xmrig | 560dacb7555916aa65d2f60024b7ed8eae20c459e02b578ef0e9c3119b019e59

Analysis

max time kernel
32s
max time network
31s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
Size

1.9MB
MD5

08dc521ead9c498aa81c1515f6fd725f
SHA1

788a2d82426892d4a64e9f60f9ee779a664668af
SHA256

560dacb7555916aa65d2f60024b7ed8eae20c459e02b578ef0e9c3119b019e59
SHA512

cdca73a0542eadd192d1bc827a7c58fd3b30ed37a79669053d26eea41d8e3dd0b0e4d53eb069507fe636692757c1a4f36aad65d8d6e0a6c04babdf95d9dca02c
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UQe:NABS

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2660-41-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2708-43-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/2996-47-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/2552-37-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	xmrig
behavioral1/memory/2212-55-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig
behavioral1/memory/2900-72-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	xmrig
behavioral1/memory/2504-66-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2820	ucJVlht.exe
2552	FtMaLmL.exe
2660	hNcTWLw.exe
2708	NqFNRXd.exe
2996	wNxpBKX.exe
2212	iajrsch.exe
2504	FIYlHtr.exe
2900	qwDoBLP.exe
2924	OjJUmUy.exe
1432	YpYQPKn.exe
2748	wUumfEh.exe
2792	bMgFeez.exe
2036	tMfWYaL.exe
2008	EvDPoJn.exe
276	gDdmxSU.exe
1940	lrOJeAB.exe
2220	YxQENvg.exe
1832	cQKCFbi.exe
2248	ihFQJft.exe
1912	jIiMPWq.exe
2848	EllwIlN.exe
588	BFmhJUo.exe
1300	EfLpWCQ.exe
3024	VCbEkOQ.exe
2416	BiAYVwN.exe
856	IKxoNYe.exe
2396	oQporTd.exe
1268	KskdYDr.exe
1304	ppwzIxY.exe
1868	wgcpjyw.exe
2336	hHyjYZL.exe
940	VrwgQKA.exe
2068	ZslurGb.exe
2960	VbEIvGO.exe
2316	IfXYqxu.exe
2076	qFEdczQ.exe
2020	BBWmHBy.exe
2056	StcBdrK.exe
1612	ZsUkQBp.exe
2284	pmPCBCU.exe
2712	BRXyCKB.exe
2716	MlnJitm.exe
2468	PXWKwYO.exe
2920	aIoNJvs.exe
2684	FnPiWwa.exe
1992	zNDINnU.exe
2096	HIfqEGV.exe
800	ynOLqsQ.exe
1136	wKKCXRm.exe
1352	KPZlMCn.exe
2324	gFFCegt.exe
3068	ocCAdAN.exe
2520	PLilCnT.exe
1276	pQSFZNG.exe
2088	FQtrVnL.exe
2044	kfgcNcp.exe
2948	HRaSray.exe
3100	jQJDwaS.exe
3132	iToHbUi.exe
3164	qTppAvB.exe
3196	UmgLqJc.exe
3228	TStJxCt.exe
3260	dudwhEi.exe
3292	YbEkgqe.exe

