xmrig | ac63bb8cfb8b90a6bbdf1ccb42bf4930d2cf4fff088002f80e1fb62debf93ec3

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
Size

2.9MB
MD5

3d1b47880d95a91e8f6aa23b092e35ee
SHA1

13490fb6f8450179043f7865492a9bf44aeb3a16
SHA256

ac63bb8cfb8b90a6bbdf1ccb42bf4930d2cf4fff088002f80e1fb62debf93ec3
SHA512

3c5b4d01dfcc02bf3cfb6b536cd8006e75e561d93e04446fe65a4cb238d3998deaaf3305e11499fc52619a5df181861a981fdfa8be51571beb38035ec21db55c
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5I/49Mw:NABJ

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral1/memory/2000-30-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/2644-41-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig
behavioral1/memory/2580-34-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig
behavioral1/memory/2532-27-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2864-93-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/2680-927-0x000000013F940000-0x000000013FD32000-memory.dmp	xmrig
behavioral1/memory/2000-95-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/2580-91-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig
behavioral1/memory/2612-74-0x000000013FEC0000-0x00000001402B2000-memory.dmp	xmrig
behavioral1/memory/2612-72-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2324-87-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/2192-61-0x000000013F660000-0x000000013FA52000-memory.dmp	xmrig
behavioral1/memory/2864-5915-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/2532-5939-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2964-6016-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2612-12539-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2280	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2324	mthYXfe.exe
2532	zyVbuBv.exe
2000	FkokYuF.exe
2580	tyHoeud.exe
2644	zCrSZUJ.exe
2680	TomBRSj.exe
2192	nmAsCWF.exe
2964	lntQdyX.exe
2548	EKoYiWI.exe
1860	sQsjvqb.exe
2864	jUvqevZ.exe
2756	AIHZBEu.exe
2904	lxNVPXl.exe
1920	wCNVlFz.exe
2300	PSXObfP.exe
1520	MtPhFDU.exe
360	LVrzRuR.exe
1316	fIKJRrL.exe
1280	CjgEQNI.exe
808	HdmsYzG.exe
868	XMfbxog.exe
2804	PCkXxZS.exe
2216	vQPdbkC.exe
1808	oppCQhx.exe
2012	PijMJtl.exe
496	XBxenCI.exe
1088	LKeeQez.exe
2976	MnYfVgn.exe
1792	uAGLIRm.exe
632	WdlMyUg.exe
688	EzlOkge.exe
3048	YZRXjaA.exe
3012	DBnjWPK.exe
1264	luZNgDd.exe
1252	GeAHjeF.exe
1048	KDxuTmt.exe
1584	MfxhvIc.exe
572	QJwwBQO.exe
2016	PeTSUmv.exe
880	hIAomoK.exe
604	kNHQpsQ.exe
2092	yXKbRqA.exe
888	JTvxPZL.exe
2852	yKByHWi.exe
1572	KslGzkA.exe
2116	YkFDBZu.exe
2648	ltSIuiX.exe
2616	jPQqtMO.exe
2884	ZclORGY.exe
2312	UzsOkgt.exe
1672	PSzKxpD.exe
2272	zJqtSim.exe
1796	VSSMsAT.exe
2084	JmarGiB.exe
536	fInLojq.exe
3016	tPLQFox.exe
1504	tERBUem.exe
2632	tuDVXXY.exe
356	OaEDGmH.exe
780	jVGtCsq.exe
2536	tWIVuAl.exe
1536	nGRoSdm.exe
1332	WkfJJLv.exe
2128	MSbPsQv.exe

