xmrig | e1077496aa0aaa730fe2d98380e8a426c9c1d7ab84939d0a6cf2857090706dd4

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
Size

2.2MB
MD5

0ecdaafc84d690a0dffd3834a9cd9fb9
SHA1

019fb45cd508c7bfebb11f5eea76bb7f1750c06b
SHA256

e1077496aa0aaa730fe2d98380e8a426c9c1d7ab84939d0a6cf2857090706dd4
SHA512

fc5ab20607e66da690b334502d848c690b94ca59fb8bdf4942a9d5b3734e7808ddba04a135835a54fbf4cb8456fe432e1e7bce19c56eb5c2cb8408f9547ea309
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrf3h:NABC

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral1/memory/2556-173-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig
behavioral1/memory/2628-180-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2748-178-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2796-174-0x000000013FF10000-0x0000000140302000-memory.dmp	xmrig
behavioral1/memory/2592-172-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/1732-171-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2164-141-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/3024-104-0x000000013F640000-0x000000013FA32000-memory.dmp	xmrig
behavioral1/memory/2216-20-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	xmrig
behavioral1/memory/2748-4402-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2164-4437-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/2628-4451-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2556-4448-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig
behavioral1/memory/2592-4445-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2796-4444-0x000000013FF10000-0x0000000140302000-memory.dmp	xmrig
behavioral1/memory/3024-4442-0x000000013F640000-0x000000013FA32000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2132	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2216	AjTkIol.exe
2748	FbREYPY.exe
3024	KwKqHyM.exe
2164	hsfhcmz.exe
1732	YSOfcDW.exe
2628	YvwCoRe.exe
2592	UQNcKum.exe
2556	MZFBLkK.exe
2796	SVNMKjf.exe
2672	anKygPf.exe
2484	swNYEjG.exe
2504	OlWensT.exe
2948	RHEwQtw.exe
2328	YObcLeU.exe
1212	nGoyjjC.exe
2724	PKmKFfq.exe
2812	VTrkvYw.exe
1888	JTWIEjq.exe
2416	ABPAoJp.exe
2624	oyhqctV.exe
1800	nmbdBkb.exe
1656	ajQnpic.exe
2452	lcOjGXx.exe
1220	UOexGWa.exe
2388	GcnKbVi.exe
2768	RTJqPZv.exe
2952	sKEjVhB.exe
2332	tKmLrAe.exe
2528	lzRnOTu.exe
2620	uKQFROP.exe
2780	EAXPleH.exe
1764	KzKcEyV.exe
1816	aXJuTkE.exe
1464	uZTIgaX.exe
836	dmjOTzO.exe
1612	qigpjBq.exe
1536	HKrKCgF.exe
1232	qLhvgJx.exe
568	sVLmHkM.exe
2904	jWtVqwi.exe
816	tuPVBrf.exe
2240	ucGcZLi.exe
1760	JxJfqAH.exe
2916	lDYECoy.exe
2188	SdRslmb.exe
1700	SuupEiH.exe
320	FvtIeIh.exe
2632	VfAeXca.exe
2648	ZyPjoCR.exe
2472	qJvxUne.exe
2496	aIymRvD.exe
2688	smFFXFg.exe
2692	hHngsyi.exe
2680	RkOPWmq.exe
584	TRCVfUI.exe
2612	EqmwaRq.exe
1088	osmFpLn.exe
2080	BgsQUKk.exe
284	SnWoIBp.exe
1696	DUvmCIZ.exe
2732	ZCetiGn.exe
1824	idkPzqS.exe
1936	bCkztSu.exe
3080	xmROTfZ.exe

