xmrig | c82b69ebd4003e8e41fdead85ab0ea95c6c65a4745f5ac984bf32f55dc9175ad

Analysis

max time kernel
8s
max time network
30s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 00:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
Size

1.8MB
MD5

0ac56be646315a89146c0fa4fca98d7a
SHA1

458ce3a11ded5d59a244f2d28f2f6cfe115167b7
SHA256

c82b69ebd4003e8e41fdead85ab0ea95c6c65a4745f5ac984bf32f55dc9175ad
SHA512

c6451edc70cfb31e587ec952ee1709cee06010c7efddff6e3a5491d521668a25fa53d4bcadbd611c60cce837709a87e7379dda4fcc242779208ec42a9e8e1b91
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrX:NABC

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/2632-85-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/2952-100-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/2620-99-0x000000013F090000-0x000000013F482000-memory.dmp	xmrig
behavioral1/memory/2488-98-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2576-96-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2520-94-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	xmrig
behavioral1/memory/2656-80-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/2740-79-0x000000013F270000-0x000000013F662000-memory.dmp	xmrig
behavioral1/memory/2744-74-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2348-63-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/2552-53-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2552	dnhNTKi.exe
2348	bWJsmYF.exe
2576	esLFIuP.exe
2744	mVoxcQP.exe
2740	mttQNTM.exe
2656	cBuvdto.exe
2632	NtftKye.exe
2488	LmzlQDW.exe
2520	aCcwTaZ.exe
2620	aFXVpht.exe
2952	CtKVnwb.exe
2524	sQXrMmu.exe
2588	OThswKR.exe
2780	dmjhpWr.exe
2728	DtobLQe.exe
2928	ZWgNwzD.exe
2352	CAIoJjD.exe
1720	Fxogrio.exe
2308	OeYnJBY.exe
2224	mfINHUz.exe
1556	oSuyAEr.exe
592	rbaPaRU.exe
704	TZXImqe.exe
3008	uhHYidZ.exe
848	BwghSpe.exe
1304	LYgYdEU.exe
2436	xCHBwKT.exe
2420	qKFWVWM.exe
1280	WeCdJDs.exe
980	hSueiPT.exe
1636	UTJAppd.exe
2860	hyPcTlj.exe
976	WfObiCn.exe
2372	uvgOyCs.exe
2176	NIwqFBk.exe
2232	FDOKtjM.exe
2208	aIQIavj.exe
1572	WFlXeFW.exe
3044	ktgMZBu.exe
1676	KhYTGST.exe
880	tROTVQi.exe
2628	pAaznew.exe
3056	fYzVYNf.exe
2604	kNwwLMF.exe
2712	pbndCtl.exe
2940	GjuKpfh.exe
1764	kwjrTaB.exe
2312	nKzRuOA.exe
576	yGYqqeR.exe
1580	uNsbWdK.exe
2076	pJAWMLX.exe
1768	TLDPIiS.exe
2756	KCadwmt.exe
1744	aTPztpq.exe
2680	NbtdJTY.exe
2964	aiVXkkH.exe
3084	kgfmpIP.exe
3116	MENaMRs.exe
3148	TbrJRak.exe
3180	feTdQKF.exe
3212	esYFucy.exe
3244	ZKAztgE.exe
3276	sxCuVHE.exe
3308	elWtIvA.exe

