xmrig | e6062cb56ada327bbd6d725efb61ffd996b8feaa1b11352fa14c2481b891db8c

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14fae000e042720194413b5501891e6f_JaffaCakes118.exe
Size

2.3MB
MD5

14fae000e042720194413b5501891e6f
SHA1

c17b5c9b65fc213b26862fd1816a886a7625444e
SHA256

e6062cb56ada327bbd6d725efb61ffd996b8feaa1b11352fa14c2481b891db8c
SHA512

6d4b5781252e3247b51e86044aed9373d53473ad4fd0179cd78e3e6d5708ae620aa28ff68b0e66b43095ab9f4ad41808ef50f955f08b4666eed067a82d03ef3e
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//LZ:NABN

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/2656-63-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/2400-65-0x000000013F070000-0x000000013F462000-memory.dmp	xmrig
behavioral1/memory/2004-1188-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2004-64-0x00000000035B0000-0x00000000039A2000-memory.dmp	xmrig
behavioral1/memory/2004-60-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2548-58-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2628-46-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2956-35-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2012-14-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2968-13-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2400-4973-0x000000013F070000-0x000000013F462000-memory.dmp	xmrig
behavioral1/memory/2012-4975-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2956-4980-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2628-4983-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2968-4981-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2656-5003-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/2104-5046-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2548-5047-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2568-5051-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2040	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2968	SLmjsoM.exe
2012	ZhTAuGr.exe
2956	mkXhnZB.exe
2628	iQHuLSz.exe
2548	DmSoQbT.exe
2656	kIYQnVl.exe
2400	cxekULr.exe
2104	HrxMKyU.exe
2568	BOSLlQZ.exe
2376	LmKyFkN.exe
304	liiWluX.exe
2444	NZlKHJW.exe
1864	KQJgSgq.exe
1680	hERzGWq.exe
1528	zubHdzS.exe
1436	xCvTHro.exe
2676	qAGqwvW.exe
3048	adapgsI.exe
2828	PpmKnpb.exe
336	tBXbQDX.exe
776	BlWUAiT.exe
1456	XwCoWaK.exe
1180	EVKGRqI.exe
2344	IYzkQtO.exe
1128	ZZkeJGF.exe
2068	eViegZb.exe
1460	UtDOYmP.exe
1536	xJuRhEp.exe
2852	VwzscVL.exe
1004	tMjrxUP.exe
768	fmdUhrX.exe
2792	XNLqYDW.exe
1988	HwStXUS.exe
2744	dKdFXsw.exe
1476	WeeXdss.exe
888	FLMcZIH.exe
2780	IcDDELn.exe
1496	BgmqhFd.exe
2984	tMdFKLb.exe
2604	zQSlnrD.exe
2660	bDcPgJo.exe
2328	VnwJKyd.exe
1244	ifiqrLz.exe
1552	jktYaIK.exe
2848	UXXmPgj.exe
648	DmUWvKz.exe
1992	RqaySan.exe
2112	JRlfBeG.exe
1996	SFrUdnm.exe
992	cQrlrPr.exe
3100	jaxnSGl.exe
3132	YunnOpw.exe
3164	acMaYNt.exe
3196	erPPFRO.exe
3228	JmIfwhm.exe
3260	AkOemfh.exe
3292	hfGhrhK.exe
3324	ogliwBY.exe
3356	bdiWvVZ.exe
3388	bmWumdy.exe
3420	iNXIFFT.exe
3452	oupyTdD.exe
3484	JDBBNkm.exe
3516	EQYrsOZ.exe

