xmrig | 34f23a5f6637cff79da74acd8147515467729c5be03652cac9095e0add76c92a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
Size

1.9MB
MD5

0cc3d4d05974303bd82b6ff27573dc0f
SHA1

8096b365e4a25e13f35b584396a819505668252c
SHA256

34f23a5f6637cff79da74acd8147515467729c5be03652cac9095e0add76c92a
SHA512

3519fe7b35e53862a5c3b82f821936670600edc1f734dcd5d547dfa352d9788ae39c78c6ba0381a5b51eefc5f0336729e257dbbda60ecc81e14b735610c33a07
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1e:NABT

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2584-13-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2708-142-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig
behavioral1/memory/2520-180-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig
behavioral1/memory/1708-178-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/2892-158-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2904-147-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/2472-145-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2984-141-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig
behavioral1/memory/2712-140-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/3016-137-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/2612-161-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2464-150-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/3016-5697-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/2708-5717-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig
behavioral1/memory/2892-5723-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2612-5729-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2584-5734-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2520-5714-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig
behavioral1/memory/1708-5706-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/2712-5705-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2904-5718-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/2464-5713-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2472-5710-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2584	chZEFCD.exe
3016	KmalFLs.exe
2712	iMzfUoh.exe
2708	SVYZIkz.exe
2472	icvhQNs.exe
2904	kYKzqNx.exe
2464	XIdQSRE.exe
2892	tRfKhbZ.exe
2612	KrQgWoC.exe
1708	brCfYnC.exe
2520	fFRpjwC.exe
2724	qkeJjbt.exe
2336	YHPKLzY.exe
1460	oUayjLB.exe
2484	CymiDbk.exe
2952	VhPiuRD.exe
2408	OwwKZXn.exe
1300	ebHBQIN.exe
308	XkLoKqL.exe
1932	xhCgEIA.exe
1960	mwFGJuo.exe
1648	XcVvPfI.exe
1792	khYjQXL.exe
1596	TGixwta.exe
676	OdehPOS.exe
2224	jghMIob.exe
1244	NMTfcFl.exe
3004	dgVBfHd.exe
1764	mYhlohQ.exe
1548	znLEuww.exe
1632	tEyVMVy.exe
2088	DMRgfAn.exe
856	dhqQgzY.exe
1488	UgrkQiz.exe
2812	neQjKiE.exe
1164	UdMPkbE.exe
852	UpcjIIf.exe
312	iYHcYkS.exe
1988	FTcvhWN.exe
1516	rhFljQu.exe
2220	SaycWcy.exe
348	balztax.exe
2772	MdOKdyj.exe
1028	URRRYtG.exe
1580	cPwThQe.exe
2128	NtIFSOl.exe
2816	QEAYeJI.exe
1748	uyhlZoX.exe
2992	SqMBxDp.exe
2880	TGqiAQj.exe
3028	lXwpzUN.exe
2592	qlTTMAR.exe
2616	RmOXpGY.exe
2860	AlcBMVf.exe
2532	nhAUeWW.exe
2448	DQDDpUn.exe
1304	MJQLJQz.exe
1740	vtfwOzs.exe
1672	uTxuFiD.exe
2716	MQssmvK.exe
2840	IFErOgc.exe
2748	qGSDknQ.exe
2504	gyXFKsu.exe
3060	oXGOsdy.exe