Loads dropped DLL 64 IoCs

pid	Process
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe

UPX packed file 50 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1848-0-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/files/0x0009000000014539-3.dat	upx
behavioral1/files/0x000a000000014de9-19.dat	upx
behavioral1/files/0x0009000000015018-28.dat	upx
behavioral1/files/0x0007000000014b70-16.dat	upx
behavioral1/files/0x000f000000005578-42.dat	upx
behavioral1/files/0x0006000000015626-66.dat	upx
behavioral1/files/0x00090000000155ed-35.dat	upx
behavioral1/files/0x00080000000155f7-45.dat	upx
behavioral1/files/0x0006000000015616-54.dat	upx
behavioral1/memory/2632-85-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/files/0x0006000000015c83-119.dat	upx
behavioral1/files/0x0006000000015d31-161.dat	upx
behavioral1/files/0x0006000000016287-184.dat	upx
behavioral1/files/0x00060000000160af-177.dat	upx
behavioral1/files/0x0006000000015f01-170.dat	upx
behavioral1/files/0x0006000000015d98-163.dat	upx
behavioral1/files/0x0006000000015d27-156.dat	upx
behavioral1/files/0x0006000000015d0f-149.dat	upx
behavioral1/files/0x0008000000014abe-142.dat	upx
behavioral1/files/0x0006000000015cf6-135.dat	upx
behavioral1/files/0x0006000000015cce-128.dat	upx
behavioral1/files/0x0006000000015c9f-121.dat	upx
behavioral1/files/0x0006000000015c78-114.dat	upx
behavioral1/files/0x0006000000015c52-107.dat	upx
behavioral1/files/0x0006000000015b6f-101.dat	upx
behavioral1/memory/2952-100-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/memory/2620-99-0x000000013F090000-0x000000013F482000-memory.dmp	upx
behavioral1/memory/2488-98-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/2576-96-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/2520-94-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	upx
behavioral1/files/0x0006000000016176-182.dat	upx
behavioral1/files/0x0006000000015f7a-175.dat	upx
behavioral1/files/0x0006000000015df1-168.dat	upx
behavioral1/files/0x0006000000015d1a-154.dat	upx
behavioral1/files/0x0006000000015d07-147.dat	upx
behavioral1/files/0x0006000000015cfe-141.dat	upx
behavioral1/files/0x0006000000015cee-133.dat	upx
behavioral1/files/0x0006000000015cb6-126.dat	upx
behavioral1/files/0x0006000000015c6b-112.dat	upx
behavioral1/files/0x0006000000015c3d-104.dat	upx
behavioral1/memory/2656-80-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/memory/2740-79-0x000000013F270000-0x000000013F662000-memory.dmp	upx
behavioral1/files/0x00090000000149f5-12.dat	upx
behavioral1/memory/2744-74-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/files/0x0009000000014ef8-73.dat	upx
behavioral1/files/0x0008000000014b31-25.dat	upx
behavioral1/files/0x0007000000015605-65.dat	upx
behavioral1/memory/2348-63-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/memory/2552-53-0x000000013F170000-0x000000013F562000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LgglhBP.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\iAYpSQP.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\iwLChel.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\bXIIWmU.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\rxyiqpt.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\yePKary.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\GWZaScF.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\eLaaTmv.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\WpfJvzX.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\WFlXeFW.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\hyTZugV.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\ZuVoeWk.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\PlYlgUH.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\wnVgTZu.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\OEtYInu.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\sJhgKyR.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\JpzybhY.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\sbptBps.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\BwghSpe.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\dMPJhDx.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\ojCCurd.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\sKfzUkr.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\dmmummJ.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\OsZCgYp.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\TjNuZjf.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\GboKJjW.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\BlcEGFP.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\cppRkPF.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\pAaznew.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\ihrKNna.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\IKsXFdG.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\gPrTAth.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\WtdhXsO.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\OURYxkw.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\OxdOEyf.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\JhnHmGR.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\ThecZpa.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\yAxrAvU.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\kwEEkdU.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\uvgOyCs.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\vvUpfhE.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\KneAFpH.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\LmzlQDW.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\zynJBkw.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\IiJPEIv.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\JjcmmGH.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\OVyBlat.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\TtbObjr.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\dmjhpWr.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\ZFSXcTL.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\undWopw.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\mspMjLO.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\CpgVlqi.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\gkfWXrZ.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\YaDjoSG.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\FDOKtjM.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\wirEnbp.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\ZBcxlvw.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\oeKScaJ.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\WjdDCRX.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\dnhNTKi.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\mfINHUz.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\sxCuVHE.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
File created	C:\Windows\System\hnfrjds.exe	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2288	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
Token: SeDebugPrivilege	2288	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2288	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	29
PID 1848 wrote to memory of 2288	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	29
PID 1848 wrote to memory of 2288	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	29
PID 1848 wrote to memory of 2552	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	30
PID 1848 wrote to memory of 2552	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	30
PID 1848 wrote to memory of 2552	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	30
PID 1848 wrote to memory of 2348	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	31
PID 1848 wrote to memory of 2348	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	31
PID 1848 wrote to memory of 2348	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	31
PID 1848 wrote to memory of 2576	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	32
PID 1848 wrote to memory of 2576	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	32
PID 1848 wrote to memory of 2576	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	32
PID 1848 wrote to memory of 2656	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	33
PID 1848 wrote to memory of 2656	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	33
PID 1848 wrote to memory of 2656	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	33
PID 1848 wrote to memory of 2744	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	34
PID 1848 wrote to memory of 2744	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	34
PID 1848 wrote to memory of 2744	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	34
PID 1848 wrote to memory of 2620	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	35
PID 1848 wrote to memory of 2620	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	35
PID 1848 wrote to memory of 2620	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	35
PID 1848 wrote to memory of 2740	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	36
PID 1848 wrote to memory of 2740	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	36
PID 1848 wrote to memory of 2740	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	36
PID 1848 wrote to memory of 2952	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	37
PID 1848 wrote to memory of 2952	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	37
PID 1848 wrote to memory of 2952	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	37
PID 1848 wrote to memory of 2632	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	38
PID 1848 wrote to memory of 2632	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	38
PID 1848 wrote to memory of 2632	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	38
PID 1848 wrote to memory of 2524	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	39
PID 1848 wrote to memory of 2524	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	39
PID 1848 wrote to memory of 2524	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	39
PID 1848 wrote to memory of 2488	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	40
PID 1848 wrote to memory of 2488	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	40
PID 1848 wrote to memory of 2488	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	40
PID 1848 wrote to memory of 2588	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	41
PID 1848 wrote to memory of 2588	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	41
PID 1848 wrote to memory of 2588	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	41
PID 1848 wrote to memory of 2520	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	42
PID 1848 wrote to memory of 2520	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	42
PID 1848 wrote to memory of 2520	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	42
PID 1848 wrote to memory of 2780	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	43
PID 1848 wrote to memory of 2780	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	43
PID 1848 wrote to memory of 2780	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	43
PID 1848 wrote to memory of 2728	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	44
PID 1848 wrote to memory of 2728	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	44
PID 1848 wrote to memory of 2728	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	44
PID 1848 wrote to memory of 2736	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	45
PID 1848 wrote to memory of 2736	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	45
PID 1848 wrote to memory of 2736	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	45
PID 1848 wrote to memory of 2928	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	46
PID 1848 wrote to memory of 2928	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	46
PID 1848 wrote to memory of 2928	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	46
PID 1848 wrote to memory of 2932	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	47
PID 1848 wrote to memory of 2932	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	47
PID 1848 wrote to memory of 2932	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	47
PID 1848 wrote to memory of 2352	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	48
PID 1848 wrote to memory of 2352	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	48
PID 1848 wrote to memory of 2352	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	48
PID 1848 wrote to memory of 3068	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	49
PID 1848 wrote to memory of 3068	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	49
PID 1848 wrote to memory of 3068	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	49
PID 1848 wrote to memory of 1720	1848	0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ac56be646315a89146c0fa4fca98d7a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2288
- C:\Windows\System\dnhNTKi.exe
  C:\Windows\System\dnhNTKi.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\bWJsmYF.exe
  C:\Windows\System\bWJsmYF.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\esLFIuP.exe
  C:\Windows\System\esLFIuP.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\cBuvdto.exe
  C:\Windows\System\cBuvdto.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\mVoxcQP.exe
  C:\Windows\System\mVoxcQP.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\aFXVpht.exe
  C:\Windows\System\aFXVpht.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\mttQNTM.exe
  C:\Windows\System\mttQNTM.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\CtKVnwb.exe
  C:\Windows\System\CtKVnwb.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\NtftKye.exe
  C:\Windows\System\NtftKye.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\sQXrMmu.exe
  C:\Windows\System\sQXrMmu.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\LmzlQDW.exe
  C:\Windows\System\LmzlQDW.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\OThswKR.exe
  C:\Windows\System\OThswKR.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\aCcwTaZ.exe
  C:\Windows\System\aCcwTaZ.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\dmjhpWr.exe
  C:\Windows\System\dmjhpWr.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\DtobLQe.exe
  C:\Windows\System\DtobLQe.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\TFPOqYa.exe
  C:\Windows\System\TFPOqYa.exe
  2⤵
  PID:2736
- C:\Windows\System\ZWgNwzD.exe
  C:\Windows\System\ZWgNwzD.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\JMSLvLi.exe
  C:\Windows\System\JMSLvLi.exe
  2⤵
  PID:2932
- C:\Windows\System\CAIoJjD.exe
  C:\Windows\System\CAIoJjD.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\TkmUOyA.exe
  C:\Windows\System\TkmUOyA.exe
  2⤵
  PID:3068
- C:\Windows\System\Fxogrio.exe
  C:\Windows\System\Fxogrio.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\VenfHAv.exe
  C:\Windows\System\VenfHAv.exe
  2⤵
  PID:2332
- C:\Windows\System\OeYnJBY.exe
  C:\Windows\System\OeYnJBY.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\aMNnLXY.exe
  C:\Windows\System\aMNnLXY.exe
  2⤵
  PID:1952
- C:\Windows\System\mfINHUz.exe
  C:\Windows\System\mfINHUz.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\emsQADg.exe
  C:\Windows\System\emsQADg.exe
  2⤵
  PID:2996
- C:\Windows\System\oSuyAEr.exe
  C:\Windows\System\oSuyAEr.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\XmQuTao.exe
  C:\Windows\System\XmQuTao.exe
  2⤵
  PID:2320
- C:\Windows\System\rbaPaRU.exe
  C:\Windows\System\rbaPaRU.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\ZIWMSMZ.exe
  C:\Windows\System\ZIWMSMZ.exe
  2⤵
  PID:564
- C:\Windows\System\TZXImqe.exe
  C:\Windows\System\TZXImqe.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\xYsukJF.exe
  C:\Windows\System\xYsukJF.exe
  2⤵
  PID:1488
- C:\Windows\System\uhHYidZ.exe
  C:\Windows\System\uhHYidZ.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\fWMqpjw.exe
  C:\Windows\System\fWMqpjw.exe
  2⤵
  PID:920
- C:\Windows\System\BwghSpe.exe
  C:\Windows\System\BwghSpe.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\rVtamZk.exe
  C:\Windows\System\rVtamZk.exe
  2⤵
  PID:668
- C:\Windows\System\LYgYdEU.exe
  C:\Windows\System\LYgYdEU.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\ZFSXcTL.exe
  C:\Windows\System\ZFSXcTL.exe
  2⤵
  PID:448
- C:\Windows\System\xCHBwKT.exe
  C:\Windows\System\xCHBwKT.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\vARAkrw.exe
  C:\Windows\System\vARAkrw.exe
  2⤵
  PID:2088
- C:\Windows\System\qKFWVWM.exe
  C:\Windows\System\qKFWVWM.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\FllmLay.exe
  C:\Windows\System\FllmLay.exe
  2⤵
  PID:2016
- C:\Windows\System\WeCdJDs.exe
  C:\Windows\System\WeCdJDs.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\JRFjpmg.exe
  C:\Windows\System\JRFjpmg.exe
  2⤵
  PID:1584
- C:\Windows\System\hSueiPT.exe
  C:\Windows\System\hSueiPT.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\sxODsKa.exe
  C:\Windows\System\sxODsKa.exe
  2⤵
  PID:276
- C:\Windows\System\UTJAppd.exe
  C:\Windows\System\UTJAppd.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\WpfJvzX.exe
  C:\Windows\System\WpfJvzX.exe
  2⤵
  PID:1708
- C:\Windows\System\hyPcTlj.exe
  C:\Windows\System\hyPcTlj.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\uaqTslU.exe
  C:\Windows\System\uaqTslU.exe
  2⤵
  PID:908
- C:\Windows\System\WfObiCn.exe
  C:\Windows\System\WfObiCn.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\jDLYsJC.exe
  C:\Windows\System\jDLYsJC.exe
  2⤵
  PID:1460
- C:\Windows\System\uvgOyCs.exe
  C:\Windows\System\uvgOyCs.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\vcXxeYN.exe
  C:\Windows\System\vcXxeYN.exe
  2⤵
  PID:2972
- C:\Windows\System\NIwqFBk.exe
  C:\Windows\System\NIwqFBk.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\YeJACMp.exe
  C:\Windows\System\YeJACMp.exe
  2⤵
  PID:2292
- C:\Windows\System\FDOKtjM.exe
  C:\Windows\System\FDOKtjM.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\etdFbPr.exe
  C:\Windows\System\etdFbPr.exe
  2⤵
  PID:2328
- C:\Windows\System\aIQIavj.exe
  C:\Windows\System\aIQIavj.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\HTUqztx.exe
  C:\Windows\System\HTUqztx.exe
  2⤵
  PID:1776
- C:\Windows\System\WFlXeFW.exe
  C:\Windows\System\WFlXeFW.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\kAPYKsO.exe
  C:\Windows\System\kAPYKsO.exe
  2⤵
  PID:1588
- C:\Windows\System\ktgMZBu.exe
  C:\Windows\System\ktgMZBu.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\jEUEDJJ.exe
  C:\Windows\System\jEUEDJJ.exe
  2⤵
  PID:1624
- C:\Windows\System\KhYTGST.exe
  C:\Windows\System\KhYTGST.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\ajtkoub.exe
  C:\Windows\System\ajtkoub.exe
  2⤵
  PID:2140
- C:\Windows\System\tROTVQi.exe
  C:\Windows\System\tROTVQi.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\GboKJjW.exe
  C:\Windows\System\GboKJjW.exe
  2⤵
  PID:2832
- C:\Windows\System\pAaznew.exe
  C:\Windows\System\pAaznew.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\nuRlcab.exe
  C:\Windows\System\nuRlcab.exe
  2⤵
  PID:2676
- C:\Windows\System\fYzVYNf.exe
  C:\Windows\System\fYzVYNf.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\xmVWJBw.exe