Loads dropped DLL 64 IoCs

pid	Process
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2612-1-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/files/0x000d000000012350-3.dat	upx
behavioral1/files/0x0008000000014a9a-14.dat	upx
behavioral1/files/0x0037000000014712-8.dat	upx
behavioral1/files/0x0007000000014b4c-20.dat	upx
behavioral1/memory/2324-25-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/2000-30-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/files/0x0007000000014e71-46.dat	upx
behavioral1/files/0x0007000000014bbc-44.dat	upx
behavioral1/memory/2680-45-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/memory/2644-41-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/memory/2580-34-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/memory/2532-27-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/files/0x0007000000014b18-26.dat	upx
behavioral1/files/0x0008000000015d20-62.dat	upx
behavioral1/files/0x000e0000000054ab-66.dat	upx
behavioral1/memory/2548-67-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/files/0x0006000000015d56-79.dat	upx
behavioral1/files/0x0006000000015d4e-76.dat	upx
behavioral1/memory/2864-93-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/files/0x003700000001471a-105.dat	upx
behavioral1/files/0x0006000000015f65-129.dat	upx
behavioral1/files/0x0006000000015fe5-146.dat	upx
behavioral1/files/0x0006000000015d93-116.dat	upx
behavioral1/files/0x0006000000015e32-124.dat	upx
behavioral1/files/0x0006000000015ecc-123.dat	upx
behavioral1/files/0x0006000000015d7f-111.dat	upx
behavioral1/files/0x000600000001610f-142.dat	upx
behavioral1/files/0x0006000000015d87-114.dat	upx
behavioral1/files/0x000600000001621e-147.dat	upx
behavioral1/files/0x0006000000016851-175.dat	upx
behavioral1/files/0x0006000000016c44-185.dat	upx
behavioral1/files/0x0006000000016c5e-187.dat	upx
behavioral1/memory/2680-927-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/files/0x0006000000016adc-180.dat	upx
behavioral1/files/0x0006000000016c64-191.dat	upx
behavioral1/files/0x0006000000016616-170.dat	upx
behavioral1/files/0x000600000001658a-165.dat	upx
behavioral1/files/0x00060000000164aa-161.dat	upx
behavioral1/files/0x000600000001630a-155.dat	upx
behavioral1/files/0x0006000000015d6b-101.dat	upx
behavioral1/memory/2000-95-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/memory/2580-91-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/files/0x0006000000015d5f-90.dat	upx
behavioral1/memory/1860-75-0x000000013FEC0000-0x00000001402B2000-memory.dmp	upx
behavioral1/memory/2612-72-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/2324-87-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/files/0x0006000000015d42-70.dat	upx
behavioral1/memory/2964-65-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2192-61-0x000000013F660000-0x000000013FA52000-memory.dmp	upx
behavioral1/memory/2864-5915-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/memory/2532-5939-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/2964-6016-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WVddjjQ.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\BfndEQi.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\yHiWkab.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\fSnoswS.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\tWrkjUl.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\wQlQQVh.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\xhCLsLr.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\SnhqXjG.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\jgMvtWo.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\PUWjwXW.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\AtoVIQe.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\NFTptDK.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\QkANFfD.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\IWQOASl.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\PHCAiXM.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\NSepuge.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\PNzisgU.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\xidrKdZ.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\HnMBdIL.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\IKspvPs.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\vdCpYIE.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\YEKVmFD.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\xAUUWrU.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\JYfndro.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\PTFrMti.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\kNHQpsQ.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\cHHPjCd.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\uBPaPWn.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\LqkoyeX.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\zcjAyAj.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\PbGwLnf.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\OvicPmP.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\vJevCYG.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\szGKaVa.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\sOzVKWq.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\QCqkyYr.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\yNVfIxb.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\shHeijo.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\fYmXNmg.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\pEYzYce.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\fUtDPsu.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\lcHnjuu.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\RMXeVDZ.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\jHkUczD.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\BFfvMou.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\yziRVJY.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\UeUMcqo.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\DDfjmkc.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\zQyKFkv.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\WtBAQYC.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\BwSRWyx.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\PszROjo.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\Glxlimn.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\QYhWHdC.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\rJLNOHr.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\NmjxSUF.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\cpdvpjX.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\FQSFXnc.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\znEVWfe.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\LrsmmAO.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\mmxJdbt.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\QgjfYMi.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\rqMWXqI.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
File created	C:\Windows\System\ZHquWzF.exe	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2280	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
Token: SeDebugPrivilege	2280	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2280	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	29
PID 2612 wrote to memory of 2280	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	29
PID 2612 wrote to memory of 2280	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	29
PID 2612 wrote to memory of 2324	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	30
PID 2612 wrote to memory of 2324	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	30
PID 2612 wrote to memory of 2324	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	30
PID 2612 wrote to memory of 2000	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	31
PID 2612 wrote to memory of 2000	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	31
PID 2612 wrote to memory of 2000	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	31
PID 2612 wrote to memory of 2532	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	32
PID 2612 wrote to memory of 2532	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	32
PID 2612 wrote to memory of 2532	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	32
PID 2612 wrote to memory of 2644	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	33
PID 2612 wrote to memory of 2644	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	33
PID 2612 wrote to memory of 2644	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	33
PID 2612 wrote to memory of 2580	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	34
PID 2612 wrote to memory of 2580	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	34
PID 2612 wrote to memory of 2580	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	34
PID 2612 wrote to memory of 2680	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	35
PID 2612 wrote to memory of 2680	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	35
PID 2612 wrote to memory of 2680	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	35
PID 2612 wrote to memory of 2192	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	36
PID 2612 wrote to memory of 2192	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	36
PID 2612 wrote to memory of 2192	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	36
PID 2612 wrote to memory of 2548	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	37
PID 2612 wrote to memory of 2548	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	37
PID 2612 wrote to memory of 2548	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	37
PID 2612 wrote to memory of 2964	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	38
PID 2612 wrote to memory of 2964	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	38
PID 2612 wrote to memory of 2964	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	38
PID 2612 wrote to memory of 1860	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	39
PID 2612 wrote to memory of 1860	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	39
PID 2612 wrote to memory of 1860	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	39
PID 2612 wrote to memory of 2756	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	40
PID 2612 wrote to memory of 2756	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	40
PID 2612 wrote to memory of 2756	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	40
PID 2612 wrote to memory of 2864	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	41
PID 2612 wrote to memory of 2864	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	41
PID 2612 wrote to memory of 2864	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	41
PID 2612 wrote to memory of 2904	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	42
PID 2612 wrote to memory of 2904	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	42
PID 2612 wrote to memory of 2904	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	42
PID 2612 wrote to memory of 1920	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	43
PID 2612 wrote to memory of 1920	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	43
PID 2612 wrote to memory of 1920	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	43
PID 2612 wrote to memory of 2300	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	44
PID 2612 wrote to memory of 2300	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	44
PID 2612 wrote to memory of 2300	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	44
PID 2612 wrote to memory of 1520	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	45
PID 2612 wrote to memory of 1520	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	45
PID 2612 wrote to memory of 1520	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	45
PID 2612 wrote to memory of 360	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	46
PID 2612 wrote to memory of 360	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	46
PID 2612 wrote to memory of 360	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	46
PID 2612 wrote to memory of 808	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	47
PID 2612 wrote to memory of 808	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	47
PID 2612 wrote to memory of 808	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	47
PID 2612 wrote to memory of 1316	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	48
PID 2612 wrote to memory of 1316	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	48
PID 2612 wrote to memory of 1316	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	48
PID 2612 wrote to memory of 868	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	49
PID 2612 wrote to memory of 868	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	49
PID 2612 wrote to memory of 868	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	49
PID 2612 wrote to memory of 1280	2612	3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d1b47880d95a91e8f6aa23b092e35ee_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2280
- C:\Windows\System\mthYXfe.exe
  C:\Windows\System\mthYXfe.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\FkokYuF.exe
  C:\Windows\System\FkokYuF.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\zyVbuBv.exe
  C:\Windows\System\zyVbuBv.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\zCrSZUJ.exe
  C:\Windows\System\zCrSZUJ.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\tyHoeud.exe
  C:\Windows\System\tyHoeud.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\TomBRSj.exe
  C:\Windows\System\TomBRSj.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\nmAsCWF.exe
  C:\Windows\System\nmAsCWF.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\EKoYiWI.exe
  C:\Windows\System\EKoYiWI.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\lntQdyX.exe
  C:\Windows\System\lntQdyX.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\sQsjvqb.exe
  C:\Windows\System\sQsjvqb.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\AIHZBEu.exe
  C:\Windows\System\AIHZBEu.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\jUvqevZ.exe
  C:\Windows\System\jUvqevZ.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\lxNVPXl.exe
  C:\Windows\System\lxNVPXl.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\wCNVlFz.exe
  C:\Windows\System\wCNVlFz.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\PSXObfP.exe
  C:\Windows\System\PSXObfP.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\MtPhFDU.exe
  C:\Windows\System\MtPhFDU.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\LVrzRuR.exe
  C:\Windows\System\LVrzRuR.exe
  2⤵
  - Executes dropped EXE
  PID:360
- C:\Windows\System\HdmsYzG.exe
  C:\Windows\System\HdmsYzG.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\fIKJRrL.exe
  C:\Windows\System\fIKJRrL.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\XMfbxog.exe
  C:\Windows\System\XMfbxog.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\CjgEQNI.exe
  C:\Windows\System\CjgEQNI.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\vQPdbkC.exe
  C:\Windows\System\vQPdbkC.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\PCkXxZS.exe
  C:\Windows\System\PCkXxZS.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\oppCQhx.exe
  C:\Windows\System\oppCQhx.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\PijMJtl.exe
  C:\Windows\System\PijMJtl.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\XBxenCI.exe
  C:\Windows\System\XBxenCI.exe
  2⤵
  - Executes dropped EXE
  PID:496
- C:\Windows\System\LKeeQez.exe
  C:\Windows\System\LKeeQez.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\MnYfVgn.exe
  C:\Windows\System\MnYfVgn.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\uAGLIRm.exe
  C:\Windows\System\uAGLIRm.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\WdlMyUg.exe
  C:\Windows\System\WdlMyUg.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\EzlOkge.exe
  C:\Windows\System\EzlOkge.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\DBnjWPK.exe
