10176
- C:\Windows\System\TmhxdhC.exe
  C:\Windows\System\TmhxdhC.exe
  2⤵
  PID:10196
- C:\Windows\System\McbANfV.exe
  C:\Windows\System\McbANfV.exe
  2⤵
  PID:10212
- C:\Windows\System\VMNynFd.exe
  C:\Windows\System\VMNynFd.exe
  2⤵
  PID:10228
- C:\Windows\System\OxheXKo.exe
  C:\Windows\System\OxheXKo.exe
  2⤵
  PID:8472
- C:\Windows\System\jvPuXWg.exe
  C:\Windows\System\jvPuXWg.exe
  2⤵
  PID:8232
- C:\Windows\System\RdkVqyc.exe
  C:\Windows\System\RdkVqyc.exe
  2⤵
  PID:9308
- C:\Windows\System\yNUCFqN.exe
  C:\Windows\System\yNUCFqN.exe
  2⤵
  PID:8588
- C:\Windows\System\nCxIYum.exe
  C:\Windows\System\nCxIYum.exe
  2⤵
  PID:9340
- C:\Windows\System\uZCSBQU.exe
  C:\Windows\System\uZCSBQU.exe
  2⤵
  PID:9228
- C:\Windows\System\sAPGhxn.exe
  C:\Windows\System\sAPGhxn.exe
  2⤵
  PID:8568
- C:\Windows\System\TfdnmzN.exe
  C:\Windows\System\TfdnmzN.exe
  2⤵
  PID:9232
- C:\Windows\System\oGeJfRs.exe
  C:\Windows\System\oGeJfRs.exe
  2⤵
  PID:9360
- C:\Windows\System\QhVuLJs.exe
  C:\Windows\System\QhVuLJs.exe
  2⤵
  PID:9424
- C:\Windows\System\VBZgXyT.exe
  C:\Windows\System\VBZgXyT.exe
  2⤵
  PID:9444
- C:\Windows\System\CuXWxrS.exe
  C:\Windows\System\CuXWxrS.exe
  2⤵
  PID:9456
- C:\Windows\System\txdphIu.exe
  C:\Windows\System\txdphIu.exe
  2⤵
  PID:9508
- C:\Windows\System\OdkchKT.exe
  C:\Windows\System\OdkchKT.exe
  2⤵
  PID:9576
- C:\Windows\System\osOiAQb.exe
  C:\Windows\System\osOiAQb.exe
  2⤵
  PID:9556
- C:\Windows\System\PtRunUS.exe
  C:\Windows\System\PtRunUS.exe
  2⤵
  PID:9524
- C:\Windows\System\IVsOFXC.exe
  C:\Windows\System\IVsOFXC.exe
  2⤵
  PID:8312
- C:\Windows\System\tQbNpan.exe
  C:\Windows\System\tQbNpan.exe
  2⤵
  PID:9644
- C:\Windows\System\QfpjBtv.exe
  C:\Windows\System\QfpjBtv.exe
  2⤵
  PID:9628
- C:\Windows\System\HtwwBni.exe
  C:\Windows\System\HtwwBni.exe
  2⤵
  PID:9660
- C:\Windows\System\OVzNqQs.exe
  C:\Windows\System\OVzNqQs.exe
  2⤵
  PID:9676
- C:\Windows\System\eoRETEc.exe
  C:\Windows\System\eoRETEc.exe
  2⤵
  PID:9700
- C:\Windows\System\DXxNWZH.exe
  C:\Windows\System\DXxNWZH.exe
  2⤵
  PID:9724
- C:\Windows\System\hidFAyx.exe
  C:\Windows\System\hidFAyx.exe
  2⤵
  PID:9768
- C:\Windows\System\oUSVRiW.exe
  C:\Windows\System\oUSVRiW.exe
  2⤵
  PID:9744
- C:\Windows\System\tKzTKBS.exe
  C:\Windows\System\tKzTKBS.exe
  2⤵
  PID:9800
- C:\Windows\System\cEqVgQk.exe
  C:\Windows\System\cEqVgQk.exe
  2⤵
  PID:9868
- C:\Windows\System\DJJyFil.exe
  C:\Windows\System\DJJyFil.exe
  2⤵
  PID:9928
- C:\Windows\System\ordPnpO.exe
  C:\Windows\System\ordPnpO.exe
  2⤵
  PID:9976
- C:\Windows\System\gfSvTxT.exe
  C:\Windows\System\gfSvTxT.exe
  2⤵
  PID:9848
- C:\Windows\System\oCxPfiG.exe
  C:\Windows\System\oCxPfiG.exe
  2⤵
  PID:9920
- C:\Windows\System\PcOIMsV.exe
  C:\Windows\System\PcOIMsV.exe
  2⤵
  PID:9988
- C:\Windows\System\BMjUcpH.exe
  C:\Windows\System\BMjUcpH.exe
  2⤵
  PID:10056
- C:\Windows\System\pqsHRas.exe
  C:\Windows\System\pqsHRas.exe
  2⤵
  PID:10076
- C:\Windows\System\tycrFOU.exe
  C:\Windows\System\tycrFOU.exe
  2⤵
  PID:10116
- C:\Windows\System\PkqQSDg.exe
  C:\Windows\System\PkqQSDg.exe
  2⤵
  PID:10140
- C:\Windows\System\DveHyFA.exe
  C:\Windows\System\DveHyFA.exe
  2⤵
  PID:10152
- C:\Windows\System\XQAodxK.exe
  C:\Windows\System\XQAodxK.exe
  2⤵
  PID:10164
- C:\Windows\System\GSiCHcf.exe
  C:\Windows\System\GSiCHcf.exe
  2⤵
  PID:10224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AkggnZb.exe