Loads dropped DLL 64 IoCs

pid	Process
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2936-0-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/files/0x000c00000001450b-3.dat	upx
behavioral1/memory/2820-12-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x0033000000014983-17.dat	upx
behavioral1/files/0x001400000000549e-22.dat	upx
behavioral1/files/0x0007000000015136-28.dat	upx
behavioral1/files/0x0008000000015023-27.dat	upx
behavioral1/memory/2660-41-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/2708-43-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/memory/2996-47-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/files/0x0007000000015362-49.dat	upx
behavioral1/memory/2552-37-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	upx
behavioral1/files/0x00310000000149ea-56.dat	upx
behavioral1/files/0x00090000000155e3-65.dat	upx
behavioral1/memory/2212-55-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/files/0x0006000000015cca-76.dat	upx
behavioral1/memory/2924-79-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/memory/2900-72-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	upx
behavioral1/files/0x0006000000015cdb-83.dat	upx
behavioral1/files/0x0006000000015d5d-99.dat	upx
behavioral1/files/0x0006000000015f1b-107.dat	upx
behavioral1/files/0x0006000000016277-118.dat	upx
behavioral1/files/0x0006000000016ce1-162.dat	upx
behavioral1/files/0x0006000000016d0e-178.dat	upx
behavioral1/files/0x0006000000016cfe-171.dat	upx
behavioral1/files/0x0006000000016ced-164.dat	upx
behavioral1/files/0x0006000000016cc9-157.dat	upx
behavioral1/files/0x0006000000016c7a-150.dat	upx
behavioral1/files/0x0006000000016c26-143.dat	upx
behavioral1/files/0x0006000000016a45-136.dat	upx
behavioral1/files/0x0006000000016597-129.dat	upx
behavioral1/files/0x0006000000016411-122.dat	upx
behavioral1/files/0x00060000000160f8-115.dat	upx
behavioral1/files/0x0006000000015f9e-108.dat	upx
behavioral1/files/0x0006000000015d6e-101.dat	upx
behavioral1/files/0x0006000000015d06-94.dat	upx
behavioral1/files/0x0006000000015cec-87.dat	upx
behavioral1/files/0x0006000000016d17-183.dat	upx
behavioral1/files/0x0006000000016d06-176.dat	upx
behavioral1/files/0x0006000000016cf5-169.dat	upx
behavioral1/files/0x0006000000016cab-155.dat	upx
behavioral1/files/0x0006000000016c2e-148.dat	upx
behavioral1/files/0x0006000000016c17-141.dat	upx
behavioral1/files/0x00060000000167ef-134.dat	upx
behavioral1/files/0x0006000000016525-127.dat	upx
behavioral1/files/0x0006000000016056-114.dat	upx
behavioral1/files/0x0006000000015cf7-92.dat	upx
behavioral1/memory/2504-66-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/files/0x0007000000015cc1-70.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QZAwNEq.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\jwSgCYP.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\GMvnvYh.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\KPZlMCn.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\vrmIQeQ.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\WxGDwng.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\HazKjcx.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\HFTHKON.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\rhaOzjS.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\SLRcXlB.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\VCbEkOQ.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\XvlJnac.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\yPxIdDR.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\ZKXcXwH.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\CNyTwir.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\RUxxZdz.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\RzTHxzJ.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\gzkTPNn.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\EJdoRtP.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\NUfPqXP.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\bnvuooj.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\YndZuBJ.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\tPmFCOo.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\hTHZBrG.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\prWRxgg.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\DZyyHRn.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\zvsGtcl.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\AJhbXMv.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\PDvxNOY.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\FPVwhQK.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\LbQuESz.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\cZwciNp.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\PODrsvr.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\WkDFzHc.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\RENkIIB.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\ebCPmUP.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\exzAUqi.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\thYIQaK.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\ZbOSsze.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\grzfoyE.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\KdnqIDU.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\pntMRZL.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\dOuTmpr.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\VznIdFV.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\scTcRoK.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\nosryst.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\DjrKkme.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\tePqcpr.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\xGYuapT.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\qZFyEIt.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\TaLWeyY.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\VFCvaYO.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\mHuFMME.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\yPxdRnu.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\JOtWgse.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\vwNcJTm.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\phqDeOh.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\QIoSDAp.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\ekcuGoG.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\qmYfHyL.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\UuQIONh.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\cxgxvAF.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\XAQXzsg.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
File created	C:\Windows\System\gzvQaha.exe	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3040	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
Token: SeDebugPrivilege	3040	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 3040	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	29
PID 2936 wrote to memory of 3040	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	29
PID 2936 wrote to memory of 3040	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	29
PID 2936 wrote to memory of 2820	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2820	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2820	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2552	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	31
PID 2936 wrote to memory of 2552	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	31
PID 2936 wrote to memory of 2552	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	31
PID 2936 wrote to memory of 2660	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	32
PID 2936 wrote to memory of 2660	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	32
PID 2936 wrote to memory of 2660	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	32
PID 2936 wrote to memory of 2708	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	33
PID 2936 wrote to memory of 2708	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	33
PID 2936 wrote to memory of 2708	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	33
PID 2936 wrote to memory of 2996	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	34
PID 2936 wrote to memory of 2996	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	34
PID 2936 wrote to memory of 2996	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	34
PID 2936 wrote to memory of 2212	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	35
PID 2936 wrote to memory of 2212	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	35
PID 2936 wrote to memory of 2212	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	35
PID 2936 wrote to memory of 2504	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	36
PID 2936 wrote to memory of 2504	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	36
PID 2936 wrote to memory of 2504	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	36
PID 2936 wrote to memory of 2900	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	37
PID 2936 wrote to memory of 2900	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	37
PID 2936 wrote to memory of 2900	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	37
PID 2936 wrote to memory of 2924	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	38
PID 2936 wrote to memory of 2924	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	38
PID 2936 wrote to memory of 2924	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	38
PID 2936 wrote to memory of 1432	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	39
PID 2936 wrote to memory of 1432	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	39
PID 2936 wrote to memory of 1432	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	39
PID 2936 wrote to memory of 2748	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	40
PID 2936 wrote to memory of 2748	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	40
PID 2936 wrote to memory of 2748	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	40
PID 2936 wrote to memory of 2548	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	41
PID 2936 wrote to memory of 2548	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	41
PID 2936 wrote to memory of 2548	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	41
PID 2936 wrote to memory of 2792	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	42
PID 2936 wrote to memory of 2792	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	42
PID 2936 wrote to memory of 2792	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	42
PID 2936 wrote to memory of 1788	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	43
PID 2936 wrote to memory of 1788	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	43
PID 2936 wrote to memory of 1788	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	43
PID 2936 wrote to memory of 2036	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	44
PID 2936 wrote to memory of 2036	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	44
PID 2936 wrote to memory of 2036	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	44
PID 2936 wrote to memory of 2412	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	45
PID 2936 wrote to memory of 2412	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	45
PID 2936 wrote to memory of 2412	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	45
PID 2936 wrote to memory of 2008	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	46
PID 2936 wrote to memory of 2008	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	46
PID 2936 wrote to memory of 2008	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	46
PID 2936 wrote to memory of 1532	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	47
PID 2936 wrote to memory of 1532	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	47
PID 2936 wrote to memory of 1532	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	47
PID 2936 wrote to memory of 276	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	48
PID 2936 wrote to memory of 276	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	48
PID 2936 wrote to memory of 276	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	48
PID 2936 wrote to memory of 1952	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	49
PID 2936 wrote to memory of 1952	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	49
PID 2936 wrote to memory of 1952	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	49
PID 2936 wrote to memory of 1940	2936	08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08dc521ead9c498aa81c1515f6fd725f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\System\ucJVlht.exe
  C:\Windows\System\ucJVlht.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\FtMaLmL.exe
  C:\Windows\System\FtMaLmL.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\hNcTWLw.exe
  C:\Windows\System\hNcTWLw.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\NqFNRXd.exe
  C:\Windows\System\NqFNRXd.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\wNxpBKX.exe
  C:\Windows\System\wNxpBKX.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\iajrsch.exe
  C:\Windows\System\iajrsch.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\FIYlHtr.exe
  C:\Windows\System\FIYlHtr.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\qwDoBLP.exe
  C:\Windows\System\qwDoBLP.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\OjJUmUy.exe
  C:\Windows\System\OjJUmUy.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\YpYQPKn.exe
  C:\Windows\System\YpYQPKn.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\wUumfEh.exe
  C:\Windows\System\wUumfEh.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\nosryst.exe
  C:\Windows\System\nosryst.exe
  2⤵
  PID:2548
- C:\Windows\System\bMgFeez.exe
  C:\Windows\System\bMgFeez.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\SLRcXlB.exe
  C:\Windows\System\SLRcXlB.exe
  2⤵
  PID:1788
- C:\Windows\System\tMfWYaL.exe
  C:\Windows\System\tMfWYaL.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\WKuILcb.exe
  C:\Windows\System\WKuILcb.exe
  2⤵
  PID:2412
- C:\Windows\System\EvDPoJn.exe
  C:\Windows\System\EvDPoJn.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\BUYqtAK.exe
  C:\Windows\System\BUYqtAK.exe
  2⤵
  PID:1532
- C:\Windows\System\gDdmxSU.exe
  C:\Windows\System\gDdmxSU.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\ebesSsb.exe
  C:\Windows\System\ebesSsb.exe
  2⤵
  PID:1952
- C:\Windows\System\lrOJeAB.exe
  C:\Windows\System\lrOJeAB.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\UqBNUNg.exe
  C:\Windows\System\UqBNUNg.exe
  2⤵
  PID:2188
- C:\Windows\System\YxQENvg.exe
  C:\Windows\System\YxQENvg.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\prCmEQL.exe
  C:\Windows\System\prCmEQL.exe
  2⤵
  PID:2176
- C:\Windows\System\cQKCFbi.exe
  C:\Windows\System\cQKCFbi.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\QQlnsGE.exe
  C:\Windows\System\QQlnsGE.exe
  2⤵
  PID:2104
- C:\Windows\System\ihFQJft.exe
  C:\Windows\System\ihFQJft.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\NphtKhZ.exe
  C:\Windows\System\NphtKhZ.exe
  2⤵
  PID:2128
- C:\Windows\System\jIiMPWq.exe
  C:\Windows\System\jIiMPWq.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\wdpcltC.exe
  C:\Windows\System\wdpcltC.exe
  2⤵
  PID:2292
- C:\Windows\System\EllwIlN.exe
  C:\Windows\System\EllwIlN.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\cFaRIJW.exe
  C:\Windows\System\cFaRIJW.exe
  2⤵
  PID:2024
- C:\Windows\System\BFmhJUo.exe
  C:\Windows\System\BFmhJUo.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\qnJNHYa.exe
  C:\Windows\System\qnJNHYa.exe
  2⤵
  PID:556
- C:\Windows\System\EfLpWCQ.exe
  C:\Windows\System\EfLpWCQ.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\cxgxvAF.exe
  C:\Windows\System\cxgxvAF.exe
  2⤵
  PID:664
- C:\Windows\System\VCbEkOQ.exe
  C:\Windows\System\VCbEkOQ.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\KIkCqgx.exe
  C:\Windows\System\KIkCqgx.exe
  2⤵
  PID:1800
- C:\Windows\System\BiAYVwN.exe
  C:\Windows\System\BiAYVwN.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\kGgRLvp.exe
  C:\Windows\System\kGgRLvp.exe
  2⤵
  PID:956
- C:\Windows\System\IKxoNYe.exe
  C:\Windows\System\IKxoNYe.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\JYJbnGv.exe
  C:\Windows\System\JYJbnGv.exe
  2⤵
  PID:2392
- C:\Windows\System\oQporTd.exe
  C:\Windows\System\oQporTd.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\mGIXQfy.exe
  C:\Windows\System\mGIXQfy.exe
  2⤵
  PID:1916
- C:\Windows\System\KskdYDr.exe
  C:\Windows\System\KskdYDr.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\vQsIYje.exe
  C:\Windows\System\vQsIYje.exe
  2⤵
  PID:1356
- C:\Windows\System\ppwzIxY.exe
  C:\Windows\System\ppwzIxY.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\eAAKpVe.exe
  C:\Windows\System\eAAKpVe.exe
  2⤵
  PID:1380
- C:\Windows\System\wgcpjyw.exe
  C:\Windows\System\wgcpjyw.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\yMlrEVi.exe
  C:\Windows\System\yMlrEVi.exe
  2⤵
  PID:1164
- C:\Windows\System\hHyjYZL.exe
  C:\Windows\System\hHyjYZL.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\LlOzkTV.exe
  C:\Windows\System\LlOzkTV.exe
  2⤵
  PID:2032
- C:\Windows\System\VrwgQKA.exe
  C:\Windows\System\VrwgQKA.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\YndZuBJ.exe
  C:\Windows\System\YndZuBJ.exe
  2⤵
  PID:2836
- C:\Windows\System\ZslurGb.exe
  C:\Windows\System\ZslurGb.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\viTEEzO.exe
  C:\Windows\System\viTEEzO.exe
  2⤵
  PID:1792
- C:\Windows\System\VbEIvGO.exe
  C:\Windows\System\VbEIvGO.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\wpywxZI.exe
  C:\Windows\System\wpywxZI.exe
  2⤵
  PID:3060
- C:\Windows\System\IfXYqxu.exe
  C:\Windows\System\IfXYqxu.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\WSUEWeg.exe
  C:\Windows\System\WSUEWeg.exe
  2⤵
  PID:332
- C:\Windows\System\qFEdczQ.exe
  C:\Windows\System\qFEdczQ.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\XkoUrbE.exe
  C:\Windows\System\XkoUrbE.exe
  2⤵
  PID:3000
- C:\Windows\System\BBWmHBy.exe
  C:\Windows\System\BBWmHBy.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\nloWNnr.exe
  C:\Windows\System\nloWNnr.exe
  2⤵
  PID:2772
- C:\Windows\System\StcBdrK.exe
  C:\Windows\System\StcBdrK.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\EpIMCpd.exe
  C:\Windows\System\EpIMCpd.exe
  2⤵
  PID:1616
- C:\Windows\System\ZsUkQBp.exe
  C:\Windows\System\ZsUkQBp.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\KdnqIDU.exe
  C:\Windows\System\KdnqIDU.exe
  2⤵
  PID:1732
- C:\Windows\System\pmPCBCU.exe
  C:\Windows\System\pmPCBCU.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\ghNgsLX.exe
  C:\Windows\System\ghNgsLX.exe
  2⤵
  PID:2988
- C:\Windows\System\BRXyCKB.exe
  C:\Windows\System\BRXyCKB.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\RsRwBZp.exe
  C:\Windows\System\RsRwBZp.exe
  2⤵
  PID:2476
- C:\Windows\System\MlnJitm.exe
  C:\Windows\System\MlnJitm.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\UIvkaut.exe
  C:\Windows\System\UIvkaut.exe
  2⤵
