xmrig | 8acda3d83fdf853a2911a2557a9a16a29d26d8b58cc6643518343f3c0793ef20

Analysis

max time kernel
28s
max time network
27s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 12:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
Size

2.2MB
MD5

09c4785e35b336cc95b697d5b90d8375
SHA1

d9b9a042b9b0ead6b801e453c41577da21a9a84c
SHA256

8acda3d83fdf853a2911a2557a9a16a29d26d8b58cc6643518343f3c0793ef20
SHA512

150e06d46a37c235d23b1c5a8683ed632635ec5e6a2d7bbf0807f2260aa97200b9b88b89eb3aad14be8a2f5985c79d4cf6f795536d1effacbc8fe43800cbf054
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfo:NABb

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2368-55-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/1912-996-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	xmrig
behavioral1/memory/2388-54-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2532-53-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig
behavioral1/memory/2060-43-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2492-1367-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/2516-1913-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2492	CILEaUg.exe
2516	AYXuxAN.exe
2060	mnZLbmt.exe
2532	KQWUTLu.exe
2388	PChYUPa.exe
2368	vvOomgt.exe
1728	OrIvEVi.exe
2424	lMuJYQr.exe
2660	fHYiiaC.exe
2108	mjyfuZt.exe
884	wtROeLL.exe
1820	QqYMDrG.exe
2084	TaapdIf.exe
1548	cyXvvgf.exe
1232	MuwYegx.exe
1692	axzEfdA.exe
3052	qiohfVe.exe
1680	QOjSYdu.exe
796	BYLqeZe.exe
768	WhGeMga.exe
1056	DIsyImm.exe
2788	vCerEIL.exe
2336	BaCLSwS.exe
2860	rCWkVXc.exe
2964	AbobHdh.exe
1708	cTnFIMY.exe
1720	MUuAznl.exe
1656	GyHQGGK.exe
1672	SaMldWB.exe
3056	NFSILOe.exe
2192	EtNjliQ.exe
2756	aFSffxj.exe
1132	BTeLDId.exe
576	obKDcdF.exe
1436	LuTCxjF.exe
2016	mZGWaec.exe
2212	oSjFmCo.exe
1532	oHtceIw.exe
2556	UrknxUl.exe
2464	OVWoRNv.exe
1504	NczqVvc.exe
2668	yfFTUSJ.exe
1508	CkspLiU.exe
1144	iPQglws.exe
876	FtgvsCW.exe
1104	nSySrwK.exe
2608	JgGopWG.exe
1916	ZytCnWZ.exe
880	OOdGtsG.exe
2372	bYLnErr.exe
3080	orjvUXI.exe
3112	zshDphT.exe
3144	KpSwmmi.exe
3176	YRscsOt.exe
3208	vLYHrvr.exe
3240	vHYvOZa.exe
3272	xxxYScC.exe
3304	ShuZscG.exe
3336	mAFmFhV.exe
3368	kQTLGdk.exe
3400	WvJRTUV.exe
3432	IRLpUPA.exe
3464	gyUnQcA.exe
3496	cquWPOn.exe

