xmrig | 2a36b13f61c115e30a8843a2960ad3ee7e152347cd749423ac20416bd372026f

Analysis

max time kernel
30s
max time network
31s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
Size

1.4MB
MD5

0679918cbbf45d8f55c895316b4b350e
SHA1

1ce912b813a7925ee057e6337acd6b711195d53b
SHA256

2a36b13f61c115e30a8843a2960ad3ee7e152347cd749423ac20416bd372026f
SHA512

1b0f32b1b05bb414e24bff0179e49b91677eb442d206185f05e519fd8fe2e00ec5d0734bc3fe60a1cd54b0f85298a65254bdf8e45ec9d7107e3df0aa0001bf5c
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPw1g6:Lz071uv4BPMkibTIA5CJGb

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2608-18-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig
behavioral1/memory/2232-61-0x000000013F270000-0x000000013F662000-memory.dmp	xmrig
behavioral1/memory/2528-58-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2720-44-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/2872-42-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig
behavioral1/memory/2876-40-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2776-390-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/3056-1060-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/2384-1059-0x000000013FD60000-0x0000000140152000-memory.dmp	xmrig
behavioral1/memory/2608-1372-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3056	icpcvKU.exe
2608	nOkHvLy.exe
2876	MhnkPsl.exe
2872	PfvhfAA.exe
2720	iYoimJW.exe
2528	HZCtNYO.exe
2232	sNLWZdo.exe
2980	LKKJdZR.exe
2776	PJiHapQ.exe
2824	ScIVikq.exe
2844	ugzAjxo.exe
2932	RgkiCAh.exe
1748	dtnKeIO.exe
1768	hoLzeXr.exe
1644	GiXDCBD.exe
2692	YHoqkMV.exe
1524	qPmagco.exe
1356	GYNCmGP.exe
2280	plLyGlM.exe
2892	WUaMwXm.exe
2024	ezJndAd.exe
684	cMrWgoa.exe
1324	FQwvaLd.exe
1108	viDeAWt.exe
1080	FlEXXSR.exe
1044	iYIFTtS.exe
1064	DrWRgNZ.exe
1880	ygOaIxG.exe
1364	ACiDHKy.exe
1424	iODRtXM.exe
1068	zbhAgdq.exe
1804	IPRJWyg.exe
2072	HmMKqjr.exe
1696	AUZJiGC.exe
1152	ZsiSaII.exe
1312	mWERbUh.exe
896	DCNcrjY.exe
2148	AmOZCBY.exe
1824	IPhIOom.exe
2992	ofenvZo.exe
2688	yCIqFSG.exe
320	jVjqPGG.exe
2796	ZcEzKmH.exe
900	dYhgrIk.exe
2696	ayyKCib.exe
2176	tkBhwoY.exe
352	SqtItaE.exe
1944	mDDYHuM.exe
1508	SfqXrQQ.exe
408	tYsmOpQ.exe
1104	wOWhUTm.exe
1996	tlBWXqf.exe
1408	hXFcXCQ.exe
3000	EtVDlTn.exe
2352	wZCzMcF.exe
1892	JARUjdH.exe
3096	uOYDnxq.exe
3128	yBXRFkz.exe
3160	bzKWUhc.exe
3192	tcIgEmi.exe
3224	rWNehPU.exe
3256	MNWGlGz.exe
3288	mLLxnUC.exe
3320	YYkGvnD.exe

