xmrig | d150b435b9a5bf4a9bf9159862ed3ebdb857405c17a4e8ec580361f4d45f17ad

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
Size

1.5MB
MD5

3b3224ae359572a429e6d1dce50c7148
SHA1

6e3b674eb7dd41be16759de454c8fb32bece5388
SHA256

d150b435b9a5bf4a9bf9159862ed3ebdb857405c17a4e8ec580361f4d45f17ad
SHA512

54a5328f0e8387d549fd53ec469b7a7f5cb2d4ab3c674b69af5d706ccc3e6cd7bad6413578afa7555a386c470d0d52af6af1a0ab6ea4f893de6b86502f24c2eb
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VxjzSRLgxc2o:Lz071uv4BPMkibTIA5CJKxX

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/2168-164-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	xmrig
behavioral1/memory/2792-184-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	xmrig
behavioral1/memory/2828-182-0x000000013F650000-0x000000013FA42000-memory.dmp	xmrig
behavioral1/memory/2540-180-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2964-177-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2508-169-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2504-161-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/2688-23-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2620-21-0x000000013FC30000-0x0000000140022000-memory.dmp	xmrig
behavioral1/memory/3064-18-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2508-4973-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2620-5393-0x000000013FC30000-0x0000000140022000-memory.dmp	xmrig
behavioral1/memory/2688-5394-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/3064-5446-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2168-5458-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	xmrig
behavioral1/memory/2964-5484-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2540-5481-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2828-5507-0x000000013F650000-0x000000013FA42000-memory.dmp	xmrig
behavioral1/memory/2792-5541-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2692	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3064	iPRYjrT.exe
2620	MbRCNno.exe
2688	EoHWTFN.exe
2504	jqecHLU.exe
2792	iYJflnR.exe
2168	rwggyBs.exe
2508	nirbRWc.exe
2964	cBjpKQz.exe
2540	cbkfplP.exe
2828	wPiSroN.exe
2708	FruTNUb.exe
2476	qiDZlWR.exe
2364	kloqjrX.exe
1596	tSWbxZt.exe
2736	JxUMSSj.exe
2848	oyvFqwg.exe
348	LMKfamn.exe
2136	NiqDXNL.exe
1608	BImbvWk.exe
2360	lwhcwGx.exe
2944	MgkvThI.exe
2548	dXBdsVA.exe
2040	RpZyAcE.exe
1120	ZExfiRw.exe
1688	okiFAfe.exe
2992	aEzFiCZ.exe
2236	jOTyoZm.exe
592	YtLHGxB.exe
768	uqBKBwd.exe
1788	gebcBpL.exe
1696	xnueqws.exe
2428	eBEPQKL.exe
1176	FgvnAXe.exe
2660	ptyEEut.exe
848	hbIPadn.exe
2884	sXbgarV.exe
316	whzYlMH.exe
776	PlTagDl.exe
2124	XJduKXU.exe
700	wzZRWTP.exe
1620	itMBKYY.exe
1300	zVMkpJg.exe
2076	gIYHLxO.exe
568	PDwVaej.exe
924	svbpLVN.exe
884	OUDIgzE.exe
1208	PHpPHzu.exe
1852	FexERuV.exe
1716	ngrIhgK.exe
1896	MFzGZth.exe
2396	ZdseGDx.exe
1524	cPuiBZh.exe
3052	FBWTKmR.exe
2876	CnpPILS.exe
2772	gFcGkSy.exe
2592	BYKRuwb.exe
3000	jcUqTPw.exe
2728	ArHTJnJ.exe
2512	RaNiLPa.exe
2492	tATKYzF.exe
1232	ooSVErX.exe
1864	IwWZPUL.exe
1600	kMmxEAh.exe
1584	qzoVvtH.exe

