xmrig | 5fe725151b1e0b8d7de236b4667874046fe45d78b3ca016a8b730c227ea4c290

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
Size

1.8MB
MD5

11a61efed27723f15b6b91199acd97c8
SHA1

22605bc7718048f4c1c887dcf3ae315e96b60b65
SHA256

5fe725151b1e0b8d7de236b4667874046fe45d78b3ca016a8b730c227ea4c290
SHA512

49f8b9bea34f77e5bc20b362d3ae7517d4c278cabb0b31e450ad0c9a90d4e8fec31e89637a53ce9127301d01187fc1b23131fe7f6bee0d657ed8e949b3be89f4
SSDEEP

49152:Lz071uv4BPMkibTIA5I4TNrpDGgDQG00y0:NABS

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 26 IoCs

miner

resource	yara_rule
behavioral1/memory/2744-127-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2408-122-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/1160-120-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/2468-117-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/2696-115-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/2528-114-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/2696-424-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2724-112-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2756-110-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/2148-106-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/2760-104-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2676-102-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2620-100-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/292-126-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2760-2983-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2620-2986-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/2408-3142-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2756-3146-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/292-3147-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2744-3207-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2676-3211-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2148-3345-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/2724-3452-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/1160-3453-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/2528-3471-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/2468-3472-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1740	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2744	XOnUnxi.exe
2620	xPMARfX.exe
2676	UHHCiHJ.exe
2760	UdtMMee.exe
2148	KtbUNJL.exe
2756	EwYqnQd.exe
2724	XDvRfrk.exe
2528	uFyzSuT.exe
2468	YhfNQxo.exe
1160	DOzePBO.exe
2408	mYUOYIy.exe
292	XFKPiaI.exe
564	nOhzgiq.exe
2640	ebAxrBJ.exe
1012	NIqSEQT.exe
2564	rDDPhlu.exe
1488	YRMFwly.exe
1904	xmYfyTN.exe
1640	xIlOorG.exe
752	yOUNPVw.exe
2716	hLxaBmX.exe
952	eKbvLwf.exe
2552	DUnPqlp.exe
2740	deMXTWe.exe
2712	wmplyxy.exe
592	DaWQJPz.exe
2952	OgMjEhp.exe
1992	AiqpnXV.exe
2984	AUfZUJF.exe
1068	jgWuXIP.exe
1152	KSpiMNH.exe
956	AKFNpvU.exe
1060	hDSDLnW.exe
1508	rJdnZSD.exe
1544	SiFZcVC.exe
1184	EESzDtw.exe
1476	ntyxkjV.exe
3000	rOysgZk.exe
1844	fsaLLlk.exe
1120	pZAYjTr.exe
2808	ASSrGMd.exe
1932	JTGvUXN.exe
608	pHUFqNt.exe
2904	eluRsEJ.exe
2076	lVyxeLu.exe
2792	GAkCMEn.exe
2100	fhexHfJ.exe
2764	WfBewFh.exe
2308	LiRDlUL.exe
2216	HBJGLiV.exe
3060	dpfNoKq.exe
1704	YBZRAmK.exe
884	zKfQnZa.exe
2008	irYCZzH.exe
2884	luCDfPy.exe
2872	JsGERmj.exe
2056	BSRHUWG.exe
1720	KnypYih.exe
912	fHLjulN.exe
2464	qGbXtGJ.exe
2636	QkETmVC.exe
2480	jlHbgMn.exe
2360	VMxdZvT.exe
2444	MxnaUAz.exe

Loads dropped DLL 64 IoCs

pid	Process
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2696-0-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/files/0x000d0000000122d1-6.dat	upx
behavioral1/files/0x00230000000122f8-14.dat	upx
behavioral1/files/0x000f0000000006fd-22.dat	upx
behavioral1/files/0x000900000001269e-23.dat	upx
behavioral1/files/0x00080000000126c7-32.dat	upx
behavioral1/files/0x00080000000126f7-33.dat	upx
behavioral1/files/0x00090000000139d6-40.dat	upx
behavioral1/files/0x0006000000014e3d-50.dat	upx
behavioral1/files/0x001a000000012300-51.dat	upx
behavioral1/files/0x0006000000014fe1-65.dat	upx
behavioral1/files/0x0006000000015364-83.dat	upx
behavioral1/memory/2744-127-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/memory/2408-122-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/1160-120-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/memory/2468-117-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/memory/2528-114-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/files/0x0006000000015c0d-139.dat	upx