Loads dropped DLL 64 IoCs

pid	Process
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2004-0-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/files/0x000b0000000143e5-6.dat	upx
behavioral1/files/0x00090000000146f4-7.dat	upx
behavioral1/files/0x00090000000146fc-20.dat	upx
behavioral1/files/0x0007000000014a9a-32.dat	upx
behavioral1/files/0x000a000000014b4c-53.dat	upx
behavioral1/files/0x0008000000015ccd-59.dat	upx
behavioral1/memory/2656-63-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/memory/2400-65-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/files/0x0006000000015d20-78.dat	upx
behavioral1/files/0x0006000000015d93-118.dat	upx
behavioral1/files/0x0006000000016d07-181.dat	upx
behavioral1/files/0x0006000000016d18-183.dat	upx
behavioral1/files/0x0006000000016cdc-176.dat	upx
behavioral1/files/0x0006000000016c64-169.dat	upx
behavioral1/files/0x0006000000016c44-162.dat	upx
behavioral1/files/0x0006000000016851-155.dat	upx
behavioral1/files/0x000600000001658a-148.dat	upx
behavioral1/files/0x000600000001630a-141.dat	upx
behavioral1/files/0x000600000001610f-134.dat	upx
behavioral1/files/0x0006000000015f65-127.dat	upx
behavioral1/files/0x0006000000015e32-120.dat	upx
behavioral1/files/0x0006000000015d87-113.dat	upx
behavioral1/files/0x0006000000015d6b-106.dat	upx
behavioral1/files/0x000a000000014bbc-47.dat	upx
behavioral1/files/0x000e0000000054ab-39.dat	upx
behavioral1/files/0x0006000000015d56-96.dat	upx
behavioral1/files/0x0006000000015d42-81.dat	upx
behavioral1/memory/2104-77-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/files/0x0006000000015ce3-75.dat	upx
behavioral1/files/0x0006000000015cff-73.dat	upx
behavioral1/files/0x0006000000015cd9-66.dat	upx
behavioral1/memory/2004-1188-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/files/0x0006000000016cb0-174.dat	upx
behavioral1/files/0x0006000000016c5e-167.dat	upx
behavioral1/files/0x0006000000016adc-160.dat	upx
behavioral1/files/0x0006000000016616-153.dat	upx
behavioral1/files/0x00060000000164aa-146.dat	upx
behavioral1/files/0x000600000001621e-139.dat	upx
behavioral1/files/0x0006000000015fe5-132.dat	upx
behavioral1/files/0x0006000000015ecc-125.dat	upx
behavioral1/files/0x0006000000015d7f-111.dat	upx
behavioral1/files/0x0006000000015d5f-104.dat	upx
behavioral1/files/0x0006000000015d4e-89.dat	upx
behavioral1/memory/2568-87-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2548-58-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/memory/2628-46-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/files/0x000700000001487f-36.dat	upx
behavioral1/memory/2956-35-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2012-14-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2968-13-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2400-4973-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/memory/2012-4975-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2956-4980-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2628-4983-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/memory/2968-4981-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2656-5003-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/memory/2104-5046-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/2548-5047-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/memory/2568-5051-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WkigDWb.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\TFTCooB.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\ZrMsiwm.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\EfOxvjQ.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\GIKUBei.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\DMKANNh.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\PnymtPW.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\iQlRPMT.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\ybGpdWv.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\NzFDkCl.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\TIEwuno.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\QhFzLAw.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\ZosKQGq.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\ubpUHcS.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\VKQaFRN.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\mvbnLnF.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\uYNhlUV.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\aVzFUhI.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\qVSKNVy.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\yQlhbDD.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\ZYogCrF.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\LhxekKU.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\BbncSCp.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\zRVWaqJ.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\bjhJmbr.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\xoGxvhp.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\TKtbNoY.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\PQAEHyL.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\XnoTHpQ.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\FaytCwc.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\siJSEam.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\XBHqmRa.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\iszBKtS.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\oAlCzxT.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\crTyoeD.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\eJseuAN.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\jKKgWWS.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\rpYoHJY.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\OaTwXSs.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\XWwXJFL.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\KTCXfLC.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\NvDaMJR.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\wHFNlTk.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\YjQMHll.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\qwlVBtx.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\aMuNvoS.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\JKIfDGn.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\UYZhJuq.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\VnTwDbY.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\mkXhnZB.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\NIYuoTf.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\ORqayxu.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\fnlTfZD.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\WJyaqlM.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\CmgXlig.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\dCPqBBz.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\khcSlAH.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\AuvWjIz.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\sqlMJQP.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\lRnOHid.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\xVkqBES.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\ygkCVmV.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\muQTKQW.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
File created	C:\Windows\System\tvFJZqX.exe	14fae000e042720194413b5501891e6f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2040	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe
Token: SeDebugPrivilege	2040	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2040	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	29
PID 2004 wrote to memory of 2040	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	29
PID 2004 wrote to memory of 2040	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	29
PID 2004 wrote to memory of 2968	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	30
PID 2004 wrote to memory of 2968	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	30
PID 2004 wrote to memory of 2968	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	30
PID 2004 wrote to memory of 2012	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	31
PID 2004 wrote to memory of 2012	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	31
PID 2004 wrote to memory of 2012	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	31
PID 2004 wrote to memory of 2956	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	32
PID 2004 wrote to memory of 2956	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	32
PID 2004 wrote to memory of 2956	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	32
PID 2004 wrote to memory of 2548	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	33
PID 2004 wrote to memory of 2548	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	33
PID 2004 wrote to memory of 2548	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	33
PID 2004 wrote to memory of 2628	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	34
PID 2004 wrote to memory of 2628	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	34
PID 2004 wrote to memory of 2628	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	34
PID 2004 wrote to memory of 2104	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	35
PID 2004 wrote to memory of 2104	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	35
PID 2004 wrote to memory of 2104	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	35
PID 2004 wrote to memory of 2656	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	36
PID 2004 wrote to memory of 2656	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	36
PID 2004 wrote to memory of 2656	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	36
PID 2004 wrote to memory of 2444	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	37
PID 2004 wrote to memory of 2444	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	37
PID 2004 wrote to memory of 2444	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	37
PID 2004 wrote to memory of 2400	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	38
PID 2004 wrote to memory of 2400	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	38
PID 2004 wrote to memory of 2400	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	38
PID 2004 wrote to memory of 2632	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	39
PID 2004 wrote to memory of 2632	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	39
PID 2004 wrote to memory of 2632	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	39
PID 2004 wrote to memory of 2568	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	40
PID 2004 wrote to memory of 2568	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	40
PID 2004 wrote to memory of 2568	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	40
PID 2004 wrote to memory of 296	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	41
PID 2004 wrote to memory of 296	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	41
PID 2004 wrote to memory of 296	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	41
PID 2004 wrote to memory of 2376	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	42
PID 2004 wrote to memory of 2376	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	42
PID 2004 wrote to memory of 2376	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	42
PID 2004 wrote to memory of 1008	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	43
PID 2004 wrote to memory of 1008	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	43
PID 2004 wrote to memory of 1008	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	43
PID 2004 wrote to memory of 304	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	44
PID 2004 wrote to memory of 304	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	44
PID 2004 wrote to memory of 304	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	44
PID 2004 wrote to memory of 1676	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	45
PID 2004 wrote to memory of 1676	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	45
PID 2004 wrote to memory of 1676	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	45
PID 2004 wrote to memory of 1864	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	46
PID 2004 wrote to memory of 1864	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	46
PID 2004 wrote to memory of 1864	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	46
PID 2004 wrote to memory of 1620	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	47
PID 2004 wrote to memory of 1620	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	47
PID 2004 wrote to memory of 1620	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	47
PID 2004 wrote to memory of 1680	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	48
PID 2004 wrote to memory of 1680	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	48
PID 2004 wrote to memory of 1680	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	48
PID 2004 wrote to memory of 2160	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	49
PID 2004 wrote to memory of 2160	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	49
PID 2004 wrote to memory of 2160	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	49
PID 2004 wrote to memory of 1528	2004	14fae000e042720194413b5501891e6f_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\14fae000e042720194413b5501891e6f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14fae000e042720194413b5501891e6f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2040
- C:\Windows\System\SLmjsoM.exe
  C:\Windows\System\SLmjsoM.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\ZhTAuGr.exe
  C:\Windows\System\ZhTAuGr.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\mkXhnZB.exe
  C:\Windows\System\mkXhnZB.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\DmSoQbT.exe
  C:\Windows\System\DmSoQbT.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\iQHuLSz.exe
  C:\Windows\System\iQHuLSz.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\HrxMKyU.exe
  C:\Windows\System\HrxMKyU.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\kIYQnVl.exe
  C:\Windows\System\kIYQnVl.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\NZlKHJW.exe
  C:\Windows\System\NZlKHJW.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\cxekULr.exe
  C:\Windows\System\cxekULr.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\vjFlzep.exe
  C:\Windows\System\vjFlzep.exe
  2⤵
  PID:2632
- C:\Windows\System\BOSLlQZ.exe
  C:\Windows\System\BOSLlQZ.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\jIJZyel.exe
  C:\Windows\System\jIJZyel.exe
  2⤵
  PID:296
- C:\Windows\System\LmKyFkN.exe
  C:\Windows\System\LmKyFkN.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\DWZzZKI.exe
  C:\Windows\System\DWZzZKI.exe
  2⤵
  PID:1008
- C:\Windows\System\liiWluX.exe
  C:\Windows\System\liiWluX.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\cNqqOCn.exe
  C:\Windows\System\cNqqOCn.exe
  2⤵
  PID:1676
- C:\Windows\System\KQJgSgq.exe
  C:\Windows\System\KQJgSgq.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\QBzSErU.exe
  C:\Windows\System\QBzSErU.exe
  2⤵
  PID:1620
- C:\Windows\System\hERzGWq.exe
  C:\Windows\System\hERzGWq.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\DIfgDeD.exe
  C:\Windows\System\DIfgDeD.exe
  2⤵
  PID:2160
- C:\Windows\System\zubHdzS.exe
  C:\Windows\System\zubHdzS.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\BSauTJs.exe
  C:\Windows\System\BSauTJs.exe
  2⤵
  PID:1596
- C:\Windows\System\xCvTHro.exe
  C:\Windows\System\xCvTHro.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\xqBQQpR.exe
  C:\Windows\System\xqBQQpR.exe
  2⤵
  PID:2724
- C:\Windows\System\qAGqwvW.exe
  C:\Windows\System\qAGqwvW.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\viqrXds.exe
  C:\Windows\System\viqrXds.exe
  2⤵
  PID:3064
- C:\Windows\System\adapgsI.exe
  C:\Windows\System\adapgsI.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\jWWgHcv.exe
  C:\Windows\System\jWWgHcv.exe
  2⤵
  PID:2056
- C:\Windows\System\PpmKnpb.exe
  C:\Windows\System\PpmKnpb.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\jOdYwEE.exe
  C:\Windows\System\jOdYwEE.exe
  2⤵
  PID:2064
- C:\Windows\System\tBXbQDX.exe
  C:\Windows\System\tBXbQDX.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\VSQyDOD.exe
  C:\Windows\System\VSQyDOD.exe
  2⤵
  PID:984
- C:\Windows\System\BlWUAiT.exe
  C:\Windows\System\BlWUAiT.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\JFvDpMd.exe
  C:\Windows\System\JFvDpMd.exe
  2⤵
  PID:2052
- C:\Windows\System\XwCoWaK.exe
  C:\Windows\System\XwCoWaK.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\BucadVa.exe
  C:\Windows\System\BucadVa.exe
  2⤵
  PID:2816
- C:\Windows\System\EVKGRqI.exe
  C:\Windows\System\EVKGRqI.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\EZbmqVE.exe
  C:\Windows\System\EZbmqVE.exe
  2⤵
  PID:1696
- C:\Windows\System\IYzkQtO.exe
  C:\Windows\System\IYzkQtO.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\EfBBzja.exe
  C:\Windows\System\EfBBzja.exe
  2⤵
  PID:2296
- C:\Windows\System\ZZkeJGF.exe
  C:\Windows\System\ZZkeJGF.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\sgLARZP.exe
  C:\Windows\System\sgLARZP.exe
  2⤵
  PID:2228
- C:\Windows\System\eViegZb.exe
  C:\Windows\System\eViegZb.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\pRtHygb.exe
  C:\Windows\System\pRtHygb.exe
  2⤵
  PID:1668
- C:\Windows\System\UtDOYmP.exe
  C:\Windows\System\UtDOYmP.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\kkeeIdE.exe
  C:\Windows\System\kkeeIdE.exe
  2⤵
  PID:1792
- C:\Windows\System\xJuRhEp.exe
  C:\Windows\System\xJuRhEp.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\abRnjtR.exe
  C:\Windows\System\abRnjtR.exe
  2⤵
  PID:772
- C:\Windows\System\VwzscVL.exe
  C:\Windows\System\VwzscVL.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\NUZlTWF.exe
  C:\Windows\System\NUZlTWF.exe
  2⤵
  PID:1240
- C:\Windows\System\tMjrxUP.exe
  C:\Windows\System\tMjrxUP.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\tYghXUW.exe
  C:\Windows\System\tYghXUW.exe
  2⤵
  PID:2384
- C:\Windows\System\fmdUhrX.exe
  C:\Windows\System\fmdUhrX.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\dNRTtfb.exe
  C:\Windows\System\dNRTtfb.exe
  2⤵
  PID:2992
- C:\Windows\System\XNLqYDW.exe
  C:\Windows\System\XNLqYDW.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\VEElIIT.exe
  C:\Windows\System\VEElIIT.exe
  2⤵
  PID:1360
- C:\Windows\System\HwStXUS.exe
  C:\Windows\System\HwStXUS.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\qwnyVXV.exe
  C:\Windows\System\qwnyVXV.exe
  2⤵
  PID:2264
- C:\Windows\System\dKdFXsw.exe
  C:\Windows\System\dKdFXsw.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\ZcVXdEc.exe
  C:\Windows\System\ZcVXdEc.exe
  2⤵
  PID:1312
- C:\Windows\System\WeeXdss.exe
  C:\Windows\System\WeeXdss.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\ZnSFnrN.exe
  C:\Windows\System\ZnSFnrN.exe
  2⤵
  PID:2032
- C:\Windows\System\FLMcZIH.exe
  C:\Windows\System\FLMcZIH.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\SvXsZhk.exe
  C:\Windows\System\SvXsZhk.exe
  2⤵
  PID:2772
- C:\Windows\System\IcDDELn.exe
  C:\Windows\System\IcDDELn.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\NJQVBIJ.exe
  C:\Windows\System\NJQVBIJ.exe
  2⤵
  PID:1348