Loads dropped DLL 64 IoCs

pid	Process
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3012-2-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/files/0x000e00000001226c-6.dat	upx
behavioral1/files/0x002f000000015cfd-7.dat	upx
behavioral1/files/0x0008000000015d42-17.dat	upx
behavioral1/files/0x000f000000003683-31.dat	upx
behavioral1/files/0x0007000000015fd4-40.dat	upx
behavioral1/files/0x0007000000016cde-50.dat	upx
behavioral1/files/0x0006000000016d44-58.dat	upx
behavioral1/files/0x0006000000016d6c-78.dat	upx
behavioral1/files/0x0006000000016d78-96.dat	upx
behavioral1/files/0x0006000000016da0-101.dat	upx
behavioral1/files/0x00060000000173d3-133.dat	upx
behavioral1/files/0x0006000000017568-147.dat	upx
behavioral1/memory/2168-164-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	upx
behavioral1/files/0x00050000000186ff-173.dat	upx
behavioral1/files/0x002f000000015d09-151.dat	upx
behavioral1/files/0x0005000000018701-190.dat	upx
behavioral1/files/0x00060000000175f4-188.dat	upx
behavioral1/memory/2792-184-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx
behavioral1/memory/2828-182-0x000000013F650000-0x000000013FA42000-memory.dmp	upx
behavioral1/memory/2540-180-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/2964-177-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/2508-169-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/memory/2504-161-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/files/0x00060000000175e8-155.dat	upx
behavioral1/files/0x00060000000173d6-142.dat	upx
behavioral1/files/0x00060000000173b4-132.dat	upx
behavioral1/files/0x000600000001720f-126.dat	upx
behavioral1/files/0x00060000000171ba-122.dat	upx
behavioral1/files/0x0006000000016dc8-111.dat	upx
behavioral1/files/0x0006000000016dd1-115.dat	upx
behavioral1/files/0x0006000000016db2-106.dat	upx
behavioral1/files/0x0006000000016d70-92.dat	upx
behavioral1/files/0x0006000000016d68-90.dat	upx
behavioral1/files/0x0006000000016d4c-88.dat	upx
behavioral1/files/0x0006000000016d3b-86.dat	upx
behavioral1/files/0x00090000000160f3-83.dat	upx
behavioral1/files/0x0008000000015f54-73.dat	upx
behavioral1/files/0x0008000000015d72-38.dat	upx
behavioral1/files/0x0006000000016d55-66.dat	upx
behavioral1/memory/2688-23-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2620-21-0x000000013FC30000-0x0000000140022000-memory.dmp	upx
behavioral1/memory/3064-18-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2508-4973-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/memory/2620-5393-0x000000013FC30000-0x0000000140022000-memory.dmp	upx
behavioral1/memory/2688-5394-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/3064-5446-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2168-5458-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	upx
behavioral1/memory/2964-5484-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/2540-5481-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/2828-5507-0x000000013F650000-0x000000013FA42000-memory.dmp	upx
behavioral1/memory/2792-5541-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FycWGXv.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\VkLlkov.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\AvxVBjG.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\RuufgBe.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\bnfmYSL.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\INLVVwS.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\jkjiuCq.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\tDWMihF.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\QbbKRQG.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\vViiNXd.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\QEJaNZx.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\dQFVUhE.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\COBmIgn.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\PGSIgIo.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\WPwRlHL.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\pdMqFxn.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\pSPRrai.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\rIWZYht.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\rHuBsQL.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\asaMNEx.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\CCupfOt.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\XQNFApB.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\aaxzCWH.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\cOfMFkh.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\VREPorC.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\kslURyL.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\myiNOjG.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\TOcfixK.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\BnCrrTa.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\UskcffX.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\vlgsExd.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\UTvCwJV.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\rxvFLTy.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\tcJeYTY.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\fweqBCN.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\NgEjhjG.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\rcthZNG.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\yjWpkVW.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\QflAWco.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\apXyKaG.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\GPdLreZ.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\NHZYFri.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\mNVWvru.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\aZvkukH.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\ScosxJu.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\LSTvaOH.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\eGprUyU.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\UIIzmqn.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\sZLVdkx.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\YuROnLL.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\FYhKGmt.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\secwsCt.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\cSbcakt.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\bDiyKap.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\VNKVspl.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\wJJAHVi.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\nMUkywn.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\yfhgNmn.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\fmoXfKR.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\hehTYcA.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\yygzqKS.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\PzEnUfB.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\kjEmRNP.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
File created	C:\Windows\System\brdiXZI.exe	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2692	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeLockMemoryPrivilege	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2692	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	29
PID 3012 wrote to memory of 2692	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	29
PID 3012 wrote to memory of 2692	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	29
PID 3012 wrote to memory of 3064	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	30
PID 3012 wrote to memory of 3064	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	30
PID 3012 wrote to memory of 3064	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	30
PID 3012 wrote to memory of 2620	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	31
PID 3012 wrote to memory of 2620	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	31
PID 3012 wrote to memory of 2620	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	31
PID 3012 wrote to memory of 2688	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	32
PID 3012 wrote to memory of 2688	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	32
PID 3012 wrote to memory of 2688	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	32
PID 3012 wrote to memory of 2792	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	33
PID 3012 wrote to memory of 2792	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	33
PID 3012 wrote to memory of 2792	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	33
PID 3012 wrote to memory of 2504	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	34
PID 3012 wrote to memory of 2504	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	34
PID 3012 wrote to memory of 2504	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	34
PID 3012 wrote to memory of 2828	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	35
PID 3012 wrote to memory of 2828	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	35
PID 3012 wrote to memory of 2828	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	35
PID 3012 wrote to memory of 2168	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	36
PID 3012 wrote to memory of 2168	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	36
PID 3012 wrote to memory of 2168	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	36
PID 3012 wrote to memory of 2476	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	37
PID 3012 wrote to memory of 2476	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	37
PID 3012 wrote to memory of 2476	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	37
PID 3012 wrote to memory of 2508	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	38
PID 3012 wrote to memory of 2508	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	38
PID 3012 wrote to memory of 2508	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	38
PID 3012 wrote to memory of 2364	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	39
PID 3012 wrote to memory of 2364	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	39
PID 3012 wrote to memory of 2364	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	39
PID 3012 wrote to memory of 2964	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	40
PID 3012 wrote to memory of 2964	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	40
PID 3012 wrote to memory of 2964	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	40
PID 3012 wrote to memory of 1596	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	41
PID 3012 wrote to memory of 1596	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	41
PID 3012 wrote to memory of 1596	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	41
PID 3012 wrote to memory of 2540	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	42
PID 3012 wrote to memory of 2540	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	42
PID 3012 wrote to memory of 2540	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	42
PID 3012 wrote to memory of 2736	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	43
PID 3012 wrote to memory of 2736	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	43
PID 3012 wrote to memory of 2736	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	43
PID 3012 wrote to memory of 2708	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	44
PID 3012 wrote to memory of 2708	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	44
PID 3012 wrote to memory of 2708	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	44
PID 3012 wrote to memory of 2848	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	45
PID 3012 wrote to memory of 2848	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	45
PID 3012 wrote to memory of 2848	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	45
PID 3012 wrote to memory of 348	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	46
PID 3012 wrote to memory of 348	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	46
PID 3012 wrote to memory of 348	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	46
PID 3012 wrote to memory of 2136	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	47
PID 3012 wrote to memory of 2136	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	47
PID 3012 wrote to memory of 2136	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	47
PID 3012 wrote to memory of 1608	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	48
PID 3012 wrote to memory of 1608	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	48
PID 3012 wrote to memory of 1608	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	48
PID 3012 wrote to memory of 2360	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	49
PID 3012 wrote to memory of 2360	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	49
PID 3012 wrote to memory of 2360	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	49
PID 3012 wrote to memory of 2944	3012	3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3b3224ae359572a429e6d1dce50c7148_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Windows\System\iPRYjrT.exe
  C:\Windows\System\iPRYjrT.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\MbRCNno.exe
  C:\Windows\System\MbRCNno.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\EoHWTFN.exe
  C:\Windows\System\EoHWTFN.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\iYJflnR.exe
  C:\Windows\System\iYJflnR.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\jqecHLU.exe
  C:\Windows\System\jqecHLU.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\wPiSroN.exe
  C:\Windows\System\wPiSroN.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\rwggyBs.exe
  C:\Windows\System\rwggyBs.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\qiDZlWR.exe
  C:\Windows\System\qiDZlWR.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\nirbRWc.exe
  C:\Windows\System\nirbRWc.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\kloqjrX.exe
  C:\Windows\System\kloqjrX.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\cBjpKQz.exe
  C:\Windows\System\cBjpKQz.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\tSWbxZt.exe
  C:\Windows\System\tSWbxZt.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\cbkfplP.exe
  C:\Windows\System\cbkfplP.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\JxUMSSj.exe
  C:\Windows\System\JxUMSSj.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\FruTNUb.exe
  C:\Windows\System\FruTNUb.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\oyvFqwg.exe
  C:\Windows\System\oyvFqwg.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\LMKfamn.exe
  C:\Windows\System\LMKfamn.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\NiqDXNL.exe
  C:\Windows\System\NiqDXNL.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\BImbvWk.exe
  C:\Windows\System\BImbvWk.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\lwhcwGx.exe
  C:\Windows\System\lwhcwGx.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\MgkvThI.exe
  C:\Windows\System\MgkvThI.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\dXBdsVA.exe
  C:\Windows\System\dXBdsVA.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\RpZyAcE.exe
  C:\Windows\System\RpZyAcE.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\ZExfiRw.exe
  C:\Windows\System\ZExfiRw.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\okiFAfe.exe
  C:\Windows\System\okiFAfe.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\aEzFiCZ.exe
  C:\Windows\System\aEzFiCZ.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\jOTyoZm.exe
  C:\Windows\System\jOTyoZm.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\YtLHGxB.exe
  C:\Windows\System\YtLHGxB.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\uqBKBwd.exe
  C:\Windows\System\uqBKBwd.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\xnueqws.exe
  C:\Windows\System\xnueqws.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\gebcBpL.exe
  C:\Windows\System\gebcBpL.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\eBEPQKL.exe