behavioral1/files/0x0006000000015c2f-149.dat	upx
behavioral1/files/0x0006000000015c3c-152.dat	upx
behavioral1/memory/2696-424-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/files/0x0006000000015db4-190.dat	upx
behavioral1/files/0x0006000000015d88-186.dat	upx
behavioral1/files/0x0006000000015cb9-182.dat	upx
behavioral1/files/0x0006000000015c87-178.dat	upx
behavioral1/files/0x0006000000015c7c-174.dat	upx
behavioral1/files/0x0006000000015c5d-164.dat	upx
behavioral1/files/0x0006000000015c69-168.dat	upx
behavioral1/files/0x0006000000015c52-159.dat	upx
behavioral1/files/0x0006000000015c23-144.dat	upx
behavioral1/files/0x0006000000015a98-134.dat	upx
behavioral1/files/0x0006000000015a2d-129.dat	upx
behavioral1/memory/2724-112-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/2756-110-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/2148-106-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/memory/2760-104-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/memory/2676-102-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/2620-100-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/memory/292-126-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/files/0x000600000001560a-95.dat	upx
behavioral1/files/0x00060000000155e2-91.dat	upx
behavioral1/files/0x00060000000155d9-88.dat	upx
behavioral1/files/0x00060000000155d4-80.dat	upx
behavioral1/files/0x0006000000015264-70.dat	upx
behavioral1/files/0x0006000000014ec4-59.dat	upx
behavioral1/files/0x0006000000014c67-46.dat	upx
behavioral1/memory/2760-2983-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/memory/2620-2986-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/memory/2408-3142-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/2756-3146-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/292-3147-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/2744-3207-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/memory/2676-3211-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/2148-3345-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/memory/2724-3452-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/1160-3453-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/memory/2528-3471-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/memory/2468-3472-0x000000013F030000-0x000000013F422000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ykhKGIk.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\onJzItW.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\kKUIHpA.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\zsGbHiu.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\ZaomlVr.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\umTpZxb.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\Qlfmovu.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\zEyxIGZ.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\rbPxdtB.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\XZhNJDI.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\oWbRFgT.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\fElofXD.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\dqawvzf.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\EdTxgdH.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\NcnjOex.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\abkKOcC.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\lRnCCuD.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\DhgBpNz.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\fXMJfBM.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\gbexnCi.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\DYWMoRN.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\QxAoIye.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\bwUgpmQ.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\CPzqAko.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\QZTbLsa.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\SJlBfli.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\MstrMTP.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\InIWhaY.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\eTOttLF.