Loads dropped DLL 64 IoCs

pid	Process
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1912-1-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	upx
behavioral1/files/0x000d00000001449a-3.dat	upx
behavioral1/memory/2492-8-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/files/0x0034000000014701-14.dat	upx
behavioral1/memory/2516-19-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/files/0x001400000000549e-20.dat	upx
behavioral1/files/0x0007000000014c25-31.dat	upx
behavioral1/files/0x0007000000014e5a-36.dat	upx
behavioral1/memory/2368-55-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/1728-61-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/files/0x0006000000015cca-73.dat	upx
behavioral1/memory/2424-101-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/files/0x00060000000160f8-121.dat	upx
behavioral1/files/0x003400000001470b-128.dat	upx
behavioral1/files/0x0006000000016ce1-163.dat	upx
behavioral1/files/0x0006000000015d5d-88.dat	upx
behavioral1/files/0x0006000000016d0e-179.dat	upx
behavioral1/files/0x0006000000016cfe-172.dat	upx
behavioral1/files/0x0006000000016ced-165.dat	upx
behavioral1/files/0x0006000000016cc9-158.dat	upx
behavioral1/files/0x0006000000016c7a-151.dat	upx
behavioral1/files/0x0006000000016c26-144.dat	upx
behavioral1/files/0x0006000000016a45-137.dat	upx
behavioral1/files/0x0006000000016597-130.dat	upx
behavioral1/files/0x0006000000016525-123.dat	upx
behavioral1/files/0x0006000000016277-115.dat	upx
behavioral1/files/0x0006000000015f9e-108.dat	upx
behavioral1/files/0x0006000000015d6e-107.dat	upx
behavioral1/files/0x0006000000015d06-106.dat	upx
behavioral1/files/0x0006000000015cec-105.dat	upx
behavioral1/files/0x0006000000016056-103.dat	upx
behavioral1/files/0x0006000000015f1b-94.dat	upx
behavioral1/files/0x0006000000015cf7-82.dat	upx
behavioral1/files/0x0006000000015cdb-76.dat	upx
behavioral1/files/0x0006000000015cc1-70.dat	upx
behavioral1/files/0x000a0000000155e3-62.dat	upx
behavioral1/files/0x0006000000016d17-182.dat	upx
behavioral1/files/0x0006000000016d06-177.dat	upx
behavioral1/files/0x0006000000016cf5-170.dat	upx
behavioral1/files/0x0006000000016cab-156.dat	upx
behavioral1/files/0x0006000000016c2e-149.dat	upx
behavioral1/files/0x0006000000016c17-142.dat	upx
behavioral1/memory/1912-996-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	upx
behavioral1/files/0x00060000000167ef-135.dat	upx
behavioral1/files/0x0006000000016411-122.dat	upx
behavioral1/files/0x0007000000015cb9-68.dat	upx
behavioral1/memory/2388-54-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2532-53-0x000000013F610000-0x000000013FA02000-memory.dmp	upx
behavioral1/files/0x0008000000014b12-45.dat	upx
behavioral1/memory/2060-43-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/files/0x0007000000015023-59.dat	upx
behavioral1/memory/2492-1367-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/memory/2516-1913-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KqELEWR.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\SoknryS.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\KXlpanf.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\QqAbLbr.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\LEHfyth.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\uheDEse.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\AbrjhUx.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\UsOHLKC.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\gQEsjPR.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\jUYvIzX.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\CAYPQIP.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\hEwQuwT.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\RAzOxfm.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\bemEGgI.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\SAxSdxI.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\ujcokfp.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\aqGPPrm.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\qiohfVe.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\qHuPQNk.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\gqXpZSa.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\LytSBRI.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\QkFtyJP.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\SFIVVVd.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\qNhwAEy.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\yzlkdBz.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\gPSFBHe.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\MLLBnVu.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\jVXVAep.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\MJMUXfh.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\Bademqy.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\WZeveYA.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\jvLVWxa.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\kjdELYX.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\HHMnBKx.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\utPoZcp.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\GHiIFIr.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\ZekVtnq.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\kMVmryI.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\TgovNlS.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\BTeLDId.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\traDSMf.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\OAgfZcA.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\DrmqlbC.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\yEMhDNM.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\tBpQdHU.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\aIxWPyU.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\lTgUsUa.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\TMlPwVb.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\reEurjK.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\mGCJEVk.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\RXebFfI.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\PSZOLzw.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\bvgtuyg.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\enWVMlX.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\accUohO.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\EDPBDUQ.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\vhSVTOC.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\tMuYBZr.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\SiNcgrg.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\QnKPtUe.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\XPqRYga.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\DfcmtLp.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\HUOuYvn.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
File created	C:\Windows\System\HWbgOSZ.exe	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3032	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
Token: SeDebugPrivilege	3032	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 3032	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	29
PID 1912 wrote to memory of 3032	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	29
PID 1912 wrote to memory of 3032	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	29
PID 1912 wrote to memory of 2492	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	30
PID 1912 wrote to memory of 2492	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	30
PID 1912 wrote to memory of 2492	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	30
PID 1912 wrote to memory of 2516	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	31
PID 1912 wrote to memory of 2516	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	31
PID 1912 wrote to memory of 2516	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	31
PID 1912 wrote to memory of 2060	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	32
PID 1912 wrote to memory of 2060	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	32
PID 1912 wrote to memory of 2060	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	32
PID 1912 wrote to memory of 2388	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	33
PID 1912 wrote to memory of 2388	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	33
PID 1912 wrote to memory of 2388	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	33
PID 1912 wrote to memory of 2532	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	34
PID 1912 wrote to memory of 2532	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	34
PID 1912 wrote to memory of 2532	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	34
PID 1912 wrote to memory of 2368	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	35
PID 1912 wrote to memory of 2368	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	35
PID 1912 wrote to memory of 2368	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	35
PID 1912 wrote to memory of 1728	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	36
PID 1912 wrote to memory of 1728	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	36
PID 1912 wrote to memory of 1728	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	36
PID 1912 wrote to memory of 1476	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	37
PID 1912 wrote to memory of 1476	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	37
PID 1912 wrote to memory of 1476	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	37
PID 1912 wrote to memory of 2424	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	38
PID 1912 wrote to memory of 2424	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	38
PID 1912 wrote to memory of 2424	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	38
PID 1912 wrote to memory of 2588	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	39
PID 1912 wrote to memory of 2588	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	39
PID 1912 wrote to memory of 2588	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	39
PID 1912 wrote to memory of 2660	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	40
PID 1912 wrote to memory of 2660	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	40
PID 1912 wrote to memory of 2660	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	40
PID 1912 wrote to memory of 2692	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	41
PID 1912 wrote to memory of 2692	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	41
PID 1912 wrote to memory of 2692	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	41
PID 1912 wrote to memory of 2108	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	42
PID 1912 wrote to memory of 2108	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	42
PID 1912 wrote to memory of 2108	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	42
PID 1912 wrote to memory of 2776	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	43
PID 1912 wrote to memory of 2776	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	43
PID 1912 wrote to memory of 2776	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	43
PID 1912 wrote to memory of 884	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	44
PID 1912 wrote to memory of 884	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	44
PID 1912 wrote to memory of 884	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	44
PID 1912 wrote to memory of 1600	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	45
PID 1912 wrote to memory of 1600	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	45
PID 1912 wrote to memory of 1600	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	45
PID 1912 wrote to memory of 1820	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	46
PID 1912 wrote to memory of 1820	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	46
PID 1912 wrote to memory of 1820	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	46
PID 1912 wrote to memory of 1804	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	47
PID 1912 wrote to memory of 1804	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	47
PID 1912 wrote to memory of 1804	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	47
PID 1912 wrote to memory of 2084	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	48
PID 1912 wrote to memory of 2084	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	48
PID 1912 wrote to memory of 2084	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	48
PID 1912 wrote to memory of 2116	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	49
PID 1912 wrote to memory of 2116	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	49
PID 1912 wrote to memory of 2116	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	49
PID 1912 wrote to memory of 1548	1912	09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09c4785e35b336cc95b697d5b90d8375_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3032
- C:\Windows\System\CILEaUg.exe
  C:\Windows\System\CILEaUg.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\AYXuxAN.exe
  C:\Windows\System\AYXuxAN.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\mnZLbmt.exe
  C:\Windows\System\mnZLbmt.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\PChYUPa.exe
  C:\Windows\System\PChYUPa.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\KQWUTLu.exe
  C:\Windows\System\KQWUTLu.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\vvOomgt.exe
  C:\Windows\System\vvOomgt.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\OrIvEVi.exe
  C:\Windows\System\OrIvEVi.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\mGTUQRn.exe
  C:\Windows\System\mGTUQRn.exe
  2⤵
  PID:1476
- C:\Windows\System\lMuJYQr.exe
  C:\Windows\System\lMuJYQr.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\LrXDVbG.exe
  C:\Windows\System\LrXDVbG.exe
  2⤵
  PID:2588
- C:\Windows\System\fHYiiaC.exe
  C:\Windows\System\fHYiiaC.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\icCvUEM.exe
  C:\Windows\System\icCvUEM.exe
  2⤵
  PID:2692
- C:\Windows\System\mjyfuZt.exe
  C:\Windows\System\mjyfuZt.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\mPOejwR.exe
  C:\Windows\System\mPOejwR.exe
  2⤵
  PID:2776
- C:\Windows\System\wtROeLL.exe
  C:\Windows\System\wtROeLL.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\gjIRZob.exe
  C:\Windows\System\gjIRZob.exe
  2⤵
  PID:1600
- C:\Windows\System\QqYMDrG.exe
  C:\Windows\System\QqYMDrG.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\lQBtHrt.exe
  C:\Windows\System\lQBtHrt.exe
  2⤵
  PID:1804
- C:\Windows\System\TaapdIf.exe
  C:\Windows\System\TaapdIf.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\vLyJFqD.exe
  C:\Windows\System\vLyJFqD.exe
  2⤵
  PID:2116
- C:\Windows\System\cyXvvgf.exe
  C:\Windows\System\cyXvvgf.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\mzTKHUa.exe
  C:\Windows\System\mzTKHUa.exe
  2⤵
  PID:1636
- C:\Windows\System\MuwYegx.exe
  C:\Windows\System\MuwYegx.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\QGCdbTV.exe
  C:\Windows\System\QGCdbTV.exe
  2⤵
  PID:1204
- C:\Windows\System\axzEfdA.exe
  C:\Windows\System\axzEfdA.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\SNAvtMp.exe
  C:\Windows\System\SNAvtMp.exe
  2⤵
  PID:2028
- C:\Windows\System\qiohfVe.exe
  C:\Windows\System\qiohfVe.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\yhUFmkU.exe
  C:\Windows\System\yhUFmkU.exe
  2⤵
  PID:1880
- C:\Windows\System\QOjSYdu.exe
  C:\Windows\System\QOjSYdu.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\KgSfokk.exe
  C:\Windows\System\KgSfokk.exe
  2⤵
  PID:2344
- C:\Windows\System\BYLqeZe.exe
  C:\Windows\System\BYLqeZe.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\LEtejVK.exe
  C:\Windows\System\LEtejVK.exe
  2⤵
  PID:540
- C:\Windows\System\WhGeMga.exe
  C:\Windows\System\WhGeMga.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\OSlHrIi.exe
  C:\Windows\System\OSlHrIi.exe
  2⤵
  PID:1408
- C:\Windows\System\DIsyImm.exe
  C:\Windows\System\DIsyImm.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\pJSkRRB.exe
  C:\Windows\System\pJSkRRB.exe
  2⤵
  PID:1808
- C:\Windows\System\vCerEIL.exe
  C:\Windows\System\vCerEIL.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\oAeKqRD.exe
  C:\Windows\System\oAeKqRD.exe
  2⤵
  PID:380
- C:\Windows\System\BaCLSwS.exe
  C:\Windows\System\BaCLSwS.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\hYOGclC.exe
  C:\Windows\System\hYOGclC.exe
  2⤵
  PID:2912
- C:\Windows\System\rCWkVXc.exe
  C:\Windows\System\rCWkVXc.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\ZPFbvGv.exe
  C:\Windows\System\ZPFbvGv.exe
  2⤵
  PID:1128
- C:\Windows\System\AbobHdh.exe
  C:\Windows\System\AbobHdh.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\iBhhtek.exe
  C:\Windows\System\iBhhtek.exe
  2⤵
  PID:2076
- C:\Windows\System\cTnFIMY.exe
  C:\Windows\System\cTnFIMY.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\aVoIFUg.exe
  C:\Windows\System\aVoIFUg.exe
  2⤵
  PID:1604
- C:\Windows\System\MUuAznl.exe
  C:\Windows\System\MUuAznl.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\MKISuZR.exe
  C:\Windows\System\MKISuZR.exe
  2⤵
  PID:1544
- C:\Windows\System\GyHQGGK.exe
  C:\Windows\System\GyHQGGK.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\VUdVPdK.exe
  C:\Windows\System\VUdVPdK.exe
  2⤵
  PID:2196
- C:\Windows\System\SaMldWB.exe
  C:\Windows\System\SaMldWB.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\HaTcZPZ.exe
  C:\Windows\System\HaTcZPZ.exe
  2⤵
  PID:904
- C:\Windows\System\NFSILOe.exe
  C:\Windows\System\NFSILOe.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\QnKPtUe.exe
  C:\Windows\System\QnKPtUe.exe
  2⤵
  PID:2924
- C:\Windows\System\EtNjliQ.exe
  C:\Windows\System\EtNjliQ.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\FeiCNJT.exe
  C:\Windows\System\FeiCNJT.exe
  2⤵
  PID:1892
- C:\Windows\System\aFSffxj.exe
  C:\Windows\System\aFSffxj.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\CSrQmDz.exe
  C:\Windows\System\CSrQmDz.exe
  2⤵
  PID:1620
- C:\Windows\System\BTeLDId.exe
  C:\Windows\System\BTeLDId.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\EfGcBmm.exe
  C:\Windows\System\EfGcBmm.exe
  2⤵
  PID:2200
- C:\Windows\System\obKDcdF.exe
  C:\Windows\System\obKDcdF.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\KhyIKGk.exe
  C:\Windows\System\KhyIKGk.exe
  2⤵
  PID:2132
- C:\Windows\System\LuTCxjF.exe
  C:\Windows\System\LuTCxjF.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\jUxugzZ.exe
  C:\Windows\System\jUxugzZ.exe
  2⤵
  PID:1588
- C:\Windows\System\mZGWaec.exe
  C:\Windows\System\mZGWaec.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\ksHcKlr.exe
  C:\Windows\System\ksHcKlr.exe
  2⤵
  PID:1980
- C:\Windows\System\oSjFmCo.exe
  C:\Windows\System\oSjFmCo.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\PmKAWQg.exe
  C:\Windows\System\PmKAWQg.exe
  2⤵
  PID:1528
- C:\Windows\System\oHtceIw.exe
  C:\Windows\System\oHtceIw.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\xrGCXcK.exe
  C:\Windows\System\xrGCXcK.exe
  2⤵
  PID:2596
- C:\Windows\System\UrknxUl.exe
  C:\Windows\System\UrknxUl.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\LeeeTQY.exe