Loads dropped DLL 64 IoCs

pid	Process
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2984-0-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/files/0x000b000000014323-3.dat	upx
behavioral1/memory/2584-13-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/files/0x0035000000014502-19.dat	upx
behavioral1/files/0x001800000000558a-18.dat	upx
behavioral1/files/0x00080000000149e1-28.dat	upx
behavioral1/files/0x0007000000014b36-33.dat	upx
behavioral1/files/0x0007000000015c85-45.dat	upx
behavioral1/files/0x0008000000014dae-56.dat	upx
behavioral1/files/0x0006000000015cbd-63.dat	upx
behavioral1/files/0x0007000000014b10-29.dat	upx
behavioral1/files/0x0006000000015c93-70.dat	upx
behavioral1/files/0x0006000000015cf5-85.dat	upx
behavioral1/files/0x0006000000015ce3-83.dat	upx
behavioral1/files/0x0006000000015d0c-94.dat	upx
behavioral1/files/0x0006000000015d4c-105.dat	upx
behavioral1/files/0x0006000000015d44-103.dat	upx
behavioral1/files/0x0006000000015e09-113.dat	upx
behavioral1/files/0x0006000000015fa7-130.dat	upx
behavioral1/files/0x0006000000015f3c-118.dat	upx
behavioral1/files/0x0006000000015e6d-119.dat	upx
behavioral1/files/0x00060000000161b3-152.dat	upx
behavioral1/files/0x00060000000165f0-168.dat	upx
behavioral1/files/0x0006000000016c3a-195.dat	upx
behavioral1/memory/2708-142-0x000000013F610000-0x000000013FA02000-memory.dmp	upx
behavioral1/files/0x0006000000016c1d-189.dat	upx
behavioral1/memory/2520-180-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/memory/1708-178-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/files/0x0006000000016476-175.dat	upx
behavioral1/files/0x0006000000016813-171.dat	upx
behavioral1/files/0x000600000001654a-165.dat	upx
behavioral1/memory/2892-158-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/files/0x00060000000162c9-155.dat	upx
behavioral1/memory/2904-147-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/memory/2472-145-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/2712-140-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/3016-137-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/files/0x00060000000160cc-132.dat	upx
behavioral1/files/0x0006000000016a6f-187.dat	upx
behavioral1/memory/2612-161-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/2464-150-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/files/0x0006000000015d24-98.dat	upx
behavioral1/files/0x0006000000015cce-65.dat	upx
behavioral1/files/0x0006000000015cb0-57.dat	upx
behavioral1/files/0x0006000000015cd9-73.dat	upx
behavioral1/files/0x0006000000015c9c-54.dat	upx
behavioral1/memory/3016-5697-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/memory/2708-5717-0x000000013F610000-0x000000013FA02000-memory.dmp	upx
behavioral1/memory/2892-5723-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2612-5729-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/2584-5734-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/memory/2520-5714-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/memory/1708-5706-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/2712-5705-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2904-5718-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/memory/2464-5713-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2472-5710-0x000000013F430000-0x000000013F822000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PfBuzdK.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\xnzUUiy.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\kBAfsci.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\VkJoalu.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\afrVVXw.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\JzRTZRl.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\KtxVGer.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\ILuxIyX.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\TtHypLq.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\LgJfiLy.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\YicWwFV.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\zXUhsEV.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\SxsDpVz.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\KYnOmwk.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\HUPjktq.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\fFtSHof.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\jaNwmbE.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\caEGkfV.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\altvnRM.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\ZVVrqdp.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\MnpXlZD.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\ooAQZsO.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\lBsRejk.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\zTShFxU.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\SUnDVVb.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\KiJCzGr.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\TGzNjjF.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\BPjpHVG.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\usGKstx.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\DSTvhgz.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\yzJTyeS.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\qVXmSoF.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\ggrFKXh.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\PtLLloa.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\DHDgTtG.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\YmSbitP.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\SBqaBfP.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\EsNCKkD.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\HPmEDbM.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\jEcHJdH.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\sNomJUv.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\GqhylhV.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\OLjHCDI.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\ovZXWcP.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\UIQmbrk.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\tZQqBcP.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\aYYmOnR.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\dtWKcwI.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\XIPddMX.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\yDzphLh.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\ZagFGhu.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\LzEsyqE.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\czABzeu.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\nSGqcRy.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\VVBgiOn.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\ryseqRe.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\BpDLMQo.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\bmYJhCF.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\qGDPmFG.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\OlGnKKH.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\mfHtltQ.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\UZtIhnw.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\XXaelAM.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
File created	C:\Windows\System\UJubVDJ.exe	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2636	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
Token: SeDebugPrivilege	2636	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2636	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2636	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2636	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2584	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	30
PID 2984 wrote to memory of 2584	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	30
PID 2984 wrote to memory of 2584	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	30
PID 2984 wrote to memory of 3016	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	31
PID 2984 wrote to memory of 3016	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	31
PID 2984 wrote to memory of 3016	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	31
PID 2984 wrote to memory of 2712	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	32
PID 2984 wrote to memory of 2712	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	32
PID 2984 wrote to memory of 2712	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	32
PID 2984 wrote to memory of 2708	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	33
PID 2984 wrote to memory of 2708	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	33
PID 2984 wrote to memory of 2708	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	33
PID 2984 wrote to memory of 2904	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	34
PID 2984 wrote to memory of 2904	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	34
PID 2984 wrote to memory of 2904	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	34
PID 2984 wrote to memory of 2472	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	35
PID 2984 wrote to memory of 2472	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	35
PID 2984 wrote to memory of 2472	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	35
PID 2984 wrote to memory of 2612	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	36
PID 2984 wrote to memory of 2612	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	36
PID 2984 wrote to memory of 2612	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	36
PID 2984 wrote to memory of 2464	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	37
PID 2984 wrote to memory of 2464	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	37
PID 2984 wrote to memory of 2464	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	37
PID 2984 wrote to memory of 2520	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	38
PID 2984 wrote to memory of 2520	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	38
PID 2984 wrote to memory of 2520	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	38
PID 2984 wrote to memory of 2892	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	39
PID 2984 wrote to memory of 2892	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	39
PID 2984 wrote to memory of 2892	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	39
PID 2984 wrote to memory of 2336	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	40
PID 2984 wrote to memory of 2336	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	40
PID 2984 wrote to memory of 2336	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	40
PID 2984 wrote to memory of 1708	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	41
PID 2984 wrote to memory of 1708	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	41
PID 2984 wrote to memory of 1708	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	41
PID 2984 wrote to memory of 1460	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	42
PID 2984 wrote to memory of 1460	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	42
PID 2984 wrote to memory of 1460	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	42
PID 2984 wrote to memory of 2724	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	43
PID 2984 wrote to memory of 2724	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	43
PID 2984 wrote to memory of 2724	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	43
PID 2984 wrote to memory of 2484	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	44
PID 2984 wrote to memory of 2484	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	44
PID 2984 wrote to memory of 2484	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	44
PID 2984 wrote to memory of 2952	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	45
PID 2984 wrote to memory of 2952	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	45
PID 2984 wrote to memory of 2952	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	45
PID 2984 wrote to memory of 2408	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	46
PID 2984 wrote to memory of 2408	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	46
PID 2984 wrote to memory of 2408	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	46
PID 2984 wrote to memory of 1300	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	47
PID 2984 wrote to memory of 1300	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	47
PID 2984 wrote to memory of 1300	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	47
PID 2984 wrote to memory of 308	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	48
PID 2984 wrote to memory of 308	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	48
PID 2984 wrote to memory of 308	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	48
PID 2984 wrote to memory of 1932	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	49
PID 2984 wrote to memory of 1932	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	49
PID 2984 wrote to memory of 1932	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	49
PID 2984 wrote to memory of 1960	2984	0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0cc3d4d05974303bd82b6ff27573dc0f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\System\chZEFCD.exe
  C:\Windows\System\chZEFCD.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\KmalFLs.exe
  C:\Windows\System\KmalFLs.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\iMzfUoh.exe
  C:\Windows\System\iMzfUoh.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\SVYZIkz.exe
  C:\Windows\System\SVYZIkz.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\kYKzqNx.exe
  C:\Windows\System\kYKzqNx.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\icvhQNs.exe
  C:\Windows\System\icvhQNs.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\KrQgWoC.exe
  C:\Windows\System\KrQgWoC.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\XIdQSRE.exe
  C:\Windows\System\XIdQSRE.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\fFRpjwC.exe
  C:\Windows\System\fFRpjwC.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\tRfKhbZ.exe
  C:\Windows\System\tRfKhbZ.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\YHPKLzY.exe
  C:\Windows\System\YHPKLzY.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\brCfYnC.exe
  C:\Windows\System\brCfYnC.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\oUayjLB.exe
  C:\Windows\System\oUayjLB.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\qkeJjbt.exe
  C:\Windows\System\qkeJjbt.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\CymiDbk.exe
  C:\Windows\System\CymiDbk.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\VhPiuRD.exe
  C:\Windows\System\VhPiuRD.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\OwwKZXn.exe
  C:\Windows\System\OwwKZXn.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\ebHBQIN.exe
  C:\Windows\System\ebHBQIN.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\XkLoKqL.exe
  C:\Windows\System\XkLoKqL.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\xhCgEIA.exe
  C:\Windows\System\xhCgEIA.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\mwFGJuo.exe
  C:\Windows\System\mwFGJuo.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\XcVvPfI.exe
  C:\Windows\System\XcVvPfI.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\khYjQXL.exe
  C:\Windows\System\khYjQXL.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\TGixwta.exe
  C:\Windows\System\TGixwta.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\mYhlohQ.exe
  C:\Windows\System\mYhlohQ.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\OdehPOS.exe
  C:\Windows\System\OdehPOS.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\UgrkQiz.exe
  C:\Windows\System\UgrkQiz.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\jghMIob.exe
  C:\Windows\System\jghMIob.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\UpcjIIf.exe
  C:\Windows\System\UpcjIIf.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\NMTfcFl.exe