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\RuUPqxz.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\qmdrlMK.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\JToqIdj.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\egEdKzp.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\uYubGTI.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\NSGBNBe.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\wRAtgGp.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\bvIikNj.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\RxwfJyJ.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\bLmTDHm.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\KETpBWv.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\FhOtzPY.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\sVjCneG.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\Ffgzgtf.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\DLHhyDp.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\EfNZKKv.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\YkcknjG.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\AeBVNeX.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\AMKFZCh.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\sKtcClb.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\QVfkCFw.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\mXxkEmz.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\LvGbEnJ.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\GtqeCMj.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\jxPKtrN.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\XDSbxDz.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\bLVhNRc.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\kTJZANd.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\XpCJUHU.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\QMaiVRI.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\bwfWHbC.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\QsYAbFS.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\kYTgPgn.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\rTMYdEZ.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
File created	C:\Windows\System\TuxFfBk.exe	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1740	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
Token: SeDebugPrivilege	1740	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 1740	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	29
PID 2696 wrote to memory of 1740	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	29
PID 2696 wrote to memory of 1740	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	29
PID 2696 wrote to memory of 2744	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	30
PID 2696 wrote to memory of 2744	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	30
PID 2696 wrote to memory of 2744	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	30
PID 2696 wrote to memory of 2620	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	31
PID 2696 wrote to memory of 2620	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	31
PID 2696 wrote to memory of 2620	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	31
PID 2696 wrote to memory of 2676	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	32
PID 2696 wrote to memory of 2676	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	32
PID 2696 wrote to memory of 2676	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	32
PID 2696 wrote to memory of 2760	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	33
PID 2696 wrote to memory of 2760	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	33
PID 2696 wrote to memory of 2760	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	33
PID 2696 wrote to memory of 2148	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	34
PID 2696 wrote to memory of 2148	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	34
PID 2696 wrote to memory of 2148	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	34
PID 2696 wrote to memory of 2756	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	35
PID 2696 wrote to memory of 2756	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	35
PID 2696 wrote to memory of 2756	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	35
PID 2696 wrote to memory of 2724	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	36