Loads dropped DLL 64 IoCs

pid	Process
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe

UPX packed file 51 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2360-2-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/files/0x000a000000015f7a-6.dat	upx
behavioral1/files/0x0006000000016d57-54.dat	upx
behavioral1/files/0x0009000000016cc6-82.dat	upx
behavioral1/files/0x0006000000017407-161.dat	upx
behavioral1/memory/2556-173-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/files/0x0005000000018717-190.dat	upx
behavioral1/files/0x000d0000000185f4-188.dat	upx
behavioral1/files/0x0006000000019064-183.dat	upx
behavioral1/files/0x0007000000016d51-162.dat	upx
behavioral1/files/0x0006000000018fbf-127.dat	upx
behavioral1/files/0x0006000000018bab-119.dat	upx
behavioral1/files/0x0006000000017422-101.dat	upx
behavioral1/files/0x00060000000173f2-100.dat	upx
behavioral1/files/0x0006000000017374-99.dat	upx
behavioral1/files/0x000600000001735a-98.dat	upx
behavioral1/files/0x0006000000016e4a-97.dat	upx
behavioral1/files/0x00060000000174a5-93.dat	upx
behavioral1/memory/2628-180-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2748-178-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/2796-174-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/memory/2592-172-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/memory/1732-171-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/files/0x0006000000019052-170.dat	upx
behavioral1/files/0x000600000001737c-153.dat	upx
behavioral1/files/0x0006000000017371-151.dat	upx
behavioral1/files/0x0006000000016fed-149.dat	upx
behavioral1/files/0x000f000000005578-147.dat	upx
behavioral1/files/0x0006000000018ed8-146.dat	upx
behavioral1/files/0x0006000000018ba1-145.dat	upx
behavioral1/files/0x000500000001860c-144.dat	upx
behavioral1/files/0x00140000000185e9-143.dat	upx
behavioral1/memory/2164-141-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/files/0x0006000000016e24-133.dat	upx
behavioral1/files/0x0007000000016d1a-106.dat	upx
behavioral1/memory/3024-104-0x000000013F640000-0x000000013FA32000-memory.dmp	upx
behavioral1/files/0x0007000000016c7c-62.dat	upx
behavioral1/files/0x0007000000016d16-53.dat	upx
behavioral1/files/0x0008000000016ca5-52.dat	upx
behavioral1/files/0x0007000000016c04-46.dat	upx
behavioral1/files/0x0007000000016c51-26.dat	upx
behavioral1/files/0x0008000000016bfb-25.dat	upx
behavioral1/files/0x00090000000167d5-23.dat	upx
behavioral1/memory/2216-20-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	upx
behavioral1/memory/2748-4402-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/2164-4437-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/memory/2628-4451-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2556-4448-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/memory/2592-4445-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/memory/2796-4444-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/memory/3024-4442-0x000000013F640000-0x000000013FA32000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ebtIvIA.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\uissAXm.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\XLeuNYi.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\mwDcZJu.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\TChvUGK.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\ofuggSb.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\LmFPuTY.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\aLwmuan.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\WGkdNXV.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\sNBWYHE.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\LtwTPXm.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\ELelEPE.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\yslRcFH.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\tREqFna.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\xovcwJN.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\oEHEAdZ.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\hEzTOzq.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\DHyjjgy.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\RZAenBd.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\soyfjpM.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\jwuqKrp.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\KPDnvNM.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\SoGPHaq.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\TFnNUej.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\dKUJNzZ.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\moYTiqo.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\lcOjGXx.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\dLMtCdj.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\QzGECpv.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\AKqfpro.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\EPKOnXY.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\HFCcVuo.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\orBRsnA.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\rIFCgFw.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\ruxNJXm.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\JNWiaXk.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\vNvDnHQ.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\CpNwLDC.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\LYtghkw.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\uMWFRKy.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\RosMqjB.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\AYliBlQ.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\ZVzKgVc.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\ssFhLCE.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\XNhwaTY.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\VactZpb.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\WDskkRw.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\hvGmsgn.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\hsgxDus.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\IqxnRvF.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\ZdKuNQK.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\FnXfFdw.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\CzKmwOL.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\zIdMlyX.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\VJfzcTA.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\LDomrDP.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\dkHoZDZ.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\xcPPtdK.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\ZOcswGI.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\UKpgsnP.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\AfpkXME.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\MrMfdry.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\sAQrNdl.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
File created	C:\Windows\System\jWpYlvY.exe	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2132	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
Token: SeDebugPrivilege	2132	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2132	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	29
PID 2360 wrote to memory of 2132	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	29
PID 2360 wrote to memory of 2132	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	29
PID 2360 wrote to memory of 2216	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	30
PID 2360 wrote to memory of 2216	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	30
PID 2360 wrote to memory of 2216	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	30
PID 2360 wrote to memory of 2748	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	31
PID 2360 wrote to memory of 2748	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	31
PID 2360 wrote to memory of 2748	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	31
PID 2360 wrote to memory of 3024	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	32
PID 2360 wrote to memory of 3024	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	32
PID 2360 wrote to memory of 3024	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	32
PID 2360 wrote to memory of 1732	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	33
PID 2360 wrote to memory of 1732	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	33
PID 2360 wrote to memory of 1732	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	33
PID 2360 wrote to memory of 2164	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	34
PID 2360 wrote to memory of 2164	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	34
PID 2360 wrote to memory of 2164	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	34
PID 2360 wrote to memory of 2796	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	35
PID 2360 wrote to memory of 2796	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	35
PID 2360 wrote to memory of 2796	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	35
PID 2360 wrote to memory of 2628	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	36
PID 2360 wrote to memory of 2628	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	36
PID 2360 wrote to memory of 2628	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	36
PID 2360 wrote to memory of 2672	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	37
PID 2360 wrote to memory of 2672	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	37
PID 2360 wrote to memory of 2672	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	37
PID 2360 wrote to memory of 2592	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	38
PID 2360 wrote to memory of 2592	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	38
PID 2360 wrote to memory of 2592	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	38
PID 2360 wrote to memory of 2724	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	39
PID 2360 wrote to memory of 2724	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	39
PID 2360 wrote to memory of 2724	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	39
PID 2360 wrote to memory of 2556	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	40
PID 2360 wrote to memory of 2556	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	40
PID 2360 wrote to memory of 2556	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	40
PID 2360 wrote to memory of 2812	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	41
PID 2360 wrote to memory of 2812	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	41
PID 2360 wrote to memory of 2812	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	41
PID 2360 wrote to memory of 2484	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	42
PID 2360 wrote to memory of 2484	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	42
PID 2360 wrote to memory of 2484	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	42
PID 2360 wrote to memory of 2452	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	43
PID 2360 wrote to memory of 2452	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	43
PID 2360 wrote to memory of 2452	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	43
PID 2360 wrote to memory of 2504	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	44
PID 2360 wrote to memory of 2504	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	44
PID 2360 wrote to memory of 2504	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	44
PID 2360 wrote to memory of 1220	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	45
PID 2360 wrote to memory of 1220	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	45
PID 2360 wrote to memory of 1220	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	45
PID 2360 wrote to memory of 2948	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	46
PID 2360 wrote to memory of 2948	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	46
PID 2360 wrote to memory of 2948	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	46
PID 2360 wrote to memory of 2388	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	47
PID 2360 wrote to memory of 2388	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	47
PID 2360 wrote to memory of 2388	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	47
PID 2360 wrote to memory of 2328	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	48
PID 2360 wrote to memory of 2328	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	48
PID 2360 wrote to memory of 2328	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	48
PID 2360 wrote to memory of 2768	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	49
PID 2360 wrote to memory of 2768	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	49
PID 2360 wrote to memory of 2768	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	49
PID 2360 wrote to memory of 1212	2360	0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ecdaafc84d690a0dffd3834a9cd9fb9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2132
- C:\Windows\System\AjTkIol.exe
  C:\Windows\System\AjTkIol.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\FbREYPY.exe
  C:\Windows\System\FbREYPY.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\KwKqHyM.exe
  C:\Windows\System\KwKqHyM.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\YSOfcDW.exe
  C:\Windows\System\YSOfcDW.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\hsfhcmz.exe
  C:\Windows\System\hsfhcmz.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\SVNMKjf.exe
  C:\Windows\System\SVNMKjf.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\YvwCoRe.exe
  C:\Windows\System\YvwCoRe.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\anKygPf.exe
  C:\Windows\System\anKygPf.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\UQNcKum.exe
  C:\Windows\System\UQNcKum.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\PKmKFfq.exe
  C:\Windows\System\PKmKFfq.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\MZFBLkK.exe
  C:\Windows\System\MZFBLkK.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\VTrkvYw.exe
  C:\Windows\System\VTrkvYw.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\swNYEjG.exe
  C:\Windows\System\swNYEjG.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\lcOjGXx.exe
  C:\Windows\System\lcOjGXx.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\OlWensT.exe
  C:\Windows\System\OlWensT.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\UOexGWa.exe
  C:\Windows\System\UOexGWa.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\RHEwQtw.exe
  C:\Windows\System\RHEwQtw.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\GcnKbVi.exe
  C:\Windows\System\GcnKbVi.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\YObcLeU.exe
  C:\Windows\System\YObcLeU.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\RTJqPZv.exe
  C:\Windows\System\RTJqPZv.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\nGoyjjC.exe
  C:\Windows\System\nGoyjjC.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\tKmLrAe.exe
  C:\Windows\System\tKmLrAe.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\JTWIEjq.exe
  C:\Windows\System\JTWIEjq.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\lzRnOTu.exe
  C:\Windows\System\lzRnOTu.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\ABPAoJp.exe
  C:\Windows\System\ABPAoJp.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\uKQFROP.exe
  C:\Windows\System\uKQFROP.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\oyhqctV.exe
  C:\Windows\System\oyhqctV.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\EAXPleH.exe
  C:\Windows\System\EAXPleH.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\nmbdBkb.exe
  C:\Windows\System\nmbdBkb.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\aXJuTkE.exe
  C:\Windows\System\aXJuTkE.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\ajQnpic.exe
  C:\Windows\System\ajQnpic.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\uZTIgaX.exe
