xmrig | 8306985efa9e1df79d4f1651a907d4aad9f462c1e36130fd3cd77122f033df57

Analysis

max time kernel
12s
max time network
31s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
Size

1.8MB
MD5

0465fc0f0cefb5e2e2d5bebb2d2ef8a2
SHA1

866e685b73ebbd69f93422cc32c48ec039b507a2
SHA256

8306985efa9e1df79d4f1651a907d4aad9f462c1e36130fd3cd77122f033df57
SHA512

7e1de901855b6fdc9cb96284a9a7194a8ad8f43a29d0f93b7305d7dcf6cb03e1f09c5645de3384d3a13aad80cce134de2a825eb1c5dc114532240d201e651294
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl8Q:NABa

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/2632-330-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig
behavioral1/memory/2308-390-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/2608-451-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/1656-496-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2656-463-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig
behavioral1/memory/2472-418-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2592-362-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2172-494-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2852-493-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2120-492-0x000000013F650000-0x000000013FA42000-memory.dmp	xmrig
behavioral1/memory/2452-490-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
296	arRvNYR.exe
2632	NDNjiwa.exe
2592	EHJAnoi.exe
2308	ybGIxdM.exe
2472	JSiDkZO.exe
2608	NelEPpS.exe
2656	XfWviat.exe
2452	JvaWusa.exe
2120	saksrlS.exe
2852	DjKzpiF.exe
2172	aUWcteE.exe
1656	skvhgbE.exe
3000	aniVuvH.exe
1712	krnQeOm.exe
2988	nzhiAGs.exe
2844	dbkPOWF.exe
1120	tHxorOA.exe
1188	XHTGuBt.exe
2676	YzKwExv.exe
2720	zTqlNkO.exe
2768	SyXeXoa.exe
2832	IWohQTR.exe
2944	VynSIIR.exe
2496	VFudwhR.exe
1312	epJGnIy.exe
1284	mNmiRvy.exe
2672	xuIXOKM.exe
1444	QDebsAL.exe
808	xVLhUyh.exe
2128	yYyheAk.exe
1080	JltnMNd.exe
2200	JjqkYuI.exe
720	aScXHRC.exe
1812	PFXWKTE.exe
2080	ERAIbvO.exe
688	ZkfFZgq.exe
1784	aSiCyZm.exe
2068	hFZIGmu.exe
1332	PEWohfD.exe
1036	VZGNRMv.exe
1756	jshKWBv.exe
1688	nErYiOi.exe
940	kugyNJx.exe
2288	GHNyTOd.exe
860	fdgWBAZ.exe
1376	wrtUiAl.exe
2368	dFZoIRZ.exe
1348	hNrPddY.exe
2380	eQvPmsZ.exe
1184	XFUeQnw.exe
2384	njmADko.exe
2336	MYqwDka.exe
1600	MrulsEy.exe
2444	cKzWsqF.exe
2516	YwoGTPE.exe
1720	xFLYdYP.exe
2560	kSoYTFr.exe
2436	wPHqEpy.exe
3020	ayLgnSm.exe
1676	xUIolMK.exe
2328	mCelOdr.exe
1824	GrXTJzm.exe
636	sWehama.exe
2392	EIwybGK.exe