  C:\Windows\System\NMTfcFl.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\iYHcYkS.exe
  C:\Windows\System\iYHcYkS.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\dgVBfHd.exe
  C:\Windows\System\dgVBfHd.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\SaycWcy.exe
  C:\Windows\System\SaycWcy.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\znLEuww.exe
  C:\Windows\System\znLEuww.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\balztax.exe
  C:\Windows\System\balztax.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\tEyVMVy.exe
  C:\Windows\System\tEyVMVy.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\MdOKdyj.exe
  C:\Windows\System\MdOKdyj.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\DMRgfAn.exe
  C:\Windows\System\DMRgfAn.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\URRRYtG.exe
  C:\Windows\System\URRRYtG.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\dhqQgzY.exe
  C:\Windows\System\dhqQgzY.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\NtIFSOl.exe
  C:\Windows\System\NtIFSOl.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\neQjKiE.exe
  C:\Windows\System\neQjKiE.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\QEAYeJI.exe
  C:\Windows\System\QEAYeJI.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\UdMPkbE.exe
  C:\Windows\System\UdMPkbE.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\uyhlZoX.exe
  C:\Windows\System\uyhlZoX.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\FTcvhWN.exe
  C:\Windows\System\FTcvhWN.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\SqMBxDp.exe
  C:\Windows\System\SqMBxDp.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\rhFljQu.exe
  C:\Windows\System\rhFljQu.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\TGqiAQj.exe
  C:\Windows\System\TGqiAQj.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\cPwThQe.exe
  C:\Windows\System\cPwThQe.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\qlTTMAR.exe
  C:\Windows\System\qlTTMAR.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\lXwpzUN.exe
  C:\Windows\System\lXwpzUN.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\RmOXpGY.exe
  C:\Windows\System\RmOXpGY.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\AlcBMVf.exe
  C:\Windows\System\AlcBMVf.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\MQssmvK.exe
  C:\Windows\System\MQssmvK.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\nhAUeWW.exe
  C:\Windows\System\nhAUeWW.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\IFErOgc.exe
  C:\Windows\System\IFErOgc.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\DQDDpUn.exe
  C:\Windows\System\DQDDpUn.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\qGSDknQ.exe
  C:\Windows\System\qGSDknQ.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\MJQLJQz.exe
  C:\Windows\System\MJQLJQz.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\gyXFKsu.exe
  C:\Windows\System\gyXFKsu.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\vtfwOzs.exe
  C:\Windows\System\vtfwOzs.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\GlAaUBQ.exe
  C:\Windows\System\GlAaUBQ.exe
  2⤵
  PID:1956
- C:\Windows\System\uTxuFiD.exe
  C:\Windows\System\uTxuFiD.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\cPhxQgr.exe
  C:\Windows\System\cPhxQgr.exe
  2⤵
  PID:1528
- C:\Windows\System\oXGOsdy.exe
  C:\Windows\System\oXGOsdy.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\lydtILv.exe
  C:\Windows\System\lydtILv.exe
  2⤵
  PID:1544
- C:\Windows\System\lTIdNME.exe
  C:\Windows\System\lTIdNME.exe
  2⤵
  PID:2136
- C:\Windows\System\WzeGguG.exe
  C:\Windows\System\WzeGguG.exe
  2⤵
  PID:3020
- C:\Windows\System\xDtuaiP.exe
  C:\Windows\System\xDtuaiP.exe
  2⤵
  PID:880
- C:\Windows\System\OREVGkP.exe
  C:\Windows\System\OREVGkP.exe
  2⤵
  PID:2344
- C:\Windows\System\VhnkpCv.exe
  C:\Windows\System\VhnkpCv.exe
  2⤵
  PID:1292
- C:\Windows\System\EHJCebL.exe
  C:\Windows\System\EHJCebL.exe
  2⤵
  PID:668
- C:\Windows\System\jHbayfT.exe
  C:\Windows\System\jHbayfT.exe
  2⤵
  PID:2092
- C:\Windows\System\EeiPuDZ.exe
  C:\Windows\System\EeiPuDZ.exe
  2⤵
  PID:2468
- C:\Windows\System\JtjjDos.exe
  C:\Windows\System\JtjjDos.exe
  2⤵
  PID:2704
- C:\Windows\System\aqayzSc.exe
  C:\Windows\System\aqayzSc.exe
  2⤵
  PID:936
- C:\Windows\System\ianSklD.exe
  C:\Windows\System\ianSklD.exe
  2⤵
  PID:1148
- C:\Windows\System\IfslBiv.exe
  C:\Windows\System\IfslBiv.exe
  2⤵
  PID:3036
- C:\Windows\System\mlZLNNV.exe
  C:\Windows\System\mlZLNNV.exe
  2⤵
  PID:2856
- C:\Windows\System\bWGQaAC.exe
  C:\Windows\System\bWGQaAC.exe
  2⤵
  PID:2544
- C:\Windows\System\JfaJlrG.exe
  C:\Windows\System\JfaJlrG.exe
  2⤵
  PID:3012
- C:\Windows\System\RTeHdUj.exe
  C:\Windows\System\RTeHdUj.exe
  2⤵
  PID:1760
- C:\Windows\System\jymjwth.exe
  C:\Windows\System\jymjwth.exe
  2⤵
  PID:1352
- C:\Windows\System\dUuLYMf.exe
  C:\Windows\System\dUuLYMf.exe
  2⤵
  PID:1828
- C:\Windows\System\QbadDDG.exe
  C:\Windows\System\QbadDDG.exe
  2⤵
  PID:908
- C:\Windows\System\NsbtPWQ.exe
  C:\Windows\System\NsbtPWQ.exe
  2⤵
  PID:2024
- C:\Windows\System\PGkFQos.exe
  C:\Windows\System\PGkFQos.exe
  2⤵
  PID:2940
- C:\Windows\System\pQUEmIV.exe
  C:\Windows\System\pQUEmIV.exe
  2⤵
  PID:2628
- C:\Windows\System\XLSePts.exe
  C:\Windows\System\XLSePts.exe
  2⤵
  PID:2156
- C:\Windows\System\yrHiOaY.exe
  C:\Windows\System\yrHiOaY.exe
  2⤵
  PID:1512
- C:\Windows\System\zzeWBBO.exe
  C:\Windows\System\zzeWBBO.exe
  2⤵
  PID:1152
- C:\Windows\System\jSazfgR.exe
  C:\Windows\System\jSazfgR.exe
  2⤵
  PID:2916
- C:\Windows\System\LDkZACL.exe
  C:\Windows\System\LDkZACL.exe
  2⤵
  PID:2260
- C:\Windows\System\yNTkINB.exe
  C:\Windows\System\yNTkINB.exe
  2⤵
  PID:1660
- C:\Windows\System\PuOcjMy.exe
  C:\Windows\System\PuOcjMy.exe
  2⤵
  PID:2528
- C:\Windows\System\qwBhbmD.exe
  C:\Windows\System\qwBhbmD.exe
  2⤵
  PID:2936
- C:\Windows\System\yImWsSq.exe
  C:\Windows\System\yImWsSq.exe
  2⤵
  PID:2828
- C:\Windows\System\nYPSfNg.exe
  C:\Windows\System\nYPSfNg.exe
  2⤵
  PID:2196
- C:\Windows\System\VdglnKD.exe
  C:\Windows\System\VdglnKD.exe
  2⤵
  PID:1200
- C:\Windows\System\RlDTLer.exe
  C:\Windows\System\RlDTLer.exe
  2⤵
  PID:1016
- C:\Windows\System\CVGhaNN.exe
  C:\Windows\System\CVGhaNN.exe
  2⤵
  PID:2516
- C:\Windows\System\esibYjh.exe
  C:\Windows\System\esibYjh.exe
  2⤵
  PID:1716
- C:\Windows\System\wWgcNZb.exe
  C:\Windows\System\wWgcNZb.exe
  2⤵
  PID:2348
- C:\Windows\System\cxEbcUg.exe
  C:\Windows\System\cxEbcUg.exe
  2⤵
  PID:808
- C:\Windows\System\hmVhgJV.exe
  C:\Windows\System\hmVhgJV.exe
  2⤵
  PID:1980
- C:\Windows\System\PEhMdBP.exe
  C:\Windows\System\PEhMdBP.exe
  2⤵
  PID:1044
- C:\Windows\System\tnuBJCF.exe
  C:\Windows\System\tnuBJCF.exe
  2⤵
  PID:2944
- C:\Windows\System\KwByYAC.exe
  C:\Windows\System\KwByYAC.exe
  2⤵
  PID:3096
- C:\Windows\System\LhlhFGB.exe
  C:\Windows\System\LhlhFGB.exe
  2⤵
  PID:3112
- C:\Windows\System\lxovklZ.exe
  C:\Windows\System\lxovklZ.exe
  2⤵
  PID:3128
- C:\Windows\System\DXpAKMg.exe
  C:\Windows\System\DXpAKMg.exe
  2⤵
  PID:3144
- C:\Windows\System\oIXMOdi.exe
  C:\Windows\System\oIXMOdi.exe
  2⤵
  PID:3160
- C:\Windows\System\FzLQJAz.exe
  C:\Windows\System\FzLQJAz.exe
  2⤵
  PID:3176
- C:\Windows\System\iAhUuHd.exe
  C:\Windows\System\iAhUuHd.exe
  2⤵
  PID:3192
- C:\Windows\System\PKDzlee.exe
  C:\Windows\System\PKDzlee.exe
  2⤵
  PID:3208
- C:\Windows\System\TpNDdUC.exe
  C:\Windows\System\TpNDdUC.exe
  2⤵
  PID:3228
- C:\Windows\System\VzHXlBd.exe
  C:\Windows\System\VzHXlBd.exe
  2⤵
  PID:3244
- C:\Windows\System\slsUxEx.exe
  C:\Windows\System\slsUxEx.exe
  2⤵
  PID:3260
- C:\Windows\System\UNlDwSh.exe
  C:\Windows\System\UNlDwSh.exe
  2⤵
  PID:3276
- C:\Windows\System\ByAkLOr.exe
  C:\Windows\System\ByAkLOr.exe
  2⤵
  PID:3352
- C:\Windows\System\jkJWyJk.exe
  C:\Windows\System\jkJWyJk.exe
  2⤵
  PID:3368
- C:\Windows\System\cmXEmRH.exe
  C:\Windows\System\cmXEmRH.exe
  2⤵
  PID:3392
- C:\Windows\System\DJquiYn.exe
  C:\Windows\System\DJquiYn.exe
  2⤵
  PID:3520
- C:\Windows\System\ljClniw.exe
  C:\Windows\System\ljClniw.exe
  2⤵
  PID:3540
- C:\Windows\System\aZlUFOE.exe
  C:\Windows\System\aZlUFOE.exe
  2⤵
  PID:3560
- C:\Windows\System\qNrNFTf.exe
  C:\Windows\System\qNrNFTf.exe
  2⤵
  PID:3580
- C:\Windows\System\bqPMOCj.exe
  C:\Windows\System\bqPMOCj.exe
  2⤵
  PID:3600
- C:\Windows\System\kQqNOqY.exe
  C:\Windows\System\kQqNOqY.exe
  2⤵
  PID:3620
- C:\Windows\System\lDFQoAt.exe
  C:\Windows\System\lDFQoAt.exe
  2⤵
  PID:3640
- C:\Windows\System\SbnlYEr.exe
  C:\Windows\System\SbnlYEr.exe
  2⤵
  PID:3660
- C:\Windows\System\tzqlxlw.exe
  C:\Windows\System\tzqlxlw.exe
  2⤵
  PID:3680
- C:\Windows\System\TVgtzmx.exe
  C:\Windows\System\TVgtzmx.exe
  2⤵
  PID:3700
- C:\Windows\System\YXVXbrC.exe
  C:\Windows\System\YXVXbrC.exe
  2⤵
  PID:3720
- C:\Windows\System\OhxpVbo.exe
  C:\Windows\System\OhxpVbo.exe
  2⤵
  PID:3740
- C:\Windows\System\uOtZYVg.exe
  C:\Windows\System\uOtZYVg.exe
  2⤵
  PID:3760
- C:\Windows\System\evWCAbM.exe
  C:\Windows\System\evWCAbM.exe
  2⤵
  PID:3780
- C:\Windows\System\khfvQVa.exe
  C:\Windows\System\khfvQVa.exe
  2⤵
  PID:3800
- C:\Windows\System\KYqRZCm.exe
  C:\Windows\System\KYqRZCm.exe
  2⤵
  PID:3820
- C:\Windows\System\bkWWLhy.exe
  C:\Windows\System\bkWWLhy.exe
  2⤵
  PID:3840
- C:\Windows\System\mNuktbD.exe
  C:\Windows\System\mNuktbD.exe
  2⤵
  PID:3860
- C:\Windows\System\CpmFcCp.exe
  C:\Windows\System\CpmFcCp.exe
  2⤵
  PID:3880
- C:\Windows\System\cVcbKIq.exe
  C:\Windows\System\cVcbKIq.exe
  2⤵
  PID:3900
- C:\Windows\System\ahDFmdO.exe
  C:\Windows\System\ahDFmdO.exe
  2⤵
  PID:3920
- C:\Windows\System\EbelyBC.exe
  C:\Windows\System\EbelyBC.exe
  2⤵
  PID:3940
- C:\Windows\System\kncWIYF.exe
  C:\Windows\System\kncWIYF.exe
  2⤵
  PID:3960
- C:\Windows\System\hBUkhwI.exe
  C:\Windows\System\hBUkhwI.exe
  2⤵
  PID:3980
- C:\Windows\System\qcglECb.exe
  C:\Windows\System\qcglECb.exe
  2⤵
  PID:4000
- C:\Windows\System\ONaZIpx.exe
  C:\Windows\System\ONaZIpx.exe
  2⤵
  PID:4020
- C:\Windows\System\UpAqVbM.exe
  C:\Windows\System\UpAqVbM.exe
  2⤵
  PID:4040
- C:\Windows\System\XOUPtpB.exe
  C:\Windows\System\XOUPtpB.exe
  2⤵
  PID:4060
- C:\Windows\System\ebtNhgE.exe
  C:\Windows\System\ebtNhgE.exe
  2⤵
  PID:4080
- C:\Windows\System\UKlqHUB.exe
  C:\Windows\System\UKlqHUB.exe
  2⤵
  PID:1584
- C:\Windows\System\ShVLYJY.exe
  C:\Windows\System\ShVLYJY.exe
  2⤵
  PID:2444
- C:\Windows\System\nlaVMfS.exe
  C:\Windows\System\nlaVMfS.exe
  2⤵
  PID:1704
- C:\Windows\System\AQIfIOE.exe
  C:\Windows\System\AQIfIOE.exe
  2⤵
  PID:2108
- C:\Windows\System\mIhwCGk.exe
  C:\Windows\System\mIhwCGk.exe
  2⤵
  PID:3084
- C:\Windows\System\xdCauzp.exe
  C:\Windows\System\xdCauzp.exe
  2⤵
  PID:3120
- C:\Windows\System\KUhfaHD.exe
  C:\Windows\System\KUhfaHD.exe
  2⤵
  PID:3216
- C:\Windows\System\DQlgFQZ.exe
  C:\Windows\System\DQlgFQZ.exe
  2⤵
  PID:3256
- C:\Windows\System\ODVBmYP.exe
  C:\Windows\System\ODVBmYP.exe
  2⤵
  PID:3308
- C:\Windows\System\Zdpkifq.exe
  C:\Windows\System\Zdpkifq.exe
  2⤵
  PID:584
- C:\Windows\System\tNMWlLV.exe
  C:\Windows\System\tNMWlLV.exe
  2⤵
  PID:3340
- C:\Windows\System\FdQccCL.exe
  C:\Windows\System\FdQccCL.exe
  2⤵
  PID:3384
- C:\Windows\System\hezVaRh.exe
  C:\Windows\System\hezVaRh.exe
  2⤵
  PID:1936
- C:\Windows\System\WhlgMCc.exe
  C:\Windows\System\WhlgMCc.exe
  2⤵
  PID:2852
- C:\Windows\System\YZptuQc.exe
  C:\Windows\System\YZptuQc.exe
  2⤵
  PID:796
- C:\Windows\System\qXuFOVN.exe
  C:\Windows\System\qXuFOVN.exe
  2⤵
  PID:2924
- C:\Windows\System\kqfltdS.exe
  C:\Windows\System\kqfltdS.exe
  2⤵
  PID:3040
- C:\Windows\System\cWvpKiv.exe
  C:\Windows\System\cWvpKiv.exe
  2⤵
  PID:2364
- C:\Windows\System\ARbotTf.exe
  C:\Windows\System\ARbotTf.exe
  2⤵
  PID:1644
- C:\Windows\System\WMCRlVJ.exe
  C:\Windows\System\WMCRlVJ.exe
  2⤵
  PID:1612
- C:\Windows\System\ALYALKb.exe
  C:\Windows\System\ALYALKb.exe
  2⤵
  PID:3412
- C:\Windows\System\ZqxmEpV.exe
  C:\Windows\System\ZqxmEpV.exe
  2⤵
  PID:3428
- C:\Windows\System\pOHpWoc.exe
  C:\Windows\System\pOHpWoc.exe
  2⤵
  PID:3268
- C:\Windows\System\TVFcXyb.exe
  C:\Windows\System\TVFcXyb.exe
  2⤵
  PID:3200
- C:\Windows\System\WoRkoGt.exe
  C:\Windows\System\WoRkoGt.exe
  2⤵
  PID:3136
- C:\Windows\System\VSdhlWG.exe
  C:\Windows\System\VSdhlWG.exe
  2⤵
  PID:700
- C:\Windows\System\TXIRAsv.exe
  C:\Windows\System\TXIRAsv.exe
  2⤵
  PID:2692
- C:\Windows\System\nocFtjT.exe
  C:\Windows\System\nocFtjT.exe
  2⤵
  PID:1408
- C:\Windows\System\jYHLmHH.exe
  C:\Windows\System\jYHLmHH.exe
  2⤵
  PID:1928
- C:\Windows\System\GzgjRNW.exe
  C:\Windows\System\GzgjRNW.exe
  2⤵
  PID:2836
- C:\Windows\System\wICnOhw.exe
  C:\Windows\System\wICnOhw.exe
  2⤵
  PID:2624
- C:\Windows\System\ImWEsHJ.exe
  C:\Windows\System\ImWEsHJ.exe
  2⤵
  PID:2864
- C:\Windows\System\TlKnqHl.exe
  C:\Windows\System\TlKnqHl.exe
  2⤵
  PID:616
- C:\Windows\System\lgqafdy.exe
  C:\Windows\System\lgqafdy.exe
  2⤵
  PID:3464
- C:\Windows\System\UnoxgOE.exe
  C:\Windows\System\UnoxgOE.exe
  2⤵
  PID:3480
- C:\Windows\System\SblQgzH.exe
  C:\Windows\System\SblQgzH.exe
  2⤵
  PID:3496
- C:\Windows\System\hYwPQlg.exe
  C:\Windows\System\hYwPQlg.exe
  2⤵
  PID:3516
- C:\Windows\System\XbozmhU.exe
  C:\Windows\System\XbozmhU.exe
  2⤵
  PID:3532
- C:\Windows\System\DPIkgIN.exe
  C:\Windows\System\DPIkgIN.exe
  2⤵
  PID:3568
- C:\Windows\System\LaFKQFE.exe
  C:\Windows\System\LaFKQFE.exe
  2⤵
  PID:3588
- C:\Windows\System\lWVwPcA.exe
  C:\Windows\System\lWVwPcA.exe
  2⤵
  PID:3592
- C:\Windows\System\dsIvRCF.exe
  C:\Windows\System\dsIvRCF.exe
  2⤵
  PID:3648
- C:\Windows\System\VZItwPp.exe
  C:\Windows\System\VZItwPp.exe
  2⤵
  PID:3668
- C:\Windows\System\BFBTHpg.exe
  C:\Windows\System\BFBTHpg.exe
  2⤵
  PID:3672
- C:\Windows\System\SoLKuoG.exe
  C:\Windows\System\SoLKuoG.exe
  2⤵
  PID:3692
- C:\Windows\System\cqSCegU.exe
  C:\Windows\System\cqSCegU.exe
  2⤵
  PID:3716
- C:\Windows\System\OkMEnGM.exe
  C:\Windows\System\OkMEnGM.exe
  2⤵
  PID:3732
- C:\Windows\System\CYnzbeK.exe
  C:\Windows\System\CYnzbeK.exe
  2⤵
  PID:3752
- C:\Windows\System\YaBBomo.exe
  C:\Windows\System\YaBBomo.exe
  2⤵
  PID:1536
- C:\Windows\System\fzGKKVs.exe
  C:\Windows\System\fzGKKVs.exe
  2⤵
  PID:3796
- C:\Windows\System\LXVBVnm.exe
  C:\Windows\System\LXVBVnm.exe
  2⤵
  PID:3828
- C:\Windows\System\PeecDSk.exe
  C:\Windows\System\PeecDSk.exe
  2⤵
  PID:3856
- C:\Windows\System\CHRPjGt.exe
  C:\Windows\System\CHRPjGt.exe
  2⤵
  PID:3876
- C:\Windows\System\SfGnezD.exe
  C:\Windows\System\SfGnezD.exe
  2⤵
  PID:3892
- C:\Windows\System\kVtQNDp.exe
  C:\Windows\System\kVtQNDp.exe
  2⤵
  PID:3928
- C:\Windows\System\JtRDOCM.exe
  C:\Windows\System\JtRDOCM.exe
  2⤵
  PID:3968
- C:\Windows\System\CaAdcSJ.exe
  C:\Windows\System\CaAdcSJ.exe
  2⤵
  PID:3952
- C:\Windows\System\xihhmvx.exe
  C:\Windows\System\xihhmvx.exe
  2⤵
  PID:3996
- C:\Windows\System\YYLKyHD.exe
  C:\Windows\System\YYLKyHD.exe
  2⤵
  PID:4012
- C:\Windows\System\KFkCmoo.exe
  C:\Windows\System\KFkCmoo.exe
  2⤵
  PID:1872
- C:\Windows\System\yRjxJnk.exe
  C:\Windows\System\yRjxJnk.exe
  2⤵
  PID:1240
- C:\Windows\System\aYYmOnR.exe
  C:\Windows\System\aYYmOnR.exe
  2⤵
  PID:2956
- C:\Windows\System\GyzApgx.exe
  C:\Windows\System\GyzApgx.exe
  2⤵
  PID:1640
- C:\Windows\System\zDdeDbx.exe
  C:\Windows\System\zDdeDbx.exe
  2⤵
  PID:2540
- C:\Windows\System\ZGTvevN.exe
  C:\Windows\System\ZGTvevN.exe
  2⤵
  PID:2368
- C:\Windows\System\sfceuUy.exe
  C:\Windows\System\sfceuUy.exe
  2⤵
  PID:3296
- C:\Windows\System\eApkfHO.exe
  C:\Windows\System\eApkfHO.exe
  2⤵
  PID:1916
- C:\Windows\System\hnUDyTZ.exe
  C:\Windows\System\hnUDyTZ.exe
  2⤵
  PID:1800
- C:\Windows\System\HhXCSPZ.exe
  C:\Windows\System\HhXCSPZ.exe
  2⤵
  PID:1076
- C:\Windows\System\YUaeexf.exe
  C:\Windows\System\YUaeexf.exe
  2⤵
  PID:3156
- C:\Windows\System\npVYDwc.exe
  C:\Windows\System\npVYDwc.exe
  2⤵
  PID:3292
- C:\Windows\System\naFeXuh.exe