  C:\Windows\System\uZTIgaX.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\sKEjVhB.exe
  C:\Windows\System\sKEjVhB.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\dmjOTzO.exe
  C:\Windows\System\dmjOTzO.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\KzKcEyV.exe
  C:\Windows\System\KzKcEyV.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\HKrKCgF.exe
  C:\Windows\System\HKrKCgF.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\qigpjBq.exe
  C:\Windows\System\qigpjBq.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\qlAVBEG.exe
  C:\Windows\System\qlAVBEG.exe
  2⤵
  PID:864
- C:\Windows\System\qLhvgJx.exe
  C:\Windows\System\qLhvgJx.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\CFCvpVC.exe
  C:\Windows\System\CFCvpVC.exe
  2⤵
  PID:1132
- C:\Windows\System\sVLmHkM.exe
  C:\Windows\System\sVLmHkM.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\OpqrWFN.exe
  C:\Windows\System\OpqrWFN.exe
  2⤵
  PID:1580
- C:\Windows\System\jWtVqwi.exe
  C:\Windows\System\jWtVqwi.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\nheRZvW.exe
  C:\Windows\System\nheRZvW.exe
  2⤵
  PID:2112
- C:\Windows\System\tuPVBrf.exe
  C:\Windows\System\tuPVBrf.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\rFMmysX.exe
  C:\Windows\System\rFMmysX.exe
  2⤵
  PID:2208
- C:\Windows\System\ucGcZLi.exe
  C:\Windows\System\ucGcZLi.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\wXfdNwA.exe
  C:\Windows\System\wXfdNwA.exe
  2⤵
  PID:1016
- C:\Windows\System\JxJfqAH.exe
  C:\Windows\System\JxJfqAH.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\LFrhTmx.exe
  C:\Windows\System\LFrhTmx.exe
  2⤵
  PID:2372
- C:\Windows\System\lDYECoy.exe
  C:\Windows\System\lDYECoy.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\pKDhDFN.exe
  C:\Windows\System\pKDhDFN.exe
  2⤵
  PID:2912
- C:\Windows\System\SdRslmb.exe
  C:\Windows\System\SdRslmb.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\CAdsjzj.exe
  C:\Windows\System\CAdsjzj.exe
  2⤵
  PID:2520
- C:\Windows\System\SuupEiH.exe
  C:\Windows\System\SuupEiH.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\OskoQux.exe
  C:\Windows\System\OskoQux.exe
  2⤵
  PID:1600
- C:\Windows\System\FvtIeIh.exe
  C:\Windows\System\FvtIeIh.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\WSaeDlf.exe
  C:\Windows\System\WSaeDlf.exe
  2⤵
  PID:2544
- C:\Windows\System\VfAeXca.exe
  C:\Windows\System\VfAeXca.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\jvzJYFH.exe
  C:\Windows\System\jvzJYFH.exe
  2⤵
  PID:2464
- C:\Windows\System\ZyPjoCR.exe
  C:\Windows\System\ZyPjoCR.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\jjJJzgT.exe
  C:\Windows\System\jjJJzgT.exe
  2⤵
  PID:2720
- C:\Windows\System\qJvxUne.exe
  C:\Windows\System\qJvxUne.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\FAkNRps.exe
  C:\Windows\System\FAkNRps.exe
  2⤵
  PID:2964
- C:\Windows\System\aIymRvD.exe
  C:\Windows\System\aIymRvD.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\zimTJrL.exe
  C:\Windows\System\zimTJrL.exe
  2⤵
  PID:2560
- C:\Windows\System\smFFXFg.exe
  C:\Windows\System\smFFXFg.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\Pstefll.exe
  C:\Windows\System\Pstefll.exe
  2⤵
  PID:2184
- C:\Windows\System\hHngsyi.exe
  C:\Windows\System\hHngsyi.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\ZTFqmCS.exe
  C:\Windows\System\ZTFqmCS.exe
  2⤵
  PID:1900
- C:\Windows\System\RkOPWmq.exe
  C:\Windows\System\RkOPWmq.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\zrWNKMy.exe
  C:\Windows\System\zrWNKMy.exe
  2⤵
  PID:2808
- C:\Windows\System\TRCVfUI.exe
  C:\Windows\System\TRCVfUI.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\JzElPwD.exe
  C:\Windows\System\JzElPwD.exe
  2⤵
  PID:956
- C:\Windows\System\EqmwaRq.exe
  C:\Windows\System\EqmwaRq.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\CMBMoxl.exe
  C:\Windows\System\CMBMoxl.exe
  2⤵
  PID:1736
- C:\Windows\System\osmFpLn.exe
  C:\Windows\System\osmFpLn.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\LoAbhUA.exe
  C:\Windows\System\LoAbhUA.exe
  2⤵
  PID:1416
- C:\Windows\System\BgsQUKk.exe
  C:\Windows\System\BgsQUKk.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\hOSZYzi.exe
  C:\Windows\System\hOSZYzi.exe
  2⤵
  PID:2264
- C:\Windows\System\SnWoIBp.exe
  C:\Windows\System\SnWoIBp.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\fUvBIBP.exe
  C:\Windows\System\fUvBIBP.exe
  2⤵
  PID:2120
- C:\Windows\System\DUvmCIZ.exe
  C:\Windows\System\DUvmCIZ.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\tupDvza.exe
  C:\Windows\System\tupDvza.exe
  2⤵
  PID:2996
- C:\Windows\System\ZCetiGn.exe
  C:\Windows\System\ZCetiGn.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\nrULflA.exe
  C:\Windows\System\nrULflA.exe
  2⤵
  PID:2440
- C:\Windows\System\idkPzqS.exe
  C:\Windows\System\idkPzqS.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\uFIlIYv.exe
  C:\Windows\System\uFIlIYv.exe
  2⤵
  PID:2272
- C:\Windows\System\bCkztSu.exe
  C:\Windows\System\bCkztSu.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\gCRgUJc.exe
  C:\Windows\System\gCRgUJc.exe
  2⤵
  PID:2116
- C:\Windows\System\xmROTfZ.exe
  C:\Windows\System\xmROTfZ.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\tppNCuj.exe
  C:\Windows\System\tppNCuj.exe
  2⤵
  PID:3096
- C:\Windows\System\jYCbfVD.exe
  C:\Windows\System\jYCbfVD.exe
  2⤵
  PID:3112
- C:\Windows\System\tLlgrLq.exe
  C:\Windows\System\tLlgrLq.exe
  2⤵
  PID:3128
- C:\Windows\System\wRcPdBF.exe
  C:\Windows\System\wRcPdBF.exe
  2⤵
  PID:3144
- C:\Windows\System\mvVfdKB.exe
  C:\Windows\System\mvVfdKB.exe
  2⤵
  PID:3160
- C:\Windows\System\OYmybii.exe
  C:\Windows\System\OYmybii.exe
  2⤵
  PID:3176
- C:\Windows\System\Hawzymt.exe
  C:\Windows\System\Hawzymt.exe
  2⤵
  PID:3192
- C:\Windows\System\lzVhKwK.exe
  C:\Windows\System\lzVhKwK.exe
  2⤵
  PID:3208
- C:\Windows\System\iVsxqDr.exe
  C:\Windows\System\iVsxqDr.exe
  2⤵
  PID:3224
- C:\Windows\System\AtqBTVD.exe
  C:\Windows\System\AtqBTVD.exe
  2⤵
  PID:3240
- C:\Windows\System\OnnYGZt.exe
  C:\Windows\System\OnnYGZt.exe
  2⤵
  PID:3256
- C:\Windows\System\JTzPOmm.exe
  C:\Windows\System\JTzPOmm.exe
  2⤵
  PID:3272
- C:\Windows\System\wHeTtsF.exe
  C:\Windows\System\wHeTtsF.exe
  2⤵
  PID:3288
- C:\Windows\System\BosVTBP.exe
  C:\Windows\System\BosVTBP.exe
  2⤵
  PID:3304
- C:\Windows\System\TOdmEgg.exe
  C:\Windows\System\TOdmEgg.exe
  2⤵
  PID:3320
- C:\Windows\System\WCjsQhw.exe
  C:\Windows\System\WCjsQhw.exe
  2⤵
  PID:3336
- C:\Windows\System\CBUUIDw.exe
  C:\Windows\System\CBUUIDw.exe
  2⤵
  PID:3352
- C:\Windows\System\FYztsep.exe
  C:\Windows\System\FYztsep.exe
  2⤵
  PID:3368
- C:\Windows\System\LPWIIVz.exe
  C:\Windows\System\LPWIIVz.exe
  2⤵
  PID:3384
- C:\Windows\System\BvGrzfj.exe
  C:\Windows\System\BvGrzfj.exe
  2⤵
  PID:3400
- C:\Windows\System\YLAdjRW.exe
  C:\Windows\System\YLAdjRW.exe
  2⤵
  PID:3416
- C:\Windows\System\ampHjmL.exe
  C:\Windows\System\ampHjmL.exe
  2⤵
  PID:3432
- C:\Windows\System\YrvaSdm.exe
  C:\Windows\System\YrvaSdm.exe
  2⤵
  PID:3448
- C:\Windows\System\ejXwahI.exe
  C:\Windows\System\ejXwahI.exe
  2⤵
  PID:3464
- C:\Windows\System\kqVwERc.exe
  C:\Windows\System\kqVwERc.exe
  2⤵
  PID:3480
- C:\Windows\System\rJNiISu.exe
  C:\Windows\System\rJNiISu.exe
  2⤵
  PID:3496
- C:\Windows\System\Emzgnap.exe
  C:\Windows\System\Emzgnap.exe
  2⤵
  PID:3512
- C:\Windows\System\AHwYmRb.exe
  C:\Windows\System\AHwYmRb.exe
  2⤵
  PID:3528
- C:\Windows\System\gLWBwaX.exe
  C:\Windows\System\gLWBwaX.exe
  2⤵
  PID:3544
- C:\Windows\System\SiiaqvU.exe
  C:\Windows\System\SiiaqvU.exe
  2⤵
  PID:3560
- C:\Windows\System\nJZtqwG.exe
  C:\Windows\System\nJZtqwG.exe
  2⤵
  PID:3576
- C:\Windows\System\EuWibGA.exe
  C:\Windows\System\EuWibGA.exe
  2⤵
  PID:3592
- C:\Windows\System\uqRbAUl.exe
  C:\Windows\System\uqRbAUl.exe
  2⤵
  PID:3608
- C:\Windows\System\pSmjXFi.exe
  C:\Windows\System\pSmjXFi.exe
  2⤵
  PID:3624
- C:\Windows\System\nSqylrS.exe
  C:\Windows\System\nSqylrS.exe
  2⤵
  PID:3640
- C:\Windows\System\QgqxtMd.exe
  C:\Windows\System\QgqxtMd.exe
  2⤵
  PID:3656
- C:\Windows\System\PJTTWiU.exe
  C:\Windows\System\PJTTWiU.exe
  2⤵
  PID:3672
- C:\Windows\System\UymfrZk.exe
  C:\Windows\System\UymfrZk.exe
  2⤵
  PID:3692
- C:\Windows\System\yzHKiAS.exe
  C:\Windows\System\yzHKiAS.exe
  2⤵
  PID:3708
- C:\Windows\System\YMexTyJ.exe
  C:\Windows\System\YMexTyJ.exe
  2⤵
  PID:3724
- C:\Windows\System\OLxujeq.exe
  C:\Windows\System\OLxujeq.exe
  2⤵
  PID:3740
- C:\Windows\System\xKOEAHd.exe
  C:\Windows\System\xKOEAHd.exe
  2⤵
  PID:3756
- C:\Windows\System\wGGyolw.exe
  C:\Windows\System\wGGyolw.exe
  2⤵
  PID:3772
- C:\Windows\System\aeNnyeQ.exe
  C:\Windows\System\aeNnyeQ.exe
  2⤵
  PID:3788
- C:\Windows\System\FqlPMOc.exe
  C:\Windows\System\FqlPMOc.exe
  2⤵
  PID:3804
- C:\Windows\System\FyovKhB.exe
  C:\Windows\System\FyovKhB.exe
  2⤵
  PID:3820
- C:\Windows\System\QnwfNHk.exe
  C:\Windows\System\QnwfNHk.exe
  2⤵
  PID:3840
- C:\Windows\System\BSZnYLb.exe
  C:\Windows\System\BSZnYLb.exe
  2⤵
  PID:3856
- C:\Windows\System\mWAXCMH.exe
  C:\Windows\System\mWAXCMH.exe
  2⤵
  PID:3872
- C:\Windows\System\VUGTGoO.exe
  C:\Windows\System\VUGTGoO.exe
  2⤵
  PID:3888
- C:\Windows\System\NJaMXgB.exe
  C:\Windows\System\NJaMXgB.exe
  2⤵
  PID:3904
- C:\Windows\System\wgXEmCR.exe
  C:\Windows\System\wgXEmCR.exe
  2⤵
  PID:3920
- C:\Windows\System\zittOwS.exe
  C:\Windows\System\zittOwS.exe
  2⤵
  PID:3936
- C:\Windows\System\fdshapU.exe
  C:\Windows\System\fdshapU.exe
  2⤵
  PID:3952
- C:\Windows\System\qYWDtCm.exe
  C:\Windows\System\qYWDtCm.exe
  2⤵
  PID:3968
- C:\Windows\System\sFNLwfn.exe
  C:\Windows\System\sFNLwfn.exe
  2⤵
  PID:3984
- C:\Windows\System\AjUDNwA.exe
  C:\Windows\System\AjUDNwA.exe
  2⤵
  PID:4000
- C:\Windows\System\oSWAhuR.exe
  C:\Windows\System\oSWAhuR.exe
  2⤵
  PID:4016
- C:\Windows\System\JdQEgVt.exe
  C:\Windows\System\JdQEgVt.exe
  2⤵
  PID:4032
- C:\Windows\System\eselIZc.exe
  C:\Windows\System\eselIZc.exe
  2⤵
  PID:4048
- C:\Windows\System\QmKkeTd.exe
  C:\Windows\System\QmKkeTd.exe
  2⤵
  PID:4064
- C:\Windows\System\xcZFgtr.exe
  C:\Windows\System\xcZFgtr.exe
  2⤵
  PID:4080
- C:\Windows\System\whZAqRx.exe
  C:\Windows\System\whZAqRx.exe
  2⤵
  PID:1992
- C:\Windows\System\TkQKWCa.exe
  C:\Windows\System\TkQKWCa.exe
  2⤵
  PID:904
- C:\Windows\System\RzrelAZ.exe
  C:\Windows\System\RzrelAZ.exe
  2⤵
  PID:3120
- C:\Windows\System\gChIMGZ.exe
  C:\Windows\System\gChIMGZ.exe
  2⤵
  PID:3056
- C:\Windows\System\jFaExGP.exe
  C:\Windows\System\jFaExGP.exe
  2⤵
  PID:3220
- C:\Windows\System\OkxYjvM.exe
  C:\Windows\System\OkxYjvM.exe
  2⤵
  PID:3280
- C:\Windows\System\fvRuuXQ.exe
  C:\Windows\System\fvRuuXQ.exe
  2⤵
  PID:3028
- C:\Windows\System\krgfOZu.exe
  C:\Windows\System\krgfOZu.exe
  2⤵
  PID:3376
- C:\Windows\System\DhrgFlw.exe
  C:\Windows\System\DhrgFlw.exe
  2⤵
  PID:2852
- C:\Windows\System\BauvQjr.exe
  C:\Windows\System\BauvQjr.exe
  2⤵
  PID:2644
- C:\Windows\System\YUeHHWD.exe
  C:\Windows\System\YUeHHWD.exe
  2⤵
  PID:3504
- C:\Windows\System\AHKUDTB.exe
  C:\Windows\System\AHKUDTB.exe
  2⤵
  PID:1372
- C:\Windows\System\EqfFURe.exe
  C:\Windows\System\EqfFURe.exe
  2⤵
  PID:1996
- C:\Windows\System\MwzetdS.exe
  C:\Windows\System\MwzetdS.exe
  2⤵
  PID:1660
- C:\Windows\System\PcwoApw.exe
  C:\Windows\System\PcwoApw.exe
  2⤵
  PID:1692
- C:\Windows\System\VIrfEut.exe
  C:\Windows\System\VIrfEut.exe
  2⤵
  PID:2888
- C:\Windows\System\NaPRxnc.exe
  C:\Windows\System\NaPRxnc.exe
  2⤵
  PID:4104
- C:\Windows\System\uFsPCLz.exe
  C:\Windows\System\uFsPCLz.exe
  2⤵
  PID:4120
- C:\Windows\System\klwNOyc.exe
  C:\Windows\System\klwNOyc.exe
  2⤵
  PID:4136
- C:\Windows\System\cRGxTuI.exe
  C:\Windows\System\cRGxTuI.exe
  2⤵
  PID:4152
- C:\Windows\System\HTUNEpG.exe
  C:\Windows\System\HTUNEpG.exe
  2⤵
  PID:4168
- C:\Windows\System\sIfwOlC.exe
  C:\Windows\System\sIfwOlC.exe
  2⤵
  PID:4184
- C:\Windows\System\KuUlBsl.exe
  C:\Windows\System\KuUlBsl.exe
  2⤵
  PID:4200
- C:\Windows\System\bsSqtLp.exe
  C:\Windows\System\bsSqtLp.exe
  2⤵
  PID:4216
- C:\Windows\System\MoxCNxF.exe
  C:\Windows\System\MoxCNxF.exe
  2⤵
  PID:4232
- C:\Windows\System\vCQLyWK.exe
  C:\Windows\System\vCQLyWK.exe
  2⤵
  PID:4248
- C:\Windows\System\AQPFPbV.exe
  C:\Windows\System\AQPFPbV.exe
  2⤵
  PID:4264
- C:\Windows\System\BkjNeDC.exe
  C:\Windows\System\BkjNeDC.exe
  2⤵
  PID:4280
- C:\Windows\System\msIzdDN.exe
  C:\Windows\System\msIzdDN.exe
  2⤵
  PID:4296
- C:\Windows\System\HkutpbL.exe
  C:\Windows\System\HkutpbL.exe
  2⤵
  PID:4312
- C:\Windows\System\LmnJTnF.exe
  C:\Windows\System\LmnJTnF.exe
  2⤵
  PID:4328
- C:\Windows\System\CXcygKS.exe
  C:\Windows\System\CXcygKS.exe
  2⤵
  PID:4344
- C:\Windows\System\KgORYFi.exe
  C:\Windows\System\KgORYFi.exe
  2⤵
  PID:4360
- C:\Windows\System\hcmeGiP.exe
  C:\Windows\System\hcmeGiP.exe
  2⤵
  PID:4380
- C:\Windows\System\AfwHqiZ.exe
  C:\Windows\System\AfwHqiZ.exe
  2⤵
  PID:4396
- C:\Windows\System\XFTzVJY.exe
  C:\Windows\System\XFTzVJY.exe
  2⤵
  PID:4412
- C:\Windows\System\vWPJqFp.exe
  C:\Windows\System\vWPJqFp.exe
  2⤵
  PID:4428
- C:\Windows\System\NDBoAkI.exe
  C:\Windows\System\NDBoAkI.exe
  2⤵
  PID:4444
- C:\Windows\System\vtwaTnF.exe
  C:\Windows\System\vtwaTnF.exe
  2⤵
  PID:4460
- C:\Windows\System\adDFPKr.exe
  C:\Windows\System\adDFPKr.exe
  2⤵
  PID:4476
- C:\Windows\System\jspFvWJ.exe
  C:\Windows\System\jspFvWJ.exe
  2⤵
  PID:4492
- C:\Windows\System\ZpTIbwX.exe
  C:\Windows\System\ZpTIbwX.exe
  2⤵
  PID:4508
- C:\Windows\System\skJQCbm.exe
  C:\Windows\System\skJQCbm.exe
  2⤵
  PID:4524
- C:\Windows\System\LfwDjtp.exe
  C:\Windows\System\LfwDjtp.exe
  2⤵
  PID:4704
- C:\Windows\System\uRMUHmx.exe
  C:\Windows\System\uRMUHmx.exe
  2⤵
  PID:4720
- C:\Windows\System\SiBcUlt.exe
  C:\Windows\System\SiBcUlt.exe
  2⤵
  PID:4736
- C:\Windows\System\ixrWOeM.exe
  C:\Windows\System\ixrWOeM.exe
  2⤵
  PID:4752
- C:\Windows\System\jRjoiAo.exe
  C:\Windows\System\jRjoiAo.exe
  2⤵
  PID:4768
- C:\Windows\System\eTzWqDS.exe
  C:\Windows\System\eTzWqDS.exe
  2⤵
  PID:4784
- C:\Windows\System\IxzZuSM.exe
  C:\Windows\System\IxzZuSM.exe
  2⤵
  PID:4800
- C:\Windows\System\uaAzDXx.exe
  C:\Windows\System\uaAzDXx.exe
  2⤵
  PID:4816
- C:\Windows\System\NPoJfTN.exe
  C:\Windows\System\NPoJfTN.exe
  2⤵
  PID:4832
- C:\Windows\System\DkJkJPB.exe
  C:\Windows\System\DkJkJPB.exe
  2⤵
  PID:4848
- C:\Windows\System\DVLKjeo.exe
  C:\Windows\System\DVLKjeo.exe
  2⤵
  PID:4864
- C:\Windows\System\jcutErX.exe
  C:\Windows\System\jcutErX.exe
  2⤵
  PID:4880
- C:\Windows\System\ErLFhAq.exe
  C:\Windows\System\ErLFhAq.exe
  2⤵
  PID:4896
- C:\Windows\System\OjTzNoU.exe
  C:\Windows\System\OjTzNoU.exe
  2⤵
  PID:4912
- C:\Windows\System\XSytpTi.exe
  C:\Windows\System\XSytpTi.exe
  2⤵
  PID:4928
- C:\Windows\System\joVNtFZ.exe
  C:\Windows\System\joVNtFZ.exe
  2⤵
  PID:4944
- C:\Windows\System\ZkOCLsj.exe
  C:\Windows\System\ZkOCLsj.exe
  2⤵
  PID:4960
- C:\Windows\System\nQgATwU.exe
  C:\Windows\System\nQgATwU.exe
  2⤵
  PID:4976
- C:\Windows\System\KohaqvU.exe
  C:\Windows\System\KohaqvU.exe
  2⤵
  PID:4992
- C:\Windows\System\kviWTaD.exe
  C:\Windows\System\kviWTaD.exe
  2⤵
  PID:5008
- C:\Windows\System\PfnUJsl.exe
  C:\Windows\System\PfnUJsl.exe
  2⤵
  PID:5024
- C:\Windows\System\SDkIsSv.exe
  C:\Windows\System\SDkIsSv.exe
  2⤵
  PID:5040
- C:\Windows\System\yimWVLX.exe
  C:\Windows\System\yimWVLX.exe
  2⤵
  PID:5056
- C:\Windows\System\FXqFyNz.exe
  C:\Windows\System\FXqFyNz.exe
  2⤵
  PID:5072
- C:\Windows\System\qiZuMln.exe
  C:\Windows\System\qiZuMln.exe
  2⤵
  PID:1756
- C:\Windows\System\AIgKEEX.exe
  C:\Windows\System\AIgKEEX.exe
  2⤵
  PID:2084
- C:\Windows\System\jZvwDtF.exe
  C:\Windows\System\jZvwDtF.exe
  2⤵
  PID:1216
- C:\Windows\System\dLMtCdj.exe
  C:\Windows\System\dLMtCdj.exe
  2⤵
  PID:276
- C:\Windows\System\COfrGwB.exe
  C:\Windows\System\COfrGwB.exe
  2⤵
  PID:2096
- C:\Windows\System\tgFpLRo.exe