- C:\Windows\System\BgmqhFd.exe
  C:\Windows\System\BgmqhFd.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\iYvoKPn.exe
  C:\Windows\System\iYvoKPn.exe
  2⤵
  PID:1276
- C:\Windows\System\tMdFKLb.exe
  C:\Windows\System\tMdFKLb.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\RflqXrt.exe
  C:\Windows\System\RflqXrt.exe
  2⤵
  PID:1268
- C:\Windows\System\zQSlnrD.exe
  C:\Windows\System\zQSlnrD.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\kKVViFT.exe
  C:\Windows\System\kKVViFT.exe
  2⤵
  PID:2640
- C:\Windows\System\bDcPgJo.exe
  C:\Windows\System\bDcPgJo.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\mJQEQsV.exe
  C:\Windows\System\mJQEQsV.exe
  2⤵
  PID:2412
- C:\Windows\System\VnwJKyd.exe
  C:\Windows\System\VnwJKyd.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\JaSHJoF.exe
  C:\Windows\System\JaSHJoF.exe
  2⤵
  PID:2464
- C:\Windows\System\ifiqrLz.exe
  C:\Windows\System\ifiqrLz.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\ZxNLQdS.exe
  C:\Windows\System\ZxNLQdS.exe
  2⤵
  PID:2164
- C:\Windows\System\jktYaIK.exe
  C:\Windows\System\jktYaIK.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\aWPlGPl.exe
  C:\Windows\System\aWPlGPl.exe
  2⤵
  PID:2820
- C:\Windows\System\UXXmPgj.exe
  C:\Windows\System\UXXmPgj.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\NpXPcgV.exe
  C:\Windows\System\NpXPcgV.exe
  2⤵
  PID:2192
- C:\Windows\System\DmUWvKz.exe
  C:\Windows\System\DmUWvKz.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\NaYAdZI.exe
  C:\Windows\System\NaYAdZI.exe
  2⤵
  PID:1616
- C:\Windows\System\RqaySan.exe
  C:\Windows\System\RqaySan.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\PsbaxHo.exe
  C:\Windows\System\PsbaxHo.exe
  2⤵
  PID:1556
- C:\Windows\System\JRlfBeG.exe
  C:\Windows\System\JRlfBeG.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\dFPpMoQ.exe
  C:\Windows\System\dFPpMoQ.exe
  2⤵
  PID:2892
- C:\Windows\System\SFrUdnm.exe
  C:\Windows\System\SFrUdnm.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\EOcMPzU.exe
  C:\Windows\System\EOcMPzU.exe
  2⤵
  PID:808
- C:\Windows\System\cQrlrPr.exe
  C:\Windows\System\cQrlrPr.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\jLhNAMD.exe
  C:\Windows\System\jLhNAMD.exe
  2⤵
  PID:3084
- C:\Windows\System\jaxnSGl.exe
  C:\Windows\System\jaxnSGl.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\WgEeJYO.exe
  C:\Windows\System\WgEeJYO.exe
  2⤵
  PID:3116
- C:\Windows\System\YunnOpw.exe
  C:\Windows\System\YunnOpw.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\LPfVLNX.exe
  C:\Windows\System\LPfVLNX.exe
  2⤵
  PID:3148
- C:\Windows\System\acMaYNt.exe
  C:\Windows\System\acMaYNt.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\VNvfVPP.exe
  C:\Windows\System\VNvfVPP.exe
  2⤵
  PID:3180
- C:\Windows\System\erPPFRO.exe
  C:\Windows\System\erPPFRO.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\TiTcklF.exe
  C:\Windows\System\TiTcklF.exe
  2⤵
  PID:3212
- C:\Windows\System\JmIfwhm.exe
  C:\Windows\System\JmIfwhm.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\JqILXdI.exe
  C:\Windows\System\JqILXdI.exe
  2⤵
  PID:3244
- C:\Windows\System\AkOemfh.exe
  C:\Windows\System\AkOemfh.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\XMYIPzL.exe
  C:\Windows\System\XMYIPzL.exe
  2⤵
  PID:3276
- C:\Windows\System\hfGhrhK.exe
  C:\Windows\System\hfGhrhK.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\hnTVpdN.exe
  C:\Windows\System\hnTVpdN.exe
  2⤵
  PID:3308
- C:\Windows\System\ogliwBY.exe
  C:\Windows\System\ogliwBY.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\oDyOUuj.exe
  C:\Windows\System\oDyOUuj.exe
  2⤵
  PID:3340
- C:\Windows\System\bdiWvVZ.exe
  C:\Windows\System\bdiWvVZ.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\zYWCVZv.exe
  C:\Windows\System\zYWCVZv.exe
  2⤵
  PID:3372
- C:\Windows\System\bmWumdy.exe
  C:\Windows\System\bmWumdy.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\amnEmch.exe
  C:\Windows\System\amnEmch.exe
  2⤵
  PID:3404
- C:\Windows\System\iNXIFFT.exe
  C:\Windows\System\iNXIFFT.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\ywjfNHZ.exe
  C:\Windows\System\ywjfNHZ.exe
  2⤵
  PID:3436
- C:\Windows\System\oupyTdD.exe
  C:\Windows\System\oupyTdD.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\CTbbhmt.exe
  C:\Windows\System\CTbbhmt.exe
  2⤵
  PID:3468
- C:\Windows\System\JDBBNkm.exe
  C:\Windows\System\JDBBNkm.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\SpkNDoh.exe
  C:\Windows\System\SpkNDoh.exe
  2⤵
  PID:3500
- C:\Windows\System\EQYrsOZ.exe
  C:\Windows\System\EQYrsOZ.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\qNdlNve.exe
  C:\Windows\System\qNdlNve.exe
  2⤵
  PID:3532
- C:\Windows\System\MBnTDsL.exe
  C:\Windows\System\MBnTDsL.exe
  2⤵
  PID:3548
- C:\Windows\System\VhyQEnb.exe
  C:\Windows\System\VhyQEnb.exe
  2⤵
  PID:3564
- C:\Windows\System\VKQaFRN.exe
  C:\Windows\System\VKQaFRN.exe
  2⤵
  PID:3580
- C:\Windows\System\uEctxUc.exe
  C:\Windows\System\uEctxUc.exe
  2⤵
  PID:3596
- C:\Windows\System\yrbUKJR.exe
  C:\Windows\System\yrbUKJR.exe
  2⤵
  PID:3612
- C:\Windows\System\SmhAqEj.exe
  C:\Windows\System\SmhAqEj.exe
  2⤵
  PID:3628
- C:\Windows\System\zmmHkJz.exe
  C:\Windows\System\zmmHkJz.exe
  2⤵
  PID:3644
- C:\Windows\System\bBHQxSS.exe
  C:\Windows\System\bBHQxSS.exe
  2⤵
  PID:3660
- C:\Windows\System\XRvLFVU.exe
  C:\Windows\System\XRvLFVU.exe
  2⤵
  PID:3676
- C:\Windows\System\uUfZqzb.exe
  C:\Windows\System\uUfZqzb.exe
  2⤵
  PID:3692
- C:\Windows\System\QOaVlIh.exe
  C:\Windows\System\QOaVlIh.exe
  2⤵
  PID:3708
- C:\Windows\System\UZYFxWp.exe
  C:\Windows\System\UZYFxWp.exe
  2⤵
  PID:3724
- C:\Windows\System\wfQIdgS.exe
  C:\Windows\System\wfQIdgS.exe
  2⤵
  PID:3740
- C:\Windows\System\FWUZQjA.exe
  C:\Windows\System\FWUZQjA.exe
  2⤵
  PID:3756
- C:\Windows\System\NUtzICg.exe
  C:\Windows\System\NUtzICg.exe
  2⤵
  PID:3772
- C:\Windows\System\cWGgHma.exe
  C:\Windows\System\cWGgHma.exe
  2⤵
  PID:3788
- C:\Windows\System\XAmWshf.exe
  C:\Windows\System\XAmWshf.exe
  2⤵
  PID:3804
- C:\Windows\System\ipIurhs.exe
  C:\Windows\System\ipIurhs.exe
  2⤵
  PID:3820
- C:\Windows\System\dnsGJtY.exe
  C:\Windows\System\dnsGJtY.exe
  2⤵
  PID:3836
- C:\Windows\System\pXmiZcu.exe
  C:\Windows\System\pXmiZcu.exe
  2⤵
  PID:3852
- C:\Windows\System\NiYCoqR.exe
  C:\Windows\System\NiYCoqR.exe
  2⤵
  PID:3868
- C:\Windows\System\JclUcNS.exe
  C:\Windows\System\JclUcNS.exe
  2⤵
  PID:3884
- C:\Windows\System\cfjLwDC.exe
  C:\Windows\System\cfjLwDC.exe
  2⤵
  PID:3900
- C:\Windows\System\EaOcckP.exe
  C:\Windows\System\EaOcckP.exe
  2⤵
  PID:3916
- C:\Windows\System\BOpxhnC.exe
  C:\Windows\System\BOpxhnC.exe
  2⤵
  PID:3932
- C:\Windows\System\yUsEEmx.exe
  C:\Windows\System\yUsEEmx.exe
  2⤵
  PID:3948
- C:\Windows\System\untgHnT.exe
  C:\Windows\System\untgHnT.exe
  2⤵
  PID:3964
- C:\Windows\System\uPZFrOm.exe
  C:\Windows\System\uPZFrOm.exe
  2⤵
  PID:3980
- C:\Windows\System\BYKpdtc.exe
  C:\Windows\System\BYKpdtc.exe
  2⤵
  PID:3996
- C:\Windows\System\IRUrbrG.exe
  C:\Windows\System\IRUrbrG.exe
  2⤵
  PID:4012
- C:\Windows\System\MAmREXC.exe
  C:\Windows\System\MAmREXC.exe
  2⤵
  PID:4028
- C:\Windows\System\qlbAvYH.exe
  C:\Windows\System\qlbAvYH.exe
  2⤵
  PID:4044
- C:\Windows\System\dNTzEwg.exe
  C:\Windows\System\dNTzEwg.exe
  2⤵
  PID:4060
- C:\Windows\System\WzAoxZr.exe
  C:\Windows\System\WzAoxZr.exe
  2⤵
  PID:4076
- C:\Windows\System\TVugJtu.exe
  C:\Windows\System\TVugJtu.exe
  2⤵
  PID:4092
- C:\Windows\System\BocsydQ.exe
  C:\Windows\System\BocsydQ.exe
  2⤵
  PID:1612
- C:\Windows\System\nZFTYIl.exe
  C:\Windows\System\nZFTYIl.exe
  2⤵
  PID:2500
- C:\Windows\System\kbmCreN.exe
  C:\Windows\System\kbmCreN.exe
  2⤵
  PID:3060
- C:\Windows\System\hXvgJhf.exe
  C:\Windows\System\hXvgJhf.exe
  2⤵
  PID:2356
- C:\Windows\System\muQTKQW.exe
  C:\Windows\System\muQTKQW.exe
  2⤵
  PID:3076
- C:\Windows\System\pjyduCQ.exe
  C:\Windows\System\pjyduCQ.exe
  2⤵
  PID:3140
- C:\Windows\System\imYTIFk.exe
  C:\Windows\System\imYTIFk.exe
  2⤵
  PID:3204
- C:\Windows\System\CALqqlN.exe
  C:\Windows\System\CALqqlN.exe
  2⤵
  PID:3268
- C:\Windows\System\lBajveu.exe
  C:\Windows\System\lBajveu.exe
  2⤵
  PID:3332
- C:\Windows\System\jyUfeEH.exe
  C:\Windows\System\jyUfeEH.exe
  2⤵
  PID:3396
- C:\Windows\System\wQgItkm.exe
  C:\Windows\System\wQgItkm.exe
  2⤵
  PID:3460
- C:\Windows\System\jQLhcDL.exe
  C:\Windows\System\jQLhcDL.exe
  2⤵
  PID:3524
- C:\Windows\System\bzYKpki.exe
  C:\Windows\System\bzYKpki.exe
  2⤵
  PID:3588
- C:\Windows\System\jQbZumi.exe
  C:\Windows\System\jQbZumi.exe
  2⤵
  PID:3652
- C:\Windows\System\PEAYTtu.exe
  C:\Windows\System\PEAYTtu.exe
  2⤵
  PID:3716
- C:\Windows\System\mwasWeF.exe
  C:\Windows\System\mwasWeF.exe
  2⤵
  PID:3780
- C:\Windows\System\OsOyCTK.exe
  C:\Windows\System\OsOyCTK.exe
  2⤵
  PID:3844
- C:\Windows\System\fLLJhAH.exe
  C:\Windows\System\fLLJhAH.exe
  2⤵
  PID:3908
- C:\Windows\System\gzhjfSg.exe
  C:\Windows\System\gzhjfSg.exe
  2⤵
  PID:3972
- C:\Windows\System\abiXMbl.exe
  C:\Windows\System\abiXMbl.exe
  2⤵
  PID:4036
- C:\Windows\System\HWbYPks.exe
  C:\Windows\System\HWbYPks.exe
  2⤵
  PID:2912
- C:\Windows\System\KaTBYKV.exe
  C:\Windows\System\KaTBYKV.exe
  2⤵
  PID:1784
- C:\Windows\System\cyjjJdS.exe
  C:\Windows\System\cyjjJdS.exe
  2⤵
  PID:3176
- C:\Windows\System\edAIVWg.exe
  C:\Windows\System\edAIVWg.exe
  2⤵
  PID:4108
- C:\Windows\System\GzxPfun.exe
  C:\Windows\System\GzxPfun.exe
  2⤵
  PID:4124
- C:\Windows\System\qeStDpV.exe
  C:\Windows\System\qeStDpV.exe
  2⤵
  PID:4140
- C:\Windows\System\yseVKzd.exe
  C:\Windows\System\yseVKzd.exe
  2⤵
  PID:4156
- C:\Windows\System\lLplJEp.exe
  C:\Windows\System\lLplJEp.exe
  2⤵
  PID:4172
- C:\Windows\System\DtrMFPZ.exe
  C:\Windows\System\DtrMFPZ.exe
  2⤵
  PID:4188
- C:\Windows\System\AqICAbq.exe
  C:\Windows\System\AqICAbq.exe
  2⤵
  PID:4204
- C:\Windows\System\tgjeJfw.exe
  C:\Windows\System\tgjeJfw.exe
  2⤵
  PID:4220
- C:\Windows\System\WwMfXhS.exe
  C:\Windows\System\WwMfXhS.exe
  2⤵
  PID:4236
- C:\Windows\System\ddDshfG.exe
  C:\Windows\System\ddDshfG.exe
  2⤵
  PID:4252
- C:\Windows\System\DlSDJXq.exe
  C:\Windows\System\DlSDJXq.exe
  2⤵
  PID:4268
- C:\Windows\System\pYzNuDb.exe
  C:\Windows\System\pYzNuDb.exe
  2⤵
  PID:4284
- C:\Windows\System\jpwavQI.exe
  C:\Windows\System\jpwavQI.exe
  2⤵
  PID:4300
- C:\Windows\System\EpcALwr.exe
  C:\Windows\System\EpcALwr.exe
  2⤵
  PID:4316
- C:\Windows\System\qeWhKxO.exe
  C:\Windows\System\qeWhKxO.exe
  2⤵
  PID:4332
- C:\Windows\System\rwbEWGQ.exe
  C:\Windows\System\rwbEWGQ.exe
  2⤵
  PID:4348
- C:\Windows\System\cKwgUcc.exe
  C:\Windows\System\cKwgUcc.exe
  2⤵
  PID:4364
- C:\Windows\System\NfsrBCR.exe
  C:\Windows\System\NfsrBCR.exe
  2⤵
  PID:4380
- C:\Windows\System\MjRKqSJ.exe
  C:\Windows\System\MjRKqSJ.exe
  2⤵
  PID:4396
- C:\Windows\System\vSGYGsB.exe
  C:\Windows\System\vSGYGsB.exe
  2⤵
  PID:4412
- C:\Windows\System\JcSWJTy.exe
  C:\Windows\System\JcSWJTy.exe
  2⤵
  PID:4428
- C:\Windows\System\JZhOuiC.exe
  C:\Windows\System\JZhOuiC.exe
  2⤵
  PID:4444
- C:\Windows\System\LCXzVjj.exe
  C:\Windows\System\LCXzVjj.exe
  2⤵
  PID:4460
- C:\Windows\System\aAaHVkb.exe
  C:\Windows\System\aAaHVkb.exe
  2⤵
  PID:4476
- C:\Windows\System\SIFyPnj.exe
  C:\Windows\System\SIFyPnj.exe
  2⤵
  PID:4492
- C:\Windows\System\VdtuieS.exe
  C:\Windows\System\VdtuieS.exe
  2⤵
  PID:4508
- C:\Windows\System\VvHcftz.exe
  C:\Windows\System\VvHcftz.exe
  2⤵
  PID:4524
- C:\Windows\System\MgslMwg.exe
  C:\Windows\System\MgslMwg.exe
  2⤵
  PID:4540
- C:\Windows\System\HeILqlM.exe
  C:\Windows\System\HeILqlM.exe
  2⤵
  PID:4556
- C:\Windows\System\kjXxIWE.exe
  C:\Windows\System\kjXxIWE.exe
  2⤵
  PID:4572
- C:\Windows\System\YhfFUbj.exe
  C:\Windows\System\YhfFUbj.exe
  2⤵
  PID:4588
- C:\Windows\System\cVSoyUJ.exe
  C:\Windows\System\cVSoyUJ.exe
  2⤵
  PID:4604
- C:\Windows\System\NmvJVAD.exe
  C:\Windows\System\NmvJVAD.exe
  2⤵
  PID:4620
- C:\Windows\System\tNlIOVK.exe
  C:\Windows\System\tNlIOVK.exe
  2⤵
  PID:4636
- C:\Windows\System\pwpvHcV.exe
  C:\Windows\System\pwpvHcV.exe
  2⤵
  PID:4652
- C:\Windows\System\HbstuJx.exe
  C:\Windows\System\HbstuJx.exe
  2⤵
  PID:4668
- C:\Windows\System\SsWnHen.exe
  C:\Windows\System\SsWnHen.exe
  2⤵
  PID:4684
- C:\Windows\System\sQBzksp.exe
  C:\Windows\System\sQBzksp.exe
  2⤵
  PID:4700
- C:\Windows\System\SiobrQg.exe
  C:\Windows\System\SiobrQg.exe
  2⤵
  PID:4716
- C:\Windows\System\kjGHtDe.exe
  C:\Windows\System\kjGHtDe.exe
  2⤵
  PID:4732
- C:\Windows\System\KUfGmIx.exe
  C:\Windows\System\KUfGmIx.exe
  2⤵
  PID:4748
- C:\Windows\System\mlPrllu.exe
  C:\Windows\System\mlPrllu.exe
  2⤵
  PID:4764
- C:\Windows\System\Inmidyq.exe
  C:\Windows\System\Inmidyq.exe
  2⤵
  PID:4780
- C:\Windows\System\YJErtXa.exe
  C:\Windows\System\YJErtXa.exe
  2⤵
  PID:4796
- C:\Windows\System\dYeGlDr.exe
  C:\Windows\System\dYeGlDr.exe
  2⤵
  PID:4812
- C:\Windows\System\hbWkzQF.exe
  C:\Windows\System\hbWkzQF.exe
  2⤵
  PID:4828
- C:\Windows\System\jejCrlW.exe
  C:\Windows\System\jejCrlW.exe
  2⤵
  PID:4844
- C:\Windows\System\jmHuNAV.exe
  C:\Windows\System\jmHuNAV.exe
  2⤵
  PID:4860
- C:\Windows\System\vHvYutE.exe
  C:\Windows\System\vHvYutE.exe
  2⤵
  PID:4876
- C:\Windows\System\wFEkreN.exe
  C:\Windows\System\wFEkreN.exe
  2⤵
  PID:4892
- C:\Windows\System\dbejyIH.exe
  C:\Windows\System\dbejyIH.exe
  2⤵
  PID:4908
- C:\Windows\System\WtVOvIN.exe
  C:\Windows\System\WtVOvIN.exe
  2⤵
  PID:4924
- C:\Windows\System\tgtMYaN.exe
  C:\Windows\System\tgtMYaN.exe
  2⤵
  PID:4940
- C:\Windows\System\MwuwOlC.exe
  C:\Windows\System\MwuwOlC.exe
  2⤵
  PID:4956
- C:\Windows\System\QeYmtRv.exe
  C:\Windows\System\QeYmtRv.exe
  2⤵
  PID:4972
- C:\Windows\System\WQXrUNr.exe
  C:\Windows\System\WQXrUNr.exe
  2⤵
  PID:4988
- C:\Windows\System\VLwCMie.exe
  C:\Windows\System\VLwCMie.exe
  2⤵
  PID:5004
- C:\Windows\System\WilzxLC.exe
  C:\Windows\System\WilzxLC.exe
  2⤵
  PID:5020
- C:\Windows\System\jDZDFnE.exe
  C:\Windows\System\jDZDFnE.exe
  2⤵
  PID:5036
- C:\Windows\System\ETYiGWa.exe
  C:\Windows\System\ETYiGWa.exe
  2⤵
  PID:5052
- C:\Windows\System\hcZmDQu.exe
  C:\Windows\System\hcZmDQu.exe
  2⤵
  PID:5068
- C:\Windows\System\tNJHjvH.exe
  C:\Windows\System\tNJHjvH.exe
  2⤵
  PID:5084
- C:\Windows\System\ojCIDGh.exe
  C:\Windows\System\ojCIDGh.exe
  2⤵
  PID:5100
- C:\Windows\System\LWBKMHN.exe
  C:\Windows\System\LWBKMHN.exe
  2⤵
  PID:5116
- C:\Windows\System\yTetNeH.exe
  C:\Windows\System\yTetNeH.exe
  2⤵
  PID:3556
- C:\Windows\System\NHEQuVi.exe
  C:\Windows\System\NHEQuVi.exe
  2⤵
  PID:3688
- C:\Windows\System\NDdoQGM.exe
  C:\Windows\System\NDdoQGM.exe
  2⤵
  PID:3944
- C:\Windows\System\FExZFIX.exe
  C:\Windows\System\FExZFIX.exe
  2⤵
  PID:3172
- C:\Windows\System\EGewuMY.exe
  C:\Windows\System\EGewuMY.exe
  2⤵
  PID:4152
- C:\Windows\System\JGgKkPD.exe
  C:\Windows\System\JGgKkPD.exe
  2⤵
  PID:4216
- C:\Windows\System\beUnlTP.exe
  C:\Windows\System\beUnlTP.exe
  2⤵
  PID:4280
- C:\Windows\System\CpNKRfV.exe
  C:\Windows\System\CpNKRfV.exe
  2⤵
  PID:4344
- C:\Windows\System\XZlurii.exe
  C:\Windows\System\XZlurii.exe
  2⤵
  PID:4408
- C:\Windows\System\TeZwWnx.exe
  C:\Windows\System\TeZwWnx.exe
  2⤵
  PID:4472
- C:\Windows\System\ACGmEVi.exe
  C:\Windows\System\ACGmEVi.exe
  2⤵
  PID:4536
- C:\Windows\System\TKlKrld.exe
  C:\Windows\System\TKlKrld.exe
  2⤵
  PID:4600
- C:\Windows\System\iotjTNc.exe
  C:\Windows\System\iotjTNc.exe
  2⤵
  PID:4664
- C:\Windows\System\KnzzApI.exe
  C:\Windows\System\KnzzApI.exe
  2⤵
  PID:4728
- C:\Windows\System\vDpgQvO.exe
  C:\Windows\System\vDpgQvO.exe
  2⤵
  PID:4792
- C:\Windows\System\kXtXRxo.exe
  C:\Windows\System\kXtXRxo.exe
  2⤵
  PID:4856
- C:\Windows\System\RYkNtcS.exe
  C:\Windows\System\RYkNtcS.exe
  2⤵
  PID:4920
- C:\Windows\System\MhBKZNW.exe
  C:\Windows\System\MhBKZNW.exe
  2⤵
  PID:4984
- C:\Windows\System\FSfGKPr.exe
  C:\Windows\System\FSfGKPr.exe
  2⤵
  PID:5048
- C:\Windows\System\QWMZhIX.exe
  C:\Windows\System\QWMZhIX.exe
  2⤵
  PID:5112
- C:\Windows\System\jYEbqbl.exe
  C:\Windows\System\jYEbqbl.exe
  2⤵
  PID:2020
- C:\Windows\System\KxeDEbV.exe
  C:\Windows\System\KxeDEbV.exe
  2⤵
  PID:2096
- C:\Windows\System\ZYogCrF.exe
  C:\Windows\System\ZYogCrF.exe
  2⤵
  PID:2596
- C:\Windows\System\rIGERyO.exe
  C:\Windows\System\rIGERyO.exe
  2⤵
  PID:4724
- C:\Windows\System\QgEtoat.exe
  C:\Windows\System\QgEtoat.exe
  2⤵
  PID:4980
- C:\Windows\System\mPdUDCK.exe
  C:\Windows\System\mPdUDCK.exe
  2⤵
  PID:5136
- C:\Windows\System\disCNow.exe
  C:\Windows\System\disCNow.exe
  2⤵
  PID:5152
- C:\Windows\System\JXHQdNH.exe
  C:\Windows\System\JXHQdNH.exe
  2⤵
  PID:5168
- C:\Windows\System\pxFYpck.exe
  C:\Windows\System\pxFYpck.exe
  2⤵
  PID:5184
- C:\Windows\System\cPRuAjJ.exe
  C:\Windows\System\cPRuAjJ.exe
  2⤵
  PID:5200
- C:\Windows\System\WkguzuO.exe
  C:\Windows\System\WkguzuO.exe
  2⤵
  PID:5216
- C:\Windows\System\DoSzKOt.exe
  C:\Windows\System\DoSzKOt.exe
  2⤵
  PID:5232
- C:\Windows\System\huzGuRv.exe
  C:\Windows\System\huzGuRv.exe
  2⤵
  PID:5248
- C:\Windows\System\HjNrFqs.exe
  C:\Windows\System\HjNrFqs.exe
  2⤵
  PID:5264
- C:\Windows\System\WSdjjYZ.exe
  C:\Windows\System\WSdjjYZ.exe
  2⤵
  PID:5280
- C:\Windows\System\VZchyRp.exe
  C:\Windows\System\VZchyRp.exe
  2⤵
  PID:5296
- C:\Windows\System\ajrnzjS.exe
  C:\Windows\System\ajrnzjS.exe
  2⤵
  PID:5312
- C:\Windows\System\qBAxMwz.exe
  C:\Windows\System\qBAxMwz.exe
  2⤵
  PID:5328
- C:\Windows\System\WHAgiBi.exe
  C:\Windows\System\WHAgiBi.exe
  2⤵
  PID:5344
- C:\Windows\System\jaNdkhx.exe
  C:\Windows\System\jaNdkhx.exe
  2⤵
  PID:5360
- C:\Windows\System\ZVGbBPz.exe
  C:\Windows\System\ZVGbBPz.exe
  2⤵
  PID:5376
- C:\Windows\System\hmhIkuH.exe
  C:\Windows\System\hmhIkuH.exe
  2⤵
  PID:5392
- C:\Windows\System\uHKQZRi.exe
  C:\Windows\System\uHKQZRi.exe
  2⤵
  PID:5408
- C:\Windows\System\rsKGwJo.exe
  C:\Windows\System\rsKGwJo.exe
  2⤵
  PID:5424
- C:\Windows\System\nVlmpfl.exe
  C:\Windows\System\nVlmpfl.exe
  2⤵
  PID:5440
- C:\Windows\System\lOFJzfU.exe
  C:\Windows\System\lOFJzfU.exe
  2⤵
  PID:5456
- C:\Windows\System\DJILOSt.exe
  C:\Windows\System\DJILOSt.exe
  2⤵
  PID:5472
- C:\Windows\System\pzULivO.exe
  C:\Windows\System\pzULivO.exe
  2⤵
  PID:5488
- C:\Windows\System\ohCapJH.exe
  C:\Windows\System\ohCapJH.exe
  2⤵
  PID:5504
- C:\Windows\System\HJyiAAx.exe
  C:\Windows\System\HJyiAAx.exe
  2⤵
  PID:5520
- C:\Windows\System\wHFNlTk.exe
  C:\Windows\System\wHFNlTk.exe
  2⤵
  PID:5536
- C:\Windows\System\jTZWmfC.exe
  C:\Windows\System\jTZWmfC.exe
  2⤵
  PID:5552
- C:\Windows\System\dkSVoDm.exe
  C:\Windows\System\dkSVoDm.exe
  2⤵
  PID:5568
- C:\Windows\System\mfeBaKF.exe
  C:\Windows\System\mfeBaKF.exe
  2⤵
  PID:5584
- C:\Windows\System\boJRhma.exe
  C:\Windows\System\boJRhma.exe
  2⤵
  PID:5600
- C:\Windows\System\htEpUBQ.exe
  C:\Windows\System\htEpUBQ.exe
  2⤵
  PID:5616
- C:\Windows\System\NYUHMjy.exe
  C:\Windows\System\NYUHMjy.exe
  2⤵
  PID:5632
- C:\Windows\System\RRwhUIf.exe
  C:\Windows\System\RRwhUIf.exe
  2⤵
  PID:5648
- C:\Windows\System\ntdEkuZ.exe
  C:\Windows\System\ntdEkuZ.exe
  2⤵
  PID:5664
- C:\Windows\System\fePddIu.exe
  C:\Windows\System\fePddIu.exe
  2⤵
  PID:5680
- C:\Windows\System\yeUWSKg.exe