  C:\Windows\System\naFeXuh.exe
  2⤵
  PID:3316
- C:\Windows\System\fVLjhGL.exe
  C:\Windows\System\fVLjhGL.exe
  2⤵
  PID:3336
- C:\Windows\System\pGUgpGH.exe
  C:\Windows\System\pGUgpGH.exe
  2⤵
  PID:2524
- C:\Windows\System\irxvQfn.exe
  C:\Windows\System\irxvQfn.exe
  2⤵
  PID:560
- C:\Windows\System\yeuGfPP.exe
  C:\Windows\System\yeuGfPP.exe
  2⤵
  PID:3440
- C:\Windows\System\rDQdSSQ.exe
  C:\Windows\System\rDQdSSQ.exe
  2⤵
  PID:3420
- C:\Windows\System\TbdfZzK.exe
  C:\Windows\System\TbdfZzK.exe
  2⤵
  PID:1484
- C:\Windows\System\vxJxvRK.exe
  C:\Windows\System\vxJxvRK.exe
  2⤵
  PID:2244
- C:\Windows\System\rMIsbzT.exe
  C:\Windows\System\rMIsbzT.exe
  2⤵
  PID:1912
- C:\Windows\System\guauJuY.exe
  C:\Windows\System\guauJuY.exe
  2⤵
  PID:3492
- C:\Windows\System\vGXepyr.exe
  C:\Windows\System\vGXepyr.exe
  2⤵
  PID:3612
- C:\Windows\System\AljTxPK.exe
  C:\Windows\System\AljTxPK.exe
  2⤵
  PID:3736
- C:\Windows\System\zjfFMQQ.exe
  C:\Windows\System\zjfFMQQ.exe
  2⤵
  PID:3788
- C:\Windows\System\wFXczqR.exe
  C:\Windows\System\wFXczqR.exe
  2⤵
  PID:3628
- C:\Windows\System\oJiGRoo.exe
  C:\Windows\System\oJiGRoo.exe
  2⤵
  PID:3836
- C:\Windows\System\RKPNXWi.exe
  C:\Windows\System\RKPNXWi.exe
  2⤵
  PID:3912
- C:\Windows\System\ADsOILM.exe
  C:\Windows\System\ADsOILM.exe
  2⤵
  PID:4052
- C:\Windows\System\sCCYnHs.exe
  C:\Windows\System\sCCYnHs.exe
  2⤵
  PID:4088
- C:\Windows\System\gKysWmr.exe
  C:\Windows\System\gKysWmr.exe
  2⤵
  PID:2172
- C:\Windows\System\sumgrIz.exe
  C:\Windows\System\sumgrIz.exe
  2⤵
  PID:3364
- C:\Windows\System\DUmapVk.exe
  C:\Windows\System\DUmapVk.exe
  2⤵
  PID:3140
- C:\Windows\System\vqtlHpo.exe
  C:\Windows\System\vqtlHpo.exe
  2⤵
  PID:1968
- C:\Windows\System\IGnfPpT.exe
  C:\Windows\System\IGnfPpT.exe
  2⤵
  PID:2508
- C:\Windows\System\ZZiBCai.exe
  C:\Windows\System\ZZiBCai.exe
  2⤵
  PID:3476
- C:\Windows\System\miLiQbU.exe
  C:\Windows\System\miLiQbU.exe
  2⤵
  PID:3556
- C:\Windows\System\RiJCBoP.exe
  C:\Windows\System\RiJCBoP.exe
  2⤵
  PID:3632
- C:\Windows\System\esbXlLr.exe
  C:\Windows\System\esbXlLr.exe
  2⤵
  PID:3712
- C:\Windows\System\arVPsxn.exe
  C:\Windows\System\arVPsxn.exe
  2⤵
  PID:3816
- C:\Windows\System\ishaamH.exe
  C:\Windows\System\ishaamH.exe
  2⤵
  PID:1296
- C:\Windows\System\nSqmPPy.exe
  C:\Windows\System\nSqmPPy.exe
  2⤵
  PID:3992
- C:\Windows\System\APAhqpT.exe
  C:\Windows\System\APAhqpT.exe
  2⤵
  PID:2396
- C:\Windows\System\MfrVPGa.exe
  C:\Windows\System\MfrVPGa.exe
  2⤵
  PID:1280
- C:\Windows\System\SyCmuKQ.exe
  C:\Windows\System\SyCmuKQ.exe
  2⤵
  PID:3152
- C:\Windows\System\mbaSHGX.exe
  C:\Windows\System\mbaSHGX.exe
  2⤵
  PID:3320
- C:\Windows\System\jxWjGyH.exe
  C:\Windows\System\jxWjGyH.exe
  2⤵
  PID:3400
- C:\Windows\System\wHpjpwg.exe
  C:\Windows\System\wHpjpwg.exe
  2⤵
  PID:3460
- C:\Windows\System\CSpdwGo.exe
  C:\Windows\System\CSpdwGo.exe
  2⤵
  PID:772
- C:\Windows\System\ovJZWAQ.exe
  C:\Windows\System\ovJZWAQ.exe
  2⤵
  PID:4092
- C:\Windows\System\dPFMBdi.exe
  C:\Windows\System\dPFMBdi.exe
  2⤵
  PID:1360
- C:\Windows\System\IUVCzdt.exe
  C:\Windows\System\IUVCzdt.exe
  2⤵
  PID:3552
- C:\Windows\System\UdduTWh.exe
  C:\Windows\System\UdduTWh.exe
  2⤵
  PID:1728
- C:\Windows\System\CmGEbOc.exe
  C:\Windows\System\CmGEbOc.exe
  2⤵
  PID:3616
- C:\Windows\System\RRQhVDK.exe
  C:\Windows\System\RRQhVDK.exe
  2⤵
  PID:2844
- C:\Windows\System\qBnytab.exe
  C:\Windows\System\qBnytab.exe
  2⤵
  PID:2568
- C:\Windows\System\PaUtZcC.exe
  C:\Windows\System\PaUtZcC.exe
  2⤵
  PID:1532
- C:\Windows\System\oGYjRbo.exe
  C:\Windows\System\oGYjRbo.exe
  2⤵
  PID:3776
- C:\Windows\System\vzMhids.exe
  C:\Windows\System\vzMhids.exe
  2⤵
  PID:1864
- C:\Windows\System\oMYwPmb.exe
  C:\Windows\System\oMYwPmb.exe
  2⤵
  PID:1820
- C:\Windows\System\elKsAVX.exe
  C:\Windows\System\elKsAVX.exe
  2⤵
  PID:2604
- C:\Windows\System\EHvkFov.exe
  C:\Windows\System\EHvkFov.exe
  2⤵
  PID:2752
- C:\Windows\System\JSrIKQK.exe
  C:\Windows\System\JSrIKQK.exe
  2⤵
  PID:2340
- C:\Windows\System\ungpfsr.exe
  C:\Windows\System\ungpfsr.exe
  2⤵
  PID:3728
- C:\Windows\System\OkBzqZp.exe
  C:\Windows\System\OkBzqZp.exe
  2⤵
  PID:3376
- C:\Windows\System\lijNSAc.exe
  C:\Windows\System\lijNSAc.exe
  2⤵
  PID:1668
- C:\Windows\System\sFdOiwO.exe
  C:\Windows\System\sFdOiwO.exe
  2⤵
  PID:3224
- C:\Windows\System\mUTUwUW.exe
  C:\Windows\System\mUTUwUW.exe
  2⤵
  PID:3252
- C:\Windows\System\PTSsNMk.exe
  C:\Windows\System\PTSsNMk.exe
  2⤵
  PID:4112
- C:\Windows\System\pcbwzjt.exe
  C:\Windows\System\pcbwzjt.exe
  2⤵
  PID:4128
- C:\Windows\System\wmGZYVt.exe
  C:\Windows\System\wmGZYVt.exe
  2⤵
  PID:4144
- C:\Windows\System\gKgBXEj.exe
  C:\Windows\System\gKgBXEj.exe
  2⤵
  PID:4160
- C:\Windows\System\jFRpHcv.exe
  C:\Windows\System\jFRpHcv.exe
  2⤵
  PID:4180
- C:\Windows\System\ujpaXVY.exe
  C:\Windows\System\ujpaXVY.exe
  2⤵
  PID:4196
- C:\Windows\System\rhzyOOQ.exe
  C:\Windows\System\rhzyOOQ.exe
  2⤵
  PID:4212
- C:\Windows\System\NMeZfOe.exe
  C:\Windows\System\NMeZfOe.exe
  2⤵
  PID:4228
- C:\Windows\System\UgQgRCn.exe
  C:\Windows\System\UgQgRCn.exe
  2⤵
  PID:4244
- C:\Windows\System\FAapBQu.exe
  C:\Windows\System\FAapBQu.exe
  2⤵
  PID:4260
- C:\Windows\System\NLecsaS.exe
  C:\Windows\System\NLecsaS.exe
  2⤵
  PID:4280
- C:\Windows\System\KNetzqD.exe
  C:\Windows\System\KNetzqD.exe
  2⤵
  PID:4296
- C:\Windows\System\bhSjOjr.exe
  C:\Windows\System\bhSjOjr.exe
  2⤵
  PID:4312
- C:\Windows\System\BEEqniR.exe
  C:\Windows\System\BEEqniR.exe
  2⤵
  PID:4328
- C:\Windows\System\QfXBJEU.exe
  C:\Windows\System\QfXBJEU.exe
  2⤵
  PID:4344
- C:\Windows\System\nuytfbQ.exe
  C:\Windows\System\nuytfbQ.exe
  2⤵
  PID:4360
- C:\Windows\System\XCJsqzg.exe
  C:\Windows\System\XCJsqzg.exe
  2⤵
  PID:4376
- C:\Windows\System\dPYWLAC.exe
  C:\Windows\System\dPYWLAC.exe
  2⤵
  PID:4392
- C:\Windows\System\gzsIknh.exe
  C:\Windows\System\gzsIknh.exe
  2⤵
  PID:4408
- C:\Windows\System\ryseqRe.exe
  C:\Windows\System\ryseqRe.exe
  2⤵
  PID:4432
- C:\Windows\System\pkmbFgU.exe
  C:\Windows\System\pkmbFgU.exe
  2⤵
  PID:4448
- C:\Windows\System\kcGIUIl.exe
  C:\Windows\System\kcGIUIl.exe
  2⤵
  PID:4472
- C:\Windows\System\stZNFgf.exe
  C:\Windows\System\stZNFgf.exe
  2⤵
  PID:4488
- C:\Windows\System\KYoNGlM.exe
  C:\Windows\System\KYoNGlM.exe
  2⤵
  PID:4504
- C:\Windows\System\dxnQaxK.exe
  C:\Windows\System\dxnQaxK.exe
  2⤵
  PID:4520
- C:\Windows\System\vmYOasS.exe
  C:\Windows\System\vmYOasS.exe
  2⤵
  PID:4536
- C:\Windows\System\JfDEAFS.exe
  C:\Windows\System\JfDEAFS.exe
  2⤵
  PID:4552
- C:\Windows\System\LpXPvCY.exe
  C:\Windows\System\LpXPvCY.exe
  2⤵
  PID:4568
- C:\Windows\System\rheFnaN.exe
  C:\Windows\System\rheFnaN.exe
  2⤵
  PID:4584
- C:\Windows\System\pZHUUkA.exe
  C:\Windows\System\pZHUUkA.exe
  2⤵
  PID:4600
- C:\Windows\System\OmzGEOo.exe
  C:\Windows\System\OmzGEOo.exe
  2⤵
  PID:4636
- C:\Windows\System\fgPngAU.exe
  C:\Windows\System\fgPngAU.exe
  2⤵
  PID:4652
- C:\Windows\System\LqLNsZb.exe
  C:\Windows\System\LqLNsZb.exe
  2⤵
  PID:4668
- C:\Windows\System\Ulmwuqk.exe
  C:\Windows\System\Ulmwuqk.exe
  2⤵
  PID:4684
- C:\Windows\System\GYjRQqE.exe
  C:\Windows\System\GYjRQqE.exe
  2⤵
  PID:4700
- C:\Windows\System\wARrUlT.exe
  C:\Windows\System\wARrUlT.exe
  2⤵
  PID:4716
- C:\Windows\System\WageGuS.exe
  C:\Windows\System\WageGuS.exe
  2⤵
  PID:4732
- C:\Windows\System\kQsmevh.exe
  C:\Windows\System\kQsmevh.exe
  2⤵
  PID:4748
- C:\Windows\System\uSKuJoG.exe
  C:\Windows\System\uSKuJoG.exe
  2⤵
  PID:4764
- C:\Windows\System\KRbSkAP.exe
  C:\Windows\System\KRbSkAP.exe
  2⤵
  PID:4780
- C:\Windows\System\zPHLFdo.exe
  C:\Windows\System\zPHLFdo.exe
  2⤵
  PID:4796
- C:\Windows\System\EtcQttj.exe
  C:\Windows\System\EtcQttj.exe
  2⤵
  PID:4812
- C:\Windows\System\QKgYQsD.exe
  C:\Windows\System\QKgYQsD.exe
  2⤵
  PID:4828
- C:\Windows\System\shVGjzV.exe
  C:\Windows\System\shVGjzV.exe
  2⤵
  PID:4848
- C:\Windows\System\EMMdsnU.exe
  C:\Windows\System\EMMdsnU.exe
  2⤵
  PID:4864
- C:\Windows\System\diXIjXs.exe
  C:\Windows\System\diXIjXs.exe
  2⤵
  PID:4880
- C:\Windows\System\bOSWByz.exe
  C:\Windows\System\bOSWByz.exe
  2⤵
  PID:4896
- C:\Windows\System\iPonWZM.exe
  C:\Windows\System\iPonWZM.exe
  2⤵
  PID:4912
- C:\Windows\System\Abeigvf.exe
  C:\Windows\System\Abeigvf.exe
  2⤵
  PID:4932
- C:\Windows\System\ZdUVBhr.exe
  C:\Windows\System\ZdUVBhr.exe
  2⤵
  PID:4948
- C:\Windows\System\FHLGBob.exe
  C:\Windows\System\FHLGBob.exe
  2⤵
  PID:4964
- C:\Windows\System\cgNnGwW.exe
  C:\Windows\System\cgNnGwW.exe
  2⤵
  PID:4980
- C:\Windows\System\rkoputL.exe
  C:\Windows\System\rkoputL.exe
  2⤵
  PID:4996
- C:\Windows\System\MgmAAGF.exe
  C:\Windows\System\MgmAAGF.exe
  2⤵
  PID:5012
- C:\Windows\System\xdcOeOt.exe
  C:\Windows\System\xdcOeOt.exe
  2⤵
  PID:5028
- C:\Windows\System\KpwUAEd.exe
  C:\Windows\System\KpwUAEd.exe
  2⤵
  PID:5044
- C:\Windows\System\qZndGaR.exe
  C:\Windows\System\qZndGaR.exe
  2⤵
  PID:5060
- C:\Windows\System\TPoOhZZ.exe
  C:\Windows\System\TPoOhZZ.exe
  2⤵
  PID:5076
- C:\Windows\System\YHQpaQJ.exe
  C:\Windows\System\YHQpaQJ.exe
  2⤵
  PID:5092
- C:\Windows\System\jWCRxKe.exe
  C:\Windows\System\jWCRxKe.exe
  2⤵
  PID:5108
- C:\Windows\System\rJTaCzR.exe
  C:\Windows\System\rJTaCzR.exe
  2⤵
  PID:3868
- C:\Windows\System\KDPHcvK.exe
  C:\Windows\System\KDPHcvK.exe
  2⤵
  PID:2168
- C:\Windows\System\DhkchUW.exe
  C:\Windows\System\DhkchUW.exe
  2⤵
  PID:2148
- C:\Windows\System\iMRXKDt.exe
  C:\Windows\System\iMRXKDt.exe
  2⤵
  PID:2164
- C:\Windows\System\BMaoQjJ.exe
  C:\Windows\System\BMaoQjJ.exe
  2⤵
  PID:3204
- C:\Windows\System\LAlboiB.exe
  C:\Windows\System\LAlboiB.exe
  2⤵
  PID:656
- C:\Windows\System\jMRCPgi.exe
  C:\Windows\System\jMRCPgi.exe
  2⤵
  PID:1788
- C:\Windows\System\BpKvrMu.exe
  C:\Windows\System\BpKvrMu.exe
  2⤵
  PID:4124
- C:\Windows\System\aIoAiKo.exe
  C:\Windows\System\aIoAiKo.exe
  2⤵
  PID:3948
- C:\Windows\System\NMyaMqA.exe
  C:\Windows\System\NMyaMqA.exe
  2⤵
  PID:4104
- C:\Windows\System\vhOQAgw.exe
  C:\Windows\System\vhOQAgw.exe
  2⤵
  PID:4168
- C:\Windows\System\ENpZRsu.exe
  C:\Windows\System\ENpZRsu.exe
  2⤵
  PID:3388
- C:\Windows\System\pGnvAHX.exe
  C:\Windows\System\pGnvAHX.exe
  2⤵
  PID:4220
- C:\Windows\System\TmACNzh.exe
  C:\Windows\System\TmACNzh.exe
  2⤵
  PID:4288
- C:\Windows\System\PMMqBBT.exe
  C:\Windows\System\PMMqBBT.exe
  2⤵
  PID:4352
- C:\Windows\System\MTShbqx.exe
  C:\Windows\System\MTShbqx.exe
  2⤵
  PID:3044
- C:\Windows\System\NzPXOwG.exe
  C:\Windows\System\NzPXOwG.exe
  2⤵
  PID:4308
- C:\Windows\System\ZNHvwDs.exe
  C:\Windows\System\ZNHvwDs.exe
  2⤵
  PID:4428
- C:\Windows\System\yVaqjmN.exe
  C:\Windows\System\yVaqjmN.exe
  2⤵
  PID:4400
- C:\Windows\System\TahrxQq.exe
  C:\Windows\System\TahrxQq.exe
  2⤵
  PID:4440
- C:\Windows\System\RnWxlKS.exe
  C:\Windows\System\RnWxlKS.exe
  2⤵
  PID:4236
- C:\Windows\System\LfDFwGb.exe
  C:\Windows\System\LfDFwGb.exe
  2⤵
  PID:4484
- C:\Windows\System\EvofgSU.exe
  C:\Windows\System\EvofgSU.exe
  2⤵
  PID:4544
- C:\Windows\System\AfoWnCb.exe
  C:\Windows\System\AfoWnCb.exe
  2⤵
  PID:4576
- C:\Windows\System\EjqZtLH.exe
  C:\Windows\System\EjqZtLH.exe
  2⤵
  PID:4460
- C:\Windows\System\ibUyNdn.exe
  C:\Windows\System\ibUyNdn.exe
  2⤵
  PID:4528
- C:\Windows\System\EIdjsjx.exe
  C:\Windows\System\EIdjsjx.exe
  2⤵
  PID:4616
- C:\Windows\System\zTHAgIi.exe
  C:\Windows\System\zTHAgIi.exe
  2⤵
  PID:1132
- C:\Windows\System\wAeQAdy.exe
  C:\Windows\System\wAeQAdy.exe
  2⤵
  PID:4660
- C:\Windows\System\upLMLGk.exe
  C:\Windows\System\upLMLGk.exe
  2⤵
  PID:4728
- C:\Windows\System\NvUtPVa.exe
  C:\Windows\System\NvUtPVa.exe
  2⤵
  PID:4788
- C:\Windows\System\BgYcHyz.exe
  C:\Windows\System\BgYcHyz.exe
  2⤵
  PID:4708
- C:\Windows\System\IhkIjUt.exe
  C:\Windows\System\IhkIjUt.exe
  2⤵
  PID:4892
- C:\Windows\System\lMZkyWZ.exe
  C:\Windows\System\lMZkyWZ.exe
  2⤵
  PID:4960
- C:\Windows\System\hZhsMiY.exe
  C:\Windows\System\hZhsMiY.exe
  2⤵
  PID:4676
- C:\Windows\System\GJlDJaJ.exe
  C:\Windows\System\GJlDJaJ.exe
  2⤵
  PID:4744
- C:\Windows\System\Lrvpxtd.exe
  C:\Windows\System\Lrvpxtd.exe
  2⤵
  PID:4804
- C:\Windows\System\sCsNpgG.exe
  C:\Windows\System\sCsNpgG.exe
  2⤵
  PID:5020
- C:\Windows\System\AljFTAs.exe
  C:\Windows\System\AljFTAs.exe
  2⤵
  PID:5088
- C:\Windows\System\QlZvMYV.exe
  C:\Windows\System\QlZvMYV.exe
  2⤵
  PID:4076
- C:\Windows\System\PbseohN.exe
  C:\Windows\System\PbseohN.exe
  2⤵
  PID:4156
- C:\Windows\System\gJZvZYW.exe
  C:\Windows\System\gJZvZYW.exe
  2⤵
  PID:4140
- C:\Windows\System\ECGeGwE.exe
  C:\Windows\System\ECGeGwE.exe
  2⤵
  PID:4876
- C:\Windows\System\llgtHeM.exe
  C:\Windows\System\llgtHeM.exe
  2⤵
  PID:4944
- C:\Windows\System\WrzVwGP.exe
  C:\Windows\System\WrzVwGP.exe
  2⤵
  PID:5040
- C:\Windows\System\iCElBnl.exe
  C:\Windows\System\iCElBnl.exe
  2⤵
  PID:5104
- C:\Windows\System\rcCaKwB.exe
  C:\Windows\System\rcCaKwB.exe
  2⤵
  PID:4048
- C:\Windows\System\wvlyRRj.exe
  C:\Windows\System\wvlyRRj.exe
  2⤵
  PID:3168
- C:\Windows\System\eVMVCHj.exe
  C:\Windows\System\eVMVCHj.exe
  2⤵
  PID:1268
- C:\Windows\System\clggRDZ.exe
  C:\Windows\System\clggRDZ.exe
  2⤵
  PID:596
- C:\Windows\System\hbIfZAd.exe
  C:\Windows\System\hbIfZAd.exe
  2⤵
  PID:4256
- C:\Windows\System\IwYDgtU.exe
  C:\Windows\System\IwYDgtU.exe
  2⤵
  PID:4388
- C:\Windows\System\EcCjVny.exe
  C:\Windows\System\EcCjVny.exe
  2⤵
  PID:2412
- C:\Windows\System\lawGBZG.exe
  C:\Windows\System\lawGBZG.exe
  2⤵
  PID:4368
- C:\Windows\System\AiskFmB.exe
  C:\Windows\System\AiskFmB.exe
  2⤵
  PID:2152
- C:\Windows\System\oDnqwDa.exe
  C:\Windows\System\oDnqwDa.exe
  2⤵
  PID:4240
- C:\Windows\System\ksBkNjr.exe
  C:\Windows\System\ksBkNjr.exe
  2⤵
  PID:4560
- C:\Windows\System\YzMmcAH.exe
  C:\Windows\System\YzMmcAH.exe
  2⤵
  PID:324
- C:\Windows\System\YRJeHop.exe
  C:\Windows\System\YRJeHop.exe
  2⤵
  PID:592
- C:\Windows\System\wgmGrXz.exe
  C:\Windows\System\wgmGrXz.exe
  2⤵
  PID:4500
- C:\Windows\System\gRbfYmw.exe
  C:\Windows\System\gRbfYmw.exe
  2⤵
  PID:4724
- C:\Windows\System\TcuAnHH.exe
  C:\Windows\System\TcuAnHH.exe
  2⤵
  PID:4612
- C:\Windows\System\BXMaSZW.exe
  C:\Windows\System\BXMaSZW.exe
  2⤵
  PID:4928
- C:\Windows\System\eZvXMzF.exe
  C:\Windows\System\eZvXMzF.exe
  2⤵
  PID:4844
- C:\Windows\System\EIohkdV.exe
  C:\Windows\System\EIohkdV.exe
  2⤵
  PID:4908
- C:\Windows\System\OMOxbTq.exe
  C:\Windows\System\OMOxbTq.exe
  2⤵
  PID:3528
- C:\Windows\System\SKFdewa.exe
  C:\Windows\System\SKFdewa.exe
  2⤵
  PID:4320
- C:\Windows\System\KfQtyDR.exe
  C:\Windows\System\KfQtyDR.exe
  2⤵
  PID:4924
- C:\Windows\System\WERhsYT.exe
  C:\Windows\System\WERhsYT.exe
  2⤵
  PID:5052
- C:\Windows\System\VHkGmaE.exe
  C:\Windows\System\VHkGmaE.exe
  2⤵
  PID:5008
- C:\Windows\System\FrbUHNU.exe
  C:\Windows\System\FrbUHNU.exe
  2⤵
  PID:4056
- C:\Windows\System\QEAPAyT.exe
  C:\Windows\System\QEAPAyT.exe
  2⤵
  PID:4036
- C:\Windows\System\NetRATE.exe
  C:\Windows\System\NetRATE.exe
  2⤵
  PID:4204
- C:\Windows\System\GCfwWha.exe
  C:\Windows\System\GCfwWha.exe
  2⤵
  PID:4268
- C:\Windows\System\QKHioNt.exe
  C:\Windows\System\QKHioNt.exe
  2⤵
  PID:2416
- C:\Windows\System\bEZFmeX.exe
  C:\Windows\System\bEZFmeX.exe
  2⤵
  PID:4856
- C:\Windows\System\oJxckAg.exe
  C:\Windows\System\oJxckAg.exe
  2⤵
  PID:5116
- C:\Windows\System\aiCWvNQ.exe
  C:\Windows\System\aiCWvNQ.exe
  2⤵
  PID:4516
- C:\Windows\System\glqdduN.exe
  C:\Windows\System\glqdduN.exe
  2⤵
  PID:4820
- C:\Windows\System\dtWKcwI.exe
  C:\Windows\System\dtWKcwI.exe
  2⤵
  PID:4740
- C:\Windows\System\wGSLuxZ.exe
  C:\Windows\System\wGSLuxZ.exe
  2⤵
  PID:2792
- C:\Windows\System\LaauhOo.exe
  C:\Windows\System\LaauhOo.exe
  2⤵
  PID:4976
- C:\Windows\System\oFEvfLi.exe
  C:\Windows\System\oFEvfLi.exe
  2⤵
  PID:3872
- C:\Windows\System\gwCdeWv.exe
  C:\Windows\System\gwCdeWv.exe
  2⤵
  PID:4776
- C:\Windows\System\NZzCEKu.exe