  C:\Windows\System\tgFpLRo.exe
  2⤵
  PID:1920
- C:\Windows\System\jYxdRTl.exe
  C:\Windows\System\jYxdRTl.exe
  2⤵
  PID:3540
- C:\Windows\System\StBCPgL.exe
  C:\Windows\System\StBCPgL.exe
  2⤵
  PID:3600
- C:\Windows\System\NgxoiGj.exe
  C:\Windows\System\NgxoiGj.exe
  2⤵
  PID:1896
- C:\Windows\System\rvHUQwi.exe
  C:\Windows\System\rvHUQwi.exe
  2⤵
  PID:3140
- C:\Windows\System\mSDCVkE.exe
  C:\Windows\System\mSDCVkE.exe
  2⤵
  PID:3332
- C:\Windows\System\YRFVwXE.exe
  C:\Windows\System\YRFVwXE.exe
  2⤵
  PID:3424
- C:\Windows\System\EdFrPZd.exe
  C:\Windows\System\EdFrPZd.exe
  2⤵
  PID:3520
- C:\Windows\System\FNbzmbM.exe
  C:\Windows\System\FNbzmbM.exe
  2⤵
  PID:3588
- C:\Windows\System\oMrCQvz.exe
  C:\Windows\System\oMrCQvz.exe
  2⤵
  PID:3652
- C:\Windows\System\yLgNtkr.exe
  C:\Windows\System\yLgNtkr.exe
  2⤵
  PID:3716
- C:\Windows\System\ktAVWHr.exe
  C:\Windows\System\ktAVWHr.exe
  2⤵
  PID:3780
- C:\Windows\System\WQzgeHb.exe
  C:\Windows\System\WQzgeHb.exe
  2⤵
  PID:3848
- C:\Windows\System\yVpbPGp.exe
  C:\Windows\System\yVpbPGp.exe
  2⤵
  PID:3916
- C:\Windows\System\hZqlCXB.exe
  C:\Windows\System\hZqlCXB.exe
  2⤵
  PID:3980
- C:\Windows\System\cvzrFMK.exe
  C:\Windows\System\cvzrFMK.exe
  2⤵
  PID:4076
- C:\Windows\System\tcOIrxY.exe
  C:\Windows\System\tcOIrxY.exe
  2⤵
  PID:3704
- C:\Windows\System\fYcvRVt.exe
  C:\Windows\System\fYcvRVt.exe
  2⤵
  PID:3796
- C:\Windows\System\beWAwlJ.exe
  C:\Windows\System\beWAwlJ.exe
  2⤵
  PID:3836
- C:\Windows\System\cSDUstj.exe
  C:\Windows\System\cSDUstj.exe
  2⤵
  PID:3900
- C:\Windows\System\LECPhEL.exe
  C:\Windows\System\LECPhEL.exe
  2⤵
  PID:3964
- C:\Windows\System\BuiUixt.exe
  C:\Windows\System\BuiUixt.exe
  2⤵
  PID:4056
- C:\Windows\System\PkjuqRI.exe
  C:\Windows\System\PkjuqRI.exe
  2⤵
  PID:3088
- C:\Windows\System\RUqFLhi.exe
  C:\Windows\System\RUqFLhi.exe
  2⤵
  PID:3312
- C:\Windows\System\vaaBGaS.exe
  C:\Windows\System\vaaBGaS.exe
  2⤵
  PID:3472
- C:\Windows\System\vGxiEbP.exe
  C:\Windows\System\vGxiEbP.exe
  2⤵
  PID:752
- C:\Windows\System\iCDllLT.exe
  C:\Windows\System\iCDllLT.exe
  2⤵
  PID:4128
- C:\Windows\System\KvLzkrO.exe
  C:\Windows\System\KvLzkrO.exe
  2⤵
  PID:4192
- C:\Windows\System\aDtbYPF.exe
  C:\Windows\System\aDtbYPF.exe
  2⤵
  PID:4256
- C:\Windows\System\rURkgXx.exe
  C:\Windows\System\rURkgXx.exe
  2⤵
  PID:4456
- C:\Windows\System\JAoVrWH.exe
  C:\Windows\System\JAoVrWH.exe
  2⤵
  PID:4712
- C:\Windows\System\MqolkPc.exe
  C:\Windows\System\MqolkPc.exe
  2⤵
  PID:4748
- C:\Windows\System\hcvgTFu.exe
  C:\Windows\System\hcvgTFu.exe
  2⤵
  PID:1768
- C:\Windows\System\kJaEmCh.exe
  C:\Windows\System\kJaEmCh.exe
  2⤵
  PID:4808
- C:\Windows\System\OhWlObN.exe
  C:\Windows\System\OhWlObN.exe
  2⤵
  PID:4844
- C:\Windows\System\TgEDKIW.exe
  C:\Windows\System\TgEDKIW.exe
  2⤵
  PID:1872
- C:\Windows\System\xCPsETV.exe
  C:\Windows\System\xCPsETV.exe
  2⤵
  PID:4972
- C:\Windows\System\enhEsHI.exe
  C:\Windows\System\enhEsHI.exe
  2⤵
  PID:5036
- C:\Windows\System\jrrhruc.exe
  C:\Windows\System\jrrhruc.exe
  2⤵
  PID:3392
- C:\Windows\System\dYiHwnu.exe
  C:\Windows\System\dYiHwnu.exe
  2⤵
  PID:1668
- C:\Windows\System\BhplLwJ.exe
  C:\Windows\System\BhplLwJ.exe
  2⤵
  PID:1328
- C:\Windows\System\FjcMPiS.exe
  C:\Windows\System\FjcMPiS.exe
  2⤵
  PID:3248
- C:\Windows\System\mysihBF.exe
  C:\Windows\System\mysihBF.exe
  2⤵
  PID:3440
- C:\Windows\System\CFFPvmc.exe
  C:\Windows\System\CFFPvmc.exe
  2⤵
  PID:4112
- C:\Windows\System\dbINClv.exe
  C:\Windows\System\dbINClv.exe
  2⤵
  PID:2516
- C:\Windows\System\dfLusVR.exe
  C:\Windows\System\dfLusVR.exe
  2⤵
  PID:4208
- C:\Windows\System\NCudtzl.exe
  C:\Windows\System\NCudtzl.exe
  2⤵
  PID:4272
- C:\Windows\System\sTGbyCe.exe
  C:\Windows\System\sTGbyCe.exe
  2⤵
  PID:2508
- C:\Windows\System\wQsalME.exe
  C:\Windows\System\wQsalME.exe
  2⤵
  PID:4376
- C:\Windows\System\nNWiuQF.exe
  C:\Windows\System\nNWiuQF.exe
  2⤵
  PID:4440
- C:\Windows\System\azKNyUg.exe
  C:\Windows\System\azKNyUg.exe
  2⤵
  PID:4504
- C:\Windows\System\LlEdhGm.exe
  C:\Windows\System\LlEdhGm.exe
  2⤵
  PID:4544
- C:\Windows\System\UEEmXLK.exe
  C:\Windows\System\UEEmXLK.exe
  2⤵
  PID:4560
- C:\Windows\System\CRooZwA.exe
  C:\Windows\System\CRooZwA.exe
  2⤵
  PID:4576
- C:\Windows\System\ZytVkzD.exe
  C:\Windows\System\ZytVkzD.exe
  2⤵
  PID:4592
- C:\Windows\System\drlRbdX.exe
  C:\Windows\System\drlRbdX.exe
  2⤵
  PID:4608
- C:\Windows\System\RptQiha.exe
  C:\Windows\System\RptQiha.exe
  2⤵
  PID:3040
- C:\Windows\System\ofWebQi.exe
  C:\Windows\System\ofWebQi.exe
  2⤵
  PID:4632
- C:\Windows\System\ZMeyEyb.exe
  C:\Windows\System\ZMeyEyb.exe
  2⤵
  PID:4648
- C:\Windows\System\XqtgoVy.exe
  C:\Windows\System\XqtgoVy.exe
  2⤵
  PID:4664
- C:\Windows\System\pnDGZpl.exe
  C:\Windows\System\pnDGZpl.exe
  2⤵
  PID:4680
- C:\Windows\System\IaVCgGy.exe
  C:\Windows\System\IaVCgGy.exe
  2⤵
  PID:4696
- C:\Windows\System\eFJMOgD.exe
  C:\Windows\System\eFJMOgD.exe
  2⤵
  PID:4764
- C:\Windows\System\HzbYpWK.exe
  C:\Windows\System\HzbYpWK.exe
  2⤵
  PID:4828
- C:\Windows\System\YxSeNvd.exe
  C:\Windows\System\YxSeNvd.exe
  2⤵
  PID:4892
- C:\Windows\System\PqnaelD.exe
  C:\Windows\System\PqnaelD.exe
  2⤵
  PID:4956
- C:\Windows\System\YnIobdx.exe
  C:\Windows\System\YnIobdx.exe
  2⤵
  PID:5048
- C:\Windows\System\rwfkVGe.exe
  C:\Windows\System\rwfkVGe.exe
  2⤵
  PID:5080
- C:\Windows\System\lQYpavN.exe
  C:\Windows\System\lQYpavN.exe
  2⤵
  PID:2844
- C:\Windows\System\kVfBvOt.exe
  C:\Windows\System\kVfBvOt.exe
  2⤵
  PID:2088
- C:\Windows\System\XUIGWOw.exe
  C:\Windows\System\XUIGWOw.exe
  2⤵
  PID:2700
- C:\Windows\System\orBRsnA.exe
  C:\Windows\System\orBRsnA.exe
  2⤵
  PID:1060
- C:\Windows\System\HrauvVF.exe
  C:\Windows\System\HrauvVF.exe
  2⤵
  PID:2608
- C:\Windows\System\kxFJBYD.exe
  C:\Windows\System\kxFJBYD.exe
  2⤵
  PID:2744
- C:\Windows\System\fGcmWdE.exe
  C:\Windows\System\fGcmWdE.exe
  2⤵
  PID:2196
- C:\Windows\System\exYBshb.exe
  C:\Windows\System\exYBshb.exe
  2⤵
  PID:1948
- C:\Windows\System\yerURFL.exe
  C:\Windows\System\yerURFL.exe
  2⤵
  PID:696
- C:\Windows\System\sQIsyTq.exe
  C:\Windows\System\sQIsyTq.exe
  2⤵
  PID:2396
- C:\Windows\System\ROPNrnJ.exe
  C:\Windows\System\ROPNrnJ.exe
  2⤵
  PID:3136
- C:\Windows\System\UTZaXvC.exe
  C:\Windows\System\UTZaXvC.exe
  2⤵
  PID:3536
- C:\Windows\System\UIBpxno.exe
  C:\Windows\System\UIBpxno.exe
  2⤵
  PID:3200
- C:\Windows\System\UFPTQsF.exe
  C:\Windows\System\UFPTQsF.exe
  2⤵
  PID:3264
- C:\Windows\System\KxRxuef.exe
  C:\Windows\System\KxRxuef.exe
  2⤵
  PID:3328
- C:\Windows\System\tzWbWsI.exe
  C:\Windows\System\tzWbWsI.exe
  2⤵
  PID:3488
- C:\Windows\System\ANdaaUR.exe
  C:\Windows\System\ANdaaUR.exe
  2⤵
  PID:3556
- C:\Windows\System\yqdxkOZ.exe
  C:\Windows\System\yqdxkOZ.exe
  2⤵
  PID:3684
- C:\Windows\System\NFxfllD.exe
  C:\Windows\System\NFxfllD.exe
  2⤵
  PID:3812
- C:\Windows\System\hbohoqh.exe
  C:\Windows\System\hbohoqh.exe
  2⤵
  PID:3748
- C:\Windows\System\pfFpAFr.exe
  C:\Windows\System\pfFpAFr.exe
  2⤵
  PID:3752
- C:\Windows\System\TCmKWpD.exe
  C:\Windows\System\TCmKWpD.exe
  2⤵
  PID:3960
- C:\Windows\System\rVyRyTM.exe
  C:\Windows\System\rVyRyTM.exe
  2⤵
  PID:3408
- C:\Windows\System\zsqfuht.exe
  C:\Windows\System\zsqfuht.exe
  2⤵
  PID:3052
- C:\Windows\System\tlAmTUJ.exe
  C:\Windows\System\tlAmTUJ.exe
  2⤵
  PID:2064
- C:\Windows\System\seWPedY.exe
  C:\Windows\System\seWPedY.exe
  2⤵
  PID:3912
- C:\Windows\System\QeDlHRB.exe
  C:\Windows\System\QeDlHRB.exe
  2⤵
  PID:4040
- C:\Windows\System\RjKIvWt.exe
  C:\Windows\System\RjKIvWt.exe
  2⤵
  PID:3896
- C:\Windows\System\lHPDvFX.exe
  C:\Windows\System\lHPDvFX.exe
  2⤵
  PID:3188
- C:\Windows\System\MALshaj.exe
  C:\Windows\System\MALshaj.exe
  2⤵
  PID:2848
- C:\Windows\System\oIYjbNG.exe
  C:\Windows\System\oIYjbNG.exe
  2⤵
  PID:4288
- C:\Windows\System\hUHblZP.exe
  C:\Windows\System\hUHblZP.exe
  2⤵
  PID:3768
- C:\Windows\System\GtebPXf.exe
  C:\Windows\System\GtebPXf.exe
  2⤵
  PID:1236
- C:\Windows\System\WBayBRj.exe
  C:\Windows\System\WBayBRj.exe
  2⤵
  PID:1244
- C:\Windows\System\nseMvEM.exe
  C:\Windows\System\nseMvEM.exe
  2⤵
  PID:4392
- C:\Windows\System\OBeMPpG.exe
  C:\Windows\System\OBeMPpG.exe
  2⤵
  PID:4452
- C:\Windows\System\JLlozSY.exe
  C:\Windows\System\JLlozSY.exe
  2⤵
  PID:4516
- C:\Windows\System\oIPEhQh.exe
  C:\Windows\System\oIPEhQh.exe
  2⤵
  PID:4780
- C:\Windows\System\Ovlyseo.exe
  C:\Windows\System\Ovlyseo.exe
  2⤵
  PID:4940
- C:\Windows\System\AOUKLPE.exe
  C:\Windows\System\AOUKLPE.exe
  2⤵
  PID:2108
- C:\Windows\System\aMclcjc.exe
  C:\Windows\System\aMclcjc.exe
  2⤵
  PID:3036
- C:\Windows\System\DqAxIPW.exe
  C:\Windows\System\DqAxIPW.exe
  2⤵
  PID:4744
- C:\Windows\System\BXsNqYg.exe
  C:\Windows\System\BXsNqYg.exe
  2⤵
  PID:4908
- C:\Windows\System\UgKHMPd.exe
  C:\Windows\System\UgKHMPd.exe
  2⤵
  PID:5032
- C:\Windows\System\sFuBdQM.exe
  C:\Windows\System\sFuBdQM.exe
  2⤵
  PID:2016
- C:\Windows\System\FckUTSl.exe
  C:\Windows\System\FckUTSl.exe
  2⤵
  PID:4176
- C:\Windows\System\BnMDtfG.exe
  C:\Windows\System\BnMDtfG.exe
  2⤵
  PID:4436
- C:\Windows\System\fyUMXWJ.exe
  C:\Windows\System\fyUMXWJ.exe
  2⤵
  PID:4180
- C:\Windows\System\kuuBJtT.exe
  C:\Windows\System\kuuBJtT.exe
  2⤵
  PID:2596
- C:\Windows\System\aTMEXdl.exe
  C:\Windows\System\aTMEXdl.exe
  2⤵
  PID:2460
- C:\Windows\System\QxqMhZq.exe
  C:\Windows\System\QxqMhZq.exe
  2⤵
  PID:4604
- C:\Windows\System\iIMdfqf.exe
  C:\Windows\System\iIMdfqf.exe
  2⤵
  PID:2536
- C:\Windows\System\WZxIHEq.exe
  C:\Windows\System\WZxIHEq.exe
  2⤵
  PID:4572
- C:\Windows\System\ivFGRzg.exe
  C:\Windows\System\ivFGRzg.exe
  2⤵
  PID:4824
- C:\Windows\System\AlmdUFx.exe
  C:\Windows\System\AlmdUFx.exe
  2⤵
  PID:2436
- C:\Windows\System\glvfgml.exe
  C:\Windows\System\glvfgml.exe
  2⤵
  PID:4340
- C:\Windows\System\qYedjmC.exe
  C:\Windows\System\qYedjmC.exe
  2⤵
  PID:4500
- C:\Windows\System\dNMJryh.exe
  C:\Windows\System\dNMJryh.exe
  2⤵
  PID:776
- C:\Windows\System\YjJTaRg.exe
  C:\Windows\System\YjJTaRg.exe
  2⤵
  PID:1316
- C:\Windows\System\UpjooPp.exe
  C:\Windows\System\UpjooPp.exe
  2⤵
  PID:1752
- C:\Windows\System\duaDbmG.exe
  C:\Windows\System\duaDbmG.exe
  2⤵
  PID:5068
- C:\Windows\System\EKQgHnq.exe
  C:\Windows\System\EKQgHnq.exe
  2⤵
  PID:4676
- C:\Windows\System\aXwXemV.exe
  C:\Windows\System\aXwXemV.exe
  2⤵
  PID:1740
- C:\Windows\System\QwvkrOS.exe
  C:\Windows\System\QwvkrOS.exe
  2⤵
  PID:4988
- C:\Windows\System\ibdJFIG.exe
  C:\Windows\System\ibdJFIG.exe
  2⤵
  PID:1904
- C:\Windows\System\lipmDDl.exe
  C:\Windows\System\lipmDDl.exe
  2⤵
  PID:2580
- C:\Windows\System\XevDlKp.exe
  C:\Windows\System\XevDlKp.exe
  2⤵
  PID:3508
- C:\Windows\System\zjZZipW.exe
  C:\Windows\System\zjZZipW.exe
  2⤵
  PID:1428
- C:\Windows\System\rpftTzC.exe
  C:\Windows\System\rpftTzC.exe
  2⤵
  PID:3620
- C:\Windows\System\RypMSuE.exe
  C:\Windows\System\RypMSuE.exe
  2⤵
  PID:2752
- C:\Windows\System\JOqWoSh.exe
  C:\Windows\System\JOqWoSh.exe
  2⤵
  PID:2012
- C:\Windows\System\hXnFxJs.exe
  C:\Windows\System\hXnFxJs.exe
  2⤵
  PID:3880
- C:\Windows\System\kxXzKWl.exe
  C:\Windows\System\kxXzKWl.exe
  2⤵
  PID:4320
- C:\Windows\System\pwnEeeh.exe
  C:\Windows\System\pwnEeeh.exe
  2⤵
  PID:2696
- C:\Windows\System\oHLtwZy.exe
  C:\Windows\System\oHLtwZy.exe
  2⤵
  PID:4424
- C:\Windows\System\QdfDamc.exe
  C:\Windows\System\QdfDamc.exe
  2⤵
  PID:3076
- C:\Windows\System\kGnOSaI.exe
  C:\Windows\System\kGnOSaI.exe
  2⤵
  PID:3444
- C:\Windows\System\rCdXzZt.exe
  C:\Windows\System\rCdXzZt.exe
  2⤵
  PID:2404
- C:\Windows\System\gaiACqF.exe
  C:\Windows\System\gaiACqF.exe
  2⤵
  PID:2588
- C:\Windows\System\EjkyLcO.exe
  C:\Windows\System\EjkyLcO.exe
  2⤵
  PID:4692
- C:\Windows\System\kTZfVAV.exe
  C:\Windows\System\kTZfVAV.exe
  2⤵
  PID:4552
- C:\Windows\System\YzaBRxY.exe
  C:\Windows\System\YzaBRxY.exe
  2⤵
  PID:2020
- C:\Windows\System\xFaorVT.exe
  C:\Windows\System\xFaorVT.exe
  2⤵
  PID:4672
- C:\Windows\System\cKckXuu.exe
  C:\Windows\System\cKckXuu.exe
  2⤵
  PID:1556
- C:\Windows\System\ljyBlph.exe
  C:\Windows\System\ljyBlph.exe
  2⤵
  PID:3948
- C:\Windows\System\xhyOcoc.exe
  C:\Windows\System\xhyOcoc.exe
  2⤵
  PID:1032
- C:\Windows\System\olDrRiE.exe
  C:\Windows\System\olDrRiE.exe
  2⤵
  PID:2816
- C:\Windows\System\SYUvvdV.exe
  C:\Windows\System\SYUvvdV.exe
  2⤵
  PID:852
- C:\Windows\System\UQDPQHX.exe
  C:\Windows\System\UQDPQHX.exe
  2⤵
  PID:3572
- C:\Windows\System\QNXAOzT.exe
  C:\Windows\System\QNXAOzT.exe
  2⤵
  PID:3300
- C:\Windows\System\BMpsnyk.exe
  C:\Windows\System\BMpsnyk.exe
  2⤵
  PID:2664
- C:\Windows\System\hChcctw.exe
  C:\Windows\System\hChcctw.exe
  2⤵
  PID:2032
- C:\Windows\System\HequiKs.exe
  C:\Windows\System\HequiKs.exe
  2⤵
  PID:4092
- C:\Windows\System\eifcgPb.exe
  C:\Windows\System\eifcgPb.exe
  2⤵
  PID:4228
- C:\Windows\System\ZQugbHW.exe
  C:\Windows\System\ZQugbHW.exe
  2⤵
  PID:2784
- C:\Windows\System\cXcDQKN.exe
  C:\Windows\System\cXcDQKN.exe
  2⤵
  PID:4420
- C:\Windows\System\ckpvrWv.exe
  C:\Windows\System\ckpvrWv.exe
  2⤵
  PID:4840
- C:\Windows\System\pwbSnJv.exe
  C:\Windows\System\pwbSnJv.exe
  2⤵
  PID:4588
- C:\Windows\System\AAPfPea.exe
  C:\Windows\System\AAPfPea.exe
  2⤵
  PID:2024
- C:\Windows\System\DnGLQuJ.exe
  C:\Windows\System\DnGLQuJ.exe
  2⤵
  PID:4408
- C:\Windows\System\jUcnvRE.exe
  C:\Windows\System\jUcnvRE.exe
  2⤵
  PID:2408
- C:\Windows\System\IUdTxGs.exe
  C:\Windows\System\IUdTxGs.exe
  2⤵
  PID:4600
- C:\Windows\System\AeDlRmm.exe
  C:\Windows\System\AeDlRmm.exe
  2⤵
  PID:5052
- C:\Windows\System\caSYzhZ.exe
  C:\Windows\System\caSYzhZ.exe
  2⤵
  PID:1912
- C:\Windows\System\apQTLLk.exe
  C:\Windows\System\apQTLLk.exe
  2⤵
  PID:940
- C:\Windows\System\AGJZFgA.exe
  C:\Windows\System\AGJZFgA.exe
  2⤵
  PID:4100
- C:\Windows\System\yclVimr.exe
  C:\Windows\System\yclVimr.exe
  2⤵
  PID:1884
- C:\Windows\System\jmblwzv.exe
  C:\Windows\System\jmblwzv.exe
  2⤵
  PID:4540
- C:\Windows\System\ZNIwkqR.exe
  C:\Windows\System\ZNIwkqR.exe
  2⤵
  PID:4888
- C:\Windows\System\dOtyfNh.exe
  C:\Windows\System\dOtyfNh.exe
  2⤵
  PID:1296
- C:\Windows\System\XkiPWAX.exe
  C:\Windows\System\XkiPWAX.exe
  2⤵
  PID:1436
- C:\Windows\System\JuHzYfd.exe
  C:\Windows\System\JuHzYfd.exe
  2⤵
  PID:4700
- C:\Windows\System\JAXnlNK.exe
  C:\Windows\System\JAXnlNK.exe
  2⤵
  PID:2960
- C:\Windows\System\hiRTCEi.exe
  C:\Windows\System\hiRTCEi.exe
  2⤵
  PID:1780
- C:\Windows\System\EneDpEn.exe
  C:\Windows\System\EneDpEn.exe
  2⤵
  PID:676
- C:\Windows\System\LSQuRmG.exe
  C:\Windows\System\LSQuRmG.exe
  2⤵
  PID:1496
- C:\Windows\System\pFTkQIC.exe
  C:\Windows\System\pFTkQIC.exe
  2⤵
  PID:4640
- C:\Windows\System\TSWWXic.exe
  C:\Windows\System\TSWWXic.exe
  2⤵
  PID:3236
- C:\Windows\System\fIWLGcm.exe
  C:\Windows\System\fIWLGcm.exe
  2⤵
  PID:3552
- C:\Windows\System\sTQtsgl.exe
  C:\Windows\System\sTQtsgl.exe
  2⤵
  PID:3996
- C:\Windows\System\jetVfhN.exe
  C:\Windows\System\jetVfhN.exe
  2⤵
  PID:4308
- C:\Windows\System\dYbrfdC.exe
  C:\Windows\System\dYbrfdC.exe
  2⤵
  PID:3172
- C:\Windows\System\vUgruml.exe
  C:\Windows\System\vUgruml.exe
  2⤵
  PID:1944
- C:\Windows\System\cVAVejE.exe
  C:\Windows\System\cVAVejE.exe
  2⤵
  PID:4240
- C:\Windows\System\geYNgCY.exe
  C:\Windows\System\geYNgCY.exe
  2⤵
  PID:1532
- C:\Windows\System\LKwurju.exe
  C:\Windows\System\LKwurju.exe
  2⤵
  PID:2356
- C:\Windows\System\bjFBidp.exe
  C:\Windows\System\bjFBidp.exe
  2⤵
  PID:1524
- C:\Windows\System\SKKAGhG.exe
  C:\Windows\System\SKKAGhG.exe
  2⤵
  PID:1248
- C:\Windows\System\vnTCeEW.exe
  C:\Windows\System\vnTCeEW.exe
  2⤵
  PID:2604
- C:\Windows\System\ifixVHj.exe
  C:\Windows\System\ifixVHj.exe
  2⤵
  PID:4164
- C:\Windows\System\NUfoTUa.exe
  C:\Windows\System\NUfoTUa.exe
  2⤵
  PID:1528
- C:\Windows\System\inenKaD.exe
  C:\Windows\System\inenKaD.exe