Loads dropped DLL 64 IoCs

pid	Process
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2384-1-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/files/0x000d000000014323-3.dat	upx
behavioral1/memory/3056-16-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/memory/2608-18-0x000000013F610000-0x000000013FA02000-memory.dmp	upx
behavioral1/files/0x0038000000014502-7.dat	upx
behavioral1/files/0x001800000000558a-23.dat	upx
behavioral1/files/0x0008000000014702-22.dat	upx
behavioral1/files/0x00080000000149e1-27.dat	upx
behavioral1/files/0x0007000000014b10-49.dat	upx
behavioral1/files/0x0007000000014b36-56.dat	upx
behavioral1/memory/2232-61-0x000000013F270000-0x000000013F662000-memory.dmp	upx
behavioral1/memory/2528-58-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/2720-44-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/memory/2872-42-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/memory/2876-40-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/files/0x0009000000014dae-65.dat	upx
behavioral1/files/0x0006000000015c93-72.dat	upx
behavioral1/files/0x0006000000015cbd-88.dat	upx
behavioral1/files/0x0006000000015cf5-102.dat	upx
behavioral1/files/0x0006000000015d4c-116.dat	upx
behavioral1/files/0x0006000000015e6d-123.dat	upx
behavioral1/files/0x0006000000015fa7-130.dat	upx
behavioral1/files/0x00060000000161b3-137.dat	upx
behavioral1/files/0x0006000000016a6f-158.dat	upx
behavioral1/files/0x0006000000016ce4-179.dat	upx
behavioral1/files/0x0037000000014588-77.dat	upx
behavioral1/memory/2776-390-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/files/0x0006000000016cb2-174.dat	upx
behavioral1/files/0x0006000000016c42-167.dat	upx
behavioral1/files/0x0006000000016c1d-160.dat	upx
behavioral1/files/0x0006000000016813-153.dat	upx
behavioral1/files/0x000600000001654a-146.dat	upx
behavioral1/files/0x00060000000162c9-139.dat	upx
behavioral1/memory/3056-1060-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/memory/2384-1059-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/memory/2608-1372-0x000000013F610000-0x000000013FA02000-memory.dmp	upx
behavioral1/files/0x00060000000160cc-132.dat	upx
behavioral1/files/0x0006000000015f3c-125.dat	upx
behavioral1/files/0x0006000000015e09-118.dat	upx
behavioral1/files/0x0006000000015d44-111.dat	upx
behavioral1/files/0x0006000000015d0c-104.dat	upx
behavioral1/files/0x0006000000015ce3-97.dat	upx
behavioral1/files/0x0006000000015cce-90.dat	upx
behavioral1/files/0x0006000000015cb0-83.dat	upx
behavioral1/files/0x0006000000016c8c-172.dat	upx
behavioral1/files/0x0006000000016c3a-165.dat	upx
behavioral1/files/0x00060000000165f0-151.dat	upx
behavioral1/files/0x0006000000016476-144.dat	upx
behavioral1/files/0x0006000000015d24-109.dat	upx
behavioral1/files/0x0006000000015cd9-95.dat	upx
behavioral1/files/0x0006000000015c9c-81.dat	upx
behavioral1/memory/2980-68-0x000000013F570000-0x000000013F962000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\cMrWgoa.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\iODRtXM.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\YYXhGtn.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\mqIQSlW.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\gHEXOFF.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\JCCaDcT.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\aJPSnJL.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\IJCkzHx.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\xmHaOTo.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\RLKZQoS.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\xoOPimN.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\kKOYRCw.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\ygOaIxG.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\ZcEzKmH.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\uOYDnxq.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\yBXRFkz.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\kYHvsHX.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\GGdnBZU.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\ushphkz.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\LLovOoM.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\nLdYbOX.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\ayyKCib.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\ooUwSnQ.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\OkgqZcx.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\IWzKBfv.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\IOUljdl.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\NSjVfGl.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\PcuYWyL.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\gBRodMV.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\rUTKXKD.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\DfvYfsn.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\FGldndi.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\kNEgnlU.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\YRMNgxN.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\KULTOFG.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\AwHkCjH.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\jVhoABD.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\ZObSJJv.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\nOkHvLy.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\ugzAjxo.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\NMTEZlY.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\euTNlpG.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\WDIdTKq.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\wZCzMcF.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\stxikth.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\AGxCXoS.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\refuRpI.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\dPpVJqN.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\FIJbSUp.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\lnbmFTx.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\vGjhSMc.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\SfqXrQQ.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\FHtEUOx.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\YRvVgMz.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\xujxYMp.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\gzUAfxT.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\ZDzrbjX.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\IvGkqoJ.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\LmIGZjn.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\UBZbqRQ.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\SWFCrkM.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\qFaNmfx.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\kQxzQbw.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
File created	C:\Windows\System\tkBhwoY.exe	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1160	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
Token: SeDebugPrivilege	1160	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 1160	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	29
PID 2384 wrote to memory of 1160	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	29
PID 2384 wrote to memory of 1160	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	29
PID 2384 wrote to memory of 3056	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	30
PID 2384 wrote to memory of 3056	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	30
PID 2384 wrote to memory of 3056	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2608	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	31
PID 2384 wrote to memory of 2608	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	31
PID 2384 wrote to memory of 2608	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	31
PID 2384 wrote to memory of 2876	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	32
PID 2384 wrote to memory of 2876	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	32
PID 2384 wrote to memory of 2876	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	32
PID 2384 wrote to memory of 2872	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	33
PID 2384 wrote to memory of 2872	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	33
PID 2384 wrote to memory of 2872	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	33
PID 2384 wrote to memory of 2720	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	34
PID 2384 wrote to memory of 2720	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	34
PID 2384 wrote to memory of 2720	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	34
PID 2384 wrote to memory of 2528	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	35
PID 2384 wrote to memory of 2528	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	35
PID 2384 wrote to memory of 2528	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	35
PID 2384 wrote to memory of 2232	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	36
PID 2384 wrote to memory of 2232	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	36
PID 2384 wrote to memory of 2232	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	36
PID 2384 wrote to memory of 2980	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	37
PID 2384 wrote to memory of 2980	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	37
PID 2384 wrote to memory of 2980	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	37
PID 2384 wrote to memory of 2776	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	38
PID 2384 wrote to memory of 2776	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	38
PID 2384 wrote to memory of 2776	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	38
PID 2384 wrote to memory of 2824	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	39
PID 2384 wrote to memory of 2824	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	39
PID 2384 wrote to memory of 2824	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	39
PID 2384 wrote to memory of 2844	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	40
PID 2384 wrote to memory of 2844	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	40
PID 2384 wrote to memory of 2844	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	40
PID 2384 wrote to memory of 2956	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	41
PID 2384 wrote to memory of 2956	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	41
PID 2384 wrote to memory of 2956	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	41
PID 2384 wrote to memory of 2932	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	42
PID 2384 wrote to memory of 2932	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	42
PID 2384 wrote to memory of 2932	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	42
PID 2384 wrote to memory of 1060	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	43
PID 2384 wrote to memory of 1060	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	43
PID 2384 wrote to memory of 1060	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	43
PID 2384 wrote to memory of 1748	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	44
PID 2384 wrote to memory of 1748	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	44
PID 2384 wrote to memory of 1748	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	44
PID 2384 wrote to memory of 2452	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	45
PID 2384 wrote to memory of 2452	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	45
PID 2384 wrote to memory of 2452	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	45
PID 2384 wrote to memory of 1768	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	46
PID 2384 wrote to memory of 1768	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	46
PID 2384 wrote to memory of 1768	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	46
PID 2384 wrote to memory of 1732	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	47
PID 2384 wrote to memory of 1732	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	47
PID 2384 wrote to memory of 1732	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	47
PID 2384 wrote to memory of 1644	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	48
PID 2384 wrote to memory of 1644	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	48
PID 2384 wrote to memory of 1644	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	48
PID 2384 wrote to memory of 2784	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	49
PID 2384 wrote to memory of 2784	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	49
PID 2384 wrote to memory of 2784	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	49
PID 2384 wrote to memory of 2692	2384	0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0679918cbbf45d8f55c895316b4b350e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1160
- C:\Windows\System\icpcvKU.exe
  C:\Windows\System\icpcvKU.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\nOkHvLy.exe
  C:\Windows\System\nOkHvLy.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\MhnkPsl.exe
  C:\Windows\System\MhnkPsl.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\PfvhfAA.exe
  C:\Windows\System\PfvhfAA.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\iYoimJW.exe
  C:\Windows\System\iYoimJW.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\HZCtNYO.exe
  C:\Windows\System\HZCtNYO.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\sNLWZdo.exe
  C:\Windows\System\sNLWZdo.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\LKKJdZR.exe
  C:\Windows\System\LKKJdZR.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\PJiHapQ.exe
  C:\Windows\System\PJiHapQ.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\ScIVikq.exe
  C:\Windows\System\ScIVikq.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\ugzAjxo.exe
  C:\Windows\System\ugzAjxo.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\nLdYbOX.exe
  C:\Windows\System\nLdYbOX.exe
  2⤵
  PID:2956
- C:\Windows\System\RgkiCAh.exe
  C:\Windows\System\RgkiCAh.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\MWFJBJY.exe
  C:\Windows\System\MWFJBJY.exe
  2⤵
  PID:1060
- C:\Windows\System\dtnKeIO.exe
  C:\Windows\System\dtnKeIO.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\LyuXuwS.exe
  C:\Windows\System\LyuXuwS.exe
  2⤵
  PID:2452
- C:\Windows\System\hoLzeXr.exe
  C:\Windows\System\hoLzeXr.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\kKOYRCw.exe
  C:\Windows\System\kKOYRCw.exe
  2⤵
  PID:1732
- C:\Windows\System\GiXDCBD.exe
  C:\Windows\System\GiXDCBD.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\SqATYDg.exe
  C:\Windows\System\SqATYDg.exe
  2⤵
  PID:2784
- C:\Windows\System\YHoqkMV.exe
  C:\Windows\System\YHoqkMV.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\LGEoYii.exe
  C:\Windows\System\LGEoYii.exe
  2⤵
  PID:768
- C:\Windows\System\qPmagco.exe
  C:\Windows\System\qPmagco.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\GnWDRfZ.exe
  C:\Windows\System\GnWDRfZ.exe
  2⤵
  PID:1208
- C:\Windows\System\GYNCmGP.exe
  C:\Windows\System\GYNCmGP.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\YIEbUQv.exe
  C:\Windows\System\YIEbUQv.exe
  2⤵
  PID:1704
- C:\Windows\System\plLyGlM.exe
  C:\Windows\System\plLyGlM.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\khLfAiq.exe
  C:\Windows\System\khLfAiq.exe
  2⤵
  PID:2896
- C:\Windows\System\WUaMwXm.exe
  C:\Windows\System\WUaMwXm.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\ynUWOUJ.exe
  C:\Windows\System\ynUWOUJ.exe
  2⤵
  PID:3048
- C:\Windows\System\ezJndAd.exe
  C:\Windows\System\ezJndAd.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\vbtMDtI.exe
  C:\Windows\System\vbtMDtI.exe
  2⤵
  PID:2288
- C:\Windows\System\cMrWgoa.exe
  C:\Windows\System\cMrWgoa.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\kQxzQbw.exe
  C:\Windows\System\kQxzQbw.exe
  2⤵
  PID:1092
- C:\Windows\System\FQwvaLd.exe
  C:\Windows\System\FQwvaLd.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\eZOPFbM.exe
  C:\Windows\System\eZOPFbM.exe
  2⤵
  PID:600
- C:\Windows\System\viDeAWt.exe
  C:\Windows\System\viDeAWt.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\NSjVfGl.exe
  C:\Windows\System\NSjVfGl.exe
  2⤵
  PID:624
- C:\Windows\System\FlEXXSR.exe
  C:\Windows\System\FlEXXSR.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\LlCpnBW.exe
  C:\Windows\System\LlCpnBW.exe
  2⤵
  PID:1560
- C:\Windows\System\iYIFTtS.exe
  C:\Windows\System\iYIFTtS.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\kdKwhlH.exe
  C:\Windows\System\kdKwhlH.exe
  2⤵
  PID:448
- C:\Windows\System\DrWRgNZ.exe
  C:\Windows\System\DrWRgNZ.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\ypRbRJJ.exe
  C:\Windows\System\ypRbRJJ.exe
  2⤵
  PID:2284
- C:\Windows\System\ygOaIxG.exe
  C:\Windows\System\ygOaIxG.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\QFXXRwd.exe
  C:\Windows\System\QFXXRwd.exe
  2⤵
  PID:1792
- C:\Windows\System\ACiDHKy.exe
  C:\Windows\System\ACiDHKy.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\UBlTTiU.exe
  C:\Windows\System\UBlTTiU.exe
  2⤵
  PID:1040
- C:\Windows\System\iODRtXM.exe
  C:\Windows\System\iODRtXM.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\wxHEjbF.exe
  C:\Windows\System\wxHEjbF.exe
  2⤵
  PID:1572
- C:\Windows\System\zbhAgdq.exe
  C:\Windows\System\zbhAgdq.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\ojNFgcl.exe
  C:\Windows\System\ojNFgcl.exe
  2⤵
  PID:1848
- C:\Windows\System\IPRJWyg.exe
  C:\Windows\System\IPRJWyg.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\vIjLLxZ.exe
  C:\Windows\System\vIjLLxZ.exe
  2⤵
  PID:848
- C:\Windows\System\HmMKqjr.exe
  C:\Windows\System\HmMKqjr.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\NIKcpcH.exe
  C:\Windows\System\NIKcpcH.exe
  2⤵
  PID:1736
- C:\Windows\System\AUZJiGC.exe
  C:\Windows\System\AUZJiGC.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\RwahqTD.exe
  C:\Windows\System\RwahqTD.exe
  2⤵
  PID:1340
- C:\Windows\System\ZsiSaII.exe
  C:\Windows\System\ZsiSaII.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\OzpgxkF.exe
  C:\Windows\System\OzpgxkF.exe
  2⤵
  PID:856
- C:\Windows\System\mWERbUh.exe
  C:\Windows\System\mWERbUh.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\ahScKxw.exe
  C:\Windows\System\ahScKxw.exe
  2⤵
  PID:2300
- C:\Windows\System\DCNcrjY.exe
  C:\Windows\System\DCNcrjY.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\RzukTgO.exe
  C:\Windows\System\RzukTgO.exe
  2⤵
  PID:892
- C:\Windows\System\AmOZCBY.exe
  C:\Windows\System\AmOZCBY.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\fmfVWeA.exe
  C:\Windows\System\fmfVWeA.exe
  2⤵
  PID:1236
- C:\Windows\System\IPhIOom.exe
  C:\Windows\System\IPhIOom.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\jUdosOl.exe
  C:\Windows\System\jUdosOl.exe
  2⤵
  PID:1624
- C:\Windows\System\ofenvZo.exe
  C:\Windows\System\ofenvZo.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\QrxMGfR.exe
  C:\Windows\System\QrxMGfR.exe
  2⤵
  PID:2420
- C:\Windows\System\yCIqFSG.exe
  C:\Windows\System\yCIqFSG.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\TRBCIld.exe