Loads dropped DLL 64 IoCs

pid	Process
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/756-0-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/files/0x000c000000014454-3.dat	upx
behavioral1/files/0x0007000000014b27-13.dat	upx
behavioral1/files/0x0007000000014b63-18.dat	upx
behavioral1/files/0x0008000000014e51-29.dat	upx
behavioral1/files/0x0006000000015ceb-38.dat	upx
behavioral1/files/0x0006000000015d28-49.dat	upx
behavioral1/files/0x0007000000014baa-53.dat	upx
behavioral1/files/0x0007000000004e76-67.dat	upx
behavioral1/files/0x0006000000015d67-78.dat	upx
behavioral1/files/0x0006000000015d79-88.dat	upx
behavioral1/files/0x0006000000015d8f-100.dat	upx
behavioral1/files/0x0006000000016572-147.dat	upx
behavioral1/files/0x0006000000016c4a-166.dat	upx
behavioral1/files/0x000600000001661c-151.dat	upx
behavioral1/files/0x0006000000016a9a-160.dat	upx
behavioral1/files/0x00060000000164b2-146.dat	upx
behavioral1/files/0x00060000000161e7-136.dat	upx
behavioral1/files/0x0006000000015fe9-125.dat	upx
behavioral1/files/0x0006000000016843-158.dat	upx
behavioral1/files/0x000600000001630b-139.dat	upx
behavioral1/files/0x0006000000015eaf-115.dat	upx
behavioral1/files/0x0006000000016117-130.dat	upx
behavioral1/files/0x0006000000015d9b-105.dat	upx
behavioral1/files/0x0006000000015f6d-120.dat	upx
behavioral1/files/0x0006000000015e3a-109.dat	upx
behavioral1/files/0x0006000000015d87-95.dat	upx
behavioral1/files/0x0007000000015d5e-83.dat	upx
behavioral1/files/0x0006000000015d6f-80.dat	upx
behavioral1/files/0x0006000000015d4a-65.dat	upx
behavioral1/files/0x0006000000015d07-41.dat	upx
behavioral1/files/0x0007000000015ce1-33.dat	upx
behavioral1/files/0x0037000000014708-28.dat	upx
behavioral1/files/0x0007000000014aa2-17.dat	upx
behavioral1/memory/2632-330-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/memory/2308-390-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/memory/2608-451-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/1656-496-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2656-463-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/memory/2472-418-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/2592-362-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/296-306-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/memory/2172-494-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2852-493-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2120-492-0x000000013F650000-0x000000013FA42000-memory.dmp	upx
behavioral1/memory/2452-490-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XtFxCug.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\XoMZZou.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\VauEkei.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\VnjFKkl.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\fzvyHwl.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\EHeqkba.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\iiTxiqY.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\dGztPBK.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\daKLysn.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\uknlNKY.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\heEFKXF.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\PKlwwlB.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\zADlYXX.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\JMVKTbQ.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\JcCqMzO.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\oZXrQDJ.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\HobtAbq.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\JltnMNd.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\hNrPddY.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\mWyeDgu.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\AnIlFbn.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\VwSpWuu.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\DgekvsL.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\Gdobcyt.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\NDNjiwa.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\SZRdqbv.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\YzKwExv.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\ZsGUwZp.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\DNuyUgS.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\aUWcteE.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\OWvWhFj.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\zjvjYfc.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\dhhAaIo.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\VyooEsq.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\GQsJLfp.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\epJGnIy.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\FSMbmwO.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\waCXyYU.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\eRbzZlx.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\JSiDkZO.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\ERAIbvO.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\KLITidD.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\sgScZfS.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\URPcBok.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\QDebsAL.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\WcNlXyN.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\Ponqfcq.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\yNLiytF.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\fFpiqTV.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\ETVjJUP.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\JwXyhiI.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\HofGhLT.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\iXGzSMm.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\dbtbfjf.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\qwZmFyE.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\oUUlSZU.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\uCxmQvp.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\VHfayDF.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\GvOoDwo.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\pwOJqMJ.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\aScXHRC.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\mBgHjES.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\hSKbIAG.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
File created	C:\Windows\System\JjrexuB.exe	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2352	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
Token: SeDebugPrivilege	2352	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2352	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	29
PID 756 wrote to memory of 2352	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	29
PID 756 wrote to memory of 2352	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	29
PID 756 wrote to memory of 296	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	30
PID 756 wrote to memory of 296	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	30
PID 756 wrote to memory of 296	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	30
PID 756 wrote to memory of 2308	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	31
PID 756 wrote to memory of 2308	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	31
PID 756 wrote to memory of 2308	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	31
PID 756 wrote to memory of 2632	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	32
PID 756 wrote to memory of 2632	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	32
PID 756 wrote to memory of 2632	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	32
PID 756 wrote to memory of 2656	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	33
PID 756 wrote to memory of 2656	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	33
PID 756 wrote to memory of 2656	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	33
PID 756 wrote to memory of 2592	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	34
PID 756 wrote to memory of 2592	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	34
PID 756 wrote to memory of 2592	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	34
PID 756 wrote to memory of 2120	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	35
PID 756 wrote to memory of 2120	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	35
PID 756 wrote to memory of 2120	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	35
PID 756 wrote to memory of 2472	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	36
PID 756 wrote to memory of 2472	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	36
PID 756 wrote to memory of 2472	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	36
PID 756 wrote to memory of 2852	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	37
PID 756 wrote to memory of 2852	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	37
PID 756 wrote to memory of 2852	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	37
PID 756 wrote to memory of 2608	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	38
PID 756 wrote to memory of 2608	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	38
PID 756 wrote to memory of 2608	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	38
PID 756 wrote to memory of 2172	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	39
PID 756 wrote to memory of 2172	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	39
PID 756 wrote to memory of 2172	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	39
PID 756 wrote to memory of 2452	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	40
PID 756 wrote to memory of 2452	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	40
PID 756 wrote to memory of 2452	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	40
PID 756 wrote to memory of 1656	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	41
PID 756 wrote to memory of 1656	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	41
PID 756 wrote to memory of 1656	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	41
PID 756 wrote to memory of 3000	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	42
PID 756 wrote to memory of 3000	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	42
PID 756 wrote to memory of 3000	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	42
PID 756 wrote to memory of 2988	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	43
PID 756 wrote to memory of 2988	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	43
PID 756 wrote to memory of 2988	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	43
PID 756 wrote to memory of 1712	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	44
PID 756 wrote to memory of 1712	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	44
PID 756 wrote to memory of 1712	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	44
PID 756 wrote to memory of 1120	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	45
PID 756 wrote to memory of 1120	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	45
PID 756 wrote to memory of 1120	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	45
PID 756 wrote to memory of 2844	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	46
PID 756 wrote to memory of 2844	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	46
PID 756 wrote to memory of 2844	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	46
PID 756 wrote to memory of 1188	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	47
PID 756 wrote to memory of 1188	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	47
PID 756 wrote to memory of 1188	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	47
PID 756 wrote to memory of 2676	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	48
PID 756 wrote to memory of 2676	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	48
PID 756 wrote to memory of 2676	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	48
PID 756 wrote to memory of 2720	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	49
PID 756 wrote to memory of 2720	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	49
PID 756 wrote to memory of 2720	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	49
PID 756 wrote to memory of 2768	756	0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0465fc0f0cefb5e2e2d5bebb2d2ef8a2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\System\arRvNYR.exe
  C:\Windows\System\arRvNYR.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\ybGIxdM.exe
  C:\Windows\System\ybGIxdM.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\NDNjiwa.exe
  C:\Windows\System\NDNjiwa.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\XfWviat.exe
  C:\Windows\System\XfWviat.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\EHJAnoi.exe
  C:\Windows\System\EHJAnoi.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\saksrlS.exe
  C:\Windows\System\saksrlS.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\JSiDkZO.exe
  C:\Windows\System\JSiDkZO.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\DjKzpiF.exe
  C:\Windows\System\DjKzpiF.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\NelEPpS.exe
  C:\Windows\System\NelEPpS.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\aUWcteE.exe
  C:\Windows\System\aUWcteE.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\JvaWusa.exe
  C:\Windows\System\JvaWusa.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\skvhgbE.exe
  C:\Windows\System\skvhgbE.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\aniVuvH.exe
  C:\Windows\System\aniVuvH.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\nzhiAGs.exe
  C:\Windows\System\nzhiAGs.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\krnQeOm.exe
  C:\Windows\System\krnQeOm.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\tHxorOA.exe
  C:\Windows\System\tHxorOA.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\dbkPOWF.exe
  C:\Windows\System\dbkPOWF.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\XHTGuBt.exe
  C:\Windows\System\XHTGuBt.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\YzKwExv.exe
  C:\Windows\System\YzKwExv.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\zTqlNkO.exe
  C:\Windows\System\zTqlNkO.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\SyXeXoa.exe
  C:\Windows\System\SyXeXoa.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\IWohQTR.exe
  C:\Windows\System\IWohQTR.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\VynSIIR.exe
  C:\Windows\System\VynSIIR.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\VFudwhR.exe
  C:\Windows\System\VFudwhR.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\epJGnIy.exe
  C:\Windows\System\epJGnIy.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\mNmiRvy.exe
  C:\Windows\System\mNmiRvy.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\xuIXOKM.exe
  C:\Windows\System\xuIXOKM.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\QDebsAL.exe
  C:\Windows\System\QDebsAL.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\xVLhUyh.exe
  C:\Windows\System\xVLhUyh.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\aScXHRC.exe
  C:\Windows\System\aScXHRC.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\yYyheAk.exe
  C:\Windows\System\yYyheAk.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\PFXWKTE.exe
  C:\Windows\System\PFXWKTE.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\JltnMNd.exe
  C:\Windows\System\JltnMNd.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\ZkfFZgq.exe
  C:\Windows\System\ZkfFZgq.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\JjqkYuI.exe
  C:\Windows\System\JjqkYuI.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\hFZIGmu.exe
  C:\Windows\System\hFZIGmu.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\ERAIbvO.exe