  2⤵
  PID:5136
- C:\Windows\System\oBvtXrB.exe
  C:\Windows\System\oBvtXrB.exe
  2⤵
  PID:5152
- C:\Windows\System\AeEgCdd.exe
  C:\Windows\System\AeEgCdd.exe
  2⤵
  PID:5168
- C:\Windows\System\JHMcABT.exe
  C:\Windows\System\JHMcABT.exe
  2⤵
  PID:5184
- C:\Windows\System\idIWTtN.exe
  C:\Windows\System\idIWTtN.exe
  2⤵
  PID:5200
- C:\Windows\System\vpQIciK.exe
  C:\Windows\System\vpQIciK.exe
  2⤵
  PID:5216
- C:\Windows\System\PRmBwND.exe
  C:\Windows\System\PRmBwND.exe
  2⤵
  PID:5232
- C:\Windows\System\MCaysEz.exe
  C:\Windows\System\MCaysEz.exe
  2⤵
  PID:5248
- C:\Windows\System\vnmaPAp.exe
  C:\Windows\System\vnmaPAp.exe
  2⤵
  PID:5264
- C:\Windows\System\SEYcfXN.exe
  C:\Windows\System\SEYcfXN.exe
  2⤵
  PID:5280
- C:\Windows\System\TJZzdjy.exe
  C:\Windows\System\TJZzdjy.exe
  2⤵
  PID:5296
- C:\Windows\System\aLqhDxt.exe
  C:\Windows\System\aLqhDxt.exe
  2⤵
  PID:5312
- C:\Windows\System\cGhRBus.exe
  C:\Windows\System\cGhRBus.exe
  2⤵
  PID:5328
- C:\Windows\System\pSNeVaD.exe
  C:\Windows\System\pSNeVaD.exe
  2⤵
  PID:5344
- C:\Windows\System\RxDqXgq.exe
  C:\Windows\System\RxDqXgq.exe
  2⤵
  PID:5360
- C:\Windows\System\SNJdlXY.exe
  C:\Windows\System\SNJdlXY.exe
  2⤵
  PID:5376
- C:\Windows\System\KHIlXai.exe
  C:\Windows\System\KHIlXai.exe
  2⤵
  PID:5392
- C:\Windows\System\eWWJqWL.exe
  C:\Windows\System\eWWJqWL.exe
  2⤵
  PID:5408
- C:\Windows\System\EQBOdZa.exe
  C:\Windows\System\EQBOdZa.exe
  2⤵
  PID:5424
- C:\Windows\System\FHAkqMT.exe
  C:\Windows\System\FHAkqMT.exe
  2⤵
  PID:5440
- C:\Windows\System\yMEABtV.exe
  C:\Windows\System\yMEABtV.exe
  2⤵
  PID:5456
- C:\Windows\System\vNvnjKA.exe
  C:\Windows\System\vNvnjKA.exe
  2⤵
  PID:5472
- C:\Windows\System\oapPLTj.exe
  C:\Windows\System\oapPLTj.exe
  2⤵
  PID:5488
- C:\Windows\System\fYJPeUY.exe
  C:\Windows\System\fYJPeUY.exe
  2⤵
  PID:5504
- C:\Windows\System\leIPCiB.exe
  C:\Windows\System\leIPCiB.exe
  2⤵
  PID:5520
- C:\Windows\System\CzHKJdq.exe
  C:\Windows\System\CzHKJdq.exe
  2⤵
  PID:5536
- C:\Windows\System\mTeMqJL.exe
  C:\Windows\System\mTeMqJL.exe
  2⤵
  PID:5552
- C:\Windows\System\GIxzjst.exe
  C:\Windows\System\GIxzjst.exe
  2⤵
  PID:5568
- C:\Windows\System\FhIrBxo.exe
  C:\Windows\System\FhIrBxo.exe
  2⤵
  PID:5584
- C:\Windows\System\FYOypgz.exe
  C:\Windows\System\FYOypgz.exe
  2⤵
  PID:5600
- C:\Windows\System\EEFgXxL.exe
  C:\Windows\System\EEFgXxL.exe
  2⤵
  PID:5616
- C:\Windows\System\XbvmXGr.exe
  C:\Windows\System\XbvmXGr.exe
  2⤵
  PID:5632
- C:\Windows\System\LOnITzP.exe
  C:\Windows\System\LOnITzP.exe
  2⤵
  PID:5648
- C:\Windows\System\vApmbGA.exe
  C:\Windows\System\vApmbGA.exe
  2⤵
  PID:5664
- C:\Windows\System\RgZOeKw.exe
  C:\Windows\System\RgZOeKw.exe
  2⤵
  PID:5680
- C:\Windows\System\DKpywhu.exe
  C:\Windows\System\DKpywhu.exe
  2⤵
  PID:5700
- C:\Windows\System\qpbWOIu.exe
  C:\Windows\System\qpbWOIu.exe
  2⤵
  PID:5716
- C:\Windows\System\KsNXxnv.exe
  C:\Windows\System\KsNXxnv.exe
  2⤵
  PID:5732
- C:\Windows\System\NMXEMFS.exe
  C:\Windows\System\NMXEMFS.exe
  2⤵
  PID:5748
- C:\Windows\System\tHNSKVW.exe
  C:\Windows\System\tHNSKVW.exe
  2⤵
  PID:5764
- C:\Windows\System\qthpWTT.exe
  C:\Windows\System\qthpWTT.exe
  2⤵
  PID:5780
- C:\Windows\System\ExUcXVa.exe
  C:\Windows\System\ExUcXVa.exe
  2⤵
  PID:5796
- C:\Windows\System\qnkhXma.exe
  C:\Windows\System\qnkhXma.exe
  2⤵
  PID:5812
- C:\Windows\System\NGVisNS.exe
  C:\Windows\System\NGVisNS.exe
  2⤵
  PID:5828
- C:\Windows\System\QdhaJBS.exe
  C:\Windows\System\QdhaJBS.exe
  2⤵
  PID:5844
- C:\Windows\System\NUSPKFo.exe
  C:\Windows\System\NUSPKFo.exe
  2⤵
  PID:5860
- C:\Windows\System\byevDmB.exe
  C:\Windows\System\byevDmB.exe
  2⤵
  PID:5876
- C:\Windows\System\LEFLtQw.exe
  C:\Windows\System\LEFLtQw.exe
  2⤵
  PID:5892
- C:\Windows\System\nmEGUhL.exe
  C:\Windows\System\nmEGUhL.exe
  2⤵
  PID:5908
- C:\Windows\System\hUoUpey.exe
  C:\Windows\System\hUoUpey.exe
  2⤵
  PID:5924
- C:\Windows\System\hMqnkPn.exe
  C:\Windows\System\hMqnkPn.exe
  2⤵
  PID:5940
- C:\Windows\System\uQoyByK.exe
  C:\Windows\System\uQoyByK.exe
  2⤵
  PID:5956
- C:\Windows\System\RszEHYR.exe
  C:\Windows\System\RszEHYR.exe
  2⤵
  PID:5972
- C:\Windows\System\jVWsJXH.exe
  C:\Windows\System\jVWsJXH.exe
  2⤵
  PID:5988
- C:\Windows\System\BFwsxzK.exe
  C:\Windows\System\BFwsxzK.exe
  2⤵
  PID:6004
- C:\Windows\System\cImqNVf.exe
  C:\Windows\System\cImqNVf.exe
  2⤵
  PID:6020
- C:\Windows\System\gZWBBud.exe
  C:\Windows\System\gZWBBud.exe
  2⤵
  PID:6036
- C:\Windows\System\IBsyNfP.exe
  C:\Windows\System\IBsyNfP.exe
  2⤵
  PID:6052
- C:\Windows\System\EVOhHQC.exe
  C:\Windows\System\EVOhHQC.exe
  2⤵
  PID:6068
- C:\Windows\System\rcKRTkG.exe
  C:\Windows\System\rcKRTkG.exe
  2⤵
  PID:6084
- C:\Windows\System\FIrsbwv.exe
  C:\Windows\System\FIrsbwv.exe
  2⤵
  PID:6100
- C:\Windows\System\MUemhcp.exe
  C:\Windows\System\MUemhcp.exe
  2⤵
  PID:6116
- C:\Windows\System\jGNqomI.exe
  C:\Windows\System\jGNqomI.exe
  2⤵
  PID:6132
- C:\Windows\System\VRbxhuZ.exe
  C:\Windows\System\VRbxhuZ.exe
  2⤵
  PID:5128
- C:\Windows\System\oZrrIZC.exe
  C:\Windows\System\oZrrIZC.exe
  2⤵
  PID:5192
- C:\Windows\System\ytSoDID.exe
  C:\Windows\System\ytSoDID.exe
  2⤵
  PID:5196
- C:\Windows\System\MpqnrVT.exe
  C:\Windows\System\MpqnrVT.exe
  2⤵
  PID:5320
- C:\Windows\System\OWiwCUd.exe
  C:\Windows\System\OWiwCUd.exe
  2⤵
  PID:5384
- C:\Windows\System\UesyQbO.exe
  C:\Windows\System\UesyQbO.exe
  2⤵
  PID:5420
- C:\Windows\System\NahLEKW.exe
  C:\Windows\System\NahLEKW.exe
  2⤵
  PID:5452
- C:\Windows\System\HLDNQPY.exe
  C:\Windows\System\HLDNQPY.exe
  2⤵
  PID:5516
- C:\Windows\System\hlPmELF.exe
  C:\Windows\System\hlPmELF.exe
  2⤵
  PID:5180
- C:\Windows\System\KHefCdp.exe
  C:\Windows\System\KHefCdp.exe
  2⤵
  PID:5612
- C:\Windows\System\GIbpQAv.exe
  C:\Windows\System\GIbpQAv.exe
  2⤵
  PID:5404
- C:\Windows\System\NcovjKL.exe
  C:\Windows\System\NcovjKL.exe
  2⤵
  PID:3232
- C:\Windows\System\MugpuMv.exe
  C:\Windows\System\MugpuMv.exe
  2⤵
  PID:5708
- C:\Windows\System\yNMYZMP.exe
  C:\Windows\System\yNMYZMP.exe
  2⤵
  PID:2060
- C:\Windows\System\kGqDnbl.exe
  C:\Windows\System\kGqDnbl.exe
  2⤵
  PID:3296
- C:\Windows\System\dkwmyCW.exe
  C:\Windows\System\dkwmyCW.exe
  2⤵
  PID:5656
- C:\Windows\System\VrDHfRx.exe
  C:\Windows\System\VrDHfRx.exe
  2⤵
  PID:2712
- C:\Windows\System\ItQnFgR.exe
  C:\Windows\System\ItQnFgR.exe
  2⤵
  PID:5148
- C:\Windows\System\xFEuGcy.exe
  C:\Windows\System\xFEuGcy.exe
  2⤵
  PID:5728
- C:\Windows\System\tqWnPqM.exe
  C:\Windows\System\tqWnPqM.exe
  2⤵
  PID:5240
- C:\Windows\System\phyewyA.exe
  C:\Windows\System\phyewyA.exe
  2⤵
  PID:5308
- C:\Windows\System\QquYCjG.exe
  C:\Windows\System\QquYCjG.exe
  2⤵
  PID:5368
- C:\Windows\System\YKoAEwP.exe
  C:\Windows\System\YKoAEwP.exe
  2⤵
  PID:5436
- C:\Windows\System\oLncqfn.exe
  C:\Windows\System\oLncqfn.exe
  2⤵
  PID:5496
- C:\Windows\System\jwjDtnk.exe
  C:\Windows\System\jwjDtnk.exe
  2⤵
  PID:5592
- C:\Windows\System\ZqIUyvG.exe
  C:\Windows\System\ZqIUyvG.exe
  2⤵
  PID:5760
- C:\Windows\System\vYrtgkB.exe
  C:\Windows\System\vYrtgkB.exe
  2⤵
  PID:5792
- C:\Windows\System\zPvgfhT.exe
  C:\Windows\System\zPvgfhT.exe
  2⤵
  PID:5900
- C:\Windows\System\naIIagW.exe
  C:\Windows\System\naIIagW.exe
  2⤵
  PID:5936
- C:\Windows\System\fmTsfpX.exe
  C:\Windows\System\fmTsfpX.exe
  2⤵
  PID:5964
- C:\Windows\System\WuTGUxt.exe
  C:\Windows\System\WuTGUxt.exe
  2⤵
  PID:5948
- C:\Windows\System\CtcspIZ.exe
  C:\Windows\System\CtcspIZ.exe
  2⤵
  PID:6060
- C:\Windows\System\zVeJvrK.exe
  C:\Windows\System\zVeJvrK.exe
  2⤵
  PID:5984
- C:\Windows\System\vvVooiv.exe
  C:\Windows\System\vvVooiv.exe
  2⤵
  PID:6044
- C:\Windows\System\JrFiOfx.exe
  C:\Windows\System\JrFiOfx.exe
  2⤵
  PID:6016
- C:\Windows\System\teoqtyI.exe
  C:\Windows\System\teoqtyI.exe
  2⤵
  PID:5164
- C:\Windows\System\tbABtXg.exe
  C:\Windows\System\tbABtXg.exe
  2⤵
  PID:2204
- C:\Windows\System\pMKdBAV.exe
  C:\Windows\System\pMKdBAV.exe
  2⤵
  PID:1916
- C:\Windows\System\uALBwGP.exe
  C:\Windows\System\uALBwGP.exe
  2⤵
  PID:408
- C:\Windows\System\yqxgokG.exe
  C:\Windows\System\yqxgokG.exe
  2⤵
  PID:5356
- C:\Windows\System\xtHayiv.exe
  C:\Windows\System\xtHayiv.exe
  2⤵
  PID:5608
- C:\Windows\System\dJbkpRm.exe
  C:\Windows\System\dJbkpRm.exe
  2⤵
  PID:5772
- C:\Windows\System\gzCAmYE.exe
  C:\Windows\System\gzCAmYE.exe
  2⤵
  PID:2156
- C:\Windows\System\hbzLzPQ.exe
  C:\Windows\System\hbzLzPQ.exe
  2⤵
  PID:5672
- C:\Windows\System\eadmohw.exe
  C:\Windows\System\eadmohw.exe
  2⤵
  PID:5336
- C:\Windows\System\tHNeJcA.exe
  C:\Windows\System\tHNeJcA.exe
  2⤵
  PID:3668
- C:\Windows\System\MFJOpUx.exe
  C:\Windows\System\MFJOpUx.exe
  2⤵
  PID:5272
- C:\Windows\System\GkkelQH.exe
  C:\Windows\System\GkkelQH.exe
  2⤵
  PID:5628
- C:\Windows\System\isvacqZ.exe
  C:\Windows\System\isvacqZ.exe
  2⤵
  PID:5888
- C:\Windows\System\jupoJrf.exe
  C:\Windows\System\jupoJrf.exe
  2⤵
  PID:6012
- C:\Windows\System\HKgBVNT.exe
  C:\Windows\System\HKgBVNT.exe
  2⤵
  PID:5532
- C:\Windows\System\lppDFFA.exe
  C:\Windows\System\lppDFFA.exe
  2⤵
  PID:5788
- C:\Windows\System\EVOsOTU.exe
  C:\Windows\System\EVOsOTU.exe
  2⤵
  PID:5952
- C:\Windows\System\YIlGBsT.exe
  C:\Windows\System\YIlGBsT.exe
  2⤵
  PID:6128
- C:\Windows\System\XBnBQlU.exe
  C:\Windows\System\XBnBQlU.exe
  2⤵
  PID:2716
- C:\Windows\System\RroWZAN.exe
  C:\Windows\System\RroWZAN.exe
  2⤵
  PID:5276
- C:\Windows\System\rrZmDwO.exe
  C:\Windows\System\rrZmDwO.exe
  2⤵
  PID:5808
- C:\Windows\System\QWYHahU.exe
  C:\Windows\System\QWYHahU.exe
  2⤵
  PID:6032
- C:\Windows\System\SPHsRdG.exe
  C:\Windows\System\SPHsRdG.exe
  2⤵
  PID:6124
- C:\Windows\System\SrDvDtv.exe
  C:\Windows\System\SrDvDtv.exe
  2⤵
  PID:5692
- C:\Windows\System\QjwHXNT.exe
  C:\Windows\System\QjwHXNT.exe
  2⤵
  PID:6148
- C:\Windows\System\TNDZtkJ.exe
  C:\Windows\System\TNDZtkJ.exe
  2⤵
  PID:6164
- C:\Windows\System\NyxclTm.exe
  C:\Windows\System\NyxclTm.exe
  2⤵
  PID:6180
- C:\Windows\System\fyQBEtD.exe
  C:\Windows\System\fyQBEtD.exe
  2⤵
  PID:6196
- C:\Windows\System\mAdOuWH.exe
  C:\Windows\System\mAdOuWH.exe
  2⤵
  PID:6212
- C:\Windows\System\uUFufUb.exe
  C:\Windows\System\uUFufUb.exe
  2⤵
  PID:6228
- C:\Windows\System\SAzzCGj.exe
  C:\Windows\System\SAzzCGj.exe
  2⤵
  PID:6244
- C:\Windows\System\LPqrWWu.exe
  C:\Windows\System\LPqrWWu.exe
  2⤵
  PID:6260
- C:\Windows\System\WFtuVGl.exe
  C:\Windows\System\WFtuVGl.exe
  2⤵
  PID:6276
- C:\Windows\System\dSvLIhl.exe
  C:\Windows\System\dSvLIhl.exe
  2⤵
  PID:6292
- C:\Windows\System\HFXdCQM.exe
  C:\Windows\System\HFXdCQM.exe
  2⤵
  PID:6308
- C:\Windows\System\cucCBoI.exe
  C:\Windows\System\cucCBoI.exe
  2⤵
  PID:6324
- C:\Windows\System\crWXEoE.exe
  C:\Windows\System\crWXEoE.exe
  2⤵
  PID:6340
- C:\Windows\System\VbOLaVr.exe
  C:\Windows\System\VbOLaVr.exe
  2⤵
  PID:6356
- C:\Windows\System\TwhPlCd.exe
  C:\Windows\System\TwhPlCd.exe
  2⤵
  PID:6372
- C:\Windows\System\pZFskeF.exe
  C:\Windows\System\pZFskeF.exe
  2⤵
  PID:6388
- C:\Windows\System\FSmObtc.exe
  C:\Windows\System\FSmObtc.exe
  2⤵
  PID:6404
- C:\Windows\System\iXdbZwj.exe
  C:\Windows\System\iXdbZwj.exe
  2⤵
  PID:6420
- C:\Windows\System\gwzjLQp.exe
  C:\Windows\System\gwzjLQp.exe
  2⤵
  PID:6436
- C:\Windows\System\JAuEHwR.exe
  C:\Windows\System\JAuEHwR.exe
  2⤵
  PID:6452
- C:\Windows\System\Cxwgwhj.exe
  C:\Windows\System\Cxwgwhj.exe
  2⤵
  PID:6468
- C:\Windows\System\agBslWu.exe
  C:\Windows\System\agBslWu.exe
  2⤵
  PID:6484
- C:\Windows\System\GyVCmom.exe
  C:\Windows\System\GyVCmom.exe
  2⤵
  PID:6500
- C:\Windows\System\IfWsbNT.exe
  C:\Windows\System\IfWsbNT.exe
  2⤵
  PID:6516
- C:\Windows\System\NFcrPCD.exe
  C:\Windows\System\NFcrPCD.exe
  2⤵
  PID:6532
- C:\Windows\System\kMfFqqj.exe
  C:\Windows\System\kMfFqqj.exe
  2⤵
  PID:6548
- C:\Windows\System\iBZkWuV.exe
  C:\Windows\System\iBZkWuV.exe
  2⤵
  PID:6564
- C:\Windows\System\rVGkXGh.exe
  C:\Windows\System\rVGkXGh.exe
  2⤵
  PID:6580
- C:\Windows\System\kqQXPAg.exe
  C:\Windows\System\kqQXPAg.exe
  2⤵
  PID:6596
- C:\Windows\System\xIBvcbk.exe
  C:\Windows\System\xIBvcbk.exe
  2⤵
  PID:6612
- C:\Windows\System\uTWpuNJ.exe
  C:\Windows\System\uTWpuNJ.exe
  2⤵
  PID:6628
- C:\Windows\System\uXLlBZQ.exe
  C:\Windows\System\uXLlBZQ.exe
  2⤵
  PID:6644
- C:\Windows\System\zqkHaje.exe
  C:\Windows\System\zqkHaje.exe
  2⤵
  PID:6660
- C:\Windows\System\znwMsCr.exe
  C:\Windows\System\znwMsCr.exe
  2⤵
  PID:6676
- C:\Windows\System\eEoFVpV.exe
  C:\Windows\System\eEoFVpV.exe
  2⤵
  PID:6692
- C:\Windows\System\YzMCByC.exe
  C:\Windows\System\YzMCByC.exe
  2⤵
  PID:6708
- C:\Windows\System\dXjZCxt.exe
  C:\Windows\System\dXjZCxt.exe
  2⤵
  PID:6724
- C:\Windows\System\DErhSdK.exe
  C:\Windows\System\DErhSdK.exe
  2⤵
  PID:6740
- C:\Windows\System\sSURdyn.exe
  C:\Windows\System\sSURdyn.exe
  2⤵
  PID:6756
- C:\Windows\System\aYOltYB.exe
  C:\Windows\System\aYOltYB.exe
  2⤵
  PID:6772
- C:\Windows\System\HRbGnYy.exe
  C:\Windows\System\HRbGnYy.exe
  2⤵
  PID:6788
- C:\Windows\System\WFUkDWv.exe
  C:\Windows\System\WFUkDWv.exe
  2⤵
  PID:6804
- C:\Windows\System\uZhGMof.exe
  C:\Windows\System\uZhGMof.exe
  2⤵
  PID:6820
- C:\Windows\System\GSFXqvN.exe
  C:\Windows\System\GSFXqvN.exe
  2⤵
  PID:6836
- C:\Windows\System\nXwfhvw.exe
  C:\Windows\System\nXwfhvw.exe
  2⤵
  PID:6852
- C:\Windows\System\ESZYarj.exe
  C:\Windows\System\ESZYarj.exe
  2⤵
  PID:6868
- C:\Windows\System\CwgDEpu.exe
  C:\Windows\System\CwgDEpu.exe
  2⤵
  PID:6884
- C:\Windows\System\tzXduOC.exe
  C:\Windows\System\tzXduOC.exe
  2⤵
  PID:6900
- C:\Windows\System\byhhCQk.exe
  C:\Windows\System\byhhCQk.exe
  2⤵
  PID:6916
- C:\Windows\System\XkMVdEm.exe
  C:\Windows\System\XkMVdEm.exe
  2⤵
  PID:6932
- C:\Windows\System\PrJaBeY.exe
  C:\Windows\System\PrJaBeY.exe
  2⤵
  PID:6948
- C:\Windows\System\sjvHhhb.exe
  C:\Windows\System\sjvHhhb.exe
  2⤵
  PID:6964
- C:\Windows\System\YXjNzMA.exe
  C:\Windows\System\YXjNzMA.exe
  2⤵
  PID:6980
- C:\Windows\System\esSQHBW.exe
  C:\Windows\System\esSQHBW.exe
  2⤵
  PID:6996
- C:\Windows\System\KXCphpl.exe
  C:\Windows\System\KXCphpl.exe
  2⤵
  PID:7100
- C:\Windows\System\COekJEZ.exe
  C:\Windows\System\COekJEZ.exe
  2⤵
  PID:7156
- C:\Windows\System\lwYfErt.exe
  C:\Windows\System\lwYfErt.exe
  2⤵
  PID:6460
- C:\Windows\System\onuhAKg.exe
  C:\Windows\System\onuhAKg.exe
  2⤵
  PID:5872
- C:\Windows\System\ObIbpOX.exe
  C:\Windows\System\ObIbpOX.exe
  2⤵
  PID:5352
- C:\Windows\System\sKmCDQD.exe
  C:\Windows\System\sKmCDQD.exe
  2⤵
  PID:6572
- C:\Windows\System\rRgSVtl.exe
  C:\Windows\System\rRgSVtl.exe
  2⤵
  PID:6240
- C:\Windows\System\LprToCK.exe
  C:\Windows\System\LprToCK.exe
  2⤵
  PID:6272
- C:\Windows\System\VAhiFYZ.exe
  C:\Windows\System\VAhiFYZ.exe
  2⤵
  PID:6560
- C:\Windows\System\GAyhCkE.exe
  C:\Windows\System\GAyhCkE.exe
  2⤵
  PID:6524
- C:\Windows\System\sjesUOK.exe
  C:\Windows\System\sjesUOK.exe
  2⤵
  PID:6620
- C:\Windows\System\tdCZSmb.exe
  C:\Windows\System\tdCZSmb.exe
  2⤵
  PID:6704
- C:\Windows\System\lxBjLZC.exe
  C:\Windows\System\lxBjLZC.exe
  2⤵
  PID:6736
- C:\Windows\System\HXcTDap.exe
  C:\Windows\System\HXcTDap.exe
  2⤵
  PID:6716
- C:\Windows\System\lblAjeT.exe
  C:\Windows\System\lblAjeT.exe
  2⤵
  PID:6796
- C:\Windows\System\DcsyQbH.exe
  C:\Windows\System\DcsyQbH.exe
  2⤵
  PID:6828
- C:\Windows\System\YpXLJtf.exe
  C:\Windows\System\YpXLJtf.exe
  2⤵
  PID:6860
- C:\Windows\System\qcxmORh.exe
  C:\Windows\System\qcxmORh.exe
  2⤵
  PID:6892
- C:\Windows\System\JuZOibr.exe
  C:\Windows\System\JuZOibr.exe
  2⤵
  PID:6924
- C:\Windows\System\GJwzhtQ.exe
  C:\Windows\System\GJwzhtQ.exe
  2⤵
  PID:6912
- C:\Windows\System\gsyMZSd.exe
  C:\Windows\System\gsyMZSd.exe
  2⤵
  PID:6988
- C:\Windows\System\IbhWEUS.exe
  C:\Windows\System\IbhWEUS.exe
  2⤵
  PID:6944
- C:\Windows\System\RgssvOr.exe
  C:\Windows\System\RgssvOr.exe
  2⤵
  PID:7032
- C:\Windows\System\PpPwjUE.exe