  PID:2364
- C:\Windows\System\PXWKwYO.exe
  C:\Windows\System\PXWKwYO.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\xNcfZtr.exe
  C:\Windows\System\xNcfZtr.exe
  2⤵
  PID:2644
- C:\Windows\System\aIoNJvs.exe
  C:\Windows\System\aIoNJvs.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\wyLtXCn.exe
  C:\Windows\System\wyLtXCn.exe
  2⤵
  PID:2696
- C:\Windows\System\FnPiWwa.exe
  C:\Windows\System\FnPiWwa.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\DpNRcbf.exe
  C:\Windows\System\DpNRcbf.exe
  2⤵
  PID:2000
- C:\Windows\System\zNDINnU.exe
  C:\Windows\System\zNDINnU.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\lNXyUoh.exe
  C:\Windows\System\lNXyUoh.exe
  2⤵
  PID:1928
- C:\Windows\System\HIfqEGV.exe
  C:\Windows\System\HIfqEGV.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\wAMIUfz.exe
  C:\Windows\System\wAMIUfz.exe
  2⤵
  PID:2260
- C:\Windows\System\ynOLqsQ.exe
  C:\Windows\System\ynOLqsQ.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\BFAjfMG.exe
  C:\Windows\System\BFAjfMG.exe
  2⤵
  PID:2804
- C:\Windows\System\wKKCXRm.exe
  C:\Windows\System\wKKCXRm.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\WYzfbGL.exe
  C:\Windows\System\WYzfbGL.exe
  2⤵
  PID:2272
- C:\Windows\System\KPZlMCn.exe
  C:\Windows\System\KPZlMCn.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\GoNtQQV.exe
  C:\Windows\System\GoNtQQV.exe
  2⤵
  PID:1192
- C:\Windows\System\gFFCegt.exe
  C:\Windows\System\gFFCegt.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\aeYTnzX.exe
  C:\Windows\System\aeYTnzX.exe
  2⤵
  PID:1260
- C:\Windows\System\ocCAdAN.exe
  C:\Windows\System\ocCAdAN.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\WxGDwng.exe
  C:\Windows\System\WxGDwng.exe
  2⤵
  PID:1608
- C:\Windows\System\PLilCnT.exe
  C:\Windows\System\PLilCnT.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\JDfyXMX.exe
  C:\Windows\System\JDfyXMX.exe
  2⤵
  PID:2276
- C:\Windows\System\pQSFZNG.exe
  C:\Windows\System\pQSFZNG.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\WuiMEjx.exe
  C:\Windows\System\WuiMEjx.exe
  2⤵
  PID:2360
- C:\Windows\System\FQtrVnL.exe
  C:\Windows\System\FQtrVnL.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\lZrXGaF.exe
  C:\Windows\System\lZrXGaF.exe
  2⤵
  PID:600
- C:\Windows\System\kfgcNcp.exe
  C:\Windows\System\kfgcNcp.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\MMBzHBx.exe
  C:\Windows\System\MMBzHBx.exe
  2⤵
  PID:1580
- C:\Windows\System\HRaSray.exe
  C:\Windows\System\HRaSray.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\kczxEEx.exe
  C:\Windows\System\kczxEEx.exe
  2⤵
  PID:3084
- C:\Windows\System\jQJDwaS.exe
  C:\Windows\System\jQJDwaS.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\zvsGtcl.exe
  C:\Windows\System\zvsGtcl.exe
  2⤵
  PID:3116
- C:\Windows\System\iToHbUi.exe
  C:\Windows\System\iToHbUi.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\lCzNWAn.exe
  C:\Windows\System\lCzNWAn.exe
  2⤵
  PID:3148
- C:\Windows\System\qTppAvB.exe
  C:\Windows\System\qTppAvB.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\TyQjfkj.exe
  C:\Windows\System\TyQjfkj.exe
  2⤵
  PID:3180
- C:\Windows\System\UmgLqJc.exe
  C:\Windows\System\UmgLqJc.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\BLGVqpy.exe
  C:\Windows\System\BLGVqpy.exe
  2⤵
  PID:3212
- C:\Windows\System\TStJxCt.exe
  C:\Windows\System\TStJxCt.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\LChIpko.exe
  C:\Windows\System\LChIpko.exe
  2⤵
  PID:3244
- C:\Windows\System\dudwhEi.exe
  C:\Windows\System\dudwhEi.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\wnEXrsi.exe
  C:\Windows\System\wnEXrsi.exe
  2⤵
  PID:3276
- C:\Windows\System\YbEkgqe.exe
  C:\Windows\System\YbEkgqe.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\xUwvBDE.exe
  C:\Windows\System\xUwvBDE.exe
  2⤵
  PID:3308
- C:\Windows\System\XAQXzsg.exe
  C:\Windows\System\XAQXzsg.exe
  2⤵
  PID:3324
- C:\Windows\System\QNyqtRo.exe
  C:\Windows\System\QNyqtRo.exe
  2⤵
  PID:3340
- C:\Windows\System\PVyBUEO.exe
  C:\Windows\System\PVyBUEO.exe
  2⤵
  PID:3356
- C:\Windows\System\wZNmYlx.exe
  C:\Windows\System\wZNmYlx.exe
  2⤵
  PID:3380
- C:\Windows\System\hfOCHkm.exe
  C:\Windows\System\hfOCHkm.exe
  2⤵
  PID:3408
- C:\Windows\System\FPVwhQK.exe
  C:\Windows\System\FPVwhQK.exe
  2⤵
  PID:3424
- C:\Windows\System\zkgegMc.exe
  C:\Windows\System\zkgegMc.exe
  2⤵
  PID:3440
- C:\Windows\System\mfftgdN.exe
  C:\Windows\System\mfftgdN.exe
  2⤵
  PID:3456
- C:\Windows\System\fFWfmRm.exe
  C:\Windows\System\fFWfmRm.exe
  2⤵
  PID:3472
- C:\Windows\System\TzYmovg.exe
  C:\Windows\System\TzYmovg.exe
  2⤵
  PID:3504
- C:\Windows\System\JqURKiR.exe
  C:\Windows\System\JqURKiR.exe
  2⤵
  PID:3520
- C:\Windows\System\gRCxUIC.exe
  C:\Windows\System\gRCxUIC.exe
  2⤵
  PID:3536
- C:\Windows\System\qjjCRwW.exe
  C:\Windows\System\qjjCRwW.exe
  2⤵
  PID:3552
- C:\Windows\System\eziTZkd.exe
  C:\Windows\System\eziTZkd.exe
  2⤵
  PID:3572
- C:\Windows\System\yjvVBgZ.exe
  C:\Windows\System\yjvVBgZ.exe
  2⤵
  PID:3596
- C:\Windows\System\tPmFCOo.exe
  C:\Windows\System\tPmFCOo.exe
  2⤵
  PID:3612
- C:\Windows\System\FEXuOAQ.exe
  C:\Windows\System\FEXuOAQ.exe
  2⤵
  PID:3628
- C:\Windows\System\RCFNcNz.exe
  C:\Windows\System\RCFNcNz.exe
  2⤵
  PID:3644
- C:\Windows\System\kSUikXt.exe
  C:\Windows\System\kSUikXt.exe
  2⤵
  PID:3660
- C:\Windows\System\ofkmMCv.exe
  C:\Windows\System\ofkmMCv.exe
  2⤵
  PID:3676
- C:\Windows\System\wGzPwOH.exe
  C:\Windows\System\wGzPwOH.exe
  2⤵
  PID:3692
- C:\Windows\System\xNpfJiT.exe
  C:\Windows\System\xNpfJiT.exe
  2⤵
  PID:3708
- C:\Windows\System\iRhFnvg.exe
  C:\Windows\System\iRhFnvg.exe
  2⤵
  PID:3728
- C:\Windows\System\NnOycvO.exe
  C:\Windows\System\NnOycvO.exe
  2⤵
  PID:3744
- C:\Windows\System\QtrxsrH.exe
  C:\Windows\System\QtrxsrH.exe
  2⤵
  PID:3760
- C:\Windows\System\xFanoAH.exe
  C:\Windows\System\xFanoAH.exe
  2⤵
  PID:3784
- C:\Windows\System\qdodojP.exe
  C:\Windows\System\qdodojP.exe
  2⤵
  PID:3800
- C:\Windows\System\jhAErTB.exe
  C:\Windows\System\jhAErTB.exe
  2⤵
  PID:3816
- C:\Windows\System\cxbAvYW.exe
  C:\Windows\System\cxbAvYW.exe
  2⤵
  PID:3832
- C:\Windows\System\ZraAIqi.exe
  C:\Windows\System\ZraAIqi.exe
  2⤵
  PID:3852
- C:\Windows\System\IsdmdOe.exe
  C:\Windows\System\IsdmdOe.exe
  2⤵
  PID:3868
- C:\Windows\System\ZrOBujr.exe
  C:\Windows\System\ZrOBujr.exe
  2⤵
  PID:3892
- C:\Windows\System\YaXclEu.exe
  C:\Windows\System\YaXclEu.exe
  2⤵
  PID:3908
- C:\Windows\System\LxDuqIL.exe
  C:\Windows\System\LxDuqIL.exe
  2⤵
  PID:3924
- C:\Windows\System\GZREvdz.exe
  C:\Windows\System\GZREvdz.exe
  2⤵
  PID:3940
- C:\Windows\System\hAeFOZm.exe
  C:\Windows\System\hAeFOZm.exe
  2⤵
  PID:3956
- C:\Windows\System\HazKjcx.exe
  C:\Windows\System\HazKjcx.exe
  2⤵
  PID:3972
- C:\Windows\System\qHmhRZo.exe
  C:\Windows\System\qHmhRZo.exe
  2⤵
  PID:3992
- C:\Windows\System\OhLqHdj.exe
  C:\Windows\System\OhLqHdj.exe
  2⤵
  PID:4008
- C:\Windows\System\PfPSXmw.exe
  C:\Windows\System\PfPSXmw.exe
  2⤵
  PID:4024
- C:\Windows\System\AJXZiSz.exe
  C:\Windows\System\AJXZiSz.exe
  2⤵
  PID:4040
- C:\Windows\System\AuPNako.exe
  C:\Windows\System\AuPNako.exe
  2⤵
  PID:4056
- C:\Windows\System\cGSsHKH.exe
  C:\Windows\System\cGSsHKH.exe
  2⤵
  PID:4072
- C:\Windows\System\XIslkIY.exe
  C:\Windows\System\XIslkIY.exe
  2⤵
  PID:4088
- C:\Windows\System\jVoyjyG.exe
  C:\Windows\System\jVoyjyG.exe
  2⤵
  PID:1500
- C:\Windows\System\QwWDzBT.exe
  C:\Windows\System\QwWDzBT.exe
  2⤵
  PID:3080
- C:\Windows\System\kNntATO.exe
  C:\Windows\System\kNntATO.exe
  2⤵
  PID:3144
- C:\Windows\System\NUfPqXP.exe
  C:\Windows\System\NUfPqXP.exe
  2⤵
  PID:3208
- C:\Windows\System\QgvUpEU.exe
  C:\Windows\System\QgvUpEU.exe
  2⤵
  PID:3272
- C:\Windows\System\QMQAtUQ.exe
  C:\Windows\System\QMQAtUQ.exe
  2⤵
  PID:3336
- C:\Windows\System\tolukQs.exe
  C:\Windows\System\tolukQs.exe
  2⤵
  PID:1964
- C:\Windows\System\XbAvjMT.exe
  C:\Windows\System\XbAvjMT.exe
  2⤵
  PID:3448
- C:\Windows\System\yPsbjfE.exe
  C:\Windows\System\yPsbjfE.exe
  2⤵
  PID:3532
- C:\Windows\System\jVBPIei.exe
  C:\Windows\System\jVBPIei.exe
  2⤵
  PID:2224
- C:\Windows\System\jWwKcbk.exe
  C:\Windows\System\jWwKcbk.exe
  2⤵
  PID:2180
- C:\Windows\System\CPthjqB.exe
  C:\Windows\System\CPthjqB.exe
  2⤵
  PID:4108
- C:\Windows\System\PkAKROS.exe
  C:\Windows\System\PkAKROS.exe
  2⤵
  PID:4124
- C:\Windows\System\OXyPdQK.exe
  C:\Windows\System\OXyPdQK.exe
  2⤵
  PID:4140
- C:\Windows\System\AMZScot.exe
  C:\Windows\System\AMZScot.exe
  2⤵
  PID:4160
- C:\Windows\System\BBDDRyl.exe
  C:\Windows\System\BBDDRyl.exe
  2⤵
  PID:4176
- C:\Windows\System\phqDeOh.exe
  C:\Windows\System\phqDeOh.exe
  2⤵
  PID:4192
- C:\Windows\System\dfKnHJu.exe
  C:\Windows\System\dfKnHJu.exe
  2⤵
  PID:4208
- C:\Windows\System\NAVOieo.exe
  C:\Windows\System\NAVOieo.exe
  2⤵
  PID:4224
- C:\Windows\System\UOrYNlq.exe
  C:\Windows\System\UOrYNlq.exe
  2⤵
  PID:4240
- C:\Windows\System\MrUaIbT.exe
  C:\Windows\System\MrUaIbT.exe
  2⤵
  PID:4256
- C:\Windows\System\alKOGmS.exe
  C:\Windows\System\alKOGmS.exe
  2⤵
  PID:4272
- C:\Windows\System\dqUeiYB.exe
  C:\Windows\System\dqUeiYB.exe
  2⤵
  PID:4292
- C:\Windows\System\yWddjDC.exe
  C:\Windows\System\yWddjDC.exe
  2⤵
  PID:4308
- C:\Windows\System\rYnwnxO.exe
  C:\Windows\System\rYnwnxO.exe
  2⤵
  PID:4324
- C:\Windows\System\XmBrmqt.exe
  C:\Windows\System\XmBrmqt.exe
  2⤵
  PID:4340
- C:\Windows\System\irDRDwJ.exe
  C:\Windows\System\irDRDwJ.exe
  2⤵
  PID:4356
- C:\Windows\System\BBiJGoY.exe
  C:\Windows\System\BBiJGoY.exe
  2⤵
  PID:4376
- C:\Windows\System\gLvbnaA.exe
  C:\Windows\System\gLvbnaA.exe
  2⤵
  PID:4392
- C:\Windows\System\EenYCpd.exe
  C:\Windows\System\EenYCpd.exe
  2⤵
  PID:4408
- C:\Windows\System\kJfcgyD.exe
  C:\Windows\System\kJfcgyD.exe
  2⤵
  PID:4424
- C:\Windows\System\ebCPmUP.exe
  C:\Windows\System\ebCPmUP.exe
  2⤵
  PID:4016
- C:\Windows\System\EPQLRLn.exe
  C:\Windows\System\EPQLRLn.exe
  2⤵
  PID:4080
- C:\Windows\System\pnRkauU.exe
  C:\Windows\System\pnRkauU.exe
  2⤵
  PID:1452
- C:\Windows\System\dlBVBVb.exe
  C:\Windows\System\dlBVBVb.exe
  2⤵
  PID:3332
- C:\Windows\System\anUNiCX.exe
  C:\Windows\System\anUNiCX.exe
  2⤵
  PID:2516
- C:\Windows\System\kRqCgSC.exe
  C:\Windows\System\kRqCgSC.exe
  2⤵
  PID:4136
- C:\Windows\System\ufvdqIF.exe
  C:\Windows\System\ufvdqIF.exe
  2⤵
  PID:4232
- C:\Windows\System\gCuTyOe.exe
  C:\Windows\System\gCuTyOe.exe
  2⤵
  PID:4300
- C:\Windows\System\ejLdObx.exe
  C:\Windows\System\ejLdObx.exe
  2⤵
  PID:4336
- C:\Windows\System\yaTHTnd.exe
  C:\Windows\System\yaTHTnd.exe
  2⤵
  PID:4404
- C:\Windows\System\xvZmbUZ.exe
  C:\Windows\System\xvZmbUZ.exe
  2⤵
  PID:4444
- C:\Windows\System\kONIUSh.exe
  C:\Windows\System\kONIUSh.exe
  2⤵
  PID:4460
- C:\Windows\System\mbVWzhs.exe
  C:\Windows\System\mbVWzhs.exe
  2⤵
  PID:4480
- C:\Windows\System\exzAUqi.exe
  C:\Windows\System\exzAUqi.exe
  2⤵
  PID:4496
- C:\Windows\System\kBVXbMD.exe
  C:\Windows\System\kBVXbMD.exe
  2⤵
  PID:4524
- C:\Windows\System\XvlJnac.exe
  C:\Windows\System\XvlJnac.exe
  2⤵
  PID:4544
- C:\Windows\System\JHrUoYA.exe
  C:\Windows\System\JHrUoYA.exe
  2⤵
  PID:4560
- C:\Windows\System\pntMRZL.exe
  C:\Windows\System\pntMRZL.exe
  2⤵
  PID:4580
- C:\Windows\System\wdEEkVm.exe
  C:\Windows\System\wdEEkVm.exe
  2⤵
  PID:4596
- C:\Windows\System\DpBrfKt.exe
  C:\Windows\System\DpBrfKt.exe
  2⤵
  PID:4612
- C:\Windows\System\AjlWmYl.exe
  C:\Windows\System\AjlWmYl.exe
  2⤵
  PID:4628
- C:\Windows\System\fgBGRvY.exe
  C:\Windows\System\fgBGRvY.exe
  2⤵
  PID:4644
- C:\Windows\System\yDcfETe.exe
  C:\Windows\System\yDcfETe.exe
  2⤵
  PID:4660
- C:\Windows\System\RhFnkcE.exe
  C:\Windows\System\RhFnkcE.exe
  2⤵
  PID:4684
- C:\Windows\System\JeyPYwj.exe
  C:\Windows\System\JeyPYwj.exe
  2⤵
  PID:4700
- C:\Windows\System\QvrkPbO.exe
  C:\Windows\System\QvrkPbO.exe
  2⤵
  PID:4716
- C:\Windows\System\iClqNIG.exe
  C:\Windows\System\iClqNIG.exe
  2⤵
  PID:4736
- C:\Windows\System\orPKIUC.exe
  C:\Windows\System\orPKIUC.exe
  2⤵
  PID:4752
- C:\Windows\System\rgwAspO.exe
  C:\Windows\System\rgwAspO.exe
  2⤵
  PID:4776
- C:\Windows\System\ZJYhXdO.exe
  C:\Windows\System\ZJYhXdO.exe
  2⤵
  PID:4792
- C:\Windows\System\zdVSQAp.exe
  C:\Windows\System\zdVSQAp.exe
  2⤵
  PID:4808
- C:\Windows\System\CmFoGMG.exe
  C:\Windows\System\CmFoGMG.exe
  2⤵
  PID:4840
- C:\Windows\System\ZYhEXYo.exe
  C:\Windows\System\ZYhEXYo.exe
  2⤵
  PID:4856
- C:\Windows\System\dgSTRkt.exe
  C:\Windows\System\dgSTRkt.exe
  2⤵
  PID:4872
- C:\Windows\System\zdlUtVP.exe
  C:\Windows\System\zdlUtVP.exe
  2⤵
  PID:2540
- C:\Windows\System\xcIgLqg.exe
  C:\Windows\System\xcIgLqg.exe
  2⤵
  PID:4912
- C:\Windows\System\lSlrCRb.exe
  C:\Windows\System\lSlrCRb.exe
  2⤵
  PID:2164
- C:\Windows\System\NxJSRup.exe
  C:\Windows\System\NxJSRup.exe
  2⤵
  PID:2856
- C:\Windows\System\SQbQVCs.exe
  C:\Windows\System\SQbQVCs.exe
  2⤵
  PID:360
- C:\Windows\System\iLdYJfE.exe
  C:\Windows\System\iLdYJfE.exe
  2⤵
  PID:796
- C:\Windows\System\roiZAPV.exe
  C:\Windows\System\roiZAPV.exe
  2⤵
  PID:2124
- C:\Windows\System\CMLZqqd.exe
  C:\Windows\System\CMLZqqd.exe
  2⤵
  PID:3008
- C:\Windows\System\QzgQMUz.exe
  C:\Windows\System\QzgQMUz.exe
  2⤵
  PID:1336
- C:\Windows\System\lOlKnUP.exe
  C:\Windows\System\lOlKnUP.exe
  2⤵
  PID:1568
- C:\Windows\System\MfffAgq.exe
  C:\Windows\System\MfffAgq.exe
  2⤵
  PID:3256
- C:\Windows\System\YWYwivO.exe
  C:\Windows\System\YWYwivO.exe
  2⤵
  PID:3388
- C:\Windows\System\LbAekta.exe
  C:\Windows\System\LbAekta.exe
  2⤵
  PID:1516
- C:\Windows\System\lceGEWv.exe
  C:\Windows\System\lceGEWv.exe
  2⤵
  PID:3980
- C:\Windows\System\MBcPIbH.exe
  C:\Windows\System\MBcPIbH.exe
  2⤵
  PID:1484
- C:\Windows\System\jOdLlmQ.exe
  C:\Windows\System\jOdLlmQ.exe
  2⤵
  PID:2700
- C:\Windows\System\cDYKkXb.exe
  C:\Windows\System\cDYKkXb.exe
  2⤵
  PID:4364
- C:\Windows\System\rutWfor.exe
  C:\Windows\System\rutWfor.exe
  2⤵
  PID:4472
- C:\Windows\System\fgKtqLC.exe
  C:\Windows\System\fgKtqLC.exe
  2⤵
  PID:2280
- C:\Windows\System\chTuTjh.exe
  C:\Windows\System\chTuTjh.exe
  2⤵
  PID:4556
- C:\Windows\System\ZBZjpxU.exe
  C:\Windows\System\ZBZjpxU.exe
  2⤵
  PID:4624
- C:\Windows\System\mqiGSoK.exe
  C:\Windows\System\mqiGSoK.exe
  2⤵
  PID:4696
- C:\Windows\System\sTklAAU.exe
  C:\Windows\System\sTklAAU.exe
  2⤵
  PID:4772
- C:\Windows\System\SuDFPRr.exe
  C:\Windows\System\SuDFPRr.exe
  2⤵
  PID:3480
- C:\Windows\System\wpCicZj.exe
  C:\Windows\System\wpCicZj.exe
  2⤵
  PID:4184
- C:\Windows\System\pnbyKOy.exe
  C:\Windows\System\pnbyKOy.exe
  2⤵
  PID:4252
- C:\Windows\System\flFJpIx.exe
  C:\Windows\System\flFJpIx.exe
  2⤵
  PID:4320
- C:\Windows\System\MpAugQf.exe
  C:\Windows\System\MpAugQf.exe
  2⤵
  PID:4388
- C:\Windows\System\KygvoiO.exe
  C:\Windows\System\KygvoiO.exe
  2⤵
  PID:4156
- C:\Windows\System\uyDfsun.exe
  C:\Windows\System\uyDfsun.exe
  2⤵
  PID:4116
- C:\Windows\System\QIoSDAp.exe
  C:\Windows\System\QIoSDAp.exe
  2⤵
  PID:3364
- C:\Windows\System\TLzsMgs.exe
  C:\Windows\System\TLzsMgs.exe
  2⤵
  PID:3140
- C:\Windows\System\bWcwwQp.exe
  C:\Windows\System\bWcwwQp.exe
  2⤵
  PID:4068
- C:\Windows\System\VIRfvxt.exe
  C:\Windows\System\VIRfvxt.exe
  2⤵
  PID:4004
- C:\Windows\System\RPqlKbV.exe
  C:\Windows\System\RPqlKbV.exe
  2⤵
  PID:3904
- C:\Windows\System\upSFmNJ.exe
  C:\Windows\System\upSFmNJ.exe
  2⤵
  PID:3304
- C:\Windows\System\ZGoJAmX.exe
  C:\Windows\System\ZGoJAmX.exe
  2⤵
  PID:3756
- C:\Windows\System\LkMDKFJ.exe
  C:\Windows\System\LkMDKFJ.exe
  2⤵
  PID:3688
- C:\Windows\System\xwBeSAb.exe
  C:\Windows\System\xwBeSAb.exe
  2⤵
  PID:4884
- C:\Windows\System\CjFjeze.exe
  C:\Windows\System\CjFjeze.exe
  2⤵
  PID:4132
- C:\Windows\System\gIaRVKG.exe
  C:\Windows\System\gIaRVKG.exe
  2⤵
  PID:2012
- C:\Windows\System\voYkUvu.exe
  C:\Windows\System\voYkUvu.exe
  2⤵
  PID:3824
- C:\Windows\System\hGNCPQL.exe
  C:\Windows\System\hGNCPQL.exe
  2⤵
  PID:3620
- C:\Windows\System\HkDbVaP.exe
  C:\Windows\System\HkDbVaP.exe
  2⤵
  PID:3544
- C:\Windows\System\ERyhxaT.exe
  C:\Windows\System\ERyhxaT.exe
  2⤵
  PID:1936
- C:\Windows\System\zNZJAfj.exe
  C:\Windows\System\zNZJAfj.exe
  2⤵
  PID:3016
- C:\Windows\System\txpdkYA.exe
  C:\Windows\System\txpdkYA.exe
  2⤵
  PID:4904
- C:\Windows\System\QWqZixA.exe
  C:\Windows\System\QWqZixA.exe
  2⤵
  PID:4828
- C:\Windows\System\jJOXqaN.exe
  C:\Windows\System\jJOXqaN.exe
  2⤵
  PID:4748
- C:\Windows\System\LbQuESz.exe
  C:\Windows\System\LbQuESz.exe
  2⤵
  PID:4680
- C:\Windows\System\WmAWcZS.exe
  C:\Windows\System\WmAWcZS.exe
  2⤵
  PID:4608
- C:\Windows\System\QtLXajN.exe
  C:\Windows\System\QtLXajN.exe
  2⤵
  PID:4540
- C:\Windows\System\BSMRxiP.exe
  C:\Windows\System\BSMRxiP.exe
  2⤵
  PID:4456
- C:\Windows\System\MIZlfZE.exe
  C:\Windows\System\MIZlfZE.exe
  2⤵
  PID:4268
- C:\Windows\System\OzEjOyY.exe
  C:\Windows\System\OzEjOyY.exe
  2⤵
  PID:2916
- C:\Windows\System\VFCvaYO.exe
  C:\Windows\System\VFCvaYO.exe
  2⤵
  PID:1776
- C:\Windows\System\ArUDVXz.exe
  C:\Windows\System\ArUDVXz.exe
  2⤵
  PID:3020
- C:\Windows\System\JZksVah.exe
  C:\Windows\System\JZksVah.exe
  2⤵
  PID:3496
- C:\Windows\System\bXlyadK.exe
  C:\Windows\System\bXlyadK.exe
  2⤵
  PID:4468
- C:\Windows\System\FvpMutP.exe
  C:\Windows\System\FvpMutP.exe
  2⤵
  PID:4652
- C:\Windows\System\wZMMpSn.exe
  C:\Windows\System\wZMMpSn.exe
  2⤵
  PID:3076
- C:\Windows\System\TFpKOjq.exe
  C:\Windows\System\TFpKOjq.exe
  2⤵
  PID:2256
- C:\Windows\System\UgwRlHb.exe
  C:\Windows\System\UgwRlHb.exe
  2⤵
  PID:4732
- C:\Windows\System\xWOGOow.exe
  C:\Windows\System\xWOGOow.exe
  2⤵
  PID:4288
- C:\Windows\System\thYIQaK.exe
  C:\Windows\System\thYIQaK.exe
  2⤵
  PID:2780
- C:\Windows\System\wTLhRDp.exe
  C:\Windows\System\wTLhRDp.exe
  2⤵
  PID:4248
- C:\Windows\System\caPCSgl.exe
  C:\Windows\System\caPCSgl.exe
  2⤵
  PID:3484
- C:\Windows\System\AUvjCmY.exe
  C:\Windows\System\AUvjCmY.exe
  2⤵
  PID:3964
- C:\Windows\System\RlwZHLI.exe
  C:\Windows\System\RlwZHLI.exe
  2⤵
  PID:3724
- C:\Windows\System\GcFyICi.exe
  C:\Windows\System\GcFyICi.exe
  2⤵
  PID:3860
- C:\Windows\System\JFvloRc.exe
  C:\Windows\System\JFvloRc.exe
  2⤵
  PID:1848
- C:\Windows\System\cBYRsTD.exe
  C:\Windows\System\cBYRsTD.exe
  2⤵
  PID:2932
- C:\Windows\System\hTHZBrG.exe
  C:\Windows\System\hTHZBrG.exe
  2⤵
  PID:2016
- C:\Windows\System\hKMexBi.exe
  C:\Windows\System\hKMexBi.exe
  2⤵
  PID:4000
- C:\Windows\System\pdQVarM.exe
  C:\Windows\System\pdQVarM.exe
  2⤵
  PID:4048
- C:\Windows\System\dKorjVo.exe
  C:\Windows\System\dKorjVo.exe
  2⤵
  PID:3512
- C:\Windows\System\ekcuGoG.exe
  C:\Windows\System\ekcuGoG.exe
  2⤵
  PID:2648
- C:\Windows\System\ZODemNU.exe
  C:\Windows\System\ZODemNU.exe
  2⤵
  PID:4492
- C:\Windows\System\hxSFGyE.exe
  C:\Windows\System\hxSFGyE.exe
  2⤵
  PID:2460
- C:\Windows\System\jvHxTSH.exe
  C:\Windows\System\jvHxTSH.exe
  2⤵
  PID:4708
- C:\Windows\System\DQyROJX.exe
  C:\Windows\System\DQyROJX.exe
  2⤵
  PID:4372
- C:\Windows\System\ZcKrAES.exe