  C:\Windows\System\DBnjWPK.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\YZRXjaA.exe
  C:\Windows\System\YZRXjaA.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\hIAomoK.exe
  C:\Windows\System\hIAomoK.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\luZNgDd.exe
  C:\Windows\System\luZNgDd.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\nGRoSdm.exe
  C:\Windows\System\nGRoSdm.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\GeAHjeF.exe
  C:\Windows\System\GeAHjeF.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\WkfJJLv.exe
  C:\Windows\System\WkfJJLv.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\KDxuTmt.exe
  C:\Windows\System\KDxuTmt.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\MSbPsQv.exe
  C:\Windows\System\MSbPsQv.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\MfxhvIc.exe
  C:\Windows\System\MfxhvIc.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\pTcNyok.exe
  C:\Windows\System\pTcNyok.exe
  2⤵
  PID:332
- C:\Windows\System\QJwwBQO.exe
  C:\Windows\System\QJwwBQO.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\oFESxph.exe
  C:\Windows\System\oFESxph.exe
  2⤵
  PID:2352
- C:\Windows\System\PeTSUmv.exe
  C:\Windows\System\PeTSUmv.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\jcOZeKG.exe
  C:\Windows\System\jcOZeKG.exe
  2⤵
  PID:472
- C:\Windows\System\kNHQpsQ.exe
  C:\Windows\System\kNHQpsQ.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\vnWTaMv.exe
  C:\Windows\System\vnWTaMv.exe
  2⤵
  PID:2176
- C:\Windows\System\yXKbRqA.exe
  C:\Windows\System\yXKbRqA.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\navWJYF.exe
  C:\Windows\System\navWJYF.exe
  2⤵
  PID:1916
- C:\Windows\System\JTvxPZL.exe
  C:\Windows\System\JTvxPZL.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\JYRYyEn.exe
  C:\Windows\System\JYRYyEn.exe
  2⤵
  PID:2792
- C:\Windows\System\yKByHWi.exe
  C:\Windows\System\yKByHWi.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\HcUnAzW.exe
  C:\Windows\System\HcUnAzW.exe
  2⤵
  PID:2836
- C:\Windows\System\KslGzkA.exe
  C:\Windows\System\KslGzkA.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\PPFPBCv.exe
  C:\Windows\System\PPFPBCv.exe
  2⤵
  PID:1600
- C:\Windows\System\YkFDBZu.exe
  C:\Windows\System\YkFDBZu.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\eqASPAZ.exe
  C:\Windows\System\eqASPAZ.exe
  2⤵
  PID:2560
- C:\Windows\System\ltSIuiX.exe
  C:\Windows\System\ltSIuiX.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\cQLBGgu.exe
  C:\Windows\System\cQLBGgu.exe
  2⤵
  PID:2356
- C:\Windows\System\jPQqtMO.exe
  C:\Windows\System\jPQqtMO.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\hpXEshc.exe
  C:\Windows\System\hpXEshc.exe
  2⤵
  PID:2492
- C:\Windows\System\ZclORGY.exe
  C:\Windows\System\ZclORGY.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\SKKEKVT.exe
  C:\Windows\System\SKKEKVT.exe
  2⤵
  PID:2676
- C:\Windows\System\UzsOkgt.exe
  C:\Windows\System\UzsOkgt.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\BTTpmqY.exe
  C:\Windows\System\BTTpmqY.exe
  2⤵
  PID:2724
- C:\Windows\System\PSzKxpD.exe
  C:\Windows\System\PSzKxpD.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\Rdeycia.exe
  C:\Windows\System\Rdeycia.exe
  2⤵
  PID:624
- C:\Windows\System\zJqtSim.exe
  C:\Windows\System\zJqtSim.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\MkZRSgJ.exe
  C:\Windows\System\MkZRSgJ.exe
  2⤵
  PID:1604
- C:\Windows\System\VSSMsAT.exe
  C:\Windows\System\VSSMsAT.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\jcwBTbu.exe
  C:\Windows\System\jcwBTbu.exe
  2⤵
  PID:2608
- C:\Windows\System\JmarGiB.exe
  C:\Windows\System\JmarGiB.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\kBjVtjn.exe
  C:\Windows\System\kBjVtjn.exe
  2⤵
  PID:2480
- C:\Windows\System\fInLojq.exe
  C:\Windows\System\fInLojq.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\RAUlYma.exe
  C:\Windows\System\RAUlYma.exe
  2⤵
  PID:956
- C:\Windows\System\tPLQFox.exe
  C:\Windows\System\tPLQFox.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\shxKhIs.exe
  C:\Windows\System\shxKhIs.exe
  2⤵
  PID:2396
- C:\Windows\System\tERBUem.exe
  C:\Windows\System\tERBUem.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\sKELztQ.exe
  C:\Windows\System\sKELztQ.exe
  2⤵
  PID:2564
- C:\Windows\System\tuDVXXY.exe
  C:\Windows\System\tuDVXXY.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\wkAqesf.exe
  C:\Windows\System\wkAqesf.exe
  2⤵
  PID:1336
- C:\Windows\System\OaEDGmH.exe
  C:\Windows\System\OaEDGmH.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\uFBWutK.exe
  C:\Windows\System\uFBWutK.exe
  2⤵
  PID:3028
- C:\Windows\System\jVGtCsq.exe
  C:\Windows\System\jVGtCsq.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\aMnGqWr.exe
  C:\Windows\System\aMnGqWr.exe
  2⤵
  PID:1500
- C:\Windows\System\tWIVuAl.exe
  C:\Windows\System\tWIVuAl.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\vsIcJvR.exe
  C:\Windows\System\vsIcJvR.exe
  2⤵
  PID:1492
- C:\Windows\System\nJKksSk.exe
  C:\Windows\System\nJKksSk.exe
  2⤵
  PID:2412
- C:\Windows\System\lMcSNBm.exe
  C:\Windows\System\lMcSNBm.exe
  2⤵
  PID:668
- C:\Windows\System\tLiiXfh.exe
  C:\Windows\System\tLiiXfh.exe
  2⤵
  PID:916
- C:\Windows\System\PQmsJgg.exe
  C:\Windows\System\PQmsJgg.exe
  2⤵
  PID:2076
- C:\Windows\System\DDfjmkc.exe
  C:\Windows\System\DDfjmkc.exe
  2⤵
  PID:1768
- C:\Windows\System\qOrfRsR.exe
  C:\Windows\System\qOrfRsR.exe
  2⤵
  PID:812
- C:\Windows\System\AEsOrzF.exe
  C:\Windows\System\AEsOrzF.exe
  2⤵
  PID:912
- C:\Windows\System\ABHdzRs.exe
  C:\Windows\System\ABHdzRs.exe
  2⤵
  PID:2004
- C:\Windows\System\PoMMIFY.exe
  C:\Windows\System\PoMMIFY.exe
  2⤵
  PID:2948
- C:\Windows\System\VNEtJcL.exe
  C:\Windows\System\VNEtJcL.exe
  2⤵
  PID:2476
- C:\Windows\System\NFTptDK.exe
  C:\Windows\System\NFTptDK.exe
  2⤵
  PID:2928
- C:\Windows\System\tKkdGyY.exe
  C:\Windows\System\tKkdGyY.exe
  2⤵
  PID:1392
- C:\Windows\System\KaqaqPW.exe
  C:\Windows\System\KaqaqPW.exe
  2⤵
  PID:2268
- C:\Windows\System\qamKbXu.exe
  C:\Windows\System\qamKbXu.exe
  2⤵
  PID:2808
- C:\Windows\System\KaFNdEf.exe
  C:\Windows\System\KaFNdEf.exe
  2⤵
  PID:2388
- C:\Windows\System\nnNdrVf.exe
  C:\Windows\System\nnNdrVf.exe
  2⤵
  PID:2692
- C:\Windows\System\hsxZLgK.exe
  C:\Windows\System\hsxZLgK.exe
  2⤵
  PID:2348
- C:\Windows\System\fRBSzbD.exe
  C:\Windows\System\fRBSzbD.exe
  2⤵
  PID:2288
- C:\Windows\System\itkhcQe.exe
  C:\Windows\System\itkhcQe.exe
  2⤵
  PID:1652
- C:\Windows\System\sdPrOok.exe
  C:\Windows\System\sdPrOok.exe
  2⤵
  PID:2784
- C:\Windows\System\knRtoWZ.exe
  C:\Windows\System\knRtoWZ.exe
  2⤵
  PID:2780
- C:\Windows\System\hDQMdGi.exe
  C:\Windows\System\hDQMdGi.exe
  2⤵
  PID:1656
- C:\Windows\System\BwZomtx.exe
  C:\Windows\System\BwZomtx.exe
  2⤵
  PID:1552
- C:\Windows\System\KoSEIkr.exe
  C:\Windows\System\KoSEIkr.exe
  2⤵
  PID:2960
- C:\Windows\System\vGqpAJY.exe
  C:\Windows\System\vGqpAJY.exe
  2⤵
  PID:2340
- C:\Windows\System\QbXFgJU.exe
  C:\Windows\System\QbXFgJU.exe
  2⤵
  PID:2828
- C:\Windows\System\MnWIuHJ.exe
  C:\Windows\System\MnWIuHJ.exe
  2⤵
  PID:1324
- C:\Windows\System\MyPHVif.exe
  C:\Windows\System\MyPHVif.exe
  2⤵
  PID:2520
- C:\Windows\System\qgWdlXU.exe
  C:\Windows\System\qgWdlXU.exe
  2⤵
  PID:1952
- C:\Windows\System\KtEszTV.exe
  C:\Windows\System\KtEszTV.exe
  2⤵
  PID:932
- C:\Windows\System\CYHuOQN.exe
  C:\Windows\System\CYHuOQN.exe
  2⤵
  PID:2932
- C:\Windows\System\YIqiIIF.exe
  C:\Windows\System\YIqiIIF.exe
  2⤵
  PID:2844
- C:\Windows\System\SLKxneE.exe
  C:\Windows\System\SLKxneE.exe
  2⤵
  PID:1636
- C:\Windows\System\jJmWpIH.exe
  C:\Windows\System\jJmWpIH.exe
  2⤵
  PID:2800
- C:\Windows\System\OSCrcAC.exe
  C:\Windows\System\OSCrcAC.exe
  2⤵
  PID:2704
- C:\Windows\System\sdroukK.exe
  C:\Windows\System\sdroukK.exe
  2⤵
  PID:1040
- C:\Windows\System\xYyPIdm.exe
  C:\Windows\System\xYyPIdm.exe
  2⤵
  PID:2152
- C:\Windows\System\jtnVBSA.exe
  C:\Windows\System\jtnVBSA.exe
  2⤵
  PID:1720
- C:\Windows\System\JXASYvU.exe
  C:\Windows\System\JXASYvU.exe
  2⤵
  PID:1620
- C:\Windows\System\NeBBGcs.exe
  C:\Windows\System\NeBBGcs.exe
  2⤵
  PID:2464
- C:\Windows\System\KIfyZxu.exe
  C:\Windows\System\KIfyZxu.exe
  2⤵
  PID:2432
- C:\Windows\System\SGEzDdb.exe
  C:\Windows\System\SGEzDdb.exe
  2⤵
  PID:1688
- C:\Windows\System\zimHgQX.exe
  C:\Windows\System\zimHgQX.exe
  2⤵
  PID:2468
- C:\Windows\System\iGVWflR.exe
  C:\Windows\System\iGVWflR.exe
  2⤵
  PID:2788
- C:\Windows\System\FRMTsoz.exe
  C:\Windows\System\FRMTsoz.exe
  2⤵
  PID:1992
- C:\Windows\System\bLwuQOq.exe
  C:\Windows\System\bLwuQOq.exe
  2⤵
  PID:3088
- C:\Windows\System\rsMksjL.exe
  C:\Windows\System\rsMksjL.exe
  2⤵
  PID:3104
- C:\Windows\System\qnujUsQ.exe
  C:\Windows\System\qnujUsQ.exe
  2⤵
  PID:3120
- C:\Windows\System\EbAVwqi.exe
  C:\Windows\System\EbAVwqi.exe
  2⤵
  PID:3136
- C:\Windows\System\RErwFLC.exe
  C:\Windows\System\RErwFLC.exe
  2⤵
  PID:3152
- C:\Windows\System\YUdKhAe.exe
  C:\Windows\System\YUdKhAe.exe
  2⤵
  PID:3168
- C:\Windows\System\nIFELhs.exe
  C:\Windows\System\nIFELhs.exe
  2⤵
  PID:3184
- C:\Windows\System\OyGbpoB.exe
  C:\Windows\System\OyGbpoB.exe
  2⤵
  PID:3200
- C:\Windows\System\AgNSLkv.exe
  C:\Windows\System\AgNSLkv.exe
  2⤵
  PID:3216
- C:\Windows\System\xNzFfFQ.exe
  C:\Windows\System\xNzFfFQ.exe
  2⤵
  PID:3232
- C:\Windows\System\izcCIyw.exe
  C:\Windows\System\izcCIyw.exe
  2⤵
  PID:3248
- C:\Windows\System\RnYfioI.exe
  C:\Windows\System\RnYfioI.exe
  2⤵
  PID:3264
- C:\Windows\System\yEFuXzw.exe
  C:\Windows\System\yEFuXzw.exe
  2⤵
  PID:3280
- C:\Windows\System\ORVPmDq.exe
  C:\Windows\System\ORVPmDq.exe
  2⤵
  PID:3296
- C:\Windows\System\oorJFFf.exe
  C:\Windows\System\oorJFFf.exe
  2⤵
  PID:3312
- C:\Windows\System\yMOzYzI.exe
  C:\Windows\System\yMOzYzI.exe
  2⤵
  PID:3328
- C:\Windows\System\FrDAiNL.exe
  C:\Windows\System\FrDAiNL.exe
  2⤵
  PID:3344
- C:\Windows\System\CRkzAEm.exe
  C:\Windows\System\CRkzAEm.exe
  2⤵
  PID:3360
- C:\Windows\System\czywtUd.exe
  C:\Windows\System\czywtUd.exe
  2⤵
  PID:3376
- C:\Windows\System\yqisYDx.exe
  C:\Windows\System\yqisYDx.exe
  2⤵
  PID:3392
- C:\Windows\System\UQOQevp.exe
  C:\Windows\System\UQOQevp.exe
  2⤵
  PID:3408
- C:\Windows\System\cppsSqA.exe
  C:\Windows\System\cppsSqA.exe
  2⤵
  PID:3424
- C:\Windows\System\ppdJPUr.exe
  C:\Windows\System\ppdJPUr.exe
  2⤵
  PID:3440
- C:\Windows\System\SyywXEy.exe
  C:\Windows\System\SyywXEy.exe
  2⤵
  PID:3456
- C:\Windows\System\FNOphmA.exe
  C:\Windows\System\FNOphmA.exe
  2⤵
  PID:3472
- C:\Windows\System\HlsPabq.exe
  C:\Windows\System\HlsPabq.exe
  2⤵
  PID:3488
- C:\Windows\System\BixtrWx.exe
  C:\Windows\System\BixtrWx.exe
  2⤵
  PID:3504
- C:\Windows\System\IyTFTQW.exe
  C:\Windows\System\IyTFTQW.exe
  2⤵
  PID:3564
- C:\Windows\System\KzaQgGf.exe
  C:\Windows\System\KzaQgGf.exe
  2⤵
  PID:3584
- C:\Windows\System\SrjixJU.exe
  C:\Windows\System\SrjixJU.exe
  2⤵
  PID:3600
- C:\Windows\System\KdjwmXd.exe
  C:\Windows\System\KdjwmXd.exe
  2⤵
  PID:3832
- C:\Windows\System\TmjzYrT.exe
  C:\Windows\System\TmjzYrT.exe
  2⤵
  PID:3848
- C:\Windows\System\aCdCSEs.exe
  C:\Windows\System\aCdCSEs.exe
  2⤵
  PID:3864
- C:\Windows\System\RDBbPHa.exe
  C:\Windows\System\RDBbPHa.exe
  2⤵
  PID:3880
- C:\Windows\System\PMkMpMr.exe
  C:\Windows\System\PMkMpMr.exe
  2⤵
  PID:3896
- C:\Windows\System\WVwpTMR.exe
  C:\Windows\System\WVwpTMR.exe
  2⤵
  PID:3912
- C:\Windows\System\zjZgTgb.exe
  C:\Windows\System\zjZgTgb.exe
  2⤵
  PID:3928
- C:\Windows\System\ZSVPRra.exe
  C:\Windows\System\ZSVPRra.exe
  2⤵
  PID:3944
- C:\Windows\System\oESLYTW.exe
  C:\Windows\System\oESLYTW.exe
  2⤵
  PID:3960
- C:\Windows\System\FQWqeaH.exe
  C:\Windows\System\FQWqeaH.exe
  2⤵
  PID:3976
- C:\Windows\System\Ogniuzj.exe
  C:\Windows\System\Ogniuzj.exe
  2⤵
  PID:3992
- C:\Windows\System\BefndDL.exe
  C:\Windows\System\BefndDL.exe
  2⤵
  PID:4008
- C:\Windows\System\iOpqdOs.exe
  C:\Windows\System\iOpqdOs.exe
  2⤵
  PID:4024
- C:\Windows\System\fAzXHQt.exe
  C:\Windows\System\fAzXHQt.exe
  2⤵
  PID:4040
- C:\Windows\System\bFYRisL.exe
  C:\Windows\System\bFYRisL.exe
  2⤵
  PID:4056
- C:\Windows\System\BEUZYEr.exe
  C:\Windows\System\BEUZYEr.exe
  2⤵
  PID:4072
- C:\Windows\System\hDlNoON.exe
  C:\Windows\System\hDlNoON.exe
  2⤵
  PID:4088
- C:\Windows\System\nTFGCPe.exe
  C:\Windows\System\nTFGCPe.exe
  2⤵
  PID:1668
- C:\Windows\System\UZkFTwW.exe
  C:\Windows\System\UZkFTwW.exe
  2⤵
  PID:844
- C:\Windows\System\duBarQp.exe
  C:\Windows\System\duBarQp.exe
  2⤵
  PID:2696
- C:\Windows\System\lShftcj.exe
  C:\Windows\System\lShftcj.exe
  2⤵
  PID:2500
- C:\Windows\System\aksDWHM.exe
  C:\Windows\System\aksDWHM.exe
  2⤵
  PID:2140
- C:\Windows\System\xBmXtDi.exe
  C:\Windows\System\xBmXtDi.exe
  2⤵
  PID:2028
- C:\Windows\System\LIgcGhB.exe
  C:\Windows\System\LIgcGhB.exe
  2⤵
  PID:1236
- C:\Windows\System\gokKSYk.exe
  C:\Windows\System\gokKSYk.exe
  2⤵
  PID:3064
- C:\Windows\System\EFWtKRu.exe
  C:\Windows\System\EFWtKRu.exe
  2⤵
  PID:3128
- C:\Windows\System\oDXNUsm.exe
  C:\Windows\System\oDXNUsm.exe
  2⤵
  PID:3132
- C:\Windows\System\AtovJNG.exe
  C:\Windows\System\AtovJNG.exe
  2⤵
  PID:3208
- C:\Windows\System\ZPecyWG.exe
  C:\Windows\System\ZPecyWG.exe
  2⤵
  PID:3192
- C:\Windows\System\kfTLUzp.exe
  C:\Windows\System\kfTLUzp.exe
  2⤵
  PID:3240
- C:\Windows\System\PqPjXPF.exe
  C:\Windows\System\PqPjXPF.exe
  2⤵
  PID:3276
- C:\Windows\System\dDTdRyO.exe
  C:\Windows\System\dDTdRyO.exe
  2⤵
  PID:3384
- C:\Windows\System\HuZOkcz.exe
  C:\Windows\System\HuZOkcz.exe
  2⤵
  PID:3432
- C:\Windows\System\AdHiKho.exe
  C:\Windows\System\AdHiKho.exe
  2⤵
  PID:3496
- C:\Windows\System\KIrqcxw.exe
  C:\Windows\System\KIrqcxw.exe
  2⤵
  PID:3416
- C:\Windows\System\rYiUNqW.exe
  C:\Windows\System\rYiUNqW.exe
  2⤵
  PID:3452
- C:\Windows\System\TXrrjHq.exe
  C:\Windows\System\TXrrjHq.exe
  2⤵
  PID:3548
- C:\Windows\System\DyxzkGN.exe
  C:\Windows\System\DyxzkGN.exe
  2⤵
  PID:3532
- C:\Windows\System\LrGONma.exe
  C:\Windows\System\LrGONma.exe
  2⤵
  PID:3552
- C:\Windows\System\uWWjCEe.exe
  C:\Windows\System\uWWjCEe.exe
  2⤵
  PID:3580
- C:\Windows\System\FuGeEcl.exe
  C:\Windows\System\FuGeEcl.exe
  2⤵
  PID:824
- C:\Windows\System\BmchtXS.exe
  C:\Windows\System\BmchtXS.exe
  2⤵
  PID:3612
- C:\Windows\System\PtiTaVw.exe
  C:\Windows\System\PtiTaVw.exe
  2⤵
  PID:3628
- C:\Windows\System\xUqoCGI.exe
  C:\Windows\System\xUqoCGI.exe
  2⤵
  PID:3640
- C:\Windows\System\kNdvJSR.exe
  C:\Windows\System\kNdvJSR.exe
  2⤵
  PID:3660
- C:\Windows\System\xNwIGuD.exe
  C:\Windows\System\xNwIGuD.exe
  2⤵
  PID:3676
- C:\Windows\System\NYEbSaB.exe
  C:\Windows\System\NYEbSaB.exe
  2⤵
  PID:3692
- C:\Windows\System\vcYVWLy.exe
  C:\Windows\System\vcYVWLy.exe
  2⤵
  PID:3708
- C:\Windows\System\OWBwxDa.exe
  C:\Windows\System\OWBwxDa.exe
  2⤵
  PID:3724
- C:\Windows\System\BLUDQfu.exe
  C:\Windows\System\BLUDQfu.exe
  2⤵
  PID:3740
- C:\Windows\System\egndCAt.exe
  C:\Windows\System\egndCAt.exe
  2⤵
  PID:3756
- C:\Windows\System\OesJrhU.exe
  C:\Windows\System\OesJrhU.exe
  2⤵
  PID:3768
- C:\Windows\System\uXOGAki.exe
  C:\Windows\System\uXOGAki.exe
  2⤵
  PID:3788
- C:\Windows\System\Inhsetw.exe
  C:\Windows\System\Inhsetw.exe
  2⤵
  PID:3804
- C:\Windows\System\BYtIzjv.exe
  C:\Windows\System\BYtIzjv.exe
  2⤵
  PID:3820
- C:\Windows\System\oYSUXQc.exe
  C:\Windows\System\oYSUXQc.exe
  2⤵
  PID:3856
- C:\Windows\System\abpZqVk.exe
  C:\Windows\System\abpZqVk.exe
  2⤵
  PID:3920
- C:\Windows\System\JqjDacJ.exe
  C:\Windows\System\JqjDacJ.exe
  2⤵
  PID:3956
- C:\Windows\System\szsziUi.exe
  C:\Windows\System\szsziUi.exe
  2⤵
  PID:4020
- C:\Windows\System\CMbGjDh.exe
  C:\Windows\System\CMbGjDh.exe
  2⤵
  PID:4084
- C:\Windows\System\wTZCvdj.exe
  C:\Windows\System\wTZCvdj.exe
  2⤵
  PID:2484
- C:\Windows\System\lKKdyUX.exe
  C:\Windows\System\lKKdyUX.exe
  2⤵