  C:\Windows\System\eBEPQKL.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\FgvnAXe.exe
  C:\Windows\System\FgvnAXe.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\ptyEEut.exe
  C:\Windows\System\ptyEEut.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\hbIPadn.exe
  C:\Windows\System\hbIPadn.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\itMBKYY.exe
  C:\Windows\System\itMBKYY.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\sXbgarV.exe
  C:\Windows\System\sXbgarV.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\zVMkpJg.exe
  C:\Windows\System\zVMkpJg.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\whzYlMH.exe
  C:\Windows\System\whzYlMH.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\gIYHLxO.exe
  C:\Windows\System\gIYHLxO.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\PlTagDl.exe
  C:\Windows\System\PlTagDl.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\svbpLVN.exe
  C:\Windows\System\svbpLVN.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\XJduKXU.exe
  C:\Windows\System\XJduKXU.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\OUDIgzE.exe
  C:\Windows\System\OUDIgzE.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\wzZRWTP.exe
  C:\Windows\System\wzZRWTP.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\PHpPHzu.exe
  C:\Windows\System\PHpPHzu.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\PDwVaej.exe
  C:\Windows\System\PDwVaej.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\FexERuV.exe
  C:\Windows\System\FexERuV.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\ngrIhgK.exe
  C:\Windows\System\ngrIhgK.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\MFzGZth.exe
  C:\Windows\System\MFzGZth.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\ZdseGDx.exe
  C:\Windows\System\ZdseGDx.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\cPuiBZh.exe
  C:\Windows\System\cPuiBZh.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\FBWTKmR.exe
  C:\Windows\System\FBWTKmR.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\CnpPILS.exe
  C:\Windows\System\CnpPILS.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\gFcGkSy.exe
  C:\Windows\System\gFcGkSy.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\BYKRuwb.exe
  C:\Windows\System\BYKRuwb.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\jcUqTPw.exe
  C:\Windows\System\jcUqTPw.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\ArHTJnJ.exe
  C:\Windows\System\ArHTJnJ.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\RaNiLPa.exe
  C:\Windows\System\RaNiLPa.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\tATKYzF.exe
  C:\Windows\System\tATKYzF.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\ooSVErX.exe
  C:\Windows\System\ooSVErX.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\kMmxEAh.exe
  C:\Windows\System\kMmxEAh.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\IwWZPUL.exe
  C:\Windows\System\IwWZPUL.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\qzoVvtH.exe
  C:\Windows\System\qzoVvtH.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\AbudDXp.exe
  C:\Windows\System\AbudDXp.exe
  2⤵
  PID:2452
- C:\Windows\System\MnbEiYi.exe
  C:\Windows\System\MnbEiYi.exe
  2⤵
  PID:1656
- C:\Windows\System\TJNyYbB.exe
  C:\Windows\System\TJNyYbB.exe
  2⤵
  PID:2172
- C:\Windows\System\WLbSJsH.exe
  C:\Windows\System\WLbSJsH.exe
  2⤵
  PID:2308
- C:\Windows\System\qenGvGS.exe
  C:\Windows\System\qenGvGS.exe
  2⤵
  PID:2016
- C:\Windows\System\noGWjSX.exe
  C:\Windows\System\noGWjSX.exe
  2⤵
  PID:2440
- C:\Windows\System\auRSVin.exe
  C:\Windows\System\auRSVin.exe
  2⤵
  PID:576
- C:\Windows\System\RMQwJIu.exe
  C:\Windows\System\RMQwJIu.exe
  2⤵
  PID:1720
- C:\Windows\System\CdzqXls.exe
  C:\Windows\System\CdzqXls.exe
  2⤵
  PID:2776
- C:\Windows\System\STcrpuR.exe
  C:\Windows\System\STcrpuR.exe
  2⤵
  PID:1468
- C:\Windows\System\HMlAHDJ.exe
  C:\Windows\System\HMlAHDJ.exe
  2⤵
  PID:2556
- C:\Windows\System\cbAgYgu.exe
  C:\Windows\System\cbAgYgu.exe
  2⤵
  PID:2712
- C:\Windows\System\yMLyIAd.exe
  C:\Windows\System\yMLyIAd.exe
  2⤵
  PID:380
- C:\Windows\System\kzKSHtK.exe
  C:\Windows\System\kzKSHtK.exe
  2⤵
  PID:108
- C:\Windows\System\kyQBdBZ.exe
  C:\Windows\System\kyQBdBZ.exe
  2⤵
  PID:2232
- C:\Windows\System\dQVdncE.exe
  C:\Windows\System\dQVdncE.exe
  2⤵
  PID:1064
- C:\Windows\System\ejVsELz.exe
  C:\Windows\System\ejVsELz.exe
  2⤵
  PID:2900
- C:\Windows\System\XbWweZX.exe
  C:\Windows\System\XbWweZX.exe
  2⤵
  PID:2000
- C:\Windows\System\pAtltBF.exe
  C:\Windows\System\pAtltBF.exe
  2⤵
  PID:1436
- C:\Windows\System\SfqWwiH.exe
  C:\Windows\System\SfqWwiH.exe
  2⤵
  PID:2696
- C:\Windows\System\AIKLpmT.exe
  C:\Windows\System\AIKLpmT.exe
  2⤵
  PID:1104
- C:\Windows\System\ySyOnUL.exe
  C:\Windows\System\ySyOnUL.exe
  2⤵
  PID:2340
- C:\Windows\System\AKEKzvd.exe
  C:\Windows\System\AKEKzvd.exe
  2⤵
  PID:2108
- C:\Windows\System\vfIadyL.exe
  C:\Windows\System\vfIadyL.exe
  2⤵
  PID:1428
- C:\Windows\System\CLFVCnt.exe
  C:\Windows\System\CLFVCnt.exe
  2⤵
  PID:1956
- C:\Windows\System\DAGWhBy.exe
  C:\Windows\System\DAGWhBy.exe
  2⤵
  PID:1560
- C:\Windows\System\yKkpoMj.exe
  C:\Windows\System\yKkpoMj.exe
  2⤵
  PID:1664
- C:\Windows\System\rRseZpa.exe
  C:\Windows\System\rRseZpa.exe
  2⤵
  PID:2112
- C:\Windows\System\hMWUrmh.exe
  C:\Windows\System\hMWUrmh.exe
  2⤵
  PID:2608
- C:\Windows\System\nFeRvaF.exe
  C:\Windows\System\nFeRvaF.exe
  2⤵
  PID:2196
- C:\Windows\System\JrqvDXj.exe
  C:\Windows\System\JrqvDXj.exe
  2⤵
  PID:1960
- C:\Windows\System\EnzFrxX.exe
  C:\Windows\System\EnzFrxX.exe
  2⤵
  PID:2684
- C:\Windows\System\svZCjyZ.exe
  C:\Windows\System\svZCjyZ.exe
  2⤵
  PID:1528
- C:\Windows\System\sFdyxgF.exe
  C:\Windows\System\sFdyxgF.exe
  2⤵
  PID:2640
- C:\Windows\System\rEgszQJ.exe
  C:\Windows\System\rEgszQJ.exe
  2⤵
  PID:2868
- C:\Windows\System\sCifxkn.exe
  C:\Windows\System\sCifxkn.exe
  2⤵
  PID:1860
- C:\Windows\System\sVDwVhw.exe
  C:\Windows\System\sVDwVhw.exe
  2⤵
  PID:2648
- C:\Windows\System\jAEEIjD.exe
  C:\Windows\System\jAEEIjD.exe
  2⤵
  PID:2808
- C:\Windows\System\YbWvezB.exe
  C:\Windows\System\YbWvezB.exe
  2⤵
  PID:3032
- C:\Windows\System\ZODGqHd.exe
  C:\Windows\System\ZODGqHd.exe
  2⤵
  PID:1224
- C:\Windows\System\yJdanHc.exe
  C:\Windows\System\yJdanHc.exe
  2⤵
  PID:2096
- C:\Windows\System\OvuwXWz.exe
  C:\Windows\System\OvuwXWz.exe
  2⤵
  PID:2200
- C:\Windows\System\vZOrRFy.exe
  C:\Windows\System\vZOrRFy.exe
  2⤵
  PID:2020
- C:\Windows\System\aiIuIPw.exe
  C:\Windows\System\aiIuIPw.exe
  2⤵
  PID:712
- C:\Windows\System\coOhNnY.exe
  C:\Windows\System\coOhNnY.exe
  2⤵
  PID:2240
- C:\Windows\System\qihxNEP.exe
  C:\Windows\System\qihxNEP.exe
  2⤵
  PID:1284
- C:\Windows\System\EoDHkff.exe
  C:\Windows\System\EoDHkff.exe
  2⤵
  PID:2008
- C:\Windows\System\iGPWLxB.exe
  C:\Windows\System\iGPWLxB.exe
  2⤵
  PID:1124
- C:\Windows\System\wxxtDoL.exe
  C:\Windows\System\wxxtDoL.exe
  2⤵
  PID:2356
- C:\Windows\System\lyQGYKY.exe
  C:\Windows\System\lyQGYKY.exe
  2⤵
  PID:2484
- C:\Windows\System\AYwDYDY.exe
  C:\Windows\System\AYwDYDY.exe
  2⤵
  PID:688
- C:\Windows\System\yJDvvkY.exe
  C:\Windows\System\yJDvvkY.exe
  2⤵
  PID:1396
- C:\Windows\System\RjLRHhs.exe
  C:\Windows\System\RjLRHhs.exe
  2⤵
  PID:1612
- C:\Windows\System\QkmDuWH.exe
  C:\Windows\System\QkmDuWH.exe
  2⤵
  PID:1912
- C:\Windows\System\iSNiMeW.exe
  C:\Windows\System\iSNiMeW.exe
  2⤵
  PID:408
- C:\Windows\System\lPWoAiQ.exe
  C:\Windows\System\lPWoAiQ.exe
  2⤵
  PID:2188
- C:\Windows\System\xXxPJBu.exe
  C:\Windows\System\xXxPJBu.exe
  2⤵
  PID:1000
- C:\Windows\System\OswWCUa.exe
  C:\Windows\System\OswWCUa.exe
  2⤵
  PID:2784
- C:\Windows\System\AcYzZtb.exe
  C:\Windows\System\AcYzZtb.exe
  2⤵
  PID:888
- C:\Windows\System\LRWGTVY.exe
  C:\Windows\System\LRWGTVY.exe
  2⤵
  PID:1932
- C:\Windows\System\mCswmRu.exe
  C:\Windows\System\mCswmRu.exe
  2⤵
  PID:1868
- C:\Windows\System\eqdFanp.exe
  C:\Windows\System\eqdFanp.exe
  2⤵
  PID:1552
- C:\Windows\System\Lvqfwuc.exe
  C:\Windows\System\Lvqfwuc.exe
  2⤵
  PID:2836
- C:\Windows\System\BjuCwiQ.exe
  C:\Windows\System\BjuCwiQ.exe
  2⤵
  PID:1508
- C:\Windows\System\FNsopaW.exe
  C:\Windows\System\FNsopaW.exe
  2⤵
  PID:1780
- C:\Windows\System\pGASGyJ.exe
  C:\Windows\System\pGASGyJ.exe
  2⤵
  PID:2500
- C:\Windows\System\FiDXIyX.exe
  C:\Windows\System\FiDXIyX.exe
  2⤵
  PID:2968
- C:\Windows\System\mzRASoY.exe
  C:\Windows\System\mzRASoY.exe
  2⤵
  PID:880
- C:\Windows\System\qGKATNN.exe
  C:\Windows\System\qGKATNN.exe
  2⤵
  PID:1412
- C:\Windows\System\tBytFAk.exe
  C:\Windows\System\tBytFAk.exe
  2⤵
  PID:1188
- C:\Windows\System\xtimfTQ.exe
  C:\Windows\System\xtimfTQ.exe
  2⤵
  PID:2820
- C:\Windows\System\RaMQjPX.exe
  C:\Windows\System\RaMQjPX.exe
  2⤵
  PID:1556
- C:\Windows\System\gGRrCef.exe
  C:\Windows\System\gGRrCef.exe
  2⤵
  PID:1904
- C:\Windows\System\FQSEUtX.exe
  C:\Windows\System\FQSEUtX.exe
  2⤵
  PID:1416
- C:\Windows\System\YSSMPLk.exe
  C:\Windows\System\YSSMPLk.exe
  2⤵
  PID:2036
- C:\Windows\System\fBvXwxq.exe
  C:\Windows\System\fBvXwxq.exe
  2⤵
  PID:1204
- C:\Windows\System\gEVmDIU.exe
  C:\Windows\System\gEVmDIU.exe
  2⤵
  PID:2568
- C:\Windows\System\ibllaoP.exe
  C:\Windows\System\ibllaoP.exe
  2⤵
  PID:2208
- C:\Windows\System\jeLyGGu.exe
  C:\Windows\System\jeLyGGu.exe
  2⤵
  PID:648
- C:\Windows\System\flSKfSs.exe
  C:\Windows\System\flSKfSs.exe
  2⤵
  PID:2604
- C:\Windows\System\ZjkjIfl.exe
  C:\Windows\System\ZjkjIfl.exe
  2⤵
  PID:1140
- C:\Windows\System\negROLA.exe
  C:\Windows\System\negROLA.exe
  2⤵
  PID:1800
- C:\Windows\System\PPGmKxa.exe
  C:\Windows\System\PPGmKxa.exe
  2⤵
  PID:780
- C:\Windows\System\dffqmVs.exe
  C:\Windows\System\dffqmVs.exe
  2⤵
  PID:2328
- C:\Windows\System\WjODvYn.exe
  C:\Windows\System\WjODvYn.exe
  2⤵
  PID:1652
- C:\Windows\System\heoZEma.exe
  C:\Windows\System\heoZEma.exe
  2⤵
  PID:2224
- C:\Windows\System\yJIYQeh.exe
  C:\Windows\System\yJIYQeh.exe
  2⤵
  PID:2616
- C:\Windows\System\ZSlcaUG.exe
  C:\Windows\System\ZSlcaUG.exe
  2⤵
  PID:1472
- C:\Windows\System\zDgMRWa.exe
  C:\Windows\System\zDgMRWa.exe
  2⤵
  PID:3084
- C:\Windows\System\KHyfEhn.exe
  C:\Windows\System\KHyfEhn.exe
  2⤵
  PID:3100
- C:\Windows\System\eGzgggx.exe
  C:\Windows\System\eGzgggx.exe
  2⤵
  PID:3128
- C:\Windows\System\xzBeVJM.exe
  C:\Windows\System\xzBeVJM.exe
  2⤵
  PID:3148
- C:\Windows\System\TVljZRq.exe
  C:\Windows\System\TVljZRq.exe
  2⤵
  PID:3164
- C:\Windows\System\kwDaJqR.exe
  C:\Windows\System\kwDaJqR.exe
  2⤵
  PID:3180
- C:\Windows\System\GViDjUi.exe
  C:\Windows\System\GViDjUi.exe
  2⤵
  PID:3200
- C:\Windows\System\bxpvZpt.exe
  C:\Windows\System\bxpvZpt.exe
  2⤵
  PID:3216
- C:\Windows\System\DAfEMhI.exe
  C:\Windows\System\DAfEMhI.exe
  2⤵
  PID:3232
- C:\Windows\System\kznoNPy.exe
  C:\Windows\System\kznoNPy.exe
  2⤵
  PID:3248
- C:\Windows\System\nMmUXTh.exe
  C:\Windows\System\nMmUXTh.exe
  2⤵
  PID:3264
- C:\Windows\System\tswQxEy.exe
  C:\Windows\System\tswQxEy.exe
  2⤵
  PID:3280
- C:\Windows\System\pyCwjPX.exe
  C:\Windows\System\pyCwjPX.exe
  2⤵
  PID:3296
- C:\Windows\System\DwQFUAV.exe
  C:\Windows\System\DwQFUAV.exe
  2⤵
  PID:3312
- C:\Windows\System\bvSUIRi.exe
  C:\Windows\System\bvSUIRi.exe
  2⤵
  PID:3328
- C:\Windows\System\VUEuJTM.exe
  C:\Windows\System\VUEuJTM.exe
  2⤵
  PID:3344
- C:\Windows\System\diRssui.exe
  C:\Windows\System\diRssui.exe
  2⤵
  PID:3360
- C:\Windows\System\ieUHsUK.exe
  C:\Windows\System\ieUHsUK.exe
  2⤵
  PID:3384
- C:\Windows\System\htdtTTt.exe
  C:\Windows\System\htdtTTt.exe
  2⤵
  PID:3400
- C:\Windows\System\pxdylzg.exe
  C:\Windows\System\pxdylzg.exe
  2⤵
  PID:3416
- C:\Windows\System\KwEBYjh.exe
  C:\Windows\System\KwEBYjh.exe
  2⤵
  PID:3432
- C:\Windows\System\gemaJFw.exe
  C:\Windows\System\gemaJFw.exe
  2⤵
  PID:3452
- C:\Windows\System\BHWygTl.exe
  C:\Windows\System\BHWygTl.exe
  2⤵
  PID:3468
- C:\Windows\System\RdzEamu.exe
  C:\Windows\System\RdzEamu.exe
  2⤵
  PID:3484
- C:\Windows\System\JYtfaYj.exe
  C:\Windows\System\JYtfaYj.exe
  2⤵
  PID:3500
- C:\Windows\System\ItLLDIv.exe
  C:\Windows\System\ItLLDIv.exe
  2⤵
  PID:3516
- C:\Windows\System\pzGpNIQ.exe
  C:\Windows\System\pzGpNIQ.exe
  2⤵
  PID:3532
- C:\Windows\System\UkBOcLa.exe
  C:\Windows\System\UkBOcLa.exe
  2⤵
  PID:3552
- C:\Windows\System\EkSbnOc.exe
  C:\Windows\System\EkSbnOc.exe
  2⤵
  PID:3568
- C:\Windows\System\mbQZVYb.exe
  C:\Windows\System\mbQZVYb.exe
  2⤵
  PID:3584
- C:\Windows\System\slTBiOW.exe
  C:\Windows\System\slTBiOW.exe
  2⤵
  PID:3600
- C:\Windows\System\PFtymll.exe
  C:\Windows\System\PFtymll.exe
  2⤵
  PID:3616
- C:\Windows\System\KzCHdKq.exe
  C:\Windows\System\KzCHdKq.exe
  2⤵
  PID:3632
- C:\Windows\System\udMFmfA.exe
  C:\Windows\System\udMFmfA.exe
  2⤵
  PID:3648
- C:\Windows\System\SFTBHvJ.exe
  C:\Windows\System\SFTBHvJ.exe
  2⤵
  PID:3664
- C:\Windows\System\tfpHgSy.exe
  C:\Windows\System\tfpHgSy.exe
  2⤵
  PID:3680
- C:\Windows\System\mWUfUNS.exe
  C:\Windows\System\mWUfUNS.exe
  2⤵
  PID:3696
- C:\Windows\System\jKQrBdE.exe
  C:\Windows\System\jKQrBdE.exe
  2⤵
  PID:3716
- C:\Windows\System\KMyLHTs.exe
  C:\Windows\System\KMyLHTs.exe
  2⤵
  PID:3732
- C:\Windows\System\ZZvOIVa.exe
  C:\Windows\System\ZZvOIVa.exe
  2⤵
  PID:3748
- C:\Windows\System\VvjlAEK.exe
  C:\Windows\System\VvjlAEK.exe
  2⤵
  PID:3764
- C:\Windows\System\EgDMqCk.exe
  C:\Windows\System\EgDMqCk.exe
  2⤵
  PID:3780
- C:\Windows\System\kRvcYjY.exe
  C:\Windows\System\kRvcYjY.exe
  2⤵
  PID:3956
- C:\Windows\System\OsTsNAY.exe
  C:\Windows\System\OsTsNAY.exe
  2⤵
  PID:3980
- C:\Windows\System\olgOLLo.exe
  C:\Windows\System\olgOLLo.exe
  2⤵
  PID:4012
- C:\Windows\System\eYbJxFv.exe
  C:\Windows\System\eYbJxFv.exe
  2⤵
  PID:4044
- C:\Windows\System\EJAdOyQ.exe
  C:\Windows\System\EJAdOyQ.exe
  2⤵
  PID:4064
- C:\Windows\System\InHUWjQ.exe
  C:\Windows\System\InHUWjQ.exe
  2⤵
  PID:1568
- C:\Windows\System\bXOSkOU.exe
  C:\Windows\System\bXOSkOU.exe
  2⤵
  PID:2664
- C:\Windows\System\ycTVSei.exe
  C:\Windows\System\ycTVSei.exe
  2⤵
  PID:1624
- C:\Windows\System\yPJjHgH.exe
  C:\Windows\System\yPJjHgH.exe
  2⤵
  PID:3176
- C:\Windows\System\GVKcniZ.exe
  C:\Windows\System\GVKcniZ.exe
  2⤵
  PID:3340
- C:\Windows\System\dcFWCNQ.exe
  C:\Windows\System\dcFWCNQ.exe
  2⤵
  PID:3412
- C:\Windows\System\UIIzmqn.exe
  C:\Windows\System\UIIzmqn.exe
  2⤵
  PID:3440
- C:\Windows\System\hTWUJdC.exe
  C:\Windows\System\hTWUJdC.exe
  2⤵
  PID:3480
- C:\Windows\System\OmiqHZV.exe
  C:\Windows\System\OmiqHZV.exe
  2⤵
  PID:3544
- C:\Windows\System\PUUxieX.exe
  C:\Windows\System\PUUxieX.exe
  2⤵
  PID:3644
- C:\Windows\System\YFlqZVZ.exe
  C:\Windows\System\YFlqZVZ.exe
  2⤵
  PID:3744
- C:\Windows\System\aZpAjXs.exe
  C:\Windows\System\aZpAjXs.exe
  2⤵
  PID:1044
- C:\Windows\System\RQNAVrT.exe
  C:\Windows\System\RQNAVrT.exe
  2⤵
  PID:1448
- C:\Windows\System\RSlLdDE.exe
  C:\Windows\System\RSlLdDE.exe
  2⤵
  PID:2888
- C:\Windows\System\FHuqSAu.exe
  C:\Windows\System\FHuqSAu.exe
  2⤵
  PID:3076
- C:\Windows\System\TUUMujs.exe
  C:\Windows\System\TUUMujs.exe
  2⤵
  PID:3968
- C:\Windows\System\eICXwbO.exe
  C:\Windows\System\eICXwbO.exe
  2⤵
  PID:4036
- C:\Windows\System\hAoMWIC.exe
  C:\Windows\System\hAoMWIC.exe
  2⤵
  PID:4084
- C:\Windows\System\StSwSmm.exe
  C:\Windows\System\StSwSmm.exe
  2⤵
  PID:3628
- C:\Windows\System\ohgIwOr.exe
  C:\Windows\System\ohgIwOr.exe
  2⤵
  PID:2744
- C:\Windows\System\iVGZWsl.exe
  C:\Windows\System\iVGZWsl.exe
  2⤵
  PID:1424
- C:\Windows\System\tpjyClg.exe
  C:\Windows\System\tpjyClg.exe
  2⤵
  PID:1564
- C:\Windows\System\JMIudOf.exe
  C:\Windows\System\JMIudOf.exe
  2⤵
  PID:2680
- C:\Windows\System\zQCSwdH.exe
  C:\Windows\System\zQCSwdH.exe
  2⤵
  PID:1532
- C:\Windows\System\EVRWDeb.exe
  C:\Windows\System\EVRWDeb.exe
  2⤵
  PID:600
- C:\Windows\System\pJKlqfA.exe
  C:\Windows\System\pJKlqfA.exe
  2⤵
  PID:3112