Filesize
1.9MB

MD5
7dc046d60b7e0ccd7d97d0f7af09cb22

SHA1
a3d5459c48bc7f9572fa6d2f0393781804e212cf

SHA256
5163f265b805e7aac8f32524b514f5c8e06c1ed54c05b9ac851fc654b675b455

SHA512
ee826dbb7578022cc081ee35a1313ebdc30729c3820fdec3399ff24273a99c5bffbe65c31ad759922c05870e2dae1210873bf9957ae07546f643b7da849ed0fd

Download Submit
C:\Windows\system\DFKvony.exe

Filesize
1.9MB

MD5
a8e74466314367bbdd2c12217829600c

SHA1
43a9168863a38da06ecaf55c19a6b44ad95df370

SHA256
406b5577c2ab1ca91037f0001b9f403bb17e71d0c95d1aac35e6e022f66d26d7

SHA512
7e9e4fe6bbe1498a1e0a70886c20a97895f2c034fd8b2fdc81b17c47f8fee58cf9769c60b77008a9042675e39c5630c9502d7cb07e0e887b3b19e532abf37d82

Download Submit
C:\Windows\system\DcLkOUJ.exe

Filesize
1.9MB

MD5
5f4d3d4903eb4c4ce8cdfbabffa8675d

SHA1
72b384ebab90f1c27620da050c4f1347896faf0d

SHA256
414cb259dbaff6fe6cc159218625475a1fa3f25dc64b166638cf30e1ddc5c0aa

SHA512
7a4f05a0a59e6ebd03235472ae81eebb9163ae1ca288f36b9b0d1d4dac87b2e3e42cc57bcd31db507a4f3b88b61d7a998691fa71c877c8e36e00d92ff53544ee

Download Submit
C:\Windows\system\HSTFiUW.exe

Filesize
1.9MB

MD5
51d0913a321349b50644452d1e44fb98

SHA1
c02364daee72b95dd616123004c2ada7ed94e730

SHA256
c49a7cb85a439ee7252b136f00e55543992241d12590d420f3dce0aad6461a59

SHA512
458e87e5e34f2328cc58f08c4c846bd7f030a14f43c797b00ab225d4cfbcb0653f9088fe021e0d8423a3324c241cf7359f0610ef476eb1dcebf82ccf85d62040

Download Submit
C:\Windows\system\IbWNUFc.exe

Filesize
1.9MB

MD5
2120d0797fa0da022667acf2105333e6

SHA1
02f938bdd2002a222bab1304a6ae316831c4fae1

SHA256
12733f611a0a118bbd8a7510ca1dfcc5c83e7c4948b9b302c2c78cda15603d98

SHA512
79b713cea4277036c255803a53a092470e4e6c4c031a123c6e5ed2d3c2c24fa8bf2b39fc57b22a667160176dca05f285fd591405da5031560d93d0244d693d1d