PID 2696 wrote to memory of 2724	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	36
PID 2696 wrote to memory of 2724	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	36
PID 2696 wrote to memory of 2528	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	37
PID 2696 wrote to memory of 2528	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	37
PID 2696 wrote to memory of 2528	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	37
PID 2696 wrote to memory of 2468	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	38
PID 2696 wrote to memory of 2468	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	38
PID 2696 wrote to memory of 2468	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	38
PID 2696 wrote to memory of 2408	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	39
PID 2696 wrote to memory of 2408	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	39
PID 2696 wrote to memory of 2408	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	39
PID 2696 wrote to memory of 1160	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	40
PID 2696 wrote to memory of 1160	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	40
PID 2696 wrote to memory of 1160	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	40
PID 2696 wrote to memory of 292	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	41
PID 2696 wrote to memory of 292	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	41
PID 2696 wrote to memory of 292	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	41
PID 2696 wrote to memory of 564	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	42
PID 2696 wrote to memory of 564	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	42
PID 2696 wrote to memory of 564	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	42
PID 2696 wrote to memory of 1012	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	43
PID 2696 wrote to memory of 1012	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	43
PID 2696 wrote to memory of 1012	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	43
PID 2696 wrote to memory of 2640	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	44
PID 2696 wrote to memory of 2640	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	44
PID 2696 wrote to memory of 2640	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	44
PID 2696 wrote to memory of 2564	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	45
PID 2696 wrote to memory of 2564	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	45
PID 2696 wrote to memory of 2564	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	45
PID 2696 wrote to memory of 1488	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	46
PID 2696 wrote to memory of 1488	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	46
PID 2696 wrote to memory of 1488	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	46
PID 2696 wrote to memory of 1904	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	47
PID 2696 wrote to memory of 1904	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	47
PID 2696 wrote to memory of 1904	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	47
PID 2696 wrote to memory of 1640	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	48
PID 2696 wrote to memory of 1640	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	48
PID 2696 wrote to memory of 1640	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	48
PID 2696 wrote to memory of 752	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	49
PID 2696 wrote to memory of 752	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	49
PID 2696 wrote to memory of 752	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	49
PID 2696 wrote to memory of 2716	2696	11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\11a61efed27723f15b6b91199acd97c8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\System\XOnUnxi.exe
  C:\Windows\System\XOnUnxi.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\xPMARfX.exe
  C:\Windows\System\xPMARfX.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\UHHCiHJ.exe
  C:\Windows\System\UHHCiHJ.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\UdtMMee.exe
  C:\Windows\System\UdtMMee.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\KtbUNJL.exe