  C:\Windows\System\ZcKrAES.exe
  2⤵
  PID:3464
- C:\Windows\System\ZwthovH.exe
  C:\Windows\System\ZwthovH.exe
  2⤵
  PID:684
- C:\Windows\System\cFHtKPM.exe
  C:\Windows\System\cFHtKPM.exe
  2⤵
  PID:2472
- C:\Windows\System\uuSeYfy.exe
  C:\Windows\System\uuSeYfy.exe
  2⤵
  PID:4148
- C:\Windows\System\SEISKAE.exe
  C:\Windows\System\SEISKAE.exe
  2⤵
  PID:776
- C:\Windows\System\cSOnZbR.exe
  C:\Windows\System\cSOnZbR.exe
  2⤵
  PID:4440
- C:\Windows\System\SkordIs.exe
  C:\Windows\System\SkordIs.exe
  2⤵
  PID:4416
- C:\Windows\System\kFrFQBj.exe
  C:\Windows\System\kFrFQBj.exe
  2⤵
  PID:448
- C:\Windows\System\aMeswgT.exe
  C:\Windows\System\aMeswgT.exe
  2⤵
  PID:4352
- C:\Windows\System\bvIVuEB.exe
  C:\Windows\System\bvIVuEB.exe
  2⤵
  PID:4036
- C:\Windows\System\wgVqHGh.exe
  C:\Windows\System\wgVqHGh.exe
  2⤵
  PID:3584
- C:\Windows\System\FOvkNFo.exe
  C:\Windows\System\FOvkNFo.exe
  2⤵
  PID:3624
- C:\Windows\System\OiTacDk.exe
  C:\Windows\System\OiTacDk.exe
  2⤵
  PID:1040
- C:\Windows\System\gzkTPNn.exe
  C:\Windows\System\gzkTPNn.exe
  2⤵
  PID:4800
- C:\Windows\System\wtUgSwN.exe
  C:\Windows\System\wtUgSwN.exe
  2⤵
  PID:4284
- C:\Windows\System\APjYsqJ.exe
  C:\Windows\System\APjYsqJ.exe
  2⤵
  PID:2064
- C:\Windows\System\OcvHEPO.exe
  C:\Windows\System\OcvHEPO.exe
  2⤵
  PID:5136
- C:\Windows\System\EkAALtU.exe
  C:\Windows\System\EkAALtU.exe
  2⤵
  PID:5152
- C:\Windows\System\jwSgCYP.exe
  C:\Windows\System\jwSgCYP.exe
  2⤵
  PID:5168
- C:\Windows\System\ARmsATx.exe
  C:\Windows\System\ARmsATx.exe
  2⤵
  PID:5184
- C:\Windows\System\dVvnvsv.exe
  C:\Windows\System\dVvnvsv.exe
  2⤵
  PID:5200
- C:\Windows\System\VlNptbq.exe
  C:\Windows\System\VlNptbq.exe
  2⤵
  PID:5216
- C:\Windows\System\uNtWTlQ.exe
  C:\Windows\System\uNtWTlQ.exe
  2⤵
  PID:5232
- C:\Windows\System\awfcAJw.exe
  C:\Windows\System\awfcAJw.exe
  2⤵
  PID:5256
- C:\Windows\System\broNUPj.exe
  C:\Windows\System\broNUPj.exe
  2⤵
  PID:5272
- C:\Windows\System\QXYlXvl.exe
  C:\Windows\System\QXYlXvl.exe
  2⤵
  PID:5288
- C:\Windows\System\jBXtrmK.exe
  C:\Windows\System\jBXtrmK.exe
  2⤵
  PID:5304
- C:\Windows\System\dnywTzU.exe
  C:\Windows\System\dnywTzU.exe
  2⤵
  PID:5320
- C:\Windows\System\LUSdSYJ.exe
  C:\Windows\System\LUSdSYJ.exe
  2⤵
  PID:5336
- C:\Windows\System\OXYjAeY.exe
  C:\Windows\System\OXYjAeY.exe
  2⤵
  PID:5352
- C:\Windows\System\kFoUewq.exe
  C:\Windows\System\kFoUewq.exe
  2⤵
  PID:5368
- C:\Windows\System\GAAWNCO.exe
  C:\Windows\System\GAAWNCO.exe
  2⤵
  PID:5384
- C:\Windows\System\FihWwLy.exe
  C:\Windows\System\FihWwLy.exe
  2⤵
  PID:5400
- C:\Windows\System\nbvXSWp.exe
  C:\Windows\System\nbvXSWp.exe
  2⤵
  PID:5416
- C:\Windows\System\FtNwMkT.exe
  C:\Windows\System\FtNwMkT.exe
  2⤵
  PID:5432
- C:\Windows\System\eJWlFnj.exe
  C:\Windows\System\eJWlFnj.exe
  2⤵
  PID:5448
- C:\Windows\System\ClWjOeC.exe
  C:\Windows\System\ClWjOeC.exe
  2⤵
  PID:5464
- C:\Windows\System\taMoOni.exe
  C:\Windows\System\taMoOni.exe
  2⤵
  PID:5480
- C:\Windows\System\YsWYwcn.exe
  C:\Windows\System\YsWYwcn.exe
  2⤵
  PID:5496
- C:\Windows\System\SLjQrYu.exe
  C:\Windows\System\SLjQrYu.exe
  2⤵
  PID:5512
- C:\Windows\System\eoUnMrE.exe
  C:\Windows\System\eoUnMrE.exe
  2⤵
  PID:5528
- C:\Windows\System\ddmjtBo.exe
  C:\Windows\System\ddmjtBo.exe
  2⤵
  PID:5544
- C:\Windows\System\cAmLtSy.exe
  C:\Windows\System\cAmLtSy.exe
  2⤵
  PID:5560
- C:\Windows\System\hOKrynA.exe
  C:\Windows\System\hOKrynA.exe
  2⤵
  PID:5576
- C:\Windows\System\PDRFXGF.exe
  C:\Windows\System\PDRFXGF.exe
  2⤵
  PID:5592
- C:\Windows\System\AJhbXMv.exe
  C:\Windows\System\AJhbXMv.exe
  2⤵
  PID:5608
- C:\Windows\System\SyUSSvE.exe
  C:\Windows\System\SyUSSvE.exe
  2⤵
  PID:5624
- C:\Windows\System\OUrkMXG.exe
  C:\Windows\System\OUrkMXG.exe
  2⤵
  PID:5640
- C:\Windows\System\bvRMGuj.exe
  C:\Windows\System\bvRMGuj.exe
  2⤵
  PID:5656
- C:\Windows\System\qZFyEIt.exe
  C:\Windows\System\qZFyEIt.exe
  2⤵
  PID:5676
- C:\Windows\System\Dyoslpt.exe
  C:\Windows\System\Dyoslpt.exe
  2⤵
  PID:5692
- C:\Windows\System\BCARhDl.exe
  C:\Windows\System\BCARhDl.exe
  2⤵
  PID:5708
- C:\Windows\System\KIZUTqH.exe
  C:\Windows\System\KIZUTqH.exe
  2⤵
  PID:5724
- C:\Windows\System\jiiufxm.exe
  C:\Windows\System\jiiufxm.exe
  2⤵
  PID:5740
- C:\Windows\System\nLbOVmN.exe
  C:\Windows\System\nLbOVmN.exe
  2⤵
  PID:5756
- C:\Windows\System\sGWKLKE.exe
  C:\Windows\System\sGWKLKE.exe
  2⤵
  PID:5772
- C:\Windows\System\Rvydacx.exe
  C:\Windows\System\Rvydacx.exe
  2⤵
  PID:5788
- C:\Windows\System\RudnOnN.exe
  C:\Windows\System\RudnOnN.exe
  2⤵
  PID:5804
- C:\Windows\System\RNENOAR.exe
  C:\Windows\System\RNENOAR.exe
  2⤵
  PID:5820
- C:\Windows\System\aWDoPPP.exe
  C:\Windows\System\aWDoPPP.exe
  2⤵
  PID:5836
- C:\Windows\System\ALoZgQO.exe
  C:\Windows\System\ALoZgQO.exe
  2⤵
  PID:5852
- C:\Windows\System\SuPgfQq.exe
  C:\Windows\System\SuPgfQq.exe
  2⤵
  PID:5868
- C:\Windows\System\jEyVpvv.exe
  C:\Windows\System\jEyVpvv.exe
  2⤵
  PID:5884
- C:\Windows\System\cZwciNp.exe
  C:\Windows\System\cZwciNp.exe
  2⤵
  PID:5900
- C:\Windows\System\tLCaQfc.exe
  C:\Windows\System\tLCaQfc.exe
  2⤵
  PID:5916
- C:\Windows\System\GLkCrzf.exe
  C:\Windows\System\GLkCrzf.exe
  2⤵
  PID:5932
- C:\Windows\System\GMvnvYh.exe
  C:\Windows\System\GMvnvYh.exe
  2⤵
  PID:5948
- C:\Windows\System\bDJzFDA.exe
  C:\Windows\System\bDJzFDA.exe
  2⤵
  PID:5964
- C:\Windows\System\iQKSsJF.exe
  C:\Windows\System\iQKSsJF.exe
  2⤵
  PID:5980
- C:\Windows\System\FwpzhpX.exe
  C:\Windows\System\FwpzhpX.exe
  2⤵
  PID:5996
- C:\Windows\System\LfAurlU.exe
  C:\Windows\System\LfAurlU.exe
  2⤵
  PID:6012
- C:\Windows\System\nVADMWt.exe
  C:\Windows\System\nVADMWt.exe
  2⤵
  PID:6028
- C:\Windows\System\wdfwlvk.exe
  C:\Windows\System\wdfwlvk.exe
  2⤵
  PID:6044
- C:\Windows\System\nNvkXsC.exe
  C:\Windows\System\nNvkXsC.exe
  2⤵
  PID:6060
- C:\Windows\System\DzKBTtN.exe
  C:\Windows\System\DzKBTtN.exe
  2⤵
  PID:6076
- C:\Windows\System\FvQeBHJ.exe
  C:\Windows\System\FvQeBHJ.exe
  2⤵
  PID:6092
- C:\Windows\System\uJDgmUQ.exe
  C:\Windows\System\uJDgmUQ.exe
  2⤵
  PID:6108
- C:\Windows\System\paKyKSN.exe
  C:\Windows\System\paKyKSN.exe
  2⤵
  PID:6124
- C:\Windows\System\lWblkuH.exe
  C:\Windows\System\lWblkuH.exe
  2⤵
  PID:6140
- C:\Windows\System\JzLchKW.exe
  C:\Windows\System\JzLchKW.exe
  2⤵
  PID:2040
- C:\Windows\System\IoAgRwU.exe
  C:\Windows\System\IoAgRwU.exe
  2⤵
  PID:2496
- C:\Windows\System\RpKXSXV.exe
  C:\Windows\System\RpKXSXV.exe
  2⤵
  PID:5228
- C:\Windows\System\MWSijBz.exe
  C:\Windows\System\MWSijBz.exe
  2⤵
  PID:4868
- C:\Windows\System\RdKkjSv.exe
  C:\Windows\System\RdKkjSv.exe
  2⤵
  PID:4204
- C:\Windows\System\OUVyxxW.exe
  C:\Windows\System\OUVyxxW.exe
  2⤵
  PID:4104
- C:\Windows\System\mHuFMME.exe
  C:\Windows\System\mHuFMME.exe
  2⤵
  PID:4804
- C:\Windows\System\DjrKkme.exe
  C:\Windows\System\DjrKkme.exe
  2⤵
  PID:3124
- C:\Windows\System\HuQWhNl.exe
  C:\Windows\System\HuQWhNl.exe
  2⤵
  PID:5148
- C:\Windows\System\sympLFc.exe
  C:\Windows\System\sympLFc.exe
  2⤵
  PID:5212
- C:\Windows\System\avPpFLd.exe
  C:\Windows\System\avPpFLd.exe
  2⤵
  PID:5264
- C:\Windows\System\ThveqfM.exe
  C:\Windows\System\ThveqfM.exe
  2⤵
  PID:5300
- C:\Windows\System\ghLBfnM.exe
  C:\Windows\System\ghLBfnM.exe
  2⤵
  PID:2628
- C:\Windows\System\mvgcNas.exe
  C:\Windows\System\mvgcNas.exe
  2⤵
  PID:5344
- C:\Windows\System\IeaPfEb.exe
  C:\Windows\System\IeaPfEb.exe
  2⤵
  PID:5364
- C:\Windows\System\EJdoRtP.exe
  C:\Windows\System\EJdoRtP.exe
  2⤵
  PID:5408
- C:\Windows\System\zamApwh.exe
  C:\Windows\System\zamApwh.exe
  2⤵
  PID:5424
- C:\Windows\System\TtHnroh.exe
  C:\Windows\System\TtHnroh.exe
  2⤵
  PID:5488
- C:\Windows\System\YjfySoK.exe
  C:\Windows\System\YjfySoK.exe
  2⤵
  PID:5476
- C:\Windows\System\uHLobhb.exe
  C:\Windows\System\uHLobhb.exe
  2⤵
  PID:5588
- C:\Windows\System\kBOqIPT.exe
  C:\Windows\System\kBOqIPT.exe
  2⤵
  PID:5620
- C:\Windows\System\WZmMGTK.exe
  C:\Windows\System\WZmMGTK.exe
  2⤵
  PID:5684
- C:\Windows\System\wRfSJOE.exe
  C:\Windows\System\wRfSJOE.exe
  2⤵
  PID:5672
- C:\Windows\System\MXJmWDE.exe
  C:\Windows\System\MXJmWDE.exe
  2⤵
  PID:5752
- C:\Windows\System\TSWQyEH.exe
  C:\Windows\System\TSWQyEH.exe
  2⤵
  PID:5844
- C:\Windows\System\sjajGGj.exe
  C:\Windows\System\sjajGGj.exe
  2⤵
  PID:5536
- C:\Windows\System\TGQwVaR.exe
  C:\Windows\System\TGQwVaR.exe
  2⤵
  PID:5908
- C:\Windows\System\PszixrP.exe
  C:\Windows\System\PszixrP.exe
  2⤵
  PID:6004
- C:\Windows\System\gLGFdua.exe
  C:\Windows\System\gLGFdua.exe
  2⤵
  PID:6068
- C:\Windows\System\PftPJqm.exe
  C:\Windows\System\PftPJqm.exe
  2⤵
  PID:6132
- C:\Windows\System\pqJivAj.exe
  C:\Windows\System\pqJivAj.exe
  2⤵
  PID:5976
- C:\Windows\System\kmIkNhb.exe
  C:\Windows\System\kmIkNhb.exe
  2⤵
  PID:2636
- C:\Windows\System\KZWbJAV.exe
  C:\Windows\System\KZWbJAV.exe
  2⤵
  PID:2952
- C:\Windows\System\MjcAuYF.exe
  C:\Windows\System\MjcAuYF.exe
  2⤵
  PID:5208
- C:\Windows\System\vbHMTks.exe
  C:\Windows\System\vbHMTks.exe
  2⤵
  PID:5632
- C:\Windows\System\VfSAkGM.exe
  C:\Windows\System\VfSAkGM.exe
  2⤵
  PID:5456
- C:\Windows\System\aIBRuax.exe
  C:\Windows\System\aIBRuax.exe
  2⤵
  PID:5552
- C:\Windows\System\gXapQLp.exe
  C:\Windows\System\gXapQLp.exe
  2⤵
  PID:5876
- C:\Windows\System\zomVRop.exe
  C:\Windows\System\zomVRop.exe
  2⤵
  PID:5972
- C:\Windows\System\DRhRBAq.exe
  C:\Windows\System\DRhRBAq.exe
  2⤵
  PID:6104
- C:\Windows\System\bvlieaD.exe
  C:\Windows\System\bvlieaD.exe
  2⤵
  PID:5252
- C:\Windows\System\LpRBeKs.exe
  C:\Windows\System\LpRBeKs.exe
  2⤵
  PID:5380
- C:\Windows\System\FxHAGnA.exe
  C:\Windows\System\FxHAGnA.exe
  2⤵
  PID:5940
- C:\Windows\System\ImwuNHz.exe
  C:\Windows\System\ImwuNHz.exe
  2⤵
  PID:5700
- C:\Windows\System\bsTwzoE.exe
  C:\Windows\System\bsTwzoE.exe
  2⤵
  PID:5732
- C:\Windows\System\znJkMYT.exe
  C:\Windows\System\znJkMYT.exe
  2⤵
  PID:5768
- C:\Windows\System\NEGFLtA.exe
  C:\Windows\System\NEGFLtA.exe
  2⤵
  PID:5832
- C:\Windows\System\wjIauzH.exe
  C:\Windows\System\wjIauzH.exe
  2⤵
  PID:5896
- C:\Windows\System\BsHyOox.exe
  C:\Windows\System\BsHyOox.exe
  2⤵
  PID:5960
- C:\Windows\System\GTQWnpn.exe
  C:\Windows\System\GTQWnpn.exe
  2⤵
  PID:6056
- C:\Windows\System\ScPlzPV.exe
  C:\Windows\System\ScPlzPV.exe
  2⤵
  PID:4640
- C:\Windows\System\wOXCkCZ.exe
  C:\Windows\System\wOXCkCZ.exe
  2⤵
  PID:3548
- C:\Windows\System\tmCJieX.exe
  C:\Windows\System\tmCJieX.exe
  2⤵
  PID:1648
- C:\Windows\System\IsJlfDE.exe
  C:\Windows\System\IsJlfDE.exe
  2⤵
  PID:5284
- C:\Windows\System\DAaJoiA.exe
  C:\Windows\System\DAaJoiA.exe
  2⤵
  PID:5396
- C:\Windows\System\tHOHcRB.exe
  C:\Windows\System\tHOHcRB.exe
  2⤵
  PID:5616
- C:\Windows\System\yzZtlzt.exe
  C:\Windows\System\yzZtlzt.exe
  2⤵
  PID:5816
- C:\Windows\System\jPOBBOV.exe
  C:\Windows\System\jPOBBOV.exe
  2⤵
  PID:2304
- C:\Windows\System\HFTHKON.exe
  C:\Windows\System\HFTHKON.exe
  2⤵
  PID:5604
- C:\Windows\System\lccXsgX.exe
  C:\Windows\System\lccXsgX.exe
  2⤵
  PID:5664
- C:\Windows\System\yoTzMzb.exe
  C:\Windows\System\yoTzMzb.exe
  2⤵
  PID:5780
- C:\Windows\System\NfXmpHe.exe
  C:\Windows\System\NfXmpHe.exe
  2⤵
  PID:5376
- C:\Windows\System\LWqboVH.exe
  C:\Windows\System\LWqboVH.exe
  2⤵
  PID:5864
- C:\Windows\System\YRQXIHp.exe
  C:\Windows\System\YRQXIHp.exe
  2⤵
  PID:6020
- C:\Windows\System\EWKXDuG.exe
  C:\Windows\System\EWKXDuG.exe
  2⤵
  PID:2692
- C:\Windows\System\LQirtjy.exe
  C:\Windows\System\LQirtjy.exe
  2⤵
  PID:5472
- C:\Windows\System\ucQmtdt.exe
  C:\Windows\System\ucQmtdt.exe
  2⤵
  PID:2232
- C:\Windows\System\reOZFRV.exe
  C:\Windows\System\reOZFRV.exe
  2⤵
  PID:6040
- C:\Windows\System\KJVtijq.exe
  C:\Windows\System\KJVtijq.exe
  2⤵
  PID:5584
- C:\Windows\System\OyDZcus.exe
  C:\Windows\System\OyDZcus.exe
  2⤵
  PID:1436
- C:\Windows\System\dOuTmpr.exe
  C:\Windows\System\dOuTmpr.exe
  2⤵
  PID:1976
- C:\Windows\System\qmYfHyL.exe
  C:\Windows\System\qmYfHyL.exe
  2⤵
  PID:5296
- C:\Windows\System\DfFoXpj.exe
  C:\Windows\System\DfFoXpj.exe
  2⤵
  PID:5716
- C:\Windows\System\qynWhKZ.exe
  C:\Windows\System\qynWhKZ.exe
  2⤵
  PID:6116
- C:\Windows\System\PODrsvr.exe
  C:\Windows\System\PODrsvr.exe
  2⤵
  PID:5812
- C:\Windows\System\hInEDZg.exe
  C:\Windows\System\hInEDZg.exe
  2⤵
  PID:6120
- C:\Windows\System\UXvwzlp.exe
  C:\Windows\System\UXvwzlp.exe
  2⤵
  PID:2788
- C:\Windows\System\HURvdce.exe
  C:\Windows\System\HURvdce.exe
  2⤵
  PID:6024
- C:\Windows\System\zOGtxAX.exe
  C:\Windows\System\zOGtxAX.exe
  2⤵
  PID:5956
- C:\Windows\System\uaMybMN.exe
  C:\Windows\System\uaMybMN.exe
  2⤵
  PID:784
- C:\Windows\System\buxOuey.exe
  C:\Windows\System\buxOuey.exe
  2⤵
  PID:5392
- C:\Windows\System\DNpLOrU.exe
  C:\Windows\System\DNpLOrU.exe
  2⤵
  PID:6036
- C:\Windows\System\XueObLN.exe
  C:\Windows\System\XueObLN.exe
  2⤵
  PID:2888
- C:\Windows\System\VgVEzri.exe
  C:\Windows\System\VgVEzri.exe
  2⤵
  PID:6160
- C:\Windows\System\btMRjhY.exe
  C:\Windows\System\btMRjhY.exe
  2⤵
  PID:6176
- C:\Windows\System\SwudjVg.exe
  C:\Windows\System\SwudjVg.exe
  2⤵
  PID:6196
- C:\Windows\System\RVLHsUB.exe
  C:\Windows\System\RVLHsUB.exe
  2⤵
  PID:6212
- C:\Windows\System\YrCuKAp.exe
  C:\Windows\System\YrCuKAp.exe
  2⤵
  PID:6228
- C:\Windows\System\vUVwqKG.exe
  C:\Windows\System\vUVwqKG.exe
  2⤵
  PID:6244
- C:\Windows\System\sYqWgEm.exe
  C:\Windows\System\sYqWgEm.exe
  2⤵
  PID:6260
- C:\Windows\System\Xtltmcc.exe
  C:\Windows\System\Xtltmcc.exe
  2⤵
  PID:6276
- C:\Windows\System\gmoIjNy.exe
  C:\Windows\System\gmoIjNy.exe
  2⤵
  PID:6296
- C:\Windows\System\ksdcQsA.exe
  C:\Windows\System\ksdcQsA.exe
  2⤵
  PID:6312
- C:\Windows\System\FBShAGF.exe
  C:\Windows\System\FBShAGF.exe
  2⤵
  PID:6332
- C:\Windows\System\MEKTjin.exe
  C:\Windows\System\MEKTjin.exe
  2⤵
  PID:6348
- C:\Windows\System\QjTznhj.exe
  C:\Windows\System\QjTznhj.exe
  2⤵
  PID:6364
- C:\Windows\System\pGGuwHp.exe
  C:\Windows\System\pGGuwHp.exe
  2⤵
  PID:6380
- C:\Windows\System\ywiKFRX.exe
  C:\Windows\System\ywiKFRX.exe
  2⤵
  PID:6396
- C:\Windows\System\HvyfHxU.exe
  C:\Windows\System\HvyfHxU.exe
  2⤵
  PID:6412
- C:\Windows\System\yPxIdDR.exe
  C:\Windows\System\yPxIdDR.exe
  2⤵
  PID:6428
- C:\Windows\System\FfBoOPC.exe
  C:\Windows\System\FfBoOPC.exe
  2⤵
  PID:6444
- C:\Windows\System\CsyyGYC.exe
  C:\Windows\System\CsyyGYC.exe
  2⤵
  PID:6460
- C:\Windows\System\wftmCyQ.exe
  C:\Windows\System\wftmCyQ.exe
  2⤵
  PID:6476
- C:\Windows\System\MEgdwZw.exe
  C:\Windows\System\MEgdwZw.exe
  2⤵
  PID:6492
- C:\Windows\System\BfABjjF.exe
  C:\Windows\System\BfABjjF.exe
  2⤵
  PID:6508
- C:\Windows\System\CXjfOuv.exe
  C:\Windows\System\CXjfOuv.exe
  2⤵
  PID:6524
- C:\Windows\System\PfYcokB.exe
  C:\Windows\System\PfYcokB.exe
  2⤵
  PID:6540
- C:\Windows\System\muVjyfs.exe
  C:\Windows\System\muVjyfs.exe
  2⤵
  PID:6556
- C:\Windows\System\pDqJLbM.exe
  C:\Windows\System\pDqJLbM.exe
  2⤵
  PID:6572
- C:\Windows\System\wGyfElZ.exe
  C:\Windows\System\wGyfElZ.exe
  2⤵
  PID:6588
- C:\Windows\System\UWDczga.exe
  C:\Windows\System\UWDczga.exe
  2⤵
  PID:6604
- C:\Windows\System\PSwNiGK.exe
  C:\Windows\System\PSwNiGK.exe
  2⤵
  PID:6620
- C:\Windows\System\JNpogdL.exe
  C:\Windows\System\JNpogdL.exe
  2⤵
  PID:6636
- C:\Windows\System\szAVBSe.exe
  C:\Windows\System\szAVBSe.exe
  2⤵
  PID:6652
- C:\Windows\System\JoHpdwF.exe
  C:\Windows\System\JoHpdwF.exe
  2⤵
  PID:6668
- C:\Windows\System\ZKXcXwH.exe
  C:\Windows\System\ZKXcXwH.exe
  2⤵
  PID:6684
- C:\Windows\System\hkJpGYB.exe
  C:\Windows\System\hkJpGYB.exe
  2⤵
  PID:6724
- C:\Windows\System\henQvmN.exe
  C:\Windows\System\henQvmN.exe
  2⤵
  PID:6748
- C:\Windows\System\ycugCNS.exe
  C:\Windows\System\ycugCNS.exe
  2⤵
  PID:6764
- C:\Windows\System\ZbOSsze.exe
  C:\Windows\System\ZbOSsze.exe
  2⤵
  PID:6780
- C:\Windows\System\HYWvspb.exe
  C:\Windows\System\HYWvspb.exe
  2⤵
  PID:6796
- C:\Windows\System\fBrRAXa.exe
  C:\Windows\System\fBrRAXa.exe
  2⤵
  PID:6812
- C:\Windows\System\ZPDWOIz.exe
  C:\Windows\System\ZPDWOIz.exe
  2⤵
  PID:6828
- C:\Windows\System\tLVtesX.exe
  C:\Windows\System\tLVtesX.exe
  2⤵
  PID:6844
- C:\Windows\System\tvgMyXp.exe
  C:\Windows\System\tvgMyXp.exe
  2⤵
  PID:6860
- C:\Windows\System\vXwHExW.exe
  C:\Windows\System\vXwHExW.exe
  2⤵
  PID:6876
- C:\Windows\System\iydJVXt.exe
  C:\Windows\System\iydJVXt.exe
  2⤵
  PID:6892
- C:\Windows\System\MQcMUyy.exe
  C:\Windows\System\MQcMUyy.exe
  2⤵
  PID:6908
- C:\Windows\System\rjqeZWc.exe
  C:\Windows\System\rjqeZWc.exe
  2⤵
  PID:6924
- C:\Windows\System\IerIHag.exe
  C:\Windows\System\IerIHag.exe
  2⤵
  PID:6940
- C:\Windows\System\ieTcuYK.exe
  C:\Windows\System\ieTcuYK.exe
  2⤵
  PID:6956
- C:\Windows\System\uZWPMzy.exe
  C:\Windows\System\uZWPMzy.exe
  2⤵
  PID:6168
- C:\Windows\System\heeZggg.exe
  C:\Windows\System\heeZggg.exe
  2⤵
  PID:6256
- C:\Windows\System\BzOgErj.exe
  C:\Windows\System\BzOgErj.exe
  2⤵
  PID:6324
- C:\Windows\System\UJYLbgO.exe
  C:\Windows\System\UJYLbgO.exe
  2⤵
  PID:6520
- C:\Windows\System\mdanWkm.exe
  C:\Windows\System\mdanWkm.exe
  2⤵
  PID:6376
- C:\Windows\System\TaLWeyY.exe
  C:\Windows\System\TaLWeyY.exe
  2⤵
  PID:6868
- C:\Windows\System\VPJAtOC.exe
  C:\Windows\System\VPJAtOC.exe
  2⤵
  PID:7072
- C:\Windows\System\bnvuooj.exe
  C:\Windows\System\bnvuooj.exe
  2⤵
  PID:7156
- C:\Windows\System\PxkVYrp.exe
  C:\Windows\System\PxkVYrp.exe
  2⤵
  PID:2796
- C:\Windows\System\QbAgCmu.exe
  C:\Windows\System\QbAgCmu.exe
  2⤵
  PID:5892
- C:\Windows\System\EQipOvB.exe
  C:\Windows\System\EQipOvB.exe
  2⤵
  PID:6172
- C:\Windows\System\gXsxeGI.exe
  C:\Windows\System\gXsxeGI.exe
  2⤵
  PID:6356
- C:\Windows\System\CPZStaP.exe
  C:\Windows\System\CPZStaP.exe
  2⤵
  PID:6552
- C:\Windows\System\bNvcApx.exe
  C:\Windows\System\bNvcApx.exe
  2⤵
  PID:6340
- C:\Windows\System\TVckDxn.exe
  C:\Windows\System\TVckDxn.exe
  2⤵
  PID:6548
- C:\Windows\System\yPxdRnu.exe
  C:\Windows\System\yPxdRnu.exe
  2⤵
  PID:6304
- C:\Windows\System\bbTwciv.exe
  C:\Windows\System\bbTwciv.exe
  2⤵
  PID:6984
- C:\Windows\System\zyBOgKc.exe
  C:\Windows\System\zyBOgKc.exe
  2⤵
  PID:6976
- C:\Windows\System\BpXaCAU.exe
  C:\Windows\System\BpXaCAU.exe
  2⤵
  PID:2740
- C:\Windows\System\HpCNeEP.exe
  C:\Windows\System\HpCNeEP.exe
  2⤵
  PID:7012
- C:\Windows\System\CzxICcC.exe
  C:\Windows\System\CzxICcC.exe
  2⤵
  PID:7036
- C:\Windows\System\yMJbbgj.exe
  C:\Windows\System\yMJbbgj.exe
  2⤵
  PID:7040
- C:\Windows\System\EcIKBMG.exe
  C:\Windows\System\EcIKBMG.exe
  2⤵
  PID:7128
- C:\Windows\System\PDvxNOY.exe
  C:\Windows\System\PDvxNOY.exe
  2⤵
  PID:7088
- C:\Windows\System\pnWSSPf.exe
  C:\Windows\System\pnWSSPf.exe
  2⤵
  PID:7112
- C:\Windows\System\trlAhEd.exe
  C:\Windows\System\trlAhEd.exe
  2⤵
  PID:7060
- C:\Windows\System\DHGmREq.exe
  C:\Windows\System\DHGmREq.exe
  2⤵
  PID:7096
- C:\Windows\System\kvuSyjT.exe
  C:\Windows\System\kvuSyjT.exe
  2⤵
  PID:6152
- C:\Windows\System\AkLtAAj.exe
  C:\Windows\System\AkLtAAj.exe
  2⤵