Download Submit
C:\Windows\system\NNMVCcX.exe

Filesize
1.9MB

MD5
2e0fba9e341e98c2f4a356a7e7090d2b

SHA1
914cf6c800f21891d96a12d494e9e0ac5149e0b3

SHA256
66f9eec2c7aed8575ca4da23d651e618eb145b59652897e12c66f58b3df1c5fa

SHA512
a1501771881cede40c9a8a71f7f23a4b84b6110d9537a38b849792437342641e26ccf4a0024e902d05e6f85213040adcf9d70fd563887094441d7e90996e0cb2

Download Submit
C:\Windows\system\OiCsWHG.exe

Filesize
1.9MB

MD5
184eabb1db320edd47a1152b3ad7859a

SHA1
04bd5038d0148a8da857d74f0d15d409658e996b

SHA256
7957daf53bd1c92257eccad3380bf7b5d7888ce77bba342a77a6a3932e4c959c

SHA512
4ac2b95ca564ca575cf439f0336903c53bdaea417961ec69930290bbac1c1bb7e812a469af57d7e8d6d4bd50723f22635c0b1173139fd7e900a139a5df11ca2b

Download Submit
C:\Windows\system\QHttHwK.exe

Filesize
1.9MB

MD5
d03a90a7ac22eb2a77bcab8d50e97bcc

SHA1
14a96c73f7580ce71d24ae7ff8075e6506c7b891

SHA256
8450954b84d1012b109e7c08d46dcdfbeed78edadf674598e1e76e2316ece78a

SHA512
36ef9228ae486001c10a0ffcf33ba86ebb201e47e7b2496c71418640e2e8e9533abce4b1bebc8c913dd34f700f3be66b9bb99626a1b6e75b7ecb2717dd79f8fb

Download Submit
C:\Windows\system\SRYPqpZ.exe

Filesize
1.9MB

MD5
6c8ea4e9d92eb15aef377e40abfe0ea9

SHA1
cf6941b1d17da1e170bb1f2bf8588380c64a1fad

SHA256
c82127a113733dc3c461ab15f97ed282b970dd26abb8f3665624ea9195ff2d55

SHA512
309eb32f5c509e2f8b51929b3c9f60121772db5253732f85aeb1e41afc886f35d3c32611ddfd2697ca892f52648278d910ba1a53941d99ccff51d295f9d0cd52

Download Submit
C:\Windows\system\TutQhXG.exe

Filesize
1.9MB

MD5
680726e125b281d290aafa8174f0cea6

SHA1
42295f1be71e3adf09e20b50be53401972d394fa

SHA256
703b425945b64c256ff6de718d845642b958fc0f7c4dc8f3babc0a1b573e7c8a

SHA512
6008baed7e62242aa232632d8062ed23c0e9023ea289704ad0f77d9610fefbce3a4a5b10653236d6e61be6f372a50bb05b774a403dd6128c9140c2b4cf1fc056

Download Submit
C:\Windows\system\XSFabGn.exe

Filesize
1.9MB

MD5
42825feaf221eac4a80b5e668a49e74a

SHA1
33096010bcc07e93cf9856c3739f6ce1e5e28162

SHA256
2f205eb5d733974f457abf0523600772f9eace926ba2492291e1aec602d41188

SHA512
1500ae2e915355b7ce7b64244f612cdc3d09b72853929a6d6a5af514850710a20c96ba429097e2ef25d5e95db39bab0236e0cd04c000917b0fcd06d640d49f2d

Download Submit
C:\Windows\system\bLrQvuQ.exe

Filesize
1.9MB

MD5
fec20d2f58bfa0473f12e36286476916

SHA1
216d354a5e3375821cf2c91846406f63527e69ed

SHA256
73c92e33a21498e138846bdf06ce5199e354ba0aafe9352d8cf9f80e64e48a35

SHA512
33eb1197adcffc3731ca5153cd0a19e4cd12db1d0106c82de403d57469787d281ffa819f058ba4cde16c070b47973c62fcc991be5f2ed6c93f977529e89bd152

Download Submit
C:\Windows\system\brxjnLI.exe

Filesize
1.9MB

MD5
dd2b2b8bd7b3455dbbe11a0f2f767bc5

SHA1
ae6af17531ebae07788c9e9158f4bb02203ecfd0

SHA256
3bd8d06c3a8f09c3206b0d78acefc4aa0c2c489b366d2f622e062068de11a06d

SHA512
12cc02ac53adc1c0a2186a5db1c7bb1901fbecd4fbbc62fce0798a8c6cfd561cefccfeabedc9be74a915ea3a10d7588cf4b855af8a7c6ca2e213bcc593c5cd23