  C:\Windows\System\LeeeTQY.exe
  2⤵
  PID:1940
- C:\Windows\System\OVWoRNv.exe
  C:\Windows\System\OVWoRNv.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\AaXnjma.exe
  C:\Windows\System\AaXnjma.exe
  2⤵
  PID:2380
- C:\Windows\System\NczqVvc.exe
  C:\Windows\System\NczqVvc.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\traDSMf.exe
  C:\Windows\System\traDSMf.exe
  2⤵
  PID:2216
- C:\Windows\System\yfFTUSJ.exe
  C:\Windows\System\yfFTUSJ.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\DOXUAaI.exe
  C:\Windows\System\DOXUAaI.exe
  2⤵
  PID:1584
- C:\Windows\System\CkspLiU.exe
  C:\Windows\System\CkspLiU.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\mbqbRnV.exe
  C:\Windows\System\mbqbRnV.exe
  2⤵
  PID:2288
- C:\Windows\System\iPQglws.exe
  C:\Windows\System\iPQglws.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\DbjbqBJ.exe
  C:\Windows\System\DbjbqBJ.exe
  2⤵
  PID:2748
- C:\Windows\System\FtgvsCW.exe
  C:\Windows\System\FtgvsCW.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\ixWdPrx.exe
  C:\Windows\System\ixWdPrx.exe
  2⤵
  PID:1768
- C:\Windows\System\nSySrwK.exe
  C:\Windows\System\nSySrwK.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\BvAbSTc.exe
  C:\Windows\System\BvAbSTc.exe
  2⤵
  PID:1700
- C:\Windows\System\JgGopWG.exe
  C:\Windows\System\JgGopWG.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\LEuDEzK.exe
  C:\Windows\System\LEuDEzK.exe
  2⤵
  PID:756
- C:\Windows\System\ZytCnWZ.exe
  C:\Windows\System\ZytCnWZ.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\qPGMvho.exe
  C:\Windows\System\qPGMvho.exe
  2⤵
  PID:872
- C:\Windows\System\OOdGtsG.exe
  C:\Windows\System\OOdGtsG.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\fpRsvDt.exe
  C:\Windows\System\fpRsvDt.exe
  2⤵
  PID:2936
- C:\Windows\System\bYLnErr.exe
  C:\Windows\System\bYLnErr.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\accUohO.exe
  C:\Windows\System\accUohO.exe
  2⤵
  PID:2472
- C:\Windows\System\orjvUXI.exe
  C:\Windows\System\orjvUXI.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\iNnoZIk.exe
  C:\Windows\System\iNnoZIk.exe
  2⤵
  PID:3096
- C:\Windows\System\zshDphT.exe
  C:\Windows\System\zshDphT.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\fQCUHxh.exe
  C:\Windows\System\fQCUHxh.exe
  2⤵
  PID:3128
- C:\Windows\System\KpSwmmi.exe
  C:\Windows\System\KpSwmmi.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\RSCqNYU.exe
  C:\Windows\System\RSCqNYU.exe
  2⤵
  PID:3160
- C:\Windows\System\YRscsOt.exe
  C:\Windows\System\YRscsOt.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\aSmjRQN.exe
  C:\Windows\System\aSmjRQN.exe
  2⤵
  PID:3192
- C:\Windows\System\vLYHrvr.exe
  C:\Windows\System\vLYHrvr.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\AyxPJog.exe
  C:\Windows\System\AyxPJog.exe
  2⤵
  PID:3224
- C:\Windows\System\vHYvOZa.exe
  C:\Windows\System\vHYvOZa.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\uDvPWjG.exe
  C:\Windows\System\uDvPWjG.exe
  2⤵
  PID:3256
- C:\Windows\System\xxxYScC.exe
  C:\Windows\System\xxxYScC.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\rbOhSKR.exe
  C:\Windows\System\rbOhSKR.exe
  2⤵
  PID:3288
- C:\Windows\System\ShuZscG.exe
  C:\Windows\System\ShuZscG.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\younquW.exe
  C:\Windows\System\younquW.exe
  2⤵
  PID:3320
- C:\Windows\System\mAFmFhV.exe
  C:\Windows\System\mAFmFhV.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\XvQpvWK.exe
  C:\Windows\System\XvQpvWK.exe
  2⤵
  PID:3352
- C:\Windows\System\kQTLGdk.exe
  C:\Windows\System\kQTLGdk.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\gBnmlWa.exe
  C:\Windows\System\gBnmlWa.exe
  2⤵
  PID:3384
- C:\Windows\System\WvJRTUV.exe
  C:\Windows\System\WvJRTUV.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\bhWOQXj.exe
  C:\Windows\System\bhWOQXj.exe
  2⤵
  PID:3416
- C:\Windows\System\IRLpUPA.exe
  C:\Windows\System\IRLpUPA.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\sFyeqpt.exe
  C:\Windows\System\sFyeqpt.exe
  2⤵
  PID:3448
- C:\Windows\System\gyUnQcA.exe
  C:\Windows\System\gyUnQcA.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\mHukVpe.exe
  C:\Windows\System\mHukVpe.exe
  2⤵
  PID:3480
- C:\Windows\System\cquWPOn.exe
  C:\Windows\System\cquWPOn.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\mBwSpeM.exe
  C:\Windows\System\mBwSpeM.exe
  2⤵
  PID:3512
- C:\Windows\System\wcZmStt.exe
  C:\Windows\System\wcZmStt.exe
  2⤵
  PID:3528
- C:\Windows\System\jOFrGFp.exe
  C:\Windows\System\jOFrGFp.exe
  2⤵
  PID:3544
- C:\Windows\System\EMinzeU.exe
  C:\Windows\System\EMinzeU.exe
  2⤵
  PID:3560
- C:\Windows\System\tcFFfEQ.exe
  C:\Windows\System\tcFFfEQ.exe
  2⤵
  PID:3576
- C:\Windows\System\fuGCZnr.exe
  C:\Windows\System\fuGCZnr.exe
  2⤵
  PID:3592
- C:\Windows\System\SSlsPHm.exe
  C:\Windows\System\SSlsPHm.exe
  2⤵
  PID:3608
- C:\Windows\System\cVEwVFZ.exe
  C:\Windows\System\cVEwVFZ.exe
  2⤵
  PID:3624
- C:\Windows\System\EqtftBo.exe
  C:\Windows\System\EqtftBo.exe
  2⤵
  PID:3640
- C:\Windows\System\ZqGuOZZ.exe
  C:\Windows\System\ZqGuOZZ.exe
  2⤵
  PID:3656
- C:\Windows\System\UJiYwOf.exe
  C:\Windows\System\UJiYwOf.exe
  2⤵
  PID:3672
- C:\Windows\System\lHNeWrl.exe
  C:\Windows\System\lHNeWrl.exe
  2⤵
  PID:3688
- C:\Windows\System\PLlhUpQ.exe
  C:\Windows\System\PLlhUpQ.exe
  2⤵
  PID:3724
- C:\Windows\System\NnSgJnU.exe
  C:\Windows\System\NnSgJnU.exe
  2⤵
  PID:3744
- C:\Windows\System\UeqSnWa.exe
  C:\Windows\System\UeqSnWa.exe
  2⤵
  PID:3760
- C:\Windows\System\pARjKfr.exe
  C:\Windows\System\pARjKfr.exe
  2⤵
  PID:3776
- C:\Windows\System\yWscwhU.exe
  C:\Windows\System\yWscwhU.exe
  2⤵
  PID:3792
- C:\Windows\System\BqSMZww.exe
  C:\Windows\System\BqSMZww.exe
  2⤵
  PID:3504
- C:\Windows\System\hBUEXwP.exe
  C:\Windows\System\hBUEXwP.exe
  2⤵
  PID:3568
- C:\Windows\System\OAIiXmj.exe
  C:\Windows\System\OAIiXmj.exe
  2⤵
  PID:3632
- C:\Windows\System\aFaHKdx.exe
  C:\Windows\System\aFaHKdx.exe
  2⤵
  PID:2640
- C:\Windows\System\xtKdfXN.exe
  C:\Windows\System\xtKdfXN.exe
  2⤵
  PID:2560
- C:\Windows\System\NkgLrht.exe
  C:\Windows\System\NkgLrht.exe
  2⤵
  PID:3716
- C:\Windows\System\MLvoqpG.exe
  C:\Windows\System\MLvoqpG.exe
  2⤵
  PID:1760
- C:\Windows\System\QHRPbyP.exe
  C:\Windows\System\QHRPbyP.exe
  2⤵
  PID:1428
- C:\Windows\System\ellqlEj.exe
  C:\Windows\System\ellqlEj.exe
  2⤵
  PID:3428
- C:\Windows\System\TSspxWz.exe
  C:\Windows\System\TSspxWz.exe
  2⤵
  PID:3268
- C:\Windows\System\eXRERHD.exe
  C:\Windows\System\eXRERHD.exe
  2⤵
  PID:3076
- C:\Windows\System\hrzkEOU.exe
  C:\Windows\System\hrzkEOU.exe
  2⤵
  PID:1048
- C:\Windows\System\gYCslRH.exe
  C:\Windows\System\gYCslRH.exe
  2⤵
  PID:2148
- C:\Windows\System\STzYHWv.exe
  C:\Windows\System\STzYHWv.exe
  2⤵
  PID:2032
- C:\Windows\System\nXZtGrs.exe
  C:\Windows\System\nXZtGrs.exe
  2⤵
  PID:1256
- C:\Windows\System\izVHnhs.exe
  C:\Windows\System\izVHnhs.exe
  2⤵
  PID:344
- C:\Windows\System\lsryNbR.exe
  C:\Windows\System\lsryNbR.exe
  2⤵
  PID:2796
- C:\Windows\System\iUFruaj.exe
  C:\Windows\System\iUFruaj.exe
  2⤵
  PID:3756
- C:\Windows\System\ccQeBvk.exe
  C:\Windows\System\ccQeBvk.exe
  2⤵
  PID:3736
- C:\Windows\System\jzNWlLB.exe
  C:\Windows\System\jzNWlLB.exe
  2⤵
  PID:3768
- C:\Windows\System\yoBJqhy.exe
  C:\Windows\System\yoBJqhy.exe
  2⤵
  PID:2064
- C:\Windows\System\qHuPQNk.exe
  C:\Windows\System\qHuPQNk.exe
  2⤵
  PID:2480
- C:\Windows\System\lxKHamM.exe
  C:\Windows\System\lxKHamM.exe
  2⤵
  PID:2744
- C:\Windows\System\xAcrERP.exe
  C:\Windows\System\xAcrERP.exe
  2⤵
  PID:2732
- C:\Windows\System\mslcNFd.exe
  C:\Windows\System\mslcNFd.exe
  2⤵
  PID:2012
- C:\Windows\System\UTZEMVP.exe
  C:\Windows\System\UTZEMVP.exe
  2⤵
  PID:1180
- C:\Windows\System\exRfFjs.exe
  C:\Windows\System\exRfFjs.exe
  2⤵
  PID:3584
- C:\Windows\System\NrgcorA.exe
  C:\Windows\System\NrgcorA.exe
  2⤵
  PID:3460
- C:\Windows\System\qiLsrEt.exe
  C:\Windows\System\qiLsrEt.exe
  2⤵
  PID:3172
- C:\Windows\System\DOlzhCs.exe
  C:\Windows\System\DOlzhCs.exe
  2⤵
  PID:3108
- C:\Windows\System\weIyPLl.exe
  C:\Windows\System\weIyPLl.exe
  2⤵
  PID:960
- C:\Windows\System\HUOuYvn.exe
  C:\Windows\System\HUOuYvn.exe
  2⤵
  PID:2664
- C:\Windows\System\VUXTDqa.exe
  C:\Windows\System\VUXTDqa.exe
  2⤵
  PID:1536
- C:\Windows\System\apuurPf.exe
  C:\Windows\System\apuurPf.exe
  2⤵
  PID:1668
- C:\Windows\System\HlKqSQy.exe
  C:\Windows\System\HlKqSQy.exe
  2⤵
  PID:1468
- C:\Windows\System\cNmpAqZ.exe
  C:\Windows\System\cNmpAqZ.exe
  2⤵
  PID:3328
- C:\Windows\System\DDlTHAa.exe
  C:\Windows\System\DDlTHAa.exe
  2⤵
  PID:2600
- C:\Windows\System\VIJaadp.exe
  C:\Windows\System\VIJaadp.exe
  2⤵
  PID:1632
- C:\Windows\System\fytdpJy.exe
  C:\Windows\System\fytdpJy.exe
  2⤵
  PID:2712
- C:\Windows\System\DrmqlbC.exe
  C:\Windows\System\DrmqlbC.exe
  2⤵
  PID:292
- C:\Windows\System\dOjknKb.exe
  C:\Windows\System\dOjknKb.exe
  2⤵
  PID:332
- C:\Windows\System\xgUIgkR.exe
  C:\Windows\System\xgUIgkR.exe
  2⤵
  PID:2716
- C:\Windows\System\uTRzvQk.exe
  C:\Windows\System\uTRzvQk.exe
  2⤵
  PID:2124
- C:\Windows\System\cOxNuLZ.exe
  C:\Windows\System\cOxNuLZ.exe
  2⤵
  PID:2160
- C:\Windows\System\NWpLjUs.exe
  C:\Windows\System\NWpLjUs.exe
  2⤵
  PID:2260
- C:\Windows\System\TEsQPfE.exe
  C:\Windows\System\TEsQPfE.exe
  2⤵
  PID:1552
- C:\Windows\System\AKsYCwk.exe
  C:\Windows\System\AKsYCwk.exe
  2⤵
  PID:1252
- C:\Windows\System\qBleVME.exe
  C:\Windows\System\qBleVME.exe
  2⤵
  PID:3136
- C:\Windows\System\ciFbSBj.exe
  C:\Windows\System\ciFbSBj.exe
  2⤵
  PID:284
- C:\Windows\System\hdyCtee.exe
  C:\Windows\System\hdyCtee.exe
  2⤵
  PID:2416
- C:\Windows\System\vyPpnGa.exe
  C:\Windows\System\vyPpnGa.exe
  2⤵
  PID:2784
- C:\Windows\System\ljfLXTZ.exe
  C:\Windows\System\ljfLXTZ.exe
  2⤵
  PID:1884
- C:\Windows\System\FdEJVVF.exe
  C:\Windows\System\FdEJVVF.exe
  2⤵
  PID:3540
- C:\Windows\System\BJShjiu.exe
  C:\Windows\System\BJShjiu.exe
  2⤵
  PID:3664
- C:\Windows\System\XBJrEhf.exe
  C:\Windows\System\XBJrEhf.exe
  2⤵
  PID:4108
- C:\Windows\System\vQvZpBv.exe
  C:\Windows\System\vQvZpBv.exe
  2⤵
  PID:4124
- C:\Windows\System\nHJFNsJ.exe
  C:\Windows\System\nHJFNsJ.exe
  2⤵
  PID:4140
- C:\Windows\System\TAJERlz.exe
  C:\Windows\System\TAJERlz.exe
  2⤵
  PID:4156
- C:\Windows\System\CjRSkpY.exe
  C:\Windows\System\CjRSkpY.exe
  2⤵
  PID:4172
- C:\Windows\System\zmLwEPn.exe
  C:\Windows\System\zmLwEPn.exe
  2⤵
  PID:4188
- C:\Windows\System\GXfFpQM.exe
  C:\Windows\System\GXfFpQM.exe
  2⤵
  PID:4204
- C:\Windows\System\xQOFFnI.exe
  C:\Windows\System\xQOFFnI.exe
  2⤵
  PID:4220
- C:\Windows\System\hnbjemg.exe
  C:\Windows\System\hnbjemg.exe
  2⤵
  PID:4236
- C:\Windows\System\ugdYSXR.exe
  C:\Windows\System\ugdYSXR.exe
  2⤵
  PID:4252
- C:\Windows\System\muDAGEn.exe
  C:\Windows\System\muDAGEn.exe
  2⤵
  PID:4268
- C:\Windows\System\XfRojab.exe
  C:\Windows\System\XfRojab.exe
  2⤵
  PID:4296
- C:\Windows\System\VWgyPxZ.exe
  C:\Windows\System\VWgyPxZ.exe
  2⤵
  PID:4432
- C:\Windows\System\XmvmndO.exe
  C:\Windows\System\XmvmndO.exe
  2⤵
  PID:4520
- C:\Windows\System\DyaMqdq.exe
  C:\Windows\System\DyaMqdq.exe
  2⤵
  PID:4536
- C:\Windows\System\KyDFrmP.exe
  C:\Windows\System\KyDFrmP.exe
  2⤵
  PID:4552
- C:\Windows\System\tyIhGIg.exe
  C:\Windows\System\tyIhGIg.exe
  2⤵
  PID:4568
- C:\Windows\System\trgSqeo.exe
  C:\Windows\System\trgSqeo.exe
  2⤵
  PID:4584
- C:\Windows\System\jyYvoZP.exe
  C:\Windows\System\jyYvoZP.exe
  2⤵
  PID:4628
- C:\Windows\System\xGhdKlB.exe
  C:\Windows\System\xGhdKlB.exe
  2⤵
  PID:4644
- C:\Windows\System\MVuLEpr.exe
  C:\Windows\System\MVuLEpr.exe
  2⤵
  PID:4660
- C:\Windows\System\bxFNTbk.exe
  C:\Windows\System\bxFNTbk.exe
  2⤵
  PID:4676
- C:\Windows\System\sIVgLZh.exe
  C:\Windows\System\sIVgLZh.exe
  2⤵
  PID:4692
- C:\Windows\System\YfUjggS.exe
  C:\Windows\System\YfUjggS.exe
  2⤵
  PID:4708
- C:\Windows\System\mfRTexr.exe
  C:\Windows\System\mfRTexr.exe
  2⤵
  PID:4724
- C:\Windows\System\GoAcshw.exe
  C:\Windows\System\GoAcshw.exe
  2⤵
  PID:4740
- C:\Windows\System\ADhgNpv.exe
  C:\Windows\System\ADhgNpv.exe
  2⤵
  PID:4756
- C:\Windows\System\CWAPCHF.exe
  C:\Windows\System\CWAPCHF.exe
  2⤵
  PID:4772
- C:\Windows\System\igFLsPP.exe
  C:\Windows\System\igFLsPP.exe
  2⤵
  PID:4788
- C:\Windows\System\KZIgJrg.exe
  C:\Windows\System\KZIgJrg.exe
  2⤵
  PID:4804
- C:\Windows\System\kpKzUdQ.exe
  C:\Windows\System\kpKzUdQ.exe
  2⤵
  PID:4820
- C:\Windows\System\EzFBhak.exe
  C:\Windows\System\EzFBhak.exe
  2⤵
  PID:4836
- C:\Windows\System\ByGkHFG.exe
  C:\Windows\System\ByGkHFG.exe
  2⤵
  PID:4852
- C:\Windows\System\RJSHPcD.exe
  C:\Windows\System\RJSHPcD.exe
  2⤵
  PID:4868
- C:\Windows\System\NohiSqa.exe
  C:\Windows\System\NohiSqa.exe
  2⤵
  PID:4884
- C:\Windows\System\LnviDbH.exe
  C:\Windows\System\LnviDbH.exe
  2⤵
  PID:4900
- C:\Windows\System\XCYcoHH.exe
  C:\Windows\System\XCYcoHH.exe
  2⤵
  PID:4920
- C:\Windows\System\yTlpyIb.exe
  C:\Windows\System\yTlpyIb.exe
  2⤵
  PID:4936
- C:\Windows\System\KBaxHNv.exe
  C:\Windows\System\KBaxHNv.exe
  2⤵
  PID:4952
- C:\Windows\System\hmyABvf.exe
  C:\Windows\System\hmyABvf.exe
  2⤵
  PID:4968
- C:\Windows\System\EovJzbw.exe
  C:\Windows\System\EovJzbw.exe
  2⤵
  PID:4984
- C:\Windows\System\PqRbiGL.exe
  C:\Windows\System\PqRbiGL.exe
  2⤵
  PID:5000
- C:\Windows\System\CgZcRcc.exe
  C:\Windows\System\CgZcRcc.exe
  2⤵
  PID:5016
- C:\Windows\System\LGUCHFy.exe
  C:\Windows\System\LGUCHFy.exe
  2⤵
  PID:5036
- C:\Windows\System\lxGuFWc.exe
  C:\Windows\System\lxGuFWc.exe
  2⤵
  PID:5052
- C:\Windows\System\wKRoNqk.exe
  C:\Windows\System\wKRoNqk.exe
  2⤵
  PID:5072
- C:\Windows\System\puNFRQc.exe
  C:\Windows\System\puNFRQc.exe
  2⤵
  PID:5088
- C:\Windows\System\GDjBqgT.exe
  C:\Windows\System\GDjBqgT.exe
  2⤵
  PID:2420
- C:\Windows\System\RDxMjSt.exe
  C:\Windows\System\RDxMjSt.exe
  2⤵
  PID:3668
- C:\Windows\System\OPNnKPc.exe
  C:\Windows\System\OPNnKPc.exe
  2⤵
  PID:4152
- C:\Windows\System\EGygcew.exe
  C:\Windows\System\EGygcew.exe
  2⤵
  PID:4216
- C:\Windows\System\AtsarSY.exe
  C:\Windows\System\AtsarSY.exe
  2⤵
  PID:4292
- C:\Windows\System\EGEgXMk.exe
  C:\Windows\System\EGEgXMk.exe
  2⤵
  PID:3600
- C:\Windows\System\HWbgOSZ.exe
  C:\Windows\System\HWbgOSZ.exe
  2⤵
  PID:2552
- C:\Windows\System\QGVjiFY.exe
  C:\Windows\System\QGVjiFY.exe
  2⤵
  PID:1380
- C:\Windows\System\DHdCClJ.exe
  C:\Windows\System\DHdCClJ.exe
  2⤵
  PID:1244
- C:\Windows\System\iJIWlPp.exe
  C:\Windows\System\iJIWlPp.exe
  2⤵
  PID:4232
- C:\Windows\System\VzHZvBj.exe
  C:\Windows\System\VzHZvBj.exe
  2⤵
  PID:4308
- C:\Windows\System\DFepUYk.exe
  C:\Windows\System\DFepUYk.exe
  2⤵
  PID:4332
- C:\Windows\System\gPSFBHe.exe
  C:\Windows\System\gPSFBHe.exe
  2⤵
  PID:2332
- C:\Windows\System\jFxiQqm.exe
  C:\Windows\System\jFxiQqm.exe
  2⤵
  PID:2940
- C:\Windows\System\bljVfDn.exe
  C:\Windows\System\bljVfDn.exe
  2⤵
  PID:1744
- C:\Windows\System\cPohcDg.exe
  C:\Windows\System\cPohcDg.exe
  2⤵
  PID:4360
- C:\Windows\System\LNwDUUF.exe
  C:\Windows\System\LNwDUUF.exe
  2⤵
  PID:4452
- C:\Windows\System\DDQWubt.exe
  C:\Windows\System\DDQWubt.exe
  2⤵
  PID:4460
- C:\Windows\System\lgNROno.exe
  C:\Windows\System\lgNROno.exe
  2⤵
  PID:4384
- C:\Windows\System\XJVugVM.exe
  C:\Windows\System\XJVugVM.exe
  2⤵
  PID:4404
- C:\Windows\System\oZSsuKz.exe
  C:\Windows\System\oZSsuKz.exe
  2⤵
  PID:4420
- C:\Windows\System\LlWNQbi.exe
  C:\Windows\System\LlWNQbi.exe
  2⤵
  PID:864
- C:\Windows\System\tHbrMyH.exe
  C:\Windows\System\tHbrMyH.exe
  2⤵
  PID:2844
- C:\Windows\System\yRraQOB.exe
  C:\Windows\System\yRraQOB.exe
  2⤵
  PID:2252
- C:\Windows\System\ZTTWFQU.exe
  C:\Windows\System\ZTTWFQU.exe
  2⤵
  PID:3300
- C:\Windows\System\gJUeWKd.exe
  C:\Windows\System\gJUeWKd.exe
  2⤵
  PID:4484
- C:\Windows\System\nuryVTs.exe
  C:\Windows\System\nuryVTs.exe
  2⤵
  PID:4504
- C:\Windows\System\SaDbtWN.exe
  C:\Windows\System\SaDbtWN.exe
  2⤵
  PID:4508
- C:\Windows\System\HAFMHxA.exe
  C:\Windows\System\HAFMHxA.exe
  2⤵
  PID:4548
- C:\Windows\System\gawtZDt.exe
  C:\Windows\System\gawtZDt.exe
  2⤵
  PID:1456
- C:\Windows\System\FKLRcWc.exe
  C:\Windows\System\FKLRcWc.exe
  2⤵
  PID:4600
- C:\Windows\System\JatoWzA.exe
  C:\Windows\System\JatoWzA.exe
  2⤵
  PID:4624
- C:\Windows\System\QmTNgGI.exe
  C:\Windows\System\QmTNgGI.exe
  2⤵
  PID:1624
- C:\Windows\System\rAYSHDM.exe
  C:\Windows\System\rAYSHDM.exe
  2⤵
  PID:4668
- C:\Windows\System\KJIGWtH.exe
  C:\Windows\System\KJIGWtH.exe
  2⤵
  PID:4732
- C:\Windows\System\AVfnEll.exe
  C:\Windows\System\AVfnEll.exe
  2⤵
  PID:2104
- C:\Windows\System\dhhFPuF.exe
  C:\Windows\System\dhhFPuF.exe
  2⤵
  PID:4720
- C:\Windows\System\OwnFhrK.exe
  C:\Windows\System\OwnFhrK.exe
  2⤵
  PID:4784
- C:\Windows\System\ebKqZgM.exe
  C:\Windows\System\ebKqZgM.exe
  2⤵
  PID:4848
- C:\Windows\System\ubjkquc.exe
  C:\Windows\System\ubjkquc.exe
  2⤵
  PID:4916
- C:\Windows\System\isfYCxw.exe
  C:\Windows\System\isfYCxw.exe
  2⤵
  PID:4768
- C:\Windows\System\yZXiZxz.exe
  C:\Windows\System\yZXiZxz.exe
  2⤵
  PID:4832
- C:\Windows\System\JqMQHLy.exe
  C:\Windows\System\JqMQHLy.exe
  2⤵
  PID:4896
- C:\Windows\System\LyEUcVr.exe
  C:\Windows\System\LyEUcVr.exe
  2⤵
  PID:4992
- C:\Windows\System\kohilKw.exe
  C:\Windows\System\kohilKw.exe
  2⤵
  PID:5032
- C:\Windows\System\jKOCMmA.exe
  C:\Windows\System\jKOCMmA.exe
  2⤵
  PID:5096
- C:\Windows\System\HueeEXM.exe
  C:\Windows\System\HueeEXM.exe
  2⤵
  PID:5112
- C:\Windows\System\oYJMNGY.exe
  C:\Windows\System\oYJMNGY.exe
  2⤵
  PID:672
- C:\Windows\System\znFgUqp.exe
  C:\Windows\System\znFgUqp.exe
  2⤵
  PID:3360
- C:\Windows\System\amtJjdo.exe
  C:\Windows\System\amtJjdo.exe
  2⤵
  PID:1572
- C:\Windows\System\qARSvue.exe
  C:\Windows\System\qARSvue.exe
  2⤵
  PID:1556
- C:\Windows\System\rIJeUDy.exe
  C:\Windows\System\rIJeUDy.exe
  2⤵
  PID:356
- C:\Windows\System\NmQkuaf.exe
  C:\Windows\System\NmQkuaf.exe
  2⤵
  PID:3492
- C:\Windows\System\olzEMiI.exe
  C:\Windows\System\olzEMiI.exe
  2⤵
  PID:4276
- C:\Windows\System\lqczYar.exe
  C:\Windows\System\lqczYar.exe
  2⤵
  PID:1080
- C:\Windows\System\tnvGSnC.exe
  C:\Windows\System\tnvGSnC.exe
  2⤵
  PID:5044
- C:\Windows\System\brfcIbo.exe
  C:\Windows\System\brfcIbo.exe
  2⤵
  PID:3684
- C:\Windows\System\lWNZrsA.exe
  C:\Windows\System\lWNZrsA.exe
  2⤵
  PID:1712
- C:\Windows\System\slVCHdC.exe
  C:\Windows\System\slVCHdC.exe
  2⤵
  PID:4104
- C:\Windows\System\BxQYRMd.exe
  C:\Windows\System\BxQYRMd.exe
  2⤵
  PID:276
- C:\Windows\System\GjBXTdR.exe
  C:\Windows\System\GjBXTdR.exe
  2⤵
  PID:4372
- C:\Windows\System\dDrkuYG.exe
  C:\Windows\System\dDrkuYG.exe
  2⤵
  PID:916
- C:\Windows\System\tmXTREF.exe
  C:\Windows\System\tmXTREF.exe
  2⤵
  PID:1268
- C:\Windows\System\NTLfuuq.exe
  C:\Windows\System\NTLfuuq.exe
  2⤵
  PID:4196
- C:\Windows\System\bfFWIBn.exe
  C:\Windows\System\bfFWIBn.exe
  2⤵
  PID:4328
- C:\Windows\System\AGFLlId.exe
  C:\Windows\System\AGFLlId.exe
  2⤵
  PID:4348
- C:\Windows\System\ADZLZeZ.exe
  C:\Windows\System\ADZLZeZ.exe
  2⤵
  PID:2000