  C:\Windows\System\TRBCIld.exe
  2⤵
  PID:2592
- C:\Windows\System\jVjqPGG.exe
  C:\Windows\System\jVjqPGG.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\ISxmHcX.exe
  C:\Windows\System\ISxmHcX.exe
  2⤵
  PID:2624
- C:\Windows\System\ZcEzKmH.exe
  C:\Windows\System\ZcEzKmH.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\FTkAPaj.exe
  C:\Windows\System\FTkAPaj.exe
  2⤵
  PID:2632
- C:\Windows\System\dYhgrIk.exe
  C:\Windows\System\dYhgrIk.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\VCyursD.exe
  C:\Windows\System\VCyursD.exe
  2⤵
  PID:1256
- C:\Windows\System\ayyKCib.exe
  C:\Windows\System\ayyKCib.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\AFCFivt.exe
  C:\Windows\System\AFCFivt.exe
  2⤵
  PID:2472
- C:\Windows\System\tkBhwoY.exe
  C:\Windows\System\tkBhwoY.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\vGjhSMc.exe
  C:\Windows\System\vGjhSMc.exe
  2⤵
  PID:1604
- C:\Windows\System\SqtItaE.exe
  C:\Windows\System\SqtItaE.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\RAJolcA.exe
  C:\Windows\System\RAJolcA.exe
  2⤵
  PID:2312
- C:\Windows\System\mDDYHuM.exe
  C:\Windows\System\mDDYHuM.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\NecbGpC.exe
  C:\Windows\System\NecbGpC.exe
  2⤵
  PID:2000
- C:\Windows\System\SfqXrQQ.exe
  C:\Windows\System\SfqXrQQ.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\ZDzrbjX.exe
  C:\Windows\System\ZDzrbjX.exe
  2⤵
  PID:2432
- C:\Windows\System\tYsmOpQ.exe
  C:\Windows\System\tYsmOpQ.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\tLPkBwj.exe
  C:\Windows\System\tLPkBwj.exe
  2⤵
  PID:2336
- C:\Windows\System\wOWhUTm.exe
  C:\Windows\System\wOWhUTm.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\aMTFwzw.exe
  C:\Windows\System\aMTFwzw.exe
  2⤵
  PID:908
- C:\Windows\System\tlBWXqf.exe
  C:\Windows\System\tlBWXqf.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\OXHEnNr.exe
  C:\Windows\System\OXHEnNr.exe
  2⤵
  PID:2180
- C:\Windows\System\hXFcXCQ.exe
  C:\Windows\System\hXFcXCQ.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\GuKcNLN.exe
  C:\Windows\System\GuKcNLN.exe
  2⤵
  PID:2756
- C:\Windows\System\EtVDlTn.exe
  C:\Windows\System\EtVDlTn.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\zzZRnjQ.exe
  C:\Windows\System\zzZRnjQ.exe
  2⤵
  PID:2568
- C:\Windows\System\wZCzMcF.exe
  C:\Windows\System\wZCzMcF.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\YVfpwpq.exe
  C:\Windows\System\YVfpwpq.exe
  2⤵
  PID:2736
- C:\Windows\System\JARUjdH.exe
  C:\Windows\System\JARUjdH.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\LyGTOnF.exe
  C:\Windows\System\LyGTOnF.exe
  2⤵
  PID:3080
- C:\Windows\System\uOYDnxq.exe
  C:\Windows\System\uOYDnxq.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\WEHuxSg.exe
  C:\Windows\System\WEHuxSg.exe
  2⤵
  PID:3112
- C:\Windows\System\yBXRFkz.exe
  C:\Windows\System\yBXRFkz.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\XQGYMHd.exe
  C:\Windows\System\XQGYMHd.exe
  2⤵
  PID:3144
- C:\Windows\System\bzKWUhc.exe
  C:\Windows\System\bzKWUhc.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\QdVEKGI.exe
  C:\Windows\System\QdVEKGI.exe
  2⤵
  PID:3176
- C:\Windows\System\tcIgEmi.exe
  C:\Windows\System\tcIgEmi.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\pdSofpY.exe
  C:\Windows\System\pdSofpY.exe
  2⤵
  PID:3208
- C:\Windows\System\rWNehPU.exe
  C:\Windows\System\rWNehPU.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\LlBmJwF.exe
  C:\Windows\System\LlBmJwF.exe
  2⤵
  PID:3240
- C:\Windows\System\MNWGlGz.exe
  C:\Windows\System\MNWGlGz.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\pxNONaG.exe
  C:\Windows\System\pxNONaG.exe
  2⤵
  PID:3272
- C:\Windows\System\mLLxnUC.exe
  C:\Windows\System\mLLxnUC.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\ZwWxQpW.exe
  C:\Windows\System\ZwWxQpW.exe
  2⤵
  PID:3304
- C:\Windows\System\YYkGvnD.exe
  C:\Windows\System\YYkGvnD.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\zHPhBHX.exe
  C:\Windows\System\zHPhBHX.exe
  2⤵
  PID:3336
- C:\Windows\System\DOyEGYH.exe
  C:\Windows\System\DOyEGYH.exe
  2⤵
  PID:3352
- C:\Windows\System\mrUIeYg.exe
  C:\Windows\System\mrUIeYg.exe
  2⤵
  PID:3368
- C:\Windows\System\qxOvrTO.exe
  C:\Windows\System\qxOvrTO.exe
  2⤵
  PID:3384
- C:\Windows\System\TtsVBSn.exe
  C:\Windows\System\TtsVBSn.exe
  2⤵
  PID:3400
- C:\Windows\System\dacrWoC.exe
  C:\Windows\System\dacrWoC.exe
  2⤵
  PID:3416
- C:\Windows\System\HnjHJiq.exe
  C:\Windows\System\HnjHJiq.exe
  2⤵
  PID:3432
- C:\Windows\System\bDcGaUc.exe
  C:\Windows\System\bDcGaUc.exe
  2⤵
  PID:3448
- C:\Windows\System\KlkuEIG.exe
  C:\Windows\System\KlkuEIG.exe
  2⤵
  PID:3464
- C:\Windows\System\wMynIlk.exe
  C:\Windows\System\wMynIlk.exe
  2⤵
  PID:3480
- C:\Windows\System\wsuKrgc.exe
  C:\Windows\System\wsuKrgc.exe
  2⤵
  PID:3496
- C:\Windows\System\WxIIGgP.exe
  C:\Windows\System\WxIIGgP.exe
  2⤵
  PID:3512
- C:\Windows\System\kcUTRCN.exe
  C:\Windows\System\kcUTRCN.exe
  2⤵
  PID:3528
- C:\Windows\System\FHtEUOx.exe
  C:\Windows\System\FHtEUOx.exe
  2⤵
  PID:3544
- C:\Windows\System\ijnhaXc.exe
  C:\Windows\System\ijnhaXc.exe
  2⤵
  PID:3560
- C:\Windows\System\DfQPEOm.exe
  C:\Windows\System\DfQPEOm.exe
  2⤵
  PID:3576
- C:\Windows\System\IjQlcMD.exe
  C:\Windows\System\IjQlcMD.exe
  2⤵
  PID:3592
- C:\Windows\System\fTvzePm.exe
  C:\Windows\System\fTvzePm.exe
  2⤵
  PID:3608
- C:\Windows\System\ZkzHqPf.exe
  C:\Windows\System\ZkzHqPf.exe
  2⤵
  PID:3624
- C:\Windows\System\OTMkurC.exe
  C:\Windows\System\OTMkurC.exe
  2⤵
  PID:3640
- C:\Windows\System\kLgEUWN.exe
  C:\Windows\System\kLgEUWN.exe
  2⤵
  PID:3656
- C:\Windows\System\GOLywRa.exe
  C:\Windows\System\GOLywRa.exe
  2⤵
  PID:3672
- C:\Windows\System\nwPPJId.exe
  C:\Windows\System\nwPPJId.exe
  2⤵
  PID:3688
- C:\Windows\System\fIsSOVu.exe
  C:\Windows\System\fIsSOVu.exe
  2⤵
  PID:3704
- C:\Windows\System\WTMEGHW.exe
  C:\Windows\System\WTMEGHW.exe
  2⤵
  PID:3720
- C:\Windows\System\bAGELGT.exe
  C:\Windows\System\bAGELGT.exe
  2⤵
  PID:3736
- C:\Windows\System\rPpnGUG.exe
  C:\Windows\System\rPpnGUG.exe
  2⤵
  PID:3792
- C:\Windows\System\pVIFbrd.exe
  C:\Windows\System\pVIFbrd.exe
  2⤵
  PID:4156
- C:\Windows\System\DBamUEQ.exe
  C:\Windows\System\DBamUEQ.exe
  2⤵
  PID:4188
- C:\Windows\System\wukRJBX.exe
  C:\Windows\System\wukRJBX.exe
  2⤵
  PID:4224
- C:\Windows\System\kPiYPnP.exe
  C:\Windows\System\kPiYPnP.exe
  2⤵
  PID:4284
- C:\Windows\System\fKFvSuo.exe
  C:\Windows\System\fKFvSuo.exe
  2⤵
  PID:4316
- C:\Windows\System\fMpZjvG.exe
  C:\Windows\System\fMpZjvG.exe
  2⤵
  PID:4336
- C:\Windows\System\eDeWsSX.exe
  C:\Windows\System\eDeWsSX.exe
  2⤵
  PID:4352
- C:\Windows\System\xvnfoLT.exe
  C:\Windows\System\xvnfoLT.exe
  2⤵
  PID:4372
- C:\Windows\System\YRvVgMz.exe
  C:\Windows\System\YRvVgMz.exe
  2⤵
  PID:4400
- C:\Windows\System\MeNuiWs.exe
  C:\Windows\System\MeNuiWs.exe
  2⤵
  PID:4444
- C:\Windows\System\gHEXOFF.exe
  C:\Windows\System\gHEXOFF.exe
  2⤵
  PID:4460
- C:\Windows\System\vgpihXh.exe
  C:\Windows\System\vgpihXh.exe
  2⤵
  PID:4476
- C:\Windows\System\RuiLZzg.exe
  C:\Windows\System\RuiLZzg.exe
  2⤵
  PID:4496
- C:\Windows\System\pDzjBBU.exe
  C:\Windows\System\pDzjBBU.exe
  2⤵
  PID:4516
- C:\Windows\System\QraaegB.exe
  C:\Windows\System\QraaegB.exe
  2⤵
  PID:4536
- C:\Windows\System\PcuYWyL.exe
  C:\Windows\System\PcuYWyL.exe
  2⤵
  PID:4556
- C:\Windows\System\MujFhhf.exe
  C:\Windows\System\MujFhhf.exe
  2⤵
  PID:4580
- C:\Windows\System\npUfdfc.exe
  C:\Windows\System\npUfdfc.exe
  2⤵
  PID:4604
- C:\Windows\System\oJMLKaJ.exe
  C:\Windows\System\oJMLKaJ.exe
  2⤵
  PID:4624
- C:\Windows\System\FCOtVJW.exe
  C:\Windows\System\FCOtVJW.exe
  2⤵
  PID:4644
- C:\Windows\System\FImDGVi.exe
  C:\Windows\System\FImDGVi.exe
  2⤵
  PID:4660
- C:\Windows\System\ZEWDnAU.exe
  C:\Windows\System\ZEWDnAU.exe
  2⤵
  PID:4688
- C:\Windows\System\nUVOtvV.exe
  C:\Windows\System\nUVOtvV.exe
  2⤵
  PID:4704
- C:\Windows\System\vGKvDYo.exe
  C:\Windows\System\vGKvDYo.exe
  2⤵
  PID:4728
- C:\Windows\System\VniDlDn.exe
  C:\Windows\System\VniDlDn.exe
  2⤵
  PID:4744
- C:\Windows\System\vmJnmrb.exe
  C:\Windows\System\vmJnmrb.exe
  2⤵
  PID:4764
- C:\Windows\System\dLkDEag.exe
  C:\Windows\System\dLkDEag.exe
  2⤵
  PID:4784
- C:\Windows\System\aLjgMGV.exe
  C:\Windows\System\aLjgMGV.exe
  2⤵
  PID:4800
- C:\Windows\System\OjRKnfg.exe
  C:\Windows\System\OjRKnfg.exe
  2⤵
  PID:4824
- C:\Windows\System\ZPXUjFx.exe
  C:\Windows\System\ZPXUjFx.exe
  2⤵
  PID:4848
- C:\Windows\System\OeJTpEF.exe
  C:\Windows\System\OeJTpEF.exe
  2⤵
  PID:4864
- C:\Windows\System\SJXGunB.exe
  C:\Windows\System\SJXGunB.exe
  2⤵
  PID:4888
- C:\Windows\System\RshVjNF.exe
  C:\Windows\System\RshVjNF.exe
  2⤵
  PID:4904
- C:\Windows\System\gAijKaw.exe
  C:\Windows\System\gAijKaw.exe
  2⤵
  PID:4928
- C:\Windows\System\CuEimDC.exe
  C:\Windows\System\CuEimDC.exe
  2⤵
  PID:4944
- C:\Windows\System\yJgoigW.exe
  C:\Windows\System\yJgoigW.exe
  2⤵
  PID:4964
- C:\Windows\System\dcFbcFf.exe
  C:\Windows\System\dcFbcFf.exe
  2⤵
  PID:4984
- C:\Windows\System\erkCYxj.exe
  C:\Windows\System\erkCYxj.exe
  2⤵
  PID:5008
- C:\Windows\System\HvwJrUl.exe
  C:\Windows\System\HvwJrUl.exe
  2⤵
  PID:5024
- C:\Windows\System\FGldndi.exe
  C:\Windows\System\FGldndi.exe
  2⤵
  PID:5044
- C:\Windows\System\xmHaOTo.exe
  C:\Windows\System\xmHaOTo.exe
  2⤵
  PID:5064
- C:\Windows\System\PFtAgzs.exe
  C:\Windows\System\PFtAgzs.exe
  2⤵
  PID:5084
- C:\Windows\System\KoVLaOF.exe
  C:\Windows\System\KoVLaOF.exe
  2⤵
  PID:5104
- C:\Windows\System\kbfsTUy.exe
  C:\Windows\System\kbfsTUy.exe
  2⤵
  PID:2732
- C:\Windows\System\qTSXUNv.exe
  C:\Windows\System\qTSXUNv.exe
  2⤵
  PID:4176
- C:\Windows\System\VKaLvBm.exe
  C:\Windows\System\VKaLvBm.exe
  2⤵
  PID:3540
- C:\Windows\System\AwHkCjH.exe
  C:\Windows\System\AwHkCjH.exe
  2⤵
  PID:560
- C:\Windows\System\uTBgGdG.exe
  C:\Windows\System\uTBgGdG.exe
  2⤵
  PID:2320
- C:\Windows\System\rpSapRN.exe
  C:\Windows\System\rpSapRN.exe
  2⤵
  PID:1516
- C:\Windows\System\bClujHg.exe
  C:\Windows\System\bClujHg.exe
  2⤵
  PID:4260
- C:\Windows\System\EnEcCwH.exe
  C:\Windows\System\EnEcCwH.exe
  2⤵
  PID:1832
- C:\Windows\System\YLRYqjB.exe
  C:\Windows\System\YLRYqjB.exe
  2⤵
  PID:2448
- C:\Windows\System\MJEUNtp.exe
  C:\Windows\System\MJEUNtp.exe
  2⤵
  PID:3032
- C:\Windows\System\njwQjEH.exe
  C:\Windows\System\njwQjEH.exe
  2⤵
  PID:2888
- C:\Windows\System\cqCjdfN.exe
  C:\Windows\System\cqCjdfN.exe
  2⤵
  PID:4324
- C:\Windows\System\kNEgnlU.exe
  C:\Windows\System\kNEgnlU.exe
  2⤵
  PID:2036
- C:\Windows\System\lSyHOfJ.exe
  C:\Windows\System\lSyHOfJ.exe
  2⤵
  PID:2436
- C:\Windows\System\NnyWwUj.exe
  C:\Windows\System\NnyWwUj.exe
  2⤵
  PID:4328
- C:\Windows\System\gYBVJES.exe
  C:\Windows\System\gYBVJES.exe
  2⤵
  PID:3460
- C:\Windows\System\RWaLUiR.exe
  C:\Windows\System\RWaLUiR.exe
  2⤵
  PID:3680
- C:\Windows\System\eDClmIq.exe
  C:\Windows\System\eDClmIq.exe
  2⤵
  PID:3444
- C:\Windows\System\SxOsbcC.exe
  C:\Windows\System\SxOsbcC.exe
  2⤵
  PID:4368
- C:\Windows\System\nEegWWS.exe
  C:\Windows\System\nEegWWS.exe
  2⤵
  PID:3616
- C:\Windows\System\YYXhGtn.exe
  C:\Windows\System\YYXhGtn.exe
  2⤵
  PID:3440
- C:\Windows\System\cLwTnpc.exe
  C:\Windows\System\cLwTnpc.exe
  2⤵
  PID:3604
- C:\Windows\System\ogMIBkQ.exe
  C:\Windows\System\ogMIBkQ.exe
  2⤵
  PID:3668
- C:\Windows\System\vszukRl.exe
  C:\Windows\System\vszukRl.exe
  2⤵
  PID:3732
- C:\Windows\System\aeEVrmI.exe
  C:\Windows\System\aeEVrmI.exe
  2⤵
  PID:3824
- C:\Windows\System\RYWRRnw.exe
  C:\Windows\System\RYWRRnw.exe
  2⤵
  PID:3832
- C:\Windows\System\RSetFAE.exe
  C:\Windows\System\RSetFAE.exe
  2⤵
  PID:3848
- C:\Windows\System\tBgAWUF.exe
  C:\Windows\System\tBgAWUF.exe
  2⤵
  PID:3892
- C:\Windows\System\jVhoABD.exe
  C:\Windows\System\jVhoABD.exe
  2⤵
  PID:3904
- C:\Windows\System\aXHmwel.exe
  C:\Windows\System\aXHmwel.exe
  2⤵
  PID:3924
- C:\Windows\System\xjCAqll.exe
  C:\Windows\System\xjCAqll.exe
  2⤵
  PID:3940
- C:\Windows\System\SeNqMlQ.exe
  C:\Windows\System\SeNqMlQ.exe
  2⤵
  PID:3956
- C:\Windows\System\zFqwwKV.exe
  C:\Windows\System\zFqwwKV.exe
  2⤵
  PID:3976
- C:\Windows\System\ypKsMsp.exe
  C:\Windows\System\ypKsMsp.exe
  2⤵
  PID:3992
- C:\Windows\System\dNMBRIb.exe
  C:\Windows\System\dNMBRIb.exe
  2⤵
  PID:4008
- C:\Windows\System\adnigBN.exe
  C:\Windows\System\adnigBN.exe
  2⤵
  PID:4024
- C:\Windows\System\xtIMDJh.exe
  C:\Windows\System\xtIMDJh.exe
  2⤵
  PID:4056
- C:\Windows\System\HFlCquy.exe
  C:\Windows\System\HFlCquy.exe
  2⤵
  PID:4076
- C:\Windows\System\RmSeHJR.exe
  C:\Windows\System\RmSeHJR.exe
  2⤵
  PID:4092
- C:\Windows\System\apILcha.exe
  C:\Windows\System\apILcha.exe
  2⤵
  PID:3020
- C:\Windows\System\JIlXYwt.exe
  C:\Windows\System\JIlXYwt.exe
  2⤵
  PID:2640
- C:\Windows\System\SQNmUGJ.exe
  C:\Windows\System\SQNmUGJ.exe
  2⤵
  PID:3108
- C:\Windows\System\jTvBFEm.exe
  C:\Windows\System\jTvBFEm.exe
  2⤵
  PID:3200
- C:\Windows\System\cryjxRI.exe
  C:\Windows\System\cryjxRI.exe
  2⤵
  PID:3264
- C:\Windows\System\tXkdEzM.exe
  C:\Windows\System\tXkdEzM.exe
  2⤵
  PID:3300
- C:\Windows\System\IvGkqoJ.exe
  C:\Windows\System\IvGkqoJ.exe
  2⤵
  PID:3364
- C:\Windows\System\JEyfpkl.exe
  C:\Windows\System\JEyfpkl.exe
  2⤵
  PID:3428
- C:\Windows\System\QfdQbEo.exe
  C:\Windows\System\QfdQbEo.exe
  2⤵
  PID:4200
- C:\Windows\System\stxikth.exe
  C:\Windows\System\stxikth.exe
  2⤵
  PID:4220
- C:\Windows\System\kCkdqKh.exe
  C:\Windows\System\kCkdqKh.exe
  2⤵
  PID:4384
- C:\Windows\System\xujxYMp.exe
  C:\Windows\System\xujxYMp.exe
  2⤵
  PID:4304
- C:\Windows\System\oECeHvN.exe
  C:\Windows\System\oECeHvN.exe
  2⤵
  PID:4196
- C:\Windows\System\MIQjoHr.exe
  C:\Windows\System\MIQjoHr.exe
  2⤵
  PID:4468
- C:\Windows\System\eNZubTW.exe
  C:\Windows\System\eNZubTW.exe
  2⤵
  PID:4472
- C:\Windows\System\cKBdXen.exe
  C:\Windows\System\cKBdXen.exe
  2⤵
  PID:4512
- C:\Windows\System\cMAzRjs.exe
  C:\Windows\System\cMAzRjs.exe
  2⤵
  PID:4544
- C:\Windows\System\ubupFGx.exe
  C:\Windows\System\ubupFGx.exe
  2⤵
  PID:2676
- C:\Windows\System\wcprMso.exe
  C:\Windows\System\wcprMso.exe
  2⤵
  PID:4568
- C:\Windows\System\qBCZZme.exe
  C:\Windows\System\qBCZZme.exe
  2⤵
  PID:4600
- C:\Windows\System\yZQvXQe.exe
  C:\Windows\System\yZQvXQe.exe
  2⤵
  PID:1948
- C:\Windows\System\WIlVrkg.exe
  C:\Windows\System\WIlVrkg.exe
  2⤵
  PID:2708
- C:\Windows\System\rNSIWPl.exe
  C:\Windows\System\rNSIWPl.exe
  2⤵
  PID:4632
- C:\Windows\System\wkxUyMe.exe
  C:\Windows\System\wkxUyMe.exe
  2⤵
  PID:4668
- C:\Windows\System\gBRodMV.exe
  C:\Windows\System\gBRodMV.exe
  2⤵
  PID:4684
- C:\Windows\System\tlPwDld.exe
  C:\Windows\System\tlPwDld.exe
  2⤵
  PID:4700
- C:\Windows\System\qmvBbQH.exe
  C:\Windows\System\qmvBbQH.exe
  2⤵
  PID:4716
- C:\Windows\System\wElKomd.exe
  C:\Windows\System\wElKomd.exe
  2⤵
  PID:2496
- C:\Windows\System\ooUwSnQ.exe
  C:\Windows\System\ooUwSnQ.exe
  2⤵
  PID:4756
- C:\Windows\System\dSjOxjU.exe
  C:\Windows\System\dSjOxjU.exe
  2⤵
  PID:4792
- C:\Windows\System\cSNhReR.exe
  C:\Windows\System\cSNhReR.exe
  2⤵
  PID:4816
- C:\Windows\System\gDIwBRv.exe
  C:\Windows\System\gDIwBRv.exe
  2⤵
  PID:4832
- C:\Windows\System\ISJdQwn.exe
  C:\Windows\System\ISJdQwn.exe
  2⤵
  PID:4856
- C:\Windows\System\nHFtbyu.exe
  C:\Windows\System\nHFtbyu.exe
  2⤵
  PID:2264
- C:\Windows\System\euuVtsJ.exe
  C:\Windows\System\euuVtsJ.exe
  2⤵
  PID:4876
- C:\Windows\System\PBRWFEC.exe
  C:\Windows\System\PBRWFEC.exe
  2⤵
  PID:4912
- C:\Windows\System\UZNVuym.exe
  C:\Windows\System\UZNVuym.exe
  2⤵
  PID:4952
- C:\Windows\System\ZObSJJv.exe
  C:\Windows\System\ZObSJJv.exe
  2⤵
  PID:4956
- C:\Windows\System\AqUZQqb.exe
  C:\Windows\System\AqUZQqb.exe
  2⤵
  PID:4972
- C:\Windows\System\UiXUUMC.exe
  C:\Windows\System\UiXUUMC.exe
  2⤵
  PID:5004
- C:\Windows\System\wEpUDpL.exe
  C:\Windows\System\wEpUDpL.exe
  2⤵
  PID:5032
- C:\Windows\System\PhOqpjJ.exe
  C:\Windows\System\PhOqpjJ.exe
  2⤵
  PID:5056
- C:\Windows\System\HRvbhrq.exe
  C:\Windows\System\HRvbhrq.exe
  2⤵
  PID:556
- C:\Windows\System\iZBSFpy.exe
  C:\Windows\System\iZBSFpy.exe
  2⤵
  PID:5092
- C:\Windows\System\rUTKXKD.exe
  C:\Windows\System\rUTKXKD.exe
  2⤵
  PID:5112
- C:\Windows\System\WEUzccB.exe
  C:\Windows\System\WEUzccB.exe
  2⤵
  PID:2052
- C:\Windows\System\DfUzyHa.exe
  C:\Windows\System\DfUzyHa.exe
  2⤵
  PID:476
- C:\Windows\System\oGhZyxq.exe
  C:\Windows\System\oGhZyxq.exe
  2⤵
  PID:4240
- C:\Windows\System\oOUoaOx.exe
  C:\Windows\System\oOUoaOx.exe
  2⤵
  PID:4244
- C:\Windows\System\wziNJgg.exe
  C:\Windows\System\wziNJgg.exe
  2⤵
  PID:4028
- C:\Windows\System\tNFkbxJ.exe
  C:\Windows\System\tNFkbxJ.exe
  2⤵
  PID:3348
- C:\Windows\System\qCoeFtE.exe
  C:\Windows\System\qCoeFtE.exe
  2⤵
  PID:2960
- C:\Windows\System\FIJbSUp.exe
  C:\Windows\System\FIJbSUp.exe
  2⤵
  PID:3156
- C:\Windows\System\yvyIwYD.exe
  C:\Windows\System\yvyIwYD.exe
  2⤵
  PID:4072
- C:\Windows\System\XDPpVqx.exe
  C:\Windows\System\XDPpVqx.exe
  2⤵
  PID:2744
- C:\Windows\System\zMdyWgv.exe
  C:\Windows\System\zMdyWgv.exe
  2⤵
  PID:2356
- C:\Windows\System\hQcOpKc.exe
  C:\Windows\System\hQcOpKc.exe
  2⤵
  PID:3504
- C:\Windows\System\kbJcwpT.exe
  C:\Windows\System\kbJcwpT.exe
  2⤵
  PID:3584
- C:\Windows\System\mYomRzk.exe
  C:\Windows\System\mYomRzk.exe
  2⤵
  PID:4344
- C:\Windows\System\MoFNvre.exe
  C:\Windows\System\MoFNvre.exe
  2⤵
  PID:4508
- C:\Windows\System\sYJxrlI.exe
  C:\Windows\System\sYJxrlI.exe
  2⤵
  PID:4572
- C:\Windows\System\FRVEomU.exe
  C:\Windows\System\FRVEomU.exe
  2⤵
  PID:3268
- C:\Windows\System\WUVMVeo.exe
  C:\Windows\System\WUVMVeo.exe
  2⤵
  PID:4616
- C:\Windows\System\RLKZQoS.exe
  C:\Windows\System\RLKZQoS.exe
  2⤵
  PID:2484
- C:\Windows\System\NMTEZlY.exe
  C:\Windows\System\NMTEZlY.exe
  2⤵
  PID:2240
- C:\Windows\System\xwlLcrD.exe
  C:\Windows\System\xwlLcrD.exe
  2⤵
  PID:3920
- C:\Windows\System\eLHcLwJ.exe
  C:\Windows\System\eLHcLwJ.exe
  2⤵
  PID:4916
- C:\Windows\System\EIYiqru.exe
  C:\Windows\System\EIYiqru.exe
  2⤵
  PID:4936
- C:\Windows\System\oQIGyJp.exe
  C:\Windows\System\oQIGyJp.exe
  2⤵
  PID:4396
- C:\Windows\System\kPxGBvh.exe
  C:\Windows\System\kPxGBvh.exe
  2⤵
  PID:3664
- C:\Windows\System\nkzycMy.exe
  C:\Windows\System\nkzycMy.exe
  2⤵
  PID:3900
- C:\Windows\System\xoOPimN.exe
  C:\Windows\System\xoOPimN.exe
  2⤵
  PID:3972
- C:\Windows\System\ltxFLbp.exe
  C:\Windows\System\ltxFLbp.exe
  2⤵
  PID:4084
- C:\Windows\System\Zlnhqfs.exe
  C:\Windows\System\Zlnhqfs.exe
  2⤵
  PID:4208
- C:\Windows\System\rLWDlSc.exe
  C:\Windows\System\rLWDlSc.exe
  2⤵
  PID:1744
- C:\Windows\System\BGtkgis.exe
  C:\Windows\System\BGtkgis.exe
  2⤵
  PID:4488
- C:\Windows\System\iALfCKo.exe
  C:\Windows\System\iALfCKo.exe
  2⤵
  PID:1968
- C:\Windows\System\vucTokR.exe
  C:\Windows\System\vucTokR.exe
  2⤵
  PID:4652
- C:\Windows\System\znJJUkN.exe
  C:\Windows\System\znJJUkN.exe
  2⤵
  PID:4736
- C:\Windows\System\anLGswj.exe
  C:\Windows\System\anLGswj.exe
  2⤵
  PID:4992