Download Submit
C:\Windows\system\dzxMyGJ.exe

Filesize
1.9MB

MD5
b3261b9771a60e8a716c93e718e58010

SHA1
a3ce92e55cd696d89a8191323ab35a1f7a3378b3

SHA256
a218522894f6efca9f16ce0a429aa36bee22764dfbddc1e94f0d3fe5c01ae2ca

SHA512
f3aa155eb59e6cb8baa555d5d7bc52181f86cd8121a65bff5e0c1188e95810467f8db389a15b0da0e43db8ceda6177138053570db8a8e534959cca34854aa7de

Download Submit
C:\Windows\system\haZVzGl.exe

Filesize
1.9MB

MD5
b6e5ff7d400ec613a5f7305ea1822cae

SHA1
c137b08bb29082acf60e7ad42c0adf9547bb9001

SHA256
2a5d11c122113cea0f36aeabe1ae907c2774a7399515dc94af465d45235ffacd

SHA512
48621a67267728f476c8307cea82d520a18241be8d9f7a8a6bd733e327739fa4d0bf94f39f45bc92285a1df755a1d325dc728fb386205d021769cd132c75cdbc

Download Submit
C:\Windows\system\jMGEaAh.exe

Filesize
1.9MB

MD5
c4df2c1230464c92540bff64e77603fb

SHA1
fbfe5c31a10f88827dd2b395029c7bb9f9635d0e

SHA256
c272c1fd74d30416f3a3224c4e3b1d9d25ec03808e67a9274872f3b6cabd7f05

SHA512
c74900053178bd1150bf800e7592ea00565d538d5b075952f22d1274db1eaa83f2d458b51ee4b54900227861799cb847d0c9a0f93ccd864866d5fc47407a32ba

Download Submit
C:\Windows\system\rtNmULq.exe

Filesize
1.9MB

MD5
86dc805f2f5d36e48d91eb3b2069a4cc

SHA1
63b7055c8957926ad09e5144eb6b8b7baee98c6b

SHA256
a6c16555a24d049b7bfcc71f4f3de866ad83aa483d4d53639a2e54b53c8293c8

SHA512
c37bfcfefc157f66ecb7d57b20fea23437342b9af718ff1133b160eeb6d7f54622b0e39b2b534a4bbf9e2f87c8e9ca3bc2859373f3971ec359fdab8280d68977

Download Submit
C:\Windows\system\uVICnQt.exe

Filesize
1.9MB

MD5
4600327d68e17dafb18923f447c090f1

SHA1
160c8556447b6eb46ed13986ec31e92b4dba25e8

SHA256
79d62d73b238f948b0b4c9562ac71086473a57e35625c0ee67bac5673e252f88

SHA512
8cb4b49b9c127e902d7fd7d63e445db092996e5ee19caac6271d299a954670e8a38cdfeedb1d9791c4f8c03e44ce14881fcc0d44ebd4fbc1b2fa2f8c5b47dce6

Download Submit
C:\Windows\system\wrTOPMa.exe

Filesize
1.9MB

MD5
9ef5d80c0f8aabeae6a2ba4760a398e0

SHA1
34f80a0bde0b44efc5d2c6105c5c9a1a7f0d68a8

SHA256
86cb36788585c816ce02a110097144b4f2d3c880b3b740afff7f8c74d424cc99

SHA512
c640052e1a3135d678e6be87d0e8742b454901af24bb8af2d778fc9d60d86ff748d1756a2f3b1a136c834d52dce9798f372aeae8c194726669077307600d256d

Download Submit
C:\Windows\system\ydQVtXx.exe

Filesize
1.9MB

MD5
9b97ee31b3dab89b6f3711d6215f3e58

SHA1
063ba2c05be92d2a5ec2d3ad2d02d86231b1fcda

SHA256
bf32aa1b77cbdc8aaedf803827a45a48e24093d079cafddbc66bca46b1b5b482

SHA512
fb175eaec7072dc6423e9de131768a0fd1c6878d0d2c0b89c6c18b89df8094b7b53ffaa36bf02bad5382ac8508da0b56e0919ceb860ff0b82996b004fab64374