- C:\Windows\System\uFoOxXI.exe
  C:\Windows\System\uFoOxXI.exe
  2⤵
  PID:3188
- C:\Windows\System\lzABjwV.exe
  C:\Windows\System\lzABjwV.exe
  2⤵
  PID:3228
- C:\Windows\System\vUjjeXy.exe
  C:\Windows\System\vUjjeXy.exe
  2⤵
  PID:3320
- C:\Windows\System\DabJwrO.exe
  C:\Windows\System\DabJwrO.exe
  2⤵
  PID:3428
- C:\Windows\System\ytyJjFJ.exe
  C:\Windows\System\ytyJjFJ.exe
  2⤵
  PID:3528
- C:\Windows\System\VImkwqR.exe
  C:\Windows\System\VImkwqR.exe
  2⤵
  PID:3596
- C:\Windows\System\mkwKPjI.exe
  C:\Windows\System\mkwKPjI.exe
  2⤵
  PID:3724
- C:\Windows\System\nwZMaUj.exe
  C:\Windows\System\nwZMaUj.exe
  2⤵
  PID:3800
- C:\Windows\System\gjQWkfp.exe
  C:\Windows\System\gjQWkfp.exe
  2⤵
  PID:3816
- C:\Windows\System\cIMLobp.exe
  C:\Windows\System\cIMLobp.exe
  2⤵
  PID:3832
- C:\Windows\System\LdfcQtO.exe
  C:\Windows\System\LdfcQtO.exe
  2⤵
  PID:3848
- C:\Windows\System\hbGBmZn.exe
  C:\Windows\System\hbGBmZn.exe
  2⤵
  PID:3864
- C:\Windows\System\yEgRCwv.exe
  C:\Windows\System\yEgRCwv.exe
  2⤵
  PID:3912
- C:\Windows\System\BqxMOOG.exe
  C:\Windows\System\BqxMOOG.exe
  2⤵
  PID:3932
- C:\Windows\System\aIirQbL.exe
  C:\Windows\System\aIirQbL.exe
  2⤵
  PID:3948
- C:\Windows\System\ZzdoOex.exe
  C:\Windows\System\ZzdoOex.exe
  2⤵
  PID:3996
- C:\Windows\System\EXpkWTv.exe
  C:\Windows\System\EXpkWTv.exe
  2⤵
  PID:4052
- C:\Windows\System\DdjDKKM.exe
  C:\Windows\System\DdjDKKM.exe
  2⤵
  PID:2044
- C:\Windows\System\pTzvKkP.exe
  C:\Windows\System\pTzvKkP.exe
  2⤵
  PID:3092
- C:\Windows\System\YowiGIx.exe
  C:\Windows\System\YowiGIx.exe
  2⤵
  PID:2272
- C:\Windows\System\vKaZSVd.exe
  C:\Windows\System\vKaZSVd.exe
  2⤵
  PID:1940
- C:\Windows\System\NpurBtU.exe
  C:\Windows\System\NpurBtU.exe
  2⤵
  PID:3272
- C:\Windows\System\mirdLkn.exe
  C:\Windows\System\mirdLkn.exe
  2⤵
  PID:3336
- C:\Windows\System\HsZJTBd.exe
  C:\Windows\System\HsZJTBd.exe
  2⤵
  PID:3576
- C:\Windows\System\vcrcmKH.exe
  C:\Windows\System\vcrcmKH.exe
  2⤵
  PID:3580
- C:\Windows\System\suYmQLI.exe
  C:\Windows\System\suYmQLI.exe
  2⤵
  PID:3776
- C:\Windows\System\SCdDfGD.exe
  C:\Windows\System\SCdDfGD.exe
  2⤵
  PID:2584
- C:\Windows\System\AKLKNyC.exe
  C:\Windows\System\AKLKNyC.exe
  2⤵
  PID:3712
- C:\Windows\System\IOgTWGy.exe
  C:\Windows\System\IOgTWGy.exe
  2⤵
  PID:3676
- C:\Windows\System\oKHRfjW.exe
  C:\Windows\System\oKHRfjW.exe
  2⤵
  PID:1260
- C:\Windows\System\rbjnoFk.exe
  C:\Windows\System\rbjnoFk.exe
  2⤵
  PID:968
- C:\Windows\System\qrWEVFg.exe
  C:\Windows\System\qrWEVFg.exe
  2⤵
  PID:4024
- C:\Windows\System\BRlNGiQ.exe
  C:\Windows\System\BRlNGiQ.exe
  2⤵
  PID:1576
- C:\Windows\System\sgJlgMP.exe
  C:\Windows\System\sgJlgMP.exe
  2⤵
  PID:2952
- C:\Windows\System\xCfppGO.exe
  C:\Windows\System\xCfppGO.exe
  2⤵
  PID:3756
- C:\Windows\System\jHNUPNs.exe
  C:\Windows\System\jHNUPNs.exe
  2⤵
  PID:2060
- C:\Windows\System\DYcQGoN.exe
  C:\Windows\System\DYcQGoN.exe
  2⤵
  PID:3392
- C:\Windows\System\OeLRKJv.exe
  C:\Windows\System\OeLRKJv.exe
  2⤵
  PID:3788
- C:\Windows\System\jTknAwT.exe
  C:\Windows\System\jTknAwT.exe
  2⤵
  PID:3156
- C:\Windows\System\FyhDPmP.exe
  C:\Windows\System\FyhDPmP.exe
  2⤵
  PID:3260
- C:\Windows\System\BfmqsAy.exe
  C:\Windows\System\BfmqsAy.exe
  2⤵
  PID:3396
- C:\Windows\System\CTWfaTH.exe
  C:\Windows\System\CTWfaTH.exe
  2⤵
  PID:3492
- C:\Windows\System\QRqTifa.exe
  C:\Windows\System\QRqTifa.exe
  2⤵
  PID:3808
- C:\Windows\System\fWEOUro.exe
  C:\Windows\System\fWEOUro.exe
  2⤵
  PID:3988
- C:\Windows\System\KWMPBrN.exe
  C:\Windows\System\KWMPBrN.exe
  2⤵
  PID:3992
- C:\Windows\System\TtWRiAk.exe
  C:\Windows\System\TtWRiAk.exe
  2⤵
  PID:1936
- C:\Windows\System\gOQHfVP.exe
  C:\Windows\System\gOQHfVP.exe
  2⤵
  PID:3376
- C:\Windows\System\higNeQf.exe
  C:\Windows\System\higNeQf.exe
  2⤵
  PID:3704
- C:\Windows\System\jrtmHtj.exe
  C:\Windows\System\jrtmHtj.exe
  2⤵
  PID:3876
- C:\Windows\System\nXTeIiX.exe
  C:\Windows\System\nXTeIiX.exe
  2⤵
  PID:4032
- C:\Windows\System\AOHMWkB.exe
  C:\Windows\System\AOHMWkB.exe
  2⤵
  PID:2972
- C:\Windows\System\CkyXmct.exe
  C:\Windows\System\CkyXmct.exe
  2⤵
  PID:3976
- C:\Windows\System\MRddpZy.exe
  C:\Windows\System\MRddpZy.exe
  2⤵
  PID:4008
- C:\Windows\System\VNtuGzt.exe
  C:\Windows\System\VNtuGzt.exe
  2⤵
  PID:2348
- C:\Windows\System\EddixUa.exe
  C:\Windows\System\EddixUa.exe
  2⤵
  PID:3884
- C:\Windows\System\OpUnESI.exe
  C:\Windows\System\OpUnESI.exe
  2⤵
  PID:3880
- C:\Windows\System\UmUtYkl.exe
  C:\Windows\System\UmUtYkl.exe
  2⤵
  PID:3920
- C:\Windows\System\DDBUcEy.exe
  C:\Windows\System\DDBUcEy.exe
  2⤵
  PID:2600
- C:\Windows\System\MFpZlGB.exe
  C:\Windows\System\MFpZlGB.exe
  2⤵
  PID:3908
- C:\Windows\System\SprJbqH.exe
  C:\Windows\System\SprJbqH.exe
  2⤵
  PID:3476
- C:\Windows\System\ORaHbJo.exe
  C:\Windows\System\ORaHbJo.exe
  2⤵
  PID:3036
- C:\Windows\System\jJnYvkn.exe
  C:\Windows\System\jJnYvkn.exe
  2⤵
  PID:3872
- C:\Windows\System\vEIQpoK.exe
  C:\Windows\System\vEIQpoK.exe
  2⤵
  PID:3244
- C:\Windows\System\bnJziUk.exe
  C:\Windows\System\bnJziUk.exe
  2⤵
  PID:2740
- C:\Windows\System\mSrwlse.exe
  C:\Windows\System\mSrwlse.exe
  2⤵
  PID:3860
- C:\Windows\System\RdTGLSi.exe
  C:\Windows\System\RdTGLSi.exe
  2⤵
  PID:3828
- C:\Windows\System\gdWPxJi.exe
  C:\Windows\System\gdWPxJi.exe
  2⤵
  PID:3352
- C:\Windows\System\sifZGsf.exe
  C:\Windows\System\sifZGsf.exe
  2⤵
  PID:3108
- C:\Windows\System\dUPnXIB.exe
  C:\Windows\System\dUPnXIB.exe
  2⤵
  PID:3900
- C:\Windows\System\sFvWpuf.exe
  C:\Windows\System\sFvWpuf.exe
  2⤵
  PID:3304
- C:\Windows\System\YEvZxdl.exe
  C:\Windows\System\YEvZxdl.exe
  2⤵
  PID:2456
- C:\Windows\System\gXmSGlG.exe
  C:\Windows\System\gXmSGlG.exe
  2⤵
  PID:3592
- C:\Windows\System\MEKqrwd.exe
  C:\Windows\System\MEKqrwd.exe
  2⤵
  PID:3760
- C:\Windows\System\RNsUZYx.exe
  C:\Windows\System\RNsUZYx.exe
  2⤵
  PID:3824
- C:\Windows\System\VOVNJHa.exe
  C:\Windows\System\VOVNJHa.exe
  2⤵
  PID:3288
- C:\Windows\System\GlutUbq.exe
  C:\Windows\System\GlutUbq.exe
  2⤵
  PID:3224
- C:\Windows\System\MeeBBfZ.exe
  C:\Windows\System\MeeBBfZ.exe
  2⤵
  PID:3512
- C:\Windows\System\drhDhwt.exe
  C:\Windows\System\drhDhwt.exe
  2⤵
  PID:704
- C:\Windows\System\IBANpWJ.exe
  C:\Windows\System\IBANpWJ.exe
  2⤵
  PID:3692
- C:\Windows\System\FcxTMwv.exe
  C:\Windows\System\FcxTMwv.exe
  2⤵
  PID:1464
- C:\Windows\System\OJGZMbv.exe
  C:\Windows\System\OJGZMbv.exe
  2⤵
  PID:2380
- C:\Windows\System\HerJOVt.exe
  C:\Windows\System\HerJOVt.exe
  2⤵
  PID:1636
- C:\Windows\System\mYiHRNS.exe
  C:\Windows\System\mYiHRNS.exe
  2⤵
  PID:3056
- C:\Windows\System\qcpcRnS.exe
  C:\Windows\System\qcpcRnS.exe
  2⤵
  PID:3308
- C:\Windows\System\YLxnkSd.exe
  C:\Windows\System\YLxnkSd.exe
  2⤵
  PID:904
- C:\Windows\System\GSRaerA.exe
  C:\Windows\System\GSRaerA.exe
  2⤵
  PID:4120
- C:\Windows\System\LbTEQBO.exe
  C:\Windows\System\LbTEQBO.exe
  2⤵
  PID:4140
- C:\Windows\System\gXHQOEj.exe
  C:\Windows\System\gXHQOEj.exe
  2⤵
  PID:4160
- C:\Windows\System\SjskuHG.exe
  C:\Windows\System\SjskuHG.exe
  2⤵
  PID:4180
- C:\Windows\System\AhjQWEj.exe
  C:\Windows\System\AhjQWEj.exe
  2⤵
  PID:4200
- C:\Windows\System\HSVVzCy.exe
  C:\Windows\System\HSVVzCy.exe
  2⤵
  PID:4220
- C:\Windows\System\fRpZSMf.exe
  C:\Windows\System\fRpZSMf.exe
  2⤵
  PID:4236
- C:\Windows\System\AwUJYny.exe
  C:\Windows\System\AwUJYny.exe
  2⤵
  PID:4256
- C:\Windows\System\mVgSZyM.exe
  C:\Windows\System\mVgSZyM.exe
  2⤵
  PID:4272
- C:\Windows\System\LUNDvir.exe
  C:\Windows\System\LUNDvir.exe
  2⤵
  PID:4300
- C:\Windows\System\pYJtUCd.exe
  C:\Windows\System\pYJtUCd.exe
  2⤵
  PID:4320
- C:\Windows\System\QKxIJsV.exe
  C:\Windows\System\QKxIJsV.exe
  2⤵
  PID:4336
- C:\Windows\System\nmqenjC.exe
  C:\Windows\System\nmqenjC.exe
  2⤵
  PID:4352
- C:\Windows\System\MJadfYz.exe
  C:\Windows\System\MJadfYz.exe
  2⤵
  PID:4372
- C:\Windows\System\VUVzuYF.exe
  C:\Windows\System\VUVzuYF.exe
  2⤵
  PID:4388
- C:\Windows\System\IRLdJMZ.exe
  C:\Windows\System\IRLdJMZ.exe
  2⤵
  PID:4404
- C:\Windows\System\YtaIluc.exe
  C:\Windows\System\YtaIluc.exe
  2⤵
  PID:4420
- C:\Windows\System\RrInuuS.exe
  C:\Windows\System\RrInuuS.exe
  2⤵
  PID:4436
- C:\Windows\System\GigeXlu.exe
  C:\Windows\System\GigeXlu.exe
  2⤵
  PID:4452
- C:\Windows\System\pGIgqjC.exe
  C:\Windows\System\pGIgqjC.exe
  2⤵
  PID:4468
- C:\Windows\System\UeerlKj.exe
  C:\Windows\System\UeerlKj.exe
  2⤵
  PID:4504
- C:\Windows\System\CLPJkea.exe
  C:\Windows\System\CLPJkea.exe
  2⤵
  PID:4520
- C:\Windows\System\SUZjeyp.exe
  C:\Windows\System\SUZjeyp.exe
  2⤵
  PID:4552
- C:\Windows\System\wtJlYLW.exe
  C:\Windows\System\wtJlYLW.exe
  2⤵
  PID:4580
- C:\Windows\System\hMnggyB.exe
  C:\Windows\System\hMnggyB.exe
  2⤵
  PID:4600
- C:\Windows\System\eVtTDGV.exe
  C:\Windows\System\eVtTDGV.exe
  2⤵
  PID:4616
- C:\Windows\System\jJhGHKF.exe
  C:\Windows\System\jJhGHKF.exe
  2⤵
  PID:4644
- C:\Windows\System\UYvYNKS.exe
  C:\Windows\System\UYvYNKS.exe
  2⤵
  PID:4696
- C:\Windows\System\CjcQclu.exe
  C:\Windows\System\CjcQclu.exe
  2⤵
  PID:4712
- C:\Windows\System\PCebwIt.exe
  C:\Windows\System\PCebwIt.exe
  2⤵
  PID:4728
- C:\Windows\System\IcKUnpa.exe
  C:\Windows\System\IcKUnpa.exe
  2⤵
  PID:4760
- C:\Windows\System\bgwPSgQ.exe
  C:\Windows\System\bgwPSgQ.exe
  2⤵
  PID:4776
- C:\Windows\System\CCGqwXp.exe
  C:\Windows\System\CCGqwXp.exe
  2⤵
  PID:4792
- C:\Windows\System\kVWlBBT.exe
  C:\Windows\System\kVWlBBT.exe
  2⤵
  PID:4808
- C:\Windows\System\axqAgKl.exe
  C:\Windows\System\axqAgKl.exe
  2⤵
  PID:4824
- C:\Windows\System\gKtjZQU.exe
  C:\Windows\System\gKtjZQU.exe
  2⤵
  PID:4840
- C:\Windows\System\kwToSoi.exe
  C:\Windows\System\kwToSoi.exe
  2⤵
  PID:4856
- C:\Windows\System\wiXoWHU.exe
  C:\Windows\System\wiXoWHU.exe
  2⤵
  PID:4872
- C:\Windows\System\UjOxgha.exe
  C:\Windows\System\UjOxgha.exe
  2⤵
  PID:4888
- C:\Windows\System\LHxKqrw.exe
  C:\Windows\System\LHxKqrw.exe
  2⤵
  PID:4904
- C:\Windows\System\WeZPUbJ.exe
  C:\Windows\System\WeZPUbJ.exe
  2⤵
  PID:4924
- C:\Windows\System\vbSzTYV.exe
  C:\Windows\System\vbSzTYV.exe
  2⤵
  PID:4940
- C:\Windows\System\VDyXrsO.exe
  C:\Windows\System\VDyXrsO.exe
  2⤵
  PID:4960
- C:\Windows\System\XSlGAGR.exe
  C:\Windows\System\XSlGAGR.exe
  2⤵
  PID:4980
- C:\Windows\System\eeubSxL.exe
  C:\Windows\System\eeubSxL.exe
  2⤵
  PID:5000
- C:\Windows\System\EGfOCaA.exe
  C:\Windows\System\EGfOCaA.exe
  2⤵
  PID:5016
- C:\Windows\System\yYGWCCz.exe
  C:\Windows\System\yYGWCCz.exe
  2⤵
  PID:5036
- C:\Windows\System\komrlfy.exe
  C:\Windows\System\komrlfy.exe
  2⤵
  PID:5056
- C:\Windows\System\FEMVwBQ.exe
  C:\Windows\System\FEMVwBQ.exe
  2⤵
  PID:5084
- C:\Windows\System\VHAxLEa.exe
  C:\Windows\System\VHAxLEa.exe
  2⤵
  PID:4148
- C:\Windows\System\iHTPnRk.exe
  C:\Windows\System\iHTPnRk.exe
  2⤵
  PID:4172
- C:\Windows\System\FQUtPVy.exe
  C:\Windows\System\FQUtPVy.exe
  2⤵
  PID:4196
- C:\Windows\System\XqUeSat.exe
  C:\Windows\System\XqUeSat.exe
  2⤵
  PID:4264
- C:\Windows\System\DcwDTzN.exe
  C:\Windows\System\DcwDTzN.exe
  2⤵
  PID:4252
- C:\Windows\System\gWRiRjp.exe
  C:\Windows\System\gWRiRjp.exe
  2⤵
  PID:4284
- C:\Windows\System\RKJgyoZ.exe
  C:\Windows\System\RKJgyoZ.exe
  2⤵
  PID:4380
- C:\Windows\System\MhWtean.exe
  C:\Windows\System\MhWtean.exe
  2⤵
  PID:4460
- C:\Windows\System\oxMkflX.exe
  C:\Windows\System\oxMkflX.exe
  2⤵
  PID:4396
- C:\Windows\System\EhyQYFS.exe
  C:\Windows\System\EhyQYFS.exe
  2⤵
  PID:4512
- C:\Windows\System\yuGyatc.exe
  C:\Windows\System\yuGyatc.exe
  2⤵
  PID:4516
- C:\Windows\System\oGZTuOi.exe
  C:\Windows\System\oGZTuOi.exe
  2⤵
  PID:4548
- C:\Windows\System\OKZYiVs.exe
  C:\Windows\System\OKZYiVs.exe
  2⤵
  PID:4568
- C:\Windows\System\JagPEPp.exe
  C:\Windows\System\JagPEPp.exe
  2⤵
  PID:4612
- C:\Windows\System\cRRcoFZ.exe
  C:\Windows\System\cRRcoFZ.exe
  2⤵
  PID:4596
- C:\Windows\System\DpknFsY.exe
  C:\Windows\System\DpknFsY.exe
  2⤵
  PID:4636
- C:\Windows\System\COOThzR.exe
  C:\Windows\System\COOThzR.exe
  2⤵
  PID:4688
- C:\Windows\System\MffGLWn.exe
  C:\Windows\System\MffGLWn.exe
  2⤵
  PID:4736
- C:\Windows\System\zJofhtO.exe
  C:\Windows\System\zJofhtO.exe
  2⤵
  PID:4748
- C:\Windows\System\CkVSeLP.exe
  C:\Windows\System\CkVSeLP.exe
  2⤵
  PID:4784
- C:\Windows\System\swDpEUU.exe
  C:\Windows\System\swDpEUU.exe
  2⤵
  PID:4848
- C:\Windows\System\cHiEyHA.exe
  C:\Windows\System\cHiEyHA.exe
  2⤵
  PID:4800
- C:\Windows\System\dzpGQmN.exe
  C:\Windows\System\dzpGQmN.exe
  2⤵
  PID:4864
- C:\Windows\System\PhSAYsr.exe
  C:\Windows\System\PhSAYsr.exe
  2⤵
  PID:4676
- C:\Windows\System\sBGcTvr.exe
  C:\Windows\System\sBGcTvr.exe
  2⤵
  PID:4996
- C:\Windows\System\diiRwiI.exe
  C:\Windows\System\diiRwiI.exe
  2⤵
  PID:4956
- C:\Windows\System\kBpaoTu.exe
  C:\Windows\System\kBpaoTu.exe
  2⤵
  PID:4920
- C:\Windows\System\ezCDaSe.exe
  C:\Windows\System\ezCDaSe.exe
  2⤵
  PID:5044
- C:\Windows\System\qJjDjYi.exe
  C:\Windows\System\qJjDjYi.exe
  2⤵
  PID:4988
- C:\Windows\System\bMChgsS.exe
  C:\Windows\System\bMChgsS.exe
  2⤵
  PID:5068
- C:\Windows\System\lLNYBSY.exe
  C:\Windows\System\lLNYBSY.exe
  2⤵
  PID:5104
- C:\Windows\System\WkWpUXw.exe
  C:\Windows\System\WkWpUXw.exe
  2⤵
  PID:4136
- C:\Windows\System\QBPjPKd.exe
  C:\Windows\System\QBPjPKd.exe
  2⤵
  PID:4176
- C:\Windows\System\nfgQmyH.exe
  C:\Windows\System\nfgQmyH.exe
  2⤵
  PID:4288
- C:\Windows\System\vEZdnTX.exe
  C:\Windows\System\vEZdnTX.exe
  2⤵
  PID:4116
- C:\Windows\System\LlNjQyU.exe
  C:\Windows\System\LlNjQyU.exe
  2⤵
  PID:4192
- C:\Windows\System\IVoMLIc.exe
  C:\Windows\System\IVoMLIc.exe
  2⤵
  PID:4312
- C:\Windows\System\npJLDmm.exe
  C:\Windows\System\npJLDmm.exe
  2⤵
  PID:4348
- C:\Windows\System\thiBqWy.exe
  C:\Windows\System\thiBqWy.exe
  2⤵
  PID:4412
- C:\Windows\System\nVkQkPp.exe
  C:\Windows\System\nVkQkPp.exe
  2⤵
  PID:4368
- C:\Windows\System\jvNUiwU.exe
  C:\Windows\System\jvNUiwU.exe
  2⤵
  PID:4432
- C:\Windows\System\pZKuNuC.exe
  C:\Windows\System\pZKuNuC.exe
  2⤵
  PID:4532
- C:\Windows\System\bdrNXUp.exe
  C:\Windows\System\bdrNXUp.exe
  2⤵
  PID:4560
- C:\Windows\System\abgaEmi.exe
  C:\Windows\System\abgaEmi.exe
  2⤵
  PID:4588
- C:\Windows\System\JaevskB.exe
  C:\Windows\System\JaevskB.exe
  2⤵
  PID:4948
- C:\Windows\System\osIJMcx.exe
  C:\Windows\System\osIJMcx.exe
  2⤵
  PID:2628
- C:\Windows\System\xNECdLZ.exe
  C:\Windows\System\xNECdLZ.exe
  2⤵
  PID:4500
- C:\Windows\System\yNgBDVY.exe
  C:\Windows\System\yNgBDVY.exe
  2⤵
  PID:2080
- C:\Windows\System\qYKYiAR.exe
  C:\Windows\System\qYKYiAR.exe
  2⤵
  PID:4740
- C:\Windows\System\OJYPmGZ.exe
  C:\Windows\System\OJYPmGZ.exe
  2⤵
  PID:4912
- C:\Windows\System\dGgUesQ.exe
  C:\Windows\System\dGgUesQ.exe
  2⤵
  PID:4932
- C:\Windows\System\DRZExdC.exe
  C:\Windows\System\DRZExdC.exe
  2⤵
  PID:4108
- C:\Windows\System\hUTxpDZ.exe
  C:\Windows\System\hUTxpDZ.exe
  2⤵
  PID:4444
- C:\Windows\System\vlgsExd.exe
  C:\Windows\System\vlgsExd.exe
  2⤵
  PID:4652
- C:\Windows\System\vuwAfkW.exe
  C:\Windows\System\vuwAfkW.exe
  2⤵
  PID:4564
- C:\Windows\System\JpjYGlK.exe
  C:\Windows\System\JpjYGlK.exe
  2⤵
  PID:5080
- C:\Windows\System\RhmqYMd.exe
  C:\Windows\System\RhmqYMd.exe
  2⤵
  PID:5116
- C:\Windows\System\aDSmKbr.exe
  C:\Windows\System\aDSmKbr.exe
  2⤵
  PID:4232
- C:\Windows\System\ChJEKqQ.exe
  C:\Windows\System\ChJEKqQ.exe
  2⤵
  PID:4720
- C:\Windows\System\wDjlZBx.exe
  C:\Windows\System\wDjlZBx.exe
  2⤵
  PID:4832
- C:\Windows\System\otHncqJ.exe
  C:\Windows\System\otHncqJ.exe
  2⤵
  PID:4464
- C:\Windows\System\ROnKHtV.exe
  C:\Windows\System\ROnKHtV.exe
  2⤵
  PID:5132
- C:\Windows\System\SgVhgUT.exe
  C:\Windows\System\SgVhgUT.exe
  2⤵
  PID:5148
- C:\Windows\System\vVLvxIr.exe
  C:\Windows\System\vVLvxIr.exe
  2⤵
  PID:5168
- C:\Windows\System\zVQBIMU.exe
  C:\Windows\System\zVQBIMU.exe
  2⤵
  PID:5184
- C:\Windows\System\jRZBKIU.exe
  C:\Windows\System\jRZBKIU.exe