  C:\Windows\System\NZzCEKu.exe
  2⤵
  PID:4340
- C:\Windows\System\NhsAcEo.exe
  C:\Windows\System\NhsAcEo.exe
  2⤵
  PID:3768
- C:\Windows\System\uIUzdUF.exe
  C:\Windows\System\uIUzdUF.exe
  2⤵
  PID:5132
- C:\Windows\System\ooAQZsO.exe
  C:\Windows\System\ooAQZsO.exe
  2⤵
  PID:5148
- C:\Windows\System\sMpucPl.exe
  C:\Windows\System\sMpucPl.exe
  2⤵
  PID:5164
- C:\Windows\System\OaqdrzO.exe
  C:\Windows\System\OaqdrzO.exe
  2⤵
  PID:5180
- C:\Windows\System\NavphHH.exe
  C:\Windows\System\NavphHH.exe
  2⤵
  PID:5196
- C:\Windows\System\GJwKAbI.exe
  C:\Windows\System\GJwKAbI.exe
  2⤵
  PID:5212
- C:\Windows\System\WWoFPgo.exe
  C:\Windows\System\WWoFPgo.exe
  2⤵
  PID:5228
- C:\Windows\System\WRkFekW.exe
  C:\Windows\System\WRkFekW.exe
  2⤵
  PID:5244
- C:\Windows\System\zPNrqov.exe
  C:\Windows\System\zPNrqov.exe
  2⤵
  PID:5260
- C:\Windows\System\xnNuwjE.exe
  C:\Windows\System\xnNuwjE.exe
  2⤵
  PID:5276
- C:\Windows\System\OkXeiaJ.exe
  C:\Windows\System\OkXeiaJ.exe
  2⤵
  PID:5292
- C:\Windows\System\ErKKFuj.exe
  C:\Windows\System\ErKKFuj.exe
  2⤵
  PID:5308
- C:\Windows\System\lBsRejk.exe
  C:\Windows\System\lBsRejk.exe
  2⤵
  PID:5324
- C:\Windows\System\plePYLX.exe
  C:\Windows\System\plePYLX.exe
  2⤵
  PID:5340
- C:\Windows\System\dAeGvDk.exe
  C:\Windows\System\dAeGvDk.exe
  2⤵
  PID:5356
- C:\Windows\System\xOVFvaO.exe
  C:\Windows\System\xOVFvaO.exe
  2⤵
  PID:5372
- C:\Windows\System\RVPlXdh.exe
  C:\Windows\System\RVPlXdh.exe
  2⤵
  PID:5388
- C:\Windows\System\iedZVhF.exe
  C:\Windows\System\iedZVhF.exe
  2⤵
  PID:5404
- C:\Windows\System\BFNAOJL.exe
  C:\Windows\System\BFNAOJL.exe
  2⤵
  PID:5420
- C:\Windows\System\mbhhdEx.exe
  C:\Windows\System\mbhhdEx.exe
  2⤵
  PID:5436
- C:\Windows\System\zlMtCEC.exe
  C:\Windows\System\zlMtCEC.exe
  2⤵
  PID:5452
- C:\Windows\System\grjkFUU.exe
  C:\Windows\System\grjkFUU.exe
  2⤵
  PID:5468
- C:\Windows\System\FTLkMFn.exe
  C:\Windows\System\FTLkMFn.exe
  2⤵
  PID:5484
- C:\Windows\System\uRSIRGw.exe
  C:\Windows\System\uRSIRGw.exe
  2⤵
  PID:5500
- C:\Windows\System\tdXWFuw.exe
  C:\Windows\System\tdXWFuw.exe
  2⤵
  PID:5516
- C:\Windows\System\qBJHEcT.exe
  C:\Windows\System\qBJHEcT.exe
  2⤵
  PID:5532
- C:\Windows\System\ZDhEbUd.exe
  C:\Windows\System\ZDhEbUd.exe
  2⤵
  PID:5548
- C:\Windows\System\OoxuvFs.exe
  C:\Windows\System\OoxuvFs.exe
  2⤵
  PID:5564
- C:\Windows\System\oiwLPtJ.exe
  C:\Windows\System\oiwLPtJ.exe
  2⤵
  PID:5580
- C:\Windows\System\PnZicxX.exe
  C:\Windows\System\PnZicxX.exe
  2⤵
  PID:5596
- C:\Windows\System\NWvyPQG.exe
  C:\Windows\System\NWvyPQG.exe
  2⤵
  PID:5624
- C:\Windows\System\yBCiUhp.exe
  C:\Windows\System\yBCiUhp.exe
  2⤵
  PID:5640
- C:\Windows\System\qNGiyzY.exe
  C:\Windows\System\qNGiyzY.exe
  2⤵
  PID:5656
- C:\Windows\System\gyZKSBY.exe
  C:\Windows\System\gyZKSBY.exe
  2⤵
  PID:5672
- C:\Windows\System\qKcrnYo.exe
  C:\Windows\System\qKcrnYo.exe
  2⤵
  PID:5688
- C:\Windows\System\pSaukLr.exe
  C:\Windows\System\pSaukLr.exe
  2⤵
  PID:5748
- C:\Windows\System\LTIlsaJ.exe
  C:\Windows\System\LTIlsaJ.exe
  2⤵
  PID:5768
- C:\Windows\System\uxaERSI.exe
  C:\Windows\System\uxaERSI.exe
  2⤵
  PID:5784
- C:\Windows\System\BWjyggM.exe
  C:\Windows\System\BWjyggM.exe
  2⤵
  PID:5800
- C:\Windows\System\zPakMot.exe
  C:\Windows\System\zPakMot.exe
  2⤵
  PID:5816
- C:\Windows\System\wbFtQVp.exe
  C:\Windows\System\wbFtQVp.exe
  2⤵
  PID:5832
- C:\Windows\System\MMYlTWb.exe
  C:\Windows\System\MMYlTWb.exe
  2⤵
  PID:5848
- C:\Windows\System\OBWKork.exe
  C:\Windows\System\OBWKork.exe
  2⤵
  PID:5864
- C:\Windows\System\UeJdWyI.exe
  C:\Windows\System\UeJdWyI.exe
  2⤵
  PID:5880
- C:\Windows\System\uaHaNtC.exe
  C:\Windows\System\uaHaNtC.exe
  2⤵
  PID:5900
- C:\Windows\System\Yvpedjn.exe
  C:\Windows\System\Yvpedjn.exe
  2⤵
  PID:5920
- C:\Windows\System\FNFycLf.exe
  C:\Windows\System\FNFycLf.exe
  2⤵
  PID:5936
- C:\Windows\System\brhnoSq.exe
  C:\Windows\System\brhnoSq.exe
  2⤵
  PID:5952
- C:\Windows\System\FZkTngc.exe
  C:\Windows\System\FZkTngc.exe
  2⤵
  PID:5968
- C:\Windows\System\SzNnVSq.exe
  C:\Windows\System\SzNnVSq.exe
  2⤵
  PID:5984
- C:\Windows\System\hBshxRV.exe
  C:\Windows\System\hBshxRV.exe
  2⤵
  PID:6004
- C:\Windows\System\Zooqcmx.exe
  C:\Windows\System\Zooqcmx.exe
  2⤵
  PID:6020
- C:\Windows\System\tetPTfg.exe
  C:\Windows\System\tetPTfg.exe
  2⤵
  PID:6040
- C:\Windows\System\iSzTtwr.exe
  C:\Windows\System\iSzTtwr.exe
  2⤵
  PID:6056
- C:\Windows\System\lXvSlab.exe
  C:\Windows\System\lXvSlab.exe
  2⤵
  PID:6072
- C:\Windows\System\tQnaLMq.exe
  C:\Windows\System\tQnaLMq.exe
  2⤵
  PID:6088
- C:\Windows\System\bzztTOx.exe
  C:\Windows\System\bzztTOx.exe
  2⤵
  PID:6104
- C:\Windows\System\YMufZhR.exe
  C:\Windows\System\YMufZhR.exe
  2⤵
  PID:6120
- C:\Windows\System\fAKtQGz.exe
  C:\Windows\System\fAKtQGz.exe
  2⤵
  PID:6136
- C:\Windows\System\IzhKMAS.exe
  C:\Windows\System\IzhKMAS.exe
  2⤵
  PID:3572
- C:\Windows\System\HHWyDtn.exe
  C:\Windows\System\HHWyDtn.exe
  2⤵
  PID:5176
- C:\Windows\System\ecRSSYk.exe
  C:\Windows\System\ecRSSYk.exe
  2⤵
  PID:5240
- C:\Windows\System\sHbeBZr.exe
  C:\Windows\System\sHbeBZr.exe
  2⤵
  PID:5072
- C:\Windows\System\IZCtuyt.exe
  C:\Windows\System\IZCtuyt.exe
  2⤵
  PID:4760
- C:\Windows\System\HELJuEj.exe
  C:\Windows\System\HELJuEj.exe
  2⤵
  PID:5036
- C:\Windows\System\TNrqAVP.exe
  C:\Windows\System\TNrqAVP.exe
  2⤵
  PID:5128
- C:\Windows\System\cXwOlfH.exe
  C:\Windows\System\cXwOlfH.exe
  2⤵
  PID:5192
- C:\Windows\System\dholuYX.exe
  C:\Windows\System\dholuYX.exe
  2⤵
  PID:5256
- C:\Windows\System\Wtjlhzx.exe
  C:\Windows\System\Wtjlhzx.exe
  2⤵
  PID:5320
- C:\Windows\System\txTrzWx.exe
  C:\Windows\System\txTrzWx.exe
  2⤵
  PID:5384
- C:\Windows\System\uRePrZf.exe
  C:\Windows\System\uRePrZf.exe
  2⤵
  PID:5444
- C:\Windows\System\XQXJwNX.exe
  C:\Windows\System\XQXJwNX.exe
  2⤵
  PID:5332
- C:\Windows\System\EotHNUX.exe
  C:\Windows\System\EotHNUX.exe
  2⤵
  PID:5396
- C:\Windows\System\VOidlgC.exe
  C:\Windows\System\VOidlgC.exe
  2⤵
  PID:5464
- C:\Windows\System\tcEQUEQ.exe
  C:\Windows\System\tcEQUEQ.exe
  2⤵
  PID:5528
- C:\Windows\System\KfvQJYc.exe
  C:\Windows\System\KfvQJYc.exe
  2⤵
  PID:5592
- C:\Windows\System\BwyxLLA.exe
  C:\Windows\System\BwyxLLA.exe
  2⤵
  PID:5604
- C:\Windows\System\AeHCjJv.exe
  C:\Windows\System\AeHCjJv.exe
  2⤵
  PID:5476
- C:\Windows\System\KghJWfZ.exe
  C:\Windows\System\KghJWfZ.exe
  2⤵
  PID:5636
- C:\Windows\System\KLykUcz.exe
  C:\Windows\System\KLykUcz.exe
  2⤵
  PID:5696
- C:\Windows\System\hmCnTbE.exe
  C:\Windows\System\hmCnTbE.exe
  2⤵
  PID:2252
- C:\Windows\System\bjQUnkO.exe
  C:\Windows\System\bjQUnkO.exe
  2⤵
  PID:5740
- C:\Windows\System\zGsmSdZ.exe
  C:\Windows\System\zGsmSdZ.exe
  2⤵
  PID:5764
- C:\Windows\System\zRWMCyV.exe
  C:\Windows\System\zRWMCyV.exe
  2⤵
  PID:5828
- C:\Windows\System\eKzLdgQ.exe
  C:\Windows\System\eKzLdgQ.exe
  2⤵
  PID:5720
- C:\Windows\System\UAwyOaw.exe
  C:\Windows\System\UAwyOaw.exe
  2⤵
  PID:5776
- C:\Windows\System\KITUFOt.exe
  C:\Windows\System\KITUFOt.exe
  2⤵
  PID:3104
- C:\Windows\System\NqhXCRO.exe
  C:\Windows\System\NqhXCRO.exe
  2⤵
  PID:5908
- C:\Windows\System\izISlup.exe
  C:\Windows\System\izISlup.exe
  2⤵
  PID:5964
- C:\Windows\System\ncBKcOt.exe
  C:\Windows\System\ncBKcOt.exe
  2⤵
  PID:6000
- C:\Windows\System\BUsGKRn.exe
  C:\Windows\System\BUsGKRn.exe
  2⤵
  PID:5976
- C:\Windows\System\iTWQZeh.exe
  C:\Windows\System\iTWQZeh.exe
  2⤵
  PID:5948
- C:\Windows\System\jweBPTm.exe
  C:\Windows\System\jweBPTm.exe
  2⤵
  PID:6096
- C:\Windows\System\HwltXZW.exe
  C:\Windows\System\HwltXZW.exe
  2⤵
  PID:6128
- C:\Windows\System\qEHmCIo.exe
  C:\Windows\System\qEHmCIo.exe
  2⤵
  PID:5172
- C:\Windows\System\fqdFxFf.exe
  C:\Windows\System\fqdFxFf.exe
  2⤵
  PID:6080
- C:\Windows\System\WXnmcix.exe
  C:\Windows\System\WXnmcix.exe
  2⤵
  PID:5004
- C:\Windows\System\NpGcBoE.exe
  C:\Windows\System\NpGcBoE.exe
  2⤵
  PID:5236
- C:\Windows\System\sydNzOc.exe
  C:\Windows\System\sydNzOc.exe
  2⤵
  PID:5316
- C:\Windows\System\mtTuxll.exe
  C:\Windows\System\mtTuxll.exe
  2⤵
  PID:5352
- C:\Windows\System\LnYrbkd.exe
  C:\Windows\System\LnYrbkd.exe
  2⤵
  PID:5380
- C:\Windows\System\pUTQxuB.exe
  C:\Windows\System\pUTQxuB.exe
  2⤵
  PID:5508
- C:\Windows\System\VXTDgby.exe
  C:\Windows\System\VXTDgby.exe
  2⤵
  PID:5588
- C:\Windows\System\IJcooea.exe
  C:\Windows\System\IJcooea.exe
  2⤵
  PID:5304
- C:\Windows\System\zotpmfh.exe
  C:\Windows\System\zotpmfh.exe
  2⤵
  PID:5544
- C:\Windows\System\wAklzfa.exe
  C:\Windows\System\wAklzfa.exe
  2⤵
  PID:5684
- C:\Windows\System\VcNLTRz.exe
  C:\Windows\System\VcNLTRz.exe
  2⤵
  PID:5888
- C:\Windows\System\tfbeOYz.exe
  C:\Windows\System\tfbeOYz.exe
  2⤵
  PID:6068
- C:\Windows\System\WQfeLmF.exe
  C:\Windows\System\WQfeLmF.exe
  2⤵
  PID:6116
- C:\Windows\System\eSMSiTK.exe
  C:\Windows\System\eSMSiTK.exe
  2⤵
  PID:5932
- C:\Windows\System\oKbxgEh.exe
  C:\Windows\System\oKbxgEh.exe
  2⤵
  PID:5252
- C:\Windows\System\bWMAYac.exe
  C:\Windows\System\bWMAYac.exe
  2⤵
  PID:5632
- C:\Windows\System\McxUflJ.exe
  C:\Windows\System\McxUflJ.exe
  2⤵
  PID:5860
- C:\Windows\System\iCGkHcq.exe
  C:\Windows\System\iCGkHcq.exe
  2⤵
  PID:6160
- C:\Windows\System\WjgQkrA.exe
  C:\Windows\System\WjgQkrA.exe
  2⤵
  PID:6176
- C:\Windows\System\vysmLFG.exe
  C:\Windows\System\vysmLFG.exe
  2⤵
  PID:6196
- C:\Windows\System\DMFyhdg.exe
  C:\Windows\System\DMFyhdg.exe
  2⤵
  PID:6212
- C:\Windows\System\juXkvub.exe
  C:\Windows\System\juXkvub.exe
  2⤵
  PID:6228
- C:\Windows\System\WGMwmeA.exe
  C:\Windows\System\WGMwmeA.exe
  2⤵
  PID:6244
- C:\Windows\System\RYxwGfw.exe
  C:\Windows\System\RYxwGfw.exe
  2⤵
  PID:6260
- C:\Windows\System\lgEqVPT.exe
  C:\Windows\System\lgEqVPT.exe
  2⤵
  PID:6280
- C:\Windows\System\eKFSjAD.exe
  C:\Windows\System\eKFSjAD.exe
  2⤵
  PID:6300
- C:\Windows\System\rQoLdvd.exe
  C:\Windows\System\rQoLdvd.exe
  2⤵
  PID:6316
- C:\Windows\System\oYYUDgF.exe
  C:\Windows\System\oYYUDgF.exe
  2⤵
  PID:6332
- C:\Windows\System\LXfBYDD.exe
  C:\Windows\System\LXfBYDD.exe
  2⤵
  PID:6348
- C:\Windows\System\oyRakKo.exe
  C:\Windows\System\oyRakKo.exe
  2⤵
  PID:6364
- C:\Windows\System\iJfGyaq.exe
  C:\Windows\System\iJfGyaq.exe
  2⤵
  PID:6380
- C:\Windows\System\jzyKrgN.exe
  C:\Windows\System\jzyKrgN.exe
  2⤵
  PID:6396
- C:\Windows\System\OtOrYhz.exe
  C:\Windows\System\OtOrYhz.exe
  2⤵
  PID:6412
- C:\Windows\System\ciiGrPp.exe
  C:\Windows\System\ciiGrPp.exe
  2⤵
  PID:6428
- C:\Windows\System\YQyWBbJ.exe
  C:\Windows\System\YQyWBbJ.exe
  2⤵
  PID:6444
- C:\Windows\System\voVeVqd.exe
  C:\Windows\System\voVeVqd.exe
  2⤵
  PID:6464
- C:\Windows\System\wqspfXT.exe
  C:\Windows\System\wqspfXT.exe
  2⤵
  PID:6480
- C:\Windows\System\orrThVp.exe
  C:\Windows\System\orrThVp.exe
  2⤵
  PID:6496
- C:\Windows\System\FHbOzUo.exe
  C:\Windows\System\FHbOzUo.exe
  2⤵
  PID:6512
- C:\Windows\System\gcfMdPM.exe
  C:\Windows\System\gcfMdPM.exe
  2⤵
  PID:6528
- C:\Windows\System\UEcXtPU.exe
  C:\Windows\System\UEcXtPU.exe
  2⤵
  PID:6544
- C:\Windows\System\CSOBnWq.exe
  C:\Windows\System\CSOBnWq.exe
  2⤵
  PID:6560
- C:\Windows\System\wCugtGH.exe
  C:\Windows\System\wCugtGH.exe
  2⤵
  PID:6580
- C:\Windows\System\KqTzJwx.exe
  C:\Windows\System\KqTzJwx.exe
  2⤵
  PID:6596
- C:\Windows\System\ChoAPYP.exe
  C:\Windows\System\ChoAPYP.exe
  2⤵
  PID:6612
- C:\Windows\System\cWvLTbc.exe
  C:\Windows\System\cWvLTbc.exe
  2⤵
  PID:6628
- C:\Windows\System\KBQgxmv.exe
  C:\Windows\System\KBQgxmv.exe
  2⤵
  PID:6644
- C:\Windows\System\PbKXsuv.exe
  C:\Windows\System\PbKXsuv.exe
  2⤵
  PID:6660
- C:\Windows\System\zPVycPs.exe
  C:\Windows\System\zPVycPs.exe
  2⤵
  PID:6676
- C:\Windows\System\PkHIimt.exe
  C:\Windows\System\PkHIimt.exe
  2⤵
  PID:6696
- C:\Windows\System\KZJHUhT.exe
  C:\Windows\System\KZJHUhT.exe
  2⤵
  PID:6712
- C:\Windows\System\ajiwMfb.exe
  C:\Windows\System\ajiwMfb.exe
  2⤵
  PID:6728
- C:\Windows\System\zlrtWsJ.exe
  C:\Windows\System\zlrtWsJ.exe
  2⤵
  PID:6744
- C:\Windows\System\dffPFkY.exe
  C:\Windows\System\dffPFkY.exe
  2⤵
  PID:6760
- C:\Windows\System\JpzeyGY.exe
  C:\Windows\System\JpzeyGY.exe
  2⤵
  PID:6776
- C:\Windows\System\iqyBjrs.exe
  C:\Windows\System\iqyBjrs.exe
  2⤵
  PID:6792
- C:\Windows\System\pIxcCMD.exe
  C:\Windows\System\pIxcCMD.exe
  2⤵
  PID:6808
- C:\Windows\System\OekZsuY.exe
  C:\Windows\System\OekZsuY.exe
  2⤵
  PID:6828
- C:\Windows\System\tfhbADx.exe
  C:\Windows\System\tfhbADx.exe
  2⤵
  PID:6844
- C:\Windows\System\BXmYwdb.exe
  C:\Windows\System\BXmYwdb.exe
  2⤵
  PID:6860
- C:\Windows\System\DjRIGpu.exe
  C:\Windows\System\DjRIGpu.exe
  2⤵
  PID:6876
- C:\Windows\System\IryXQZs.exe
  C:\Windows\System\IryXQZs.exe
  2⤵
  PID:6892
- C:\Windows\System\BGWixao.exe
  C:\Windows\System\BGWixao.exe
  2⤵
  PID:6908
- C:\Windows\System\ZBevmNt.exe
  C:\Windows\System\ZBevmNt.exe
  2⤵
  PID:6924
- C:\Windows\System\JeQQGTg.exe
  C:\Windows\System\JeQQGTg.exe
  2⤵
  PID:6940
- C:\Windows\System\aoXSlaJ.exe
  C:\Windows\System\aoXSlaJ.exe
  2⤵
  PID:6956
- C:\Windows\System\MFDJvQn.exe
  C:\Windows\System\MFDJvQn.exe
  2⤵
  PID:6972
- C:\Windows\System\NUAIzNI.exe
  C:\Windows\System\NUAIzNI.exe
  2⤵
  PID:6988
- C:\Windows\System\nKrMJWA.exe
  C:\Windows\System\nKrMJWA.exe
  2⤵
  PID:7008
- C:\Windows\System\VxScgJS.exe
  C:\Windows\System\VxScgJS.exe
  2⤵
  PID:7024
- C:\Windows\System\TLSVYVC.exe
  C:\Windows\System\TLSVYVC.exe
  2⤵
  PID:7040
- C:\Windows\System\mVHnegG.exe
  C:\Windows\System\mVHnegG.exe
  2⤵
  PID:7056
- C:\Windows\System\wBIWIDr.exe
  C:\Windows\System\wBIWIDr.exe
  2⤵
  PID:7072
- C:\Windows\System\zzkaHba.exe
  C:\Windows\System\zzkaHba.exe
  2⤵
  PID:7088
- C:\Windows\System\giWvVzm.exe
  C:\Windows\System\giWvVzm.exe
  2⤵
  PID:7104
- C:\Windows\System\Nchsqns.exe
  C:\Windows\System\Nchsqns.exe
  2⤵
  PID:7120
- C:\Windows\System\IEdtoXo.exe
  C:\Windows\System\IEdtoXo.exe
  2⤵
  PID:7136
- C:\Windows\System\YrwWGLQ.exe
  C:\Windows\System\YrwWGLQ.exe
  2⤵
  PID:7152
- C:\Windows\System\Evipekk.exe
  C:\Windows\System\Evipekk.exe
  2⤵
  PID:5144
- C:\Windows\System\Hrcgnbq.exe
  C:\Windows\System\Hrcgnbq.exe
  2⤵
  PID:5432
- C:\Windows\System\OfydJZt.exe
  C:\Windows\System\OfydJZt.exe
  2⤵
  PID:6204
- C:\Windows\System\ZpTjacX.exe
  C:\Windows\System\ZpTjacX.exe
  2⤵
  PID:5892
- C:\Windows\System\bvRLqpM.exe
  C:\Windows\System\bvRLqpM.exe
  2⤵
  PID:5844
- C:\Windows\System\QBkfffR.exe
  C:\Windows\System\QBkfffR.exe
  2⤵
  PID:5912
- C:\Windows\System\FAyxCXT.exe
  C:\Windows\System\FAyxCXT.exe
  2⤵
  PID:4860
- C:\Windows\System\XDQZoVy.exe
  C:\Windows\System\XDQZoVy.exe
  2⤵
  PID:5208
- C:\Windows\System\tlmIzlC.exe
  C:\Windows\System\tlmIzlC.exe
  2⤵
  PID:5224
- C:\Windows\System\CjQywOS.exe
  C:\Windows\System\CjQywOS.exe
  2⤵
  PID:5648
- C:\Windows\System\mOgEkWi.exe
  C:\Windows\System\mOgEkWi.exe
  2⤵
  PID:6256
- C:\Windows\System\DBIWOcL.exe
  C:\Windows\System\DBIWOcL.exe
  2⤵
  PID:6192
- C:\Windows\System\HajjwcL.exe
  C:\Windows\System\HajjwcL.exe
  2⤵
  PID:6152
- C:\Windows\System\SyCmuhn.exe
  C:\Windows\System\SyCmuhn.exe
  2⤵
  PID:5812
- C:\Windows\System\LqMShlH.exe
  C:\Windows\System\LqMShlH.exe
  2⤵
  PID:6272
- C:\Windows\System\GKfyBIM.exe
  C:\Windows\System\GKfyBIM.exe
  2⤵
  PID:6340
- C:\Windows\System\DbaDvVT.exe
  C:\Windows\System\DbaDvVT.exe
  2⤵
  PID:6404
- C:\Windows\System\voYlyqx.exe
  C:\Windows\System\voYlyqx.exe
  2⤵
  PID:6472
- C:\Windows\System\FqhnSxR.exe
  C:\Windows\System\FqhnSxR.exe
  2⤵
  PID:6536
- C:\Windows\System\TTgfjwp.exe
  C:\Windows\System\TTgfjwp.exe
  2⤵
  PID:6576
- C:\Windows\System\mEpckrW.exe
  C:\Windows\System\mEpckrW.exe
  2⤵
  PID:6668
- C:\Windows\System\wvtwxnd.exe
  C:\Windows\System\wvtwxnd.exe
  2⤵
  PID:6708
- C:\Windows\System\ryrgcHs.exe
  C:\Windows\System\ryrgcHs.exe
  2⤵
  PID:6772
- C:\Windows\System\skNfSVi.exe
  C:\Windows\System\skNfSVi.exe
  2⤵
  PID:6840
- C:\Windows\System\iyYasVD.exe