  C:\Windows\System\yeUWSKg.exe
  2⤵
  PID:5696
- C:\Windows\System\TGkxmzq.exe
  C:\Windows\System\TGkxmzq.exe
  2⤵
  PID:5712
- C:\Windows\System\JkdTSsu.exe
  C:\Windows\System\JkdTSsu.exe
  2⤵
  PID:5728
- C:\Windows\System\eUPZahh.exe
  C:\Windows\System\eUPZahh.exe
  2⤵
  PID:5744
- C:\Windows\System\ubphzMH.exe
  C:\Windows\System\ubphzMH.exe
  2⤵
  PID:5760
- C:\Windows\System\uuNFKBu.exe
  C:\Windows\System\uuNFKBu.exe
  2⤵
  PID:5776
- C:\Windows\System\kGObsEe.exe
  C:\Windows\System\kGObsEe.exe
  2⤵
  PID:5792
- C:\Windows\System\aQDPdAn.exe
  C:\Windows\System\aQDPdAn.exe
  2⤵
  PID:5808
- C:\Windows\System\WCmcELc.exe
  C:\Windows\System\WCmcELc.exe
  2⤵
  PID:5824
- C:\Windows\System\AeKAdKR.exe
  C:\Windows\System\AeKAdKR.exe
  2⤵
  PID:5840
- C:\Windows\System\wrHIfCB.exe
  C:\Windows\System\wrHIfCB.exe
  2⤵
  PID:5856
- C:\Windows\System\QUVmzMa.exe
  C:\Windows\System\QUVmzMa.exe
  2⤵
  PID:5872
- C:\Windows\System\tvFJZqX.exe
  C:\Windows\System\tvFJZqX.exe
  2⤵
  PID:5888
- C:\Windows\System\wnXisGO.exe
  C:\Windows\System\wnXisGO.exe
  2⤵
  PID:5904
- C:\Windows\System\ilNwscu.exe
  C:\Windows\System\ilNwscu.exe
  2⤵
  PID:5920
- C:\Windows\System\jVHVIYU.exe
  C:\Windows\System\jVHVIYU.exe
  2⤵
  PID:5936
- C:\Windows\System\onGNLUE.exe
  C:\Windows\System\onGNLUE.exe
  2⤵
  PID:5952
- C:\Windows\System\csEdjnh.exe
  C:\Windows\System\csEdjnh.exe
  2⤵
  PID:5968
- C:\Windows\System\nIEQrwY.exe
  C:\Windows\System\nIEQrwY.exe
  2⤵
  PID:5984
- C:\Windows\System\zbQYLQF.exe
  C:\Windows\System\zbQYLQF.exe
  2⤵
  PID:6000
- C:\Windows\System\eVxGOoN.exe
  C:\Windows\System\eVxGOoN.exe
  2⤵
  PID:6016
- C:\Windows\System\ynMqued.exe
  C:\Windows\System\ynMqued.exe
  2⤵
  PID:6032
- C:\Windows\System\qfAzAoZ.exe
  C:\Windows\System\qfAzAoZ.exe
  2⤵
  PID:6048
- C:\Windows\System\wWeTsuT.exe
  C:\Windows\System\wWeTsuT.exe
  2⤵
  PID:6064
- C:\Windows\System\hFhgAtj.exe
  C:\Windows\System\hFhgAtj.exe
  2⤵
  PID:6080
- C:\Windows\System\YzZAhgM.exe
  C:\Windows\System\YzZAhgM.exe
  2⤵
  PID:6096
- C:\Windows\System\eSovseR.exe
  C:\Windows\System\eSovseR.exe
  2⤵
  PID:6112
- C:\Windows\System\JTrXIoB.exe
  C:\Windows\System\JTrXIoB.exe
  2⤵
  PID:6128
- C:\Windows\System\GaxsDpb.exe
  C:\Windows\System\GaxsDpb.exe
  2⤵
  PID:5080
- C:\Windows\System\fuEiEgZ.exe
  C:\Windows\System\fuEiEgZ.exe
  2⤵
  PID:4596
- C:\Windows\System\uYLGtno.exe
  C:\Windows\System\uYLGtno.exe
  2⤵
  PID:5132
- C:\Windows\System\xLVsOgE.exe
  C:\Windows\System\xLVsOgE.exe
  2⤵
  PID:5192
- C:\Windows\System\BdGqNyZ.exe
  C:\Windows\System\BdGqNyZ.exe
  2⤵
  PID:5256
- C:\Windows\System\MNNeuRF.exe
  C:\Windows\System\MNNeuRF.exe
  2⤵
  PID:5320
- C:\Windows\System\SztQbDi.exe
  C:\Windows\System\SztQbDi.exe
  2⤵
  PID:5352
- C:\Windows\System\WuktxUI.exe
  C:\Windows\System\WuktxUI.exe
  2⤵
  PID:5416
- C:\Windows\System\SZhhWWa.exe
  C:\Windows\System\SZhhWWa.exe
  2⤵
  PID:5480
- C:\Windows\System\bpFLZhk.exe
  C:\Windows\System\bpFLZhk.exe
  2⤵
  PID:5544
- C:\Windows\System\fjGruLp.exe
  C:\Windows\System\fjGruLp.exe
  2⤵
  PID:5608
- C:\Windows\System\Brgtusv.exe
  C:\Windows\System\Brgtusv.exe
  2⤵
  PID:5672
- C:\Windows\System\ZDnfPjv.exe
  C:\Windows\System\ZDnfPjv.exe
  2⤵
  PID:5708
- C:\Windows\System\pHdmajR.exe
  C:\Windows\System\pHdmajR.exe
  2⤵
  PID:5772
- C:\Windows\System\hcHuDRl.exe
  C:\Windows\System\hcHuDRl.exe
  2⤵
  PID:5832
- C:\Windows\System\rmCaezr.exe
  C:\Windows\System\rmCaezr.exe
  2⤵
  PID:5896
- C:\Windows\System\mxCTztp.exe
  C:\Windows\System\mxCTztp.exe
  2⤵
  PID:5932
- C:\Windows\System\bHbqUGA.exe
  C:\Windows\System\bHbqUGA.exe
  2⤵
  PID:5992
- C:\Windows\System\QgDKzre.exe
  C:\Windows\System\QgDKzre.exe
  2⤵
  PID:6056
- C:\Windows\System\haHxsld.exe
  C:\Windows\System\haHxsld.exe
  2⤵
  PID:6120
- C:\Windows\System\MzUKGRl.exe
  C:\Windows\System\MzUKGRl.exe
  2⤵
  PID:5164
- C:\Windows\System\WUOgGvy.exe
  C:\Windows\System\WUOgGvy.exe
  2⤵
  PID:5384
- C:\Windows\System\SgNVlhN.exe
  C:\Windows\System\SgNVlhN.exe
  2⤵
  PID:5640
- C:\Windows\System\YXGcMmu.exe
  C:\Windows\System\YXGcMmu.exe
  2⤵
  PID:2884
- C:\Windows\System\NgeaLZJ.exe
  C:\Windows\System\NgeaLZJ.exe
  2⤵
  PID:2432
- C:\Windows\System\QJMQhLP.exe
  C:\Windows\System\QJMQhLP.exe
  2⤵
  PID:6156
- C:\Windows\System\cpmfzHX.exe
  C:\Windows\System\cpmfzHX.exe
  2⤵
  PID:6172
- C:\Windows\System\eJseuAN.exe
  C:\Windows\System\eJseuAN.exe
  2⤵
  PID:6192
- C:\Windows\System\zRjPItw.exe
  C:\Windows\System\zRjPItw.exe
  2⤵
  PID:6208
- C:\Windows\System\kNHUImn.exe
  C:\Windows\System\kNHUImn.exe
  2⤵
  PID:6224
- C:\Windows\System\yaGkpta.exe
  C:\Windows\System\yaGkpta.exe
  2⤵
  PID:6248
- C:\Windows\System\VFuWSqo.exe
  C:\Windows\System\VFuWSqo.exe
  2⤵
  PID:6264
- C:\Windows\System\CPafuwG.exe
  C:\Windows\System\CPafuwG.exe
  2⤵
  PID:6280
- C:\Windows\System\vfnkIvr.exe
  C:\Windows\System\vfnkIvr.exe
  2⤵
  PID:6296
- C:\Windows\System\BWWRaiG.exe
  C:\Windows\System\BWWRaiG.exe
  2⤵
  PID:6312
- C:\Windows\System\IaBKJko.exe
  C:\Windows\System\IaBKJko.exe
  2⤵
  PID:6328
- C:\Windows\System\SLHOmPo.exe
  C:\Windows\System\SLHOmPo.exe
  2⤵
  PID:6344
- C:\Windows\System\uhUzrSI.exe
  C:\Windows\System\uhUzrSI.exe
  2⤵
  PID:6360
- C:\Windows\System\xVAcWXN.exe
  C:\Windows\System\xVAcWXN.exe
  2⤵
  PID:6376
- C:\Windows\System\tMEDvXo.exe
  C:\Windows\System\tMEDvXo.exe
  2⤵
  PID:6392
- C:\Windows\System\bdVUkdi.exe
  C:\Windows\System\bdVUkdi.exe
  2⤵
  PID:6408
- C:\Windows\System\qifxjHs.exe
  C:\Windows\System\qifxjHs.exe
  2⤵
  PID:6428
- C:\Windows\System\ooEQKRs.exe
  C:\Windows\System\ooEQKRs.exe
  2⤵
  PID:6444
- C:\Windows\System\uYcWGtg.exe
  C:\Windows\System\uYcWGtg.exe
  2⤵
  PID:6460
- C:\Windows\System\ClKpvbx.exe
  C:\Windows\System\ClKpvbx.exe
  2⤵
  PID:6476
- C:\Windows\System\HICwBXu.exe
  C:\Windows\System\HICwBXu.exe
  2⤵
  PID:6492
- C:\Windows\System\wdDrtTN.exe
  C:\Windows\System\wdDrtTN.exe
  2⤵
  PID:6508
- C:\Windows\System\COLtYsy.exe
  C:\Windows\System\COLtYsy.exe
  2⤵
  PID:6524
- C:\Windows\System\Mvemafq.exe
  C:\Windows\System\Mvemafq.exe
  2⤵
  PID:6540
- C:\Windows\System\bdFUuXt.exe
  C:\Windows\System\bdFUuXt.exe
  2⤵
  PID:6556
- C:\Windows\System\xiUlcmh.exe
  C:\Windows\System\xiUlcmh.exe
  2⤵
  PID:6572
- C:\Windows\System\yMEtuJZ.exe
  C:\Windows\System\yMEtuJZ.exe
  2⤵
  PID:6588
- C:\Windows\System\YLWIkij.exe
  C:\Windows\System\YLWIkij.exe
  2⤵
  PID:6608
- C:\Windows\System\LOWGlFB.exe
  C:\Windows\System\LOWGlFB.exe
  2⤵
  PID:6624
- C:\Windows\System\xaDJHuP.exe
  C:\Windows\System\xaDJHuP.exe
  2⤵
  PID:6640
- C:\Windows\System\pOpALrB.exe
  C:\Windows\System\pOpALrB.exe
  2⤵
  PID:6656
- C:\Windows\System\wrMagYr.exe
  C:\Windows\System\wrMagYr.exe
  2⤵
  PID:6672
- C:\Windows\System\KpUYoFu.exe
  C:\Windows\System\KpUYoFu.exe
  2⤵
  PID:6688
- C:\Windows\System\gWxKNev.exe
  C:\Windows\System\gWxKNev.exe
  2⤵
  PID:6704
- C:\Windows\System\rSAvkuA.exe
  C:\Windows\System\rSAvkuA.exe
  2⤵
  PID:6720
- C:\Windows\System\RtNjnly.exe
  C:\Windows\System\RtNjnly.exe
  2⤵
  PID:6736
- C:\Windows\System\CgdXBNe.exe
  C:\Windows\System\CgdXBNe.exe
  2⤵
  PID:6752
- C:\Windows\System\OcZbbOC.exe
  C:\Windows\System\OcZbbOC.exe
  2⤵
  PID:6772
- C:\Windows\System\DgWWCnP.exe
  C:\Windows\System\DgWWCnP.exe
  2⤵
  PID:6788
- C:\Windows\System\JiXxxoB.exe
  C:\Windows\System\JiXxxoB.exe
  2⤵
  PID:6804
- C:\Windows\System\SYqGfJl.exe
  C:\Windows\System\SYqGfJl.exe
  2⤵
  PID:6820
- C:\Windows\System\wHrCImJ.exe
  C:\Windows\System\wHrCImJ.exe
  2⤵
  PID:6836
- C:\Windows\System\vPzhNxe.exe
  C:\Windows\System\vPzhNxe.exe
  2⤵
  PID:6852
- C:\Windows\System\IYaCZSE.exe
  C:\Windows\System\IYaCZSE.exe
  2⤵
  PID:6868
- C:\Windows\System\ZtihOnl.exe
  C:\Windows\System\ZtihOnl.exe
  2⤵
  PID:6888
- C:\Windows\System\talvwiP.exe
  C:\Windows\System\talvwiP.exe
  2⤵
  PID:8080
- C:\Windows\System\WVIivSb.exe
  C:\Windows\System\WVIivSb.exe
  2⤵
  PID:8096
- C:\Windows\System\LqYcRXl.exe
  C:\Windows\System\LqYcRXl.exe
  2⤵
  PID:8112
- C:\Windows\System\uvEtuzx.exe
  C:\Windows\System\uvEtuzx.exe
  2⤵
  PID:8128
- C:\Windows\System\ltVeAzN.exe
  C:\Windows\System\ltVeAzN.exe
  2⤵
  PID:8144
- C:\Windows\System\QNrbnwD.exe
  C:\Windows\System\QNrbnwD.exe
  2⤵
  PID:8160
- C:\Windows\System\zWCZkAJ.exe
  C:\Windows\System\zWCZkAJ.exe
  2⤵
  PID:8176
- C:\Windows\System\dkjWMkO.exe
  C:\Windows\System\dkjWMkO.exe
  2⤵
  PID:5288
- C:\Windows\System\OVqxXbh.exe
  C:\Windows\System\OVqxXbh.exe
  2⤵
  PID:5740
- C:\Windows\System\XQkyyaV.exe
  C:\Windows\System\XQkyyaV.exe
  2⤵
  PID:6180
- C:\Windows\System\TfEnzUv.exe
  C:\Windows\System\TfEnzUv.exe
  2⤵
  PID:6260
- C:\Windows\System\IYZdBIw.exe
  C:\Windows\System\IYZdBIw.exe
  2⤵
  PID:6320
- C:\Windows\System\ToOqrFd.exe
  C:\Windows\System\ToOqrFd.exe
  2⤵
  PID:6384
- C:\Windows\System\hBsNocO.exe
  C:\Windows\System\hBsNocO.exe
  2⤵
  PID:6424
- C:\Windows\System\woqozmu.exe
  C:\Windows\System\woqozmu.exe
  2⤵
  PID:6488
- C:\Windows\System\PXJbjfk.exe
  C:\Windows\System\PXJbjfk.exe
  2⤵
  PID:6972
- C:\Windows\System\MsJZALn.exe
  C:\Windows\System\MsJZALn.exe
  2⤵
  PID:6988
- C:\Windows\System\zJqkOSZ.exe
  C:\Windows\System\zJqkOSZ.exe
  2⤵
  PID:7024
- C:\Windows\System\IeQaPFH.exe
  C:\Windows\System\IeQaPFH.exe
  2⤵
  PID:2156
- C:\Windows\System\IxRYvVy.exe
  C:\Windows\System\IxRYvVy.exe
  2⤵
  PID:880
- C:\Windows\System\cZhzPyH.exe
  C:\Windows\System\cZhzPyH.exe
  2⤵
  PID:3220
- C:\Windows\System\ADEcaXt.exe
  C:\Windows\System\ADEcaXt.exe
  2⤵
  PID:3412
- C:\Windows\System\BacahCI.exe
  C:\Windows\System\BacahCI.exe
  2⤵
  PID:2196
- C:\Windows\System\CoKXoMF.exe
  C:\Windows\System\CoKXoMF.exe
  2⤵
  PID:1512
- C:\Windows\System\SIOJqnc.exe
  C:\Windows\System\SIOJqnc.exe
  2⤵
  PID:2288
- C:\Windows\System\CDOizKY.exe
  C:\Windows\System\CDOizKY.exe
  2⤵
  PID:1752
- C:\Windows\System\DYhOrdp.exe
  C:\Windows\System\DYhOrdp.exe
  2⤵
  PID:3096
- C:\Windows\System\bBVIRVb.exe
  C:\Windows\System\bBVIRVb.exe
  2⤵
  PID:3224
- C:\Windows\System\LQxYrxu.exe
  C:\Windows\System\LQxYrxu.exe
  2⤵
  PID:3352
- C:\Windows\System\sCfnVWz.exe
  C:\Windows\System\sCfnVWz.exe
  2⤵
  PID:3480
- C:\Windows\System\cQBwSiu.exe
  C:\Windows\System\cQBwSiu.exe
  2⤵
  PID:7056
- C:\Windows\System\uqLvHKe.exe
  C:\Windows\System\uqLvHKe.exe
  2⤵
  PID:7072
- C:\Windows\System\DPSCjhJ.exe
  C:\Windows\System\DPSCjhJ.exe
  2⤵
  PID:7092
- C:\Windows\System\WHazKxe.exe
  C:\Windows\System\WHazKxe.exe
  2⤵
  PID:7108
- C:\Windows\System\thXeYqk.exe
  C:\Windows\System\thXeYqk.exe
  2⤵
  PID:7132
- C:\Windows\System\wLMtwMo.exe
  C:\Windows\System\wLMtwMo.exe
  2⤵
  PID:7148
- C:\Windows\System\InUhXzB.exe
  C:\Windows\System\InUhXzB.exe
  2⤵
  PID:4452
- C:\Windows\System\dQlGDVm.exe
  C:\Windows\System\dQlGDVm.exe
  2⤵
  PID:4520
- C:\Windows\System\ZhlLXdg.exe
  C:\Windows\System\ZhlLXdg.exe
  2⤵
  PID:4616
- C:\Windows\System\LwLcjzs.exe
  C:\Windows\System\LwLcjzs.exe
  2⤵
  PID:4680
- C:\Windows\System\GKezVyy.exe
  C:\Windows\System\GKezVyy.exe
  2⤵
  PID:4772
- C:\Windows\System\oNavwBu.exe
  C:\Windows\System\oNavwBu.exe
  2⤵
  PID:4836
- C:\Windows\System\vSYPyEu.exe
  C:\Windows\System\vSYPyEu.exe
  2⤵
  PID:4900
- C:\Windows\System\dOOMdyd.exe
  C:\Windows\System\dOOMdyd.exe
  2⤵
  PID:4964
- C:\Windows\System\QJmZSQU.exe
  C:\Windows\System\QJmZSQU.exe
  2⤵
  PID:5028
- C:\Windows\System\TDduhFQ.exe
  C:\Windows\System\TDduhFQ.exe
  2⤵
  PID:5096
- C:\Windows\System\Xamxitr.exe
  C:\Windows\System\Xamxitr.exe
  2⤵
  PID:4148
- C:\Windows\System\bjljpGd.exe
  C:\Windows\System\bjljpGd.exe
  2⤵
  PID:4404
- C:\Windows\System\ePdvLHg.exe
  C:\Windows\System\ePdvLHg.exe
  2⤵
  PID:4788
- C:\Windows\System\hLcYuGk.exe
  C:\Windows\System\hLcYuGk.exe
  2⤵
  PID:5044
- C:\Windows\System\jsUNmtE.exe
  C:\Windows\System\jsUNmtE.exe
  2⤵
  PID:4468
- C:\Windows\System\JnbmOCQ.exe
  C:\Windows\System\JnbmOCQ.exe
  2⤵
  PID:5148
- C:\Windows\System\PbVgJkI.exe
  C:\Windows\System\PbVgJkI.exe
  2⤵
  PID:5240
- C:\Windows\System\guJTkwP.exe
  C:\Windows\System\guJTkwP.exe
  2⤵
  PID:5304
- C:\Windows\System\HaeqbDC.exe
  C:\Windows\System\HaeqbDC.exe
  2⤵
  PID:5368
- C:\Windows\System\tyONbeQ.exe
  C:\Windows\System\tyONbeQ.exe
  2⤵
  PID:5468
- C:\Windows\System\gyUsudZ.exe
  C:\Windows\System\gyUsudZ.exe
  2⤵
  PID:5532
- C:\Windows\System\mDPMKNt.exe
  C:\Windows\System\mDPMKNt.exe
  2⤵
  PID:5596
- C:\Windows\System\swfqtDi.exe
  C:\Windows\System\swfqtDi.exe
  2⤵
  PID:5660
- C:\Windows\System\kylzKvj.exe
  C:\Windows\System\kylzKvj.exe
  2⤵
  PID:5724
- C:\Windows\System\OVFVKqR.exe
  C:\Windows\System\OVFVKqR.exe
  2⤵
  PID:5788
- C:\Windows\System\dPVrvwC.exe
  C:\Windows\System\dPVrvwC.exe
  2⤵
  PID:5852
- C:\Windows\System\GQmCmAU.exe
  C:\Windows\System\GQmCmAU.exe
  2⤵
  PID:5916
- C:\Windows\System\bfhzptB.exe
  C:\Windows\System\bfhzptB.exe
  2⤵
  PID:5980
- C:\Windows\System\nSNwlvj.exe
  C:\Windows\System\nSNwlvj.exe
  2⤵
  PID:6044
- C:\Windows\System\balHvph.exe
  C:\Windows\System\balHvph.exe
  2⤵
  PID:6108
- C:\Windows\System\NelqOBk.exe
  C:\Windows\System\NelqOBk.exe
  2⤵
  PID:5128
- C:\Windows\System\chHsDSL.exe
  C:\Windows\System\chHsDSL.exe
  2⤵
  PID:2312
- C:\Windows\System\EGygYLw.exe
  C:\Windows\System\EGygYLw.exe
  2⤵
  PID:5580
- C:\Windows\System\CPCxVnZ.exe
  C:\Windows\System\CPCxVnZ.exe
  2⤵
  PID:5804
- C:\Windows\System\vGdQeTx.exe
  C:\Windows\System\vGdQeTx.exe
  2⤵
  PID:6028
- C:\Windows\System\xsUlroL.exe
  C:\Windows\System\xsUlroL.exe
  2⤵
  PID:5516
- C:\Windows\System\xWlxxbb.exe
  C:\Windows\System\xWlxxbb.exe
  2⤵
  PID:6164
- C:\Windows\System\khcSlAH.exe
  C:\Windows\System\khcSlAH.exe
  2⤵
  PID:6232
- C:\Windows\System\kejFqUg.exe
  C:\Windows\System\kejFqUg.exe
  2⤵
  PID:8088
- C:\Windows\System\fuuNqsh.exe
  C:\Windows\System\fuuNqsh.exe
  2⤵
  PID:8120
- C:\Windows\System\uHCKvQc.exe
  C:\Windows\System\uHCKvQc.exe
  2⤵
  PID:1136
- C:\Windows\System\cgFvNxW.exe
  C:\Windows\System\cgFvNxW.exe
  2⤵
  PID:6152
- C:\Windows\System\qmYrxgl.exe
  C:\Windows\System\qmYrxgl.exe
  2⤵
  PID:6416
- C:\Windows\System\dlKVDnC.exe
  C:\Windows\System\dlKVDnC.exe
  2⤵
  PID:2476
- C:\Windows\System\cbleReD.exe
  C:\Windows\System\cbleReD.exe
  2⤵
  PID:2840
- C:\Windows\System\LBDvuNd.exe
  C:\Windows\System\LBDvuNd.exe
  2⤵
  PID:2520
- C:\Windows\System\fOXstaY.exe
  C:\Windows\System\fOXstaY.exe
  2⤵
  PID:2720
- C:\Windows\System\WNyVFin.exe
  C:\Windows\System\WNyVFin.exe
  2⤵
  PID:2916
- C:\Windows\System\JnJLmGu.exe
  C:\Windows\System\JnJLmGu.exe
  2⤵
  PID:6504
- C:\Windows\System\UByTisn.exe
  C:\Windows\System\UByTisn.exe
  2⤵
  PID:1260
- C:\Windows\System\cngyXJl.exe
  C:\Windows\System\cngyXJl.exe
  2⤵
  PID:5208
- C:\Windows\System\GGOxkFP.exe
  C:\Windows\System\GGOxkFP.exe
  2⤵
  PID:6956
- C:\Windows\System\GulKorI.exe
  C:\Windows\System\GulKorI.exe
  2⤵
  PID:8168
- C:\Windows\System\jHDizvE.exe
  C:\Windows\System\jHDizvE.exe
  2⤵
  PID:4264
- C:\Windows\System\ZLOMTas.exe
  C:\Windows\System\ZLOMTas.exe
  2⤵
  PID:6220
- C:\Windows\System\CEbSelW.exe
  C:\Windows\System\CEbSelW.exe
  2⤵
  PID:6484
- C:\Windows\System\xReeSlK.exe
  C:\Windows\System\xReeSlK.exe
  2⤵
  PID:2108
- C:\Windows\System\iipGvyE.exe
  C:\Windows\System\iipGvyE.exe
  2⤵
  PID:6800
- C:\Windows\System\FGTQTPh.exe
  C:\Windows\System\FGTQTPh.exe
  2⤵
  PID:6732
- C:\Windows\System\SVvbqqP.exe
  C:\Windows\System\SVvbqqP.exe
  2⤵
  PID:6668
- C:\Windows\System\csQVxKb.exe
  C:\Windows\System\csQVxKb.exe
  2⤵
  PID:6604
- C:\Windows\System\HLynAQV.exe
  C:\Windows\System\HLynAQV.exe
  2⤵
  PID:6536
- C:\Windows\System\nLjDmjL.exe
  C:\Windows\System\nLjDmjL.exe
  2⤵
  PID:1600
- C:\Windows\System\yDtGtTi.exe
  C:\Windows\System\yDtGtTi.exe
  2⤵
  PID:1624
- C:\Windows\System\VpmsfdW.exe
  C:\Windows\System\VpmsfdW.exe
  2⤵
  PID:7040
- C:\Windows\System\usWDxfP.exe
  C:\Windows\System\usWDxfP.exe
  2⤵
  PID:1140
- C:\Windows\System\WhwHaSB.exe
  C:\Windows\System\WhwHaSB.exe
  2⤵
  PID:3448
- C:\Windows\System\nyirgLU.exe
  C:\Windows\System\nyirgLU.exe
  2⤵
  PID:7104
- C:\Windows\System\PPEIQDB.exe
  C:\Windows\System\PPEIQDB.exe
  2⤵
  PID:4516
- C:\Windows\System\gHDsSdl.exe
  C:\Windows\System\gHDsSdl.exe
  2⤵
  PID:4712
- C:\Windows\System\HbcvhaZ.exe
  C:\Windows\System\HbcvhaZ.exe
  2⤵
  PID:3024
- C:\Windows\System\Owvkgrv.exe
  C:\Windows\System\Owvkgrv.exe
  2⤵
  PID:4552
- C:\Windows\System\fCllmfL.exe
  C:\Windows\System\fCllmfL.exe
  2⤵
  PID:4936
- C:\Windows\System\IiNMkrs.exe
  C:\Windows\System\IiNMkrs.exe
  2⤵
  PID:4376
- C:\Windows\System\lCqGAnN.exe
  C:\Windows\System\lCqGAnN.exe
  2⤵
  PID:7036
- C:\Windows\System\zFjqYsY.exe
  C:\Windows\System\zFjqYsY.exe
  2⤵
  PID:3736
- C:\Windows\System\elzSbVr.exe
  C:\Windows\System\elzSbVr.exe
  2⤵
  PID:4916
- C:\Windows\System\JKIfDGn.exe
  C:\Windows\System\JKIfDGn.exe
  2⤵
  PID:5016
- C:\Windows\System\GDTPSpa.exe
  C:\Windows\System\GDTPSpa.exe
  2⤵
  PID:3544
- C:\Windows\System\XBNOBBo.exe
  C:\Windows\System\XBNOBBo.exe
  2⤵
  PID:4740
- C:\Windows\System\GeedTWZ.exe
  C:\Windows\System\GeedTWZ.exe
  2⤵
  PID:1016
- C:\Windows\System\waxRRQA.exe
  C:\Windows\System\waxRRQA.exe
  2⤵
  PID:7120
- C:\Windows\System\cLCDHPo.exe
  C:\Windows\System\cLCDHPo.exe
  2⤵
  PID:4868
- C:\Windows\System\wviLMfy.exe
  C:\Windows\System\wviLMfy.exe
  2⤵
  PID:3432
- C:\Windows\System\sJgyOJG.exe
  C:\Windows\System\sJgyOJG.exe
  2⤵
  PID:4440
- C:\Windows\System\VAtxRkO.exe
  C:\Windows\System\VAtxRkO.exe
  2⤵
  PID:5340
- C:\Windows\System\MxByAmb.exe
  C:\Windows\System\MxByAmb.exe
  2⤵
  PID:5592
- C:\Windows\System\YdKRRsa.exe
  C:\Windows\System\YdKRRsa.exe
  2⤵
  PID:5848
- C:\Windows\System\NYcPGdw.exe
  C:\Windows\System\NYcPGdw.exe
  2⤵
  PID:6104
- C:\Windows\System\MLjbHNY.exe
  C:\Windows\System\MLjbHNY.exe
  2⤵
  PID:2416
- C:\Windows\System\CDyEzom.exe
  C:\Windows\System\CDyEzom.exe
  2⤵
  PID:2600
- C:\Windows\System\pnWErLg.exe
  C:\Windows\System\pnWErLg.exe
  2⤵
  PID:2028
- C:\Windows\System\bZZBLqI.exe
  C:\Windows\System\bZZBLqI.exe
  2⤵
  PID:5756
- C:\Windows\System\YSrWavA.exe
  C:\Windows\System\YSrWavA.exe
  2⤵
  PID:6336
- C:\Windows\System\PrczpCq.exe
  C:\Windows\System\PrczpCq.exe
  2⤵
  PID:2556
- C:\Windows\System\NPVoxcb.exe
  C:\Windows\System\NPVoxcb.exe
  2⤵
  PID:8136
- C:\Windows\System\zkZlXCT.exe
  C:\Windows\System\zkZlXCT.exe
  2⤵
  PID:5704
- C:\Windows\System\DVdBfAw.exe
  C:\Windows\System\DVdBfAw.exe
  2⤵
  PID:4996
- C:\Windows\System\aasYMtz.exe
  C:\Windows\System\aasYMtz.exe
  2⤵
  PID:6276
- C:\Windows\System\hNxEiQc.exe
  C:\Windows\System\hNxEiQc.exe
  2⤵
  PID:5656
- C:\Windows\System\osLDnRT.exe
  C:\Windows\System\osLDnRT.exe
  2⤵
  PID:5928
- C:\Windows\System\CLiEzbA.exe
  C:\Windows\System\CLiEzbA.exe
  2⤵
  PID:6372
- C:\Windows\System\vYczMDZ.exe
  C:\Windows\System\vYczMDZ.exe
  2⤵
  PID:8108
- C:\Windows\System\lfTKfzs.exe
  C:\Windows\System\lfTKfzs.exe
  2⤵
  PID:6472
- C:\Windows\System\fTMxVCu.exe
  C:\Windows\System\fTMxVCu.exe
  2⤵
  PID:1936
- C:\Windows\System\yXpVXrr.exe
  C:\Windows\System\yXpVXrr.exe
  2⤵
  PID:412
- C:\Windows\System\bLNTQFp.exe
  C:\Windows\System\bLNTQFp.exe
  2⤵
  PID:2060