  C:\Windows\System\xmVWJBw.exe
  2⤵
  PID:2792
- C:\Windows\System\kNwwLMF.exe
  C:\Windows\System\kNwwLMF.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\aUVoHOl.exe
  C:\Windows\System\aUVoHOl.exe
  2⤵
  PID:2472
- C:\Windows\System\pbndCtl.exe
  C:\Windows\System\pbndCtl.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\WkVFPQo.exe
  C:\Windows\System\WkVFPQo.exe
  2⤵
  PID:2148
- C:\Windows\System\GjuKpfh.exe
  C:\Windows\System\GjuKpfh.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\sLWifMN.exe
  C:\Windows\System\sLWifMN.exe
  2⤵
  PID:2920
- C:\Windows\System\kwjrTaB.exe
  C:\Windows\System\kwjrTaB.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\bchilqm.exe
  C:\Windows\System\bchilqm.exe
  2⤵
  PID:2192
- C:\Windows\System\nKzRuOA.exe
  C:\Windows\System\nKzRuOA.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\LgupnMe.exe
  C:\Windows\System\LgupnMe.exe
  2⤵
  PID:1444
- C:\Windows\System\yGYqqeR.exe
  C:\Windows\System\yGYqqeR.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\VmHuHok.exe
  C:\Windows\System\VmHuHok.exe
  2⤵
  PID:2044
- C:\Windows\System\uNsbWdK.exe
  C:\Windows\System\uNsbWdK.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\DhlRVMg.exe
  C:\Windows\System\DhlRVMg.exe
  2⤵
  PID:2280
- C:\Windows\System\pJAWMLX.exe
  C:\Windows\System\pJAWMLX.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\vdnWCfj.exe
  C:\Windows\System\vdnWCfj.exe
  2⤵
  PID:1944
- C:\Windows\System\TLDPIiS.exe
  C:\Windows\System\TLDPIiS.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\clWHugF.exe
  C:\Windows\System\clWHugF.exe
  2⤵
  PID:2236
- C:\Windows\System\KCadwmt.exe
  C:\Windows\System\KCadwmt.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\IzaHBPv.exe
  C:\Windows\System\IzaHBPv.exe
  2⤵
  PID:2828
- C:\Windows\System\aTPztpq.exe
  C:\Windows\System\aTPztpq.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\tBPrIxI.exe
  C:\Windows\System\tBPrIxI.exe
  2⤵
  PID:1456
- C:\Windows\System\NbtdJTY.exe
  C:\Windows\System\NbtdJTY.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\CdJnBGR.exe
  C:\Windows\System\CdJnBGR.exe
  2⤵
  PID:3028
- C:\Windows\System\aiVXkkH.exe
  C:\Windows\System\aiVXkkH.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\aXNwMGo.exe
  C:\Windows\System\aXNwMGo.exe
  2⤵
  PID:2612
- C:\Windows\System\kgfmpIP.exe
  C:\Windows\System\kgfmpIP.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\JefuaDK.exe
  C:\Windows\System\JefuaDK.exe
  2⤵
  PID:3100
- C:\Windows\System\MENaMRs.exe
  C:\Windows\System\MENaMRs.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\aYTAfPa.exe
  C:\Windows\System\aYTAfPa.exe
  2⤵
  PID:3132
- C:\Windows\System\TbrJRak.exe
  C:\Windows\System\TbrJRak.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\udtrDED.exe
  C:\Windows\System\udtrDED.exe
  2⤵
  PID:3164
- C:\Windows\System\feTdQKF.exe
  C:\Windows\System\feTdQKF.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\FKdnNxV.exe
  C:\Windows\System\FKdnNxV.exe
  2⤵
  PID:3196
- C:\Windows\System\esYFucy.exe
  C:\Windows\System\esYFucy.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\KrnbWet.exe
  C:\Windows\System\KrnbWet.exe
  2⤵
  PID:3228
- C:\Windows\System\ZKAztgE.exe
  C:\Windows\System\ZKAztgE.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\QoujEBX.exe
  C:\Windows\System\QoujEBX.exe
  2⤵
  PID:3260
- C:\Windows\System\sxCuVHE.exe
  C:\Windows\System\sxCuVHE.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\biXyBle.exe
  C:\Windows\System\biXyBle.exe
  2⤵
  PID:3292
- C:\Windows\System\elWtIvA.exe
  C:\Windows\System\elWtIvA.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\oaWjNfm.exe
  C:\Windows\System\oaWjNfm.exe
  2⤵
  PID:3324
- C:\Windows\System\Whmgpib.exe
  C:\Windows\System\Whmgpib.exe
  2⤵
  PID:3340
- C:\Windows\System\TUgjNUa.exe
  C:\Windows\System\TUgjNUa.exe
  2⤵
  PID:3356
- C:\Windows\System\hxbiVQB.exe
  C:\Windows\System\hxbiVQB.exe
  2⤵
  PID:3372
- C:\Windows\System\tpJwoPX.exe
  C:\Windows\System\tpJwoPX.exe
  2⤵
  PID:3388
- C:\Windows\System\xMlwekh.exe
  C:\Windows\System\xMlwekh.exe
  2⤵
  PID:3404
- C:\Windows\System\hyTZugV.exe
  C:\Windows\System\hyTZugV.exe
  2⤵
  PID:3420
- C:\Windows\System\UjigVSJ.exe
  C:\Windows\System\UjigVSJ.exe
  2⤵
  PID:3436
- C:\Windows\System\TOJJgqk.exe
  C:\Windows\System\TOJJgqk.exe
  2⤵
  PID:3452
- C:\Windows\System\eSWzFkR.exe
  C:\Windows\System\eSWzFkR.exe
  2⤵
  PID:3468
- C:\Windows\System\CMMlzYj.exe
  C:\Windows\System\CMMlzYj.exe
  2⤵
  PID:3484
- C:\Windows\System\KNqaXdJ.exe
  C:\Windows\System\KNqaXdJ.exe
  2⤵
  PID:3500
- C:\Windows\System\VumOiDL.exe
  C:\Windows\System\VumOiDL.exe
  2⤵
  PID:3516
- C:\Windows\System\dSLXYeY.exe
  C:\Windows\System\dSLXYeY.exe
  2⤵
  PID:3532
- C:\Windows\System\fTbeOVZ.exe
  C:\Windows\System\fTbeOVZ.exe
  2⤵
  PID:3548
- C:\Windows\System\eIKgsht.exe
  C:\Windows\System\eIKgsht.exe
  2⤵
  PID:3564
- C:\Windows\System\UMDRtVp.exe
  C:\Windows\System\UMDRtVp.exe
  2⤵
  PID:3580
- C:\Windows\System\ZhKORXF.exe
  C:\Windows\System\ZhKORXF.exe
  2⤵
  PID:3596
- C:\Windows\System\LKpntAd.exe
  C:\Windows\System\LKpntAd.exe
  2⤵
  PID:3612
- C:\Windows\System\gCZOcNH.exe
  C:\Windows\System\gCZOcNH.exe
  2⤵
  PID:3628
- C:\Windows\System\XYuQfWm.exe
  C:\Windows\System\XYuQfWm.exe
  2⤵
  PID:3644
- C:\Windows\System\apgMfPH.exe
  C:\Windows\System\apgMfPH.exe
  2⤵
  PID:3660
- C:\Windows\System\jTFDofo.exe
  C:\Windows\System\jTFDofo.exe
  2⤵
  PID:3676
- C:\Windows\System\aGUrhSo.exe
  C:\Windows\System\aGUrhSo.exe
  2⤵
  PID:3692
- C:\Windows\System\MickQUj.exe
  C:\Windows\System\MickQUj.exe
  2⤵
  PID:3708
- C:\Windows\System\zynJBkw.exe
  C:\Windows\System\zynJBkw.exe
  2⤵
  PID:3724
- C:\Windows\System\szkZmVk.exe
  C:\Windows\System\szkZmVk.exe
  2⤵
  PID:3740
- C:\Windows\System\LgglhBP.exe
  C:\Windows\System\LgglhBP.exe
  2⤵
  PID:3756
- C:\Windows\System\ETAmMhB.exe
  C:\Windows\System\ETAmMhB.exe
  2⤵
  PID:3772
- C:\Windows\System\bxoerMQ.exe
  C:\Windows\System\bxoerMQ.exe
  2⤵
  PID:3788
- C:\Windows\System\yXAnvyA.exe
  C:\Windows\System\yXAnvyA.exe
  2⤵
  PID:3804
- C:\Windows\System\XMiHDsh.exe
  C:\Windows\System\XMiHDsh.exe
  2⤵
  PID:3820
- C:\Windows\System\dMPJhDx.exe
  C:\Windows\System\dMPJhDx.exe
  2⤵
  PID:3836
- C:\Windows\System\LblluHD.exe
  C:\Windows\System\LblluHD.exe
  2⤵
  PID:3852
- C:\Windows\System\QmjTATw.exe
  C:\Windows\System\QmjTATw.exe
  2⤵
  PID:3868
- C:\Windows\System\zNlXQvu.exe
  C:\Windows\System\zNlXQvu.exe
  2⤵
  PID:3884
- C:\Windows\System\YVPmDjq.exe
  C:\Windows\System\YVPmDjq.exe
  2⤵
  PID:3900
- C:\Windows\System\dmrkHUz.exe
  C:\Windows\System\dmrkHUz.exe
  2⤵
  PID:3916
- C:\Windows\System\xNyprNZ.exe
  C:\Windows\System\xNyprNZ.exe
  2⤵
  PID:3932
- C:\Windows\System\ScNUyXa.exe
  C:\Windows\System\ScNUyXa.exe
  2⤵
  PID:3948
- C:\Windows\System\WUyLeia.exe
  C:\Windows\System\WUyLeia.exe
  2⤵
  PID:3964
- C:\Windows\System\dmLYzqG.exe
  C:\Windows\System\dmLYzqG.exe
  2⤵
  PID:3980
- C:\Windows\System\ohWlksr.exe
  C:\Windows\System\ohWlksr.exe
  2⤵
  PID:3996
- C:\Windows\System\qLNkTae.exe
  C:\Windows\System\qLNkTae.exe
  2⤵
  PID:4012
- C:\Windows\System\sjjFZjs.exe
  C:\Windows\System\sjjFZjs.exe
  2⤵
  PID:4028
- C:\Windows\System\MeEGBHu.exe
  C:\Windows\System\MeEGBHu.exe
  2⤵
  PID:4044
- C:\Windows\System\IGyxLtN.exe
  C:\Windows\System\IGyxLtN.exe
  2⤵
  PID:4060
- C:\Windows\System\pomdSIu.exe
  C:\Windows\System\pomdSIu.exe
  2⤵
  PID:4076
- C:\Windows\System\hvbYiyu.exe
  C:\Windows\System\hvbYiyu.exe
  2⤵
  PID:4092
- C:\Windows\System\YEXbWkD.exe
  C:\Windows\System\YEXbWkD.exe
  2⤵
  PID:2256
- C:\Windows\System\hAYIOwe.exe
  C:\Windows\System\hAYIOwe.exe
  2⤵
  PID:3124
- C:\Windows\System\lAuhQSn.exe
  C:\Windows\System\lAuhQSn.exe
  2⤵
  PID:3128
- C:\Windows\System\kNgZqPp.exe
  C:\Windows\System\kNgZqPp.exe
  2⤵
  PID:3192
- C:\Windows\System\fNhruZL.exe
  C:\Windows\System\fNhruZL.exe
  2⤵
  PID:2160
- C:\Windows\System\xytnsrF.exe
  C:\Windows\System\xytnsrF.exe
  2⤵
  PID:3288
- C:\Windows\System\ydRqwBX.exe
  C:\Windows\System\ydRqwBX.exe
  2⤵
  PID:3348
- C:\Windows\System\aKDQNia.exe
  C:\Windows\System\aKDQNia.exe
  2⤵
  PID:3384
- C:\Windows\System\qSgyIKY.exe
  C:\Windows\System\qSgyIKY.exe
  2⤵
  PID:2536
- C:\Windows\System\hnfrjds.exe
  C:\Windows\System\hnfrjds.exe
  2⤵
  PID:3508
- C:\Windows\System\GjbcWfY.exe
  C:\Windows\System\GjbcWfY.exe
  2⤵
  PID:3572
- C:\Windows\System\yoKOHAm.exe
  C:\Windows\System\yoKOHAm.exe
  2⤵
  PID:3636
- C:\Windows\System\PZjitoI.exe
  C:\Windows\System\PZjitoI.exe
  2⤵
  PID:3700
- C:\Windows\System\pzFmyUU.exe
  C:\Windows\System\pzFmyUU.exe
  2⤵
  PID:3736
- C:\Windows\System\tmUIOVK.exe
  C:\Windows\System\tmUIOVK.exe
  2⤵
  PID:3800
- C:\Windows\System\yxUVAva.exe
  C:\Windows\System\yxUVAva.exe
  2⤵
  PID:3832
- C:\Windows\System\btoedku.exe
  C:\Windows\System\btoedku.exe
  2⤵
  PID:3896
- C:\Windows\System\GzodDmz.exe
  C:\Windows\System\GzodDmz.exe
  2⤵
  PID:3956
- C:\Windows\System\kPeiRVd.exe
  C:\Windows\System\kPeiRVd.exe
  2⤵
  PID:4020
- C:\Windows\System\gxXWKiO.exe
  C:\Windows\System\gxXWKiO.exe
  2⤵
  PID:4084
- C:\Windows\System\uSJFLUo.exe
  C:\Windows\System\uSJFLUo.exe
  2⤵
  PID:3096
- C:\Windows\System\vqLDgjp.exe
  C:\Windows\System\vqLDgjp.exe
  2⤵
  PID:3284
- C:\Windows\System\IheQcmc.exe
  C:\Windows\System\IheQcmc.exe
  2⤵
  PID:3480
- C:\Windows\System\rLXpzbM.exe
  C:\Windows\System\rLXpzbM.exe
  2⤵
  PID:3732
- C:\Windows\System\yoSPebV.exe
  C:\Windows\System\yoSPebV.exe
  2⤵
  PID:2820
- C:\Windows\System\vTKDcLe.exe
  C:\Windows\System\vTKDcLe.exe
  2⤵
  PID:2912
- C:\Windows\System\iAYpSQP.exe
  C:\Windows\System\iAYpSQP.exe
  2⤵
  PID:4104
- C:\Windows\System\JpXMVXx.exe
  C:\Windows\System\JpXMVXx.exe
  2⤵
  PID:4120
- C:\Windows\System\vUopvGL.exe
  C:\Windows\System\vUopvGL.exe
  2⤵
  PID:4136
- C:\Windows\System\itSgPKs.exe
  C:\Windows\System\itSgPKs.exe
  2⤵
  PID:4152
- C:\Windows\System\MljjfAk.exe
  C:\Windows\System\MljjfAk.exe
  2⤵
  PID:4168
- C:\Windows\System\MQuDEeZ.exe
  C:\Windows\System\MQuDEeZ.exe
  2⤵
  PID:4184
- C:\Windows\System\YBXCDkO.exe
  C:\Windows\System\YBXCDkO.exe
  2⤵
  PID:4200
- C:\Windows\System\CHajddl.exe
  C:\Windows\System\CHajddl.exe
  2⤵
  PID:4216
- C:\Windows\System\LPAtfpC.exe
  C:\Windows\System\LPAtfpC.exe
  2⤵
  PID:4240
- C:\Windows\System\BYCSbab.exe
  C:\Windows\System\BYCSbab.exe
  2⤵
  PID:4260
- C:\Windows\System\HUNqiQQ.exe
  C:\Windows\System\HUNqiQQ.exe
  2⤵
  PID:4276
- C:\Windows\System\qAKVCXA.exe
  C:\Windows\System\qAKVCXA.exe
  2⤵
  PID:4292
- C:\Windows\System\SWHMbXV.exe
  C:\Windows\System\SWHMbXV.exe
  2⤵
  PID:4308
- C:\Windows\System\ihUWzsY.exe
  C:\Windows\System\ihUWzsY.exe
  2⤵
  PID:4324
- C:\Windows\System\aGxObJJ.exe
  C:\Windows\System\aGxObJJ.exe
  2⤵
  PID:4340
- C:\Windows\System\kceoRdx.exe
  C:\Windows\System\kceoRdx.exe
  2⤵
  PID:4360
- C:\Windows\System\LogwIEB.exe
  C:\Windows\System\LogwIEB.exe
  2⤵
  PID:4376
- C:\Windows\System\rTVUZWy.exe
  C:\Windows\System\rTVUZWy.exe
  2⤵
  PID:4392
- C:\Windows\System\cUoIwll.exe
  C:\Windows\System\cUoIwll.exe
  2⤵
  PID:4416
- C:\Windows\System\ahAgbYS.exe
  C:\Windows\System\ahAgbYS.exe
  2⤵
  PID:4432
- C:\Windows\System\JUsoFaQ.exe
  C:\Windows\System\JUsoFaQ.exe
  2⤵
  PID:4460
- C:\Windows\System\jrJkCXb.exe
  C:\Windows\System\jrJkCXb.exe
  2⤵
  PID:4476
- C:\Windows\System\nULRrug.exe
  C:\Windows\System\nULRrug.exe
  2⤵
  PID:4492
- C:\Windows\System\RzSKhBy.exe
  C:\Windows\System\RzSKhBy.exe
  2⤵
  PID:4508
- C:\Windows\System\EkTnAaR.exe
  C:\Windows\System\EkTnAaR.exe
  2⤵
  PID:4524
- C:\Windows\System\GUEhdpy.exe
  C:\Windows\System\GUEhdpy.exe
  2⤵
  PID:4540
- C:\Windows\System\sMJsWFB.exe
  C:\Windows\System\sMJsWFB.exe
  2⤵
  PID:4556
- C:\Windows\System\jpndyUO.exe
  C:\Windows\System\jpndyUO.exe
  2⤵
  PID:4572
- C:\Windows\System\YKKAgBT.exe
  C:\Windows\System\YKKAgBT.exe
  2⤵
  PID:4588
- C:\Windows\System\RDKgXSu.exe
  C:\Windows\System\RDKgXSu.exe
  2⤵
  PID:4604
- C:\Windows\System\vVtcDnK.exe
  C:\Windows\System\vVtcDnK.exe
  2⤵
  PID:4620
- C:\Windows\System\StavDJN.exe
  C:\Windows\System\StavDJN.exe
  2⤵
  PID:4636
- C:\Windows\System\WCwBHNC.exe
  C:\Windows\System\WCwBHNC.exe
  2⤵
  PID:4652
- C:\Windows\System\ojCCurd.exe
  C:\Windows\System\ojCCurd.exe
  2⤵
  PID:4668
- C:\Windows\System\urttAni.exe
  C:\Windows\System\urttAni.exe
  2⤵
  PID:4688
- C:\Windows\System\mqAPHZX.exe
  C:\Windows\System\mqAPHZX.exe
  2⤵
  PID:4704
- C:\Windows\System\iwLChel.exe
  C:\Windows\System\iwLChel.exe
  2⤵
  PID:4720
- C:\Windows\System\MjqjOIQ.exe
  C:\Windows\System\MjqjOIQ.exe
  2⤵
  PID:4736
- C:\Windows\System\HINNluG.exe
  C:\Windows\System\HINNluG.exe
  2⤵
  PID:4752
- C:\Windows\System\rIMpyNL.exe
  C:\Windows\System\rIMpyNL.exe
  2⤵
  PID:4768
- C:\Windows\System\eToNiSd.exe
  C:\Windows\System\eToNiSd.exe
  2⤵
  PID:4784
- C:\Windows\System\NcDzBem.exe
  C:\Windows\System\NcDzBem.exe
  2⤵
  PID:4996
- C:\Windows\System\agbUPMf.exe
  C:\Windows\System\agbUPMf.exe
  2⤵
  PID:5328
- C:\Windows\System\wOrrzUO.exe
  C:\Windows\System\wOrrzUO.exe
  2⤵
  PID:5352
- C:\Windows\System\ShGDEIy.exe
  C:\Windows\System\ShGDEIy.exe
  2⤵
  PID:5368
- C:\Windows\System\uXVmbkD.exe
  C:\Windows\System\uXVmbkD.exe
  2⤵
  PID:5384
- C:\Windows\System\GXEvROF.exe
  C:\Windows\System\GXEvROF.exe
  2⤵
  PID:5400
- C:\Windows\System\OIfxQrA.exe
  C:\Windows\System\OIfxQrA.exe
  2⤵
  PID:5416
- C:\Windows\System\rrzyifT.exe
  C:\Windows\System\rrzyifT.exe
  2⤵
  PID:5432
- C:\Windows\System\yZhLDzV.exe
  C:\Windows\System\yZhLDzV.exe
  2⤵
  PID:5448
- C:\Windows\System\jujAGZB.exe
  C:\Windows\System\jujAGZB.exe
  2⤵
  PID:5464
- C:\Windows\System\mjnktky.exe
  C:\Windows\System\mjnktky.exe
  2⤵
  PID:5480
- C:\Windows\System\rdlvnzm.exe
  C:\Windows\System\rdlvnzm.exe
  2⤵
  PID:5496
- C:\Windows\System\AcSjmQK.exe
  C:\Windows\System\AcSjmQK.exe
  2⤵
  PID:5512
- C:\Windows\System\wirEnbp.exe
  C:\Windows\System\wirEnbp.exe
  2⤵
  PID:5528
- C:\Windows\System\abXyQPt.exe
  C:\Windows\System\abXyQPt.exe
  2⤵
  PID:5544
- C:\Windows\System\zofOQWI.exe
  C:\Windows\System\zofOQWI.exe
  2⤵
  PID:5560
- C:\Windows\System\WCLuZtu.exe
  C:\Windows\System\WCLuZtu.exe
  2⤵
  PID:5576
- C:\Windows\System\yhBlFqw.exe
  C:\Windows\System\yhBlFqw.exe
  2⤵
  PID:5592
- C:\Windows\System\ZBcxlvw.exe
  C:\Windows\System\ZBcxlvw.exe
  2⤵
  PID:5608
- C:\Windows\System\iAYvYlP.exe
  C:\Windows\System\iAYvYlP.exe
  2⤵
  PID:5624
- C:\Windows\System\jLiqoqz.exe
  C:\Windows\System\jLiqoqz.exe
  2⤵
  PID:5640
- C:\Windows\System\fpfcFPZ.exe
  C:\Windows\System\fpfcFPZ.exe
  2⤵
  PID:5656
- C:\Windows\System\Gkkcdae.exe
  C:\Windows\System\Gkkcdae.exe
  2⤵
  PID:5676
- C:\Windows\System\GbIhTvU.exe
  C:\Windows\System\GbIhTvU.exe
  2⤵
  PID:5696
- C:\Windows\System\GeEIBZN.exe
  C:\Windows\System\GeEIBZN.exe
  2⤵
  PID:5712
- C:\Windows\System\soxpzGb.exe
  C:\Windows\System\soxpzGb.exe
  2⤵
  PID:5728
- C:\Windows\System\OMHGjaW.exe
  C:\Windows\System\OMHGjaW.exe
  2⤵
  PID:5744
- C:\Windows\System\gMDRxXJ.exe
  C:\Windows\System\gMDRxXJ.exe
  2⤵
  PID:5760
- C:\Windows\System\ncNJpNI.exe
  C:\Windows\System\ncNJpNI.exe
  2⤵
  PID:5776
- C:\Windows\System\wgdmTLG.exe
  C:\Windows\System\wgdmTLG.exe
  2⤵
  PID:5792
- C:\Windows\System\PSeRpGf.exe
  C:\Windows\System\PSeRpGf.exe
  2⤵
  PID:5808
- C:\Windows\System\OURYxkw.exe
  C:\Windows\System\OURYxkw.exe
  2⤵
  PID:5824
- C:\Windows\System\ZtdmSxE.exe
  C:\Windows\System\ZtdmSxE.exe
  2⤵
  PID:5840
- C:\Windows\System\HNwCRJL.exe
  C:\Windows\System\HNwCRJL.exe
  2⤵
  PID:5856
- C:\Windows\System\BlcEGFP.exe
  C:\Windows\System\BlcEGFP.exe
  2⤵
  PID:5872
- C:\Windows\System\IiJPEIv.exe
  C:\Windows\System\IiJPEIv.exe
  2⤵
  PID:5888
- C:\Windows\System\tvJAdBY.exe
  C:\Windows\System\tvJAdBY.exe
  2⤵
  PID:5904
- C:\Windows\System\EVYMnAu.exe
  C:\Windows\System\EVYMnAu.exe
  2⤵
  PID:5924
- C:\Windows\System\rCziwaE.exe
  C:\Windows\System\rCziwaE.exe
  2⤵
  PID:5988
- C:\Windows\System\gwpMcNO.exe
  C:\Windows\System\gwpMcNO.exe
  2⤵
  PID:6004
- C:\Windows\System\IiFknTv.exe
  C:\Windows\System\IiFknTv.exe
  2⤵
  PID:6020
- C:\Windows\System\rEcMIem.exe
  C:\Windows\System\rEcMIem.exe
  2⤵
  PID:6036
- C:\Windows\System\CAaKdAv.exe
  C:\Windows\System\CAaKdAv.exe
  2⤵
  PID:6052
- C:\Windows\System\qlRwSEI.exe
  C:\Windows\System\qlRwSEI.exe
  2⤵
  PID:6068
- C:\Windows\System\JekdARQ.exe
  C:\Windows\System\JekdARQ.exe
  2⤵
  PID:6084
- C:\Windows\System\wILJuOJ.exe
  C:\Windows\System\wILJuOJ.exe
  2⤵
  PID:6100
- C:\Windows\System\ZuVoeWk.exe
  C:\Windows\System\ZuVoeWk.exe
  2⤵
  PID:6116
- C:\Windows\System\BbKceiE.exe
  C:\Windows\System\BbKceiE.exe
  2⤵
  PID:6132
- C:\Windows\System\XjAyoEL.exe
  C:\Windows\System\XjAyoEL.exe
  2⤵
  PID:1112
- C:\Windows\System\NAmruKP.exe
  C:\Windows\System\NAmruKP.exe
  2⤵
  PID:1436
- C:\Windows\System\tUQikpb.exe
  C:\Windows\System\tUQikpb.exe
  2⤵
  PID:808
- C:\Windows\System\DmSuqhd.exe
  C:\Windows\System\DmSuqhd.exe
  2⤵
  PID:384
- C:\Windows\System\nxnxnDw.exe
  C:\Windows\System\nxnxnDw.exe
  2⤵
  PID:2116
- C:\Windows\System\KAQBBym.exe
  C:\Windows\System\KAQBBym.exe
  2⤵
  PID:1728
- C:\Windows\System\KKOzGFr.exe
  C:\Windows\System\KKOzGFr.exe
  2⤵
  PID:1136
- C:\Windows\System\KpAkRCF.exe
  C:\Windows\System\KpAkRCF.exe
  2⤵
  PID:5376
- C:\Windows\System\PlYlgUH.exe
  C:\Windows\System\PlYlgUH.exe
  2⤵
  PID:5440
- C:\Windows\System\qOFjETz.exe
  C:\Windows\System\qOFjETz.exe
  2⤵
  PID:5504
- C:\Windows\System\jykiSbh.exe
  C:\Windows\System\jykiSbh.exe
  2⤵
  PID:5568
- C:\Windows\System\FVflnZS.exe
  C:\Windows\System\FVflnZS.exe
  2⤵
  PID:5632
- C:\Windows\System\PLrwgwV.exe
  C:\Windows\System\PLrwgwV.exe
  2⤵
  PID:5704
- C:\Windows\System\bXIIWmU.exe
  C:\Windows\System\bXIIWmU.exe
  2⤵
  PID:5768
- C:\Windows\System\HBLVLNx.exe
  C:\Windows\System\HBLVLNx.exe
  2⤵
  PID:5832
- C:\Windows\System\PuYFHLy.exe
  C:\Windows\System\PuYFHLy.exe
  2⤵
  PID:5896
- C:\Windows\System\AsmVFFc.exe
  C:\Windows\System\AsmVFFc.exe
  2⤵
  PID:4552
- C:\Windows\System\uZkAgKA.exe
  C:\Windows\System\uZkAgKA.exe
  2⤵
  PID:4644
- C:\Windows\System\DLyUkSe.exe
  C:\Windows\System\DLyUkSe.exe
  2⤵
  PID:4680
- C:\Windows\System\lWelIbS.exe
  C:\Windows\System\lWelIbS.exe
  2⤵
  PID:2584
- C:\Windows\System\rKNUAMC.exe
  C:\Windows\System\rKNUAMC.exe
  2⤵
  PID:4304
- C:\Windows\System\XAmFIXt.exe
  C:\Windows\System\XAmFIXt.exe
  2⤵
  PID:4228
- C:\Windows\System\GTSGVdN.exe
  C:\Windows\System\GTSGVdN.exe
  2⤵
  PID:4164
- C:\Windows\System\wnVgTZu.exe
  C:\Windows\System\wnVgTZu.exe
  2⤵
  PID:4100
- C:\Windows\System\AtjbSZl.exe
  C:\Windows\System\AtjbSZl.exe
  2⤵
  PID:4780
- C:\Windows\System\xVWWeCc.exe
  C:\Windows\System\xVWWeCc.exe
  2⤵
  PID:1632
- C:\Windows\System\wzfCmrG.exe
  C:\Windows\System\wzfCmrG.exe
  2⤵
  PID:888
- C:\Windows\System\aoekZVe.exe
  C:\Windows\System\aoekZVe.exe
  2⤵
  PID:1884
- C:\Windows\System\efGmZnR.exe
  C:\Windows\System\efGmZnR.exe
  2⤵
  PID:4484
- C:\Windows\System\AKLawkb.exe