  C:\Windows\System\iyYasVD.exe
  2⤵
  PID:6904
- C:\Windows\System\SrSnVRQ.exe
  C:\Windows\System\SrSnVRQ.exe
  2⤵
  PID:6964
- C:\Windows\System\mBUdugG.exe
  C:\Windows\System\mBUdugG.exe
  2⤵
  PID:6968
- C:\Windows\System\yxSqaqj.exe
  C:\Windows\System\yxSqaqj.exe
  2⤵
  PID:6292
- C:\Windows\System\nHuYMtd.exe
  C:\Windows\System\nHuYMtd.exe
  2⤵
  PID:6952
- C:\Windows\System\JGzcyDp.exe
  C:\Windows\System\JGzcyDp.exe
  2⤵
  PID:6820
- C:\Windows\System\PQRbNxy.exe
  C:\Windows\System\PQRbNxy.exe
  2⤵
  PID:6328
- C:\Windows\System\ZEskHCw.exe
  C:\Windows\System\ZEskHCw.exe
  2⤵
  PID:6392
- C:\Windows\System\EKeNEyP.exe
  C:\Windows\System\EKeNEyP.exe
  2⤵
  PID:6452
- C:\Windows\System\dVXESQX.exe
  C:\Windows\System\dVXESQX.exe
  2⤵
  PID:6520
- C:\Windows\System\YAXaSCG.exe
  C:\Windows\System\YAXaSCG.exe
  2⤵
  PID:6588
- C:\Windows\System\ZaZdxFt.exe
  C:\Windows\System\ZaZdxFt.exe
  2⤵
  PID:7164
- C:\Windows\System\RuAvNBk.exe
  C:\Windows\System\RuAvNBk.exe
  2⤵
  PID:5896
- C:\Windows\System\syCCqtz.exe
  C:\Windows\System\syCCqtz.exe
  2⤵
  PID:5496
- C:\Windows\System\bmGtpwy.exe
  C:\Windows\System\bmGtpwy.exe
  2⤵
  PID:6268
- C:\Windows\System\WjnXAjX.exe
  C:\Windows\System\WjnXAjX.exe
  2⤵
  PID:6768
- C:\Windows\System\oCmccTl.exe
  C:\Windows\System\oCmccTl.exe
  2⤵
  PID:6568
- C:\Windows\System\bvUKGeF.exe
  C:\Windows\System\bvUKGeF.exe
  2⤵
  PID:6948
- C:\Windows\System\DWZfntf.exe
  C:\Windows\System\DWZfntf.exe
  2⤵
  PID:6324
- C:\Windows\System\gJOaBwl.exe
  C:\Windows\System\gJOaBwl.exe
  2⤵
  PID:6932
- C:\Windows\System\CUXbREv.exe
  C:\Windows\System\CUXbREv.exe
  2⤵
  PID:7016
- C:\Windows\System\naSdEeT.exe
  C:\Windows\System\naSdEeT.exe
  2⤵
  PID:6460
- C:\Windows\System\UFiFALJ.exe
  C:\Windows\System\UFiFALJ.exe
  2⤵
  PID:6652
- C:\Windows\System\NMwPxZe.exe
  C:\Windows\System\NMwPxZe.exe
  2⤵
  PID:6684
- C:\Windows\System\vAWsdmt.exe
  C:\Windows\System\vAWsdmt.exe
  2⤵
  PID:6752
- C:\Windows\System\DncUgWH.exe
  C:\Windows\System\DncUgWH.exe
  2⤵
  PID:6920
- C:\Windows\System\qFMyBCt.exe
  C:\Windows\System\qFMyBCt.exe
  2⤵
  PID:7052
- C:\Windows\System\VYzBtaM.exe
  C:\Windows\System\VYzBtaM.exe
  2⤵
  PID:6916
- C:\Windows\System\bpDVsee.exe
  C:\Windows\System\bpDVsee.exe
  2⤵
  PID:7160
- C:\Windows\System\voBrtOR.exe
  C:\Windows\System\voBrtOR.exe
  2⤵
  PID:7148
- C:\Windows\System\kSKAJsn.exe
  C:\Windows\System\kSKAJsn.exe
  2⤵
  PID:5732
- C:\Windows\System\NseviMK.exe
  C:\Windows\System\NseviMK.exe
  2⤵
  PID:5188
- C:\Windows\System\MYlDJZD.exe
  C:\Windows\System\MYlDJZD.exe
  2⤵
  PID:5524
- C:\Windows\System\czABzeu.exe
  C:\Windows\System\czABzeu.exe
  2⤵
  PID:6376
- C:\Windows\System\LVLYbNy.exe
  C:\Windows\System\LVLYbNy.exe
  2⤵
  PID:6824
- C:\Windows\System\lfHjQQN.exe
  C:\Windows\System\lfHjQQN.exe
  2⤵
  PID:6640
- C:\Windows\System\khJGVCh.exe
  C:\Windows\System\khJGVCh.exe
  2⤵
  PID:6672
- C:\Windows\System\fizjboO.exe
  C:\Windows\System\fizjboO.exe
  2⤵
  PID:6704
- C:\Windows\System\hionAYP.exe
  C:\Windows\System\hionAYP.exe
  2⤵
  PID:7036
- C:\Windows\System\AFuQRPq.exe
  C:\Windows\System\AFuQRPq.exe
  2⤵
  PID:7020
- C:\Windows\System\UMQbcBR.exe
  C:\Windows\System\UMQbcBR.exe
  2⤵
  PID:6688
- C:\Windows\System\vBmjcjc.exe
  C:\Windows\System\vBmjcjc.exe
  2⤵
  PID:6724
- C:\Windows\System\WuSEnyi.exe
  C:\Windows\System\WuSEnyi.exe
  2⤵
  PID:6888
- C:\Windows\System\bNrrNHK.exe
  C:\Windows\System\bNrrNHK.exe
  2⤵
  PID:6012
- C:\Windows\System\RBdNOrf.exe
  C:\Windows\System\RBdNOrf.exe
  2⤵
  PID:6636
- C:\Windows\System\jPXhDex.exe
  C:\Windows\System\jPXhDex.exe
  2⤵
  PID:6984
- C:\Windows\System\ROpoxqi.exe
  C:\Windows\System\ROpoxqi.exe
  2⤵
  PID:6184
- C:\Windows\System\dTHBITJ.exe
  C:\Windows\System\dTHBITJ.exe
  2⤵
  PID:6508
- C:\Windows\System\WwORyZF.exe
  C:\Windows\System\WwORyZF.exe
  2⤵
  PID:5668
- C:\Windows\System\gDqyRZX.exe
  C:\Windows\System\gDqyRZX.exe
  2⤵
  PID:5160
- C:\Windows\System\VYgUfwD.exe
  C:\Windows\System\VYgUfwD.exe
  2⤵
  PID:6852
- C:\Windows\System\SvfTVrl.exe
  C:\Windows\System\SvfTVrl.exe
  2⤵
  PID:6980
- C:\Windows\System\AypnuSg.exe
  C:\Windows\System\AypnuSg.exe
  2⤵
  PID:6420
- C:\Windows\System\rfLZKJt.exe
  C:\Windows\System\rfLZKJt.exe
  2⤵
  PID:6720
- C:\Windows\System\AbUfsji.exe
  C:\Windows\System\AbUfsji.exe
  2⤵
  PID:6556
- C:\Windows\System\uFqwoec.exe
  C:\Windows\System\uFqwoec.exe
  2⤵
  PID:7000
- C:\Windows\System\aRBeFSt.exe
  C:\Windows\System\aRBeFSt.exe
  2⤵
  PID:7048
- C:\Windows\System\MingEoQ.exe
  C:\Windows\System\MingEoQ.exe
  2⤵
  PID:7172
- C:\Windows\System\tTPEGHc.exe
  C:\Windows\System\tTPEGHc.exe
  2⤵
  PID:7188
- C:\Windows\System\qxqRvHT.exe
  C:\Windows\System\qxqRvHT.exe
  2⤵
  PID:7204
- C:\Windows\System\sVmVNvX.exe
  C:\Windows\System\sVmVNvX.exe
  2⤵
  PID:7220
- C:\Windows\System\fmOfOyr.exe
  C:\Windows\System\fmOfOyr.exe
  2⤵
  PID:7240
- C:\Windows\System\GXYWwEc.exe
  C:\Windows\System\GXYWwEc.exe
  2⤵
  PID:7256
- C:\Windows\System\tOclksW.exe
  C:\Windows\System\tOclksW.exe
  2⤵
  PID:7272
- C:\Windows\System\PNlMtgT.exe
  C:\Windows\System\PNlMtgT.exe
  2⤵
  PID:7288
- C:\Windows\System\wslkjjw.exe
  C:\Windows\System\wslkjjw.exe
  2⤵
  PID:7304
- C:\Windows\System\bODnkHz.exe
  C:\Windows\System\bODnkHz.exe
  2⤵
  PID:7356
- C:\Windows\System\VlJJVNf.exe
  C:\Windows\System\VlJJVNf.exe
  2⤵
  PID:7384
- C:\Windows\System\YJIGOHo.exe
  C:\Windows\System\YJIGOHo.exe
  2⤵
  PID:7400
- C:\Windows\System\nJWunne.exe
  C:\Windows\System\nJWunne.exe
  2⤵
  PID:7416
- C:\Windows\System\pRPkGuo.exe
  C:\Windows\System\pRPkGuo.exe
  2⤵
  PID:7432
- C:\Windows\System\PoztlQj.exe
  C:\Windows\System\PoztlQj.exe
  2⤵
  PID:7452
- C:\Windows\System\dAYHVFN.exe
  C:\Windows\System\dAYHVFN.exe
  2⤵
  PID:7468
- C:\Windows\System\YRpVOrC.exe
  C:\Windows\System\YRpVOrC.exe
  2⤵
  PID:7484
- C:\Windows\System\rxaDAmG.exe
  C:\Windows\System\rxaDAmG.exe
  2⤵
  PID:7500
- C:\Windows\System\SDnosiv.exe
  C:\Windows\System\SDnosiv.exe
  2⤵
  PID:7516
- C:\Windows\System\JxgHFVV.exe
  C:\Windows\System\JxgHFVV.exe
  2⤵
  PID:7532
- C:\Windows\System\FkBAAWM.exe
  C:\Windows\System\FkBAAWM.exe
  2⤵
  PID:7548
- C:\Windows\System\RdiFgwr.exe
  C:\Windows\System\RdiFgwr.exe
  2⤵
  PID:7568
- C:\Windows\System\MeJqUpu.exe
  C:\Windows\System\MeJqUpu.exe
  2⤵
  PID:7584
- C:\Windows\System\AbUMDjT.exe
  C:\Windows\System\AbUMDjT.exe
  2⤵
  PID:7600
- C:\Windows\System\gGdywuK.exe
  C:\Windows\System\gGdywuK.exe
  2⤵
  PID:7616
- C:\Windows\System\oMdzUjd.exe
  C:\Windows\System\oMdzUjd.exe
  2⤵
  PID:7636
- C:\Windows\System\tEpbTMf.exe
  C:\Windows\System\tEpbTMf.exe
  2⤵
  PID:7652
- C:\Windows\System\zrTbABo.exe
  C:\Windows\System\zrTbABo.exe
  2⤵
  PID:7668
- C:\Windows\System\DiBzldF.exe
  C:\Windows\System\DiBzldF.exe
  2⤵
  PID:7684
- C:\Windows\System\JAglltB.exe
  C:\Windows\System\JAglltB.exe
  2⤵
  PID:7700
- C:\Windows\System\eYAHHFH.exe
  C:\Windows\System\eYAHHFH.exe
  2⤵
  PID:7716
- C:\Windows\System\bKsjpod.exe
  C:\Windows\System\bKsjpod.exe
  2⤵
  PID:7732
- C:\Windows\System\yGYJWSY.exe
  C:\Windows\System\yGYJWSY.exe
  2⤵
  PID:7748
- C:\Windows\System\awwNcLb.exe
  C:\Windows\System\awwNcLb.exe
  2⤵
  PID:7764
- C:\Windows\System\eTbCqkY.exe
  C:\Windows\System\eTbCqkY.exe
  2⤵
  PID:7884
- C:\Windows\System\LURkdkd.exe
  C:\Windows\System\LURkdkd.exe
  2⤵
  PID:7964
- C:\Windows\System\XjJPMej.exe
  C:\Windows\System\XjJPMej.exe
  2⤵
  PID:7984
- C:\Windows\System\RtsUkit.exe
  C:\Windows\System\RtsUkit.exe
  2⤵
  PID:8012
- C:\Windows\System\qCxVyAJ.exe
  C:\Windows\System\qCxVyAJ.exe
  2⤵
  PID:8032
- C:\Windows\System\TdkfbkO.exe
  C:\Windows\System\TdkfbkO.exe
  2⤵
  PID:8048
- C:\Windows\System\vHmaOMi.exe
  C:\Windows\System\vHmaOMi.exe
  2⤵
  PID:8064
- C:\Windows\System\ZeajLpD.exe
  C:\Windows\System\ZeajLpD.exe
  2⤵
  PID:8080
- C:\Windows\System\NjzGyYB.exe
  C:\Windows\System\NjzGyYB.exe
  2⤵
  PID:8096
- C:\Windows\System\VnmEcwX.exe
  C:\Windows\System\VnmEcwX.exe
  2⤵
  PID:8112
- C:\Windows\System\MARnFAW.exe
  C:\Windows\System\MARnFAW.exe
  2⤵
  PID:8132
- C:\Windows\System\gGtcKJd.exe
  C:\Windows\System\gGtcKJd.exe
  2⤵
  PID:8148
- C:\Windows\System\fKGKyYM.exe
  C:\Windows\System\fKGKyYM.exe
  2⤵
  PID:8168
- C:\Windows\System\qRqBexT.exe
  C:\Windows\System\qRqBexT.exe
  2⤵
  PID:8184
- C:\Windows\System\UihxsTB.exe
  C:\Windows\System\UihxsTB.exe
  2⤵
  PID:7212
- C:\Windows\System\ZpyHZWM.exe
  C:\Windows\System\ZpyHZWM.exe
  2⤵
  PID:6804
- C:\Windows\System\jAXQdDz.exe
  C:\Windows\System\jAXQdDz.exe
  2⤵
  PID:6492
- C:\Windows\System\LpRFVdm.exe
  C:\Windows\System\LpRFVdm.exe
  2⤵
  PID:7284
- C:\Windows\System\ttmYUoT.exe
  C:\Windows\System\ttmYUoT.exe
  2⤵
  PID:7296
- C:\Windows\System\oiWFrcc.exe
  C:\Windows\System\oiWFrcc.exe
  2⤵
  PID:7324
- C:\Windows\System\vFEopag.exe
  C:\Windows\System\vFEopag.exe
  2⤵
  PID:7332
- C:\Windows\System\KPnAZUz.exe
  C:\Windows\System\KPnAZUz.exe
  2⤵
  PID:7364
- C:\Windows\System\qtdCEIk.exe
  C:\Windows\System\qtdCEIk.exe
  2⤵
  PID:7408
- C:\Windows\System\zmQYjAV.exe
  C:\Windows\System\zmQYjAV.exe
  2⤵
  PID:7428
- C:\Windows\System\IudZFAE.exe
  C:\Windows\System\IudZFAE.exe
  2⤵
  PID:7464
- C:\Windows\System\uAQujLd.exe
  C:\Windows\System\uAQujLd.exe
  2⤵
  PID:7496
- C:\Windows\System\HdlqbPy.exe
  C:\Windows\System\HdlqbPy.exe
  2⤵
  PID:7528
- C:\Windows\System\apdrept.exe
  C:\Windows\System\apdrept.exe
  2⤵
  PID:7556
- C:\Windows\System\aFTGmxz.exe
  C:\Windows\System\aFTGmxz.exe
  2⤵
  PID:7624
- C:\Windows\System\kLwlQRR.exe
  C:\Windows\System\kLwlQRR.exe
  2⤵
  PID:7692
- C:\Windows\System\hzQSNPz.exe
  C:\Windows\System\hzQSNPz.exe
  2⤵
  PID:7760
- C:\Windows\System\xwBipsx.exe
  C:\Windows\System\xwBipsx.exe
  2⤵
  PID:7580
- C:\Windows\System\PiMQwwK.exe
  C:\Windows\System\PiMQwwK.exe
  2⤵
  PID:7708
- C:\Windows\System\aNoaUDo.exe
  C:\Windows\System\aNoaUDo.exe
  2⤵
  PID:7772
- C:\Windows\System\gqaETrm.exe
  C:\Windows\System\gqaETrm.exe
  2⤵
  PID:7784
- C:\Windows\System\erOnXQJ.exe
  C:\Windows\System\erOnXQJ.exe
  2⤵
  PID:7800
- C:\Windows\System\yDhHGoV.exe
  C:\Windows\System\yDhHGoV.exe
  2⤵
  PID:7816
- C:\Windows\System\RQtWXpF.exe
  C:\Windows\System\RQtWXpF.exe
  2⤵
  PID:7832
- C:\Windows\System\znTVEWc.exe
  C:\Windows\System\znTVEWc.exe
  2⤵
  PID:7848
- C:\Windows\System\OLhvKZA.exe
  C:\Windows\System\OLhvKZA.exe
  2⤵
  PID:7864
- C:\Windows\System\PlAcNZT.exe
  C:\Windows\System\PlAcNZT.exe
  2⤵
  PID:7876
- C:\Windows\System\wqHoCed.exe
  C:\Windows\System\wqHoCed.exe
  2⤵
  PID:7904
- C:\Windows\System\vJmstSx.exe
  C:\Windows\System\vJmstSx.exe
  2⤵
  PID:7976
- C:\Windows\System\gZCZJfq.exe
  C:\Windows\System\gZCZJfq.exe
  2⤵
  PID:7956
- C:\Windows\System\BOfQSCX.exe
  C:\Windows\System\BOfQSCX.exe
  2⤵
  PID:7940
- C:\Windows\System\EVdtpKA.exe
  C:\Windows\System\EVdtpKA.exe
  2⤵
  PID:7900
- C:\Windows\System\wTuYatB.exe
  C:\Windows\System\wTuYatB.exe
  2⤵
  PID:8000
- C:\Windows\System\tGXVfBH.exe
  C:\Windows\System\tGXVfBH.exe
  2⤵
  PID:8020
- C:\Windows\System\yRpXpeT.exe
  C:\Windows\System\yRpXpeT.exe
  2⤵
  PID:8072
- C:\Windows\System\SKmtTVO.exe
  C:\Windows\System\SKmtTVO.exe
  2⤵
  PID:8060
- C:\Windows\System\MbUIQUC.exe
  C:\Windows\System\MbUIQUC.exe
  2⤵
  PID:8120
- C:\Windows\System\nOfclpX.exe
  C:\Windows\System\nOfclpX.exe
  2⤵
  PID:8124
- C:\Windows\System\HHgpDcE.exe
  C:\Windows\System\HHgpDcE.exe
  2⤵
  PID:8160
- C:\Windows\System\UUOJyAc.exe
  C:\Windows\System\UUOJyAc.exe
  2⤵
  PID:7180
- C:\Windows\System\LEeqgRT.exe
  C:\Windows\System\LEeqgRT.exe
  2⤵
  PID:7228
- C:\Windows\System\TKdwicg.exe
  C:\Windows\System\TKdwicg.exe
  2⤵
  PID:7252
- C:\Windows\System\ESzidOL.exe
  C:\Windows\System\ESzidOL.exe
  2⤵
  PID:7316
- C:\Windows\System\RYpBKXF.exe
  C:\Windows\System\RYpBKXF.exe
  2⤵
  PID:7328
- C:\Windows\System\yiJSGuI.exe
  C:\Windows\System\yiJSGuI.exe
  2⤵
  PID:7392
- C:\Windows\System\ficJQvg.exe
  C:\Windows\System\ficJQvg.exe
  2⤵
  PID:7492
- C:\Windows\System\hlmSVqF.exe
  C:\Windows\System\hlmSVqF.exe
  2⤵
  PID:7592
- C:\Windows\System\SArnGcB.exe
  C:\Windows\System\SArnGcB.exe
  2⤵
  PID:7724
- C:\Windows\System\GweEavJ.exe
  C:\Windows\System\GweEavJ.exe
  2⤵
  PID:7728
- C:\Windows\System\tIkusOK.exe
  C:\Windows\System\tIkusOK.exe
  2⤵
  PID:7512
- C:\Windows\System\jHHUjQK.exe
  C:\Windows\System\jHHUjQK.exe
  2⤵
  PID:7776
- C:\Windows\System\ExgiIjY.exe
  C:\Windows\System\ExgiIjY.exe
  2⤵
  PID:7824
- C:\Windows\System\ujBUvhz.exe
  C:\Windows\System\ujBUvhz.exe
  2⤵
  PID:7856
- C:\Windows\System\oCXKixX.exe
  C:\Windows\System\oCXKixX.exe
  2⤵
  PID:7908
- C:\Windows\System\QRMqVEh.exe
  C:\Windows\System\QRMqVEh.exe
  2⤵
  PID:8024
- C:\Windows\System\dCWYxoL.exe
  C:\Windows\System\dCWYxoL.exe
  2⤵
  PID:7928
- C:\Windows\System\edyeMXq.exe
  C:\Windows\System\edyeMXq.exe
  2⤵
  PID:7916
- C:\Windows\System\KPMbsDW.exe
  C:\Windows\System\KPMbsDW.exe
  2⤵
  PID:7868
- C:\Windows\System\YDductC.exe
  C:\Windows\System\YDductC.exe
  2⤵
  PID:8040
- C:\Windows\System\ObEtifo.exe
  C:\Windows\System\ObEtifo.exe
  2⤵
  PID:8156
- C:\Windows\System\kRuFDtn.exe
  C:\Windows\System\kRuFDtn.exe
  2⤵
  PID:7348
- C:\Windows\System\bpfUPyD.exe
  C:\Windows\System\bpfUPyD.exe
  2⤵
  PID:8164
- C:\Windows\System\AafbqUF.exe
  C:\Windows\System\AafbqUF.exe
  2⤵
  PID:7268
- C:\Windows\System\nnDIinz.exe
  C:\Windows\System\nnDIinz.exe
  2⤵
  PID:7596
- C:\Windows\System\meaCLYy.exe
  C:\Windows\System\meaCLYy.exe
  2⤵
  PID:7648
- C:\Windows\System\KRGMdkE.exe
  C:\Windows\System\KRGMdkE.exe
  2⤵
  PID:7696
- C:\Windows\System\KkeSemy.exe
  C:\Windows\System\KkeSemy.exe
  2⤵
  PID:7892
- C:\Windows\System\SMkVrQE.exe
  C:\Windows\System\SMkVrQE.exe
  2⤵
  PID:7808
- C:\Windows\System\qkJQuTe.exe
  C:\Windows\System\qkJQuTe.exe
  2⤵
  PID:7996
- C:\Windows\System\hJtVvHy.exe
  C:\Windows\System\hJtVvHy.exe
  2⤵
  PID:8044
- C:\Windows\System\mhiSOQG.exe
  C:\Windows\System\mhiSOQG.exe
  2⤵
  PID:7440
- C:\Windows\System\JCrPodu.exe
  C:\Windows\System\JCrPodu.exe
  2⤵
  PID:7200
- C:\Windows\System\IeNNyME.exe
  C:\Windows\System\IeNNyME.exe
  2⤵
  PID:7264
- C:\Windows\System\rETSfRZ.exe
  C:\Windows\System\rETSfRZ.exe
  2⤵
  PID:7792
- C:\Windows\System\gFmFJkh.exe
  C:\Windows\System\gFmFJkh.exe
  2⤵
  PID:7840
- C:\Windows\System\lckMSBS.exe
  C:\Windows\System\lckMSBS.exe
  2⤵
  PID:7196
- C:\Windows\System\FjqvpEM.exe
  C:\Windows\System\FjqvpEM.exe
  2⤵
  PID:7576
- C:\Windows\System\UWQWqjA.exe
  C:\Windows\System\UWQWqjA.exe
  2⤵
  PID:8200
- C:\Windows\System\SkqSTvS.exe
  C:\Windows\System\SkqSTvS.exe
  2⤵
  PID:8216
- C:\Windows\System\ASeabSK.exe
  C:\Windows\System\ASeabSK.exe
  2⤵
  PID:8232
- C:\Windows\System\HFODAey.exe
  C:\Windows\System\HFODAey.exe
  2⤵
  PID:8248
- C:\Windows\System\fmSNSqn.exe
  C:\Windows\System\fmSNSqn.exe
  2⤵
  PID:8264
- C:\Windows\System\OkaUinD.exe
  C:\Windows\System\OkaUinD.exe
  2⤵
  PID:8280
- C:\Windows\System\mHAenMc.exe
  C:\Windows\System\mHAenMc.exe
  2⤵
  PID:8296
- C:\Windows\System\ppytFeP.exe
  C:\Windows\System\ppytFeP.exe
  2⤵
  PID:8312
- C:\Windows\System\vBiHbxt.exe
  C:\Windows\System\vBiHbxt.exe
  2⤵
  PID:8328
- C:\Windows\System\otHsuMM.exe
  C:\Windows\System\otHsuMM.exe
  2⤵
  PID:8344
- C:\Windows\System\HnBCycM.exe
  C:\Windows\System\HnBCycM.exe
  2⤵
  PID:8360
- C:\Windows\System\PENtPsA.exe
  C:\Windows\System\PENtPsA.exe
  2⤵
  PID:8376
- C:\Windows\System\FQToAIU.exe
  C:\Windows\System\FQToAIU.exe
  2⤵
  PID:8392
- C:\Windows\System\bJzFuoi.exe
  C:\Windows\System\bJzFuoi.exe
  2⤵
  PID:8408
- C:\Windows\System\uVAtFsL.exe
  C:\Windows\System\uVAtFsL.exe
  2⤵
  PID:8424
- C:\Windows\System\KpRMPXJ.exe
  C:\Windows\System\KpRMPXJ.exe
  2⤵
  PID:8440
- C:\Windows\System\guXVrxU.exe
  C:\Windows\System\guXVrxU.exe
  2⤵
  PID:8456
- C:\Windows\System\cmFSRhK.exe
  C:\Windows\System\cmFSRhK.exe
  2⤵
  PID:8472