- C:\Windows\System\cgImSfX.exe
  C:\Windows\System\cgImSfX.exe
  2⤵
  PID:2740
- C:\Windows\System\vPBUGwo.exe
  C:\Windows\System\vPBUGwo.exe
  2⤵
  PID:1568
- C:\Windows\System\XzuaJwQ.exe
  C:\Windows\System\XzuaJwQ.exe
  2⤵
  PID:2716
- C:\Windows\System\uDgaTuF.exe
  C:\Windows\System\uDgaTuF.exe
  2⤵
  PID:1604
- C:\Windows\System\fiSnAYG.exe
  C:\Windows\System\fiSnAYG.exe
  2⤵
  PID:6764
- C:\Windows\System\aHXWPqZ.exe
  C:\Windows\System\aHXWPqZ.exe
  2⤵
  PID:948
- C:\Windows\System\XgFHcMm.exe
  C:\Windows\System\XgFHcMm.exe
  2⤵
  PID:2468
- C:\Windows\System\PrXwePg.exe
  C:\Windows\System\PrXwePg.exe
  2⤵
  PID:2824
- C:\Windows\System\lKYqCKB.exe
  C:\Windows\System\lKYqCKB.exe
  2⤵
  PID:4232
- C:\Windows\System\wxExSot.exe
  C:\Windows\System\wxExSot.exe
  2⤵
  PID:6912
- C:\Windows\System\hJCodQz.exe
  C:\Windows\System\hJCodQz.exe
  2⤵
  PID:1924
- C:\Windows\System\PVIOxzn.exe
  C:\Windows\System\PVIOxzn.exe
  2⤵
  PID:6920
- C:\Windows\System\wGFMoWW.exe
  C:\Windows\System\wGFMoWW.exe
  2⤵
  PID:7004
- C:\Windows\System\NfEEHcl.exe
  C:\Windows\System\NfEEHcl.exe
  2⤵
  PID:6216
- C:\Windows\System\DKKGEYu.exe
  C:\Windows\System\DKKGEYu.exe
  2⤵
  PID:6768
- C:\Windows\System\ZMQMpmW.exe
  C:\Windows\System\ZMQMpmW.exe
  2⤵
  PID:3416
- C:\Windows\System\SOIaLSs.exe
  C:\Windows\System\SOIaLSs.exe
  2⤵
  PID:2408
- C:\Windows\System\sWhlTYb.exe
  C:\Windows\System\sWhlTYb.exe
  2⤵
  PID:4484
- C:\Windows\System\IyQKwqq.exe
  C:\Windows\System\IyQKwqq.exe
  2⤵
  PID:5564
- C:\Windows\System\BwgoPRt.exe
  C:\Windows\System\BwgoPRt.exe
  2⤵
  PID:3188
- C:\Windows\System\tTdYnrR.exe
  C:\Windows\System\tTdYnrR.exe
  2⤵
  PID:2000
- C:\Windows\System\zIFzRHj.exe
  C:\Windows\System\zIFzRHj.exe
  2⤵
  PID:4580
- C:\Windows\System\RRqGoyw.exe
  C:\Windows\System\RRqGoyw.exe
  2⤵
  PID:6076
- C:\Windows\System\HpPsnBn.exe
  C:\Windows\System\HpPsnBn.exe
  2⤵
  PID:2928
- C:\Windows\System\sDSBwjN.exe
  C:\Windows\System\sDSBwjN.exe
  2⤵
  PID:7160
- C:\Windows\System\rIaGNOa.exe
  C:\Windows\System\rIaGNOa.exe
  2⤵
  PID:6696
- C:\Windows\System\gSFEfqk.exe
  C:\Windows\System\gSFEfqk.exe
  2⤵
  PID:5720
- C:\Windows\System\HSqDOrT.exe
  C:\Windows\System\HSqDOrT.exe
  2⤵
  PID:6200
- C:\Windows\System\ZxIWAPT.exe
  C:\Windows\System\ZxIWAPT.exe
  2⤵
  PID:2124
- C:\Windows\System\MdOveuh.exe
  C:\Windows\System\MdOveuh.exe
  2⤵
  PID:4276
- C:\Windows\System\GBlzMLW.exe
  C:\Windows\System\GBlzMLW.exe
  2⤵
  PID:1464
- C:\Windows\System\ZGNtXKI.exe
  C:\Windows\System\ZGNtXKI.exe
  2⤵
  PID:2684
- C:\Windows\System\ACGlKnn.exe
  C:\Windows\System\ACGlKnn.exe
  2⤵
  PID:7020
- C:\Windows\System\wGEjkeD.exe
  C:\Windows\System\wGEjkeD.exe
  2⤵
  PID:8212
- C:\Windows\System\mbmlHRu.exe
  C:\Windows\System\mbmlHRu.exe
  2⤵
  PID:8228
- C:\Windows\System\eAOMwde.exe
  C:\Windows\System\eAOMwde.exe
  2⤵
  PID:8244
- C:\Windows\System\HPQSwON.exe
  C:\Windows\System\HPQSwON.exe
  2⤵
  PID:8264
- C:\Windows\System\RrkWkwm.exe
  C:\Windows\System\RrkWkwm.exe
  2⤵
  PID:8288
- C:\Windows\System\ubeHHLu.exe
  C:\Windows\System\ubeHHLu.exe
  2⤵
  PID:8312
- C:\Windows\System\gYVBwtg.exe
  C:\Windows\System\gYVBwtg.exe
  2⤵
  PID:8328
- C:\Windows\System\hGfYvZH.exe
  C:\Windows\System\hGfYvZH.exe
  2⤵
  PID:8380
- C:\Windows\System\IvXyHYg.exe
  C:\Windows\System\IvXyHYg.exe
  2⤵
  PID:8400
- C:\Windows\System\tjVlrDj.exe
  C:\Windows\System\tjVlrDj.exe
  2⤵
  PID:8420
- C:\Windows\System\dPUFqtg.exe
  C:\Windows\System\dPUFqtg.exe
  2⤵
  PID:8440
- C:\Windows\System\HssEOfv.exe
  C:\Windows\System\HssEOfv.exe
  2⤵
  PID:8456
- C:\Windows\System\VmJtFxA.exe
  C:\Windows\System\VmJtFxA.exe
  2⤵
  PID:8472
- C:\Windows\System\HnInLkT.exe
  C:\Windows\System\HnInLkT.exe
  2⤵
  PID:8488
- C:\Windows\System\BrRrBme.exe
  C:\Windows\System\BrRrBme.exe
  2⤵
  PID:8508
- C:\Windows\System\YKdkYlf.exe
  C:\Windows\System\YKdkYlf.exe
  2⤵
  PID:8532
- C:\Windows\System\udEINfi.exe
  C:\Windows\System\udEINfi.exe
  2⤵
  PID:8552
- C:\Windows\System\eIwFEWx.exe
  C:\Windows\System\eIwFEWx.exe
  2⤵
  PID:8568
- C:\Windows\System\uKAjoYc.exe
  C:\Windows\System\uKAjoYc.exe
  2⤵
  PID:8584
- C:\Windows\System\wSwtEEN.exe
  C:\Windows\System\wSwtEEN.exe
  2⤵
  PID:8772
- C:\Windows\System\bhxWAid.exe
  C:\Windows\System\bhxWAid.exe
  2⤵
  PID:8788
- C:\Windows\System\qgLmCvt.exe
  C:\Windows\System\qgLmCvt.exe
  2⤵
  PID:8804
- C:\Windows\System\USXZnNW.exe
  C:\Windows\System\USXZnNW.exe
  2⤵
  PID:8824
- C:\Windows\System\zgRJLlE.exe
  C:\Windows\System\zgRJLlE.exe
  2⤵
  PID:8840
- C:\Windows\System\FJxdmWJ.exe
  C:\Windows\System\FJxdmWJ.exe
  2⤵
  PID:8860
- C:\Windows\System\IMJSXSh.exe
  C:\Windows\System\IMJSXSh.exe
  2⤵
  PID:8876
- C:\Windows\System\xEjXBeh.exe
  C:\Windows\System\xEjXBeh.exe
  2⤵
  PID:8912
- C:\Windows\System\aZDNevU.exe
  C:\Windows\System\aZDNevU.exe
  2⤵
  PID:8928
- C:\Windows\System\TVrLpJt.exe
  C:\Windows\System\TVrLpJt.exe
  2⤵
  PID:8948
- C:\Windows\System\GSNdlsi.exe
  C:\Windows\System\GSNdlsi.exe
  2⤵
  PID:8964
- C:\Windows\System\nZqkPgI.exe
  C:\Windows\System\nZqkPgI.exe
  2⤵
  PID:8988
- C:\Windows\System\DyUerDA.exe
  C:\Windows\System\DyUerDA.exe
  2⤵
  PID:9004
- C:\Windows\System\NrQfPob.exe
  C:\Windows\System\NrQfPob.exe
  2⤵
  PID:9024
- C:\Windows\System\MbDPOIe.exe
  C:\Windows\System\MbDPOIe.exe
  2⤵
  PID:9040
- C:\Windows\System\KTCXfLC.exe
  C:\Windows\System\KTCXfLC.exe
  2⤵
  PID:9060
- C:\Windows\System\DeOrcwm.exe
  C:\Windows\System\DeOrcwm.exe
  2⤵
  PID:9080
- C:\Windows\System\kBOMsyj.exe
  C:\Windows\System\kBOMsyj.exe
  2⤵
  PID:9096
- C:\Windows\System\RmzkmxU.exe
  C:\Windows\System\RmzkmxU.exe
  2⤵
  PID:9128
- C:\Windows\System\AwfCxeA.exe
  C:\Windows\System\AwfCxeA.exe
  2⤵
  PID:9144
- C:\Windows\System\qoEbTUu.exe
  C:\Windows\System\qoEbTUu.exe
  2⤵
  PID:1880
- C:\Windows\System\YXLVNMA.exe
  C:\Windows\System\YXLVNMA.exe
  2⤵
  PID:6140
- C:\Windows\System\nCvOyle.exe
  C:\Windows\System\nCvOyle.exe
  2⤵
  PID:6404
- C:\Windows\System\qkgKnNB.exe
  C:\Windows\System\qkgKnNB.exe
  2⤵
  PID:2872
- C:\Windows\System\YRSsuqs.exe
  C:\Windows\System\YRSsuqs.exe
  2⤵
  PID:2120
- C:\Windows\System\JYkVjMo.exe
  C:\Windows\System\JYkVjMo.exe
  2⤵
  PID:1920
- C:\Windows\System\vmXLXhy.exe
  C:\Windows\System\vmXLXhy.exe
  2⤵
  PID:1940
- C:\Windows\System\DhBNYwh.exe
  C:\Windows\System\DhBNYwh.exe
  2⤵
  PID:3192
- C:\Windows\System\serIyjl.exe
  C:\Windows\System\serIyjl.exe
  2⤵
  PID:2452
- C:\Windows\System\CUaKNUw.exe
  C:\Windows\System\CUaKNUw.exe
  2⤵
  PID:3028
- C:\Windows\System\znfdXVA.exe
  C:\Windows\System\znfdXVA.exe
  2⤵
  PID:1656
- C:\Windows\System\NGvHfue.exe
  C:\Windows\System\NGvHfue.exe
  2⤵
  PID:6916
- C:\Windows\System\kUpcOWt.exe
  C:\Windows\System\kUpcOWt.exe
  2⤵
  PID:6468
- C:\Windows\System\BeqxmZz.exe
  C:\Windows\System\BeqxmZz.exe
  2⤵
  PID:5452
- C:\Windows\System\kZudfIE.exe
  C:\Windows\System\kZudfIE.exe
  2⤵
  PID:1896
- C:\Windows\System\NlVxsiX.exe
  C:\Windows\System\NlVxsiX.exe
  2⤵
  PID:8260
- C:\Windows\System\yhIqmgN.exe
  C:\Windows\System\yhIqmgN.exe
  2⤵
  PID:3316
- C:\Windows\System\FCQNGck.exe
  C:\Windows\System\FCQNGck.exe
  2⤵
  PID:3320
- C:\Windows\System\cQVbaTb.exe
  C:\Windows\System\cQVbaTb.exe
  2⤵
  PID:6456
- C:\Windows\System\dfBVhwG.exe
  C:\Windows\System\dfBVhwG.exe
  2⤵
  PID:5144
- C:\Windows\System\bnsZFIM.exe
  C:\Windows\System\bnsZFIM.exe
  2⤵
  PID:7088
- C:\Windows\System\ZvoFURD.exe
  C:\Windows\System\ZvoFURD.exe
  2⤵
  PID:8500
- C:\Windows\System\MkhjNpu.exe
  C:\Windows\System\MkhjNpu.exe
  2⤵
  PID:8576
- C:\Windows\System\wdkgfMx.exe
  C:\Windows\System\wdkgfMx.exe
  2⤵
  PID:8356
- C:\Windows\System\CFaqHRm.exe
  C:\Windows\System\CFaqHRm.exe
  2⤵
  PID:8364
- C:\Windows\System\REBEyNp.exe
  C:\Windows\System\REBEyNp.exe
  2⤵
  PID:8408
- C:\Windows\System\jjdShpU.exe
  C:\Windows\System\jjdShpU.exe
  2⤵
  PID:8480
- C:\Windows\System\DTYpOSr.exe
  C:\Windows\System\DTYpOSr.exe
  2⤵
  PID:8604
- C:\Windows\System\eyCQMGA.exe
  C:\Windows\System\eyCQMGA.exe
  2⤵
  PID:8620
- C:\Windows\System\CyFSbCC.exe
  C:\Windows\System\CyFSbCC.exe
  2⤵
  PID:8632
- C:\Windows\System\PXdrVTW.exe
  C:\Windows\System\PXdrVTW.exe
  2⤵
  PID:8648
- C:\Windows\System\TFAQFpF.exe
  C:\Windows\System\TFAQFpF.exe
  2⤵
  PID:8336
- C:\Windows\System\lXJHleQ.exe
  C:\Windows\System\lXJHleQ.exe
  2⤵
  PID:8672
- C:\Windows\System\aWOusBj.exe
  C:\Windows\System\aWOusBj.exe
  2⤵
  PID:8320
- C:\Windows\System\SIDwvSY.exe
  C:\Windows\System\SIDwvSY.exe
  2⤵
  PID:8700
- C:\Windows\System\WUtbPZk.exe
  C:\Windows\System\WUtbPZk.exe
  2⤵
  PID:8716
- C:\Windows\System\galIKsp.exe
  C:\Windows\System\galIKsp.exe
  2⤵
  PID:8732
- C:\Windows\System\ZeQtCVb.exe
  C:\Windows\System\ZeQtCVb.exe
  2⤵
  PID:8752
- C:\Windows\System\QjUFLWI.exe
  C:\Windows\System\QjUFLWI.exe
  2⤵
  PID:8780
- C:\Windows\System\fbAfArL.exe
  C:\Windows\System\fbAfArL.exe
  2⤵
  PID:8760
- C:\Windows\System\wKBszzS.exe
  C:\Windows\System\wKBszzS.exe
  2⤵
  PID:8812
- C:\Windows\System\AdHcwzi.exe
  C:\Windows\System\AdHcwzi.exe
  2⤵
  PID:8856
- C:\Windows\System\BsdCQAj.exe
  C:\Windows\System\BsdCQAj.exe
  2⤵
  PID:8896
- C:\Windows\System\mMGCVVp.exe
  C:\Windows\System\mMGCVVp.exe
  2⤵
  PID:8936
- C:\Windows\System\NYdfPWB.exe
  C:\Windows\System\NYdfPWB.exe
  2⤵
  PID:8944
- C:\Windows\System\gYGBEnU.exe
  C:\Windows\System\gYGBEnU.exe
  2⤵
  PID:8996
- C:\Windows\System\HWtkKov.exe
  C:\Windows\System\HWtkKov.exe
  2⤵
  PID:8956
- C:\Windows\System\gyVUHDD.exe
  C:\Windows\System\gyVUHDD.exe
  2⤵
  PID:9068
- C:\Windows\System\dquKORA.exe
  C:\Windows\System\dquKORA.exe
  2⤵
  PID:8984
- C:\Windows\System\oTDRBgs.exe
  C:\Windows\System\oTDRBgs.exe
  2⤵
  PID:9112
- C:\Windows\System\vrmjylO.exe
  C:\Windows\System\vrmjylO.exe
  2⤵
  PID:9012
- C:\Windows\System\tmXHoGB.exe
  C:\Windows\System\tmXHoGB.exe
  2⤵
  PID:9056
- C:\Windows\System\NXLMZGm.exe
  C:\Windows\System\NXLMZGm.exe
  2⤵
  PID:9164
- C:\Windows\System\dqQgMAe.exe
  C:\Windows\System\dqQgMAe.exe
  2⤵
  PID:9172
- C:\Windows\System\QmFaoPu.exe
  C:\Windows\System\QmFaoPu.exe
  2⤵
  PID:9192
- C:\Windows\System\xHPWfRT.exe
  C:\Windows\System\xHPWfRT.exe
  2⤵
  PID:8188
- C:\Windows\System\LCZGSwF.exe
  C:\Windows\System\LCZGSwF.exe
  2⤵
  PID:2644
- C:\Windows\System\hXbvNGk.exe
  C:\Windows\System\hXbvNGk.exe
  2⤵
  PID:6400
- C:\Windows\System\eWFcakh.exe
  C:\Windows\System\eWFcakh.exe
  2⤵
  PID:1876
- C:\Windows\System\jSmTpgC.exe
  C:\Windows\System\jSmTpgC.exe
  2⤵
  PID:8156
- C:\Windows\System\RXOvMfk.exe
  C:\Windows\System\RXOvMfk.exe
  2⤵
  PID:2508
- C:\Windows\System\HirSWSB.exe
  C:\Windows\System\HirSWSB.exe
  2⤵
  PID:4648
- C:\Windows\System\VdlLFxS.exe
  C:\Windows\System\VdlLFxS.exe
  2⤵
  PID:8304
- C:\Windows\System\weWiUzX.exe
  C:\Windows\System\weWiUzX.exe
  2⤵
  PID:4760
- C:\Windows\System\HQNGGRi.exe
  C:\Windows\System\HQNGGRi.exe
  2⤵
  PID:2620
- C:\Windows\System\UCqWgWl.exe
  C:\Windows\System\UCqWgWl.exe
  2⤵
  PID:5976
- C:\Windows\System\uQNylWo.exe
  C:\Windows\System\uQNylWo.exe
  2⤵
  PID:6700
- C:\Windows\System\meWWeWj.exe
  C:\Windows\System\meWWeWj.exe
  2⤵
  PID:6292
- C:\Windows\System\noLtuAD.exe
  C:\Windows\System\noLtuAD.exe
  2⤵
  PID:5092
- C:\Windows\System\ZLpNqMr.exe
  C:\Windows\System\ZLpNqMr.exe
  2⤵
  PID:8236
- C:\Windows\System\hmrJyEk.exe
  C:\Windows\System\hmrJyEk.exe
  2⤵
  PID:8276
- C:\Windows\System\AnKADzZ.exe
  C:\Windows\System\AnKADzZ.exe
  2⤵
  PID:1376
- C:\Windows\System\aPMlxfS.exe
  C:\Windows\System\aPMlxfS.exe
  2⤵
  PID:8428
- C:\Windows\System\LmnFlvn.exe
  C:\Windows\System\LmnFlvn.exe
  2⤵
  PID:8468
- C:\Windows\System\tijWssN.exe
  C:\Windows\System\tijWssN.exe
  2⤵
  PID:8564
- C:\Windows\System\pLwSNgf.exe
  C:\Windows\System\pLwSNgf.exe
  2⤵
  PID:8388
- C:\Windows\System\JENNezo.exe
  C:\Windows\System\JENNezo.exe
  2⤵
  PID:8360
- C:\Windows\System\oCZmNbX.exe
  C:\Windows\System\oCZmNbX.exe
  2⤵
  PID:8592
- C:\Windows\System\NSSCfhd.exe
  C:\Windows\System\NSSCfhd.exe
  2⤵
  PID:8548
- C:\Windows\System\XNXsGtF.exe
  C:\Windows\System\XNXsGtF.exe
  2⤵
  PID:8656
- C:\Windows\System\wSUGfMI.exe
  C:\Windows\System\wSUGfMI.exe
  2⤵
  PID:8688
- C:\Windows\System\OwJRIHQ.exe
  C:\Windows\System\OwJRIHQ.exe
  2⤵
  PID:8712
- C:\Windows\System\ZcDKpQN.exe
  C:\Windows\System\ZcDKpQN.exe
  2⤵
  PID:8728
- C:\Windows\System\eGfKEWY.exe
  C:\Windows\System\eGfKEWY.exe
  2⤵
  PID:8724
- C:\Windows\System\AhwZeMv.exe
  C:\Windows\System\AhwZeMv.exe
  2⤵
  PID:8740
- C:\Windows\System\jSohYop.exe
  C:\Windows\System\jSohYop.exe
  2⤵
  PID:8800
- C:\Windows\System\IYMBuJD.exe
  C:\Windows\System\IYMBuJD.exe
  2⤵
  PID:8820
- C:\Windows\System\yhPRjcr.exe
  C:\Windows\System\yhPRjcr.exe
  2⤵
  PID:8852
- C:\Windows\System\wWpjiXs.exe
  C:\Windows\System\wWpjiXs.exe
  2⤵
  PID:8908
- C:\Windows\System\NiSPtGw.exe
  C:\Windows\System\NiSPtGw.exe
  2⤵
  PID:9020
- C:\Windows\System\tsnGbhr.exe
  C:\Windows\System\tsnGbhr.exe
  2⤵
  PID:9160
- C:\Windows\System\kYvQabP.exe
  C:\Windows\System\kYvQabP.exe
  2⤵
  PID:9184
- C:\Windows\System\cVDzhXF.exe
  C:\Windows\System\cVDzhXF.exe
  2⤵
  PID:2180
- C:\Windows\System\TwnchoC.exe
  C:\Windows\System\TwnchoC.exe
  2⤵
  PID:2388
- C:\Windows\System\zMJcMWM.exe
  C:\Windows\System\zMJcMWM.exe
  2⤵
  PID:8980
- C:\Windows\System\sSrYzoM.exe
  C:\Windows\System\sSrYzoM.exe
  2⤵
  PID:2940
- C:\Windows\System\TypOuwV.exe
  C:\Windows\System\TypOuwV.exe
  2⤵
  PID:2700
- C:\Windows\System\SIYsaAh.exe
  C:\Windows\System\SIYsaAh.exe
  2⤵
  PID:4360
- C:\Windows\System\PQmqqZo.exe
  C:\Windows\System\PQmqqZo.exe
  2⤵
  PID:7100
- C:\Windows\System\EeHUNcg.exe
  C:\Windows\System\EeHUNcg.exe
  2⤵
  PID:2572
- C:\Windows\System\tJOJATh.exe
  C:\Windows\System\tJOJATh.exe
  2⤵
  PID:1404
- C:\Windows\System\GwkIXNV.exe
  C:\Windows\System\GwkIXNV.exe
  2⤵
  PID:1212
- C:\Windows\System\gIwcRyK.exe
  C:\Windows\System\gIwcRyK.exe
  2⤵
  PID:8560
- C:\Windows\System\TzacTdi.exe
  C:\Windows\System\TzacTdi.exe
  2⤵
  PID:3508
- C:\Windows\System\gRePMGM.exe
  C:\Windows\System\gRePMGM.exe
  2⤵
  PID:8516
- C:\Windows\System\IpiNQss.exe
  C:\Windows\System\IpiNQss.exe
  2⤵
  PID:8524
- C:\Windows\System\wOBXHzL.exe
  C:\Windows\System\wOBXHzL.exe
  2⤵
  PID:8628
- C:\Windows\System\KgpwMXe.exe
  C:\Windows\System\KgpwMXe.exe
  2⤵
  PID:8696
- C:\Windows\System\FPreDqG.exe
  C:\Windows\System\FPreDqG.exe
  2⤵
  PID:2308
- C:\Windows\System\NBqwjPt.exe
  C:\Windows\System\NBqwjPt.exe
  2⤵
  PID:8668
- C:\Windows\System\MZKrWnj.exe
  C:\Windows\System\MZKrWnj.exe
  2⤵
  PID:9052
- C:\Windows\System\aCGffjl.exe
  C:\Windows\System\aCGffjl.exe
  2⤵
  PID:9120
- C:\Windows\System\XBsaZGL.exe
  C:\Windows\System\XBsaZGL.exe
  2⤵
  PID:8784
- C:\Windows\System\rhoKFVJ.exe
  C:\Windows\System\rhoKFVJ.exe
  2⤵
  PID:1508
- C:\Windows\System\PwIjDcS.exe
  C:\Windows\System\PwIjDcS.exe
  2⤵
  PID:8348
- C:\Windows\System\RKlupVp.exe
  C:\Windows\System\RKlupVp.exe
  2⤵
  PID:8452
- C:\Windows\System\nRftoqK.exe
  C:\Windows\System\nRftoqK.exe
  2⤵
  PID:8432
- C:\Windows\System\jYXUyLM.exe
  C:\Windows\System\jYXUyLM.exe
  2⤵
  PID:9124
- C:\Windows\System\iBgobVU.exe
  C:\Windows\System\iBgobVU.exe
  2⤵
  PID:9076
- C:\Windows\System\aBQhXQZ.exe
  C:\Windows\System\aBQhXQZ.exe
  2⤵
  PID:8872
- C:\Windows\System\nJcMtEd.exe
  C:\Windows\System\nJcMtEd.exe
  2⤵
  PID:9200
- C:\Windows\System\oLxkkuS.exe
  C:\Windows\System\oLxkkuS.exe
  2⤵
  PID:8748
- C:\Windows\System\AmZrIwq.exe
  C:\Windows\System\AmZrIwq.exe
  2⤵
  PID:9136
- C:\Windows\System\AyEubwq.exe
  C:\Windows\System\AyEubwq.exe
  2⤵
  PID:9228
- C:\Windows\System\WTBlxDY.exe
  C:\Windows\System\WTBlxDY.exe
  2⤵
  PID:9244
- C:\Windows\System\CceSUvv.exe
  C:\Windows\System\CceSUvv.exe
  2⤵
  PID:9260
- C:\Windows\System\AgayMSn.exe
  C:\Windows\System\AgayMSn.exe
  2⤵
  PID:9276
- C:\Windows\System\arsDVTu.exe
  C:\Windows\System\arsDVTu.exe
  2⤵
  PID:9292
- C:\Windows\System\VGgZofn.exe
  C:\Windows\System\VGgZofn.exe
  2⤵
  PID:9308
- C:\Windows\System\OdYAMaL.exe
  C:\Windows\System\OdYAMaL.exe
  2⤵
  PID:9324
- C:\Windows\System\mxZmgTG.exe
  C:\Windows\System\mxZmgTG.exe
  2⤵
  PID:9340
- C:\Windows\System\uqVdYkF.exe
  C:\Windows\System\uqVdYkF.exe
  2⤵
  PID:9356
- C:\Windows\System\RXcrZxQ.exe
  C:\Windows\System\RXcrZxQ.exe
  2⤵
  PID:9372
- C:\Windows\System\ukdggAh.exe
  C:\Windows\System\ukdggAh.exe
  2⤵
  PID:9388
- C:\Windows\System\bLjExEH.exe
  C:\Windows\System\bLjExEH.exe
  2⤵
  PID:9404
- C:\Windows\System\TRqnWhv.exe
  C:\Windows\System\TRqnWhv.exe
  2⤵
  PID:9420
- C:\Windows\System\AHrhysa.exe
  C:\Windows\System\AHrhysa.exe
  2⤵
  PID:9436
- C:\Windows\System\TcXApPM.exe
  C:\Windows\System\TcXApPM.exe
  2⤵
  PID:9452
- C:\Windows\System\ljKiJzW.exe
  C:\Windows\System\ljKiJzW.exe
  2⤵
  PID:9468
- C:\Windows\System\JKiQOWk.exe
  C:\Windows\System\JKiQOWk.exe
  2⤵
  PID:9484
- C:\Windows\System\UlACGXk.exe
  C:\Windows\System\UlACGXk.exe
  2⤵
  PID:9500
- C:\Windows\System\PwRGXCL.exe
  C:\Windows\System\PwRGXCL.exe
  2⤵
  PID:9516
- C:\Windows\System\YXtfTfY.exe
  C:\Windows\System\YXtfTfY.exe
  2⤵
  PID:9532
- C:\Windows\System\TicENaI.exe
  C:\Windows\System\TicENaI.exe
  2⤵
  PID:9548
- C:\Windows\System\rhGhfhY.exe
  C:\Windows\System\rhGhfhY.exe
  2⤵
  PID:9564
- C:\Windows\System\iCCHKlm.exe
  C:\Windows\System\iCCHKlm.exe
  2⤵
  PID:9580
- C:\Windows\System\vCKXpJn.exe
  C:\Windows\System\vCKXpJn.exe
  2⤵
  PID:9596
- C:\Windows\System\lXFvBEh.exe
  C:\Windows\System\lXFvBEh.exe
  2⤵
  PID:9612
- C:\Windows\System\brzSYRP.exe
  C:\Windows\System\brzSYRP.exe
  2⤵
  PID:9628
- C:\Windows\System\lgGNPvO.exe
  C:\Windows\System\lgGNPvO.exe
  2⤵
  PID:9644
- C:\Windows\System\Svnfcbp.exe
  C:\Windows\System\Svnfcbp.exe
  2⤵
  PID:9660
- C:\Windows\System\WqZDYKw.exe
  C:\Windows\System\WqZDYKw.exe
  2⤵
  PID:9676
- C:\Windows\System\mhInbGC.exe
  C:\Windows\System\mhInbGC.exe
  2⤵
  PID:9692
- C:\Windows\System\fkyjwhd.exe
  C:\Windows\System\fkyjwhd.exe
  2⤵
  PID:9712
- C:\Windows\System\AIxpPJY.exe
  C:\Windows\System\AIxpPJY.exe
  2⤵
  PID:9728
- C:\Windows\System\BnnPEAP.exe
  C:\Windows\System\BnnPEAP.exe
  2⤵
  PID:9744
- C:\Windows\System\wbMjyXT.exe
  C:\Windows\System\wbMjyXT.exe
  2⤵
  PID:9760
- C:\Windows\System\AwWuKiR.exe
  C:\Windows\System\AwWuKiR.exe
  2⤵
  PID:9776
- C:\Windows\System\NIYuoTf.exe
  C:\Windows\System\NIYuoTf.exe
  2⤵
  PID:9792
- C:\Windows\System\osRBiVd.exe
  C:\Windows\System\osRBiVd.exe
  2⤵
  PID:9808
- C:\Windows\System\FTXtZux.exe
  C:\Windows\System\FTXtZux.exe
  2⤵
  PID:9824
- C:\Windows\System\qTKGwtY.exe
  C:\Windows\System\qTKGwtY.exe
  2⤵
  PID:9840
- C:\Windows\System\hyWjPMU.exe
  C:\Windows\System\hyWjPMU.exe
  2⤵
  PID:9856
- C:\Windows\System\zvLEnUr.exe
  C:\Windows\System\zvLEnUr.exe
  2⤵
  PID:9872
- C:\Windows\System\jwKwGUr.exe
  C:\Windows\System\jwKwGUr.exe
  2⤵
  PID:9888
- C:\Windows\System\jsWjNFn.exe
  C:\Windows\System\jsWjNFn.exe
  2⤵
  PID:9904
- C:\Windows\System\qkkcnLf.exe
  C:\Windows\System\qkkcnLf.exe
  2⤵
  PID:9920
- C:\Windows\System\BvseriD.exe
  C:\Windows\System\BvseriD.exe
  2⤵
  PID:9936
- C:\Windows\System\telcRke.exe
  C:\Windows\System\telcRke.exe
  2⤵
  PID:9952