  C:\Windows\System\PpPwjUE.exe
  2⤵
  PID:7024
- C:\Windows\System\ePCRxOo.exe
  C:\Windows\System\ePCRxOo.exe
  2⤵
  PID:7052
- C:\Windows\System\CqBApbg.exe
  C:\Windows\System\CqBApbg.exe
  2⤵
  PID:7064
- C:\Windows\System\WvkuxOU.exe
  C:\Windows\System\WvkuxOU.exe
  2⤵
  PID:7084
- C:\Windows\System\DHebRRr.exe
  C:\Windows\System\DHebRRr.exe
  2⤵
  PID:7120
- C:\Windows\System\TmVwcjT.exe
  C:\Windows\System\TmVwcjT.exe
  2⤵
  PID:7132
- C:\Windows\System\lhJUOwz.exe
  C:\Windows\System\lhJUOwz.exe
  2⤵
  PID:7108
- C:\Windows\System\QWvedmC.exe
  C:\Windows\System\QWvedmC.exe
  2⤵
  PID:6192
- C:\Windows\System\MhfvanK.exe
  C:\Windows\System\MhfvanK.exe
  2⤵
  PID:6188
- C:\Windows\System\YLNDyMK.exe
  C:\Windows\System\YLNDyMK.exe
  2⤵
  PID:5512
- C:\Windows\System\kDVsLoT.exe
  C:\Windows\System\kDVsLoT.exe
  2⤵
  PID:5856
- C:\Windows\System\NCjqNKO.exe
  C:\Windows\System\NCjqNKO.exe
  2⤵
  PID:6320
- C:\Windows\System\RlzKqCi.exe
  C:\Windows\System\RlzKqCi.exe
  2⤵
  PID:6316
- C:\Windows\System\jRbiSSK.exe
  C:\Windows\System\jRbiSSK.exe
  2⤵
  PID:6412
- C:\Windows\System\SxmJtcK.exe
  C:\Windows\System\SxmJtcK.exe
  2⤵
  PID:6380
- C:\Windows\System\UYgOBNW.exe
  C:\Windows\System\UYgOBNW.exe
  2⤵
  PID:6476
- C:\Windows\System\oAukvOC.exe
  C:\Windows\System\oAukvOC.exe
  2⤵
  PID:6176
- C:\Windows\System\OePFATR.exe
  C:\Windows\System\OePFATR.exe
  2⤵
  PID:6508
- C:\Windows\System\fmOpyzy.exe
  C:\Windows\System\fmOpyzy.exe
  2⤵
  PID:5176
- C:\Windows\System\TylsgOw.exe
  C:\Windows\System\TylsgOw.exe
  2⤵
  PID:5916
- C:\Windows\System\JGcBNYs.exe
  C:\Windows\System\JGcBNYs.exe
  2⤵
  PID:5932
- C:\Windows\System\mMuqoBs.exe
  C:\Windows\System\mMuqoBs.exe
  2⤵
  PID:6432
- C:\Windows\System\GHQnKbh.exe
  C:\Windows\System\GHQnKbh.exe
  2⤵
  PID:6700
- C:\Windows\System\lPPstpV.exe
  C:\Windows\System\lPPstpV.exe
  2⤵
  PID:6876
- C:\Windows\System\WjepRyM.exe
  C:\Windows\System\WjepRyM.exe
  2⤵
  PID:7012
- C:\Windows\System\obNhMVi.exe
  C:\Windows\System\obNhMVi.exe
  2⤵
  PID:7088
- C:\Windows\System\wYiNQnz.exe
  C:\Windows\System\wYiNQnz.exe
  2⤵
  PID:6156
- C:\Windows\System\pMTNmVm.exe
  C:\Windows\System\pMTNmVm.exe
  2⤵
  PID:3456
- C:\Windows\System\hChqVMG.exe
  C:\Windows\System\hChqVMG.exe
  2⤵
  PID:6448
- C:\Windows\System\RbwcOBh.exe
  C:\Windows\System\RbwcOBh.exe
  2⤵
  PID:6624
- C:\Windows\System\WPBEeQO.exe
  C:\Windows\System\WPBEeQO.exe
  2⤵
  PID:6720
- C:\Windows\System\rHLwcut.exe
  C:\Windows\System\rHLwcut.exe
  2⤵
  PID:6592
- C:\Windows\System\mVBXNgY.exe
  C:\Windows\System\mVBXNgY.exe
  2⤵
  PID:7048
- C:\Windows\System\KxLrOLy.exe
  C:\Windows\System\KxLrOLy.exe
  2⤵
  PID:6304
- C:\Windows\System\rdfQpyl.exe
  C:\Windows\System\rdfQpyl.exe
  2⤵
  PID:6768
- C:\Windows\System\sUqqBOL.exe
  C:\Windows\System\sUqqBOL.exe
  2⤵
  PID:7028
- C:\Windows\System\bEChlJY.exe
  C:\Windows\System\bEChlJY.exe
  2⤵
  PID:7128
- C:\Windows\System\OOZtDPu.exe
  C:\Windows\System\OOZtDPu.exe
  2⤵
  PID:6252
- C:\Windows\System\peCKedK.exe
  C:\Windows\System\peCKedK.exe
  2⤵
  PID:6208
- C:\Windows\System\DJttygj.exe
  C:\Windows\System\DJttygj.exe
  2⤵
  PID:5144
- C:\Windows\System\SDYyfJr.exe
  C:\Windows\System\SDYyfJr.exe
  2⤵
  PID:5400
- C:\Windows\System\TLLGluo.exe
  C:\Windows\System\TLLGluo.exe
  2⤵
  PID:6748
- C:\Windows\System\txGNxpn.exe
  C:\Windows\System\txGNxpn.exe
  2⤵
  PID:6800
- C:\Windows\System\zXkxkLR.exe
  C:\Windows\System\zXkxkLR.exe
  2⤵
  PID:7004
- C:\Windows\System\eaBwaQb.exe
  C:\Windows\System\eaBwaQb.exe
  2⤵
  PID:7144
- C:\Windows\System\BdmIEOl.exe
  C:\Windows\System\BdmIEOl.exe
  2⤵
  PID:5160
- C:\Windows\System\qiItyov.exe
  C:\Windows\System\qiItyov.exe
  2⤵
  PID:6668
- C:\Windows\System\NLRlTTk.exe
  C:\Windows\System\NLRlTTk.exe
  2⤵
  PID:1688
- C:\Windows\System\ypGpAjf.exe
  C:\Windows\System\ypGpAjf.exe
  2⤵
  PID:5304
- C:\Windows\System\KsqoBNq.exe
  C:\Windows\System\KsqoBNq.exe
  2⤵
  PID:6364
- C:\Windows\System\vsUcJou.exe
  C:\Windows\System\vsUcJou.exe
  2⤵
  PID:6848
- C:\Windows\System\LHZCiKg.exe
  C:\Windows\System\LHZCiKg.exe
  2⤵
  PID:5644
- C:\Windows\System\uMfyaUZ.exe
  C:\Windows\System\uMfyaUZ.exe
  2⤵
  PID:6864
- C:\Windows\System\FiNxHSw.exe
  C:\Windows\System\FiNxHSw.exe
  2⤵
  PID:7044
- C:\Windows\System\qFUGnXa.exe
  C:\Windows\System\qFUGnXa.exe
  2⤵
  PID:6236
- C:\Windows\System\qCtiXEr.exe
  C:\Windows\System\qCtiXEr.exe
  2⤵
  PID:7080
- C:\Windows\System\YBbVqYy.exe
  C:\Windows\System\YBbVqYy.exe
  2⤵
  PID:6960
- C:\Windows\System\wOKnzKQ.exe
  C:\Windows\System\wOKnzKQ.exe
  2⤵
  PID:7180
- C:\Windows\System\EsfmhAl.exe
  C:\Windows\System\EsfmhAl.exe
  2⤵
  PID:7196
- C:\Windows\System\JXlccPV.exe
  C:\Windows\System\JXlccPV.exe
  2⤵
  PID:7212
- C:\Windows\System\yXEYImX.exe
  C:\Windows\System\yXEYImX.exe
  2⤵
  PID:7228
- C:\Windows\System\pdBWaCw.exe
  C:\Windows\System\pdBWaCw.exe
  2⤵
  PID:7244
- C:\Windows\System\sILoYHK.exe
  C:\Windows\System\sILoYHK.exe
  2⤵
  PID:7260
- C:\Windows\System\IwlIieD.exe
  C:\Windows\System\IwlIieD.exe
  2⤵
  PID:7276
- C:\Windows\System\toVYHSv.exe
  C:\Windows\System\toVYHSv.exe
  2⤵
  PID:7292
- C:\Windows\System\GVxDMGk.exe
  C:\Windows\System\GVxDMGk.exe
  2⤵
  PID:7308
- C:\Windows\System\lqENKaP.exe
  C:\Windows\System\lqENKaP.exe
  2⤵
  PID:7324
- C:\Windows\System\WVjYpBa.exe
  C:\Windows\System\WVjYpBa.exe
  2⤵
  PID:7340
- C:\Windows\System\yfFHZeY.exe
  C:\Windows\System\yfFHZeY.exe
  2⤵
  PID:7356
- C:\Windows\System\NWEEjSo.exe
  C:\Windows\System\NWEEjSo.exe
  2⤵
  PID:7372
- C:\Windows\System\srFuODD.exe
  C:\Windows\System\srFuODD.exe
  2⤵
  PID:7388
- C:\Windows\System\EKVHlAp.exe
  C:\Windows\System\EKVHlAp.exe
  2⤵
  PID:7408
- C:\Windows\System\JGyhFXI.exe
  C:\Windows\System\JGyhFXI.exe
  2⤵
  PID:7428
- C:\Windows\System\YDDXNif.exe
  C:\Windows\System\YDDXNif.exe
  2⤵
  PID:7444
- C:\Windows\System\CWOtfpT.exe
  C:\Windows\System\CWOtfpT.exe
  2⤵
  PID:7460
- C:\Windows\System\wIeSPpP.exe
  C:\Windows\System\wIeSPpP.exe
  2⤵
  PID:7484
- C:\Windows\System\QVmTqoU.exe
  C:\Windows\System\QVmTqoU.exe
  2⤵
  PID:7500
- C:\Windows\System\guuiXRV.exe
  C:\Windows\System\guuiXRV.exe
  2⤵
  PID:7516
- C:\Windows\System\VOiVZpR.exe
  C:\Windows\System\VOiVZpR.exe
  2⤵
  PID:7532
- C:\Windows\System\FxDeLzw.exe
  C:\Windows\System\FxDeLzw.exe
  2⤵
  PID:7548
- C:\Windows\System\vkUbwoW.exe
  C:\Windows\System\vkUbwoW.exe
  2⤵
  PID:7564
- C:\Windows\System\gobxtuJ.exe
  C:\Windows\System\gobxtuJ.exe
  2⤵
  PID:7580
- C:\Windows\System\RvLiOlR.exe
  C:\Windows\System\RvLiOlR.exe
  2⤵
  PID:7596
- C:\Windows\System\OzGYPzd.exe
  C:\Windows\System\OzGYPzd.exe
  2⤵
  PID:7612
- C:\Windows\System\kdDlOLp.exe
  C:\Windows\System\kdDlOLp.exe
  2⤵
  PID:7628
- C:\Windows\System\hFNtoPu.exe
  C:\Windows\System\hFNtoPu.exe
  2⤵
  PID:7644
- C:\Windows\System\fosJlnH.exe
  C:\Windows\System\fosJlnH.exe
  2⤵
  PID:7660
- C:\Windows\System\OXWcrFB.exe
  C:\Windows\System\OXWcrFB.exe
  2⤵
  PID:7676
- C:\Windows\System\BGiSKDw.exe
  C:\Windows\System\BGiSKDw.exe
  2⤵
  PID:7692
- C:\Windows\System\DQZliCR.exe
  C:\Windows\System\DQZliCR.exe
  2⤵
  PID:7708
- C:\Windows\System\JkRZLXJ.exe
  C:\Windows\System\JkRZLXJ.exe
  2⤵
  PID:7724
- C:\Windows\System\eAkLLNs.exe
  C:\Windows\System\eAkLLNs.exe
  2⤵
  PID:7740
- C:\Windows\System\hBUFTMm.exe
  C:\Windows\System\hBUFTMm.exe
  2⤵
  PID:7756
- C:\Windows\System\UWkNyFq.exe
  C:\Windows\System\UWkNyFq.exe
  2⤵
  PID:7772
- C:\Windows\System\ddZXzJq.exe
  C:\Windows\System\ddZXzJq.exe
  2⤵
  PID:7788
- C:\Windows\System\obCBzCT.exe
  C:\Windows\System\obCBzCT.exe
  2⤵
  PID:7804
- C:\Windows\System\HAAMNQi.exe
  C:\Windows\System\HAAMNQi.exe
  2⤵
  PID:7820
- C:\Windows\System\jJSrrXy.exe
  C:\Windows\System\jJSrrXy.exe
  2⤵
  PID:7836
- C:\Windows\System\nylLUnJ.exe
  C:\Windows\System\nylLUnJ.exe
  2⤵
  PID:7852
- C:\Windows\System\UmEJSbx.exe
  C:\Windows\System\UmEJSbx.exe
  2⤵
  PID:7872
- C:\Windows\System\ZECQZgT.exe
  C:\Windows\System\ZECQZgT.exe
  2⤵
  PID:7888
- C:\Windows\System\JCKpHoy.exe
  C:\Windows\System\JCKpHoy.exe
  2⤵
  PID:7904
- C:\Windows\System\ODufCUD.exe
  C:\Windows\System\ODufCUD.exe
  2⤵
  PID:7920
- C:\Windows\System\UfzRMIi.exe
  C:\Windows\System\UfzRMIi.exe
  2⤵
  PID:7936
- C:\Windows\System\RLzDpBn.exe
  C:\Windows\System\RLzDpBn.exe
  2⤵
  PID:7952
- C:\Windows\System\eCXzwwj.exe
  C:\Windows\System\eCXzwwj.exe
  2⤵
  PID:7972
- C:\Windows\System\SMhahWl.exe
  C:\Windows\System\SMhahWl.exe
  2⤵
  PID:7988
- C:\Windows\System\koDZGdv.exe
  C:\Windows\System\koDZGdv.exe
  2⤵
  PID:8004
- C:\Windows\System\SjfXXoy.exe
  C:\Windows\System\SjfXXoy.exe
  2⤵
  PID:8020
- C:\Windows\System\sJZgoRh.exe
  C:\Windows\System\sJZgoRh.exe
  2⤵
  PID:8036
- C:\Windows\System\RsKNCiB.exe
  C:\Windows\System\RsKNCiB.exe
  2⤵
  PID:8052
- C:\Windows\System\hDphZil.exe
  C:\Windows\System\hDphZil.exe
  2⤵
  PID:8068
- C:\Windows\System\pZieWCr.exe
  C:\Windows\System\pZieWCr.exe
  2⤵
  PID:8084
- C:\Windows\System\xUZWQuH.exe
  C:\Windows\System\xUZWQuH.exe
  2⤵
  PID:8104
- C:\Windows\System\SblXvSZ.exe
  C:\Windows\System\SblXvSZ.exe
  2⤵
  PID:8120
- C:\Windows\System\yVdqOVg.exe
  C:\Windows\System\yVdqOVg.exe
  2⤵
  PID:8136
- C:\Windows\System\MKrbDAJ.exe
  C:\Windows\System\MKrbDAJ.exe
  2⤵
  PID:8152
- C:\Windows\System\kHuasad.exe
  C:\Windows\System\kHuasad.exe
  2⤵
  PID:8188
- C:\Windows\System\RIdAwXl.exe
  C:\Windows\System\RIdAwXl.exe
  2⤵
  PID:7124
- C:\Windows\System\wfnzcDA.exe
  C:\Windows\System\wfnzcDA.exe
  2⤵
  PID:7192
- C:\Windows\System\pDLiiEM.exe
  C:\Windows\System\pDLiiEM.exe
  2⤵
  PID:7060
- C:\Windows\System\pfHuFrF.exe
  C:\Windows\System\pfHuFrF.exe
  2⤵
  PID:7208
- C:\Windows\System\DgfSnhK.exe
  C:\Windows\System\DgfSnhK.exe
  2⤵
  PID:5256
- C:\Windows\System\sKOxwOt.exe
  C:\Windows\System\sKOxwOt.exe
  2⤵
  PID:7236
- C:\Windows\System\zZmJEUc.exe
  C:\Windows\System\zZmJEUc.exe
  2⤵
  PID:7316
- C:\Windows\System\tPVxJaz.exe
  C:\Windows\System\tPVxJaz.exe
  2⤵
  PID:7272
- C:\Windows\System\HvWlSSi.exe
  C:\Windows\System\HvWlSSi.exe
  2⤵
  PID:7300
- C:\Windows\System\YcBtImz.exe
  C:\Windows\System\YcBtImz.exe
  2⤵
  PID:7368
- C:\Windows\System\qAjyYkN.exe
  C:\Windows\System\qAjyYkN.exe
  2⤵
  PID:7416
- C:\Windows\System\srXNfwA.exe
  C:\Windows\System\srXNfwA.exe
  2⤵
  PID:7440
- C:\Windows\System\tthVmpz.exe
  C:\Windows\System\tthVmpz.exe
  2⤵
  PID:7480
- C:\Windows\System\usHYqUH.exe
  C:\Windows\System\usHYqUH.exe
  2⤵
  PID:7452
- C:\Windows\System\nOqCApS.exe
  C:\Windows\System\nOqCApS.exe
  2⤵
  PID:7560
- C:\Windows\System\AnHdvwo.exe
  C:\Windows\System\AnHdvwo.exe
  2⤵
  PID:7624
- C:\Windows\System\zHtKgGC.exe
  C:\Windows\System\zHtKgGC.exe
  2⤵
  PID:7688
- C:\Windows\System\iwClKTp.exe
  C:\Windows\System\iwClKTp.exe
  2⤵
  PID:7748
- C:\Windows\System\FsBgyKm.exe
  C:\Windows\System\FsBgyKm.exe
  2⤵
  PID:7512
- C:\Windows\System\CFkcgoQ.exe
  C:\Windows\System\CFkcgoQ.exe
  2⤵
  PID:7608
- C:\Windows\System\FkyiXnT.exe
  C:\Windows\System\FkyiXnT.exe
  2⤵
  PID:7668
- C:\Windows\System\rzztMDm.exe
  C:\Windows\System\rzztMDm.exe
  2⤵
  PID:7732
- C:\Windows\System\QMDwtuM.exe
  C:\Windows\System\QMDwtuM.exe
  2⤵
  PID:7800
- C:\Windows\System\NolgCwv.exe
  C:\Windows\System\NolgCwv.exe
  2⤵
  PID:7844
- C:\Windows\System\DIXmmdf.exe
  C:\Windows\System\DIXmmdf.exe
  2⤵
  PID:7880
- C:\Windows\System\zNoCwDL.exe
  C:\Windows\System\zNoCwDL.exe
  2⤵
  PID:7948
- C:\Windows\System\hByxqhJ.exe
  C:\Windows\System\hByxqhJ.exe
  2⤵
  PID:8016
- C:\Windows\System\MtJNuer.exe
  C:\Windows\System\MtJNuer.exe
  2⤵
  PID:8080
- C:\Windows\System\FkjSfdc.exe
  C:\Windows\System\FkjSfdc.exe
  2⤵
  PID:7900
- C:\Windows\System\JikdMEJ.exe
  C:\Windows\System\JikdMEJ.exe
  2⤵
  PID:7928
- C:\Windows\System\dTwCOni.exe
  C:\Windows\System\dTwCOni.exe
  2⤵
  PID:8000
- C:\Windows\System\QnpGSVO.exe
  C:\Windows\System\QnpGSVO.exe
  2⤵
  PID:8112
- C:\Windows\System\MZWaReH.exe
  C:\Windows\System\MZWaReH.exe
  2⤵
  PID:8144
- C:\Windows\System\FdvoVDC.exe
  C:\Windows\System\FdvoVDC.exe
  2⤵
  PID:6640
- C:\Windows\System\MHKmxHz.exe
  C:\Windows\System\MHKmxHz.exe
  2⤵
  PID:8180
- C:\Windows\System\bHUYcAA.exe
  C:\Windows\System\bHUYcAA.exe
  2⤵
  PID:6428
- C:\Windows\System\uzyNBko.exe
  C:\Windows\System\uzyNBko.exe
  2⤵
  PID:7288
- C:\Windows\System\KqViqbq.exe
  C:\Windows\System\KqViqbq.exe
  2⤵
  PID:6492
- C:\Windows\System\fUqEkUb.exe
  C:\Windows\System\fUqEkUb.exe
  2⤵
  PID:7528
- C:\Windows\System\uLsjDVi.exe
  C:\Windows\System\uLsjDVi.exe
  2⤵
  PID:7336
- C:\Windows\System\EkiIqBN.exe
  C:\Windows\System\EkiIqBN.exe
  2⤵
  PID:7188
- C:\Windows\System\veuutfO.exe
  C:\Windows\System\veuutfO.exe
  2⤵
  PID:7224
- C:\Windows\System\ZVRzrTY.exe
  C:\Windows\System\ZVRzrTY.exe
  2⤵
  PID:7656
- C:\Windows\System\KzrDMvW.exe
  C:\Windows\System\KzrDMvW.exe
  2⤵
  PID:7540
- C:\Windows\System\MnFZqFx.exe
  C:\Windows\System\MnFZqFx.exe
  2⤵
  PID:7768
- C:\Windows\System\suKuAoJ.exe
  C:\Windows\System\suKuAoJ.exe
  2⤵
  PID:7640
- C:\Windows\System\UKpgsnP.exe
  C:\Windows\System\UKpgsnP.exe
  2⤵
  PID:7884
- C:\Windows\System\rnQYwjF.exe
  C:\Windows\System\rnQYwjF.exe
  2⤵
  PID:7700
- C:\Windows\System\nBqeeuI.exe
  C:\Windows\System\nBqeeuI.exe
  2⤵
  PID:7984
- C:\Windows\System\qrCJCSq.exe
  C:\Windows\System\qrCJCSq.exe
  2⤵
  PID:7996
- C:\Windows\System\PYShgTV.exe
  C:\Windows\System\PYShgTV.exe
  2⤵
  PID:8076
- C:\Windows\System\ThNkjTn.exe
  C:\Windows\System\ThNkjTn.exe
  2⤵
  PID:7932
- C:\Windows\System\USCHpAZ.exe
  C:\Windows\System\USCHpAZ.exe
  2⤵
  PID:8148
- C:\Windows\System\MBkfBHE.exe
  C:\Windows\System\MBkfBHE.exe
  2⤵
  PID:7136
- C:\Windows\System\rkPKUFy.exe
  C:\Windows\System\rkPKUFy.exe
  2⤵
  PID:7332
- C:\Windows\System\mZhNKTI.exe
  C:\Windows\System\mZhNKTI.exe
  2⤵
  PID:7252
- C:\Windows\System\faGsAYX.exe
  C:\Windows\System\faGsAYX.exe
  2⤵
  PID:7424
- C:\Windows\System\OHAmumm.exe
  C:\Windows\System\OHAmumm.exe
  2⤵
  PID:7764
- C:\Windows\System\vzbwFlV.exe
  C:\Windows\System\vzbwFlV.exe
  2⤵
  PID:7620
- C:\Windows\System\BDzoPVs.exe
  C:\Windows\System\BDzoPVs.exe
  2⤵
  PID:7636
- C:\Windows\System\zmQZZsR.exe
  C:\Windows\System\zmQZZsR.exe
  2⤵
  PID:7780
- C:\Windows\System\pgJpwDP.exe
  C:\Windows\System\pgJpwDP.exe
  2⤵
  PID:8160
- C:\Windows\System\wXKwfhJ.exe
  C:\Windows\System\wXKwfhJ.exe
  2⤵
  PID:7476
- C:\Windows\System\riwsDZJ.exe
  C:\Windows\System\riwsDZJ.exe
  2⤵
  PID:7944
- C:\Windows\System\wgKwruP.exe
  C:\Windows\System\wgKwruP.exe
  2⤵
  PID:7284
- C:\Windows\System\XDrVrDB.exe
  C:\Windows\System\XDrVrDB.exe
  2⤵
  PID:8204
- C:\Windows\System\GOYBYso.exe
  C:\Windows\System\GOYBYso.exe
  2⤵
  PID:8220
- C:\Windows\System\kqPmnpH.exe
  C:\Windows\System\kqPmnpH.exe
  2⤵
  PID:8236
- C:\Windows\System\HuumyuP.exe
  C:\Windows\System\HuumyuP.exe
  2⤵
  PID:8252
- C:\Windows\System\WasXaIX.exe
  C:\Windows\System\WasXaIX.exe
  2⤵
  PID:8268
- C:\Windows\System\GBbyPvk.exe
  C:\Windows\System\GBbyPvk.exe
  2⤵
  PID:8284
- C:\Windows\System\aeqvNdn.exe
  C:\Windows\System\aeqvNdn.exe
  2⤵
  PID:8300
- C:\Windows\System\WOpTGnU.exe
  C:\Windows\System\WOpTGnU.exe
  2⤵
  PID:8316
- C:\Windows\System\BGrvePU.exe
  C:\Windows\System\BGrvePU.exe
  2⤵
  PID:8332
- C:\Windows\System\ntqqzoy.exe
  C:\Windows\System\ntqqzoy.exe
  2⤵
  PID:8348
- C:\Windows\System\AnfjivE.exe
  C:\Windows\System\AnfjivE.exe
  2⤵
  PID:8364
- C:\Windows\System\LEpyKqc.exe
  C:\Windows\System\LEpyKqc.exe
  2⤵
  PID:8380
- C:\Windows\System\ioAWWqP.exe
  C:\Windows\System\ioAWWqP.exe
  2⤵
  PID:8396
- C:\Windows\System\FwTqPqw.exe
  C:\Windows\System\FwTqPqw.exe
  2⤵
  PID:8412
- C:\Windows\System\OQHNutK.exe
  C:\Windows\System\OQHNutK.exe
  2⤵
  PID:8432
- C:\Windows\System\ajaIgjI.exe
  C:\Windows\System\ajaIgjI.exe
  2⤵
  PID:8448
- C:\Windows\System\JXFrZEm.exe
  C:\Windows\System\JXFrZEm.exe