- C:\Windows\System\EaWwLJd.exe
  C:\Windows\System\EaWwLJd.exe
  2⤵
  PID:5080
- C:\Windows\System\CnRzJLm.exe
  C:\Windows\System\CnRzJLm.exe
  2⤵
  PID:5116
- C:\Windows\System\hjbwAEp.exe
  C:\Windows\System\hjbwAEp.exe
  2⤵
  PID:2836
- C:\Windows\System\dXkOsiE.exe
  C:\Windows\System\dXkOsiE.exe
  2⤵
  PID:3036
- C:\Windows\System\JhkAbax.exe
  C:\Windows\System\JhkAbax.exe
  2⤵
  PID:3184
- C:\Windows\System\ktAxLvD.exe
  C:\Windows\System\ktAxLvD.exe
  2⤵
  PID:3600
- C:\Windows\System\YRMNgxN.exe
  C:\Windows\System\YRMNgxN.exe
  2⤵
  PID:3884
- C:\Windows\System\nzcwDqI.exe
  C:\Windows\System\nzcwDqI.exe
  2⤵
  PID:1812
- C:\Windows\System\cdgKUEt.exe
  C:\Windows\System\cdgKUEt.exe
  2⤵
  PID:1820
- C:\Windows\System\NMcdsZS.exe
  C:\Windows\System\NMcdsZS.exe
  2⤵
  PID:2668
- C:\Windows\System\kYHvsHX.exe
  C:\Windows\System\kYHvsHX.exe
  2⤵
  PID:4680
- C:\Windows\System\LDAvDum.exe
  C:\Windows\System\LDAvDum.exe
  2⤵
  PID:4796
- C:\Windows\System\IxfJQyR.exe
  C:\Windows\System\IxfJQyR.exe
  2⤵
  PID:2636
- C:\Windows\System\VfPIInP.exe
  C:\Windows\System\VfPIInP.exe
  2⤵
  PID:3408
- C:\Windows\System\VUVLWWz.exe
  C:\Windows\System\VUVLWWz.exe
  2⤵
  PID:4412
- C:\Windows\System\PjJzGoj.exe
  C:\Windows\System\PjJzGoj.exe
  2⤵
  PID:2820
- C:\Windows\System\LVpNNpO.exe
  C:\Windows\System\LVpNNpO.exe
  2⤵
  PID:1144
- C:\Windows\System\QFpFiIc.exe
  C:\Windows\System\QFpFiIc.exe
  2⤵
  PID:4696
- C:\Windows\System\euTNlpG.exe
  C:\Windows\System\euTNlpG.exe
  2⤵
  PID:3932
- C:\Windows\System\aQqpgqP.exe
  C:\Windows\System\aQqpgqP.exe
  2⤵
  PID:2532
- C:\Windows\System\gKthsEa.exe
  C:\Windows\System\gKthsEa.exe
  2⤵
  PID:4004
- C:\Windows\System\XOxXCCm.exe
  C:\Windows\System\XOxXCCm.exe
  2⤵
  PID:4360
- C:\Windows\System\DfvYfsn.exe
  C:\Windows\System\DfvYfsn.exe
  2⤵
  PID:4484
- C:\Windows\System\EQKuAgh.exe
  C:\Windows\System\EQKuAgh.exe
  2⤵
  PID:3376
- C:\Windows\System\eElPjPU.exe
  C:\Windows\System\eElPjPU.exe
  2⤵
  PID:5096
- C:\Windows\System\QpbjLGL.exe
  C:\Windows\System\QpbjLGL.exe
  2⤵
  PID:2768
- C:\Windows\System\JCCaDcT.exe
  C:\Windows\System\JCCaDcT.exe
  2⤵
  PID:4296
- C:\Windows\System\GGdnBZU.exe
  C:\Windows\System\GGdnBZU.exe
  2⤵
  PID:872
- C:\Windows\System\fqUKdQL.exe
  C:\Windows\System\fqUKdQL.exe
  2⤵
  PID:4780
- C:\Windows\System\GEzlLfL.exe
  C:\Windows\System\GEzlLfL.exe
  2⤵
  PID:3572
- C:\Windows\System\GjxZGAy.exe
  C:\Windows\System\GjxZGAy.exe
  2⤵
  PID:3172
- C:\Windows\System\hyADSgz.exe
  C:\Windows\System\hyADSgz.exe
  2⤵
  PID:4884
- C:\Windows\System\PnYJEMx.exe
  C:\Windows\System\PnYJEMx.exe
  2⤵
  PID:3556
- C:\Windows\System\yOqbBNz.exe
  C:\Windows\System\yOqbBNz.exe
  2⤵
  PID:1632
- C:\Windows\System\OZHTBAT.exe
  C:\Windows\System\OZHTBAT.exe
  2⤵
  PID:2656
- C:\Windows\System\zDijSUL.exe
  C:\Windows\System\zDijSUL.exe
  2⤵
  PID:3864
- C:\Windows\System\nsbJvIA.exe
  C:\Windows\System\nsbJvIA.exe
  2⤵
  PID:3852
- C:\Windows\System\vDOBUII.exe
  C:\Windows\System\vDOBUII.exe
  2⤵
  PID:2084
- C:\Windows\System\tDtOkaQ.exe
  C:\Windows\System\tDtOkaQ.exe
  2⤵
  PID:4532
- C:\Windows\System\PIvICNO.exe
  C:\Windows\System\PIvICNO.exe
  2⤵
  PID:1992
- C:\Windows\System\imthygg.exe
  C:\Windows\System\imthygg.exe
  2⤵
  PID:2588
- C:\Windows\System\AvADuKf.exe
  C:\Windows\System\AvADuKf.exe
  2⤵
  PID:2440
- C:\Windows\System\SaFDnTD.exe
  C:\Windows\System\SaFDnTD.exe
  2⤵
  PID:3140
- C:\Windows\System\KHnDqEm.exe
  C:\Windows\System\KHnDqEm.exe
  2⤵
  PID:5052
- C:\Windows\System\FkAxbgq.exe
  C:\Windows\System\FkAxbgq.exe
  2⤵
  PID:4844
- C:\Windows\System\ushphkz.exe
  C:\Windows\System\ushphkz.exe
  2⤵
  PID:3396
- C:\Windows\System\lddtRmc.exe
  C:\Windows\System\lddtRmc.exe
  2⤵
  PID:4236
- C:\Windows\System\eWBHSPA.exe
  C:\Windows\System\eWBHSPA.exe
  2⤵
  PID:4380
- C:\Windows\System\WZkACvu.exe
  C:\Windows\System\WZkACvu.exe
  2⤵
  PID:4528
- C:\Windows\System\toJGSxj.exe
  C:\Windows\System\toJGSxj.exe
  2⤵
  PID:4980
- C:\Windows\System\TtHbkHu.exe
  C:\Windows\System\TtHbkHu.exe
  2⤵
  PID:992
- C:\Windows\System\ZRxEnFt.exe
  C:\Windows\System\ZRxEnFt.exe
  2⤵
  PID:3728
- C:\Windows\System\sJurxRA.exe
  C:\Windows\System\sJurxRA.exe
  2⤵
  PID:5040
- C:\Windows\System\mqIQSlW.exe
  C:\Windows\System\mqIQSlW.exe
  2⤵
  PID:4040
- C:\Windows\System\VJYXhce.exe
  C:\Windows\System\VJYXhce.exe
  2⤵
  PID:3076
- C:\Windows\System\qkwDsiQ.exe
  C:\Windows\System\qkwDsiQ.exe
  2⤵
  PID:3360
- C:\Windows\System\LmIGZjn.exe
  C:\Windows\System\LmIGZjn.exe
  2⤵
  PID:4172
- C:\Windows\System\yeWjdVR.exe
  C:\Windows\System\yeWjdVR.exe
  2⤵
  PID:988
- C:\Windows\System\BonWsrP.exe
  C:\Windows\System\BonWsrP.exe
  2⤵
  PID:5132
- C:\Windows\System\NjHGUce.exe
  C:\Windows\System\NjHGUce.exe
  2⤵
  PID:5148
- C:\Windows\System\fgQiDEp.exe
  C:\Windows\System\fgQiDEp.exe
  2⤵
  PID:5168
- C:\Windows\System\UHLLpGf.exe
  C:\Windows\System\UHLLpGf.exe
  2⤵
  PID:5184
- C:\Windows\System\YiGiHZC.exe
  C:\Windows\System\YiGiHZC.exe
  2⤵
  PID:5200
- C:\Windows\System\ijPEQMf.exe
  C:\Windows\System\ijPEQMf.exe
  2⤵
  PID:5216
- C:\Windows\System\FGHyRMM.exe
  C:\Windows\System\FGHyRMM.exe
  2⤵
  PID:5236
- C:\Windows\System\KwwhAci.exe
  C:\Windows\System\KwwhAci.exe
  2⤵
  PID:5256
- C:\Windows\System\nEJxkiH.exe
  C:\Windows\System\nEJxkiH.exe
  2⤵
  PID:5272
- C:\Windows\System\wjrNsVl.exe
  C:\Windows\System\wjrNsVl.exe
  2⤵
  PID:5288
- C:\Windows\System\EGgienb.exe
  C:\Windows\System\EGgienb.exe
  2⤵
  PID:5304
- C:\Windows\System\oNAeTwX.exe
  C:\Windows\System\oNAeTwX.exe
  2⤵
  PID:5320
- C:\Windows\System\NOADwCP.exe
  C:\Windows\System\NOADwCP.exe
  2⤵
  PID:5336
- C:\Windows\System\QotQBaz.exe
  C:\Windows\System\QotQBaz.exe
  2⤵
  PID:5356
- C:\Windows\System\mERnbIF.exe
  C:\Windows\System\mERnbIF.exe
  2⤵
  PID:5372
- C:\Windows\System\VslpDUW.exe
  C:\Windows\System\VslpDUW.exe
  2⤵
  PID:5388
- C:\Windows\System\YyZIKnZ.exe
  C:\Windows\System\YyZIKnZ.exe
  2⤵
  PID:5404
- C:\Windows\System\BwBablu.exe
  C:\Windows\System\BwBablu.exe
  2⤵
  PID:5420
- C:\Windows\System\YwJpPJj.exe
  C:\Windows\System\YwJpPJj.exe
  2⤵
  PID:5436
- C:\Windows\System\nwuOurb.exe
  C:\Windows\System\nwuOurb.exe
  2⤵
  PID:5452
- C:\Windows\System\RcNutNt.exe
  C:\Windows\System\RcNutNt.exe
  2⤵
  PID:5472
- C:\Windows\System\XiWyTJX.exe
  C:\Windows\System\XiWyTJX.exe
  2⤵
  PID:5488
- C:\Windows\System\qeUGiXX.exe
  C:\Windows\System\qeUGiXX.exe
  2⤵
  PID:5504
- C:\Windows\System\WMhPXFi.exe
  C:\Windows\System\WMhPXFi.exe
  2⤵
  PID:5580
- C:\Windows\System\IWzKBfv.exe
  C:\Windows\System\IWzKBfv.exe
  2⤵
  PID:5596
- C:\Windows\System\kPgfocv.exe
  C:\Windows\System\kPgfocv.exe
  2⤵
  PID:5612
- C:\Windows\System\bcOUINx.exe
  C:\Windows\System\bcOUINx.exe
  2⤵
  PID:5628
- C:\Windows\System\ktqZGAd.exe
  C:\Windows\System\ktqZGAd.exe
  2⤵
  PID:5644
- C:\Windows\System\xmqGYxa.exe
  C:\Windows\System\xmqGYxa.exe
  2⤵
  PID:5660
- C:\Windows\System\mBkAvGh.exe
  C:\Windows\System\mBkAvGh.exe
  2⤵
  PID:5676
- C:\Windows\System\lbuakyW.exe
  C:\Windows\System\lbuakyW.exe
  2⤵
  PID:5692
- C:\Windows\System\RihqgVn.exe
  C:\Windows\System\RihqgVn.exe
  2⤵
  PID:5708
- C:\Windows\System\NKgAWNI.exe
  C:\Windows\System\NKgAWNI.exe
  2⤵
  PID:5724
- C:\Windows\System\JfRyCER.exe
  C:\Windows\System\JfRyCER.exe
  2⤵
  PID:5740
- C:\Windows\System\CJbUEtx.exe
  C:\Windows\System\CJbUEtx.exe
  2⤵
  PID:5756
- C:\Windows\System\sGMwhES.exe
  C:\Windows\System\sGMwhES.exe
  2⤵
  PID:5772
- C:\Windows\System\khGNnkh.exe
  C:\Windows\System\khGNnkh.exe
  2⤵
  PID:5788
- C:\Windows\System\XCypeIq.exe
  C:\Windows\System\XCypeIq.exe
  2⤵
  PID:5804
- C:\Windows\System\nferSHu.exe
  C:\Windows\System\nferSHu.exe
  2⤵
  PID:5820
- C:\Windows\System\UBZbqRQ.exe
  C:\Windows\System\UBZbqRQ.exe
  2⤵
  PID:5836
- C:\Windows\System\xUcymEd.exe
  C:\Windows\System\xUcymEd.exe
  2⤵
  PID:5852
- C:\Windows\System\XxOhlrh.exe
  C:\Windows\System\XxOhlrh.exe
  2⤵
  PID:5868
- C:\Windows\System\qFaNmfx.exe
  C:\Windows\System\qFaNmfx.exe
  2⤵
  PID:5884
- C:\Windows\System\WDIdTKq.exe
  C:\Windows\System\WDIdTKq.exe
  2⤵
  PID:5900
- C:\Windows\System\qdCqEhl.exe
  C:\Windows\System\qdCqEhl.exe
  2⤵
  PID:5916
- C:\Windows\System\lnbmFTx.exe
  C:\Windows\System\lnbmFTx.exe
  2⤵
  PID:5940
- C:\Windows\System\hzmMyDF.exe
  C:\Windows\System\hzmMyDF.exe
  2⤵
  PID:5956
- C:\Windows\System\zMnnmHD.exe
  C:\Windows\System\zMnnmHD.exe
  2⤵
  PID:5972
- C:\Windows\System\lnEpMkC.exe
  C:\Windows\System\lnEpMkC.exe
  2⤵
  PID:6104
- C:\Windows\System\AENjrBa.exe
  C:\Windows\System\AENjrBa.exe
  2⤵
  PID:6120
- C:\Windows\System\XRDkRyi.exe
  C:\Windows\System\XRDkRyi.exe
  2⤵
  PID:6136
- C:\Windows\System\FvjVJnD.exe
  C:\Windows\System\FvjVJnD.exe
  2⤵
  PID:5140
- C:\Windows\System\rDRIjYW.exe
  C:\Windows\System\rDRIjYW.exe
  2⤵
  PID:5160
- C:\Windows\System\dNTeKwr.exe
  C:\Windows\System\dNTeKwr.exe
  2⤵
  PID:5244
- C:\Windows\System\IOUljdl.exe
  C:\Windows\System\IOUljdl.exe
  2⤵
  PID:5232
- C:\Windows\System\wtirquW.exe
  C:\Windows\System\wtirquW.exe
  2⤵
  PID:5268
- C:\Windows\System\pmHiubj.exe
  C:\Windows\System\pmHiubj.exe
  2⤵
  PID:5348
- C:\Windows\System\tjzZXbO.exe
  C:\Windows\System\tjzZXbO.exe
  2⤵
  PID:5516
- C:\Windows\System\zflnmcG.exe
  C:\Windows\System\zflnmcG.exe
  2⤵
  PID:5564
- C:\Windows\System\pNyyqvA.exe
  C:\Windows\System\pNyyqvA.exe
  2⤵
  PID:5592
- C:\Windows\System\PQaWGnQ.exe
  C:\Windows\System\PQaWGnQ.exe
  2⤵
  PID:5640
- C:\Windows\System\ZDdPJit.exe
  C:\Windows\System\ZDdPJit.exe
  2⤵
  PID:5668
- C:\Windows\System\XnBEsZF.exe
  C:\Windows\System\XnBEsZF.exe
  2⤵
  PID:5716
- C:\Windows\System\fPmMiZJ.exe
  C:\Windows\System\fPmMiZJ.exe
  2⤵
  PID:5736
- C:\Windows\System\bsmReuf.exe
  C:\Windows\System\bsmReuf.exe
  2⤵
  PID:5768
- C:\Windows\System\AGxCXoS.exe
  C:\Windows\System\AGxCXoS.exe
  2⤵
  PID:5812
- C:\Windows\System\opPfNBo.exe
  C:\Windows\System\opPfNBo.exe
  2⤵
  PID:5844
- C:\Windows\System\yHAwdmP.exe
  C:\Windows\System\yHAwdmP.exe
  2⤵
  PID:5876
- C:\Windows\System\EzYibgD.exe
  C:\Windows\System\EzYibgD.exe
  2⤵
  PID:5912
- C:\Windows\System\gbrmUcg.exe
  C:\Windows\System\gbrmUcg.exe
  2⤵
  PID:5948
- C:\Windows\System\sqXADbT.exe
  C:\Windows\System\sqXADbT.exe
  2⤵
  PID:5020
- C:\Windows\System\BZVEAAl.exe
  C:\Windows\System\BZVEAAl.exe
  2⤵
  PID:6000
- C:\Windows\System\PVMmnRi.exe
  C:\Windows\System\PVMmnRi.exe
  2⤵
  PID:6012
- C:\Windows\System\aDCiWnw.exe
  C:\Windows\System\aDCiWnw.exe
  2⤵
  PID:6024
- C:\Windows\System\GHmbmIM.exe
  C:\Windows\System\GHmbmIM.exe
  2⤵
  PID:6064
- C:\Windows\System\xEIbOiP.exe
  C:\Windows\System\xEIbOiP.exe
  2⤵
  PID:6060
- C:\Windows\System\iwobVPE.exe
  C:\Windows\System\iwobVPE.exe
  2⤵
  PID:6040
- C:\Windows\System\mJNUqmr.exe
  C:\Windows\System\mJNUqmr.exe
  2⤵
  PID:6092
- C:\Windows\System\tqowdqD.exe
  C:\Windows\System\tqowdqD.exe
  2⤵
  PID:2620
- C:\Windows\System\UZjTnrB.exe
  C:\Windows\System\UZjTnrB.exe
  2⤵
  PID:5332
- C:\Windows\System\tSaunxL.exe
  C:\Windows\System\tSaunxL.exe
  2⤵
  PID:5252
- C:\Windows\System\bVFrEgl.exe
  C:\Windows\System\bVFrEgl.exe
  2⤵
  PID:5400
- C:\Windows\System\GXdPczl.exe
  C:\Windows\System\GXdPczl.exe
  2⤵
  PID:5496
- C:\Windows\System\LksRgNo.exe
  C:\Windows\System\LksRgNo.exe
  2⤵
  PID:5500
- C:\Windows\System\FMyQyjt.exe
  C:\Windows\System\FMyQyjt.exe
  2⤵
  PID:5524
- C:\Windows\System\VcsFUOY.exe
  C:\Windows\System\VcsFUOY.exe
  2⤵
  PID:5444
- C:\Windows\System\kONCWuI.exe
  C:\Windows\System\kONCWuI.exe
  2⤵
  PID:5568
- C:\Windows\System\jcTqySW.exe
  C:\Windows\System\jcTqySW.exe
  2⤵
  PID:5316
- C:\Windows\System\bhWrASE.exe
  C:\Windows\System\bhWrASE.exe
  2⤵
  PID:5412
- C:\Windows\System\KULTOFG.exe
  C:\Windows\System\KULTOFG.exe
  2⤵
  PID:5964
- C:\Windows\System\WvfQhVf.exe
  C:\Windows\System\WvfQhVf.exe
  2⤵
  PID:5588
- C:\Windows\System\lnBPaPq.exe
  C:\Windows\System\lnBPaPq.exe
  2⤵
  PID:5368
- C:\Windows\System\aJPSnJL.exe
  C:\Windows\System\aJPSnJL.exe
  2⤵
  PID:5656
- C:\Windows\System\SFEeaRm.exe
  C:\Windows\System\SFEeaRm.exe
  2⤵
  PID:5248
- C:\Windows\System\CxLawus.exe
  C:\Windows\System\CxLawus.exe
  2⤵
  PID:968
- C:\Windows\System\FtfcFPL.exe
  C:\Windows\System\FtfcFPL.exe
  2⤵
  PID:5448
- C:\Windows\System\vVJnMEW.exe
  C:\Windows\System\vVJnMEW.exe
  2⤵
  PID:6088
- C:\Windows\System\AuWeRis.exe
  C:\Windows\System\AuWeRis.exe
  2⤵
  PID:5864
- C:\Windows\System\JNRYCeS.exe
  C:\Windows\System\JNRYCeS.exe
  2⤵
  PID:6020
- C:\Windows\System\nIJCLCq.exe
  C:\Windows\System\nIJCLCq.exe
  2⤵
  PID:5520
- C:\Windows\System\CQMkSnr.exe
  C:\Windows\System\CQMkSnr.exe
  2⤵
  PID:3828
- C:\Windows\System\jlaDZEB.exe
  C:\Windows\System\jlaDZEB.exe
  2⤵
  PID:5752
- C:\Windows\System\hSPcXkH.exe
  C:\Windows\System\hSPcXkH.exe
  2⤵
  PID:5264
- C:\Windows\System\xJmilcU.exe
  C:\Windows\System\xJmilcU.exe
  2⤵
  PID:5328
- C:\Windows\System\CPLdbVU.exe
  C:\Windows\System\CPLdbVU.exe
  2⤵
  PID:5552
- C:\Windows\System\HlVVOAy.exe
  C:\Windows\System\HlVVOAy.exe
  2⤵
  PID:5996
- C:\Windows\System\oUSirix.exe
  C:\Windows\System\oUSirix.exe
  2⤵
  PID:5832
- C:\Windows\System\SWFCrkM.exe
  C:\Windows\System\SWFCrkM.exe
  2⤵
  PID:5928
- C:\Windows\System\mQVvyfW.exe
  C:\Windows\System\mQVvyfW.exe
  2⤵
  PID:5512
- C:\Windows\System\IJCkzHx.exe
  C:\Windows\System\IJCkzHx.exe
  2⤵
  PID:5604
- C:\Windows\System\lDdsjkj.exe
  C:\Windows\System\lDdsjkj.exe
  2⤵
  PID:5980
- C:\Windows\System\nBjKfjM.exe
  C:\Windows\System\nBjKfjM.exe
  2⤵
  PID:6132
- C:\Windows\System\JjLzByS.exe
  C:\Windows\System\JjLzByS.exe
  2⤵
  PID:6160
- C:\Windows\System\CPIWuho.exe
  C:\Windows\System\CPIWuho.exe
  2⤵
  PID:6176
- C:\Windows\System\PzPdxnI.exe
  C:\Windows\System\PzPdxnI.exe
  2⤵
  PID:6192
- C:\Windows\System\iMgmxcw.exe
  C:\Windows\System\iMgmxcw.exe
  2⤵
  PID:6292
- C:\Windows\System\BaaxzqY.exe
  C:\Windows\System\BaaxzqY.exe
  2⤵
  PID:6308
- C:\Windows\System\qTPxrSK.exe
  C:\Windows\System\qTPxrSK.exe
  2⤵
  PID:6324
- C:\Windows\System\UKiaTxZ.exe
  C:\Windows\System\UKiaTxZ.exe
  2⤵
  PID:6340
- C:\Windows\System\bUshbOf.exe
  C:\Windows\System\bUshbOf.exe
  2⤵
  PID:6356
- C:\Windows\System\VSgibFl.exe
  C:\Windows\System\VSgibFl.exe
  2⤵
  PID:6372
- C:\Windows\System\dDWgIrb.exe
  C:\Windows\System\dDWgIrb.exe
  2⤵
  PID:6388
- C:\Windows\System\WDdAAer.exe
  C:\Windows\System\WDdAAer.exe
  2⤵
  PID:6404
- C:\Windows\System\xPjXizP.exe
  C:\Windows\System\xPjXizP.exe
  2⤵
  PID:6420
- C:\Windows\System\EsoHCNF.exe
  C:\Windows\System\EsoHCNF.exe
  2⤵
  PID:6464
- C:\Windows\System\OptrFnq.exe
  C:\Windows\System\OptrFnq.exe
  2⤵
  PID:6480
- C:\Windows\System\FacVajQ.exe
  C:\Windows\System\FacVajQ.exe
  2⤵
  PID:6496
- C:\Windows\System\refuRpI.exe
  C:\Windows\System\refuRpI.exe
  2⤵
  PID:6520
- C:\Windows\System\gzUAfxT.exe
  C:\Windows\System\gzUAfxT.exe
  2⤵
  PID:6536
- C:\Windows\System\SlAsnoY.exe
  C:\Windows\System\SlAsnoY.exe
  2⤵
  PID:6552
- C:\Windows\System\tYeXtpX.exe
  C:\Windows\System\tYeXtpX.exe
  2⤵
  PID:6568
- C:\Windows\System\PuXYkCT.exe
  C:\Windows\System\PuXYkCT.exe
  2⤵
  PID:6584
- C:\Windows\System\kUCbBDK.exe
  C:\Windows\System\kUCbBDK.exe
  2⤵
  PID:6604
- C:\Windows\System\LJkUjRR.exe
  C:\Windows\System\LJkUjRR.exe
  2⤵
  PID:6620
- C:\Windows\System\hFZxscy.exe
  C:\Windows\System\hFZxscy.exe
  2⤵
  PID:6636
- C:\Windows\System\YwRdBCC.exe
  C:\Windows\System\YwRdBCC.exe
  2⤵
  PID:6652
- C:\Windows\System\EZbzyYd.exe
  C:\Windows\System\EZbzyYd.exe
  2⤵
  PID:6672
- C:\Windows\System\MxSxdgq.exe
  C:\Windows\System\MxSxdgq.exe
  2⤵
  PID:6688
- C:\Windows\System\IGLWXMY.exe
  C:\Windows\System\IGLWXMY.exe
  2⤵
  PID:6704
- C:\Windows\System\QDisBhP.exe
  C:\Windows\System\QDisBhP.exe
  2⤵
  PID:6720
- C:\Windows\System\GrZaMCz.exe
  C:\Windows\System\GrZaMCz.exe
  2⤵
  PID:6736
- C:\Windows\System\GgPhuUn.exe
  C:\Windows\System\GgPhuUn.exe
  2⤵
  PID:6756
- C:\Windows\System\PMPavtB.exe
  C:\Windows\System\PMPavtB.exe
  2⤵
  PID:6772
- C:\Windows\System\jgdqRIq.exe
  C:\Windows\System\jgdqRIq.exe
  2⤵
  PID:6788
- C:\Windows\System\sWWkDMd.exe
  C:\Windows\System\sWWkDMd.exe
  2⤵
  PID:6804
- C:\Windows\System\BwXzUVi.exe
  C:\Windows\System\BwXzUVi.exe
  2⤵
  PID:6820
- C:\Windows\System\ZwRnrQF.exe
  C:\Windows\System\ZwRnrQF.exe
  2⤵
  PID:6840
- C:\Windows\System\RLMImwh.exe
  C:\Windows\System\RLMImwh.exe
  2⤵
  PID:6856
- C:\Windows\System\VyXAkxj.exe
  C:\Windows\System\VyXAkxj.exe
  2⤵
  PID:6900
- C:\Windows\System\otqoEVF.exe
  C:\Windows\System\otqoEVF.exe
  2⤵
  PID:6924
- C:\Windows\System\PylXuyq.exe
  C:\Windows\System\PylXuyq.exe
  2⤵
  PID:6940
- C:\Windows\System\wRxMKdx.exe
  C:\Windows\System\wRxMKdx.exe
  2⤵
  PID:6956
- C:\Windows\System\cevprin.exe
  C:\Windows\System\cevprin.exe
  2⤵
  PID:6972
- C:\Windows\System\AHKsCJw.exe
  C:\Windows\System\AHKsCJw.exe
  2⤵
  PID:6988
- C:\Windows\System\ZzFvsRj.exe
  C:\Windows\System\ZzFvsRj.exe
  2⤵
  PID:7008
- C:\Windows\System\VErMefD.exe
  C:\Windows\System\VErMefD.exe
  2⤵
  PID:7028
- C:\Windows\System\QqDkLRQ.exe
  C:\Windows\System\QqDkLRQ.exe
  2⤵
  PID:7044
- C:\Windows\System\jhLYYNE.exe
  C:\Windows\System\jhLYYNE.exe
  2⤵
  PID:7060
- C:\Windows\System\kKidADT.exe
  C:\Windows\System\kKidADT.exe
  2⤵
  PID:7076
- C:\Windows\System\BIVTVtg.exe
  C:\Windows\System\BIVTVtg.exe
  2⤵
  PID:7092
- C:\Windows\System\OkgqZcx.exe
  C:\Windows\System\OkgqZcx.exe
  2⤵
  PID:7108
- C:\Windows\System\KKspCnS.exe
  C:\Windows\System\KKspCnS.exe
  2⤵
  PID:7124
- C:\Windows\System\baVrdVm.exe
  C:\Windows\System\baVrdVm.exe
  2⤵
  PID:7140
- C:\Windows\System\olkBNBK.exe
  C:\Windows\System\olkBNBK.exe
  2⤵
  PID:7156
- C:\Windows\System\wsXkDRr.exe
  C:\Windows\System\wsXkDRr.exe
  2⤵
  PID:5212
- C:\Windows\System\dPpVJqN.exe
  C:\Windows\System\dPpVJqN.exe
  2⤵
  PID:5624
- C:\Windows\System\oxayAld.exe
  C:\Windows\System\oxayAld.exe
  2⤵
  PID:6068
- C:\Windows\System\RvXuVOu.exe
  C:\Windows\System\RvXuVOu.exe
  2⤵
  PID:6184
- C:\Windows\System\cUhYUzk.exe
  C:\Windows\System\cUhYUzk.exe
  2⤵
  PID:3768
- C:\Windows\System\bZqzUFJ.exe
  C:\Windows\System\bZqzUFJ.exe
  2⤵
  PID:5800
- C:\Windows\System\mPWDaPw.exe
  C:\Windows\System\mPWDaPw.exe
  2⤵
  PID:5620
- C:\Windows\System\cAwLZob.exe
  C:\Windows\System\cAwLZob.exe
  2⤵
  PID:5784
- C:\Windows\System\LLovOoM.exe
  C:\Windows\System\LLovOoM.exe
  2⤵
  PID:5300
- C:\Windows\System\BSEimfG.exe
  C:\Windows\System\BSEimfG.exe
  2⤵
  PID:6084
- C:\Windows\System\jKiTylt.exe
  C:\Windows\System\jKiTylt.exe
  2⤵
  PID:6172
- C:\Windows\System\OskLuiZ.exe
  C:\Windows\System\OskLuiZ.exe
  2⤵
  PID:6216
- C:\Windows\System\LqHFxxv.exe
  C:\Windows\System\LqHFxxv.exe
  2⤵
  PID:6228
- C:\Windows\System\UacqeYU.exe
  C:\Windows\System\UacqeYU.exe
  2⤵
  PID:6244
- C:\Windows\System\sKcAaka.exe
  C:\Windows\System\sKcAaka.exe
  2⤵
  PID:6564
- C:\Windows\System\wlECMVp.exe
  C:\Windows\System\wlECMVp.exe
  2⤵
  PID:6632
- C:\Windows\System\evAIEPM.exe
  C:\Windows\System\evAIEPM.exe
  2⤵
  PID:6696
- C:\Windows\System\gsuIfSK.exe