- C:\Windows\System\yGrlnJF.exe
  C:\Windows\System\yGrlnJF.exe
  2⤵
  PID:8488
- C:\Windows\System\IrMfAIf.exe
  C:\Windows\System\IrMfAIf.exe
  2⤵
  PID:8504
- C:\Windows\System\aMJIKGy.exe
  C:\Windows\System\aMJIKGy.exe
  2⤵
  PID:8520
- C:\Windows\System\MCqjpQs.exe
  C:\Windows\System\MCqjpQs.exe
  2⤵
  PID:8536
- C:\Windows\System\UqFTAOG.exe
  C:\Windows\System\UqFTAOG.exe
  2⤵
  PID:8556
- C:\Windows\System\OpKpkNb.exe
  C:\Windows\System\OpKpkNb.exe
  2⤵
  PID:8572
- C:\Windows\System\WiqidRj.exe
  C:\Windows\System\WiqidRj.exe
  2⤵
  PID:8588
- C:\Windows\System\CXBaJDe.exe
  C:\Windows\System\CXBaJDe.exe
  2⤵
  PID:8608
- C:\Windows\System\CFwOWkW.exe
  C:\Windows\System\CFwOWkW.exe
  2⤵
  PID:8624
- C:\Windows\System\SQecToL.exe
  C:\Windows\System\SQecToL.exe
  2⤵
  PID:8640
- C:\Windows\System\IkoapPp.exe
  C:\Windows\System\IkoapPp.exe
  2⤵
  PID:8656
- C:\Windows\System\CVkqfiV.exe
  C:\Windows\System\CVkqfiV.exe
  2⤵
  PID:8672
- C:\Windows\System\Qoczbhp.exe
  C:\Windows\System\Qoczbhp.exe
  2⤵
  PID:8688
- C:\Windows\System\XdrCIJF.exe
  C:\Windows\System\XdrCIJF.exe
  2⤵
  PID:8704
- C:\Windows\System\tSKLylS.exe
  C:\Windows\System\tSKLylS.exe
  2⤵
  PID:8720
- C:\Windows\System\UFSdVyZ.exe
  C:\Windows\System\UFSdVyZ.exe
  2⤵
  PID:8736
- C:\Windows\System\cftpMzH.exe
  C:\Windows\System\cftpMzH.exe
  2⤵
  PID:8752
- C:\Windows\System\CzZfsHx.exe
  C:\Windows\System\CzZfsHx.exe
  2⤵
  PID:8768
- C:\Windows\System\effXpjo.exe
  C:\Windows\System\effXpjo.exe
  2⤵
  PID:8784
- C:\Windows\System\GuOGxCq.exe
  C:\Windows\System\GuOGxCq.exe
  2⤵
  PID:8800
- C:\Windows\System\awgoGxe.exe
  C:\Windows\System\awgoGxe.exe
  2⤵
  PID:8900
- C:\Windows\System\wGESHVJ.exe
  C:\Windows\System\wGESHVJ.exe
  2⤵
  PID:8916
- C:\Windows\System\XVDQuzx.exe
  C:\Windows\System\XVDQuzx.exe
  2⤵
  PID:8932
- C:\Windows\System\CPubeII.exe
  C:\Windows\System\CPubeII.exe
  2⤵
  PID:8948
- C:\Windows\System\OzECRaJ.exe
  C:\Windows\System\OzECRaJ.exe
  2⤵
  PID:8968
- C:\Windows\System\aBMJNRZ.exe
  C:\Windows\System\aBMJNRZ.exe
  2⤵
  PID:8984
- C:\Windows\System\SwelZXe.exe
  C:\Windows\System\SwelZXe.exe
  2⤵
  PID:9000
- C:\Windows\System\JbcgLxh.exe
  C:\Windows\System\JbcgLxh.exe
  2⤵
  PID:9016
- C:\Windows\System\ABvuqSS.exe
  C:\Windows\System\ABvuqSS.exe
  2⤵
  PID:9032
- C:\Windows\System\CfaDeBD.exe
  C:\Windows\System\CfaDeBD.exe
  2⤵
  PID:9048
- C:\Windows\System\mpPDyPk.exe
  C:\Windows\System\mpPDyPk.exe
  2⤵
  PID:9064
- C:\Windows\System\hnCvtBR.exe
  C:\Windows\System\hnCvtBR.exe
  2⤵
  PID:9080
- C:\Windows\System\GQAVlrF.exe
  C:\Windows\System\GQAVlrF.exe
  2⤵
  PID:9096
- C:\Windows\System\lDhfUJe.exe
  C:\Windows\System\lDhfUJe.exe
  2⤵
  PID:9116
- C:\Windows\System\ugBioEe.exe
  C:\Windows\System\ugBioEe.exe
  2⤵
  PID:9132
- C:\Windows\System\sclVfzC.exe
  C:\Windows\System\sclVfzC.exe
  2⤵
  PID:9148
- C:\Windows\System\KEYcfau.exe
  C:\Windows\System\KEYcfau.exe
  2⤵
  PID:9164
- C:\Windows\System\prQCEpn.exe
  C:\Windows\System\prQCEpn.exe
  2⤵
  PID:9180
- C:\Windows\System\aBFRKVs.exe
  C:\Windows\System\aBFRKVs.exe
  2⤵
  PID:9196
- C:\Windows\System\pfeHBPc.exe
  C:\Windows\System\pfeHBPc.exe
  2⤵
  PID:9212
- C:\Windows\System\DdzXYIT.exe
  C:\Windows\System\DdzXYIT.exe
  2⤵
  PID:8180
- C:\Windows\System\DpHjSzI.exe
  C:\Windows\System\DpHjSzI.exe
  2⤵
  PID:8208
- C:\Windows\System\SyutZFr.exe
  C:\Windows\System\SyutZFr.exe
  2⤵
  PID:7828
- C:\Windows\System\YIAVDpw.exe
  C:\Windows\System\YIAVDpw.exe
  2⤵
  PID:8260
- C:\Windows\System\AvGxoja.exe
  C:\Windows\System\AvGxoja.exe
  2⤵
  PID:8272
- C:\Windows\System\GhWSXOv.exe
  C:\Windows\System\GhWSXOv.exe
  2⤵
  PID:8320
- C:\Windows\System\PttUtxO.exe
  C:\Windows\System\PttUtxO.exe
  2⤵
  PID:8336
- C:\Windows\System\QVCGWKZ.exe
  C:\Windows\System\QVCGWKZ.exe
  2⤵
  PID:8420
- C:\Windows\System\DckszGF.exe
  C:\Windows\System\DckszGF.exe
  2⤵
  PID:8372
- C:\Windows\System\aKufaog.exe
  C:\Windows\System\aKufaog.exe
  2⤵
  PID:8452
- C:\Windows\System\sfDRrWz.exe
  C:\Windows\System\sfDRrWz.exe
  2⤵
  PID:8496
- C:\Windows\System\VyPKZNa.exe
  C:\Windows\System\VyPKZNa.exe
  2⤵
  PID:8528
- C:\Windows\System\FbtEocE.exe
  C:\Windows\System\FbtEocE.exe
  2⤵
  PID:8548
- C:\Windows\System\MxpYLgy.exe
  C:\Windows\System\MxpYLgy.exe
  2⤵
  PID:8616
- C:\Windows\System\kBrKXpI.exe
  C:\Windows\System\kBrKXpI.exe
  2⤵
  PID:8596
- C:\Windows\System\zykANkL.exe
  C:\Windows\System\zykANkL.exe
  2⤵
  PID:8716
- C:\Windows\System\rXVCdqh.exe
  C:\Windows\System\rXVCdqh.exe
  2⤵
  PID:8780
- C:\Windows\System\EAqvFeT.exe
  C:\Windows\System\EAqvFeT.exe
  2⤵
  PID:8700
- C:\Windows\System\RlJqMBl.exe
  C:\Windows\System\RlJqMBl.exe
  2⤵
  PID:8852
- C:\Windows\System\uhlnnRq.exe
  C:\Windows\System\uhlnnRq.exe
  2⤵
  PID:8864
- C:\Windows\System\IGqNGfs.exe
  C:\Windows\System\IGqNGfs.exe
  2⤵
  PID:8888
- C:\Windows\System\LJzeHRb.exe
  C:\Windows\System\LJzeHRb.exe
  2⤵
  PID:8928
- C:\Windows\System\sOmQcqV.exe
  C:\Windows\System\sOmQcqV.exe
  2⤵
  PID:8996
- C:\Windows\System\ncZEvjc.exe
  C:\Windows\System\ncZEvjc.exe
  2⤵
  PID:9124
- C:\Windows\System\fcfbxqE.exe
  C:\Windows\System\fcfbxqE.exe
  2⤵
  PID:9188
- C:\Windows\System\ARLVcze.exe
  C:\Windows\System\ARLVcze.exe
  2⤵
  PID:7960
- C:\Windows\System\uBetnVX.exe
  C:\Windows\System\uBetnVX.exe
  2⤵
  PID:8352
- C:\Windows\System\NgjZzof.exe
  C:\Windows\System\NgjZzof.exe
  2⤵
  PID:8480
- C:\Windows\System\aHSbEGB.exe
  C:\Windows\System\aHSbEGB.exe
  2⤵
  PID:8552
- C:\Windows\System\zItnUIt.exe
  C:\Windows\System\zItnUIt.exe
  2⤵
  PID:8776
- C:\Windows\System\NjzLjOa.exe
  C:\Windows\System\NjzLjOa.exe
  2⤵
  PID:8240
- C:\Windows\System\hEcXiuk.exe
  C:\Windows\System\hEcXiuk.exe
  2⤵
  PID:8432
- C:\Windows\System\LyWFjCt.exe
  C:\Windows\System\LyWFjCt.exe
  2⤵
  PID:8912
- C:\Windows\System\JOXCZAv.exe
  C:\Windows\System\JOXCZAv.exe
  2⤵
  PID:9144
- C:\Windows\System\JWeutEP.exe
  C:\Windows\System\JWeutEP.exe
  2⤵
  PID:8436
- C:\Windows\System\SxdrnYF.exe
  C:\Windows\System\SxdrnYF.exe
  2⤵
  PID:8532
- C:\Windows\System\XdZgurR.exe
  C:\Windows\System\XdZgurR.exe
  2⤵
  PID:9040
- C:\Windows\System\glSkmKP.exe
  C:\Windows\System\glSkmKP.exe
  2⤵
  PID:8960
- C:\Windows\System\BEdpecI.exe
  C:\Windows\System\BEdpecI.exe
  2⤵
  PID:9204
- C:\Windows\System\PDvuHbm.exe
  C:\Windows\System\PDvuHbm.exe
  2⤵
  PID:8416
- C:\Windows\System\QxrnSbf.exe
  C:\Windows\System\QxrnSbf.exe
  2⤵
  PID:8828
- C:\Windows\System\XFSVRQB.exe
  C:\Windows\System\XFSVRQB.exe
  2⤵
  PID:8796
- C:\Windows\System\yPiqLnr.exe
  C:\Windows\System\yPiqLnr.exe
  2⤵
  PID:8632
- C:\Windows\System\TClCQvz.exe
  C:\Windows\System\TClCQvz.exe
  2⤵
  PID:8764
- C:\Windows\System\QpfYKwY.exe
  C:\Windows\System\QpfYKwY.exe
  2⤵
  PID:8836
- C:\Windows\System\QWbdULN.exe
  C:\Windows\System\QWbdULN.exe
  2⤵
  PID:8832
- C:\Windows\System\GuNJRiG.exe
  C:\Windows\System\GuNJRiG.exe
  2⤵
  PID:8884
- C:\Windows\System\xjlmLou.exe
  C:\Windows\System\xjlmLou.exe
  2⤵
  PID:9160
- C:\Windows\System\BpxqcLJ.exe
  C:\Windows\System\BpxqcLJ.exe
  2⤵
  PID:8908
- C:\Windows\System\TTfncgA.exe
  C:\Windows\System\TTfncgA.exe
  2⤵
  PID:8604
- C:\Windows\System\EKYYmys.exe
  C:\Windows\System\EKYYmys.exe
  2⤵
  PID:7844
- C:\Windows\System\FzOOHLW.exe
  C:\Windows\System\FzOOHLW.exe
  2⤵
  PID:8224
- C:\Windows\System\nxRBhMS.exe
  C:\Windows\System\nxRBhMS.exe
  2⤵
  PID:8976
- C:\Windows\System\vdvbhfb.exe
  C:\Windows\System\vdvbhfb.exe
  2⤵
  PID:9176
- C:\Windows\System\fEFiIlx.exe
  C:\Windows\System\fEFiIlx.exe
  2⤵
  PID:1576
- C:\Windows\System\nyqWehS.exe
  C:\Windows\System\nyqWehS.exe
  2⤵
  PID:9220
- C:\Windows\System\wOJPKJY.exe
  C:\Windows\System\wOJPKJY.exe
  2⤵
  PID:9240
- C:\Windows\System\oatukKK.exe
  C:\Windows\System\oatukKK.exe
  2⤵
  PID:9256
- C:\Windows\System\ZIAhBKB.exe
  C:\Windows\System\ZIAhBKB.exe
  2⤵
  PID:9272
- C:\Windows\System\cEMhRio.exe
  C:\Windows\System\cEMhRio.exe
  2⤵
  PID:9288
- C:\Windows\System\SDmPOJc.exe
  C:\Windows\System\SDmPOJc.exe
  2⤵
  PID:9304
- C:\Windows\System\juqADxi.exe
  C:\Windows\System\juqADxi.exe
  2⤵
  PID:9320
- C:\Windows\System\LYSnfQh.exe
  C:\Windows\System\LYSnfQh.exe
  2⤵
  PID:9336
- C:\Windows\System\BQLbPmu.exe
  C:\Windows\System\BQLbPmu.exe
  2⤵
  PID:9352
- C:\Windows\System\nwqRdRd.exe
  C:\Windows\System\nwqRdRd.exe
  2⤵
  PID:9368
- C:\Windows\System\jaLopjc.exe
  C:\Windows\System\jaLopjc.exe
  2⤵
  PID:9384
- C:\Windows\System\YIVpavC.exe
  C:\Windows\System\YIVpavC.exe
  2⤵
  PID:9400
- C:\Windows\System\RHdbkcE.exe
  C:\Windows\System\RHdbkcE.exe
  2⤵
  PID:9416
- C:\Windows\System\PrquFkG.exe
  C:\Windows\System\PrquFkG.exe
  2⤵
  PID:9508
- C:\Windows\System\FHauRiA.exe
  C:\Windows\System\FHauRiA.exe
  2⤵
  PID:8964
- C:\Windows\System\eandPIg.exe
  C:\Windows\System\eandPIg.exe
  2⤵
  PID:9500
- C:\Windows\System\mzYJgxr.exe
  C:\Windows\System\mzYJgxr.exe
  2⤵
  PID:9252
- C:\Windows\System\tHVXozO.exe
  C:\Windows\System\tHVXozO.exe
  2⤵
  PID:9380
- C:\Windows\System\hRwzvzu.exe
  C:\Windows\System\hRwzvzu.exe
  2⤵
  PID:9488
- C:\Windows\System\blUmsVB.exe
  C:\Windows\System\blUmsVB.exe
  2⤵
  PID:9264
- C:\Windows\System\xULYIoy.exe
  C:\Windows\System\xULYIoy.exe
  2⤵
  PID:10168
- C:\Windows\System\epNSbxY.exe
  C:\Windows\System\epNSbxY.exe
  2⤵
  PID:9816
- C:\Windows\System\ZZIwuza.exe
  C:\Windows\System\ZZIwuza.exe
  2⤵
  PID:9548
- C:\Windows\System\ZjuVRWn.exe
  C:\Windows\System\ZjuVRWn.exe
  2⤵
  PID:9828
- C:\Windows\System\uhlTDAi.exe
  C:\Windows\System\uhlTDAi.exe
  2⤵
  PID:9852
- C:\Windows\System\iqsEVtE.exe
  C:\Windows\System\iqsEVtE.exe
  2⤵
  PID:9448
- C:\Windows\System\BlwNqZV.exe
  C:\Windows\System\BlwNqZV.exe
  2⤵
  PID:9300
- C:\Windows\System\xaPBYxA.exe
  C:\Windows\System\xaPBYxA.exe
  2⤵
  PID:9348
- C:\Windows\System\HVDVBIf.exe
  C:\Windows\System\HVDVBIf.exe
  2⤵
  PID:8848
- C:\Windows\System\DBawfCZ.exe
  C:\Windows\System\DBawfCZ.exe
  2⤵
  PID:8892
- C:\Windows\System\AVxIGST.exe
  C:\Windows\System\AVxIGST.exe
  2⤵
  PID:9748
- C:\Windows\System\sbziTsK.exe
  C:\Windows\System\sbziTsK.exe
  2⤵
  PID:9764
- C:\Windows\System\TZGsnuS.exe
  C:\Windows\System\TZGsnuS.exe
  2⤵
  PID:9784
- C:\Windows\System\uKgRgVU.exe
  C:\Windows\System\uKgRgVU.exe
  2⤵
  PID:10120
- C:\Windows\System\iCYKvdD.exe
  C:\Windows\System\iCYKvdD.exe
  2⤵
  PID:8636
- C:\Windows\System\nzKerWZ.exe
  C:\Windows\System\nzKerWZ.exe
  2⤵
  PID:9428
- C:\Windows\System\ZuQkFKo.exe
  C:\Windows\System\ZuQkFKo.exe
  2⤵
  PID:9312
- C:\Windows\System\sLAHWTx.exe
  C:\Windows\System\sLAHWTx.exe
  2⤵
  PID:9112
- C:\Windows\System\ybSatNE.exe
  C:\Windows\System\ybSatNE.exe
  2⤵
  PID:10032
- C:\Windows\System\lDqfkDB.exe
  C:\Windows\System\lDqfkDB.exe
  2⤵
  PID:10048
- C:\Windows\System\ufELBZp.exe
  C:\Windows\System\ufELBZp.exe
  2⤵
  PID:10084
- C:\Windows\System\SkvGQeu.exe
  C:\Windows\System\SkvGQeu.exe
  2⤵
  PID:9560
- C:\Windows\System\BSJrtUq.exe
  C:\Windows\System\BSJrtUq.exe
  2⤵
  PID:9572
- C:\Windows\System\kFJmNrr.exe
  C:\Windows\System\kFJmNrr.exe
  2⤵
  PID:9588
- C:\Windows\System\xUGdrNq.exe
  C:\Windows\System\xUGdrNq.exe
  2⤵
  PID:9608
- C:\Windows\System\ntsbcIN.exe
  C:\Windows\System\ntsbcIN.exe
  2⤵
  PID:9620
- C:\Windows\System\mCkCZuD.exe
  C:\Windows\System\mCkCZuD.exe
  2⤵
  PID:9632
- C:\Windows\System\wEyGJiy.exe
  C:\Windows\System\wEyGJiy.exe
  2⤵
  PID:9644
- C:\Windows\System\vrZWIou.exe
  C:\Windows\System\vrZWIou.exe
  2⤵
  PID:9788
- C:\Windows\System\PwIvhGl.exe
  C:\Windows\System\PwIvhGl.exe
  2⤵
  PID:9660
- C:\Windows\System\QpMadJl.exe
  C:\Windows\System\QpMadJl.exe
  2⤵
  PID:9676
- C:\Windows\System\lahioVv.exe
  C:\Windows\System\lahioVv.exe
  2⤵
  PID:9696
- C:\Windows\System\XinHnJq.exe
  C:\Windows\System\XinHnJq.exe
  2⤵
  PID:10160
- C:\Windows\System\TkzEpvJ.exe
  C:\Windows\System\TkzEpvJ.exe
  2⤵
  PID:9860
- C:\Windows\System\TqiFpEm.exe
  C:\Windows\System\TqiFpEm.exe
  2⤵
  PID:9844
- C:\Windows\System\qpplLJf.exe
  C:\Windows\System\qpplLJf.exe
  2⤵
  PID:9884
- C:\Windows\System\BppRlEJ.exe
  C:\Windows\System\BppRlEJ.exe
  2⤵
  PID:9916
- C:\Windows\System\nSGqcRy.exe
  C:\Windows\System\nSGqcRy.exe
  2⤵
  PID:9848
- C:\Windows\System\kEkVOOO.exe
  C:\Windows\System\kEkVOOO.exe
  2⤵
  PID:9376
- C:\Windows\System\cDdDMfY.exe
  C:\Windows\System\cDdDMfY.exe
  2⤵
  PID:9868
- C:\Windows\System\wTwNPrl.exe
  C:\Windows\System\wTwNPrl.exe
  2⤵
  PID:8824
- C:\Windows\System\qfYwrjP.exe
  C:\Windows\System\qfYwrjP.exe
  2⤵
  PID:9984
- C:\Windows\System\ycbUafu.exe
  C:\Windows\System\ycbUafu.exe
  2⤵
  PID:9964
- C:\Windows\System\IUQkVeG.exe
  C:\Windows\System\IUQkVeG.exe
  2⤵
  PID:9544
- C:\Windows\System\RspwKqK.exe
  C:\Windows\System\RspwKqK.exe
  2⤵
  PID:9896
- C:\Windows\System\tIdNzJh.exe
  C:\Windows\System\tIdNzJh.exe
  2⤵
  PID:9960
- C:\Windows\System\fMfdbOi.exe
  C:\Windows\System\fMfdbOi.exe
  2⤵
  PID:9980
- C:\Windows\System\yzGxyyi.exe
  C:\Windows\System\yzGxyyi.exe
  2⤵
  PID:10016
- C:\Windows\System\vQXWvbv.exe
  C:\Windows\System\vQXWvbv.exe
  2⤵
  PID:10068
- C:\Windows\System\LgxEcgt.exe
  C:\Windows\System\LgxEcgt.exe
  2⤵
  PID:10088
- C:\Windows\System\cgjEzDD.exe
  C:\Windows\System\cgjEzDD.exe
  2⤵
  PID:10192
- C:\Windows\System\eJZFIXq.exe
  C:\Windows\System\eJZFIXq.exe
  2⤵
  PID:9072
- C:\Windows\System\uWGiUtT.exe
  C:\Windows\System\uWGiUtT.exe
  2⤵
  PID:10236
- C:\Windows\System\dENsXoZ.exe
  C:\Windows\System\dENsXoZ.exe
  2⤵
  PID:9480
- C:\Windows\System\YhhhOGT.exe
  C:\Windows\System\YhhhOGT.exe
  2⤵
  PID:9456
- C:\Windows\System\wfTWpcj.exe
  C:\Windows\System\wfTWpcj.exe
  2⤵
  PID:9724
- C:\Windows\System\qOVOTaK.exe
  C:\Windows\System\qOVOTaK.exe
  2⤵
  PID:9268
- C:\Windows\System\fCTtgvZ.exe
  C:\Windows\System\fCTtgvZ.exe
  2⤵
  PID:9760
- C:\Windows\System\LleTdBb.exe
  C:\Windows\System\LleTdBb.exe
  2⤵
  PID:9780
- C:\Windows\System\vWCubTq.exe
  C:\Windows\System\vWCubTq.exe
  2⤵
  PID:9328
- C:\Windows\System\QErXlYF.exe
  C:\Windows\System\QErXlYF.exe
  2⤵
  PID:9028
- C:\Windows\System\xqKDBrU.exe
  C:\Windows\System\xqKDBrU.exe
  2⤵
  PID:9900
- C:\Windows\System\xiTtyCn.exe
  C:\Windows\System\xiTtyCn.exe
  2⤵
  PID:9528
- C:\Windows\System\ZrhVLeV.exe
  C:\Windows\System\ZrhVLeV.exe
  2⤵
  PID:9772
- C:\Windows\System\pqsofms.exe
  C:\Windows\System\pqsofms.exe
  2⤵
  PID:9396
- C:\Windows\System\LFZceOP.exe
  C:\Windows\System\LFZceOP.exe
  2⤵
  PID:9996
- C:\Windows\System\ZhidGhs.exe
  C:\Windows\System\ZhidGhs.exe
  2⤵
  PID:9888
- C:\Windows\System\gEniWnC.exe
  C:\Windows\System\gEniWnC.exe
  2⤵
  PID:9236
- C:\Windows\System\CmdBLkc.exe
  C:\Windows\System\CmdBLkc.exe
  2⤵
  PID:9432
- C:\Windows\System\LebreLY.exe
  C:\Windows\System\LebreLY.exe
  2⤵
  PID:10136
- C:\Windows\System\OxYepYz.exe
  C:\Windows\System\OxYepYz.exe
  2⤵
  PID:8868
- C:\Windows\System\rwASATk.exe
  C:\Windows\System\rwASATk.exe
  2⤵
  PID:9792
- C:\Windows\System\fpwFMVO.exe
  C:\Windows\System\fpwFMVO.exe
  2⤵
  PID:9652
- C:\Windows\System\SGEmhhZ.exe
  C:\Windows\System\SGEmhhZ.exe
  2⤵
  PID:10152
- C:\Windows\System\SRnbzRU.exe
  C:\Windows\System\SRnbzRU.exe
  2⤵
  PID:9464
- C:\Windows\System\NjVvRBC.exe
  C:\Windows\System\NjVvRBC.exe
  2⤵
  PID:9944
- C:\Windows\System\AjVMHxg.exe
  C:\Windows\System\AjVMHxg.exe
  2⤵
  PID:10200
- C:\Windows\System\sQkILmh.exe
  C:\Windows\System\sQkILmh.exe
  2⤵
  PID:10132
- C:\Windows\System\MUbPJNh.exe
  C:\Windows\System\MUbPJNh.exe
  2⤵
  PID:8860
- C:\Windows\System\IRbpNRZ.exe
  C:\Windows\System\IRbpNRZ.exe
  2⤵
  PID:8816
- C:\Windows\System\rAEUMOW.exe
  C:\Windows\System\rAEUMOW.exe
  2⤵
  PID:9712
- C:\Windows\System\vxRqvsk.exe
  C:\Windows\System\vxRqvsk.exe
  2⤵
  PID:9776
- C:\Windows\System\EKsGXMR.exe
  C:\Windows\System\EKsGXMR.exe
  2⤵
  PID:9392
- C:\Windows\System\tVaKjQM.exe
  C:\Windows\System\tVaKjQM.exe
  2⤵
  PID:8308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CymiDbk.exe