- C:\Windows\System\fbZjLmY.exe
  C:\Windows\System\fbZjLmY.exe
  2⤵
  PID:4456
- C:\Windows\System\VufkGNU.exe
  C:\Windows\System\VufkGNU.exe
  2⤵
  PID:4476
- C:\Windows\System\JFLrBLh.exe
  C:\Windows\System\JFLrBLh.exe
  2⤵
  PID:4392
- C:\Windows\System\XBbfquK.exe
  C:\Windows\System\XBbfquK.exe
  2⤵
  PID:4396
- C:\Windows\System\hsUXgCe.exe
  C:\Windows\System\hsUXgCe.exe
  2⤵
  PID:2632
- C:\Windows\System\fuoWPGs.exe
  C:\Windows\System\fuoWPGs.exe
  2⤵
  PID:4516
- C:\Windows\System\GkohEXb.exe
  C:\Windows\System\GkohEXb.exe
  2⤵
  PID:4560
- C:\Windows\System\VNVpHJc.exe
  C:\Windows\System\VNVpHJc.exe
  2⤵
  PID:2440
- C:\Windows\System\OKLXDnE.exe
  C:\Windows\System\OKLXDnE.exe
  2⤵
  PID:4844
- C:\Windows\System\RAtlvik.exe
  C:\Windows\System\RAtlvik.exe
  2⤵
  PID:4704
- C:\Windows\System\JxzogkN.exe
  C:\Windows\System\JxzogkN.exe
  2⤵
  PID:5028
- C:\Windows\System\vhLrWwJ.exe
  C:\Windows\System\vhLrWwJ.exe
  2⤵
  PID:4428
- C:\Windows\System\BETxfzQ.exe
  C:\Windows\System\BETxfzQ.exe
  2⤵
  PID:2536
- C:\Windows\System\iaOkcOC.exe
  C:\Windows\System\iaOkcOC.exe
  2⤵
  PID:4580
- C:\Windows\System\KgahgNM.exe
  C:\Windows\System\KgahgNM.exe
  2⤵
  PID:4656
- C:\Windows\System\rZoPVNx.exe
  C:\Windows\System\rZoPVNx.exe
  2⤵
  PID:4908
- C:\Windows\System\IdtdCNR.exe
  C:\Windows\System\IdtdCNR.exe
  2⤵
  PID:4960
- C:\Windows\System\yyFBjDg.exe
  C:\Windows\System\yyFBjDg.exe
  2⤵
  PID:5116
- C:\Windows\System\AgvpNTe.exe
  C:\Windows\System\AgvpNTe.exe
  2⤵
  PID:4912
- C:\Windows\System\poqTcbr.exe
  C:\Windows\System\poqTcbr.exe
  2⤵
  PID:5080
- C:\Windows\System\DuCLHRy.exe
  C:\Windows\System\DuCLHRy.exe
  2⤵
  PID:2428
- C:\Windows\System\hDVEOjT.exe
  C:\Windows\System\hDVEOjT.exe
  2⤵
  PID:2736
- C:\Windows\System\zavmCoY.exe
  C:\Windows\System\zavmCoY.exe
  2⤵
  PID:5008
- C:\Windows\System\CClGTXa.exe
  C:\Windows\System\CClGTXa.exe
  2⤵
  PID:4612
- C:\Windows\System\RkdXKBh.exe
  C:\Windows\System\RkdXKBh.exe
  2⤵
  PID:3024
- C:\Windows\System\MLLBnVu.exe
  C:\Windows\System\MLLBnVu.exe
  2⤵
  PID:4100
- C:\Windows\System\PuaeBVr.exe
  C:\Windows\System\PuaeBVr.exe
  2⤵
  PID:4368
- C:\Windows\System\dWOAMMa.exe
  C:\Windows\System\dWOAMMa.exe
  2⤵
  PID:4356
- C:\Windows\System\OZzQRjz.exe
  C:\Windows\System\OZzQRjz.exe
  2⤵
  PID:4284
- C:\Windows\System\FWovzpY.exe
  C:\Windows\System\FWovzpY.exe
  2⤵
  PID:4716
- C:\Windows\System\HNbTCEU.exe
  C:\Windows\System\HNbTCEU.exe
  2⤵
  PID:4448
- C:\Windows\System\KIEVnUF.exe
  C:\Windows\System\KIEVnUF.exe
  2⤵
  PID:2408
- C:\Windows\System\gVuIqQm.exe
  C:\Windows\System\gVuIqQm.exe
  2⤵
  PID:4652
- C:\Windows\System\nQjqrgp.exe
  C:\Windows\System\nQjqrgp.exe
  2⤵
  PID:2120
- C:\Windows\System\bBQdQXj.exe
  C:\Windows\System\bBQdQXj.exe
  2⤵
  PID:4212
- C:\Windows\System\XMtLGve.exe
  C:\Windows\System\XMtLGve.exe
  2⤵
  PID:580
- C:\Windows\System\ldLooJY.exe
  C:\Windows\System\ldLooJY.exe
  2⤵
  PID:4312
- C:\Windows\System\sOFoVCw.exe
  C:\Windows\System\sOFoVCw.exe
  2⤵
  PID:4596
- C:\Windows\System\cnLMHGr.exe
  C:\Windows\System\cnLMHGr.exe
  2⤵
  PID:2276
- C:\Windows\System\oRFVgdy.exe
  C:\Windows\System\oRFVgdy.exe
  2⤵
  PID:1836
- C:\Windows\System\SnTSQdi.exe
  C:\Windows\System\SnTSQdi.exe
  2⤵
  PID:2540
- C:\Windows\System\wENeQdM.exe
  C:\Windows\System\wENeQdM.exe
  2⤵
  PID:5064
- C:\Windows\System\fEhoKwI.exe
  C:\Windows\System\fEhoKwI.exe
  2⤵
  PID:4376
- C:\Windows\System\qKKAoVx.exe
  C:\Windows\System\qKKAoVx.exe
  2⤵
  PID:2832
- C:\Windows\System\SDQyadk.exe
  C:\Windows\System\SDQyadk.exe
  2⤵
  PID:3236
- C:\Windows\System\VtaygpO.exe
  C:\Windows\System\VtaygpO.exe
  2⤵
  PID:5024
- C:\Windows\System\RpCWaqI.exe
  C:\Windows\System\RpCWaqI.exe
  2⤵
  PID:5104
- C:\Windows\System\OjgwVbY.exe
  C:\Windows\System\OjgwVbY.exe
  2⤵
  PID:4304
- C:\Windows\System\heegcnU.exe
  C:\Windows\System\heegcnU.exe
  2⤵
  PID:1688
- C:\Windows\System\ckjCNOk.exe
  C:\Windows\System\ckjCNOk.exe
  2⤵
  PID:3296
- C:\Windows\System\kgSVKIY.exe
  C:\Windows\System\kgSVKIY.exe
  2⤵
  PID:2128
- C:\Windows\System\xlfAZdr.exe
  C:\Windows\System\xlfAZdr.exe
  2⤵
  PID:5068
- C:\Windows\System\ofHnxTq.exe
  C:\Windows\System\ofHnxTq.exe
  2⤵
  PID:4228
- C:\Windows\System\ZyhygOk.exe
  C:\Windows\System\ZyhygOk.exe
  2⤵
  PID:4412
- C:\Windows\System\vnJBrSY.exe
  C:\Windows\System\vnJBrSY.exe
  2⤵
  PID:544
- C:\Windows\System\rBKXVOP.exe
  C:\Windows\System\rBKXVOP.exe
  2⤵
  PID:2812
- C:\Windows\System\VDsJHAZ.exe
  C:\Windows\System\VDsJHAZ.exe
  2⤵
  PID:1644
- C:\Windows\System\auRHjdx.exe
  C:\Windows\System\auRHjdx.exe
  2⤵
  PID:4472
- C:\Windows\System\WOEsFtx.exe
  C:\Windows\System\WOEsFtx.exe
  2⤵
  PID:4480
- C:\Windows\System\wxfqlnV.exe
  C:\Windows\System\wxfqlnV.exe
  2⤵
  PID:4380
- C:\Windows\System\eoopeot.exe
  C:\Windows\System\eoopeot.exe
  2⤵
  PID:4636
- C:\Windows\System\kUshYaz.exe
  C:\Windows\System\kUshYaz.exe
  2⤵
  PID:5124
- C:\Windows\System\sBSCLIZ.exe
  C:\Windows\System\sBSCLIZ.exe
  2⤵
  PID:5164
- C:\Windows\System\GlCURoQ.exe
  C:\Windows\System\GlCURoQ.exe
  2⤵
  PID:5196
- C:\Windows\System\VFBzYBS.exe
  C:\Windows\System\VFBzYBS.exe
  2⤵
  PID:5224
- C:\Windows\System\TitCsyk.exe
  C:\Windows\System\TitCsyk.exe
  2⤵
  PID:5264
- C:\Windows\System\XOfghZi.exe
  C:\Windows\System\XOfghZi.exe
  2⤵
  PID:5288
- C:\Windows\System\RPaHZPj.exe
  C:\Windows\System\RPaHZPj.exe
  2⤵
  PID:5304
- C:\Windows\System\LyaDGFD.exe
  C:\Windows\System\LyaDGFD.exe
  2⤵
  PID:5320
- C:\Windows\System\qnHRNtR.exe
  C:\Windows\System\qnHRNtR.exe
  2⤵
  PID:5336
- C:\Windows\System\vhaIeZy.exe
  C:\Windows\System\vhaIeZy.exe
  2⤵
  PID:5352
- C:\Windows\System\nwYEVgs.exe
  C:\Windows\System\nwYEVgs.exe
  2⤵
  PID:5380
- C:\Windows\System\ULleMYC.exe
  C:\Windows\System\ULleMYC.exe
  2⤵
  PID:5396
- C:\Windows\System\ccutSOa.exe
  C:\Windows\System\ccutSOa.exe
  2⤵
  PID:5412
- C:\Windows\System\wXBRBOz.exe
  C:\Windows\System\wXBRBOz.exe
  2⤵
  PID:5428
- C:\Windows\System\Yxwtpqs.exe
  C:\Windows\System\Yxwtpqs.exe
  2⤵
  PID:5444
- C:\Windows\System\wFolykc.exe
  C:\Windows\System\wFolykc.exe
  2⤵
  PID:5460
- C:\Windows\System\nIxDhry.exe
  C:\Windows\System\nIxDhry.exe
  2⤵
  PID:5476
- C:\Windows\System\SBWgeVv.exe
  C:\Windows\System\SBWgeVv.exe
  2⤵
  PID:5492
- C:\Windows\System\hvIsaCo.exe
  C:\Windows\System\hvIsaCo.exe
  2⤵
  PID:5508
- C:\Windows\System\gtiCZhJ.exe
  C:\Windows\System\gtiCZhJ.exe
  2⤵
  PID:5524
- C:\Windows\System\WtAVjeR.exe
  C:\Windows\System\WtAVjeR.exe
  2⤵
  PID:5540
- C:\Windows\System\otlcEbR.exe
  C:\Windows\System\otlcEbR.exe
  2⤵
  PID:5560
- C:\Windows\System\WsjKDoH.exe
  C:\Windows\System\WsjKDoH.exe
  2⤵
  PID:5576
- C:\Windows\System\tDXAiBk.exe
  C:\Windows\System\tDXAiBk.exe
  2⤵
  PID:5592
- C:\Windows\System\YsDtpmk.exe
  C:\Windows\System\YsDtpmk.exe
  2⤵
  PID:5608
- C:\Windows\System\RPMiFiu.exe
  C:\Windows\System\RPMiFiu.exe
  2⤵
  PID:5624
- C:\Windows\System\WjIRRKK.exe
  C:\Windows\System\WjIRRKK.exe
  2⤵
  PID:5644
- C:\Windows\System\UrbGpiA.exe
  C:\Windows\System\UrbGpiA.exe
  2⤵
  PID:5660
- C:\Windows\System\DWcBTeY.exe
  C:\Windows\System\DWcBTeY.exe
  2⤵
  PID:5716
- C:\Windows\System\VgDZKdQ.exe
  C:\Windows\System\VgDZKdQ.exe
  2⤵
  PID:5732
- C:\Windows\System\vBQzMkF.exe
  C:\Windows\System\vBQzMkF.exe
  2⤵
  PID:5756
- C:\Windows\System\kTvcXca.exe
  C:\Windows\System\kTvcXca.exe
  2⤵
  PID:5772
- C:\Windows\System\KAdszcf.exe
  C:\Windows\System\KAdszcf.exe
  2⤵
  PID:5788
- C:\Windows\System\sSYkGyl.exe
  C:\Windows\System\sSYkGyl.exe
  2⤵
  PID:5808
- C:\Windows\System\CFtWPCm.exe
  C:\Windows\System\CFtWPCm.exe
  2⤵
  PID:5828
- C:\Windows\System\IJzotrp.exe
  C:\Windows\System\IJzotrp.exe
  2⤵
  PID:5888
- C:\Windows\System\WJUeAft.exe
  C:\Windows\System\WJUeAft.exe
  2⤵
  PID:5904
- C:\Windows\System\YuKPcXD.exe
  C:\Windows\System\YuKPcXD.exe
  2⤵
  PID:5920
- C:\Windows\System\lbjBXrX.exe
  C:\Windows\System\lbjBXrX.exe
  2⤵
  PID:5936
- C:\Windows\System\LvZMmUA.exe
  C:\Windows\System\LvZMmUA.exe
  2⤵
  PID:5952
- C:\Windows\System\BiJBfFL.exe
  C:\Windows\System\BiJBfFL.exe
  2⤵
  PID:5968
- C:\Windows\System\EIbDtYk.exe
  C:\Windows\System\EIbDtYk.exe
  2⤵
  PID:5984
- C:\Windows\System\exORKuh.exe
  C:\Windows\System\exORKuh.exe
  2⤵
  PID:6000
- C:\Windows\System\IGXemow.exe
  C:\Windows\System\IGXemow.exe
  2⤵
  PID:6068
- C:\Windows\System\xwwJyBt.exe
  C:\Windows\System\xwwJyBt.exe
  2⤵
  PID:6084
- C:\Windows\System\DEYHKpD.exe
  C:\Windows\System\DEYHKpD.exe
  2⤵
  PID:6104
- C:\Windows\System\yKtGrQe.exe
  C:\Windows\System\yKtGrQe.exe
  2⤵
  PID:5220
- C:\Windows\System\WxMkykw.exe
  C:\Windows\System\WxMkykw.exe
  2⤵
  PID:5236
- C:\Windows\System\uIfGKLt.exe
  C:\Windows\System\uIfGKLt.exe
  2⤵
  PID:5260
- C:\Windows\System\uACfeMP.exe
  C:\Windows\System\uACfeMP.exe
  2⤵
  PID:5280
- C:\Windows\System\OAgfZcA.exe
  C:\Windows\System\OAgfZcA.exe
  2⤵
  PID:5368
- C:\Windows\System\nxnsCae.exe
  C:\Windows\System\nxnsCae.exe
  2⤵
  PID:5316
- C:\Windows\System\FlgBLTK.exe
  C:\Windows\System\FlgBLTK.exe
  2⤵
  PID:5348
- C:\Windows\System\cBrxqJy.exe
  C:\Windows\System\cBrxqJy.exe
  2⤵
  PID:5500
- C:\Windows\System\XbDJeRE.exe
  C:\Windows\System\XbDJeRE.exe
  2⤵
  PID:5472
- C:\Windows\System\erZRDIO.exe
  C:\Windows\System\erZRDIO.exe
  2⤵
  PID:5572
- C:\Windows\System\uFfqyQT.exe
  C:\Windows\System\uFfqyQT.exe
  2⤵
  PID:5556
- C:\Windows\System\szIkSdp.exe
  C:\Windows\System\szIkSdp.exe
  2⤵
  PID:5420
- C:\Windows\System\HXcSEfT.exe
  C:\Windows\System\HXcSEfT.exe
  2⤵
  PID:5488
- C:\Windows\System\EDsFmyT.exe
  C:\Windows\System\EDsFmyT.exe
  2⤵
  PID:5632
- C:\Windows\System\fYXQmva.exe
  C:\Windows\System\fYXQmva.exe
  2⤵
  PID:5636
- C:\Windows\System\OOzSxJE.exe
  C:\Windows\System\OOzSxJE.exe
  2⤵
  PID:5676
- C:\Windows\System\coVetnb.exe
  C:\Windows\System\coVetnb.exe
  2⤵
  PID:5688
- C:\Windows\System\FfIPjwt.exe
  C:\Windows\System\FfIPjwt.exe
  2⤵
  PID:5704
- C:\Windows\System\BGPnFCE.exe
  C:\Windows\System\BGPnFCE.exe
  2⤵
  PID:5748
- C:\Windows\System\GPrdkMe.exe
  C:\Windows\System\GPrdkMe.exe
  2⤵
  PID:5752
- C:\Windows\System\ocvcfJa.exe
  C:\Windows\System\ocvcfJa.exe
  2⤵
  PID:5796
- C:\Windows\System\qlCKWTP.exe
  C:\Windows\System\qlCKWTP.exe
  2⤵
  PID:5840
- C:\Windows\System\bhRRiXh.exe
  C:\Windows\System\bhRRiXh.exe
  2⤵
  PID:5852
- C:\Windows\System\TIfjSet.exe
  C:\Windows\System\TIfjSet.exe
  2⤵
  PID:5824
- C:\Windows\System\AQHKAKq.exe
  C:\Windows\System\AQHKAKq.exe
  2⤵
  PID:5876
- C:\Windows\System\fbOPLdC.exe
  C:\Windows\System\fbOPLdC.exe
  2⤵
  PID:2840
- C:\Windows\System\ORPNSlO.exe
  C:\Windows\System\ORPNSlO.exe
  2⤵
  PID:6012
- C:\Windows\System\FaCOozJ.exe
  C:\Windows\System\FaCOozJ.exe
  2⤵
  PID:5948
- C:\Windows\System\tRvVESG.exe
  C:\Windows\System\tRvVESG.exe
  2⤵
  PID:5976
- C:\Windows\System\WeLjTxP.exe
  C:\Windows\System\WeLjTxP.exe
  2⤵
  PID:6008
- C:\Windows\System\MPyMQjY.exe
  C:\Windows\System\MPyMQjY.exe
  2⤵
  PID:6020
- C:\Windows\System\StofDXz.exe
  C:\Windows\System\StofDXz.exe
  2⤵
  PID:6052
- C:\Windows\System\TMlPwVb.exe
  C:\Windows\System\TMlPwVb.exe
  2⤵
  PID:6064
- C:\Windows\System\IMAVAuw.exe
  C:\Windows\System\IMAVAuw.exe
  2⤵
  PID:6112
- C:\Windows\System\lrAkbiA.exe
  C:\Windows\System\lrAkbiA.exe
  2⤵
  PID:6120
- C:\Windows\System\nBlzzqP.exe
  C:\Windows\System\nBlzzqP.exe
  2⤵
  PID:6140
- C:\Windows\System\XOUCZCh.exe
  C:\Windows\System\XOUCZCh.exe
  2⤵
  PID:4320
- C:\Windows\System\DjkNVbr.exe
  C:\Windows\System\DjkNVbr.exe
  2⤵
  PID:4444
- C:\Windows\System\QEdqnqX.exe
  C:\Windows\System\QEdqnqX.exe
  2⤵
  PID:5148
- C:\Windows\System\EaAUEKj.exe
  C:\Windows\System\EaAUEKj.exe
  2⤵
  PID:5928
- C:\Windows\System\JozOKDR.exe
  C:\Windows\System\JozOKDR.exe
  2⤵
  PID:6032
- C:\Windows\System\WSuRNqH.exe
  C:\Windows\System\WSuRNqH.exe
  2⤵
  PID:2484
- C:\Windows\System\bemEGgI.exe
  C:\Windows\System\bemEGgI.exe
  2⤵
  PID:6092
- C:\Windows\System\cWkpcam.exe
  C:\Windows\System\cWkpcam.exe
  2⤵
  PID:5160
- C:\Windows\System\NJoxWcK.exe
  C:\Windows\System\NJoxWcK.exe
  2⤵
  PID:5180
- C:\Windows\System\zbhzhOW.exe
  C:\Windows\System\zbhzhOW.exe
  2⤵
  PID:6096
- C:\Windows\System\ngEaaIj.exe
  C:\Windows\System\ngEaaIj.exe
  2⤵
  PID:5680
- C:\Windows\System\PKWaxlw.exe
  C:\Windows\System\PKWaxlw.exe
  2⤵
  PID:5344
- C:\Windows\System\CiQWopZ.exe
  C:\Windows\System\CiQWopZ.exe
  2⤵
  PID:5424
- C:\Windows\System\cEKktHG.exe
  C:\Windows\System\cEKktHG.exe
  2⤵
  PID:5672
- C:\Windows\System\CuWytRQ.exe
  C:\Windows\System\CuWytRQ.exe
  2⤵
  PID:5804
- C:\Windows\System\PtohhFG.exe
  C:\Windows\System\PtohhFG.exe
  2⤵
  PID:5872
- C:\Windows\System\hKjsMyd.exe
  C:\Windows\System\hKjsMyd.exe
  2⤵
  PID:5996
- C:\Windows\System\kbHKyUM.exe
  C:\Windows\System\kbHKyUM.exe
  2⤵
  PID:4532
- C:\Windows\System\DacrXbe.exe
  C:\Windows\System\DacrXbe.exe
  2⤵
  PID:5276
- C:\Windows\System\dVVHGtB.exe
  C:\Windows\System\dVVHGtB.exe
  2⤵
  PID:5468
- C:\Windows\System\KmEyAIy.exe
  C:\Windows\System\KmEyAIy.exe
  2⤵
  PID:5392
- C:\Windows\System\tfPlrpR.exe
  C:\Windows\System\tfPlrpR.exe
  2⤵
  PID:5652
- C:\Windows\System\KyNlaYR.exe
  C:\Windows\System\KyNlaYR.exe
  2⤵
  PID:5712
- C:\Windows\System\GZZaDbC.exe
  C:\Windows\System\GZZaDbC.exe
  2⤵
  PID:5844
- C:\Windows\System\UygbeNb.exe
  C:\Windows\System\UygbeNb.exe
  2⤵
  PID:5172
- C:\Windows\System\KFwouiQ.exe
  C:\Windows\System\KFwouiQ.exe
  2⤵
  PID:6036
- C:\Windows\System\kiZFUTS.exe
  C:\Windows\System\kiZFUTS.exe
  2⤵
  PID:5184
- C:\Windows\System\jVXVAep.exe
  C:\Windows\System\jVXVAep.exe
  2⤵
  PID:5992
- C:\Windows\System\npHVdLU.exe
  C:\Windows\System\npHVdLU.exe
  2⤵
  PID:5296
- C:\Windows\System\XOQSmMB.exe
  C:\Windows\System\XOQSmMB.exe
  2⤵
  PID:6148
- C:\Windows\System\zLpgxUf.exe
  C:\Windows\System\zLpgxUf.exe
  2⤵
  PID:6164
- C:\Windows\System\FlUwtUw.exe
  C:\Windows\System\FlUwtUw.exe
  2⤵
  PID:6180
- C:\Windows\System\lxBYmTL.exe
  C:\Windows\System\lxBYmTL.exe
  2⤵
  PID:6196
- C:\Windows\System\tlhiCQa.exe
  C:\Windows\System\tlhiCQa.exe
  2⤵
  PID:6212
- C:\Windows\System\nuFbwmc.exe
  C:\Windows\System\nuFbwmc.exe
  2⤵
  PID:6228
- C:\Windows\System\DPguTKX.exe
  C:\Windows\System\DPguTKX.exe
  2⤵
  PID:6244
- C:\Windows\System\bryvrWS.exe
  C:\Windows\System\bryvrWS.exe
  2⤵
  PID:6260
- C:\Windows\System\VrSiCaz.exe
  C:\Windows\System\VrSiCaz.exe
  2⤵
  PID:6280
- C:\Windows\System\HaPotOs.exe
  C:\Windows\System\HaPotOs.exe
  2⤵
  PID:6296
- C:\Windows\System\JCpUIhP.exe
  C:\Windows\System\JCpUIhP.exe
  2⤵
  PID:6312
- C:\Windows\System\qpWUmuS.exe
  C:\Windows\System\qpWUmuS.exe
  2⤵
  PID:6328
- C:\Windows\System\CLNDfAQ.exe
  C:\Windows\System\CLNDfAQ.exe
  2⤵
  PID:6344
- C:\Windows\System\LWcBpSr.exe
  C:\Windows\System\LWcBpSr.exe
  2⤵
  PID:6360
- C:\Windows\System\WkJSXcd.exe
  C:\Windows\System\WkJSXcd.exe
  2⤵
  PID:6376
- C:\Windows\System\ytHpxAB.exe
  C:\Windows\System\ytHpxAB.exe
  2⤵
  PID:6392
- C:\Windows\System\pCiZvJB.exe
  C:\Windows\System\pCiZvJB.exe
  2⤵
  PID:6408
- C:\Windows\System\RdfSYtN.exe
  C:\Windows\System\RdfSYtN.exe
  2⤵
  PID:6424
- C:\Windows\System\aQaAVKE.exe
  C:\Windows\System\aQaAVKE.exe
  2⤵
  PID:6440
- C:\Windows\System\RkNaDpC.exe
  C:\Windows\System\RkNaDpC.exe
  2⤵
  PID:6456
- C:\Windows\System\cVrDiEb.exe
  C:\Windows\System\cVrDiEb.exe
  2⤵
  PID:6472
- C:\Windows\System\JjIrAqO.exe
  C:\Windows\System\JjIrAqO.exe
  2⤵
  PID:6488
- C:\Windows\System\kvQcxeX.exe
  C:\Windows\System\kvQcxeX.exe
  2⤵
  PID:6504
- C:\Windows\System\RFTKLhg.exe
  C:\Windows\System\RFTKLhg.exe
  2⤵
  PID:6520
- C:\Windows\System\pfYgQmF.exe
  C:\Windows\System\pfYgQmF.exe
  2⤵
  PID:6536
- C:\Windows\System\UsjgDTZ.exe
  C:\Windows\System\UsjgDTZ.exe
  2⤵
  PID:6552
- C:\Windows\System\ZJJpmLB.exe
  C:\Windows\System\ZJJpmLB.exe
  2⤵
  PID:6568
- C:\Windows\System\vXkEIwo.exe
  C:\Windows\System\vXkEIwo.exe
  2⤵
  PID:6588
- C:\Windows\System\nmGSzkL.exe
  C:\Windows\System\nmGSzkL.exe
  2⤵
  PID:6604
- C:\Windows\System\NipsSVA.exe
  C:\Windows\System\NipsSVA.exe
  2⤵
  PID:6620
- C:\Windows\System\stoQnLF.exe
  C:\Windows\System\stoQnLF.exe
  2⤵
  PID:6636
- C:\Windows\System\LeImCuY.exe
  C:\Windows\System\LeImCuY.exe
  2⤵
  PID:6652
- C:\Windows\System\yXzVytm.exe
  C:\Windows\System\yXzVytm.exe
  2⤵
  PID:6672
- C:\Windows\System\mgYjEBB.exe
  C:\Windows\System\mgYjEBB.exe
  2⤵
  PID:6688
- C:\Windows\System\CEzeoTE.exe
  C:\Windows\System\CEzeoTE.exe
  2⤵
  PID:6704
- C:\Windows\System\QatWZdi.exe
  C:\Windows\System\QatWZdi.exe
  2⤵
  PID:6720
- C:\Windows\System\zBvnUhs.exe
  C:\Windows\System\zBvnUhs.exe
  2⤵
  PID:6736
- C:\Windows\System\reEurjK.exe
  C:\Windows\System\reEurjK.exe
  2⤵
  PID:6752
- C:\Windows\System\vkXvSMn.exe
  C:\Windows\System\vkXvSMn.exe
  2⤵
  PID:6768
- C:\Windows\System\VKKlBzL.exe
  C:\Windows\System\VKKlBzL.exe
  2⤵
  PID:6784
- C:\Windows\System\AZJnrRO.exe
  C:\Windows\System\AZJnrRO.exe
  2⤵
  PID:6800
- C:\Windows\System\aWlRIBP.exe
  C:\Windows\System\aWlRIBP.exe
  2⤵
  PID:6816
- C:\Windows\System\wJbFzTa.exe
  C:\Windows\System\wJbFzTa.exe
  2⤵
  PID:6832
- C:\Windows\System\swYHYFb.exe
  C:\Windows\System\swYHYFb.exe
  2⤵
  PID:6848
- C:\Windows\System\SooGOJq.exe
  C:\Windows\System\SooGOJq.exe
  2⤵
  PID:6864
- C:\Windows\System\uheDEse.exe
  C:\Windows\System\uheDEse.exe
  2⤵
  PID:6880
- C:\Windows\System\VipdKPj.exe
  C:\Windows\System\VipdKPj.exe
  2⤵
  PID:6896
- C:\Windows\System\fvDmLit.exe
  C:\Windows\System\fvDmLit.exe
  2⤵
  PID:6912
- C:\Windows\System\ldPwLOX.exe
  C:\Windows\System\ldPwLOX.exe
  2⤵
  PID:6928
- C:\Windows\System\euRDZqn.exe
  C:\Windows\System\euRDZqn.exe
  2⤵
  PID:6944
- C:\Windows\System\YASmQxQ.exe
  C:\Windows\System\YASmQxQ.exe
  2⤵
  PID:6960
- C:\Windows\System\cERdmub.exe
  C:\Windows\System\cERdmub.exe
  2⤵
  PID:6976
- C:\Windows\System\LytSBRI.exe
  C:\Windows\System\LytSBRI.exe
  2⤵
  PID:6992
- C:\Windows\System\KCKzjoY.exe
  C:\Windows\System\KCKzjoY.exe
  2⤵
  PID:7008
- C:\Windows\System\BYgqWvW.exe
  C:\Windows\System\BYgqWvW.exe
  2⤵
  PID:7024
- C:\Windows\System\rgPMROd.exe
  C:\Windows\System\rgPMROd.exe
  2⤵
  PID:7040
- C:\Windows\System\WCvtwKK.exe
  C:\Windows\System\WCvtwKK.exe
  2⤵
  PID:7056
- C:\Windows\System\jsZGuRt.exe
  C:\Windows\System\jsZGuRt.exe
  2⤵
  PID:7072
- C:\Windows\System\tIdBRHg.exe
  C:\Windows\System\tIdBRHg.exe
  2⤵
  PID:7096
- C:\Windows\System\WoibbcI.exe
  C:\Windows\System\WoibbcI.exe
  2⤵
  PID:7112
- C:\Windows\System\vRdxXjn.exe
  C:\Windows\System\vRdxXjn.exe
  2⤵
  PID:7128
- C:\Windows\System\QkFtyJP.exe
  C:\Windows\System\QkFtyJP.exe
  2⤵
  PID:7144
- C:\Windows\System\zTUZrtV.exe
  C:\Windows\System\zTUZrtV.exe
  2⤵
  PID:7160
- C:\Windows\System\SKrrHke.exe
  C:\Windows\System\SKrrHke.exe
  2⤵
  PID:6116
- C:\Windows\System\yCuFCyv.exe
  C:\Windows\System\yCuFCyv.exe
  2⤵
  PID:5820
- C:\Windows\System\sEHkaxz.exe
  C:\Windows\System\sEHkaxz.exe
  2⤵
  PID:5856
- C:\Windows\System\FRGlEgR.exe
  C:\Windows\System\FRGlEgR.exe
  2⤵
  PID:6044