  C:\Windows\System\ERAIbvO.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\jshKWBv.exe
  C:\Windows\System\jshKWBv.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\aSiCyZm.exe
  C:\Windows\System\aSiCyZm.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\nErYiOi.exe
  C:\Windows\System\nErYiOi.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\PEWohfD.exe
  C:\Windows\System\PEWohfD.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\kugyNJx.exe
  C:\Windows\System\kugyNJx.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\VZGNRMv.exe
  C:\Windows\System\VZGNRMv.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\GHNyTOd.exe
  C:\Windows\System\GHNyTOd.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\fdgWBAZ.exe
  C:\Windows\System\fdgWBAZ.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\wrtUiAl.exe
  C:\Windows\System\wrtUiAl.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\dFZoIRZ.exe
  C:\Windows\System\dFZoIRZ.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\hNrPddY.exe
  C:\Windows\System\hNrPddY.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\eQvPmsZ.exe
  C:\Windows\System\eQvPmsZ.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\PNYLusA.exe
  C:\Windows\System\PNYLusA.exe
  2⤵
  PID:2408
- C:\Windows\System\XFUeQnw.exe
  C:\Windows\System\XFUeQnw.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\blBLLiB.exe
  C:\Windows\System\blBLLiB.exe
  2⤵
  PID:1524
- C:\Windows\System\njmADko.exe
  C:\Windows\System\njmADko.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\YscPAsa.exe
  C:\Windows\System\YscPAsa.exe
  2⤵
  PID:2316
- C:\Windows\System\MYqwDka.exe
  C:\Windows\System\MYqwDka.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\eQguklL.exe
  C:\Windows\System\eQguklL.exe
  2⤵
  PID:1604
- C:\Windows\System\MrulsEy.exe
  C:\Windows\System\MrulsEy.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\PdDFzaz.exe
  C:\Windows\System\PdDFzaz.exe
  2⤵
  PID:868
- C:\Windows\System\cKzWsqF.exe
  C:\Windows\System\cKzWsqF.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\WmhDeVj.exe
  C:\Windows\System\WmhDeVj.exe
  2⤵
  PID:2616
- C:\Windows\System\YwoGTPE.exe
  C:\Windows\System\YwoGTPE.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\VIUcVXw.exe
  C:\Windows\System\VIUcVXw.exe
  2⤵
  PID:2976
- C:\Windows\System\xFLYdYP.exe
  C:\Windows\System\xFLYdYP.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\DxpOUvK.exe
  C:\Windows\System\DxpOUvK.exe
  2⤵
  PID:2964
- C:\Windows\System\kSoYTFr.exe
  C:\Windows\System\kSoYTFr.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\QkmWCgE.exe
  C:\Windows\System\QkmWCgE.exe
  2⤵
  PID:1608
- C:\Windows\System\wPHqEpy.exe
  C:\Windows\System\wPHqEpy.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\AmLZptB.exe
  C:\Windows\System\AmLZptB.exe
  2⤵
  PID:2140
- C:\Windows\System\ayLgnSm.exe
  C:\Windows\System\ayLgnSm.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\mmAIBhg.exe
  C:\Windows\System\mmAIBhg.exe
  2⤵
  PID:1152
- C:\Windows\System\xUIolMK.exe
  C:\Windows\System\xUIolMK.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\rnEglZJ.exe
  C:\Windows\System\rnEglZJ.exe
  2⤵
  PID:2528
- C:\Windows\System\mCelOdr.exe
  C:\Windows\System\mCelOdr.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\VAIqfag.exe
  C:\Windows\System\VAIqfag.exe
  2⤵
  PID:2856
- C:\Windows\System\GrXTJzm.exe
  C:\Windows\System\GrXTJzm.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\XxxZUzK.exe
  C:\Windows\System\XxxZUzK.exe
  2⤵
  PID:2804
- C:\Windows\System\sWehama.exe
  C:\Windows\System\sWehama.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\ralBDjE.exe
  C:\Windows\System\ralBDjE.exe
  2⤵
  PID:2932
- C:\Windows\System\EIwybGK.exe
  C:\Windows\System\EIwybGK.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\USkopeN.exe
  C:\Windows\System\USkopeN.exe
  2⤵
  PID:856
- C:\Windows\System\haDdXIR.exe
  C:\Windows\System\haDdXIR.exe
  2⤵
  PID:2252
- C:\Windows\System\YxkaONV.exe
  C:\Windows\System\YxkaONV.exe
  2⤵
  PID:2892
- C:\Windows\System\mBgHjES.exe
  C:\Windows\System\mBgHjES.exe
  2⤵
  PID:304
- C:\Windows\System\uZUPOuL.exe
  C:\Windows\System\uZUPOuL.exe
  2⤵
  PID:1488
- C:\Windows\System\nFWnpBC.exe
  C:\Windows\System\nFWnpBC.exe
  2⤵
  PID:864
- C:\Windows\System\jmMLCrB.exe
  C:\Windows\System\jmMLCrB.exe
  2⤵
  PID:1788
- C:\Windows\System\kWJWqVk.exe
  C:\Windows\System\kWJWqVk.exe
  2⤵
  PID:2388
- C:\Windows\System\ZazciRt.exe
  C:\Windows\System\ZazciRt.exe
  2⤵
  PID:1264
- C:\Windows\System\JGuBzme.exe
  C:\Windows\System\JGuBzme.exe
  2⤵
  PID:1952
- C:\Windows\System\KLITidD.exe
  C:\Windows\System\KLITidD.exe
  2⤵
  PID:1892
- C:\Windows\System\OkQCgbC.exe
  C:\Windows\System\OkQCgbC.exe
  2⤵
  PID:2284
- C:\Windows\System\ZqIdBSc.exe
  C:\Windows\System\ZqIdBSc.exe
  2⤵
  PID:2860
- C:\Windows\System\TAoDeeA.exe
  C:\Windows\System\TAoDeeA.exe
  2⤵
  PID:1680
- C:\Windows\System\fnxUqId.exe
  C:\Windows\System\fnxUqId.exe
  2⤵
  PID:2652
- C:\Windows\System\gJfVrMW.exe
  C:\Windows\System\gJfVrMW.exe
  2⤵
  PID:1760
- C:\Windows\System\dUDziSp.exe
  C:\Windows\System\dUDziSp.exe
  2⤵
  PID:2724
- C:\Windows\System\QXpJERB.exe
  C:\Windows\System\QXpJERB.exe
  2⤵
  PID:1948
- C:\Windows\System\UElJVzd.exe
  C:\Windows\System\UElJVzd.exe
  2⤵
  PID:1568
- C:\Windows\System\uyuNlfv.exe
  C:\Windows\System\uyuNlfv.exe
  2⤵
  PID:2700
- C:\Windows\System\HTvTDlR.exe
  C:\Windows\System\HTvTDlR.exe
  2⤵
  PID:3016
- C:\Windows\System\iaWAUHM.exe
  C:\Windows\System\iaWAUHM.exe
  2⤵
  PID:2748
- C:\Windows\System\daKLysn.exe
  C:\Windows\System\daKLysn.exe
  2⤵
  PID:1248
- C:\Windows\System\QgHODuq.exe
  C:\Windows\System\QgHODuq.exe
  2⤵
  PID:2540
- C:\Windows\System\FgsnQtd.exe
  C:\Windows\System\FgsnQtd.exe
  2⤵
  PID:2788
- C:\Windows\System\yhOTUks.exe
  C:\Windows\System\yhOTUks.exe
  2⤵
  PID:1744
- C:\Windows\System\zYzfYXe.exe
  C:\Windows\System\zYzfYXe.exe
  2⤵
  PID:2348
- C:\Windows\System\JHfNMlv.exe
  C:\Windows\System\JHfNMlv.exe
  2⤵
  PID:588
- C:\Windows\System\DyCwzzo.exe
  C:\Windows\System\DyCwzzo.exe
  2⤵
  PID:1028
- C:\Windows\System\vLNQPAS.exe
  C:\Windows\System\vLNQPAS.exe
  2⤵
  PID:2160
- C:\Windows\System\uCxmQvp.exe
  C:\Windows\System\uCxmQvp.exe
  2⤵
  PID:1292
- C:\Windows\System\ikMvLQn.exe
  C:\Windows\System\ikMvLQn.exe
  2⤵
  PID:1092
- C:\Windows\System\gdejznj.exe
  C:\Windows\System\gdejznj.exe
  2⤵
  PID:1192
- C:\Windows\System\OWvWhFj.exe
  C:\Windows\System\OWvWhFj.exe
  2⤵
  PID:2304
- C:\Windows\System\yaIxQYj.exe
  C:\Windows\System\yaIxQYj.exe
  2⤵
  PID:2504
- C:\Windows\System\mrYvpXW.exe
  C:\Windows\System\mrYvpXW.exe
  2⤵
  PID:2016
- C:\Windows\System\MFUSevr.exe
  C:\Windows\System\MFUSevr.exe
  2⤵
  PID:1972
- C:\Windows\System\cYZwtQt.exe
  C:\Windows\System\cYZwtQt.exe
  2⤵
  PID:1288
- C:\Windows\System\AGNxITo.exe
  C:\Windows\System\AGNxITo.exe
  2⤵
  PID:1684
- C:\Windows\System\JwXyhiI.exe
  C:\Windows\System\JwXyhiI.exe
  2⤵
  PID:944
- C:\Windows\System\EMLDxJz.exe
  C:\Windows\System\EMLDxJz.exe
  2⤵
  PID:3084
- C:\Windows\System\WsfjQLO.exe
  C:\Windows\System\WsfjQLO.exe
  2⤵
  PID:3100
- C:\Windows\System\XkZxJrd.exe
  C:\Windows\System\XkZxJrd.exe
  2⤵
  PID:3116
- C:\Windows\System\xdfdSFP.exe
  C:\Windows\System\xdfdSFP.exe
  2⤵
  PID:3132
- C:\Windows\System\NCbkbwY.exe
  C:\Windows\System\NCbkbwY.exe
  2⤵
  PID:3148
- C:\Windows\System\vvjCgwG.exe
  C:\Windows\System\vvjCgwG.exe
  2⤵
  PID:3168
- C:\Windows\System\tBEUYfb.exe
  C:\Windows\System\tBEUYfb.exe
  2⤵
  PID:3184
- C:\Windows\System\nwZFjAn.exe
  C:\Windows\System\nwZFjAn.exe
  2⤵
  PID:3200
- C:\Windows\System\hxhcIlQ.exe
  C:\Windows\System\hxhcIlQ.exe
  2⤵
  PID:3216
- C:\Windows\System\AiFCANo.exe
  C:\Windows\System\AiFCANo.exe
  2⤵
  PID:3232
- C:\Windows\System\sgScZfS.exe
  C:\Windows\System\sgScZfS.exe
  2⤵
  PID:3248
- C:\Windows\System\rhuNfdE.exe
  C:\Windows\System\rhuNfdE.exe
  2⤵
  PID:3264
- C:\Windows\System\mWyeDgu.exe
  C:\Windows\System\mWyeDgu.exe
  2⤵
  PID:3284
- C:\Windows\System\zAFsVck.exe
  C:\Windows\System\zAFsVck.exe
  2⤵
  PID:3300
- C:\Windows\System\tSPmaqS.exe
  C:\Windows\System\tSPmaqS.exe
  2⤵
  PID:3316
- C:\Windows\System\enULWKV.exe
  C:\Windows\System\enULWKV.exe
  2⤵
  PID:3332
- C:\Windows\System\PWfxqYj.exe
  C:\Windows\System\PWfxqYj.exe
  2⤵
  PID:3348
- C:\Windows\System\ETVjJUP.exe
  C:\Windows\System\ETVjJUP.exe
  2⤵
  PID:3364
- C:\Windows\System\sPDPeyR.exe
  C:\Windows\System\sPDPeyR.exe
  2⤵
  PID:3380
- C:\Windows\System\aZPjgrM.exe
  C:\Windows\System\aZPjgrM.exe
  2⤵
  PID:3396
- C:\Windows\System\rMlzoWl.exe
  C:\Windows\System\rMlzoWl.exe
  2⤵
  PID:3416
- C:\Windows\System\awFNeSH.exe
  C:\Windows\System\awFNeSH.exe
  2⤵
  PID:3432
- C:\Windows\System\rrYhxfg.exe
  C:\Windows\System\rrYhxfg.exe
  2⤵
  PID:3448
- C:\Windows\System\CigmrIz.exe
  C:\Windows\System\CigmrIz.exe
  2⤵
  PID:3464
- C:\Windows\System\nonEcmx.exe
  C:\Windows\System\nonEcmx.exe
  2⤵
  PID:3480
- C:\Windows\System\CaMJogx.exe
  C:\Windows\System\CaMJogx.exe
  2⤵
  PID:3500
- C:\Windows\System\spSSSZX.exe
  C:\Windows\System\spSSSZX.exe
  2⤵
  PID:3516
- C:\Windows\System\WqbeKYD.exe
  C:\Windows\System\WqbeKYD.exe
  2⤵
  PID:3532
- C:\Windows\System\Ijxjrnb.exe
  C:\Windows\System\Ijxjrnb.exe
  2⤵
  PID:3548
- C:\Windows\System\wLuMkLE.exe
  C:\Windows\System\wLuMkLE.exe
  2⤵
  PID:3564
- C:\Windows\System\bnyazlN.exe
  C:\Windows\System\bnyazlN.exe
  2⤵
  PID:3580
- C:\Windows\System\ziJXfMz.exe
  C:\Windows\System\ziJXfMz.exe
  2⤵
  PID:3596
- C:\Windows\System\xSXTtZc.exe
  C:\Windows\System\xSXTtZc.exe
  2⤵
  PID:3612
- C:\Windows\System\WcNlXyN.exe
  C:\Windows\System\WcNlXyN.exe
  2⤵
  PID:3632
- C:\Windows\System\dYqXsYe.exe
  C:\Windows\System\dYqXsYe.exe
  2⤵
  PID:3648
- C:\Windows\System\bIMGPMl.exe
  C:\Windows\System\bIMGPMl.exe
  2⤵
  PID:3664
- C:\Windows\System\bKBxRHy.exe
  C:\Windows\System\bKBxRHy.exe
  2⤵
  PID:3680
- C:\Windows\System\hrORtzm.exe
  C:\Windows\System\hrORtzm.exe
  2⤵
  PID:3700
- C:\Windows\System\yBRDNSI.exe
  C:\Windows\System\yBRDNSI.exe
  2⤵
  PID:3716
- C:\Windows\System\DDOWHMZ.exe
  C:\Windows\System\DDOWHMZ.exe
  2⤵
  PID:3732
- C:\Windows\System\LtnAmOk.exe
  C:\Windows\System\LtnAmOk.exe
  2⤵
  PID:3752
- C:\Windows\System\IlYUKkx.exe
  C:\Windows\System\IlYUKkx.exe
  2⤵
  PID:3768
- C:\Windows\System\usvMGTu.exe
  C:\Windows\System\usvMGTu.exe
  2⤵
  PID:3784
- C:\Windows\System\fzvyHwl.exe
  C:\Windows\System\fzvyHwl.exe
  2⤵
  PID:3804
- C:\Windows\System\BtfgvGg.exe
  C:\Windows\System\BtfgvGg.exe
  2⤵
  PID:3820
- C:\Windows\System\vpAQuXX.exe
  C:\Windows\System\vpAQuXX.exe
  2⤵
  PID:3840
- C:\Windows\System\NVKuZNL.exe
  C:\Windows\System\NVKuZNL.exe
  2⤵
  PID:3856
- C:\Windows\System\YgWLCRN.exe
  C:\Windows\System\YgWLCRN.exe
  2⤵
  PID:3872
- C:\Windows\System\uuJGXpy.exe
  C:\Windows\System\uuJGXpy.exe
  2⤵
  PID:3888
- C:\Windows\System\TVcMKIZ.exe
  C:\Windows\System\TVcMKIZ.exe
  2⤵
  PID:3904
- C:\Windows\System\EMppPmd.exe
  C:\Windows\System\EMppPmd.exe
  2⤵
  PID:3924
- C:\Windows\System\AnIlFbn.exe
  C:\Windows\System\AnIlFbn.exe
  2⤵
  PID:3940
- C:\Windows\System\NAlkirX.exe
  C:\Windows\System\NAlkirX.exe
  2⤵
  PID:3956
- C:\Windows\System\Ponqfcq.exe
  C:\Windows\System\Ponqfcq.exe
  2⤵
  PID:3972
- C:\Windows\System\VnjFKkl.exe
  C:\Windows\System\VnjFKkl.exe
  2⤵
  PID:3988
- C:\Windows\System\IoMosax.exe
  C:\Windows\System\IoMosax.exe
  2⤵
  PID:4004
- C:\Windows\System\CfyDftA.exe
  C:\Windows\System\CfyDftA.exe
  2⤵
  PID:4020
- C:\Windows\System\rgRqksR.exe
  C:\Windows\System\rgRqksR.exe
  2⤵
  PID:4036
- C:\Windows\System\IeEyjZd.exe
  C:\Windows\System\IeEyjZd.exe
  2⤵
  PID:3280
- C:\Windows\System\obdgLfm.exe
  C:\Windows\System\obdgLfm.exe
  2⤵
  PID:3372
- C:\Windows\System\hSKbIAG.exe
  C:\Windows\System\hSKbIAG.exe
  2⤵
  PID:3276
- C:\Windows\System\jHMpJsU.exe
  C:\Windows\System\jHMpJsU.exe
  2⤵
  PID:3440
- C:\Windows\System\tJoWSpe.exe
  C:\Windows\System\tJoWSpe.exe
  2⤵
  PID:3540
- C:\Windows\System\HofGhLT.exe
  C:\Windows\System\HofGhLT.exe
  2⤵
  PID:3640
- C:\Windows\System\QXtMSSM.exe
  C:\Windows\System\QXtMSSM.exe
  2⤵
  PID:3672
- C:\Windows\System\ZCpaXAh.exe
  C:\Windows\System\ZCpaXAh.exe
  2⤵
  PID:3748
- C:\Windows\System\xGbpggq.exe
  C:\Windows\System\xGbpggq.exe
  2⤵
  PID:3816
- C:\Windows\System\trboiZk.exe
  C:\Windows\System\trboiZk.exe
  2⤵
  PID:3884
- C:\Windows\System\yKSrLGu.exe
  C:\Windows\System\yKSrLGu.exe
  2⤵
  PID:3948
- C:\Windows\System\ekfqmhf.exe
  C:\Windows\System\ekfqmhf.exe
  2⤵
  PID:4012
- C:\Windows\System\WindnSF.exe
  C:\Windows\System\WindnSF.exe
  2⤵
  PID:896
- C:\Windows\System\LltwxPX.exe
  C:\Windows\System\LltwxPX.exe
  2⤵
  PID:2184
- C:\Windows\System\KbpRlvI.exe
  C:\Windows\System\KbpRlvI.exe
  2⤵
  PID:884
- C:\Windows\System\kixuADa.exe
  C:\Windows\System\kixuADa.exe
  2⤵
  PID:2020
- C:\Windows\System\EHeqkba.exe
  C:\Windows\System\EHeqkba.exe
  2⤵
  PID:2644
- C:\Windows\System\ZpMQfiR.exe
  C:\Windows\System\ZpMQfiR.exe
  2⤵
  PID:2492
- C:\Windows\System\tzTgRRC.exe
  C:\Windows\System\tzTgRRC.exe
  2⤵
  PID:2704
- C:\Windows\System\YtIvvuN.exe
  C:\Windows\System\YtIvvuN.exe
  2⤵
  PID:612
- C:\Windows\System\VHfayDF.exe
  C:\Windows\System\VHfayDF.exe
  2⤵
  PID:824
- C:\Windows\System\xSCLpmB.exe
  C:\Windows\System\xSCLpmB.exe
  2⤵
  PID:4108
- C:\Windows\System\WUWJskH.exe
  C:\Windows\System\WUWJskH.exe
  2⤵
  PID:4124
- C:\Windows\System\fEeKPBI.exe
  C:\Windows\System\fEeKPBI.exe
  2⤵
  PID:4144
- C:\Windows\System\tVqUuLR.exe
  C:\Windows\System\tVqUuLR.exe
  2⤵
  PID:4160
- C:\Windows\System\xCUvlbQ.exe
  C:\Windows\System\xCUvlbQ.exe
  2⤵
  PID:4176
- C:\Windows\System\XHflWDk.exe
  C:\Windows\System\XHflWDk.exe
  2⤵
  PID:4192
- C:\Windows\System\CkpoAWO.exe
  C:\Windows\System\CkpoAWO.exe
  2⤵
  PID:4208
- C:\Windows\System\VLSziVE.exe
  C:\Windows\System\VLSziVE.exe
  2⤵
  PID:4224
- C:\Windows\System\FQNcCqf.exe
  C:\Windows\System\FQNcCqf.exe
  2⤵
  PID:4244
- C:\Windows\System\hQCsIyf.exe
  C:\Windows\System\hQCsIyf.exe
  2⤵
  PID:4260
- C:\Windows\System\kbXeMnh.exe
  C:\Windows\System\kbXeMnh.exe
  2⤵
  PID:4276
- C:\Windows\System\koItwuo.exe
  C:\Windows\System\koItwuo.exe
  2⤵
  PID:4292
- C:\Windows\System\SJhwzQa.exe
  C:\Windows\System\SJhwzQa.exe
  2⤵
  PID:4308
- C:\Windows\System\iiTxiqY.exe
  C:\Windows\System\iiTxiqY.exe
  2⤵
  PID:4324
- C:\Windows\System\jbJAQuQ.exe
  C:\Windows\System\jbJAQuQ.exe
  2⤵
  PID:4340
- C:\Windows\System\dgivvnh.exe
  C:\Windows\System\dgivvnh.exe
  2⤵
  PID:4360
- C:\Windows\System\AGEyDON.exe
  C:\Windows\System\AGEyDON.exe
  2⤵
  PID:4376
- C:\Windows\System\LIQmtOd.exe
  C:\Windows\System\LIQmtOd.exe
  2⤵
  PID:4392
- C:\Windows\System\XubTpZx.exe
  C:\Windows\System\XubTpZx.exe
  2⤵
  PID:4408
- C:\Windows\System\zjvjYfc.exe
  C:\Windows\System\zjvjYfc.exe
  2⤵
  PID:4424
- C:\Windows\System\TrowDLr.exe
  C:\Windows\System\TrowDLr.exe
  2⤵
  PID:4444
- C:\Windows\System\CWbKsiE.exe
  C:\Windows\System\CWbKsiE.exe
  2⤵
  PID:4460
- C:\Windows\System\hojOxNJ.exe
  C:\Windows\System\hojOxNJ.exe
  2⤵
  PID:4476
- C:\Windows\System\CyCzauf.exe
  C:\Windows\System\CyCzauf.exe
  2⤵
  PID:4492
- C:\Windows\System\DtXtxGL.exe
  C:\Windows\System\DtXtxGL.exe
  2⤵
  PID:4508
- C:\Windows\System\HobtAbq.exe
  C:\Windows\System\HobtAbq.exe
  2⤵
  PID:4556
- C:\Windows\System\BDQRMKp.exe
  C:\Windows\System\BDQRMKp.exe
  2⤵
  PID:4640
- C:\Windows\System\QllEHfN.exe
  C:\Windows\System\QllEHfN.exe
  2⤵
  PID:4656
- C:\Windows\System\ajjfedR.exe
  C:\Windows\System\ajjfedR.exe
  2⤵
  PID:4672
- C:\Windows\System\UoGvOjq.exe
  C:\Windows\System\UoGvOjq.exe
  2⤵
  PID:4688
- C:\Windows\System\XTXDtQR.exe
  C:\Windows\System\XTXDtQR.exe
  2⤵
  PID:4704
- C:\Windows\System\KQbefhz.exe
  C:\Windows\System\KQbefhz.exe
  2⤵
  PID:4720