  C:\Windows\System\AKLawkb.exe
  2⤵
  PID:4400
- C:\Windows\System\dNxpldE.exe
  C:\Windows\System\dNxpldE.exe
  2⤵
  PID:2568
- C:\Windows\System\GdpTNem.exe
  C:\Windows\System\GdpTNem.exe
  2⤵
  PID:3092
- C:\Windows\System\RQiFbjE.exe
  C:\Windows\System\RQiFbjE.exe
  2⤵
  PID:3796
- C:\Windows\System\cNETqhd.exe
  C:\Windows\System\cNETqhd.exe
  2⤵
  PID:3668
- C:\Windows\System\zsjEHtW.exe
  C:\Windows\System\zsjEHtW.exe
  2⤵
  PID:3416
- C:\Windows\System\XViIcPs.exe
  C:\Windows\System\XViIcPs.exe
  2⤵
  PID:3220
- C:\Windows\System\gDGwvCe.exe
  C:\Windows\System\gDGwvCe.exe
  2⤵
  PID:1644
- C:\Windows\System\zmdRfdY.exe
  C:\Windows\System\zmdRfdY.exe
  2⤵
  PID:4008
- C:\Windows\System\XSgQOsP.exe
  C:\Windows\System\XSgQOsP.exe
  2⤵
  PID:3972
- C:\Windows\System\yudtWBI.exe
  C:\Windows\System\yudtWBI.exe
  2⤵
  PID:3880
- C:\Windows\System\ihrKNna.exe
  C:\Windows\System\ihrKNna.exe
  2⤵
  PID:3844
- C:\Windows\System\beFYmeZ.exe
  C:\Windows\System\beFYmeZ.exe
  2⤵
  PID:3780
- C:\Windows\System\OxdOEyf.exe
  C:\Windows\System\OxdOEyf.exe
  2⤵
  PID:3716
- C:\Windows\System\ycmKYJi.exe
  C:\Windows\System\ycmKYJi.exe
  2⤵
  PID:3624
- C:\Windows\System\ukGkUZD.exe
  C:\Windows\System\ukGkUZD.exe
  2⤵
  PID:3588
- C:\Windows\System\cbgfBLe.exe
  C:\Windows\System\cbgfBLe.exe
  2⤵
  PID:3528
- C:\Windows\System\uSNmSiV.exe
  C:\Windows\System\uSNmSiV.exe
  2⤵
  PID:3460
- C:\Windows\System\JlnhEAl.exe
  C:\Windows\System\JlnhEAl.exe
  2⤵
  PID:3396
- C:\Windows\System\vArYNcb.exe
  C:\Windows\System\vArYNcb.exe
  2⤵
  PID:3332
- C:\Windows\System\ofDhMNC.exe
  C:\Windows\System\ofDhMNC.exe
  2⤵
  PID:3268
- C:\Windows\System\khwDAUM.exe
  C:\Windows\System\khwDAUM.exe
  2⤵
  PID:3204
- C:\Windows\System\QlTROVm.exe
  C:\Windows\System\QlTROVm.exe
  2⤵
  PID:3140
- C:\Windows\System\DhECkTX.exe
  C:\Windows\System\DhECkTX.exe
  2⤵
  PID:3076
- C:\Windows\System\bMseBQx.exe
  C:\Windows\System\bMseBQx.exe
  2⤵
  PID:1020
- C:\Windows\System\MdciXun.exe
  C:\Windows\System\MdciXun.exe
  2⤵
  PID:2660
- C:\Windows\System\NfjlvgO.exe
  C:\Windows\System\NfjlvgO.exe
  2⤵
  PID:1976
- C:\Windows\System\UOBLVna.exe
  C:\Windows\System\UOBLVna.exe
  2⤵
  PID:1472
- C:\Windows\System\JuSKped.exe
  C:\Windows\System\JuSKped.exe
  2⤵
  PID:2904
- C:\Windows\System\mxUQttD.exe
  C:\Windows\System\mxUQttD.exe
  2⤵
  PID:2888
- C:\Windows\System\gclespg.exe
  C:\Windows\System\gclespg.exe
  2⤵
  PID:2540
- C:\Windows\System\HUMGpRk.exe
  C:\Windows\System\HUMGpRk.exe
  2⤵
  PID:2720
- C:\Windows\System\pAnqorA.exe
  C:\Windows\System\pAnqorA.exe
  2⤵
  PID:5488
- C:\Windows\System\ybSxAjE.exe
  C:\Windows\System\ybSxAjE.exe
  2⤵
  PID:5552
- C:\Windows\System\KGmxWtO.exe
  C:\Windows\System\KGmxWtO.exe
  2⤵
  PID:5588
- C:\Windows\System\JhnHmGR.exe
  C:\Windows\System\JhnHmGR.exe
  2⤵
  PID:5684
- C:\Windows\System\oJahZCT.exe
  C:\Windows\System\oJahZCT.exe
  2⤵
  PID:5724
- C:\Windows\System\nHbTvMe.exe
  C:\Windows\System\nHbTvMe.exe
  2⤵
  PID:5788
- C:\Windows\System\JkBHYKc.exe
  C:\Windows\System\JkBHYKc.exe
  2⤵
  PID:5852
- C:\Windows\System\uuSzpHa.exe
  C:\Windows\System\uuSzpHa.exe
  2⤵
  PID:5912
- C:\Windows\System\gLAOmPE.exe
  C:\Windows\System\gLAOmPE.exe
  2⤵
  PID:5980
- C:\Windows\System\MVoqFFH.exe
  C:\Windows\System\MVoqFFH.exe
  2⤵
  PID:5392
- C:\Windows\System\qTVSxcn.exe
  C:\Windows\System\qTVSxcn.exe
  2⤵
  PID:6016
- C:\Windows\System\rZZrGgK.exe
  C:\Windows\System\rZZrGgK.exe
  2⤵
  PID:6080
- C:\Windows\System\IuMPvzV.exe
  C:\Windows\System\IuMPvzV.exe
  2⤵
  PID:6060
- C:\Windows\System\RCQiCrO.exe
  C:\Windows\System\RCQiCrO.exe
  2⤵
  PID:6112
- C:\Windows\System\mFaXWHR.exe
  C:\Windows\System\mFaXWHR.exe
  2⤵
  PID:1428
- C:\Windows\System\jKEBUtx.exe
  C:\Windows\System\jKEBUtx.exe
  2⤵
  PID:2704
- C:\Windows\System\LKzrhjB.exe
  C:\Windows\System\LKzrhjB.exe
  2⤵
  PID:2528
- C:\Windows\System\tkmwfBk.exe
  C:\Windows\System\tkmwfBk.exe
  2⤵
  PID:1144
- C:\Windows\System\YJcJFCX.exe
  C:\Windows\System\YJcJFCX.exe
  2⤵
  PID:4452
- C:\Windows\System\eOUtMoP.exe
  C:\Windows\System\eOUtMoP.exe
  2⤵
  PID:2448
- C:\Windows\System\NEkuSsu.exe
  C:\Windows\System\NEkuSsu.exe
  2⤵
  PID:5536
- C:\Windows\System\mnWFDjG.exe
  C:\Windows\System\mnWFDjG.exe
  2⤵
  PID:2344
- C:\Windows\System\CxdPANs.exe
  C:\Windows\System\CxdPANs.exe
  2⤵
  PID:2316
- C:\Windows\System\bmCHWKd.exe
  C:\Windows\System\bmCHWKd.exe
  2⤵
  PID:5600
- C:\Windows\System\bxozdyZ.exe
  C:\Windows\System\bxozdyZ.exe
  2⤵
  PID:5868
- C:\Windows\System\oEohWjv.exe
  C:\Windows\System\oEohWjv.exe
  2⤵
  PID:4712
- C:\Windows\System\dGHPnFj.exe
  C:\Windows\System\dGHPnFj.exe
  2⤵
  PID:4676
- C:\Windows\System\AFMWqLv.exe
  C:\Windows\System\AFMWqLv.exe
  2⤵
  PID:4336
- C:\Windows\System\OqYWzvz.exe
  C:\Windows\System\OqYWzvz.exe
  2⤵
  PID:1108
- C:\Windows\System\CeAdVvh.exe
  C:\Windows\System\CeAdVvh.exe
  2⤵
  PID:3924
- C:\Windows\System\gWSnvqv.exe
  C:\Windows\System\gWSnvqv.exe
  2⤵
  PID:3544
- C:\Windows\System\BRbNrfH.exe
  C:\Windows\System\BRbNrfH.exe
  2⤵
  PID:4004
- C:\Windows\System\xygNfXQ.exe
  C:\Windows\System\xygNfXQ.exe
  2⤵
  PID:3768
- C:\Windows\System\NwmPDKN.exe
  C:\Windows\System\NwmPDKN.exe
  2⤵
  PID:3224
- C:\Windows\System\VOgtMnz.exe
  C:\Windows\System\VOgtMnz.exe
  2⤵
  PID:2240
- C:\Windows\System\bJVbCUu.exe
  C:\Windows\System\bJVbCUu.exe
  2⤵
  PID:2840
- C:\Windows\System\MDRQDHs.exe
  C:\Windows\System\MDRQDHs.exe
  2⤵
  PID:3908
- C:\Windows\System\aryIolP.exe
  C:\Windows\System\aryIolP.exe
  2⤵
  PID:3748
- C:\Windows\System\VjfRwBe.exe
  C:\Windows\System\VjfRwBe.exe
  2⤵
  PID:3492
- C:\Windows\System\pOTqgAX.exe
  C:\Windows\System\pOTqgAX.exe
  2⤵
  PID:3784
- C:\Windows\System\UjciPwq.exe
  C:\Windows\System\UjciPwq.exe
  2⤵
  PID:3400
- C:\Windows\System\WKkqYVK.exe
  C:\Windows\System\WKkqYVK.exe
  2⤵
  PID:3172
- C:\Windows\System\CQqPnAw.exe
  C:\Windows\System\CQqPnAw.exe
  2⤵
  PID:3336
- C:\Windows\System\khevMpL.exe
  C:\Windows\System\khevMpL.exe
  2⤵
  PID:3080
- C:\Windows\System\wVoCypE.exe
  C:\Windows\System\wVoCypE.exe
  2⤵
  PID:112
- C:\Windows\System\undWopw.exe
  C:\Windows\System\undWopw.exe
  2⤵
  PID:5492
- C:\Windows\System\eKdhXPl.exe
  C:\Windows\System\eKdhXPl.exe
  2⤵
  PID:5620
- C:\Windows\System\BvQnJPh.exe
  C:\Windows\System\BvQnJPh.exe
  2⤵
  PID:5364
- C:\Windows\System\YWhMVtI.exe
  C:\Windows\System\YWhMVtI.exe
  2⤵
  PID:6048
- C:\Windows\System\jEvueCl.exe
  C:\Windows\System\jEvueCl.exe
  2⤵
  PID:1500
- C:\Windows\System\YyTWmFd.exe
  C:\Windows\System\YyTWmFd.exe
  2⤵
  PID:6128
- C:\Windows\System\wJlKNKS.exe
  C:\Windows\System\wJlKNKS.exe
  2⤵
  PID:5668
- C:\Windows\System\QGgDcxb.exe
  C:\Windows\System\QGgDcxb.exe
  2⤵
  PID:5804
- C:\Windows\System\EgcvsRN.exe
  C:\Windows\System\EgcvsRN.exe
  2⤵
  PID:5408
- C:\Windows\System\OBLeJlK.exe
  C:\Windows\System\OBLeJlK.exe
  2⤵
  PID:5412
- C:\Windows\System\GOLKuQF.exe
  C:\Windows\System\GOLKuQF.exe
  2⤵
  PID:6028
- C:\Windows\System\tKuVJaU.exe
  C:\Windows\System\tKuVJaU.exe
  2⤵
  PID:5604
- C:\Windows\System\OfHpWZM.exe
  C:\Windows\System\OfHpWZM.exe
  2⤵
  PID:2768
- C:\Windows\System\WruizEB.exe
  C:\Windows\System\WruizEB.exe
  2⤵
  PID:5456
- C:\Windows\System\BzDVvDK.exe
  C:\Windows\System\BzDVvDK.exe
  2⤵
  PID:5476
- C:\Windows\System\tiIfWLZ.exe
  C:\Windows\System\tiIfWLZ.exe
  2⤵
  PID:5932
- C:\Windows\System\CXvcXkG.exe
  C:\Windows\System\CXvcXkG.exe
  2⤵
  PID:2752
- C:\Windows\System\JsYnyOm.exe
  C:\Windows\System\JsYnyOm.exe
  2⤵
  PID:2168
- C:\Windows\System\GqlnvCo.exe
  C:\Windows\System\GqlnvCo.exe
  2⤵
  PID:5584
- C:\Windows\System\OEtYInu.exe
  C:\Windows\System\OEtYInu.exe
  2⤵
  PID:5848
- C:\Windows\System\itPIFwB.exe
  C:\Windows\System\itPIFwB.exe
  2⤵
  PID:3556
- C:\Windows\System\AQwjQIz.exe
  C:\Windows\System\AQwjQIz.exe
  2⤵
  PID:3236
- C:\Windows\System\CMJeNLk.exe
  C:\Windows\System\CMJeNLk.exe
  2⤵
  PID:5884
- C:\Windows\System\xQqJxCE.exe
  C:\Windows\System\xQqJxCE.exe
  2⤵
  PID:5396
- C:\Windows\System\qtHVlwZ.exe
  C:\Windows\System\qtHVlwZ.exe
  2⤵
  PID:4776
- C:\Windows\System\ATTyGCo.exe
  C:\Windows\System\ATTyGCo.exe
  2⤵
  PID:1732
- C:\Windows\System\AICJefE.exe
  C:\Windows\System\AICJefE.exe
  2⤵
  PID:5424
- C:\Windows\System\ThecZpa.exe
  C:\Windows\System\ThecZpa.exe
  2⤵
  PID:3364
- C:\Windows\System\YGFflZM.exe
  C:\Windows\System\YGFflZM.exe
  2⤵
  PID:3592
- C:\Windows\System\qJISrcE.exe
  C:\Windows\System\qJISrcE.exe
  2⤵
  PID:4456
- C:\Windows\System\iKiQUAa.exe
  C:\Windows\System\iKiQUAa.exe
  2⤵
  PID:6124
- C:\Windows\System\AMLGLuw.exe
  C:\Windows\System\AMLGLuw.exe
  2⤵
  PID:600
- C:\Windows\System\zpOehct.exe
  C:\Windows\System\zpOehct.exe
  2⤵
  PID:2040
- C:\Windows\System\NKUjlFQ.exe
  C:\Windows\System\NKUjlFQ.exe
  2⤵
  PID:3040
- C:\Windows\System\yFTHuMF.exe
  C:\Windows\System\yFTHuMF.exe
  2⤵
  PID:3316
- C:\Windows\System\fkkSuOl.exe
  C:\Windows\System\fkkSuOl.exe
  2⤵
  PID:5820
- C:\Windows\System\xpDdYtA.exe
  C:\Windows\System\xpDdYtA.exe
  2⤵
  PID:896
- C:\Windows\System\ezmKOaT.exe
  C:\Windows\System\ezmKOaT.exe
  2⤵
  PID:2692
- C:\Windows\System\dupXYTA.exe
  C:\Windows\System\dupXYTA.exe
  2⤵
  PID:4516
- C:\Windows\System\BpjDXiJ.exe
  C:\Windows\System\BpjDXiJ.exe
  2⤵
  PID:3524
- C:\Windows\System\RKHvAks.exe
  C:\Windows\System\RKHvAks.exe
  2⤵
  PID:6096
- C:\Windows\System\OmfzUnH.exe
  C:\Windows\System\OmfzUnH.exe
  2⤵
  PID:5664
- C:\Windows\System\QRAbLFj.exe
  C:\Windows\System\QRAbLFj.exe
  2⤵
  PID:3988
- C:\Windows\System\oNkmxLj.exe
  C:\Windows\System\oNkmxLj.exe
  2⤵
  PID:3380
- C:\Windows\System\naRTXpO.exe
  C:\Windows\System\naRTXpO.exe
  2⤵
  PID:2644
- C:\Windows\System\epDqZKE.exe
  C:\Windows\System\epDqZKE.exe
  2⤵
  PID:5316
- C:\Windows\System\OssveNN.exe
  C:\Windows\System\OssveNN.exe
  2⤵
  PID:2428
- C:\Windows\System\hdaQUbj.exe
  C:\Windows\System\hdaQUbj.exe
  2⤵
  PID:4488
- C:\Windows\System\IaiUXsE.exe
  C:\Windows\System\IaiUXsE.exe
  2⤵
  PID:3848
- C:\Windows\System\TRchtOm.exe
  C:\Windows\System\TRchtOm.exe
  2⤵
  PID:2808
- C:\Windows\System\vvUpfhE.exe
  C:\Windows\System\vvUpfhE.exe
  2⤵
  PID:6140
- C:\Windows\System\ClitDHU.exe
  C:\Windows\System\ClitDHU.exe
  2⤵
  PID:2916
- C:\Windows\System\QNykIzO.exe
  C:\Windows\System\QNykIzO.exe
  2⤵
  PID:2268
- C:\Windows\System\RqQwaKU.exe
  C:\Windows\System\RqQwaKU.exe
  2⤵
  PID:4584
- C:\Windows\System\jTjnMCd.exe
  C:\Windows\System\jTjnMCd.exe
  2⤵
  PID:2416
- C:\Windows\System\KneAFpH.exe
  C:\Windows\System\KneAFpH.exe
  2⤵
  PID:6156
- C:\Windows\System\gqecfCA.exe
  C:\Windows\System\gqecfCA.exe
  2⤵
  PID:6172
- C:\Windows\System\GMPLkrJ.exe
  C:\Windows\System\GMPLkrJ.exe
  2⤵
  PID:6188
- C:\Windows\System\pKBtHws.exe
  C:\Windows\System\pKBtHws.exe
  2⤵
  PID:6204
- C:\Windows\System\FfsscpL.exe
  C:\Windows\System\FfsscpL.exe
  2⤵
  PID:6220
- C:\Windows\System\LsbGZTV.exe
  C:\Windows\System\LsbGZTV.exe
  2⤵
  PID:6236
- C:\Windows\System\eSRQGMu.exe
  C:\Windows\System\eSRQGMu.exe
  2⤵
  PID:6252
- C:\Windows\System\TrAHkrm.exe
  C:\Windows\System\TrAHkrm.exe
  2⤵
  PID:6268
- C:\Windows\System\AKGaaYX.exe
  C:\Windows\System\AKGaaYX.exe
  2⤵
  PID:6284
- C:\Windows\System\aohiqNf.exe
  C:\Windows\System\aohiqNf.exe
  2⤵
  PID:6300
- C:\Windows\System\UyuLOxB.exe
  C:\Windows\System\UyuLOxB.exe
  2⤵
  PID:6316
- C:\Windows\System\lyLDYGd.exe
  C:\Windows\System\lyLDYGd.exe
  2⤵
  PID:6332
- C:\Windows\System\AMmeLpW.exe
  C:\Windows\System\AMmeLpW.exe
  2⤵
  PID:6348
- C:\Windows\System\HrgUrCm.exe
  C:\Windows\System\HrgUrCm.exe
  2⤵
  PID:6364
- C:\Windows\System\cGzjGkw.exe
  C:\Windows\System\cGzjGkw.exe
  2⤵
  PID:6380
- C:\Windows\System\qDJdNdn.exe
  C:\Windows\System\qDJdNdn.exe
  2⤵
  PID:6396
- C:\Windows\System\ynhzwho.exe
  C:\Windows\System\ynhzwho.exe
  2⤵
  PID:6412
- C:\Windows\System\TQCDLch.exe
  C:\Windows\System\TQCDLch.exe
  2⤵
  PID:6428
- C:\Windows\System\OmfyLRf.exe
  C:\Windows\System\OmfyLRf.exe
  2⤵
  PID:6444
- C:\Windows\System\JjcmmGH.exe
  C:\Windows\System\JjcmmGH.exe
  2⤵
  PID:6460
- C:\Windows\System\sMAwAlC.exe
  C:\Windows\System\sMAwAlC.exe
  2⤵
  PID:6476
- C:\Windows\System\rxyiqpt.exe
  C:\Windows\System\rxyiqpt.exe
  2⤵
  PID:6492
- C:\Windows\System\AdyEmjo.exe
  C:\Windows\System\AdyEmjo.exe
  2⤵
  PID:6508
- C:\Windows\System\IvxaNuU.exe
  C:\Windows\System\IvxaNuU.exe
  2⤵
  PID:6524
- C:\Windows\System\yvtTmmG.exe
  C:\Windows\System\yvtTmmG.exe
  2⤵
  PID:6540
- C:\Windows\System\WkkXsUA.exe
  C:\Windows\System\WkkXsUA.exe
  2⤵
  PID:6556
- C:\Windows\System\oeKScaJ.exe
  C:\Windows\System\oeKScaJ.exe
  2⤵
  PID:6572
- C:\Windows\System\ggYBcpa.exe
  C:\Windows\System\ggYBcpa.exe
  2⤵
  PID:6588
- C:\Windows\System\nLMaZMw.exe
  C:\Windows\System\nLMaZMw.exe
  2⤵
  PID:6604
- C:\Windows\System\YpXuDRz.exe
  C:\Windows\System\YpXuDRz.exe
  2⤵
  PID:6620
- C:\Windows\System\pOXqRiC.exe
  C:\Windows\System\pOXqRiC.exe
  2⤵
  PID:6636
- C:\Windows\System\dZWrIMs.exe
  C:\Windows\System\dZWrIMs.exe
  2⤵
  PID:6652
- C:\Windows\System\UNUAAee.exe
  C:\Windows\System\UNUAAee.exe
  2⤵
  PID:6668
- C:\Windows\System\owsslef.exe
  C:\Windows\System\owsslef.exe
  2⤵
  PID:6684
- C:\Windows\System\mEdcMie.exe
  C:\Windows\System\mEdcMie.exe
  2⤵
  PID:6700
- C:\Windows\System\nUXQAKU.exe
  C:\Windows\System\nUXQAKU.exe
  2⤵
  PID:6716
- C:\Windows\System\WjdDCRX.exe
  C:\Windows\System\WjdDCRX.exe
  2⤵
  PID:6732
- C:\Windows\System\bkSzswq.exe
  C:\Windows\System\bkSzswq.exe
  2⤵
  PID:6748
- C:\Windows\System\eLbGsZg.exe
  C:\Windows\System\eLbGsZg.exe
  2⤵
  PID:6764
- C:\Windows\System\rUFTSjY.exe
  C:\Windows\System\rUFTSjY.exe
  2⤵
  PID:6780
- C:\Windows\System\esNnPpB.exe
  C:\Windows\System\esNnPpB.exe
  2⤵
  PID:6796
- C:\Windows\System\yodzKHg.exe
  C:\Windows\System\yodzKHg.exe
  2⤵
  PID:6812
- C:\Windows\System\HIlLQyc.exe
  C:\Windows\System\HIlLQyc.exe
  2⤵
  PID:6828
- C:\Windows\System\OISpvIb.exe
  C:\Windows\System\OISpvIb.exe
  2⤵
  PID:6844
- C:\Windows\System\LTmTByU.exe
  C:\Windows\System\LTmTByU.exe
  2⤵
  PID:6860
- C:\Windows\System\kPMQMRy.exe
  C:\Windows\System\kPMQMRy.exe
  2⤵
  PID:6876
- C:\Windows\System\flRwBQt.exe
  C:\Windows\System\flRwBQt.exe
  2⤵
  PID:6892
- C:\Windows\System\SPJYwRh.exe
  C:\Windows\System\SPJYwRh.exe
  2⤵
  PID:6908
- C:\Windows\System\ozhfBwN.exe
  C:\Windows\System\ozhfBwN.exe
  2⤵
  PID:6924
- C:\Windows\System\pJFOIHW.exe
  C:\Windows\System\pJFOIHW.exe
  2⤵
  PID:6940
- C:\Windows\System\vlMKAFG.exe
  C:\Windows\System\vlMKAFG.exe
  2⤵
  PID:6956
- C:\Windows\System\BwDnSmE.exe
  C:\Windows\System\BwDnSmE.exe
  2⤵
  PID:6972
- C:\Windows\System\JdhaGxh.exe
  C:\Windows\System\JdhaGxh.exe
  2⤵
  PID:6988
- C:\Windows\System\tOaUZmi.exe
  C:\Windows\System\tOaUZmi.exe
  2⤵
  PID:7004
- C:\Windows\System\rUvvcdo.exe
  C:\Windows\System\rUvvcdo.exe
  2⤵
  PID:7020
- C:\Windows\System\jILfaqx.exe
  C:\Windows\System\jILfaqx.exe
  2⤵
  PID:7036
- C:\Windows\System\OVyBlat.exe
  C:\Windows\System\OVyBlat.exe
  2⤵
  PID:7052
- C:\Windows\System\bIZoqwC.exe
  C:\Windows\System\bIZoqwC.exe
  2⤵
  PID:7068
- C:\Windows\System\JymCbeB.exe
  C:\Windows\System\JymCbeB.exe
  2⤵
  PID:7084
- C:\Windows\System\aNjNwxQ.exe
  C:\Windows\System\aNjNwxQ.exe
  2⤵
  PID:7100
- C:\Windows\System\nYqWidv.exe
  C:\Windows\System\nYqWidv.exe
  2⤵
  PID:7116
- C:\Windows\System\tgirarh.exe
  C:\Windows\System\tgirarh.exe
  2⤵
  PID:7132
- C:\Windows\System\AOBbhGX.exe
  C:\Windows\System\AOBbhGX.exe
  2⤵
  PID:7148
- C:\Windows\System\Bqkivnq.exe
  C:\Windows\System\Bqkivnq.exe
  2⤵
  PID:7164
- C:\Windows\System\rJeajmk.exe
  C:\Windows\System\rJeajmk.exe
  2⤵
  PID:6152
- C:\Windows\System\qMgRIQD.exe
  C:\Windows\System\qMgRIQD.exe
  2⤵
  PID:6212
- C:\Windows\System\tZmlltV.exe
  C:\Windows\System\tZmlltV.exe
  2⤵
  PID:2600
- C:\Windows\System\WIVgZds.exe
  C:\Windows\System\WIVgZds.exe
  2⤵
  PID:2852
- C:\Windows\System\OXVDUYo.exe
  C:\Windows\System\OXVDUYo.exe
  2⤵
  PID:6344
- C:\Windows\System\LvJKToG.exe
  C:\Windows\System\LvJKToG.exe
  2⤵
  PID:2640
- C:\Windows\System\yAxrAvU.exe
  C:\Windows\System\yAxrAvU.exe
  2⤵
  PID:6404
- C:\Windows\System\NWdGNES.exe
  C:\Windows\System\NWdGNES.exe
  2⤵
  PID:5756
- C:\Windows\System\JUXhufw.exe
  C:\Windows\System\JUXhufw.exe
  2⤵
  PID:3940
- C:\Windows\System\KRmXWGK.exe
  C:\Windows\System\KRmXWGK.exe
  2⤵
  PID:6196
- C:\Windows\System\cPHnxaq.exe
  C:\Windows\System\cPHnxaq.exe
  2⤵
  PID:6264
- C:\Windows\System\FsgQCkN.exe
  C:\Windows\System\FsgQCkN.exe
  2⤵
  PID:6328
- C:\Windows\System\EaBNgyr.exe
  C:\Windows\System\EaBNgyr.exe
  2⤵
  PID:6388
- C:\Windows\System\gIgBYxM.exe
  C:\Windows\System\gIgBYxM.exe
  2⤵
  PID:6468
- C:\Windows\System\XZUFgpa.exe
  C:\Windows\System\XZUFgpa.exe
  2⤵
  PID:6440
- C:\Windows\System\qbtElDl.exe
  C:\Windows\System\qbtElDl.exe
  2⤵
  PID:6532
- C:\Windows\System\lulmPcH.exe
  C:\Windows\System\lulmPcH.exe
  2⤵
  PID:6520
- C:\Windows\System\bmpsvEh.exe
  C:\Windows\System\bmpsvEh.exe
  2⤵
  PID:6564
- C:\Windows\System\ZdmIRIN.exe
  C:\Windows\System\ZdmIRIN.exe
  2⤵
  PID:6632
- C:\Windows\System\kQZOAmP.exe
  C:\Windows\System\kQZOAmP.exe
  2⤵
  PID:6692
- C:\Windows\System\XinEcDj.exe
  C:\Windows\System\XinEcDj.exe
  2⤵
  PID:6760
- C:\Windows\System\GmoKhIo.exe
  C:\Windows\System\GmoKhIo.exe
  2⤵
  PID:2788
- C:\Windows\System\pYvmfSJ.exe
  C:\Windows\System\pYvmfSJ.exe
  2⤵
  PID:6644
- C:\Windows\System\WQapjxW.exe
  C:\Windows\System\WQapjxW.exe
  2⤵
  PID:6680
- C:\Windows\System\mKBuIqk.exe
  C:\Windows\System\mKBuIqk.exe
  2⤵
  PID:6772
- C:\Windows\System\uEqMeSd.exe
  C:\Windows\System\uEqMeSd.exe
  2⤵
  PID:6612
- C:\Windows\System\RaMQaKy.exe
  C:\Windows\System\RaMQaKy.exe
  2⤵
  PID:6852
- C:\Windows\System\zBzszKg.exe
  C:\Windows\System\zBzszKg.exe
  2⤵
  PID:6836
- C:\Windows\System\UeoBVGh.exe
  C:\Windows\System\UeoBVGh.exe
  2⤵
  PID:6888
- C:\Windows\System\oCmThpe.exe
  C:\Windows\System\oCmThpe.exe
  2⤵
  PID:6948
- C:\Windows\System\jImpDRm.exe
  C:\Windows\System\jImpDRm.exe
  2⤵
  PID:6984
- C:\Windows\System\aLzvrZZ.exe
  C:\Windows\System\aLzvrZZ.exe
  2⤵
  PID:7016
- C:\Windows\System\OjauIlR.exe
  C:\Windows\System\OjauIlR.exe
  2⤵
  PID:7076
- C:\Windows\System\HdGHbJY.exe
  C:\Windows\System\HdGHbJY.exe
  2⤵
  PID:6932
- C:\Windows\System\GvVBCtx.exe
  C:\Windows\System\GvVBCtx.exe
  2⤵
  PID:7000
- C:\Windows\System\SVcMBqb.exe
  C:\Windows\System\SVcMBqb.exe
  2⤵
  PID:7064
- C:\Windows\System\NhAeZjW.exe
  C:\Windows\System\NhAeZjW.exe
  2⤵
  PID:7140
- C:\Windows\System\LUVaMTh.exe
  C:\Windows\System\LUVaMTh.exe
  2⤵
  PID:7128
- C:\Windows\System\SQUviYz.exe
  C:\Windows\System\SQUviYz.exe
  2⤵
  PID:6184
- C:\Windows\System\aBYwwye.exe
  C:\Windows\System\aBYwwye.exe
  2⤵
  PID:6148
- C:\Windows\System\nVtPXTG.exe
  C:\Windows\System\nVtPXTG.exe
  2⤵
  PID:6340
- C:\Windows\System\UaNEpjv.exe
  C:\Windows\System\UaNEpjv.exe
  2⤵
  PID:5720
- C:\Windows\System\mspMjLO.exe
  C:\Windows\System\mspMjLO.exe
  2⤵
  PID:6436
- C:\Windows\System\qivsJmB.exe