- C:\Windows\System\AUaMNKV.exe
  C:\Windows\System\AUaMNKV.exe
  2⤵
  PID:5600
- C:\Windows\System\CXAfPGQ.exe
  C:\Windows\System\CXAfPGQ.exe
  2⤵
  PID:5728
- C:\Windows\System\fxYCONH.exe
  C:\Windows\System\fxYCONH.exe
  2⤵
  PID:5216
- C:\Windows\System\aClKydP.exe
  C:\Windows\System\aClKydP.exe
  2⤵
  PID:5140
- C:\Windows\System\gXcNHhs.exe
  C:\Windows\System\gXcNHhs.exe
  2⤵
  PID:5700
- C:\Windows\System\ydKIkNN.exe
  C:\Windows\System\ydKIkNN.exe
  2⤵
  PID:5188
- C:\Windows\System\cAqESWY.exe
  C:\Windows\System\cAqESWY.exe
  2⤵
  PID:6192
- C:\Windows\System\tISUPHK.exe
  C:\Windows\System\tISUPHK.exe
  2⤵
  PID:6256
- C:\Windows\System\UVMDhdH.exe
  C:\Windows\System\UVMDhdH.exe
  2⤵
  PID:6208
- C:\Windows\System\xNjvmBo.exe
  C:\Windows\System\xNjvmBo.exe
  2⤵
  PID:6276
- C:\Windows\System\IeTGYad.exe
  C:\Windows\System\IeTGYad.exe
  2⤵
  PID:6240
- C:\Windows\System\xKNkuKt.exe
  C:\Windows\System\xKNkuKt.exe
  2⤵
  PID:6320
- C:\Windows\System\iGvUMTH.exe
  C:\Windows\System\iGvUMTH.exe
  2⤵
  PID:6416
- C:\Windows\System\UMCfmaS.exe
  C:\Windows\System\UMCfmaS.exe
  2⤵
  PID:6452
- C:\Windows\System\xpfUkPY.exe
  C:\Windows\System\xpfUkPY.exe
  2⤵
  PID:6340
- C:\Windows\System\AZELawi.exe
  C:\Windows\System\AZELawi.exe
  2⤵
  PID:6468
- C:\Windows\System\OVDOFJy.exe
  C:\Windows\System\OVDOFJy.exe
  2⤵
  PID:6532
- C:\Windows\System\JrdOzkF.exe
  C:\Windows\System\JrdOzkF.exe
  2⤵
  PID:6628
- C:\Windows\System\VhaKFuo.exe
  C:\Windows\System\VhaKFuo.exe
  2⤵
  PID:6512
- C:\Windows\System\swewFtH.exe
  C:\Windows\System\swewFtH.exe
  2⤵
  PID:6544
- C:\Windows\System\MZtKRCc.exe
  C:\Windows\System\MZtKRCc.exe
  2⤵
  PID:6616
- C:\Windows\System\sWacRlZ.exe
  C:\Windows\System\sWacRlZ.exe
  2⤵
  PID:6712
- C:\Windows\System\jQkYnMa.exe
  C:\Windows\System\jQkYnMa.exe
  2⤵
  PID:6776
- C:\Windows\System\fkLsDXa.exe
  C:\Windows\System\fkLsDXa.exe
  2⤵
  PID:6696
- C:\Windows\System\hSMVvMP.exe
  C:\Windows\System\hSMVvMP.exe
  2⤵
  PID:6728
- C:\Windows\System\FHOAlbB.exe
  C:\Windows\System\FHOAlbB.exe
  2⤵
  PID:6792
- C:\Windows\System\VjygLAI.exe
  C:\Windows\System\VjygLAI.exe
  2⤵
  PID:6856
- C:\Windows\System\ZVpfdin.exe
  C:\Windows\System\ZVpfdin.exe
  2⤵
  PID:6952
- C:\Windows\System\BkiUUrg.exe
  C:\Windows\System\BkiUUrg.exe
  2⤵
  PID:6984
- C:\Windows\System\yEMhDNM.exe
  C:\Windows\System\yEMhDNM.exe
  2⤵
  PID:6840
- C:\Windows\System\upJURTF.exe
  C:\Windows\System\upJURTF.exe
  2⤵
  PID:6904
- C:\Windows\System\vKQBUqm.exe
  C:\Windows\System\vKQBUqm.exe
  2⤵
  PID:6972
- C:\Windows\System\xvrVzPk.exe
  C:\Windows\System\xvrVzPk.exe
  2⤵
  PID:7048
- C:\Windows\System\WNuajmA.exe
  C:\Windows\System\WNuajmA.exe
  2⤵
  PID:7092
- C:\Windows\System\oTvHSNp.exe
  C:\Windows\System\oTvHSNp.exe
  2⤵
  PID:7120
- C:\Windows\System\WcHcaVy.exe
  C:\Windows\System\WcHcaVy.exe
  2⤵
  PID:7036
- C:\Windows\System\jfrNfgt.exe
  C:\Windows\System\jfrNfgt.exe
  2⤵
  PID:7104
- C:\Windows\System\XPqRYga.exe
  C:\Windows\System\XPqRYga.exe
  2⤵
  PID:6172
- C:\Windows\System\cCBgQNg.exe
  C:\Windows\System\cCBgQNg.exe
  2⤵
  PID:7108
- C:\Windows\System\TGxBxdb.exe
  C:\Windows\System\TGxBxdb.exe
  2⤵
  PID:5868
- C:\Windows\System\WcdUMOI.exe
  C:\Windows\System\WcdUMOI.exe
  2⤵
  PID:5176
- C:\Windows\System\gOQfmMZ.exe
  C:\Windows\System\gOQfmMZ.exe
  2⤵
  PID:5604
- C:\Windows\System\BBrwzAu.exe
  C:\Windows\System\BBrwzAu.exe
  2⤵
  PID:5232
- C:\Windows\System\iDVnQBg.exe
  C:\Windows\System\iDVnQBg.exe
  2⤵
  PID:6204
- C:\Windows\System\SvEFiFG.exe
  C:\Windows\System\SvEFiFG.exe
  2⤵
  PID:6272
- C:\Windows\System\IQnVEGA.exe
  C:\Windows\System\IQnVEGA.exe
  2⤵
  PID:6356
- C:\Windows\System\ZrAuGJS.exe
  C:\Windows\System\ZrAuGJS.exe
  2⤵
  PID:6500
- C:\Windows\System\eKPPCPy.exe
  C:\Windows\System\eKPPCPy.exe
  2⤵
  PID:6584
- C:\Windows\System\rgssutj.exe
  C:\Windows\System\rgssutj.exe
  2⤵
  PID:6436
- C:\Windows\System\aCzwNko.exe
  C:\Windows\System\aCzwNko.exe
  2⤵
  PID:6680
- C:\Windows\System\ucLIOfj.exe
  C:\Windows\System\ucLIOfj.exe
  2⤵
  PID:6668
- C:\Windows\System\NpgaHwu.exe
  C:\Windows\System\NpgaHwu.exe
  2⤵
  PID:6812
- C:\Windows\System\zuhCFtR.exe
  C:\Windows\System\zuhCFtR.exe
  2⤵
  PID:6748
- C:\Windows\System\MpFWIpQ.exe
  C:\Windows\System\MpFWIpQ.exe
  2⤵
  PID:6924
- C:\Windows\System\TyreRmk.exe
  C:\Windows\System\TyreRmk.exe
  2⤵
  PID:6648
- C:\Windows\System\Faksysr.exe
  C:\Windows\System\Faksysr.exe
  2⤵
  PID:7000
- C:\Windows\System\YIGVOXn.exe
  C:\Windows\System\YIGVOXn.exe
  2⤵
  PID:6132
- C:\Windows\System\AbrjhUx.exe
  C:\Windows\System\AbrjhUx.exe
  2⤵
  PID:6876
- C:\Windows\System\jxMFzpB.exe
  C:\Windows\System\jxMFzpB.exe
  2⤵
  PID:6060
- C:\Windows\System\KSAHTwg.exe
  C:\Windows\System\KSAHTwg.exe
  2⤵
  PID:6016
- C:\Windows\System\DPuqdPN.exe
  C:\Windows\System\DPuqdPN.exe
  2⤵
  PID:7068
- C:\Windows\System\qtrnxZF.exe
  C:\Windows\System\qtrnxZF.exe
  2⤵
  PID:6388
- C:\Windows\System\xDGWRcq.exe
  C:\Windows\System\xDGWRcq.exe
  2⤵
  PID:5780
- C:\Windows\System\exZuGCi.exe
  C:\Windows\System\exZuGCi.exe
  2⤵
  PID:6888
- C:\Windows\System\eoItaMV.exe
  C:\Windows\System\eoItaMV.exe
  2⤵
  PID:6968
- C:\Windows\System\iZfxhyR.exe
  C:\Windows\System\iZfxhyR.exe
  2⤵
  PID:6872
- C:\Windows\System\xANRHub.exe
  C:\Windows\System\xANRHub.exe
  2⤵
  PID:6372
- C:\Windows\System\FiHwrot.exe
  C:\Windows\System\FiHwrot.exe
  2⤵
  PID:7088
- C:\Windows\System\vuhbnQT.exe
  C:\Windows\System\vuhbnQT.exe
  2⤵
  PID:6764
- C:\Windows\System\caoVRdn.exe
  C:\Windows\System\caoVRdn.exe
  2⤵
  PID:7180
- C:\Windows\System\UbDqlGL.exe
  C:\Windows\System\UbDqlGL.exe
  2⤵
  PID:7196
- C:\Windows\System\SFIVVVd.exe
  C:\Windows\System\SFIVVVd.exe
  2⤵
  PID:7212
- C:\Windows\System\jtcptvb.exe
  C:\Windows\System\jtcptvb.exe
  2⤵
  PID:7228
- C:\Windows\System\fkdNWZq.exe
  C:\Windows\System\fkdNWZq.exe
  2⤵
  PID:7244
- C:\Windows\System\GaBDWbH.exe
  C:\Windows\System\GaBDWbH.exe
  2⤵
  PID:7260
- C:\Windows\System\oGpFDAP.exe
  C:\Windows\System\oGpFDAP.exe
  2⤵
  PID:7280
- C:\Windows\System\LpxIuaS.exe
  C:\Windows\System\LpxIuaS.exe
  2⤵
  PID:7296
- C:\Windows\System\rxKGxNY.exe
  C:\Windows\System\rxKGxNY.exe
  2⤵
  PID:7312
- C:\Windows\System\IPVQGEx.exe
  C:\Windows\System\IPVQGEx.exe
  2⤵
  PID:7328
- C:\Windows\System\LsArqwR.exe
  C:\Windows\System\LsArqwR.exe
  2⤵
  PID:7344
- C:\Windows\System\SfCgQfL.exe
  C:\Windows\System\SfCgQfL.exe
  2⤵
  PID:7360
- C:\Windows\System\xxbDaPy.exe
  C:\Windows\System\xxbDaPy.exe
  2⤵
  PID:7376
- C:\Windows\System\yJOFKnz.exe
  C:\Windows\System\yJOFKnz.exe
  2⤵
  PID:7392
- C:\Windows\System\QZEBjEe.exe
  C:\Windows\System\QZEBjEe.exe
  2⤵
  PID:7408
- C:\Windows\System\EDPBDUQ.exe
  C:\Windows\System\EDPBDUQ.exe
  2⤵
  PID:7424
- C:\Windows\System\RQiBKkJ.exe
  C:\Windows\System\RQiBKkJ.exe
  2⤵
  PID:7440
- C:\Windows\System\RyNTAoz.exe
  C:\Windows\System\RyNTAoz.exe
  2⤵
  PID:7456
- C:\Windows\System\zicoYRv.exe
  C:\Windows\System\zicoYRv.exe
  2⤵
  PID:7472
- C:\Windows\System\uaCsGQy.exe
  C:\Windows\System\uaCsGQy.exe
  2⤵
  PID:7488
- C:\Windows\System\ZBCIQtq.exe
  C:\Windows\System\ZBCIQtq.exe
  2⤵
  PID:7504
- C:\Windows\System\qoGsNsE.exe
  C:\Windows\System\qoGsNsE.exe
  2⤵
  PID:7520
- C:\Windows\System\GHiIFIr.exe
  C:\Windows\System\GHiIFIr.exe
  2⤵
  PID:7536
- C:\Windows\System\pcabmaO.exe
  C:\Windows\System\pcabmaO.exe
  2⤵
  PID:7552
- C:\Windows\System\DJUeUyb.exe
  C:\Windows\System\DJUeUyb.exe
  2⤵
  PID:7568
- C:\Windows\System\DQufxoz.exe
  C:\Windows\System\DQufxoz.exe
  2⤵
  PID:7584
- C:\Windows\System\urblMvs.exe
  C:\Windows\System\urblMvs.exe
  2⤵
  PID:7600
- C:\Windows\System\NupWqIm.exe
  C:\Windows\System\NupWqIm.exe
  2⤵
  PID:7616
- C:\Windows\System\caNkVWb.exe
  C:\Windows\System\caNkVWb.exe
  2⤵
  PID:7632
- C:\Windows\System\GzvEtIN.exe
  C:\Windows\System\GzvEtIN.exe
  2⤵
  PID:7648
- C:\Windows\System\dBLjEeM.exe
  C:\Windows\System\dBLjEeM.exe
  2⤵
  PID:7664
- C:\Windows\System\nYLFdSJ.exe
  C:\Windows\System\nYLFdSJ.exe
  2⤵
  PID:7680
- C:\Windows\System\okdKOFL.exe
  C:\Windows\System\okdKOFL.exe
  2⤵
  PID:7696
- C:\Windows\System\eYCOxEY.exe
  C:\Windows\System\eYCOxEY.exe
  2⤵
  PID:7712
- C:\Windows\System\fLZCzkE.exe
  C:\Windows\System\fLZCzkE.exe
  2⤵
  PID:7728
- C:\Windows\System\BdbPVNj.exe
  C:\Windows\System\BdbPVNj.exe
  2⤵
  PID:7744
- C:\Windows\System\typOvaa.exe
  C:\Windows\System\typOvaa.exe
  2⤵
  PID:7760
- C:\Windows\System\LZCFtKX.exe
  C:\Windows\System\LZCFtKX.exe
  2⤵
  PID:7776
- C:\Windows\System\nxdiYab.exe
  C:\Windows\System\nxdiYab.exe
  2⤵
  PID:7792
- C:\Windows\System\ePAlIJA.exe
  C:\Windows\System\ePAlIJA.exe
  2⤵
  PID:7808
- C:\Windows\System\RbetxQG.exe
  C:\Windows\System\RbetxQG.exe
  2⤵
  PID:7824
- C:\Windows\System\IRzmNEz.exe
  C:\Windows\System\IRzmNEz.exe
  2⤵
  PID:7840
- C:\Windows\System\OXPdgBV.exe
  C:\Windows\System\OXPdgBV.exe
  2⤵
  PID:7856
- C:\Windows\System\lZDiULq.exe
  C:\Windows\System\lZDiULq.exe
  2⤵
  PID:7872
- C:\Windows\System\cUyoPPu.exe
  C:\Windows\System\cUyoPPu.exe
  2⤵
  PID:7888
- C:\Windows\System\gqXpZSa.exe
  C:\Windows\System\gqXpZSa.exe
  2⤵
  PID:7916
- C:\Windows\System\EzdZOYc.exe
  C:\Windows\System\EzdZOYc.exe
  2⤵
  PID:7936
- C:\Windows\System\wmuoVqN.exe
  C:\Windows\System\wmuoVqN.exe
  2⤵
  PID:8032
- C:\Windows\System\brnzdtH.exe
  C:\Windows\System\brnzdtH.exe
  2⤵
  PID:8048
- C:\Windows\System\TiAMQOa.exe
  C:\Windows\System\TiAMQOa.exe
  2⤵
  PID:8064
- C:\Windows\System\UsOHLKC.exe
  C:\Windows\System\UsOHLKC.exe
  2⤵
  PID:8080
- C:\Windows\System\VMBZPAc.exe
  C:\Windows\System\VMBZPAc.exe
  2⤵
  PID:8096
- C:\Windows\System\RtKgmbZ.exe
  C:\Windows\System\RtKgmbZ.exe
  2⤵
  PID:8116
- C:\Windows\System\aqpKgaw.exe
  C:\Windows\System\aqpKgaw.exe
  2⤵
  PID:8132
- C:\Windows\System\hLuHZCN.exe
  C:\Windows\System\hLuHZCN.exe
  2⤵
  PID:8148
- C:\Windows\System\mDIwzWp.exe
  C:\Windows\System\mDIwzWp.exe
  2⤵
  PID:8164
- C:\Windows\System\ssKGcBE.exe
  C:\Windows\System\ssKGcBE.exe
  2⤵
  PID:8180
- C:\Windows\System\RiyfpzM.exe
  C:\Windows\System\RiyfpzM.exe
  2⤵
  PID:7172
- C:\Windows\System\ZoIYYtl.exe
  C:\Windows\System\ZoIYYtl.exe
  2⤵
  PID:7020
- C:\Windows\System\VlbdUVw.exe
  C:\Windows\System\VlbdUVw.exe
  2⤵
  PID:7032
- C:\Windows\System\LRnCmeV.exe
  C:\Windows\System\LRnCmeV.exe
  2⤵
  PID:6940
- C:\Windows\System\gahUzEr.exe
  C:\Windows\System\gahUzEr.exe
  2⤵
  PID:7156
- C:\Windows\System\AfqkZui.exe
  C:\Windows\System\AfqkZui.exe
  2⤵
  PID:5896
- C:\Windows\System\bAskPli.exe
  C:\Windows\System\bAskPli.exe
  2⤵
  PID:7188
- C:\Windows\System\kHNnaKi.exe
  C:\Windows\System\kHNnaKi.exe
  2⤵
  PID:7256
- C:\Windows\System\XXoDtAY.exe
  C:\Windows\System\XXoDtAY.exe
  2⤵
  PID:7292
- C:\Windows\System\RROtyRU.exe
  C:\Windows\System\RROtyRU.exe
  2⤵
  PID:7308
- C:\Windows\System\AfjdnYF.exe
  C:\Windows\System\AfjdnYF.exe
  2⤵
  PID:7372
- C:\Windows\System\IkLBMVf.exe
  C:\Windows\System\IkLBMVf.exe
  2⤵
  PID:7436
- C:\Windows\System\udCcoty.exe
  C:\Windows\System\udCcoty.exe
  2⤵
  PID:7384
- C:\Windows\System\niFMusw.exe
  C:\Windows\System\niFMusw.exe
  2⤵
  PID:7532
- C:\Windows\System\GcXMZfu.exe
  C:\Windows\System\GcXMZfu.exe
  2⤵
  PID:7388
- C:\Windows\System\lNsAkKS.exe
  C:\Windows\System\lNsAkKS.exe
  2⤵
  PID:7480
- C:\Windows\System\DFnWSFK.exe
  C:\Windows\System\DFnWSFK.exe
  2⤵
  PID:7544
- C:\Windows\System\nqTSmxU.exe
  C:\Windows\System\nqTSmxU.exe
  2⤵
  PID:7564
- C:\Windows\System\mGCJEVk.exe
  C:\Windows\System\mGCJEVk.exe
  2⤵
  PID:7656
- C:\Windows\System\KJfeLBB.exe
  C:\Windows\System\KJfeLBB.exe
  2⤵
  PID:7640
- C:\Windows\System\ABlQOZq.exe
  C:\Windows\System\ABlQOZq.exe
  2⤵
  PID:7692
- C:\Windows\System\HUfFjef.exe
  C:\Windows\System\HUfFjef.exe
  2⤵
  PID:7672
- C:\Windows\System\qhGlZjR.exe
  C:\Windows\System\qhGlZjR.exe
  2⤵
  PID:7768
- C:\Windows\System\fFAiidG.exe
  C:\Windows\System\fFAiidG.exe
  2⤵
  PID:7784
- C:\Windows\System\XYsEWct.exe
  C:\Windows\System\XYsEWct.exe
  2⤵
  PID:7852
- C:\Windows\System\wEbbJQZ.exe
  C:\Windows\System\wEbbJQZ.exe
  2⤵
  PID:7804
- C:\Windows\System\XnUhgHz.exe
  C:\Windows\System\XnUhgHz.exe
  2⤵
  PID:7868
- C:\Windows\System\igrpWWh.exe
  C:\Windows\System\igrpWWh.exe
  2⤵
  PID:7904
- C:\Windows\System\QjIBxSx.exe
  C:\Windows\System\QjIBxSx.exe
  2⤵
  PID:7944
- C:\Windows\System\COwbWha.exe
  C:\Windows\System\COwbWha.exe
  2⤵
  PID:7964
- C:\Windows\System\aIxWPyU.exe
  C:\Windows\System\aIxWPyU.exe
  2⤵
  PID:7968
- C:\Windows\System\elrulMW.exe
  C:\Windows\System\elrulMW.exe
  2⤵
  PID:7988
- C:\Windows\System\DsFNOMU.exe
  C:\Windows\System\DsFNOMU.exe
  2⤵
  PID:8004
- C:\Windows\System\WzIEcsK.exe
  C:\Windows\System\WzIEcsK.exe
  2⤵
  PID:8020
- C:\Windows\System\FRsgfha.exe
  C:\Windows\System\FRsgfha.exe
  2⤵
  PID:8124
- C:\Windows\System\OchEsNI.exe
  C:\Windows\System\OchEsNI.exe
  2⤵
  PID:8072
- C:\Windows\System\eHTBnBV.exe
  C:\Windows\System\eHTBnBV.exe
  2⤵
  PID:8156
- C:\Windows\System\LesgDRs.exe
  C:\Windows\System\LesgDRs.exe
  2⤵
  PID:8140
- C:\Windows\System\AbVVytU.exe
  C:\Windows\System\AbVVytU.exe
  2⤵
  PID:7204
- C:\Windows\System\TIsUaXQ.exe
  C:\Windows\System\TIsUaXQ.exe
  2⤵
  PID:2220
- C:\Windows\System\MuTNMzy.exe
  C:\Windows\System\MuTNMzy.exe
  2⤵
  PID:7224
- C:\Windows\System\ULXWMMW.exe
  C:\Windows\System\ULXWMMW.exe
  2⤵
  PID:7304
- C:\Windows\System\SUpMQcl.exe
  C:\Windows\System\SUpMQcl.exe
  2⤵
  PID:6824
- C:\Windows\System\ziePZWC.exe
  C:\Windows\System\ziePZWC.exe
  2⤵
  PID:7080
- C:\Windows\System\ObErqgc.exe
  C:\Windows\System\ObErqgc.exe
  2⤵
  PID:7268
- C:\Windows\System\TUWoZiO.exe
  C:\Windows\System\TUWoZiO.exe
  2⤵
  PID:7324
- C:\Windows\System\vhSVTOC.exe
  C:\Windows\System\vhSVTOC.exe
  2⤵
  PID:7596
- C:\Windows\System\zJPGGfk.exe
  C:\Windows\System\zJPGGfk.exe
  2⤵
  PID:7628
- C:\Windows\System\vMjxheG.exe
  C:\Windows\System\vMjxheG.exe
  2⤵
  PID:7452
- C:\Windows\System\jvRbeRF.exe
  C:\Windows\System\jvRbeRF.exe
  2⤵
  PID:7724
- C:\Windows\System\bPblAhs.exe
  C:\Windows\System\bPblAhs.exe
  2⤵
  PID:7752
- C:\Windows\System\yyRCiFb.exe
  C:\Windows\System\yyRCiFb.exe
  2⤵
  PID:7884
- C:\Windows\System\LQBabHl.exe
  C:\Windows\System\LQBabHl.exe
  2⤵
  PID:7864
- C:\Windows\System\cWGNGgF.exe
  C:\Windows\System\cWGNGgF.exe
  2⤵
  PID:7900
- C:\Windows\System\iZJOYTO.exe
  C:\Windows\System\iZJOYTO.exe
  2⤵
  PID:5960
- C:\Windows\System\kwOTYaC.exe
  C:\Windows\System\kwOTYaC.exe
  2⤵
  PID:7984
- C:\Windows\System\TXDwupu.exe
  C:\Windows\System\TXDwupu.exe
  2⤵
  PID:8060
- C:\Windows\System\MJqHPem.exe
  C:\Windows\System\MJqHPem.exe
  2⤵
  PID:8112
- C:\Windows\System\lmygxUh.exe
  C:\Windows\System\lmygxUh.exe
  2⤵
  PID:7960
- C:\Windows\System\VtxrgmX.exe
  C:\Windows\System\VtxrgmX.exe
  2⤵
  PID:8104
- C:\Windows\System\QlAOogM.exe
  C:\Windows\System\QlAOogM.exe
  2⤵
  PID:6252
- C:\Windows\System\XIExRGF.exe
  C:\Windows\System\XIExRGF.exe
  2⤵
  PID:6600
- C:\Windows\System\KqELEWR.exe
  C:\Windows\System\KqELEWR.exe
  2⤵
  PID:6496
- C:\Windows\System\YRAoeyc.exe
  C:\Windows\System\YRAoeyc.exe
  2⤵
  PID:7468
- C:\Windows\System\wKKNHhE.exe
  C:\Windows\System\wKKNHhE.exe
  2⤵
  PID:7688
- C:\Windows\System\GmICZBA.exe
  C:\Windows\System\GmICZBA.exe
  2⤵
  PID:7708
- C:\Windows\System\ufSvEdx.exe
  C:\Windows\System\ufSvEdx.exe
  2⤵
  PID:7820
- C:\Windows\System\LhwhEhD.exe
  C:\Windows\System\LhwhEhD.exe
  2⤵
  PID:8000
- C:\Windows\System\dvwjkXE.exe
  C:\Windows\System\dvwjkXE.exe
  2⤵
  PID:8172
- C:\Windows\System\aGSPxvi.exe
  C:\Windows\System\aGSPxvi.exe
  2⤵
  PID:8012
- C:\Windows\System\RpmXSHK.exe
  C:\Windows\System\RpmXSHK.exe
  2⤵
  PID:7220
- C:\Windows\System\GidNvwJ.exe
  C:\Windows\System\GidNvwJ.exe
  2⤵
  PID:7924
- C:\Windows\System\rdVtDmj.exe
  C:\Windows\System\rdVtDmj.exe
  2⤵
  PID:8016
- C:\Windows\System\Jpytgqd.exe
  C:\Windows\System\Jpytgqd.exe
  2⤵
  PID:7612
- C:\Windows\System\mSgrvga.exe
  C:\Windows\System\mSgrvga.exe
  2⤵
  PID:6420
- C:\Windows\System\RdzgHrm.exe
  C:\Windows\System\RdzgHrm.exe
  2⤵
  PID:7252
- C:\Windows\System\gXGJdkO.exe
  C:\Windows\System\gXGJdkO.exe
  2⤵
  PID:7932
- C:\Windows\System\dAXgmoc.exe
  C:\Windows\System\dAXgmoc.exe
  2⤵
  PID:8056
- C:\Windows\System\iezAHcn.exe
  C:\Windows\System\iezAHcn.exe
  2⤵
  PID:8204
- C:\Windows\System\clkbebh.exe
  C:\Windows\System\clkbebh.exe
  2⤵
  PID:8220
- C:\Windows\System\JVJKfEI.exe
  C:\Windows\System\JVJKfEI.exe
  2⤵
  PID:8240
- C:\Windows\System\CsxedYo.exe
  C:\Windows\System\CsxedYo.exe
  2⤵
  PID:8256
- C:\Windows\System\SafXOGD.exe
  C:\Windows\System\SafXOGD.exe
  2⤵
  PID:8272
- C:\Windows\System\xGeYtDL.exe
  C:\Windows\System\xGeYtDL.exe
  2⤵
  PID:8288
- C:\Windows\System\NjCvCIu.exe
  C:\Windows\System\NjCvCIu.exe
  2⤵
  PID:8304
- C:\Windows\System\mnnasag.exe
  C:\Windows\System\mnnasag.exe
  2⤵
  PID:8320
- C:\Windows\System\ZWtlqjC.exe
  C:\Windows\System\ZWtlqjC.exe
  2⤵
  PID:8340
- C:\Windows\System\fmtHJyQ.exe
  C:\Windows\System\fmtHJyQ.exe
  2⤵
  PID:8360
- C:\Windows\System\AgyTfTv.exe
  C:\Windows\System\AgyTfTv.exe
  2⤵
  PID:8376
- C:\Windows\System\fEsWpcz.exe
  C:\Windows\System\fEsWpcz.exe
  2⤵
  PID:8396
- C:\Windows\System\rZXJDRO.exe
  C:\Windows\System\rZXJDRO.exe
  2⤵
  PID:8412
- C:\Windows\System\uwkVgyX.exe
  C:\Windows\System\uwkVgyX.exe
  2⤵
  PID:8428
- C:\Windows\System\BSpFGUT.exe
  C:\Windows\System\BSpFGUT.exe
  2⤵
  PID:8448
- C:\Windows\System\meaMUaP.exe
  C:\Windows\System\meaMUaP.exe
  2⤵
  PID:8464
- C:\Windows\System\tGGpcve.exe
  C:\Windows\System\tGGpcve.exe
  2⤵
  PID:8480
- C:\Windows\System\OYAjpEC.exe
  C:\Windows\System\OYAjpEC.exe
  2⤵
  PID:8496
- C:\Windows\System\SZXEBsb.exe
  C:\Windows\System\SZXEBsb.exe
  2⤵
  PID:8512
- C:\Windows\System\jTkEQWJ.exe
  C:\Windows\System\jTkEQWJ.exe
  2⤵
  PID:8528
- C:\Windows\System\pmENekp.exe
  C:\Windows\System\pmENekp.exe
  2⤵
  PID:8544
- C:\Windows\System\QICWxQj.exe
  C:\Windows\System\QICWxQj.exe
  2⤵
  PID:8564
- C:\Windows\System\oJxCRWC.exe
  C:\Windows\System\oJxCRWC.exe
  2⤵
  PID:8580
- C:\Windows\System\pxqIXEL.exe
  C:\Windows\System\pxqIXEL.exe
  2⤵
  PID:8596
- C:\Windows\System\DSeJPSd.exe
  C:\Windows\System\DSeJPSd.exe
  2⤵
  PID:8612
- C:\Windows\System\MLoyPiJ.exe
  C:\Windows\System\MLoyPiJ.exe
  2⤵
  PID:8628
- C:\Windows\System\BStXRcL.exe
  C:\Windows\System\BStXRcL.exe
  2⤵
  PID:8644
- C:\Windows\System\XWBbtRY.exe
  C:\Windows\System\XWBbtRY.exe
  2⤵
  PID:8664
- C:\Windows\System\YfMmZyt.exe
  C:\Windows\System\YfMmZyt.exe
  2⤵
  PID:8680
- C:\Windows\System\sUnrVKd.exe
  C:\Windows\System\sUnrVKd.exe
  2⤵
  PID:8696
- C:\Windows\System\qNhwAEy.exe
  C:\Windows\System\qNhwAEy.exe
  2⤵
  PID:8712
- C:\Windows\System\TxnkQxb.exe
  C:\Windows\System\TxnkQxb.exe
  2⤵
  PID:8728
- C:\Windows\System\bSQEAVl.exe
  C:\Windows\System\bSQEAVl.exe
  2⤵
  PID:8744
- C:\Windows\System\XJfHmSL.exe
  C:\Windows\System\XJfHmSL.exe
  2⤵
  PID:8760
- C:\Windows\System\SskrrzA.exe
  C:\Windows\System\SskrrzA.exe
  2⤵
  PID:8776
- C:\Windows\System\uOmwXiG.exe