- C:\Windows\System\XpoDYwH.exe
  C:\Windows\System\XpoDYwH.exe
  2⤵
  PID:9968
- C:\Windows\System\YGGzpOg.exe
  C:\Windows\System\YGGzpOg.exe
  2⤵
  PID:9984
- C:\Windows\System\bRWySJr.exe
  C:\Windows\System\bRWySJr.exe
  2⤵
  PID:10000
- C:\Windows\System\QKcOjcx.exe
  C:\Windows\System\QKcOjcx.exe
  2⤵
  PID:10016
- C:\Windows\System\rsSNBrj.exe
  C:\Windows\System\rsSNBrj.exe
  2⤵
  PID:10032
- C:\Windows\System\WEvDuwQ.exe
  C:\Windows\System\WEvDuwQ.exe
  2⤵
  PID:10048
- C:\Windows\System\sTsgctt.exe
  C:\Windows\System\sTsgctt.exe
  2⤵
  PID:10064
- C:\Windows\System\vjcEKHS.exe
  C:\Windows\System\vjcEKHS.exe
  2⤵
  PID:10080
- C:\Windows\System\rflkuIj.exe
  C:\Windows\System\rflkuIj.exe
  2⤵
  PID:10100
- C:\Windows\System\rfEiHTG.exe
  C:\Windows\System\rfEiHTG.exe
  2⤵
  PID:10116
- C:\Windows\System\CVkwelc.exe
  C:\Windows\System\CVkwelc.exe
  2⤵
  PID:10132
- C:\Windows\System\EnaiJJX.exe
  C:\Windows\System\EnaiJJX.exe
  2⤵
  PID:10148
- C:\Windows\System\hJXQviV.exe
  C:\Windows\System\hJXQviV.exe
  2⤵
  PID:10164
- C:\Windows\System\WFrXrwb.exe
  C:\Windows\System\WFrXrwb.exe
  2⤵
  PID:10180
- C:\Windows\System\lTAmcRQ.exe
  C:\Windows\System\lTAmcRQ.exe
  2⤵
  PID:10196
- C:\Windows\System\dhxpqJl.exe
  C:\Windows\System\dhxpqJl.exe
  2⤵
  PID:10212
- C:\Windows\System\RfzKYEy.exe
  C:\Windows\System\RfzKYEy.exe
  2⤵
  PID:10228
- C:\Windows\System\vRfSVsM.exe
  C:\Windows\System\vRfSVsM.exe
  2⤵
  PID:8208
- C:\Windows\System\LIoYapx.exe
  C:\Windows\System\LIoYapx.exe
  2⤵
  PID:9108
- C:\Windows\System\aoAbrWB.exe
  C:\Windows\System\aoAbrWB.exe
  2⤵
  PID:8664
- C:\Windows\System\WRWacLo.exe
  C:\Windows\System\WRWacLo.exe
  2⤵
  PID:9256
- C:\Windows\System\myfvcuN.exe
  C:\Windows\System\myfvcuN.exe
  2⤵
  PID:8464
- C:\Windows\System\zszISVo.exe
  C:\Windows\System\zszISVo.exe
  2⤵
  PID:8888
- C:\Windows\System\jiVaclj.exe
  C:\Windows\System\jiVaclj.exe
  2⤵
  PID:9272
- C:\Windows\System\SgCjBlH.exe
  C:\Windows\System\SgCjBlH.exe
  2⤵
  PID:9104
- C:\Windows\System\qzCpkgw.exe
  C:\Windows\System\qzCpkgw.exe
  2⤵
  PID:9316
- C:\Windows\System\rfKmNhW.exe
  C:\Windows\System\rfKmNhW.exe
  2⤵
  PID:9380
- C:\Windows\System\dOIeOXD.exe
  C:\Windows\System\dOIeOXD.exe
  2⤵
  PID:9400
- C:\Windows\System\EExuAcf.exe
  C:\Windows\System\EExuAcf.exe
  2⤵
  PID:9412
- C:\Windows\System\qbPZxbc.exe
  C:\Windows\System\qbPZxbc.exe
  2⤵
  PID:9432
- C:\Windows\System\JUWgixy.exe
  C:\Windows\System\JUWgixy.exe
  2⤵
  PID:9460
- C:\Windows\System\IpbkZwV.exe
  C:\Windows\System\IpbkZwV.exe
  2⤵
  PID:9528
- C:\Windows\System\RinBZiG.exe
  C:\Windows\System\RinBZiG.exe
  2⤵
  PID:9508
- C:\Windows\System\hqaajSa.exe
  C:\Windows\System\hqaajSa.exe
  2⤵
  PID:9576
- C:\Windows\System\aLapxAh.exe
  C:\Windows\System\aLapxAh.exe
  2⤵
  PID:9640
- C:\Windows\System\mirFTQB.exe
  C:\Windows\System\mirFTQB.exe
  2⤵
  PID:9560
- C:\Windows\System\fxfhcoO.exe
  C:\Windows\System\fxfhcoO.exe
  2⤵
  PID:9652
- C:\Windows\System\ScsqgPI.exe
  C:\Windows\System\ScsqgPI.exe
  2⤵
  PID:9708
- C:\Windows\System\aqlhEph.exe
  C:\Windows\System\aqlhEph.exe
  2⤵
  PID:9740
- C:\Windows\System\fpFrBmi.exe
  C:\Windows\System\fpFrBmi.exe
  2⤵
  PID:9784
- C:\Windows\System\sEbFNVd.exe
  C:\Windows\System\sEbFNVd.exe
  2⤵
  PID:9724
- C:\Windows\System\eyvUFbZ.exe
  C:\Windows\System\eyvUFbZ.exe
  2⤵
  PID:9836
- C:\Windows\System\cvFaoNq.exe
  C:\Windows\System\cvFaoNq.exe
  2⤵
  PID:9848
- C:\Windows\System\pZuNTFl.exe
  C:\Windows\System\pZuNTFl.exe
  2⤵
  PID:9900
- C:\Windows\System\crVAFmP.exe
  C:\Windows\System\crVAFmP.exe
  2⤵
  PID:9964
- C:\Windows\System\UPefSDi.exe
  C:\Windows\System\UPefSDi.exe
  2⤵
  PID:10028
- C:\Windows\System\xKPilbp.exe
  C:\Windows\System\xKPilbp.exe
  2⤵
  PID:10060
- C:\Windows\System\WfKOoUs.exe
  C:\Windows\System\WfKOoUs.exe
  2⤵
  PID:9884
- C:\Windows\System\XauPovc.exe
  C:\Windows\System\XauPovc.exe
  2⤵
  PID:9948
- C:\Windows\System\PeGflhV.exe
  C:\Windows\System\PeGflhV.exe
  2⤵
  PID:10076
- C:\Windows\System\EBellhm.exe
  C:\Windows\System\EBellhm.exe
  2⤵
  PID:10108
- C:\Windows\System\XmNMslj.exe
  C:\Windows\System\XmNMslj.exe
  2⤵
  PID:10156
- C:\Windows\System\vBTPdNY.exe
  C:\Windows\System\vBTPdNY.exe
  2⤵
  PID:10188
- C:\Windows\System\qpTxoVk.exe
  C:\Windows\System\qpTxoVk.exe
  2⤵
  PID:6984
- C:\Windows\System\elLIxrf.exe
  C:\Windows\System\elLIxrf.exe
  2⤵
  PID:8544
- C:\Windows\System\AvWWbsp.exe
  C:\Windows\System\AvWWbsp.exe
  2⤵
  PID:7144
- C:\Windows\System\LCXqXIs.exe
  C:\Windows\System\LCXqXIs.exe
  2⤵
  PID:10208
- C:\Windows\System\kdpEPHX.exe
  C:\Windows\System\kdpEPHX.exe
  2⤵
  PID:9336
- C:\Windows\System\eqRTXEC.exe
  C:\Windows\System\eqRTXEC.exe
  2⤵
  PID:6832
- C:\Windows\System\pUujlMf.exe
  C:\Windows\System\pUujlMf.exe
  2⤵
  PID:8528
- C:\Windows\System\VHCpnpx.exe
  C:\Windows\System\VHCpnpx.exe
  2⤵
  PID:9364
- C:\Windows\System\nVwdRjc.exe
  C:\Windows\System\nVwdRjc.exe
  2⤵
  PID:9524
- C:\Windows\System\DnWxcdN.exe
  C:\Windows\System\DnWxcdN.exe
  2⤵
  PID:9620
- C:\Windows\System\DQiFkDs.exe
  C:\Windows\System\DQiFkDs.exe
  2⤵
  PID:9624
- C:\Windows\System\wtFedat.exe
  C:\Windows\System\wtFedat.exe
  2⤵
  PID:9804
- C:\Windows\System\YsFeJpg.exe
  C:\Windows\System\YsFeJpg.exe
  2⤵
  PID:9756
- C:\Windows\System\wJhmrLD.exe
  C:\Windows\System\wJhmrLD.exe
  2⤵
  PID:9772
- C:\Windows\System\qZxIMVd.exe
  C:\Windows\System\qZxIMVd.exe
  2⤵
  PID:9980
- C:\Windows\System\VaJORwQ.exe
  C:\Windows\System\VaJORwQ.exe
  2⤵
  PID:10024
- C:\Windows\System\wXUVAoI.exe
  C:\Windows\System\wXUVAoI.exe
  2⤵
  PID:5820
- C:\Windows\System\oTRptZT.exe
  C:\Windows\System\oTRptZT.exe
  2⤵
  PID:9224
- C:\Windows\System\DzOCZQF.exe
  C:\Windows\System\DzOCZQF.exe
  2⤵
  PID:9304
- C:\Windows\System\nZRjXIn.exe
  C:\Windows\System\nZRjXIn.exe
  2⤵
  PID:9512
- C:\Windows\System\vUCJebd.exe
  C:\Windows\System\vUCJebd.exe
  2⤵
  PID:9880
- C:\Windows\System\TdplEFP.exe
  C:\Windows\System\TdplEFP.exe
  2⤵
  PID:10012
- C:\Windows\System\nFRJCOG.exe
  C:\Windows\System\nFRJCOG.exe
  2⤵
  PID:10224
- C:\Windows\System\MAteCCR.exe
  C:\Windows\System\MAteCCR.exe
  2⤵
  PID:9288
- C:\Windows\System\ERBTIJJ.exe
  C:\Windows\System\ERBTIJJ.exe
  2⤵
  PID:9736
- C:\Windows\System\kpTTacs.exe
  C:\Windows\System\kpTTacs.exe
  2⤵
  PID:9896
- C:\Windows\System\iXTeBZs.exe
  C:\Windows\System\iXTeBZs.exe
  2⤵
  PID:9492
- C:\Windows\System\xbdiIIT.exe
  C:\Windows\System\xbdiIIT.exe
  2⤵
  PID:9352
- C:\Windows\System\jueIxgV.exe
  C:\Windows\System\jueIxgV.exe
  2⤵
  PID:10124
- C:\Windows\System\hBdpJHB.exe
  C:\Windows\System\hBdpJHB.exe
  2⤵
  PID:8376
- C:\Windows\System\IRLvZPY.exe
  C:\Windows\System\IRLvZPY.exe
  2⤵
  PID:10220
- C:\Windows\System\OEYMGox.exe
  C:\Windows\System\OEYMGox.exe
  2⤵
  PID:9556
- C:\Windows\System\mFoUYQo.exe
  C:\Windows\System\mFoUYQo.exe
  2⤵
  PID:9348
- C:\Windows\System\basvzsf.exe
  C:\Windows\System\basvzsf.exe
  2⤵
  PID:9752
- C:\Windows\System\mMrvUDG.exe
  C:\Windows\System\mMrvUDG.exe
  2⤵
  PID:10128
- C:\Windows\System\BvTAKBg.exe
  C:\Windows\System\BvTAKBg.exe
  2⤵
  PID:10176
- C:\Windows\System\rIBHgud.exe
  C:\Windows\System\rIBHgud.exe
  2⤵
  PID:10252
- C:\Windows\System\ETIThbP.exe
  C:\Windows\System\ETIThbP.exe
  2⤵
  PID:10268
- C:\Windows\System\oxkSvHr.exe
  C:\Windows\System\oxkSvHr.exe
  2⤵
  PID:10284
- C:\Windows\System\itonjJN.exe
  C:\Windows\System\itonjJN.exe
  2⤵
  PID:10300
- C:\Windows\System\gAiKWAr.exe
  C:\Windows\System\gAiKWAr.exe
  2⤵
  PID:10316
- C:\Windows\System\SWdyfKX.exe
  C:\Windows\System\SWdyfKX.exe
  2⤵
  PID:10332
- C:\Windows\System\vxsvsdx.exe
  C:\Windows\System\vxsvsdx.exe
  2⤵
  PID:10348
- C:\Windows\System\dkrfTHe.exe
  C:\Windows\System\dkrfTHe.exe
  2⤵
  PID:10364
- C:\Windows\System\SbTlxdK.exe
  C:\Windows\System\SbTlxdK.exe
  2⤵
  PID:10380
- C:\Windows\System\AKXxISB.exe
  C:\Windows\System\AKXxISB.exe
  2⤵
  PID:10396
- C:\Windows\System\vzVBsvE.exe
  C:\Windows\System\vzVBsvE.exe
  2⤵
  PID:10412
- C:\Windows\System\MPWoHvM.exe
  C:\Windows\System\MPWoHvM.exe
  2⤵
  PID:10428
- C:\Windows\System\bpzSGmm.exe
  C:\Windows\System\bpzSGmm.exe
  2⤵
  PID:10444
- C:\Windows\System\DXqcziT.exe
  C:\Windows\System\DXqcziT.exe
  2⤵
  PID:10460
- C:\Windows\System\nsJNmXB.exe
  C:\Windows\System\nsJNmXB.exe
  2⤵
  PID:10476
- C:\Windows\System\xiXJgjS.exe
  C:\Windows\System\xiXJgjS.exe
  2⤵
  PID:10492
- C:\Windows\System\hNJAvgy.exe
  C:\Windows\System\hNJAvgy.exe
  2⤵
  PID:10508
- C:\Windows\System\jEfNajT.exe
  C:\Windows\System\jEfNajT.exe
  2⤵
  PID:10524
- C:\Windows\System\JTloCnd.exe
  C:\Windows\System\JTloCnd.exe
  2⤵
  PID:10540
- C:\Windows\System\PlOehpE.exe
  C:\Windows\System\PlOehpE.exe
  2⤵
  PID:10556
- C:\Windows\System\kiYMVCI.exe
  C:\Windows\System\kiYMVCI.exe
  2⤵
  PID:10572
- C:\Windows\System\CCsqvJd.exe
  C:\Windows\System\CCsqvJd.exe
  2⤵
  PID:10588
- C:\Windows\System\ietVDHp.exe
  C:\Windows\System\ietVDHp.exe
  2⤵
  PID:10604
- C:\Windows\System\LhxekKU.exe
  C:\Windows\System\LhxekKU.exe
  2⤵
  PID:10624
- C:\Windows\System\HFwpmVa.exe
  C:\Windows\System\HFwpmVa.exe
  2⤵
  PID:10640
- C:\Windows\System\DYZyteZ.exe
  C:\Windows\System\DYZyteZ.exe
  2⤵
  PID:10656
- C:\Windows\System\pZdLuFh.exe
  C:\Windows\System\pZdLuFh.exe
  2⤵
  PID:10672
- C:\Windows\System\aBqQbDH.exe
  C:\Windows\System\aBqQbDH.exe
  2⤵
  PID:10688
- C:\Windows\System\pSpNFCa.exe
  C:\Windows\System\pSpNFCa.exe
  2⤵
  PID:10704
- C:\Windows\System\PLhzpgv.exe
  C:\Windows\System\PLhzpgv.exe
  2⤵
  PID:10720
- C:\Windows\System\DgMybKE.exe
  C:\Windows\System\DgMybKE.exe
  2⤵
  PID:10736
- C:\Windows\System\AFRDbSO.exe
  C:\Windows\System\AFRDbSO.exe
  2⤵
  PID:10752
- C:\Windows\System\DvhLenW.exe
  C:\Windows\System\DvhLenW.exe
  2⤵
  PID:10768
- C:\Windows\System\afQOCkd.exe
  C:\Windows\System\afQOCkd.exe
  2⤵
  PID:10784
- C:\Windows\System\ZfiEAFc.exe
  C:\Windows\System\ZfiEAFc.exe
  2⤵
  PID:10800
- C:\Windows\System\gbLFbai.exe
  C:\Windows\System\gbLFbai.exe
  2⤵
  PID:10816
- C:\Windows\System\nmbrsls.exe
  C:\Windows\System\nmbrsls.exe
  2⤵
  PID:10832
- C:\Windows\System\TAoCJWx.exe
  C:\Windows\System\TAoCJWx.exe
  2⤵
  PID:10848
- C:\Windows\System\xNxZJqp.exe
  C:\Windows\System\xNxZJqp.exe
  2⤵
  PID:10864
- C:\Windows\System\QGffmGH.exe
  C:\Windows\System\QGffmGH.exe
  2⤵
  PID:10880
- C:\Windows\System\hMplMxE.exe
  C:\Windows\System\hMplMxE.exe
  2⤵
  PID:10896
- C:\Windows\System\anFifxD.exe
  C:\Windows\System\anFifxD.exe
  2⤵
  PID:10912
- C:\Windows\System\aEpSOTz.exe
  C:\Windows\System\aEpSOTz.exe
  2⤵
  PID:10928
- C:\Windows\System\AJdqXEg.exe
  C:\Windows\System\AJdqXEg.exe
  2⤵
  PID:10944
- C:\Windows\System\oiAbWVB.exe
  C:\Windows\System\oiAbWVB.exe
  2⤵
  PID:10960
- C:\Windows\System\uoRUzwC.exe
  C:\Windows\System\uoRUzwC.exe
  2⤵
  PID:10976
- C:\Windows\System\XJaMzNz.exe
  C:\Windows\System\XJaMzNz.exe
  2⤵
  PID:10992
- C:\Windows\System\pfBbhbB.exe
  C:\Windows\System\pfBbhbB.exe
  2⤵
  PID:11008
- C:\Windows\System\xIJGnGg.exe
  C:\Windows\System\xIJGnGg.exe
  2⤵
  PID:11024
- C:\Windows\System\BkEWidS.exe
  C:\Windows\System\BkEWidS.exe
  2⤵
  PID:11040
- C:\Windows\System\gjzZbFi.exe
  C:\Windows\System\gjzZbFi.exe
  2⤵
  PID:11056
- C:\Windows\System\sdlMotO.exe
  C:\Windows\System\sdlMotO.exe
  2⤵
  PID:11072
- C:\Windows\System\qQDtJdb.exe
  C:\Windows\System\qQDtJdb.exe
  2⤵
  PID:11088
- C:\Windows\System\MYOukRr.exe
  C:\Windows\System\MYOukRr.exe
  2⤵
  PID:11104
- C:\Windows\System\JgzGvaD.exe
  C:\Windows\System\JgzGvaD.exe
  2⤵
  PID:11120
- C:\Windows\System\MjyGUHi.exe
  C:\Windows\System\MjyGUHi.exe
  2⤵
  PID:11136
- C:\Windows\System\blbBwUa.exe
  C:\Windows\System\blbBwUa.exe
  2⤵
  PID:11152
- C:\Windows\System\BvzyWsz.exe
  C:\Windows\System\BvzyWsz.exe
  2⤵
  PID:11168
- C:\Windows\System\hyZkAeU.exe
  C:\Windows\System\hyZkAeU.exe
  2⤵
  PID:11184
- C:\Windows\System\UlUiYAJ.exe
  C:\Windows\System\UlUiYAJ.exe
  2⤵
  PID:11200
- C:\Windows\System\ocwjFwO.exe
  C:\Windows\System\ocwjFwO.exe
  2⤵
  PID:11216
- C:\Windows\System\BkWQNCo.exe
  C:\Windows\System\BkWQNCo.exe
  2⤵
  PID:11232
- C:\Windows\System\edvHltt.exe
  C:\Windows\System\edvHltt.exe
  2⤵
  PID:11248
- C:\Windows\System\XWEZYDL.exe
  C:\Windows\System\XWEZYDL.exe
  2⤵
  PID:9832
- C:\Windows\System\sPeoOrC.exe
  C:\Windows\System\sPeoOrC.exe
  2⤵
  PID:10292
- C:\Windows\System\CywTrVj.exe
  C:\Windows\System\CywTrVj.exe
  2⤵
  PID:9932
- C:\Windows\System\VpXbcCB.exe
  C:\Windows\System\VpXbcCB.exe
  2⤵
  PID:10328
- C:\Windows\System\ppMXste.exe
  C:\Windows\System\ppMXste.exe
  2⤵
  PID:10392
- C:\Windows\System\xFhdgPD.exe
  C:\Windows\System\xFhdgPD.exe
  2⤵
  PID:10312
- C:\Windows\System\VUphBOy.exe
  C:\Windows\System\VUphBOy.exe
  2⤵
  PID:10456
- C:\Windows\System\srUIdqw.exe
  C:\Windows\System\srUIdqw.exe
  2⤵
  PID:10520
- C:\Windows\System\lSWSIKI.exe
  C:\Windows\System\lSWSIKI.exe
  2⤵
  PID:10580
- C:\Windows\System\bvvWFoS.exe
  C:\Windows\System\bvvWFoS.exe
  2⤵
  PID:10472
- C:\Windows\System\nvOtAZo.exe
  C:\Windows\System\nvOtAZo.exe
  2⤵
  PID:10372
- C:\Windows\System\DMHryxB.exe
  C:\Windows\System\DMHryxB.exe
  2⤵
  PID:10596
- C:\Windows\System\FUjtxBD.exe
  C:\Windows\System\FUjtxBD.exe
  2⤵
  PID:10500
- C:\Windows\System\TmJbEmG.exe
  C:\Windows\System\TmJbEmG.exe
  2⤵
  PID:10620
- C:\Windows\System\TDqjsGL.exe
  C:\Windows\System\TDqjsGL.exe
  2⤵
  PID:10684
- C:\Windows\System\rxMChMj.exe
  C:\Windows\System\rxMChMj.exe
  2⤵
  PID:10748
- C:\Windows\System\gYvSMLo.exe
  C:\Windows\System\gYvSMLo.exe
  2⤵
  PID:10812
- C:\Windows\System\kpqzPGr.exe
  C:\Windows\System\kpqzPGr.exe
  2⤵
  PID:10876
- C:\Windows\System\YEjvDBH.exe
  C:\Windows\System\YEjvDBH.exe
  2⤵
  PID:10940
- C:\Windows\System\sSDFmvC.exe
  C:\Windows\System\sSDFmvC.exe
  2⤵
  PID:11004
- C:\Windows\System\TpoXMZQ.exe
  C:\Windows\System\TpoXMZQ.exe
  2⤵
  PID:10728
- C:\Windows\System\KiSudPT.exe
  C:\Windows\System\KiSudPT.exe
  2⤵
  PID:10668
- C:\Windows\System\KzBriNq.exe
  C:\Windows\System\KzBriNq.exe
  2⤵
  PID:11020
- C:\Windows\System\yISKQWK.exe
  C:\Windows\System\yISKQWK.exe
  2⤵
  PID:10920
- C:\Windows\System\BTEVxXC.exe
  C:\Windows\System\BTEVxXC.exe
  2⤵
  PID:10956
- C:\Windows\System\gLrpGtj.exe
  C:\Windows\System\gLrpGtj.exe
  2⤵
  PID:10792
- C:\Windows\System\qyfiDrY.exe
  C:\Windows\System\qyfiDrY.exe
  2⤵
  PID:10984
- C:\Windows\System\VJZWJLk.exe
  C:\Windows\System\VJZWJLk.exe
  2⤵
  PID:11068
- C:\Windows\System\ZbercaB.exe
  C:\Windows\System\ZbercaB.exe
  2⤵
  PID:11100
- C:\Windows\System\PQTaaWK.exe
  C:\Windows\System\PQTaaWK.exe
  2⤵
  PID:11112
- C:\Windows\System\uxGYBjV.exe
  C:\Windows\System\uxGYBjV.exe
  2⤵
  PID:11164
- C:\Windows\System\PguemsH.exe
  C:\Windows\System\PguemsH.exe
  2⤵
  PID:11224
- C:\Windows\System\fVNRvhu.exe
  C:\Windows\System\fVNRvhu.exe
  2⤵
  PID:11260
- C:\Windows\System\vLWWvaB.exe
  C:\Windows\System\vLWWvaB.exe
  2⤵
  PID:10388
- C:\Windows\System\CixYooX.exe
  C:\Windows\System\CixYooX.exe
  2⤵
  PID:10552
- C:\Windows\System\UWZGUJK.exe
  C:\Windows\System\UWZGUJK.exe
  2⤵
  PID:10616
- C:\Windows\System\HiWlmST.exe
  C:\Windows\System\HiWlmST.exe
  2⤵
  PID:10248
- C:\Windows\System\ZDWusmV.exe
  C:\Windows\System\ZDWusmV.exe
  2⤵
  PID:10264
- C:\Windows\System\esNHfpq.exe
  C:\Windows\System\esNHfpq.exe
  2⤵
  PID:10516
- C:\Windows\System\AhdsCFZ.exe
  C:\Windows\System\AhdsCFZ.exe
  2⤵
  PID:10468
- C:\Windows\System\XioUhEE.exe
  C:\Windows\System\XioUhEE.exe
  2⤵
  PID:10780
- C:\Windows\System\bLzKlUf.exe
  C:\Windows\System\bLzKlUf.exe
  2⤵
  PID:10716
- C:\Windows\System\JQzxdoK.exe
  C:\Windows\System\JQzxdoK.exe
  2⤵
  PID:10844
- C:\Windows\System\ZzpCIcv.exe
  C:\Windows\System\ZzpCIcv.exe
  2⤵
  PID:11036
- C:\Windows\System\YHrZEVY.exe
  C:\Windows\System\YHrZEVY.exe
  2⤵
  PID:10636
- C:\Windows\System\rBsDMNv.exe
  C:\Windows\System\rBsDMNv.exe
  2⤵
  PID:10764
- C:\Windows\System\ohpcaon.exe
  C:\Windows\System\ohpcaon.exe
  2⤵
  PID:10952
- C:\Windows\System\ABXUMmJ.exe
  C:\Windows\System\ABXUMmJ.exe
  2⤵
  PID:11080
- C:\Windows\System\ildYPEY.exe
  C:\Windows\System\ildYPEY.exe
  2⤵
  PID:11176
- C:\Windows\System\PBuqfqH.exe
  C:\Windows\System\PBuqfqH.exe
  2⤵
  PID:11192
- C:\Windows\System\ExwNyNU.exe
  C:\Windows\System\ExwNyNU.exe
  2⤵
  PID:11240
- C:\Windows\System\BupGxGw.exe
  C:\Windows\System\BupGxGw.exe
  2⤵
  PID:10652
- C:\Windows\System\lQOYIUC.exe
  C:\Windows\System\lQOYIUC.exe
  2⤵
  PID:10340
- C:\Windows\System\JMpTDzs.exe
  C:\Windows\System\JMpTDzs.exe
  2⤵
  PID:9700
- C:\Windows\System\YetenRm.exe
  C:\Windows\System\YetenRm.exe
  2⤵
  PID:10972
- C:\Windows\System\oyNtobW.exe
  C:\Windows\System\oyNtobW.exe
  2⤵
  PID:10700
- C:\Windows\System\FIDkeIX.exe
  C:\Windows\System\FIDkeIX.exe
  2⤵
  PID:10892
- C:\Windows\System\kedNtdC.exe
  C:\Windows\System\kedNtdC.exe
  2⤵
  PID:10612
- C:\Windows\System\ckAFupW.exe
  C:\Windows\System\ckAFupW.exe
  2⤵
  PID:10828
- C:\Windows\System\IUHOXXi.exe
  C:\Windows\System\IUHOXXi.exe
  2⤵
  PID:11132
- C:\Windows\System\RkRnkNm.exe
  C:\Windows\System\RkRnkNm.exe
  2⤵
  PID:10888
- C:\Windows\System\OUkDnmp.exe
  C:\Windows\System\OUkDnmp.exe
  2⤵
  PID:10308
- C:\Windows\System\SBztgSS.exe
  C:\Windows\System\SBztgSS.exe
  2⤵
  PID:10856
- C:\Windows\System\ewpmyDU.exe
  C:\Windows\System\ewpmyDU.exe
  2⤵
  PID:10808
- C:\Windows\System\XtZUHsk.exe
  C:\Windows\System\XtZUHsk.exe
  2⤵
  PID:11272
- C:\Windows\System\PshpGFf.exe
  C:\Windows\System\PshpGFf.exe
  2⤵
  PID:11288
- C:\Windows\System\FamnkXU.exe
  C:\Windows\System\FamnkXU.exe
  2⤵
  PID:11308
- C:\Windows\System\NgGJbOw.exe
  C:\Windows\System\NgGJbOw.exe
  2⤵
  PID:11324
- C:\Windows\System\tSWTgSv.exe
  C:\Windows\System\tSWTgSv.exe
  2⤵
  PID:11340
- C:\Windows\System\tuwRSot.exe
  C:\Windows\System\tuwRSot.exe
  2⤵
  PID:11360
- C:\Windows\System\zXPpXMO.exe
  C:\Windows\System\zXPpXMO.exe
  2⤵
  PID:11376
- C:\Windows\System\trVJcvi.exe
  C:\Windows\System\trVJcvi.exe
  2⤵
  PID:11392
- C:\Windows\System\PFJmbzf.exe
  C:\Windows\System\PFJmbzf.exe
  2⤵
  PID:11408
- C:\Windows\System\tIUDkUJ.exe
  C:\Windows\System\tIUDkUJ.exe
  2⤵
  PID:11424
- C:\Windows\System\SujPEXo.exe
  C:\Windows\System\SujPEXo.exe
  2⤵
  PID:11440
- C:\Windows\System\pdhZkNE.exe
  C:\Windows\System\pdhZkNE.exe
  2⤵
  PID:11456
- C:\Windows\System\TOOWSQx.exe
  C:\Windows\System\TOOWSQx.exe
  2⤵
  PID:11472
- C:\Windows\System\JfjprNT.exe
  C:\Windows\System\JfjprNT.exe
  2⤵
  PID:11488
- C:\Windows\System\RgGAVbt.exe
  C:\Windows\System\RgGAVbt.exe
  2⤵
  PID:11504
- C:\Windows\System\ZFLeTtx.exe
  C:\Windows\System\ZFLeTtx.exe
  2⤵
  PID:11520
- C:\Windows\System\WGTDRZQ.exe
  C:\Windows\System\WGTDRZQ.exe
  2⤵
  PID:11536
- C:\Windows\System\pAXVbnH.exe
  C:\Windows\System\pAXVbnH.exe
  2⤵
  PID:11552
- C:\Windows\System\tyYQPvD.exe
  C:\Windows\System\tyYQPvD.exe
  2⤵
  PID:11568
- C:\Windows\System\WAxaypZ.exe
  C:\Windows\System\WAxaypZ.exe
  2⤵
  PID:11584
- C:\Windows\System\cfgHOIr.exe
  C:\Windows\System\cfgHOIr.exe
  2⤵
  PID:11600
- C:\Windows\System\LiANtht.exe
  C:\Windows\System\LiANtht.exe
  2⤵
  PID:11616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BOSLlQZ.exe