Download Submit
\Windows\system\ChflXFc.exe

Filesize
1.9MB

MD5
9226972bc1a25b9717201812498a443c

SHA1
58e18936cab9991279bf8eedb87f3c3e07f4d7a9

SHA256
cf6934a9b9c840558e4196d617dee18740b16afc2a801e79d8d0beef7817cfa1

SHA512
60ab74b1565c2e999ffdca8190eb9ac915fadf862de7bf6d166fa5bfac241f17842957821c5846ea89015426d16dd6ef0941bdb33b441cbe6c41f56e8549bc71

Download Submit
\Windows\system\DujFEVP.exe

Filesize
1.9MB

MD5
9c6980164c534c415cd98530c898375d

SHA1
619dc1d22dcf7cf11219647b307de0f017ccbade

SHA256
5e418edd05a11965b894387ca53c58a41997285e249f26306a8d757a66f479d9

SHA512
7c82c1595b01bea42c52d67b0f38f54952e991e3de00918097b16415b0e3bce600b588529c8d938d9fbddc5f09f271d33343eff0b765617b23696efa7369b362

Download Submit
\Windows\system\JYmrETl.exe

Filesize
1.9MB

MD5
96727e5451d9d2034b7ea080e9341133

SHA1
436f096e11c5a6e85c8835e92dc92e81ad2f6dee

SHA256
b9592e2bcef2f1ea84d7b75b16e38fb9b48b25d032a78958db6a2f43e6958929

SHA512
a1871fe122db7c26e09716d0840ff55ec18ddc3fb7fddccffbe48f059b35c6f5529b8a5aac4334dc65cb773d038d814ed4d80928383f487335b1eec2bdc15c13

Download Submit
\Windows\system\MrIFWtp.exe

Filesize
1.9MB

MD5
35bbfec441aae9a1a8ea4441bbfaddcc

SHA1
65463aa53e4146191d4e26dd14ecc4bc61ffcaa4

SHA256
bad715200d798b448acd19b83bae674ade62f952d1b1c98c5ec8a249d5b1ec6e

SHA512
9e9260c8735efaadf654f37e84669edc6a1de7b0cdc747c6f0fcc49bac7180a045fc041b4991a1bb5596ff8affb5c4273ca196cdd0a8206767960e3a79af6cd5

Download Submit
\Windows\system\QqQRfkt.exe

Filesize
1.9MB

MD5
2dccbcfd87e30f40783b9f18773124d5

SHA1
2382e520b5176525d9e6f04e4132ec8cab9fdbd7

SHA256
306d276c4d5dc92c1730b0934b12b9624c7f01884e343ca0b7258816c0de3c91

SHA512
ac410c95d8d7055d446f88fecbea4f0cf8066a96934b663776ce458cb1ce6955d27133d5d95c4c3d80c6060583f88951d947a989d4d2a935d3fcdaaa0d504d42

Download Submit
\Windows\system\WyEMnXW.exe

Filesize
1.9MB

MD5
7bc26fc1dd753469ff167237097469bd

SHA1
5cb55f1158d289b1c1f2663af70335676b0a6ce0

SHA256
855b56d2dba8735448ba8043a6549c08f22e4fc63dd043824093dbf6fc1c1e46

SHA512
d23c13d6acc317814a83cd996e04a38da78ea50a54262baca7612bd3e0a6da808ff3d140061816d94df5781372fee42b4932b8f4c25cff7d12681b5d3434d887

Download Submit
\Windows\system\ijqGzRG.exe

Filesize
1.9MB

MD5
3a40e6ec0faa9ff0edcc392150669b72

SHA1
0ad06486b5069f8b1358348052186382667e7df7

SHA256
c3536fca703ef40b63634f5bc9af99cbbbc3203ac01ccb29476ff51b70531996

SHA512
27a12e7590ef90402275408cf6b8f153d415fee6337159b50371abebf999b16c7f47e2fb7b36bd1ddf969f582f0b6a5c20226fcee13920b2c382cefc0f84d266

Download Submit
\Windows\system\jwrFTJb.exe

Filesize
1.9MB

MD5
87ea2b12df7f628c4782f464b9933b07

SHA1
21f13db56ce80a409f46ae54b28ef6865633469a

SHA256
408a453334ee13691cb3dfb54ba474c1e81d4dd45b484e055f771873c3c1a985

SHA512
5726351f467ab5695b3ff0bb319c5300b76ea3b0966d3bdc09a7b1faf5c43bdcaf6db0be6a4d96c614d2f9486bd7c607c6cb79ac13a398e10d9162802fea2a46