  C:\Windows\System\uOmwXiG.exe
  2⤵
  PID:8792
- C:\Windows\System\wRgnVRF.exe
  C:\Windows\System\wRgnVRF.exe
  2⤵
  PID:8808
- C:\Windows\System\QBNLMaK.exe
  C:\Windows\System\QBNLMaK.exe
  2⤵
  PID:8824
- C:\Windows\System\wguXlsO.exe
  C:\Windows\System\wguXlsO.exe
  2⤵
  PID:8840
- C:\Windows\System\SeUoguY.exe
  C:\Windows\System\SeUoguY.exe
  2⤵
  PID:8856
- C:\Windows\System\nYHMbaw.exe
  C:\Windows\System\nYHMbaw.exe
  2⤵
  PID:8872
- C:\Windows\System\bkVYgwS.exe
  C:\Windows\System\bkVYgwS.exe
  2⤵
  PID:8888
- C:\Windows\System\KRSapwB.exe
  C:\Windows\System\KRSapwB.exe
  2⤵
  PID:8904
- C:\Windows\System\NZRaLCn.exe
  C:\Windows\System\NZRaLCn.exe
  2⤵
  PID:8924
- C:\Windows\System\JdzkFQE.exe
  C:\Windows\System\JdzkFQE.exe
  2⤵
  PID:8940
- C:\Windows\System\FaFATjp.exe
  C:\Windows\System\FaFATjp.exe
  2⤵
  PID:8956
- C:\Windows\System\nvfWVHg.exe
  C:\Windows\System\nvfWVHg.exe
  2⤵
  PID:8976
- C:\Windows\System\VnTBrCP.exe
  C:\Windows\System\VnTBrCP.exe
  2⤵
  PID:8992
- C:\Windows\System\IgTKUUO.exe
  C:\Windows\System\IgTKUUO.exe
  2⤵
  PID:9008
- C:\Windows\System\JKAXlQQ.exe
  C:\Windows\System\JKAXlQQ.exe
  2⤵
  PID:9024
- C:\Windows\System\YwzujpH.exe
  C:\Windows\System\YwzujpH.exe
  2⤵
  PID:9040
- C:\Windows\System\BnEPPFf.exe
  C:\Windows\System\BnEPPFf.exe
  2⤵
  PID:9056
- C:\Windows\System\AiuHJUt.exe
  C:\Windows\System\AiuHJUt.exe
  2⤵
  PID:9072
- C:\Windows\System\qjdyHeQ.exe
  C:\Windows\System\qjdyHeQ.exe
  2⤵
  PID:9088
- C:\Windows\System\jjCKPfB.exe
  C:\Windows\System\jjCKPfB.exe
  2⤵
  PID:9104
- C:\Windows\System\LtOHinE.exe
  C:\Windows\System\LtOHinE.exe
  2⤵
  PID:9120
- C:\Windows\System\BmKhlmn.exe
  C:\Windows\System\BmKhlmn.exe
  2⤵
  PID:9136
- C:\Windows\System\RRLHLQB.exe
  C:\Windows\System\RRLHLQB.exe
  2⤵
  PID:9152
- C:\Windows\System\KLcCibu.exe
  C:\Windows\System\KLcCibu.exe
  2⤵
  PID:9168
- C:\Windows\System\DfcmtLp.exe
  C:\Windows\System\DfcmtLp.exe
  2⤵
  PID:9184
- C:\Windows\System\LmtLYsJ.exe
  C:\Windows\System\LmtLYsJ.exe
  2⤵
  PID:9200
- C:\Windows\System\GLzMcVc.exe
  C:\Windows\System\GLzMcVc.exe
  2⤵
  PID:8216
- C:\Windows\System\AMkLSAK.exe
  C:\Windows\System\AMkLSAK.exe
  2⤵
  PID:8248
- C:\Windows\System\jblrYDO.exe
  C:\Windows\System\jblrYDO.exe
  2⤵
  PID:8232
- C:\Windows\System\BHVEUHA.exe
  C:\Windows\System\BHVEUHA.exe
  2⤵
  PID:8236
- C:\Windows\System\lHEGYZk.exe
  C:\Windows\System\lHEGYZk.exe
  2⤵
  PID:8196
- C:\Windows\System\oyUgOXy.exe
  C:\Windows\System\oyUgOXy.exe
  2⤵
  PID:8296
- C:\Windows\System\NJlmIXV.exe
  C:\Windows\System\NJlmIXV.exe
  2⤵
  PID:8356
- C:\Windows\System\dkwAOSl.exe
  C:\Windows\System\dkwAOSl.exe
  2⤵
  PID:8420
- C:\Windows\System\FwTHtzz.exe
  C:\Windows\System\FwTHtzz.exe
  2⤵
  PID:8332
- C:\Windows\System\OVWimsf.exe
  C:\Windows\System\OVWimsf.exe
  2⤵
  PID:8372
- C:\Windows\System\pMnCHGK.exe
  C:\Windows\System\pMnCHGK.exe
  2⤵
  PID:8444
- C:\Windows\System\vyWqHAM.exe
  C:\Windows\System\vyWqHAM.exe
  2⤵
  PID:8504
- C:\Windows\System\VFBkcla.exe
  C:\Windows\System\VFBkcla.exe
  2⤵
  PID:7908
- C:\Windows\System\tMuYBZr.exe
  C:\Windows\System\tMuYBZr.exe
  2⤵
  PID:8572
- C:\Windows\System\TbtmRRG.exe
  C:\Windows\System\TbtmRRG.exe
  2⤵
  PID:8552
- C:\Windows\System\bJSOwSp.exe
  C:\Windows\System\bJSOwSp.exe
  2⤵
  PID:8592
- C:\Windows\System\uaDXxNk.exe
  C:\Windows\System\uaDXxNk.exe
  2⤵
  PID:8640
- C:\Windows\System\SUdORMG.exe
  C:\Windows\System\SUdORMG.exe
  2⤵
  PID:8656
- C:\Windows\System\yzlkdBz.exe
  C:\Windows\System\yzlkdBz.exe
  2⤵
  PID:8708
- C:\Windows\System\mkqkMpe.exe
  C:\Windows\System\mkqkMpe.exe
  2⤵
  PID:8724
- C:\Windows\System\YCsMVRm.exe
  C:\Windows\System\YCsMVRm.exe
  2⤵
  PID:8736
- C:\Windows\System\tXSCRGK.exe
  C:\Windows\System\tXSCRGK.exe
  2⤵
  PID:8784
- C:\Windows\System\DxnIjep.exe
  C:\Windows\System\DxnIjep.exe
  2⤵
  PID:8820
- C:\Windows\System\soUMuHu.exe
  C:\Windows\System\soUMuHu.exe
  2⤵
  PID:8836
- C:\Windows\System\dIwWbBm.exe
  C:\Windows\System\dIwWbBm.exe
  2⤵
  PID:8912
- C:\Windows\System\zbiPfdE.exe
  C:\Windows\System\zbiPfdE.exe
  2⤵
  PID:8952
- C:\Windows\System\WtktmNc.exe
  C:\Windows\System\WtktmNc.exe
  2⤵
  PID:9016
- C:\Windows\System\sQiZAbi.exe
  C:\Windows\System\sQiZAbi.exe
  2⤵
  PID:9080
- C:\Windows\System\WNgMnig.exe
  C:\Windows\System\WNgMnig.exe
  2⤵
  PID:9144
- C:\Windows\System\ifMTPpz.exe
  C:\Windows\System\ifMTPpz.exe
  2⤵
  PID:9208
- C:\Windows\System\AQNzyAE.exe
  C:\Windows\System\AQNzyAE.exe
  2⤵
  PID:8968
- C:\Windows\System\wEHcLmY.exe
  C:\Windows\System\wEHcLmY.exe
  2⤵
  PID:8280
- C:\Windows\System\IuOwDlS.exe
  C:\Windows\System\IuOwDlS.exe
  2⤵
  PID:9036
- C:\Windows\System\RCYKExh.exe
  C:\Windows\System\RCYKExh.exe
  2⤵
  PID:9192
- C:\Windows\System\buSmlYm.exe
  C:\Windows\System\buSmlYm.exe
  2⤵
  PID:9096
- C:\Windows\System\czDVukk.exe
  C:\Windows\System\czDVukk.exe
  2⤵
  PID:9164
- C:\Windows\System\JRWAOXH.exe
  C:\Windows\System\JRWAOXH.exe
  2⤵
  PID:7288
- C:\Windows\System\EltiTMt.exe
  C:\Windows\System\EltiTMt.exe
  2⤵
  PID:8328
- C:\Windows\System\rUWycHj.exe
  C:\Windows\System\rUWycHj.exe
  2⤵
  PID:8392
- C:\Windows\System\hCBeDwI.exe
  C:\Windows\System\hCBeDwI.exe
  2⤵
  PID:8268
- C:\Windows\System\tiGhCeY.exe
  C:\Windows\System\tiGhCeY.exe
  2⤵
  PID:8492
- C:\Windows\System\LDFVmPq.exe
  C:\Windows\System\LDFVmPq.exe
  2⤵
  PID:8624
- C:\Windows\System\RcTxkDy.exe
  C:\Windows\System\RcTxkDy.exe
  2⤵
  PID:8768
- C:\Windows\System\RWfuZNG.exe
  C:\Windows\System\RWfuZNG.exe
  2⤵
  PID:8884
- C:\Windows\System\MLWubcX.exe
  C:\Windows\System\MLWubcX.exe
  2⤵
  PID:8476
- C:\Windows\System\JViqaJW.exe
  C:\Windows\System\JViqaJW.exe
  2⤵
  PID:8560
- C:\Windows\System\goPCrkI.exe
  C:\Windows\System\goPCrkI.exe
  2⤵
  PID:8692
- C:\Windows\System\hBAjrqh.exe
  C:\Windows\System\hBAjrqh.exe
  2⤵
  PID:8936
- C:\Windows\System\IIxzhYF.exe
  C:\Windows\System\IIxzhYF.exe
  2⤵
  PID:9048
- C:\Windows\System\wtUrQLV.exe
  C:\Windows\System\wtUrQLV.exe
  2⤵
  PID:8896
- C:\Windows\System\evWsCdd.exe
  C:\Windows\System\evWsCdd.exe
  2⤵
  PID:9064
- C:\Windows\System\XeQhpSo.exe
  C:\Windows\System\XeQhpSo.exe
  2⤵
  PID:8456
- C:\Windows\System\EOgSaTx.exe
  C:\Windows\System\EOgSaTx.exe
  2⤵
  PID:9160
- C:\Windows\System\DqJNMlk.exe
  C:\Windows\System\DqJNMlk.exe
  2⤵
  PID:8436
- C:\Windows\System\lfeBfwr.exe
  C:\Windows\System\lfeBfwr.exe
  2⤵
  PID:8988
- C:\Windows\System\VCuhcaE.exe
  C:\Windows\System\VCuhcaE.exe
  2⤵
  PID:9052
- C:\Windows\System\NSblAnc.exe
  C:\Windows\System\NSblAnc.exe
  2⤵
  PID:9116
- C:\Windows\System\jGCGnkv.exe
  C:\Windows\System\jGCGnkv.exe
  2⤵
  PID:8920
- C:\Windows\System\xOqtNGd.exe
  C:\Windows\System\xOqtNGd.exe
  2⤵
  PID:8816
- C:\Windows\System\mlJzcWJ.exe
  C:\Windows\System\mlJzcWJ.exe
  2⤵
  PID:9000
- C:\Windows\System\ezANrkW.exe
  C:\Windows\System\ezANrkW.exe
  2⤵
  PID:8964
- C:\Windows\System\NnbJrUf.exe
  C:\Windows\System\NnbJrUf.exe
  2⤵
  PID:8756
- C:\Windows\System\zVOSZaf.exe
  C:\Windows\System\zVOSZaf.exe
  2⤵
  PID:8608
- C:\Windows\System\QQDpvyg.exe
  C:\Windows\System\QQDpvyg.exe
  2⤵
  PID:8524
- C:\Windows\System\nWLLXxB.exe
  C:\Windows\System\nWLLXxB.exe
  2⤵
  PID:8880
- C:\Windows\System\pBMpjiv.exe
  C:\Windows\System\pBMpjiv.exe
  2⤵
  PID:7420
- C:\Windows\System\sfLEMdT.exe
  C:\Windows\System\sfLEMdT.exe
  2⤵
  PID:8588
- C:\Windows\System\QDKohvS.exe
  C:\Windows\System\QDKohvS.exe
  2⤵
  PID:8832
- C:\Windows\System\PlJpiNs.exe
  C:\Windows\System\PlJpiNs.exe
  2⤵
  PID:9220
- C:\Windows\System\OoksTpi.exe
  C:\Windows\System\OoksTpi.exe
  2⤵
  PID:9236
- C:\Windows\System\nVMqDLy.exe
  C:\Windows\System\nVMqDLy.exe
  2⤵
  PID:9252
- C:\Windows\System\QylqoNB.exe
  C:\Windows\System\QylqoNB.exe
  2⤵
  PID:9268
- C:\Windows\System\czYJznz.exe
  C:\Windows\System\czYJznz.exe
  2⤵
  PID:9284
- C:\Windows\System\WeBSZCg.exe
  C:\Windows\System\WeBSZCg.exe
  2⤵
  PID:9300
- C:\Windows\System\PaAonVU.exe
  C:\Windows\System\PaAonVU.exe
  2⤵
  PID:9316
- C:\Windows\System\hOGSDKa.exe
  C:\Windows\System\hOGSDKa.exe
  2⤵
  PID:9332
- C:\Windows\System\ooYpLdF.exe
  C:\Windows\System\ooYpLdF.exe
  2⤵
  PID:9348
- C:\Windows\System\piukslq.exe
  C:\Windows\System\piukslq.exe
  2⤵
  PID:9364
- C:\Windows\System\tOQmAbm.exe
  C:\Windows\System\tOQmAbm.exe
  2⤵
  PID:9380
- C:\Windows\System\nFyGmCW.exe
  C:\Windows\System\nFyGmCW.exe
  2⤵
  PID:9396
- C:\Windows\System\pkZHzsX.exe
  C:\Windows\System\pkZHzsX.exe
  2⤵
  PID:9416
- C:\Windows\System\udnSJZt.exe
  C:\Windows\System\udnSJZt.exe
  2⤵
  PID:9432
- C:\Windows\System\OxpxLYJ.exe
  C:\Windows\System\OxpxLYJ.exe
  2⤵
  PID:9448
- C:\Windows\System\YNBvloF.exe
  C:\Windows\System\YNBvloF.exe
  2⤵
  PID:9464
- C:\Windows\System\QIjdleY.exe
  C:\Windows\System\QIjdleY.exe
  2⤵
  PID:9480
- C:\Windows\System\kiyOjAS.exe
  C:\Windows\System\kiyOjAS.exe
  2⤵
  PID:9496
- C:\Windows\System\QPFwdfu.exe
  C:\Windows\System\QPFwdfu.exe
  2⤵
  PID:9512
- C:\Windows\System\fKdWEtW.exe
  C:\Windows\System\fKdWEtW.exe
  2⤵
  PID:9532
- C:\Windows\System\WFOgLOm.exe
  C:\Windows\System\WFOgLOm.exe
  2⤵
  PID:9548
- C:\Windows\System\oUhdosf.exe
  C:\Windows\System\oUhdosf.exe
  2⤵
  PID:9564
- C:\Windows\System\zOTwGyB.exe
  C:\Windows\System\zOTwGyB.exe
  2⤵
  PID:9580
- C:\Windows\System\qtYyUCU.exe
  C:\Windows\System\qtYyUCU.exe
  2⤵
  PID:9596
- C:\Windows\System\ZXaTTvj.exe
  C:\Windows\System\ZXaTTvj.exe
  2⤵
  PID:9612
- C:\Windows\System\GRLADAd.exe
  C:\Windows\System\GRLADAd.exe
  2⤵
  PID:9628
- C:\Windows\System\aKLQWTL.exe
  C:\Windows\System\aKLQWTL.exe
  2⤵
  PID:9644
- C:\Windows\System\RaEDfSp.exe
  C:\Windows\System\RaEDfSp.exe
  2⤵
  PID:9660
- C:\Windows\System\NiRkDwW.exe
  C:\Windows\System\NiRkDwW.exe
  2⤵
  PID:9676
- C:\Windows\System\QpSHBrM.exe
  C:\Windows\System\QpSHBrM.exe
  2⤵
  PID:9692
- C:\Windows\System\fpACMJU.exe
  C:\Windows\System\fpACMJU.exe
  2⤵
  PID:9708
- C:\Windows\System\qbiJPgA.exe
  C:\Windows\System\qbiJPgA.exe
  2⤵
  PID:9728
- C:\Windows\System\QJnhNln.exe
  C:\Windows\System\QJnhNln.exe
  2⤵
  PID:9744
- C:\Windows\System\hkfHNHB.exe
  C:\Windows\System\hkfHNHB.exe
  2⤵
  PID:9760
- C:\Windows\System\hyIwByQ.exe
  C:\Windows\System\hyIwByQ.exe
  2⤵
  PID:9776
- C:\Windows\System\CXjMUzZ.exe
  C:\Windows\System\CXjMUzZ.exe
  2⤵
  PID:9792
- C:\Windows\System\ukfOPKA.exe
  C:\Windows\System\ukfOPKA.exe
  2⤵
  PID:9808
- C:\Windows\System\vaDucLE.exe
  C:\Windows\System\vaDucLE.exe
  2⤵
  PID:9824
- C:\Windows\System\reKcJUP.exe
  C:\Windows\System\reKcJUP.exe
  2⤵
  PID:9840
- C:\Windows\System\gWCdAKN.exe
  C:\Windows\System\gWCdAKN.exe
  2⤵
  PID:9856
- C:\Windows\System\WZeveYA.exe
  C:\Windows\System\WZeveYA.exe
  2⤵
  PID:9872
- C:\Windows\System\DpGVcCK.exe
  C:\Windows\System\DpGVcCK.exe
  2⤵
  PID:9896
- C:\Windows\System\dmXeCnC.exe
  C:\Windows\System\dmXeCnC.exe
  2⤵
  PID:9912
- C:\Windows\System\ByroGMG.exe
  C:\Windows\System\ByroGMG.exe
  2⤵
  PID:9928
- C:\Windows\System\ffKwPcA.exe
  C:\Windows\System\ffKwPcA.exe
  2⤵
  PID:9944
- C:\Windows\System\WJzMEVC.exe
  C:\Windows\System\WJzMEVC.exe
  2⤵
  PID:9964
- C:\Windows\System\cHiULko.exe
  C:\Windows\System\cHiULko.exe
  2⤵
  PID:9980
- C:\Windows\System\ISJkYSm.exe
  C:\Windows\System\ISJkYSm.exe
  2⤵
  PID:9996
- C:\Windows\System\dRVpYnO.exe
  C:\Windows\System\dRVpYnO.exe
  2⤵
  PID:10012
- C:\Windows\System\lqrqfdY.exe
  C:\Windows\System\lqrqfdY.exe
  2⤵
  PID:10028
- C:\Windows\System\LeHHALk.exe
  C:\Windows\System\LeHHALk.exe
  2⤵
  PID:10044
- C:\Windows\System\JgzGhUF.exe
  C:\Windows\System\JgzGhUF.exe
  2⤵
  PID:10060
- C:\Windows\System\USxeHrG.exe
  C:\Windows\System\USxeHrG.exe
  2⤵
  PID:10076
- C:\Windows\System\xUYpeuG.exe
  C:\Windows\System\xUYpeuG.exe
  2⤵
  PID:10092
- C:\Windows\System\SroiqxM.exe
  C:\Windows\System\SroiqxM.exe
  2⤵
  PID:10112
- C:\Windows\System\dAPmWzL.exe
  C:\Windows\System\dAPmWzL.exe
  2⤵
  PID:10128
- C:\Windows\System\cwPQrev.exe
  C:\Windows\System\cwPQrev.exe
  2⤵
  PID:10144
- C:\Windows\System\XTiumjX.exe
  C:\Windows\System\XTiumjX.exe
  2⤵
  PID:10160
- C:\Windows\System\YKafFfZ.exe
  C:\Windows\System\YKafFfZ.exe
  2⤵
  PID:10176
- C:\Windows\System\UyNFwUh.exe
  C:\Windows\System\UyNFwUh.exe
  2⤵
  PID:10192
- C:\Windows\System\DTdsftQ.exe
  C:\Windows\System\DTdsftQ.exe
  2⤵
  PID:10208
- C:\Windows\System\XsrGPhA.exe
  C:\Windows\System\XsrGPhA.exe
  2⤵
  PID:10224
- C:\Windows\System\CYiPZOC.exe
  C:\Windows\System\CYiPZOC.exe
  2⤵
  PID:8672
- C:\Windows\System\eiKgeck.exe
  C:\Windows\System\eiKgeck.exe
  2⤵
  PID:9276
- C:\Windows\System\jBawrxh.exe
  C:\Windows\System\jBawrxh.exe
  2⤵
  PID:9340
- C:\Windows\System\HHMnBKx.exe
  C:\Windows\System\HHMnBKx.exe
  2⤵
  PID:9404
- C:\Windows\System\SAxSdxI.exe
  C:\Windows\System\SAxSdxI.exe
  2⤵
  PID:9444
- C:\Windows\System\zmvLrjc.exe
  C:\Windows\System\zmvLrjc.exe
  2⤵
  PID:9504
- C:\Windows\System\HMVpOCZ.exe
  C:\Windows\System\HMVpOCZ.exe
  2⤵
  PID:9264
- C:\Windows\System\bOfVQgG.exe
  C:\Windows\System\bOfVQgG.exe
  2⤵
  PID:8948
- C:\Windows\System\tBpQdHU.exe
  C:\Windows\System\tBpQdHU.exe
  2⤵
  PID:9360
- C:\Windows\System\SoknryS.exe
  C:\Windows\System\SoknryS.exe
  2⤵
  PID:9428
- C:\Windows\System\hGhXKWk.exe
  C:\Windows\System\hGhXKWk.exe
  2⤵
  PID:9492
- C:\Windows\System\eVzhNBb.exe
  C:\Windows\System\eVzhNBb.exe
  2⤵
  PID:9544
- C:\Windows\System\NzphXHW.exe
  C:\Windows\System\NzphXHW.exe
  2⤵
  PID:9604
- C:\Windows\System\ybyQrhh.exe
  C:\Windows\System\ybyQrhh.exe
  2⤵
  PID:9640
- C:\Windows\System\AcFuext.exe
  C:\Windows\System\AcFuext.exe
  2⤵
  PID:9588
- C:\Windows\System\zRATkLA.exe
  C:\Windows\System\zRATkLA.exe
  2⤵
  PID:9652
- C:\Windows\System\JNFVGyW.exe
  C:\Windows\System\JNFVGyW.exe
  2⤵
  PID:9736
- C:\Windows\System\YRbGkoO.exe
  C:\Windows\System\YRbGkoO.exe
  2⤵
  PID:9800
- C:\Windows\System\yIMuYhV.exe
  C:\Windows\System\yIMuYhV.exe
  2⤵
  PID:9864
- C:\Windows\System\aTPMrsW.exe
  C:\Windows\System\aTPMrsW.exe
  2⤵
  PID:9880
- C:\Windows\System\WwdUXUD.exe
  C:\Windows\System\WwdUXUD.exe
  2⤵
  PID:9752
- C:\Windows\System\NyKhreV.exe
  C:\Windows\System\NyKhreV.exe
  2⤵
  PID:9820
- C:\Windows\System\TQxItVC.exe
  C:\Windows\System\TQxItVC.exe
  2⤵
  PID:1496
- C:\Windows\System\LrriRRO.exe
  C:\Windows\System\LrriRRO.exe
  2⤵
  PID:9940
- C:\Windows\System\UpTijKX.exe
  C:\Windows\System\UpTijKX.exe
  2⤵
  PID:9972
- C:\Windows\System\uJpWoVe.exe
  C:\Windows\System\uJpWoVe.exe
  2⤵
  PID:10040
- C:\Windows\System\jvLVWxa.exe
  C:\Windows\System\jvLVWxa.exe
  2⤵
  PID:10104
- C:\Windows\System\uYrgBDC.exe
  C:\Windows\System\uYrgBDC.exe
  2⤵
  PID:10168
- C:\Windows\System\GKRtOQU.exe
  C:\Windows\System\GKRtOQU.exe
  2⤵
  PID:10232
- C:\Windows\System\FRQwgqu.exe
  C:\Windows\System\FRQwgqu.exe
  2⤵
  PID:9952
- C:\Windows\System\oTkigZh.exe
  C:\Windows\System\oTkigZh.exe
  2⤵
  PID:10120
- C:\Windows\System\ugDddaQ.exe
  C:\Windows\System\ugDddaQ.exe
  2⤵
  PID:9372
- C:\Windows\System\xoIoTml.exe
  C:\Windows\System\xoIoTml.exe
  2⤵
  PID:10024
- C:\Windows\System\bVHZjOt.exe
  C:\Windows\System\bVHZjOt.exe
  2⤵
  PID:9232
- C:\Windows\System\sbLuspU.exe
  C:\Windows\System\sbLuspU.exe
  2⤵
  PID:10152
- C:\Windows\System\fQaPwZH.exe
  C:\Windows\System\fQaPwZH.exe
  2⤵
  PID:9248
- C:\Windows\System\tapiFGa.exe
  C:\Windows\System\tapiFGa.exe
  2⤵
  PID:9424
- C:\Windows\System\rlyYhJN.exe
  C:\Windows\System\rlyYhJN.exe
  2⤵
  PID:9528
- C:\Windows\System\izFFlIw.exe
  C:\Windows\System\izFFlIw.exe
  2⤵
  PID:9296
- C:\Windows\System\lTgUsUa.exe
  C:\Windows\System\lTgUsUa.exe
  2⤵
  PID:9576
- C:\Windows\System\USiRgIa.exe
  C:\Windows\System\USiRgIa.exe
  2⤵
  PID:9624
- C:\Windows\System\ZKkvFAo.exe
  C:\Windows\System\ZKkvFAo.exe
  2⤵
  PID:9804
- C:\Windows\System\lCAEsCO.exe
  C:\Windows\System\lCAEsCO.exe
  2⤵
  PID:9888
- C:\Windows\System\pPPhYVZ.exe
  C:\Windows\System\pPPhYVZ.exe
  2⤵
  PID:9788
- C:\Windows\System\AvCdJjp.exe
  C:\Windows\System\AvCdJjp.exe
  2⤵
  PID:10100
- C:\Windows\System\AQRzXdE.exe
  C:\Windows\System\AQRzXdE.exe
  2⤵
  PID:9848
- C:\Windows\System\ujcokfp.exe
  C:\Windows\System\ujcokfp.exe
  2⤵
  PID:10004
- C:\Windows\System\GJuYPTg.exe
  C:\Windows\System\GJuYPTg.exe
  2⤵
  PID:9908
- C:\Windows\System\EpjrRdX.exe
  C:\Windows\System\EpjrRdX.exe
  2⤵
  PID:10124
- C:\Windows\System\ziLEsDJ.exe
  C:\Windows\System\ziLEsDJ.exe
  2⤵
  PID:9636
- C:\Windows\System\jPyoldM.exe
  C:\Windows\System\jPyoldM.exe
  2⤵
  PID:10008
- C:\Windows\System\bvulzLr.exe
  C:\Windows\System\bvulzLr.exe
  2⤵
  PID:9440
- C:\Windows\System\igDVkPG.exe
  C:\Windows\System\igDVkPG.exe
  2⤵
  PID:9700
- C:\Windows\System\eeFsHUt.exe
  C:\Windows\System\eeFsHUt.exe
  2⤵
  PID:9460
- C:\Windows\System\PLkKYXf.exe
  C:\Windows\System\PLkKYXf.exe
  2⤵
  PID:9768
- C:\Windows\System\xZSlJJh.exe
  C:\Windows\System\xZSlJJh.exe
  2⤵
  PID:10020
- C:\Windows\System\GSyhAWS.exe
  C:\Windows\System\GSyhAWS.exe
  2⤵
  PID:9356
- C:\Windows\System\SOXYLFd.exe
  C:\Windows\System\SOXYLFd.exe
  2⤵
  PID:10204
- C:\Windows\System\AgdKmFF.exe
  C:\Windows\System\AgdKmFF.exe
  2⤵
  PID:9960
- C:\Windows\System\VxyZHNl.exe
  C:\Windows\System\VxyZHNl.exe
  2⤵
  PID:9620
- C:\Windows\System\jOEMNUs.exe
  C:\Windows\System\jOEMNUs.exe
  2⤵
  PID:9392
- C:\Windows\System\sKwIycc.exe
  C:\Windows\System\sKwIycc.exe
  2⤵
  PID:10052
- C:\Windows\System\GMrntoO.exe
  C:\Windows\System\GMrntoO.exe
  2⤵
  PID:9308
- C:\Windows\System\kjdELYX.exe
  C:\Windows\System\kjdELYX.exe
  2⤵
  PID:9992
- C:\Windows\System\eiqkQuI.exe
  C:\Windows\System\eiqkQuI.exe
  2⤵
  PID:9488
- C:\Windows\System\RNUUPKX.exe
  C:\Windows\System\RNUUPKX.exe
  2⤵
  PID:10252
- C:\Windows\System\oJFXATu.exe
  C:\Windows\System\oJFXATu.exe
  2⤵
  PID:10268
- C:\Windows\System\svVPlGa.exe
  C:\Windows\System\svVPlGa.exe
  2⤵
  PID:10288
- C:\Windows\System\XWZCzPf.exe
  C:\Windows\System\XWZCzPf.exe
  2⤵
  PID:10304
- C:\Windows\System\tLuOsUS.exe
  C:\Windows\System\tLuOsUS.exe
  2⤵
  PID:10320
- C:\Windows\System\JxfyTwx.exe
  C:\Windows\System\JxfyTwx.exe
  2⤵
  PID:10336
- C:\Windows\System\SduZPEN.exe
  C:\Windows\System\SduZPEN.exe
  2⤵
  PID:10352
- C:\Windows\System\WZrPdBz.exe
  C:\Windows\System\WZrPdBz.exe
  2⤵
  PID:10368
- C:\Windows\System\QGRHfOt.exe
  C:\Windows\System\QGRHfOt.exe
  2⤵
  PID:10384
- C:\Windows\System\XnMkoAk.exe
  C:\Windows\System\XnMkoAk.exe
  2⤵
  PID:10400
- C:\Windows\System\VhEpQxD.exe
  C:\Windows\System\VhEpQxD.exe
  2⤵
  PID:10416
- C:\Windows\System\uMBRyrb.exe
  C:\Windows\System\uMBRyrb.exe
  2⤵
  PID:10432
- C:\Windows\System\FKUoMQD.exe
  C:\Windows\System\FKUoMQD.exe
  2⤵
  PID:10448
- C:\Windows\System\aBhaEKW.exe
  C:\Windows\System\aBhaEKW.exe
  2⤵
  PID:10468
- C:\Windows\System\OBMkTut.exe
  C:\Windows\System\OBMkTut.exe
  2⤵
  PID:10484
- C:\Windows\System\jtizLWi.exe
  C:\Windows\System\jtizLWi.exe
  2⤵
  PID:10500
- C:\Windows\System\FMjdMKj.exe
  C:\Windows\System\FMjdMKj.exe
  2⤵
  PID:10516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BYLqeZe.exe