  C:\Windows\System\qivsJmB.exe
  2⤵
  PID:6164
- C:\Windows\System\LIxYTkT.exe
  C:\Windows\System\LIxYTkT.exe
  2⤵
  PID:6296
- C:\Windows\System\sfUCpYg.exe
  C:\Windows\System\sfUCpYg.exe
  2⤵
  PID:328
- C:\Windows\System\BnVjWDD.exe
  C:\Windows\System\BnVjWDD.exe
  2⤵
  PID:2492
- C:\Windows\System\SeckkOA.exe
  C:\Windows\System\SeckkOA.exe
  2⤵
  PID:6456
- C:\Windows\System\NmjBzZi.exe
  C:\Windows\System\NmjBzZi.exe
  2⤵
  PID:6552
- C:\Windows\System\IwxtFQa.exe
  C:\Windows\System\IwxtFQa.exe
  2⤵
  PID:6600
- C:\Windows\System\ntAnZWL.exe
  C:\Windows\System\ntAnZWL.exe
  2⤵
  PID:6660
- C:\Windows\System\mSTUzYg.exe
  C:\Windows\System\mSTUzYg.exe
  2⤵
  PID:6676
- C:\Windows\System\uMrGWVJ.exe
  C:\Windows\System\uMrGWVJ.exe
  2⤵
  PID:6740
- C:\Windows\System\ZLdXeuL.exe
  C:\Windows\System\ZLdXeuL.exe
  2⤵
  PID:6868
- C:\Windows\System\RidHKOv.exe
  C:\Windows\System\RidHKOv.exe
  2⤵
  PID:1808
- C:\Windows\System\VSRJLPe.exe
  C:\Windows\System\VSRJLPe.exe
  2⤵
  PID:7096
- C:\Windows\System\Qqatatg.exe
  C:\Windows\System\Qqatatg.exe
  2⤵
  PID:2480
- C:\Windows\System\RLShoZv.exe
  C:\Windows\System\RLShoZv.exe
  2⤵
  PID:7032
- C:\Windows\System\ppzOVuS.exe
  C:\Windows\System\ppzOVuS.exe
  2⤵
  PID:7124
- C:\Windows\System\laUCYHn.exe
  C:\Windows\System\laUCYHn.exe
  2⤵
  PID:6804
- C:\Windows\System\ZzezPwd.exe
  C:\Windows\System\ZzezPwd.exe
  2⤵
  PID:6452
- C:\Windows\System\AogBIPo.exe
  C:\Windows\System\AogBIPo.exe
  2⤵
  PID:6756
- C:\Windows\System\ghjeXkS.exe
  C:\Windows\System\ghjeXkS.exe
  2⤵
  PID:6884
- C:\Windows\System\tPQHCjo.exe
  C:\Windows\System\tPQHCjo.exe
  2⤵
  PID:7012
- C:\Windows\System\BkurZHR.exe
  C:\Windows\System\BkurZHR.exe
  2⤵
  PID:6488
- C:\Windows\System\ldCSPFq.exe
  C:\Windows\System\ldCSPFq.exe
  2⤵
  PID:6792
- C:\Windows\System\CpgVlqi.exe
  C:\Windows\System\CpgVlqi.exe
  2⤵
  PID:6744
- C:\Windows\System\DTJIosv.exe
  C:\Windows\System\DTJIosv.exe
  2⤵
  PID:6872
- C:\Windows\System\rCPzGID.exe
  C:\Windows\System\rCPzGID.exe
  2⤵
  PID:6168
- C:\Windows\System\UEWAgUf.exe
  C:\Windows\System\UEWAgUf.exe
  2⤵
  PID:2456
- C:\Windows\System\fdnuHHR.exe
  C:\Windows\System\fdnuHHR.exe
  2⤵
  PID:2824
- C:\Windows\System\WbljZhk.exe
  C:\Windows\System\WbljZhk.exe
  2⤵
  PID:6708
- C:\Windows\System\YYTWutm.exe
  C:\Windows\System\YYTWutm.exe
  2⤵
  PID:7184
- C:\Windows\System\DZxJUaH.exe
  C:\Windows\System\DZxJUaH.exe
  2⤵
  PID:7200
- C:\Windows\System\beTmcDA.exe
  C:\Windows\System\beTmcDA.exe
  2⤵
  PID:7216
- C:\Windows\System\puhRFWQ.exe
  C:\Windows\System\puhRFWQ.exe
  2⤵
  PID:7232
- C:\Windows\System\gsokmBT.exe
  C:\Windows\System\gsokmBT.exe
  2⤵
  PID:7248
- C:\Windows\System\YPbQRgP.exe
  C:\Windows\System\YPbQRgP.exe
  2⤵
  PID:7264
- C:\Windows\System\XtPoYzE.exe
  C:\Windows\System\XtPoYzE.exe
  2⤵
  PID:7280
- C:\Windows\System\dVbNhQQ.exe
  C:\Windows\System\dVbNhQQ.exe
  2⤵
  PID:7296
- C:\Windows\System\XfoUzfj.exe
  C:\Windows\System\XfoUzfj.exe
  2⤵
  PID:7312
- C:\Windows\System\eBxaiJL.exe
  C:\Windows\System\eBxaiJL.exe
  2⤵
  PID:7328
- C:\Windows\System\FOAQsnJ.exe
  C:\Windows\System\FOAQsnJ.exe
  2⤵
  PID:7344
- C:\Windows\System\fMUrMHf.exe
  C:\Windows\System\fMUrMHf.exe
  2⤵
  PID:7360
- C:\Windows\System\ybMpvJf.exe
  C:\Windows\System\ybMpvJf.exe
  2⤵
  PID:7376
- C:\Windows\System\jsdRdaI.exe
  C:\Windows\System\jsdRdaI.exe
  2⤵
  PID:7392
- C:\Windows\System\bWGWKQK.exe
  C:\Windows\System\bWGWKQK.exe
  2⤵
  PID:7408
- C:\Windows\System\ZGCjhcS.exe
  C:\Windows\System\ZGCjhcS.exe
  2⤵
  PID:7424
- C:\Windows\System\ICYnFVo.exe
  C:\Windows\System\ICYnFVo.exe
  2⤵
  PID:7440
- C:\Windows\System\foldLOu.exe
  C:\Windows\System\foldLOu.exe
  2⤵
  PID:7456
- C:\Windows\System\IXkJcqf.exe
  C:\Windows\System\IXkJcqf.exe
  2⤵
  PID:7472
- C:\Windows\System\qaMgAEt.exe
  C:\Windows\System\qaMgAEt.exe
  2⤵
  PID:7488
- C:\Windows\System\JUpwsSt.exe
  C:\Windows\System\JUpwsSt.exe
  2⤵
  PID:7504
- C:\Windows\System\SNMizxH.exe
  C:\Windows\System\SNMizxH.exe
  2⤵
  PID:7520
- C:\Windows\System\tJTRICc.exe
  C:\Windows\System\tJTRICc.exe
  2⤵
  PID:7536
- C:\Windows\System\truKChL.exe
  C:\Windows\System\truKChL.exe
  2⤵
  PID:7552
- C:\Windows\System\FHiCwkV.exe
  C:\Windows\System\FHiCwkV.exe
  2⤵
  PID:7568
- C:\Windows\System\RfRzvKI.exe
  C:\Windows\System\RfRzvKI.exe
  2⤵
  PID:7584
- C:\Windows\System\snpsBEA.exe
  C:\Windows\System\snpsBEA.exe
  2⤵
  PID:7600
- C:\Windows\System\JlYcPzu.exe
  C:\Windows\System\JlYcPzu.exe
  2⤵
  PID:7616
- C:\Windows\System\wmFCSaB.exe
  C:\Windows\System\wmFCSaB.exe
  2⤵
  PID:7632
- C:\Windows\System\uaoHQxF.exe
  C:\Windows\System\uaoHQxF.exe
  2⤵
  PID:7648
- C:\Windows\System\TNugbRl.exe
  C:\Windows\System\TNugbRl.exe
  2⤵
  PID:7664
- C:\Windows\System\bHhxysu.exe
  C:\Windows\System\bHhxysu.exe
  2⤵
  PID:7680
- C:\Windows\System\JIpCvRZ.exe
  C:\Windows\System\JIpCvRZ.exe
  2⤵
  PID:7696
- C:\Windows\System\OISCKdU.exe
  C:\Windows\System\OISCKdU.exe
  2⤵
  PID:7716
- C:\Windows\System\UqoBTUk.exe
  C:\Windows\System\UqoBTUk.exe
  2⤵
  PID:7732
- C:\Windows\System\ychsOpl.exe
  C:\Windows\System\ychsOpl.exe
  2⤵
  PID:7748
- C:\Windows\System\nuWFagQ.exe
  C:\Windows\System\nuWFagQ.exe
  2⤵
  PID:7764
- C:\Windows\System\HRCbmeg.exe
  C:\Windows\System\HRCbmeg.exe
  2⤵
  PID:7780
- C:\Windows\System\jMGylMw.exe
  C:\Windows\System\jMGylMw.exe
  2⤵
  PID:7796
- C:\Windows\System\sKfzUkr.exe
  C:\Windows\System\sKfzUkr.exe
  2⤵
  PID:7812
- C:\Windows\System\MkrOBhN.exe
  C:\Windows\System\MkrOBhN.exe
  2⤵
  PID:7828
- C:\Windows\System\MqJFRbm.exe
  C:\Windows\System\MqJFRbm.exe
  2⤵
  PID:7844
- C:\Windows\System\IuArJfJ.exe
  C:\Windows\System\IuArJfJ.exe
  2⤵
  PID:7860
- C:\Windows\System\TkoRWxn.exe
  C:\Windows\System\TkoRWxn.exe
  2⤵
  PID:7876
- C:\Windows\System\LnCXPLN.exe
  C:\Windows\System\LnCXPLN.exe
  2⤵
  PID:7892
- C:\Windows\System\YejxQDq.exe
  C:\Windows\System\YejxQDq.exe
  2⤵
  PID:7908
- C:\Windows\System\ecgtHIt.exe
  C:\Windows\System\ecgtHIt.exe
  2⤵
  PID:7924
- C:\Windows\System\qBrOPPc.exe
  C:\Windows\System\qBrOPPc.exe
  2⤵
  PID:7940
- C:\Windows\System\GGIXXoo.exe
  C:\Windows\System\GGIXXoo.exe
  2⤵
  PID:7956
- C:\Windows\System\TtbObjr.exe
  C:\Windows\System\TtbObjr.exe
  2⤵
  PID:7972
- C:\Windows\System\nZToceU.exe
  C:\Windows\System\nZToceU.exe
  2⤵
  PID:7988
- C:\Windows\System\cWZEHyK.exe
  C:\Windows\System\cWZEHyK.exe
  2⤵
  PID:8004
- C:\Windows\System\WxERSlf.exe
  C:\Windows\System\WxERSlf.exe
  2⤵
  PID:8020
- C:\Windows\System\dmmummJ.exe
  C:\Windows\System\dmmummJ.exe
  2⤵
  PID:8036
- C:\Windows\System\QwyfSDY.exe
  C:\Windows\System\QwyfSDY.exe
  2⤵
  PID:8052
- C:\Windows\System\vWjQBTD.exe
  C:\Windows\System\vWjQBTD.exe
  2⤵
  PID:8068
- C:\Windows\System\yAInDzw.exe
  C:\Windows\System\yAInDzw.exe
  2⤵
  PID:8084
- C:\Windows\System\YuqIMnX.exe
  C:\Windows\System\YuqIMnX.exe
  2⤵
  PID:8100
- C:\Windows\System\paFvWns.exe
  C:\Windows\System\paFvWns.exe
  2⤵
  PID:8116
- C:\Windows\System\NdHkywV.exe
  C:\Windows\System\NdHkywV.exe
  2⤵
  PID:8132
- C:\Windows\System\stTXLui.exe
  C:\Windows\System\stTXLui.exe
  2⤵
  PID:8148
- C:\Windows\System\sWDMqNu.exe
  C:\Windows\System\sWDMqNu.exe
  2⤵
  PID:8164
- C:\Windows\System\bpVFtcl.exe
  C:\Windows\System\bpVFtcl.exe
  2⤵
  PID:8180
- C:\Windows\System\IKsXFdG.exe
  C:\Windows\System\IKsXFdG.exe
  2⤵
  PID:7160
- C:\Windows\System\yePKary.exe
  C:\Windows\System\yePKary.exe
  2⤵
  PID:7180
- C:\Windows\System\HRlEovQ.exe
  C:\Windows\System\HRlEovQ.exe
  2⤵
  PID:7244
- C:\Windows\System\IvyoDnH.exe
  C:\Windows\System\IvyoDnH.exe
  2⤵
  PID:7304
- C:\Windows\System\VosTTff.exe
  C:\Windows\System\VosTTff.exe
  2⤵
  PID:7368
- C:\Windows\System\ZRtUrZm.exe
  C:\Windows\System\ZRtUrZm.exe
  2⤵
  PID:7432
- C:\Windows\System\BbOrqqj.exe
  C:\Windows\System\BbOrqqj.exe
  2⤵
  PID:7496
- C:\Windows\System\XgXseLs.exe
  C:\Windows\System\XgXseLs.exe
  2⤵
  PID:7560
- C:\Windows\System\aUdFFZZ.exe
  C:\Windows\System\aUdFFZZ.exe
  2⤵
  PID:2556
- C:\Windows\System\EhCMbtY.exe
  C:\Windows\System\EhCMbtY.exe
  2⤵
  PID:7624
- C:\Windows\System\KjOEadg.exe
  C:\Windows\System\KjOEadg.exe
  2⤵
  PID:7692
- C:\Windows\System\sJhgKyR.exe
  C:\Windows\System\sJhgKyR.exe
  2⤵
  PID:7388
- C:\Windows\System\GEIlyOe.exe
  C:\Windows\System\GEIlyOe.exe
  2⤵
  PID:1928
- C:\Windows\System\JcCqLCj.exe
  C:\Windows\System\JcCqLCj.exe
  2⤵
  PID:7544
- C:\Windows\System\OsZCgYp.exe
  C:\Windows\System\OsZCgYp.exe
  2⤵
  PID:7260
- C:\Windows\System\krdpHeS.exe
  C:\Windows\System\krdpHeS.exe
  2⤵
  PID:7612
- C:\Windows\System\XiRjYiO.exe
  C:\Windows\System\XiRjYiO.exe
  2⤵
  PID:6824
- C:\Windows\System\ocSTmUI.exe
  C:\Windows\System\ocSTmUI.exe
  2⤵
  PID:7288
- C:\Windows\System\LEBKxXZ.exe
  C:\Windows\System\LEBKxXZ.exe
  2⤵
  PID:7644
- C:\Windows\System\tqgZPih.exe
  C:\Windows\System\tqgZPih.exe
  2⤵
  PID:7224
- C:\Windows\System\BPawsol.exe
  C:\Windows\System\BPawsol.exe
  2⤵
  PID:7704
- C:\Windows\System\vyHIYov.exe
  C:\Windows\System\vyHIYov.exe
  2⤵
  PID:7516
- C:\Windows\System\eGVwVgE.exe
  C:\Windows\System\eGVwVgE.exe
  2⤵
  PID:7712
- C:\Windows\System\GWZaScF.exe
  C:\Windows\System\GWZaScF.exe
  2⤵
  PID:7760
- C:\Windows\System\KJdUhdj.exe
  C:\Windows\System\KJdUhdj.exe
  2⤵
  PID:7824
- C:\Windows\System\jsmFMGC.exe
  C:\Windows\System\jsmFMGC.exe
  2⤵
  PID:7888
- C:\Windows\System\ccivJNL.exe
  C:\Windows\System\ccivJNL.exe
  2⤵
  PID:7804
- C:\Windows\System\lhMyECp.exe
  C:\Windows\System\lhMyECp.exe
  2⤵
  PID:7868
- C:\Windows\System\NpoxUbf.exe
  C:\Windows\System\NpoxUbf.exe
  2⤵
  PID:7932
- C:\Windows\System\rzjKRHT.exe
  C:\Windows\System\rzjKRHT.exe
  2⤵
  PID:7980
- C:\Windows\System\DtSvfbi.exe
  C:\Windows\System\DtSvfbi.exe
  2⤵
  PID:8044
- C:\Windows\System\cqMexfH.exe
  C:\Windows\System\cqMexfH.exe
  2⤵
  PID:7996
- C:\Windows\System\jqukBDb.exe
  C:\Windows\System\jqukBDb.exe
  2⤵
  PID:8028
- C:\Windows\System\qRgwwLh.exe
  C:\Windows\System\qRgwwLh.exe
  2⤵
  PID:8064
- C:\Windows\System\ZuYlZJQ.exe
  C:\Windows\System\ZuYlZJQ.exe
  2⤵
  PID:8112
- C:\Windows\System\zRrkico.exe
  C:\Windows\System\zRrkico.exe
  2⤵
  PID:3004
- C:\Windows\System\CikIlHh.exe
  C:\Windows\System\CikIlHh.exe
  2⤵
  PID:7176
- C:\Windows\System\YjnocxR.exe
  C:\Windows\System\YjnocxR.exe
  2⤵
  PID:7404
- C:\Windows\System\IgMTPUt.exe
  C:\Windows\System\IgMTPUt.exe
  2⤵
  PID:7336
- C:\Windows\System\VQkuiDU.exe
  C:\Windows\System\VQkuiDU.exe
  2⤵
  PID:7628
- C:\Windows\System\kwEEkdU.exe
  C:\Windows\System\kwEEkdU.exe
  2⤵
  PID:8160
- C:\Windows\System\FDbljGp.exe
  C:\Windows\System\FDbljGp.exe
  2⤵
  PID:7420
- C:\Windows\System\gkfWXrZ.exe
  C:\Windows\System\gkfWXrZ.exe
  2⤵
  PID:6548
- C:\Windows\System\gmXuebE.exe
  C:\Windows\System\gmXuebE.exe
  2⤵
  PID:6376
- C:\Windows\System\YaDjoSG.exe
  C:\Windows\System\YaDjoSG.exe
  2⤵
  PID:7576
- C:\Windows\System\MiPJjWI.exe
  C:\Windows\System\MiPJjWI.exe
  2⤵
  PID:6232
- C:\Windows\System\QzJueDW.exe
  C:\Windows\System\QzJueDW.exe
  2⤵
  PID:7256
- C:\Windows\System\sdZXlwb.exe
  C:\Windows\System\sdZXlwb.exe
  2⤵
  PID:7484
- C:\Windows\System\tiPOXwv.exe
  C:\Windows\System\tiPOXwv.exe
  2⤵
  PID:7856
- C:\Windows\System\dOSptTJ.exe
  C:\Windows\System\dOSptTJ.exe
  2⤵
  PID:7948
- C:\Windows\System\matMpbC.exe
  C:\Windows\System\matMpbC.exe
  2⤵
  PID:8060
- C:\Windows\System\MzHoGdj.exe
  C:\Windows\System\MzHoGdj.exe
  2⤵
  PID:7276
- C:\Windows\System\HXnPPef.exe
  C:\Windows\System\HXnPPef.exe
  2⤵
  PID:7480
- C:\Windows\System\gzmTMIH.exe
  C:\Windows\System\gzmTMIH.exe
  2⤵
  PID:6180
- C:\Windows\System\hCrJQpz.exe
  C:\Windows\System\hCrJQpz.exe
  2⤵
  PID:8200
- C:\Windows\System\gPrTAth.exe
  C:\Windows\System\gPrTAth.exe
  2⤵
  PID:8216
- C:\Windows\System\TjNuZjf.exe
  C:\Windows\System\TjNuZjf.exe
  2⤵
  PID:8232
- C:\Windows\System\BLNNJAM.exe
  C:\Windows\System\BLNNJAM.exe
  2⤵
  PID:8248
- C:\Windows\System\TvXrbWI.exe
  C:\Windows\System\TvXrbWI.exe
  2⤵
  PID:8264
- C:\Windows\System\KNVZWHo.exe
  C:\Windows\System\KNVZWHo.exe
  2⤵
  PID:8280
- C:\Windows\System\OueSqve.exe
  C:\Windows\System\OueSqve.exe
  2⤵
  PID:8296
- C:\Windows\System\lgHIteD.exe
  C:\Windows\System\lgHIteD.exe
  2⤵
  PID:8312
- C:\Windows\System\GWScAdS.exe
  C:\Windows\System\GWScAdS.exe
  2⤵
  PID:8328
- C:\Windows\System\cqsRYbQ.exe
  C:\Windows\System\cqsRYbQ.exe
  2⤵
  PID:8344
- C:\Windows\System\IKTNuRJ.exe
  C:\Windows\System\IKTNuRJ.exe
  2⤵
  PID:8360
- C:\Windows\System\WtdhXsO.exe
  C:\Windows\System\WtdhXsO.exe
  2⤵
  PID:8376
- C:\Windows\System\EcFXKJk.exe
  C:\Windows\System\EcFXKJk.exe
  2⤵
  PID:8392
- C:\Windows\System\CVcwPfj.exe
  C:\Windows\System\CVcwPfj.exe
  2⤵
  PID:8408
- C:\Windows\System\JpzybhY.exe
  C:\Windows\System\JpzybhY.exe
  2⤵
  PID:8424
- C:\Windows\System\RejZqrV.exe
  C:\Windows\System\RejZqrV.exe
  2⤵
  PID:8440
- C:\Windows\System\RdXjPQI.exe
  C:\Windows\System\RdXjPQI.exe
  2⤵
  PID:8456
- C:\Windows\System\LyDACdI.exe
  C:\Windows\System\LyDACdI.exe
  2⤵
  PID:8472
- C:\Windows\System\tdSztue.exe
  C:\Windows\System\tdSztue.exe
  2⤵
  PID:8488
- C:\Windows\System\KpTLHHC.exe
  C:\Windows\System\KpTLHHC.exe
  2⤵
  PID:8504
- C:\Windows\System\yBEvBKV.exe
  C:\Windows\System\yBEvBKV.exe
  2⤵
  PID:8520
- C:\Windows\System\ZptxdEX.exe
  C:\Windows\System\ZptxdEX.exe
  2⤵
  PID:8536
- C:\Windows\System\qnlnaiI.exe
  C:\Windows\System\qnlnaiI.exe
  2⤵
  PID:8552
- C:\Windows\System\BZdwSQp.exe
  C:\Windows\System\BZdwSQp.exe
  2⤵
  PID:8568
- C:\Windows\System\YNcuAmX.exe
  C:\Windows\System\YNcuAmX.exe
  2⤵
  PID:8584
- C:\Windows\System\uVSGPPM.exe
  C:\Windows\System\uVSGPPM.exe
  2⤵
  PID:8600
- C:\Windows\System\DMPCSsA.exe
  C:\Windows\System\DMPCSsA.exe
  2⤵
  PID:8616
- C:\Windows\System\boYlHCK.exe
  C:\Windows\System\boYlHCK.exe
  2⤵
  PID:8632
- C:\Windows\System\gYCYCCA.exe
  C:\Windows\System\gYCYCCA.exe
  2⤵
  PID:8648
- C:\Windows\System\YLHjNFZ.exe
  C:\Windows\System\YLHjNFZ.exe
  2⤵
  PID:8664
- C:\Windows\System\sbptBps.exe
  C:\Windows\System\sbptBps.exe
  2⤵
  PID:8680
- C:\Windows\System\gwmZqsG.exe
  C:\Windows\System\gwmZqsG.exe
  2⤵
  PID:8696
- C:\Windows\System\hlCAnLX.exe
  C:\Windows\System\hlCAnLX.exe
  2⤵
  PID:8712
- C:\Windows\System\MXIDrQG.exe
  C:\Windows\System\MXIDrQG.exe
  2⤵
  PID:8728
- C:\Windows\System\OgjUQFn.exe
  C:\Windows\System\OgjUQFn.exe
  2⤵
  PID:8744
- C:\Windows\System\PEtqsop.exe
  C:\Windows\System\PEtqsop.exe
  2⤵
  PID:8760
- C:\Windows\System\npXEamG.exe
  C:\Windows\System\npXEamG.exe
  2⤵
  PID:8776
- C:\Windows\System\DFevKpr.exe
  C:\Windows\System\DFevKpr.exe
  2⤵
  PID:8792
- C:\Windows\System\Ushffgc.exe
  C:\Windows\System\Ushffgc.exe
  2⤵
  PID:8808
- C:\Windows\System\SfGbeFh.exe
  C:\Windows\System\SfGbeFh.exe
  2⤵
  PID:8824
- C:\Windows\System\CmXeXJV.exe
  C:\Windows\System\CmXeXJV.exe
  2⤵
  PID:8840
- C:\Windows\System\oSoICnf.exe
  C:\Windows\System\oSoICnf.exe
  2⤵
  PID:8856
- C:\Windows\System\cbmWjdd.exe
  C:\Windows\System\cbmWjdd.exe
  2⤵
  PID:8872
- C:\Windows\System\pHyEQcV.exe
  C:\Windows\System\pHyEQcV.exe
  2⤵
  PID:8888
- C:\Windows\System\koIAzyU.exe
  C:\Windows\System\koIAzyU.exe
  2⤵
  PID:8904
- C:\Windows\System\lehWysV.exe
  C:\Windows\System\lehWysV.exe
  2⤵
  PID:8920
- C:\Windows\System\SDoByOc.exe
  C:\Windows\System\SDoByOc.exe
  2⤵
  PID:8936
- C:\Windows\System\tryPkUB.exe
  C:\Windows\System\tryPkUB.exe
  2⤵
  PID:8952
- C:\Windows\System\eBSxoGy.exe
  C:\Windows\System\eBSxoGy.exe
  2⤵
  PID:8968
- C:\Windows\System\DpsuSoI.exe
  C:\Windows\System\DpsuSoI.exe
  2⤵
  PID:8984
- C:\Windows\System\xwhcAJS.exe
  C:\Windows\System\xwhcAJS.exe
  2⤵
  PID:9000
- C:\Windows\System\xXeslel.exe
  C:\Windows\System\xXeslel.exe
  2⤵
  PID:9016
- C:\Windows\System\MuOjfJn.exe
  C:\Windows\System\MuOjfJn.exe
  2⤵
  PID:9032
- C:\Windows\System\KjMHnjd.exe
  C:\Windows\System\KjMHnjd.exe
  2⤵
  PID:9048
- C:\Windows\System\eLaaTmv.exe
  C:\Windows\System\eLaaTmv.exe
  2⤵
  PID:9064
- C:\Windows\System\CoMrxDu.exe
  C:\Windows\System\CoMrxDu.exe
  2⤵
  PID:9080
- C:\Windows\System\mVmFgWe.exe
  C:\Windows\System\mVmFgWe.exe
  2⤵
  PID:9096
- C:\Windows\System\qmmyBJD.exe
  C:\Windows\System\qmmyBJD.exe
  2⤵
  PID:9112
- C:\Windows\System\idPggvs.exe
  C:\Windows\System\idPggvs.exe
  2⤵
  PID:9128
- C:\Windows\System\epnQuJf.exe
  C:\Windows\System\epnQuJf.exe
  2⤵
  PID:9144
- C:\Windows\System\tQdfJxU.exe
  C:\Windows\System\tQdfJxU.exe
  2⤵
  PID:9160
- C:\Windows\System\OetctIP.exe
  C:\Windows\System\OetctIP.exe
  2⤵
  PID:9176
- C:\Windows\System\yPrWZxM.exe
  C:\Windows\System\yPrWZxM.exe
  2⤵
  PID:9192
- C:\Windows\System\BJOmvEL.exe
  C:\Windows\System\BJOmvEL.exe
  2⤵
  PID:9208
- C:\Windows\System\uPWOmQL.exe
  C:\Windows\System\uPWOmQL.exe
  2⤵
  PID:7808
- C:\Windows\System\cppRkPF.exe
  C:\Windows\System\cppRkPF.exe
  2⤵
  PID:7660
- C:\Windows\System\uRGIkPY.exe
  C:\Windows\System\uRGIkPY.exe
  2⤵
  PID:8144
- C:\Windows\System\Njyqrrt.exe
  C:\Windows\System\Njyqrrt.exe
  2⤵
  PID:8000
- C:\Windows\System\WQdTFPA.exe
  C:\Windows\System\WQdTFPA.exe
  2⤵
  PID:8108
- C:\Windows\System\ORFZHTI.exe
  C:\Windows\System\ORFZHTI.exe
  2⤵
  PID:7596
- C:\Windows\System\PHaskem.exe
  C:\Windows\System\PHaskem.exe
  2⤵
  PID:8012
- C:\Windows\System\PmVZZDo.exe
  C:\Windows\System\PmVZZDo.exe
  2⤵
  PID:7384
- C:\Windows\System\OwxZCUH.exe
  C:\Windows\System\OwxZCUH.exe
  2⤵
  PID:7772
- C:\Windows\System\dGZiOQi.exe
  C:\Windows\System\dGZiOQi.exe
  2⤵
  PID:2724
- C:\Windows\System\jQweeBm.exe
  C:\Windows\System\jQweeBm.exe
  2⤵
  PID:7324
- C:\Windows\System\savDfRj.exe
  C:\Windows\System\savDfRj.exe
  2⤵
  PID:7340
- C:\Windows\System\hAXOHhj.exe
  C:\Windows\System\hAXOHhj.exe
  2⤵
  PID:8336
- C:\Windows\System\fFRfmTt.exe
  C:\Windows\System\fFRfmTt.exe
  2⤵
  PID:8228
- C:\Windows\System\xKcJBZk.exe
  C:\Windows\System\xKcJBZk.exe
  2⤵
  PID:8356
- C:\Windows\System\ibyOTPq.exe
  C:\Windows\System\ibyOTPq.exe
  2⤵
  PID:8324
- C:\Windows\System\HhkDsiT.exe
  C:\Windows\System\HhkDsiT.exe
  2⤵
  PID:8416
- C:\Windows\System\TEhYZkD.exe
  C:\Windows\System\TEhYZkD.exe
  2⤵
  PID:8436
- C:\Windows\System\efLoqag.exe
  C:\Windows\System\efLoqag.exe
  2⤵
  PID:8468
- C:\Windows\System\SifAQBW.exe
  C:\Windows\System\SifAQBW.exe
  2⤵
  PID:8500
- C:\Windows\System\iSzKWkR.exe
  C:\Windows\System\iSzKWkR.exe
  2⤵
  PID:8564
- C:\Windows\System\kLYWMWK.exe
  C:\Windows\System\kLYWMWK.exe
  2⤵
  PID:8596
- C:\Windows\System\pGDiJwh.exe
  C:\Windows\System\pGDiJwh.exe
  2⤵
  PID:8656
- C:\Windows\System\AtROnPX.exe
  C:\Windows\System\AtROnPX.exe
  2⤵
  PID:8612
- C:\Windows\System\jsmYoLv.exe
  C:\Windows\System\jsmYoLv.exe
  2⤵
  PID:8660
- C:\Windows\System\IyAHMxG.exe
  C:\Windows\System\IyAHMxG.exe
  2⤵
  PID:8692
- C:\Windows\System\BzYQNqP.exe
  C:\Windows\System\BzYQNqP.exe
  2⤵
  PID:8704
- C:\Windows\System\rxcKVoY.exe
  C:\Windows\System\rxcKVoY.exe
  2⤵
  PID:8756
- C:\Windows\System\RPUDVHq.exe
  C:\Windows\System\RPUDVHq.exe
  2⤵
  PID:8816
- C:\Windows\System\eppLoLa.exe
  C:\Windows\System\eppLoLa.exe