Filesize
2.3MB

MD5
0fa2fe7f114f0cdba3eaa7fdfbe07c68

SHA1
a44124afb6147d698d6aab29a232d522bea94a90

SHA256
80c0c1063d858f9c30328c269d0e050c666ac4e88a2ae2d2f6fe5bf72b160517

SHA512
5cb45ce626255cb53b3f8a7eed9c806b981a609de9c87992fd8ca1158292c1cc3e6d7d0e56c8648a0543bc57d72120e74b6c51c4b24b6770725b969e3875030f

Download Submit
C:\Windows\system\BlWUAiT.exe

Filesize
2.3MB

MD5
ed8902f5eafaa47b0c1f4cec01222f3d

SHA1
4f0736cbd74bb3a8fa0a1682c7717cb7ac67726a

SHA256
24ff48f76455e6c44711c5ae821b60684a0961972d3ce3011cf29f459713a891

SHA512
e61a092d5e2cf01c7adacf0852da866984c5d0cd3310cff9867b1bfdb26db5801192cc26999b67a93d2b205f16c1ea0826cc340dde23583b1f96128a3845317e

Download Submit
C:\Windows\system\DmSoQbT.exe

Filesize
2.3MB

MD5
cd5602a989d2bce74ed448f613b663b9

SHA1
a71502c3e95962d39cd264067187edaf01fa291a

SHA256
d89bb70e7a61e23e992b8c9ebbb1559e3c12421434cc01a82b7047dd129fd594

SHA512
302139866072ab2834687412339c36ac81bfbf539b3155735578e9b8779692b999dccec64a9630705fd2a44d264dd5afd2e135d3a81bf05fbc0ed3a0db840fdb

Download Submit
C:\Windows\system\EVKGRqI.exe

Filesize
2.3MB

MD5
57bc610cf2dd027f1632eb5ae22c3ce5

SHA1
71b7fb6a825e69f39036fe7fd30b091c35788df3

SHA256
eb157c169c03a9126cc9491163a63458c86b07ae417354f14ab5c93de5df26d9

SHA512
6c77d8537509860bfb28e9901e515fc30453a8e3a054f60aa09c901a5ba10d8b3fdb37850844a280db4db19469d72ebb3b5e0c129ca7ac9ba304ea65e8ac4f11

Download Submit
C:\Windows\system\IYzkQtO.exe

Filesize
2.3MB

MD5
5142cae0420dd9e306dfadbc31e209b7

SHA1
001dac11a859179f0d1c47141a90e366920af0b2

SHA256
5e7c47dccf143aaa4bdd0842d0a458badccd0fa851b9cbb3cebcf013b09dab22

SHA512
d62a968ba9ed99f53e0757258d6fc4339213f6326441d60a5febf4089e1b90d388866481c1b66bed2218f986027dd3d6eaed381348144549e7884e468ae2ac82

Download Submit
C:\Windows\system\KQJgSgq.exe

Filesize
2.3MB

MD5
6b5aa82ab81e9143f9402ca80a21a801

SHA1
6a93d10557dab85048117d07a6b53a604a7f502f

SHA256
72054c1fe90a69b0260d113f231cd40574a7ca95094182687b0a2bf5aed504f9

SHA512
9218ad3e0f7780600841dea371c297e3531a03a32b6e107409da15b2e230bfe36b11af4942fb9abe3ad459e34718bfba04057bb7bb4587803e17297f4620d90e

Download Submit
C:\Windows\system\PpmKnpb.exe

Filesize
2.3MB

MD5
84328353339ad2549a66f2e8ad055249

SHA1
b7a41b13d2b99d0e77d82f7ba97846f9f6a7646e

SHA256
ad7b2758702b31de4b6e1349935fb8453a1f7ed43bf34390f0583eec5d621b85

SHA512
1143f88642a94811b3bc91477125a0f022f8dd1d6d897519ec33e90940b98c5b1f3c3296d5b9feccdd4a0f00e763ebd490756121a2b27952370b4c027fdcd426