  PID:3080
- C:\Windows\System\BlrttPQ.exe
  C:\Windows\System\BlrttPQ.exe
  2⤵
  PID:3212
- C:\Windows\System\VHWxsCe.exe
  C:\Windows\System\VHWxsCe.exe
  2⤵
  PID:2540
- C:\Windows\System\qWugnIz.exe
  C:\Windows\System\qWugnIz.exe
  2⤵
  PID:2180
- C:\Windows\System\BKqZeWQ.exe
  C:\Windows\System\BKqZeWQ.exe
  2⤵
  PID:3940
- C:\Windows\System\Apgeehb.exe
  C:\Windows\System\Apgeehb.exe
  2⤵
  PID:4004
- C:\Windows\System\PbGwLnf.exe
  C:\Windows\System\PbGwLnf.exe
  2⤵
  PID:2760
- C:\Windows\System\EOGFKbc.exe
  C:\Windows\System\EOGFKbc.exe
  2⤵
  PID:1292
- C:\Windows\System\uEYRlhL.exe
  C:\Windows\System\uEYRlhL.exe
  2⤵
  PID:2772
- C:\Windows\System\oOfcacr.exe
  C:\Windows\System\oOfcacr.exe
  2⤵
  PID:3100
- C:\Windows\System\hwcfVlG.exe
  C:\Windows\System\hwcfVlG.exe
  2⤵
  PID:3224
- C:\Windows\System\qWRojXt.exe
  C:\Windows\System\qWRojXt.exe
  2⤵
  PID:3872
- C:\Windows\System\smpwDsW.exe
  C:\Windows\System\smpwDsW.exe
  2⤵
  PID:3904
- C:\Windows\System\GxtQbgf.exe
  C:\Windows\System\GxtQbgf.exe
  2⤵
  PID:3304
- C:\Windows\System\gbSeReI.exe
  C:\Windows\System\gbSeReI.exe
  2⤵
  PID:1820
- C:\Windows\System\TMxqhrg.exe
  C:\Windows\System\TMxqhrg.exe
  2⤵
  PID:3448
- C:\Windows\System\fgDkQNF.exe
  C:\Windows\System\fgDkQNF.exe
  2⤵
  PID:3336
- C:\Windows\System\OQMzzhd.exe
  C:\Windows\System\OQMzzhd.exe
  2⤵
  PID:3368
- C:\Windows\System\vxMHNwF.exe
  C:\Windows\System\vxMHNwF.exe
  2⤵
  PID:3468
- C:\Windows\System\SGgQhNh.exe
  C:\Windows\System\SGgQhNh.exe
  2⤵
  PID:1472
- C:\Windows\System\VXalyRU.exe
  C:\Windows\System\VXalyRU.exe
  2⤵
  PID:3356
- C:\Windows\System\dbcWoVl.exe
  C:\Windows\System\dbcWoVl.exe
  2⤵
  PID:3540
- C:\Windows\System\LvQBFVb.exe
  C:\Windows\System\LvQBFVb.exe
  2⤵
  PID:3636
- C:\Windows\System\rQuxyfS.exe
  C:\Windows\System\rQuxyfS.exe
  2⤵
  PID:2856
- C:\Windows\System\SDtkSFG.exe
  C:\Windows\System\SDtkSFG.exe
  2⤵
  PID:3700
- C:\Windows\System\EJBVttR.exe
  C:\Windows\System\EJBVttR.exe
  2⤵
  PID:3772
- C:\Windows\System\qLsGUYI.exe
  C:\Windows\System\qLsGUYI.exe
  2⤵
  PID:3860
- C:\Windows\System\OqmwbqY.exe
  C:\Windows\System\OqmwbqY.exe
  2⤵
  PID:4080
- C:\Windows\System\EHEkjAv.exe
  C:\Windows\System\EHEkjAv.exe
  2⤵
  PID:3732
- C:\Windows\System\wcwRoWL.exe
  C:\Windows\System\wcwRoWL.exe
  2⤵
  PID:900
- C:\Windows\System\mpDmKsq.exe
  C:\Windows\System\mpDmKsq.exe
  2⤵
  PID:3624
- C:\Windows\System\zNJUlXn.exe
  C:\Windows\System\zNJUlXn.exe
  2⤵
  PID:3596
- C:\Windows\System\MsKPwVj.exe
  C:\Windows\System\MsKPwVj.exe
  2⤵
  PID:3716
- C:\Windows\System\yjJAGrc.exe
  C:\Windows\System\yjJAGrc.exe
  2⤵
  PID:3784
- C:\Windows\System\IdvhSWW.exe
  C:\Windows\System\IdvhSWW.exe
  2⤵
  PID:3892
- C:\Windows\System\WtAFyAG.exe
  C:\Windows\System\WtAFyAG.exe
  2⤵
  PID:2244
- C:\Windows\System\xmhbHpl.exe
  C:\Windows\System\xmhbHpl.exe
  2⤵
  PID:1576
- C:\Windows\System\IIKZMVR.exe
  C:\Windows\System\IIKZMVR.exe
  2⤵
  PID:1628
- C:\Windows\System\zUsQLuu.exe
  C:\Windows\System\zUsQLuu.exe
  2⤵
  PID:1420
- C:\Windows\System\wXBZmVZ.exe
  C:\Windows\System\wXBZmVZ.exe
  2⤵
  PID:2236
- C:\Windows\System\cNfkgoh.exe
  C:\Windows\System\cNfkgoh.exe
  2⤵
  PID:3840
- C:\Windows\System\eCfJIjm.exe
  C:\Windows\System\eCfJIjm.exe
  2⤵
  PID:452
- C:\Windows\System\UgAWmzC.exe
  C:\Windows\System\UgAWmzC.exe
  2⤵
  PID:1940
- C:\Windows\System\hHDAONX.exe
  C:\Windows\System\hHDAONX.exe
  2⤵
  PID:3672
- C:\Windows\System\wucwAIm.exe
  C:\Windows\System\wucwAIm.exe
  2⤵
  PID:1960
- C:\Windows\System\dYyKODL.exe
  C:\Windows\System\dYyKODL.exe
  2⤵
  PID:1756
- C:\Windows\System\kyMaXHp.exe
  C:\Windows\System\kyMaXHp.exe
  2⤵
  PID:2428
- C:\Windows\System\UwFCZoW.exe
  C:\Windows\System\UwFCZoW.exe
  2⤵
  PID:1640
- C:\Windows\System\YDgNsEE.exe
  C:\Windows\System\YDgNsEE.exe
  2⤵
  PID:2740
- C:\Windows\System\xppGtOy.exe
  C:\Windows\System\xppGtOy.exe
  2⤵
  PID:1748
- C:\Windows\System\RYdsEeO.exe
  C:\Windows\System\RYdsEeO.exe
  2⤵
  PID:560
- C:\Windows\System\KSMKidU.exe
  C:\Windows\System\KSMKidU.exe
  2⤵
  PID:2400
- C:\Windows\System\yrotAPU.exe
  C:\Windows\System\yrotAPU.exe
  2⤵
  PID:4112
- C:\Windows\System\DEoloct.exe
  C:\Windows\System\DEoloct.exe
  2⤵
  PID:4128
- C:\Windows\System\uiFyMOp.exe
  C:\Windows\System\uiFyMOp.exe
  2⤵
  PID:4144
- C:\Windows\System\pLJBjGy.exe
  C:\Windows\System\pLJBjGy.exe
  2⤵
  PID:4160
- C:\Windows\System\VClbNDB.exe
  C:\Windows\System\VClbNDB.exe
  2⤵
  PID:4176
- C:\Windows\System\qoWJCCe.exe
  C:\Windows\System\qoWJCCe.exe
  2⤵
  PID:4192
- C:\Windows\System\ZfZNYAX.exe
  C:\Windows\System\ZfZNYAX.exe
  2⤵
  PID:4208
- C:\Windows\System\CdAVyuP.exe
  C:\Windows\System\CdAVyuP.exe
  2⤵
  PID:4224
- C:\Windows\System\aSCQVOP.exe
  C:\Windows\System\aSCQVOP.exe
  2⤵
  PID:4240
- C:\Windows\System\KPrpwyJ.exe
  C:\Windows\System\KPrpwyJ.exe
  2⤵
  PID:4256
- C:\Windows\System\kxXaNMW.exe
  C:\Windows\System\kxXaNMW.exe
  2⤵
  PID:4272
- C:\Windows\System\wBTtVHc.exe
  C:\Windows\System\wBTtVHc.exe
  2⤵
  PID:4288
- C:\Windows\System\VduVTRx.exe
  C:\Windows\System\VduVTRx.exe
  2⤵
  PID:4304
- C:\Windows\System\MkRTuyl.exe
  C:\Windows\System\MkRTuyl.exe
  2⤵
  PID:4320
- C:\Windows\System\sreubGs.exe
  C:\Windows\System\sreubGs.exe
  2⤵
  PID:4336
- C:\Windows\System\hKCPRXk.exe
  C:\Windows\System\hKCPRXk.exe
  2⤵
  PID:4352
- C:\Windows\System\kbiVirG.exe
  C:\Windows\System\kbiVirG.exe
  2⤵
  PID:4368
- C:\Windows\System\xisJHvd.exe
  C:\Windows\System\xisJHvd.exe
  2⤵
  PID:4384
- C:\Windows\System\MeOGTAq.exe
  C:\Windows\System\MeOGTAq.exe
  2⤵
  PID:4400
- C:\Windows\System\XdNLyIE.exe
  C:\Windows\System\XdNLyIE.exe
  2⤵
  PID:4416
- C:\Windows\System\xRPwkTH.exe
  C:\Windows\System\xRPwkTH.exe
  2⤵
  PID:4432
- C:\Windows\System\ayzutPK.exe
  C:\Windows\System\ayzutPK.exe
  2⤵
  PID:4448
- C:\Windows\System\TKShJZG.exe
  C:\Windows\System\TKShJZG.exe
  2⤵
  PID:4464
- C:\Windows\System\IOovgIv.exe
  C:\Windows\System\IOovgIv.exe
  2⤵
  PID:4480
- C:\Windows\System\QteoEYA.exe
  C:\Windows\System\QteoEYA.exe
  2⤵
  PID:4496
- C:\Windows\System\WEMOiGR.exe
  C:\Windows\System\WEMOiGR.exe
  2⤵
  PID:4512
- C:\Windows\System\nSFNCJz.exe
  C:\Windows\System\nSFNCJz.exe
  2⤵
  PID:4528
- C:\Windows\System\hrYXEiR.exe
  C:\Windows\System\hrYXEiR.exe
  2⤵
  PID:4544
- C:\Windows\System\Wikhiln.exe
  C:\Windows\System\Wikhiln.exe
  2⤵
  PID:4560
- C:\Windows\System\LvezQVx.exe
  C:\Windows\System\LvezQVx.exe
  2⤵
  PID:4576
- C:\Windows\System\Jrmstyn.exe
  C:\Windows\System\Jrmstyn.exe
  2⤵
  PID:4592
- C:\Windows\System\GTSeCqD.exe
  C:\Windows\System\GTSeCqD.exe
  2⤵
  PID:4608
- C:\Windows\System\hDyylGf.exe
  C:\Windows\System\hDyylGf.exe
  2⤵
  PID:4624
- C:\Windows\System\RYJKjjK.exe
  C:\Windows\System\RYJKjjK.exe
  2⤵
  PID:4640
- C:\Windows\System\gaOVYbH.exe
  C:\Windows\System\gaOVYbH.exe
  2⤵
  PID:4656
- C:\Windows\System\vKNlONg.exe
  C:\Windows\System\vKNlONg.exe
  2⤵
  PID:4672
- C:\Windows\System\hOTprsu.exe
  C:\Windows\System\hOTprsu.exe
  2⤵
  PID:4688
- C:\Windows\System\UalNAFv.exe
  C:\Windows\System\UalNAFv.exe
  2⤵
  PID:4704
- C:\Windows\System\ZTGuwej.exe
  C:\Windows\System\ZTGuwej.exe
  2⤵
  PID:4720
- C:\Windows\System\gTDyWrm.exe
  C:\Windows\System\gTDyWrm.exe
  2⤵
  PID:4736
- C:\Windows\System\OuJyUlv.exe
  C:\Windows\System\OuJyUlv.exe
  2⤵
  PID:4752
- C:\Windows\System\YUMUoVF.exe
  C:\Windows\System\YUMUoVF.exe
  2⤵
  PID:4768
- C:\Windows\System\XknWwTB.exe
  C:\Windows\System\XknWwTB.exe
  2⤵
  PID:4784
- C:\Windows\System\lLGSXqt.exe
  C:\Windows\System\lLGSXqt.exe
  2⤵
  PID:4800
- C:\Windows\System\LpWnJES.exe
  C:\Windows\System\LpWnJES.exe
  2⤵
  PID:4816
- C:\Windows\System\aokDsKH.exe
  C:\Windows\System\aokDsKH.exe
  2⤵
  PID:4832
- C:\Windows\System\QrgXmxm.exe
  C:\Windows\System\QrgXmxm.exe
  2⤵
  PID:4848
- C:\Windows\System\dyAwFAw.exe
  C:\Windows\System\dyAwFAw.exe
  2⤵
  PID:4864
- C:\Windows\System\SnhqXjG.exe
  C:\Windows\System\SnhqXjG.exe
  2⤵
  PID:4880
- C:\Windows\System\xfdhapj.exe
  C:\Windows\System\xfdhapj.exe
  2⤵
  PID:4896
- C:\Windows\System\CqXXnfA.exe
  C:\Windows\System\CqXXnfA.exe
  2⤵
  PID:4912
- C:\Windows\System\vYKgvhT.exe
  C:\Windows\System\vYKgvhT.exe
  2⤵
  PID:4928
- C:\Windows\System\RFxNqKY.exe
  C:\Windows\System\RFxNqKY.exe
  2⤵
  PID:4944
- C:\Windows\System\zaitCDd.exe
  C:\Windows\System\zaitCDd.exe
  2⤵
  PID:4960
- C:\Windows\System\oKpTJVq.exe
  C:\Windows\System\oKpTJVq.exe
  2⤵
  PID:4976
- C:\Windows\System\cmIqVqc.exe
  C:\Windows\System\cmIqVqc.exe
  2⤵
  PID:4992
- C:\Windows\System\pHatTsf.exe
  C:\Windows\System\pHatTsf.exe
  2⤵
  PID:5008
- C:\Windows\System\annSTtQ.exe
  C:\Windows\System\annSTtQ.exe
  2⤵
  PID:5024
- C:\Windows\System\SLPBgQB.exe
  C:\Windows\System\SLPBgQB.exe
  2⤵
  PID:5044
- C:\Windows\System\gPDGItq.exe
  C:\Windows\System\gPDGItq.exe
  2⤵
  PID:5060
- C:\Windows\System\DLJGaAT.exe
  C:\Windows\System\DLJGaAT.exe
  2⤵
  PID:5076
- C:\Windows\System\rywOLOf.exe
  C:\Windows\System\rywOLOf.exe
  2⤵
  PID:5092
- C:\Windows\System\QcolKUu.exe
  C:\Windows\System\QcolKUu.exe
  2⤵
  PID:5108
- C:\Windows\System\OROopgn.exe
  C:\Windows\System\OROopgn.exe
  2⤵
  PID:3608
- C:\Windows\System\EUDgzxD.exe
  C:\Windows\System\EUDgzxD.exe
  2⤵
  PID:3056
- C:\Windows\System\DWctXcj.exe
  C:\Windows\System\DWctXcj.exe
  2⤵
  PID:4064
- C:\Windows\System\ghdbZwk.exe
  C:\Windows\System\ghdbZwk.exe
  2⤵
  PID:3340
- C:\Windows\System\tRVdQvT.exe
  C:\Windows\System\tRVdQvT.exe
  2⤵
  PID:3720
- C:\Windows\System\hnBikGl.exe
  C:\Windows\System\hnBikGl.exe
  2⤵
  PID:4156
- C:\Windows\System\FuiwNrl.exe
  C:\Windows\System\FuiwNrl.exe
  2⤵
  PID:3696
- C:\Windows\System\zHSkIzy.exe
  C:\Windows\System\zHSkIzy.exe
  2⤵
  PID:4220
- C:\Windows\System\JlXQTwg.exe
  C:\Windows\System\JlXQTwg.exe
  2⤵
  PID:4108
- C:\Windows\System\gXwKvCK.exe
  C:\Windows\System\gXwKvCK.exe
  2⤵
  PID:4172
- C:\Windows\System\nSpvkCv.exe
  C:\Windows\System\nSpvkCv.exe
  2⤵
  PID:1984
- C:\Windows\System\MqjxgmG.exe
  C:\Windows\System\MqjxgmG.exe
  2⤵
  PID:3876
- C:\Windows\System\JzvmzwO.exe
  C:\Windows\System\JzvmzwO.exe
  2⤵
  PID:2264
- C:\Windows\System\UzexoOJ.exe
  C:\Windows\System\UzexoOJ.exe
  2⤵
  PID:3536
- C:\Windows\System\FASPGwb.exe
  C:\Windows\System\FASPGwb.exe
  2⤵
  PID:3272
- C:\Windows\System\tvpMscO.exe
  C:\Windows\System\tvpMscO.exe
  2⤵
  PID:4248
- C:\Windows\System\HdWVBJD.exe
  C:\Windows\System\HdWVBJD.exe
  2⤵
  PID:4300
- C:\Windows\System\YNZnajj.exe
  C:\Windows\System\YNZnajj.exe
  2⤵
  PID:4344
- C:\Windows\System\yiLUtyh.exe
  C:\Windows\System\yiLUtyh.exe
  2⤵
  PID:4408
- C:\Windows\System\hbzPJtE.exe
  C:\Windows\System\hbzPJtE.exe
  2⤵
  PID:4440
- C:\Windows\System\OALrxgV.exe
  C:\Windows\System\OALrxgV.exe
  2⤵
  PID:4504
- C:\Windows\System\nFHzQxt.exe
  C:\Windows\System\nFHzQxt.exe
  2⤵
  PID:2720
- C:\Windows\System\pnxyOIa.exe
  C:\Windows\System\pnxyOIa.exe
  2⤵
  PID:4428
- C:\Windows\System\NBSwjDS.exe
  C:\Windows\System\NBSwjDS.exe
  2⤵
  PID:4492
- C:\Windows\System\xQfzVpH.exe
  C:\Windows\System\xQfzVpH.exe
  2⤵
  PID:4540
- C:\Windows\System\pMEuUwP.exe
  C:\Windows\System\pMEuUwP.exe
  2⤵
  PID:4552
- C:\Windows\System\odnnJgS.exe
  C:\Windows\System\odnnJgS.exe
  2⤵
  PID:4572
- C:\Windows\System\oEfvctI.exe
  C:\Windows\System\oEfvctI.exe
  2⤵
  PID:4616
- C:\Windows\System\NrNOjFK.exe
  C:\Windows\System\NrNOjFK.exe
  2⤵
  PID:1304
- C:\Windows\System\HYEFlLT.exe
  C:\Windows\System\HYEFlLT.exe
  2⤵
  PID:4684
- C:\Windows\System\tTSIDkE.exe
  C:\Windows\System\tTSIDkE.exe
  2⤵
  PID:4668
- C:\Windows\System\BurRALJ.exe
  C:\Windows\System\BurRALJ.exe
  2⤵
  PID:2600
- C:\Windows\System\lIFvNLX.exe
  C:\Windows\System\lIFvNLX.exe
  2⤵
  PID:4716
- C:\Windows\System\dsfUsFR.exe
  C:\Windows\System\dsfUsFR.exe
  2⤵
  PID:4812
- C:\Windows\System\YIhKGaB.exe
  C:\Windows\System\YIhKGaB.exe
  2⤵
  PID:4732
- C:\Windows\System\AQpjIBJ.exe
  C:\Windows\System\AQpjIBJ.exe
  2⤵
  PID:4876
- C:\Windows\System\MOvSFhD.exe
  C:\Windows\System\MOvSFhD.exe
  2⤵
  PID:4844
- C:\Windows\System\PitOtLB.exe
  C:\Windows\System\PitOtLB.exe
  2⤵
  PID:4968
- C:\Windows\System\RkobLYq.exe
  C:\Windows\System\RkobLYq.exe
  2⤵
  PID:5000
- C:\Windows\System\OvicPmP.exe
  C:\Windows\System\OvicPmP.exe
  2⤵
  PID:1368
- C:\Windows\System\UKYrmKy.exe
  C:\Windows\System\UKYrmKy.exe
  2⤵
  PID:4824
- C:\Windows\System\IBnljlg.exe
  C:\Windows\System\IBnljlg.exe
  2⤵
  PID:4860
- C:\Windows\System\yWlAKha.exe
  C:\Windows\System\yWlAKha.exe
  2⤵
  PID:4952
- C:\Windows\System\rGbJwLi.exe
  C:\Windows\System\rGbJwLi.exe
  2⤵
  PID:5016
- C:\Windows\System\JBmxtIv.exe
  C:\Windows\System\JBmxtIv.exe
  2⤵
  PID:2732
- C:\Windows\System\usxakoX.exe
  C:\Windows\System\usxakoX.exe
  2⤵
  PID:5072
- C:\Windows\System\Xaqsinr.exe
  C:\Windows\System\Xaqsinr.exe
  2⤵
  PID:5104
- C:\Windows\System\SmQqhWz.exe
  C:\Windows\System\SmQqhWz.exe
  2⤵
  PID:5088
- C:\Windows\System\vOTPhSY.exe
  C:\Windows\System\vOTPhSY.exe
  2⤵
  PID:1496
- C:\Windows\System\ZOXbOAY.exe
  C:\Windows\System\ZOXbOAY.exe
  2⤵
  PID:3736
- C:\Windows\System\VEdgRCs.exe
  C:\Windows\System\VEdgRCs.exe
  2⤵
  PID:3828
- C:\Windows\System\IedZXwR.exe
  C:\Windows\System\IedZXwR.exe
  2⤵
  PID:4104
- C:\Windows\System\DpJtcoe.exe
  C:\Windows\System\DpJtcoe.exe
  2⤵
  PID:4296
- C:\Windows\System\cZDmYQF.exe
  C:\Windows\System\cZDmYQF.exe
  2⤵
  PID:4376
- C:\Windows\System\cHHPjCd.exe
  C:\Windows\System\cHHPjCd.exe
  2⤵
  PID:4424
- C:\Windows\System\ZOExfVv.exe
  C:\Windows\System\ZOExfVv.exe
  2⤵
  PID:4588
- C:\Windows\System\zcOjdDv.exe
  C:\Windows\System\zcOjdDv.exe
  2⤵
  PID:4328
- C:\Windows\System\OUSTQjY.exe
  C:\Windows\System\OUSTQjY.exe
  2⤵
  PID:4124
- C:\Windows\System\WoQhRQP.exe
  C:\Windows\System\WoQhRQP.exe
  2⤵
  PID:4168
- C:\Windows\System\bmSXvuQ.exe
  C:\Windows\System\bmSXvuQ.exe
  2⤵
  PID:3524
- C:\Windows\System\aLDIKRz.exe
  C:\Windows\System\aLDIKRz.exe
  2⤵
  PID:1548
- C:\Windows\System\AFeiijA.exe
  C:\Windows\System\AFeiijA.exe
  2⤵
  PID:4460
- C:\Windows\System\RJhpsoo.exe
  C:\Windows\System\RJhpsoo.exe
  2⤵
  PID:4604
- C:\Windows\System\xFSQPsO.exe
  C:\Windows\System\xFSQPsO.exe
  2⤵
  PID:4712
- C:\Windows\System\IXhFUrE.exe
  C:\Windows\System\IXhFUrE.exe
  2⤵
  PID:4664
- C:\Windows\System\HhDBRuF.exe
  C:\Windows\System\HhDBRuF.exe
  2⤵
  PID:4872
- C:\Windows\System\lbphXdA.exe
  C:\Windows\System\lbphXdA.exe
  2⤵
  PID:5032
- C:\Windows\System\CyaUUeV.exe
  C:\Windows\System\CyaUUeV.exe
  2⤵
  PID:4856
- C:\Windows\System\zavglzE.exe
  C:\Windows\System\zavglzE.exe
  2⤵
  PID:5036
- C:\Windows\System\hfFdBGK.exe
  C:\Windows\System\hfFdBGK.exe
  2⤵
  PID:1996
- C:\Windows\System\lcbNqYA.exe
  C:\Windows\System\lcbNqYA.exe
  2⤵
  PID:4796
- C:\Windows\System\jfuVHlq.exe
  C:\Windows\System\jfuVHlq.exe
  2⤵
  PID:5068
- C:\Windows\System\TwfXxTY.exe
  C:\Windows\System\TwfXxTY.exe
  2⤵
  PID:5056
- C:\Windows\System\PZXmQmt.exe
  C:\Windows\System\PZXmQmt.exe
  2⤵
  PID:2024
- C:\Windows\System\ProgMOz.exe
  C:\Windows\System\ProgMOz.exe
  2⤵
  PID:4284
- C:\Windows\System\YgDsoAY.exe
  C:\Windows\System\YgDsoAY.exe
  2⤵
  PID:4584
- C:\Windows\System\vmyskDU.exe
  C:\Windows\System\vmyskDU.exe
  2⤵
  PID:4360
- C:\Windows\System\qzFkPAQ.exe
  C:\Windows\System\qzFkPAQ.exe
  2⤵
  PID:4780
- C:\Windows\System\uAwBMxk.exe
  C:\Windows\System\uAwBMxk.exe
  2⤵
  PID:4204
- C:\Windows\System\rwqEdRk.exe
  C:\Windows\System\rwqEdRk.exe
  2⤵
  PID:4268
- C:\Windows\System\xGVQiRA.exe
  C:\Windows\System\xGVQiRA.exe
  2⤵
  PID:4392
- C:\Windows\System\eoWiRJU.exe
  C:\Windows\System\eoWiRJU.exe
  2⤵
  PID:2472
- C:\Windows\System\xdXnhVy.exe
  C:\Windows\System\xdXnhVy.exe
  2⤵
  PID:4620
- C:\Windows\System\MDLLQiw.exe
  C:\Windows\System\MDLLQiw.exe
  2⤵
  PID:1908
- C:\Windows\System\PMfhwOe.exe
  C:\Windows\System\PMfhwOe.exe
  2⤵
  PID:4908
- C:\Windows\System\ggPxVbl.exe