- C:\Windows\System\JjrexuB.exe
  C:\Windows\System\JjrexuB.exe
  2⤵
  PID:4736
- C:\Windows\System\mraMEZu.exe
  C:\Windows\System\mraMEZu.exe
  2⤵
  PID:4756
- C:\Windows\System\tTcSbDB.exe
  C:\Windows\System\tTcSbDB.exe
  2⤵
  PID:4772
- C:\Windows\System\tLYmsCC.exe
  C:\Windows\System\tLYmsCC.exe
  2⤵
  PID:4788
- C:\Windows\System\XtFxCug.exe
  C:\Windows\System\XtFxCug.exe
  2⤵
  PID:4804
- C:\Windows\System\FgXqEma.exe
  C:\Windows\System\FgXqEma.exe
  2⤵
  PID:4820
- C:\Windows\System\hgYfrBI.exe
  C:\Windows\System\hgYfrBI.exe
  2⤵
  PID:4836
- C:\Windows\System\BcXaOkh.exe
  C:\Windows\System\BcXaOkh.exe
  2⤵
  PID:4852
- C:\Windows\System\gdjLVvk.exe
  C:\Windows\System\gdjLVvk.exe
  2⤵
  PID:4868
- C:\Windows\System\rBxHwoG.exe
  C:\Windows\System\rBxHwoG.exe
  2⤵
  PID:4884
- C:\Windows\System\ufxhxrD.exe
  C:\Windows\System\ufxhxrD.exe
  2⤵
  PID:4900
- C:\Windows\System\hIQHDit.exe
  C:\Windows\System\hIQHDit.exe
  2⤵
  PID:4916
- C:\Windows\System\dhhAaIo.exe
  C:\Windows\System\dhhAaIo.exe
  2⤵
  PID:4932
- C:\Windows\System\kXBRhbl.exe
  C:\Windows\System\kXBRhbl.exe
  2⤵
  PID:4948
- C:\Windows\System\usIhdZJ.exe
  C:\Windows\System\usIhdZJ.exe
  2⤵
  PID:4964
- C:\Windows\System\vsBIQyw.exe
  C:\Windows\System\vsBIQyw.exe
  2⤵
  PID:4980
- C:\Windows\System\KxRDpaK.exe
  C:\Windows\System\KxRDpaK.exe
  2⤵
  PID:4996
- C:\Windows\System\kMZcNDI.exe
  C:\Windows\System\kMZcNDI.exe
  2⤵
  PID:5012
- C:\Windows\System\pJSbpod.exe
  C:\Windows\System\pJSbpod.exe
  2⤵
  PID:5028
- C:\Windows\System\XbkpMhx.exe
  C:\Windows\System\XbkpMhx.exe
  2⤵
  PID:5044
- C:\Windows\System\ZTfLSWC.exe
  C:\Windows\System\ZTfLSWC.exe
  2⤵
  PID:5060
- C:\Windows\System\vSsvmWo.exe
  C:\Windows\System\vSsvmWo.exe
  2⤵
  PID:5076
- C:\Windows\System\tlLVNnh.exe
  C:\Windows\System\tlLVNnh.exe
  2⤵
  PID:5092
- C:\Windows\System\FlbpgUJ.exe
  C:\Windows\System\FlbpgUJ.exe
  2⤵
  PID:5112
- C:\Windows\System\URPcBok.exe
  C:\Windows\System\URPcBok.exe
  2⤵
  PID:412
- C:\Windows\System\CQRxLam.exe
  C:\Windows\System\CQRxLam.exe
  2⤵
  PID:2900
- C:\Windows\System\GvOoDwo.exe
  C:\Windows\System\GvOoDwo.exe
  2⤵
  PID:4092
- C:\Windows\System\PwSnALI.exe
  C:\Windows\System\PwSnALI.exe
  2⤵
  PID:3108
- C:\Windows\System\ahPetoU.exe
  C:\Windows\System\ahPetoU.exe
  2⤵
  PID:3208
- C:\Windows\System\ZlCDOwD.exe
  C:\Windows\System\ZlCDOwD.exe
  2⤵
  PID:3272
- C:\Windows\System\MUqunKX.exe
  C:\Windows\System\MUqunKX.exe
  2⤵
  PID:3508
- C:\Windows\System\WMWDOSH.exe
  C:\Windows\System\WMWDOSH.exe
  2⤵
  PID:3776
- C:\Windows\System\ACmhgZh.exe
  C:\Windows\System\ACmhgZh.exe
  2⤵
  PID:1404
- C:\Windows\System\zgxmfIa.exe
  C:\Windows\System\zgxmfIa.exe
  2⤵
  PID:2084
- C:\Windows\System\PKlwwlB.exe
  C:\Windows\System\PKlwwlB.exe
  2⤵
  PID:2244
- C:\Windows\System\FJxlsJs.exe
  C:\Windows\System\FJxlsJs.exe
  2⤵
  PID:4152
- C:\Windows\System\fCRvPAm.exe
  C:\Windows\System\fCRvPAm.exe
  2⤵
  PID:4216
- C:\Windows\System\hfbKMsP.exe
  C:\Windows\System\hfbKMsP.exe
  2⤵
  PID:4284
- C:\Windows\System\eDlDwnH.exe
  C:\Windows\System\eDlDwnH.exe
  2⤵
  PID:4348
- C:\Windows\System\PFRfuzY.exe
  C:\Windows\System\PFRfuzY.exe
  2⤵
  PID:4388
- C:\Windows\System\FvdsAKY.exe
  C:\Windows\System\FvdsAKY.exe
  2⤵
  PID:4456
- C:\Windows\System\iXGzSMm.exe
  C:\Windows\System\iXGzSMm.exe
  2⤵
  PID:4524
- C:\Windows\System\LMUGDQR.exe
  C:\Windows\System\LMUGDQR.exe
  2⤵
  PID:4540
- C:\Windows\System\WKrwiwf.exe
  C:\Windows\System\WKrwiwf.exe
  2⤵
  PID:4552
- C:\Windows\System\prEHllf.exe
  C:\Windows\System\prEHllf.exe
  2⤵
  PID:4652
- C:\Windows\System\JekccVZ.exe
  C:\Windows\System\JekccVZ.exe
  2⤵
  PID:4716
- C:\Windows\System\lKcMlim.exe
  C:\Windows\System\lKcMlim.exe
  2⤵
  PID:4784
- C:\Windows\System\DeoOKaq.exe
  C:\Windows\System\DeoOKaq.exe
  2⤵
  PID:4848
- C:\Windows\System\JMVKTbQ.exe
  C:\Windows\System\JMVKTbQ.exe
  2⤵
  PID:4912
- C:\Windows\System\tpmwacH.exe
  C:\Windows\System\tpmwacH.exe
  2⤵
  PID:4976
- C:\Windows\System\OtqLvvB.exe
  C:\Windows\System\OtqLvvB.exe
  2⤵
  PID:2400
- C:\Windows\System\BltDwjU.exe
  C:\Windows\System\BltDwjU.exe
  2⤵
  PID:5072
- C:\Windows\System\mwMnMav.exe
  C:\Windows\System\mwMnMav.exe
  2⤵
  PID:3644
- C:\Windows\System\CXAVjkO.exe
  C:\Windows\System\CXAVjkO.exe
  2⤵
  PID:4120
- C:\Windows\System\dbtbfjf.exe
  C:\Windows\System\dbtbfjf.exe
  2⤵
  PID:4384
- C:\Windows\System\vBCePQK.exe
  C:\Windows\System\vBCePQK.exe
  2⤵
  PID:4684
- C:\Windows\System\IpeGjqm.exe
  C:\Windows\System\IpeGjqm.exe
  2⤵
  PID:3712
- C:\Windows\System\vvTVCkx.exe
  C:\Windows\System\vvTVCkx.exe
  2⤵
  PID:1980
- C:\Windows\System\EvXYpyF.exe
  C:\Windows\System\EvXYpyF.exe
  2⤵
  PID:852
- C:\Windows\System\QaXSOcW.exe
  C:\Windows\System\QaXSOcW.exe
  2⤵
  PID:4168
- C:\Windows\System\FSMbmwO.exe
  C:\Windows\System\FSMbmwO.exe
  2⤵
  PID:4240
- C:\Windows\System\ZsGUwZp.exe
  C:\Windows\System\ZsGUwZp.exe
  2⤵
  PID:4332
- C:\Windows\System\qwZmFyE.exe
  C:\Windows\System\qwZmFyE.exe
  2⤵
  PID:4564
- C:\Windows\System\gYTRcPY.exe
  C:\Windows\System\gYTRcPY.exe
  2⤵
  PID:1996
- C:\Windows\System\bAeLcWx.exe
  C:\Windows\System\bAeLcWx.exe
  2⤵
  PID:4892
- C:\Windows\System\eeTixGf.exe
  C:\Windows\System\eeTixGf.exe
  2⤵
  PID:5024
- C:\Windows\System\DNuyUgS.exe
  C:\Windows\System\DNuyUgS.exe
  2⤵
  PID:3868
- C:\Windows\System\lkXOqKh.exe
  C:\Windows\System\lkXOqKh.exe
  2⤵
  PID:3476
- C:\Windows\System\xaaooBb.exe
  C:\Windows\System\xaaooBb.exe
  2⤵
  PID:4336
- C:\Windows\System\pwOJqMJ.exe
  C:\Windows\System\pwOJqMJ.exe
  2⤵
  PID:2576
- C:\Windows\System\SqqktCc.exe
  C:\Windows\System\SqqktCc.exe
  2⤵
  PID:2464
- C:\Windows\System\vWupemx.exe
  C:\Windows\System\vWupemx.exe
  2⤵
  PID:2784
- C:\Windows\System\sKwDMyb.exe
  C:\Windows\System\sKwDMyb.exe
  2⤵
  PID:1672
- C:\Windows\System\AxsuqAP.exe
  C:\Windows\System\AxsuqAP.exe
  2⤵
  PID:2004
- C:\Windows\System\KarBmPp.exe
  C:\Windows\System\KarBmPp.exe
  2⤵
  PID:3008
- C:\Windows\System\VyooEsq.exe
  C:\Windows\System\VyooEsq.exe
  2⤵
  PID:3128
- C:\Windows\System\GGuYHRQ.exe
  C:\Windows\System\GGuYHRQ.exe
  2⤵
  PID:3256
- C:\Windows\System\sdHplsw.exe
  C:\Windows\System\sdHplsw.exe
  2⤵
  PID:3324
- C:\Windows\System\wxbInfw.exe
  C:\Windows\System\wxbInfw.exe
  2⤵
  PID:3388
- C:\Windows\System\uYYnZpf.exe
  C:\Windows\System\uYYnZpf.exe
  2⤵
  PID:3456
- C:\Windows\System\mWgnkwx.exe
  C:\Windows\System\mWgnkwx.exe
  2⤵
  PID:3524
- C:\Windows\System\ExsYVtu.exe
  C:\Windows\System\ExsYVtu.exe
  2⤵
  PID:3588
- C:\Windows\System\GQsJLfp.exe
  C:\Windows\System\GQsJLfp.exe
  2⤵
  PID:3656
- C:\Windows\System\MGeJZAR.exe
  C:\Windows\System\MGeJZAR.exe
  2⤵
  PID:3760
- C:\Windows\System\fWXRILP.exe
  C:\Windows\System\fWXRILP.exe
  2⤵
  PID:3828
- C:\Windows\System\arwJAxv.exe
  C:\Windows\System\arwJAxv.exe
  2⤵
  PID:3900
- C:\Windows\System\KAjoBVe.exe
  C:\Windows\System\KAjoBVe.exe
  2⤵
  PID:3996
- C:\Windows\System\scGWwgk.exe
  C:\Windows\System\scGWwgk.exe
  2⤵
  PID:1836
- C:\Windows\System\pDHdNsQ.exe
  C:\Windows\System\pDHdNsQ.exe
  2⤵
  PID:4372
- C:\Windows\System\VwSpWuu.exe
  C:\Windows\System\VwSpWuu.exe
  2⤵
  PID:4472
- C:\Windows\System\FFezdvW.exe
  C:\Windows\System\FFezdvW.exe
  2⤵
  PID:4584
- C:\Windows\System\scubiUE.exe
  C:\Windows\System\scubiUE.exe
  2⤵
  PID:4600
- C:\Windows\System\KjycUXh.exe
  C:\Windows\System\KjycUXh.exe
  2⤵
  PID:4616
- C:\Windows\System\qbcIViE.exe
  C:\Windows\System\qbcIViE.exe
  2⤵
  PID:4632
- C:\Windows\System\DqFJQus.exe
  C:\Windows\System\DqFJQus.exe
  2⤵
  PID:4728
- C:\Windows\System\lHXuAQZ.exe
  C:\Windows\System\lHXuAQZ.exe
  2⤵
  PID:4796
- C:\Windows\System\VXYRZyh.exe
  C:\Windows\System\VXYRZyh.exe
  2⤵
  PID:4924
- C:\Windows\System\kfclbti.exe
  C:\Windows\System\kfclbti.exe
  2⤵
  PID:5056
- C:\Windows\System\JcCqMzO.exe
  C:\Windows\System\JcCqMzO.exe
  2⤵
  PID:4084
- C:\Windows\System\dwwpGgU.exe
  C:\Windows\System\dwwpGgU.exe
  2⤵
  PID:3408
- C:\Windows\System\sZCmeNW.exe
  C:\Windows\System\sZCmeNW.exe
  2⤵
  PID:3920
- C:\Windows\System\UXCgNef.exe
  C:\Windows\System\UXCgNef.exe
  2⤵
  PID:4188
- C:\Windows\System\VldOUpq.exe
  C:\Windows\System\VldOUpq.exe
  2⤵
  PID:4452
- C:\Windows\System\vnqoFKs.exe
  C:\Windows\System\vnqoFKs.exe
  2⤵
  PID:4648
- C:\Windows\System\CGndJkA.exe
  C:\Windows\System\CGndJkA.exe
  2⤵
  PID:4908
- C:\Windows\System\CsVechg.exe
  C:\Windows\System\CsVechg.exe
  2⤵
  PID:4100
- C:\Windows\System\DOHOFIN.exe
  C:\Windows\System\DOHOFIN.exe
  2⤵
  PID:2296
- C:\Windows\System\ErpnqeX.exe
  C:\Windows\System\ErpnqeX.exe
  2⤵
  PID:4972
- C:\Windows\System\zADlYXX.exe
  C:\Windows\System\zADlYXX.exe
  2⤵
  PID:2324
- C:\Windows\System\BubIyhK.exe
  C:\Windows\System\BubIyhK.exe
  2⤵
  PID:2432
- C:\Windows\System\voErvaC.exe
  C:\Windows\System\voErvaC.exe
  2⤵
  PID:1268
- C:\Windows\System\rIxzNNW.exe
  C:\Windows\System\rIxzNNW.exe
  2⤵
  PID:4136
- C:\Windows\System\seEUFOX.exe
  C:\Windows\System\seEUFOX.exe
  2⤵
  PID:2688
- C:\Windows\System\RkbVxKM.exe
  C:\Windows\System\RkbVxKM.exe
  2⤵
  PID:5020
- C:\Windows\System\BxMQQfF.exe
  C:\Windows\System\BxMQQfF.exe
  2⤵
  PID:2052
- C:\Windows\System\NZMuecm.exe
  C:\Windows\System\NZMuecm.exe
  2⤵
  PID:2648
- C:\Windows\System\oUUlSZU.exe
  C:\Windows\System\oUUlSZU.exe
  2⤵
  PID:3292
- C:\Windows\System\zwjCtol.exe
  C:\Windows\System\zwjCtol.exe
  2⤵
  PID:3556
- C:\Windows\System\ApbsBiD.exe
  C:\Windows\System\ApbsBiD.exe
  2⤵
  PID:3688
- C:\Windows\System\xAgJXqR.exe
  C:\Windows\System\xAgJXqR.exe
  2⤵
  PID:4624
- C:\Windows\System\uknlNKY.exe
  C:\Windows\System\uknlNKY.exe
  2⤵
  PID:4960
- C:\Windows\System\WEYFGqO.exe
  C:\Windows\System\WEYFGqO.exe
  2⤵
  PID:5040
- C:\Windows\System\PKAwRZB.exe
  C:\Windows\System\PKAwRZB.exe
  2⤵
  PID:3576
- C:\Windows\System\IheBadp.exe
  C:\Windows\System\IheBadp.exe
  2⤵
  PID:540
- C:\Windows\System\vfRLbSW.exe
  C:\Windows\System\vfRLbSW.exe
  2⤵
  PID:2040
- C:\Windows\System\DsAGKvQ.exe
  C:\Windows\System\DsAGKvQ.exe
  2⤵
  PID:5036
- C:\Windows\System\JLcEXoy.exe
  C:\Windows\System\JLcEXoy.exe
  2⤵
  PID:4232
- C:\Windows\System\ftNQAIM.exe
  C:\Windows\System\ftNQAIM.exe
  2⤵
  PID:4860
- C:\Windows\System\KhYxtJl.exe
  C:\Windows\System\KhYxtJl.exe
  2⤵
  PID:5052
- C:\Windows\System\AstcYvq.exe
  C:\Windows\System\AstcYvq.exe
  2⤵
  PID:4896
- C:\Windows\System\DgekvsL.exe
  C:\Windows\System\DgekvsL.exe
  2⤵
  PID:3344
- C:\Windows\System\cUmKtmH.exe
  C:\Windows\System\cUmKtmH.exe
  2⤵
  PID:4880
- C:\Windows\System\qKPLwgo.exe
  C:\Windows\System\qKPLwgo.exe
  2⤵
  PID:3980
- C:\Windows\System\XdDquAM.exe
  C:\Windows\System\XdDquAM.exe
  2⤵
  PID:4504
- C:\Windows\System\LTsdQgz.exe
  C:\Windows\System\LTsdQgz.exe
  2⤵
  PID:4432
- C:\Windows\System\Zsyplrl.exe
  C:\Windows\System\Zsyplrl.exe
  2⤵
  PID:4028
- C:\Windows\System\RovVfkF.exe
  C:\Windows\System\RovVfkF.exe
  2⤵
  PID:4592
- C:\Windows\System\XoMZZou.exe
  C:\Windows\System\XoMZZou.exe
  2⤵
  PID:4844
- C:\Windows\System\LGYCZLT.exe
  C:\Windows\System\LGYCZLT.exe
  2⤵
  PID:4256
- C:\Windows\System\IRRUvTO.exe
  C:\Windows\System\IRRUvTO.exe
  2⤵
  PID:292
- C:\Windows\System\hOvIonL.exe
  C:\Windows\System\hOvIonL.exe
  2⤵
  PID:1884
- C:\Windows\System\lQrewUX.exe
  C:\Windows\System\lQrewUX.exe
  2⤵
  PID:3196
- C:\Windows\System\SYTMtyR.exe
  C:\Windows\System\SYTMtyR.exe
  2⤵
  PID:3180
- C:\Windows\System\elGcZWJ.exe
  C:\Windows\System\elGcZWJ.exe
  2⤵
  PID:4768
- C:\Windows\System\YJSbiYQ.exe
  C:\Windows\System\YJSbiYQ.exe
  2⤵
  PID:3496
- C:\Windows\System\SvzYiLO.exe
  C:\Windows\System\SvzYiLO.exe
  2⤵
  PID:1520
- C:\Windows\System\MIttLlZ.exe
  C:\Windows\System\MIttLlZ.exe
  2⤵
  PID:3620
- C:\Windows\System\sQtMDHA.exe
  C:\Windows\System\sQtMDHA.exe
  2⤵
  PID:3964
- C:\Windows\System\JDrjfBq.exe
  C:\Windows\System\JDrjfBq.exe
  2⤵
  PID:3412
- C:\Windows\System\adGIxLF.exe
  C:\Windows\System\adGIxLF.exe
  2⤵
  PID:3984
- C:\Windows\System\yNLiytF.exe
  C:\Windows\System\yNLiytF.exe
  2⤵
  PID:1640
- C:\Windows\System\RfHkkPv.exe
  C:\Windows\System\RfHkkPv.exe
  2⤵
  PID:4580
- C:\Windows\System\gJqZDrV.exe
  C:\Windows\System\gJqZDrV.exe
  2⤵
  PID:4668
- C:\Windows\System\QueFCqZ.exe
  C:\Windows\System\QueFCqZ.exe
  2⤵
  PID:4864
- C:\Windows\System\hTMEDJN.exe
  C:\Windows\System\hTMEDJN.exe
  2⤵
  PID:4080
- C:\Windows\System\VauEkei.exe
  C:\Windows\System\VauEkei.exe
  2⤵
  PID:2772
- C:\Windows\System\yHVizuE.exe
  C:\Windows\System\yHVizuE.exe
  2⤵
  PID:3424
- C:\Windows\System\oZXrQDJ.exe
  C:\Windows\System\oZXrQDJ.exe
  2⤵
  PID:3880
- C:\Windows\System\gDsDWaT.exe
  C:\Windows\System\gDsDWaT.exe
  2⤵
  PID:2796
- C:\Windows\System\waCXyYU.exe
  C:\Windows\System\waCXyYU.exe
  2⤵
  PID:4272
- C:\Windows\System\fFpiqTV.exe
  C:\Windows\System\fFpiqTV.exe
  2⤵
  PID:1508
- C:\Windows\System\AoYZcfl.exe
  C:\Windows\System\AoYZcfl.exe
  2⤵
  PID:4752
- C:\Windows\System\vLCHTlv.exe
  C:\Windows\System\vLCHTlv.exe
  2⤵
  PID:4828
- C:\Windows\System\oJDxqzO.exe
  C:\Windows\System\oJDxqzO.exe
  2⤵
  PID:2584
- C:\Windows\System\heEFKXF.exe
  C:\Windows\System\heEFKXF.exe
  2⤵
  PID:3572
- C:\Windows\System\sUOEJYW.exe
  C:\Windows\System\sUOEJYW.exe
  2⤵
  PID:1296
- C:\Windows\System\XVxRtwL.exe
  C:\Windows\System\XVxRtwL.exe
  2⤵
  PID:2104
- C:\Windows\System\wOmwEpt.exe
  C:\Windows\System\wOmwEpt.exe
  2⤵
  PID:2968
- C:\Windows\System\cPHzKSN.exe
  C:\Windows\System\cPHzKSN.exe
  2⤵
  PID:3936
- C:\Windows\System\NQJJQoY.exe
  C:\Windows\System\NQJJQoY.exe
  2⤵
  PID:2132
- C:\Windows\System\sUNBezB.exe
  C:\Windows\System\sUNBezB.exe
  2⤵
  PID:4500
- C:\Windows\System\dGztPBK.exe
  C:\Windows\System\dGztPBK.exe
  2⤵
  PID:2600
- C:\Windows\System\ITmOUdk.exe
  C:\Windows\System\ITmOUdk.exe
  2⤵
  PID:4780
- C:\Windows\System\jDcDbJn.exe
  C:\Windows\System\jDcDbJn.exe
  2⤵
  PID:4612
- C:\Windows\System\YQseiHp.exe
  C:\Windows\System\YQseiHp.exe
  2⤵
  PID:4404
- C:\Windows\System\wfLduen.exe
  C:\Windows\System\wfLduen.exe
  2⤵
  PID:4032
- C:\Windows\System\EMNgnUm.exe
  C:\Windows\System\EMNgnUm.exe
  2⤵
  PID:3056
- C:\Windows\System\BKEHMlf.exe
  C:\Windows\System\BKEHMlf.exe
  2⤵
  PID:2624
- C:\Windows\System\Gdobcyt.exe
  C:\Windows\System\Gdobcyt.exe
  2⤵
  PID:2764
- C:\Windows\System\QkWBpth.exe
  C:\Windows\System\QkWBpth.exe
  2⤵
  PID:544
- C:\Windows\System\BXADaVY.exe
  C:\Windows\System\BXADaVY.exe
  2⤵
  PID:3032
- C:\Windows\System\eukgCXX.exe
  C:\Windows\System\eukgCXX.exe
  2⤵
  PID:776
- C:\Windows\System\xSRgddZ.exe
  C:\Windows\System\xSRgddZ.exe
  2⤵
  PID:3428
- C:\Windows\System\skALPOx.exe
  C:\Windows\System\skALPOx.exe
  2⤵
  PID:2812
- C:\Windows\System\WBLRpAP.exe
  C:\Windows\System\WBLRpAP.exe
  2⤵
  PID:3224
- C:\Windows\System\MzZUbNS.exe
  C:\Windows\System\MzZUbNS.exe
  2⤵
  PID:3800
- C:\Windows\System\cXmiQyp.exe
  C:\Windows\System\cXmiQyp.exe
  2⤵
  PID:4816
- C:\Windows\System\eXkPbTf.exe
  C:\Windows\System\eXkPbTf.exe
  2⤵
  PID:4420
- C:\Windows\System\YvuuxOE.exe
  C:\Windows\System\YvuuxOE.exe
  2⤵
  PID:1452
- C:\Windows\System\SZRdqbv.exe
  C:\Windows\System\SZRdqbv.exe
  2⤵
  PID:3192
- C:\Windows\System\utbKZnK.exe
  C:\Windows\System\utbKZnK.exe
  2⤵
  PID:5128
- C:\Windows\System\jexqzUJ.exe
  C:\Windows\System\jexqzUJ.exe
  2⤵
  PID:5144
- C:\Windows\System\KWfCRTx.exe
  C:\Windows\System\KWfCRTx.exe
  2⤵
  PID:5160
- C:\Windows\System\iNKZEZc.exe
  C:\Windows\System\iNKZEZc.exe
  2⤵
  PID:5176
- C:\Windows\System\gPNbOeQ.exe
  C:\Windows\System\gPNbOeQ.exe
  2⤵
  PID:5192
- C:\Windows\System\LzOapUe.exe
  C:\Windows\System\LzOapUe.exe
  2⤵
  PID:5208
- C:\Windows\System\mQIqNRs.exe
  C:\Windows\System\mQIqNRs.exe
  2⤵
  PID:5224
- C:\Windows\System\FenNuiw.exe
  C:\Windows\System\FenNuiw.exe
  2⤵
  PID:5240
- C:\Windows\System\nGqxkzP.exe