Download Submit
C:\Windows\system\SLmjsoM.exe

Filesize
2.3MB

MD5
550d447c8cdcd5e875b2316f6b7f5641

SHA1
f6c5f708f509dec371156032ba00b7094b79afea

SHA256
9d7e1a64929d34915c03e87b521238850f372f40793ac1fc6fe0c5b0e1086a70

SHA512
94392e3efa91ac024c6c7f832612f8ca6675e2467b0f4ec4f3dbbd35b4675eb2e44f88764936f7c71f837e36cefb7b8748d92eec3193bd328a320127e7f044d0

Download Submit
C:\Windows\system\XwCoWaK.exe

Filesize
2.3MB

MD5
dd94aa79fcfdcae0aff3e34a6f6fea04

SHA1
91d802767667a5e3479065d2fdda39e7e967386f

SHA256
882875b6e7688a1057ffcddf3917cdcada995538f4a29ce76db91e2017310aea

SHA512
665db1150222c7bbc151a530ae59cc89b9519426ac8acc4e7dff810af5129ace4c0e427e54880c8e60484e13b2332cdbfe09fee5ebd8d2f0b39fafc2f9eeb4e9

Download Submit
C:\Windows\system\adapgsI.exe

Filesize
2.3MB

MD5
b05c2c2304b33de3f86ba1ba380c37ff

SHA1
468e6030b9df8dfb0d37a1b6d578110d4d0f99ff

SHA256
5bb92b6579158902a1180370b7278ce356d523253a7796f7e1d8027c20e10b49

SHA512
c602099a2c49b31870a7faf85e71fe223b7bfca081daba841cb4f9fbbb04f9dd82ac1774c4b3d013217668afba9ee8620ca5ec9338ec75f4217caba4b32cb5f6

Download Submit
C:\Windows\system\cxekULr.exe

Filesize
2.3MB

MD5
65af5bb9ba99bf7ae8779074d9fe2ab0

SHA1
4c12a0f6d0402cafbd01f027f5c9b8c327c61af8

SHA256
914e8af7d43fdc3086ab899fdffc28b94f3514d7cb86f858dd04ee9e123371b9

SHA512
e968f8d9cb604d7c900d820a62436fdd03e14b8927ad4745d9c33a6053bef9a0ffc178fa36ae3045950b59eb8814674666a0c0ed8384d2b8a09535a7f798bb0d

Download Submit
C:\Windows\system\hERzGWq.exe

Filesize
2.3MB

MD5
be9f4913e28f08e4ddf4faa3c591bafa

SHA1
71b0b0f914af17463f4a39a787c4956b4b189869

SHA256
9653d7fd160e978f5fdc281a3504855d11e944271061c16f63a314c3b84dc9c4

SHA512
bd2bb96fe6d42bd860f942cf8b18735e9a50f53e5600e14a920d2c132e444d56ce8bb613ac2723f8138a162f44bcf0881ea02c2fc7b62ed72832bb28c7d34274

Download Submit
C:\Windows\system\iQHuLSz.exe

Filesize
2.3MB

MD5
43895fd755eff7de2e95e63db1abe6cd

SHA1
05e6d60ed7b4a36e27b6af6d5c279d089040f3d5

SHA256
33fac861ef05f6f58769a43c71209c0169e82e62966f2e0f0a0ed3f7153529ab

SHA512
1564a22d35f7f4b2a732bb3917e38085faca82e83a4beb9b18cf902105d38381b4fff0fad5b25d2072dad437a20605da7f3d4ad12e852130031d8f5f1fbdcd62

Download Submit
C:\Windows\system\kIYQnVl.exe

Filesize
2.3MB

MD5
3d7e4e54650b73145bee0e60d2a1faa0

SHA1
f868f4973f0eaf9f5963f60ad620b6b648c15000

SHA256
bf8048fb1f3b8f21036fc3440c934a15cdd417f71576ccccb01c4261c5539117

SHA512
c0dd66b88539f61b129cf16b046b3e10cc025db133781a6413d0e3004132efc2a561eb276154b388b58b3fb0852acd806b376bba4cec0a6b0f6f10c27f5d6911

Download Submit
C:\Windows\system\liiWluX.exe

Filesize
2.3MB

MD5
92a508c17c106194cecf412265bea3c9

SHA1
3f2f1b3dac248865eadc7c057b5d0de24384e9b8

SHA256
a98ab5c0aa5c5c0b71ea39fabd3019b8b8d8a6d24335683139f57166e6ab3203

SHA512
16327b249bc61a2f0d8c31fdda67dd5e648c319afaebfe8dc6ef0ea4533e2ee206b7c22e37d87fe0031f27f7c62094b8f1480e71dca1d30509c17cc798130e34

Download Submit
C:\Windows\system\mkXhnZB.exe

Filesize
2.3MB

MD5
4e72c008b855a95564cc8fd6d1f21c5b

SHA1
47802b86286cd33909dddb621d791937c56216f7

SHA256
16174cffd78c2d74496b1cde3488168f16580887665491c62046a6297b6a2249

SHA512
45a7b6439a4bd2ccab693e13cc825df4d8ad2781f05f231f98731252248414f51f8997a889fb1f50c07b44195e6ada3f1660ed0f6846bc6dd52ec0d821bdfc4b

Download Submit
C:\Windows\system\nrcJIog.exe

Filesize
8B

MD5
35e5aaaf64cfd996c128b5184afab2be

SHA1
d7f20e4be6b4dde2825158ba2dd315b1bd72d28d

SHA256
6844456d90722603693b3ccb4dc7bec92d10cefdd8ff55f8d3991fa66251cfa0

SHA512
8de872792634ad54586844c3ca75a8d446eafd9e8cd0e2be7e71c9b414ecc129d0165f96a35cf512cc4cf012f7eb348d16fa3bd899e37b2671c810982406d8b2

Download Submit
C:\Windows\system\qAGqwvW.exe

Filesize
2.3MB

MD5
01536318fb5412bb0c3380c7fa8b66df

SHA1
898fdb087881b84ffc7668f65390be29ea579e8e

SHA256
202774382190aa84af484cea89f2ab7406346e25dad2ad0167748f52ab5914aa

SHA512
1264842e3b3851938e30e6d03fce4ec67f98d89f47f926d4dd8be639e4b369577e2d8c92a5e39108504c62cd23e99c316c64e966f396916a4ebeb1183e3f588e

Download Submit
C:\Windows\system\tBXbQDX.exe

Filesize
2.3MB

MD5
8a5772a6589baaf5a89cd0da4daf4294

SHA1
d20cb254b4e4e8efd7d3c8e09e9b5e05c6c5baf6

SHA256
d1a12fe7a1d4f132a7eff12467e59d8f47e3c5c42a1e6f3dcd271a525bdd4ecb

SHA512
fc00e4db0771029cd81a9a02e0c2fe33f2b60715046be5ddbbcc3d69427e12672d16f907a18a3a296b24090aaa07b2f91372446d1f39a6b9764d807cf2265309

Download Submit
C:\Windows\system\xCvTHro.exe

Filesize
2.3MB

MD5
f8eba1054cc76522646f0eada6e9a8a2

SHA1
ff38e289e96fa27771a916a135e7887b53550d55

SHA256
ab2cdba87f8eb4664ae038b131867d86e3817b6a38e79e157a759c8ee687a427

SHA512
b817b9301e6b1da3639fd18f4438a90111a6b4cc258ba5c09dbd82e4cfaa24ada7f2f0c130c0277bf14ae78b8e66b8416093136dec7549b7de2cd72a8e0234d4

Download Submit
C:\Windows\system\zubHdzS.exe

Filesize
2.3MB

MD5
3bd4523cf59cd45eabdc0f825e4a91da

SHA1
5ce43e2b8b6471958fcfb65c1030b618507d6973

SHA256
2305561b4374cc12d7323698d2cc13fb14aaa5f8e8f24c5c794c943f4735c591

SHA512
566e6d0a43a0184bb70984f835a7aa86ff607a15b17d4a36226a8af20c391d0f62ad3ab0f5fac89097ecc08c7dc4beae92f0f4b5be8cf74dc05006f1bda4bae3

Download Submit
\Windows\system\BSauTJs.exe

Filesize
2.3MB

MD5
8300850252c3c2da205d7e846613a9a4

SHA1
1e65f8f0b00d558aa18c363d447afcf1817650a2

SHA256
154fb8bc691b234063a135ab8b50adea9e37e0b1990122c9607476fb25c003ad

SHA512
b33b8843b900db6031f5cf11496fad467dbbd7209fc179e7b43936713a523a7e00a1ebdbacebfca5a82fe1c2a819661996a14e21c3e23bebec7f8d2fa08bda09

Download Submit
\Windows\system\BucadVa.exe

Filesize
2.3MB

MD5
8ae9168665449d04715121970a1720d8

SHA1
ff7f68228cf9d5f132909b042e6e339c261c5323

SHA256
3b76449e81a1fbd114b0aed13e8d3823b957b5b6a2e6f79863e4ce5ff7d792f3

SHA512
1fcf00eef3177c74c4da3259485cf6c4ba4c47716dafd8218c8c7d53f654e52ad2ccd6e75940847868df42a8b99ffce2587fe28572ddb21bf3a84d4f88fb7e7e

Download Submit
\Windows\system\DIfgDeD.exe

Filesize
2.3MB

MD5
057d03d82c714e455dba8b575fa47abf

SHA1
ebd071c9fbfda7764d5e704acfece5d27d014ae8

SHA256
bd7c1de1d79073754f86bea7b8ffade0322cb34b60ca332621de487f1796b58e

SHA512
fe86068539679bbd98a9bd25a6548699c973fdfb6af6aeaea756c5824818d761deff2f426ef11c1f0b7bd10c41cd9200f89b41450432258e81702d26b68cfa84

Download Submit
\Windows\system\DWZzZKI.exe

Filesize
2.3MB

MD5
58d1ec1e472643d379b1053b310a81aa

SHA1
393c67bf98a9a4a68919f2d9502e42d34fa928e7

SHA256
011be37dd6c5dae3e15d47accc16c5774461ea0980427ff7bf2aec5e5dd83d6e

SHA512
55d22589a4ba9b40f738564970db6b2a137ab75b86cafd09c20488a69073a8274ef209ec7e19ec645f0da63dadce2b776ac7314d9646a3a9b5b9d65b4ce256ed

Download Submit
\Windows\system\EZbmqVE.exe

Filesize
2.3MB

MD5
d83f0ebbe3d6afe5b47b5d8b3716533d

SHA1
4661213f9d7c74a2767ee9758147aea391a3646b

SHA256
587d4cd8fd9438b2cd1fa508d01ed1cc4d6a22ec8516e47039c868810e4e6891

SHA512
7a5c1d3bd1049959b345cc1d5aae22e17e72b786b8917b58c02a2c2a6480e96a2d9fb2ff8661e58f2d733aa37c2f42df162de4530f40bf297454cf575bc56ce1

Download Submit
\Windows\system\EfBBzja.exe

Filesize
2.3MB

MD5
80eb63e25b4feecae9cd35f0d84fc9cd

SHA1
2d6135e21134fce81c74d2874b7d381ef1450773

SHA256
3b3a3cd194f7d12f602e98093a1ef6d07511886f86c7d5cfd1aa877f1e5f5b08

SHA512
d5763ad481508335f6f011e9a5ac698629d3b6f008067df0d1a4491537f12c6246248fc1fcba2dde495be49ce5fb958f8b979dbbc74897544ac85267bce4bb2f

Download Submit
\Windows\system\HrxMKyU.exe

Filesize
2.3MB

MD5
0d016b9a26a40efad6fee9e5ad3a0d66

SHA1
e6b1e01f9f7fe65e9cbe0daecc035bf90b536ffb

SHA256
94071994edc39458bffeca8a20f8f69bb86581d5b9bca5dfac7bc694d0fd5f4c

SHA512
7ad28d81573e663fa599ab0ae2d6136abe07682530641ab1737115244649db19f55b9eae383570c785c04e496592da97b6960a8679f9fa80d55f5a4a5684d02e

Download Submit
\Windows\system\JFvDpMd.exe

Filesize
2.3MB

MD5
f38c6056172c9a9f2321bce35ebfedfd

SHA1
32c8eb49dcb9a8ebf072978b6425f8e6002fa4c2

SHA256
f20b6c6dc49564e3940f81cd999f8a994981878422c92bfed74ef83eeff5b951

SHA512
b7d61de563825705e020cecba84daec5978c962de23e17a3842683c9f0e5e5e564e9d8ea31ea0d18c36276ea91fa9006d85a3370b5974cb064de2b863c298f0a

Download Submit
\Windows\system\LmKyFkN.exe

Filesize
2.3MB

MD5
1c7964fb53e7abad66c8150f3f2a7a2c

SHA1
9d4db605ae84470ad40e2263348aa6ecd9a153d9

SHA256
070a490478c46181aaff92d752f2aa9c2990d9e0afc38c73c2778663d0218ba2

SHA512
ef45ef7786c6e1525209154bb61e8eca80fcc5ab070a69cf707f33de9aec3c0b4d8f1f0876d399c7e0663e4bda837aedfab47d633a624137dc7d659c5759d3d5

Download Submit
\Windows\system\NZlKHJW.exe

Filesize
2.3MB

MD5
873b96da7b6b22cf76998e75eb25267d

SHA1
0bfb730f9e6f35e81f706b1e95e2a0933426bcb0

SHA256
dbd23b227d2cb13d7e758ad3ca40a8219dc1431d6ec2d4d71b449a5b094ef497

SHA512
d31c0ffb55cd5d40ff3e94c1164047727ab5b2f5613881688b4a0eaf90b1860da6859e277a14212c5b337b4ea9435629ee019775354b086843ebe12a12401455

Download Submit
\Windows\system\QBzSErU.exe

Filesize
2.3MB

MD5
5e5ffa8a0ec3eb932a8afc850a64e3cb

SHA1
988173b654081898a55f69980275ed5ca3b977eb

SHA256
79f682470e1a8f3989e98f6b84b0d1c24e8687109acc0481f977eafc90b467cb

SHA512
ee5dc841b068ae888ff47025276464a2dc7cd92329f4990a43ecb147175cb80541407a33eadabc5cded98504c048672fa8c4d62722481a1b4b708c3ac9809c6d

Download Submit
\Windows\system\VSQyDOD.exe

Filesize
2.3MB

MD5
3a806010b60e4881d6fad6780327fda9

SHA1
514fbe80a7441e01d17126fffe9502dd706e76a4

SHA256
7bd67f8fab66d38b6532a3275afc9307b40925d7f40c1140ea8cd1941d0b1984

SHA512
0166eae98961e7462276320c139c6b9bb97fc17058534e4b1955fbdab8cd62390eeb8f33b8dd27fac3837faa752871680dce3fbd46d45d7992c7f0a4c1926922

Download Submit
\Windows\system\ZhTAuGr.exe

Filesize
2.3MB

MD5
bde0248fd767eff02e1986ac414320b7

SHA1
99505f32bccac6be1ae4fc1d0855115696f8dd15

SHA256
beb43313354519ae5799905b81cd3dbc24d2d3434ded3fb89273bc745a8d3164

SHA512
ac933ae516126b9f863e678d0ede014432fd5f3a8a6002e1ab71a79dc9fd7dd724c3734faeb651fff4d1e6268cc36e44c1cc9660ee0f9835af2103dd21411e45

Download Submit
\Windows\system\cNqqOCn.exe

Filesize
2.3MB

MD5
8b58b872f0d1bed9219a85b171c5b4e6

SHA1
a36bd7d7451abee6650da18f7dabe125af8ffab5

SHA256
b0e3ab7578dfaf67d9f7208aad49e9dd6cf8bc13483efc41f1250c630e8e6df4

SHA512
ba3b48514f7d8c8c4d45da20416f42b1e8a61e5d0f76add0867632ac8e876fd0440a0630378b6bc72e5062b266a7bd8562002972214c210f5ef803128f473c92

Download Submit
\Windows\system\jIJZyel.exe

Filesize
2.3MB

MD5
47147af2502780676ef47c31076bcc7e

SHA1
10b02c26fe75623f2044fafcc3f4d6f84856c009

SHA256
75c5220f9ad405ed82d796ce480034c45bd05dd398c133bcfcbba4800022b78d

SHA512
a661db81c62f2f618f43c272f4b137d07fee56b83c6a68505de34020654269836a1433823088a3198272f2f542f6352f0ac77034126ba97f885338dc2ea06892

Download Submit
\Windows\system\jOdYwEE.exe

Filesize
2.3MB

MD5
0fe0428642295dc0a59ca12d8ac18f6a

SHA1
57ffa72592163774eabe71b3585cfb73133abf74

SHA256
bfde161f29c956a15d180197c137a89f623cfb0202ccb549fd1a61e3f3dfb6c7

SHA512
30586ed54902b02221c0cafbadc3474fe18ed79753cade18a43af27a47cad2664d929227f7b3e590fcf07351d7a7ae0aca50fed825b28a4cf8cc154e5399f97f

Download Submit
\Windows\system\jWWgHcv.exe

Filesize
2.3MB

MD5
b74558a9958a2cf6a3451fe74de64f8d

SHA1
a94b6a1aa3d54fce7cac8ca882dad899026baf64

SHA256
98698f26bb7f85543544ac066a4524230a745c1145d6c6b092481211e1df4e92

SHA512
2d0933afcd6b0dc7ee120c88d5005a29587cd2c92133e0258e7d6ffaf2a4c16c5be6709a69fbaef140aea479412af866c7e2bed90dbe052a70cbb708f7d2be74

Download Submit
\Windows\system\viqrXds.exe

Filesize
2.3MB

MD5
f2ce00d87a8f82c9d49f03a8cd66ea64

SHA1
37fb29c49634e8dced72b04cd8ecf01e1a9825c4

SHA256
bf9f1f81d3a161a472d9f74570b48f5285b0d43415ced1e05c910422f3da92f5

SHA512
8e99b1e130ee3933dea2a7362c563c2a36496129a48be9f5c8ff611c882321760189256b3a5fafa6c72eb9334b56a46ae8c7209fe46175f2cd23bb7bd38d4e1e

Download Submit
\Windows\system\vjFlzep.exe

Filesize
2.3MB

MD5
5fb2359085772633ab4a97a7bcd26215

SHA1
9c6c0d6035fa437569dc248af1b3ec8f78c2a2f2

SHA256
85fc79a6b7db6c97ca0442b8bf7fa8d808ee31825829b224cdd0825003b804f6

SHA512
4ba07bfdacb47ab4072ef4bdeaa45c2baaefa15ad9a471c77e2147c40766872d984b43ce793868b83f07344e82898db951bf1134ffbc29005fc00289fb081e6a

Download Submit
\Windows\system\xqBQQpR.exe

Filesize
2.3MB

MD5
4187d0126e897a76e1a34ed03828d09e

SHA1
ac3a0352c7e31cb0e4174889a1304bb4f0c63e07

SHA256
ae22c6d11fabc29d6709342a1e01b939f6cf8315a45a283bac024a0e11a08114

SHA512
130befe28370e18548fca37d8892778ccea5c9ef0299824d98874821ea51bd13e021ed39f46df3cf4a7b56e763f7f362378026f3fb58aba223a21f5fdab3f010

Download Submit
memory/2004-60-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2004-12-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2004-92-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/2004-90-0x00000000035B0000-0x00000000039A2000-memory.dmp

Filesize
3.9MB

Download
memory/2004-1188-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2004-0-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2004-12675-0x00000000035B0000-0x00000000039A2000-memory.dmp

Filesize
3.9MB

Download
memory/2004-91-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2004-37-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2004-50-0x00000000035B0000-0x00000000039A2000-memory.dmp

Filesize
3.9MB

Download
memory/2004-64-0x00000000035B0000-0x00000000039A2000-memory.dmp

Filesize
3.9MB

Download
memory/2004-61-0x00000000035B0000-0x00000000039A2000-memory.dmp

Filesize
3.9MB

Download
memory/2004-11921-0x00000000035B0000-0x00000000039A2000-memory.dmp

Filesize
3.9MB

Download
memory/2004-16-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2004-33-0x0000000003040000-0x0000000003432000-memory.dmp

Filesize
3.9MB

Download
memory/2004-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2012-14-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-4975-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2040-38-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/2040-55-0x000000001B7E0000-0x000000001BAC2000-memory.dmp

Filesize
2.9MB

Download
memory/2040-57-0x0000000001E20000-0x0000000001E28000-memory.dmp

Filesize
32KB

Download
memory/2104-77-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2104-5046-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2400-4973-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2400-65-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2548-58-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2548-5047-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2568-5051-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-87-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-4983-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2628-46-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2656-5003-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2656-63-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2956-4980-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-35-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-4981-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2968-13-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download