  2⤵
  PID:8880
- C:\Windows\System\HHtCMgK.exe
  C:\Windows\System\HHtCMgK.exe
  2⤵
  PID:8944
- C:\Windows\System\mOKTLNz.exe
  C:\Windows\System\mOKTLNz.exe
  2⤵
  PID:8976
- C:\Windows\System\tZVTRJT.exe
  C:\Windows\System\tZVTRJT.exe
  2⤵
  PID:9040
- C:\Windows\System\zbktuud.exe
  C:\Windows\System\zbktuud.exe
  2⤵
  PID:8832
- C:\Windows\System\TVMCkQB.exe
  C:\Windows\System\TVMCkQB.exe
  2⤵
  PID:9076
- C:\Windows\System\ZIsiJew.exe
  C:\Windows\System\ZIsiJew.exe
  2⤵
  PID:8868
- C:\Windows\System\OZeiAAb.exe
  C:\Windows\System\OZeiAAb.exe
  2⤵
  PID:8900
- C:\Windows\System\TuvSJqq.exe
  C:\Windows\System\TuvSJqq.exe
  2⤵
  PID:8964
- C:\Windows\System\kLXJUmo.exe
  C:\Windows\System\kLXJUmo.exe
  2⤵
  PID:9120
- C:\Windows\System\qHfhCdB.exe
  C:\Windows\System\qHfhCdB.exe
  2⤵
  PID:9028
- C:\Windows\System\vcTvvSp.exe
  C:\Windows\System\vcTvvSp.exe
  2⤵
  PID:9168
- C:\Windows\System\BeVPRNz.exe
  C:\Windows\System\BeVPRNz.exe
  2⤵
  PID:2900
- C:\Windows\System\sSRyymw.exe
  C:\Windows\System\sSRyymw.exe
  2⤵
  PID:9156
- C:\Windows\System\GToOoVz.exe
  C:\Windows\System\GToOoVz.exe
  2⤵
  PID:7672
- C:\Windows\System\XlAkOFC.exe
  C:\Windows\System\XlAkOFC.exe
  2⤵
  PID:7468
- C:\Windows\System\ZFByxXT.exe
  C:\Windows\System\ZFByxXT.exe
  2⤵
  PID:8256
- C:\Windows\System\iPqiJyu.exe
  C:\Windows\System\iPqiJyu.exe
  2⤵
  PID:8196
- C:\Windows\System\tMVGqcE.exe
  C:\Windows\System\tMVGqcE.exe
  2⤵
  PID:8404
- C:\Windows\System\gPupWMV.exe
  C:\Windows\System\gPupWMV.exe
  2⤵
  PID:7756
- C:\Windows\System\JlIjbKi.exe
  C:\Windows\System\JlIjbKi.exe
  2⤵
  PID:7532
- C:\Windows\System\WZYiNVl.exe
  C:\Windows\System\WZYiNVl.exe
  2⤵
  PID:8372
- C:\Windows\System\aRQsHlP.exe
  C:\Windows\System\aRQsHlP.exe
  2⤵
  PID:8320
- C:\Windows\System\MraNpcF.exe
  C:\Windows\System\MraNpcF.exe
  2⤵
  PID:8592
- C:\Windows\System\CdZbkvK.exe
  C:\Windows\System\CdZbkvK.exe
  2⤵
  PID:8672
- C:\Windows\System\PUHNgzM.exe
  C:\Windows\System\PUHNgzM.exe
  2⤵
  PID:7964
- C:\Windows\System\XajqhJL.exe
  C:\Windows\System\XajqhJL.exe
  2⤵
  PID:8308
- C:\Windows\System\rNKbCxI.exe
  C:\Windows\System\rNKbCxI.exe
  2⤵
  PID:8644
- C:\Windows\System\cLIlIUL.exe
  C:\Windows\System\cLIlIUL.exe
  2⤵
  PID:8804
- C:\Windows\System\xdSVVfR.exe
  C:\Windows\System\xdSVVfR.exe
  2⤵
  PID:9104
- C:\Windows\System\CJbnwDi.exe
  C:\Windows\System\CJbnwDi.exe
  2⤵
  PID:8212
- C:\Windows\System\cNiSvsy.exe
  C:\Windows\System\cNiSvsy.exe
  2⤵
  PID:776
- C:\Windows\System\THjujmp.exe
  C:\Windows\System\THjujmp.exe
  2⤵
  PID:8676
- C:\Windows\System\pSTFCkI.exe
  C:\Windows\System\pSTFCkI.exe
  2⤵
  PID:8848
- C:\Windows\System\PGnCtmu.exe
  C:\Windows\System\PGnCtmu.exe
  2⤵
  PID:9200
- C:\Windows\System\qqiDFjr.exe
  C:\Windows\System\qqiDFjr.exe
  2⤵
  PID:9184
- C:\Windows\System\YbHDegU.exe
  C:\Windows\System\YbHDegU.exe
  2⤵
  PID:9044
- C:\Windows\System\PkTEDeK.exe
  C:\Windows\System\PkTEDeK.exe
  2⤵
  PID:8912
- C:\Windows\System\AImpdTL.exe
  C:\Windows\System\AImpdTL.exe
  2⤵
  PID:2424
- C:\Windows\System\ZEkfYOr.exe
  C:\Windows\System\ZEkfYOr.exe
  2⤵
  PID:9152
- C:\Windows\System\vPkDsHa.exe
  C:\Windows\System\vPkDsHa.exe
  2⤵
  PID:7904
- C:\Windows\System\FkjqYou.exe
  C:\Windows\System\FkjqYou.exe
  2⤵
  PID:8452
- C:\Windows\System\AIYHgGo.exe
  C:\Windows\System\AIYHgGo.exe
  2⤵
  PID:8864
- C:\Windows\System\kPGKUfh.exe
  C:\Windows\System\kPGKUfh.exe
  2⤵
  PID:2892
- C:\Windows\System\SVuAOej.exe
  C:\Windows\System\SVuAOej.exe
  2⤵
  PID:8788
- C:\Windows\System\rAlxnww.exe
  C:\Windows\System\rAlxnww.exe
  2⤵
  PID:8368
- C:\Windows\System\YQojAai.exe
  C:\Windows\System\YQojAai.exe
  2⤵
  PID:9060
- C:\Windows\System\WGabJDN.exe
  C:\Windows\System\WGabJDN.exe
  2⤵
  PID:8124
- C:\Windows\System\GuhpCaz.exe
  C:\Windows\System\GuhpCaz.exe
  2⤵
  PID:8496
- C:\Windows\System\VHuVZOY.exe
  C:\Windows\System\VHuVZOY.exe
  2⤵
  PID:8388
- C:\Windows\System\vHPoSsL.exe
  C:\Windows\System\vHPoSsL.exe
  2⤵
  PID:9012
- C:\Windows\System\XSIJBLW.exe
  C:\Windows\System\XSIJBLW.exe
  2⤵
  PID:8544
- C:\Windows\System\jyMWhpl.exe
  C:\Windows\System\jyMWhpl.exe
  2⤵
  PID:2180
- C:\Windows\System\xYGUOKo.exe
  C:\Windows\System\xYGUOKo.exe
  2⤵
  PID:8736
- C:\Windows\System\ptLckOu.exe
  C:\Windows\System\ptLckOu.exe
  2⤵
  PID:7708
- C:\Windows\System\WPcTpdD.exe
  C:\Windows\System\WPcTpdD.exe
  2⤵
  PID:9236
- C:\Windows\System\NuTdDbG.exe
  C:\Windows\System\NuTdDbG.exe
  2⤵
  PID:9252
- C:\Windows\System\VNeOugl.exe
  C:\Windows\System\VNeOugl.exe
  2⤵
  PID:9272
- C:\Windows\System\IRiZalX.exe
  C:\Windows\System\IRiZalX.exe
  2⤵
  PID:9288
- C:\Windows\System\RZodZcn.exe
  C:\Windows\System\RZodZcn.exe
  2⤵
  PID:9304
- C:\Windows\System\COHkkVP.exe
  C:\Windows\System\COHkkVP.exe
  2⤵
  PID:9320
- C:\Windows\System\tMcMILr.exe
  C:\Windows\System\tMcMILr.exe
  2⤵
  PID:9336
- C:\Windows\System\eAASado.exe
  C:\Windows\System\eAASado.exe
  2⤵
  PID:9352
- C:\Windows\System\KpfvyxL.exe
  C:\Windows\System\KpfvyxL.exe
  2⤵
  PID:9368
- C:\Windows\System\dpWCLRw.exe
  C:\Windows\System\dpWCLRw.exe
  2⤵
  PID:9384
- C:\Windows\System\fySEyRM.exe
  C:\Windows\System\fySEyRM.exe
  2⤵
  PID:9400
- C:\Windows\System\ovMdFQX.exe
  C:\Windows\System\ovMdFQX.exe
  2⤵
  PID:9416
- C:\Windows\System\IWQNUkb.exe
  C:\Windows\System\IWQNUkb.exe
  2⤵
  PID:9436
- C:\Windows\System\pimzjZA.exe
  C:\Windows\System\pimzjZA.exe
  2⤵
  PID:9452
- C:\Windows\System\LnssDDI.exe
  C:\Windows\System\LnssDDI.exe
  2⤵
  PID:9468
- C:\Windows\System\ZnlVdrh.exe
  C:\Windows\System\ZnlVdrh.exe
  2⤵
  PID:9488
- C:\Windows\System\qpxABDY.exe
  C:\Windows\System\qpxABDY.exe
  2⤵
  PID:9504
- C:\Windows\System\uZnQAwO.exe
  C:\Windows\System\uZnQAwO.exe
  2⤵
  PID:9520
- C:\Windows\System\nyzcryn.exe
  C:\Windows\System\nyzcryn.exe
  2⤵
  PID:9536
- C:\Windows\System\hTErPfJ.exe
  C:\Windows\System\hTErPfJ.exe
  2⤵
  PID:9552
- C:\Windows\System\qQeHQvV.exe
  C:\Windows\System\qQeHQvV.exe
  2⤵
  PID:9568
- C:\Windows\System\mZIfOQa.exe
  C:\Windows\System\mZIfOQa.exe
  2⤵
  PID:9584
- C:\Windows\System\hXzNlPA.exe
  C:\Windows\System\hXzNlPA.exe
  2⤵
  PID:9600
- C:\Windows\System\dwkDVtr.exe
  C:\Windows\System\dwkDVtr.exe
  2⤵
  PID:9616
- C:\Windows\System\WVWhsiI.exe
  C:\Windows\System\WVWhsiI.exe
  2⤵
  PID:9632
- C:\Windows\System\rZtFBHO.exe
  C:\Windows\System\rZtFBHO.exe
  2⤵
  PID:9648
- C:\Windows\System\CAEJOgb.exe
  C:\Windows\System\CAEJOgb.exe
  2⤵
  PID:9664
- C:\Windows\System\qIWyCGm.exe
  C:\Windows\System\qIWyCGm.exe
  2⤵
  PID:9680
- C:\Windows\System\nfNxTdi.exe
  C:\Windows\System\nfNxTdi.exe
  2⤵
  PID:9696
- C:\Windows\System\XYiJjZY.exe
  C:\Windows\System\XYiJjZY.exe
  2⤵
  PID:9712
- C:\Windows\System\EoHzFNx.exe
  C:\Windows\System\EoHzFNx.exe
  2⤵
  PID:9728
- C:\Windows\System\SRREaEC.exe
  C:\Windows\System\SRREaEC.exe
  2⤵
  PID:9744
- C:\Windows\System\MYTnJhJ.exe
  C:\Windows\System\MYTnJhJ.exe
  2⤵
  PID:9760
- C:\Windows\System\MRxBZOh.exe
  C:\Windows\System\MRxBZOh.exe
  2⤵
  PID:9776
- C:\Windows\System\pJBBsVU.exe
  C:\Windows\System\pJBBsVU.exe
  2⤵
  PID:9792
- C:\Windows\System\ZUmhDZv.exe
  C:\Windows\System\ZUmhDZv.exe
  2⤵
  PID:9808
- C:\Windows\System\OWVnEob.exe
  C:\Windows\System\OWVnEob.exe
  2⤵
  PID:9824
- C:\Windows\System\OnUNIod.exe
  C:\Windows\System\OnUNIod.exe
  2⤵
  PID:9840
- C:\Windows\System\mzQYamA.exe
  C:\Windows\System\mzQYamA.exe
  2⤵
  PID:9856
- C:\Windows\System\PfWTBke.exe
  C:\Windows\System\PfWTBke.exe
  2⤵
  PID:9872
- C:\Windows\System\DxYivhO.exe
  C:\Windows\System\DxYivhO.exe
  2⤵
  PID:9888
- C:\Windows\System\NmriOUD.exe
  C:\Windows\System\NmriOUD.exe
  2⤵
  PID:9904
- C:\Windows\System\sqZqVaK.exe
  C:\Windows\System\sqZqVaK.exe
  2⤵
  PID:9920
- C:\Windows\System\Zvxmkin.exe
  C:\Windows\System\Zvxmkin.exe
  2⤵
  PID:9936
- C:\Windows\System\vGQavZs.exe
  C:\Windows\System\vGQavZs.exe
  2⤵
  PID:9952
- C:\Windows\System\EBfOiaO.exe
  C:\Windows\System\EBfOiaO.exe
  2⤵
  PID:9968
- C:\Windows\System\xyiujoG.exe
  C:\Windows\System\xyiujoG.exe
  2⤵
  PID:9984
- C:\Windows\System\FwFzAqq.exe
  C:\Windows\System\FwFzAqq.exe
  2⤵
  PID:10000
- C:\Windows\System\csJXOPF.exe
  C:\Windows\System\csJXOPF.exe
  2⤵
  PID:10016
- C:\Windows\System\juNMZWN.exe
  C:\Windows\System\juNMZWN.exe
  2⤵
  PID:10032
- C:\Windows\System\DRtJOrw.exe
  C:\Windows\System\DRtJOrw.exe
  2⤵
  PID:10048
- C:\Windows\System\KRkKlzX.exe
  C:\Windows\System\KRkKlzX.exe
  2⤵
  PID:10064
- C:\Windows\System\sAvJeCN.exe
  C:\Windows\System\sAvJeCN.exe
  2⤵
  PID:10080
- C:\Windows\System\bJRSZqY.exe
  C:\Windows\System\bJRSZqY.exe
  2⤵
  PID:10096
- C:\Windows\System\qthUojj.exe
  C:\Windows\System\qthUojj.exe
  2⤵
  PID:10112
- C:\Windows\System\CJoZZOF.exe
  C:\Windows\System\CJoZZOF.exe
  2⤵
  PID:10128
- C:\Windows\System\flHwaKb.exe
  C:\Windows\System\flHwaKb.exe
  2⤵
  PID:10144
- C:\Windows\System\kFVhWBz.exe
  C:\Windows\System\kFVhWBz.exe
  2⤵
  PID:10160
- C:\Windows\System\ujFNrZH.exe
  C:\Windows\System\ujFNrZH.exe
  2⤵
  PID:10176
- C:\Windows\System\QaYqLva.exe
  C:\Windows\System\QaYqLva.exe
  2⤵
  PID:10192
- C:\Windows\System\CdXpHYz.exe
  C:\Windows\System\CdXpHYz.exe
  2⤵
  PID:10208
- C:\Windows\System\YctAAzC.exe
  C:\Windows\System\YctAAzC.exe
  2⤵
  PID:10224
- C:\Windows\System\iZQiLqh.exe
  C:\Windows\System\iZQiLqh.exe
  2⤵
  PID:8932
- C:\Windows\System\FuyTcvM.exe
  C:\Windows\System\FuyTcvM.exe
  2⤵
  PID:8484
- C:\Windows\System\mMZbvGF.exe
  C:\Windows\System\mMZbvGF.exe
  2⤵
  PID:8172
- C:\Windows\System\MbIDCAn.exe
  C:\Windows\System\MbIDCAn.exe
  2⤵
  PID:9284
- C:\Windows\System\UsDOstQ.exe
  C:\Windows\System\UsDOstQ.exe
  2⤵
  PID:9316
- C:\Windows\System\XMktjcD.exe
  C:\Windows\System\XMktjcD.exe
  2⤵
  PID:9264
- C:\Windows\System\VzIFBdJ.exe
  C:\Windows\System\VzIFBdJ.exe
  2⤵
  PID:9408
- C:\Windows\System\IyfThyA.exe
  C:\Windows\System\IyfThyA.exe
  2⤵
  PID:9476
- C:\Windows\System\MbkLeYI.exe
  C:\Windows\System\MbkLeYI.exe
  2⤵
  PID:9460
- C:\Windows\System\SVjUkrp.exe
  C:\Windows\System\SVjUkrp.exe
  2⤵
  PID:9332
- C:\Windows\System\PsYXiBX.exe
  C:\Windows\System\PsYXiBX.exe
  2⤵
  PID:9396
- C:\Windows\System\DOmUWzj.exe
  C:\Windows\System\DOmUWzj.exe
  2⤵
  PID:9428
- C:\Windows\System\yhEWqvw.exe
  C:\Windows\System\yhEWqvw.exe
  2⤵
  PID:9512
- C:\Windows\System\CDDDWMb.exe
  C:\Windows\System\CDDDWMb.exe
  2⤵
  PID:9560
- C:\Windows\System\VhddSOx.exe
  C:\Windows\System\VhddSOx.exe
  2⤵
  PID:9564
- C:\Windows\System\PiETSWe.exe
  C:\Windows\System\PiETSWe.exe
  2⤵
  PID:9612
- C:\Windows\System\dnPYHWY.exe
  C:\Windows\System\dnPYHWY.exe
  2⤵
  PID:9672
- C:\Windows\System\XvlvZAz.exe
  C:\Windows\System\XvlvZAz.exe
  2⤵
  PID:9736
- C:\Windows\System\JgWfMEX.exe
  C:\Windows\System\JgWfMEX.exe
  2⤵
  PID:9772
- C:\Windows\System\fFLMzNo.exe
  C:\Windows\System\fFLMzNo.exe
  2⤵
  PID:9656
- C:\Windows\System\PwULQQZ.exe
  C:\Windows\System\PwULQQZ.exe
  2⤵
  PID:9868
- C:\Windows\System\ZyzODKL.exe
  C:\Windows\System\ZyzODKL.exe
  2⤵
  PID:9928
- C:\Windows\System\TOxFMEn.exe
  C:\Windows\System\TOxFMEn.exe
  2⤵
  PID:9880
- C:\Windows\System\jUfYNJs.exe
  C:\Windows\System\jUfYNJs.exe
  2⤵
  PID:9724
- C:\Windows\System\lVRyUYy.exe
  C:\Windows\System\lVRyUYy.exe
  2⤵
  PID:9820
- C:\Windows\System\enQLSBH.exe
  C:\Windows\System\enQLSBH.exe
  2⤵
  PID:9960
- C:\Windows\System\ttlusct.exe
  C:\Windows\System\ttlusct.exe
  2⤵
  PID:9964
- C:\Windows\System\TvUSlRe.exe
  C:\Windows\System\TvUSlRe.exe
  2⤵
  PID:10024
- C:\Windows\System\LcIXhUj.exe
  C:\Windows\System\LcIXhUj.exe
  2⤵
  PID:10088
- C:\Windows\System\rzYrsmf.exe
  C:\Windows\System\rzYrsmf.exe
  2⤵
  PID:10008
- C:\Windows\System\shkjVar.exe
  C:\Windows\System\shkjVar.exe
  2⤵
  PID:10044
- C:\Windows\System\FMZPMXs.exe
  C:\Windows\System\FMZPMXs.exe
  2⤵
  PID:10120
- C:\Windows\System\AwhjGUq.exe
  C:\Windows\System\AwhjGUq.exe
  2⤵
  PID:10156
- C:\Windows\System\rfdOsDy.exe
  C:\Windows\System\rfdOsDy.exe
  2⤵
  PID:10200
- C:\Windows\System\NQBKXwF.exe
  C:\Windows\System\NQBKXwF.exe
  2⤵
  PID:10172
- C:\Windows\System\YPEayNA.exe
  C:\Windows\System\YPEayNA.exe
  2⤵
  PID:10232
- C:\Windows\System\PxYySRL.exe
  C:\Windows\System\PxYySRL.exe
  2⤵
  PID:10236
- C:\Windows\System\XZHNLnr.exe
  C:\Windows\System\XZHNLnr.exe
  2⤵
  PID:9444
- C:\Windows\System\ixnKnXv.exe
  C:\Windows\System\ixnKnXv.exe
  2⤵
  PID:9464
- C:\Windows\System\EPAqrDr.exe
  C:\Windows\System\EPAqrDr.exe
  2⤵
  PID:9380
- C:\Windows\System\WahDOgn.exe
  C:\Windows\System\WahDOgn.exe
  2⤵
  PID:9392
- C:\Windows\System\PWFXDho.exe
  C:\Windows\System\PWFXDho.exe
  2⤵
  PID:9544
- C:\Windows\System\uhvOqIG.exe
  C:\Windows\System\uhvOqIG.exe
  2⤵
  PID:9532
- C:\Windows\System\iqHhNWD.exe
  C:\Windows\System\iqHhNWD.exe
  2⤵
  PID:9644
- C:\Windows\System\AtwyJtF.exe
  C:\Windows\System\AtwyJtF.exe
  2⤵
  PID:9740
- C:\Windows\System\jbczans.exe
  C:\Windows\System\jbczans.exe
  2⤵
  PID:9896
- C:\Windows\System\bQBDyCr.exe
  C:\Windows\System\bQBDyCr.exe
  2⤵
  PID:9852
- C:\Windows\System\hOAZwOP.exe
  C:\Windows\System\hOAZwOP.exe
  2⤵
  PID:9976
- C:\Windows\System\SEJYbHS.exe
  C:\Windows\System\SEJYbHS.exe
  2⤵
  PID:10140
- C:\Windows\System\RcfQedr.exe
  C:\Windows\System\RcfQedr.exe
  2⤵
  PID:8464
- C:\Windows\System\QrCMelq.exe
  C:\Windows\System\QrCMelq.exe
  2⤵
  PID:9424
- C:\Windows\System\BoCwTVs.exe
  C:\Windows\System\BoCwTVs.exe
  2⤵
  PID:9804
- C:\Windows\System\kNgFeTi.exe
  C:\Windows\System\kNgFeTi.exe
  2⤵
  PID:9948
- C:\Windows\System\MKJtDNV.exe
  C:\Windows\System\MKJtDNV.exe
  2⤵
  PID:9720
- C:\Windows\System\GDfXxIZ.exe
  C:\Windows\System\GDfXxIZ.exe
  2⤵
  PID:9800
- C:\Windows\System\UkxxdYP.exe
  C:\Windows\System\UkxxdYP.exe
  2⤵
  PID:1084
- C:\Windows\System\bUPFFVu.exe
  C:\Windows\System\bUPFFVu.exe
  2⤵
  PID:10060
- C:\Windows\System\mezuxuy.exe
  C:\Windows\System\mezuxuy.exe
  2⤵
  PID:10188
- C:\Windows\System\orEZdfP.exe
  C:\Windows\System\orEZdfP.exe
  2⤵
  PID:8240
- C:\Windows\System\XuDgSAI.exe
  C:\Windows\System\XuDgSAI.exe
  2⤵
  PID:10216
- C:\Windows\System\ObhqnFZ.exe
  C:\Windows\System\ObhqnFZ.exe
  2⤵
  PID:9608
- C:\Windows\System\FCyFeAJ.exe
  C:\Windows\System\FCyFeAJ.exe
  2⤵
  PID:9944
- C:\Windows\System\OaVhlVB.exe
  C:\Windows\System\OaVhlVB.exe
  2⤵
  PID:9692
- C:\Windows\System\AdeOJDe.exe
  C:\Windows\System\AdeOJDe.exe
  2⤵
  PID:10248
- C:\Windows\System\qZWDXBG.exe
  C:\Windows\System\qZWDXBG.exe
  2⤵
  PID:10264
- C:\Windows\System\IsLwhkS.exe
  C:\Windows\System\IsLwhkS.exe
  2⤵
  PID:10280
- C:\Windows\System\ncMViGb.exe
  C:\Windows\System\ncMViGb.exe
  2⤵
  PID:10296
- C:\Windows\System\NRZTlRJ.exe
  C:\Windows\System\NRZTlRJ.exe
  2⤵
  PID:10312
- C:\Windows\System\AaoDhMn.exe
  C:\Windows\System\AaoDhMn.exe
  2⤵
  PID:10332
- C:\Windows\System\bnbOHAu.exe
  C:\Windows\System\bnbOHAu.exe
  2⤵
  PID:10436
- C:\Windows\System\HjgfxZf.exe
  C:\Windows\System\HjgfxZf.exe
  2⤵
  PID:10456
- C:\Windows\System\mWkexVL.exe
  C:\Windows\System\mWkexVL.exe
  2⤵
  PID:10472
- C:\Windows\System\Mzbcioe.exe
  C:\Windows\System\Mzbcioe.exe
  2⤵
  PID:10488
- C:\Windows\System\FvdBKvL.exe
  C:\Windows\System\FvdBKvL.exe
  2⤵
  PID:10508
- C:\Windows\System\AmJbLKa.exe
  C:\Windows\System\AmJbLKa.exe
  2⤵
  PID:10524
- C:\Windows\System\zNqxhFb.exe
  C:\Windows\System\zNqxhFb.exe
  2⤵
  PID:10540
- C:\Windows\System\usQOjPU.exe
  C:\Windows\System\usQOjPU.exe
  2⤵
  PID:10556
- C:\Windows\System\AbWSdCB.exe
  C:\Windows\System\AbWSdCB.exe
  2⤵
  PID:10572
- C:\Windows\System\fuaQRbI.exe
  C:\Windows\System\fuaQRbI.exe
  2⤵
  PID:10588
- C:\Windows\System\atcyYtD.exe
  C:\Windows\System\atcyYtD.exe
  2⤵
  PID:10604
- C:\Windows\System\BJpubYd.exe
  C:\Windows\System\BJpubYd.exe
  2⤵
  PID:10620
- C:\Windows\System\TVluyUu.exe
  C:\Windows\System\TVluyUu.exe
  2⤵
  PID:10636
- C:\Windows\System\oDgnZrK.exe
  C:\Windows\System\oDgnZrK.exe
  2⤵
  PID:10652
- C:\Windows\System\tHRDjZS.exe
  C:\Windows\System\tHRDjZS.exe
  2⤵
  PID:10668
- C:\Windows\System\jCKXTsC.exe
  C:\Windows\System\jCKXTsC.exe
  2⤵
  PID:10684
- C:\Windows\System\dNuOdPd.exe
  C:\Windows\System\dNuOdPd.exe
  2⤵
  PID:10700
- C:\Windows\System\eJWykIq.exe
  C:\Windows\System\eJWykIq.exe
  2⤵
  PID:10716
- C:\Windows\System\BLYNfbp.exe
  C:\Windows\System\BLYNfbp.exe
  2⤵
  PID:10732
- C:\Windows\System\nctefgg.exe
  C:\Windows\System\nctefgg.exe
  2⤵
  PID:10748
- C:\Windows\System\BHuyPpI.exe
  C:\Windows\System\BHuyPpI.exe
  2⤵
  PID:10764
- C:\Windows\System\ANoEWgd.exe
  C:\Windows\System\ANoEWgd.exe
  2⤵
  PID:10780
- C:\Windows\System\qCOepMo.exe
  C:\Windows\System\qCOepMo.exe
  2⤵
  PID:10796
- C:\Windows\System\rLVPqRj.exe
  C:\Windows\System\rLVPqRj.exe
  2⤵
  PID:10812
- C:\Windows\System\MunMJXk.exe
  C:\Windows\System\MunMJXk.exe
  2⤵
  PID:10828
- C:\Windows\System\zYFvKax.exe
  C:\Windows\System\zYFvKax.exe
  2⤵
  PID:10844
- C:\Windows\System\crIekqE.exe
  C:\Windows\System\crIekqE.exe
  2⤵
  PID:10860
- C:\Windows\System\ziOZDTd.exe
  C:\Windows\System\ziOZDTd.exe
  2⤵
  PID:10876
- C:\Windows\System\XeUmLuE.exe
  C:\Windows\System\XeUmLuE.exe
  2⤵
  PID:10892
- C:\Windows\System\VoEyfIb.exe
  C:\Windows\System\VoEyfIb.exe
  2⤵
  PID:10908
- C:\Windows\System\iebWfAh.exe
  C:\Windows\System\iebWfAh.exe
  2⤵
  PID:10924
- C:\Windows\System\BdYbmfh.exe
  C:\Windows\System\BdYbmfh.exe
  2⤵
  PID:10940
- C:\Windows\System\NapuSjJ.exe
  C:\Windows\System\NapuSjJ.exe
  2⤵
  PID:10980
- C:\Windows\System\VSwUNBl.exe
  C:\Windows\System\VSwUNBl.exe
  2⤵
  PID:11004
- C:\Windows\System\WLCjwfY.exe
  C:\Windows\System\WLCjwfY.exe
  2⤵
  PID:11020
- C:\Windows\System\nzxrUXA.exe
  C:\Windows\System\nzxrUXA.exe
  2⤵
  PID:11036
- C:\Windows\System\tbCNlyb.exe
  C:\Windows\System\tbCNlyb.exe
  2⤵
  PID:11052
- C:\Windows\System\BdrrKcB.exe
  C:\Windows\System\BdrrKcB.exe
  2⤵
  PID:11072
- C:\Windows\System\hMufsbr.exe
  C:\Windows\System\hMufsbr.exe
  2⤵
  PID:11100
- C:\Windows\System\wbUwoGe.exe
  C:\Windows\System\wbUwoGe.exe
  2⤵
  PID:11132
- C:\Windows\System\tvpxyWN.exe
  C:\Windows\System\tvpxyWN.exe
  2⤵
  PID:11160
- C:\Windows\System\BURcooO.exe
  C:\Windows\System\BURcooO.exe
  2⤵
  PID:11180
- C:\Windows\System\RfeRNTE.exe
  C:\Windows\System\RfeRNTE.exe
  2⤵
  PID:11208
- C:\Windows\System\pxTbXtk.exe
  C:\Windows\System\pxTbXtk.exe
  2⤵
  PID:11248
- C:\Windows\System\OrwvtrU.exe
  C:\Windows\System\OrwvtrU.exe
  2⤵
  PID:10244
- C:\Windows\System\HyZqskH.exe
  C:\Windows\System\HyZqskH.exe
  2⤵
  PID:10276
- C:\Windows\System\hPGCUXZ.exe
  C:\Windows\System\hPGCUXZ.exe
  2⤵
  PID:9548
- C:\Windows\System\eoQJIxv.exe
  C:\Windows\System\eoQJIxv.exe
  2⤵
  PID:10400
- C:\Windows\System\JfDNoQy.exe
  C:\Windows\System\JfDNoQy.exe
  2⤵
  PID:10424
- C:\Windows\System\jzmHreP.exe
  C:\Windows\System\jzmHreP.exe
  2⤵
  PID:10448
- C:\Windows\System\dKqkLXe.exe
  C:\Windows\System\dKqkLXe.exe
  2⤵
  PID:11240
- C:\Windows\System\udGMmYI.exe
  C:\Windows\System\udGMmYI.exe
  2⤵
  PID:10040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BwghSpe.exe