  PID:7160
- C:\Windows\System\fsKxLRI.exe
  C:\Windows\System\fsKxLRI.exe
  2⤵
  PID:7028
- C:\Windows\System\VxtJvFF.exe
  C:\Windows\System\VxtJvFF.exe
  2⤵
  PID:6288
- C:\Windows\System\jeQtZbP.exe
  C:\Windows\System\jeQtZbP.exe
  2⤵
  PID:6484
- C:\Windows\System\qRrYWRQ.exe
  C:\Windows\System\qRrYWRQ.exe
  2⤵
  PID:6292
- C:\Windows\System\AiHwiOW.exe
  C:\Windows\System\AiHwiOW.exe
  2⤵
  PID:6424
- C:\Windows\System\vcjXViA.exe
  C:\Windows\System\vcjXViA.exe
  2⤵
  PID:6268
- C:\Windows\System\CjSxTyi.exe
  C:\Windows\System\CjSxTyi.exe
  2⤵
  PID:6932
- C:\Windows\System\ecSjepT.exe
  C:\Windows\System\ecSjepT.exe
  2⤵
  PID:6904
- C:\Windows\System\eiwBEgh.exe
  C:\Windows\System\eiwBEgh.exe
  2⤵
  PID:6840
- C:\Windows\System\tePqcpr.exe
  C:\Windows\System\tePqcpr.exe
  2⤵
  PID:6884
- C:\Windows\System\pfqgixN.exe
  C:\Windows\System\pfqgixN.exe
  2⤵
  PID:6852
- C:\Windows\System\EVpAAcD.exe
  C:\Windows\System\EVpAAcD.exe
  2⤵
  PID:6980
- C:\Windows\System\VznIdFV.exe
  C:\Windows\System\VznIdFV.exe
  2⤵
  PID:6320
- C:\Windows\System\EPgpSiW.exe
  C:\Windows\System\EPgpSiW.exe
  2⤵
  PID:7144
- C:\Windows\System\xdGkFGE.exe
  C:\Windows\System\xdGkFGE.exe
  2⤵
  PID:7100
- C:\Windows\System\XJOdxUO.exe
  C:\Windows\System\XJOdxUO.exe
  2⤵
  PID:7020
- C:\Windows\System\AaMCPaU.exe
  C:\Windows\System\AaMCPaU.exe
  2⤵
  PID:2688
- C:\Windows\System\gzvQaha.exe
  C:\Windows\System\gzvQaha.exe
  2⤵
  PID:6188
- C:\Windows\System\vrmIQeQ.exe
  C:\Windows\System\vrmIQeQ.exe
  2⤵
  PID:6372
- C:\Windows\System\RwYNzjr.exe
  C:\Windows\System\RwYNzjr.exe
  2⤵
  PID:6388
- C:\Windows\System\ywaDNcU.exe
  C:\Windows\System\ywaDNcU.exe
  2⤵
  PID:6820
- C:\Windows\System\KGKSwNZ.exe
  C:\Windows\System\KGKSwNZ.exe
  2⤵
  PID:6156
- C:\Windows\System\WkDFzHc.exe
  C:\Windows\System\WkDFzHc.exe
  2⤵
  PID:4400
- C:\Windows\System\dQAvzlL.exe
  C:\Windows\System\dQAvzlL.exe
  2⤵
  PID:7176
- C:\Windows\System\AvEcUfH.exe
  C:\Windows\System\AvEcUfH.exe
  2⤵
  PID:7196
- C:\Windows\System\QMSFGXA.exe
  C:\Windows\System\QMSFGXA.exe
  2⤵
  PID:7220
- C:\Windows\System\GxCYrOv.exe
  C:\Windows\System\GxCYrOv.exe
  2⤵
  PID:7240
- C:\Windows\System\WevntZm.exe
  C:\Windows\System\WevntZm.exe
  2⤵
  PID:7272
- C:\Windows\System\cFPkDZa.exe
  C:\Windows\System\cFPkDZa.exe
  2⤵
  PID:7288
- C:\Windows\System\FlgNCtB.exe
  C:\Windows\System\FlgNCtB.exe
  2⤵
  PID:7308
- C:\Windows\System\eLdAlzf.exe
  C:\Windows\System\eLdAlzf.exe
  2⤵
  PID:7324
- C:\Windows\System\RPduTdg.exe
  C:\Windows\System\RPduTdg.exe
  2⤵
  PID:7340
- C:\Windows\System\BfFIOUv.exe
  C:\Windows\System\BfFIOUv.exe
  2⤵
  PID:7356
- C:\Windows\System\FwOyNGi.exe
  C:\Windows\System\FwOyNGi.exe
  2⤵
  PID:7372
- C:\Windows\System\JOtWgse.exe
  C:\Windows\System\JOtWgse.exe
  2⤵
  PID:7396
- C:\Windows\System\IWbsQVc.exe
  C:\Windows\System\IWbsQVc.exe
  2⤵
  PID:7412
- C:\Windows\System\pnRdBnj.exe
  C:\Windows\System\pnRdBnj.exe
  2⤵
  PID:7432
- C:\Windows\System\sKJDiWl.exe
  C:\Windows\System\sKJDiWl.exe
  2⤵
  PID:7452
- C:\Windows\System\RhsQrdp.exe
  C:\Windows\System\RhsQrdp.exe
  2⤵
  PID:7468
- C:\Windows\System\jhTLoNA.exe
  C:\Windows\System\jhTLoNA.exe
  2⤵
  PID:7484
- C:\Windows\System\FMEfuwH.exe
  C:\Windows\System\FMEfuwH.exe
  2⤵
  PID:7500
- C:\Windows\System\WQGYmEg.exe
  C:\Windows\System\WQGYmEg.exe
  2⤵
  PID:7516
- C:\Windows\System\ubuUWCi.exe
  C:\Windows\System\ubuUWCi.exe
  2⤵
  PID:7700
- C:\Windows\System\cZYajKZ.exe
  C:\Windows\System\cZYajKZ.exe
  2⤵
  PID:7716
- C:\Windows\System\yDMmgZL.exe
  C:\Windows\System\yDMmgZL.exe
  2⤵
  PID:7732
- C:\Windows\System\kuMPMSv.exe
  C:\Windows\System\kuMPMSv.exe
  2⤵
  PID:7752
- C:\Windows\System\xsUymTY.exe
  C:\Windows\System\xsUymTY.exe
  2⤵
  PID:7768
- C:\Windows\System\iNALdzh.exe
  C:\Windows\System\iNALdzh.exe
  2⤵
  PID:7784
- C:\Windows\System\tnyyQwD.exe
  C:\Windows\System\tnyyQwD.exe
  2⤵
  PID:7800
- C:\Windows\System\ZSBOMJG.exe
  C:\Windows\System\ZSBOMJG.exe
  2⤵
  PID:7824
- C:\Windows\System\UHtgAnt.exe
  C:\Windows\System\UHtgAnt.exe
  2⤵
  PID:7860
- C:\Windows\System\xRRLfxO.exe
  C:\Windows\System\xRRLfxO.exe
  2⤵
  PID:7904
- C:\Windows\System\oEvgNOF.exe
  C:\Windows\System\oEvgNOF.exe
  2⤵
  PID:7920
- C:\Windows\System\ERsievq.exe
  C:\Windows\System\ERsievq.exe
  2⤵
  PID:7936
- C:\Windows\System\hWuEiop.exe
  C:\Windows\System\hWuEiop.exe
  2⤵
  PID:7956
- C:\Windows\System\CNyTwir.exe
  C:\Windows\System\CNyTwir.exe
  2⤵
  PID:7972
- C:\Windows\System\xOsmxjv.exe
  C:\Windows\System\xOsmxjv.exe
  2⤵
  PID:7988
- C:\Windows\System\OGtbFLF.exe
  C:\Windows\System\OGtbFLF.exe
  2⤵
  PID:8008
- C:\Windows\System\KYZBYFf.exe
  C:\Windows\System\KYZBYFf.exe
  2⤵
  PID:8024
- C:\Windows\System\kDgkFWj.exe
  C:\Windows\System\kDgkFWj.exe
  2⤵
  PID:8040
- C:\Windows\System\jWzjGIj.exe
  C:\Windows\System\jWzjGIj.exe
  2⤵
  PID:8056
- C:\Windows\System\YzHvapG.exe
  C:\Windows\System\YzHvapG.exe
  2⤵
  PID:8076
- C:\Windows\System\MqjTEHM.exe
  C:\Windows\System\MqjTEHM.exe
  2⤵
  PID:7120
- C:\Windows\System\meGjkNj.exe
  C:\Windows\System\meGjkNj.exe
  2⤵
  PID:7216
- C:\Windows\System\hRRbIJN.exe
  C:\Windows\System\hRRbIJN.exe
  2⤵
  PID:6744
- C:\Windows\System\ZYbiZLg.exe
  C:\Windows\System\ZYbiZLg.exe
  2⤵
  PID:2752
- C:\Windows\System\FcTXvpw.exe
  C:\Windows\System\FcTXvpw.exe
  2⤵
  PID:6804
- C:\Windows\System\adFfhzl.exe
  C:\Windows\System\adFfhzl.exe
  2⤵
  PID:2484
- C:\Windows\System\FaDGEtz.exe
  C:\Windows\System\FaDGEtz.exe
  2⤵
  PID:2108
- C:\Windows\System\jXIntZh.exe
  C:\Windows\System\jXIntZh.exe
  2⤵
  PID:2480
- C:\Windows\System\FzqsWxe.exe
  C:\Windows\System\FzqsWxe.exe
  2⤵
  PID:7264
- C:\Windows\System\iwVXsDB.exe
  C:\Windows\System\iwVXsDB.exe
  2⤵
  PID:7248
- C:\Windows\System\OsHcvuj.exe
  C:\Windows\System\OsHcvuj.exe
  2⤵
  PID:7368
- C:\Windows\System\KeALSPG.exe
  C:\Windows\System\KeALSPG.exe
  2⤵
  PID:7476
- C:\Windows\System\WjUQWDG.exe
  C:\Windows\System\WjUQWDG.exe
  2⤵
  PID:7404
- C:\Windows\System\gCaZXdA.exe
  C:\Windows\System\gCaZXdA.exe
  2⤵
  PID:7052
- C:\Windows\System\ZfSZvui.exe
  C:\Windows\System\ZfSZvui.exe
  2⤵
  PID:6240
- C:\Windows\System\sOZflwV.exe
  C:\Windows\System\sOZflwV.exe
  2⤵
  PID:7560
- C:\Windows\System\vEHWbaT.exe
  C:\Windows\System\vEHWbaT.exe
  2⤵
  PID:7608
- C:\Windows\System\PlCzbIi.exe
  C:\Windows\System\PlCzbIi.exe
  2⤵
  PID:7496
- C:\Windows\System\CRiLHsW.exe
  C:\Windows\System\CRiLHsW.exe
  2⤵
  PID:7552
- C:\Windows\System\ARrmeHx.exe
  C:\Windows\System\ARrmeHx.exe
  2⤵
  PID:7576
- C:\Windows\System\YMKCPkI.exe
  C:\Windows\System\YMKCPkI.exe
  2⤵
  PID:7600
- C:\Windows\System\gSECwDk.exe
  C:\Windows\System\gSECwDk.exe
  2⤵
  PID:7284
- C:\Windows\System\DsyaXDz.exe
  C:\Windows\System\DsyaXDz.exe
  2⤵
  PID:7632
- C:\Windows\System\uSBgroa.exe
  C:\Windows\System\uSBgroa.exe
  2⤵
  PID:7648
- C:\Windows\System\gCjHTra.exe
  C:\Windows\System\gCjHTra.exe
  2⤵
  PID:7664
- C:\Windows\System\DVMNtIV.exe
  C:\Windows\System\DVMNtIV.exe
  2⤵
  PID:7688
- C:\Windows\System\EdFpUOO.exe
  C:\Windows\System\EdFpUOO.exe
  2⤵
  PID:7740
- C:\Windows\System\CgEQEhB.exe
  C:\Windows\System\CgEQEhB.exe
  2⤵
  PID:7780
- C:\Windows\System\jIiaxZV.exe
  C:\Windows\System\jIiaxZV.exe
  2⤵
  PID:7812
- C:\Windows\System\xvYcKqG.exe
  C:\Windows\System\xvYcKqG.exe
  2⤵
  PID:7696
- C:\Windows\System\lBpZfhU.exe
  C:\Windows\System\lBpZfhU.exe
  2⤵
  PID:7832
- C:\Windows\System\BvZFkRp.exe
  C:\Windows\System\BvZFkRp.exe
  2⤵
  PID:8084
- C:\Windows\System\bdgCtKN.exe
  C:\Windows\System\bdgCtKN.exe
  2⤵
  PID:8104
- C:\Windows\System\XMFJIRO.exe
  C:\Windows\System\XMFJIRO.exe
  2⤵
  PID:8124
- C:\Windows\System\WSpqXVN.exe
  C:\Windows\System\WSpqXVN.exe
  2⤵
  PID:8140
- C:\Windows\System\YimWCON.exe
  C:\Windows\System\YimWCON.exe
  2⤵
  PID:8156
- C:\Windows\System\XxgnDpc.exe
  C:\Windows\System\XxgnDpc.exe
  2⤵
  PID:7164
- C:\Windows\System\oSfxlsQ.exe
  C:\Windows\System\oSfxlsQ.exe
  2⤵
  PID:8188
- C:\Windows\System\KdmcFMy.exe
  C:\Windows\System\KdmcFMy.exe
  2⤵
  PID:7116
- C:\Windows\System\RkkkQMR.exe
  C:\Windows\System\RkkkQMR.exe
  2⤵
  PID:7212
- C:\Windows\System\idCHGFM.exe
  C:\Windows\System\idCHGFM.exe
  2⤵
  PID:6756
- C:\Windows\System\BydypMy.exe
  C:\Windows\System\BydypMy.exe
  2⤵
  PID:4728
- C:\Windows\System\bdaUDGA.exe
  C:\Windows\System\bdaUDGA.exe
  2⤵
  PID:7024
- C:\Windows\System\bOhOFpe.exe
  C:\Windows\System\bOhOFpe.exe
  2⤵
  PID:7480
- C:\Windows\System\kiqKwIy.exe
  C:\Windows\System\kiqKwIy.exe
  2⤵
  PID:6808
- C:\Windows\System\MAlWCdT.exe
  C:\Windows\System\MAlWCdT.exe
  2⤵
  PID:7536
- C:\Windows\System\prWRxgg.exe
  C:\Windows\System\prWRxgg.exe
  2⤵
  PID:7616
- C:\Windows\System\ITBRIbX.exe
  C:\Windows\System\ITBRIbX.exe
  2⤵
  PID:7776
- C:\Windows\System\gyStlTM.exe
  C:\Windows\System\gyStlTM.exe
  2⤵
  PID:7876
- C:\Windows\System\PXViNjz.exe
  C:\Windows\System\PXViNjz.exe
  2⤵
  PID:7540
- C:\Windows\System\vLxvEMi.exe
  C:\Windows\System\vLxvEMi.exe
  2⤵
  PID:7624
- C:\Windows\System\IIMjQkm.exe
  C:\Windows\System\IIMjQkm.exe
  2⤵
  PID:7708
- C:\Windows\System\BeJihLf.exe
  C:\Windows\System\BeJihLf.exe
  2⤵
  PID:7792
- C:\Windows\System\xGYuapT.exe
  C:\Windows\System\xGYuapT.exe
  2⤵
  PID:7932
- C:\Windows\System\bTPItsm.exe
  C:\Windows\System\bTPItsm.exe
  2⤵
  PID:7964
- C:\Windows\System\dMBiDnX.exe
  C:\Windows\System\dMBiDnX.exe
  2⤵
  PID:8068
- C:\Windows\System\dgZxixD.exe
  C:\Windows\System\dgZxixD.exe
  2⤵
  PID:7844
- C:\Windows\System\SuNYWnU.exe
  C:\Windows\System\SuNYWnU.exe
  2⤵
  PID:7884
- C:\Windows\System\KwItxGo.exe
  C:\Windows\System\KwItxGo.exe
  2⤵
  PID:7912
- C:\Windows\System\RUDeHBN.exe
  C:\Windows\System\RUDeHBN.exe
  2⤵
  PID:7952
- C:\Windows\System\wXfVdso.exe
  C:\Windows\System\wXfVdso.exe
  2⤵
  PID:8020
- C:\Windows\System\TltpCSc.exe
  C:\Windows\System\TltpCSc.exe
  2⤵
  PID:3044
- C:\Windows\System\GaYGuVy.exe
  C:\Windows\System\GaYGuVy.exe
  2⤵
  PID:2072
- C:\Windows\System\YNfkZwz.exe
  C:\Windows\System\YNfkZwz.exe
  2⤵
  PID:7232
- C:\Windows\System\CeTZtZY.exe
  C:\Windows\System\CeTZtZY.exe
  2⤵
  PID:6964
- C:\Windows\System\oNuwoRX.exe
  C:\Windows\System\oNuwoRX.exe
  2⤵
  PID:7348
- C:\Windows\System\Nxltuxg.exe
  C:\Windows\System\Nxltuxg.exe
  2⤵
  PID:7420
- C:\Windows\System\mjbphLC.exe
  C:\Windows\System\mjbphLC.exe
  2⤵
  PID:7492
- C:\Windows\System\bkhkXEj.exe
  C:\Windows\System\bkhkXEj.exe
  2⤵
  PID:7612
- C:\Windows\System\kRseFWZ.exe
  C:\Windows\System\kRseFWZ.exe
  2⤵
  PID:7684
- C:\Windows\System\OqhpGhc.exe
  C:\Windows\System\OqhpGhc.exe
  2⤵
  PID:7660
- C:\Windows\System\igtbqwE.exe
  C:\Windows\System\igtbqwE.exe
  2⤵
  PID:7852
- C:\Windows\System\xMXeRet.exe
  C:\Windows\System\xMXeRet.exe
  2⤵
  PID:7944
- C:\Windows\System\aRfUMwz.exe
  C:\Windows\System\aRfUMwz.exe
  2⤵
  PID:7872
- C:\Windows\System\tTPKmIj.exe
  C:\Windows\System\tTPKmIj.exe
  2⤵
  PID:8016
- C:\Windows\System\xKIFKXC.exe
  C:\Windows\System\xKIFKXC.exe
  2⤵
  PID:7892
- C:\Windows\System\qUacPGJ.exe
  C:\Windows\System\qUacPGJ.exe
  2⤵
  PID:7820
- C:\Windows\System\AavRsbv.exe
  C:\Windows\System\AavRsbv.exe
  2⤵
  PID:8180
- C:\Windows\System\jQHbbKH.exe
  C:\Windows\System\jQHbbKH.exe
  2⤵
  PID:8152
- C:\Windows\System\PAXMdmC.exe
  C:\Windows\System\PAXMdmC.exe
  2⤵
  PID:8132
- C:\Windows\System\bgmSMJV.exe
  C:\Windows\System\bgmSMJV.exe
  2⤵
  PID:1524
- C:\Windows\System\tCkPkbG.exe
  C:\Windows\System\tCkPkbG.exe
  2⤵
  PID:7336
- C:\Windows\System\IOFYYWX.exe
  C:\Windows\System\IOFYYWX.exe
  2⤵
  PID:7260
- C:\Windows\System\FrxRRro.exe
  C:\Windows\System\FrxRRro.exe
  2⤵
  PID:7300
- C:\Windows\System\xoxEMzC.exe
  C:\Windows\System\xoxEMzC.exe
  2⤵
  PID:6612
- C:\Windows\System\qmZnSHh.exe
  C:\Windows\System\qmZnSHh.exe
  2⤵
  PID:6664
- C:\Windows\System\GAIiRQW.exe
  C:\Windows\System\GAIiRQW.exe
  2⤵
  PID:2940
- C:\Windows\System\JfsyeBt.exe
  C:\Windows\System\JfsyeBt.exe
  2⤵
  PID:2808
- C:\Windows\System\uMFjTmN.exe
  C:\Windows\System\uMFjTmN.exe
  2⤵
  PID:7532
- C:\Windows\System\ODeoTLK.exe
  C:\Windows\System\ODeoTLK.exe
  2⤵
  PID:7464
- C:\Windows\System\vOXiSaC.exe
  C:\Windows\System\vOXiSaC.exe
  2⤵
  PID:7388
- C:\Windows\System\FEnIIiH.exe
  C:\Windows\System\FEnIIiH.exe
  2⤵
  PID:8036
- C:\Windows\System\TXWXkxx.exe
  C:\Windows\System\TXWXkxx.exe
  2⤵
  PID:7840
- C:\Windows\System\TuGdngB.exe
  C:\Windows\System\TuGdngB.exe
  2⤵
  PID:8136
- C:\Windows\System\zFsbHsz.exe
  C:\Windows\System\zFsbHsz.exe
  2⤵
  PID:7104
- C:\Windows\System\pXaCXGY.exe
  C:\Windows\System\pXaCXGY.exe
  2⤵
  PID:6272
- C:\Windows\System\VvhJTIU.exe
  C:\Windows\System\VvhJTIU.exe
  2⤵
  PID:7380
- C:\Windows\System\idHOdRx.exe
  C:\Windows\System\idHOdRx.exe
  2⤵
  PID:8064
- C:\Windows\System\aDpERIy.exe
  C:\Windows\System\aDpERIy.exe
  2⤵
  PID:8208
- C:\Windows\System\EhmjmYb.exe
  C:\Windows\System\EhmjmYb.exe
  2⤵
  PID:8224
- C:\Windows\System\hGnwvqs.exe
  C:\Windows\System\hGnwvqs.exe
  2⤵
  PID:8240
- C:\Windows\System\YxISXPr.exe
  C:\Windows\System\YxISXPr.exe
  2⤵
  PID:8256
- C:\Windows\System\RENkIIB.exe
  C:\Windows\System\RENkIIB.exe
  2⤵
  PID:8272
- C:\Windows\System\isjuIkr.exe
  C:\Windows\System\isjuIkr.exe
  2⤵
  PID:8288
- C:\Windows\System\NOLvcon.exe
  C:\Windows\System\NOLvcon.exe
  2⤵
  PID:8304
- C:\Windows\System\MbGGRaQ.exe
  C:\Windows\System\MbGGRaQ.exe
  2⤵
  PID:8320
- C:\Windows\System\Usngxpr.exe
  C:\Windows\System\Usngxpr.exe
  2⤵
  PID:8336
- C:\Windows\System\KRaFHFX.exe
  C:\Windows\System\KRaFHFX.exe
  2⤵
  PID:8352
- C:\Windows\System\mXqPHLx.exe
  C:\Windows\System\mXqPHLx.exe
  2⤵
  PID:8368
- C:\Windows\System\DZyyHRn.exe
  C:\Windows\System\DZyyHRn.exe
  2⤵
  PID:8384
- C:\Windows\System\BArjBMJ.exe
  C:\Windows\System\BArjBMJ.exe
  2⤵
  PID:8400
- C:\Windows\System\enTCMLR.exe
  C:\Windows\System\enTCMLR.exe
  2⤵
  PID:8416
- C:\Windows\System\YMDxUlp.exe
  C:\Windows\System\YMDxUlp.exe
  2⤵
  PID:8432
- C:\Windows\System\CyArwlJ.exe
  C:\Windows\System\CyArwlJ.exe
  2⤵
  PID:8448
- C:\Windows\System\UOIjStw.exe
  C:\Windows\System\UOIjStw.exe
  2⤵
  PID:8464
- C:\Windows\System\MmKsPKh.exe
  C:\Windows\System\MmKsPKh.exe
  2⤵
  PID:8480
- C:\Windows\System\tboIuNe.exe
  C:\Windows\System\tboIuNe.exe
  2⤵
  PID:8496
- C:\Windows\System\RtnNnBG.exe
  C:\Windows\System\RtnNnBG.exe
  2⤵
  PID:8512
- C:\Windows\System\mJCpMJf.exe
  C:\Windows\System\mJCpMJf.exe
  2⤵
  PID:8528
- C:\Windows\System\NRWBdwx.exe
  C:\Windows\System\NRWBdwx.exe
  2⤵
  PID:8548
- C:\Windows\System\POOgRSq.exe
  C:\Windows\System\POOgRSq.exe
  2⤵
  PID:8568
- C:\Windows\System\rhaOzjS.exe
  C:\Windows\System\rhaOzjS.exe
  2⤵
  PID:8584
- C:\Windows\System\XADHtCg.exe
  C:\Windows\System\XADHtCg.exe
  2⤵
  PID:8600
- C:\Windows\System\FyQjqBd.exe
  C:\Windows\System\FyQjqBd.exe
  2⤵
  PID:8616
- C:\Windows\System\CthojgT.exe
  C:\Windows\System\CthojgT.exe
  2⤵
  PID:8632
- C:\Windows\System\hObqUKY.exe
  C:\Windows\System\hObqUKY.exe
  2⤵
  PID:8648
- C:\Windows\System\PqLIJSA.exe
  C:\Windows\System\PqLIJSA.exe
  2⤵
  PID:8664
- C:\Windows\System\DjAQRbr.exe
  C:\Windows\System\DjAQRbr.exe
  2⤵
  PID:8680
- C:\Windows\System\xPRJdSc.exe
  C:\Windows\System\xPRJdSc.exe
  2⤵
  PID:8696
- C:\Windows\System\IItiSQn.exe
  C:\Windows\System\IItiSQn.exe
  2⤵
  PID:8712
- C:\Windows\System\BMVPRGl.exe
  C:\Windows\System\BMVPRGl.exe
  2⤵
  PID:8728
- C:\Windows\System\puRRVvg.exe
  C:\Windows\System\puRRVvg.exe
  2⤵
  PID:8744
- C:\Windows\System\YfElLXs.exe
  C:\Windows\System\YfElLXs.exe
  2⤵
  PID:8760
- C:\Windows\System\trvweWn.exe
  C:\Windows\System\trvweWn.exe
  2⤵
  PID:8776
- C:\Windows\System\Nvdaihx.exe
  C:\Windows\System\Nvdaihx.exe
  2⤵
  PID:8792
- C:\Windows\System\AoKmwYp.exe
  C:\Windows\System\AoKmwYp.exe
  2⤵
  PID:8808
- C:\Windows\System\XpaprCI.exe
  C:\Windows\System\XpaprCI.exe
  2⤵
  PID:8824
- C:\Windows\System\YrzHEDO.exe
  C:\Windows\System\YrzHEDO.exe
  2⤵
  PID:8840
- C:\Windows\System\PqflTfJ.exe
  C:\Windows\System\PqflTfJ.exe
  2⤵
  PID:8856
- C:\Windows\System\MOPyeWi.exe
  C:\Windows\System\MOPyeWi.exe
  2⤵
  PID:8872
- C:\Windows\System\tBsLZhj.exe
  C:\Windows\System\tBsLZhj.exe
  2⤵
  PID:8888
- C:\Windows\System\eVHBtlE.exe
  C:\Windows\System\eVHBtlE.exe
  2⤵
  PID:8904
- C:\Windows\System\xJabzsR.exe
  C:\Windows\System\xJabzsR.exe
  2⤵
  PID:8920
- C:\Windows\System\RNtimqd.exe
  C:\Windows\System\RNtimqd.exe
  2⤵
  PID:8936
- C:\Windows\System\DZkrwbD.exe
  C:\Windows\System\DZkrwbD.exe
  2⤵
  PID:8952
- C:\Windows\System\ILRlIUv.exe
  C:\Windows\System\ILRlIUv.exe
  2⤵
  PID:8968
- C:\Windows\System\UuQIONh.exe
  C:\Windows\System\UuQIONh.exe
  2⤵
  PID:8984
- C:\Windows\System\UmWNAyQ.exe
  C:\Windows\System\UmWNAyQ.exe
  2⤵
  PID:9000
- C:\Windows\System\lbdCivn.exe
  C:\Windows\System\lbdCivn.exe
  2⤵
  PID:9016
- C:\Windows\System\rwBwJcj.exe
  C:\Windows\System\rwBwJcj.exe
  2⤵
  PID:9032
- C:\Windows\System\uqjBNRd.exe
  C:\Windows\System\uqjBNRd.exe
  2⤵
  PID:9048
- C:\Windows\System\rMbvmuD.exe
  C:\Windows\System\rMbvmuD.exe
  2⤵
  PID:9064
- C:\Windows\System\KilxhcP.exe
  C:\Windows\System\KilxhcP.exe
  2⤵
  PID:9080
- C:\Windows\System\CCeazMk.exe
  C:\Windows\System\CCeazMk.exe
  2⤵
  PID:9096
- C:\Windows\System\VJZKCml.exe
  C:\Windows\System\VJZKCml.exe
  2⤵
  PID:9112
- C:\Windows\System\CFRBghJ.exe
  C:\Windows\System\CFRBghJ.exe
  2⤵
  PID:9132
- C:\Windows\System\VgWwhKT.exe
  C:\Windows\System\VgWwhKT.exe
  2⤵
  PID:9148
- C:\Windows\System\wcEOynK.exe
  C:\Windows\System\wcEOynK.exe
  2⤵
  PID:9164
- C:\Windows\System\mtmoVOh.exe
  C:\Windows\System\mtmoVOh.exe
  2⤵
  PID:9180
- C:\Windows\System\XdOevXY.exe
  C:\Windows\System\XdOevXY.exe
  2⤵
  PID:9196
- C:\Windows\System\tCIxBsa.exe
  C:\Windows\System\tCIxBsa.exe
  2⤵
  PID:9212
- C:\Windows\System\mmHZmLn.exe
  C:\Windows\System\mmHZmLn.exe
  2⤵
  PID:6584
- C:\Windows\System\djZRdLc.exe
  C:\Windows\System\djZRdLc.exe
  2⤵
  PID:8220
- C:\Windows\System\BFbquQi.exe
  C:\Windows\System\BFbquQi.exe
  2⤵
  PID:8312
- C:\Windows\System\ZjGBwkq.exe
  C:\Windows\System\ZjGBwkq.exe
  2⤵
  PID:7816
- C:\Windows\System\rGsizzI.exe
  C:\Windows\System\rGsizzI.exe
  2⤵
  PID:7064
- C:\Windows\System\MoiCGXA.exe
  C:\Windows\System\MoiCGXA.exe
  2⤵
  PID:8408
- C:\Windows\System\pTuXpQf.exe
  C:\Windows\System\pTuXpQf.exe
  2⤵
  PID:8444
- C:\Windows\System\RUxxZdz.exe
  C:\Windows\System\RUxxZdz.exe
  2⤵
  PID:6648
- C:\Windows\System\gRZYpTv.exe
  C:\Windows\System\gRZYpTv.exe
  2⤵
  PID:6888
- C:\Windows\System\XGZsEIg.exe
  C:\Windows\System\XGZsEIg.exe
  2⤵
  PID:6772
- C:\Windows\System\yIhSMvB.exe
  C:\Windows\System\yIhSMvB.exe
  2⤵
  PID:7656
- C:\Windows\System\uTzcAbF.exe
  C:\Windows\System\uTzcAbF.exe
  2⤵
  PID:8100
- C:\Windows\System\RtflxSi.exe
  C:\Windows\System\RtflxSi.exe
  2⤵
  PID:6948
- C:\Windows\System\zOFlZEO.exe
  C:\Windows\System\zOFlZEO.exe
  2⤵
  PID:7384
- C:\Windows\System\rBxHStR.exe
  C:\Windows\System\rBxHStR.exe
  2⤵
  PID:8204
- C:\Windows\System\cHlrxmB.exe