  C:\Windows\System\ggPxVbl.exe
  2⤵
  PID:3972
- C:\Windows\System\pItbPAe.exe
  C:\Windows\System\pItbPAe.exe
  2⤵
  PID:5040
- C:\Windows\System\ZlENFJP.exe
  C:\Windows\System\ZlENFJP.exe
  2⤵
  PID:648
- C:\Windows\System\JmDSoPx.exe
  C:\Windows\System\JmDSoPx.exe
  2⤵
  PID:2736
- C:\Windows\System\UQCVjGi.exe
  C:\Windows\System\UQCVjGi.exe
  2⤵
  PID:4888
- C:\Windows\System\SumkKfI.exe
  C:\Windows\System\SumkKfI.exe
  2⤵
  PID:2404
- C:\Windows\System\dJmMQNj.exe
  C:\Windows\System\dJmMQNj.exe
  2⤵
  PID:4524
- C:\Windows\System\JjongZD.exe
  C:\Windows\System\JjongZD.exe
  2⤵
  PID:3748
- C:\Windows\System\AnNZJFN.exe
  C:\Windows\System\AnNZJFN.exe
  2⤵
  PID:4536
- C:\Windows\System\gPAzeZD.exe
  C:\Windows\System\gPAzeZD.exe
  2⤵
  PID:4036
- C:\Windows\System\adBBSqL.exe
  C:\Windows\System\adBBSqL.exe
  2⤵
  PID:5132
- C:\Windows\System\fWowhNS.exe
  C:\Windows\System\fWowhNS.exe
  2⤵
  PID:5148
- C:\Windows\System\nifrNHo.exe
  C:\Windows\System\nifrNHo.exe
  2⤵
  PID:5164
- C:\Windows\System\DKWKzGX.exe
  C:\Windows\System\DKWKzGX.exe
  2⤵
  PID:5180
- C:\Windows\System\fJgSJMV.exe
  C:\Windows\System\fJgSJMV.exe
  2⤵
  PID:5196
- C:\Windows\System\ueKpPQB.exe
  C:\Windows\System\ueKpPQB.exe
  2⤵
  PID:5212
- C:\Windows\System\EGHqZLa.exe
  C:\Windows\System\EGHqZLa.exe
  2⤵
  PID:5228
- C:\Windows\System\AeNGgad.exe
  C:\Windows\System\AeNGgad.exe
  2⤵
  PID:5244
- C:\Windows\System\cAhLedq.exe
  C:\Windows\System\cAhLedq.exe
  2⤵
  PID:5260
- C:\Windows\System\ogqIWZd.exe
  C:\Windows\System\ogqIWZd.exe
  2⤵
  PID:5276
- C:\Windows\System\MZgtKwt.exe
  C:\Windows\System\MZgtKwt.exe
  2⤵
  PID:5292
- C:\Windows\System\kfueGVJ.exe
  C:\Windows\System\kfueGVJ.exe
  2⤵
  PID:5308
- C:\Windows\System\XaPjIwA.exe
  C:\Windows\System\XaPjIwA.exe
  2⤵
  PID:5324
- C:\Windows\System\txHCtQR.exe
  C:\Windows\System\txHCtQR.exe
  2⤵
  PID:5340
- C:\Windows\System\XhptLwr.exe
  C:\Windows\System\XhptLwr.exe
  2⤵
  PID:5356
- C:\Windows\System\ChVOKbq.exe
  C:\Windows\System\ChVOKbq.exe
  2⤵
  PID:5372
- C:\Windows\System\kGmjnOv.exe
  C:\Windows\System\kGmjnOv.exe
  2⤵
  PID:5388
- C:\Windows\System\IBjxWbm.exe
  C:\Windows\System\IBjxWbm.exe
  2⤵
  PID:5404
- C:\Windows\System\RwzxVQl.exe
  C:\Windows\System\RwzxVQl.exe
  2⤵
  PID:5420
- C:\Windows\System\Akpqljf.exe
  C:\Windows\System\Akpqljf.exe
  2⤵
  PID:5436
- C:\Windows\System\tioYVyQ.exe
  C:\Windows\System\tioYVyQ.exe
  2⤵
  PID:5452
- C:\Windows\System\YwqIAFB.exe
  C:\Windows\System\YwqIAFB.exe
  2⤵
  PID:5468
- C:\Windows\System\TfpGULs.exe
  C:\Windows\System\TfpGULs.exe
  2⤵
  PID:5484
- C:\Windows\System\HVaTDfC.exe
  C:\Windows\System\HVaTDfC.exe
  2⤵
  PID:5500
- C:\Windows\System\EmFxMTD.exe
  C:\Windows\System\EmFxMTD.exe
  2⤵
  PID:5516
- C:\Windows\System\gtfrKtk.exe
  C:\Windows\System\gtfrKtk.exe
  2⤵
  PID:5532
- C:\Windows\System\JGsrsIM.exe
  C:\Windows\System\JGsrsIM.exe
  2⤵
  PID:5548
- C:\Windows\System\NbxMpfh.exe
  C:\Windows\System\NbxMpfh.exe
  2⤵
  PID:5564
- C:\Windows\System\PIJQfJQ.exe
  C:\Windows\System\PIJQfJQ.exe
  2⤵
  PID:5580
- C:\Windows\System\RvdXbLc.exe
  C:\Windows\System\RvdXbLc.exe
  2⤵
  PID:5596
- C:\Windows\System\IePCGcr.exe
  C:\Windows\System\IePCGcr.exe
  2⤵
  PID:5612
- C:\Windows\System\hHsERlx.exe
  C:\Windows\System\hHsERlx.exe
  2⤵
  PID:5628
- C:\Windows\System\mzxcHvj.exe
  C:\Windows\System\mzxcHvj.exe
  2⤵
  PID:5644
- C:\Windows\System\WbAmVHg.exe
  C:\Windows\System\WbAmVHg.exe
  2⤵
  PID:5660
- C:\Windows\System\rjqvSho.exe
  C:\Windows\System\rjqvSho.exe
  2⤵
  PID:5676
- C:\Windows\System\TXNwpzC.exe
  C:\Windows\System\TXNwpzC.exe
  2⤵
  PID:5692
- C:\Windows\System\jeqUAJB.exe
  C:\Windows\System\jeqUAJB.exe
  2⤵
  PID:5708
- C:\Windows\System\VVQPthY.exe
  C:\Windows\System\VVQPthY.exe
  2⤵
  PID:5724
- C:\Windows\System\HWpvAGS.exe
  C:\Windows\System\HWpvAGS.exe
  2⤵
  PID:5740
- C:\Windows\System\eKLbbOz.exe
  C:\Windows\System\eKLbbOz.exe
  2⤵
  PID:5756
- C:\Windows\System\vgzzFxN.exe
  C:\Windows\System\vgzzFxN.exe
  2⤵
  PID:5772
- C:\Windows\System\opaOJSZ.exe
  C:\Windows\System\opaOJSZ.exe
  2⤵
  PID:5788
- C:\Windows\System\LLhTUzA.exe
  C:\Windows\System\LLhTUzA.exe
  2⤵
  PID:5804
- C:\Windows\System\KoPomuR.exe
  C:\Windows\System\KoPomuR.exe
  2⤵
  PID:5820
- C:\Windows\System\fSPOBPX.exe
  C:\Windows\System\fSPOBPX.exe
  2⤵
  PID:5836
- C:\Windows\System\POicsxW.exe
  C:\Windows\System\POicsxW.exe
  2⤵
  PID:5852
- C:\Windows\System\rehvzPl.exe
  C:\Windows\System\rehvzPl.exe
  2⤵
  PID:5868
- C:\Windows\System\BJRsjZl.exe
  C:\Windows\System\BJRsjZl.exe
  2⤵
  PID:5884
- C:\Windows\System\hmBuJgG.exe
  C:\Windows\System\hmBuJgG.exe
  2⤵
  PID:5900
- C:\Windows\System\pKtafdn.exe
  C:\Windows\System\pKtafdn.exe
  2⤵
  PID:5916
- C:\Windows\System\wLOfeeS.exe
  C:\Windows\System\wLOfeeS.exe
  2⤵
  PID:5932
- C:\Windows\System\YKPRVJm.exe
  C:\Windows\System\YKPRVJm.exe
  2⤵
  PID:5948
- C:\Windows\System\XaoLEUl.exe
  C:\Windows\System\XaoLEUl.exe
  2⤵
  PID:5964
- C:\Windows\System\MoBwdTL.exe
  C:\Windows\System\MoBwdTL.exe
  2⤵
  PID:5980
- C:\Windows\System\tOIHAXz.exe
  C:\Windows\System\tOIHAXz.exe
  2⤵
  PID:5996
- C:\Windows\System\Cmzdayn.exe
  C:\Windows\System\Cmzdayn.exe
  2⤵
  PID:6012
- C:\Windows\System\yFskOdc.exe
  C:\Windows\System\yFskOdc.exe
  2⤵
  PID:6028
- C:\Windows\System\UyvoLuF.exe
  C:\Windows\System\UyvoLuF.exe
  2⤵
  PID:6044
- C:\Windows\System\DEdylaI.exe
  C:\Windows\System\DEdylaI.exe
  2⤵
  PID:6060
- C:\Windows\System\LcBAwvB.exe
  C:\Windows\System\LcBAwvB.exe
  2⤵
  PID:6076
- C:\Windows\System\NQtGEux.exe
  C:\Windows\System\NQtGEux.exe
  2⤵
  PID:6092
- C:\Windows\System\DchJdxQ.exe
  C:\Windows\System\DchJdxQ.exe
  2⤵
  PID:6108
- C:\Windows\System\wKetewp.exe
  C:\Windows\System\wKetewp.exe
  2⤵
  PID:6124
- C:\Windows\System\wIhIUtm.exe
  C:\Windows\System\wIhIUtm.exe
  2⤵
  PID:6140
- C:\Windows\System\NdJaMoB.exe
  C:\Windows\System\NdJaMoB.exe
  2⤵
  PID:3068
- C:\Windows\System\NIaFqza.exe
  C:\Windows\System\NIaFqza.exe
  2⤵
  PID:5140
- C:\Windows\System\ZAxZSXC.exe
  C:\Windows\System\ZAxZSXC.exe
  2⤵
  PID:5172
- C:\Windows\System\grLFpyi.exe
  C:\Windows\System\grLFpyi.exe
  2⤵
  PID:5224
- C:\Windows\System\WMiIsjA.exe
  C:\Windows\System\WMiIsjA.exe
  2⤵
  PID:5316
- C:\Windows\System\tqAyBCw.exe
  C:\Windows\System\tqAyBCw.exe
  2⤵
  PID:5412
- C:\Windows\System\golGRYY.exe
  C:\Windows\System\golGRYY.exe
  2⤵
  PID:5384
- C:\Windows\System\XdjHgOJ.exe
  C:\Windows\System\XdjHgOJ.exe
  2⤵
  PID:5176
- C:\Windows\System\vZJATbe.exe
  C:\Windows\System\vZJATbe.exe
  2⤵
  PID:5508
- C:\Windows\System\DJcMoUZ.exe
  C:\Windows\System\DJcMoUZ.exe
  2⤵
  PID:3752
- C:\Windows\System\cmiQAJS.exe
  C:\Windows\System\cmiQAJS.exe
  2⤵
  PID:5400
- C:\Windows\System\sOzVKWq.exe
  C:\Windows\System\sOzVKWq.exe
  2⤵
  PID:5364
- C:\Windows\System\txDmGdp.exe
  C:\Windows\System\txDmGdp.exe
  2⤵
  PID:5460
- C:\Windows\System\flDZsLf.exe
  C:\Windows\System\flDZsLf.exe
  2⤵
  PID:5512
- C:\Windows\System\kNdcspp.exe
  C:\Windows\System\kNdcspp.exe
  2⤵
  PID:5576
- C:\Windows\System\dEDuOex.exe
  C:\Windows\System\dEDuOex.exe
  2⤵
  PID:5640
- C:\Windows\System\nSmVJNf.exe
  C:\Windows\System\nSmVJNf.exe
  2⤵
  PID:5560
- C:\Windows\System\kCbClyq.exe
  C:\Windows\System\kCbClyq.exe
  2⤵
  PID:5624
- C:\Windows\System\iAelyCn.exe
  C:\Windows\System\iAelyCn.exe
  2⤵
  PID:5672
- C:\Windows\System\KfgQySw.exe
  C:\Windows\System\KfgQySw.exe
  2⤵
  PID:5736
- C:\Windows\System\NsbejBx.exe
  C:\Windows\System\NsbejBx.exe
  2⤵
  PID:5720
- C:\Windows\System\PChsPSP.exe
  C:\Windows\System\PChsPSP.exe
  2⤵
  PID:5796
- C:\Windows\System\FYveZXG.exe
  C:\Windows\System\FYveZXG.exe
  2⤵
  PID:5828
- C:\Windows\System\znEVWfe.exe
  C:\Windows\System\znEVWfe.exe
  2⤵
  PID:5812
- C:\Windows\System\fiESNNw.exe
  C:\Windows\System\fiESNNw.exe
  2⤵
  PID:5876
- C:\Windows\System\RYtowkj.exe
  C:\Windows\System\RYtowkj.exe
  2⤵
  PID:5928
- C:\Windows\System\dtwpMUZ.exe
  C:\Windows\System\dtwpMUZ.exe
  2⤵
  PID:5988
- C:\Windows\System\gxCaJnk.exe
  C:\Windows\System\gxCaJnk.exe
  2⤵
  PID:6020
- C:\Windows\System\uoohEEi.exe
  C:\Windows\System\uoohEEi.exe
  2⤵
  PID:6088
- C:\Windows\System\RsJgHQq.exe
  C:\Windows\System\RsJgHQq.exe
  2⤵
  PID:6116
- C:\Windows\System\sysiAFQ.exe
  C:\Windows\System\sysiAFQ.exe
  2⤵
  PID:6068
- C:\Windows\System\hLZqIMn.exe
  C:\Windows\System\hLZqIMn.exe
  2⤵
  PID:5912
- C:\Windows\System\NRfOSgP.exe
  C:\Windows\System\NRfOSgP.exe
  2⤵
  PID:6040
- C:\Windows\System\PGTnmwJ.exe
  C:\Windows\System\PGTnmwJ.exe
  2⤵
  PID:4792
- C:\Windows\System\xSPfyHr.exe
  C:\Windows\System\xSPfyHr.exe
  2⤵
  PID:5156
- C:\Windows\System\ZJmLHZX.exe
  C:\Windows\System\ZJmLHZX.exe
  2⤵
  PID:5428
- C:\Windows\System\TZjodNe.exe
  C:\Windows\System\TZjodNe.exe
  2⤵
  PID:5816
- C:\Windows\System\ssKxjOp.exe
  C:\Windows\System\ssKxjOp.exe
  2⤵
  PID:5204
- C:\Windows\System\hcJwbzM.exe
  C:\Windows\System\hcJwbzM.exe
  2⤵
  PID:5992
- C:\Windows\System\YahPzkG.exe
  C:\Windows\System\YahPzkG.exe
  2⤵
  PID:5592
- C:\Windows\System\tGTPWIh.exe
  C:\Windows\System\tGTPWIh.exe
  2⤵
  PID:5764
- C:\Windows\System\tBKgpKR.exe
  C:\Windows\System\tBKgpKR.exe
  2⤵
  PID:6024
- C:\Windows\System\AiJusYH.exe
  C:\Windows\System\AiJusYH.exe
  2⤵
  PID:6084
- C:\Windows\System\AKqExXt.exe
  C:\Windows\System\AKqExXt.exe
  2⤵
  PID:6104
- C:\Windows\System\lqXgrDh.exe
  C:\Windows\System\lqXgrDh.exe
  2⤵
  PID:6136
- C:\Windows\System\vGBqbpo.exe
  C:\Windows\System\vGBqbpo.exe
  2⤵
  PID:5236
- C:\Windows\System\PvVdYao.exe
  C:\Windows\System\PvVdYao.exe
  2⤵
  PID:5556
- C:\Windows\System\Bnwlkjj.exe
  C:\Windows\System\Bnwlkjj.exe
  2⤵
  PID:5528
- C:\Windows\System\ZVydPOt.exe
  C:\Windows\System\ZVydPOt.exe
  2⤵
  PID:5844
- C:\Windows\System\lBRnOeg.exe
  C:\Windows\System\lBRnOeg.exe
  2⤵
  PID:5716
- C:\Windows\System\gnPRjBY.exe
  C:\Windows\System\gnPRjBY.exe
  2⤵
  PID:5768
- C:\Windows\System\SuKLHVM.exe
  C:\Windows\System\SuKLHVM.exe
  2⤵
  PID:5636
- C:\Windows\System\onNDqDN.exe
  C:\Windows\System\onNDqDN.exe
  2⤵
  PID:6148
- C:\Windows\System\ztFJSSv.exe
  C:\Windows\System\ztFJSSv.exe
  2⤵
  PID:6172
- C:\Windows\System\IKspvPs.exe
  C:\Windows\System\IKspvPs.exe
  2⤵
  PID:6188
- C:\Windows\System\QkANFfD.exe
  C:\Windows\System\QkANFfD.exe
  2⤵
  PID:6208
- C:\Windows\System\wBOAqPQ.exe
  C:\Windows\System\wBOAqPQ.exe
  2⤵
  PID:6228
- C:\Windows\System\fwCOIxj.exe
  C:\Windows\System\fwCOIxj.exe
  2⤵
  PID:6244
- C:\Windows\System\fNKImZw.exe
  C:\Windows\System\fNKImZw.exe
  2⤵
  PID:6260
- C:\Windows\System\XCkJTzD.exe
  C:\Windows\System\XCkJTzD.exe
  2⤵
  PID:6280
- C:\Windows\System\YpFvOMc.exe
  C:\Windows\System\YpFvOMc.exe
  2⤵
  PID:6296
- C:\Windows\System\dJIplXt.exe
  C:\Windows\System\dJIplXt.exe
  2⤵
  PID:6312
- C:\Windows\System\rfnNJbA.exe
  C:\Windows\System\rfnNJbA.exe
  2⤵
  PID:6328
- C:\Windows\System\hGPqFUq.exe
  C:\Windows\System\hGPqFUq.exe
  2⤵
  PID:6344
- C:\Windows\System\cugAxFE.exe
  C:\Windows\System\cugAxFE.exe
  2⤵
  PID:6364
- C:\Windows\System\xUhOsyZ.exe
  C:\Windows\System\xUhOsyZ.exe
  2⤵
  PID:6400
- C:\Windows\System\ljRfmHB.exe
  C:\Windows\System\ljRfmHB.exe
  2⤵
  PID:6416
- C:\Windows\System\BbEUAOc.exe
  C:\Windows\System\BbEUAOc.exe
  2⤵
  PID:6432
- C:\Windows\System\XSZVfbQ.exe
  C:\Windows\System\XSZVfbQ.exe
  2⤵
  PID:6448
- C:\Windows\System\xsksZOj.exe
  C:\Windows\System\xsksZOj.exe
  2⤵
  PID:6464
- C:\Windows\System\TxwiPlZ.exe
  C:\Windows\System\TxwiPlZ.exe
  2⤵
  PID:6480
- C:\Windows\System\sswKYIE.exe
  C:\Windows\System\sswKYIE.exe
  2⤵
  PID:6500
- C:\Windows\System\bDwLUTK.exe
  C:\Windows\System\bDwLUTK.exe
  2⤵
  PID:6516
- C:\Windows\System\dERRYRs.exe
  C:\Windows\System\dERRYRs.exe
  2⤵
  PID:6532
- C:\Windows\System\GPjsdJn.exe
  C:\Windows\System\GPjsdJn.exe
  2⤵
  PID:6548
- C:\Windows\System\gMQvHjp.exe
  C:\Windows\System\gMQvHjp.exe
  2⤵
  PID:6568
- C:\Windows\System\ferrdrE.exe
  C:\Windows\System\ferrdrE.exe
  2⤵
  PID:6584
- C:\Windows\System\WZYBPpu.exe
  C:\Windows\System\WZYBPpu.exe
  2⤵
  PID:6600
- C:\Windows\System\cExeZCl.exe
  C:\Windows\System\cExeZCl.exe
  2⤵
  PID:6620
- C:\Windows\System\eYXYAPF.exe
  C:\Windows\System\eYXYAPF.exe
  2⤵
  PID:6636
- C:\Windows\System\YjspRGw.exe
  C:\Windows\System\YjspRGw.exe
  2⤵
  PID:6652
- C:\Windows\System\vafIkFM.exe
  C:\Windows\System\vafIkFM.exe
  2⤵
  PID:6668
- C:\Windows\System\YESKPTt.exe
  C:\Windows\System\YESKPTt.exe
  2⤵
  PID:6684
- C:\Windows\System\DkIKAkb.exe
  C:\Windows\System\DkIKAkb.exe
  2⤵
  PID:6700
- C:\Windows\System\RYWTPkg.exe
  C:\Windows\System\RYWTPkg.exe
  2⤵
  PID:6720
- C:\Windows\System\mGuZSkv.exe
  C:\Windows\System\mGuZSkv.exe
  2⤵
  PID:6736
- C:\Windows\System\WLGtTHl.exe
  C:\Windows\System\WLGtTHl.exe
  2⤵
  PID:6752
- C:\Windows\System\chvgkdy.exe
  C:\Windows\System\chvgkdy.exe
  2⤵
  PID:6768
- C:\Windows\System\brtxQxB.exe
  C:\Windows\System\brtxQxB.exe
  2⤵
  PID:6784
- C:\Windows\System\hWjILPk.exe
  C:\Windows\System\hWjILPk.exe
  2⤵
  PID:6804
- C:\Windows\System\usLUOar.exe
  C:\Windows\System\usLUOar.exe
  2⤵
  PID:6820
- C:\Windows\System\JuLgXkC.exe
  C:\Windows\System\JuLgXkC.exe
  2⤵
  PID:6836
- C:\Windows\System\BLjqeQH.exe
  C:\Windows\System\BLjqeQH.exe
  2⤵
  PID:6852
- C:\Windows\System\juvvafv.exe
  C:\Windows\System\juvvafv.exe
  2⤵
  PID:6868
- C:\Windows\System\WVddjjQ.exe
  C:\Windows\System\WVddjjQ.exe
  2⤵
  PID:6888
- C:\Windows\System\PTpxrqU.exe
  C:\Windows\System\PTpxrqU.exe
  2⤵
  PID:6904
- C:\Windows\System\NAmVggs.exe
  C:\Windows\System\NAmVggs.exe
  2⤵
  PID:6924
- C:\Windows\System\HbGXRlB.exe
  C:\Windows\System\HbGXRlB.exe
  2⤵
  PID:6940
- C:\Windows\System\zBKtBzS.exe
  C:\Windows\System\zBKtBzS.exe
  2⤵
  PID:6960
- C:\Windows\System\dSDOzkB.exe
  C:\Windows\System\dSDOzkB.exe
  2⤵
  PID:6976
- C:\Windows\System\uWYMDlG.exe
  C:\Windows\System\uWYMDlG.exe
  2⤵
  PID:6992
- C:\Windows\System\RDnIlNy.exe
  C:\Windows\System\RDnIlNy.exe
  2⤵
  PID:7012
- C:\Windows\System\esxyDlk.exe
  C:\Windows\System\esxyDlk.exe
  2⤵
  PID:7028
- C:\Windows\System\DddgXoe.exe
  C:\Windows\System\DddgXoe.exe
  2⤵
  PID:7044
- C:\Windows\System\LsdoOyt.exe
  C:\Windows\System\LsdoOyt.exe
  2⤵
  PID:7060
- C:\Windows\System\hzmezrb.exe
  C:\Windows\System\hzmezrb.exe
  2⤵
  PID:7076
- C:\Windows\System\SJXLOPi.exe
  C:\Windows\System\SJXLOPi.exe
  2⤵
  PID:7096
- C:\Windows\System\tIZMxtP.exe
  C:\Windows\System\tIZMxtP.exe
  2⤵
  PID:7112
- C:\Windows\System\zJrqHDR.exe
  C:\Windows\System\zJrqHDR.exe
  2⤵
  PID:7128
- C:\Windows\System\hnmddoT.exe
  C:\Windows\System\hnmddoT.exe
  2⤵
  PID:7152
- C:\Windows\System\DfVjzas.exe
  C:\Windows\System\DfVjzas.exe
  2⤵
  PID:5332
- C:\Windows\System\uJtDQHY.exe
  C:\Windows\System\uJtDQHY.exe
  2⤵
  PID:6036
- C:\Windows\System\vgZOxrs.exe
  C:\Windows\System\vgZOxrs.exe
  2⤵
  PID:5444
- C:\Windows\System\AiRUurz.exe
  C:\Windows\System\AiRUurz.exe
  2⤵
  PID:5800
- C:\Windows\System\wfieYUa.exe
  C:\Windows\System\wfieYUa.exe
  2⤵
  PID:6184
- C:\Windows\System\fQehmDd.exe
  C:\Windows\System\fQehmDd.exe
  2⤵
  PID:5304
- C:\Windows\System\NzauUTb.exe
  C:\Windows\System\NzauUTb.exe
  2⤵
  PID:6292
- C:\Windows\System\rPIIiwZ.exe
  C:\Windows\System\rPIIiwZ.exe
  2⤵
  PID:6360
- C:\Windows\System\jUYikgW.exe
  C:\Windows\System\jUYikgW.exe
  2⤵
  PID:4988
- C:\Windows\System\wfSfXXP.exe
  C:\Windows\System\wfSfXXP.exe
  2⤵
  PID:6408
- C:\Windows\System\DLGGZQt.exe
  C:\Windows\System\DLGGZQt.exe
  2⤵
  PID:5688
- C:\Windows\System\QCqkyYr.exe
  C:\Windows\System\QCqkyYr.exe
  2⤵
  PID:6160
- C:\Windows\System\lfiUKHz.exe
  C:\Windows\System\lfiUKHz.exe
  2⤵
  PID:6200
- C:\Windows\System\eGLEjEY.exe
  C:\Windows\System\eGLEjEY.exe
  2⤵
  PID:6268
- C:\Windows\System\yuUXNaa.exe
  C:\Windows\System\yuUXNaa.exe
  2⤵
  PID:6336
- C:\Windows\System\JbiaEsP.exe
  C:\Windows\System\JbiaEsP.exe
  2⤵
  PID:6376