  C:\Windows\System\KtbUNJL.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\EwYqnQd.exe
  C:\Windows\System\EwYqnQd.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\XDvRfrk.exe
  C:\Windows\System\XDvRfrk.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\uFyzSuT.exe
  C:\Windows\System\uFyzSuT.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\YhfNQxo.exe
  C:\Windows\System\YhfNQxo.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\mYUOYIy.exe
  C:\Windows\System\mYUOYIy.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\DOzePBO.exe
  C:\Windows\System\DOzePBO.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\XFKPiaI.exe
  C:\Windows\System\XFKPiaI.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\nOhzgiq.exe
  C:\Windows\System\nOhzgiq.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\NIqSEQT.exe
  C:\Windows\System\NIqSEQT.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\ebAxrBJ.exe
  C:\Windows\System\ebAxrBJ.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\rDDPhlu.exe
  C:\Windows\System\rDDPhlu.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\YRMFwly.exe
  C:\Windows\System\YRMFwly.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\xmYfyTN.exe
  C:\Windows\System\xmYfyTN.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\xIlOorG.exe
  C:\Windows\System\xIlOorG.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\yOUNPVw.exe
  C:\Windows\System\yOUNPVw.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\hLxaBmX.exe
  C:\Windows\System\hLxaBmX.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\eKbvLwf.exe
  C:\Windows\System\eKbvLwf.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\DUnPqlp.exe
  C:\Windows\System\DUnPqlp.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\deMXTWe.exe
  C:\Windows\System\deMXTWe.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\wmplyxy.exe
  C:\Windows\System\wmplyxy.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\DaWQJPz.exe
  C:\Windows\System\DaWQJPz.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\OgMjEhp.exe
  C:\Windows\System\OgMjEhp.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\AiqpnXV.exe
  C:\Windows\System\AiqpnXV.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\AUfZUJF.exe
  C:\Windows\System\AUfZUJF.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\jgWuXIP.exe
  C:\Windows\System\jgWuXIP.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\KSpiMNH.exe
  C:\Windows\System\KSpiMNH.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\AKFNpvU.exe
  C:\Windows\System\AKFNpvU.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\hDSDLnW.exe
  C:\Windows\System\hDSDLnW.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\rJdnZSD.exe
  C:\Windows\System\rJdnZSD.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\SiFZcVC.exe
  C:\Windows\System\SiFZcVC.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\EESzDtw.exe
  C:\Windows\System\EESzDtw.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\ntyxkjV.exe
  C:\Windows\System\ntyxkjV.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\rOysgZk.exe
  C:\Windows\System\rOysgZk.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\fsaLLlk.exe
  C:\Windows\System\fsaLLlk.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\pZAYjTr.exe
  C:\Windows\System\pZAYjTr.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\ASSrGMd.exe
  C:\Windows\System\ASSrGMd.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\JTGvUXN.exe
  C:\Windows\System\JTGvUXN.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\pHUFqNt.exe
  C:\Windows\System\pHUFqNt.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\eluRsEJ.exe
  C:\Windows\System\eluRsEJ.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\lVyxeLu.exe
  C:\Windows\System\lVyxeLu.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\GAkCMEn.exe
  C:\Windows\System\GAkCMEn.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\fhexHfJ.exe
  C:\Windows\System\fhexHfJ.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\WfBewFh.exe
  C:\Windows\System\WfBewFh.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\LiRDlUL.exe
  C:\Windows\System\LiRDlUL.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\HBJGLiV.exe
  C:\Windows\System\HBJGLiV.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\dpfNoKq.exe