  C:\Windows\System\cHlrxmB.exe
  2⤵
  PID:8268
- C:\Windows\System\RuCZGyb.exe
  C:\Windows\System\RuCZGyb.exe
  2⤵
  PID:8424
- C:\Windows\System\grzfoyE.exe
  C:\Windows\System\grzfoyE.exe
  2⤵
  PID:8488
- C:\Windows\System\RxmAFWx.exe
  C:\Windows\System\RxmAFWx.exe
  2⤵
  PID:8540
- C:\Windows\System\szQCwbA.exe
  C:\Windows\System\szQCwbA.exe
  2⤵
  PID:8612
- C:\Windows\System\AjNDZWD.exe
  C:\Windows\System\AjNDZWD.exe
  2⤵
  PID:8672
- C:\Windows\System\nJrFCcA.exe
  C:\Windows\System\nJrFCcA.exe
  2⤵
  PID:8736
- C:\Windows\System\RxjAsNe.exe
  C:\Windows\System\RxjAsNe.exe
  2⤵
  PID:8804
- C:\Windows\System\FlBVzBI.exe
  C:\Windows\System\FlBVzBI.exe
  2⤵
  PID:8560
- C:\Windows\System\uQSHLFj.exe
  C:\Windows\System\uQSHLFj.exe
  2⤵
  PID:8720
- C:\Windows\System\eGbRXyW.exe
  C:\Windows\System\eGbRXyW.exe
  2⤵
  PID:8592
- C:\Windows\System\SCeeDIU.exe
  C:\Windows\System\SCeeDIU.exe
  2⤵
  PID:9092
- C:\Windows\System\CFDzeNk.exe
  C:\Windows\System\CFDzeNk.exe
  2⤵
  PID:9060
- C:\Windows\System\GidmcTe.exe
  C:\Windows\System\GidmcTe.exe
  2⤵
  PID:9104
- C:\Windows\System\srHPzpi.exe
  C:\Windows\System\srHPzpi.exe
  2⤵
  PID:8252
- C:\Windows\System\NjVwyqQ.exe
  C:\Windows\System\NjVwyqQ.exe
  2⤵
  PID:8376
- C:\Windows\System\tkNaYKN.exe
  C:\Windows\System\tkNaYKN.exe
  2⤵
  PID:7644
- C:\Windows\System\xoqBYxQ.exe
  C:\Windows\System\xoqBYxQ.exe
  2⤵
  PID:7364
- C:\Windows\System\QRdghXp.exe
  C:\Windows\System\QRdghXp.exe
  2⤵
  PID:8328
- C:\Windows\System\sOGDQtH.exe
  C:\Windows\System\sOGDQtH.exe
  2⤵
  PID:8544
- C:\Windows\System\Ytzttvf.exe
  C:\Windows\System\Ytzttvf.exe
  2⤵
  PID:9208
- C:\Windows\System\SLxDwaa.exe
  C:\Windows\System\SLxDwaa.exe
  2⤵
  PID:9140
- C:\Windows\System\pVTYybu.exe
  C:\Windows\System\pVTYybu.exe
  2⤵
  PID:8216
- C:\Windows\System\muzxDAp.exe
  C:\Windows\System\muzxDAp.exe
  2⤵
  PID:8344
- C:\Windows\System\JLsGEBv.exe
  C:\Windows\System\JLsGEBv.exe
  2⤵
  PID:8644
- C:\Windows\System\TBFobhA.exe
  C:\Windows\System\TBFobhA.exe
  2⤵
  PID:8392
- C:\Windows\System\RzTHxzJ.exe
  C:\Windows\System\RzTHxzJ.exe
  2⤵
  PID:8264
- C:\Windows\System\scTcRoK.exe
  C:\Windows\System\scTcRoK.exe
  2⤵
  PID:8580
- C:\Windows\System\jAayAFn.exe
  C:\Windows\System\jAayAFn.exe
  2⤵
  PID:8784
- C:\Windows\System\oGNQrAD.exe
  C:\Windows\System\oGNQrAD.exe
  2⤵
  PID:8788
- C:\Windows\System\ZLrhOMi.exe
  C:\Windows\System\ZLrhOMi.exe
  2⤵
  PID:8756
- C:\Windows\System\CVfOIFG.exe
  C:\Windows\System\CVfOIFG.exe
  2⤵
  PID:8852
- C:\Windows\System\cyLaTDC.exe
  C:\Windows\System\cyLaTDC.exe
  2⤵
  PID:8880
- C:\Windows\System\wJzkskT.exe
  C:\Windows\System\wJzkskT.exe
  2⤵
  PID:8928
- C:\Windows\System\QZAwNEq.exe
  C:\Windows\System\QZAwNEq.exe
  2⤵
  PID:8916
- C:\Windows\System\wppIKQU.exe
  C:\Windows\System\wppIKQU.exe
  2⤵
  PID:9040
- C:\Windows\System\vwNcJTm.exe
  C:\Windows\System\vwNcJTm.exe
  2⤵
  PID:9008
- C:\Windows\System\fGqoGJX.exe
  C:\Windows\System\fGqoGJX.exe
  2⤵
  PID:9124
- C:\Windows\System\UkBBVfs.exe
  C:\Windows\System\UkBBVfs.exe
  2⤵
  PID:8168
- C:\Windows\System\QrSMQzn.exe
  C:\Windows\System\QrSMQzn.exe
  2⤵
  PID:8092
- C:\Windows\System\rlTcrIN.exe
  C:\Windows\System\rlTcrIN.exe
  2⤵
  PID:8316
- C:\Windows\System\PNppjvl.exe
  C:\Windows\System\PNppjvl.exe
  2⤵
  PID:9128
- C:\Windows\System\GnjCmfW.exe
  C:\Windows\System\GnjCmfW.exe
  2⤵
  PID:8164
- C:\Windows\System\kbVwvIT.exe
  C:\Windows\System\kbVwvIT.exe
  2⤵
  PID:8200
- C:\Windows\System\zIPtmbv.exe
  C:\Windows\System\zIPtmbv.exe
  2⤵
  PID:7728
- C:\Windows\System\RFySaiY.exe
  C:\Windows\System\RFySaiY.exe
  2⤵
  PID:8708
- C:\Windows\System\OmCurWX.exe
  C:\Windows\System\OmCurWX.exe
  2⤵
  PID:8848
- C:\Windows\System\pqjxBlT.exe
  C:\Windows\System\pqjxBlT.exe
  2⤵
  PID:8996
- C:\Windows\System\OlBAyDZ.exe
  C:\Windows\System\OlBAyDZ.exe
  2⤵
  PID:8232
- C:\Windows\System\MUtalIJ.exe
  C:\Windows\System\MUtalIJ.exe
  2⤵
  PID:8980
- C:\Windows\System\EdZCNjw.exe
  C:\Windows\System\EdZCNjw.exe
  2⤵
  PID:9088
- C:\Windows\System\zRenMkY.exe
  C:\Windows\System\zRenMkY.exe
  2⤵
  PID:7304
- C:\Windows\System\pphGvyr.exe
  C:\Windows\System\pphGvyr.exe
  2⤵
  PID:8836
- C:\Windows\System\iWFKwfn.exe
  C:\Windows\System\iWFKwfn.exe
  2⤵
  PID:8348
- C:\Windows\System\wgNRHNH.exe
  C:\Windows\System\wgNRHNH.exe
  2⤵
  PID:8556
- C:\Windows\System\gNBQzFh.exe
  C:\Windows\System\gNBQzFh.exe
  2⤵
  PID:8396
- C:\Windows\System\aCKJeRy.exe
  C:\Windows\System\aCKJeRy.exe
  2⤵
  PID:8460
- C:\Windows\System\VvOrnau.exe
  C:\Windows\System\VvOrnau.exe
  2⤵
  PID:9012
- C:\Windows\System\SCbAlwA.exe
  C:\Windows\System\SCbAlwA.exe
  2⤵
  PID:9028
- C:\Windows\System\HHjRpUT.exe
  C:\Windows\System\HHjRpUT.exe
  2⤵
  PID:2968
- C:\Windows\System\eVTZWrs.exe
  C:\Windows\System\eVTZWrs.exe
  2⤵
  PID:8628
- C:\Windows\System\zzoQwcm.exe
  C:\Windows\System\zzoQwcm.exe
  2⤵
  PID:7928
- C:\Windows\System\dUZSPCY.exe
  C:\Windows\System\dUZSPCY.exe
  2⤵
  PID:9220
- C:\Windows\System\wqLMVvA.exe
  C:\Windows\System\wqLMVvA.exe
  2⤵
  PID:9236
- C:\Windows\System\abmjuuC.exe
  C:\Windows\System\abmjuuC.exe
  2⤵
  PID:9252
- C:\Windows\System\eqBRXFq.exe
  C:\Windows\System\eqBRXFq.exe
  2⤵
  PID:9268
- C:\Windows\System\nHmvUQy.exe
  C:\Windows\System\nHmvUQy.exe
  2⤵
  PID:9284
- C:\Windows\System\sRjBmBU.exe
  C:\Windows\System\sRjBmBU.exe
  2⤵
  PID:9300
- C:\Windows\System\CWgfMhI.exe
  C:\Windows\System\CWgfMhI.exe
  2⤵
  PID:9320
- C:\Windows\System\KUYhYcX.exe
  C:\Windows\System\KUYhYcX.exe
  2⤵
  PID:9336
- C:\Windows\System\FxmtDWp.exe
  C:\Windows\System\FxmtDWp.exe
  2⤵
  PID:9352
- C:\Windows\System\czwvUnB.exe
  C:\Windows\System\czwvUnB.exe
  2⤵
  PID:9368
- C:\Windows\System\AEanJKf.exe
  C:\Windows\System\AEanJKf.exe
  2⤵
  PID:9384
- C:\Windows\System\NnbsSyp.exe
  C:\Windows\System\NnbsSyp.exe
  2⤵
  PID:9400
- C:\Windows\System\lfjvCgS.exe
  C:\Windows\System\lfjvCgS.exe
  2⤵
  PID:9416
- C:\Windows\System\QGXaLdI.exe
  C:\Windows\System\QGXaLdI.exe
  2⤵
  PID:9432
- C:\Windows\System\xAReaLw.exe
  C:\Windows\System\xAReaLw.exe
  2⤵
  PID:9452
- C:\Windows\System\eEbmgkm.exe
  C:\Windows\System\eEbmgkm.exe
  2⤵
  PID:9468
- C:\Windows\System\vEuMMGd.exe
  C:\Windows\System\vEuMMGd.exe
  2⤵
  PID:9484
- C:\Windows\System\vlGbAaM.exe
  C:\Windows\System\vlGbAaM.exe
  2⤵
  PID:9500
- C:\Windows\System\WezZfIy.exe
  C:\Windows\System\WezZfIy.exe
  2⤵
  PID:9516
- C:\Windows\System\vMhyBJo.exe
  C:\Windows\System\vMhyBJo.exe
  2⤵
  PID:9532
- C:\Windows\System\SdFVGZG.exe
  C:\Windows\System\SdFVGZG.exe
  2⤵
  PID:9548
- C:\Windows\System\NvIKKpa.exe
  C:\Windows\System\NvIKKpa.exe
  2⤵
  PID:9564
- C:\Windows\System\HBuygct.exe
  C:\Windows\System\HBuygct.exe
  2⤵
  PID:9580
- C:\Windows\System\amgQzjc.exe
  C:\Windows\System\amgQzjc.exe
  2⤵
  PID:9596
- C:\Windows\System\GkQlZwv.exe
  C:\Windows\System\GkQlZwv.exe
  2⤵
  PID:9612
- C:\Windows\System\aHowoRS.exe
  C:\Windows\System\aHowoRS.exe
  2⤵
  PID:9628
- C:\Windows\System\ZmnFgCb.exe
  C:\Windows\System\ZmnFgCb.exe
  2⤵
  PID:9644
- C:\Windows\System\HkFmxZT.exe
  C:\Windows\System\HkFmxZT.exe
  2⤵
  PID:9660
- C:\Windows\System\dDrMMLM.exe
  C:\Windows\System\dDrMMLM.exe
  2⤵
  PID:9676
- C:\Windows\System\aepDXke.exe
  C:\Windows\System\aepDXke.exe
  2⤵
  PID:9692
- C:\Windows\System\EepcttV.exe
  C:\Windows\System\EepcttV.exe
  2⤵
  PID:9708
- C:\Windows\System\ViObTMx.exe
  C:\Windows\System\ViObTMx.exe
  2⤵
  PID:9724
- C:\Windows\System\GGLIoAz.exe
  C:\Windows\System\GGLIoAz.exe
  2⤵
  PID:9740
- C:\Windows\System\CHVTUip.exe
  C:\Windows\System\CHVTUip.exe
  2⤵
  PID:9756
- C:\Windows\System\TMtWlCh.exe
  C:\Windows\System\TMtWlCh.exe
  2⤵
  PID:9772
- C:\Windows\System\isUQaDT.exe
  C:\Windows\System\isUQaDT.exe
  2⤵
  PID:9788
- C:\Windows\System\yKDoGdR.exe
  C:\Windows\System\yKDoGdR.exe
  2⤵
  PID:9804
- C:\Windows\System\dJCoOsj.exe
  C:\Windows\System\dJCoOsj.exe
  2⤵
  PID:9820
- C:\Windows\System\lMZJFsb.exe
  C:\Windows\System\lMZJFsb.exe
  2⤵
  PID:9836
- C:\Windows\System\HprzPLq.exe
  C:\Windows\System\HprzPLq.exe
  2⤵
  PID:9852
- C:\Windows\System\KSZmAZH.exe
  C:\Windows\System\KSZmAZH.exe
  2⤵
  PID:9956
- C:\Windows\System\ERVxrdp.exe
  C:\Windows\System\ERVxrdp.exe
  2⤵
  PID:9972
- C:\Windows\System\BxbVUjo.exe
  C:\Windows\System\BxbVUjo.exe
  2⤵
  PID:9996
- C:\Windows\System\ZJKJmSX.exe
  C:\Windows\System\ZJKJmSX.exe
  2⤵
  PID:10016
- C:\Windows\System\zvlBnAp.exe
  C:\Windows\System\zvlBnAp.exe
  2⤵
  PID:10032
- C:\Windows\System\yNnRoEV.exe
  C:\Windows\System\yNnRoEV.exe
  2⤵
  PID:10048
- C:\Windows\System\EWjtBsS.exe
  C:\Windows\System\EWjtBsS.exe
  2⤵
  PID:10064
- C:\Windows\System\VdpybCV.exe
  C:\Windows\System\VdpybCV.exe
  2⤵
  PID:10080
- C:\Windows\System\jsktkNi.exe
  C:\Windows\System\jsktkNi.exe
  2⤵
  PID:10096
- C:\Windows\System\mmAhcDI.exe
  C:\Windows\System\mmAhcDI.exe
  2⤵
  PID:10112
- C:\Windows\System\IVUzuRw.exe
  C:\Windows\System\IVUzuRw.exe
  2⤵
  PID:10128
- C:\Windows\System\irlofbY.exe
  C:\Windows\System\irlofbY.exe
  2⤵
  PID:10148
- C:\Windows\System\BzKLnvj.exe
  C:\Windows\System\BzKLnvj.exe
  2⤵
  PID:10164
- C:\Windows\System\miDtKFj.exe
  C:\Windows\System\miDtKFj.exe
  2⤵
  PID:10180
- C:\Windows\System\DLgOuhx.exe
  C:\Windows\System\DLgOuhx.exe
  2⤵
  PID:10196
- C:\Windows\System\HQKWREI.exe
  C:\Windows\System\HQKWREI.exe
  2⤵
  PID:10212
- C:\Windows\System\SkbisFG.exe
  C:\Windows\System\SkbisFG.exe
  2⤵
  PID:10228
- C:\Windows\System\OGcxSSu.exe
  C:\Windows\System\OGcxSSu.exe
  2⤵
  PID:9784
- C:\Windows\System\gtRmOQq.exe
  C:\Windows\System\gtRmOQq.exe
  2⤵
  PID:9872
- C:\Windows\System\cGlsUoI.exe
  C:\Windows\System\cGlsUoI.exe
  2⤵
  PID:9888
- C:\Windows\System\dVJTKVp.exe
  C:\Windows\System\dVJTKVp.exe
  2⤵
  PID:9904
- C:\Windows\System\hgKJBbd.exe
  C:\Windows\System\hgKJBbd.exe
  2⤵
  PID:9932
- C:\Windows\System\pKzhpAZ.exe
  C:\Windows\System\pKzhpAZ.exe
  2⤵
  PID:9968
- C:\Windows\System\DoZDseY.exe
  C:\Windows\System\DoZDseY.exe
  2⤵
  PID:10040
- C:\Windows\System\gbMApOZ.exe
  C:\Windows\System\gbMApOZ.exe
  2⤵
  PID:10104
- C:\Windows\System\UtNopio.exe
  C:\Windows\System\UtNopio.exe
  2⤵
  PID:10144
- C:\Windows\System\ZrpwRIL.exe
  C:\Windows\System\ZrpwRIL.exe
  2⤵
  PID:10208
- C:\Windows\System\ArbyDzE.exe
  C:\Windows\System\ArbyDzE.exe
  2⤵
  PID:2588
- C:\Windows\System\FuJblya.exe
  C:\Windows\System\FuJblya.exe
  2⤵
  PID:9260
- C:\Windows\System\bZnsyjo.exe
  C:\Windows\System\bZnsyjo.exe
  2⤵
  PID:9980
- C:\Windows\System\sjpYVQG.exe
  C:\Windows\System\sjpYVQG.exe
  2⤵
  PID:10060
- C:\Windows\System\DnTXEyk.exe
  C:\Windows\System\DnTXEyk.exe
  2⤵
  PID:10156
- C:\Windows\System\gmHIznO.exe
  C:\Windows\System\gmHIznO.exe
  2⤵
  PID:9292
- C:\Windows\System\BUpWxmu.exe
  C:\Windows\System\BUpWxmu.exe
  2⤵
  PID:9360
- C:\Windows\System\FsVSpjJ.exe
  C:\Windows\System\FsVSpjJ.exe
  2⤵
  PID:9492
- C:\Windows\System\GkXYRyP.exe
  C:\Windows\System\GkXYRyP.exe
  2⤵
  PID:9556
- C:\Windows\System\DrPMuVw.exe
  C:\Windows\System\DrPMuVw.exe
  2⤵
  PID:9588
- C:\Windows\System\fyWrzhd.exe
  C:\Windows\System\fyWrzhd.exe
  2⤵
  PID:9656
- C:\Windows\System\EasErRN.exe
  C:\Windows\System\EasErRN.exe
  2⤵
  PID:9296
- C:\Windows\System\FYuiFXA.exe
  C:\Windows\System\FYuiFXA.exe
  2⤵
  PID:9528
- C:\Windows\System\jGTypzb.exe
  C:\Windows\System\jGTypzb.exe
  2⤵
  PID:9312
- C:\Windows\System\TCvuTnW.exe
  C:\Windows\System\TCvuTnW.exe
  2⤵
  PID:9344
- C:\Windows\System\RMsKQND.exe
  C:\Windows\System\RMsKQND.exe
  2⤵
  PID:9636
- C:\Windows\System\eJfZZQR.exe
  C:\Windows\System\eJfZZQR.exe
  2⤵
  PID:9448
- C:\Windows\System\DTmxooq.exe
  C:\Windows\System\DTmxooq.exe
  2⤵
  PID:9248
- C:\Windows\System\CcogHoR.exe
  C:\Windows\System\CcogHoR.exe
  2⤵
  PID:9816
- C:\Windows\System\hMCBkCc.exe
  C:\Windows\System\hMCBkCc.exe
  2⤵
  PID:9640
- C:\Windows\System\VEbGvYI.exe
  C:\Windows\System\VEbGvYI.exe
  2⤵
  PID:9796
- C:\Windows\System\saeSnHU.exe
  C:\Windows\System\saeSnHU.exe
  2⤵
  PID:9576
- C:\Windows\System\aHNiVXB.exe
  C:\Windows\System\aHNiVXB.exe
  2⤵
  PID:9732
- C:\Windows\System\tVdBDiL.exe
  C:\Windows\System\tVdBDiL.exe
  2⤵
  PID:9920
- C:\Windows\System\MXHyGRW.exe
  C:\Windows\System\MXHyGRW.exe
  2⤵
  PID:10012
- C:\Windows\System\JyHtEUI.exe
  C:\Windows\System\JyHtEUI.exe
  2⤵
  PID:9176
- C:\Windows\System\odGEJbW.exe
  C:\Windows\System\odGEJbW.exe
  2⤵
  PID:9868
- C:\Windows\System\werWyXl.exe
  C:\Windows\System\werWyXl.exe
  2⤵
  PID:9860
- C:\Windows\System\xcjFEwQ.exe
  C:\Windows\System\xcjFEwQ.exe
  2⤵
  PID:9964
- C:\Windows\System\IpIdZyh.exe
  C:\Windows\System\IpIdZyh.exe
  2⤵
  PID:10076
- C:\Windows\System\ForzYbP.exe
  C:\Windows\System\ForzYbP.exe
  2⤵
  PID:10056
- C:\Windows\System\yPhorTg.exe
  C:\Windows\System\yPhorTg.exe
  2⤵
  PID:10188
- C:\Windows\System\IjTmkwU.exe
  C:\Windows\System\IjTmkwU.exe
  2⤵
  PID:9984
- C:\Windows\System\gHmTjti.exe
  C:\Windows\System\gHmTjti.exe
  2⤵
  PID:9396
- C:\Windows\System\LVVZOHD.exe
  C:\Windows\System\LVVZOHD.exe
  2⤵
  PID:9624
- C:\Windows\System\mOWyjGK.exe
  C:\Windows\System\mOWyjGK.exe
  2⤵
  PID:8964
- C:\Windows\System\ysgbuWy.exe
  C:\Windows\System\ysgbuWy.exe
  2⤵
  PID:9232
- C:\Windows\System\BJbWtNW.exe
  C:\Windows\System\BJbWtNW.exe
  2⤵
  PID:9076
- C:\Windows\System\QpBdrQd.exe
  C:\Windows\System\QpBdrQd.exe
  2⤵
  PID:9780
- C:\Windows\System\IFZrIRD.exe
  C:\Windows\System\IFZrIRD.exe
  2⤵
  PID:9592
- C:\Windows\System\geMokmB.exe
  C:\Windows\System\geMokmB.exe
  2⤵
  PID:9412
- C:\Windows\System\mufUWbq.exe
  C:\Windows\System\mufUWbq.exe
  2⤵
  PID:9912
- C:\Windows\System\mwbsNYb.exe
  C:\Windows\System\mwbsNYb.exe
  2⤵
  PID:9308
- C:\Windows\System\RnkFcTa.exe
  C:\Windows\System\RnkFcTa.exe
  2⤵
  PID:9844
- C:\Windows\System\gjvqhKo.exe
  C:\Windows\System\gjvqhKo.exe
  2⤵
  PID:9800
- C:\Windows\System\OvIeMLJ.exe
  C:\Windows\System\OvIeMLJ.exe
  2⤵
  PID:9940
- C:\Windows\System\exqQDiD.exe
  C:\Windows\System\exqQDiD.exe
  2⤵
  PID:9764
- C:\Windows\System\iulFtlX.exe
  C:\Windows\System\iulFtlX.exe
  2⤵
  PID:9992
- C:\Windows\System\SuDTVtq.exe
  C:\Windows\System\SuDTVtq.exe
  2⤵
  PID:9716
- C:\Windows\System\eumDCwT.exe
  C:\Windows\System\eumDCwT.exe
  2⤵
  PID:9464
- C:\Windows\System\yQrRSSG.exe
  C:\Windows\System\yQrRSSG.exe
  2⤵
  PID:9508
- C:\Windows\System\tjnFnNa.exe
  C:\Windows\System\tjnFnNa.exe
  2⤵
  PID:9424
- C:\Windows\System\jKXRgyX.exe
  C:\Windows\System\jKXRgyX.exe
  2⤵
  PID:9380
- C:\Windows\System\RiXdLvK.exe
  C:\Windows\System\RiXdLvK.exe
  2⤵
  PID:9916
- C:\Windows\System\ItsZKsI.exe
  C:\Windows\System\ItsZKsI.exe
  2⤵
  PID:9936
- C:\Windows\System\wdJNwJJ.exe
  C:\Windows\System\wdJNwJJ.exe
  2⤵
  PID:9748
- C:\Windows\System\zKKDNsb.exe
  C:\Windows\System\zKKDNsb.exe
  2⤵
  PID:9952
- C:\Windows\System\arPSpCR.exe
  C:\Windows\System\arPSpCR.exe
  2⤵
  PID:9572
- C:\Windows\System\oVUjHND.exe
  C:\Windows\System\oVUjHND.exe
  2⤵
  PID:9328
- C:\Windows\System\bGUVxpA.exe
  C:\Windows\System\bGUVxpA.exe
  2⤵
  PID:9948
- C:\Windows\System\zYzWhEJ.exe
  C:\Windows\System\zYzWhEJ.exe
  2⤵
  PID:9812
- C:\Windows\System\xbMfaaP.exe
  C:\Windows\System\xbMfaaP.exe
  2⤵
  PID:9544
- C:\Windows\System\mnLYWJv.exe
  C:\Windows\System\mnLYWJv.exe
  2⤵
  PID:10204
- C:\Windows\System\mwCPclc.exe
  C:\Windows\System\mwCPclc.exe
  2⤵
  PID:10252
- C:\Windows\System\DVrFSrn.exe
  C:\Windows\System\DVrFSrn.exe
  2⤵
  PID:10268
- C:\Windows\System\TwZWXJU.exe
  C:\Windows\System\TwZWXJU.exe
  2⤵
  PID:10284
- C:\Windows\System\QmRASfk.exe
  C:\Windows\System\QmRASfk.exe
  2⤵
  PID:10300
- C:\Windows\System\ECVhrAi.exe
  C:\Windows\System\ECVhrAi.exe
  2⤵
  PID:10320
- C:\Windows\System\PBKQlxA.exe
  C:\Windows\System\PBKQlxA.exe
  2⤵
  PID:10336
- C:\Windows\System\cgWUyWA.exe
  C:\Windows\System\cgWUyWA.exe
  2⤵
  PID:10352
- C:\Windows\System\GcjEsFt.exe
  C:\Windows\System\GcjEsFt.exe
  2⤵
  PID:10368
- C:\Windows\System\OBfAZiI.exe
  C:\Windows\System\OBfAZiI.exe
  2⤵
  PID:10384
- C:\Windows\System\sRhhesh.exe
  C:\Windows\System\sRhhesh.exe
  2⤵
  PID:10400
- C:\Windows\System\UJwVDkY.exe
  C:\Windows\System\UJwVDkY.exe
  2⤵
  PID:10416
- C:\Windows\System\YnvXhgR.exe
  C:\Windows\System\YnvXhgR.exe
  2⤵
  PID:10432
- C:\Windows\System\SOaBVnZ.exe
  C:\Windows\System\SOaBVnZ.exe
  2⤵
  PID:10448
- C:\Windows\System\UgoJQNk.exe
  C:\Windows\System\UgoJQNk.exe
  2⤵
  PID:10472
- C:\Windows\System\wFmqEKe.exe
  C:\Windows\System\wFmqEKe.exe
  2⤵
  PID:10488
- C:\Windows\System\TmgpMJa.exe
  C:\Windows\System\TmgpMJa.exe
  2⤵
  PID:10504
- C:\Windows\System\oPeINpc.exe
  C:\Windows\System\oPeINpc.exe
  2⤵
  PID:10520
- C:\Windows\System\iPiKkFd.exe
  C:\Windows\System\iPiKkFd.exe
  2⤵
  PID:10536
- C:\Windows\System\bQKdoHj.exe
  C:\Windows\System\bQKdoHj.exe
  2⤵
  PID:10552
- C:\Windows\System\VujOzGM.exe
  C:\Windows\System\VujOzGM.exe
  2⤵
  PID:10568
- C:\Windows\System\LlldxAi.exe
  C:\Windows\System\LlldxAi.exe
  2⤵
  PID:10584
- C:\Windows\System\nJCTZmb.exe
  C:\Windows\System\nJCTZmb.exe
  2⤵
  PID:10628
- C:\Windows\System\wSXCYle.exe
  C:\Windows\System\wSXCYle.exe
  2⤵
  PID:10644
- C:\Windows\System\EGLsklz.exe
  C:\Windows\System\EGLsklz.exe
  2⤵
  PID:10668
- C:\Windows\System\XRJOlNG.exe
  C:\Windows\System\XRJOlNG.exe
  2⤵
  PID:10684
- C:\Windows\System\ifrXCjN.exe
  C:\Windows\System\ifrXCjN.exe
  2⤵
  PID:10700
- C:\Windows\System\ofvOpSv.exe
  C:\Windows\System\ofvOpSv.exe
  2⤵
  PID:10716
- C:\Windows\System\MQknpEi.exe
  C:\Windows\System\MQknpEi.exe
  2⤵
  PID:10732
- C:\Windows\System\cNmwxkX.exe
  C:\Windows\System\cNmwxkX.exe
  2⤵
  PID:10748
- C:\Windows\System\shgMixC.exe
  C:\Windows\System\shgMixC.exe
  2⤵
  PID:10764
- C:\Windows\System\jdQDCiP.exe
  C:\Windows\System\jdQDCiP.exe
  2⤵
  PID:10780
- C:\Windows\System\bfpeKgb.exe
  C:\Windows\System\bfpeKgb.exe
  2⤵
  PID:10796
- C:\Windows\System\jyrYXQv.exe
  C:\Windows\System\jyrYXQv.exe
  2⤵
  PID:10812
- C:\Windows\System\cPUuhEt.exe
  C:\Windows\System\cPUuhEt.exe
  2⤵
  PID:10828
- C:\Windows\System\tRaSCve.exe
  C:\Windows\System\tRaSCve.exe
  2⤵
  PID:10844
- C:\Windows\System\WWmsNwv.exe
  C:\Windows\System\WWmsNwv.exe
  2⤵
  PID:10872
- C:\Windows\System\CHyKFQn.exe
  C:\Windows\System\CHyKFQn.exe
  2⤵
  PID:10888
- C:\Windows\System\kRVepxd.exe
  C:\Windows\System\kRVepxd.exe
  2⤵
  PID:10904
- C:\Windows\System\SxzuGHO.exe
  C:\Windows\System\SxzuGHO.exe
  2⤵
  PID:10920
- C:\Windows\System\yEUBUUD.exe
  C:\Windows\System\yEUBUUD.exe
  2⤵
  PID:10936
- C:\Windows\System\MOaovlR.exe
  C:\Windows\System\MOaovlR.exe
  2⤵
  PID:10952
- C:\Windows\System\hnlDRKb.exe
  C:\Windows\System\hnlDRKb.exe
  2⤵
  PID:10968
- C:\Windows\System\ZMVflpF.exe
  C:\Windows\System\ZMVflpF.exe
  2⤵
  PID:10984
- C:\Windows\System\nbJUGGq.exe
  C:\Windows\System\nbJUGGq.exe
  2⤵
  PID:11000
- C:\Windows\System\gTEJFqF.exe
  C:\Windows\System\gTEJFqF.exe
  2⤵
  PID:11016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BFmhJUo.exe