Filesize
1.8MB

MD5
880a23156a199ed660523be5581debe3

SHA1
3f1ccecf97a985c7ac06076054e1e9f7167765fb

SHA256
baa160beaa56b62033b8058e7bb552a16ef239ddfb82b9bb54ad729f6fe44c7a

SHA512
7f2f48a70363c70f054816eb0d9dae6e818b942f06a58f130fc92813e1920bfa492310bcf7c24d3a09733f421df0a595678000e8b029e9031e464bbbf5d14493

Download Submit
C:\Windows\system\CAIoJjD.exe

Filesize
1.8MB

MD5
ba11929374284245c0f57251baf3ac72

SHA1
d325d465d318a6ff32f3f6f311739a25e9676fc2

SHA256
d407f609f6287fd7a3f9da64ab63d30223ee68c7a26376dfbbf04aa04bb8a216

SHA512
0de87ef90fba6e224d6b8ffab777b053b2dc6a7c054169edb62179686ccc1812a6f978a18236131d5cabd6dce32ea443eeae8739d0ef46c77e072aceeefca7cd

Download Submit
C:\Windows\system\DtobLQe.exe

Filesize
1.8MB

MD5
8d37558314b990184b81af7687a9de2b

SHA1
4cfdc56e2b680c6373a892d215ac0f84c5670dae

SHA256
0c69043e4b6c91d88b21c4d6b07dd923dfcaebb4248d6199bab71cacd40ad8a5

SHA512
76fd2e6dad7e9c5635cfab2645c8707034ef861daaabafd5a3c1b2cfeddb772800189c83fc1db71aa2c052a3b5ddd91befd700d05012100e4b9877f140464fd9