  C:\Windows\System\dpfNoKq.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\YBZRAmK.exe
  C:\Windows\System\YBZRAmK.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\zKfQnZa.exe
  C:\Windows\System\zKfQnZa.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\irYCZzH.exe
  C:\Windows\System\irYCZzH.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\luCDfPy.exe
  C:\Windows\System\luCDfPy.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\JsGERmj.exe
  C:\Windows\System\JsGERmj.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\BSRHUWG.exe
  C:\Windows\System\BSRHUWG.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\KnypYih.exe
  C:\Windows\System\KnypYih.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\fHLjulN.exe
  C:\Windows\System\fHLjulN.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\qGbXtGJ.exe
  C:\Windows\System\qGbXtGJ.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\QkETmVC.exe
  C:\Windows\System\QkETmVC.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\jlHbgMn.exe
  C:\Windows\System\jlHbgMn.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\VMxdZvT.exe
  C:\Windows\System\VMxdZvT.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\MxnaUAz.exe
  C:\Windows\System\MxnaUAz.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\TXieKAs.exe
  C:\Windows\System\TXieKAs.exe
  2⤵
  PID:2392
- C:\Windows\System\nsqvztl.exe
  C:\Windows\System\nsqvztl.exe
  2⤵
  PID:2356
- C:\Windows\System\njrwUvX.exe
  C:\Windows\System\njrwUvX.exe
  2⤵
  PID:1056
- C:\Windows\System\XKuWJTr.exe
  C:\Windows\System\XKuWJTr.exe
  2⤵
  PID:1384
- C:\Windows\System\uLNpblr.exe
  C:\Windows\System\uLNpblr.exe
  2⤵
  PID:2020
- C:\Windows\System\ibqABml.exe
  C:\Windows\System\ibqABml.exe
  2⤵
  PID:2584
- C:\Windows\System\OWfZwaZ.exe
  C:\Windows\System\OWfZwaZ.exe
  2⤵
  PID:1248
- C:\Windows\System\MKZUAKk.exe
  C:\Windows\System\MKZUAKk.exe
  2⤵
  PID:2340
- C:\Windows\System\egkKtow.exe
  C:\Windows\System\egkKtow.exe
  2⤵
  PID:2460
- C:\Windows\System\dUZhqzY.exe
  C:\Windows\System\dUZhqzY.exe
  2⤵
  PID:1472
- C:\Windows\System\kOZdxBz.exe
  C:\Windows\System\kOZdxBz.exe
  2⤵
  PID:2364
- C:\Windows\System\gMcOVMX.exe
  C:\Windows\System\gMcOVMX.exe
  2⤵
  PID:1980
- C:\Windows\System\rTMYdEZ.exe
  C:\Windows\System\rTMYdEZ.exe
  2⤵
  PID:2652
- C:\Windows\System\wfpqjVx.exe
  C:\Windows\System\wfpqjVx.exe
  2⤵
  PID:2648
- C:\Windows\System\etoPAaD.exe
  C:\Windows\System\etoPAaD.exe
  2⤵
  PID:1688
- C:\Windows\System\YcOzSWc.exe
  C:\Windows\System\YcOzSWc.exe
  2⤵
  PID:2324
- C:\Windows\System\pHfsrJG.exe
  C:\Windows\System\pHfsrJG.exe
  2⤵
  PID:2720
- C:\Windows\System\PrpQKWv.exe
  C:\Windows\System\PrpQKWv.exe
  2⤵
  PID:472
- C:\Windows\System\uHRsDjj.exe
  C:\Windows\System\uHRsDjj.exe
  2⤵
  PID:852
- C:\Windows\System\IpaPqtA.exe
  C:\Windows\System\IpaPqtA.exe
  2⤵
  PID:2328
- C:\Windows\System\QxAoIye.exe
  C:\Windows\System\QxAoIye.exe
  2⤵
  PID:2768
- C:\Windows\System\lZxihkx.exe
  C:\Windows\System\lZxihkx.exe
  2⤵
  PID:2512
- C:\Windows\System\FIfRwad.exe
  C:\Windows\System\FIfRwad.exe
  2⤵
  PID:1636
- C:\Windows\System\ctJmXyX.exe
  C:\Windows\System\ctJmXyX.exe
  2⤵
  PID:2684
- C:\Windows\System\lVyhwBZ.exe
  C:\Windows\System\lVyhwBZ.exe
  2⤵
  PID:2000
- C:\Windows\System\bHaezVi.exe
  C:\Windows\System\bHaezVi.exe
  2⤵
  PID:2044
- C:\Windows\System\HLhBOSN.exe
  C:\Windows\System\HLhBOSN.exe
  2⤵
  PID:3016
- C:\Windows\System\vHQmjyj.exe
  C:\Windows\System\vHQmjyj.exe
  2⤵
  PID:1836
- C:\Windows\System\diwAXAc.exe
  C:\Windows\System\diwAXAc.exe
  2⤵
  PID:1804
- C:\Windows\System\JIaEDaU.exe
  C:\Windows\System\JIaEDaU.exe
  2⤵
  PID:980
- C:\Windows\System\cczlgez.exe
  C:\Windows\System\cczlgez.exe
  2⤵
  PID:960
- C:\Windows\System\dixWjAZ.exe
  C:\Windows\System\dixWjAZ.exe
  2⤵
  PID:1936
- C:\Windows\System\GXyhwaG.exe
  C:\Windows\System\GXyhwaG.exe
  2⤵
  PID:1952
- C:\Windows\System\qNVgpMY.exe
  C:\Windows\System\qNVgpMY.exe
  2⤵
  PID:2960
- C:\Windows\System\fBzxIaM.exe
  C:\Windows\System\fBzxIaM.exe
  2⤵
  PID:2320
- C:\Windows\System\vXoheFb.exe
  C:\Windows\System\vXoheFb.exe
  2⤵
  PID:2268
- C:\Windows\System\HYYdiWz.exe
  C:\Windows\System\HYYdiWz.exe
  2⤵
  PID:2876