  C:\Windows\System\nGqxkzP.exe
  2⤵
  PID:5256
- C:\Windows\System\cbNTXbG.exe
  C:\Windows\System\cbNTXbG.exe
  2⤵
  PID:5272
- C:\Windows\System\kGgEhFg.exe
  C:\Windows\System\kGgEhFg.exe
  2⤵
  PID:5288
- C:\Windows\System\uFEjpxH.exe
  C:\Windows\System\uFEjpxH.exe
  2⤵
  PID:5304
- C:\Windows\System\ELuKkRu.exe
  C:\Windows\System\ELuKkRu.exe
  2⤵
  PID:5320
- C:\Windows\System\qkhsmuM.exe
  C:\Windows\System\qkhsmuM.exe
  2⤵
  PID:5336
- C:\Windows\System\gVwjTSr.exe
  C:\Windows\System\gVwjTSr.exe
  2⤵
  PID:5352
- C:\Windows\System\XfBZazW.exe
  C:\Windows\System\XfBZazW.exe
  2⤵
  PID:5368
- C:\Windows\System\eRbzZlx.exe
  C:\Windows\System\eRbzZlx.exe
  2⤵
  PID:5384
- C:\Windows\System\EeJHkTc.exe
  C:\Windows\System\EeJHkTc.exe
  2⤵
  PID:5400
- C:\Windows\System\icWKnDj.exe
  C:\Windows\System\icWKnDj.exe
  2⤵
  PID:5416
- C:\Windows\System\LxPvYWA.exe
  C:\Windows\System\LxPvYWA.exe
  2⤵
  PID:5432
- C:\Windows\System\DMkTSxV.exe
  C:\Windows\System\DMkTSxV.exe
  2⤵
  PID:5448
- C:\Windows\System\TYPnKqV.exe
  C:\Windows\System\TYPnKqV.exe
  2⤵
  PID:5464
- C:\Windows\System\aDrAzzH.exe
  C:\Windows\System\aDrAzzH.exe
  2⤵
  PID:5480
- C:\Windows\System\zgutKvj.exe
  C:\Windows\System\zgutKvj.exe
  2⤵
  PID:5496
- C:\Windows\System\SRjoosK.exe
  C:\Windows\System\SRjoosK.exe
  2⤵
  PID:5512
- C:\Windows\System\PzKtbIP.exe
  C:\Windows\System\PzKtbIP.exe
  2⤵
  PID:5528
- C:\Windows\System\somddEO.exe
  C:\Windows\System\somddEO.exe
  2⤵
  PID:5544
- C:\Windows\System\hPzsAPK.exe
  C:\Windows\System\hPzsAPK.exe
  2⤵
  PID:5560
- C:\Windows\System\nasroWn.exe
  C:\Windows\System\nasroWn.exe
  2⤵
  PID:5576
- C:\Windows\System\eDTUAAv.exe
  C:\Windows\System\eDTUAAv.exe
  2⤵
  PID:5592
- C:\Windows\System\kegfgSJ.exe
  C:\Windows\System\kegfgSJ.exe
  2⤵
  PID:5608
- C:\Windows\System\HRlMSPj.exe
  C:\Windows\System\HRlMSPj.exe
  2⤵
  PID:5624
- C:\Windows\System\mqKdRzE.exe
  C:\Windows\System\mqKdRzE.exe
  2⤵
  PID:5640
- C:\Windows\System\ppjBTPf.exe
  C:\Windows\System\ppjBTPf.exe
  2⤵
  PID:5656
- C:\Windows\System\NPfRGtV.exe
  C:\Windows\System\NPfRGtV.exe
  2⤵
  PID:5672
- C:\Windows\System\osngbxN.exe
  C:\Windows\System\osngbxN.exe
  2⤵
  PID:5688
- C:\Windows\System\LjXhBQI.exe
  C:\Windows\System\LjXhBQI.exe
  2⤵
  PID:5704
- C:\Windows\System\ZpWNaCj.exe
  C:\Windows\System\ZpWNaCj.exe
  2⤵
  PID:5720
- C:\Windows\System\xmFfAuO.exe
  C:\Windows\System\xmFfAuO.exe
  2⤵
  PID:5736
- C:\Windows\System\Cmhlogm.exe
  C:\Windows\System\Cmhlogm.exe
  2⤵
  PID:5752
- C:\Windows\System\lnVrAjP.exe
  C:\Windows\System\lnVrAjP.exe
  2⤵
  PID:5768
- C:\Windows\System\KZvstiR.exe
  C:\Windows\System\KZvstiR.exe
  2⤵
  PID:5784
- C:\Windows\System\TntQxtW.exe
  C:\Windows\System\TntQxtW.exe
  2⤵
  PID:5800
- C:\Windows\System\TekfFrj.exe
  C:\Windows\System\TekfFrj.exe
  2⤵
  PID:5816
- C:\Windows\System\vbQRnEC.exe
  C:\Windows\System\vbQRnEC.exe
  2⤵
  PID:5832
- C:\Windows\System\ZLKvxFX.exe
  C:\Windows\System\ZLKvxFX.exe
  2⤵
  PID:5848
- C:\Windows\System\IBFLZcc.exe
  C:\Windows\System\IBFLZcc.exe
  2⤵
  PID:5872
- C:\Windows\System\WgDqKDo.exe
  C:\Windows\System\WgDqKDo.exe
  2⤵
  PID:5888
- C:\Windows\System\wHoJrQR.exe
  C:\Windows\System\wHoJrQR.exe
  2⤵
  PID:5904
- C:\Windows\System\mXswfNE.exe
  C:\Windows\System\mXswfNE.exe
  2⤵
  PID:5980
- C:\Windows\System\xTwhzIV.exe
  C:\Windows\System\xTwhzIV.exe
  2⤵
  PID:6008
- C:\Windows\System\ETOQlot.exe
  C:\Windows\System\ETOQlot.exe
  2⤵
  PID:6028
- C:\Windows\System\cGCjzzJ.exe
  C:\Windows\System\cGCjzzJ.exe
  2⤵
  PID:6048
- C:\Windows\System\XWogQDs.exe
  C:\Windows\System\XWogQDs.exe
  2⤵
  PID:6064
- C:\Windows\System\uAZQiKT.exe
  C:\Windows\System\uAZQiKT.exe
  2⤵
  PID:6088
- C:\Windows\System\xhzMqli.exe
  C:\Windows\System\xhzMqli.exe
  2⤵
  PID:6112
- C:\Windows\System\uSjMeWh.exe
  C:\Windows\System\uSjMeWh.exe
  2⤵
  PID:6132
- C:\Windows\System\hpeeVdQ.exe
  C:\Windows\System\hpeeVdQ.exe
  2⤵
  PID:2536
- C:\Windows\System\KiEvQwG.exe
  C:\Windows\System\KiEvQwG.exe
  2⤵
  PID:4044
- C:\Windows\System\ZyxEBwk.exe
  C:\Windows\System\ZyxEBwk.exe
  2⤵
  PID:4132
- C:\Windows\System\aUbNuie.exe
  C:\Windows\System\aUbNuie.exe
  2⤵
  PID:5172
- C:\Windows\System\ILLZGKq.exe
  C:\Windows\System\ILLZGKq.exe
  2⤵
  PID:5232
- C:\Windows\System\MVzltud.exe
  C:\Windows\System\MVzltud.exe
  2⤵
  PID:5152
- C:\Windows\System\qPsfquL.exe
  C:\Windows\System\qPsfquL.exe
  2⤵
  PID:5280
- C:\Windows\System\zVCgZfU.exe
  C:\Windows\System\zVCgZfU.exe
  2⤵
  PID:5332
- C:\Windows\System\AXnJyCq.exe
  C:\Windows\System\AXnJyCq.exe
  2⤵
  PID:5312
- C:\Windows\System\AZlHpvp.exe
  C:\Windows\System\AZlHpvp.exe
  2⤵
  PID:5412
- C:\Windows\System\aMQWJHQ.exe
  C:\Windows\System\aMQWJHQ.exe
  2⤵
  PID:5408
- C:\Windows\System\TXNAAXx.exe
  C:\Windows\System\TXNAAXx.exe
  2⤵
  PID:5620
- C:\Windows\System\MAFaeis.exe
  C:\Windows\System\MAFaeis.exe
  2⤵
  PID:5680
- C:\Windows\System\RNOczay.exe
  C:\Windows\System\RNOczay.exe
  2⤵
  PID:5668
- C:\Windows\System\VcBltUT.exe
  C:\Windows\System\VcBltUT.exe
  2⤵
  PID:5696
- C:\Windows\System\FAhNRCa.exe
  C:\Windows\System\FAhNRCa.exe
  2⤵
  PID:5824
- C:\Windows\System\ZnZvYhq.exe
  C:\Windows\System\ZnZvYhq.exe
  2⤵
  PID:5780
- C:\Windows\System\IKnBSsT.exe
  C:\Windows\System\IKnBSsT.exe
  2⤵
  PID:5856
- C:\Windows\System\ExvlbaH.exe
  C:\Windows\System\ExvlbaH.exe
  2⤵
  PID:2280
- C:\Windows\System\QIPOSJA.exe
  C:\Windows\System\QIPOSJA.exe
  2⤵
  PID:5880
- C:\Windows\System\UNCkTeg.exe
  C:\Windows\System\UNCkTeg.exe
  2⤵
  PID:5916
- C:\Windows\System\uqBSbda.exe
  C:\Windows\System\uqBSbda.exe
  2⤵
  PID:5932
- C:\Windows\System\azeqroF.exe
  C:\Windows\System\azeqroF.exe
  2⤵
  PID:5948
- C:\Windows\System\tVrBeUG.exe
  C:\Windows\System\tVrBeUG.exe
  2⤵
  PID:5964
- C:\Windows\System\KIHcKNn.exe
  C:\Windows\System\KIHcKNn.exe
  2⤵
  PID:5996
- C:\Windows\System\aPIibVa.exe
  C:\Windows\System\aPIibVa.exe
  2⤵
  PID:6004
- C:\Windows\System\QBOJbmo.exe
  C:\Windows\System\QBOJbmo.exe
  2⤵
  PID:6024
- C:\Windows\System\EJlGlYV.exe
  C:\Windows\System\EJlGlYV.exe
  2⤵
  PID:6072
- C:\Windows\System\pbJdbKI.exe
  C:\Windows\System\pbJdbKI.exe
  2⤵
  PID:6104
- C:\Windows\System\GSAVgGe.exe
  C:\Windows\System\GSAVgGe.exe
  2⤵
  PID:3360
- C:\Windows\System\lbwYZaS.exe
  C:\Windows\System\lbwYZaS.exe
  2⤵
  PID:5248
- C:\Windows\System\UsXqDdl.exe
  C:\Windows\System\UsXqDdl.exe
  2⤵
  PID:5216
- C:\Windows\System\OIbzRYy.exe
  C:\Windows\System\OIbzRYy.exe
  2⤵
  PID:5140
- C:\Windows\System\FzFQyYD.exe
  C:\Windows\System\FzFQyYD.exe
  2⤵
  PID:6124
- C:\Windows\System\WvsvTBM.exe
  C:\Windows\System\WvsvTBM.exe
  2⤵
  PID:5392
- C:\Windows\System\xFabndW.exe
  C:\Windows\System\xFabndW.exe
  2⤵
  PID:5268
- C:\Windows\System\lXgLdLi.exe
  C:\Windows\System\lXgLdLi.exe
  2⤵
  PID:5424
- C:\Windows\System\mwvIWuk.exe
  C:\Windows\System\mwvIWuk.exe
  2⤵
  PID:5456
- C:\Windows\System\ksZugZQ.exe
  C:\Windows\System\ksZugZQ.exe
  2⤵
  PID:5492
- C:\Windows\System\motmlpn.exe
  C:\Windows\System\motmlpn.exe
  2⤵
  PID:5524
- C:\Windows\System\fVKpnIx.exe
  C:\Windows\System\fVKpnIx.exe
  2⤵
  PID:5652
- C:\Windows\System\ZVwVdjZ.exe
  C:\Windows\System\ZVwVdjZ.exe
  2⤵
  PID:5556
- C:\Windows\System\qnTSCgw.exe
  C:\Windows\System\qnTSCgw.exe
  2⤵
  PID:5604
- C:\Windows\System\gffZCXB.exe
  C:\Windows\System\gffZCXB.exe
  2⤵
  PID:2884
- C:\Windows\System\mIWkEGR.exe
  C:\Windows\System\mIWkEGR.exe
  2⤵
  PID:5776
- C:\Windows\System\fYWFiNM.exe
  C:\Windows\System\fYWFiNM.exe
  2⤵
  PID:660
- C:\Windows\System\gwGNfyt.exe
  C:\Windows\System\gwGNfyt.exe
  2⤵
  PID:5976
- C:\Windows\System\pJVYvCg.exe
  C:\Windows\System\pJVYvCg.exe
  2⤵
  PID:5792
- C:\Windows\System\RRDGCJq.exe
  C:\Windows\System\RRDGCJq.exe
  2⤵
  PID:5864
- C:\Windows\System\nBJyAAH.exe
  C:\Windows\System\nBJyAAH.exe
  2⤵
  PID:2292
- C:\Windows\System\lUEJzrr.exe
  C:\Windows\System\lUEJzrr.exe
  2⤵
  PID:5360
- C:\Windows\System\CTuCqwO.exe
  C:\Windows\System\CTuCqwO.exe
  2⤵
  PID:5476
- C:\Windows\System\APNcIZr.exe
  C:\Windows\System\APNcIZr.exe
  2⤵
  PID:5748
- C:\Windows\System\sRpszAG.exe
  C:\Windows\System\sRpszAG.exe
  2⤵
  PID:6056
- C:\Windows\System\OyhQhsy.exe
  C:\Windows\System\OyhQhsy.exe
  2⤵
  PID:5956
- C:\Windows\System\TEQHsCE.exe
  C:\Windows\System\TEQHsCE.exe
  2⤵
  PID:6100
- C:\Windows\System\xHzZrfd.exe
  C:\Windows\System\xHzZrfd.exe
  2⤵
  PID:5840
- C:\Windows\System\QvBcDrZ.exe
  C:\Windows\System\QvBcDrZ.exe
  2⤵
  PID:5488
- C:\Windows\System\WePoPYw.exe
  C:\Windows\System\WePoPYw.exe
  2⤵
  PID:2588
- C:\Windows\System\jrCdlrd.exe
  C:\Windows\System\jrCdlrd.exe
  2⤵
  PID:5536
- C:\Windows\System\tXSCRhI.exe
  C:\Windows\System\tXSCRhI.exe
  2⤵
  PID:6000
- C:\Windows\System\ZchdkvP.exe
  C:\Windows\System\ZchdkvP.exe
  2⤵
  PID:6084
- C:\Windows\System\ixVhxtw.exe
  C:\Windows\System\ixVhxtw.exe
  2⤵
  PID:5296
- C:\Windows\System\LQqrwSH.exe
  C:\Windows\System\LQqrwSH.exe
  2⤵
  PID:5168
- C:\Windows\System\umaTKeY.exe
  C:\Windows\System\umaTKeY.exe
  2⤵
  PID:4052
- C:\Windows\System\IzoyHPd.exe
  C:\Windows\System\IzoyHPd.exe
  2⤵
  PID:5860
- C:\Windows\System\lfmqoAk.exe
  C:\Windows\System\lfmqoAk.exe
  2⤵
  PID:3492
- C:\Windows\System\ByPmDFq.exe
  C:\Windows\System\ByPmDFq.exe
  2⤵
  PID:6020
- C:\Windows\System\NGhGVVw.exe
  C:\Windows\System\NGhGVVw.exe
  2⤵
  PID:5204
- C:\Windows\System\LOYgJzD.exe
  C:\Windows\System\LOYgJzD.exe
  2⤵
  PID:6120
- C:\Windows\System\DdFeQTW.exe
  C:\Windows\System\DdFeQTW.exe
  2⤵
  PID:5380
- C:\Windows\System\bEBRmbY.exe
  C:\Windows\System\bEBRmbY.exe
  2⤵
  PID:5348
- C:\Windows\System\CeLZbbm.exe
  C:\Windows\System\CeLZbbm.exe
  2⤵
  PID:5712
- C:\Windows\System\KQdTLSG.exe
  C:\Windows\System\KQdTLSG.exe
  2⤵
  PID:6036
- C:\Windows\System\aqVWvXq.exe
  C:\Windows\System\aqVWvXq.exe
  2⤵
  PID:6156
- C:\Windows\System\eUMnxTr.exe
  C:\Windows\System\eUMnxTr.exe
  2⤵
  PID:6172
- C:\Windows\System\URoBwwg.exe
  C:\Windows\System\URoBwwg.exe
  2⤵
  PID:6188
- C:\Windows\System\vNfaSvK.exe
  C:\Windows\System\vNfaSvK.exe
  2⤵
  PID:6204
- C:\Windows\System\WGRTuUr.exe
  C:\Windows\System\WGRTuUr.exe
  2⤵
  PID:6220
- C:\Windows\System\jhvsnyy.exe
  C:\Windows\System\jhvsnyy.exe
  2⤵
  PID:6236
- C:\Windows\System\bnswAWD.exe
  C:\Windows\System\bnswAWD.exe
  2⤵
  PID:6252
- C:\Windows\System\phUYTGW.exe
  C:\Windows\System\phUYTGW.exe
  2⤵
  PID:6268
- C:\Windows\System\VHXjRMg.exe
  C:\Windows\System\VHXjRMg.exe
  2⤵
  PID:6284
- C:\Windows\System\saVBnZT.exe
  C:\Windows\System\saVBnZT.exe
  2⤵
  PID:6304
- C:\Windows\System\sEPfpyv.exe
  C:\Windows\System\sEPfpyv.exe
  2⤵
  PID:6320
- C:\Windows\System\zSLZDBr.exe
  C:\Windows\System\zSLZDBr.exe
  2⤵
  PID:6336
- C:\Windows\System\fHUMAsh.exe
  C:\Windows\System\fHUMAsh.exe
  2⤵
  PID:6352
- C:\Windows\System\cMHXMFG.exe
  C:\Windows\System\cMHXMFG.exe
  2⤵
  PID:6368
- C:\Windows\System\yfHmIfW.exe
  C:\Windows\System\yfHmIfW.exe
  2⤵
  PID:6384
- C:\Windows\System\LrVkjeZ.exe
  C:\Windows\System\LrVkjeZ.exe
  2⤵
  PID:6400
- C:\Windows\System\HraIILP.exe
  C:\Windows\System\HraIILP.exe
  2⤵
  PID:6416
- C:\Windows\System\lXwTbdy.exe
  C:\Windows\System\lXwTbdy.exe
  2⤵
  PID:6432
- C:\Windows\System\ydwPcvK.exe
  C:\Windows\System\ydwPcvK.exe
  2⤵
  PID:6448
- C:\Windows\System\VbYCmOY.exe
  C:\Windows\System\VbYCmOY.exe
  2⤵
  PID:6464
- C:\Windows\System\YONkIIN.exe
  C:\Windows\System\YONkIIN.exe
  2⤵
  PID:6480
- C:\Windows\System\yNfvcKS.exe
  C:\Windows\System\yNfvcKS.exe
  2⤵
  PID:6496
- C:\Windows\System\qljyKSS.exe
  C:\Windows\System\qljyKSS.exe
  2⤵
  PID:6512
- C:\Windows\System\nnqcqCc.exe
  C:\Windows\System\nnqcqCc.exe
  2⤵
  PID:6528
- C:\Windows\System\WFxuunR.exe
  C:\Windows\System\WFxuunR.exe
  2⤵
  PID:6544
- C:\Windows\System\wmKtWLg.exe
  C:\Windows\System\wmKtWLg.exe
  2⤵
  PID:6560
- C:\Windows\System\vlcWzXa.exe
  C:\Windows\System\vlcWzXa.exe
  2⤵
  PID:6576
- C:\Windows\System\fcLkGXl.exe
  C:\Windows\System\fcLkGXl.exe
  2⤵
  PID:6592
- C:\Windows\System\mdzCQVp.exe
  C:\Windows\System\mdzCQVp.exe
  2⤵
  PID:6608
- C:\Windows\System\NUdLaoQ.exe
  C:\Windows\System\NUdLaoQ.exe
  2⤵
  PID:6624
- C:\Windows\System\qaPmyNI.exe
  C:\Windows\System\qaPmyNI.exe
  2⤵
  PID:6640
- C:\Windows\System\eQfHHTu.exe
  C:\Windows\System\eQfHHTu.exe
  2⤵
  PID:6656
- C:\Windows\System\joLxrrR.exe
  C:\Windows\System\joLxrrR.exe
  2⤵
  PID:6672
- C:\Windows\System\ZkEuHIy.exe
  C:\Windows\System\ZkEuHIy.exe
  2⤵
  PID:6688
- C:\Windows\System\KpdTnbi.exe
  C:\Windows\System\KpdTnbi.exe
  2⤵
  PID:6704
- C:\Windows\System\VtUfhdZ.exe
  C:\Windows\System\VtUfhdZ.exe
  2⤵
  PID:6720
- C:\Windows\System\QTxlMoh.exe
  C:\Windows\System\QTxlMoh.exe
  2⤵
  PID:6736
- C:\Windows\System\cBupEuA.exe
  C:\Windows\System\cBupEuA.exe
  2⤵
  PID:6752
- C:\Windows\System\qRpyOAu.exe
  C:\Windows\System\qRpyOAu.exe
  2⤵
  PID:6768
- C:\Windows\System\dzbpuhl.exe
  C:\Windows\System\dzbpuhl.exe
  2⤵
  PID:6784
- C:\Windows\System\tvQSGnJ.exe
  C:\Windows\System\tvQSGnJ.exe
  2⤵
  PID:6800
- C:\Windows\System\fnNGlfr.exe
  C:\Windows\System\fnNGlfr.exe
  2⤵
  PID:6816
- C:\Windows\System\KarNsBM.exe
  C:\Windows\System\KarNsBM.exe
  2⤵
  PID:6832
- C:\Windows\System\OwkMDMC.exe
  C:\Windows\System\OwkMDMC.exe
  2⤵
  PID:6848
- C:\Windows\System\aFcDbbn.exe
  C:\Windows\System\aFcDbbn.exe
  2⤵
  PID:6864
- C:\Windows\System\RNMxPQV.exe
  C:\Windows\System\RNMxPQV.exe
  2⤵
  PID:6880
- C:\Windows\System\BUQAhcO.exe
  C:\Windows\System\BUQAhcO.exe
  2⤵
  PID:6900
- C:\Windows\System\PjspyVg.exe
  C:\Windows\System\PjspyVg.exe
  2⤵
  PID:6916
- C:\Windows\System\DklkiNx.exe
  C:\Windows\System\DklkiNx.exe
  2⤵
  PID:6932
- C:\Windows\System\nVERGGu.exe
  C:\Windows\System\nVERGGu.exe
  2⤵
  PID:6948
- C:\Windows\System\tpdYkkm.exe
  C:\Windows\System\tpdYkkm.exe
  2⤵
  PID:6964
- C:\Windows\System\kriJrJh.exe
  C:\Windows\System\kriJrJh.exe
  2⤵
  PID:6980
- C:\Windows\System\UtkUnkP.exe
  C:\Windows\System\UtkUnkP.exe
  2⤵
  PID:6996
- C:\Windows\System\SIEnjQn.exe
  C:\Windows\System\SIEnjQn.exe
  2⤵
  PID:7012
- C:\Windows\System\dDZZvuA.exe
  C:\Windows\System\dDZZvuA.exe
  2⤵
  PID:7028
- C:\Windows\System\TJaPYhg.exe
  C:\Windows\System\TJaPYhg.exe
  2⤵
  PID:7044
- C:\Windows\System\wGvJdJm.exe
  C:\Windows\System\wGvJdJm.exe
  2⤵
  PID:7060
- C:\Windows\System\ZkMZsWj.exe
  C:\Windows\System\ZkMZsWj.exe
  2⤵
  PID:7076
- C:\Windows\System\pHALOxc.exe
  C:\Windows\System\pHALOxc.exe
  2⤵
  PID:7092
- C:\Windows\System\haSWLYr.exe
  C:\Windows\System\haSWLYr.exe
  2⤵
  PID:7108
- C:\Windows\System\tgcGarm.exe
  C:\Windows\System\tgcGarm.exe
  2⤵
  PID:7124
- C:\Windows\System\CSoagsK.exe
  C:\Windows\System\CSoagsK.exe
  2⤵
  PID:7140
- C:\Windows\System\eRmkoeH.exe
  C:\Windows\System\eRmkoeH.exe
  2⤵
  PID:7156
- C:\Windows\System\CbWvdja.exe
  C:\Windows\System\CbWvdja.exe
  2⤵
  PID:5184
- C:\Windows\System\BfzaKye.exe
  C:\Windows\System\BfzaKye.exe
  2⤵
  PID:6184
- C:\Windows\System\uJVvpVo.exe
  C:\Windows\System\uJVvpVo.exe
  2⤵
  PID:6244
- C:\Windows\System\AzQDoIZ.exe
  C:\Windows\System\AzQDoIZ.exe
  2⤵
  PID:6296
- C:\Windows\System\RbFMiRb.exe
  C:\Windows\System\RbFMiRb.exe
  2⤵
  PID:6228
- C:\Windows\System\YhLDnCz.exe
  C:\Windows\System\YhLDnCz.exe
  2⤵
  PID:5284
- C:\Windows\System\QcVnyHd.exe
  C:\Windows\System\QcVnyHd.exe
  2⤵
  PID:6216
- C:\Windows\System\ysBiLes.exe
  C:\Windows\System\ysBiLes.exe
  2⤵
  PID:6312
- C:\Windows\System\nyrZequ.exe
  C:\Windows\System\nyrZequ.exe
  2⤵
  PID:6408
- C:\Windows\System\RQvklnb.exe
  C:\Windows\System\RQvklnb.exe
  2⤵
  PID:6428
- C:\Windows\System\llylnja.exe
  C:\Windows\System\llylnja.exe
  2⤵
  PID:6488
- C:\Windows\System\sWXabff.exe
  C:\Windows\System\sWXabff.exe
  2⤵
  PID:6524
- C:\Windows\System\TIYvFJe.exe