Download Submit
C:\Windows\system\Fxogrio.exe

Filesize
1.8MB

MD5
ea4e94dc62468dd0259cabdf4d1ffe17

SHA1
d98f4aaf5edc091e9bbabbb6aac020faab4d1760

SHA256
e18580ecc6f217c92e7155db46e6eb71e8f5992b42db6d2dd852c38352b50430

SHA512
b00703739d51416c1e32b10969329abd780afa441268eb3ee57207e89dfe50ff454c3293c704184af2c989221e3121fc0b177620d50d3c38eb2c321fbb78d171

Download Submit
C:\Windows\system\LYgYdEU.exe

Filesize
1.8MB

MD5
9111b1cc4832f0bdfc980e13fb56f5b2

SHA1
772b871ffafb05b9d0bdb2d00b24adda4aeca133

SHA256
10dfef003abb86e0b28fcad1a85e5d38610169baf5c107db43a8d9e209160b8c

SHA512
be9e59123ea207cdd8bf111270d019a741ad0bfb323c069389c6629201a0d9f40a5b671e8549f59696c5299eab0c088e3befd68de30fcf8b87d9358b26db3608

Download Submit
C:\Windows\system\LmzlQDW.exe

Filesize
1.8MB

MD5
e44b12d094f51a490252ddef8f644472

SHA1
5c5626044535524cea3f783cde6af3afffa17426

SHA256
5ce9c1795db1069124bd3a6cf093a986c0ca4086a3aacd784d71a1a51521ad9a

SHA512
352ffce07f140076bd8800d6cd0588b8b58227e7c8efe8d3f88a8ed3b73c8df4b6ba4efd3e00c68fdc964dac5d756e0d11280728eef08281c13960ca1f47ce9c

Download Submit
C:\Windows\system\OeYnJBY.exe

Filesize
1.8MB

MD5
af5ed553d3a9324791104f63fbe01f50

SHA1
a5040c77e910f8d7e43c8f4fe4594e9cbe0898b2

SHA256
b45809394f8e08967344783f44cb483c00001b71b2af67002e89b60b999cf318

SHA512
3c1b95f1e7b3558b40a2670bb4b423b4ada362eca553c58600d63c4ff76e0a4f56eccc09f21d0db30bddf7ecd5cb244e4015d87bca6f24f081edb684b9808a08

Download Submit
C:\Windows\system\TZXImqe.exe

Filesize
1.8MB

MD5
997e56d690cc4a26c8434669d781de15

SHA1
675cebb4099e7eaf3fb7154a245115c56d368a0c

SHA256
f0d6c602bc6d7b07fe92aa0ae7e5acbdbc402a3c42d08bb4dd6cd29553b68007

SHA512
dbb1ddf96bea877ae8d4803cf8886d94ccba0a3389a85c8281c5e9ada348556933ea9f16caf421bcfee2bac62b071220f880d078b76bfb5009606c9798e75199

Download Submit
C:\Windows\system\ZWgNwzD.exe

Filesize
1.8MB

MD5
433b3f2c46b1646a175795852b96bedb

SHA1
47cb7206c453d918aad75f9bf7ee396023d6ed18

SHA256
8555df9e321a03f779bf00c3060e03280dc8e1bcf9c8b65b263f4c6d05ac27ef

SHA512
b668751c0d6093a547840507bc682217d5f9ee6b0def2b138cd7bf5fa2e051b7c6c656191a41404ec22ad986520a8edc34182ce663e9b8d4e0fda078fad8ae54

Download Submit
C:\Windows\system\aCcwTaZ.exe

Filesize
1.8MB

MD5
f3ffd2022671b408cff95cdd07e98f02

SHA1
74a27a8b5013759d5f24061128550b85cd4bae70

SHA256
e0efe462ea1071138e4b1f229beff7e9522a7ec489b4338464279fedc8f728a5

SHA512
46121b1f3a235653bdb1b93954368ecfb67a120734533e170c8e2056359c7e58e2ba4262db65398c464a7d40d1868575bf45d63e9451d4e77f3ac3312b9aa14a

Download Submit
C:\Windows\system\aFXVpht.exe

Filesize
1.8MB

MD5
f2226e6c2d9cb44c6d335faf59a88cc8

SHA1
d5a4aa64253f3132cfecfa9c91cd989099b9e0cf

SHA256
3c3b174a24af80cdc2f00e755ca0ceceefbc2dc836d73175d083948fbc8e8bbc

SHA512
fbf2aaea76ff78398703abdf7d875dbe70947f295cbd2d19e9b1af42000d4a861587565bd1066d7adcb05fc4ee978ae7327315f0dd99f2f17dcadf9eae8f5be0

Download Submit
C:\Windows\system\bWJsmYF.exe

Filesize
1.8MB

MD5
036bd26dbdaa3be4c65e9a8d30d458e0

SHA1
dce1ffe9c00ab789d70689949199583766db3a49

SHA256
c4ee62c5acc3c4befa28c5381d3710956c55c3006ff17aeba3e11adc116e061f

SHA512
013b1be9f82f8feb3571e14109fe16788bfff0fbe62fa4cceb726f7d06b73496c4852d696515ff8d9f2a3798738f4194deb8f4528bc9e82938d7dceffe3bace9

Download Submit
C:\Windows\system\dmjhpWr.exe

Filesize
1.8MB

MD5
85c27fea1fcf6fe6ac4b5921f5a0f9d8

SHA1
2f40e0934ce2963dcbbab135b096d3032097dc36

SHA256
37d48bb2c0e041b20c8871523b4f3f197b6ab34c7af99b752034165c5b5645e4

SHA512
e1898b8d8b0ef01c5f16cefb413fdac6a76bec86e8cb23978ebb40d08ee5f497d52496ed8d5e0a5ef92fc458c0668a12519f5ac2cb4ec89bf0d16d3e2da53a68

Download Submit
C:\Windows\system\esLFIuP.exe

Filesize
1.8MB

MD5
99d490e065887cb93a13160cf251cf18

SHA1
57c5dd02b2edfa9a206ad42836988bbd03e68018

SHA256
be1449da7050223b0945b8d49e46204fa31043f47a69a3835ec37a165f97251f

SHA512
f942a4a909474f0dac4570792e7fa0f5f8f77a09543a9219ef621655222254ff3ededaef393dcdb0389f9b9842169ba40de32c5a010ddf96e959bd3bb5142a4e

Download Submit
C:\Windows\system\mfINHUz.exe

Filesize
1.8MB

MD5
20803141d3f37d1091da76343e14f103

SHA1
5684b2523bc777dc1ed41076a4550e3f384d7bb9

SHA256
52d291f9fa3f70317179bdb0fb72a919f465ddb3d3bbf7a41ebb69140d057380

SHA512
612f59bc6b4f16fc73a0ea6c84bad514b9ea57cd76a05a52c751433d801e72a8489622be5a12ff030e3a4a3836851c29aa1a61f5ce3589ce9e522f31ca7060ba

Download Submit
C:\Windows\system\oSuyAEr.exe

Filesize
1.8MB

MD5
edea522c9c1d09dfb6632e640432752a

SHA1
c9bb3575cd94351e34882e1a9aa2e2718bef9365

SHA256
6c7a6257b15bd1f551886e05d8d56d64e819dd534954b0e300f3479320b4f774

SHA512
1681cf7ff09b715fd985a6574f50c1bd61ef8e13089265d0e4227d834a7422aa44efe823089144e5b719b2bdebdee4a7f53e07ce3391fb5347de98b7f2cea18f

Download Submit
C:\Windows\system\rbaPaRU.exe

Filesize
1.8MB

MD5
a0c97ff920d7d1b941b224920211dacf

SHA1
b4cafa336f9783039d7eb3128638e442e883b2fc

SHA256
d1f91d1c10509a1eea3ff71b3a54d7aae8f4f06522809e335a1b66b256a6f5ae

SHA512
305f13bc76a3e87d6a66348ce0c5778ad1554c928866dd3e4d694d77f3d03146457bf18a1651f836564a5a92d488f9c5b831a6849747d67e13bd3cd2d7bfe2fa

Download Submit
C:\Windows\system\uhHYidZ.exe

Filesize
1.8MB

MD5
e131f30e1c9b1bd475af384bdd9c3a67

SHA1
b5f0259960684d61eb322bf9c94d4c88a51102e3

SHA256
e545c9f7bd940204c0fbcf6a4606b89540d8f19da3dd209f2096af6c914e6057

SHA512
edb7ea716e2c8ad5425295da1a8d5a7e646c2286fff6c3ecdc6654bcc94bc49f9319ab42963a5a8bc8f4edbf5260d019463f5c53ab9f818aebcc6fd47f30619b

Download Submit
\Windows\system\CtKVnwb.exe

Filesize
1.8MB

MD5
c711cfb196f07832d9208ae8b04adcfa

SHA1
1d79eafd8408214ebe53deaf59f5a65dbd8d1903

SHA256
5bfefba6986db6ba41af7ed1f4e552f0f4a549bbc23d14397cf63adf86d3dfd5

SHA512
4af63a714d5417f88f6fb881b3875a3def859f04d3ee1f33914135520afbaa63c16f288ef51ec390f1cbbf807b6f5bfa698a16c204b9ec7537b2de28ec957c08

Download Submit
\Windows\system\JMSLvLi.exe

Filesize
1.8MB

MD5
8582f24b9002c52f02614c65ffc35243

SHA1
250315232c7d5e2e274c205a3a9e7bd3539e41a0

SHA256
955ccfd89b7c7fa8f3ea7f76c7945be18c25b45c8110a6ecd930f216421b0e7b

SHA512
619a9c0b964d310141c85e6ec2569323ff867b09bfd54c1a6ee0c1f777dd30f811e2854be15a36e48a25dd4b54512d0e619b03a11b357dc2262efeb10e51244a

Download Submit
\Windows\system\NtftKye.exe

Filesize
1.8MB

MD5
86c37527e02d5f332f497475f18653f1

SHA1
d78835dfffaa398adb6280cab20cc2131e6b39e2

SHA256
29292df74691f360b4c1fb9e8670f69f9fcd87535199d638929bdd51c39b6207

SHA512
a2bdcab2ef6e1e3258e472c60422550779210ea802b2ba5d40b5f444fabd76b65777cefa65a81e7c1e1894f372a80dfe722578cf893b3cbcc824a3e7f221e02c

Download Submit
\Windows\system\OThswKR.exe

Filesize
1.8MB

MD5
d12400f461cd0a21e93fc8fa64c77b0f

SHA1
0839c0106f1e98acd6d8f0dc40302472945670b7

SHA256
c892da5be116489351dd1a82906140d4cd1a066edc2d9064ff488e3cba4397e0

SHA512
04381711dd53e53ce80970c222afbcba2c8fde49d993c3e9ca6186af66a95f2c94e4313d54b635e291d4174e44ca54c5b813df4d9102dd8f8fc8de7af42c4e19

Download Submit
\Windows\system\TFPOqYa.exe

Filesize
1.8MB

MD5
5523ce6e2fb5281e4af70b40bfb8fc4d

SHA1
22eaf498e03c4ab7450049ca62685783e90a2fba

SHA256
8ae8084fcf3d4098c7926f20c3d74f2325144f0cc815609e7356ae4f0c19d22a

SHA512
dc44cf54b9c4ebca1f2e95155763c553038f3fe8ebce1187a886a2f631194413cc4ea11d8dbafb59f23c6c74939b4fa5918f152a8ab8ce37348631b8cb827386

Download Submit
\Windows\system\TkmUOyA.exe

Filesize
1.8MB

MD5
6946b4692703605987c47284ee269b28

SHA1
313f81f10b15341b378317e6a9e5beac2e3d8d9c

SHA256
8234f6252d7fc77841a7ffbe586e5f0b70d17613e209ccf8c954a5a4a4d7d71b

SHA512
97583ef29f73a35de8d55e4084b37a4098f02393339dcae3adf7ae4eb675161e7133c15bbff808a39187e791bb414e4659217450ed98f69ce7ccbbf11b793e97

Download Submit
\Windows\system\VenfHAv.exe

Filesize
1.8MB

MD5
d3ae3612e813ded5a78ec67c6d772d1c

SHA1
0d1a9f15e69b9625d9506f08a5ea7201748e049c

SHA256
39ef3bee1ca8ac056d332de5402516f1bab56cf2c75787102ed78c87606d4294

SHA512
6f13088a6e424d837d953713a1994c226b0ed2637797873a2f26de7a2b8cee8d2c7387d4c7e395422dac6154239971612394a86fba9ddb3e5bafb96a52ad8ffd

Download Submit
\Windows\system\XmQuTao.exe

Filesize
1.8MB

MD5
edf129b7ddfc17809bd0ab222d74d081

SHA1
7bdb75f38efabb2bc8f0d1bc39b674c54b251693

SHA256
219951e7970fd680ec980bc10613dff890a9045b3c4f717359a3a7c90d12723e

SHA512
97438c088dc064aaab50831cd68f5f320a8f5d3ee34193a92402b7c98c09111661642642e7663f99f0c9c5f4cb40ceb2e3e7b03f131b9c2035b7f27a1635b64a

Download Submit
\Windows\system\ZFSXcTL.exe

Filesize
1.8MB

MD5
ea1901c89790312d54c3fd5749c4de45

SHA1
977b1d8a234be3977d9807438d84e4b754b758b7

SHA256
80361809013d2873cf1bee0f785a23ea5f44a021090326f729471cade2de6215

SHA512
a2ffb8bdc8c34051ef8aaee8a3d94280d5d6d40c75972e5c6e8c40ec45535458bcb1c744428529cf7454511299f7f4cb9667f563940ea80f989db54330df7a94

Download Submit
\Windows\system\ZIWMSMZ.exe

Filesize
1.8MB

MD5
e440d3e144605276711fc10620ecc5ff

SHA1
b0a52ed2054cc0a77ae8f3a5bab9319d6e102593

SHA256
1f2f0754642a2b293c89b3e9705f87c8bb4c0eb2f67e2418efcc39b85be9ce2c

SHA512
1a94f0eb2a82b00df4aa6729abfd994b8843eb1bd98479db268210a8a01e23cc6a5b7ea2fd5b4a47503b935089b5ec0507f7199794379c0ac86a9559f9ca1eb1

Download Submit
\Windows\system\aMNnLXY.exe

Filesize
1.8MB

MD5
e090b1fe0612d6d8f226ed6b7db2300d

SHA1
b9d4718f35afd5e82d604b2496bb92ffa6080c45

SHA256
4718403b0c74ffdb50fa45885f7768d3a0fa3708a13b572e47d90dea8fe87de9

SHA512
66c0f83b4f95e03c561c69b1b6518e7a1b3f6a0471d9bb1ee46ae225f348f11e271d58a43ef507a17c04552461a53cd46756ad498c4c389e1a89085ba7187134

Download Submit
\Windows\system\cBuvdto.exe

Filesize
1.8MB

MD5
fd630bbb5290bd7cfe62ecf064e65ec4

SHA1
d6085c96f19ac46811fa66c12f2a297986a89d99

SHA256
19a40e294f93675641c7ab551d8141a8038fd389a7cf28d2b8f38dc48a145cbc

SHA512
85c219eb4f9df516077b5db5c8a83d572571b529c5decc2a4ad14155a28615c49d3931c007070040ffd629d91593bd9d562a795e26daedb003da6f113f5481e3

Download Submit
\Windows\system\dnhNTKi.exe

Filesize
1.8MB

MD5
fe0c0d7118eaa02dd022575c525ec7de

SHA1
e3c7748a12a2941751ad835d934ffb4d651fd850

SHA256
c138c82a94ac4e3e137f8a2aca5e69b26320d0a0c438e4c52f333049cbf5192a

SHA512
9514314372d7a2a50c0c3219f1ae504b6a8ec55c849d769132a7d5cc2ba56228d7681968f889f0528a77c1d00e4ccd42accd908a4e1463388886f17ea1e92947

Download Submit
\Windows\system\emsQADg.exe

Filesize
1.8MB

MD5
3c8a71decbaf76a29827fb75cd786057

SHA1
a583beefcf566381a4a49040b3401d05f4855638

SHA256
8f1ec6c0ee452bec78bffe4ede48ac78dc92d86b5cb8ffcf30f9bbf0ec00ce0e

SHA512
ee891a3356c93efc3ec2f3300542083c79c689c324632d033cd966ca5e34126bf5ebab148a484b0215c2d31ec2e8396b60a928d81aba0740c9aaa3cb1587cb8d

Download Submit
\Windows\system\fWMqpjw.exe

Filesize
1.8MB

MD5
543104d8a85e58aa029c1e25ca548db9

SHA1
cd957c49d23a76bda5931dc5adc93b10f70fee2f

SHA256
2bde47ef256239966eedab117f08bc35187c0f49d128a4bcb206c2c06793673d

SHA512
c9011be31a3a7e151a1560b7ac7f5243dd779296d66f46797f04c3674547aafd0e41324660edc11dbefe7dbcc208872e6183a5692a9c80ebafc798c4d4a0fb23

Download Submit
\Windows\system\mVoxcQP.exe

Filesize
1.8MB

MD5
f832e9a6fc8ad430765c27e5e34475d6

SHA1
80a04db4752670260bc05ec486450f7c7c73fa18

SHA256
0dfcfe8294615c3972a7efdd1f16bd62bc7456adac537342a91d31f7bbc7c59c

SHA512
41589fea0eefdc25cdc23ed213db2ae50b59c0f9649944b41c75aad0976de9de58f2389ddb4975484cf5c0e3aeff9ac7b02fa4b7872f1bacced0b72eb9604536

Download Submit
\Windows\system\mttQNTM.exe

Filesize
1.8MB

MD5
0053d2ee3b156bf07c4299677e82857b

SHA1
6476f9aa6dbf2112d1f86734294506fbb2f30727

SHA256
d4e75a8cef78c7a822b3cdca0c34eada75af4e5c199035039e80c8a0accc36ce

SHA512
99cd6b101a5f881528bed896fd87a38a33c9fa6194efe5bc9f4515731c4ace5d1f3d96a2adbfad6c418b1a5b486442f7ecdf76a55185a217842bc48e01d420b0

Download Submit
\Windows\system\rVtamZk.exe

Filesize
1.8MB

MD5
04ed35a3e7cefef0e6e1f85ec48bfd6d

SHA1
6fb9efa44c32b6125362bc6956812407d8fc174a

SHA256
0f187fcc3b2d374520783a13033665df24dfc18c26b40a66b10b0153cbbcdd76

SHA512
b8d8b006ae0721855066198a89c05d9f581d2a5f5fd4605595e9865eff1ce7155e642fd7386c430380104f3a55b10c010c539043bba5f341b18f5d76583be903

Download Submit
\Windows\system\sQXrMmu.exe

Filesize
1.8MB

MD5
c539796a5cff029e671a909abbdb2bc3

SHA1
b074f21e54290103ee72c9a517513d3144fe6ec7

SHA256
4f1523eb988cc31fd9c51b9092de8038ddfbe238241f254b4b8216ce509c9fe1

SHA512
3086a55cf1da8ccb29b8c575bbde63abe7803ff854d80e5cb556c4c46207386b53f712fd2c3944b9f92ebc1af2b41dcc7a77a008c5af687e01db03a5154de930

Download Submit
\Windows\system\xYsukJF.exe

Filesize
1.8MB

MD5
ccb4d0d5136142f3274b12c5aca0f068

SHA1
034db1a1c914af28b1c7ec406593d30479fc000b

SHA256
95bf9bbf44f964f4b434f907914d87081dfa8260b0b17a3f3c0cde87ea30b83f

SHA512
dc749efc5a649d3641f4521a1bb10d04b027ccfef345c07d84697564ab4b9c3e04b0b1c6a1c745aa4eb12b17744a74f8846cb3f43c8101d5e5a4d78cb8a528e2

Download Submit
memory/1848-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1848-83-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/1848-72-0x0000000002EC0000-0x00000000032B2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-87-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/1848-67-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/1848-95-0x0000000002EC0000-0x00000000032B2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-88-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/1848-0-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/1848-84-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/1848-93-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-70-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/1848-71-0x0000000002EC0000-0x00000000032B2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-77-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/1848-75-0x0000000002EC0000-0x00000000032B2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-8-0x0000000002EC0000-0x00000000032B2000-memory.dmp

Filesize
3.9MB

Download
memory/2288-64-0x0000000001F60000-0x0000000001F68000-memory.dmp

Filesize
32KB

Download
memory/2288-61-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/2348-63-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2488-98-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2520-94-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-53-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2576-96-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2620-99-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2632-85-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2656-80-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2740-79-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download
memory/2744-74-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-100-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download