Filesize
1.9MB

MD5
71a63501b8b4a2ff0b0638c7fa180fcf

SHA1
2def676e44257f373e98ed03ec609c448ad70577

SHA256
6d2f265679245363e172c7bf7cbcdcdda432d38f911e39032612380683106386

SHA512
17374c95f2ef7d036168759ce7d27be5e1d3191f42392d6616525619a07e2bec8186549fa1534d81b2f436f832ec4d586f91159897e172fd9ebff61a628bb387

Download Submit
C:\Windows\system\KmalFLs.exe

Filesize
1.9MB

MD5
9ddb970dc9f228f06a258b2d2bae46d6

SHA1
48379baeaf5dc8d639e77ee1d6b2036fb6b1339f

SHA256
b6dc13c0fa075584751c3a966455eac86170ae171048b84392c5071007edda56

SHA512
a3832a2d86ec59c5c22c1c6710e1545cd4aa325a8795f5ca1621704bdeffbe3f5011ae62d52a39ae447c95c811111aa40b772867348de0d0166a1239d22ef1cd

Download Submit
C:\Windows\system\KrQgWoC.exe

Filesize
1.9MB

MD5
c69d41a475695884ac13bb0b1f8b6b8d

SHA1
82ba5ec77ae250d3b6ac2d179dbfcc21e17fde1e

SHA256
f6bee6a2a2e536bb1c0f55eadff7722de700f1708f29fa9bf0f652d5b63160d8

SHA512
704e33341099801c6f46b65eb0e7e802617937706c66f0068f43e3214e37fccfe270032f815f472cc24145b835513cc5eed030cebd73d95b5bc70ba702a3ac25

Download Submit
C:\Windows\system\OdehPOS.exe

Filesize
1.9MB

MD5
ed2f47f894b143b83786cc3ff2bab2ff

SHA1
a10da1a8c72b9c83be4c9fef5f6cd76b9eee6c65

SHA256
4bdd1f9cbf594988d4d9ebcbebf45eddf204355f01baf9356f201ee38f1e2072

SHA512
3d5064616b81cf6fa814af5752a1d9cee464658c79b334b53bd12623d4b590ed8e6d4a92cb98c1d7bb53621e28b477d5fee144cbd78ba4c2579082baa8b7b638

Download Submit
C:\Windows\system\OwwKZXn.exe

Filesize
1.9MB

MD5
7a58d9ed72a27af1852bcf130dc2103a

SHA1
f2fd33c00f2384201b34a2951e766ee7b93af2e1

SHA256
11d8820d01bee40b4d72c90ff8a0709c15eacc3b82f05ec61393ab8870b41773

SHA512
6fb674cc70a28e7fa0427c6c4ff28fce5269e2f2a8756e9a63a2339f481dfa2229474e7f80ea3e6e0979f212237d1d1fec6e75d48e241a0962435cd8b3048bf9

Download Submit
C:\Windows\system\SVYZIkz.exe

Filesize
1.9MB

MD5
daa8d33d636ac67979039a33b1f6e9a2

SHA1
7a9295389a70ed262e503212cf138a216c0640a2

SHA256
b6fdf03242f2c8f20ac01d2c0361873e010a638d997ed43c1cc870a89ddadc6b

SHA512
d11270d6581e6f6bc48b7fe92a2e1a2524fde73f4ed4c8300424492dd09a29d03d7a65acf208aee7e474b548b875cbc337260f97d944641904216c5d70ce0cce

Download Submit
C:\Windows\system\TGixwta.exe

Filesize
1.9MB

MD5
a07257bfbefb461d8d6f3a54a2646579

SHA1
8b1ba19173e899d6f2300afcc82e980d4292444f

SHA256
0b0d2588733fac05cb8f80e6def76b463c3eb91abad9951dc74a71babf6a70bd

SHA512
9cdece5a6ec09b2389f881f69e493f2e2a79f4b59faf1689d5e8b66af99c38265d03b7ce42371d4ae2cd7e3ee2d81109d94694c6555b149420187a12cb53dc79

Download Submit
C:\Windows\system\XIdQSRE.exe

Filesize
1.9MB

MD5
f71f6048e932eee7158db8c64b609291

SHA1
791831d1cf7ae41bd77369c03dd19bb3d72ba401

SHA256
d94d31a24e3a04950cd4a4aaf0a2e8d0bc68a75d95b5ecb7e8671d9c0577c57f

SHA512
38414f80f651124144e84d9c855a068dd72ae7666afe97da8727aea88339c26b1ff811f27165f385e9b67914eb0ad3154e921c7c2e0d4bdcb1d99052eb6ab4a4

Download Submit
C:\Windows\system\XcVvPfI.exe

Filesize
1.9MB

MD5
389d3b5f19a139872b6c0bf41640c1aa

SHA1
ccc0792c192e47ccabe52e8759d3e33fe68a8f21

SHA256
f2b20c5c7f910c26fd2239f84765a9abea6ec409b7088e3316bd803711b3d1f5

SHA512
cf46284eb86b620b8e5b2883a8a8a2028b49f5af0d564c62ec145b875692fee2febd061c3f258b02cdc1fa090bf467c32588179dee5669e02ded468e9cee3dda

Download Submit
C:\Windows\system\XkLoKqL.exe

Filesize
1.9MB

MD5
e1530f011fdcf00951996a228cece2f2

SHA1
fb3b9a13d86fcbccb5d29a2d7f7dd0a1fb340550

SHA256
59a0d916f5d42c2fbc68980ccaeb712e937d4bff04582e92676a83a4bb5a1771

SHA512
27db26d20b6a814c14a6c1e046f430cfcc8f3f82fcc5558b84bb078523b622d771cd809225947123c5ec2827a3416633bc8a990e3bca9c7e0f98bb4855248af1

Download Submit
C:\Windows\system\brCfYnC.exe

Filesize
1.9MB

MD5
e903c5610047eb833d8b331c84c18c44

SHA1
1e011e6f3a49c34fce1cb47b49ef0b6f80f60a66

SHA256
696f4a12f7d1eb726e125da59c322b7bad9d68207d9a4d36e2f44619c23f7811

SHA512
dbd719df69e9557688c46e0fb841e91d8eb40ab1bbc88b5d643cd9fb4018acce7167c6754bbfd61a4cb510b0154235ef75a4bc5a493ae148d8341203e26e2aab

Download Submit
C:\Windows\system\dgVBfHd.exe

Filesize
1.9MB

MD5
162f41a3e492ad2aa3c7252f2f936365

SHA1
ba72f3c7e1641abd6ca9701adcdf52093a847ec3

SHA256
66c120a84326e72b46437a5d7a5a4fb4df44efec2d7181a7298be3c6b500a6fb

SHA512
c6d15cd9121c78099706364d65a2c349359f623999b25a2dcae406c950bb49651f548be4cbcf558ce48856408e34e2c124e89e30334ce6023e1f4c67c3440e35

Download Submit
C:\Windows\system\ebHBQIN.exe

Filesize
1.9MB

MD5
3693124bd7d40092efb8ed5b800f91d8

SHA1
13bc229983dc1de2c5c2b9dc296695de8a12fd20

SHA256
364335b6383115e5c35320cc85f6e43f0d33942d5dcd8437f0a763b0fff982ea

SHA512
b5dafecf376f868cc8bd6d7c15ec02161ef00fe13447bccbfe4dd7c895741e2e2a981a795d11d3fc7cdc32412e29c4a94618ca7331cbc262c71675a6c785881d

Download Submit
C:\Windows\system\fFRpjwC.exe

Filesize
1.9MB

MD5
157af0794269e31cccb4468a19ac0c72

SHA1
041f233cfa60852d4f9ef3886c1acb70c33282d2

SHA256
acad41b6c6f938151d4533f9b15935054833bade7dab19358b1f4bf445e8d834

SHA512
ac5aeac4b54ec6b403cb217264704777ad674e7e0eaf777c0f401be13624f576fb1f9e448290d2843a9be0db40e278864c73895a75bbd1c33b85ac9ba6dcddcc

Download Submit
C:\Windows\system\iMzfUoh.exe

Filesize
1.9MB

MD5
cb0786835247fa523764f798cd649f2c

SHA1
f8ad1cb5ef4439e268ca45487ce624f17a9e33a5

SHA256
5def43276fe558987026fb40cde0d5e7a52942f33c6e36102b1e93ed75028feb

SHA512
ef93bc7ff5d9f67420f8cd30703c75bc3cf3bf4099a454b8afe7ffe90281012ba3b5c467744c09ea15917697a2c4fe1315349e9cc1975612ac7700eabec32b24

Download Submit
C:\Windows\system\jghMIob.exe

Filesize
1.9MB

MD5
fdd3d87664d720d7cda2645e4ca1198e

SHA1
4f017b78339faafc86c77b11f77645e945bf95ba

SHA256
a904305e5e1f87452c7983d8ff04563a044660bbbf21345e059b87344a45f577

SHA512
ba4c90a1ffaa52e7af6ada3fe1ca7b73f7a09694413d816958a139a9b4a876023300dd679282a4c9e6b780df530f731d1c7cf3ea3c32eb8f2fb4cb1f442ee302

Download Submit
C:\Windows\system\mwFGJuo.exe

Filesize
1.9MB

MD5
927f2c787ff384af2ed97d09a2fb10ea

SHA1
d04e322af77ba05744c02fd70c986c560833646b

SHA256
af4d7378ca2abd34999f9de01498fe74ce366c6ba15dd419b463c45f32768471

SHA512
6bbfed181ff4484323411263cd8d3207c86890e0ca8663b1b75af65a31d5d8fe9732d623172339358488baa9ef35ac59e8035d2cfcf9bd8231afba481fd986a9

Download Submit
C:\Windows\system\qkeJjbt.exe

Filesize
1.9MB

MD5
89710ffa87de9ba0d8b91b0003936105

SHA1
a1b56124c6c4f5c35c76dea4123a1ef21103407d

SHA256
4bac1fbc99b1ee6a9955d33b78dad32b50635d6c246cadc76fb6ed059a79d456

SHA512
047f9368b847143b7dc1afe3919285ecdf0758aef62944aa7ff3695f648e79d6f57f6488e1d8f978b7ec555bbffae358838cf1efe05a56449e7d169ee263e612

Download Submit
C:\Windows\system\tRfKhbZ.exe

Filesize
1.9MB

MD5
4392c22f9e7b8c44bbd006738f44d40e

SHA1
2acbdfef73f941e8b72deb6226639fce92254d62

SHA256
e65e2fb747e0b0bee682bcc0fe7b0115f08e194547d35af489305b5adb11be47

SHA512
f5706dbf34bbe248f5a578ee3c8bb576f8ffad177012e82254690d8e64a8bd9384b8a0b224c692e08bbc4d34a99a2b2634005f303365dcc74de373f13290aceb

Download Submit
C:\Windows\system\ygZrMJL.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\system\znLEuww.exe

Filesize
1.9MB

MD5
9507ca0e82495ec5df5d80b6d9be62b4

SHA1
4cba56f46e7b90c684134eb8820e3dd7f155c4c8

SHA256
eb1476beeaf4ed33b8b82eb843eba6b2342c917ac370ca8c2b1e21709c045380

SHA512
81f8e9d53e5c0a455e89bffc483bb7be9640ff178d12bf7e4432c8a755eef115272ca625ef72683a4fbfcb6950478c427b4b880eed6b3fd4ecfdec98b8b7d083

Download Submit
\Windows\system\NMTfcFl.exe

Filesize
1.9MB

MD5
6c0291c811081c2ba3273d0828fcce9c

SHA1
c4115bfb282d373bb62ad9032a1ff776b2ba3db3

SHA256
31ffb663d0734272af57db79ba6e67a070aeae3ed3af246d820c0f0c9d8dc0d5

SHA512
0864f22cbe87b08ea22177bd78f532903e73ac62f897ea9f3d07ba90344e0bafc239af3c47a732c7c2a468d441716df8e07ca91c3d2547a6d3a93da75c78249b

Download Submit
\Windows\system\SaycWcy.exe

Filesize
1.9MB

MD5
35fbed7c8229cbd94ab5399a3e2d0351

SHA1
37bb3baddeeb829eb542b5cc8e191211c31988cb

SHA256
af2b9dca25ecd90d175854895e441b7faa09f1c79b9590948cb55f52fbd8b055

SHA512
4da2a1ffb17c71e726aa4927707ca2e1c86a7daf89e53a55add21b3d86792d8e7f3b59bf61b52c6c681e681d0790fa7bd7a420ff9a9589a00b5bff83115eaa62

Download Submit
\Windows\system\UgrkQiz.exe

Filesize
1.9MB

MD5
052255102f541a368778676ed73cb81c

SHA1
d7704ce6521ab1f3545ad14929e6c62933ab84fb

SHA256
5fbe383ea92c64a5aabd63f247da6eefae673536afb29b69868817c1fccbb10f

SHA512
68970eea2c777f1a865a2a048325d5c97060bed06675944b90f66ef018be60fdb29aab43a5ade337358d0e1b2303395985b40b38a88b04615193f57df43cf6c6

Download Submit
\Windows\system\UpcjIIf.exe

Filesize
1.9MB

MD5
58fcd8ceb89fb88b8f4cee2534965cb6

SHA1
2454728d48b3fca998c1797efdff75498b349621

SHA256
b934f781a98086334db40f029c84dba780ed03ce6bf04376dde01c58ff561232

SHA512
f71e6952b1f740abb74b101657a0335abaa1d5a23ef3f03648809e3ff7de4dea40450c60d362bad2cdc7a83043347127b7a716575bb7ca113d2b03d9240be3da

Download Submit
\Windows\system\VhPiuRD.exe

Filesize
1.9MB

MD5
b674a5af8e129acb96ee082a36c9adc9

SHA1
1673b23d22cc81f5f9d2c9f6ec2a57a9258569b2

SHA256
b65fcdbd3c8a19722abae516fb2f959ba9097b48bf888fdd965dcd1b893fb1da

SHA512
20dc94083e1ff08e36c2d0a7deddf2b7bb186dc391b929cd2cb51bab9e46a1b3a0d60ec84c41c99fe4c3337022109eb5bcfe0f2de8f06479d0ad2c95f9ed95c1

Download Submit
\Windows\system\YHPKLzY.exe

Filesize
1.9MB

MD5
d3f7e9fd938ccc7a31e61f3441a0672c

SHA1
bfa15b6e98b8295a9b4d2f4e1f0f27d9d2781990

SHA256
84061abf6e0852273f044c65251ce4c3d43796637c9e508fb1ffdbb938d8d956

SHA512
10f69909d1f239324bb964c698e5ad0ad45aad6ca32d9f0eb3b97a50e22f83514758e9a685a9e31808dc9ba71a4c6e1c055e3d60d359b353f0d551092d3482fc

Download Submit
\Windows\system\chZEFCD.exe

Filesize
1.9MB

MD5
5ecaea7f2caadcd084bf313726f96553

SHA1
6ee209cb61d680284f3c6acf4a92b2bdab95f8d7

SHA256
955c89549198c93c46470c9116327ca9c38654a71f9fa8143adb7d6dac1776c1

SHA512
a34cd2bba1df99152deccf8fcef18dd49e864193b2c43351b6b9ca14a22d3d3a3c19e2e6c968e4b955cbf778814bd764e5c66616a57ddaee6ab20ffd61d087ce

Download Submit
\Windows\system\iYHcYkS.exe

Filesize
1.9MB

MD5
9fe78ea52dd4b9ab9138b2252d92543d

SHA1
dc4769e3b92bd403a8934e66910b0cbcaff978af

SHA256
c3dd44fd631d8bf195a2e6c045b0e3b591e75f945aa9050974ff02d84a3f06a1

SHA512
fa1e118ea6ba73b042dc48e2dde7ba6c1f571dc26076430bdca2ae591b435ff8e6e44c9e5550bcb2045d05a409b4daf5617a56367f68ee9fd9d55b213509b0e9

Download Submit
\Windows\system\icvhQNs.exe

Filesize
1.9MB

MD5
4d616769e89b7234ee0345fe764d59d5

SHA1
f5cce91b0336e7588674d714c76a5943a8e3a7a4

SHA256
6313c2332082b8210a7648dd16921fbc8801b954b46d9b2f60d936fd6eebf685

SHA512
8eb1d9d3a74251402c8b8354c07cac32f1b7f420420bb08d8b11eb3e28d0c0a62bc21d138454edc25f3bde39e695bc386d0fdb901abad1f26bb70e3ffbb84926

Download Submit
\Windows\system\kYKzqNx.exe

Filesize
1.9MB

MD5
840d55476a831acf1bb06a9fa3af704b

SHA1
9cd44073d62b8c325d99a2a23fb7649ee0d3cd5e

SHA256
12f41551a557e0303409b87566350ad2eaa59251be873040266bb2e1e57e771a

SHA512
7d6a4c0fe541c888a8539adfe9c0e86cee5738654349e121577c586d3e2c2aff4ef5c074d03df1eec63f4c12598a4a2caa859b5387e379fcfe44e3387fa6a928

Download Submit
\Windows\system\khYjQXL.exe

Filesize
1.9MB

MD5
1cfdd69c9c694fdf3094a9ca393cc82c

SHA1
311aaab95463578c581cc2d79d920fbe5e91cd38

SHA256
369d168d71936be2f45dfc8652bb51555493c8e244c07dca4a30f002a9fb5d88

SHA512
60c6c5033b422423716dc98bdcefb8f69f40240d5f10a7f9082abebbc159329d91cf5424de13b3b8b9fe04642277d680ad99ef5e650330f9bf7487591c853f67

Download Submit
\Windows\system\mYhlohQ.exe

Filesize
1.9MB

MD5
5a4f967c9ceb10cf088fbdc307cb5f81

SHA1
1a0a0c3f4f6a8f955ea51252db4f02c2a0c23344

SHA256
72f5d0a695e1e691d208865448203b45497b9141fe0848037a3879f20ed5557d

SHA512
6656b3e11838b5e304e1d0748898191206c3c00ec9c7adb3dea3bef7950f101994d6b76668a7c638ca2622f9acb266092866ec7c79888d685845a23038c61804

Download Submit
\Windows\system\oUayjLB.exe

Filesize
1.9MB

MD5
63a6d7174c0b185a8ce33344b7bdc9fb

SHA1
fbccc9ac1603e3e427e6149ade5e742a92d0dfca

SHA256
8052e2c3482a03dc6dcb949fce125a57c4d3cf6ac8859ca1667987896c7f0999

SHA512
613991b8de29052822689382e4db796b1a1623c0016551fdf774713c2f0d4a39a68f3d0743fd6fda7980f0d9751cf88b84026e5db846cbb474d7a57c7272e98e

Download Submit
\Windows\system\xhCgEIA.exe

Filesize
1.9MB

MD5
0136ddccda9af5665d4b02f28aa70c14

SHA1
3503d1160350ee6005e7ddb3f017c58fe045a039

SHA256
e030a604a3d4399f470e788a486b16f6bc6f973b9c604dc6eae1282e36751ef4

SHA512
e7454d74ac57b7891369d25bcdf45d95e943db78f8f2c58bc0480c291321cb888811c142e3e842ed4845d818a0f9f4ceb64b17632df08284ec5e2d2eec8e1153

Download Submit
memory/1708-178-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/1708-5706-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-5713-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-150-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2472-5710-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2472-145-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2520-180-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2520-5714-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2584-5734-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2584-13-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2612-5729-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2612-161-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2636-126-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

Filesize
2.9MB

Download
memory/2636-14-0x0000000002E40000-0x0000000002EC0000-memory.dmp

Filesize
512KB

Download
memory/2636-138-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

Filesize
9.6MB

Download
memory/2636-136-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

Filesize
9.6MB

Download
memory/2636-15-0x000007FEF5FAE000-0x000007FEF5FAF000-memory.dmp

Filesize
4KB

Download
memory/2636-451-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

Filesize
9.6MB

Download
memory/2636-127-0x00000000020C0000-0x00000000020C8000-memory.dmp

Filesize
32KB

Download
memory/2708-142-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/2708-5717-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/2712-5705-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-140-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2892-5723-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2892-158-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2904-5718-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2904-147-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2984-177-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2984-164-0x0000000003630000-0x0000000003A22000-memory.dmp

Filesize
3.9MB

Download
memory/2984-149-0x0000000003630000-0x0000000003A22000-memory.dmp

Filesize
3.9MB

Download
memory/2984-179-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2984-181-0x00000000030C0000-0x00000000034B2000-memory.dmp

Filesize
3.9MB

Download
memory/2984-0-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2984-5694-0x0000000003630000-0x0000000003A22000-memory.dmp

Filesize
3.9MB

Download
memory/2984-1-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2984-146-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2984-156-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2984-143-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2984-154-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2984-144-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2984-141-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/2984-12-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2984-139-0x00000000030C0000-0x00000000034B2000-memory.dmp

Filesize
3.9MB

Download
memory/3016-137-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/3016-5697-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download