Download Submit
\Windows\system\knjlaGz.exe

Filesize
1.9MB

MD5
82f241f7ea88f7c874bf1a457309c448

SHA1
01bce8446c0a961234b3932c9f187ab647a87c33

SHA256
9418f5e64e0a27cef868d6a741f63955923a097ccb50f90eb417941b48d51350

SHA512
d794a895b218faf18240007cb3ba79b126a07d730b7d31f4891c59e9762b95c2949d81f2e0d008258af021cb5185243307b58495eb5de23451dd93750cbdea0d

Download Submit
\Windows\system\rGZfLMJ.exe

Filesize
1.9MB

MD5
f4312f24d8a37b4624d6abb5c1f5dd8b

SHA1
0ae8acb211774725a206af5231a7fb187ea925ac

SHA256
da1da4e9f7380d18047a15bdc90d04e733cb4641410385a48c20cd5e28201a52

SHA512
789bd3f7cd86f97187112bc280151c2cebc11a32e6f1d397ca59c14265619e52c2ce5a280dfb20f5bdf90e8f024a1096b32ada3cbc7d91708e28f0cdd9569c6e

Download Submit
\Windows\system\smOSLDQ.exe

Filesize
1.9MB

MD5
94ae53cc98bd4932845b2988fda2fda2

SHA1
ac65986455bddd28c7bbd32d13fb3eca0832c6e5

SHA256
c6513bbcb02a3e5d9f17afc60b8cb4b89221441e50bd2009e973f1aa179cbf58

SHA512
2fe8022bc9fc932f4591f0ff3e9fa93f63a0d606726269844d5698ae25b41e499f8f2df3540f42012cf8780764ab22c1e45b74a964e2c4d2322009a63493ec33

Download Submit
\Windows\system\umphYbB.exe

Filesize
1.9MB

MD5
c4e1ac1d3efbae424c6f10238cd6c866

SHA1
96428e3dcaec24a7f01fe3ddbaf7222474a73d89

SHA256
e8df33de1037b33ceed49ef3636b2e47b95039c1a9bd3bf44c64d9367be33dd7

SHA512
5ec81e5f3168dd47db8474640a57f15e5084608083a7279823bc55fba62ac758abc8d60c43df3cb6f686cbc42c0beff9af9022526397e94c79bbbc34f46dcf7b

Download Submit
\Windows\system\zAdQTVk.exe

Filesize
1.9MB

MD5
0224d5abed1f4311ab0cd4afae4e4eb5

SHA1
23c42fc2f1417703d9d121e9f72f0f1589390b60

SHA256
ad04b756eeccb43ff561f6c7c428861f79230db5521340387e3fed5081a213b2

SHA512
f113c4b5c3c100cc7cd677fd63c4ac7a7d26f540bcb72f3846cc029483e3d6e38e322502390ec40001a7c6daf21c5d8390edd7e504343829594950e219c7f793

Download Submit
memory/1228-98-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/1608-58-0x000007FEF5B80000-0x000007FEF651D000-memory.dmp

Filesize
9.6MB

Download
memory/1608-73-0x000007FEF5B80000-0x000007FEF651D000-memory.dmp

Filesize
9.6MB

Download
memory/1608-30-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/1608-476-0x000007FEF5B80000-0x000007FEF651D000-memory.dmp

Filesize
9.6MB

Download
memory/1608-68-0x000007FEF5B80000-0x000007FEF651D000-memory.dmp

Filesize
9.6MB

Download
memory/1608-57-0x00000000029E0000-0x00000000029E8000-memory.dmp

Filesize
32KB

Download
memory/1608-20-0x00000000029F0000-0x0000000002A70000-memory.dmp

Filesize
512KB

Download
memory/1608-21-0x000007FEF5E3E000-0x000007FEF5E3F000-memory.dmp

Filesize
4KB

Download
memory/1728-109-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/1728-18-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/1728-96-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/1728-10158-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-70-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/1728-8-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1728-114-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/1728-113-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/1728-79-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/1728-77-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/1728-75-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/1728-0-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-90-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/1728-82-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/1728-10420-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/1728-9809-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-87-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2132-5207-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2132-13-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2152-78-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2152-5185-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2316-112-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2316-5070-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2388-81-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2388-5237-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2460-83-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-5286-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-19-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2548-5289-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2556-69-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2556-5202-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2620-72-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2620-5287-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2864-110-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-5254-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-76-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download