  C:\Windows\System\TIYvFJe.exe
  2⤵
  PID:6588
- C:\Windows\System\IEJcwrw.exe
  C:\Windows\System\IEJcwrw.exe
  2⤵
  PID:6652
- C:\Windows\System\aejZPpI.exe
  C:\Windows\System\aejZPpI.exe
  2⤵
  PID:6744
- C:\Windows\System\jqVdcfd.exe
  C:\Windows\System\jqVdcfd.exe
  2⤵
  PID:6808
- C:\Windows\System\lYDDRhJ.exe
  C:\Windows\System\lYDDRhJ.exe
  2⤵
  PID:6876
- C:\Windows\System\CYCGdsv.exe
  C:\Windows\System\CYCGdsv.exe
  2⤵
  PID:6940
- C:\Windows\System\YqeazJe.exe
  C:\Windows\System\YqeazJe.exe
  2⤵
  PID:6976
- C:\Windows\System\zRCozoJ.exe
  C:\Windows\System\zRCozoJ.exe
  2⤵
  PID:7036
- C:\Windows\System\jTVHGGj.exe
  C:\Windows\System\jTVHGGj.exe
  2⤵
  PID:7132
- C:\Windows\System\tDDiqMY.exe
  C:\Windows\System\tDDiqMY.exe
  2⤵
  PID:6572
- C:\Windows\System\rxccRkR.exe
  C:\Windows\System\rxccRkR.exe
  2⤵
  PID:6956
- C:\Windows\System\DjgXqwK.exe
  C:\Windows\System\DjgXqwK.exe
  2⤵
  PID:6760
- C:\Windows\System\vfpWVbi.exe
  C:\Windows\System\vfpWVbi.exe
  2⤵
  PID:6924
- C:\Windows\System\BWWsjic.exe
  C:\Windows\System\BWWsjic.exe
  2⤵
  PID:6668
- C:\Windows\System\xuQxMoj.exe
  C:\Windows\System\xuQxMoj.exe
  2⤵
  PID:6792
- C:\Windows\System\ZqFRmPN.exe
  C:\Windows\System\ZqFRmPN.exe
  2⤵
  PID:6892
- C:\Windows\System\aDuUmxp.exe
  C:\Windows\System\aDuUmxp.exe
  2⤵
  PID:7020
- C:\Windows\System\sKDrLJv.exe
  C:\Windows\System\sKDrLJv.exe
  2⤵
  PID:7116
- C:\Windows\System\cPgsFrD.exe
  C:\Windows\System\cPgsFrD.exe
  2⤵
  PID:1564
- C:\Windows\System\aPPeYXz.exe
  C:\Windows\System\aPPeYXz.exe
  2⤵
  PID:6168
- C:\Windows\System\tUcvwFK.exe
  C:\Windows\System\tUcvwFK.exe
  2⤵
  PID:6392
- C:\Windows\System\UovbREo.exe
  C:\Windows\System\UovbREo.exe
  2⤵
  PID:6276
- C:\Windows\System\UygxrrI.exe
  C:\Windows\System\UygxrrI.exe
  2⤵
  PID:6472
- C:\Windows\System\iFByHNB.exe
  C:\Windows\System\iFByHNB.exe
  2⤵
  PID:6152
- C:\Windows\System\isugGRE.exe
  C:\Windows\System\isugGRE.exe
  2⤵
  PID:6348
- C:\Windows\System\gyiYhTV.exe
  C:\Windows\System\gyiYhTV.exe
  2⤵
  PID:6476
- C:\Windows\System\PYWGSfm.exe
  C:\Windows\System\PYWGSfm.exe
  2⤵
  PID:7104
- C:\Windows\System\zXloBAn.exe
  C:\Windows\System\zXloBAn.exe
  2⤵
  PID:6844
- C:\Windows\System\XqwyDJS.exe
  C:\Windows\System\XqwyDJS.exe
  2⤵
  PID:6684
- C:\Windows\System\tasUWUK.exe
  C:\Windows\System\tasUWUK.exe
  2⤵
  PID:6856
- C:\Windows\System\VAbrTYk.exe
  C:\Windows\System\VAbrTYk.exe
  2⤵
  PID:7152
- C:\Windows\System\rkGyKzL.exe
  C:\Windows\System\rkGyKzL.exe
  2⤵
  PID:6444
- C:\Windows\System\gCLcztk.exe
  C:\Windows\System\gCLcztk.exe
  2⤵
  PID:6520
- C:\Windows\System\BQeUtxl.exe
  C:\Windows\System\BQeUtxl.exe
  2⤵
  PID:6912
- C:\Windows\System\GDIDeoE.exe
  C:\Windows\System\GDIDeoE.exe
  2⤵
  PID:7008
- C:\Windows\System\OJvdXoz.exe
  C:\Windows\System\OJvdXoz.exe
  2⤵
  PID:6732
- C:\Windows\System\EYWzIxo.exe
  C:\Windows\System\EYWzIxo.exe
  2⤵
  PID:7056
- C:\Windows\System\wUXMWOd.exe
  C:\Windows\System\wUXMWOd.exe
  2⤵
  PID:6364
- C:\Windows\System\IQlyHDK.exe
  C:\Windows\System\IQlyHDK.exe
  2⤵
  PID:6460
- C:\Windows\System\JXghHYK.exe
  C:\Windows\System\JXghHYK.exe
  2⤵
  PID:6508
- C:\Windows\System\uYryTgm.exe
  C:\Windows\System\uYryTgm.exe
  2⤵
  PID:7180
- C:\Windows\System\jpOBUNS.exe
  C:\Windows\System\jpOBUNS.exe
  2⤵
  PID:7196
- C:\Windows\System\cEflrmp.exe
  C:\Windows\System\cEflrmp.exe
  2⤵
  PID:7216
- C:\Windows\System\cGlVSEk.exe
  C:\Windows\System\cGlVSEk.exe
  2⤵
  PID:7232
- C:\Windows\System\bgepNNU.exe
  C:\Windows\System\bgepNNU.exe
  2⤵
  PID:7248
- C:\Windows\System\TgBPCCK.exe
  C:\Windows\System\TgBPCCK.exe
  2⤵
  PID:7272
- C:\Windows\System\OXzNLOo.exe
  C:\Windows\System\OXzNLOo.exe
  2⤵
  PID:7288
- C:\Windows\System\YQXkfle.exe
  C:\Windows\System\YQXkfle.exe
  2⤵
  PID:7304
- C:\Windows\System\WovEqOW.exe
  C:\Windows\System\WovEqOW.exe
  2⤵
  PID:7324
- C:\Windows\System\MbdMLeR.exe
  C:\Windows\System\MbdMLeR.exe
  2⤵
  PID:7340
- C:\Windows\System\ovEmzdv.exe
  C:\Windows\System\ovEmzdv.exe
  2⤵
  PID:7360
- C:\Windows\System\iRGcUod.exe
  C:\Windows\System\iRGcUod.exe
  2⤵
  PID:7376
- C:\Windows\System\vjCmWXX.exe
  C:\Windows\System\vjCmWXX.exe
  2⤵
  PID:7392
- C:\Windows\System\rKhSCDc.exe
  C:\Windows\System\rKhSCDc.exe
  2⤵
  PID:7412
- C:\Windows\System\QLwBoWS.exe
  C:\Windows\System\QLwBoWS.exe
  2⤵
  PID:7428
- C:\Windows\System\fUkCUrN.exe
  C:\Windows\System\fUkCUrN.exe
  2⤵
  PID:7444
- C:\Windows\System\JkrpnMs.exe
  C:\Windows\System\JkrpnMs.exe
  2⤵
  PID:7460
- C:\Windows\System\IlrcMnv.exe
  C:\Windows\System\IlrcMnv.exe
  2⤵
  PID:7476
- C:\Windows\System\FqoOLQS.exe
  C:\Windows\System\FqoOLQS.exe
  2⤵
  PID:7492
- C:\Windows\System\yxwbmAR.exe
  C:\Windows\System\yxwbmAR.exe
  2⤵
  PID:7508
- C:\Windows\System\CbZzcxd.exe
  C:\Windows\System\CbZzcxd.exe
  2⤵
  PID:7528
- C:\Windows\System\wocxJmh.exe
  C:\Windows\System\wocxJmh.exe
  2⤵
  PID:7544
- C:\Windows\System\fwtjDvl.exe
  C:\Windows\System\fwtjDvl.exe
  2⤵
  PID:7560
- C:\Windows\System\znoxbtN.exe
  C:\Windows\System\znoxbtN.exe
  2⤵
  PID:7576
- C:\Windows\System\SxWxVuH.exe
  C:\Windows\System\SxWxVuH.exe
  2⤵
  PID:7592
- C:\Windows\System\fWTSSEk.exe
  C:\Windows\System\fWTSSEk.exe
  2⤵
  PID:7608
- C:\Windows\System\umAykTA.exe
  C:\Windows\System\umAykTA.exe
  2⤵
  PID:7628
- C:\Windows\System\walLImc.exe
  C:\Windows\System\walLImc.exe
  2⤵
  PID:7648
- C:\Windows\System\kFEEzSJ.exe
  C:\Windows\System\kFEEzSJ.exe
  2⤵
  PID:7668
- C:\Windows\System\UoGjEJm.exe
  C:\Windows\System\UoGjEJm.exe
  2⤵
  PID:7684
- C:\Windows\System\QFJavcf.exe
  C:\Windows\System\QFJavcf.exe
  2⤵
  PID:7700
- C:\Windows\System\OgFKPOq.exe
  C:\Windows\System\OgFKPOq.exe
  2⤵
  PID:7720
- C:\Windows\System\wCWjuLR.exe
  C:\Windows\System\wCWjuLR.exe
  2⤵
  PID:7736
- C:\Windows\System\KYUlWjO.exe
  C:\Windows\System\KYUlWjO.exe
  2⤵
  PID:7752
- C:\Windows\System\jABhASL.exe
  C:\Windows\System\jABhASL.exe
  2⤵
  PID:7768
- C:\Windows\System\JqMKRQS.exe
  C:\Windows\System\JqMKRQS.exe
  2⤵
  PID:7784
- C:\Windows\System\TQChDjD.exe
  C:\Windows\System\TQChDjD.exe
  2⤵
  PID:7800
- C:\Windows\System\rRfCtVG.exe
  C:\Windows\System\rRfCtVG.exe
  2⤵
  PID:7816
- C:\Windows\System\ToNKNnS.exe
  C:\Windows\System\ToNKNnS.exe
  2⤵
  PID:7832
- C:\Windows\System\yZyfSIO.exe
  C:\Windows\System\yZyfSIO.exe
  2⤵
  PID:7848
- C:\Windows\System\xVagnzm.exe
  C:\Windows\System\xVagnzm.exe
  2⤵
  PID:7864
- C:\Windows\System\UcRyWXR.exe
  C:\Windows\System\UcRyWXR.exe
  2⤵
  PID:7880
- C:\Windows\System\dlXQNeh.exe
  C:\Windows\System\dlXQNeh.exe
  2⤵
  PID:7896
- C:\Windows\System\DhYOuxP.exe
  C:\Windows\System\DhYOuxP.exe
  2⤵
  PID:7912
- C:\Windows\System\oRvYBLX.exe
  C:\Windows\System\oRvYBLX.exe
  2⤵
  PID:7928
- C:\Windows\System\zqDEwId.exe
  C:\Windows\System\zqDEwId.exe
  2⤵
  PID:7944
- C:\Windows\System\NkyiRam.exe
  C:\Windows\System\NkyiRam.exe
  2⤵
  PID:7960
- C:\Windows\System\MANEEfW.exe
  C:\Windows\System\MANEEfW.exe
  2⤵
  PID:7976
- C:\Windows\System\KTYRYON.exe
  C:\Windows\System\KTYRYON.exe
  2⤵
  PID:7992
- C:\Windows\System\ymJQciR.exe
  C:\Windows\System\ymJQciR.exe
  2⤵
  PID:8008
- C:\Windows\System\VhbnJpO.exe
  C:\Windows\System\VhbnJpO.exe
  2⤵
  PID:8024
- C:\Windows\System\OkTffso.exe
  C:\Windows\System\OkTffso.exe
  2⤵
  PID:8040
- C:\Windows\System\DFCBzDj.exe
  C:\Windows\System\DFCBzDj.exe
  2⤵
  PID:8056
- C:\Windows\System\YXJgniZ.exe
  C:\Windows\System\YXJgniZ.exe
  2⤵
  PID:8072
- C:\Windows\System\IdzBbUp.exe
  C:\Windows\System\IdzBbUp.exe
  2⤵
  PID:8088
- C:\Windows\System\EktGclp.exe
  C:\Windows\System\EktGclp.exe
  2⤵
  PID:8104
- C:\Windows\System\lWvctmY.exe
  C:\Windows\System\lWvctmY.exe
  2⤵
  PID:8120
- C:\Windows\System\QMtmZur.exe
  C:\Windows\System\QMtmZur.exe
  2⤵
  PID:8136
- C:\Windows\System\OlFMjzJ.exe
  C:\Windows\System\OlFMjzJ.exe
  2⤵
  PID:8152
- C:\Windows\System\hDMnNuc.exe
  C:\Windows\System\hDMnNuc.exe
  2⤵
  PID:8168
- C:\Windows\System\dypfNYL.exe
  C:\Windows\System\dypfNYL.exe
  2⤵
  PID:8184
- C:\Windows\System\TolIfgn.exe
  C:\Windows\System\TolIfgn.exe
  2⤵
  PID:6700
- C:\Windows\System\PzTNSvD.exe
  C:\Windows\System\PzTNSvD.exe
  2⤵
  PID:6212
- C:\Windows\System\Brzuzkp.exe
  C:\Windows\System\Brzuzkp.exe
  2⤵
  PID:6376
- C:\Windows\System\LgLFAzk.exe
  C:\Windows\System\LgLFAzk.exe
  2⤵
  PID:7208
- C:\Windows\System\vmurJOR.exe
  C:\Windows\System\vmurJOR.exe
  2⤵
  PID:6716
- C:\Windows\System\GCNkkpe.exe
  C:\Windows\System\GCNkkpe.exe
  2⤵
  PID:6164
- C:\Windows\System\tFUvldM.exe
  C:\Windows\System\tFUvldM.exe
  2⤵
  PID:7320
- C:\Windows\System\oYcWJEf.exe
  C:\Windows\System\oYcWJEf.exe
  2⤵
  PID:7384
- C:\Windows\System\kNGotMA.exe
  C:\Windows\System\kNGotMA.exe
  2⤵
  PID:7424
- C:\Windows\System\YjpvuMZ.exe
  C:\Windows\System\YjpvuMZ.exe
  2⤵
  PID:7488
- C:\Windows\System\yGCUmym.exe
  C:\Windows\System\yGCUmym.exe
  2⤵
  PID:7516
- C:\Windows\System\XFFFCBH.exe
  C:\Windows\System\XFFFCBH.exe
  2⤵
  PID:7584
- C:\Windows\System\pcQYPbN.exe
  C:\Windows\System\pcQYPbN.exe
  2⤵
  PID:7260
- C:\Windows\System\pyDOvfR.exe
  C:\Windows\System\pyDOvfR.exe
  2⤵
  PID:7468
- C:\Windows\System\sxlpDde.exe
  C:\Windows\System\sxlpDde.exe
  2⤵
  PID:6780
- C:\Windows\System\xoZuKhf.exe
  C:\Windows\System\xoZuKhf.exe
  2⤵
  PID:6888
- C:\Windows\System\IgPdMUU.exe
  C:\Windows\System\IgPdMUU.exe
  2⤵
  PID:7224
- C:\Windows\System\HttAWWM.exe
  C:\Windows\System\HttAWWM.exe
  2⤵
  PID:7268
- C:\Windows\System\FYkESYk.exe
  C:\Windows\System\FYkESYk.exe
  2⤵
  PID:7336
- C:\Windows\System\NAJltUu.exe
  C:\Windows\System\NAJltUu.exe
  2⤵
  PID:7436
- C:\Windows\System\oGdfvzP.exe
  C:\Windows\System\oGdfvzP.exe
  2⤵
  PID:7536
- C:\Windows\System\ALXIIyt.exe
  C:\Windows\System\ALXIIyt.exe
  2⤵
  PID:7588
- C:\Windows\System\PvdVHFW.exe
  C:\Windows\System\PvdVHFW.exe
  2⤵
  PID:7636
- C:\Windows\System\WoseqXJ.exe
  C:\Windows\System\WoseqXJ.exe
  2⤵
  PID:7676
- C:\Windows\System\bCcuvON.exe
  C:\Windows\System\bCcuvON.exe
  2⤵
  PID:7692
- C:\Windows\System\TwSGRWE.exe
  C:\Windows\System\TwSGRWE.exe
  2⤵
  PID:7708
- C:\Windows\System\pzVroPu.exe
  C:\Windows\System\pzVroPu.exe
  2⤵
  PID:7760
- C:\Windows\System\IdrGhgK.exe
  C:\Windows\System\IdrGhgK.exe
  2⤵
  PID:7828
- C:\Windows\System\vwURUgs.exe
  C:\Windows\System\vwURUgs.exe
  2⤵
  PID:7892
- C:\Windows\System\SMgvxtm.exe
  C:\Windows\System\SMgvxtm.exe
  2⤵
  PID:7956
- C:\Windows\System\HODCmDz.exe
  C:\Windows\System\HODCmDz.exe
  2⤵
  PID:8020
- C:\Windows\System\QDqDUGQ.exe
  C:\Windows\System\QDqDUGQ.exe
  2⤵
  PID:8080
- C:\Windows\System\BvipgPz.exe
  C:\Windows\System\BvipgPz.exe
  2⤵
  PID:8144
- C:\Windows\System\VkjUCJM.exe
  C:\Windows\System\VkjUCJM.exe
  2⤵
  PID:6632
- C:\Windows\System\VBcDQxO.exe
  C:\Windows\System\VBcDQxO.exe
  2⤵
  PID:7280
- C:\Windows\System\NHfOgFN.exe
  C:\Windows\System\NHfOgFN.exe
  2⤵
  PID:7908
- C:\Windows\System\xlHfCRa.exe
  C:\Windows\System\xlHfCRa.exe
  2⤵
  PID:8068
- C:\Windows\System\GlNlclK.exe
  C:\Windows\System\GlNlclK.exe
  2⤵
  PID:7408
- C:\Windows\System\NhuqDGi.exe
  C:\Windows\System\NhuqDGi.exe
  2⤵
  PID:7808
- C:\Windows\System\ZexClBR.exe
  C:\Windows\System\ZexClBR.exe
  2⤵
  PID:7400
- C:\Windows\System\EroHUFF.exe
  C:\Windows\System\EroHUFF.exe
  2⤵
  PID:8064
- C:\Windows\System\eaDJFRp.exe
  C:\Windows\System\eaDJFRp.exe
  2⤵
  PID:8160
- C:\Windows\System\ljHOLhN.exe
  C:\Windows\System\ljHOLhN.exe
  2⤵
  PID:7568
- C:\Windows\System\PJtTCKu.exe
  C:\Windows\System\PJtTCKu.exe
  2⤵
  PID:7872
- C:\Windows\System\hOZjTvL.exe
  C:\Windows\System\hOZjTvL.exe
  2⤵
  PID:7968
- C:\Windows\System\edXwJvY.exe
  C:\Windows\System\edXwJvY.exe
  2⤵
  PID:8032
- C:\Windows\System\JYMdGZu.exe
  C:\Windows\System\JYMdGZu.exe
  2⤵
  PID:6992
- C:\Windows\System\kmcfgbI.exe
  C:\Windows\System\kmcfgbI.exe
  2⤵
  PID:7240
- C:\Windows\System\CbPNwik.exe
  C:\Windows\System\CbPNwik.exe
  2⤵
  PID:7644
- C:\Windows\System\OHikDzT.exe
  C:\Windows\System\OHikDzT.exe
  2⤵
  PID:7484
- C:\Windows\System\xtJVGOJ.exe
  C:\Windows\System\xtJVGOJ.exe
  2⤵
  PID:7188
- C:\Windows\System\xQSqnwd.exe
  C:\Windows\System\xQSqnwd.exe
  2⤵
  PID:7712
- C:\Windows\System\lrKJXLZ.exe
  C:\Windows\System\lrKJXLZ.exe
  2⤵
  PID:7604
- C:\Windows\System\KZYnhzg.exe
  C:\Windows\System\KZYnhzg.exe
  2⤵
  PID:7824
- C:\Windows\System\hnbcUOt.exe
  C:\Windows\System\hnbcUOt.exe
  2⤵
  PID:8052
- C:\Windows\System\ItTyWUR.exe
  C:\Windows\System\ItTyWUR.exe
  2⤵
  PID:7888
- C:\Windows\System\Cjxpuwp.exe
  C:\Windows\System\Cjxpuwp.exe
  2⤵
  PID:7860
- C:\Windows\System\kjVprCa.exe
  C:\Windows\System\kjVprCa.exe
  2⤵
  PID:8116
- C:\Windows\System\PLBqAnx.exe
  C:\Windows\System\PLBqAnx.exe
  2⤵
  PID:7204
- C:\Windows\System\gdDDQAC.exe
  C:\Windows\System\gdDDQAC.exe
  2⤵
  PID:7264
- C:\Windows\System\MpTSEVY.exe
  C:\Windows\System\MpTSEVY.exe
  2⤵
  PID:7520
- C:\Windows\System\GFhttcg.exe
  C:\Windows\System\GFhttcg.exe
  2⤵
  PID:7844
- C:\Windows\System\guzTtWZ.exe
  C:\Windows\System\guzTtWZ.exe
  2⤵
  PID:7940
- C:\Windows\System\AYfwSer.exe
  C:\Windows\System\AYfwSer.exe
  2⤵
  PID:7388
- C:\Windows\System\KxfzJvi.exe
  C:\Windows\System\KxfzJvi.exe
  2⤵
  PID:7312
- C:\Windows\System\mTAitaM.exe
  C:\Windows\System\mTAitaM.exe
  2⤵
  PID:7600
- C:\Windows\System\rWyjxhe.exe
  C:\Windows\System\rWyjxhe.exe
  2⤵
  PID:7500
- C:\Windows\System\rnwxOfh.exe
  C:\Windows\System\rnwxOfh.exe
  2⤵
  PID:7952
- C:\Windows\System\YsfHEUA.exe
  C:\Windows\System\YsfHEUA.exe
  2⤵
  PID:7904
- C:\Windows\System\iysKPUM.exe
  C:\Windows\System\iysKPUM.exe
  2⤵
  PID:8132
- C:\Windows\System\LspWnZk.exe
  C:\Windows\System\LspWnZk.exe
  2⤵
  PID:6196
- C:\Windows\System\GYooUGP.exe
  C:\Windows\System\GYooUGP.exe
  2⤵
  PID:6712
- C:\Windows\System\tkXOMGE.exe
  C:\Windows\System\tkXOMGE.exe
  2⤵
  PID:8180
- C:\Windows\System\fjoPMlO.exe
  C:\Windows\System\fjoPMlO.exe
  2⤵
  PID:7332
- C:\Windows\System\vYWMaAc.exe
  C:\Windows\System\vYWMaAc.exe
  2⤵
  PID:7556
- C:\Windows\System\TtzyTIN.exe
  C:\Windows\System\TtzyTIN.exe
  2⤵
  PID:8164
- C:\Windows\System\KItWOPN.exe
  C:\Windows\System\KItWOPN.exe
  2⤵
  PID:7744
- C:\Windows\System\tXDKMua.exe
  C:\Windows\System\tXDKMua.exe
  2⤵
  PID:8200
- C:\Windows\System\HiGEFAj.exe
  C:\Windows\System\HiGEFAj.exe
  2⤵
  PID:8216
- C:\Windows\System\QSBAVTM.exe
  C:\Windows\System\QSBAVTM.exe
  2⤵
  PID:8232
- C:\Windows\System\ZwxoXmm.exe
  C:\Windows\System\ZwxoXmm.exe
  2⤵
  PID:8248
- C:\Windows\System\KQwBscZ.exe
  C:\Windows\System\KQwBscZ.exe
  2⤵
  PID:8264
- C:\Windows\System\qfMxtVY.exe
  C:\Windows\System\qfMxtVY.exe
  2⤵
  PID:8280
- C:\Windows\System\EuHahwW.exe
  C:\Windows\System\EuHahwW.exe
  2⤵
  PID:8296
- C:\Windows\System\aLNvNKn.exe
  C:\Windows\System\aLNvNKn.exe
  2⤵
  PID:8312
- C:\Windows\System\SemSfYC.exe
  C:\Windows\System\SemSfYC.exe
  2⤵
  PID:8328
- C:\Windows\System\BaFMkgn.exe
  C:\Windows\System\BaFMkgn.exe
  2⤵
  PID:8344
- C:\Windows\System\kzGvbzQ.exe
  C:\Windows\System\kzGvbzQ.exe
  2⤵
  PID:8360
- C:\Windows\System\AMsWGrr.exe
  C:\Windows\System\AMsWGrr.exe
  2⤵
  PID:8376
- C:\Windows\System\kMBzXYD.exe
  C:\Windows\System\kMBzXYD.exe
  2⤵
  PID:8392
- C:\Windows\System\qtLVHyx.exe
  C:\Windows\System\qtLVHyx.exe
  2⤵
  PID:8408
- C:\Windows\System\djFXaTn.exe
  C:\Windows\System\djFXaTn.exe
  2⤵
  PID:8424
- C:\Windows\System\grbeRfo.exe
  C:\Windows\System\grbeRfo.exe
  2⤵
  PID:8440
- C:\Windows\System\VuRwcYO.exe
  C:\Windows\System\VuRwcYO.exe
  2⤵
  PID:8456
- C:\Windows\System\cbHesXu.exe
  C:\Windows\System\cbHesXu.exe
  2⤵
  PID:8472
- C:\Windows\System\lOrXLxQ.exe
  C:\Windows\System\lOrXLxQ.exe
  2⤵
  PID:8488
- C:\Windows\System\JgmyAam.exe
  C:\Windows\System\JgmyAam.exe
  2⤵
  PID:8504
- C:\Windows\System\npmDJxg.exe
  C:\Windows\System\npmDJxg.exe