  C:\Windows\System\gsuIfSK.exe
  2⤵
  PID:6768
- C:\Windows\System\OtwifKx.exe
  C:\Windows\System\OtwifKx.exe
  2⤵
  PID:6852
- C:\Windows\System\OICOSVr.exe
  C:\Windows\System\OICOSVr.exe
  2⤵
  PID:6580
- C:\Windows\System\LKVJrYA.exe
  C:\Windows\System\LKVJrYA.exe
  2⤵
  PID:6504
- C:\Windows\System\kHWVKHR.exe
  C:\Windows\System\kHWVKHR.exe
  2⤵
  PID:6836
- C:\Windows\System\MYpsYjO.exe
  C:\Windows\System\MYpsYjO.exe
  2⤵
  PID:6876
- C:\Windows\System\IzqZeAe.exe
  C:\Windows\System\IzqZeAe.exe
  2⤵
  PID:6892
- C:\Windows\System\JdQeTiY.exe
  C:\Windows\System\JdQeTiY.exe
  2⤵
  PID:6964
- C:\Windows\System\kmzsKyE.exe
  C:\Windows\System\kmzsKyE.exe
  2⤵
  PID:7000
- C:\Windows\System\EBffHzH.exe
  C:\Windows\System\EBffHzH.exe
  2⤵
  PID:7068
- C:\Windows\System\DrUidDF.exe
  C:\Windows\System\DrUidDF.exe
  2⤵
  PID:7136
- C:\Windows\System\KRVjdWw.exe
  C:\Windows\System\KRVjdWw.exe
  2⤵
  PID:6052
- C:\Windows\System\tyorgDK.exe
  C:\Windows\System\tyorgDK.exe
  2⤵
  PID:6224
- C:\Windows\System\dbxwbYb.exe
  C:\Windows\System\dbxwbYb.exe
  2⤵
  PID:5464
- C:\Windows\System\EhZNoEL.exe
  C:\Windows\System\EhZNoEL.exe
  2⤵
  PID:6612
- C:\Windows\System\jDpPZUf.exe
  C:\Windows\System\jDpPZUf.exe
  2⤵
  PID:6684
- C:\Windows\System\vHJqeQb.exe
  C:\Windows\System\vHJqeQb.exe
  2⤵
  PID:6812
- C:\Windows\System\bXWjxmX.exe
  C:\Windows\System\bXWjxmX.exe
  2⤵
  PID:6980
- C:\Windows\System\OkjQIAW.exe
  C:\Windows\System\OkjQIAW.exe
  2⤵
  PID:7056
- C:\Windows\System\nwsNltZ.exe
  C:\Windows\System\nwsNltZ.exe
  2⤵
  PID:7120
- C:\Windows\System\NgbHmEa.exe
  C:\Windows\System\NgbHmEa.exe
  2⤵
  PID:5544
- C:\Windows\System\ZuWnmjy.exe
  C:\Windows\System\ZuWnmjy.exe
  2⤵
  PID:6268
- C:\Windows\System\horZrJp.exe
  C:\Windows\System\horZrJp.exe
  2⤵
  PID:6300
- C:\Windows\System\nsuCplt.exe
  C:\Windows\System\nsuCplt.exe
  2⤵
  PID:6732
- C:\Windows\System\wzYpOLM.exe
  C:\Windows\System\wzYpOLM.exe
  2⤵
  PID:6276
- C:\Windows\System\ZYIksVX.exe
  C:\Windows\System\ZYIksVX.exe
  2⤵
  PID:6412
- C:\Windows\System\yrdwhxG.exe
  C:\Windows\System\yrdwhxG.exe
  2⤵
  PID:6472
- C:\Windows\System\pJUijvg.exe
  C:\Windows\System\pJUijvg.exe
  2⤵
  PID:6428
- C:\Windows\System\qkVURWG.exe
  C:\Windows\System\qkVURWG.exe
  2⤵
  PID:6440
- C:\Windows\System\bmeZTUr.exe
  C:\Windows\System\bmeZTUr.exe
  2⤵
  PID:4724
- C:\Windows\System\YBvGHse.exe
  C:\Windows\System\YBvGHse.exe
  2⤵
  PID:6528
- C:\Windows\System\gBFHAZI.exe
  C:\Windows\System\gBFHAZI.exe
  2⤵
  PID:6512
- C:\Windows\System\lWOHoFY.exe
  C:\Windows\System\lWOHoFY.exe
  2⤵
  PID:6936
- C:\Windows\System\rgnsyfQ.exe
  C:\Windows\System\rgnsyfQ.exe
  2⤵
  PID:5720
- C:\Windows\System\sIrgjIS.exe
  C:\Windows\System\sIrgjIS.exe
  2⤵
  PID:6796
- C:\Windows\System\KzuqpXS.exe
  C:\Windows\System\KzuqpXS.exe
  2⤵
  PID:6832
- C:\Windows\System\GiudgUM.exe
  C:\Windows\System\GiudgUM.exe
  2⤵
  PID:7100
- C:\Windows\System\coYXZcd.exe
  C:\Windows\System\coYXZcd.exe
  2⤵
  PID:5700
- C:\Windows\System\CMLuBcI.exe
  C:\Windows\System\CMLuBcI.exe
  2⤵
  PID:5936
- C:\Windows\System\FzdoRXy.exe
  C:\Windows\System\FzdoRXy.exe
  2⤵
  PID:6208
- C:\Windows\System\WbFzuOK.exe
  C:\Windows\System\WbFzuOK.exe
  2⤵
  PID:6260
- C:\Windows\System\gnvZXBT.exe
  C:\Windows\System\gnvZXBT.exe
  2⤵
  PID:7152
- C:\Windows\System\Yttgutt.exe
  C:\Windows\System\Yttgutt.exe
  2⤵
  PID:6728
- C:\Windows\System\rZOdydk.exe
  C:\Windows\System\rZOdydk.exe
  2⤵
  PID:6352
- C:\Windows\System\ZLaaRDf.exe
  C:\Windows\System\ZLaaRDf.exe
  2⤵
  PID:6448
- C:\Windows\System\qQRMRkI.exe
  C:\Windows\System\qQRMRkI.exe
  2⤵
  PID:6848
- C:\Windows\System\HVdICqT.exe
  C:\Windows\System\HVdICqT.exe
  2⤵
  PID:6112
- C:\Windows\System\ZhijOyu.exe
  C:\Windows\System\ZhijOyu.exe
  2⤵
  PID:6916
- C:\Windows\System\pFzHfhF.exe
  C:\Windows\System\pFzHfhF.exe
  2⤵
  PID:6320
- C:\Windows\System\piZktkc.exe
  C:\Windows\System\piZktkc.exe
  2⤵
  PID:6364
- C:\Windows\System\iZNgbwj.exe
  C:\Windows\System\iZNgbwj.exe
  2⤵
  PID:6436
- C:\Windows\System\MtpgYfs.exe
  C:\Windows\System\MtpgYfs.exe
  2⤵
  PID:6476
- C:\Windows\System\KDXMQNm.exe
  C:\Windows\System\KDXMQNm.exe
  2⤵
  PID:6780
- C:\Windows\System\fEjlWLB.exe
  C:\Windows\System\fEjlWLB.exe
  2⤵
  PID:6716
- C:\Windows\System\PtWInUH.exe
  C:\Windows\System\PtWInUH.exe
  2⤵
  PID:6628
- C:\Windows\System\WgXJIdK.exe
  C:\Windows\System\WgXJIdK.exe
  2⤵
  PID:6004
- C:\Windows\System\vDolUsz.exe
  C:\Windows\System\vDolUsz.exe
  2⤵
  PID:5576
- C:\Windows\System\SALTWMw.exe
  C:\Windows\System\SALTWMw.exe
  2⤵
  PID:1772
- C:\Windows\System\EUiCqso.exe
  C:\Windows\System\EUiCqso.exe
  2⤵
  PID:6368
- C:\Windows\System\OJzDlyA.exe
  C:\Windows\System\OJzDlyA.exe
  2⤵
  PID:7180
- C:\Windows\System\NSwVUOg.exe
  C:\Windows\System\NSwVUOg.exe
  2⤵
  PID:7196
- C:\Windows\System\MrdJtbF.exe
  C:\Windows\System\MrdJtbF.exe
  2⤵
  PID:7212
- C:\Windows\System\gFeHbzn.exe
  C:\Windows\System\gFeHbzn.exe
  2⤵
  PID:7232
- C:\Windows\System\jkThXny.exe
  C:\Windows\System\jkThXny.exe
  2⤵
  PID:7248
- C:\Windows\System\UATYHSu.exe
  C:\Windows\System\UATYHSu.exe
  2⤵
  PID:7264
- C:\Windows\System\WjEzvzR.exe
  C:\Windows\System\WjEzvzR.exe
  2⤵
  PID:7284
- C:\Windows\System\ItBlSvC.exe
  C:\Windows\System\ItBlSvC.exe
  2⤵
  PID:7300
- C:\Windows\System\KgggMXP.exe
  C:\Windows\System\KgggMXP.exe
  2⤵
  PID:7316
- C:\Windows\System\AxaknGz.exe
  C:\Windows\System\AxaknGz.exe
  2⤵
  PID:7336
- C:\Windows\System\TCuRZTk.exe
  C:\Windows\System\TCuRZTk.exe
  2⤵
  PID:7352
- C:\Windows\System\oDIQVFe.exe
  C:\Windows\System\oDIQVFe.exe
  2⤵
  PID:7368
- C:\Windows\System\uwTrCuq.exe
  C:\Windows\System\uwTrCuq.exe
  2⤵
  PID:7388
- C:\Windows\System\wGoweSG.exe
  C:\Windows\System\wGoweSG.exe
  2⤵
  PID:7404
- C:\Windows\System\hrksIYn.exe
  C:\Windows\System\hrksIYn.exe
  2⤵
  PID:7420
- C:\Windows\System\KUxZbFt.exe
  C:\Windows\System\KUxZbFt.exe
  2⤵
  PID:7436
- C:\Windows\System\GisWuHq.exe
  C:\Windows\System\GisWuHq.exe
  2⤵
  PID:7452
- C:\Windows\System\PfZSDha.exe
  C:\Windows\System\PfZSDha.exe
  2⤵
  PID:7472
- C:\Windows\System\dMOcPeP.exe
  C:\Windows\System\dMOcPeP.exe
  2⤵
  PID:7488
- C:\Windows\System\wSOiPLY.exe
  C:\Windows\System\wSOiPLY.exe
  2⤵
  PID:7504
- C:\Windows\System\qShlqVP.exe
  C:\Windows\System\qShlqVP.exe
  2⤵
  PID:7520
- C:\Windows\System\NwIcNbi.exe
  C:\Windows\System\NwIcNbi.exe
  2⤵
  PID:7536
- C:\Windows\System\rkWBZaI.exe
  C:\Windows\System\rkWBZaI.exe
  2⤵
  PID:7552
- C:\Windows\System\IFRGJZE.exe
  C:\Windows\System\IFRGJZE.exe
  2⤵
  PID:7572
- C:\Windows\System\MPECLfN.exe
  C:\Windows\System\MPECLfN.exe
  2⤵
  PID:7588
- C:\Windows\System\KAEPxAV.exe
  C:\Windows\System\KAEPxAV.exe
  2⤵
  PID:7604
- C:\Windows\System\qDVHPhy.exe
  C:\Windows\System\qDVHPhy.exe
  2⤵
  PID:7660
- C:\Windows\System\nZLKxiD.exe
  C:\Windows\System\nZLKxiD.exe
  2⤵
  PID:7680
- C:\Windows\System\eZctHjK.exe
  C:\Windows\System\eZctHjK.exe
  2⤵
  PID:7704
- C:\Windows\System\fZEOGzK.exe
  C:\Windows\System\fZEOGzK.exe
  2⤵
  PID:7720
- C:\Windows\System\hgbJSKj.exe
  C:\Windows\System\hgbJSKj.exe
  2⤵
  PID:7740
- C:\Windows\System\ogkESMM.exe
  C:\Windows\System\ogkESMM.exe
  2⤵
  PID:7756
- C:\Windows\System\bTVwLcE.exe
  C:\Windows\System\bTVwLcE.exe
  2⤵
  PID:7772
- C:\Windows\System\nJzwvxd.exe
  C:\Windows\System\nJzwvxd.exe
  2⤵
  PID:7788
- C:\Windows\System\VBXJpvA.exe
  C:\Windows\System\VBXJpvA.exe
  2⤵
  PID:7808
- C:\Windows\System\hPVhsxt.exe
  C:\Windows\System\hPVhsxt.exe
  2⤵
  PID:7824
- C:\Windows\System\LMYvSxI.exe
  C:\Windows\System\LMYvSxI.exe
  2⤵
  PID:7840
- C:\Windows\System\ctFSUWW.exe
  C:\Windows\System\ctFSUWW.exe
  2⤵
  PID:7856
- C:\Windows\System\iicNhGY.exe
  C:\Windows\System\iicNhGY.exe
  2⤵
  PID:7872
- C:\Windows\System\wziiKKa.exe
  C:\Windows\System\wziiKKa.exe
  2⤵
  PID:7888
- C:\Windows\System\yfxUTtt.exe
  C:\Windows\System\yfxUTtt.exe
  2⤵
  PID:7916
- C:\Windows\System\TWmzvTu.exe
  C:\Windows\System\TWmzvTu.exe
  2⤵
  PID:7932
- C:\Windows\System\mfnavBL.exe
  C:\Windows\System\mfnavBL.exe
  2⤵
  PID:7948
- C:\Windows\System\NcvZAra.exe
  C:\Windows\System\NcvZAra.exe
  2⤵
  PID:7964
- C:\Windows\System\tOHzpBU.exe
  C:\Windows\System\tOHzpBU.exe
  2⤵
  PID:7980
- C:\Windows\System\bhNJYQg.exe
  C:\Windows\System\bhNJYQg.exe
  2⤵
  PID:8000
- C:\Windows\System\qmbhecw.exe
  C:\Windows\System\qmbhecw.exe
  2⤵
  PID:8020
- C:\Windows\System\wflckoo.exe
  C:\Windows\System\wflckoo.exe
  2⤵
  PID:8036
- C:\Windows\System\aKixHbw.exe
  C:\Windows\System\aKixHbw.exe
  2⤵
  PID:8052
- C:\Windows\System\yGNpJfy.exe
  C:\Windows\System\yGNpJfy.exe
  2⤵
  PID:8068
- C:\Windows\System\TLJqTCJ.exe
  C:\Windows\System\TLJqTCJ.exe
  2⤵
  PID:8084
- C:\Windows\System\LgRDSvA.exe
  C:\Windows\System\LgRDSvA.exe
  2⤵
  PID:8100
- C:\Windows\System\ybOwmKv.exe
  C:\Windows\System\ybOwmKv.exe
  2⤵
  PID:8116
- C:\Windows\System\WZoWONK.exe
  C:\Windows\System\WZoWONK.exe
  2⤵
  PID:8132
- C:\Windows\System\MLFyZMf.exe
  C:\Windows\System\MLFyZMf.exe
  2⤵
  PID:8148
- C:\Windows\System\qVrVbtD.exe
  C:\Windows\System\qVrVbtD.exe
  2⤵
  PID:8168
- C:\Windows\System\SZYPkTY.exe
  C:\Windows\System\SZYPkTY.exe
  2⤵
  PID:8184
- C:\Windows\System\JRMvxkD.exe
  C:\Windows\System\JRMvxkD.exe
  2⤵
  PID:6908
- C:\Windows\System\IFglvDt.exe
  C:\Windows\System\IFglvDt.exe
  2⤵
  PID:6596
- C:\Windows\System\UtLhhCX.exe
  C:\Windows\System\UtLhhCX.exe
  2⤵
  PID:2660
- C:\Windows\System\KHnsPAu.exe
  C:\Windows\System\KHnsPAu.exe
  2⤵
  PID:7612
- C:\Windows\System\LqXDGnN.exe
  C:\Windows\System\LqXDGnN.exe
  2⤵
  PID:7512
- C:\Windows\System\TZKjpbM.exe
  C:\Windows\System\TZKjpbM.exe
  2⤵
  PID:7412
- C:\Windows\System\GlcbUhu.exe
  C:\Windows\System\GlcbUhu.exe
  2⤵
  PID:7348
- C:\Windows\System\XOJJFXT.exe
  C:\Windows\System\XOJJFXT.exe
  2⤵
  PID:7276
- C:\Windows\System\VEpZnrq.exe
  C:\Windows\System\VEpZnrq.exe
  2⤵
  PID:6668
- C:\Windows\System\PIeZmus.exe
  C:\Windows\System\PIeZmus.exe
  2⤵
  PID:7172
- C:\Windows\System\CEjQuLy.exe
  C:\Windows\System\CEjQuLy.exe
  2⤵
  PID:7432
- C:\Windows\System\cmWAbmv.exe
  C:\Windows\System\cmWAbmv.exe
  2⤵
  PID:6932
- C:\Windows\System\xbLLGvD.exe
  C:\Windows\System\xbLLGvD.exe
  2⤵
  PID:7364
- C:\Windows\System\btKBOXP.exe
  C:\Windows\System\btKBOXP.exe
  2⤵
  PID:6488
- C:\Windows\System\uTUCYhn.exe
  C:\Windows\System\uTUCYhn.exe
  2⤵
  PID:6336
- C:\Windows\System\HipcbcT.exe
  C:\Windows\System\HipcbcT.exe
  2⤵
  PID:7088
- C:\Windows\System\XUzlonX.exe
  C:\Windows\System\XUzlonX.exe
  2⤵
  PID:6200
- C:\Windows\System\lBwZRiN.exe
  C:\Windows\System\lBwZRiN.exe
  2⤵
  PID:7220
- C:\Windows\System\ZqIGYUS.exe
  C:\Windows\System\ZqIGYUS.exe
  2⤵
  PID:7324
- C:\Windows\System\uLofaVX.exe
  C:\Windows\System\uLofaVX.exe
  2⤵
  PID:7396
- C:\Windows\System\BBoJZTl.exe
  C:\Windows\System\BBoJZTl.exe
  2⤵
  PID:7500
- C:\Windows\System\TkbWxCY.exe
  C:\Windows\System\TkbWxCY.exe
  2⤵
  PID:7564
- C:\Windows\System\VqHmySf.exe
  C:\Windows\System\VqHmySf.exe
  2⤵
  PID:7636
- C:\Windows\System\bylRaKM.exe
  C:\Windows\System\bylRaKM.exe
  2⤵
  PID:5532
- C:\Windows\System\kCWewpY.exe
  C:\Windows\System\kCWewpY.exe
  2⤵
  PID:7700
- C:\Windows\System\xeXGoIB.exe
  C:\Windows\System\xeXGoIB.exe
  2⤵
  PID:7764
- C:\Windows\System\hrKLNHO.exe
  C:\Windows\System\hrKLNHO.exe
  2⤵
  PID:7804
- C:\Windows\System\MrFxpde.exe
  C:\Windows\System\MrFxpde.exe
  2⤵
  PID:7976
- C:\Windows\System\VgWzDoB.exe
  C:\Windows\System\VgWzDoB.exe
  2⤵
  PID:7944
- C:\Windows\System\AcQPVmZ.exe
  C:\Windows\System\AcQPVmZ.exe
  2⤵
  PID:8032
- C:\Windows\System\iQzCwSN.exe
  C:\Windows\System\iQzCwSN.exe
  2⤵
  PID:8092
- C:\Windows\System\WsqohGW.exe
  C:\Windows\System\WsqohGW.exe
  2⤵
  PID:7040
- C:\Windows\System\LJSQJSD.exe
  C:\Windows\System\LJSQJSD.exe
  2⤵
  PID:8028
- C:\Windows\System\zOJkGmp.exe
  C:\Windows\System\zOJkGmp.exe
  2⤵
  PID:7752
- C:\Windows\System\TptnjMJ.exe
  C:\Windows\System\TptnjMJ.exe
  2⤵
  PID:7848
- C:\Windows\System\pIOOXse.exe
  C:\Windows\System\pIOOXse.exe
  2⤵
  PID:7924
- C:\Windows\System\IuOOGUw.exe
  C:\Windows\System\IuOOGUw.exe
  2⤵
  PID:7996
- C:\Windows\System\rXVziEr.exe
  C:\Windows\System\rXVziEr.exe
  2⤵
  PID:7548
- C:\Windows\System\WxFndHN.exe
  C:\Windows\System\WxFndHN.exe
  2⤵
  PID:8080
- C:\Windows\System\DckXzGQ.exe
  C:\Windows\System\DckXzGQ.exe
  2⤵
  PID:8048
- C:\Windows\System\jTHpwMu.exe
  C:\Windows\System\jTHpwMu.exe
  2⤵
  PID:8180
- C:\Windows\System\zFlEklw.exe
  C:\Windows\System\zFlEklw.exe
  2⤵
  PID:6888
- C:\Windows\System\HnhEsvc.exe
  C:\Windows\System\HnhEsvc.exe
  2⤵
  PID:7444
- C:\Windows\System\SyTRlvn.exe
  C:\Windows\System\SyTRlvn.exe
  2⤵
  PID:7204
- C:\Windows\System\owySvsq.exe
  C:\Windows\System\owySvsq.exe
  2⤵
  PID:6332
- C:\Windows\System\xroOcRH.exe
  C:\Windows\System\xroOcRH.exe
  2⤵
  PID:6912
- C:\Windows\System\gUiiTDR.exe
  C:\Windows\System\gUiiTDR.exe
  2⤵
  PID:7328
- C:\Windows\System\gzehpBN.exe
  C:\Windows\System\gzehpBN.exe
  2⤵
  PID:6288
- C:\Windows\System\fwnLAQM.exe
  C:\Windows\System\fwnLAQM.exe
  2⤵
  PID:7900
- C:\Windows\System\fKbzTiz.exe
  C:\Windows\System\fKbzTiz.exe
  2⤵
  PID:7240
- C:\Windows\System\FngDHmt.exe
  C:\Windows\System\FngDHmt.exe
  2⤵
  PID:7260
- C:\Windows\System\RCqXyyk.exe
  C:\Windows\System\RCqXyyk.exe
  2⤵
  PID:7596
- C:\Windows\System\RakshUE.exe
  C:\Windows\System\RakshUE.exe
  2⤵
  PID:7428
- C:\Windows\System\BsCVZNV.exe
  C:\Windows\System\BsCVZNV.exe
  2⤵
  PID:7908
- C:\Windows\System\SSRytTO.exe
  C:\Windows\System\SSRytTO.exe
  2⤵
  PID:7836
- C:\Windows\System\aGtATvV.exe
  C:\Windows\System\aGtATvV.exe
  2⤵
  PID:7632
- C:\Windows\System\cRcbONE.exe
  C:\Windows\System\cRcbONE.exe
  2⤵
  PID:7800
- C:\Windows\System\pMGzLbc.exe
  C:\Windows\System\pMGzLbc.exe
  2⤵
  PID:8156
- C:\Windows\System\Bacmnpm.exe
  C:\Windows\System\Bacmnpm.exe
  2⤵
  PID:7880
- C:\Windows\System\eujznew.exe
  C:\Windows\System\eujznew.exe
  2⤵
  PID:8064
- C:\Windows\System\IErQsLk.exe
  C:\Windows\System\IErQsLk.exe
  2⤵
  PID:7716
- C:\Windows\System\EiRIddj.exe
  C:\Windows\System\EiRIddj.exe
  2⤵
  PID:7624
- C:\Windows\System\hiuQwAp.exe
  C:\Windows\System\hiuQwAp.exe
  2⤵
  PID:7460
- C:\Windows\System\pEmjIZe.exe
  C:\Windows\System\pEmjIZe.exe
  2⤵
  PID:7256
- C:\Windows\System\EdCfcSW.exe
  C:\Windows\System\EdCfcSW.exe
  2⤵
  PID:7732
- C:\Windows\System\IMezTdQ.exe
  C:\Windows\System\IMezTdQ.exe
  2⤵
  PID:8124
- C:\Windows\System\vpzHzls.exe
  C:\Windows\System\vpzHzls.exe
  2⤵
  PID:7736
- C:\Windows\System\BuEmXTx.exe
  C:\Windows\System\BuEmXTx.exe
  2⤵
  PID:7992
- C:\Windows\System\FRNejHP.exe
  C:\Windows\System\FRNejHP.exe
  2⤵
  PID:7712
- C:\Windows\System\etnXXIk.exe
  C:\Windows\System\etnXXIk.exe
  2⤵
  PID:7308
- C:\Windows\System\kErWYyu.exe
  C:\Windows\System\kErWYyu.exe
  2⤵
  PID:7688
- C:\Windows\System\qrmMsOB.exe
  C:\Windows\System\qrmMsOB.exe
  2⤵
  PID:7820
- C:\Windows\System\qCTwAwe.exe
  C:\Windows\System\qCTwAwe.exe
  2⤵
  PID:7480
- C:\Windows\System\vTVioAl.exe
  C:\Windows\System\vTVioAl.exe
  2⤵
  PID:7376
- C:\Windows\System\ZqjlUcx.exe
  C:\Windows\System\ZqjlUcx.exe
  2⤵
  PID:7656
- C:\Windows\System\wKJadYv.exe
  C:\Windows\System\wKJadYv.exe
  2⤵
  PID:7896
- C:\Windows\System\UZSXdGp.exe
  C:\Windows\System\UZSXdGp.exe
  2⤵
  PID:7580
- C:\Windows\System\JlnGNzl.exe
  C:\Windows\System\JlnGNzl.exe
  2⤵
  PID:7360
- C:\Windows\System\vKkeMBb.exe
  C:\Windows\System\vKkeMBb.exe
  2⤵
  PID:8176
- C:\Windows\System\ySuzDqE.exe
  C:\Windows\System\ySuzDqE.exe
  2⤵
  PID:8008
- C:\Windows\System\lMoMQEx.exe
  C:\Windows\System\lMoMQEx.exe
  2⤵
  PID:7696
- C:\Windows\System\mtKzZBc.exe
  C:\Windows\System\mtKzZBc.exe
  2⤵
  PID:7628
- C:\Windows\System\oEDAidD.exe
  C:\Windows\System\oEDAidD.exe
  2⤵
  PID:7912
- C:\Windows\System\mDVwgri.exe
  C:\Windows\System\mDVwgri.exe
  2⤵
  PID:7672
- C:\Windows\System\sYaiElA.exe
  C:\Windows\System\sYaiElA.exe
  2⤵
  PID:7244
- C:\Windows\System\bwRIWVF.exe
  C:\Windows\System\bwRIWVF.exe
  2⤵
  PID:8308
- C:\Windows\System\MKmssXE.exe
  C:\Windows\System\MKmssXE.exe
  2⤵
  PID:8328
- C:\Windows\System\mBCRyWj.exe
  C:\Windows\System\mBCRyWj.exe
  2⤵
  PID:8344
- C:\Windows\System\lysYvKp.exe
  C:\Windows\System\lysYvKp.exe
  2⤵
  PID:8364
- C:\Windows\System\UVseeYq.exe
  C:\Windows\System\UVseeYq.exe
  2⤵
  PID:8384
- C:\Windows\System\vfYAzwI.exe
  C:\Windows\System\vfYAzwI.exe
  2⤵
  PID:8400
- C:\Windows\System\bBmXxQU.exe
  C:\Windows\System\bBmXxQU.exe
  2⤵
  PID:8416
- C:\Windows\System\freNBux.exe
  C:\Windows\System\freNBux.exe
  2⤵
  PID:8432
- C:\Windows\System\DXpOtnb.exe
  C:\Windows\System\DXpOtnb.exe
  2⤵
  PID:8496
- C:\Windows\System\TPacgtp.exe
  C:\Windows\System\TPacgtp.exe
  2⤵
  PID:8512
- C:\Windows\System\CtbhOTg.exe
  C:\Windows\System\CtbhOTg.exe
  2⤵
  PID:8532
- C:\Windows\System\gklMXgT.exe
  C:\Windows\System\gklMXgT.exe
  2⤵
  PID:8548
- C:\Windows\System\kNZruKj.exe
  C:\Windows\System\kNZruKj.exe
  2⤵
  PID:8564
- C:\Windows\System\oYdgBQF.exe
  C:\Windows\System\oYdgBQF.exe
  2⤵
  PID:8580
- C:\Windows\System\oENxUQE.exe
  C:\Windows\System\oENxUQE.exe
  2⤵
  PID:8596
- C:\Windows\System\SuvzVim.exe
  C:\Windows\System\SuvzVim.exe
  2⤵
  PID:8612
- C:\Windows\System\LoqVfXD.exe
  C:\Windows\System\LoqVfXD.exe
  2⤵
  PID:8628
- C:\Windows\System\wQeHdVV.exe
  C:\Windows\System\wQeHdVV.exe
  2⤵
  PID:8644
- C:\Windows\System\AIeJutV.exe
  C:\Windows\System\AIeJutV.exe
  2⤵
  PID:8660
- C:\Windows\System\YCihSaO.exe
  C:\Windows\System\YCihSaO.exe
  2⤵
  PID:8676
- C:\Windows\System\weUYtOD.exe
  C:\Windows\System\weUYtOD.exe
  2⤵
  PID:8692
- C:\Windows\System\fXEjgKv.exe
  C:\Windows\System\fXEjgKv.exe
  2⤵
  PID:8708
- C:\Windows\System\MsXSClU.exe
  C:\Windows\System\MsXSClU.exe
  2⤵
  PID:8724
- C:\Windows\System\KKmBxva.exe
  C:\Windows\System\KKmBxva.exe
  2⤵
  PID:8740
- C:\Windows\System\XzPjTSI.exe
  C:\Windows\System\XzPjTSI.exe
  2⤵
  PID:8756
- C:\Windows\System\zlaZejW.exe
  C:\Windows\System\zlaZejW.exe
  2⤵
  PID:8772
- C:\Windows\System\MlVvGdO.exe
  C:\Windows\System\MlVvGdO.exe
  2⤵
  PID:8788
- C:\Windows\System\UiFVihE.exe
  C:\Windows\System\UiFVihE.exe
  2⤵
  PID:8804
- C:\Windows\System\lrMCECB.exe
  C:\Windows\System\lrMCECB.exe
  2⤵
  PID:8820
- C:\Windows\System\jkBlRjM.exe
  C:\Windows\System\jkBlRjM.exe
  2⤵
  PID:8836
- C:\Windows\System\VjdeJWT.exe
  C:\Windows\System\VjdeJWT.exe
  2⤵
  PID:8852
- C:\Windows\System\JCaryIf.exe
  C:\Windows\System\JCaryIf.exe
  2⤵
  PID:8868
- C:\Windows\System\OmkxfaW.exe
  C:\Windows\System\OmkxfaW.exe
  2⤵
  PID:8884
- C:\Windows\System\JOPGfpq.exe
  C:\Windows\System\JOPGfpq.exe
  2⤵
  PID:8900
- C:\Windows\System\MZLULDO.exe
  C:\Windows\System\MZLULDO.exe
  2⤵
  PID:8916
- C:\Windows\System\BhwKSjA.exe
  C:\Windows\System\BhwKSjA.exe
  2⤵
  PID:8932
- C:\Windows\System\GZcSVry.exe
  C:\Windows\System\GZcSVry.exe
  2⤵
  PID:8948
- C:\Windows\System\sIahXdd.exe
  C:\Windows\System\sIahXdd.exe
  2⤵
  PID:8964
- C:\Windows\System\KzsknYu.exe