Filesize
2.2MB

MD5
f38b06a9ef93bcc1e52d83d328bbff69

SHA1
64ca3a9af7571cf37f105623468bf1e3a2a85be8

SHA256
8e417e54464bcd37491b72f44ea3bfc271539fac765be9fe40ed737da885c542

SHA512
8e22954056cb245484fa54437d99087b93b75a57c53bd1fe6014b3073508e9aae3de73968c04a55d1d704a62b8c7e8464bd150d82df45d1f6205454f386ef3af

Download Submit
C:\Windows\system\BaCLSwS.exe

Filesize
2.2MB

MD5
06adcccdc22918682cd1fc4412f4abe9

SHA1
d4ebe49fcfb21877cadf1a8c68de5b8788098162

SHA256
399a3cff4cc6e3469038bf018318029642bcb26ad6cf14e5d108b4214ba44959

SHA512
cd8bac5e66c82e1175a13cbfb2ce40f9c871e1f5ea2e683758599b4105330a6b89699e5adce832b349125bbb91f54a1ae91a44a2833ba7e627dba5061fee19b0

Download Submit
C:\Windows\system\DIsyImm.exe

Filesize
2.2MB

MD5
992b40db801f333d9f34b6a4c36c28f1

SHA1
4fdc58a41e91286b24645f812213896d180f60d0

SHA256
612167e8626dcaa834d8ec56925149c38a31acdc148593f960096c211fc300ce

SHA512
fd98a8ba2bdcc4c125f65dcdc72bc9f6accffa1a42da1f64a422bc7928b9b9bb7232f234e626c09060f12e029b30fc9f2619d7f90f52c2460dce8c5e026379db

Download Submit
C:\Windows\system\MuwYegx.exe

Filesize
2.2MB

MD5
f9fe79b7cec77819c2e12498b3e61d87

SHA1
6c1908364ee90d182273b66e308a0512a76e4803

SHA256
1f523874154aac194eaa03403de388a9cf457181d18e152ad45d2733c6080341

SHA512
34808fe01cced14620553babc43ac595356dc83b9cf74c369de205d0084b2f19e020cdc45017802c01d429ceae6be167ccc77c8117948adf20bf5c9217ca42d8

Download Submit
C:\Windows\system\OrIvEVi.exe

Filesize
2.2MB

MD5
76cd2674440f6c028e41502d2a5e2b59

SHA1
63cf7f3d48a45c0bd8e82111c55d6788ec209b85

SHA256
1e6082ceef505850d3edc46f314310c8c5d2e5cd5860f21324473fa71df7150e

SHA512
d78035aebe993fc021a30da4bc3fe10e694ab6319a8ea04c4e7fbfe88fa93a7b9fde0c56d4491a6e6733337d6e87d1f868bac8025ff6b37db370f4fdaa6e9482

Download Submit
C:\Windows\system\PChYUPa.exe

Filesize
2.2MB

MD5
c84a88df3fb64030a23812514ceeb8b1

SHA1
db8b2ed656f48182c26f1a0a7228bdc09c211eae

SHA256
bc861c3f8e0ce5acd6ac4fbc4749bbb2d63e4e16f9d7825d2147f3b559f44e47

SHA512
528eca0e329597c9cd4a513c6f89a34d2f5feb0ec272cec4a771ef5b40fedfe2f736d5e2374835a8366ee5198b14aaa9f78396717b2bb0a3958568a938b64b60