  2⤵
  PID:8520
- C:\Windows\System\vuzTmwI.exe
  C:\Windows\System\vuzTmwI.exe
  2⤵
  PID:8536
- C:\Windows\System\MbgpLHG.exe
  C:\Windows\System\MbgpLHG.exe
  2⤵
  PID:8552
- C:\Windows\System\NEIlyRx.exe
  C:\Windows\System\NEIlyRx.exe
  2⤵
  PID:8568
- C:\Windows\System\cxmBttU.exe
  C:\Windows\System\cxmBttU.exe
  2⤵
  PID:8584
- C:\Windows\System\RptgpLm.exe
  C:\Windows\System\RptgpLm.exe
  2⤵
  PID:8600
- C:\Windows\System\bdORVuC.exe
  C:\Windows\System\bdORVuC.exe
  2⤵
  PID:8616
- C:\Windows\System\MQiAFuO.exe
  C:\Windows\System\MQiAFuO.exe
  2⤵
  PID:8632
- C:\Windows\System\aQQFNhw.exe
  C:\Windows\System\aQQFNhw.exe
  2⤵
  PID:8648
- C:\Windows\System\EshrSTv.exe
  C:\Windows\System\EshrSTv.exe
  2⤵
  PID:8664
- C:\Windows\System\FAZehCA.exe
  C:\Windows\System\FAZehCA.exe
  2⤵
  PID:8680
- C:\Windows\System\QFINAmx.exe
  C:\Windows\System\QFINAmx.exe
  2⤵
  PID:8696
- C:\Windows\System\WIaILIm.exe
  C:\Windows\System\WIaILIm.exe
  2⤵
  PID:8712
- C:\Windows\System\tXapuom.exe
  C:\Windows\System\tXapuom.exe
  2⤵
  PID:8728
- C:\Windows\System\ugbEvJp.exe
  C:\Windows\System\ugbEvJp.exe
  2⤵
  PID:8744
- C:\Windows\System\QnvGVsS.exe
  C:\Windows\System\QnvGVsS.exe
  2⤵
  PID:8760
- C:\Windows\System\MCtsMKV.exe
  C:\Windows\System\MCtsMKV.exe
  2⤵
  PID:8776
- C:\Windows\System\eZlPBFn.exe
  C:\Windows\System\eZlPBFn.exe
  2⤵
  PID:8792
- C:\Windows\System\cHAuzLO.exe
  C:\Windows\System\cHAuzLO.exe
  2⤵
  PID:8812
- C:\Windows\System\pcKspTJ.exe
  C:\Windows\System\pcKspTJ.exe
  2⤵
  PID:8828
- C:\Windows\System\unlTSuM.exe
  C:\Windows\System\unlTSuM.exe
  2⤵
  PID:8844
- C:\Windows\System\OiiSQPL.exe
  C:\Windows\System\OiiSQPL.exe
  2⤵
  PID:8860
- C:\Windows\System\idSQogb.exe
  C:\Windows\System\idSQogb.exe
  2⤵
  PID:8876
- C:\Windows\System\LFStZfI.exe
  C:\Windows\System\LFStZfI.exe
  2⤵
  PID:8892
- C:\Windows\System\VmqfnUX.exe
  C:\Windows\System\VmqfnUX.exe
  2⤵
  PID:8908
- C:\Windows\System\OgomlLO.exe
  C:\Windows\System\OgomlLO.exe
  2⤵
  PID:8924
- C:\Windows\System\ruzmYju.exe
  C:\Windows\System\ruzmYju.exe
  2⤵
  PID:8940
- C:\Windows\System\JinATfa.exe
  C:\Windows\System\JinATfa.exe
  2⤵
  PID:8956
- C:\Windows\System\lrihEZt.exe
  C:\Windows\System\lrihEZt.exe
  2⤵
  PID:8972
- C:\Windows\System\pdMcECX.exe
  C:\Windows\System\pdMcECX.exe
  2⤵
  PID:8988
- C:\Windows\System\wTrHpGj.exe
  C:\Windows\System\wTrHpGj.exe
  2⤵
  PID:9004
- C:\Windows\System\nyeFlGQ.exe
  C:\Windows\System\nyeFlGQ.exe
  2⤵
  PID:9020
- C:\Windows\System\nkvAyzV.exe
  C:\Windows\System\nkvAyzV.exe
  2⤵
  PID:9036
- C:\Windows\System\QARjLnd.exe
  C:\Windows\System\QARjLnd.exe
  2⤵
  PID:9052
- C:\Windows\System\GsqcZgY.exe
  C:\Windows\System\GsqcZgY.exe
  2⤵
  PID:9068
- C:\Windows\System\PfnBHGH.exe
  C:\Windows\System\PfnBHGH.exe
  2⤵
  PID:9084
- C:\Windows\System\KJPLmgx.exe
  C:\Windows\System\KJPLmgx.exe
  2⤵
  PID:9100
- C:\Windows\System\CYkPMEk.exe
  C:\Windows\System\CYkPMEk.exe
  2⤵
  PID:9116
- C:\Windows\System\ZZnXKWr.exe
  C:\Windows\System\ZZnXKWr.exe
  2⤵
  PID:9132
- C:\Windows\System\VChzpFT.exe
  C:\Windows\System\VChzpFT.exe
  2⤵
  PID:9148
- C:\Windows\System\QcCsxFT.exe
  C:\Windows\System\QcCsxFT.exe
  2⤵
  PID:9164
- C:\Windows\System\YsVnrnR.exe
  C:\Windows\System\YsVnrnR.exe
  2⤵
  PID:9180
- C:\Windows\System\pfNLhAe.exe
  C:\Windows\System\pfNLhAe.exe
  2⤵
  PID:9196
- C:\Windows\System\xeFVllB.exe
  C:\Windows\System\xeFVllB.exe
  2⤵
  PID:9212
- C:\Windows\System\MwChWxd.exe
  C:\Windows\System\MwChWxd.exe
  2⤵
  PID:7812
- C:\Windows\System\jTNtGWd.exe
  C:\Windows\System\jTNtGWd.exe
  2⤵
  PID:6568
- C:\Windows\System\gMTjTOR.exe
  C:\Windows\System\gMTjTOR.exe
  2⤵
  PID:8228
- C:\Windows\System\cfMLWkr.exe
  C:\Windows\System\cfMLWkr.exe
  2⤵
  PID:8256
- C:\Windows\System\bIJoMlr.exe
  C:\Windows\System\bIJoMlr.exe
  2⤵
  PID:8272
- C:\Windows\System\eMsqVrW.exe
  C:\Windows\System\eMsqVrW.exe
  2⤵
  PID:8336
- C:\Windows\System\CHlSlIk.exe
  C:\Windows\System\CHlSlIk.exe
  2⤵
  PID:8356
- C:\Windows\System\gkAlvrj.exe
  C:\Windows\System\gkAlvrj.exe
  2⤵
  PID:8420
- C:\Windows\System\AAhUbvG.exe
  C:\Windows\System\AAhUbvG.exe
  2⤵
  PID:8480
- C:\Windows\System\UWGywiI.exe
  C:\Windows\System\UWGywiI.exe
  2⤵
  PID:8544
- C:\Windows\System\CxGmHKY.exe
  C:\Windows\System\CxGmHKY.exe
  2⤵
  PID:8400
- C:\Windows\System\Nndxqcr.exe
  C:\Windows\System\Nndxqcr.exe
  2⤵
  PID:8436
- C:\Windows\System\yFGefdW.exe
  C:\Windows\System\yFGefdW.exe
  2⤵
  PID:8500
- C:\Windows\System\LloyaGC.exe
  C:\Windows\System\LloyaGC.exe
  2⤵
  PID:8592
- C:\Windows\System\uUfQZiH.exe
  C:\Windows\System\uUfQZiH.exe
  2⤵
  PID:8640
- C:\Windows\System\GiAcpQw.exe
  C:\Windows\System\GiAcpQw.exe
  2⤵
  PID:8628
- C:\Windows\System\AOawzPw.exe
  C:\Windows\System\AOawzPw.exe
  2⤵
  PID:8676
- C:\Windows\System\NtmUJiq.exe
  C:\Windows\System\NtmUJiq.exe
  2⤵
  PID:8736
- C:\Windows\System\sNmNmvo.exe
  C:\Windows\System\sNmNmvo.exe
  2⤵
  PID:8740
- C:\Windows\System\cUimCaD.exe
  C:\Windows\System\cUimCaD.exe
  2⤵
  PID:8784
- C:\Windows\System\SxsImXl.exe
  C:\Windows\System\SxsImXl.exe
  2⤵
  PID:8804
- C:\Windows\System\DgKTJoc.exe
  C:\Windows\System\DgKTJoc.exe
  2⤵
  PID:8868
- C:\Windows\System\Dhtsqee.exe
  C:\Windows\System\Dhtsqee.exe
  2⤵
  PID:8932
- C:\Windows\System\GSvOszU.exe
  C:\Windows\System\GSvOszU.exe
  2⤵
  PID:8820
- C:\Windows\System\NvTBzps.exe
  C:\Windows\System\NvTBzps.exe
  2⤵
  PID:9000
- C:\Windows\System\raLwdDC.exe
  C:\Windows\System\raLwdDC.exe
  2⤵
  PID:9060
- C:\Windows\System\foalliU.exe
  C:\Windows\System\foalliU.exe
  2⤵
  PID:9096
- C:\Windows\System\ETENune.exe
  C:\Windows\System\ETENune.exe
  2⤵
  PID:9128
- C:\Windows\System\DzXnHoP.exe
  C:\Windows\System\DzXnHoP.exe
  2⤵
  PID:8980
- C:\Windows\System\CPKIByi.exe
  C:\Windows\System\CPKIByi.exe
  2⤵
  PID:8888
- C:\Windows\System\hSxxKqs.exe
  C:\Windows\System\hSxxKqs.exe
  2⤵
  PID:9080
- C:\Windows\System\bZclYsj.exe
  C:\Windows\System\bZclYsj.exe
  2⤵
  PID:9112
- C:\Windows\System\lKCvWpe.exe
  C:\Windows\System\lKCvWpe.exe
  2⤵
  PID:9144
- C:\Windows\System\dLOSlVx.exe
  C:\Windows\System\dLOSlVx.exe
  2⤵
  PID:8100
- C:\Windows\System\RGZatmq.exe
  C:\Windows\System\RGZatmq.exe
  2⤵
  PID:8208
- C:\Windows\System\hdDvLKR.exe
  C:\Windows\System\hdDvLKR.exe
  2⤵
  PID:8320
- C:\Windows\System\EWplooD.exe
  C:\Windows\System\EWplooD.exe
  2⤵
  PID:8448
- C:\Windows\System\endEqpS.exe
  C:\Windows\System\endEqpS.exe
  2⤵
  PID:8388
- C:\Windows\System\ZZWZAit.exe
  C:\Windows\System\ZZWZAit.exe
  2⤵
  PID:8512
- C:\Windows\System\eyTJCJB.exe
  C:\Windows\System\eyTJCJB.exe
  2⤵
  PID:8516
- C:\Windows\System\ZQGGNpj.exe
  C:\Windows\System\ZQGGNpj.exe
  2⤵
  PID:8608
- C:\Windows\System\odeqbiY.exe
  C:\Windows\System\odeqbiY.exe
  2⤵
  PID:8660
- C:\Windows\System\FnDPmaI.exe
  C:\Windows\System\FnDPmaI.exe
  2⤵
  PID:8724
- C:\Windows\System\DuKguWB.exe
  C:\Windows\System\DuKguWB.exe
  2⤵
  PID:8840
- C:\Windows\System\kNoXdzQ.exe
  C:\Windows\System\kNoXdzQ.exe
  2⤵
  PID:9032
- C:\Windows\System\QgHharu.exe
  C:\Windows\System\QgHharu.exe
  2⤵
  PID:8900
- C:\Windows\System\RDfMdeR.exe
  C:\Windows\System\RDfMdeR.exe
  2⤵
  PID:9064
- C:\Windows\System\kchzVPB.exe
  C:\Windows\System\kchzVPB.exe
  2⤵
  PID:9076
- C:\Windows\System\uMPlJfs.exe
  C:\Windows\System\uMPlJfs.exe
  2⤵
  PID:8196
- C:\Windows\System\PxwDjgk.exe
  C:\Windows\System\PxwDjgk.exe
  2⤵
  PID:8576
- C:\Windows\System\JzlUgVD.exe
  C:\Windows\System\JzlUgVD.exe
  2⤵
  PID:8708
- C:\Windows\System\UlcMZqc.exe
  C:\Windows\System\UlcMZqc.exe
  2⤵
  PID:9192
- C:\Windows\System\ppscXym.exe
  C:\Windows\System\ppscXym.exe
  2⤵
  PID:8996
- C:\Windows\System\tUITHpl.exe
  C:\Windows\System\tUITHpl.exe
  2⤵
  PID:8560
- C:\Windows\System\UDbDaRl.exe
  C:\Windows\System\UDbDaRl.exe
  2⤵
  PID:8372
- C:\Windows\System\WKWMBmT.exe
  C:\Windows\System\WKWMBmT.exe
  2⤵
  PID:9204
- C:\Windows\System\ZbuxXIc.exe
  C:\Windows\System\ZbuxXIc.exe
  2⤵
  PID:8304
- C:\Windows\System\HhBpcRU.exe
  C:\Windows\System\HhBpcRU.exe
  2⤵
  PID:8292
- C:\Windows\System\xWHoTdG.exe
  C:\Windows\System\xWHoTdG.exe
  2⤵
  PID:9228
- C:\Windows\System\wfenfRX.exe
  C:\Windows\System\wfenfRX.exe
  2⤵
  PID:9244
- C:\Windows\System\iieDNTx.exe
  C:\Windows\System\iieDNTx.exe
  2⤵
  PID:9260
- C:\Windows\System\ITkWhaj.exe
  C:\Windows\System\ITkWhaj.exe
  2⤵
  PID:9276
- C:\Windows\System\LsfsMAZ.exe
  C:\Windows\System\LsfsMAZ.exe
  2⤵
  PID:9292
- C:\Windows\System\dMCpySR.exe
  C:\Windows\System\dMCpySR.exe
  2⤵
  PID:9308
- C:\Windows\System\LCuYSRq.exe
  C:\Windows\System\LCuYSRq.exe
  2⤵
  PID:9324
- C:\Windows\System\ENyQKnq.exe
  C:\Windows\System\ENyQKnq.exe
  2⤵
  PID:9340
- C:\Windows\System\xawkUJK.exe
  C:\Windows\System\xawkUJK.exe
  2⤵
  PID:9356
- C:\Windows\System\rhyVPzN.exe
  C:\Windows\System\rhyVPzN.exe
  2⤵
  PID:9372
- C:\Windows\System\ptIYUsu.exe
  C:\Windows\System\ptIYUsu.exe
  2⤵
  PID:9388
- C:\Windows\System\ZQMPapn.exe
  C:\Windows\System\ZQMPapn.exe
  2⤵
  PID:9404
- C:\Windows\System\PCblbOV.exe
  C:\Windows\System\PCblbOV.exe
  2⤵
  PID:9420
- C:\Windows\System\AfYhzeU.exe
  C:\Windows\System\AfYhzeU.exe
  2⤵
  PID:9436
- C:\Windows\System\VMYFEnr.exe
  C:\Windows\System\VMYFEnr.exe
  2⤵
  PID:9452
- C:\Windows\System\dOWIjbC.exe
  C:\Windows\System\dOWIjbC.exe
  2⤵
  PID:9472
- C:\Windows\System\ShMDeXI.exe
  C:\Windows\System\ShMDeXI.exe
  2⤵
  PID:9488
- C:\Windows\System\BJOJwaV.exe
  C:\Windows\System\BJOJwaV.exe
  2⤵
  PID:9504
- C:\Windows\System\UbiGDkB.exe
  C:\Windows\System\UbiGDkB.exe
  2⤵
  PID:9520
- C:\Windows\System\qtKDKSl.exe
  C:\Windows\System\qtKDKSl.exe
  2⤵
  PID:9536
- C:\Windows\System\iLhMkhV.exe
  C:\Windows\System\iLhMkhV.exe
  2⤵
  PID:9552
- C:\Windows\System\pmrENss.exe
  C:\Windows\System\pmrENss.exe
  2⤵
  PID:9568
- C:\Windows\System\ZomsgPR.exe
  C:\Windows\System\ZomsgPR.exe
  2⤵
  PID:9584
- C:\Windows\System\PTGsdba.exe
  C:\Windows\System\PTGsdba.exe
  2⤵
  PID:9600
- C:\Windows\System\fxbgFzs.exe
  C:\Windows\System\fxbgFzs.exe
  2⤵
  PID:9616
- C:\Windows\System\vubOWKW.exe
  C:\Windows\System\vubOWKW.exe
  2⤵
  PID:9632
- C:\Windows\System\eHUbSQb.exe
  C:\Windows\System\eHUbSQb.exe
  2⤵
  PID:9648
- C:\Windows\System\DelDyBa.exe
  C:\Windows\System\DelDyBa.exe
  2⤵
  PID:9664
- C:\Windows\System\pCzrzRw.exe
  C:\Windows\System\pCzrzRw.exe
  2⤵
  PID:9680
- C:\Windows\System\cmMgVFM.exe
  C:\Windows\System\cmMgVFM.exe
  2⤵
  PID:9696
- C:\Windows\System\SpYsiaS.exe
  C:\Windows\System\SpYsiaS.exe
  2⤵
  PID:9712
- C:\Windows\System\uLHtxJH.exe
  C:\Windows\System\uLHtxJH.exe
  2⤵
  PID:9728
- C:\Windows\System\EDjnggm.exe
  C:\Windows\System\EDjnggm.exe
  2⤵
  PID:9748
- C:\Windows\System\uBBhRhX.exe
  C:\Windows\System\uBBhRhX.exe
  2⤵
  PID:9764
- C:\Windows\System\JLsjxij.exe
  C:\Windows\System\JLsjxij.exe
  2⤵
  PID:9780
- C:\Windows\System\khwJClP.exe
  C:\Windows\System\khwJClP.exe
  2⤵
  PID:9796
- C:\Windows\System\oSZTcrq.exe
  C:\Windows\System\oSZTcrq.exe
  2⤵
  PID:9812
- C:\Windows\System\HlzGDAZ.exe
  C:\Windows\System\HlzGDAZ.exe
  2⤵
  PID:9828
- C:\Windows\System\Puaeqrs.exe
  C:\Windows\System\Puaeqrs.exe
  2⤵
  PID:9844
- C:\Windows\System\THMhChV.exe
  C:\Windows\System\THMhChV.exe
  2⤵
  PID:9860
- C:\Windows\System\BxwSOKX.exe
  C:\Windows\System\BxwSOKX.exe
  2⤵
  PID:9876
- C:\Windows\System\JCoPWqT.exe
  C:\Windows\System\JCoPWqT.exe
  2⤵
  PID:9892
- C:\Windows\System\UzfsXNK.exe
  C:\Windows\System\UzfsXNK.exe
  2⤵
  PID:9908
- C:\Windows\System\gJdosuM.exe
  C:\Windows\System\gJdosuM.exe
  2⤵
  PID:9924
- C:\Windows\System\KqkJeRr.exe
  C:\Windows\System\KqkJeRr.exe
  2⤵
  PID:9940
- C:\Windows\System\tRDUKSC.exe
  C:\Windows\System\tRDUKSC.exe
  2⤵
  PID:9960
- C:\Windows\System\nczBQJD.exe
  C:\Windows\System\nczBQJD.exe
  2⤵
  PID:9976
- C:\Windows\System\LWVcmMV.exe
  C:\Windows\System\LWVcmMV.exe
  2⤵
  PID:9992
- C:\Windows\System\ZsmZODm.exe
  C:\Windows\System\ZsmZODm.exe
  2⤵
  PID:10008
- C:\Windows\System\CGLjQyV.exe
  C:\Windows\System\CGLjQyV.exe
  2⤵
  PID:10024
- C:\Windows\System\vdsUmOF.exe
  C:\Windows\System\vdsUmOF.exe
  2⤵
  PID:10040
- C:\Windows\System\pPHURjA.exe
  C:\Windows\System\pPHURjA.exe
  2⤵
  PID:10056
- C:\Windows\System\TRzubGm.exe
  C:\Windows\System\TRzubGm.exe
  2⤵
  PID:10072
- C:\Windows\System\AWVstab.exe
  C:\Windows\System\AWVstab.exe
  2⤵
  PID:10088
- C:\Windows\System\ncMVmVm.exe
  C:\Windows\System\ncMVmVm.exe
  2⤵
  PID:10104
- C:\Windows\System\WydwAoq.exe
  C:\Windows\System\WydwAoq.exe
  2⤵
  PID:10120
- C:\Windows\System\DTtSxqr.exe
  C:\Windows\System\DTtSxqr.exe
  2⤵
  PID:10136
- C:\Windows\System\QjGGXeD.exe
  C:\Windows\System\QjGGXeD.exe
  2⤵
  PID:10152
- C:\Windows\System\nbjmXNn.exe
  C:\Windows\System\nbjmXNn.exe
  2⤵
  PID:10168
- C:\Windows\System\ECzXkMl.exe
  C:\Windows\System\ECzXkMl.exe
  2⤵
  PID:10184
- C:\Windows\System\FGkVzfU.exe
  C:\Windows\System\FGkVzfU.exe
  2⤵
  PID:10200
- C:\Windows\System\rueFWYO.exe
  C:\Windows\System\rueFWYO.exe
  2⤵
  PID:10216
- C:\Windows\System\LMVqlVt.exe
  C:\Windows\System\LMVqlVt.exe
  2⤵
  PID:10232
- C:\Windows\System\cHYxMIt.exe
  C:\Windows\System\cHYxMIt.exe
  2⤵
  PID:9252
- C:\Windows\System\vkKDrPC.exe
  C:\Windows\System\vkKDrPC.exe
  2⤵
  PID:9284
- C:\Windows\System\qKEPipy.exe
  C:\Windows\System\qKEPipy.exe
  2⤵
  PID:7780
- C:\Windows\System\UsIXcBC.exe
  C:\Windows\System\UsIXcBC.exe
  2⤵
  PID:9320
- C:\Windows\System\CcYhYlU.exe
  C:\Windows\System\CcYhYlU.exe
  2⤵
  PID:9352
- C:\Windows\System\sbZEhJS.exe
  C:\Windows\System\sbZEhJS.exe
  2⤵
  PID:8884
- C:\Windows\System\ueGkXaW.exe
  C:\Windows\System\ueGkXaW.exe
  2⤵
  PID:8352
- C:\Windows\System\lYeHPpx.exe
  C:\Windows\System\lYeHPpx.exe
  2⤵
  PID:9140
- C:\Windows\System\eMJsmqM.exe
  C:\Windows\System\eMJsmqM.exe
  2⤵
  PID:9272
- C:\Windows\System\bCyLNeg.exe
  C:\Windows\System\bCyLNeg.exe
  2⤵
  PID:9368
- C:\Windows\System\xdZLRby.exe
  C:\Windows\System\xdZLRby.exe
  2⤵
  PID:9448
- C:\Windows\System\kiSGLiI.exe
  C:\Windows\System\kiSGLiI.exe
  2⤵
  PID:9396
- C:\Windows\System\recwcYB.exe
  C:\Windows\System\recwcYB.exe
  2⤵
  PID:9468
- C:\Windows\System\rEqkiMU.exe
  C:\Windows\System\rEqkiMU.exe
  2⤵
  PID:9544
- C:\Windows\System\ZSXablE.exe
  C:\Windows\System\ZSXablE.exe
  2⤵
  PID:9608
- C:\Windows\System\oYviyjz.exe
  C:\Windows\System\oYviyjz.exe
  2⤵
  PID:9672
- C:\Windows\System\bOjRVez.exe
  C:\Windows\System\bOjRVez.exe
  2⤵
  PID:9740
- C:\Windows\System\nBwZEMQ.exe
  C:\Windows\System\nBwZEMQ.exe
  2⤵
  PID:9500
- C:\Windows\System\HmmMOYV.exe
  C:\Windows\System\HmmMOYV.exe
  2⤵
  PID:9592
- C:\Windows\System\dFjAKhh.exe
  C:\Windows\System\dFjAKhh.exe
  2⤵
  PID:9656
- C:\Windows\System\IfjUwmC.exe
  C:\Windows\System\IfjUwmC.exe
  2⤵
  PID:9724
- C:\Windows\System\pdbgleY.exe
  C:\Windows\System\pdbgleY.exe
  2⤵
  PID:9788
- C:\Windows\System\lDwmjOV.exe
  C:\Windows\System\lDwmjOV.exe
  2⤵
  PID:9804
- C:\Windows\System\tpHkawv.exe
  C:\Windows\System\tpHkawv.exe
  2⤵
  PID:9868
- C:\Windows\System\XSluorO.exe
  C:\Windows\System\XSluorO.exe
  2⤵
  PID:9904
- C:\Windows\System\ctWFmGF.exe
  C:\Windows\System\ctWFmGF.exe
  2⤵
  PID:9936
- C:\Windows\System\wbfCeTn.exe
  C:\Windows\System\wbfCeTn.exe
  2⤵
  PID:9856
- C:\Windows\System\IViTKgY.exe
  C:\Windows\System\IViTKgY.exe
  2⤵
  PID:9920
- C:\Windows\System\rmNCPCu.exe
  C:\Windows\System\rmNCPCu.exe
  2⤵
  PID:9952
- C:\Windows\System\SuEBGZl.exe
  C:\Windows\System\SuEBGZl.exe
  2⤵
  PID:10036
- C:\Windows\System\TqPcKBv.exe
  C:\Windows\System\TqPcKBv.exe
  2⤵
  PID:10080
- C:\Windows\System\xkiOWvi.exe
  C:\Windows\System\xkiOWvi.exe
  2⤵
  PID:10144
- C:\Windows\System\qtOYwuv.exe
  C:\Windows\System\qtOYwuv.exe
  2⤵
  PID:10148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\IWohQTR.exe