  C:\Windows\System\KzsknYu.exe
  2⤵
  PID:8980
- C:\Windows\System\hDAnyxu.exe
  C:\Windows\System\hDAnyxu.exe
  2⤵
  PID:8996
- C:\Windows\System\mRnPVnH.exe
  C:\Windows\System\mRnPVnH.exe
  2⤵
  PID:9012
- C:\Windows\System\UENtrXi.exe
  C:\Windows\System\UENtrXi.exe
  2⤵
  PID:9028
- C:\Windows\System\uWGDTwc.exe
  C:\Windows\System\uWGDTwc.exe
  2⤵
  PID:9044
- C:\Windows\System\mepmlET.exe
  C:\Windows\System\mepmlET.exe
  2⤵
  PID:9060
- C:\Windows\System\NoxcYrp.exe
  C:\Windows\System\NoxcYrp.exe
  2⤵
  PID:9076
- C:\Windows\System\LHpMUli.exe
  C:\Windows\System\LHpMUli.exe
  2⤵
  PID:9096
- C:\Windows\System\QSiqOVm.exe
  C:\Windows\System\QSiqOVm.exe
  2⤵
  PID:9112
- C:\Windows\System\gLJNofS.exe
  C:\Windows\System\gLJNofS.exe
  2⤵
  PID:9128
- C:\Windows\System\yxXHtCM.exe
  C:\Windows\System\yxXHtCM.exe
  2⤵
  PID:9144
- C:\Windows\System\RbGQFdJ.exe
  C:\Windows\System\RbGQFdJ.exe
  2⤵
  PID:9160
- C:\Windows\System\SDtCnlh.exe
  C:\Windows\System\SDtCnlh.exe
  2⤵
  PID:9176
- C:\Windows\System\JeFNXTZ.exe
  C:\Windows\System\JeFNXTZ.exe
  2⤵
  PID:9192
- C:\Windows\System\tbwCMVV.exe
  C:\Windows\System\tbwCMVV.exe
  2⤵
  PID:9208
- C:\Windows\System\Czdbuux.exe
  C:\Windows\System\Czdbuux.exe
  2⤵
  PID:7496
- C:\Windows\System\svOlhax.exe
  C:\Windows\System\svOlhax.exe
  2⤵
  PID:8212
- C:\Windows\System\lbLOseU.exe
  C:\Windows\System\lbLOseU.exe
  2⤵
  PID:8228
- C:\Windows\System\axrPrQD.exe
  C:\Windows\System\axrPrQD.exe
  2⤵
  PID:8248
- C:\Windows\System\kmhvRpa.exe
  C:\Windows\System\kmhvRpa.exe
  2⤵
  PID:8260
- C:\Windows\System\ueBTGth.exe
  C:\Windows\System\ueBTGth.exe
  2⤵
  PID:7016
- C:\Windows\System\LBuWtIa.exe
  C:\Windows\System\LBuWtIa.exe
  2⤵
  PID:8272
- C:\Windows\System\LWpvgCe.exe
  C:\Windows\System\LWpvgCe.exe
  2⤵
  PID:8292
- C:\Windows\System\FCNDoSt.exe
  C:\Windows\System\FCNDoSt.exe
  2⤵
  PID:8324
- C:\Windows\System\uRqEgpU.exe
  C:\Windows\System\uRqEgpU.exe
  2⤵
  PID:8356
- C:\Windows\System\JpjDHwR.exe
  C:\Windows\System\JpjDHwR.exe
  2⤵
  PID:8300
- C:\Windows\System\FvaTyFj.exe
  C:\Windows\System\FvaTyFj.exe
  2⤵
  PID:8372
- C:\Windows\System\mXaViaU.exe
  C:\Windows\System\mXaViaU.exe
  2⤵
  PID:8440
- C:\Windows\System\TklIqfi.exe
  C:\Windows\System\TklIqfi.exe
  2⤵
  PID:6400
- C:\Windows\System\GLOtrJF.exe
  C:\Windows\System\GLOtrJF.exe
  2⤵
  PID:8464
- C:\Windows\System\jZOsLAp.exe
  C:\Windows\System\jZOsLAp.exe
  2⤵
  PID:8488
- C:\Windows\System\jWFFVGn.exe
  C:\Windows\System\jWFFVGn.exe
  2⤵
  PID:8476
- C:\Windows\System\kQrDrqE.exe
  C:\Windows\System\kQrDrqE.exe
  2⤵
  PID:8528
- C:\Windows\System\yNNcmxe.exe
  C:\Windows\System\yNNcmxe.exe
  2⤵
  PID:8588
- C:\Windows\System\gdcsgGS.exe
  C:\Windows\System\gdcsgGS.exe
  2⤵
  PID:8620
- C:\Windows\System\IwSbBnz.exe
  C:\Windows\System\IwSbBnz.exe
  2⤵
  PID:8652
- C:\Windows\System\EgmnnIq.exe
  C:\Windows\System\EgmnnIq.exe
  2⤵
  PID:8684
- C:\Windows\System\MjYWPVC.exe
  C:\Windows\System\MjYWPVC.exe
  2⤵
  PID:9008
- C:\Windows\System\YmKZIxY.exe
  C:\Windows\System\YmKZIxY.exe
  2⤵
  PID:9020
- C:\Windows\System\nyBOuUw.exe
  C:\Windows\System\nyBOuUw.exe
  2⤵
  PID:8928
- C:\Windows\System\nRxCLsw.exe
  C:\Windows\System\nRxCLsw.exe
  2⤵
  PID:9036
- C:\Windows\System\WKHcLOG.exe
  C:\Windows\System\WKHcLOG.exe
  2⤵
  PID:9108
- C:\Windows\System\URGTrwE.exe
  C:\Windows\System\URGTrwE.exe
  2⤵
  PID:9140
- C:\Windows\System\pcsFDqL.exe
  C:\Windows\System\pcsFDqL.exe
  2⤵
  PID:9124
- C:\Windows\System\PfLYhqL.exe
  C:\Windows\System\PfLYhqL.exe
  2⤵
  PID:9172
- C:\Windows\System\fWDHRXY.exe
  C:\Windows\System\fWDHRXY.exe
  2⤵
  PID:9152
- C:\Windows\System\wdDTYTc.exe
  C:\Windows\System\wdDTYTc.exe
  2⤵
  PID:8200
- C:\Windows\System\NVNTELr.exe
  C:\Windows\System\NVNTELr.exe
  2⤵
  PID:7192
- C:\Windows\System\pvIoFSo.exe
  C:\Windows\System\pvIoFSo.exe
  2⤵
  PID:8224
- C:\Windows\System\lzhFMzH.exe
  C:\Windows\System\lzhFMzH.exe
  2⤵
  PID:8352
- C:\Windows\System\Kqgddgg.exe
  C:\Windows\System\Kqgddgg.exe
  2⤵
  PID:8444
- C:\Windows\System\OcnNCqK.exe
  C:\Windows\System\OcnNCqK.exe
  2⤵
  PID:8424
- C:\Windows\System\RCQRbHo.exe
  C:\Windows\System\RCQRbHo.exe
  2⤵
  PID:8428
- C:\Windows\System\MCXeaQm.exe
  C:\Windows\System\MCXeaQm.exe
  2⤵
  PID:8468
- C:\Windows\System\lBdbrNu.exe
  C:\Windows\System\lBdbrNu.exe
  2⤵
  PID:8812
- C:\Windows\System\yZYcjhQ.exe
  C:\Windows\System\yZYcjhQ.exe
  2⤵
  PID:8880
- C:\Windows\System\VFZKOtg.exe
  C:\Windows\System\VFZKOtg.exe
  2⤵
  PID:8832
- C:\Windows\System\PNSiveg.exe
  C:\Windows\System\PNSiveg.exe
  2⤵
  PID:9004
- C:\Windows\System\lrsVdVM.exe
  C:\Windows\System\lrsVdVM.exe
  2⤵
  PID:8896
- C:\Windows\System\rLscKSp.exe
  C:\Windows\System\rLscKSp.exe
  2⤵
  PID:9188
- C:\Windows\System\AfjzbBE.exe
  C:\Windows\System\AfjzbBE.exe
  2⤵
  PID:7644
- C:\Windows\System\pPBYCMv.exe
  C:\Windows\System\pPBYCMv.exe
  2⤵
  PID:8860
- C:\Windows\System\eozbQqv.exe
  C:\Windows\System\eozbQqv.exe
  2⤵
  PID:8992
- C:\Windows\System\RcaYWaQ.exe
  C:\Windows\System\RcaYWaQ.exe
  2⤵
  PID:9120
- C:\Windows\System\aINPwqA.exe
  C:\Windows\System\aINPwqA.exe
  2⤵
  PID:8544
- C:\Windows\System\SpcVjZp.exe
  C:\Windows\System\SpcVjZp.exe
  2⤵
  PID:9104
- C:\Windows\System\JLAhEOw.exe
  C:\Windows\System\JLAhEOw.exe
  2⤵
  PID:8220
- C:\Windows\System\rjlkbFC.exe
  C:\Windows\System\rjlkbFC.exe
  2⤵
  PID:8396
- C:\Windows\System\QDBXKsO.exe
  C:\Windows\System\QDBXKsO.exe
  2⤵
  PID:8624
- C:\Windows\System\IkBrvcn.exe
  C:\Windows\System\IkBrvcn.exe
  2⤵
  PID:8720
- C:\Windows\System\kRsvuUl.exe
  C:\Windows\System\kRsvuUl.exe
  2⤵
  PID:8752
- C:\Windows\System\RdVOhWk.exe
  C:\Windows\System\RdVOhWk.exe
  2⤵
  PID:8704
- C:\Windows\System\icIBVBq.exe
  C:\Windows\System\icIBVBq.exe
  2⤵
  PID:8780
- C:\Windows\System\pQokshq.exe
  C:\Windows\System\pQokshq.exe
  2⤵
  PID:8796
- C:\Windows\System\ErGjzpy.exe
  C:\Windows\System\ErGjzpy.exe
  2⤵
  PID:8800
- C:\Windows\System\GHqvgUf.exe
  C:\Windows\System\GHqvgUf.exe
  2⤵
  PID:8940
- C:\Windows\System\wZDFqSs.exe
  C:\Windows\System\wZDFqSs.exe
  2⤵
  PID:8412
- C:\Windows\System\tbEwnCj.exe
  C:\Windows\System\tbEwnCj.exe
  2⤵
  PID:8252
- C:\Windows\System\gAXHpFv.exe
  C:\Windows\System\gAXHpFv.exe
  2⤵
  PID:9088
- C:\Windows\System\ontcTFG.exe
  C:\Windows\System\ontcTFG.exe
  2⤵
  PID:8556
- C:\Windows\System\kNmvumi.exe
  C:\Windows\System\kNmvumi.exe
  2⤵
  PID:8276
- C:\Windows\System\TPXayHn.exe
  C:\Windows\System\TPXayHn.exe
  2⤵
  PID:6952
- C:\Windows\System\Modtpqj.exe
  C:\Windows\System\Modtpqj.exe
  2⤵
  PID:8656
- C:\Windows\System\pMKDUvH.exe
  C:\Windows\System\pMKDUvH.exe
  2⤵
  PID:4312
- C:\Windows\System\EFCXxij.exe
  C:\Windows\System\EFCXxij.exe
  2⤵
  PID:8284
- C:\Windows\System\ZINhYom.exe
  C:\Windows\System\ZINhYom.exe
  2⤵
  PID:8972
- C:\Windows\System\QoMVDzy.exe
  C:\Windows\System\QoMVDzy.exe
  2⤵
  PID:8520
- C:\Windows\System\LmBBigj.exe
  C:\Windows\System\LmBBigj.exe
  2⤵
  PID:9228
- C:\Windows\System\RYBhxGl.exe
  C:\Windows\System\RYBhxGl.exe
  2⤵
  PID:9248
- C:\Windows\System\zOLkaYF.exe
  C:\Windows\System\zOLkaYF.exe
  2⤵
  PID:9268
- C:\Windows\System\JmFJKmC.exe
  C:\Windows\System\JmFJKmC.exe
  2⤵
  PID:9284
- C:\Windows\System\UYikzsm.exe
  C:\Windows\System\UYikzsm.exe
  2⤵
  PID:9300
- C:\Windows\System\pFSQaVm.exe
  C:\Windows\System\pFSQaVm.exe
  2⤵
  PID:9316
- C:\Windows\System\TNxPxHE.exe
  C:\Windows\System\TNxPxHE.exe
  2⤵
  PID:9332
- C:\Windows\System\JepYozo.exe
  C:\Windows\System\JepYozo.exe
  2⤵
  PID:9348
- C:\Windows\System\dcwXWZb.exe
  C:\Windows\System\dcwXWZb.exe
  2⤵
  PID:9364
- C:\Windows\System\qYuxvDK.exe
  C:\Windows\System\qYuxvDK.exe
  2⤵
  PID:9380
- C:\Windows\System\XGvnTtv.exe
  C:\Windows\System\XGvnTtv.exe
  2⤵
  PID:9396
- C:\Windows\System\CfGfDCB.exe
  C:\Windows\System\CfGfDCB.exe
  2⤵
  PID:9412
- C:\Windows\System\dBrKJBY.exe
  C:\Windows\System\dBrKJBY.exe
  2⤵
  PID:9428
- C:\Windows\System\zDdBIfl.exe
  C:\Windows\System\zDdBIfl.exe
  2⤵
  PID:9444
- C:\Windows\System\DIcicxj.exe
  C:\Windows\System\DIcicxj.exe
  2⤵
  PID:9464
- C:\Windows\System\jTohPAD.exe
  C:\Windows\System\jTohPAD.exe
  2⤵
  PID:9492
- C:\Windows\System\MvXIKeF.exe
  C:\Windows\System\MvXIKeF.exe
  2⤵
  PID:9508
- C:\Windows\System\tHepESz.exe
  C:\Windows\System\tHepESz.exe
  2⤵
  PID:9524
- C:\Windows\System\IUZlOSK.exe
  C:\Windows\System\IUZlOSK.exe
  2⤵
  PID:9540
- C:\Windows\System\LmQqGZu.exe
  C:\Windows\System\LmQqGZu.exe
  2⤵
  PID:9556
- C:\Windows\System\SZamPOc.exe
  C:\Windows\System\SZamPOc.exe
  2⤵
  PID:9572
- C:\Windows\System\ABqWfTV.exe
  C:\Windows\System\ABqWfTV.exe
  2⤵
  PID:9588
- C:\Windows\System\rEIHmDZ.exe
  C:\Windows\System\rEIHmDZ.exe
  2⤵
  PID:9604
- C:\Windows\System\VkXHwCj.exe
  C:\Windows\System\VkXHwCj.exe
  2⤵
  PID:9620
- C:\Windows\System\QvFKXUE.exe
  C:\Windows\System\QvFKXUE.exe
  2⤵
  PID:9636
- C:\Windows\System\vTlNlOW.exe
  C:\Windows\System\vTlNlOW.exe
  2⤵
  PID:9652
- C:\Windows\System\brSFKUA.exe
  C:\Windows\System\brSFKUA.exe
  2⤵
  PID:9668
- C:\Windows\System\nFPWbzS.exe
  C:\Windows\System\nFPWbzS.exe
  2⤵
  PID:9684
- C:\Windows\System\hwtEvdR.exe
  C:\Windows\System\hwtEvdR.exe
  2⤵
  PID:9700
- C:\Windows\System\DHYnsWy.exe
  C:\Windows\System\DHYnsWy.exe
  2⤵
  PID:9716
- C:\Windows\System\bvyoHbP.exe
  C:\Windows\System\bvyoHbP.exe
  2⤵
  PID:9732
- C:\Windows\System\uYqSsbW.exe
  C:\Windows\System\uYqSsbW.exe
  2⤵
  PID:9748
- C:\Windows\System\IZBzBAt.exe
  C:\Windows\System\IZBzBAt.exe
  2⤵
  PID:9764
- C:\Windows\System\sVRNgfk.exe
  C:\Windows\System\sVRNgfk.exe
  2⤵
  PID:9780
- C:\Windows\System\yzRpjxJ.exe
  C:\Windows\System\yzRpjxJ.exe
  2⤵
  PID:9796
- C:\Windows\System\JrXlbdX.exe
  C:\Windows\System\JrXlbdX.exe
  2⤵
  PID:9812
- C:\Windows\System\ZSTAzKn.exe
  C:\Windows\System\ZSTAzKn.exe
  2⤵
  PID:9828
- C:\Windows\System\pEKHmre.exe
  C:\Windows\System\pEKHmre.exe
  2⤵
  PID:9844
- C:\Windows\System\Wqufhgl.exe
  C:\Windows\System\Wqufhgl.exe
  2⤵
  PID:9860
- C:\Windows\System\zIanARn.exe
  C:\Windows\System\zIanARn.exe
  2⤵
  PID:9876
- C:\Windows\System\kogUKsg.exe
  C:\Windows\System\kogUKsg.exe
  2⤵
  PID:9892
- C:\Windows\System\dbUgOzQ.exe
  C:\Windows\System\dbUgOzQ.exe
  2⤵
  PID:9908
- C:\Windows\System\qarIYBU.exe
  C:\Windows\System\qarIYBU.exe
  2⤵
  PID:9924
- C:\Windows\System\TUbkmqq.exe
  C:\Windows\System\TUbkmqq.exe
  2⤵
  PID:9940
- C:\Windows\System\GHCJmmw.exe
  C:\Windows\System\GHCJmmw.exe
  2⤵
  PID:9956
- C:\Windows\System\AQSjpZq.exe
  C:\Windows\System\AQSjpZq.exe
  2⤵
  PID:9976
- C:\Windows\System\JDJDDMi.exe
  C:\Windows\System\JDJDDMi.exe
  2⤵
  PID:9992
- C:\Windows\System\IrMzmMj.exe
  C:\Windows\System\IrMzmMj.exe
  2⤵
  PID:10012
- C:\Windows\System\NNdbFID.exe
  C:\Windows\System\NNdbFID.exe
  2⤵
  PID:10028
- C:\Windows\System\EOvlrtJ.exe
  C:\Windows\System\EOvlrtJ.exe
  2⤵
  PID:10044
- C:\Windows\System\bIJbgwW.exe
  C:\Windows\System\bIJbgwW.exe
  2⤵
  PID:10060
- C:\Windows\System\EFXXxxQ.exe
  C:\Windows\System\EFXXxxQ.exe
  2⤵
  PID:10080
- C:\Windows\System\TdHZtmX.exe
  C:\Windows\System\TdHZtmX.exe
  2⤵
  PID:10096
- C:\Windows\System\ADYMkQx.exe
  C:\Windows\System\ADYMkQx.exe
  2⤵
  PID:10112
- C:\Windows\System\gxHxFDj.exe
  C:\Windows\System\gxHxFDj.exe
  2⤵
  PID:10128
- C:\Windows\System\aaEndUQ.exe
  C:\Windows\System\aaEndUQ.exe
  2⤵
  PID:10148
- C:\Windows\System\cCFxIpP.exe
  C:\Windows\System\cCFxIpP.exe
  2⤵
  PID:10168
- C:\Windows\System\TEkDJWy.exe
  C:\Windows\System\TEkDJWy.exe
  2⤵
  PID:10188
- C:\Windows\System\vDBCslC.exe
  C:\Windows\System\vDBCslC.exe
  2⤵
  PID:10208
- C:\Windows\System\HhmeHqH.exe
  C:\Windows\System\HhmeHqH.exe
  2⤵
  PID:10224
- C:\Windows\System\xCsQcFb.exe
  C:\Windows\System\xCsQcFb.exe
  2⤵
  PID:9068
- C:\Windows\System\LnCPfPB.exe
  C:\Windows\System\LnCPfPB.exe
  2⤵
  PID:9244
- C:\Windows\System\mDkrQWZ.exe
  C:\Windows\System\mDkrQWZ.exe
  2⤵
  PID:9312
- C:\Windows\System\gsgSZLN.exe
  C:\Windows\System\gsgSZLN.exe
  2⤵
  PID:8764
- C:\Windows\System\baEcrkG.exe
  C:\Windows\System\baEcrkG.exe
  2⤵
  PID:8256
- C:\Windows\System\YsHBoNQ.exe
  C:\Windows\System\YsHBoNQ.exe
  2⤵
  PID:8976
- C:\Windows\System\fmhtoRv.exe
  C:\Windows\System\fmhtoRv.exe
  2⤵
  PID:9264
- C:\Windows\System\mrLrJZB.exe
  C:\Windows\System\mrLrJZB.exe
  2⤵
  PID:9376
- C:\Windows\System\lLDiNaz.exe
  C:\Windows\System\lLDiNaz.exe
  2⤵
  PID:9436
- C:\Windows\System\dqjUJID.exe
  C:\Windows\System\dqjUJID.exe
  2⤵
  PID:9480
- C:\Windows\System\DBUsopt.exe
  C:\Windows\System\DBUsopt.exe
  2⤵
  PID:9424
- C:\Windows\System\jpsropc.exe
  C:\Windows\System\jpsropc.exe
  2⤵
  PID:9296
- C:\Windows\System\pVuwoNr.exe
  C:\Windows\System\pVuwoNr.exe
  2⤵
  PID:9552
- C:\Windows\System\bBghRUo.exe
  C:\Windows\System\bBghRUo.exe
  2⤵
  PID:9580
- C:\Windows\System\lvbyMix.exe
  C:\Windows\System\lvbyMix.exe
  2⤵
  PID:9644
- C:\Windows\System\qPuZyiB.exe
  C:\Windows\System\qPuZyiB.exe
  2⤵
  PID:9708
- C:\Windows\System\RQYOeRH.exe
  C:\Windows\System\RQYOeRH.exe
  2⤵
  PID:9772
- C:\Windows\System\MtFbsSE.exe
  C:\Windows\System\MtFbsSE.exe
  2⤵
  PID:9500
- C:\Windows\System\yBwEWoc.exe
  C:\Windows\System\yBwEWoc.exe
  2⤵
  PID:9600
- C:\Windows\System\WSmHcJR.exe
  C:\Windows\System\WSmHcJR.exe
  2⤵
  PID:9756
- C:\Windows\System\nPXNSVi.exe
  C:\Windows\System\nPXNSVi.exe
  2⤵
  PID:9808
- C:\Windows\System\rGDTyQV.exe
  C:\Windows\System\rGDTyQV.exe
  2⤵
  PID:9840
- C:\Windows\System\naqOoIi.exe
  C:\Windows\System\naqOoIi.exe
  2⤵
  PID:9904
- C:\Windows\System\XNpMuss.exe
  C:\Windows\System\XNpMuss.exe
  2⤵
  PID:9972
- C:\Windows\System\CrBBdGI.exe
  C:\Windows\System\CrBBdGI.exe
  2⤵
  PID:9856
- C:\Windows\System\yjAxNmo.exe
  C:\Windows\System\yjAxNmo.exe
  2⤵
  PID:10040
- C:\Windows\System\SjOqlqp.exe
  C:\Windows\System\SjOqlqp.exe
  2⤵
  PID:10076
- C:\Windows\System\BdAGWtC.exe
  C:\Windows\System\BdAGWtC.exe
  2⤵
  PID:9920
- C:\Windows\System\xkEqOrG.exe
  C:\Windows\System\xkEqOrG.exe
  2⤵
  PID:10088
- C:\Windows\System\UFjYXJT.exe
  C:\Windows\System\UFjYXJT.exe
  2⤵
  PID:10164
- C:\Windows\System\xaqRMze.exe
  C:\Windows\System\xaqRMze.exe
  2⤵
  PID:10180
- C:\Windows\System\tymIcrQ.exe
  C:\Windows\System\tymIcrQ.exe
  2⤵
  PID:10216
- C:\Windows\System\XFfELSq.exe
  C:\Windows\System\XFfELSq.exe
  2⤵
  PID:10124
- C:\Windows\System\gDAtkmo.exe
  C:\Windows\System\gDAtkmo.exe
  2⤵
  PID:8892
- C:\Windows\System\adChLtD.exe
  C:\Windows\System\adChLtD.exe
  2⤵
  PID:10160
- C:\Windows\System\egFAmVs.exe
  C:\Windows\System\egFAmVs.exe
  2⤵
  PID:9280
- C:\Windows\System\aQZFSQC.exe
  C:\Windows\System\aQZFSQC.exe
  2⤵
  PID:9340
- C:\Windows\System\yRbmrYO.exe
  C:\Windows\System\yRbmrYO.exe
  2⤵
  PID:9516
- C:\Windows\System\GJisHxL.exe
  C:\Windows\System\GJisHxL.exe
  2⤵
  PID:9680
- C:\Windows\System\jakqEir.exe
  C:\Windows\System\jakqEir.exe
  2⤵
  PID:9260
- C:\Windows\System\iJmKCRj.exe
  C:\Windows\System\iJmKCRj.exe
  2⤵
  PID:9256
- C:\Windows\System\bwUXZjF.exe
  C:\Windows\System\bwUXZjF.exe
  2⤵
  PID:9596
- C:\Windows\System\OKsRprO.exe
  C:\Windows\System\OKsRprO.exe
  2⤵
  PID:9616
- C:\Windows\System\SBhEvWZ.exe
  C:\Windows\System\SBhEvWZ.exe
  2⤵
  PID:9532
- C:\Windows\System\AayvQHx.exe
  C:\Windows\System\AayvQHx.exe
  2⤵
  PID:9628
- C:\Windows\System\kHXYinm.exe
  C:\Windows\System\kHXYinm.exe
  2⤵
  PID:9696
- C:\Windows\System\vKNPMbc.exe
  C:\Windows\System\vKNPMbc.exe
  2⤵
  PID:9804
- C:\Windows\System\NQhbZPk.exe
  C:\Windows\System\NQhbZPk.exe
  2⤵
  PID:9964
- C:\Windows\System\otYYpqR.exe
  C:\Windows\System\otYYpqR.exe
  2⤵
  PID:9872
- C:\Windows\System\WjGnnHp.exe
  C:\Windows\System\WjGnnHp.exe
  2⤵
  PID:9900
- C:\Windows\System\aniUZuo.exe
  C:\Windows\System\aniUZuo.exe
  2⤵
  PID:10072
- C:\Windows\System\fjNGcTg.exe
  C:\Windows\System\fjNGcTg.exe
  2⤵
  PID:10052
- C:\Windows\System\udeJRHa.exe
  C:\Windows\System\udeJRHa.exe
  2⤵
  PID:9988
- C:\Windows\System\GeCbGUG.exe
  C:\Windows\System\GeCbGUG.exe
  2⤵
  PID:9236
- C:\Windows\System\bjhGENX.exe
  C:\Windows\System\bjhGENX.exe
  2⤵
  PID:8288
- C:\Windows\System\BSjQyuL.exe
  C:\Windows\System\BSjQyuL.exe
  2⤵
  PID:9476
- C:\Windows\System\DkUJDSC.exe
  C:\Windows\System\DkUJDSC.exe
  2⤵
  PID:9676
- C:\Windows\System\ZIPXmra.exe
  C:\Windows\System\ZIPXmra.exe
  2⤵
  PID:9460
- C:\Windows\System\XYLlRES.exe
  C:\Windows\System\XYLlRES.exe
  2⤵
  PID:9692
- C:\Windows\System\MtYRdCg.exe
  C:\Windows\System\MtYRdCg.exe
  2⤵
  PID:9792
- C:\Windows\System\KtbPJic.exe
  C:\Windows\System\KtbPJic.exe
  2⤵
  PID:9612
- C:\Windows\System\CoqFOZE.exe
  C:\Windows\System\CoqFOZE.exe
  2⤵
  PID:10004
- C:\Windows\System\FWfWRwm.exe
  C:\Windows\System\FWfWRwm.exe
  2⤵
  PID:10140
- C:\Windows\System\cmakYPX.exe
  C:\Windows\System\cmakYPX.exe
  2⤵
  PID:9456
- C:\Windows\System\hGbcDml.exe
  C:\Windows\System\hGbcDml.exe
  2⤵
  PID:10204
- C:\Windows\System\wBJjFVU.exe
  C:\Windows\System\wBJjFVU.exe
  2⤵
  PID:8672
- C:\Windows\System\LwczqAK.exe
  C:\Windows\System\LwczqAK.exe
  2⤵
  PID:10156
- C:\Windows\System\IAhwgen.exe
  C:\Windows\System\IAhwgen.exe
  2⤵
  PID:9744
- C:\Windows\System\tEaTgoK.exe
  C:\Windows\System\tEaTgoK.exe
  2⤵
  PID:10104
- C:\Windows\System\vpjTJMu.exe
  C:\Windows\System\vpjTJMu.exe
  2⤵
  PID:10248
- C:\Windows\System\cItShoB.exe
  C:\Windows\System\cItShoB.exe
  2⤵
  PID:10264
- C:\Windows\System\UgoWUsB.exe
  C:\Windows\System\UgoWUsB.exe
  2⤵
  PID:10280
- C:\Windows\System\zXUNYWX.exe
  C:\Windows\System\zXUNYWX.exe
  2⤵
  PID:10296
- C:\Windows\System\bGBkDVw.exe
  C:\Windows\System\bGBkDVw.exe
  2⤵
  PID:10312
- C:\Windows\System\KVNjdVI.exe
  C:\Windows\System\KVNjdVI.exe
  2⤵
  PID:10328
- C:\Windows\System\xEcbByw.exe
  C:\Windows\System\xEcbByw.exe
  2⤵
  PID:10344
- C:\Windows\System\CNfSMDo.exe
  C:\Windows\System\CNfSMDo.exe
  2⤵
  PID:10360
- C:\Windows\System\EYgIIfw.exe
  C:\Windows\System\EYgIIfw.exe
  2⤵
  PID:10380
- C:\Windows\System\lemdJdT.exe
  C:\Windows\System\lemdJdT.exe
  2⤵
  PID:10396
- C:\Windows\System\IrGUcAW.exe
  C:\Windows\System\IrGUcAW.exe
  2⤵
  PID:10412
- C:\Windows\System\hQSQsFN.exe
  C:\Windows\System\hQSQsFN.exe
  2⤵
  PID:10428
- C:\Windows\System\DydlcDF.exe
  C:\Windows\System\DydlcDF.exe
  2⤵
  PID:10444
- C:\Windows\System\RMVNbmu.exe
  C:\Windows\System\RMVNbmu.exe
  2⤵
  PID:10460
- C:\Windows\System\NOdePOt.exe
  C:\Windows\System\NOdePOt.exe
  2⤵
  PID:10476
- C:\Windows\System\rfCfSpo.exe
  C:\Windows\System\rfCfSpo.exe
  2⤵
  PID:10496
- C:\Windows\System\sKUiyQq.exe
  C:\Windows\System\sKUiyQq.exe
  2⤵
  PID:10512
- C:\Windows\System\EChEVXk.exe
  C:\Windows\System\EChEVXk.exe
  2⤵
  PID:10528
- C:\Windows\System\RPwbdgr.exe
  C:\Windows\System\RPwbdgr.exe
  2⤵
  PID:10544
- C:\Windows\System\GXgVAoa.exe
  C:\Windows\System\GXgVAoa.exe
  2⤵
  PID:10560
- C:\Windows\System\ucwAfJn.exe
  C:\Windows\System\ucwAfJn.exe
  2⤵
  PID:10580
- C:\Windows\System\USgmphn.exe
  C:\Windows\System\USgmphn.exe
  2⤵
  PID:10596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\FQwvaLd.exe