Filesize
1.9MB

MD5
e794f82c18c0f53698619a2bee81fea8

SHA1
e2598be2873bf1e658aa91ad7a9a23cb21abf976

SHA256
49f4d76b011c0a760ff0e51a86adcd6a49e2c1262444e23b4cbff7a1829387ff

SHA512
498c9803dafa64defab3963debc48da5ce8f01dc75736bc68b9ddc63e8389af4b0c7dc75db00b568c3754a2bd6b77b84e022a303737fb25ddffa3e7fa6ae3d1c

Download Submit
C:\Windows\system\BiAYVwN.exe

Filesize
1.9MB

MD5
0a8258d9a3917185feec13583a1493b9

SHA1
208732413ad13bc8e51481596e405e88665a17a6

SHA256
16d66cba4b59f8c62da64ba86647412ec6889307392bb2ea151b028a85da45e1

SHA512
f73138c86181c10d8c7cf2cc7748988c23f56da98e815443b615608c43e921ef1f043f54f54818712aa6a0066027ad611d3646ac1eb9cc6c519674f6becfd3fb

Download Submit
C:\Windows\system\EfLpWCQ.exe

Filesize
1.9MB

MD5
ab7a8777d30deeb9c1bea33ad1ca20d6

SHA1
9a3845a67c781dfa747259a0bdeaf6aab7341a68

SHA256
a1ad05e5082c0c3377d4282d3e86985ea668fd0527a5f600567c9c740675639c

SHA512
e1e4cad317e3f8daf285edbf346ad7069cc3f627bdaf63a25b04740978f22fabbd3bf3390781a4dac857f40e24c0fcdfd00b77aac81febf78c28a3dea5c148f8

Download Submit
C:\Windows\system\EllwIlN.exe

Filesize
1.9MB

MD5
cdb026dc4d7686576091b236a9cbd098

SHA1
51beef570cd307e48e9fa25016275014a1d99b27

SHA256
e426a7668639300e66020c1a86c847cc41953e45a808cacb7a3cda2d003afe3e

SHA512
d8853fc3f51ad535357eb67920d146cde20ab268059b79d71f556345664068ebdb74c397e957b182e883febf0c258820a1491976f1b78a21f9ac554d23451231

Download Submit
C:\Windows\system\EvDPoJn.exe

Filesize
1.9MB

MD5
dd5e07444eb04c0edd1a40bb015a4466

SHA1
136cf815e7e18c23e499cc54c6a5fc2d8779037e

SHA256
8ff7dfd3e9216c01786a6452fc6a49550fb40396696b6c7088a7f648cbd632f2

SHA512
2d5e8d55956c09c219d1ccebef010e9d3883035eb869ae4d129abe0c96ba29dd672caae5c72121369f51a16ffd81770caeebfc90776dbacec1e4c9c570f419fc