Download Submit
C:\Windows\system\QOjSYdu.exe

Filesize
2.2MB

MD5
7ff5f0bd080fbd436df87d4b98008667

SHA1
8af91d948a96840bae755d5b67229edb347402f2

SHA256
5c86e49952ea21ad5398ae1e38d426c4a813a93603ec9617fc8aa0c2efbb2705

SHA512
7a17c1820482278ea37503e6f249cc5b2d463b3632a430c48b6f177ba7d6194f3fdceab0345fa152ed118f116368e2e7c5f64ee202ca093c0806393795ca7a16

Download Submit
C:\Windows\system\QqYMDrG.exe

Filesize
2.2MB

MD5
fcabdb87eadb96825757a32faea30c70

SHA1
0c2640190a23048eb6add952a91b4319748b5918

SHA256
f180f77b596f21012772c28f8cb11dc6da291a885b899b32798045a07998607b

SHA512
cc4a3f6b60a588ed52f72dfedc1e222731a2777bcb05a3f97a37870f420adb5cf056ecf53b60e771721265bd0b715170eaa2352b2405dc384eaf811b7970faed

Download Submit
C:\Windows\system\TaapdIf.exe

Filesize
2.2MB

MD5
40f74a757b07ec353d636ceacc290509

SHA1
5c332e8c1eefaf13da6191abbb159847ecba7398

SHA256
61808c48b4f3dcc82c595b150f1dc8a5951efd2651bba3f66add757147187039

SHA512
2c08d1bed3858084bf0a170e144a70e868af7fe8b4b650e380ca9df6f1da9dac108d2f43f307acae7de14b67d5e125d37062d03639ec93981991d30a3cc5586a

Download Submit
C:\Windows\system\WhGeMga.exe

Filesize
2.2MB

MD5
791545f5f0499bc95058815b30a14344

SHA1
65e9edf35fe8c023be2215d82f48fbe1be851a31

SHA256
7ad08d35755517a00cb2d128e6a818d73ee5c588141060f32ad0803f7a26d1c7

SHA512
6afca9b155f5c0197a92f94bc68b2b7b338e171b3d809a71d650539a3f3aec3d1ea843b0cbe244e2b65f4091566df7da79c3f768b299aeddad297619ea1789f9

Download Submit
C:\Windows\system\axzEfdA.exe

Filesize
2.2MB

MD5
fe8bb3ae32e69fd00bfdcb29b6dee693

SHA1
ee6a49406e0d7ab1598d19e92274423609dc2c1c

SHA256
327429344c62c31c10929101c0b1ebe13550b7d73f2275fd0718ec86fe5cc4a3

SHA512
9a65566a529e466504ece38ab2059eed8a5e06212fcfc621d755af234e1180df0dc159fd925595baa9de6cdd7788d8b1eb0a6b5985e219ffb76af4a20ad3d7f4

Download Submit
C:\Windows\system\cyXvvgf.exe

Filesize
2.2MB

MD5
4c29520c5d43d11d875b5ebf11b1934a

SHA1
a3e2940bc2afc8bdfbf20f5a313c33fa295cee10

SHA256
e6369fac35f2b599579d244002f5287aa26c40608132bd5ae11424f655fdd87c

SHA512
9132e348df9355073910c85a9705938508c9b6fdb78d1cfa159b7e3b9b02dbfdd94e1bae36d1308048930a203dbafe6d688c0e3fe99ca7381fa70ec2f787c9cb

Download Submit
C:\Windows\system\lMuJYQr.exe

Filesize
2.2MB

MD5
56b91cc32ff142ab49e69478ca4585b9

SHA1
97a135852140092de5280a63d7294ef532f28385

SHA256
f7439d0c44a7544ad6e89c748b49061d49196350c5858d7ae209449181b519f1

SHA512
70e5defd855f2e291ba459f798181ec3f6a9aadd452397db8972426addd1cb4a321a0e01e3a31c043373648745e275a5365762573df137bb6882baa6a31a74a0

Download Submit
C:\Windows\system\mjyfuZt.exe

Filesize
2.2MB

MD5
380d7442a3ec43248d85dc4e69f99304

SHA1
86ff040817f89eb0fa3593c2ff5d44e222cd7880

SHA256
c6ca345a51cc002502a9879a6fa469ce34fe1c89ca377eeb7f95b024302b8076

SHA512
450f079d61483ffd84cd6c90c321009485e5f13a3871f43f95b39b77956fc161c9ab49793ce6147db9a43ebf8c17b2eef0856515df5541244855b4c3aa5a4e98

Download Submit
C:\Windows\system\qiohfVe.exe

Filesize
2.2MB

MD5
2e6d6f720982177853d5156ad40f1159

SHA1
0941ae7933e0b1890e952724396a90031451a6ff

SHA256
ea42d61b1216aef02763694fb6195325c666f91c6bda0e09e543bfabaf20c07a

SHA512
18cf740cc81144ab8e1c5bd4e290f70a42be7a74dd53ddeb0d4bbfecd71d842db1dd9d39d034fc802cab08f4379d2472b92356d39e8aba8e2c54ee9918475f04

Download Submit
C:\Windows\system\vCerEIL.exe

Filesize
2.2MB

MD5
ac97309cad846f2e71706d8a785b5ce6

SHA1
166895e205d0f649bc4ae119c23a75ff6c28a536

SHA256
ed22a85babbedb7b17489b13ead77900c080e82522ecd1623f7d7cab44bfa6ba

SHA512
76e63cd6766197337f95d19c46e0e012997b94f018996f3594e107e05a380506bf124c8f62feed14cbb30204a62372f750a185a3242de4e94b4116ace056f961

Download Submit
C:\Windows\system\wtROeLL.exe

Filesize
2.2MB

MD5
b36528c25c09edf567448c0a6ca26af1

SHA1
ef8b7b5a7352689c4c8fbd35fd90c5a85a924857

SHA256
b4c326bcf1f695d41a5510693fd82376b4793bf3039cf197abfc166ef5e36767

SHA512
2c68fca141641a3b6413d9200e496cfa463be090a5e1e512b6a265be081925753cce61fd64ef6fc87b6fafeef501c9bce4fc95a1db54ca1df8e2b2a74e7bcd7b

Download Submit
\Windows\system\AYXuxAN.exe

Filesize
2.2MB

MD5
7c5a89016aec11d3f694f40b872cd743

SHA1
30a53e660c2afcf146892c6599bb3d44468b3cae

SHA256
78cc713e2c2df5cf802362152340ddba0de247160b4f18867b321b53685e84e7

SHA512
ed66f7c2017eadbafbde37f2ff9167e9399dc8f068c869fe97249ef2026dc8c6e352c4661a4d0cb2903980080e1b5c3b310570c9434167bf272139dd7771421b

Download Submit
\Windows\system\CILEaUg.exe

Filesize
2.2MB

MD5
01f6a94ca5fa9df1ec7710517ebe68f8

SHA1
3ef698dbd257cfc4e542c3e71685c9d9bcfbd90a

SHA256
26528f7ee1aaf4b066b10499907c2acb666c359cfe77b63634bb201ca1f5aa2c

SHA512
b0afa9a732700e156de5335570d3c008979b794ec5faaf3c946d2c764ad9c033fefe8745b54ea84b6cb49eee077ab26656cb709a1178116d5b9407030f1f72b3

Download Submit
\Windows\system\KQWUTLu.exe

Filesize
2.2MB

MD5
0c2a5515ae7f830ee2cdbc0c8d458998

SHA1
f63cd6af2b9a649c0075200d0e4837d73cf7ccd7

SHA256
1224591a07b1c0b982352afa858c06b41f584a729a6493a6c0feb03a0299258e

SHA512
07b4daeeb4cc6d4e4947873ad8442ddd445acef3895504de173a777abc261ae21ea24c985c5a5817ab47fbbd176d17cbc80f35c34596869a1eeb52d7181d44e4

Download Submit
\Windows\system\KgSfokk.exe

Filesize
2.2MB

MD5
d855d1c1d999e60fdf1b2084bcff38d5

SHA1
ec1c445f137f7fcdaabee2bcc62d8f676146b9f5

SHA256
be3e69921ae572add4f54798f4c015ba2661cfe8515968167e8965bf19c709ad

SHA512
9e2352925deed08757793a92a9952ba3e343e6dc2f684799981ed62fa2cd74ca087baa086045d359b731aa1ea85737bf38dc079dc1a92a8271f3c1e204065e43

Download Submit
\Windows\system\LEtejVK.exe

Filesize
2.2MB

MD5
a22ca553f70383aa96103982293b9465

SHA1
0e267eca904264cd31c8587142f6d19371444abb

SHA256
433acfc51a5dd05522a1c97a9835a406c872fde15005559801962d108cfe29bb

SHA512
4f577a9af08490fe8c2d6b7c336208d4cdbee1306a564994b914a19158150e6c2effda0d777cb7ebb8b161c5dd9fd9855b1f84935e4bc8627cce1dce9bb25f43

Download Submit
\Windows\system\LrXDVbG.exe

Filesize
2.2MB

MD5
d77d17ebacbf63101e477be98675b311

SHA1
f2fe4a18042fb1fd5d8cf126ae148cf41665de37

SHA256
f9eb6501dd89b65c1af7dc081485c41ce25e3fe5808716a51cc67a91c8a76d39

SHA512
ca6421dbd4db468761574eb2cc4a6aa2c3189d65c7ec8c97b1c41caf3dede9e6fabfad32f1d6bc4bfc8677826691ea104c3df5a98b189ff5ec6aa7806607e2a1

Download Submit
\Windows\system\OSlHrIi.exe

Filesize
2.2MB

MD5
3dd61fef58dd1fdd5fb77e4f5c57909f

SHA1
bad7ceba7fb66b9cb41e8e6bbaec2a120abd729c

SHA256
af3991b57accf9a7bcba77651058b5be4995e79e39fd3f01f66ed7e3d3a91f88

SHA512
36a6b4d2372e80d5e1a4666694af4597b646285876aa610112c3bb8922f4f04436bad0b39c2f572a5cf3cff20e8e6ac85a1a0ad07ff47970ac724e5bf23106bf

Download Submit
\Windows\system\QGCdbTV.exe

Filesize
2.2MB

MD5
c8d33cd7ad13e0cf1605995d0890a956

SHA1
2fdb7a611712063516c4d60ce27fd7ada231e16d

SHA256
1c61eb5ee1d8d328bd3d0f5064be6d158ffe282d9536296e7e235e44604c08ba

SHA512
bd33e344ee91878b8524bd3b7cf84abb14f1755ac0675ec457edf293841452e56450bc485be3b7aca76db8c3d4b05354a9a6f2645737f7b80692b0626f4948a7

Download Submit
\Windows\system\SNAvtMp.exe

Filesize
2.2MB

MD5
091e427fbebb2be30538200d1855e3cb

SHA1
973b194c74673359bab018ae96dbd4b91d8222d9

SHA256
4b8e625c3e63515853e6be501ab28c78507761822d8a5903166d6a5b524d3c18

SHA512
6f2ef3267e2b4b6194934d671e056d3ae6cdbcbfd37e5fdf41a0faa586bbd4811475d7c67f66e051f44e905f8c8e1f638155718cfedd8fa54ee20399586f0431

Download Submit
\Windows\system\fHYiiaC.exe

Filesize
2.2MB

MD5
788af58ed744a40eff23031776253c61

SHA1
6610bd8c36cf07b20619bc072234055512eb6364

SHA256
dc17e067797a42d6cd002aaf95e866c90273c84b9c769c2ab7325cdbd83d6c88

SHA512
d6c75648a37929604e45dd2fceede9e633d02f2a8502e955c5780e8db29324ba54ca6b885270d99288c6441c94bc05f7216ef12a3aaf2ac91db241a02e2cf1ac

Download Submit
\Windows\system\gjIRZob.exe

Filesize
2.2MB

MD5
dc61572b4c80b00e391ba8c8a0781012

SHA1
70d24439ba44445a19fb1749b191a1df95047157

SHA256
a39b8d28da348c190765df9619abc7e80e36012c116cf29fb330ab63c542bccf

SHA512
f0dd006047130c5df314a3fa69783a273a94781decf1d5c3eaf3a9f5d4f1f17b5e4e6e9be666ff2f0c6887478939527df7c3697b39fa22b8346445ec06eeee41

Download Submit
\Windows\system\hYOGclC.exe

Filesize
2.2MB

MD5
1b28281fc6c9da95a2fea3f0e1480455

SHA1
2d5c2cc85882e3807b7ff2e44845bf41eb870aab

SHA256
1a7932bb31df0fc219c5470d0d3632ad567beafa4dd9004e309e94b9f3667332

SHA512
eee435a623f9a03f90d2dc3f5aca4d32ce72bcada69eec1774907510c7dac5ba2148b1a52a286e570b6322aa05fb3ee646a1cb88406f418b5f32ae42f80baec8

Download Submit
\Windows\system\icCvUEM.exe

Filesize
2.2MB

MD5
4ee5333e9a45798368d9b33e056fbe25

SHA1
5b24c4f1fa22354be99ec8103e4f6621b7816a09

SHA256
52712be60393f961d331a97c696104c43c5f625f1a3fc78e20152ebc882a26af

SHA512
43feff34e60fc2bd1ce391c34e62fd2375ac66f41fdbafb895f5e18c56c14cc92261886e10401005288f3841e9583ec6c466f892f10619c0143fc9d2f7d7d563

Download Submit
\Windows\system\lQBtHrt.exe

Filesize
2.2MB

MD5
7f3cbe35cec8b1de6cecddc6591d9d24

SHA1
287df06dbb3531e9a46f0cd81bdb21395bb9759f

SHA256
4ef2a42cf051ae625df2842d3f6407824c4283eb65f2c6d54d1165d4d966c529

SHA512
e8fcafbefd186b15608e8dd0da8324447810ce4a0fe7dc02df6485a23ef0ab5b38a20f0c5e22fa7cf9f645922befb7eea0e6ff91cb3f68ce7811244323b4af43

Download Submit
\Windows\system\mGTUQRn.exe

Filesize
2.2MB

MD5
0d96f3cec50bf5cafff9e263604d8aac

SHA1
7a76499fe0c74c9f8e7bfc6a65fe65ba33ea155b

SHA256
0050ba1bec04e6dbb731c9faa59b0fb3f075cde8e807dbe17a5f08c1dc194dd0

SHA512
282f617fe720d799305b6cbabb931ab4a7b03d608bc6f848b35b1bde31e85cdc4e0ceeaf78dbc94a301a0b3a04bf6bb2ddb481680a02e3dd921d02a19a7f4da7

Download Submit
\Windows\system\mPOejwR.exe

Filesize
2.2MB

MD5
2f55ef5ca82464e655737293e5dd8ed0

SHA1
eede1574eb14aeee9d29aa78d0033b238ab74d6f

SHA256
2e7d22c6b658d1a88dbf651689d344e56728891e61a61b7cb499a4af428db6c9

SHA512
ab587d79565b8c9b084959d80c94b6399a1358618fae2d24e4187fa568f48115f14f8db1f92b4e9fb190006feb8e62d317f0634464fc6f5a0ba37f1bc168a58e

Download Submit
\Windows\system\mnZLbmt.exe

Filesize
2.2MB

MD5
5095555d21f3d37d32da2db292d1364b

SHA1
395a7a355b8bf7dde1981a484af7d37a1471bf72

SHA256
6801593e1c48f9ad4885c4b768b523093fc18ffffafa4f0906cdba7d9f82b631

SHA512
28a5b33e8578c0885175f4f8160da3ec7d60d4194f5284c2daf170db653f22eb3eec03335abf532455b35088ad9b5f73500bbb366c7a6d14aeea448678be671b

Download Submit
\Windows\system\mzTKHUa.exe

Filesize
2.2MB

MD5
d10e77763eb35282c516e6d96ed963f4

SHA1
d1e68a61ac030bd35bf6ae1b9a3792337ca84917

SHA256
8f44c6ad6b4cd7b10f4dc4b1aa191933dfad8b48a24627cca1c3715d73b6c2d8

SHA512
97dda031da25d824149ebf545c0bce0fa8b7cbdd34bdabb00079c1912da701a5417b4d94e433d554e88e28177298793ae861c78f409c48317842e1d64a685a0b

Download Submit
\Windows\system\oAeKqRD.exe

Filesize
2.2MB

MD5
1b90466cacde5ac5bf81686c73eead9b

SHA1
b6b65d59ab4e086109a2a41ce3fa83dca8f79894

SHA256
ce27fe0e8ff3a52dab460176078fb3ec17f46385ab2f08421596859a8a9dbcf0

SHA512
c8fc4ba53b5cdf9d365a3041a88c208ae81cd11ad2932bbc2c975caf7b1aab676b01e10d881b7942264055d965dec6272c49758df86c0dcd63268ae6067aa90f

Download Submit
\Windows\system\pJSkRRB.exe

Filesize
2.2MB

MD5
a54e9812458c48ed198753ed841d6712

SHA1
7bdb3dda2699393b3688fc6691355bb7812a1d1c

SHA256
a26dc504b57521291f0c3d9767c80190626dc85022e23130d4fe1ad6c21bbe5d

SHA512
3a161e07059e4db3231b289328ce799a3cbd05f9c8d7e9453806acff9ca80fbdf3440d145398ba9367fe7fb20418c0eff72dbc51d96a8ea2df1d62122cf06918

Download Submit
\Windows\system\rCWkVXc.exe

Filesize
2.2MB

MD5
7d795ffe5ee7af1b06d9862b75f63f7d

SHA1
1601e4a45335e09723461f7caca45fc2dba7f11b

SHA256
8b4eac89d5d8637c9b97a1e0cc1242138cbaa40e964b1b86ccfaf9e6afab598c

SHA512
db6d18f2de5257a60e0017f3c9b753c2b32f715c3d867f7d78d9d73a0369b11f0ca5c29bc1b3ebe993d2b87169a85535f61bd391b5f8739a7399bd3023dce78c

Download Submit
\Windows\system\vLyJFqD.exe

Filesize
2.2MB

MD5
1ea49db4e55ac7bc1974bbf77e74f80d

SHA1
e84819220ffe79faac894c4ac876d5087a410a38

SHA256
63e716cca1b2717f199ca6d5d798fc64c1c791643531150b8cd845bb31085811

SHA512
a52edbe22d32786aca1bc8c20202c5c738853b457708c7f3738fd17a79967a820bc55f018627fc714fe591034b5fb277e9f2ac95c06c1e79141f78afadedeb09

Download Submit
\Windows\system\vvOomgt.exe

Filesize
2.2MB

MD5
d96b16c64e547ab04401a96ad31ba7b8

SHA1
18790d008462e4015d7fad323367642a8abf9fbe

SHA256
803bdc15f1a3dba057bc55fc6b60af543ef75ccc74add633d1f9096b48297935

SHA512
57cc7b74fe30fe64204d669342ae06f6972c864094eb3dd10d63c905828cb361face7c117c076439b228c4d9c7ef870bbb647b4ab371ee707c05e66bab77efe8

Download Submit
\Windows\system\yhUFmkU.exe

Filesize
2.2MB

MD5
d295ae6d03d8577c728549b421a37dd0

SHA1
910f3ca12d665f1736b76ba7d908f6e1a603a796

SHA256
b0cb9c16e1f8d48174e9d2415c6aa0e7bb452c9526917761fff45d438fd70044

SHA512
f425809d2841a9ffb9da90175feab351725a365c5d676eb50857ad3e83fbcc2384d682eff27c6dbb1519965a126b3287e4a7df5e138d718407602be1d0bcc2b7

Download Submit
memory/1728-61-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-7-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/1912-996-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-1914-0x00000000036B0000-0x0000000003AA2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-44-0x00000000036B0000-0x0000000003AA2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-18-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-41-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-52-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/1912-65-0x00000000036B0000-0x0000000003AA2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-1-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-50-0x00000000036B0000-0x0000000003AA2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-109-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-60-0x00000000036B0000-0x0000000003AA2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2060-43-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2368-55-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2388-54-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2424-101-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2492-8-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2492-1367-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2516-19-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2516-1913-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-53-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/3032-48-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/3032-35-0x0000000002D90000-0x0000000002E10000-memory.dmp

Filesize
512KB

Download
memory/3032-34-0x0000000002D90000-0x0000000002E10000-memory.dmp

Filesize
512KB

Download
memory/3032-29-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/3032-25-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/3032-480-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/3032-21-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/3032-40-0x0000000002D90000-0x0000000002E10000-memory.dmp

Filesize
512KB

Download