- C:\Windows\System\ZLkQAbE.exe
  C:\Windows\System\ZLkQAbE.exe
  2⤵
  PID:6476
- C:\Windows\System\IQcKRVe.exe
  C:\Windows\System\IQcKRVe.exe
  2⤵
  PID:6576
- C:\Windows\System\YbxlkIP.exe
  C:\Windows\System\YbxlkIP.exe
  2⤵
  PID:6616
- C:\Windows\System\tjRSMtu.exe
  C:\Windows\System\tjRSMtu.exe
  2⤵
  PID:6648
- C:\Windows\System\ObfYYtU.exe
  C:\Windows\System\ObfYYtU.exe
  2⤵
  PID:6744
- C:\Windows\System\lRpSMTo.exe
  C:\Windows\System\lRpSMTo.exe
  2⤵
  PID:6780
- C:\Windows\System\gSQfccP.exe
  C:\Windows\System\gSQfccP.exe
  2⤵
  PID:6844
- C:\Windows\System\qehIBdb.exe
  C:\Windows\System\qehIBdb.exe
  2⤵
  PID:6920
- C:\Windows\System\hsOtuTk.exe
  C:\Windows\System\hsOtuTk.exe
  2⤵
  PID:6984
- C:\Windows\System\uBPaPWn.exe
  C:\Windows\System\uBPaPWn.exe
  2⤵
  PID:7020
- C:\Windows\System\pdpfAOm.exe
  C:\Windows\System\pdpfAOm.exe
  2⤵
  PID:7120
- C:\Windows\System\XSTgkNh.exe
  C:\Windows\System\XSTgkNh.exe
  2⤵
  PID:7164
- C:\Windows\System\tlGpZjI.exe
  C:\Windows\System\tlGpZjI.exe
  2⤵
  PID:7124
- C:\Windows\System\rlmlWNn.exe
  C:\Windows\System\rlmlWNn.exe
  2⤵
  PID:6216
- C:\Windows\System\kaTZtuJ.exe
  C:\Windows\System\kaTZtuJ.exe
  2⤵
  PID:6196
- C:\Windows\System\aaEXlmQ.exe
  C:\Windows\System\aaEXlmQ.exe
  2⤵
  PID:6252
- C:\Windows\System\nOeQgdv.exe
  C:\Windows\System\nOeQgdv.exe
  2⤵
  PID:6716
- C:\Windows\System\fllTyDl.exe
  C:\Windows\System\fllTyDl.exe
  2⤵
  PID:7056
- C:\Windows\System\ygVLoic.exe
  C:\Windows\System\ygVLoic.exe
  2⤵
  PID:5944
- C:\Windows\System\eADRxFh.exe
  C:\Windows\System\eADRxFh.exe
  2⤵
  PID:7184
- C:\Windows\System\UAgpujX.exe
  C:\Windows\System\UAgpujX.exe
  2⤵
  PID:7204
- C:\Windows\System\sIkTMoZ.exe
  C:\Windows\System\sIkTMoZ.exe
  2⤵
  PID:7220
- C:\Windows\System\DTtEEsF.exe
  C:\Windows\System\DTtEEsF.exe
  2⤵
  PID:7236
- C:\Windows\System\jWGVrie.exe
  C:\Windows\System\jWGVrie.exe
  2⤵
  PID:7252
- C:\Windows\System\KBsgagv.exe
  C:\Windows\System\KBsgagv.exe
  2⤵
  PID:7268
- C:\Windows\System\qNdsCCf.exe
  C:\Windows\System\qNdsCCf.exe
  2⤵
  PID:7284
- C:\Windows\System\ldYOjLu.exe
  C:\Windows\System\ldYOjLu.exe
  2⤵
  PID:7304
- C:\Windows\System\MPtcMgM.exe
  C:\Windows\System\MPtcMgM.exe
  2⤵
  PID:7320
- C:\Windows\System\UcPxobY.exe
  C:\Windows\System\UcPxobY.exe
  2⤵
  PID:7336
- C:\Windows\System\qhoiFVy.exe
  C:\Windows\System\qhoiFVy.exe
  2⤵
  PID:7352
- C:\Windows\System\qRzCpxV.exe
  C:\Windows\System\qRzCpxV.exe
  2⤵
  PID:7372
- C:\Windows\System\FMLrRJA.exe
  C:\Windows\System\FMLrRJA.exe
  2⤵
  PID:7388
- C:\Windows\System\wGqwbtN.exe
  C:\Windows\System\wGqwbtN.exe
  2⤵
  PID:7404
- C:\Windows\System\GvnFIeO.exe
  C:\Windows\System\GvnFIeO.exe
  2⤵
  PID:7424
- C:\Windows\System\mkIStaI.exe
  C:\Windows\System\mkIStaI.exe
  2⤵
  PID:7440
- C:\Windows\System\ubVrhjr.exe
  C:\Windows\System\ubVrhjr.exe
  2⤵
  PID:7456
- C:\Windows\System\PhTgQmp.exe
  C:\Windows\System\PhTgQmp.exe
  2⤵
  PID:7472
- C:\Windows\System\kZIUTIC.exe
  C:\Windows\System\kZIUTIC.exe
  2⤵
  PID:7488
- C:\Windows\System\cGNzaiP.exe
  C:\Windows\System\cGNzaiP.exe
  2⤵
  PID:7504
- C:\Windows\System\vTeRffM.exe
  C:\Windows\System\vTeRffM.exe
  2⤵
  PID:7528
- C:\Windows\System\OWKrUnS.exe
  C:\Windows\System\OWKrUnS.exe
  2⤵
  PID:7548
- C:\Windows\System\omjMNeV.exe
  C:\Windows\System\omjMNeV.exe
  2⤵
  PID:7564
- C:\Windows\System\LfsjyKR.exe
  C:\Windows\System\LfsjyKR.exe
  2⤵
  PID:7580
- C:\Windows\System\DlyoKgT.exe
  C:\Windows\System\DlyoKgT.exe
  2⤵
  PID:7600
- C:\Windows\System\emPJMJF.exe
  C:\Windows\System\emPJMJF.exe
  2⤵
  PID:7616
- C:\Windows\System\yUJoWbz.exe
  C:\Windows\System\yUJoWbz.exe
  2⤵
  PID:7632
- C:\Windows\System\TOzfPYH.exe
  C:\Windows\System\TOzfPYH.exe
  2⤵
  PID:7652
- C:\Windows\System\DgZlmON.exe
  C:\Windows\System\DgZlmON.exe
  2⤵
  PID:7668
- C:\Windows\System\hmmZqOM.exe
  C:\Windows\System\hmmZqOM.exe
  2⤵
  PID:7688
- C:\Windows\System\hwYbnmq.exe
  C:\Windows\System\hwYbnmq.exe
  2⤵
  PID:7704
- C:\Windows\System\hQTgqGG.exe
  C:\Windows\System\hQTgqGG.exe
  2⤵
  PID:7720
- C:\Windows\System\pFqxbxl.exe
  C:\Windows\System\pFqxbxl.exe
  2⤵
  PID:7736
- C:\Windows\System\GMcjrkM.exe
  C:\Windows\System\GMcjrkM.exe
  2⤵
  PID:7752
- C:\Windows\System\zaqCeoX.exe
  C:\Windows\System\zaqCeoX.exe
  2⤵
  PID:7772
- C:\Windows\System\JFvJLXw.exe
  C:\Windows\System\JFvJLXw.exe
  2⤵
  PID:7792
- C:\Windows\System\ImYExZC.exe
  C:\Windows\System\ImYExZC.exe
  2⤵
  PID:7808
- C:\Windows\System\EqtDmhX.exe
  C:\Windows\System\EqtDmhX.exe
  2⤵
  PID:7824
- C:\Windows\System\dbTnQKI.exe
  C:\Windows\System\dbTnQKI.exe
  2⤵
  PID:7940
- C:\Windows\System\LBwBrMK.exe
  C:\Windows\System\LBwBrMK.exe
  2⤵
  PID:7976
- C:\Windows\System\ppOqBxq.exe
  C:\Windows\System\ppOqBxq.exe
  2⤵
  PID:7992
- C:\Windows\System\IxHKJoy.exe
  C:\Windows\System\IxHKJoy.exe
  2⤵
  PID:8008
- C:\Windows\System\pNWERqH.exe
  C:\Windows\System\pNWERqH.exe
  2⤵
  PID:8032
- C:\Windows\System\ztPkABZ.exe
  C:\Windows\System\ztPkABZ.exe
  2⤵
  PID:8076
- C:\Windows\System\GexJmDQ.exe
  C:\Windows\System\GexJmDQ.exe
  2⤵
  PID:6628
- C:\Windows\System\ThyGhUv.exe
  C:\Windows\System\ThyGhUv.exe
  2⤵
  PID:7040
- C:\Windows\System\DvSnYlq.exe
  C:\Windows\System\DvSnYlq.exe
  2⤵
  PID:7108
- C:\Windows\System\yBwqXqt.exe
  C:\Windows\System\yBwqXqt.exe
  2⤵
  PID:5608
- C:\Windows\System\HccxsKp.exe
  C:\Windows\System\HccxsKp.exe
  2⤵
  PID:6324
- C:\Windows\System\UDHyuJz.exe
  C:\Windows\System\UDHyuJz.exe
  2⤵
  PID:548
- C:\Windows\System\HOugNJd.exe
  C:\Windows\System\HOugNJd.exe
  2⤵
  PID:6240
- C:\Windows\System\chwsCtD.exe
  C:\Windows\System\chwsCtD.exe
  2⤵
  PID:6544
- C:\Windows\System\EsFKTGC.exe
  C:\Windows\System\EsFKTGC.exe
  2⤵
  PID:6676
- C:\Windows\System\vexAipZ.exe
  C:\Windows\System\vexAipZ.exe
  2⤵
  PID:6916
- C:\Windows\System\JxVEhqX.exe
  C:\Windows\System\JxVEhqX.exe
  2⤵
  PID:6304
- C:\Windows\System\fNYtrTe.exe
  C:\Windows\System\fNYtrTe.exe
  2⤵
  PID:7176
- C:\Windows\System\LHBIdrY.exe
  C:\Windows\System\LHBIdrY.exe
  2⤵
  PID:7264
- C:\Windows\System\xPPwEsF.exe
  C:\Windows\System\xPPwEsF.exe
  2⤵
  PID:7364
- C:\Windows\System\NAXWhQi.exe
  C:\Windows\System\NAXWhQi.exe
  2⤵
  PID:7396
- C:\Windows\System\UdQuGdE.exe
  C:\Windows\System\UdQuGdE.exe
  2⤵
  PID:7468
- C:\Windows\System\vceHNVv.exe
  C:\Windows\System\vceHNVv.exe
  2⤵
  PID:7212
- C:\Windows\System\xiqmsfP.exe
  C:\Windows\System\xiqmsfP.exe
  2⤵
  PID:7276
- C:\Windows\System\iyZETyd.exe
  C:\Windows\System\iyZETyd.exe
  2⤵
  PID:7344
- C:\Windows\System\wGrqvRF.exe
  C:\Windows\System\wGrqvRF.exe
  2⤵
  PID:7412
- C:\Windows\System\LZQtClr.exe
  C:\Windows\System\LZQtClr.exe
  2⤵
  PID:7452
- C:\Windows\System\EKVJVtJ.exe
  C:\Windows\System\EKVJVtJ.exe
  2⤵
  PID:7556
- C:\Windows\System\MWxgAEw.exe
  C:\Windows\System\MWxgAEw.exe
  2⤵
  PID:7572
- C:\Windows\System\FdgFaMM.exe
  C:\Windows\System\FdgFaMM.exe
  2⤵
  PID:7592
- C:\Windows\System\kaLejKZ.exe
  C:\Windows\System\kaLejKZ.exe
  2⤵
  PID:7612
- C:\Windows\System\Vybraaa.exe
  C:\Windows\System\Vybraaa.exe
  2⤵
  PID:7644
- C:\Windows\System\JVVvyeP.exe
  C:\Windows\System\JVVvyeP.exe
  2⤵
  PID:7744
- C:\Windows\System\MnaEhkb.exe
  C:\Windows\System\MnaEhkb.exe
  2⤵
  PID:7760
- C:\Windows\System\SunLNYp.exe
  C:\Windows\System\SunLNYp.exe
  2⤵
  PID:7728
- C:\Windows\System\wxaMNLt.exe
  C:\Windows\System\wxaMNLt.exe
  2⤵
  PID:7712
- C:\Windows\System\awGPtbX.exe
  C:\Windows\System\awGPtbX.exe
  2⤵
  PID:7816
- C:\Windows\System\nlaCuSe.exe
  C:\Windows\System\nlaCuSe.exe
  2⤵
  PID:7836
- C:\Windows\System\ZjGFDiy.exe
  C:\Windows\System\ZjGFDiy.exe
  2⤵
  PID:7856
- C:\Windows\System\tSfWIYN.exe
  C:\Windows\System\tSfWIYN.exe
  2⤵
  PID:7876
- C:\Windows\System\qlSrleU.exe
  C:\Windows\System\qlSrleU.exe
  2⤵
  PID:7888
- C:\Windows\System\EEwluoB.exe
  C:\Windows\System\EEwluoB.exe
  2⤵
  PID:7912
- C:\Windows\System\oKByOFb.exe
  C:\Windows\System\oKByOFb.exe
  2⤵
  PID:7952
- C:\Windows\System\LRCdZoE.exe
  C:\Windows\System\LRCdZoE.exe
  2⤵
  PID:7916
- C:\Windows\System\vLpeNYV.exe
  C:\Windows\System\vLpeNYV.exe
  2⤵
  PID:7964
- C:\Windows\System\uQTxasD.exe
  C:\Windows\System\uQTxasD.exe
  2⤵
  PID:7972
- C:\Windows\System\uwjrjIB.exe
  C:\Windows\System\uwjrjIB.exe
  2⤵
  PID:8040
- C:\Windows\System\lcHnjuu.exe
  C:\Windows\System\lcHnjuu.exe
  2⤵
  PID:8052
- C:\Windows\System\JrkUWwJ.exe
  C:\Windows\System\JrkUWwJ.exe
  2⤵
  PID:8044
- C:\Windows\System\YauQcRd.exe
  C:\Windows\System\YauQcRd.exe
  2⤵
  PID:8108
- C:\Windows\System\BwSRWyx.exe
  C:\Windows\System\BwSRWyx.exe
  2⤵
  PID:8168
- C:\Windows\System\mWpRABc.exe
  C:\Windows\System\mWpRABc.exe
  2⤵
  PID:6156
- C:\Windows\System\JvQnEum.exe
  C:\Windows\System\JvQnEum.exe
  2⤵
  PID:6460
- C:\Windows\System\jGIwBBI.exe
  C:\Windows\System\jGIwBBI.exe
  2⤵
  PID:6860
- C:\Windows\System\nqiAnic.exe
  C:\Windows\System\nqiAnic.exe
  2⤵
  PID:6936
- C:\Windows\System\nsCGWYZ.exe
  C:\Windows\System\nsCGWYZ.exe
  2⤵
  PID:7008
- C:\Windows\System\YXZpqgc.exe
  C:\Windows\System\YXZpqgc.exe
  2⤵
  PID:6456
- C:\Windows\System\QkCYbcN.exe
  C:\Windows\System\QkCYbcN.exe
  2⤵
  PID:6564
- C:\Windows\System\yMWROAA.exe
  C:\Windows\System\yMWROAA.exe
  2⤵
  PID:6696
- C:\Windows\System\JqwrxYO.exe
  C:\Windows\System\JqwrxYO.exe
  2⤵
  PID:7144
- C:\Windows\System\WxLjbTf.exe
  C:\Windows\System\WxLjbTf.exe
  2⤵
  PID:6236
- C:\Windows\System\ZyEosMC.exe
  C:\Windows\System\ZyEosMC.exe
  2⤵
  PID:7292
- C:\Windows\System\GVLiHgD.exe
  C:\Windows\System\GVLiHgD.exe
  2⤵
  PID:7500
- C:\Windows\System\FaFcVTt.exe
  C:\Windows\System\FaFcVTt.exe
  2⤵
  PID:7516
- C:\Windows\System\ybywIKR.exe
  C:\Windows\System\ybywIKR.exe
  2⤵
  PID:7588
- C:\Windows\System\sQNGErX.exe
  C:\Windows\System\sQNGErX.exe
  2⤵
  PID:6952
- C:\Windows\System\cUOnNqW.exe
  C:\Windows\System\cUOnNqW.exe
  2⤵
  PID:7648
- C:\Windows\System\YQTeAbh.exe
  C:\Windows\System\YQTeAbh.exe
  2⤵
  PID:6352
- C:\Windows\System\aKWXbEs.exe
  C:\Windows\System\aKWXbEs.exe
  2⤵
  PID:7768
- C:\Windows\System\TjnHtlP.exe
  C:\Windows\System\TjnHtlP.exe
  2⤵
  PID:7864
- C:\Windows\System\kNTyjNC.exe
  C:\Windows\System\kNTyjNC.exe
  2⤵
  PID:7868
- C:\Windows\System\LuHsiJD.exe
  C:\Windows\System\LuHsiJD.exe
  2⤵
  PID:7968
- C:\Windows\System\cfLGfcd.exe
  C:\Windows\System\cfLGfcd.exe
  2⤵
  PID:5496
- C:\Windows\System\JwFCZPU.exe
  C:\Windows\System\JwFCZPU.exe
  2⤵
  PID:7660
- C:\Windows\System\hYHxuSS.exe
  C:\Windows\System\hYHxuSS.exe
  2⤵
  PID:7540
- C:\Windows\System\YUZyEIK.exe
  C:\Windows\System\YUZyEIK.exe
  2⤵
  PID:7988
- C:\Windows\System\VNnSncF.exe
  C:\Windows\System\VNnSncF.exe
  2⤵
  PID:7852
- C:\Windows\System\nLHQgPi.exe
  C:\Windows\System\nLHQgPi.exe
  2⤵
  PID:7908
- C:\Windows\System\QrHtdOB.exe
  C:\Windows\System\QrHtdOB.exe
  2⤵
  PID:8020
- C:\Windows\System\IrjOzId.exe
  C:\Windows\System\IrjOzId.exe
  2⤵
  PID:8176
- C:\Windows\System\ZfIAuEj.exe
  C:\Windows\System\ZfIAuEj.exe
  2⤵
  PID:8060
- C:\Windows\System\zoZwljm.exe
  C:\Windows\System\zoZwljm.exe
  2⤵
  PID:8160
- C:\Windows\System\uKXfQpB.exe
  C:\Windows\System\uKXfQpB.exe
  2⤵
  PID:5656
- C:\Windows\System\iurJGcj.exe
  C:\Windows\System\iurJGcj.exe
  2⤵
  PID:6608
- C:\Windows\System\ySxDufD.exe
  C:\Windows\System\ySxDufD.exe
  2⤵
  PID:6816
- C:\Windows\System\bSAbgsm.exe
  C:\Windows\System\bSAbgsm.exe
  2⤵
  PID:6796
- C:\Windows\System\iDCgBmR.exe
  C:\Windows\System\iDCgBmR.exe
  2⤵
  PID:6832
- C:\Windows\System\fsqDprJ.exe
  C:\Windows\System\fsqDprJ.exe
  2⤵
  PID:6732
- C:\Windows\System\CjsaTnl.exe
  C:\Windows\System\CjsaTnl.exe
  2⤵
  PID:6828
- C:\Windows\System\YVUrBeK.exe
  C:\Windows\System\YVUrBeK.exe
  2⤵
  PID:6632
- C:\Windows\System\QRISVas.exe
  C:\Windows\System\QRISVas.exe
  2⤵
  PID:6288
- C:\Windows\System\uMcsvyn.exe
  C:\Windows\System\uMcsvyn.exe
  2⤵
  PID:7248
- C:\Windows\System\jTFtSgd.exe
  C:\Windows\System\jTFtSgd.exe
  2⤵
  PID:7232
- C:\Windows\System\ZdQShFl.exe
  C:\Windows\System\ZdQShFl.exe
  2⤵
  PID:7484
- C:\Windows\System\jQfMXdw.exe
  C:\Windows\System\jQfMXdw.exe
  2⤵
  PID:7136
- C:\Windows\System\YVVVcsA.exe
  C:\Windows\System\YVVVcsA.exe
  2⤵
  PID:7200
- C:\Windows\System\FdueOcE.exe
  C:\Windows\System\FdueOcE.exe
  2⤵
  PID:6912
- C:\Windows\System\cWlYCIU.exe
  C:\Windows\System\cWlYCIU.exe
  2⤵
  PID:7832
- C:\Windows\System\LMlSQdt.exe
  C:\Windows\System\LMlSQdt.exe
  2⤵
  PID:7420
- C:\Windows\System\cGHYJSj.exe
  C:\Windows\System\cGHYJSj.exe
  2⤵
  PID:7432
- C:\Windows\System\BIHwulY.exe
  C:\Windows\System\BIHwulY.exe
  2⤵
  PID:7896
- C:\Windows\System\ngOeXAN.exe
  C:\Windows\System\ngOeXAN.exe
  2⤵
  PID:7716
- C:\Windows\System\NLPJvRo.exe
  C:\Windows\System\NLPJvRo.exe
  2⤵
  PID:7900
- C:\Windows\System\ZotIzjn.exe
  C:\Windows\System\ZotIzjn.exe
  2⤵
  PID:7676
- C:\Windows\System\AWEfpom.exe
  C:\Windows\System\AWEfpom.exe
  2⤵
  PID:8096
- C:\Windows\System\LlmlZAC.exe
  C:\Windows\System\LlmlZAC.exe
  2⤵
  PID:8104
- C:\Windows\System\enoRkwZ.exe
  C:\Windows\System\enoRkwZ.exe
  2⤵
  PID:8156
- C:\Windows\System\xSncuNb.exe
  C:\Windows\System\xSncuNb.exe
  2⤵
  PID:6496
- C:\Windows\System\QozYYlq.exe
  C:\Windows\System\QozYYlq.exe
  2⤵
  PID:6488
- C:\Windows\System\GNQcICl.exe
  C:\Windows\System\GNQcICl.exe
  2⤵
  PID:7000
- C:\Windows\System\CGCbWAO.exe
  C:\Windows\System\CGCbWAO.exe
  2⤵
  PID:7072
- C:\Windows\System\TPTUTZg.exe
  C:\Windows\System\TPTUTZg.exe
  2⤵
  PID:7804
- C:\Windows\System\YJujrkF.exe
  C:\Windows\System\YJujrkF.exe
  2⤵
  PID:5892
- C:\Windows\System\iDmuqKV.exe
  C:\Windows\System\iDmuqKV.exe
  2⤵
  PID:7196
- C:\Windows\System\KPmSjsV.exe
  C:\Windows\System\KPmSjsV.exe
  2⤵
  PID:7384
- C:\Windows\System\QIRPkIE.exe
  C:\Windows\System\QIRPkIE.exe
  2⤵
  PID:6760
- C:\Windows\System\osUuDKj.exe
  C:\Windows\System\osUuDKj.exe
  2⤵
  PID:7520
- C:\Windows\System\ZFhNgXW.exe
  C:\Windows\System\ZFhNgXW.exe
  2⤵
  PID:5220
- C:\Windows\System\AlpwCFz.exe
  C:\Windows\System\AlpwCFz.exe
  2⤵
  PID:8016
- C:\Windows\System\gQPnYpQ.exe
  C:\Windows\System\gQPnYpQ.exe
  2⤵
  PID:7300
- C:\Windows\System\BLBoYpO.exe
  C:\Windows\System\BLBoYpO.exe
  2⤵
  PID:8128
- C:\Windows\System\RlwWSYM.exe
  C:\Windows\System\RlwWSYM.exe
  2⤵
  PID:6524
- C:\Windows\System\bpiRBLW.exe
  C:\Windows\System\bpiRBLW.exe
  2⤵
  PID:8004
- C:\Windows\System\lkiYPaE.exe
  C:\Windows\System\lkiYPaE.exe
  2⤵
  PID:6848
- C:\Windows\System\JkXjlSm.exe
  C:\Windows\System\JkXjlSm.exe
  2⤵
  PID:8180
- C:\Windows\System\vSuyWdS.exe
  C:\Windows\System\vSuyWdS.exe
  2⤵
  PID:7936
- C:\Windows\System\GMLtUCd.exe
  C:\Windows\System\GMLtUCd.exe
  2⤵
  PID:6004
- C:\Windows\System\NkesEFG.exe
  C:\Windows\System\NkesEFG.exe
  2⤵
  PID:8204
- C:\Windows\System\hUbXMeV.exe
  C:\Windows\System\hUbXMeV.exe
  2⤵
  PID:8220
- C:\Windows\System\ezDplMU.exe
  C:\Windows\System\ezDplMU.exe
  2⤵
  PID:8236
- C:\Windows\System\jFXcmPZ.exe
  C:\Windows\System\jFXcmPZ.exe
  2⤵
  PID:8252
- C:\Windows\System\hQNqNIh.exe
  C:\Windows\System\hQNqNIh.exe
  2⤵
  PID:8272
- C:\Windows\System\KixhTvP.exe
  C:\Windows\System\KixhTvP.exe
  2⤵
  PID:8288
- C:\Windows\System\zHDvgdv.exe
  C:\Windows\System\zHDvgdv.exe
  2⤵
  PID:8304
- C:\Windows\System\zhmBTew.exe
  C:\Windows\System\zhmBTew.exe
  2⤵
  PID:8320
- C:\Windows\System\TCoSBXO.exe
  C:\Windows\System\TCoSBXO.exe
  2⤵
  PID:8336
- C:\Windows\System\qLeXIhG.exe
  C:\Windows\System\qLeXIhG.exe
  2⤵
  PID:8360
- C:\Windows\System\gnQPKyz.exe
  C:\Windows\System\gnQPKyz.exe
  2⤵
  PID:8376
- C:\Windows\System\KvzUwQh.exe
  C:\Windows\System\KvzUwQh.exe
  2⤵
  PID:8412
- C:\Windows\System\MRJfAie.exe
  C:\Windows\System\MRJfAie.exe
  2⤵
  PID:8428
- C:\Windows\System\vHIbPLE.exe
  C:\Windows\System\vHIbPLE.exe
  2⤵
  PID:8444
- C:\Windows\System\xrSsgRb.exe
  C:\Windows\System\xrSsgRb.exe
  2⤵
  PID:8460
- C:\Windows\System\gHkGKlV.exe