Filesize
1.8MB

MD5
e6ec3bd9d9abcf0554494f69e7894c3f

SHA1
57002b05f31309b5b0a1bff39deeeb8095934057

SHA256
b09a4b0962f1239b8fdaa186fe7bc49da5742991476fe033898c7fa9047131c9

SHA512
6a448115857491c56a52d8fd0c25426cc2d137f0d27b1a43a5da56c6b739a3141f1af247c07e6d72eaba59dff23edeb9c769930b91c2cf5013b7d71b22584482

Download Submit
C:\Windows\system\JltnMNd.exe

Filesize
1.8MB

MD5
b7a18b1e3a8f60fbb91a2575ac73460e

SHA1
fbb51eb0bb1e1bca72029a7efe6b7165c8c1c52e

SHA256
1118a9c46a7b77e994a770c7a5f3e00a5e537f6b601e9f851a87e5aca974f8c5

SHA512
5369c3a441bc9fc293ea6ea418d0a0c3e1d55dacd7c9d69fb5c80909236eaefccc10f3de38262e49349811f95c7e6f3165e41ebf154764f8eb7b7d2bbed7bb97

Download Submit
C:\Windows\system\JvaWusa.exe

Filesize
1.8MB

MD5
91524be0993e42ddf4b5f3fbbf1f8d0b

SHA1
a5d7fd6b45a41c7fac551589d2cbcbc309fa7802

SHA256
06b2ef8390991706cd42183e6ddda05c567a6fc8b276229cd0a8cd000dd63212

SHA512
6c829d3772d7dabc0e335630f892839ed0c8b0379d3884cb2a0ddce74f3fa6842fc0cdf43c3c4610188beff4e0b4d7dae48c563709eb3e70004556946a06374f

Download Submit
C:\Windows\system\NDNjiwa.exe

Filesize
1.8MB

MD5
ff5f305c8f0ce7ba65e5e247c1594a17

SHA1
c7353e4ee2354c3dd956d0f192974f83fc6fbad4

SHA256
003a8029cc772c78917745f56cf8519814335d6bd52dbda04300fa66020d1376

SHA512
9e958bb4eb1a26ebe43fe54b730748a0a2c7d09c788b2e53688c8b380da6cf225995d9815832ad316f996ca2996f0ba535fae243dee722ed6956d68502ded2c2

Download Submit
C:\Windows\system\NelEPpS.exe

Filesize
1.8MB

MD5
be2e3d92e843370f8270f7eb07849fd2

SHA1
b840f93081f78c57f144f689ac6c7fb26c477695

SHA256
70ab37a860262423214403352103b85b0c3806a84b6e0e7ce9db462c6ccbf4bb

SHA512
3af7d2040ad4cfc327f5086862d2c63a1dedc01bbb730149dd405433132b9cbc5ad66542b0c1cca239ca48fabf27c32cef6871e0dac1cccf61fe768f004445d4

Download Submit
C:\Windows\system\QDebsAL.exe

Filesize
1.8MB

MD5
9de735aac4951bba1c9debda0a796db3

SHA1
0511f60edde09f4064d1ce3dc0ce1fee225a8f98

SHA256
48b5984fcfcded9e6a485c29558de291381d4a24d9a154dd5d401dde8ee1e5f1

SHA512
41ceb58e8dc46734594e695786ee8bd2a5a97727553e4e0457d7bed49ae82665bad40eacd173e03bcbfd94ea13b69a0d2c14ba91e293acdcd6a2ff8189dbe2d4

Download Submit
C:\Windows\system\SyXeXoa.exe

Filesize
1.8MB

MD5
0567c8f85005723ae6c4bc880d69619d

SHA1
232a189a08b4d1df5a3e34c8a5f2b26fd18ec19b

SHA256
6e3d3891a4d1e3f6fa3c02b4980c9622f6bd6e9ff6ff4e288fb48de57918b294

SHA512
a66a9e87fd3127627e7b6a12e69b73731562dd48037470d51aeeeb2acbd4786265bc873631a6277279327b3da22188aa4682db351bdd400cc0d7b4c810092cea

Download Submit
C:\Windows\system\VFudwhR.exe

Filesize
1.8MB

MD5
37137f38ea4d7dfe91d697d37a4eca2d

SHA1
0f87ece8a0eb208af05bd02634c25753219964e8

SHA256
d7725e6f10fa534a9d7db8c7e7adeeb8c29bab416b1756db6226e1ea06ec64df

SHA512
f9cd17a24d78750d62aeb9ae0ba61451b52faa98529c575cb20f524241535a3977c083f14144c74c0229d3599030ed315c071cf1d8e2682491d6d42c40a177a0

Download Submit
C:\Windows\system\VynSIIR.exe

Filesize
1.8MB

MD5
7cf4530edc9b2d2384827eab3c3c84fe

SHA1
d749b45551fabdb926abd2cd9b39e5974cb28475

SHA256
643201cdd66da415fc106bc9c1d3b5e81488b70c3e6385b608ed6153fd289804

SHA512
5687ab30e51fb7925d794e418ed90834cd170f5b7a4c3675589f6cc7802a2ddca9936d63fca7f251b797d5d6aac7622ddce098478971a5865e8ee0740c24db44

Download Submit
C:\Windows\system\XHTGuBt.exe

Filesize
1.8MB

MD5
af397b5052f266b9490b49a22dfe58c2

SHA1
10f0a827e9efbb55d135a36783c3644bdcccea18

SHA256
de79fe14f4554bbffb1bafffa44d5d6d29eb0d375bcd210ea1da6525fd84422f

SHA512
e24ee60f6a25a2f1adb6010f2b41078c0031b0886e85db855ccb0c3d8c5df98c8d4ddbe1895a3221c1205db6d07541402e510e484e49d5550f25b7024c0d95af

Download Submit
C:\Windows\system\XfWviat.exe

Filesize
1.8MB

MD5
a55d26888c26d66891a90e81af421c40

SHA1
3168b07e73734d894a3e18d2faae5afe12e85663

SHA256
063607e57077aed869530028df5698699d9357b533c276661c3caa1656a7ecd1

SHA512
679d44fc2fce37cb06fa3013bc4d3851104dadff04621520ebb53939ea58b0d2330237c4cc8741b089978b3276f55229431f3cbb9af6d1e5fd586cd9da330d74

Download Submit
C:\Windows\system\YzKwExv.exe

Filesize
1.8MB

MD5
54a8f01d95dd893626d47fb2ae2aad59

SHA1
d750c3d3317c10b4728a05cf69217d21f3a5dffb

SHA256
fb8c11db7abc0729b715287fe9a3b58c7d239c9645c85db4f7e5b6458f190c23

SHA512
adb8ade6775330a39ae6c0e7443f2037e593dac353d9d823696061615f59d3dafd551db9f2a1fff378bae1dd3d0f3aef7224d8d99d09d61c51a402f0d51e09c4

Download Submit
C:\Windows\system\dbkPOWF.exe

Filesize
1.8MB

MD5
04e2c41d0def1a04149214b0de06c4a9

SHA1
21df4d18a7238a8b46fe43096405e2a0e0d5b92e

SHA256
74da939c747e232007ccf8a37d80f8629a9a55635d083963d2e25a23b10d1a0e

SHA512
60a5cc7b23aca9aa3cfa9c171112b2ade0dd9231a66e22cc825deb06188a4f537b44aeb3c0c740b92fbc6f81fc503f588a396df74d6bfca082dc9959ec3fb824

Download Submit
C:\Windows\system\epJGnIy.exe

Filesize
1.8MB

MD5
96d77e02b858a6918d3a1b8553f6eb9f

SHA1
051c96498958542b88f0f29a27cff3189156fb1c

SHA256
93b367935655f53c75ae1d59fee79fc56c88411617ff6a01dab4632cc0be455f

SHA512
dbef92ed9d5a68857d70f3927eb115c23460942f29b715bfc9ea571f571b4f29410c1239607068df904e6e0fe7b3fe15035f0237358c5d266caa35268e4bb46a

Download Submit
C:\Windows\system\krnQeOm.exe

Filesize
1.8MB

MD5
312585044901872d755dacf15a082f48

SHA1
02b2158772f616ec215e03dec5dee669ccabf0fc

SHA256
ba9cae6f9db5f01874fdeda227fc6841852df7f70be57a53c31b7b8c5ef37840

SHA512
c815aee2f29ec5b04367ee30feac05192bfc4c1021344aea9ad1748da5fc7f1dd861eff181baf448ab54adca507a162a69b79b6725c55fc873d472dda3c77880

Download Submit
C:\Windows\system\mNmiRvy.exe

Filesize
1.8MB

MD5
7ea5d0de6279e8bf9ac70ee9aab36f90

SHA1
15700b12167c6f1f3a13411214fe4264259a2f25

SHA256
602f24e38d62d616a47c652b8427453d3f636419acb1e4f60836d9e12f09b08d

SHA512
8116043ab5d75c937a4d8f81b999fd625b713d775996b5e1be8e146c0f06e0b02247727586b7bd7a6ac8f0d44a02ffd6c5dc3a5cc6ea14508a99f0aaa547e8df

Download Submit
C:\Windows\system\nzhiAGs.exe

Filesize
1.8MB

MD5
d9db2a439b2257808fbb082622508827

SHA1
06c3bbe7d61b00c7ca8d5844dcea81f567eb1ff9

SHA256
7b9e3628c4c2923d23e033b817542b7ab25326b6ec60cba6927f4c2633c58798

SHA512
127a170572ed11817360eb736566d71029c0d539123b9858a058ac5730fed28d39c50119af7454abb58f0283326378120cfbe29aa93fdc09e13576d1807ab57d

Download Submit
C:\Windows\system\saksrlS.exe

Filesize
1.8MB

MD5
f8425768743da73b7c9b19550419b520

SHA1
d06ae0e4ef67b6e7d3eeb7c80ee284543f460e19

SHA256
95025267b47810227ac6fcdbcd7721f804495c709ffa7d8d0c72d53585f1fd26

SHA512
cb187bbf46de74f745dd976d5f2742f30bc7faf6ab31d1cc65ab3b410c30b8fcda9483511b780744acc7af2615fbcabead0a5fd9f4a790cf4f12a2fb3e8d573c

Download Submit
C:\Windows\system\skvhgbE.exe

Filesize
1.8MB

MD5
4c28aad4d69611cfcf35cf2561c05057

SHA1
807e7542097f1bbcb73576c29f271893cb5a75a1

SHA256
277b2ecb6c811745b16e42a4374c55e7f9bc371608e03cf132c184f1a2ab2ea1

SHA512
c11aae5dce5172ac75c8573bf5f7ba8f2cfdad79688a1c2c78e72fb59762b80d46f24b543843743a4ec4e49e9ee42291b72c09d626d9747f48e513471f64349a

Download Submit
C:\Windows\system\xuIXOKM.exe

Filesize
1.8MB

MD5
f70359bcfbcf0a6f92b93fe0e2285a7b

SHA1
75a891e5fa2e6f97e9157da11bb9dba19697b060

SHA256
f9aad1e58b1d7f7e32aaadb85e817ee57383d9275be96a3e5bad91676409263e

SHA512
df04f0fbf0ceac465d498e56134ebc6a9d47f4b71d764dd98a7bb5b6943db45382e9f72b3fc990aa0f9ca62d8955ee18b936d1c8ad9246aaf94a6342c2f2bcbb

Download Submit
C:\Windows\system\yYyheAk.exe

Filesize
1.8MB

MD5
e98b19b8f969ff8c2d22123bc9f9f283

SHA1
cd8d2d27660220f8a7031f1632735c5c035c1eb2

SHA256
5fdfc29e89e5b42acc22a5bbbb1f740d1b3e8ce5347f107f26dc7543856ef416

SHA512
1a53603a005f504da8500d8483d274337207ceaf54332d1b1a2e6a366fdf69bd5a25eff5a490272f1e29c4743a33de95e5389ff6db17ab428e86405a2bbb57c5

Download Submit
C:\Windows\system\ybGIxdM.exe

Filesize
1.8MB

MD5
65816a0ea0aa1010d57614f833d29aaf

SHA1
e1568e09ae0269c6fc626ca2f7c0994447c8b4ce

SHA256
7e692c41b17c78445f17570807a802b765a392ed35c0134c422d73fb8fe3956e

SHA512
bfa70c24064cc862bc808bbded8b510f335fc01280c4e5b68e819f3fd515532126519fde9c85dfbe251d8f2b0c0445591daf600a5eea509855420701e833d231

Download Submit
C:\Windows\system\zTqlNkO.exe

Filesize
1.8MB

MD5
89d82ff029954433ffac7b5505b83052

SHA1
f9933b28df1f0fb6baca4f26021c520339e13112

SHA256
ce414c5b25b2f0ececf24163b6673ac7a391b1a6e639ff27dea5ea6a448834ee

SHA512
2e4ce47b738f7debc947ba15bdde3e90a0e3ccc46430065f9f5a00ef6217fd4696dac08af977c51716ffbe5b3c3ac1b4450e3b1593c11c5f3943e28bcc7aaca5

Download Submit
\Windows\system\DjKzpiF.exe

Filesize
1.8MB

MD5
df0b48976ca4db3d78dc3087030dda1c

SHA1
bd48417b546967d1e909ed264d23d238aa7ddfb1

SHA256
ad53a9c50f9571693d732af99a6d618b60e0211753d76d83f951e17939fac8bc

SHA512
dcec0da94af54940ec0996adca27e1c46b2908eb5d1e72361c121df3991bc08f6fde83333c2f0e4cfa8d81b446899a16e3a9146fb91e05386766b69f3e835091

Download Submit
\Windows\system\EHJAnoi.exe

Filesize
1.8MB

MD5
1dbef7f010e9cbb5e47bafcaad6b93a5

SHA1
e9650b4977b5beb084a5cdf040754bb1e46c11bb

SHA256
61df7b0bff39d17a2f2c2635dfe77900306b995be017878a0b934596d730f54b

SHA512
a50d3e0ac8a5cf202b3a1e185ffe8b4e4d0a66f1684099d7f1e2ad4ed229695c2191b27f5d020e7a0a57ac011b34c6c9f2ba08c4766aba0bc3768011dce35003

Download Submit
\Windows\system\JSiDkZO.exe

Filesize
1.8MB

MD5
6f32045f78183549191251fa717323bc

SHA1
c11b20098ba42034403bad4920ae573a51569bd2

SHA256
62a6882b5e8103cae192edf437483061dac957f39407749a50f0b7caed9d229d

SHA512
6b35e32b9b7390cf60d8dd576c37928765c0ada05784415e42d6d9568fa69de4ed38a0499322636535285a42326f7130cfec4aa5911a6a16a8ded056b44a5f40

Download Submit
\Windows\system\PFXWKTE.exe

Filesize
1.8MB

MD5
fe7157d1881367162b3c0306f891b9df

SHA1
6f3df311cc12b1e530c790ad5337b50fb36ad54f

SHA256
e1046c0b4eb2dfdf4b6624360fd56a0109d3d880b274c4ee324d1a424d8c32cb

SHA512
38d6af2c28daf3cc67ab3c543ad84b8fb5a354da6b74508fe1c219192513c9ca2604533d711cac43ca2206553a08e33e0dedb51d0d1b5ee3b67f1b422527dfa6

Download Submit
\Windows\system\aScXHRC.exe

Filesize
1.8MB

MD5
4f416f7d84e241fbb6b58a56e164cdbe

SHA1
b39a451f2ee51c789ad76731e3d1c3715b5ead9b

SHA256
209af089e97eb004bf571ca75c499de5b28b3df5bea85c869ab7afaa7d91cc8f

SHA512
e78d941d64b5a05221dc25a06201f60c3f72d8d78f9ddd71b74ff4168ea40bb26e1ee8fd095666cf62023979fc3b1d3a4aaded5ca86708f3a268605c609183c6

Download Submit
\Windows\system\aUWcteE.exe

Filesize
1.8MB

MD5
0fb2ce134b8723f361bf0b57d7719f9a

SHA1
52ce26feac14bb4f04a8b4c4f99e37a4e63d8a0a

SHA256
2afaec5a4cf0031b190101b2aabecda97aef0c1d5cc2d39a5b0fa545faa7bda6

SHA512
02f912fedbd5dc4154c3449d384f8b0dd6d47d208aef7022f2c24c036edda304028a24a5a18209883c72f2b5280d912d13f2bc9cbff20794999903f8476bcb01

Download Submit
\Windows\system\aniVuvH.exe

Filesize
1.8MB

MD5
b3862e95cb9154e25552258cb693865d

SHA1
c130b87dbde82fd62ef4e023363881590154d1ca

SHA256
d0f1a96e605b62dc9592ad466263c1eacef584fac40c2415a87e20d1c223243f

SHA512
986860a341c76329af69fd14db294559893af351c8d9cba65dcb5a9d5feac1f05a4f238b351557779e05811c916710efbd49f8e486cb2e1c3bd2fcee8a17865c

Download Submit
\Windows\system\arRvNYR.exe

Filesize
1.8MB

MD5
1c3aa03e593874459b404bf956b7c2de

SHA1
0eca4f6aed8af4c66c696783bd2be971e5771278

SHA256
cfda60063428a83a1b784d6249fa49ba689a5db6e95966c4f3558d879a100cee

SHA512
0334ab21b9d5040500c68ba4725d5357d3d80ac3e6fc130c0dc507c1a5d0514e448652813fa31692414e41245a01833ed25dc7c0b727a01aff5f023a9c84c52c

Download Submit
\Windows\system\tHxorOA.exe

Filesize
1.8MB

MD5
4bcf7d0a0820b84ce6a0d7bcc5bd59fe

SHA1
b111b48ded7ab662d223011e4f46823ac245ec78

SHA256
088e5f7d4ec4de023097022e71451000e9ac4367b2b64afb058e2c579288b56f

SHA512
af60edb41ff1b89b6733c80bd1611036135311ea42568534183efc84d6f9fddfc448a2e3a3280af944dd6c5cd5a702d7ce2cc64c6327c47239937a0e02593703

Download Submit
\Windows\system\xVLhUyh.exe

Filesize
1.8MB

MD5
6ebde7830acae81c982855dc212ba601

SHA1
5654ca07b41d145ad51c6250473bba016768eb24

SHA256
84c711ce0f81c1437971169b7431c478ad8fbe1c98c3c494da9e3a0afde61ec8

SHA512
03e33341dbd8dd79f3c88bf903f05856dc6e7e6c5f2f80644fe67b15579cf98f65544ad7d086975c4b2400bbfc4be9fecd281668b3abde163f0915b0cea8403d

Download Submit
memory/296-306-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/756-495-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/756-474-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/756-318-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/756-445-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/756-0-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/756-406-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/756-345-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/756-8-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/756-375-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/756-498-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/756-497-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/756-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/756-435-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/756-457-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/1656-496-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2120-492-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/2172-494-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2308-390-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2352-217-0x0000000001FD0000-0x0000000001FD8000-memory.dmp

Filesize
32KB

Download
memory/2352-215-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2452-490-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2472-418-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2592-362-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2608-451-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-330-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/2656-463-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-493-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download