Download Submit
C:\Windows\system\FtMaLmL.exe

Filesize
1.9MB

MD5
337746891c971fab491337fc1f607673

SHA1
e24dbfece8d1c567c013e7ee5ed67712c7a3945d

SHA256
eefd76aea34ef6bc37de3f4d4ee2a0288b62e55e6d71041647d48756595a07e7

SHA512
34f6a8d4ea75d233d20634dddef041eb6de8f325a59cc51ee048c32e624a7887c81dd92a377a02b24ec8351e34939ae658b682a540941fb04db41c477209abfd

Download Submit
C:\Windows\system\NqFNRXd.exe

Filesize
1.9MB

MD5
56c58f958c0b5698f5bd6182c7c90d0b

SHA1
8e3a48d00e574b66df482d7dc1af57e7bf0d20d2

SHA256
a2a53a62c7d21b8e886f366dfeee0595a3b279cd5f140ac05f74479dd371d4da

SHA512
168c79d26cc6878de790d7d16e29284bee84e238e99c3684cc9307c5e2ef8cadb05211e0fc64166383c2776d1071e3a42519f02522f4ea0d439b6b480a353db0

Download Submit
C:\Windows\system\OjJUmUy.exe

Filesize
1.9MB

MD5
fb8f1b204d53d559617179aca0baf1be

SHA1
48568938ab1238efb5c25a0076d496d0817a0fc9

SHA256
161eba805f81dba564b3b82a55dea7daa313e950ae966472d27153e6cc69a898

SHA512
19b4dc44c74ac4a425cb7f18b9d1875f0ea51ac160e3a68dd19d7d89dd6bd982cbcaa4acb53cdfeb81f36768b85ce4e8b597d7ffded0dc174668c3849df2833c

Download Submit
C:\Windows\system\VCbEkOQ.exe

Filesize
1.9MB

MD5
63e0422c879e426f56f7b94324e51f0f

SHA1
3915b1fd83ed04b41beddac2282a4fc1c67783b5

SHA256
1ce5f2296a349129ddfb5c9866df516e4afa44885d92e6d69577c674560a5e0b

SHA512
e8e97ef6982857887c95a275f4b5709b47d87f514b286a1f783891b03f64488efd808b00e33d59d529c4a0b28217f0477faf33117c7b7047f0c0e4b4d7954839

Download Submit
C:\Windows\system\YpYQPKn.exe

Filesize
1.9MB

MD5
55ff51c229df1ec82b253ca2714fe88e

SHA1
558a65a428709f12b67b12ca0ae2714eec79dac5

SHA256
e24f62f7f7b4df2645b08f8565527d13e060acecbee933dc204f124ab8a7cdf7

SHA512
c6fe68743142c09baf80bfc076feab49991d6ef217c5e655d7f7c34fbacf057b9793ec0de21cb45c9eeef586c042ed8093a1f7f204ef37227a6ecbc3751b46f7

Download Submit
C:\Windows\system\YxQENvg.exe

Filesize
1.9MB

MD5
b8094c6812ec4e64bdd313d71db2c97a

SHA1
8d4c3650a277b3bcb518a20f54f59f4cc2c3f343

SHA256
38b1253d1f7159cd41ee209c609e742f311d5d08fb3573fcbf2b0e2a45a9b3fe

SHA512
1b28d252fbc7f001f3082b20931b180499dff8003436eef67be67f6d699e235b2edc2f002e76614465dfe6a555b82ab7be60bd413e71728541ec6d5d8e4fbd7c

Download Submit
C:\Windows\system\bMgFeez.exe

Filesize
1.9MB

MD5
f484be831645b342b327fb97c404816f

SHA1
adda59873fc8fe0fd833a9febf110580e15702a6

SHA256
a25bcaefb0935b5eca8cb1b31b8af3755d3b4937b21dca578c871f841adc7fb7

SHA512
4462ed2431cb9ec5c963bc344c2f97ca821029643e9631c97b9a4dd78296fe0011f121e1b82c1feedfc3c1e0ae94e745ece845ff19bcc01021042f5cfd8c2362

Download Submit
C:\Windows\system\cQKCFbi.exe

Filesize
1.9MB

MD5
36fe800aa7aabd64ab1ca1a471c9c4f1

SHA1
d5842e4ab0b7ff06cd994a8a5ce3978cd520ae70

SHA256
d510b019419e182182d55e7927cc15254b8786df62d4e1ed784712134526914a

SHA512
9db30d05a82cd57e9a7d224d163756cc293cfbb3b1ef6dcda1a8f6a12a519b13460a6f264d243ae841633c27d2d72418e1c0a2450f46277cbfe45166237c1867

Download Submit
C:\Windows\system\gDdmxSU.exe

Filesize
1.9MB

MD5
ba5ecf82914e5adb115e14e516ed28a1

SHA1
5d564291ff8f44d51639424a10f043b85835dcd3

SHA256
888393c6d337ff5b2c5d408d343250323362ac1faa1ff1346ce2efacd8beaf07

SHA512
436101e9d1e4c6fa0deba0387cbb7c93c1cd896371d661f97254b9c3a3c9c3982c21abee6698400f50f8b38e16181f520b083d0300ebe706c82840280a88a504

Download Submit
C:\Windows\system\hNcTWLw.exe

Filesize
1.9MB

MD5
ac122ed202c71430593e236ee82dafc3

SHA1
2a5feb177bd7fcae7e8236948c2d250ad354e571

SHA256
5d8d647fba72c309a4cdc40df32da07a05c6d1f8ca4c5a98cccff7492f28b8cb

SHA512
14749fd36f9af8c665a7b9bcecf88803ef6b979d4dcf23ea10dd7791e65bddaf56562bdc01960f88e6fb0c064984e538fbaf104f21e7d5a06f503d38ed1566d9

Download Submit
C:\Windows\system\ihFQJft.exe

Filesize
1.9MB

MD5
116adbe1ed0b89ba48b2c399d47568a3

SHA1
5661085a8299eb8f3e29ce723ed319c76fb68104

SHA256
1e59380f7133af55c9c8fbcc4ad6f0c98a58fa1a9a05931adaee30e1763d2c10

SHA512
7aa35e67d79babfc449c6b89d04ea3f4dae58c8884409e4f9ffa7c063f190a653ea11d0480a9239aee03b34030a938743ce65bfc0725299b6467cb7c36dd879c

Download Submit
C:\Windows\system\jIiMPWq.exe

Filesize
1.9MB

MD5
8995ef85b4613efa748abf76803e41bf

SHA1
b97f82a3319733062ed0d19e234e9f02f13ff032

SHA256
243f3677145bd8a2159f92080107dc19f0bb8177665bcb1400f166a3f358ae16

SHA512
bc4b64c71b41d5f641ffe30604e0e9e817f963b677be48631d9184ff2a650359b365c57f270c55d9ac891b30b94d9e67af477d7071dbe3e124515102fe0bd956

Download Submit
C:\Windows\system\qwDoBLP.exe

Filesize
1.9MB

MD5
3937b3b5d8863c9fa1e71fea42e0796f

SHA1
317a5d94f36098b273b9d045aea3b1ea088a4613

SHA256
9006a6c55c5a855b8550a3a5f497367f2186c2f4ba93e9f816fa4b303cd79219

SHA512
061a4a9455dbee1cf1309623d00d73db8a39f7e4b92014c33f40c163793906d580fbd690baaaa18b9cb68e64f939cc9d20abc0a7a81f8e84ea136a9be2c85932

Download Submit
C:\Windows\system\tMfWYaL.exe

Filesize
1.9MB

MD5
18e14a4dacbbb28ed2cc521b6c6e3f4f

SHA1
806fcfe329abcca1391ba983993ba31fa81c920c

SHA256
fcad6fc37ceb8a52884f68f3d82fcabc00222cc6796f3dfd65336dea576f6f9f

SHA512
1b6ce103527be5092f3aea21600d388e8bbd9c55301b6204dbe42575b708193fe605fe290c8b77a3e6642a94d5e3f9638f6d6704ebffc7674295ff060b38a1c1

Download Submit
\Windows\system\BUYqtAK.exe

Filesize
1.9MB

MD5
68811f5f7db55edd814367c767cf865d

SHA1
523fe86558aa9e62392f9586259b3754124063b8

SHA256
f164e99cee859c98621c17b2def2e5f83105471654e0e7e9b98c0b79107379bc

SHA512
bf32a6d7934b44ec0700060562847db6da3a6a414fcfbae0d58144a25c5e929f38d50d4ebd3426a2f13e59feff7db661190a195da0a623267b2ad396274387ee

Download Submit
\Windows\system\FIYlHtr.exe

Filesize
1.9MB

MD5
96b2aaf779b57626aedbaeb409de0a23

SHA1
80f4300410ea8570bf93b882139d90a1bd261569

SHA256
2967d364a48b63ee9d110de5a03b95cbb2181925ecca7747a28ca637c8894dd4

SHA512
112cac3fb4523409990385b7d3bb57b2b9b98530dcec757ad3e933ea9df3cde4ee527e56be77a45cf2d89718d90648c0d8e4077263261e6b7bbc69e1f9764fa7

Download Submit
\Windows\system\KIkCqgx.exe

Filesize
1.9MB

MD5
fbf87df722b664a810aaf30773d8ba37

SHA1
7ee5a891edcad1aca9202707bf03cbaf027320fa

SHA256
5b6f07e7f056425bfe3afdbd6721be358878931c85c90580ba543b5db2db7efd

SHA512
6e9fb611b3550cc49294a956f1dbff4e4214f76ca1e89b5e14d0def6cfaed8c8a6bdf55300866926c8bf0779671f26ef6e1e63ef5226e3ac8c6e33cce6baa070

Download Submit
\Windows\system\NphtKhZ.exe

Filesize
1.9MB

MD5
92fa2346057e7dd0bd01884713088112

SHA1
9c0423392ba65f45e178e2209ad4d75d073eaa85

SHA256
59c8d4fe919a94863aa65eb8f9b61b1d7488b91dc22b1a52cc2741fb7c1b1eb8

SHA512
790c0ac7770852ca6d93b1c71873bfa7730b107cce2a0b3cb0cb8a4605e14ac03cff912a7e65c346c48c80edaaf6a97a34fb57f1d9257463bedac6f0004247f0

Download Submit
\Windows\system\QQlnsGE.exe

Filesize
1.9MB

MD5
7890cd9ba9c94282b1d5359efc853354

SHA1
8fef30d376c1794d8a854e537a7ae0a5ecde4e84

SHA256
b2a8d79eb484f25f8cdfe7848c4f1ceb2f0879ec0de2df6928d3077664e2be4c

SHA512
67bd3ca3d06199943a8262b6b85577ec0d8613bb21afcca2513e94ac58de21bc402debea3648525f644843b8219b0a42fd0aa96bfd9411fd64eb263ea0fcafe9

Download Submit
\Windows\system\SLRcXlB.exe

Filesize
1.9MB

MD5
efbcd5510d160988e51ec172af6d906a

SHA1
afd057a68502bd14af0757a24d01408da8a093bc

SHA256
ddeb186ce5b0c2767e4809a6f0ae0a2ea51de8cb70504e8d72ee6d7474d55f2c

SHA512
2ad93589316a1808b39ac323621301307cb056132805b2c96afc1fb3b60480e2b9b9bf664db11fe73b772a27bfb493c2119c43e26d373bb0c5054ba0c3be2970

Download Submit
\Windows\system\UqBNUNg.exe

Filesize
1.9MB

MD5
62ac98f21740fecb32a9a5098de62518

SHA1
b901c6a182be0e3c46bd5f5a712035ae7d06f4db

SHA256
a86d01cb6b28006c1cdb9ce930084292a12a856fa4971f6934fa45aac62ab447

SHA512
7b74f3e13bec3138ccc3c6e78bb57869ed3951b34ec668bfcb8a0302d4f1e91db9f4479a4c2e9cb53e3d810d2d82d53df6a9da810ea70d9ec263bfcede1d63aa

Download Submit
\Windows\system\WKuILcb.exe

Filesize
1.9MB

MD5
9713ef02fa81caee156e6cb514ad1117

SHA1
f9238e84a955445fc279787388fda466b0e2126e

SHA256
715d9830e8b35fdf880ddc6884e6f3faf643942204a1e6d4219a63c48fe4f6e6

SHA512
69c8c48e1e99c9be7bb00e2ca0812cf0ddcab78498b1dcd688ab9f424c7ef74aeb33f36e6d149051bd334c71e0658cde89d2058788eef1bc89e2f04c10ecd52c

Download Submit
\Windows\system\cFaRIJW.exe

Filesize
1.9MB

MD5
579aa54b5977b9809aea59e6fcabca61

SHA1
2b11d9301462975219d97a3a43e9d290a1ba5b01

SHA256
8d2fd9a5c09b1fb6c8c1b00ce545ce38a8c5b7ef213b9d7ab739ba4c0056ea86

SHA512
cd2cca2db97235ec1e4629d750ddcf1b6d4e107cf4fdb5a8fc732f3b15fb59eb9548fc5c944871a4eba67770e3c35a3723ad3f989f32cf58f73fd46947c2c0de

Download Submit
\Windows\system\cxgxvAF.exe

Filesize
1.9MB

MD5
39a5c923ccfb8e38f1beb050b15cd081

SHA1
03a258e91e684f873fa82de309056aa1a35a5de2

SHA256
fdd9f45a872f529229cd178b897ba0875d5acca0dc6f6c053976f7458b6196f7

SHA512
eb4d793b1a9cc28ef6e4d1423b5f42e1b14b2b6d9f989532c4a33891d53dc48706c395230146a447659759f5b2849f1687018ca3b7c93fa1a8200eb126fe6394

Download Submit
\Windows\system\ebesSsb.exe

Filesize
1.9MB

MD5
239fc5476b35cf3d87e12ab26084edab

SHA1
12829ae3ca08330365686725852718786357f554

SHA256
593a6b557d5711618f4269612e324217066edff00085fa6c5d854f534653bd20

SHA512
06aa138477fb74381201fa93ec2839343e0601019cf47a9c90c39391e28a77a14f2812de125b716d0717b9f723795a77e14d7dc16728471832d1b8cc0275507d

Download Submit
\Windows\system\iajrsch.exe

Filesize
1.9MB

MD5
71cfc168af21f7fc3c463fe2adc48190

SHA1
42dc53fd7eef858f9ed0bc80b1d6b38d1886caa4

SHA256
4a162fde43a45500aed7eafb5747519422cac1a91e845ab94e6c04ef2768c4e2

SHA512
67038e4dba4c231eae51c75f5c1d6a0d5559f3415e1bd956b47b681e6317f95ef7f2f202d9c3681ab30de2fcf7d653846f90e79d48cf6e675b3541cb40db9a5f

Download Submit
\Windows\system\lrOJeAB.exe

Filesize
1.9MB

MD5
fb6c502c7302ade628817954fbef76a2

SHA1
339a1f182df265727d6b6f481e676d8dd0a6627a

SHA256
ec49dc825f246dd46b98a6f86d142bcc2084e45c9da1d35282cdd5bb385fcfff

SHA512
d6087d3d5908118bb2a27c39611d7fbca7821632776d16b44ea53631fcead9357d366ab048a4bc0a2b5663787ec5246b13620e82e4a8d345a3ac27915c5a4732

Download Submit
\Windows\system\nosryst.exe

Filesize
1.9MB

MD5
005c67b1f966ac124b9af4c3d52ed93e

SHA1
8b7f9cbc9f86a23f5d62001991aad7e361b233ce

SHA256
438296dc6aae768e55cff31aaaed9cc283d95c24c9219203152207d460ca814a

SHA512
d60071c74d1e1d6135166f9cf1c37174af862824b8b21e00e5017719694059be3a5d4b02a71a9025e2e25b585b9f58fb2cfd1271bb22ad5e18615a7c261489b1

Download Submit
\Windows\system\prCmEQL.exe

Filesize
1.9MB

MD5
48799ec0efe367442d4eada2689a44a2

SHA1
288982468aab82b5ec52773680bf4f1085f5213e

SHA256
a75f98b0e93ed90fcfee6b1713db9230072c73f9a44a096f2b3bc3058a0c5c2b

SHA512
1d08a5072204d3c40d21548355e05f54809714169f56a3a0ed69505e7cd223a240b00b2579f01f9c09bfeb76ecd762275bead4ba6f29d91c0df0e1e736482dac

Download Submit
\Windows\system\qnJNHYa.exe

Filesize
1.9MB

MD5
26d127d76366b62d51e9c621f18513d3

SHA1
c7bca94d0d6643423da8a1afc9e8ead14cba5d01

SHA256
c3e7e36c94c16a0d472da3989eb922180c903e585e7df60e66725f0a5ac6694a

SHA512
b1fdcc5e0cc1999af3eabdc5933543cd539eeb260f18052207e56a87410c9f78c0b15cb8e3af635e60514c323a4947d35f0df7c7a12c7f01577375790da405c3

Download Submit
\Windows\system\ucJVlht.exe

Filesize
1.9MB

MD5
2e86ed2e9d542b6ed0dc6899c31472ab

SHA1
7740c462cca2542d47f57ce031c2a15aebe11fcf

SHA256
0d7e426435dcafb6c71fa1f2914ba2e2527a81bc32edd04f451d4950bcc1691e

SHA512
10b383bab5e6371085fa3a4615f0bc21cf52c3d4bae397b2c17896acbb2aeb4614193b43c30818b58d1a2a92ffa54e4e62eeea029a4d52a96e439ebfeb1bbc51

Download Submit
\Windows\system\wNxpBKX.exe

Filesize
1.9MB

MD5
d33348e369aa37f328dafb754643fc7f

SHA1
952e781295134ea112966bb6c16ce0c229926546

SHA256
3500d7c3c9e82b0126cbd722eeab85b8f43be20169dd1858786941d5b35f3a60

SHA512
10d2b9ee6aa79f578028b3022a17bddae789342d7284da4b4fb4c5d0d37a781affd82b651b995c9420499c57e50e47f947398f0e86b27c09cd2fe6549c65f704

Download Submit
\Windows\system\wUumfEh.exe

Filesize
1.9MB

MD5
c23b234c25668fe398ad30f00190c26e

SHA1
9667b26904d6d6a2b1f1c7c96b4ab710927bbce5

SHA256
f5a96d9cd0e63e280f40a2597f7080453013333d805772f4950160a92a5e16ff

SHA512
f5d03679f7fab8f04c8406942fa15dd5d422cd28721ee4361545e955f6f5bd09347212bfcda6eae342a363dd624cea0472aa7bdf4ce4932b5204eb5dc6e4df5e

Download Submit
\Windows\system\wdpcltC.exe

Filesize
1.9MB

MD5
0dcf621b077e620e8a6f6676361d872f

SHA1
5ccd922ccd1a2ae285062a16f1ce06862a976f7e

SHA256
15aaed169fd4aecf00c09ef77257be230b19bc89ace82f4aa26d18c671c3717b

SHA512
24bdcd2cd25494e2c7feeeea3c2c9fb0596b784d03a7281d3eabf92386d1af894d4527b6d7f07b6f417c9208753ac2197e094680ee80ea02f45b5b4c9c6b562b

Download Submit
memory/2212-55-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2504-66-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2552-37-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2660-41-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2708-43-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2820-12-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-72-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-79-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2936-35-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2936-60-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2936-0-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2936-7-0x0000000003150000-0x0000000003542000-memory.dmp

Filesize
3.9MB

Download
memory/2936-81-0x0000000003520000-0x0000000003912000-memory.dmp

Filesize
3.9MB

Download
memory/2936-80-0x0000000003520000-0x0000000003912000-memory.dmp

Filesize
3.9MB

Download
memory/2936-50-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2936-82-0x0000000003520000-0x0000000003912000-memory.dmp

Filesize
3.9MB

Download
memory/2936-40-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2936-42-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2936-44-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2996-47-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/3040-38-0x000000001B7E0000-0x000000001BAC2000-memory.dmp

Filesize
2.9MB

Download
memory/3040-48-0x0000000002CC0000-0x0000000002D40000-memory.dmp

Filesize
512KB

Download
memory/3040-46-0x000007FEF5500000-0x000007FEF5E9D000-memory.dmp

Filesize
9.6MB

Download
memory/3040-34-0x0000000002CC0000-0x0000000002D40000-memory.dmp

Filesize
512KB

Download
memory/3040-45-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/3040-33-0x0000000002CC0000-0x0000000002D40000-memory.dmp

Filesize
512KB

Download
memory/3040-32-0x000007FEF5500000-0x000007FEF5E9D000-memory.dmp

Filesize
9.6MB

Download