  C:\Windows\System\gHkGKlV.exe
  2⤵
  PID:8476
- C:\Windows\System\Lmacqwy.exe
  C:\Windows\System\Lmacqwy.exe
  2⤵
  PID:8496
- C:\Windows\System\KJxFCSH.exe
  C:\Windows\System\KJxFCSH.exe
  2⤵
  PID:8512
- C:\Windows\System\fNIBCKK.exe
  C:\Windows\System\fNIBCKK.exe
  2⤵
  PID:8528
- C:\Windows\System\JPeJrEw.exe
  C:\Windows\System\JPeJrEw.exe
  2⤵
  PID:8548
- C:\Windows\System\sucvzio.exe
  C:\Windows\System\sucvzio.exe
  2⤵
  PID:8564
- C:\Windows\System\vfKDcrf.exe
  C:\Windows\System\vfKDcrf.exe
  2⤵
  PID:8580
- C:\Windows\System\NeBHctt.exe
  C:\Windows\System\NeBHctt.exe
  2⤵
  PID:8596
- C:\Windows\System\hWRnBeg.exe
  C:\Windows\System\hWRnBeg.exe
  2⤵
  PID:8612
- C:\Windows\System\ryrgnPK.exe
  C:\Windows\System\ryrgnPK.exe
  2⤵
  PID:8632
- C:\Windows\System\rKsGjTl.exe
  C:\Windows\System\rKsGjTl.exe
  2⤵
  PID:8648
- C:\Windows\System\lMGOOmD.exe
  C:\Windows\System\lMGOOmD.exe
  2⤵
  PID:8664
- C:\Windows\System\vDtpRsC.exe
  C:\Windows\System\vDtpRsC.exe
  2⤵
  PID:8680
- C:\Windows\System\AWBTkZd.exe
  C:\Windows\System\AWBTkZd.exe
  2⤵
  PID:8696
- C:\Windows\System\YPZNkSh.exe
  C:\Windows\System\YPZNkSh.exe
  2⤵
  PID:8712
- C:\Windows\System\RMXeVDZ.exe
  C:\Windows\System\RMXeVDZ.exe
  2⤵
  PID:8728
- C:\Windows\System\LOBZeSo.exe
  C:\Windows\System\LOBZeSo.exe
  2⤵
  PID:8744
- C:\Windows\System\lngPmTM.exe
  C:\Windows\System\lngPmTM.exe
  2⤵
  PID:8768
- C:\Windows\System\vGKUNBN.exe
  C:\Windows\System\vGKUNBN.exe
  2⤵
  PID:8784
- C:\Windows\System\hKbtyeN.exe
  C:\Windows\System\hKbtyeN.exe
  2⤵
  PID:8800
- C:\Windows\System\EMDIMDa.exe
  C:\Windows\System\EMDIMDa.exe
  2⤵
  PID:8816
- C:\Windows\System\FkRKEXg.exe
  C:\Windows\System\FkRKEXg.exe
  2⤵
  PID:8832
- C:\Windows\System\zXRQoIu.exe
  C:\Windows\System\zXRQoIu.exe
  2⤵
  PID:8848
- C:\Windows\System\uittOXG.exe
  C:\Windows\System\uittOXG.exe
  2⤵
  PID:8864
- C:\Windows\System\PTlSLfy.exe
  C:\Windows\System\PTlSLfy.exe
  2⤵
  PID:8880
- C:\Windows\System\QVeWWMi.exe
  C:\Windows\System\QVeWWMi.exe
  2⤵
  PID:8920
- C:\Windows\System\qFIpskM.exe
  C:\Windows\System\qFIpskM.exe
  2⤵
  PID:8936
- C:\Windows\System\YiWzoSf.exe
  C:\Windows\System\YiWzoSf.exe
  2⤵
  PID:8952
- C:\Windows\System\CDQoDUR.exe
  C:\Windows\System\CDQoDUR.exe
  2⤵
  PID:8968
- C:\Windows\System\MEncCQW.exe
  C:\Windows\System\MEncCQW.exe
  2⤵
  PID:8984
- C:\Windows\System\lXwlcSp.exe
  C:\Windows\System\lXwlcSp.exe
  2⤵
  PID:9000
- C:\Windows\System\WNKSatx.exe
  C:\Windows\System\WNKSatx.exe
  2⤵
  PID:9016
- C:\Windows\System\LcktheY.exe
  C:\Windows\System\LcktheY.exe
  2⤵
  PID:9032
- C:\Windows\System\oeQkYpx.exe
  C:\Windows\System\oeQkYpx.exe
  2⤵
  PID:9048
- C:\Windows\System\jHeTiaY.exe
  C:\Windows\System\jHeTiaY.exe
  2⤵
  PID:9064
- C:\Windows\System\SbhGniR.exe
  C:\Windows\System\SbhGniR.exe
  2⤵
  PID:9080
- C:\Windows\System\OAOmxnr.exe
  C:\Windows\System\OAOmxnr.exe
  2⤵
  PID:9096
- C:\Windows\System\DSISnGo.exe
  C:\Windows\System\DSISnGo.exe
  2⤵
  PID:9112
- C:\Windows\System\ywwwAmJ.exe
  C:\Windows\System\ywwwAmJ.exe
  2⤵
  PID:9128
- C:\Windows\System\TKVRMaH.exe
  C:\Windows\System\TKVRMaH.exe
  2⤵
  PID:9144
- C:\Windows\System\KJypBfJ.exe
  C:\Windows\System\KJypBfJ.exe
  2⤵
  PID:9160
- C:\Windows\System\gezgvUm.exe
  C:\Windows\System\gezgvUm.exe
  2⤵
  PID:9180
- C:\Windows\System\yUetEoY.exe
  C:\Windows\System\yUetEoY.exe
  2⤵
  PID:9196
- C:\Windows\System\CGLtAHT.exe
  C:\Windows\System\CGLtAHT.exe
  2⤵
  PID:8196
- C:\Windows\System\GUDROPm.exe
  C:\Windows\System\GUDROPm.exe
  2⤵
  PID:8260
- C:\Windows\System\mbWKbvr.exe
  C:\Windows\System\mbWKbvr.exe
  2⤵
  PID:7436
- C:\Windows\System\uZozgBf.exe
  C:\Windows\System\uZozgBf.exe
  2⤵
  PID:8024
- C:\Windows\System\QYrYNjF.exe
  C:\Windows\System\QYrYNjF.exe
  2⤵
  PID:8328
- C:\Windows\System\iEaKYPi.exe
  C:\Windows\System\iEaKYPi.exe
  2⤵
  PID:8316
- C:\Windows\System\oVDYmZJ.exe
  C:\Windows\System\oVDYmZJ.exe
  2⤵
  PID:7160
- C:\Windows\System\VteDmcm.exe
  C:\Windows\System\VteDmcm.exe
  2⤵
  PID:8352
- C:\Windows\System\iPsxcEi.exe
  C:\Windows\System\iPsxcEi.exe
  2⤵
  PID:8372
- C:\Windows\System\VtnwVqi.exe
  C:\Windows\System\VtnwVqi.exe
  2⤵
  PID:8396
- C:\Windows\System\TMBlGQN.exe
  C:\Windows\System\TMBlGQN.exe
  2⤵
  PID:8424
- C:\Windows\System\GVtcjKA.exe
  C:\Windows\System\GVtcjKA.exe
  2⤵
  PID:8520
- C:\Windows\System\NKCuHSJ.exe
  C:\Windows\System\NKCuHSJ.exe
  2⤵
  PID:8436
- C:\Windows\System\AugVjpB.exe
  C:\Windows\System\AugVjpB.exe
  2⤵
  PID:8472
- C:\Windows\System\yYCkZBH.exe
  C:\Windows\System\yYCkZBH.exe
  2⤵
  PID:8624
- C:\Windows\System\gQjJlpe.exe
  C:\Windows\System\gQjJlpe.exe
  2⤵
  PID:8656
- C:\Windows\System\NfVWbMy.exe
  C:\Windows\System\NfVWbMy.exe
  2⤵
  PID:8572
- C:\Windows\System\SoeCAmi.exe
  C:\Windows\System\SoeCAmi.exe
  2⤵
  PID:8752
- C:\Windows\System\yvACPSR.exe
  C:\Windows\System\yvACPSR.exe
  2⤵
  PID:8692
- C:\Windows\System\fcGAznk.exe
  C:\Windows\System\fcGAznk.exe
  2⤵
  PID:8828
- C:\Windows\System\GSKQahe.exe
  C:\Windows\System\GSKQahe.exe
  2⤵
  PID:8708
- C:\Windows\System\OTaZyiY.exe
  C:\Windows\System\OTaZyiY.exe
  2⤵
  PID:8640
- C:\Windows\System\GYRiRkV.exe
  C:\Windows\System\GYRiRkV.exe
  2⤵
  PID:8776
- C:\Windows\System\czhANlO.exe
  C:\Windows\System\czhANlO.exe
  2⤵
  PID:8840
- C:\Windows\System\VCxwfve.exe
  C:\Windows\System\VCxwfve.exe
  2⤵
  PID:8888
- C:\Windows\System\fIMEwTd.exe
  C:\Windows\System\fIMEwTd.exe
  2⤵
  PID:8932
- C:\Windows\System\AvoPYba.exe
  C:\Windows\System\AvoPYba.exe
  2⤵
  PID:8944
- C:\Windows\System\KqgPXoV.exe
  C:\Windows\System\KqgPXoV.exe
  2⤵
  PID:8916
- C:\Windows\System\CtqvYuT.exe
  C:\Windows\System\CtqvYuT.exe
  2⤵
  PID:9044
- C:\Windows\System\OeJPzhH.exe
  C:\Windows\System\OeJPzhH.exe
  2⤵
  PID:9072
- C:\Windows\System\PSsUmUI.exe
  C:\Windows\System\PSsUmUI.exe
  2⤵
  PID:8992
- C:\Windows\System\phLcZVd.exe
  C:\Windows\System\phLcZVd.exe
  2⤵
  PID:9060
- C:\Windows\System\cMnCmww.exe
  C:\Windows\System\cMnCmww.exe
  2⤵
  PID:9124
- C:\Windows\System\akFtumf.exe
  C:\Windows\System\akFtumf.exe
  2⤵
  PID:8228
- C:\Windows\System\otMdsTk.exe
  C:\Windows\System\otMdsTk.exe
  2⤵
  PID:8300
- C:\Windows\System\WlGdkEX.exe
  C:\Windows\System\WlGdkEX.exe
  2⤵
  PID:8248
- C:\Windows\System\YiHBjRa.exe
  C:\Windows\System\YiHBjRa.exe
  2⤵
  PID:8392
- C:\Windows\System\cEUjQWQ.exe
  C:\Windows\System\cEUjQWQ.exe
  2⤵
  PID:8592
- C:\Windows\System\eIzRWea.exe
  C:\Windows\System\eIzRWea.exe
  2⤵
  PID:8720
- C:\Windows\System\hwNjfwm.exe
  C:\Windows\System\hwNjfwm.exe
  2⤵
  PID:8856
- C:\Windows\System\nmXURfL.exe
  C:\Windows\System\nmXURfL.exe
  2⤵
  PID:9208
- C:\Windows\System\zjeftmC.exe
  C:\Windows\System\zjeftmC.exe
  2⤵
  PID:7624
- C:\Windows\System\ErHVHuu.exe
  C:\Windows\System\ErHVHuu.exe
  2⤵
  PID:8344
- C:\Windows\System\wpLsQcm.exe
  C:\Windows\System\wpLsQcm.exe
  2⤵
  PID:8420
- C:\Windows\System\suxseql.exe
  C:\Windows\System\suxseql.exe
  2⤵
  PID:8620
- C:\Windows\System\mgGluLD.exe
  C:\Windows\System\mgGluLD.exe
  2⤵
  PID:8688
- C:\Windows\System\fccDPEB.exe
  C:\Windows\System\fccDPEB.exe
  2⤵
  PID:8676
- C:\Windows\System\hwacGTq.exe
  C:\Windows\System\hwacGTq.exe
  2⤵
  PID:8876
- C:\Windows\System\JYRPazE.exe
  C:\Windows\System\JYRPazE.exe
  2⤵
  PID:8284
- C:\Windows\System\iGXictY.exe
  C:\Windows\System\iGXictY.exe
  2⤵
  PID:8860
- C:\Windows\System\UaEKNJG.exe
  C:\Windows\System\UaEKNJG.exe
  2⤵
  PID:9092
- C:\Windows\System\tJWSNQX.exe
  C:\Windows\System\tJWSNQX.exe
  2⤵
  PID:8976
- C:\Windows\System\pbXHOwj.exe
  C:\Windows\System\pbXHOwj.exe
  2⤵
  PID:8980
- C:\Windows\System\tKPYmuK.exe
  C:\Windows\System\tKPYmuK.exe
  2⤵
  PID:9156
- C:\Windows\System\pPFnGyz.exe
  C:\Windows\System\pPFnGyz.exe
  2⤵
  PID:8388
- C:\Windows\System\wmBkNzg.exe
  C:\Windows\System\wmBkNzg.exe
  2⤵
  PID:9212
- C:\Windows\System\qFNDndG.exe
  C:\Windows\System\qFNDndG.exe
  2⤵
  PID:8484
- C:\Windows\System\igTSwHv.exe
  C:\Windows\System\igTSwHv.exe
  2⤵
  PID:9176
- C:\Windows\System\roAfpyT.exe
  C:\Windows\System\roAfpyT.exe
  2⤵
  PID:8588
- C:\Windows\System\vWHGFfC.exe
  C:\Windows\System\vWHGFfC.exe
  2⤵
  PID:8508
- C:\Windows\System\ASmRxVx.exe
  C:\Windows\System\ASmRxVx.exe
  2⤵
  PID:9040
- C:\Windows\System\ZtdNHDo.exe
  C:\Windows\System\ZtdNHDo.exe
  2⤵
  PID:9224
- C:\Windows\System\zHYIKLF.exe
  C:\Windows\System\zHYIKLF.exe
  2⤵
  PID:9240
- C:\Windows\System\thKcYWL.exe
  C:\Windows\System\thKcYWL.exe
  2⤵
  PID:9260
- C:\Windows\System\ZtxOOhO.exe
  C:\Windows\System\ZtxOOhO.exe
  2⤵
  PID:9276
- C:\Windows\System\IXgcvkf.exe
  C:\Windows\System\IXgcvkf.exe
  2⤵
  PID:9296
- C:\Windows\System\tewXHep.exe
  C:\Windows\System\tewXHep.exe
  2⤵
  PID:9312
- C:\Windows\System\fQofJpK.exe
  C:\Windows\System\fQofJpK.exe
  2⤵
  PID:9328
- C:\Windows\System\VxdGwqZ.exe
  C:\Windows\System\VxdGwqZ.exe
  2⤵
  PID:9344
- C:\Windows\System\IRnFEyU.exe
  C:\Windows\System\IRnFEyU.exe
  2⤵
  PID:9364
- C:\Windows\System\DpwvUcq.exe
  C:\Windows\System\DpwvUcq.exe
  2⤵
  PID:9380
- C:\Windows\System\SnPxAJT.exe
  C:\Windows\System\SnPxAJT.exe
  2⤵
  PID:9396
- C:\Windows\System\XXbHrav.exe
  C:\Windows\System\XXbHrav.exe
  2⤵
  PID:9412
- C:\Windows\System\SfTcsAd.exe
  C:\Windows\System\SfTcsAd.exe
  2⤵
  PID:9428
- C:\Windows\System\SxfRCrw.exe
  C:\Windows\System\SxfRCrw.exe
  2⤵
  PID:9444
- C:\Windows\System\hGdGZqX.exe
  C:\Windows\System\hGdGZqX.exe
  2⤵
  PID:9460
- C:\Windows\System\HTatrvt.exe
  C:\Windows\System\HTatrvt.exe
  2⤵
  PID:9476
- C:\Windows\System\ZDcCBbb.exe
  C:\Windows\System\ZDcCBbb.exe
  2⤵
  PID:9492
- C:\Windows\System\QdIJiFC.exe
  C:\Windows\System\QdIJiFC.exe
  2⤵
  PID:9508
- C:\Windows\System\RluRgfq.exe
  C:\Windows\System\RluRgfq.exe
  2⤵
  PID:9524
- C:\Windows\System\LrsmmAO.exe
  C:\Windows\System\LrsmmAO.exe
  2⤵
  PID:9540
- C:\Windows\System\xYioNBC.exe
  C:\Windows\System\xYioNBC.exe
  2⤵
  PID:9556
- C:\Windows\System\MuYDqJl.exe
  C:\Windows\System\MuYDqJl.exe
  2⤵
  PID:9572
- C:\Windows\System\SHsxRnO.exe
  C:\Windows\System\SHsxRnO.exe
  2⤵
  PID:9588
- C:\Windows\System\mUycIkD.exe
  C:\Windows\System\mUycIkD.exe
  2⤵
  PID:9604
- C:\Windows\System\VEahRmc.exe
  C:\Windows\System\VEahRmc.exe
  2⤵
  PID:9620
- C:\Windows\System\kEkjhdj.exe
  C:\Windows\System\kEkjhdj.exe
  2⤵
  PID:9636
- C:\Windows\System\ArTcfAX.exe
  C:\Windows\System\ArTcfAX.exe
  2⤵
  PID:9652
- C:\Windows\System\swokaLr.exe
  C:\Windows\System\swokaLr.exe
  2⤵
  PID:9668
- C:\Windows\System\cPDGSbF.exe
  C:\Windows\System\cPDGSbF.exe
  2⤵
  PID:9684
- C:\Windows\System\IvRJwrY.exe
  C:\Windows\System\IvRJwrY.exe
  2⤵
  PID:9700
- C:\Windows\System\lkivnhJ.exe
  C:\Windows\System\lkivnhJ.exe
  2⤵
  PID:9716
- C:\Windows\System\jeDXabW.exe
  C:\Windows\System\jeDXabW.exe
  2⤵
  PID:9732
- C:\Windows\System\Yyzdgbe.exe
  C:\Windows\System\Yyzdgbe.exe
  2⤵
  PID:9748
- C:\Windows\System\hcwwvxl.exe
  C:\Windows\System\hcwwvxl.exe
  2⤵
  PID:9764
- C:\Windows\System\hkEvOid.exe
  C:\Windows\System\hkEvOid.exe
  2⤵
  PID:9780
- C:\Windows\System\zQWIBKi.exe
  C:\Windows\System\zQWIBKi.exe
  2⤵
  PID:9796
- C:\Windows\System\ksqEdZe.exe
  C:\Windows\System\ksqEdZe.exe
  2⤵
  PID:9812
- C:\Windows\System\NhBwDwS.exe
  C:\Windows\System\NhBwDwS.exe
  2⤵
  PID:9828
- C:\Windows\System\uqKpVmr.exe
  C:\Windows\System\uqKpVmr.exe
  2⤵
  PID:9844
- C:\Windows\System\mqiBFwS.exe
  C:\Windows\System\mqiBFwS.exe
  2⤵
  PID:9860
- C:\Windows\System\GzKyxQL.exe
  C:\Windows\System\GzKyxQL.exe
  2⤵
  PID:9876
- C:\Windows\System\WvmuPzS.exe
  C:\Windows\System\WvmuPzS.exe
  2⤵
  PID:9892
- C:\Windows\System\dqVwMan.exe
  C:\Windows\System\dqVwMan.exe
  2⤵
  PID:9908
- C:\Windows\System\qbRJjLo.exe
  C:\Windows\System\qbRJjLo.exe
  2⤵
  PID:9924
- C:\Windows\System\mxcgvZU.exe
  C:\Windows\System\mxcgvZU.exe
  2⤵
  PID:9940
- C:\Windows\System\ImaGkIo.exe
  C:\Windows\System\ImaGkIo.exe
  2⤵
  PID:9956
- C:\Windows\System\UekQksM.exe
  C:\Windows\System\UekQksM.exe
  2⤵
  PID:9972
- C:\Windows\System\hRJPDRa.exe
  C:\Windows\System\hRJPDRa.exe
  2⤵
  PID:9988
- C:\Windows\System\GOBpETq.exe
  C:\Windows\System\GOBpETq.exe
  2⤵
  PID:10004
- C:\Windows\System\MPGIIml.exe
  C:\Windows\System\MPGIIml.exe
  2⤵
  PID:10020
- C:\Windows\System\OorpbJl.exe
  C:\Windows\System\OorpbJl.exe
  2⤵
  PID:10036
- C:\Windows\System\YLBobva.exe
  C:\Windows\System\YLBobva.exe
  2⤵
  PID:10052
- C:\Windows\System\JjboNKA.exe
  C:\Windows\System\JjboNKA.exe
  2⤵
  PID:10068
- C:\Windows\System\tJAmXSd.exe
  C:\Windows\System\tJAmXSd.exe
  2⤵
  PID:10084
- C:\Windows\System\IOPCvXW.exe
  C:\Windows\System\IOPCvXW.exe
  2⤵
  PID:10104
- C:\Windows\System\GUhtfMj.exe
  C:\Windows\System\GUhtfMj.exe
  2⤵
  PID:10120
- C:\Windows\System\didNbtY.exe
  C:\Windows\System\didNbtY.exe
  2⤵
  PID:10136
- C:\Windows\System\ULyaBPs.exe
  C:\Windows\System\ULyaBPs.exe
  2⤵
  PID:10152
- C:\Windows\System\SRWjnXZ.exe
  C:\Windows\System\SRWjnXZ.exe
  2⤵
  PID:10168
- C:\Windows\System\MXnXeey.exe
  C:\Windows\System\MXnXeey.exe
  2⤵
  PID:10184
- C:\Windows\System\kyQuIUW.exe
  C:\Windows\System\kyQuIUW.exe
  2⤵
  PID:10200
- C:\Windows\System\kAzdzRj.exe
  C:\Windows\System\kAzdzRj.exe
  2⤵
  PID:10216
- C:\Windows\System\noDUYhd.exe
  C:\Windows\System\noDUYhd.exe
  2⤵
  PID:10232
- C:\Windows\System\UMDcrhi.exe
  C:\Windows\System\UMDcrhi.exe
  2⤵
  PID:8928
- C:\Windows\System\htbBPFE.exe
  C:\Windows\System\htbBPFE.exe
  2⤵
  PID:8704
- C:\Windows\System\pnFUDyX.exe
  C:\Windows\System\pnFUDyX.exe
  2⤵
  PID:9136
- C:\Windows\System\ZXssnyJ.exe
  C:\Windows\System\ZXssnyJ.exe
  2⤵
  PID:9232
- C:\Windows\System\pLVtfuu.exe
  C:\Windows\System\pLVtfuu.exe
  2⤵
  PID:8672
- C:\Windows\System\SYtXWlU.exe
  C:\Windows\System\SYtXWlU.exe
  2⤵
  PID:9252
- C:\Windows\System\YWclSMI.exe
  C:\Windows\System\YWclSMI.exe
  2⤵
  PID:9192
- C:\Windows\System\urJqeqv.exe
  C:\Windows\System\urJqeqv.exe
  2⤵
  PID:9304
- C:\Windows\System\YBLPutc.exe
  C:\Windows\System\YBLPutc.exe
  2⤵
  PID:9388
- C:\Windows\System\qvayGEO.exe
  C:\Windows\System\qvayGEO.exe
  2⤵
  PID:9360
- C:\Windows\System\QYhWHdC.exe
  C:\Windows\System\QYhWHdC.exe
  2⤵
  PID:9452
- C:\Windows\System\xaykcEs.exe
  C:\Windows\System\xaykcEs.exe
  2⤵
  PID:9468
- C:\Windows\System\wVIqZjd.exe
  C:\Windows\System\wVIqZjd.exe
  2⤵
  PID:9532
- C:\Windows\System\mAAEdUe.exe
  C:\Windows\System\mAAEdUe.exe
  2⤵
  PID:9628
- C:\Windows\System\qavLlNs.exe
  C:\Windows\System\qavLlNs.exe
  2⤵
  PID:9724
- C:\Windows\System\nypTMTx.exe
  C:\Windows\System\nypTMTx.exe
  2⤵
  PID:9788
- C:\Windows\System\kHufldY.exe
  C:\Windows\System\kHufldY.exe
  2⤵
  PID:9856
- C:\Windows\System\QVSarfu.exe
  C:\Windows\System\QVSarfu.exe
  2⤵
  PID:9552
- C:\Windows\System\NROqBEI.exe
  C:\Windows\System\NROqBEI.exe
  2⤵
  PID:9616
- C:\Windows\System\WTMDLUW.exe
  C:\Windows\System\WTMDLUW.exe
  2⤵
  PID:9708
- C:\Windows\System\KcmokLh.exe
  C:\Windows\System\KcmokLh.exe
  2⤵
  PID:9776
- C:\Windows\System\ErGyjYn.exe
  C:\Windows\System\ErGyjYn.exe
  2⤵
  PID:9868
- C:\Windows\System\QdLtzXo.exe
  C:\Windows\System\QdLtzXo.exe
  2⤵
  PID:9920
- C:\Windows\System\pFFlMgz.exe
  C:\Windows\System\pFFlMgz.exe
  2⤵
  PID:9984
- C:\Windows\System\eQtDblb.exe
  C:\Windows\System\eQtDblb.exe
  2⤵
  PID:10044
- C:\Windows\System\FiJCkow.exe
  C:\Windows\System\FiJCkow.exe
  2⤵
  PID:9996
- C:\Windows\System\RbLwbLz.exe
  C:\Windows\System\RbLwbLz.exe
  2⤵
  PID:10032
- C:\Windows\System\UWfulRr.exe
  C:\Windows\System\UWfulRr.exe
  2⤵
  PID:10144
- C:\Windows\System\YymiJyQ.exe
  C:\Windows\System\YymiJyQ.exe
  2⤵
  PID:10208
- C:\Windows\System\LsBblAv.exe
  C:\Windows\System\LsBblAv.exe
  2⤵
  PID:8808
- C:\Windows\System\iRFQapW.exe
  C:\Windows\System\iRFQapW.exe
  2⤵
  PID:8268
- C:\Windows\System\mBgfELj.exe
  C:\Windows\System\mBgfELj.exe
  2⤵
  PID:8824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CjgEQNI.exe