Filesize
1.4MB

MD5
c1e46b3b7ee98efd620c3246dab5a705

SHA1
a04fed5acfa3e77195c3128ea682b4d9a3d4249b

SHA256
dff7fdacd5a72fa2a49dbf83bbe5ce7c4f5452fa32fcf702af08ce5e24081629

SHA512
54fdb638656350e44f3e36b635632dfda338b119664ee5ea765fd7a6e7c91051b2d74d5e05e42a0b3a9fb8f1b20a93aa93d97ae90062b22f4cf6522587a860ff

Download Submit
C:\Windows\system\FlEXXSR.exe

Filesize
1.4MB

MD5
6572a6bc70d4bcaf9645fbd6b386ebd6

SHA1
64fb770e4cdc319f4f1fc064e37c16030020bed4

SHA256
76f6427a72d2da8dc7ba433820253900834d6e7f1463045bbfbb39456eea91f7

SHA512
65c39468bd8461aeac3db81aecf7cf996000797d1a9ff02e566110fbb88ff6efdaaf441687f2aa6f29c318647fc5699877652162d45d9a1c6ede9c4be528a2a8

Download Submit
C:\Windows\system\GYNCmGP.exe

Filesize
1.4MB

MD5
3dba0965fe990e744a6aa9e1ae65310c

SHA1
b90c7618cceab9c906142fe7465e85822af745f2

SHA256
a61a80b8302e6339d224f938974888ca0ea8ea863496464868a3d5b8192ab0f3

SHA512
334bcb882eb38c2d29a2e27c1cde1b6fb279b8d8b0703fa1d8ebfd2eabb9735bf6e43e263f5fa188fd92b55b8ecfc40857147571a9a5e333b5acc916644cb034

Download Submit
C:\Windows\system\GiXDCBD.exe

Filesize
1.4MB

MD5
d3ff0c8a16f6f194d2ee9f2c44373c47

SHA1
2f70e8bde19de6644b32ac721c5f5ee99e06538b

SHA256
471eacbac60b8f58ef1edfbbef9836f2ee8836af3ce1fa5333668ad78041119d

SHA512
8764cb9465e00bc007f220f06433e82a749f052212f53d2713b6d45e8f46dda79dc8b980114cbfe96a78511a7d7b526bc0238d7419a6bac61c9f951ffc3d462b

Download Submit
C:\Windows\system\LKKJdZR.exe

Filesize
1.4MB

MD5
dfb0cbba7ade65bd4cb05ea31c94f9c3

SHA1
836a3a7b398950c4a8e716dfd9f19382f8373e1f

SHA256
511f6e1c53d01a3f3a5a8a75dab161be3a6efc897a21744e9b39fad0300e9285

SHA512
b0f0cd710c5ee816eee2db019f09a417ec36ce6cbdaed77edc6f1f2ed5dbe4bbd282fe9189bd9feeb7cb7440f9a7e46579b460a0011a463752088b5f5b86798a