  2⤵
  PID:5204
- C:\Windows\System\sIElGcn.exe
  C:\Windows\System\sIElGcn.exe
  2⤵
  PID:5220
- C:\Windows\System\HiGEPBj.exe
  C:\Windows\System\HiGEPBj.exe
  2⤵
  PID:5236
- C:\Windows\System\UTMYvPn.exe
  C:\Windows\System\UTMYvPn.exe
  2⤵
  PID:5256
- C:\Windows\System\srmOLIh.exe
  C:\Windows\System\srmOLIh.exe
  2⤵
  PID:5276
- C:\Windows\System\KGUSApI.exe
  C:\Windows\System\KGUSApI.exe
  2⤵
  PID:5292
- C:\Windows\System\cAAVhCk.exe
  C:\Windows\System\cAAVhCk.exe
  2⤵
  PID:5308
- C:\Windows\System\xxzfoSP.exe
  C:\Windows\System\xxzfoSP.exe
  2⤵
  PID:5324
- C:\Windows\System\YssfWdF.exe
  C:\Windows\System\YssfWdF.exe
  2⤵
  PID:5340
- C:\Windows\System\fRkbgsG.exe
  C:\Windows\System\fRkbgsG.exe
  2⤵
  PID:5356
- C:\Windows\System\Hhdtunh.exe
  C:\Windows\System\Hhdtunh.exe
  2⤵
  PID:5376
- C:\Windows\System\WypUpUU.exe
  C:\Windows\System\WypUpUU.exe
  2⤵
  PID:5392
- C:\Windows\System\isSduMn.exe
  C:\Windows\System\isSduMn.exe
  2⤵
  PID:5408
- C:\Windows\System\pwxmWbH.exe
  C:\Windows\System\pwxmWbH.exe
  2⤵
  PID:5424
- C:\Windows\System\HoFjZAO.exe
  C:\Windows\System\HoFjZAO.exe
  2⤵
  PID:5440
- C:\Windows\System\OBjOFzF.exe
  C:\Windows\System\OBjOFzF.exe
  2⤵
  PID:5456
- C:\Windows\System\QbbKRQG.exe
  C:\Windows\System\QbbKRQG.exe
  2⤵
  PID:5476
- C:\Windows\System\xinrcMD.exe
  C:\Windows\System\xinrcMD.exe
  2⤵
  PID:5492
- C:\Windows\System\GueEnKv.exe
  C:\Windows\System\GueEnKv.exe
  2⤵
  PID:5508
- C:\Windows\System\syofECs.exe
  C:\Windows\System\syofECs.exe
  2⤵
  PID:5524
- C:\Windows\System\qgJYezq.exe
  C:\Windows\System\qgJYezq.exe
  2⤵
  PID:5540
- C:\Windows\System\RvnUWRv.exe
  C:\Windows\System\RvnUWRv.exe
  2⤵
  PID:5556
- C:\Windows\System\MOZQNdu.exe
  C:\Windows\System\MOZQNdu.exe
  2⤵
  PID:5576
- C:\Windows\System\ykOhRjL.exe
  C:\Windows\System\ykOhRjL.exe
  2⤵
  PID:5592
- C:\Windows\System\cljeSVC.exe
  C:\Windows\System\cljeSVC.exe
  2⤵
  PID:5608
- C:\Windows\System\VMCEDrU.exe
  C:\Windows\System\VMCEDrU.exe
  2⤵
  PID:5624
- C:\Windows\System\kvgctvm.exe
  C:\Windows\System\kvgctvm.exe
  2⤵
  PID:5644
- C:\Windows\System\obUbEIs.exe
  C:\Windows\System\obUbEIs.exe
  2⤵
  PID:5808
- C:\Windows\System\cvPcfic.exe
  C:\Windows\System\cvPcfic.exe
  2⤵
  PID:5824
- C:\Windows\System\dDFFgTq.exe
  C:\Windows\System\dDFFgTq.exe
  2⤵
  PID:5840
- C:\Windows\System\DpmEeTi.exe
  C:\Windows\System\DpmEeTi.exe
  2⤵
  PID:5856
- C:\Windows\System\FOwcwCt.exe
  C:\Windows\System\FOwcwCt.exe
  2⤵
  PID:5872
- C:\Windows\System\khgTRHD.exe
  C:\Windows\System\khgTRHD.exe
  2⤵
  PID:5896
- C:\Windows\System\LAMnYEd.exe
  C:\Windows\System\LAMnYEd.exe
  2⤵
  PID:5912
- C:\Windows\System\UbDnOwO.exe
  C:\Windows\System\UbDnOwO.exe
  2⤵
  PID:5928
- C:\Windows\System\NReiQuB.exe
  C:\Windows\System\NReiQuB.exe
  2⤵
  PID:5944
- C:\Windows\System\uFMPcwV.exe
  C:\Windows\System\uFMPcwV.exe
  2⤵
  PID:5964
- C:\Windows\System\eSILJxA.exe
  C:\Windows\System\eSILJxA.exe
  2⤵
  PID:5980
- C:\Windows\System\AySDZjr.exe
  C:\Windows\System\AySDZjr.exe
  2⤵
  PID:5996
- C:\Windows\System\xsfxcTv.exe
  C:\Windows\System\xsfxcTv.exe
  2⤵
  PID:6012
- C:\Windows\System\uHIwOyW.exe
  C:\Windows\System\uHIwOyW.exe
  2⤵
  PID:6028
- C:\Windows\System\nkLuNbR.exe
  C:\Windows\System\nkLuNbR.exe
  2⤵
  PID:6044
- C:\Windows\System\cOGZbIm.exe
  C:\Windows\System\cOGZbIm.exe
  2⤵
  PID:6060
- C:\Windows\System\fEKqyGO.exe
  C:\Windows\System\fEKqyGO.exe
  2⤵
  PID:6080
- C:\Windows\System\OYiVUks.exe
  C:\Windows\System\OYiVUks.exe
  2⤵
  PID:6096
- C:\Windows\System\zPlQuZo.exe
  C:\Windows\System\zPlQuZo.exe
  2⤵
  PID:6116
- C:\Windows\System\upDZYnZ.exe
  C:\Windows\System\upDZYnZ.exe
  2⤵
  PID:6132
- C:\Windows\System\lmZfKEb.exe
  C:\Windows\System\lmZfKEb.exe
  2⤵
  PID:4968
- C:\Windows\System\OaeUJsL.exe
  C:\Windows\System\OaeUJsL.exe
  2⤵
  PID:5128
- C:\Windows\System\MsqCbmB.exe
  C:\Windows\System\MsqCbmB.exe
  2⤵
  PID:5192
- C:\Windows\System\fcdcfLP.exe
  C:\Windows\System\fcdcfLP.exe
  2⤵
  PID:5232
- C:\Windows\System\tPntVmR.exe
  C:\Windows\System\tPntVmR.exe
  2⤵
  PID:5304
- C:\Windows\System\JucEUNO.exe
  C:\Windows\System\JucEUNO.exe
  2⤵
  PID:5364
- C:\Windows\System\GzcERQD.exe
  C:\Windows\System\GzcERQD.exe
  2⤵
  PID:5472
- C:\Windows\System\kJmcmeC.exe
  C:\Windows\System\kJmcmeC.exe
  2⤵
  PID:5404
- C:\Windows\System\UiJBUCW.exe
  C:\Windows\System\UiJBUCW.exe
  2⤵
  PID:5504
- C:\Windows\System\npTSfqa.exe
  C:\Windows\System\npTSfqa.exe
  2⤵
  PID:5316
- C:\Windows\System\WPIyxyQ.exe
  C:\Windows\System\WPIyxyQ.exe
  2⤵
  PID:5568
- C:\Windows\System\FaPyvHc.exe
  C:\Windows\System\FaPyvHc.exe
  2⤵
  PID:5632
- C:\Windows\System\cVVrUKE.exe
  C:\Windows\System\cVVrUKE.exe
  2⤵
  PID:4684
- C:\Windows\System\mzfDzlb.exe
  C:\Windows\System\mzfDzlb.exe
  2⤵
  PID:5140
- C:\Windows\System\ECdxtBW.exe
  C:\Windows\System\ECdxtBW.exe
  2⤵
  PID:5664
- C:\Windows\System\oWlTzpl.exe
  C:\Windows\System\oWlTzpl.exe
  2⤵
  PID:4756
- C:\Windows\System\eSmmhpC.exe
  C:\Windows\System\eSmmhpC.exe
  2⤵
  PID:4884
- C:\Windows\System\vHkKzbb.exe
  C:\Windows\System\vHkKzbb.exe
  2⤵
  PID:4972
- C:\Windows\System\omGcgIV.exe
  C:\Windows\System\omGcgIV.exe
  2⤵
  PID:4624
- C:\Windows\System\BmjizNV.exe
  C:\Windows\System\BmjizNV.exe
  2⤵
  PID:5884
- C:\Windows\System\BMsyJWb.exe
  C:\Windows\System\BMsyJWb.exe
  2⤵
  PID:4916
- C:\Windows\System\Wayjjip.exe
  C:\Windows\System\Wayjjip.exe
  2⤵
  PID:4628
- C:\Windows\System\fwYNklJ.exe
  C:\Windows\System\fwYNklJ.exe
  2⤵
  PID:5716
- C:\Windows\System\msyrhyI.exe
  C:\Windows\System\msyrhyI.exe
  2⤵
  PID:5988
- C:\Windows\System\wfEGksy.exe
  C:\Windows\System\wfEGksy.exe
  2⤵
  PID:6052
- C:\Windows\System\ecXkxou.exe
  C:\Windows\System\ecXkxou.exe
  2⤵
  PID:5228
- C:\Windows\System\WIJJdXo.exe
  C:\Windows\System\WIJJdXo.exe
  2⤵
  PID:5924
- C:\Windows\System\kslURyL.exe
  C:\Windows\System\kslURyL.exe
  2⤵
  PID:6124
- C:\Windows\System\KiixKGf.exe
  C:\Windows\System\KiixKGf.exe
  2⤵
  PID:5464
- C:\Windows\System\pEzYcbu.exe
  C:\Windows\System\pEzYcbu.exe
  2⤵
  PID:6292
- C:\Windows\System\AMKDhFg.exe
  C:\Windows\System\AMKDhFg.exe
  2⤵
  PID:6308
- C:\Windows\System\jRKkSnW.exe
  C:\Windows\System\jRKkSnW.exe
  2⤵
  PID:6324
- C:\Windows\System\IvHRNrW.exe
  C:\Windows\System\IvHRNrW.exe
  2⤵
  PID:6340
- C:\Windows\System\MhMEZgI.exe
  C:\Windows\System\MhMEZgI.exe
  2⤵
  PID:6360
- C:\Windows\System\dGgSegE.exe
  C:\Windows\System\dGgSegE.exe
  2⤵
  PID:6376
- C:\Windows\System\zzGevih.exe
  C:\Windows\System\zzGevih.exe
  2⤵
  PID:6392
- C:\Windows\System\MmDjQHz.exe
  C:\Windows\System\MmDjQHz.exe
  2⤵
  PID:6408
- C:\Windows\System\uxivGsZ.exe
  C:\Windows\System\uxivGsZ.exe
  2⤵
  PID:6424
- C:\Windows\System\QYFZFeL.exe
  C:\Windows\System\QYFZFeL.exe
  2⤵
  PID:6444
- C:\Windows\System\RRorUST.exe
  C:\Windows\System\RRorUST.exe
  2⤵
  PID:6460
- C:\Windows\System\PCwaMPc.exe
  C:\Windows\System\PCwaMPc.exe
  2⤵
  PID:6476
- C:\Windows\System\jKseeeH.exe
  C:\Windows\System\jKseeeH.exe
  2⤵
  PID:6492
- C:\Windows\System\MlHjhgq.exe
  C:\Windows\System\MlHjhgq.exe
  2⤵
  PID:6508
- C:\Windows\System\rmCCPpv.exe
  C:\Windows\System\rmCCPpv.exe
  2⤵
  PID:6528
- C:\Windows\System\mpOlnbd.exe
  C:\Windows\System\mpOlnbd.exe
  2⤵
  PID:6544
- C:\Windows\System\ySuzBVe.exe
  C:\Windows\System\ySuzBVe.exe
  2⤵
  PID:6560
- C:\Windows\System\MDhxrbC.exe
  C:\Windows\System\MDhxrbC.exe
  2⤵
  PID:6576
- C:\Windows\System\sHHNFCs.exe
  C:\Windows\System\sHHNFCs.exe
  2⤵
  PID:6592
- C:\Windows\System\jLPghwS.exe
  C:\Windows\System\jLPghwS.exe
  2⤵
  PID:6608
- C:\Windows\System\lcxJnbd.exe
  C:\Windows\System\lcxJnbd.exe
  2⤵
  PID:6624
- C:\Windows\System\ksGtQjn.exe
  C:\Windows\System\ksGtQjn.exe
  2⤵
  PID:6640
- C:\Windows\System\TAHzArQ.exe
  C:\Windows\System\TAHzArQ.exe
  2⤵
  PID:6660
- C:\Windows\System\quJGqyx.exe
  C:\Windows\System\quJGqyx.exe
  2⤵
  PID:6676
- C:\Windows\System\PUpcFmn.exe
  C:\Windows\System\PUpcFmn.exe
  2⤵
  PID:6692
- C:\Windows\System\uYarxip.exe
  C:\Windows\System\uYarxip.exe
  2⤵
  PID:6708
- C:\Windows\System\sRsVhCn.exe
  C:\Windows\System\sRsVhCn.exe
  2⤵
  PID:6724
- C:\Windows\System\pUYeDoD.exe
  C:\Windows\System\pUYeDoD.exe
  2⤵
  PID:6740
- C:\Windows\System\GRTVchE.exe
  C:\Windows\System\GRTVchE.exe
  2⤵
  PID:6756
- C:\Windows\System\kTtgOMG.exe
  C:\Windows\System\kTtgOMG.exe
  2⤵
  PID:6772
- C:\Windows\System\PQuHPHY.exe
  C:\Windows\System\PQuHPHY.exe
  2⤵
  PID:6792
- C:\Windows\System\kTTOVgb.exe
  C:\Windows\System\kTTOVgb.exe
  2⤵
  PID:6808
- C:\Windows\System\SGiGoRv.exe
  C:\Windows\System\SGiGoRv.exe
  2⤵
  PID:6824
- C:\Windows\System\plugczW.exe
  C:\Windows\System\plugczW.exe
  2⤵
  PID:6840
- C:\Windows\System\amWInYl.exe
  C:\Windows\System\amWInYl.exe
  2⤵
  PID:6856
- C:\Windows\System\lTeitoa.exe
  C:\Windows\System\lTeitoa.exe
  2⤵
  PID:6872
- C:\Windows\System\lNNPeiA.exe
  C:\Windows\System\lNNPeiA.exe
  2⤵
  PID:6888
- C:\Windows\System\BCeYrsf.exe
  C:\Windows\System\BCeYrsf.exe
  2⤵
  PID:6904
- C:\Windows\System\BXUklmc.exe
  C:\Windows\System\BXUklmc.exe
  2⤵
  PID:6920
- C:\Windows\System\FjgOfIT.exe
  C:\Windows\System\FjgOfIT.exe
  2⤵
  PID:6936
- C:\Windows\System\HFfDoTT.exe
  C:\Windows\System\HFfDoTT.exe
  2⤵
  PID:6952
- C:\Windows\System\aVVxRET.exe
  C:\Windows\System\aVVxRET.exe
  2⤵
  PID:6968
- C:\Windows\System\vuyCbWJ.exe
  C:\Windows\System\vuyCbWJ.exe
  2⤵
  PID:6984
- C:\Windows\System\GCfkwtj.exe
  C:\Windows\System\GCfkwtj.exe
  2⤵
  PID:7000
- C:\Windows\System\zwpphnI.exe
  C:\Windows\System\zwpphnI.exe
  2⤵
  PID:7016
- C:\Windows\System\owGxzEF.exe
  C:\Windows\System\owGxzEF.exe
  2⤵
  PID:7032
- C:\Windows\System\bdlcdtb.exe
  C:\Windows\System\bdlcdtb.exe
  2⤵
  PID:7048
- C:\Windows\System\YuHICUi.exe
  C:\Windows\System\YuHICUi.exe
  2⤵
  PID:7064
- C:\Windows\System\lfhUvme.exe
  C:\Windows\System\lfhUvme.exe
  2⤵
  PID:7084
- C:\Windows\System\eNBvXFj.exe
  C:\Windows\System\eNBvXFj.exe
  2⤵
  PID:7100
- C:\Windows\System\VEpyviC.exe
  C:\Windows\System\VEpyviC.exe
  2⤵
  PID:7116
- C:\Windows\System\naHuhXN.exe
  C:\Windows\System\naHuhXN.exe
  2⤵
  PID:7136
- C:\Windows\System\InrQRtJ.exe
  C:\Windows\System\InrQRtJ.exe
  2⤵
  PID:7152
- C:\Windows\System\iXoEeZw.exe
  C:\Windows\System\iXoEeZw.exe
  2⤵
  PID:4708
- C:\Windows\System\swKlvaz.exe
  C:\Windows\System\swKlvaz.exe
  2⤵
  PID:5744
- C:\Windows\System\GFZvMpn.exe
  C:\Windows\System\GFZvMpn.exe
  2⤵
  PID:5252
- C:\Windows\System\FJFfQxz.exe
  C:\Windows\System\FJFfQxz.exe
  2⤵
  PID:5352
- C:\Windows\System\HfNKtQC.exe
  C:\Windows\System\HfNKtQC.exe
  2⤵
  PID:5420
- C:\Windows\System\BtBjjhC.exe
  C:\Windows\System\BtBjjhC.exe
  2⤵
  PID:5516
- C:\Windows\System\EZoNwXb.exe
  C:\Windows\System\EZoNwXb.exe
  2⤵
  PID:5584
- C:\Windows\System\lGCPevp.exe
  C:\Windows\System\lGCPevp.exe
  2⤵
  PID:5588
- C:\Windows\System\OKYaOwz.exe
  C:\Windows\System\OKYaOwz.exe
  2⤵
  PID:5660
- C:\Windows\System\OhruwhP.exe
  C:\Windows\System\OhruwhP.exe
  2⤵
  PID:5820
- C:\Windows\System\RLPRckl.exe
  C:\Windows\System\RLPRckl.exe
  2⤵
  PID:6212
- C:\Windows\System\dMSDSGK.exe
  C:\Windows\System\dMSDSGK.exe
  2⤵
  PID:6188
- C:\Windows\System\UWMSymP.exe
  C:\Windows\System\UWMSymP.exe
  2⤵
  PID:6172
- C:\Windows\System\XuvcKyt.exe
  C:\Windows\System\XuvcKyt.exe
  2⤵
  PID:6152
- C:\Windows\System\MIWpYoT.exe
  C:\Windows\System\MIWpYoT.exe
  2⤵
  PID:5112
- C:\Windows\System\LAJFnPw.exe
  C:\Windows\System\LAJFnPw.exe
  2⤵
  PID:5852
- C:\Windows\System\ipUaJRZ.exe
  C:\Windows\System\ipUaJRZ.exe
  2⤵
  PID:5848
- C:\Windows\System\qXglqQa.exe
  C:\Windows\System\qXglqQa.exe
  2⤵
  PID:5688
- C:\Windows\System\IHGdXLF.exe
  C:\Windows\System\IHGdXLF.exe
  2⤵
  PID:5708
- C:\Windows\System\soXnxeY.exe
  C:\Windows\System\soXnxeY.exe
  2⤵
  PID:6220
- C:\Windows\System\DeYUaTq.exe
  C:\Windows\System\DeYUaTq.exe
  2⤵
  PID:6236
- C:\Windows\System\RYwYUBD.exe
  C:\Windows\System\RYwYUBD.exe
  2⤵
  PID:6252
- C:\Windows\System\xwtzuUW.exe
  C:\Windows\System\xwtzuUW.exe
  2⤵
  PID:6268
- C:\Windows\System\JLbALbq.exe
  C:\Windows\System\JLbALbq.exe
  2⤵
  PID:6276
- C:\Windows\System\VamxLGp.exe
  C:\Windows\System\VamxLGp.exe
  2⤵
  PID:5724
- C:\Windows\System\swRjRMw.exe
  C:\Windows\System\swRjRMw.exe
  2⤵
  PID:5748
- C:\Windows\System\bZwubdw.exe
  C:\Windows\System\bZwubdw.exe
  2⤵
  PID:5764
- C:\Windows\System\JfcGutJ.exe
  C:\Windows\System\JfcGutJ.exe
  2⤵
  PID:5780
- C:\Windows\System\YhGaRrZ.exe
  C:\Windows\System\YhGaRrZ.exe
  2⤵
  PID:5832
- C:\Windows\System\VSxwORv.exe
  C:\Windows\System\VSxwORv.exe
  2⤵
  PID:5972
- C:\Windows\System\zjSoduX.exe
  C:\Windows\System\zjSoduX.exe
  2⤵
  PID:5268
- C:\Windows\System\NsKlyfW.exe
  C:\Windows\System\NsKlyfW.exe
  2⤵
  PID:5804
- C:\Windows\System\vfTeguW.exe
  C:\Windows\System\vfTeguW.exe
  2⤵
  PID:5976
- C:\Windows\System\zDynSbb.exe
  C:\Windows\System\zDynSbb.exe
  2⤵
  PID:6076
- C:\Windows\System\aIojmyY.exe
  C:\Windows\System\aIojmyY.exe
  2⤵
  PID:5372
- C:\Windows\System\FillBKT.exe
  C:\Windows\System\FillBKT.exe
  2⤵
  PID:5600
- C:\Windows\System\actisrY.exe
  C:\Windows\System\actisrY.exe
  2⤵
  PID:5452
- C:\Windows\System\QJHsVBr.exe
  C:\Windows\System\QJHsVBr.exe
  2⤵
  PID:4416
- C:\Windows\System\eXDLVBY.exe
  C:\Windows\System\eXDLVBY.exe
  2⤵
  PID:3448
- C:\Windows\System\LhHLHGZ.exe
  C:\Windows\System\LhHLHGZ.exe
  2⤵
  PID:5952
- C:\Windows\System\EoBxmZP.exe
  C:\Windows\System\EoBxmZP.exe
  2⤵
  PID:6288
- C:\Windows\System\BdiuJwp.exe
  C:\Windows\System\BdiuJwp.exe
  2⤵
  PID:6348
- C:\Windows\System\JXhlOBJ.exe
  C:\Windows\System\JXhlOBJ.exe
  2⤵
  PID:6388
- C:\Windows\System\HLUPLTo.exe
  C:\Windows\System\HLUPLTo.exe
  2⤵
  PID:6456
- C:\Windows\System\CVAKsje.exe
  C:\Windows\System\CVAKsje.exe
  2⤵
  PID:6520
- C:\Windows\System\SoyhLIH.exe
  C:\Windows\System\SoyhLIH.exe
  2⤵
  PID:6400
- C:\Windows\System\gUmuset.exe
  C:\Windows\System\gUmuset.exe
  2⤵
  PID:6500
- C:\Windows\System\UcZpZHc.exe
  C:\Windows\System\UcZpZHc.exe
  2⤵
  PID:6436
- C:\Windows\System\friGPcd.exe
  C:\Windows\System\friGPcd.exe
  2⤵
  PID:6552
- C:\Windows\System\hwdcXSS.exe
  C:\Windows\System\hwdcXSS.exe
  2⤵
  PID:6572
- C:\Windows\System\QVplWKk.exe
  C:\Windows\System\QVplWKk.exe
  2⤵
  PID:6620
- C:\Windows\System\cMFzvSU.exe
  C:\Windows\System\cMFzvSU.exe
  2⤵
  PID:6716
- C:\Windows\System\hXWFPqZ.exe
  C:\Windows\System\hXWFPqZ.exe
  2⤵
  PID:6600
- C:\Windows\System\xEWFGZa.exe
  C:\Windows\System\xEWFGZa.exe
  2⤵
  PID:6636
- C:\Windows\System\wtHvAht.exe
  C:\Windows\System\wtHvAht.exe
  2⤵
  PID:6732
- C:\Windows\System\oIcOhwd.exe
  C:\Windows\System\oIcOhwd.exe
  2⤵
  PID:6784
- C:\Windows\System\UManoyH.exe
  C:\Windows\System\UManoyH.exe
  2⤵
  PID:6848
- C:\Windows\System\GbKZXVX.exe
  C:\Windows\System\GbKZXVX.exe
  2⤵
  PID:6804
- C:\Windows\System\HxWrJSn.exe
  C:\Windows\System\HxWrJSn.exe
  2⤵
  PID:6916
- C:\Windows\System\ymnxqQJ.exe
  C:\Windows\System\ymnxqQJ.exe
  2⤵
  PID:6900
- C:\Windows\System\vymwvcT.exe
  C:\Windows\System\vymwvcT.exe
  2⤵
  PID:6864
- C:\Windows\System\JMZCBuZ.exe
  C:\Windows\System\JMZCBuZ.exe
  2⤵
  PID:7008
- C:\Windows\System\KlvipyB.exe
  C:\Windows\System\KlvipyB.exe
  2⤵
  PID:6932
- C:\Windows\System\EYfBtZV.exe
  C:\Windows\System\EYfBtZV.exe
  2⤵
  PID:6992
- C:\Windows\System\uUcQAPf.exe
  C:\Windows\System\uUcQAPf.exe
  2⤵
  PID:7076
- C:\Windows\System\yyAPeRK.exe
  C:\Windows\System\yyAPeRK.exe
  2⤵
  PID:1496
- C:\Windows\System\useiMWs.exe
  C:\Windows\System\useiMWs.exe
  2⤵
  PID:5740
- C:\Windows\System\yPWkMlc.exe
  C:\Windows\System\yPWkMlc.exe
  2⤵
  PID:5488
- C:\Windows\System\PfimoHc.exe
  C:\Windows\System\PfimoHc.exe
  2⤵
  PID:5096
- C:\Windows\System\LwIuXTK.exe
  C:\Windows\System\LwIuXTK.exe
  2⤵
  PID:6192
- C:\Windows\System\PCzIwTs.exe
  C:\Windows\System\PCzIwTs.exe
  2⤵
  PID:7096