  2⤵
  PID:8464
- C:\Windows\System\ioQdIcF.exe
  C:\Windows\System\ioQdIcF.exe
  2⤵
  PID:8480
- C:\Windows\System\JbzpToe.exe
  C:\Windows\System\JbzpToe.exe
  2⤵
  PID:8496
- C:\Windows\System\ytMDyid.exe
  C:\Windows\System\ytMDyid.exe
  2⤵
  PID:8512
- C:\Windows\System\tfrLiww.exe
  C:\Windows\System\tfrLiww.exe
  2⤵
  PID:8528
- C:\Windows\System\auntsiA.exe
  C:\Windows\System\auntsiA.exe
  2⤵
  PID:8544
- C:\Windows\System\ZccNfCP.exe
  C:\Windows\System\ZccNfCP.exe
  2⤵
  PID:8560
- C:\Windows\System\Nrdadcg.exe
  C:\Windows\System\Nrdadcg.exe
  2⤵
  PID:8576
- C:\Windows\System\LBQLNwu.exe
  C:\Windows\System\LBQLNwu.exe
  2⤵
  PID:8592
- C:\Windows\System\bwJcKSC.exe
  C:\Windows\System\bwJcKSC.exe
  2⤵
  PID:8608
- C:\Windows\System\RRKFznA.exe
  C:\Windows\System\RRKFznA.exe
  2⤵
  PID:8624
- C:\Windows\System\rgaPemw.exe
  C:\Windows\System\rgaPemw.exe
  2⤵
  PID:8640
- C:\Windows\System\EpzlSAP.exe
  C:\Windows\System\EpzlSAP.exe
  2⤵
  PID:8656
- C:\Windows\System\wwQbhoV.exe
  C:\Windows\System\wwQbhoV.exe
  2⤵
  PID:8672
- C:\Windows\System\DmBaiyV.exe
  C:\Windows\System\DmBaiyV.exe
  2⤵
  PID:8688
- C:\Windows\System\RcLdrlT.exe
  C:\Windows\System\RcLdrlT.exe
  2⤵
  PID:8704
- C:\Windows\System\GzjQzFQ.exe
  C:\Windows\System\GzjQzFQ.exe
  2⤵
  PID:8732
- C:\Windows\System\idjMqKM.exe
  C:\Windows\System\idjMqKM.exe
  2⤵
  PID:8752
- C:\Windows\System\oCFspzo.exe
  C:\Windows\System\oCFspzo.exe
  2⤵
  PID:8772
- C:\Windows\System\qRitYfX.exe
  C:\Windows\System\qRitYfX.exe
  2⤵
  PID:8788
- C:\Windows\System\vEfUrxN.exe
  C:\Windows\System\vEfUrxN.exe
  2⤵
  PID:8808
- C:\Windows\System\SyWQZKg.exe
  C:\Windows\System\SyWQZKg.exe
  2⤵
  PID:8824
- C:\Windows\System\cYlUaPM.exe
  C:\Windows\System\cYlUaPM.exe
  2⤵
  PID:8840
- C:\Windows\System\bdAwqsu.exe
  C:\Windows\System\bdAwqsu.exe
  2⤵
  PID:8856
- C:\Windows\System\XUWvXBG.exe
  C:\Windows\System\XUWvXBG.exe
  2⤵
  PID:8872
- C:\Windows\System\WXKQyNw.exe
  C:\Windows\System\WXKQyNw.exe
  2⤵
  PID:8888
- C:\Windows\System\CtjclxL.exe
  C:\Windows\System\CtjclxL.exe
  2⤵
  PID:8904
- C:\Windows\System\LLEkggm.exe
  C:\Windows\System\LLEkggm.exe
  2⤵
  PID:8920
- C:\Windows\System\sTVlkrQ.exe
  C:\Windows\System\sTVlkrQ.exe
  2⤵
  PID:8936
- C:\Windows\System\NEfYmEs.exe
  C:\Windows\System\NEfYmEs.exe
  2⤵
  PID:8956
- C:\Windows\System\oSedrmX.exe
  C:\Windows\System\oSedrmX.exe
  2⤵
  PID:8972
- C:\Windows\System\UUfXVHL.exe
  C:\Windows\System\UUfXVHL.exe
  2⤵
  PID:8988
- C:\Windows\System\ujJpLhT.exe
  C:\Windows\System\ujJpLhT.exe
  2⤵
  PID:9004
- C:\Windows\System\FaCeNRK.exe
  C:\Windows\System\FaCeNRK.exe
  2⤵
  PID:9020
- C:\Windows\System\teiBhTP.exe
  C:\Windows\System\teiBhTP.exe
  2⤵
  PID:9036
- C:\Windows\System\AfpkXME.exe
  C:\Windows\System\AfpkXME.exe
  2⤵
  PID:9052
- C:\Windows\System\FkhnSzg.exe
  C:\Windows\System\FkhnSzg.exe
  2⤵
  PID:9068
- C:\Windows\System\esihBbC.exe
  C:\Windows\System\esihBbC.exe
  2⤵
  PID:9084
- C:\Windows\System\MXdUhoW.exe
  C:\Windows\System\MXdUhoW.exe
  2⤵
  PID:9100
- C:\Windows\System\VJdxkNK.exe
  C:\Windows\System\VJdxkNK.exe
  2⤵
  PID:9116
- C:\Windows\System\hulensr.exe
  C:\Windows\System\hulensr.exe
  2⤵
  PID:9132
- C:\Windows\System\pCElKLZ.exe
  C:\Windows\System\pCElKLZ.exe
  2⤵
  PID:9148
- C:\Windows\System\TAHGeUn.exe
  C:\Windows\System\TAHGeUn.exe
  2⤵
  PID:9164
- C:\Windows\System\FDGgngF.exe
  C:\Windows\System\FDGgngF.exe
  2⤵
  PID:9180
- C:\Windows\System\sxCeDlU.exe
  C:\Windows\System\sxCeDlU.exe
  2⤵
  PID:9196
- C:\Windows\System\NYbRWXC.exe
  C:\Windows\System\NYbRWXC.exe
  2⤵
  PID:9212
- C:\Windows\System\ZlnorQn.exe
  C:\Windows\System\ZlnorQn.exe
  2⤵
  PID:8212
- C:\Windows\System\qylaEQP.exe
  C:\Windows\System\qylaEQP.exe
  2⤵
  PID:7472
- C:\Windows\System\VSijfMf.exe
  C:\Windows\System\VSijfMf.exe
  2⤵
  PID:8048
- C:\Windows\System\ufpiDWf.exe
  C:\Windows\System\ufpiDWf.exe
  2⤵
  PID:8200
- C:\Windows\System\kcxTURd.exe
  C:\Windows\System\kcxTURd.exe
  2⤵
  PID:8296
- C:\Windows\System\Gkzuztp.exe
  C:\Windows\System\Gkzuztp.exe
  2⤵
  PID:8244
- C:\Windows\System\IfmYBSk.exe
  C:\Windows\System\IfmYBSk.exe
  2⤵
  PID:8324
- C:\Windows\System\eVvUSgO.exe
  C:\Windows\System\eVvUSgO.exe
  2⤵
  PID:8356
- C:\Windows\System\Vybfbnn.exe
  C:\Windows\System\Vybfbnn.exe
  2⤵
  PID:8404
- C:\Windows\System\UHRHnQQ.exe
  C:\Windows\System\UHRHnQQ.exe
  2⤵
  PID:8388
- C:\Windows\System\xAgcMCO.exe
  C:\Windows\System\xAgcMCO.exe
  2⤵
  PID:8504
- C:\Windows\System\IwyQLIB.exe
  C:\Windows\System\IwyQLIB.exe
  2⤵
  PID:8572
- C:\Windows\System\NaKBNHa.exe
  C:\Windows\System\NaKBNHa.exe
  2⤵
  PID:8632
- C:\Windows\System\DlnjeQJ.exe
  C:\Windows\System\DlnjeQJ.exe
  2⤵
  PID:8664
- C:\Windows\System\VuZSyDp.exe
  C:\Windows\System\VuZSyDp.exe
  2⤵
  PID:8696
- C:\Windows\System\BdBqBLv.exe
  C:\Windows\System\BdBqBLv.exe
  2⤵
  PID:8552
- C:\Windows\System\fbUTlNz.exe
  C:\Windows\System\fbUTlNz.exe
  2⤵
  PID:8616
- C:\Windows\System\ghvsdQk.exe
  C:\Windows\System\ghvsdQk.exe
  2⤵
  PID:7916
- C:\Windows\System\eEHtplL.exe
  C:\Windows\System\eEHtplL.exe
  2⤵
  PID:8820
- C:\Windows\System\ahtZnuI.exe
  C:\Windows\System\ahtZnuI.exe
  2⤵
  PID:8196
- C:\Windows\System\qlhGJZZ.exe
  C:\Windows\System\qlhGJZZ.exe
  2⤵
  PID:8896
- C:\Windows\System\FCtERuf.exe
  C:\Windows\System\FCtERuf.exe
  2⤵
  PID:8796
- C:\Windows\System\LVhqqgV.exe
  C:\Windows\System\LVhqqgV.exe
  2⤵
  PID:8232
- C:\Windows\System\SApSPKw.exe
  C:\Windows\System\SApSPKw.exe
  2⤵
  PID:8376
- C:\Windows\System\wIlnxKy.exe
  C:\Windows\System\wIlnxKy.exe
  2⤵
  PID:8604
- C:\Windows\System\ujTUevv.exe
  C:\Windows\System\ujTUevv.exe
  2⤵
  PID:8520
- C:\Windows\System\tTOfmqq.exe
  C:\Windows\System\tTOfmqq.exe
  2⤵
  PID:8648
- C:\Windows\System\pXNegBG.exe
  C:\Windows\System\pXNegBG.exe
  2⤵
  PID:7828
- C:\Windows\System\EAauUFz.exe
  C:\Windows\System\EAauUFz.exe
  2⤵
  PID:7204
- C:\Windows\System\SzrYesY.exe
  C:\Windows\System\SzrYesY.exe
  2⤵
  PID:9704
- C:\Windows\System\KeybXTU.exe
  C:\Windows\System\KeybXTU.exe
  2⤵
  PID:9888
- C:\Windows\System\UMCkFvY.exe
  C:\Windows\System\UMCkFvY.exe
  2⤵
  PID:9900
- C:\Windows\System\CnVvzKv.exe
  C:\Windows\System\CnVvzKv.exe
  2⤵
  PID:9924
- C:\Windows\System\JQaOHqw.exe
  C:\Windows\System\JQaOHqw.exe
  2⤵
  PID:9952
- C:\Windows\System\EgJEopC.exe
  C:\Windows\System\EgJEopC.exe
  2⤵
  PID:9968
- C:\Windows\System\YEJwkMI.exe
  C:\Windows\System\YEJwkMI.exe
  2⤵
  PID:9984
- C:\Windows\System\bUFNGvd.exe
  C:\Windows\System\bUFNGvd.exe
  2⤵
  PID:10020
- C:\Windows\System\PThqxuE.exe
  C:\Windows\System\PThqxuE.exe
  2⤵
  PID:10188
- C:\Windows\System\PAqwhug.exe
  C:\Windows\System\PAqwhug.exe
  2⤵
  PID:10228
- C:\Windows\System\kEBXVJW.exe
  C:\Windows\System\kEBXVJW.exe
  2⤵
  PID:10236
- C:\Windows\System\KPDnvNM.exe
  C:\Windows\System\KPDnvNM.exe
  2⤵
  PID:8584
- C:\Windows\System\yyKpgyq.exe
  C:\Windows\System\yyKpgyq.exe
  2⤵
  PID:10060
- C:\Windows\System\ZxEZcMK.exe
  C:\Windows\System\ZxEZcMK.exe
  2⤵
  PID:9504
- C:\Windows\System\mBEnoGy.exe
  C:\Windows\System\mBEnoGy.exe
  2⤵
  PID:10096
- C:\Windows\System\gGdsVDV.exe
  C:\Windows\System\gGdsVDV.exe
  2⤵
  PID:10116
- C:\Windows\System\jaarpdw.exe
  C:\Windows\System\jaarpdw.exe
  2⤵
  PID:10132
- C:\Windows\System\TloStGO.exe
  C:\Windows\System\TloStGO.exe
  2⤵
  PID:10152
- C:\Windows\System\UFPsgah.exe
  C:\Windows\System\UFPsgah.exe
  2⤵
  PID:10176
- C:\Windows\System\mRlAwML.exe
  C:\Windows\System\mRlAwML.exe
  2⤵
  PID:10196
- C:\Windows\System\YtRThjo.exe
  C:\Windows\System\YtRThjo.exe
  2⤵
  PID:10216
- C:\Windows\System\gWiVpJg.exe
  C:\Windows\System\gWiVpJg.exe
  2⤵
  PID:8588
- C:\Windows\System\XBHoDeG.exe
  C:\Windows\System\XBHoDeG.exe
  2⤵
  PID:9356
- C:\Windows\System\ovJmvtA.exe
  C:\Windows\System\ovJmvtA.exe
  2⤵
  PID:9492
- C:\Windows\System\hrkRCZJ.exe
  C:\Windows\System\hrkRCZJ.exe
  2⤵
  PID:9580
- C:\Windows\System\MgfKdvu.exe
  C:\Windows\System\MgfKdvu.exe
  2⤵
  PID:9628
- C:\Windows\System\zLQQKOH.exe
  C:\Windows\System\zLQQKOH.exe
  2⤵
  PID:8832
- C:\Windows\System\KGRSyET.exe
  C:\Windows\System\KGRSyET.exe
  2⤵
  PID:8928
- C:\Windows\System\SWaoadR.exe
  C:\Windows\System\SWaoadR.exe
  2⤵
  PID:8932
- C:\Windows\System\ycAizSa.exe
  C:\Windows\System\ycAizSa.exe
  2⤵
  PID:9028
- C:\Windows\System\qXurMYN.exe
  C:\Windows\System\qXurMYN.exe
  2⤵
  PID:9000
- C:\Windows\System\bhiNYhm.exe
  C:\Windows\System\bhiNYhm.exe
  2⤵
  PID:8312
- C:\Windows\System\xQKfgkp.exe
  C:\Windows\System\xQKfgkp.exe
  2⤵
  PID:8360
- C:\Windows\System\WSsYIlZ.exe
  C:\Windows\System\WSsYIlZ.exe
  2⤵
  PID:8964
- C:\Windows\System\QDDKpSH.exe
  C:\Windows\System\QDDKpSH.exe
  2⤵
  PID:8716
- C:\Windows\System\saundFM.exe
  C:\Windows\System\saundFM.exe
  2⤵
  PID:8784
- C:\Windows\System\MYnWPte.exe
  C:\Windows\System\MYnWPte.exe
  2⤵
  PID:8912
- C:\Windows\System\gtYVijJ.exe
  C:\Windows\System\gtYVijJ.exe
  2⤵
  PID:9048
- C:\Windows\System\xYadAsY.exe
  C:\Windows\System\xYadAsY.exe
  2⤵
  PID:9108
- C:\Windows\System\aqWXpCN.exe
  C:\Windows\System\aqWXpCN.exe
  2⤵
  PID:8760
- C:\Windows\System\StrvttX.exe
  C:\Windows\System\StrvttX.exe
  2⤵
  PID:9348
- C:\Windows\System\CVtjiKY.exe
  C:\Windows\System\CVtjiKY.exe
  2⤵
  PID:9188
- C:\Windows\System\ELFpwNI.exe
  C:\Windows\System\ELFpwNI.exe
  2⤵
  PID:8168
- C:\Windows\System\NvFtOkB.exe
  C:\Windows\System\NvFtOkB.exe
  2⤵
  PID:9396
- C:\Windows\System\zxOyakz.exe
  C:\Windows\System\zxOyakz.exe
  2⤵
  PID:8280
- C:\Windows\System\tkDNtaJ.exe
  C:\Windows\System\tkDNtaJ.exe
  2⤵
  PID:9420
- C:\Windows\System\ULGEFvv.exe
  C:\Windows\System\ULGEFvv.exe
  2⤵
  PID:9436
- C:\Windows\System\UpIAzgY.exe
  C:\Windows\System\UpIAzgY.exe
  2⤵
  PID:9464
- C:\Windows\System\ERQYJfX.exe
  C:\Windows\System\ERQYJfX.exe
  2⤵
  PID:9476
- C:\Windows\System\EcOZpgW.exe
  C:\Windows\System\EcOZpgW.exe
  2⤵
  PID:9516
- C:\Windows\System\qyTeTBK.exe
  C:\Windows\System\qyTeTBK.exe
  2⤵
  PID:9540
- C:\Windows\System\cExTnpb.exe
  C:\Windows\System\cExTnpb.exe
  2⤵
  PID:9268
- C:\Windows\System\WopDYUf.exe
  C:\Windows\System\WopDYUf.exe
  2⤵
  PID:9572
- C:\Windows\System\EIDDwcc.exe
  C:\Windows\System\EIDDwcc.exe
  2⤵
  PID:9596
- C:\Windows\System\lvqDxel.exe
  C:\Windows\System\lvqDxel.exe
  2⤵
  PID:9280
- C:\Windows\System\gdKYDzp.exe
  C:\Windows\System\gdKYDzp.exe
  2⤵
  PID:9316
- C:\Windows\System\lZhunTJ.exe
  C:\Windows\System\lZhunTJ.exe
  2⤵
  PID:9676
- C:\Windows\System\lXzjLoN.exe
  C:\Windows\System\lXzjLoN.exe
  2⤵
  PID:9660
- C:\Windows\System\YMWMhoi.exe
  C:\Windows\System\YMWMhoi.exe
  2⤵
  PID:9648
- C:\Windows\System\UxOEdeM.exe
  C:\Windows\System\UxOEdeM.exe
  2⤵
  PID:9688
- C:\Windows\System\nkKgMMh.exe
  C:\Windows\System\nkKgMMh.exe
  2⤵
  PID:9472
- C:\Windows\System\sZPfKBK.exe
  C:\Windows\System\sZPfKBK.exe
  2⤵
  PID:9528
- C:\Windows\System\uMJRnAx.exe
  C:\Windows\System\uMJRnAx.exe
  2⤵
  PID:9716
- C:\Windows\System\UjkuclS.exe
  C:\Windows\System\UjkuclS.exe
  2⤵
  PID:9860
- C:\Windows\System\PFjJxTl.exe
  C:\Windows\System\PFjJxTl.exe
  2⤵
  PID:8472
- C:\Windows\System\QsiTBpD.exe
  C:\Windows\System\QsiTBpD.exe
  2⤵
  PID:10048
- C:\Windows\System\uTohwTz.exe
  C:\Windows\System\uTohwTz.exe
  2⤵
  PID:9204
- C:\Windows\System\wETDipH.exe
  C:\Windows\System\wETDipH.exe
  2⤵
  PID:10056
- C:\Windows\System\hhBNkLV.exe
  C:\Windows\System\hhBNkLV.exe
  2⤵
  PID:10124
- C:\Windows\System\UoyspCd.exe
  C:\Windows\System\UoyspCd.exe
  2⤵
  PID:10232
- C:\Windows\System\BMDjghL.exe
  C:\Windows\System\BMDjghL.exe
  2⤵
  PID:10208
- C:\Windows\System\MhLhzNX.exe
  C:\Windows\System\MhLhzNX.exe
  2⤵
  PID:9568
- C:\Windows\System\KbqqfvY.exe
  C:\Windows\System\KbqqfvY.exe
  2⤵
  PID:9144
- C:\Windows\System\ScBWJuB.exe
  C:\Windows\System\ScBWJuB.exe
  2⤵
  PID:8804
- C:\Windows\System\SonuKhI.exe
  C:\Windows\System\SonuKhI.exe
  2⤵
  PID:10072
- C:\Windows\System\LLlEddI.exe
  C:\Windows\System\LLlEddI.exe
  2⤵
  PID:8836
- C:\Windows\System\gcBVUsJ.exe
  C:\Windows\System\gcBVUsJ.exe
  2⤵
  PID:9156
- C:\Windows\System\tCFGBUy.exe
  C:\Windows\System\tCFGBUy.exe
  2⤵
  PID:9896
- C:\Windows\System\mdWwGHg.exe
  C:\Windows\System\mdWwGHg.exe
  2⤵
  PID:8444
- C:\Windows\System\MySNNLT.exe
  C:\Windows\System\MySNNLT.exe
  2⤵
  PID:8536
- C:\Windows\System\eALKWqm.exe
  C:\Windows\System\eALKWqm.exe
  2⤵
  PID:8916
- C:\Windows\System\OQYWBIC.exe
  C:\Windows\System\OQYWBIC.exe
  2⤵
  PID:9336
- C:\Windows\System\UNGVKZL.exe
  C:\Windows\System\UNGVKZL.exe
  2⤵
  PID:7912
- C:\Windows\System\veQFexe.exe
  C:\Windows\System\veQFexe.exe
  2⤵
  PID:9428
- C:\Windows\System\rOXlXLQ.exe
  C:\Windows\System\rOXlXLQ.exe
  2⤵
  PID:9532
- C:\Windows\System\fcuNBem.exe
  C:\Windows\System\fcuNBem.exe
  2⤵
  PID:9256
- C:\Windows\System\EVQxHKY.exe
  C:\Windows\System\EVQxHKY.exe
  2⤵
  PID:9352
- C:\Windows\System\xXUTJDu.exe
  C:\Windows\System\xXUTJDu.exe
  2⤵
  PID:9140
- C:\Windows\System\QWRbQvZ.exe
  C:\Windows\System\QWRbQvZ.exe
  2⤵
  PID:9260
- C:\Windows\System\wFduRqW.exe
  C:\Windows\System\wFduRqW.exe
  2⤵
  PID:9388
- C:\Windows\System\BpUciPk.exe
  C:\Windows\System\BpUciPk.exe
  2⤵
  PID:9536
- C:\Windows\System\zCLJRga.exe
  C:\Windows\System\zCLJRga.exe
  2⤵
  PID:9500
- C:\Windows\System\TcnNpwO.exe
  C:\Windows\System\TcnNpwO.exe
  2⤵
  PID:8620
- C:\Windows\System\QxPHbRs.exe
  C:\Windows\System\QxPHbRs.exe
  2⤵
  PID:9684
- C:\Windows\System\bwVsQsW.exe
  C:\Windows\System\bwVsQsW.exe
  2⤵
  PID:9756
- C:\Windows\System\otELObV.exe
  C:\Windows\System\otELObV.exe
  2⤵
  PID:9852
- C:\Windows\System\bsZHpuP.exe
  C:\Windows\System\bsZHpuP.exe
  2⤵
  PID:9960
- C:\Windows\System\vsSFXpL.exe
  C:\Windows\System\vsSFXpL.exe
  2⤵
  PID:10012
- C:\Windows\System\teNjwSF.exe
  C:\Windows\System\teNjwSF.exe
  2⤵
  PID:9996
- C:\Windows\System\eYVHJyY.exe
  C:\Windows\System\eYVHJyY.exe
  2⤵
  PID:10212
- C:\Windows\System\GMnovBw.exe
  C:\Windows\System\GMnovBw.exe
  2⤵
  PID:10172
- C:\Windows\System\cLcctCV.exe
  C:\Windows\System\cLcctCV.exe
  2⤵
  PID:10092
- C:\Windows\System\MbNuvpA.exe
  C:\Windows\System\MbNuvpA.exe
  2⤵
  PID:10192
- C:\Windows\System\ayWzFEQ.exe
  C:\Windows\System\ayWzFEQ.exe
  2⤵
  PID:8816
- C:\Windows\System\HJajSuu.exe
  C:\Windows\System\HJajSuu.exe
  2⤵
  PID:8852
- C:\Windows\System\vRRAxGv.exe
  C:\Windows\System\vRRAxGv.exe
  2⤵
  PID:9488
- C:\Windows\System\vJCfucz.exe
  C:\Windows\System\vJCfucz.exe
  2⤵
  PID:8984
- C:\Windows\System\YurxPAd.exe
  C:\Windows\System\YurxPAd.exe
  2⤵
  PID:10140
- C:\Windows\System\UYPGuft.exe
  C:\Windows\System\UYPGuft.exe
  2⤵
  PID:8944
- C:\Windows\System\kUlLuHc.exe
  C:\Windows\System\kUlLuHc.exe
  2⤵
  PID:9012
- C:\Windows\System\UsCWwxU.exe
  C:\Windows\System\UsCWwxU.exe
  2⤵
  PID:9236
- C:\Windows\System\NjouNLS.exe
  C:\Windows\System\NjouNLS.exe
  2⤵
  PID:9244
- C:\Windows\System\XBUKcLV.exe
  C:\Windows\System\XBUKcLV.exe
  2⤵
  PID:9292
- C:\Windows\System\jIFFtnx.exe
  C:\Windows\System\jIFFtnx.exe
  2⤵
  PID:9112
- C:\Windows\System\NFPvpdO.exe
  C:\Windows\System\NFPvpdO.exe
  2⤵
  PID:9440
- C:\Windows\System\ZpjdyHV.exe
  C:\Windows\System\ZpjdyHV.exe
  2⤵
  PID:9700
- C:\Windows\System\sQEoQDA.exe
  C:\Windows\System\sQEoQDA.exe
  2⤵
  PID:9324
- C:\Windows\System\UEKiqkX.exe
  C:\Windows\System\UEKiqkX.exe
  2⤵
  PID:9496
- C:\Windows\System\wCnHMmc.exe
  C:\Windows\System\wCnHMmc.exe
  2⤵
  PID:9588
- C:\Windows\System\MwKhcWV.exe
  C:\Windows\System\MwKhcWV.exe
  2⤵
  PID:9740
- C:\Windows\System\jUbDxyB.exe
  C:\Windows\System\jUbDxyB.exe
  2⤵
  PID:9452
- C:\Windows\System\GbNPuOP.exe
  C:\Windows\System\GbNPuOP.exe
  2⤵
  PID:9792
- C:\Windows\System\SEWRjTH.exe
  C:\Windows\System\SEWRjTH.exe
  2⤵
  PID:9816
- C:\Windows\System\HcDCyBQ.exe
  C:\Windows\System\HcDCyBQ.exe
  2⤵
  PID:9344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ABPAoJp.exe