Download Submit
C:\Windows\system\MhnkPsl.exe

Filesize
1.4MB

MD5
1c4e8290ff150a1738b919c08e4f4070

SHA1
2068c39cde7b4a91a9b74e8eee9b9a65b6e90128

SHA256
53827ad304e2e7f46a64a37be44836fc68d5235ccbda91732a7e17eae4cf5fa7

SHA512
5c94562f7410eac9009630df1a5f369ffe970b0d13a02e74afc80dbb3e9ab0a3328dad1abff8a46600f06ea5c382593fc626af69d62be1ddfd12c1b7e1199950

Download Submit
C:\Windows\system\PJiHapQ.exe

Filesize
1.4MB

MD5
7fd61172aca1dc171be3d5c970fb5391

SHA1
6faab70722699d4e6c085ab03dd4a61dad005633

SHA256
085357875f79843db8254b7599aa8c39266136d38d9827223b6f74e9197260d3

SHA512
d44b3ac203b572ba284176379cf1e4dcc4604b80925457a92769ad785d9c5f573855fd5feea136e3672bc6fb95b526dc11e0ff9236cb402a66084821944740f0

Download Submit
C:\Windows\system\RgkiCAh.exe

Filesize
1.4MB

MD5
d73b69b2159a10fd200002ebbd381561

SHA1
42851c7a8ff93b8f71e2310effc987de963bfc26

SHA256
1d4afdf1715f1dea8c5d40676d9535670bb28b6684ea82d950f32b350cc2f877

SHA512
59e6cd24f8485781675be10c1a0fa64d6d59f5181fa52fa1f10c0d9a2ed36ad6e7d0914b094fe0affb9bf1b0e8c7e431c846f859318f6abbc0d8895c80e08bff

Download Submit
C:\Windows\system\ScIVikq.exe

Filesize
1.4MB

MD5
ae414806388393a6992978577d9cb0b9

SHA1
3af18ab67cf18658cb91636cd17d8e69bb5307e4

SHA256
bd2490e2412789b0d65a9bfced45395d39d00d3f1a76eb93a632754411587fcc

SHA512
db06939cfc3ea2d305be6fa412cab9df09c543c614e7d6493178eb1424c5148dc085474fcd9d76d2507ab9906c6ddaa8fcbfcea93fd5da4526638439ea3afcb1

Download Submit
C:\Windows\system\WUaMwXm.exe

Filesize
1.4MB

MD5
610d398ca4ea387448b462e53f3999f6

SHA1
5c86e31ec9852c476ad9e1318536c586af7118f9

SHA256
39540b44f87b8b9730588c01461789e69c2807d7c4ce84d09658fb53578ecfc0

SHA512
122962dbfe17f8757c63ece9c7def4617c66a05e37cdb97f0deb7b67fc7d04aab6758312d337b36775ffec0bf704961f416716aadc7d7b52882e4ff73c67658c

Download Submit
C:\Windows\system\YHoqkMV.exe

Filesize
1.4MB

MD5
7b7901b75b6670481256b15e0af2e8f0

SHA1
b32d01c59d7f2ba9eed9eef6ed4c4d5976ca3605

SHA256
c837c65335fc4005bf10d8ceac11fc19fccf277331f5ccfba33dc70bb3184f1d

SHA512
a8ea78790f4c6d6dc28ae0488ba7744be1e65d6ff35ebe8312023cee4794e9ceda0c709ae9fb1e05294e20ea62717c3531ebea8e5a1cc6381779effb7f4fb86a

Download Submit
C:\Windows\system\cMrWgoa.exe

Filesize
1.4MB

MD5
d04fed99a06161c261d255fe04fcd0c4

SHA1
eda3bef730c3b7952845423d309c103616442375

SHA256
3793bfea6133748ad52a1e3d73a938b0b412ed10afa2c965e7aac6bc20e4f806

SHA512
54af03ff0b2a3280bc351a14e16f23ff9b11548394027832e742437fac82198a7025f6ea9a47e01535b2651ee99eeafec2599306fed7434ce07d3d768579c9d0

Download Submit
C:\Windows\system\dtnKeIO.exe

Filesize
1.4MB

MD5
ab6068d6163ef0e1aaea724c7d6eb09f

SHA1
9a5f621f2e76f39a3f16c10005af591c588a9f24

SHA256
d418a5aa4b6ede70d9643634d568a39c207c87e39eb9884beaa7bce66f00f624

SHA512
fbd50ad3fe004d39c8dc5975a0da1bb1a31fffd176d8db77f988a6a089fb02a55420be3bdf0e460637d9169c48169aaf296896187dd87c4fe4807757fbd47545

Download Submit
C:\Windows\system\ezJndAd.exe

Filesize
1.4MB

MD5
6916a6a3d84a007c98d55e13e895b15e

SHA1
26e5333e3bf89d9739f213514d6faaa7f1fb02ac

SHA256
d74b67f1f82046123a8cc5e26a81376fa9e4850a95aeffcb1462d805db306669

SHA512
6467cd28a9cd0744fc5fb77c44be71376439210c10f7822568f2db0d6a27d3b914e2cdec7fcd75a0dd6fdc65d16ef77f8c57e8a006045b36b9be68dae4ed0023

Download Submit
C:\Windows\system\hoLzeXr.exe

Filesize
1.4MB

MD5
62e79e56ff7415c5fcdb59ff89a85a76

SHA1
012e76f51c4b2cbfcfac9805885100c683e84300

SHA256
72441ddd8566930a2b929f6a5454cb62139183891fc1f4460bbf722689577ac6

SHA512
3b50d248c9a93c2d517cea2ad03a54836dc5d7204417d497e23637ca50aeb322c2fcb8616194912ee5776a9f8b0d6292568ced7fb6d4432d37ad24fab8001609

Download Submit
C:\Windows\system\plLyGlM.exe

Filesize
1.4MB

MD5
328014a5b6f57281b697df07004baf04

SHA1
791dca57bc3da1b941e69126225f6aa6858e440a

SHA256
e28e0137a77b0b5831b95602de8394d311e7296d757de11342e2696a8e04b162

SHA512
ac701cb12a7e9d66c06d83abaa20c7b6ff9d445b7d0cd629d4ae12b61d82850aadb63267b974057811c10fe9185bacb001855fe259c3e9698012b90a97b71193

Download Submit
C:\Windows\system\qPmagco.exe

Filesize
1.4MB

MD5
472d863d276175dc08d12e245851bc99

SHA1
474669d6601eaadd2f95a91f333cec4e04332b68

SHA256
9567e14a9a707b8351834169874a37ffc37e10a7f57d9e8e43f2c6c4d023e48e

SHA512
cc9e7a4819d3d284e4011c63445822e4dda72642e5f39dd778c4dda3726647018a0195a80ef5d8673a453ccf9a98c5caa099b94939d12fcafcac35209fdc0364

Download Submit
C:\Windows\system\sNLWZdo.exe

Filesize
1.4MB

MD5
1bbda61ac2a9147fab599f645b47de36

SHA1
919de046da44419d68485e0a56d05ff76cd457ac

SHA256
48ffe7925d5921ed4df5a2956c8ded38d07399c95b646b6827af4ea21bb8f889

SHA512
50f76444567faa3f970bbf58197ad77947cd4462ed817cf4381adc1d67d1a03f5e697c3e7294d743e60c11f9d9a1db8e94cc9c094ec0e9cde78569304bb08ebc

Download Submit
C:\Windows\system\ugzAjxo.exe

Filesize
1.4MB

MD5
279ef0559c558c4ab71673fe9371ad39

SHA1
ef34aedc58c11bbcef1591c46153870e73a5c9d4

SHA256
5af0c427cc2488a6b020abf58f3ce7da2e2c0fb9f4be5ebc80b33d08833e22a9

SHA512
9d8c1ff29543047943b7951150978b44637d363bd883203ccd61350cd8c235ee46fc2e4ad8acb9706e471667690d6973e6e92fba28df29b29a36350991f13122

Download Submit
C:\Windows\system\viDeAWt.exe

Filesize
1.4MB

MD5
7e52a15d2547a0f626af811d4fd048e4

SHA1
0240cbc4ea9a3233ba1f12dffa7f9322b4dd53b1

SHA256
3d88b48b9d34fecc7a9714b738a1a18e2b8c718af7c46bab60c595a049b833f3

SHA512
9442476b5533bf61713dc6b6e3b118af0189709dae7837cf28c038ee85766a6db7abd89234191a201c39f080188a91f6796feac046c95e8b9efb80469ca31d3d

Download Submit
\Windows\system\GnWDRfZ.exe

Filesize
1.4MB

MD5
412dd085b5ee94284ff873b893852e7c

SHA1
133eeda0e1fad95c37f571be9c03f21f28eb500c

SHA256
019eea3d951b0a3c79da76cf6048cc1ada5e01fa8a87ed29543476b6b431c0fe

SHA512
bd182ae89f145ea20ade1e872b5eade9e221cd2d4f7cdb3a471717ef2786617dcc2463bc2777cf27af506088dba7db90913b1dd6876fcc8ec0fb4371c483c059

Download Submit
\Windows\system\HZCtNYO.exe

Filesize
1.4MB

MD5
e2ea35ab43676c01b39c712db83367ff

SHA1
e9be9e48cbbfd734c1a695cebfaba4873a863d0c

SHA256
726f88bacb8ee77de1fc48b054ce5873367bbf702e3239c2c89c2b40d380c99a

SHA512
8a3cfc381f30ce99ad1ca8e72cabc4521b543619924d61d6e7f94c0859dd9a77eb8f265a8c7e33bb085fec34ed4665ad194bdff4f8b04d58df751cbc562dd214

Download Submit
\Windows\system\LGEoYii.exe

Filesize
1.4MB

MD5
3e6a9647166c34188ea4b1be225ffebb

SHA1
1a9c3fa38f6ba023fc2a4073cfe131612384f93b

SHA256
daa0d610f427f0988b6a9179bd7d8cd72321817d63b935bd14729995709b0282

SHA512
a1a52dd528493b974f6e77fcc27693448dae42113fe73d3923fee2c093038fb84501290f7a73b9d3f5b8722beb845770dc4247c8631ba4f255faa8417954aeb4

Download Submit
\Windows\system\LyuXuwS.exe

Filesize
1.4MB

MD5
bf100069d56eda54f9b684dd3ae4e161

SHA1
fd7190da90d55812dc7eecdc4365b360594da4b7

SHA256
653804c18fc05e2c430e054fc6d7713b47405928920c7cff6dc159ce9e476f36

SHA512
fae342a288b90e12bf54c081f36b7e5946d4b688b4c3dbe15385e3aa4576fe6cab0931372fb566358999b22db163c2a231bd69c34063437eac14bcbebf2bd3e4

Download Submit
\Windows\system\MWFJBJY.exe

Filesize
1.4MB

MD5
a4ac9330e5383d81e0b2636ef94b58be

SHA1
bb1fe76a60d28a380601de771e9a96764c1c3d55

SHA256
e65461869df5df5a94a54125bc88a3a000e84e758509756d14667b8dd51e78de

SHA512
c79c6e424c25beeb4b8eb899347f94e0ebaa2bcaa441f798c0dbd965d0eb3dbb2f1a1d34c82c6184f4866af1d312f72cc964bbdb5512f21574d15102d7cd047e

Download Submit
\Windows\system\NSjVfGl.exe

Filesize
1.4MB

MD5
8ed29fcfb1cf6038cc5d5f27e5de2553

SHA1
7f72defc8eb83fc82e3ab01fc3d0afdc245e0d21

SHA256
b2b96d448600926a1a4250341c396bef2b07013722afa16b902b9cbd6a386ef7

SHA512
ac74c49ae802cc968a7b472414eff230b31b936bf381efae684f5a92b2b2f8633ffb768a60bb35e5de0cee0ed61dc8d35bd39be0e569debb8ca7312657d0bb4e

Download Submit
\Windows\system\PfvhfAA.exe

Filesize
1.4MB

MD5
b66555d46b942b02e68ea7967fb6f2dd

SHA1
54faf2f2f19cfa32ede8b23053c2c42f5c12ae77

SHA256
930ba97d58d4569de87b86459dc83e61537e4bde9e499a9332d2b48167cf92f9

SHA512
0405759af9d89c681e4b790cbe40fe94c20e7cda17769e9880ed363ff85a5623b927ecc4e527218e554ca8148d16337465cc38ba9bf3c87a4ca0384eeac6c492

Download Submit
\Windows\system\SqATYDg.exe

Filesize
1.4MB

MD5
e2bef7400c2d3d2ae35725db52c8941e

SHA1
fa309febf378b09350a75fd13c20de433abf03f2

SHA256
4c0ee17e5b402ac85122572cbafa3867b171b314202656cf324b55c858b63512

SHA512
e8d46af2dc387ab900f10a95e2c91e73fda0555a2fd12d6ffcb40a21b6de19e2c4165c6abe79dc8ff664aed376ca7b3e2fdd7d3caa59ce202366b71015e11657

Download Submit
\Windows\system\YIEbUQv.exe

Filesize
1.4MB

MD5
10ecbfa9a53a490830f1af28c501226a

SHA1
2fc5f1dc598fc9e8ecd5b5d39406cec52b3bcde9

SHA256
ed0053c5fed1284b3dbad1e2c89c3c3ead93de73cd86f4da278dbd634f8d0c5a

SHA512
00c38fdceb6907f5a31f99159bcaf63f632032af10f9fee8f3ec8c4dca9fd9dfdac34edc8ae05511f82277dc7ab62079c5d750158d72d413d6ba7429f1637dd5

Download Submit
\Windows\system\eZOPFbM.exe

Filesize
1.4MB

MD5
ab9f8e83e3f144adcbccffbc3c20da44

SHA1
69e15a913ee538d1bc62aaa88257d59b3170bda0

SHA256
9b44b50dc0ef22fe77f3aa9232b291da97fd98516d858609d95ef205c88a180d

SHA512
b1357fe3265840c6b8ce54bd2251a8ffabc221a74bfc1c79919af260a02a83a8cee45a8bbfd5290cf3631b332a9daba59ca344ffc7cdd7b4ee65efd2afd40f4b

Download Submit
\Windows\system\iYoimJW.exe

Filesize
1.4MB

MD5
f7405cd20fdc91cda3359bbe98007848

SHA1
4261d6025c09c3acd24e4b84c1b611356cc0fe5b

SHA256
c990534352ca57ed1d4500a80b7b31574fbbc69cdde3af5132346ab7190d6e97

SHA512
3459f77e7077204b73b72ccf4041b8c579431166ccd0520a30388134bb099a24f4d16bf42953f2651582e718e658db519f75e920807f1f3b224f82c6ffb54078

Download Submit
\Windows\system\icpcvKU.exe

Filesize
1.4MB

MD5
3cede7515f674845ed79cd8faeebbf27

SHA1
c94c26f4b3ff05883c0272a11b4548a83bb95dbe

SHA256
65246c6daea952b9bdb8afb38df6d12515741be8740b868685e48be6e68aa12c

SHA512
17fcc5ad20d2e7b807296fa8e746b5ca06c2a8aae6cbc6869f9601db56f798293229091f24e2c24c80a3a5ab8d5c88ea0deb1759199adc6c442f048f7027f534

Download Submit
\Windows\system\kKOYRCw.exe

Filesize
1.4MB

MD5
8621e63ac916209ab1414e63b9fa6a28

SHA1
216fcfe30be7e369f0fdd47592572c4a5fd3913c

SHA256
0e8ba64bf013653d75fb2058913ddb5826b1a94d81fff8ad2031953f69d38764

SHA512
5e916189aef97d5679495c18b1d94cb33362f204518ff4f9f723ab8f7587f91288ac5379088a31547f37f00027fef60f7b64ca0d3d401b8c9e7af302968b77aa

Download Submit
\Windows\system\kQxzQbw.exe

Filesize
1.4MB

MD5
515807faac6c7c44401f9713c81a176d

SHA1
e145938d3bd1279378960f8d41b2d6b624075525

SHA256
86bcf02f27a1e07e6a6446dc1f122298430c29bf238b48047f7d95c473bae84f

SHA512
e2fabde9c49bff478839bea0fc41f0f9377d0db9b915e530b634ae43918814be08986f9f95b8f1bb7cdfb5bb0c9fd03d91a2240a4a3527ced6ef7a113c054822

Download Submit
\Windows\system\khLfAiq.exe

Filesize
1.4MB

MD5
9ee2960c2507e7f77834bc2e92c11b96

SHA1
eff8621e18448a05dc470906a96e7179213e4626

SHA256
a45c1ba2082f42e1ee7606b6db851f78f7112c39b6f545114729bac88a88a5fd

SHA512
e4a885718f5bf71b7bc23fefd44418802259329e0b5abedf8e787f8064b98d48cb4091e5bdf102c03b619206673764c06d581ee2e24f7b9cf438ccb3e679d63c

Download Submit
\Windows\system\nLdYbOX.exe

Filesize
1.4MB

MD5
24075d4329318c8519ffc9c69ea33a65

SHA1
1686a84d49c2acbca56b3b06c32bda5f93ecf73a

SHA256
7c12a802b640c054a6bed1b0f54a75025621cf47648bca078fed142b391006e1

SHA512
0bdf30637c766b7088ff5006c8598a3a07e854e3c82ba3e201822ecda56ba6c2d8cd302640c2ff321099570659e1734c8ad20b7ddb3268f10233d5714a3af098

Download Submit
\Windows\system\nOkHvLy.exe

Filesize
1.4MB

MD5
2d0cdbb2be9fea76b47048c9e1cbf8fd

SHA1
c4b7ad42bdf9ad7154b18095c2b8843c3a553bcc

SHA256
64eab772e0d09e0bc46854273ee7da3fbcf7834a569475fbecae8b38ea270de3

SHA512
ec24307f04e6b5f3dc4f5f84b9a33bc0ef51432625ac28ef3b93cff45a9aa584830c503cacd114b19c2fb3bc178ab14f7d5187e1ed9421aa45a72a3a5269b8b4

Download Submit
\Windows\system\vbtMDtI.exe

Filesize
1.4MB

MD5
d66143946e9eb8858a198dc125c1ccee

SHA1
4c0c3cce88d7ac37401f8020a3ba40cb85f6b7d1

SHA256
c01bb3e4c1891ecefdd9a37438f5a3d66c39572072eeddd9d20d870c5d6c5ef6

SHA512
9e4008a5d1fa37c32c53ca3dae92a454058990c542f9825d94f4e936f0eda4e7bee3cabbd011bd6b0f3f0ed21c78b695f08227ee619d42e7bd396329be79b121

Download Submit
\Windows\system\ynUWOUJ.exe

Filesize
1.4MB

MD5
7de2cb5f61af639d4a841922e8b28493

SHA1
7f685e2ec227eada30f51951ae09bc28e731d6cf

SHA256
268e33d4de66939251eed9232ca48687ff7d321ad118ac937cb75f35fa37aa22

SHA512
391a873cd7d2c708bc789e52dda8bce2913a87eb4da334eb9f651d3102d20a995811758469c1bd7142c60f1e7ab2feab44627e32d0f3f435226dbbe265b0acd9

Download Submit
memory/1160-39-0x0000000002880000-0x0000000002900000-memory.dmp

Filesize
512KB

Download
memory/1160-36-0x000007FEF5B00000-0x000007FEF649D000-memory.dmp

Filesize
9.6MB

Download
memory/1160-32-0x000000001B570000-0x000000001B852000-memory.dmp

Filesize
2.9MB

Download
memory/1160-538-0x000007FEF5B00000-0x000007FEF649D000-memory.dmp

Filesize
9.6MB

Download
memory/1160-47-0x000007FEF5B00000-0x000007FEF649D000-memory.dmp

Filesize
9.6MB

Download
memory/1160-45-0x0000000002880000-0x0000000002900000-memory.dmp

Filesize
512KB

Download
memory/1160-37-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/1160-38-0x0000000002880000-0x0000000002900000-memory.dmp

Filesize
512KB

Download
memory/2232-61-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download
memory/2384-57-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download
memory/2384-43-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2384-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2384-1059-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2384-15-0x0000000002F50000-0x0000000003342000-memory.dmp

Filesize
3.9MB

Download
memory/2384-48-0x0000000002F50000-0x0000000003342000-memory.dmp

Filesize
3.9MB

Download
memory/2384-73-0x00000000033F0000-0x00000000037E2000-memory.dmp

Filesize
3.9MB

Download
memory/2384-63-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2384-1-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2384-41-0x0000000002F50000-0x0000000003342000-memory.dmp

Filesize
3.9MB

Download
memory/2384-46-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/2384-533-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2528-58-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2608-18-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/2608-1372-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/2720-44-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2776-390-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2872-42-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2876-40-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-68-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/3056-16-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/3056-1060-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download