- C:\Windows\System\rYxAYMk.exe
  C:\Windows\System\rYxAYMk.exe
  2⤵
  PID:7128
- C:\Windows\System\McmIXCe.exe
  C:\Windows\System\McmIXCe.exe
  2⤵
  PID:5244
- C:\Windows\System\KqLtXyz.exe
  C:\Windows\System\KqLtXyz.exe
  2⤵
  PID:5960
- C:\Windows\System\YONfDkV.exe
  C:\Windows\System\YONfDkV.exe
  2⤵
  PID:5552
- C:\Windows\System\XLUWjzT.exe
  C:\Windows\System\XLUWjzT.exe
  2⤵
  PID:6180
- C:\Windows\System\voGDESx.exe
  C:\Windows\System\voGDESx.exe
  2⤵
  PID:4544
- C:\Windows\System\uNiWfjf.exe
  C:\Windows\System\uNiWfjf.exe
  2⤵
  PID:6072
- C:\Windows\System\hYjQvTd.exe
  C:\Windows\System\hYjQvTd.exe
  2⤵
  PID:6248
- C:\Windows\System\NcXPOyX.exe
  C:\Windows\System\NcXPOyX.exe
  2⤵
  PID:5736
- C:\Windows\System\VfDuGcQ.exe
  C:\Windows\System\VfDuGcQ.exe
  2⤵
  PID:6264
- C:\Windows\System\COsXCvB.exe
  C:\Windows\System\COsXCvB.exe
  2⤵
  PID:5760
- C:\Windows\System\PxCqXyV.exe
  C:\Windows\System\PxCqXyV.exe
  2⤵
  PID:5656
- C:\Windows\System\nHVzEGI.exe
  C:\Windows\System\nHVzEGI.exe
  2⤵
  PID:6036
- C:\Windows\System\GpThQrb.exe
  C:\Windows\System\GpThQrb.exe
  2⤵
  PID:5904
- C:\Windows\System\dZdTSYZ.exe
  C:\Windows\System\dZdTSYZ.exe
  2⤵
  PID:4880
- C:\Windows\System\MFwUgCA.exe
  C:\Windows\System\MFwUgCA.exe
  2⤵
  PID:6104
- C:\Windows\System\nCJfNMo.exe
  C:\Windows\System\nCJfNMo.exe
  2⤵
  PID:5124
- C:\Windows\System\oWLgExp.exe
  C:\Windows\System\oWLgExp.exe
  2⤵
  PID:6420
- C:\Windows\System\aKjpWAv.exe
  C:\Windows\System\aKjpWAv.exe
  2⤵
  PID:6432
- C:\Windows\System\UenIxye.exe
  C:\Windows\System\UenIxye.exe
  2⤵
  PID:5676
- C:\Windows\System\LAxhLdl.exe
  C:\Windows\System\LAxhLdl.exe
  2⤵
  PID:6516
- C:\Windows\System\PojJreT.exe
  C:\Windows\System\PojJreT.exe
  2⤵
  PID:6540
- C:\Windows\System\BSkGwiy.exe
  C:\Windows\System\BSkGwiy.exe
  2⤵
  PID:6684
- C:\Windows\System\ENvlRGB.exe
  C:\Windows\System\ENvlRGB.exe
  2⤵
  PID:4640
- C:\Windows\System\sKReLhB.exe
  C:\Windows\System\sKReLhB.exe
  2⤵
  PID:6704
- C:\Windows\System\rxKMova.exe
  C:\Windows\System\rxKMova.exe
  2⤵
  PID:6768
- C:\Windows\System\daTgDkO.exe
  C:\Windows\System\daTgDkO.exe
  2⤵
  PID:6816
- C:\Windows\System\OEovjpB.exe
  C:\Windows\System\OEovjpB.exe
  2⤵
  PID:6948
- C:\Windows\System\hHMGZbH.exe
  C:\Windows\System\hHMGZbH.exe
  2⤵
  PID:6868
- C:\Windows\System\qxZyUHO.exe
  C:\Windows\System\qxZyUHO.exe
  2⤵
  PID:6996
- C:\Windows\System\MivdAqZ.exe
  C:\Windows\System\MivdAqZ.exe
  2⤵
  PID:5348
- C:\Windows\System\ZClhqYp.exe
  C:\Windows\System\ZClhqYp.exe
  2⤵
  PID:7092
- C:\Windows\System\CqLTUTV.exe
  C:\Windows\System\CqLTUTV.exe
  2⤵
  PID:5652
- C:\Windows\System\tBNnzcB.exe
  C:\Windows\System\tBNnzcB.exe
  2⤵
  PID:6108
- C:\Windows\System\TtgEoNY.exe
  C:\Windows\System\TtgEoNY.exe
  2⤵
  PID:5756
- C:\Windows\System\WwjegJD.exe
  C:\Windows\System\WwjegJD.exe
  2⤵
  PID:6040
- C:\Windows\System\NUhommc.exe
  C:\Windows\System\NUhommc.exe
  2⤵
  PID:7148
- C:\Windows\System\vOaSduS.exe
  C:\Windows\System\vOaSduS.exe
  2⤵
  PID:6488
- C:\Windows\System\hEqvRvY.exe
  C:\Windows\System\hEqvRvY.exe
  2⤵
  PID:6504
- C:\Windows\System\woRhHdG.exe
  C:\Windows\System\woRhHdG.exe
  2⤵
  PID:4212
- C:\Windows\System\HVNcxvq.exe
  C:\Windows\System\HVNcxvq.exe
  2⤵
  PID:7060
- C:\Windows\System\DXsDORb.exe
  C:\Windows\System\DXsDORb.exe
  2⤵
  PID:7160
- C:\Windows\System\SZlVAzl.exe
  C:\Windows\System\SZlVAzl.exe
  2⤵
  PID:5436
- C:\Windows\System\DXDbzCE.exe
  C:\Windows\System\DXDbzCE.exe
  2⤵
  PID:6736
- C:\Windows\System\GvJraae.exe
  C:\Windows\System\GvJraae.exe
  2⤵
  PID:6128
- C:\Windows\System\HfgjSsq.exe
  C:\Windows\System\HfgjSsq.exe
  2⤵
  PID:6228
- C:\Windows\System\nTPvbzZ.exe
  C:\Windows\System\nTPvbzZ.exe
  2⤵
  PID:6020
- C:\Windows\System\JXpXIKn.exe
  C:\Windows\System\JXpXIKn.exe
  2⤵
  PID:6884
- C:\Windows\System\rRjpXvQ.exe
  C:\Windows\System\rRjpXvQ.exe
  2⤵
  PID:7108
- C:\Windows\System\FYhKGmt.exe
  C:\Windows\System\FYhKGmt.exe
  2⤵
  PID:4308
- C:\Windows\System\boOrQVj.exe
  C:\Windows\System\boOrQVj.exe
  2⤵
  PID:6524
- C:\Windows\System\WUZNmzm.exe
  C:\Windows\System\WUZNmzm.exe
  2⤵
  PID:6384
- C:\Windows\System\gMqiVIZ.exe
  C:\Windows\System\gMqiVIZ.exe
  2⤵
  PID:5864
- C:\Windows\System\nPMepvu.exe
  C:\Windows\System\nPMepvu.exe
  2⤵
  PID:5572
- C:\Windows\System\ZASEspS.exe
  C:\Windows\System\ZASEspS.exe
  2⤵
  PID:6320
- C:\Windows\System\aUpXtmB.exe
  C:\Windows\System\aUpXtmB.exe
  2⤵
  PID:6156
- C:\Windows\System\TGPcfdo.exe
  C:\Windows\System\TGPcfdo.exe
  2⤵
  PID:6468
- C:\Windows\System\bjasKWX.exe
  C:\Windows\System\bjasKWX.exe
  2⤵
  PID:4672
- C:\Windows\System\EKxmBEy.exe
  C:\Windows\System\EKxmBEy.exe
  2⤵
  PID:6616
- C:\Windows\System\GIhTDeZ.exe
  C:\Windows\System\GIhTDeZ.exe
  2⤵
  PID:5892
- C:\Windows\System\dDyVEPr.exe
  C:\Windows\System\dDyVEPr.exe
  2⤵
  PID:6536
- C:\Windows\System\ikUnxIK.exe
  C:\Windows\System\ikUnxIK.exe
  2⤵
  PID:6300
- C:\Windows\System\hHwmsYW.exe
  C:\Windows\System\hHwmsYW.exe
  2⤵
  PID:6832
- C:\Windows\System\qilcrEt.exe
  C:\Windows\System\qilcrEt.exe
  2⤵
  PID:5416
- C:\Windows\System\hzOEwgN.exe
  C:\Windows\System\hzOEwgN.exe
  2⤵
  PID:7172
- C:\Windows\System\IoeCjhW.exe
  C:\Windows\System\IoeCjhW.exe
  2⤵
  PID:7192
- C:\Windows\System\IKTMNIA.exe
  C:\Windows\System\IKTMNIA.exe
  2⤵
  PID:7208
- C:\Windows\System\Hdrfxwc.exe
  C:\Windows\System\Hdrfxwc.exe
  2⤵
  PID:7224
- C:\Windows\System\uBcZghA.exe
  C:\Windows\System\uBcZghA.exe
  2⤵
  PID:7240
- C:\Windows\System\FwBalhp.exe
  C:\Windows\System\FwBalhp.exe
  2⤵
  PID:7316
- C:\Windows\System\BhAytsL.exe
  C:\Windows\System\BhAytsL.exe
  2⤵
  PID:7336
- C:\Windows\System\svnkBaz.exe
  C:\Windows\System\svnkBaz.exe
  2⤵
  PID:7352
- C:\Windows\System\UKGkLTt.exe
  C:\Windows\System\UKGkLTt.exe
  2⤵
  PID:7368
- C:\Windows\System\KdsWcfj.exe
  C:\Windows\System\KdsWcfj.exe
  2⤵
  PID:7384
- C:\Windows\System\cVIeILE.exe
  C:\Windows\System\cVIeILE.exe
  2⤵
  PID:7400
- C:\Windows\System\CEagJMI.exe
  C:\Windows\System\CEagJMI.exe
  2⤵
  PID:7416
- C:\Windows\System\QMjfLHY.exe
  C:\Windows\System\QMjfLHY.exe
  2⤵
  PID:7452
- C:\Windows\System\kGPklOH.exe
  C:\Windows\System\kGPklOH.exe
  2⤵
  PID:7468
- C:\Windows\System\ZHKEaeO.exe
  C:\Windows\System\ZHKEaeO.exe
  2⤵
  PID:7484
- C:\Windows\System\GwaGtmb.exe
  C:\Windows\System\GwaGtmb.exe
  2⤵
  PID:7504
- C:\Windows\System\NZFFOjB.exe
  C:\Windows\System\NZFFOjB.exe
  2⤵
  PID:7520
- C:\Windows\System\kxrHxhF.exe
  C:\Windows\System\kxrHxhF.exe
  2⤵
  PID:7536
- C:\Windows\System\aucfslR.exe
  C:\Windows\System\aucfslR.exe
  2⤵
  PID:7552
- C:\Windows\System\wUPZhXu.exe
  C:\Windows\System\wUPZhXu.exe
  2⤵
  PID:7572
- C:\Windows\System\SYkcYzp.exe
  C:\Windows\System\SYkcYzp.exe
  2⤵
  PID:7588
- C:\Windows\System\FflXkTz.exe
  C:\Windows\System\FflXkTz.exe
  2⤵
  PID:7604
- C:\Windows\System\BTLRoir.exe
  C:\Windows\System\BTLRoir.exe
  2⤵
  PID:7620
- C:\Windows\System\cjSxJTQ.exe
  C:\Windows\System\cjSxJTQ.exe
  2⤵
  PID:7636
- C:\Windows\System\ggrzFaM.exe
  C:\Windows\System\ggrzFaM.exe
  2⤵
  PID:7652
- C:\Windows\System\dqkenlu.exe
  C:\Windows\System\dqkenlu.exe
  2⤵
  PID:7668
- C:\Windows\System\QZbsAqm.exe
  C:\Windows\System\QZbsAqm.exe
  2⤵
  PID:7684
- C:\Windows\System\eEAVHjs.exe
  C:\Windows\System\eEAVHjs.exe
  2⤵
  PID:7708
- C:\Windows\System\aUpbMdL.exe
  C:\Windows\System\aUpbMdL.exe
  2⤵
  PID:7724
- C:\Windows\System\JqhJpef.exe
  C:\Windows\System\JqhJpef.exe
  2⤵
  PID:7740
- C:\Windows\System\gEvtkHp.exe
  C:\Windows\System\gEvtkHp.exe
  2⤵
  PID:7756
- C:\Windows\System\ynyeskn.exe
  C:\Windows\System\ynyeskn.exe
  2⤵
  PID:7772
- C:\Windows\System\ywjarfL.exe
  C:\Windows\System\ywjarfL.exe
  2⤵
  PID:7792
- C:\Windows\System\nFnZvPj.exe
  C:\Windows\System\nFnZvPj.exe
  2⤵
  PID:7808
- C:\Windows\System\YMQDmIX.exe
  C:\Windows\System\YMQDmIX.exe
  2⤵
  PID:7824
- C:\Windows\System\neGxQYL.exe
  C:\Windows\System\neGxQYL.exe
  2⤵
  PID:7840
- C:\Windows\System\ijVmVfy.exe
  C:\Windows\System\ijVmVfy.exe
  2⤵
  PID:7856
- C:\Windows\System\noxMAVL.exe
  C:\Windows\System\noxMAVL.exe
  2⤵
  PID:7872
- C:\Windows\System\XgoEUis.exe
  C:\Windows\System\XgoEUis.exe
  2⤵
  PID:7888
- C:\Windows\System\tmKtaum.exe
  C:\Windows\System\tmKtaum.exe
  2⤵
  PID:7904
- C:\Windows\System\ZbCuemH.exe
  C:\Windows\System\ZbCuemH.exe
  2⤵
  PID:7920
- C:\Windows\System\FycWGXv.exe
  C:\Windows\System\FycWGXv.exe
  2⤵
  PID:7936
- C:\Windows\System\RFIlUhs.exe
  C:\Windows\System\RFIlUhs.exe
  2⤵
  PID:7952
- C:\Windows\System\yLKuNeS.exe
  C:\Windows\System\yLKuNeS.exe
  2⤵
  PID:7968
- C:\Windows\System\SgEXALl.exe
  C:\Windows\System\SgEXALl.exe
  2⤵
  PID:7984
- C:\Windows\System\JMmELgJ.exe
  C:\Windows\System\JMmELgJ.exe
  2⤵
  PID:8000
- C:\Windows\System\QsRjBYf.exe
  C:\Windows\System\QsRjBYf.exe
  2⤵
  PID:8016
- C:\Windows\System\DdTCDIb.exe
  C:\Windows\System\DdTCDIb.exe
  2⤵
  PID:8032
- C:\Windows\System\bbDWqGq.exe
  C:\Windows\System\bbDWqGq.exe
  2⤵
  PID:8048
- C:\Windows\System\ULqxiHf.exe
  C:\Windows\System\ULqxiHf.exe
  2⤵
  PID:8064
- C:\Windows\System\aMIdtjR.exe
  C:\Windows\System\aMIdtjR.exe
  2⤵
  PID:8080
- C:\Windows\System\slZARfM.exe
  C:\Windows\System\slZARfM.exe
  2⤵
  PID:8096
- C:\Windows\System\AeRYEIu.exe
  C:\Windows\System\AeRYEIu.exe
  2⤵
  PID:8112
- C:\Windows\System\MdWbYAA.exe
  C:\Windows\System\MdWbYAA.exe
  2⤵
  PID:8128
- C:\Windows\System\VuHVVPL.exe
  C:\Windows\System\VuHVVPL.exe
  2⤵
  PID:8144
- C:\Windows\System\QRywEMC.exe
  C:\Windows\System\QRywEMC.exe
  2⤵
  PID:8160
- C:\Windows\System\aNVJuEF.exe
  C:\Windows\System\aNVJuEF.exe
  2⤵
  PID:8176
- C:\Windows\System\iCnQzPX.exe
  C:\Windows\System\iCnQzPX.exe
  2⤵
  PID:7164
- C:\Windows\System\EWsIwxf.exe
  C:\Windows\System\EWsIwxf.exe
  2⤵
  PID:5940
- C:\Windows\System\ytrqXCz.exe
  C:\Windows\System\ytrqXCz.exe
  2⤵
  PID:7184
- C:\Windows\System\lHoKnJx.exe
  C:\Windows\System\lHoKnJx.exe
  2⤵
  PID:5500
- C:\Windows\System\dzDXfcC.exe
  C:\Windows\System\dzDXfcC.exe
  2⤵
  PID:7200
- C:\Windows\System\iQRhHkU.exe
  C:\Windows\System\iQRhHkU.exe
  2⤵
  PID:7252
- C:\Windows\System\QRJDvHY.exe
  C:\Windows\System\QRJDvHY.exe
  2⤵
  PID:7268
- C:\Windows\System\SQDaSwE.exe
  C:\Windows\System\SQDaSwE.exe
  2⤵
  PID:7288
- C:\Windows\System\ivmAbNL.exe
  C:\Windows\System\ivmAbNL.exe
  2⤵
  PID:7344
- C:\Windows\System\ztcDrzt.exe
  C:\Windows\System\ztcDrzt.exe
  2⤵
  PID:7380
- C:\Windows\System\lmSpAyV.exe
  C:\Windows\System\lmSpAyV.exe
  2⤵
  PID:7332
- C:\Windows\System\IWbtJse.exe
  C:\Windows\System\IWbtJse.exe
  2⤵
  PID:7396
- C:\Windows\System\swULufI.exe
  C:\Windows\System\swULufI.exe
  2⤵
  PID:7436
- C:\Windows\System\QWUICse.exe
  C:\Windows\System\QWUICse.exe
  2⤵
  PID:7476
- C:\Windows\System\YBOQgff.exe
  C:\Windows\System\YBOQgff.exe
  2⤵
  PID:7544
- C:\Windows\System\asBaSAZ.exe
  C:\Windows\System\asBaSAZ.exe
  2⤵
  PID:7584
- C:\Windows\System\QRgipAO.exe
  C:\Windows\System\QRgipAO.exe
  2⤵
  PID:7648
- C:\Windows\System\geGsfwH.exe
  C:\Windows\System\geGsfwH.exe
  2⤵
  PID:7464
- C:\Windows\System\UIzVMFK.exe
  C:\Windows\System\UIzVMFK.exe
  2⤵
  PID:7492
- C:\Windows\System\TxvXxEl.exe
  C:\Windows\System\TxvXxEl.exe
  2⤵
  PID:7532
- C:\Windows\System\SjYtKhu.exe
  C:\Windows\System\SjYtKhu.exe
  2⤵
  PID:7660
- C:\Windows\System\UiArDri.exe
  C:\Windows\System\UiArDri.exe
  2⤵
  PID:6372
- C:\Windows\System\gDbzmbu.exe
  C:\Windows\System\gDbzmbu.exe
  2⤵
  PID:7752
- C:\Windows\System\OiNaktA.exe
  C:\Windows\System\OiNaktA.exe
  2⤵
  PID:7820
- C:\Windows\System\ukiiinC.exe
  C:\Windows\System\ukiiinC.exe
  2⤵
  PID:7884
- C:\Windows\System\IiEBcfJ.exe
  C:\Windows\System\IiEBcfJ.exe
  2⤵
  PID:7944
- C:\Windows\System\InrIuiy.exe
  C:\Windows\System\InrIuiy.exe
  2⤵
  PID:8008
- C:\Windows\System\CHpclbm.exe
  C:\Windows\System\CHpclbm.exe
  2⤵
  PID:7800
- C:\Windows\System\zwEzKAN.exe
  C:\Windows\System\zwEzKAN.exe
  2⤵
  PID:8076
- C:\Windows\System\UxuTaOW.exe
  C:\Windows\System\UxuTaOW.exe
  2⤵
  PID:7868
- C:\Windows\System\IFpSQZv.exe
  C:\Windows\System\IFpSQZv.exe
  2⤵
  PID:7836
- C:\Windows\System\rwXRZTI.exe
  C:\Windows\System\rwXRZTI.exe
  2⤵
  PID:7932
- C:\Windows\System\xjEViEj.exe
  C:\Windows\System\xjEViEj.exe
  2⤵
  PID:7996
- C:\Windows\System\lKFxoRz.exe
  C:\Windows\System\lKFxoRz.exe
  2⤵
  PID:8088
- C:\Windows\System\VxienMC.exe
  C:\Windows\System\VxienMC.exe
  2⤵
  PID:8140
- C:\Windows\System\xHNELMR.exe
  C:\Windows\System\xHNELMR.exe
  2⤵
  PID:8168
- C:\Windows\System\kJWKQoi.exe
  C:\Windows\System\kJWKQoi.exe
  2⤵
  PID:8188
- C:\Windows\System\HTkyZrN.exe
  C:\Windows\System\HTkyZrN.exe
  2⤵
  PID:7248
- C:\Windows\System\wYJswta.exe
  C:\Windows\System\wYJswta.exe
  2⤵
  PID:7280
- C:\Windows\System\pvwXcPI.exe
  C:\Windows\System\pvwXcPI.exe
  2⤵
  PID:7392
- C:\Windows\System\XsfnioO.exe
  C:\Windows\System\XsfnioO.exe
  2⤵
  PID:6632
- C:\Windows\System\qPryzHy.exe
  C:\Windows\System\qPryzHy.exe
  2⤵
  PID:7312
- C:\Windows\System\reFPueS.exe
  C:\Windows\System\reFPueS.exe
  2⤵
  PID:7428
- C:\Windows\System\ceDTrIo.exe
  C:\Windows\System\ceDTrIo.exe
  2⤵
  PID:7676
- C:\Windows\System\XQZoYXI.exe
  C:\Windows\System\XQZoYXI.exe
  2⤵
  PID:7692
- C:\Windows\System\KahodLK.exe
  C:\Windows\System\KahodLK.exe
  2⤵
  PID:7816
- C:\Windows\System\goSpAnU.exe
  C:\Windows\System\goSpAnU.exe
  2⤵
  PID:7732
- C:\Windows\System\LewROxG.exe
  C:\Windows\System\LewROxG.exe
  2⤵
  PID:8028
- C:\Windows\System\QUXkACG.exe
  C:\Windows\System\QUXkACG.exe
  2⤵
  PID:5800
- C:\Windows\System\hAZuNBg.exe
  C:\Windows\System\hAZuNBg.exe
  2⤵
  PID:7976
- C:\Windows\System\QUlIqtb.exe
  C:\Windows\System\QUlIqtb.exe
  2⤵
  PID:7596
- C:\Windows\System\nsljKKh.exe
  C:\Windows\System\nsljKKh.exe
  2⤵
  PID:7236
- C:\Windows\System\vmpCWUr.exe
  C:\Windows\System\vmpCWUr.exe
  2⤵
  PID:7516
- C:\Windows\System\xBTKZFA.exe
  C:\Windows\System\xBTKZFA.exe
  2⤵
  PID:7768
- C:\Windows\System\yJfSunS.exe
  C:\Windows\System\yJfSunS.exe
  2⤵
  PID:8072
- C:\Windows\System\KWjtbsn.exe
  C:\Windows\System\KWjtbsn.exe
  2⤵
  PID:7992
- C:\Windows\System\ZgvcLta.exe
  C:\Windows\System\ZgvcLta.exe
  2⤵
  PID:7188
- C:\Windows\System\vTNzlqe.exe
  C:\Windows\System\vTNzlqe.exe
  2⤵
  PID:7916
- C:\Windows\System\CeVSpqk.exe
  C:\Windows\System\CeVSpqk.exe
  2⤵
  PID:7500
- C:\Windows\System\JGGpySr.exe
  C:\Windows\System\JGGpySr.exe
  2⤵
  PID:8044
- C:\Windows\System\EtdyJAE.exe
  C:\Windows\System\EtdyJAE.exe
  2⤵
  PID:8124
- C:\Windows\System\AhVcDoK.exe
  C:\Windows\System\AhVcDoK.exe
  2⤵
  PID:7276
- C:\Windows\System\cayhzbc.exe
  C:\Windows\System\cayhzbc.exe
  2⤵
  PID:7832
- C:\Windows\System\htqtLut.exe
  C:\Windows\System\htqtLut.exe
  2⤵
  PID:7528
- C:\Windows\System\nUDEjYQ.exe
  C:\Windows\System\nUDEjYQ.exe
  2⤵
  PID:7448
- C:\Windows\System\WZuLqDc.exe
  C:\Windows\System\WZuLqDc.exe
  2⤵
  PID:7328
- C:\Windows\System\hTXAskp.exe
  C:\Windows\System\hTXAskp.exe
  2⤵
  PID:8200
- C:\Windows\System\CXhTSdB.exe
  C:\Windows\System\CXhTSdB.exe
  2⤵
  PID:8216
- C:\Windows\System\AGChzwN.exe
  C:\Windows\System\AGChzwN.exe
  2⤵
  PID:8232
- C:\Windows\System\PRWqLHc.exe
  C:\Windows\System\PRWqLHc.exe
  2⤵
  PID:8248
- C:\Windows\System\bQPXJir.exe
  C:\Windows\System\bQPXJir.exe
  2⤵
  PID:8264
- C:\Windows\System\HRAhRzy.exe
  C:\Windows\System\HRAhRzy.exe
  2⤵
  PID:8280
- C:\Windows\System\MKfeejp.exe
  C:\Windows\System\MKfeejp.exe
  2⤵
  PID:8296
- C:\Windows\System\EfxCUfX.exe
  C:\Windows\System\EfxCUfX.exe
  2⤵
  PID:8312
- C:\Windows\System\bEeKgQp.exe
  C:\Windows\System\bEeKgQp.exe
  2⤵
  PID:8328
- C:\Windows\System\myVIZAY.exe
  C:\Windows\System\myVIZAY.exe
  2⤵
  PID:8344
- C:\Windows\System\aKEHCMO.exe
  C:\Windows\System\aKEHCMO.exe
  2⤵
  PID:8360
- C:\Windows\System\WooELjI.exe
  C:\Windows\System\WooELjI.exe
  2⤵
  PID:8376
- C:\Windows\System\mPzEuNO.exe