Filesize
2.9MB

MD5
0f43090c72835a4e192af2fa1043567d

SHA1
ddaf4174222ad784f4028fc6c81f3ffa8774274b

SHA256
06d83d93fb00fb88643c3fb4b1bf839255d203fb95713414f1d258dda04d2b11

SHA512
973c052aa1e20d18d06b6c9f1e2bf561c76e1a66fae7fc5f474b2d9a76041b0b0f304aa7a96f00654f51a7b5e123dc9fb5185ef8a4586571845089b9f2db0e10

Download Submit
C:\Windows\system\EKoYiWI.exe

Filesize
2.9MB

MD5
34261c84a32da7e9b846229be928a2b5

SHA1
1120db8c5396e58890bdace6e8619dd9beed3dd2

SHA256
80d36d10893a4d73f5e67eae864193ec4dab22ffd6e4f4c1ab094a18e65d1e80

SHA512
1c12b7536020f267ba577a11ba8d06f2ef316d0148ae7b5f020bf4b2f11cb0d8e3460efb9e7b92004a3a5e1a0d278b4133ac372c18bc313344101625c507031f

Download Submit
C:\Windows\system\EzlOkge.exe

Filesize
2.9MB

MD5
55236caa4cd980148db31f5918682aff

SHA1
b5f0742829bfbebadc67740c0ed6225c02edddbf

SHA256
9759d0170139d1636efb869d9999365e4dbbfd8574114e6cb98f0b01dd2f91bf

SHA512
abff86a86c192c2ccccde9c8107f5add1692d196a35c871a5386076d60e5bf0748b69277beaea9486ad9dc207d7078b41c542c174cb75e357b45e42012b030a8

Download Submit
C:\Windows\system\LKeeQez.exe

Filesize
2.9MB

MD5
e3b6fee1c72aeaa1c4bf91fdf4996a6e

SHA1
9fce4284440723c67b4fbe7817b4fb2c6327d947

SHA256
783d6c26764709912b9fea07dc988b1e4d98303b4cd580b63b2ae47542498346

SHA512
b8fec92a1df149c3ea011672a670b48689ad08def10b2c27ab1296ea544ea53e99abe29e528e38239e7a7d162018b65112172930696e7c8b54e239244b5b5b4b

Download Submit
C:\Windows\system\LVrzRuR.exe

Filesize
2.9MB

MD5
c5624cf00806353e5a5fcd531e2cc409

SHA1
f07874ca5bf3430f5d2379fd755e3919dff3fb19

SHA256
4fff35762f1d9afa391ea018007acc58adf5abdcec47ba1c420a713f14a89aa8

SHA512
6a7e2efa830f8d2c6778117c7ba465307e432f935887eea3fb5eb593a50cca7c17d28c666acc01c2266c6a6a8948034ff2da1e1de1b00ac13079f866dcbf88e7

Download Submit
C:\Windows\system\MnYfVgn.exe

Filesize
2.9MB

MD5
a63d4c6210f3ebed52c06f0f0fe43c8c

SHA1
a93278f41a59e61c70f417e6c81549ff45bff6c3

SHA256
eb2f12a0784e5745775e30b52e7c19c0356ddea04cafa765a82da200b5d354f0

SHA512
7080b63f9b89722bea3f9e7f413ba5eb2612344d4aadf90b397d17fa2abe2e3989caa07e4655c66cfa78d5bf5dfc5ad48a30c47042895834812f183a2e4c4089

Download Submit
C:\Windows\system\MtPhFDU.exe

Filesize
2.9MB

MD5
9ed7c639e127f4dda8f5cd96c8086ace

SHA1
b552255e5fe0e53265c33390373909c815a6ab94

SHA256
fd41c47fc97701d8af0b2e8f52a59695745e3da040cdc06d364c9347193a5b8e

SHA512
7e3400ccdeff062e6735c27793b337d50ff770b23cc2075a1be3ddc3fce3c12695fb6a77445979151125ba4f6614728910aaeccc6040498c6fa96c443d893fb3

Download Submit
C:\Windows\system\PCkXxZS.exe

Filesize
2.9MB

MD5
724b64335ac90fec436000269e335a7d

SHA1
af82c6558aa61e9423f38f9664ce57e80d926ec2

SHA256
d857d8ae8b78ea6f800c2d6d3b78fe6a11bd6c9cbb6081df11e0e3b5510794b3

SHA512
00c50dd57f4d3e20b3c22898736c93606cb7a53f99eea4232848057e81f0f85a261d7fa42700a57a7128e94c11f9f52e5c8980e3ddae67ab1b6fb1c475000518

Download Submit
C:\Windows\system\PSXObfP.exe

Filesize
2.9MB

MD5
d13b6a1eb704f24c52653804adc59a1c

SHA1
b460d0568d193af32b6adc5ee3274c993f6e8f49

SHA256
d3dd4c7d855fa877e616557a557471f99a509c2fae0a44a6468e248687bd94d5

SHA512
639d5b235c88d53878d263027eb2654a4ffdd34709e5ffd91c4a16f371651dc10eb20a005c8e0bdb0b49ee0ae2e255ef0ffb3ec801cdb7fae858b296216c5d37

Download Submit
C:\Windows\system\PijMJtl.exe

Filesize
2.9MB

MD5
1483d2d78bdd4d7095fa1dd87a38f8da

SHA1
5afb64331fc6285d6bb32381c16083e15f722819

SHA256
d1d7c2513bc73919bb9830cf92f9b71509e254a8e0aaf695a00578165f2529ad

SHA512
2d7a001c31e01c79b60418dde3add33ca093b9824ecc8cd666c2ce8d6e662fd0759e58015ae262d5f758fa699036e6ba4a483c9024f0927acb030df9d8666c33

Download Submit
C:\Windows\system\TomBRSj.exe

Filesize
2.9MB

MD5
1b5cd298a0e371dee997bf5d02d843a6

SHA1
0bef337c31fc36819075e828b5ba154e2f609d82

SHA256
ba4127426b45db592923c93a9ed7a68264b862781bcdff9e8d85b294e075fbfa

SHA512
2ec268ef73f3e5c6333820565ee3a5e5f53a1fda4c987c69bb6ccbbe9eb824224585400db7beb12ca97fe4a03814c0f524067fb1002390fda30257ebff14a95f

Download Submit
C:\Windows\system\WdlMyUg.exe

Filesize
2.9MB

MD5
caadb840b4f552772d7fe432e9c52e73

SHA1
a06a5aa1886368dedf7591bbeb56afca446030af

SHA256
98a54488288bcb5d8fb2123145dec4e4dbaac375e3ed82ca43a952ccc0fc52ac

SHA512
7979e40ff3f6213b247d89832649e1d5c1281a419f5af7f3bd87f8db019fabf8e34578ba16ba7ca2db8399d9fddc2892d367254f8874e2ba37721af1b3d4fa31

Download Submit
C:\Windows\system\XBxenCI.exe

Filesize
2.9MB

MD5
b194fdc643b4568256ff8f41b8816207

SHA1
f1994c9bdafcf415293b0edfb0146675b855a405

SHA256
5036bef5e9565479e32d958b80227e0a784b35f47ae090bc32baf9717ca58cba

SHA512
8135b904813d7f859b33e25793ac351982ea8d1793addf1126a53e6fcc4ddc3cc51b52b9132bcdb70f3dc431a3c138f739affc253a00a89a0e75b26956c93b9f

Download Submit
C:\Windows\system\fIKJRrL.exe

Filesize
2.9MB

MD5
ead9ea7725a5542bda57b248b548c719

SHA1
b31a2b0e6ddf5212ed9c871e6962aca378d06ada

SHA256
91f4b7bb1b57df1bd257172eedd452851b22579db1ca91795a667d30a88b6573

SHA512
eed6d9ef2800a95bce41b8d6bdc109ec78d62bd0717df38f82b90b25989e1156101ad4a4121fa33e94ecdf15b650142b606433467845ba53c20b42ba7c7aed72

Download Submit
C:\Windows\system\lntQdyX.exe

Filesize
2.9MB

MD5
687e3ee56f5d2e8450cffa7b1f8368b6

SHA1
0f79e697d85253c87772daa1b5ea81d8cff2e51a

SHA256
32f1be4f5c631a7de84cda95c9d5c8bbfbdf09dc74f331ff8ef6fc746f049e41

SHA512
932ff4dd94a06ff7d8c6e4c7aaa5f08ae1273586a13645f990a40cac60863e0bc0e4e8fe7dd4db82f11202a7f08c94b76aa1b6cfe8e1b9ee183441a254e7785a

Download Submit
C:\Windows\system\lxNVPXl.exe

Filesize
2.9MB

MD5
1d42aab585d1e4126d8a8b4d3e104388

SHA1
c65b3ed10d59ae376cee0fe28daf1cda09555d26

SHA256
d5603c7db93e9c35422f5a36a56e358a4bba98d5ced434cc0e2e2a93fd8fe7e1

SHA512
e8fa1542e4f873a612e08e3e6094157634d4f171c743f11e9c74f766fc9415632e5ac44b6d23eb10d0ed4fb53c5b4e933306f555f651f134248265f464528e95

Download Submit
C:\Windows\system\sQsjvqb.exe

Filesize
2.9MB

MD5
846b7c63248bd6a2b36ddc38a12c6f4b

SHA1
421b4ebb31d40be4dc0601a06958060d3508fc43

SHA256
938cffc173affca5fa021da97ef17a4a39d7b25702094279715a082bd5327665

SHA512
e46640489bf183ad5192b2c1b779736c1ae577f1e6d603d359996882df8cd493d0c7ea08b10356b55c593c4318e78860df7ab15a9285929134f2ac550a1056d4

Download Submit
C:\Windows\system\uAGLIRm.exe

Filesize
2.9MB

MD5
c3f4e265ebb52cc740957a58de589805

SHA1
c1c8af040a27a8d9ca9a9965d560971ebb0c14f4

SHA256
b865234e2a1351b4a9408b4f8e310e3286a3b099c47d57d235c3d9c414cf66d3

SHA512
ffdd57ced34a5613c6e071d3e8a57f7afdf39e22f95fcdbddedd364cfd5b391460de9dcebfdb15ae9e19d7a4726c3b2dbc64ae636ee2ceb429d46186a038ca97

Download Submit
C:\Windows\system\vQPdbkC.exe

Filesize
2.9MB

MD5
390c4af1e231e6d4a12156caf8ecea1f

SHA1
2d76f73ce6a577e51d8dffcbb2ea7d5307b0c581

SHA256
e725b6c058e1f7054fec96d56f55b8cd1b2be524f2223d8bf3ff0b621d05b0f9

SHA512
f8f46a09195c420f429792ad1afd8a98c21e4f9fe8038540a83c65082835590afe2a30c5d8c1bc869836201d96512cca19a17f37c4f1ce711324c1fe56038105

Download Submit
C:\Windows\system\wCNVlFz.exe

Filesize
2.9MB

MD5
4cd5c288f76f534cf3d05e92f117cd1b

SHA1
b4856f02f36822d7126ac0aed15a68e380438d45

SHA256
5d00ae764367eed849746363c490284a7f81dab5a75bbcc0758a19103c7e3b16

SHA512
aad540478c84c4f0fd0bdac5e50bc701bbcec53b73b5e4d8e6351f1611b1e9bc8855a3bd6918cb8c3092c139f0874ccce844e88bdcc50948e8ecded9126089ef

Download Submit
C:\Windows\system\zCrSZUJ.exe

Filesize
2.9MB

MD5
c855206273c5010f836d3620935b2813

SHA1
81ad075119353b1898a5fba7c1cf39dd1be68165

SHA256
519d99b7730465d5de564ce088e9b5439a345908fbc29db8cca2d2d8b5e81f48

SHA512
5d3a271a68bc01aa8fb72f2b7e2443768fb9c4f9d4394cfa2c88d3dfbdd248d9ac02e29d5ddfe8e2205af7d631ecc29c06c9d540b3070a9e51a5f2e4ac591da4

Download Submit
C:\Windows\system\zyVbuBv.exe

Filesize
2.9MB

MD5
d169c051465328ac7bfd2e919f5b9c89

SHA1
a2122152bafe64bc03f26ae1b5287ded62ebd7b9

SHA256
429d25bb1de771f0e5521f783a1435ad2f708055e228d617f162904809be5f93

SHA512
fb0d2df9b6671f8fbf948a46488f637fd7a5b9d72644a441162baa6a3f76bc39fc1ecd9dec4d74c7c3e327484f48b07ecb45a8c4798b1f668048b1f1a2c3cde1

Download Submit
\Windows\system\AIHZBEu.exe

Filesize
2.9MB

MD5
d954906451274c67040bb1f2a464ab90

SHA1
a79d88b54c8a135a79241c868e2d16e1d62b1a23

SHA256
732480d6209e3a9a80d953a3d52bc5a26c53e209ddd70f03543bb114687327da

SHA512
8ecefe72f0f06b10be518308f8b10f61cff17858b167ecd41791f3e5c27fe138feef1feaac053bf975494314eff3e40ee3fbfa895a743b0bc26b6e194551889e

Download Submit
\Windows\system\DBnjWPK.exe

Filesize
2.9MB

MD5
9a25098bf28c1a141abe1512bb75470f

SHA1
2e8160c94a72e1a02fc5c0fa94b0c6cf2862edf9

SHA256
ef9a938d3074ba8555d85ae15add5e51583d3383dac15605af64c8de24c9d334

SHA512
421b51649e799e097fae757d049f6e73a590a48a3fff07cb909aed615fece34f9e97f02f26b859d9025ec1184575426fa01c35cd8c3da023cc0cab75d682ad8b

Download Submit
\Windows\system\FkokYuF.exe

Filesize
2.9MB

MD5
3eeb0d60735c17b378ed276a9f12e761

SHA1
5c41ac2abb1a0b70556006c2d1df2c2d45a6bfb1

SHA256
8b42f50c52d934c9402025c2b9641cdd0c7d45bfd3b4b456ca27ab81fd470457

SHA512
07de7f77cb8a0a8723dbd40da4129e6e336da7ef0efe10911999fa020937cd94970522999acb03586e0ab7602279bb868ab94ed52f505c998aaf0e27058fbe74

Download Submit
\Windows\system\HdmsYzG.exe

Filesize
2.9MB

MD5
3b501bef3939ed1433780bb4e3f28744

SHA1
8e49ca0de91f00beaae59b78eb7e59121bb94c4d

SHA256
b42b752a0085f849a8123b7d8db72c06d8806b1011683f2cefc4938984d2b0e5

SHA512
e0105eef424e5354345938a88423bb72872b0296c22c140f7e07170171cdb738302df605bf53398a1f1db6ccfba0f8fdaca43278781a6ef2df5fe2f0927cacf5

Download Submit
\Windows\system\XMfbxog.exe

Filesize
2.9MB

MD5
7d5a1c2bc2b8f10d08932489e93cd805

SHA1
d1198decf11da042b7dc382a4ac5f09b96d55115

SHA256
a166cd4ee3df4c5cda67d12609b7e308180075967827fd6337fece218bab62bb

SHA512
abe786b33a70ce02c4a5b45a05b2d41a7b900f12f0dbec8859177ba2c1588d8542f8759ee423675aa7af6d4c03402c428a16ae0dbc362934f04b878789d6eb94

Download Submit
\Windows\system\YZRXjaA.exe

Filesize
2.9MB

MD5
98306d0b728063abff308d4076e59ea4

SHA1
703057b9e8e6a0e2fcb350a80546a490f8530f7a

SHA256
dc48f90ff3d8ad297fbe3f522c6262d79339f4305e4fa41a977efde94b4b3e25

SHA512
46d01e7f5b6ac8c7667ac6197e5bfaaab0cffe644a96d2725f5108413b689a3a2b385bbe70aa4d0169b568985d3fb217b123004b82f087494d33b400dd8ccc74

Download Submit
\Windows\system\jUvqevZ.exe

Filesize
2.9MB

MD5
8bdeac07958cdb84f520492f665556d3

SHA1
91372a21d02f528c7d7064d066f9e3add0d7ed8e

SHA256
8c7d21753187d138f9134502028db7623ee3de7233cdfac9a6829efaaa3d3fdf

SHA512
ca931d50848933c10fa2112e6eb2469f02846253d491b0f5d9287052f1dfc08eca8b0021fb2199f25c3ab82589fbe59fb95dbdb263c142fadaf46fc972ce72d2

Download Submit
\Windows\system\mthYXfe.exe

Filesize
2.9MB

MD5
22edaefdc68ccc988f6ef093f7789ecc

SHA1
1378eb65468a4e2c17d0ef861ccecafd026cb744

SHA256
0d2e1cb8747b5a4be2f16b1602e086215bf7f01d4fa559e982a31c2f48a66565

SHA512
865bd157895af3e13b5a29f6fde5f774a92c5084cbe549e4218031859568e3799dbba9a2dd7f6182efcadbb2ec93f326fb2037e3047036ccddc620889e0af9df

Download Submit
\Windows\system\nmAsCWF.exe

Filesize
2.9MB

MD5
8c4a8b3f84ab8fb04764d8bae0d50b39

SHA1
f29b02a6920c61e6a575336a68da1731cfef0b09

SHA256
197dff06157cffbd06461397cd4024a1b068cfa810abc22b4ff9513bc0174a87

SHA512
bbe182fc80dcfc1b2f5d3796e2d41698f999c5edf87be3d22ed96bb27c8f94a24c412340c7178e1ccb3082b66ec30e8abaf596c2fcc0f704782b998a7d3ba8d7

Download Submit
\Windows\system\oppCQhx.exe

Filesize
2.9MB

MD5
3424fb1769bade75a5e99a63918b1777

SHA1
c86851fb0ac498d678425c81b09aad4bab992ba7

SHA256
a36fe7d4c12ebec112171cc0eefc1d30b363fd588b868283040677db02959e1c

SHA512
93ac4d626a512976f7d9fdd62297603e25355d30351e294baaba090223fa787106b52fd0dc491f6e67584f996128050b1caee17b403f7f32c815577331c986c9

Download Submit
\Windows\system\tyHoeud.exe

Filesize
2.9MB

MD5
f6313f3324e50ccce910d7d86c124ddd

SHA1
996b8d9289040de519f3f3f8b0cf0fdd6891b651

SHA256
0e9590a69363af6785c43df56286ed1332a70d4acfc380d455f6adc360f89de4

SHA512
eafb7c30dd6c1516d554e43842a420ba09eae107228c144bee92246443268902516ff6a9d558b30e717df5fdbc10a0f8a15b764f4fdd31920fcaf759ab3bf54a

Download Submit
memory/1860-75-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2000-95-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2000-30-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2192-61-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/2280-50-0x00000000022E0000-0x00000000022E8000-memory.dmp

Filesize
32KB

Download
memory/2280-49-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/2324-87-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2324-25-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2532-27-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2532-5939-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2548-67-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-34-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-91-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2612-28-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2612-72-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-11122-0x0000000003600000-0x00000000039F2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-94-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2612-92-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-63-0x0000000003600000-0x00000000039F2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-43-0x00000000030D0000-0x00000000034C2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-47-0x00000000030D0000-0x00000000034C2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-8759-0x0000000003600000-0x00000000039F2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-1-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-12539-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-74-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-11544-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-31-0x00000000030D0000-0x00000000034C2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-6-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2644-41-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2680-45-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/2680-927-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/2864-93-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2864-5915-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2964-6016-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-65-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download