Filesize
2.2MB

MD5
2810df39b0db23152376640a6c15bc77

SHA1
c57391c5267b650da49ad9767006334d69be7040

SHA256
10eec28cc61635ff9fbf4b73794cf2553e8dbd0a100d9e62f94be3e40162fa0d

SHA512
65efab8652d7746192baa6e23feaf22a737ee1202eb4d9dbfbbe525e7f612a0c3145eb727313cbdad95fef1b5cb5a0cb3cfe3a3ccfd0fca6ce71dc777e398685

Download Submit
C:\Windows\system\AjTkIol.exe

Filesize
2.2MB

MD5
a25d81e68e2cea78bb4e4effce2a6c47

SHA1
d87693b4bd72630115d93a7a41d5e92f67bd1dc4

SHA256
fc0a8470b701b92f28a999640a78bb176c46f4a0dca1f648cda2e95090cebb49

SHA512
b71815dc5bbc56356acb20247f970510bbe569df877a579fcfb8ba5fd0bab47a8c030847faeaf396a9ee2c1fdc78f85e6c5d45f8b0d9f896d99ab81778d56d6a

Download Submit
C:\Windows\system\CeggwID.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
C:\Windows\system\FbREYPY.exe

Filesize
2.2MB

MD5
9adf6286010495f3042f9032d9062f10

SHA1
16c9324e78745edd3c33714c957242cd356e4919

SHA256
e6177567ef04dcf244bad5827b31f002be94af2f7d33003f34b33c8216e5cd54

SHA512
b6f39b80841c95441896f2602813e3eca8475b80b740f2a4868d6a438d9b05d2774526ab8ab627a232b844d0f75aacc89091b9bc3487045e52abcfe18a7a11d4

Download Submit
C:\Windows\system\GcnKbVi.exe

Filesize
2.2MB

MD5
6fc8a93a5996ffeff9867817b69fa23a

SHA1
b9110d02c0021655750c5eb5ddd74d1d548ae18b

SHA256
00e18e733ec649e3d7f3d9ec631a6a43f06118df068367cc941cd79425d5d154

SHA512
8a1a6ea50476f03b513a58eb66ee61102bfd17a7b30211327c2d78842eaff8270f1bd0d2c7f9d0dd002d24925f5e8048f1bed05072da26c02fe0ce13177a350d

Download Submit
C:\Windows\system\JTWIEjq.exe

Filesize
2.2MB

MD5
e09bcacc3a7d6f1a0ce5af4280b3861d

SHA1
df8505555280b158f1d5c4ea98d1952df10ea4d6

SHA256
3b3d819cf9046c3b1341dc5c8e5db63ebb65b3f09eddd5c42ee12a4baf6a94d1

SHA512
25572be1bb05738e0d2e4920b988e07518284e3f243f1e94fdd2e77bff1687542f17d69393a003b94d7fad50fe662367dc2ecce9844e19c2945f4c897f6b615f

Download Submit
C:\Windows\system\KwKqHyM.exe

Filesize
2.2MB

MD5
eef02ead4f28b66441a9eb6d678609c6

SHA1
b375a0995a4377825fdf7aca8acd656303363291

SHA256
b280566b6d07f723f02fa9cbd6aaecce448bfdb4f35a6ffe6865b3676b0d226a

SHA512
61c899a3e77fbc47ee2c383479eb83b19a15f4cfd5a10dc3d376793d491304ef421ed949fd74ce51f3d8dfc943c270384911397787cff4bc103550e8ee8e7bd8

Download Submit
C:\Windows\system\MZFBLkK.exe

Filesize
2.2MB

MD5
7e089c608c4ef4ab564a2a44a368ef64

SHA1
b45330b4080c6932eb6617518774838f8ff51a62

SHA256
c630eacae31e8288e7a00e23fd1ec21d4749832363c741712d9062034dc0e338

SHA512
864f2b5084291a9359378bb65273fbd2ba63785d20631c9a5ed53df80fa9558336e75e9f5f0618e839e68e1838905e853b25e0c8654ee394c4a02556713355c4

Download Submit
C:\Windows\system\OlWensT.exe

Filesize
2.2MB

MD5
c84063b380e2761b709d6a8e1173b619

SHA1
e9713b1acfd7dbb839b3762bdb595c4ed2e37919

SHA256
4182f508484426d445b2297f35fb26c79e21e5dce215cac5f305863710e7d729

SHA512
e432f3c02fe2909b56a38f447d09e6f4a3eaaf3fa3828c3c729d62212f0e5b08ce56b08d61f78659a1b33707d73ce4d1e6812de99dbd9f7ffa5f72d5458f2f9f

Download Submit
C:\Windows\system\PKmKFfq.exe

Filesize
2.2MB

MD5
0873263b38987b83ca9d02b0554a02da

SHA1
2c51dc5acf9294180fc983ea1fe31dedb8e8c2d1

SHA256
0d949995342d4b5c63f85ee3e0f19436417fdc08a3031286d76ddb31698f5171

SHA512
3ebf6eb098bad04e6310ab96e26859561723e7fb633a8c953a88e12f1121c2f19b24d0894b7cbe505207256d7f76b523381cdfb7eef9d7ea8915ae4834ca5031

Download Submit
C:\Windows\system\RHEwQtw.exe

Filesize
2.2MB

MD5
50ee72a35e145cc4502f5527b634965e

SHA1
df4b61e7f76aecf07e4b23a5db766d8b795abedc

SHA256
3793a2477dfda8772ad53baa76ab8f50a5c69e07541310ba23ec33f40e5b2377

SHA512
81472bc32b5d7cb3e282650dd89b6021e735ae8cdef513fec711bb798d10ee2bc3ed57ef09fe6d55d02a006ed28fd82f7d32db8b5144824a34b1c36fbacf39f2

Download Submit
C:\Windows\system\RTJqPZv.exe

Filesize
2.2MB

MD5
84a24c31dce44b96d9ac5fe491fef693

SHA1
56317741dac71cf5bec62a870d91f1c35f84654f

SHA256
fff2d481645c2b5f76332adcf514a5c0713f851ae567660a3dff0a0bdc371fc3

SHA512
8779830c2f796b907540353732c7cbfa59b5df6d7fc89163dcf34dd174d6501471ab51b684d32daf3d8d9f4e31db6e5023e9d1ef3923cb36970df766f095cfaf

Download Submit
C:\Windows\system\SVNMKjf.exe

Filesize
2.2MB

MD5
2c2f67bcb8d626cfa3f971b6a7e52f33

SHA1
b92badd09e8420018e66837241ead71e7e73f3d6

SHA256
de30bdd3a0ff140b067bec1b81e8952de4899364aeb8011572f60485f25aca29

SHA512
3e7011fbf0ef514262cef573d66c0557166a86a8b16ec334e9e9695312e7d08dce9d16f213dbc6c65417fa1af14f1ff8cfbfcabd93203243605efa57e90ea2e0

Download Submit
C:\Windows\system\UOexGWa.exe

Filesize
2.2MB

MD5
c10b8068751c79c6bb077e2f435ef350

SHA1
16795b9f893dc60d6ed11c3e2cc714ef71a01725

SHA256
a7ac13a25702ec13fa49dc14d15ae21778645119ebb8c4e4a75f53bdc294b9d0

SHA512
1171ca83cbe2447cf7b141f5414688fe9bb075ca9b8e75b40500aa903ebe1a58601f4f2db1976c09648ea6bd7176f308073f860e62b7551e179108f910341744

Download Submit
C:\Windows\system\UQNcKum.exe

Filesize
2.2MB

MD5
95641f3010c20b29f4c21929ff183945

SHA1
d7db3cd6902f178eae2e6fe664161b63f9db1bc9

SHA256
223cbcaed72b25808ac40bd75879311300d4eafd6fb0058b171b88ad6f461176

SHA512
8b1a4472cd7998fc76615cbcbbff80164f56194dfc932d8913820a8ca20ceff25a5da9b07a953e861ff24054928a6a7ff8185ab3ab6aafe6ad1c6f9ee4237118

Download Submit
C:\Windows\system\VTrkvYw.exe

Filesize
2.2MB

MD5
dae96416457bc9f4ca7b246315156cb4

SHA1
b3e07ff8e31842d3f0a2463ac364a5161939bf54

SHA256
d8eb2eb5ad459b0aa7ac2dcc17bc143547b2ca469f60fe048c1a3b8d75cd6966

SHA512
f7f50372edb0ffdca16bb459e653f54c1790f38ceba3c626e4b32cfebff08fa1700da78f3a0aed9bba023e56ffa688af94ee08ecd014be7a5773d52cc1f04d74

Download Submit
C:\Windows\system\YObcLeU.exe

Filesize
2.2MB

MD5
e6178003cb4f3380bc6b7ca8108855fd

SHA1
15b1df5de8b533529f7292e34184911986a3eefa

SHA256
30ff4cde320645a392a31ff3dd4e6e35c6ae235bdb4d3b020fa13d9b65ba5b36

SHA512
660f55f745044bcad6fa6c313225b9023043495e9425de249e97e5ff2fede18f02c6e3c6ffe475a09d6e4587a1d4709b5db4025f7f158f5e3d02cfb12b773dc4

Download Submit
C:\Windows\system\YSOfcDW.exe

Filesize
2.2MB

MD5
e75b95fc8da2d190501426a50885360e

SHA1
950bd4ef243b7a7643610fd7768cfbd8ea5a0f84

SHA256
69cef37a2479b2770a2a56a2e0b740dff216670e3d7fd453bcf843b252682d95

SHA512
78cf768906b9a6a7f92dd656322144d0f57ba9823af2c0056c264f9370a594a40fc975375362ab05261e0aa7c9fcc36c1a1d54afc3d62061a2d2b6a915c91be3

Download Submit
C:\Windows\system\YvwCoRe.exe

Filesize
2.2MB

MD5
b37bfea3f0a745d4338815b8da59c9a3

SHA1
f9b3b7c7f6af1ca70bd7d45ae3cec28b51967090

SHA256
9512dd7e9cdded932145db4487c567d5dc053b4b4e7781f5e3823f801b164607

SHA512
20448b3eda38254928eceaf441cf9618cc4667bc9a7cdb3b0ade07f8c68f107f396b1ab8ef2ca8ee8a3a6ebb0c7842046dc2bf99308609b795def8e8578c6ea3

Download Submit
C:\Windows\system\ajQnpic.exe

Filesize
2.2MB

MD5
9e69d932e2e3510b60a49317a52cc75c

SHA1
08c54d2f019120f822fbf3eb0246539a0fcafbf1

SHA256
e62c97d6bfb93114863285e0a2071edea0fc944dc19737e40a9e6e9c779b2a00

SHA512
e0afdc39be701d2120d2ea63fdf40d044772fca273ff601b49acdf1d01882812f77b7a235fcc327898fcb71b463be4df5ca057f8e2a60eb451f2f6560b8768dd

Download Submit
C:\Windows\system\anKygPf.exe

Filesize
2.2MB

MD5
375eb0055cfb6d22ad282d236c63906f

SHA1
f772bc4448095e38be4828ba0b7dbcc7f95e85b4

SHA256
9933c4d378979146525833996692b4b6ceaaf6f43ed65b3a6ed5c21c9fde5031

SHA512
8224109045d876175550933e7446c8e37ed30a6f0942967c4d347527d02888a585369025332d4d1991cf4ca3baf030149693d6459095c0cab6d646bb19545eb0

Download Submit
C:\Windows\system\hsfhcmz.exe

Filesize
2.2MB

MD5
984fbb41229d73dba7d20be71040cf9e

SHA1
4f7032e39054a6a0be572fcfcf91c7af693c32f4

SHA256
d5694ae374381dd113ec7213d6dc64cf82a3edb691d2932eaefb9a9cacfe2962

SHA512
45b41f2985501d3c9872fdb07d7bf18bead5a7f6e8dead3b42bd7de8850cfe069059852ad7b74ef1956293643cadf382ee4f2a49dc9c6f3b74dae1ad74750220

Download Submit
C:\Windows\system\lcOjGXx.exe

Filesize
2.2MB

MD5
feede25e0bf4b84944be917e0522956c

SHA1
e31018c4828a3dd55bd2a6cf8dd1357112ff626e

SHA256
5155526e3cd657eb8c463f3af37f0af920b8a5286589dec5121d6e986ec71a39

SHA512
626e9df2462cbc493a75268aaf9af208d5176c2bbf3ae68756094c51cceba86bca88b3dc2a62c44262b5e774f02c97fe4690e3a02d1e98aa9ddacee24bd36a3d

Download Submit
C:\Windows\system\lzRnOTu.exe

Filesize
2.2MB

MD5
7a51a1b72bb5c894862308e88b850955

SHA1
59287c5a561b2ea6f3f2f95c0d4375be8b1c80e5

SHA256
a57721385905dc1f0d7090217cd0ac9244ba802c07607cbe2825aeabf81eebb4

SHA512
82cd77efc63ff992c8af51187bad97fb33f9f0ba16b1d47082ec374818d154d892a13ea37488a3d4e5b1d4eb63ee71463d7ea8b7c553825c3e01f5780191dc41

Download Submit
C:\Windows\system\nGoyjjC.exe

Filesize
2.2MB

MD5
90615a1fba0b15c53077e65b0582beb8

SHA1
5bceafe8ddd06651292f079f9ee02406481987a3

SHA256
09f62030292c5ca863ba77571bee17d813e77052f5d0d4e9d361ad0fc7ef8efc

SHA512
af9790a1fbd41991db021d5d9d7879acb8c2a9f1ed20c4965665d625ea6e5acbda7bbb21c2205a1478e33ecb8aeb6ab8b3ee947aadddcf612686f41b2412e417

Download Submit
C:\Windows\system\nmbdBkb.exe

Filesize
2.2MB

MD5
29517488bd225eaaa756cca9cd7c3f3f

SHA1
b5ec56236dadd6a60c63a4156ecc9a36dda668cf

SHA256
242c9459e3192b62eeab6838afcfb3f298a7ef6e5d7457e60c9004d84e8aee8b

SHA512
0270d389666489e5f9832301e045a36a8a95075cd2f00ad77ddd4cecd517e085e49bb37ea7f684ab461e37cb98ac53873ddd03e75b95c9ab96fe6becb8b9a9a4

Download Submit
C:\Windows\system\oyhqctV.exe

Filesize
2.2MB

MD5
7213771e7b708e26a6aaaa7e37c70cc8

SHA1
f932ca51447b71cbf96b0e0034ffda013ed9d0bb

SHA256
a7d5747e67aff8c3691ccadc87d3bed778fff2f585e9f44cf58929d3a37d54b8

SHA512
a3d6aae1ad1d35e7eb73ea6fd7980c9931d752334dddb6634c81ac938c9a3a0480d4e7a83c58435da8333fb09477875a9dd604bec9a97540c417b6325a51cc58

Download Submit
C:\Windows\system\sKEjVhB.exe

Filesize
2.2MB

MD5
673b3f218e3da5acb975273bf0fd224d

SHA1
4a755e887ba54079fbe9bc42e04a8697b7de3073

SHA256
b96e583b74e3f42a9595ac823263c8f29f3ca756df32b4a620df4de3da439c8a

SHA512
90f450b1e88ac212e30815a4f3d7cc1b49a022f2b277df208bc872a7c210efcafb7461f69e9b808f7cbc7cf1baf7dc228799ac666cf33f0005b6cecd5a81c9ec

Download Submit
C:\Windows\system\swNYEjG.exe

Filesize
2.2MB

MD5
1bf0556273910e2e16b089c05a331ce3

SHA1
6a7f6925aec96b28e97d2b885476d3accada9428

SHA256
68b0d626f4012ae35123a4b45b83a9d173af4bb40a969011854d10544cbf4c91

SHA512
726822874fb9692fcd45dfebad5dc7d1c0ba341af21858c4ee21cd6f6d1cf96234aa92ca13a746a5bef534dabbbfe9654bc80c60b14ef379fee0135ed98534a0

Download Submit
C:\Windows\system\uKQFROP.exe

Filesize
2.2MB

MD5
072fbe674576e42d8498625a5c2c44b8

SHA1
ad480d7302156f2b4c924333d93869069f327807

SHA256
0d4ffa248e48ed695585f8b7a87938c692df06ffa2bcb7e231e559040b7c6a21

SHA512
3f43e204a0f59596cb8627e0d4e0f30310d813c613fba149798d83c89de824895525cc3d686ccd361b5116fc4013ee08ea1753d2dec40053edc7af62b7d63a57

Download Submit
\Windows\system\EAXPleH.exe

Filesize
2.2MB

MD5
7fb0761e02a18bcfa83c1ae454f31c67

SHA1
0c4ba689709ae6bb0c4d1740ed8dc8c491f592f4

SHA256
cc59f50c42861db162abaa9c4afd8fa7f04370c7794587a01f580a62f8163473

SHA512
ac00a15d566cb92dea66cba73b5bc5f85bdb5f2b2b3a7736bb13073fc466503774b2c43aa0ade87bc9daa2539eee6f0a23a7b21a1b4b965a22972318ac38c418

Download Submit
\Windows\system\aXJuTkE.exe

Filesize
2.2MB

MD5
5f56bcbb975d3d1dd5c106d5bae02401

SHA1
b706ace23c5540491a167f46bc4eb846b36923dc

SHA256
70dbe52759ed00e5011aee381e1d740b7c6d0e99d4bb01db72b6323a708c721e

SHA512
f983fe218fa91a2a2832795805162927936986a2c5e4e8669948bb36fc714d13cd8156adec356a8f146434cb883f5b2d6bc5554b5738c095e796b8a032111472

Download Submit
\Windows\system\dmjOTzO.exe

Filesize
2.2MB

MD5
46282d23c2715ec8b60cfc70d0587e4f

SHA1
5459c2085b8f5673627b7e425dcf10c3041963b1

SHA256
437b16c62fc27c2a9bcf3bb23fe4db0258774545f0bc9011e2223d3407710070

SHA512
6f17f810e2def189fd71306aeabae5b83bb39cf0ec409784fe459cfbfd4039ad57e772a8e3a751d5b03a7980647f751ff3476e20422065026ef24b94310e82d1

Download Submit
\Windows\system\tKmLrAe.exe

Filesize
2.2MB

MD5
4ff950fc832088b5d4c52bb38ca183ce

SHA1
0ca3f8f48790551ef55e8c92f2aea4a5b70d3364

SHA256
4b772960078c549914968a69b6cc8a5a4766e6bf03c06e0fd38bb7f656ea0b09

SHA512
22c56f2b498750d1f5017d4684c0e64d9d96e701777f61c5bb1705aa0b9e17ccae453b5a85aa98c21eb2c5f7e04367f7fbfdcea54aa18ca137eefa713f9259f4

Download Submit
\Windows\system\uZTIgaX.exe

Filesize
2.2MB

MD5
d27415610ff18f72bc9c43f0225b5b43

SHA1
89dae3d475a94d632f6fa31858e42cfa6fbc8947

SHA256
36ba5c2885cd29c835228537c2ad1aac12cd35a120e63ae31fc52c87e067696c

SHA512
e03f8adf95a99983eef314002bf1d86734dbd0e1cabeb79a5a874b1bd10aa074297a35ad23a5e7e632b65be9f09a5d3cb96510182edddb246f0e6edbdd5be061

Download Submit
memory/1732-171-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2132-140-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/2132-197-0x0000000002690000-0x0000000002698000-memory.dmp

Filesize
32KB

Download
memory/2164-141-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2164-4437-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-20-0x000000013F9F0000-0x000000013FDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-50-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-175-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2360-142-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-160-0x0000000003110000-0x0000000003502000-memory.dmp

Filesize
3.9MB

Download
memory/2360-166-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-148-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2360-176-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2360-179-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2360-57-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-86-0x0000000003110000-0x0000000003502000-memory.dmp

Filesize
3.9MB

Download
memory/2360-167-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2360-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2360-181-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-2-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-47-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-177-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/2556-4448-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2556-173-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2592-4445-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2592-172-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2628-180-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-4451-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2748-4402-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2748-178-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2796-174-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2796-4444-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/3024-104-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/3024-4442-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download