  C:\Windows\System\mPzEuNO.exe
  2⤵
  PID:8392
- C:\Windows\System\EIRXeIU.exe
  C:\Windows\System\EIRXeIU.exe
  2⤵
  PID:8408
- C:\Windows\System\kVeXxCH.exe
  C:\Windows\System\kVeXxCH.exe
  2⤵
  PID:8424
- C:\Windows\System\pbuThOj.exe
  C:\Windows\System\pbuThOj.exe
  2⤵
  PID:8440
- C:\Windows\System\ihYwxyi.exe
  C:\Windows\System\ihYwxyi.exe
  2⤵
  PID:8456
- C:\Windows\System\jJiLTjX.exe
  C:\Windows\System\jJiLTjX.exe
  2⤵
  PID:8472
- C:\Windows\System\AGJVayc.exe
  C:\Windows\System\AGJVayc.exe
  2⤵
  PID:8488
- C:\Windows\System\XeKoinw.exe
  C:\Windows\System\XeKoinw.exe
  2⤵
  PID:8504
- C:\Windows\System\ZdGlWxW.exe
  C:\Windows\System\ZdGlWxW.exe
  2⤵
  PID:8520
- C:\Windows\System\HEqYkTi.exe
  C:\Windows\System\HEqYkTi.exe
  2⤵
  PID:8536
- C:\Windows\System\NRwdmmg.exe
  C:\Windows\System\NRwdmmg.exe
  2⤵
  PID:8552
- C:\Windows\System\rIeDhvh.exe
  C:\Windows\System\rIeDhvh.exe
  2⤵
  PID:8568
- C:\Windows\System\YjkoFln.exe
  C:\Windows\System\YjkoFln.exe
  2⤵
  PID:8584
- C:\Windows\System\cxqHJHo.exe
  C:\Windows\System\cxqHJHo.exe
  2⤵
  PID:8600
- C:\Windows\System\BqrRiIv.exe
  C:\Windows\System\BqrRiIv.exe
  2⤵
  PID:8616
- C:\Windows\System\PNeTpJZ.exe
  C:\Windows\System\PNeTpJZ.exe
  2⤵
  PID:8632
- C:\Windows\System\HBKHeMz.exe
  C:\Windows\System\HBKHeMz.exe
  2⤵
  PID:8648
- C:\Windows\System\ZdXRDvQ.exe
  C:\Windows\System\ZdXRDvQ.exe
  2⤵
  PID:8664
- C:\Windows\System\mCzLIgQ.exe
  C:\Windows\System\mCzLIgQ.exe
  2⤵
  PID:8680
- C:\Windows\System\sWzawZd.exe
  C:\Windows\System\sWzawZd.exe
  2⤵
  PID:8696
- C:\Windows\System\kQPkiUf.exe
  C:\Windows\System\kQPkiUf.exe
  2⤵
  PID:8712
- C:\Windows\System\RGHxGwT.exe
  C:\Windows\System\RGHxGwT.exe
  2⤵
  PID:8728
- C:\Windows\System\mxbQBRk.exe
  C:\Windows\System\mxbQBRk.exe
  2⤵
  PID:8744
- C:\Windows\System\SnmiMKX.exe
  C:\Windows\System\SnmiMKX.exe
  2⤵
  PID:8760
- C:\Windows\System\IYjtFPZ.exe
  C:\Windows\System\IYjtFPZ.exe
  2⤵
  PID:8776
- C:\Windows\System\YbqZGZM.exe
  C:\Windows\System\YbqZGZM.exe
  2⤵
  PID:8792
- C:\Windows\System\RKmZCSS.exe
  C:\Windows\System\RKmZCSS.exe
  2⤵
  PID:8808
- C:\Windows\System\BQNlNAu.exe
  C:\Windows\System\BQNlNAu.exe
  2⤵
  PID:8824
- C:\Windows\System\KaBaWoH.exe
  C:\Windows\System\KaBaWoH.exe
  2⤵
  PID:8840
- C:\Windows\System\XIccVHP.exe
  C:\Windows\System\XIccVHP.exe
  2⤵
  PID:8856
- C:\Windows\System\LkRnPLj.exe
  C:\Windows\System\LkRnPLj.exe
  2⤵
  PID:8872
- C:\Windows\System\ggMxkfT.exe
  C:\Windows\System\ggMxkfT.exe
  2⤵
  PID:8888
- C:\Windows\System\ZZlJluq.exe
  C:\Windows\System\ZZlJluq.exe
  2⤵
  PID:8904
- C:\Windows\System\QOyDLqA.exe
  C:\Windows\System\QOyDLqA.exe
  2⤵
  PID:8920
- C:\Windows\System\FFpCzHH.exe
  C:\Windows\System\FFpCzHH.exe
  2⤵
  PID:8936
- C:\Windows\System\ridzNmN.exe
  C:\Windows\System\ridzNmN.exe
  2⤵
  PID:8952
- C:\Windows\System\SatEjPe.exe
  C:\Windows\System\SatEjPe.exe
  2⤵
  PID:8968
- C:\Windows\System\msFLshl.exe
  C:\Windows\System\msFLshl.exe
  2⤵
  PID:8984
- C:\Windows\System\YiNmqbY.exe
  C:\Windows\System\YiNmqbY.exe
  2⤵
  PID:9000
- C:\Windows\System\iYJOnZQ.exe
  C:\Windows\System\iYJOnZQ.exe
  2⤵
  PID:9016
- C:\Windows\System\gxJxUfb.exe
  C:\Windows\System\gxJxUfb.exe
  2⤵
  PID:9032
- C:\Windows\System\xrACxJG.exe
  C:\Windows\System\xrACxJG.exe
  2⤵
  PID:9048
- C:\Windows\System\jxBPXYe.exe
  C:\Windows\System\jxBPXYe.exe
  2⤵
  PID:9064
- C:\Windows\System\heQJOKN.exe
  C:\Windows\System\heQJOKN.exe
  2⤵
  PID:9080
- C:\Windows\System\zlvmToD.exe
  C:\Windows\System\zlvmToD.exe
  2⤵
  PID:9096
- C:\Windows\System\MKVOcBp.exe
  C:\Windows\System\MKVOcBp.exe
  2⤵
  PID:9112
- C:\Windows\System\jVNzAUP.exe
  C:\Windows\System\jVNzAUP.exe
  2⤵
  PID:9128
- C:\Windows\System\TRXETor.exe
  C:\Windows\System\TRXETor.exe
  2⤵
  PID:9144
- C:\Windows\System\lOcyWmC.exe
  C:\Windows\System\lOcyWmC.exe
  2⤵
  PID:9160
- C:\Windows\System\PbFutsk.exe
  C:\Windows\System\PbFutsk.exe
  2⤵
  PID:9176
- C:\Windows\System\tRZdcXe.exe
  C:\Windows\System\tRZdcXe.exe
  2⤵
  PID:9192
- C:\Windows\System\qLPqwaO.exe
  C:\Windows\System\qLPqwaO.exe
  2⤵
  PID:9208
- C:\Windows\System\UKHbIKl.exe
  C:\Windows\System\UKHbIKl.exe
  2⤵
  PID:8184
- C:\Windows\System\uxNpdap.exe
  C:\Windows\System\uxNpdap.exe
  2⤵
  PID:7720
- C:\Windows\System\yjqFtTC.exe
  C:\Windows\System\yjqFtTC.exe
  2⤵
  PID:7700
- C:\Windows\System\ngEktaX.exe
  C:\Windows\System\ngEktaX.exe
  2⤵
  PID:8240
- C:\Windows\System\IVUDTvu.exe
  C:\Windows\System\IVUDTvu.exe
  2⤵
  PID:8196
- C:\Windows\System\AkPTKZj.exe
  C:\Windows\System\AkPTKZj.exe
  2⤵
  PID:8260
- C:\Windows\System\dUEMxBb.exe
  C:\Windows\System\dUEMxBb.exe
  2⤵
  PID:8320
- C:\Windows\System\WMUBNdp.exe
  C:\Windows\System\WMUBNdp.exe
  2⤵
  PID:8368
- C:\Windows\System\lvmwWFw.exe
  C:\Windows\System\lvmwWFw.exe
  2⤵
  PID:8628
- C:\Windows\System\LypsJVn.exe
  C:\Windows\System\LypsJVn.exe
  2⤵
  PID:8692
- C:\Windows\System\fllcLQG.exe
  C:\Windows\System\fllcLQG.exe
  2⤵
  PID:8752
- C:\Windows\System\brdiXZI.exe
  C:\Windows\System\brdiXZI.exe
  2⤵
  PID:8784
- C:\Windows\System\CLPgTsD.exe
  C:\Windows\System\CLPgTsD.exe
  2⤵
  PID:8848
- C:\Windows\System\xcSGgzx.exe
  C:\Windows\System\xcSGgzx.exe
  2⤵
  PID:8416
- C:\Windows\System\KUPnVxf.exe
  C:\Windows\System\KUPnVxf.exe
  2⤵
  PID:8452
- C:\Windows\System\EnhqLts.exe
  C:\Windows\System\EnhqLts.exe
  2⤵
  PID:8388
- C:\Windows\System\osLlsBt.exe
  C:\Windows\System\osLlsBt.exe
  2⤵
  PID:8548
- C:\Windows\System\lojgVvl.exe
  C:\Windows\System\lojgVvl.exe
  2⤵
  PID:8644
- C:\Windows\System\lSTSHzH.exe
  C:\Windows\System\lSTSHzH.exe
  2⤵
  PID:8736
- C:\Windows\System\hvxnSuR.exe
  C:\Windows\System\hvxnSuR.exe
  2⤵
  PID:8804
- C:\Windows\System\jnsbzLT.exe
  C:\Windows\System\jnsbzLT.exe
  2⤵
  PID:8864
- C:\Windows\System\bjTIhkC.exe
  C:\Windows\System\bjTIhkC.exe
  2⤵
  PID:8928
- C:\Windows\System\ShMEuly.exe
  C:\Windows\System\ShMEuly.exe
  2⤵
  PID:8944
- C:\Windows\System\sGvdFva.exe
  C:\Windows\System\sGvdFva.exe
  2⤵
  PID:9008
- C:\Windows\System\gASvSzY.exe
  C:\Windows\System\gASvSzY.exe
  2⤵
  PID:8992
- C:\Windows\System\UOZvUEi.exe
  C:\Windows\System\UOZvUEi.exe
  2⤵
  PID:9072
- C:\Windows\System\zarxETr.exe
  C:\Windows\System\zarxETr.exe
  2⤵
  PID:9060
- C:\Windows\System\WlDtmvm.exe
  C:\Windows\System\WlDtmvm.exe
  2⤵
  PID:9140
- C:\Windows\System\LQVcJBY.exe
  C:\Windows\System\LQVcJBY.exe
  2⤵
  PID:9120
- C:\Windows\System\jHIHWxO.exe
  C:\Windows\System\jHIHWxO.exe
  2⤵
  PID:9172
- C:\Windows\System\hBRdKBW.exe
  C:\Windows\System\hBRdKBW.exe
  2⤵
  PID:7568
- C:\Windows\System\Uajngbj.exe
  C:\Windows\System\Uajngbj.exe
  2⤵
  PID:8228
- C:\Windows\System\DQuBOnT.exe
  C:\Windows\System\DQuBOnT.exe
  2⤵
  PID:9188
- C:\Windows\System\kgoOZVp.exe
  C:\Windows\System\kgoOZVp.exe
  2⤵
  PID:8304
- C:\Windows\System\EKuWjZZ.exe
  C:\Windows\System\EKuWjZZ.exe
  2⤵
  PID:8276
- C:\Windows\System\ohUwpIL.exe
  C:\Windows\System\ohUwpIL.exe
  2⤵
  PID:8404
- C:\Windows\System\iPQHVqp.exe
  C:\Windows\System\iPQHVqp.exe
  2⤵
  PID:8468
- C:\Windows\System\WMhKFSu.exe
  C:\Windows\System\WMhKFSu.exe
  2⤵
  PID:8500
- C:\Windows\System\xXETkFW.exe
  C:\Windows\System\xXETkFW.exe
  2⤵
  PID:8560
- C:\Windows\System\TJaNFKX.exe
  C:\Windows\System\TJaNFKX.exe
  2⤵
  PID:8624
- C:\Windows\System\KcyYDUw.exe
  C:\Windows\System\KcyYDUw.exe
  2⤵
  PID:8816
- C:\Windows\System\UxAiHeK.exe
  C:\Windows\System\UxAiHeK.exe
  2⤵
  PID:8516
- C:\Windows\System\eaSHXfN.exe
  C:\Windows\System\eaSHXfN.exe
  2⤵
  PID:8384
- C:\Windows\System\hcDIgHf.exe
  C:\Windows\System\hcDIgHf.exe
  2⤵
  PID:8612
- C:\Windows\System\MtepjBV.exe
  C:\Windows\System\MtepjBV.exe
  2⤵
  PID:8708
- C:\Windows\System\ZHlPBjR.exe
  C:\Windows\System\ZHlPBjR.exe
  2⤵
  PID:8976
- C:\Windows\System\nZhpFgU.exe
  C:\Windows\System\nZhpFgU.exe
  2⤵
  PID:9108
- C:\Windows\System\rMkIITq.exe
  C:\Windows\System\rMkIITq.exe
  2⤵
  PID:9124
- C:\Windows\System\PpFqDEZ.exe
  C:\Windows\System\PpFqDEZ.exe
  2⤵
  PID:7880
- C:\Windows\System\PuogRyd.exe
  C:\Windows\System\PuogRyd.exe
  2⤵
  PID:8832
- C:\Windows\System\lGZlglj.exe
  C:\Windows\System\lGZlglj.exe
  2⤵
  PID:9088
- C:\Windows\System\WXBgiLC.exe
  C:\Windows\System\WXBgiLC.exe
  2⤵
  PID:8272
- C:\Windows\System\HbTBKFA.exe
  C:\Windows\System\HbTBKFA.exe
  2⤵
  PID:7852
- C:\Windows\System\DFqiaWM.exe
  C:\Windows\System\DFqiaWM.exe
  2⤵
  PID:8592
- C:\Windows\System\DpvijVj.exe
  C:\Windows\System\DpvijVj.exe
  2⤵
  PID:8740
- C:\Windows\System\UDeTxvM.exe
  C:\Windows\System\UDeTxvM.exe
  2⤵
  PID:9156
- C:\Windows\System\FFsMaxt.exe
  C:\Windows\System\FFsMaxt.exe
  2⤵
  PID:8916
- C:\Windows\System\stUMdBH.exe
  C:\Windows\System\stUMdBH.exe
  2⤵
  PID:8820
- C:\Windows\System\bfNuQLI.exe
  C:\Windows\System\bfNuQLI.exe
  2⤵
  PID:8704
- C:\Windows\System\FqbTdIk.exe
  C:\Windows\System\FqbTdIk.exe
  2⤵
  PID:8224
- C:\Windows\System\kcBHAzh.exe
  C:\Windows\System\kcBHAzh.exe
  2⤵
  PID:9028
- C:\Windows\System\VVwtNgh.exe
  C:\Windows\System\VVwtNgh.exe
  2⤵
  PID:8896
- C:\Windows\System\RVitsWE.exe
  C:\Windows\System\RVitsWE.exe
  2⤵
  PID:9204
- C:\Windows\System\bEuhxuw.exe
  C:\Windows\System\bEuhxuw.exe
  2⤵
  PID:8340
- C:\Windows\System\KmDNNPM.exe
  C:\Windows\System\KmDNNPM.exe
  2⤵
  PID:8672
- C:\Windows\System\XeImbHe.exe
  C:\Windows\System\XeImbHe.exe
  2⤵
  PID:8772
- C:\Windows\System\gMWXYxO.exe
  C:\Windows\System\gMWXYxO.exe
  2⤵
  PID:8308
- C:\Windows\System\nsvtlfN.exe
  C:\Windows\System\nsvtlfN.exe
  2⤵
  PID:8836
- C:\Windows\System\eesGZVa.exe
  C:\Windows\System\eesGZVa.exe
  2⤵
  PID:9224
- C:\Windows\System\sABXIqD.exe
  C:\Windows\System\sABXIqD.exe
  2⤵
  PID:9240
- C:\Windows\System\bgrWotp.exe
  C:\Windows\System\bgrWotp.exe
  2⤵
  PID:9256
- C:\Windows\System\qQCQSvY.exe
  C:\Windows\System\qQCQSvY.exe
  2⤵
  PID:9272
- C:\Windows\System\SLLdyZu.exe
  C:\Windows\System\SLLdyZu.exe
  2⤵
  PID:9288
- C:\Windows\System\JMULIPn.exe
  C:\Windows\System\JMULIPn.exe
  2⤵
  PID:9304
- C:\Windows\System\MRqAawh.exe
  C:\Windows\System\MRqAawh.exe
  2⤵
  PID:9320
- C:\Windows\System\RMmDcuD.exe
  C:\Windows\System\RMmDcuD.exe
  2⤵
  PID:9336
- C:\Windows\System\bHVkwUA.exe
  C:\Windows\System\bHVkwUA.exe
  2⤵
  PID:9352
- C:\Windows\System\SSjLrpd.exe
  C:\Windows\System\SSjLrpd.exe
  2⤵
  PID:9368
- C:\Windows\System\lqbMRxV.exe
  C:\Windows\System\lqbMRxV.exe
  2⤵
  PID:9384
- C:\Windows\System\lmTRYdy.exe
  C:\Windows\System\lmTRYdy.exe
  2⤵
  PID:9400
- C:\Windows\System\RLNwsMu.exe
  C:\Windows\System\RLNwsMu.exe
  2⤵
  PID:9416
- C:\Windows\System\cKPAmRs.exe
  C:\Windows\System\cKPAmRs.exe
  2⤵
  PID:9436
- C:\Windows\System\WnCuJam.exe
  C:\Windows\System\WnCuJam.exe
  2⤵
  PID:9452
- C:\Windows\System\sxRtYNk.exe
  C:\Windows\System\sxRtYNk.exe
  2⤵
  PID:9468
- C:\Windows\System\TbRhKEw.exe
  C:\Windows\System\TbRhKEw.exe
  2⤵
  PID:9484
- C:\Windows\System\Tbtbgbt.exe
  C:\Windows\System\Tbtbgbt.exe
  2⤵
  PID:9500
- C:\Windows\System\pNTnJGh.exe
  C:\Windows\System\pNTnJGh.exe
  2⤵
  PID:9516
- C:\Windows\System\OzuzURb.exe
  C:\Windows\System\OzuzURb.exe
  2⤵
  PID:9532
- C:\Windows\System\fzQYorb.exe
  C:\Windows\System\fzQYorb.exe
  2⤵
  PID:9548
- C:\Windows\System\NCOvcLt.exe
  C:\Windows\System\NCOvcLt.exe
  2⤵
  PID:9564
- C:\Windows\System\oqTzXqm.exe
  C:\Windows\System\oqTzXqm.exe
  2⤵
  PID:9584
- C:\Windows\System\grBhlwV.exe
  C:\Windows\System\grBhlwV.exe
  2⤵
  PID:9600
- C:\Windows\System\RLDpjWd.exe
  C:\Windows\System\RLDpjWd.exe
  2⤵
  PID:9616
- C:\Windows\System\ByhQnDm.exe
  C:\Windows\System\ByhQnDm.exe
  2⤵
  PID:9632
- C:\Windows\System\GLdwQbh.exe
  C:\Windows\System\GLdwQbh.exe
  2⤵
  PID:9648
- C:\Windows\System\OhlcTed.exe
  C:\Windows\System\OhlcTed.exe
  2⤵
  PID:9664
- C:\Windows\System\ZNhbYqx.exe
  C:\Windows\System\ZNhbYqx.exe
  2⤵
  PID:9680
- C:\Windows\System\ABQwnwQ.exe
  C:\Windows\System\ABQwnwQ.exe
  2⤵
  PID:9700
- C:\Windows\System\iYAdTpM.exe
  C:\Windows\System\iYAdTpM.exe
  2⤵
  PID:9716
- C:\Windows\System\qzjIcha.exe
  C:\Windows\System\qzjIcha.exe
  2⤵
  PID:9736
- C:\Windows\System\xxXhFfS.exe
  C:\Windows\System\xxXhFfS.exe
  2⤵
  PID:9756
- C:\Windows\System\cbstDje.exe
  C:\Windows\System\cbstDje.exe
  2⤵
  PID:9800
- C:\Windows\System\SfUyHBf.exe
  C:\Windows\System\SfUyHBf.exe
  2⤵
  PID:9820
- C:\Windows\System\WphUGxt.exe
  C:\Windows\System\WphUGxt.exe
  2⤵
  PID:9836
- C:\Windows\System\FavDRcW.exe
  C:\Windows\System\FavDRcW.exe
  2⤵
  PID:9852
- C:\Windows\System\zJywsvW.exe
  C:\Windows\System\zJywsvW.exe
  2⤵
  PID:9868
- C:\Windows\System\hYgSoCV.exe
  C:\Windows\System\hYgSoCV.exe
  2⤵
  PID:9884
- C:\Windows\System\uxOCSmN.exe
  C:\Windows\System\uxOCSmN.exe
  2⤵
  PID:9900
- C:\Windows\System\olyNsuU.exe
  C:\Windows\System\olyNsuU.exe
  2⤵
  PID:9916
- C:\Windows\System\aVQBeLo.exe
  C:\Windows\System\aVQBeLo.exe
  2⤵
  PID:9932
- C:\Windows\System\rVUbCHK.exe
  C:\Windows\System\rVUbCHK.exe
  2⤵
  PID:9948
- C:\Windows\System\BwlNTKc.exe
  C:\Windows\System\BwlNTKc.exe
  2⤵
  PID:9968
- C:\Windows\System\RZfGosN.exe
  C:\Windows\System\RZfGosN.exe
  2⤵
  PID:9984
- C:\Windows\System\loZEqET.exe
  C:\Windows\System\loZEqET.exe
  2⤵
  PID:10000
- C:\Windows\System\iEyuLGR.exe
  C:\Windows\System\iEyuLGR.exe
  2⤵
  PID:10016
- C:\Windows\System\GYZtfVb.exe
  C:\Windows\System\GYZtfVb.exe
  2⤵
  PID:10032
- C:\Windows\System\rNmBkvZ.exe
  C:\Windows\System\rNmBkvZ.exe
  2⤵
  PID:10048
- C:\Windows\System\FHIzftA.exe
  C:\Windows\System\FHIzftA.exe
  2⤵
  PID:10064
- C:\Windows\System\gQTWGyo.exe
  C:\Windows\System\gQTWGyo.exe
  2⤵
  PID:10080
- C:\Windows\System\iAbFleH.exe
  C:\Windows\System\iAbFleH.exe
  2⤵
  PID:10096
- C:\Windows\System\NGrsTRh.exe
  C:\Windows\System\NGrsTRh.exe
  2⤵
  PID:10112
- C:\Windows\System\DOZyfSr.exe
  C:\Windows\System\DOZyfSr.exe
  2⤵
  PID:10128
- C:\Windows\System\ZWKbekc.exe
  C:\Windows\System\ZWKbekc.exe
  2⤵
  PID:10144
- C:\Windows\System\rouwASG.exe
  C:\Windows\System\rouwASG.exe
  2⤵
  PID:10160
- C:\Windows\System\YmEESFo.exe
  C:\Windows\System\YmEESFo.exe
  2⤵
  PID:10176
- C:\Windows\System\HxHbHgF.exe
  C:\Windows\System\HxHbHgF.exe
  2⤵
  PID:10192
- C:\Windows\System\utuKbTv.exe
  C:\Windows\System\utuKbTv.exe
  2⤵
  PID:10208
- C:\Windows\System\yUwEaTT.exe
  C:\Windows\System\yUwEaTT.exe
  2⤵
  PID:10224
- C:\Windows\System\ovtgDHx.exe
  C:\Windows\System\ovtgDHx.exe
  2⤵
  PID:9232
- C:\Windows\System\yDwwVGY.exe
  C:\Windows\System\yDwwVGY.exe
  2⤵
  PID:9296
- C:\Windows\System\aHwDFis.exe
  C:\Windows\System\aHwDFis.exe
  2⤵
  PID:9360
- C:\Windows\System\TJecagK.exe
  C:\Windows\System\TJecagK.exe
  2⤵
  PID:9424
- C:\Windows\System\GRfCrcT.exe
  C:\Windows\System\GRfCrcT.exe
  2⤵
  PID:9492
- C:\Windows\System\YlJlIap.exe
  C:\Windows\System\YlJlIap.exe
  2⤵
  PID:8544
- C:\Windows\System\nIVNGGB.exe
  C:\Windows\System\nIVNGGB.exe
  2⤵
  PID:9344
- C:\Windows\System\EXWkajc.exe
  C:\Windows\System\EXWkajc.exe
  2⤵
  PID:9556
- C:\Windows\System\KRJLwoy.exe
  C:\Windows\System\KRJLwoy.exe
  2⤵
  PID:9596
- C:\Windows\System\wimnbrP.exe
  C:\Windows\System\wimnbrP.exe
  2⤵
  PID:9380
- C:\Windows\System\pyUeiXj.exe
  C:\Windows\System\pyUeiXj.exe
  2⤵
  PID:9656
- C:\Windows\System\aJoRvip.exe
  C:\Windows\System\aJoRvip.exe
  2⤵
  PID:9508
- C:\Windows\System\SGywBGJ.exe
  C:\Windows\System\SGywBGJ.exe
  2⤵
  PID:9728
- C:\Windows\System\mBtCsfc.exe
  C:\Windows\System\mBtCsfc.exe
  2⤵
  PID:9688
- C:\Windows\System\yfhgNmn.exe
  C:\Windows\System\yfhgNmn.exe
  2⤵
  PID:9644
- C:\Windows\System\rYwEZns.exe
  C:\Windows\System\rYwEZns.exe
  2⤵
  PID:9580
- C:\Windows\System\KoJpeiy.exe
  C:\Windows\System\KoJpeiy.exe
  2⤵
  PID:9544
- C:\Windows\System\tzChSvs.exe
  C:\Windows\System\tzChSvs.exe
  2⤵
  PID:9672
- C:\Windows\System\mBFcKBj.exe
  C:\Windows\System\mBFcKBj.exe
  2⤵
  PID:9748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BImbvWk.exe

Filesize
1.5MB

MD5
da295461d3838384c79da7793d646892

SHA1
32693e2eace2fec6d7ed8f81ff0a0c8dcb476ebd

SHA256
d1c93a0fb1920f9cee48846c74eb0243aa4c1775e817dfaf8b59e9a5c6257269

SHA512
a97f22c3dd5c06d4dd515f8a9b1542743bdc37ddafc3fb79ec32198e846f1a4f1ac381e3b439e8ac6ba1ea00d88d54ad1fbbb1658e5308aae68b8004b8f4970b

Download Submit
C:\Windows\system\EoHWTFN.exe

Filesize
1.5MB

MD5
24ba9371e0ba00d1893bb7d977b96f40

SHA1
ef9d7f3b4375f817b83e7eee569e56b27893cc25

SHA256
d4e3b606afc80010eeeeddd9456531651ca3da9c633633efedf993419b1a427b

SHA512
4413def39c0acb28f7f88b16701c4048b722ebd954101a5e48a74f892ee1d110514bee70595a04a1f32db227555ad8bc7b0d51f11a1756a01d2588ce9e7b9790

Download Submit
C:\Windows\system\FruTNUb.exe

Filesize
1.5MB

MD5
a278f7fdd5cd0e83a6319994bfe26e33

SHA1
866e174c6960384aeec12f55bc544f1b235d679a

SHA256
7aab436abc05131fb96d909fd4f1e081bc3b440eac02f4d7673e38ec36b6aa1b

SHA512
190a439e4b49e95bb1b08773c13137f3ec87d2e01aa8f26c0852be4c4e81d47f6ac247afac214f9f305f9f29af31377407bb4005690f23a0d964e470ceffe2b7

Download Submit
C:\Windows\system\JxUMSSj.exe

Filesize
1.5MB

MD5
44908277b3368fada2d7c529b80187a6

SHA1
dc848ccae6a48fd7208c5c26c963cd4ad34d98f5

SHA256
687e404a032f3922e6f21e1ef541ef5c7a2c666721777f5643a9b0f889d0289f

SHA512
25d9f4952ef31b28714134714489d9f25c9b7f650414913e8ccbe364bfb8ee3030f7507cdbf39fe2529c3cbde4628104010aed6a5a56c94ba91b49aafe481353

Download Submit
C:\Windows\system\LMKfamn.exe

Filesize
1.5MB

MD5
1a20aec54e8cf767268e73b235506760

SHA1
92ab67d91364c801df895bf788ae0f771b5c7f4e

SHA256
c161d1f3050696c9b3f26263b143fa6f5afb0779b4ab4b4f2061c8c98fd5ef77

SHA512
14c2e40308011dd2d7d238c0ad90a776e6da78fd7d1841eaa6bde4416727a4ef93114a8443361a68cb41247f7f9a38f89ec46acdb5a6b62fac39ecff45b071d3

Download Submit
C:\Windows\system\MgkvThI.exe

Filesize
1.5MB

MD5
7cec9f566d55f99549ea8550ded96f6f

SHA1
90d56cdf27951d283721f1ac5deaf811b66fbb57

SHA256
70174eb2238c631827eabb7985e15d7fa2a6041942d0d2b6dc59cd3223ca2640

SHA512
711c12d56a52a30e64b54208174e1c9388489f99c7c650efa44de8147c164c1fac91108eaa15bff1daacd00189f1f1a6e25a8f3ea3b6b7427a3b1609a793d3cf

Download Submit
C:\Windows\system\NiqDXNL.exe

Filesize
1.5MB

MD5
91279878add93c02505c9ab08c59283c

SHA1
459acc46f3bba19621816a8bb70e3941315274e0

SHA256
8d9c05ca74d3dd1e3eff3cbf46c655c5460ba1cfc9a3d584a664b5b7ebcc203a

SHA512
b0ca4726d7632758be618720cd160cc39f1d939b22b229d774786569c0b27408afdc0aaa01695ef8433be2b1bad7205d005ace658e3905b0a2caf0b3711fa5db

Download Submit
C:\Windows\system\RpZyAcE.exe

Filesize
1.5MB

MD5
23144f8a8dcee66c02231344eeb85e70

SHA1
46c8e6d89117adf497b4e91f03812fb480d0d343

SHA256
8a98aead19d41d1e12295d6b397eded3e08f633b32979971c85b08595296d04e

SHA512
99bf8c2039c9ff73a08083244097afc5b3b22a2114c5634857eae0b41d16ef6ba7bbaa565cba8f3c8b21012bb371e59e94ba3062bb7f4723d34f6bc05320beff

Download Submit
C:\Windows\system\YtLHGxB.exe

Filesize
1.5MB

MD5
9ebcc3b6fb36eff0ca9fd10fd731249f

SHA1
2b2ecb3113573dc898c58b89f70ce8a9d83e6e27

SHA256
d2a6ab8af0331d12307748cf74e8354d798f53243c99955c24d51f5625e311b8

SHA512
925cf0866a751025a4b8dd0129ea3d20954a8eaa43e2c2ed94ff6baba986e61425867328cbfbbaf1ac75a5cac5697efe38e29bcab6ea8bec851f564e70b86eb3

Download Submit
C:\Windows\system\ZExfiRw.exe

Filesize
1.5MB

MD5
2ae8493982c81f52de5525ab086db281

SHA1
9573dfd4c6f13bdcfb60cb0fab13a246c868e80a

SHA256
aadd51dd96a43c7e70b07f75ffc1bbbe89395ba6f140f003b15cf489dd05ff4c

SHA512
2a702d592fba313907c5430633cdb60e2279648040e2b367a8771b3b6718c4682e4e9976c713f379ad04596b71ba8f1a3166183d1a5bca972e94f3b574cd83dd

Download Submit
C:\Windows\system\aEzFiCZ.exe

Filesize
1.5MB

MD5
b815386a1a394cb3277695b7ee150e2b

SHA1
b994f348d6259baac895435ef76caa1e772c766b

SHA256
073a19612140b2c4e61fe6a6ba6b8c426276c0d8fdb55d84c0778c2ee903c531

SHA512
41f3dae5df95c27dd8ee20da0c190bb0acbb42481c51fdf34f34c998ae06ba39a7ab53a853ee20cb065c91c085a8077b090deda6a0b8e8d516be8e5d9bd61d38

Download Submit
C:\Windows\system\cBjpKQz.exe

Filesize
1.5MB

MD5
6dbfb4916f73478a2b6e2404f6ff6395

SHA1
c922f5b0245ab58f422e5a802855c12a0ed1bcf5

SHA256
7be5ed0c1496f6f22b0b8b725b4c186234176173b6a66785a30b434bc14012c9

SHA512
a1ea2a698a54a3f46fe1c1584c1cb12e73f03c09f845c334b3a4467a13b8e7e4ea2f070fd53c6519db54c9391092bd51c589fb8ff7977f3d96567f3d880e3887

Download Submit
C:\Windows\system\cbkfplP.exe

Filesize
1.5MB

MD5
1a962724f4773c965cf708a4a7b0ae0a

SHA1
c1cee774ff3d770825fc7e696d578ee64f70288f

SHA256
dcd28f716c6386177d85569a67b66fc79ae952aa6bb0d5e1c0b138efbf51db23

SHA512
b96bbb960b89c4ef907e00c43eb646bc58ee212648a89591fab18c56a7427180e957330c013590b39f84a038c3b26aea24bff8005c6d23d6a381a961d66af8f8

Download Submit
C:\Windows\system\dXBdsVA.exe

Filesize
1.5MB

MD5
6d2f8c01a6ded5a404be56a3352dcad0

SHA1
c348bc106c277807c737727e3db0183f63ba79fe

SHA256
f81f4f3869c67827a1c065e5e73b75086b994d42cd56a989a8333ca0468b9b8f

SHA512
4ad45d5388aeba92dd7cda3ee03625551cb72be77ebdf2668be372ae1bcd57d7e2496ac69b3ecf27287f9a2c8208f82fcd417017ff5874dbf5a3a67bfa32a695

Download Submit
C:\Windows\system\eBEPQKL.exe

Filesize
1.5MB

MD5
bdf980db7ead623005e69cd9bc1aea65

SHA1
e3134f4fb4a9e97e42a140f81b9ed45eff46aa90

SHA256
878e777ce6dbd8fe7aef729a789937686ff85bc91ff1f8150f48f85c75b42cae

SHA512
19ae1befcd4a574d4803fa7a0b80f538525626f703c010f604a1d1951e37ed38033bc663cc174c0becd06a941aba87e4dc2121ade6933435f3f228b5205e7cdb

Download Submit
C:\Windows\system\gebcBpL.exe

Filesize
1.5MB

MD5
d92da7778648b8afb404ded1efe74161

SHA1
12fca13bd3b0e47e47b8eb014ab4510d2ada93e5

SHA256
3f8a9cf72aac77af9b5c533eb27c629f658a276a298fb5d9a11b5d83516a82b2

SHA512
a69244b8d9db4c0f455dc4d9727feca33ae0111bac5f0d6f5d5535794ebba51abbdd92928a5faa795482cb4f007620dd89e71cc333ac698e3add234d27cc8f86

Download Submit
C:\Windows\system\iPRYjrT.exe

Filesize
1.5MB

MD5
075383e736804d6c5d59d783648feb5f

SHA1
de92d158eb4d9030939fe0923008bb0de29862a7

SHA256
1ef500780421c0abf2397a651a18bb9d36cd64c05e1046c841f46634baa0aaec

SHA512
2e5cc8080bc537b24c1c50a3d90fec022e5a26e87bc48c8d599070b977620e3182490676c9f3f42f777bc1fa48fc9bc3acb72edf0c049274230188d2153868e0

Download Submit
C:\Windows\system\iYJflnR.exe

Filesize
1.5MB

MD5
a2e1c294540a484beef5ffb9c99b9144

SHA1
2ca773bedd279cba59da6177dfed467edb3a642b

SHA256
59be7ca782fd2e87d9bf31015c9b4afacff7eab6fc6558eb84cc7bb0d07a6593

SHA512
b69fb98f85b86c6f49fb9f0e8ceef561df511d912b91285f89972815914842238812dfda66956e0a6e2ae8d50ecafa42300c50f9ee9368791139f2ca9fb2e2aa

Download Submit
C:\Windows\system\jOTyoZm.exe

Filesize
1.5MB

MD5
f9046aa445b6bab52b5d04fa41378b62

SHA1
6b80ce5fae85a505232d3ca3deb1e54ef2236448

SHA256
c3c2fc422bb5a828ee14fa83a9f03b9537b532c81dc54f052c74f61835059ca5

SHA512
eb8a5dc58f759530e7a571f389dbb85c2dc962b47b4455ebd6e865e2020f9897a7646346ac244e95d610ebeda41daa046a543502aeaf1f9b992b5b1e8646e08b

Download Submit
C:\Windows\system\kloqjrX.exe

Filesize
1.5MB

MD5
3044fea606f416283c5cd997d4f36476

SHA1
f37c4160325afb24824704eff7bf541a31802207

SHA256
8fbf189954815109784a7f4aed56ae93cd2de7ebaae6693c9fe5498152b36c2f

SHA512
f7c5a85695212f59de1319021025350a5f42af364f0eb40093affc997ce831cd01f874fc46a803a3310f1b7b06721dc1e218a653950ed7f8c9c843ecdba1d023

Download Submit
C:\Windows\system\lwhcwGx.exe

Filesize
1.5MB

MD5
8f9936f8ea5b4e2e9461f3f25c7e3cb0

SHA1
f915a8bc0f1fa3b86008714b6861f074d23c0d35

SHA256
9dc919dddcce8fc313381abb6880c2a8f1db870b5c203d49f61be67c11c86991

SHA512
7b4ec9d325d6fc59daec41e1acbada481b08fd0ad02e046e5d4b4aa6ce9cb75a7534dd512873b6e254c4b2864540795084282d27d8858d7400c0e327c3065ec5

Download Submit
C:\Windows\system\nirbRWc.exe

Filesize
1.5MB

MD5
0117c885a61e4a6353d4f3b5d6d6e082

SHA1
d7250c935534f37b95d33a3f5463f6350e7afbaa

SHA256
3edee2288dce2d538b2f34565b12e93debccc0fa6b40d1c70e654b736883da12

SHA512
d57d247b7586497fd4e0ca3966ad08ed3bb46e3b5d4654b81327f2e6a7e793cd29f1378b956f82a02453672ae3af8f776ad66a6b9671d417740dba2f496fcef4

Download Submit
C:\Windows\system\oyvFqwg.exe

Filesize
1.5MB

MD5
d404bb9e6a296bbb3950efc89b757645

SHA1
99bdce1aa8d80c93eba64cbe012dc7f85420c0b6

SHA256
c7dc38184ef8855ebd9f5c2751ee3ad315223594fff76527a764b815e47e3bb6

SHA512
12e82094d9988de52983baeb6ec2ff1e8184946d37767de98badf81622e503da353dc9d790e646b163e67229a3a2b73dadf13b8f46c212aefde5e3a4c44da8b9

Download Submit
C:\Windows\system\qiDZlWR.exe

Filesize
1.5MB

MD5
edf0d18fa6dfe16a6e59fd381928fba5

SHA1
bdb81ca80f693dafe38c2921c02e3b370f47d4cd

SHA256
a87e05220316a3e9fe0bc3ba3ff2c8f824e093eec466a5d8ced45c6625f72d42

SHA512
a556519c19464eb0c5dfa279784ccba2f580ff0e1c8781370ec3e316de086bf6267c23094753ec4a821cbf68af5995c457301047ebeb11ffd9e1681481b800e0

Download Submit
C:\Windows\system\tSWbxZt.exe

Filesize
1.5MB

MD5
d866dc05349aa07e9246278d51376297

SHA1
9d878e6455e66c4dcfc8301a0a45f9a47b3d6d62

SHA256
ebd090fd8c8d391ce421310bfde6c2a3d9b2b116f1011e9e9f9aa740f1d22146

SHA512
59f97ff3e2455c277f35a262dd4e0861e9c87d340da966ba605bbd6e7e72e4b07c384fd3072bf642aeaf5a50932bb5f48c1004246c759d3421811cb9e19eeddb

Download Submit
C:\Windows\system\uqBKBwd.exe

Filesize
1.5MB

MD5
a5ef0c6754ad9cd144ea1b7cdd736eab

SHA1
8441163f45d23ecef673269fcbe80e907f6c1c9a

SHA256
324ed4e5ff1319b710369ed6bb08aba679d115591d54959f1f05370b07122a9f

SHA512
eebd591fd091827a0e8208c7a39626bfafa7f046b59757f2c0ee1e06f294e3d9077d947334ad30b7c92681bbae4c2f5af277313924db734f383ad44a08f22693

Download Submit
C:\Windows\system\wPiSroN.exe

Filesize
1.5MB

MD5
d9633d4563fa365789442eddfac50974

SHA1
562009289d336ed0f4c1a1a416e7408240835313

SHA256
0d8f27d580ddefb1f1308911a1300bce4992256d183ccea630ef64ebff2fdecd

SHA512
66d8c774c9c8a808481b81d85333fb9ccbf1eda1e2d93b41c1e3b5a9e727b4e1b2a9830c41f815165dd4809ec252ca49a067132d80e4c9a3c97399c24cfbc78e

Download Submit
C:\Windows\system\xnueqws.exe

Filesize
1.5MB

MD5
1c53531c26da7896d0b6871858626aa1

SHA1
df1a4a3cc7ae38c2ed3912dc556f6ca769f3daa1

SHA256
5db8190a30151924c061fb76c7e9e4aa23bdde6c444350ed97ff86d378648b47

SHA512
2932258d5e384adf6c94f8c8df8dc20e48f863d00d7ab120e1e62cc67ef1b36543b02faae1508020a6e3ae947f5d4390f6e330274940cf1e1342c5968f902b1f

Download Submit
\Windows\system\MbRCNno.exe

Filesize
1.5MB

MD5
7eb1e436b2b8924db3fd02e5285cc755

SHA1
b4db79fde70e8e07c649fe9dc11003e8d56fbef6

SHA256
87b92c0b32515f6ff9171f57b221a3de78f7130c448b739df6d79aaafbc8d408

SHA512
526b93b5f303ce838e17fcc860e172cbe5cbf132d2d9e5b63b3500929fe3a45382187d2cce737ed6c64cac15ea9758c05671f100d3814fb4b010c26958dd0619

Download Submit
\Windows\system\jqecHLU.exe

Filesize
1.5MB

MD5
e66ce662dc67cdd9c4f3c6e3a26d11e3

SHA1
eec6f351da868a36a84978e7fdcdbc1f0cedf8fb

SHA256
74d426b1cb7cccd4a82247a342f6da64f5a07bce23901974cd300ff195939e66

SHA512
56fa53094463f699f814946131a8dfdd5da62073b24632bae44752f0e03d157090eac0bd435fcf5052d34968d22844d85ad1e194f4167eb7b9f7eb03630325c1

Download Submit
\Windows\system\okiFAfe.exe

Filesize
1.5MB

MD5
06b614a150083d167611addf22cd840c

SHA1
a5daff142f056980ba84c24388a026549955bb35

SHA256
71bc771655a44817ca7b6bdc1e0b3d07cbd69a5ca453dc95ac86c1d3bc721db7

SHA512
f2549b339c2f17c3ae28ac4e5f6b1e33da3b73a81d5eb6899d0b10cf788d744b1506382e4aee9537625e9c2ed26d87435291b3b2862c0cf940229cd7f0e0857d

Download Submit
\Windows\system\rwggyBs.exe

Filesize
1.5MB

MD5
391c3f7137fe9e3c77e598f77869acc2

SHA1
ab98843d484228d86f467474c4666e8dbd7b44e9

SHA256
a3f66b2b4cb246a1bd58a7f11897ea3712becb9a45b4f593aef70acc2c9e710f

SHA512
f5fc99519be7ab8c051d9ab9db10f86bad4f2b5f1a58747fedf40d45673737a341bd46cf52ff920ad9b9d212079b9ddb6b2fccb5a671a5e7c29a94bb89463ee9

Download Submit
memory/2168-164-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2168-5458-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-161-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2508-169-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2508-4973-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2540-180-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2540-5481-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2620-21-0x000000013FC30000-0x0000000140022000-memory.dmp

Filesize
3.9MB

Download
memory/2620-5393-0x000000013FC30000-0x0000000140022000-memory.dmp

Filesize
3.9MB

Download
memory/2688-23-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2688-5394-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2692-37-0x000007FEF5BDE000-0x000007FEF5BDF000-memory.dmp

Filesize
4KB

Download
memory/2692-195-0x000000001B570000-0x000000001B852000-memory.dmp

Filesize
2.9MB

Download
memory/2692-159-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download
memory/2692-239-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download
memory/2692-198-0x0000000002920000-0x0000000002928000-memory.dmp

Filesize
32KB

Download
memory/2792-5541-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2792-184-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2828-5507-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/2828-182-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/2964-5484-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-177-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/3012-175-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/3012-19-0x0000000002CC0000-0x00000000030B2000-memory.dmp

Filesize
3.9MB

Download
memory/3012-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/3012-179-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/3012-181-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/3012-14441-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/3012-15-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/3012-178-0x0000000002DC0000-0x00000000031B2000-memory.dmp

Filesize
3.9MB

Download
memory/3012-176-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/3012-183-0x0000000002DC0000-0x00000000031B2000-memory.dmp

Filesize
3.9MB

Download
memory/3012-166-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/3012-160-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/3012-163-0x0000000002DC0000-0x00000000031B2000-memory.dmp

Filesize
3.9MB

Download
memory/3012-2-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/3012-22-0x0000000002DC0000-0x00000000031B2000-memory.dmp

Filesize
3.9MB

Download
memory/3012-162-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/3064-5446-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/3064-18-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download