- C:\Windows\System\qzlHcDv.exe
  C:\Windows\System\qzlHcDv.exe
  2⤵
  PID:2380
- C:\Windows\System\hPpanCZ.exe
  C:\Windows\System\hPpanCZ.exe
  2⤵
  PID:2800
- C:\Windows\System\xmFqAHS.exe
  C:\Windows\System\xmFqAHS.exe
  2⤵
  PID:3056
- C:\Windows\System\mFJXrUB.exe
  C:\Windows\System\mFJXrUB.exe
  2⤵
  PID:2988
- C:\Windows\System\gMrqndU.exe
  C:\Windows\System\gMrqndU.exe
  2⤵
  PID:1608
- C:\Windows\System\hVbFELI.exe
  C:\Windows\System\hVbFELI.exe
  2⤵
  PID:2772
- C:\Windows\System\hgreHmg.exe
  C:\Windows\System\hgreHmg.exe
  2⤵
  PID:1048
- C:\Windows\System\bKLYaRX.exe
  C:\Windows\System\bKLYaRX.exe
  2⤵
  PID:2548
- C:\Windows\System\MzWJziR.exe
  C:\Windows\System\MzWJziR.exe
  2⤵
  PID:2412
- C:\Windows\System\UhizVbp.exe
  C:\Windows\System\UhizVbp.exe
  2⤵
  PID:2336
- C:\Windows\System\vJVipgg.exe
  C:\Windows\System\vJVipgg.exe
  2⤵
  PID:2332
- C:\Windows\System\xmxrugE.exe
  C:\Windows\System\xmxrugE.exe
  2⤵
  PID:2416
- C:\Windows\System\umTpZxb.exe
  C:\Windows\System\umTpZxb.exe
  2⤵
  PID:2680
- C:\Windows\System\UbpZBap.exe
  C:\Windows\System\UbpZBap.exe
  2⤵
  PID:2520
- C:\Windows\System\zewHZdB.exe
  C:\Windows\System\zewHZdB.exe
  2⤵
  PID:2432
- C:\Windows\System\RpaWzwj.exe
  C:\Windows\System\RpaWzwj.exe
  2⤵
  PID:692
- C:\Windows\System\qFHKNSD.exe
  C:\Windows\System\qFHKNSD.exe
  2⤵
  PID:556
- C:\Windows\System\mXxkEmz.exe
  C:\Windows\System\mXxkEmz.exe
  2⤵
  PID:2784
- C:\Windows\System\FVVkHbS.exe
  C:\Windows\System\FVVkHbS.exe
  2⤵
  PID:2036
- C:\Windows\System\ACNSCrZ.exe
  C:\Windows\System\ACNSCrZ.exe
  2⤵
  PID:1744
- C:\Windows\System\qauvuya.exe
  C:\Windows\System\qauvuya.exe
  2⤵
  PID:1168
- C:\Windows\System\kTJZANd.exe
  C:\Windows\System\kTJZANd.exe
  2⤵
  PID:2144
- C:\Windows\System\AvRXsnz.exe
  C:\Windows\System\AvRXsnz.exe
  2⤵
  PID:2004
- C:\Windows\System\CGPoUBQ.exe
  C:\Windows\System\CGPoUBQ.exe
  2⤵
  PID:672
- C:\Windows\System\XpCJUHU.exe
  C:\Windows\System\XpCJUHU.exe
  2⤵
  PID:1964
- C:\Windows\System\LQspHsJ.exe
  C:\Windows\System\LQspHsJ.exe
  2⤵
  PID:1288
- C:\Windows\System\syHWqbZ.exe
  C:\Windows\System\syHWqbZ.exe
  2⤵
  PID:2220
- C:\Windows\System\wqcxVXB.exe
  C:\Windows\System\wqcxVXB.exe
  2⤵
  PID:888
- C:\Windows\System\AHECxvS.exe
  C:\Windows\System\AHECxvS.exe
  2⤵
  PID:1464
- C:\Windows\System\eiEaTRI.exe
  C:\Windows\System\eiEaTRI.exe
  2⤵
  PID:1584
- C:\Windows\System\DDFVaig.exe
  C:\Windows\System\DDFVaig.exe
  2⤵
  PID:1064
- C:\Windows\System\FwrGqVd.exe
  C:\Windows\System\FwrGqVd.exe
  2⤵
  PID:1132
- C:\Windows\System\aSrTGLh.exe
  C:\Windows\System\aSrTGLh.exe
  2⤵
  PID:908
- C:\Windows\System\DiAWkNm.exe
  C:\Windows\System\DiAWkNm.exe
  2⤵
  PID:2348
- C:\Windows\System\izYwXmq.exe
  C:\Windows\System\izYwXmq.exe
  2⤵
  PID:1372
- C:\Windows\System\iDexNtN.exe
  C:\Windows\System\iDexNtN.exe
  2⤵
  PID:1648
- C:\Windows\System\jKCgFPs.exe
  C:\Windows\System\jKCgFPs.exe
  2⤵
  PID:1532
- C:\Windows\System\UCwMQNL.exe
  C:\Windows\System\UCwMQNL.exe
  2⤵
  PID:2304
- C:\Windows\System\afIqTEy.exe
  C:\Windows\System\afIqTEy.exe
  2⤵
  PID:1772
- C:\Windows\System\ysbFsjd.exe
  C:\Windows\System\ysbFsjd.exe
  2⤵
  PID:572
- C:\Windows\System\tbDEVYD.exe
  C:\Windows\System\tbDEVYD.exe
  2⤵
  PID:756
- C:\Windows\System\DTRKHat.exe
  C:\Windows\System\DTRKHat.exe
  2⤵
  PID:2176
- C:\Windows\System\ZKdjHLY.exe
  C:\Windows\System\ZKdjHLY.exe
  2⤵
  PID:1196
- C:\Windows\System\IKPRewZ.exe
  C:\Windows\System\IKPRewZ.exe
  2⤵
  PID:2024
- C:\Windows\System\jaFxXOI.exe
  C:\Windows\System\jaFxXOI.exe
  2⤵
  PID:2672
- C:\Windows\System\awxZGUG.exe
  C:\Windows\System\awxZGUG.exe
  2⤵
  PID:2704
- C:\Windows\System\wkjKpLt.exe
  C:\Windows\System\wkjKpLt.exe
  2⤵
  PID:2352
- C:\Windows\System\WGvxZHU.exe
  C:\Windows\System\WGvxZHU.exe
  2⤵
  PID:772
- C:\Windows\System\OplvKxw.exe
  C:\Windows\System\OplvKxw.exe
  2⤵
  PID:2916
- C:\Windows\System\sxaVcem.exe
  C:\Windows\System\sxaVcem.exe
  2⤵
  PID:2604
- C:\Windows\System\JRzAFgW.exe
  C:\Windows\System\JRzAFgW.exe
  2⤵
  PID:1680
- C:\Windows\System\jSqCJcd.exe
  C:\Windows\System\jSqCJcd.exe
  2⤵
  PID:1604
- C:\Windows\System\GrGAhvY.exe
  C:\Windows\System\GrGAhvY.exe
  2⤵
  PID:2224
- C:\Windows\System\MUbfJFi.exe
  C:\Windows\System\MUbfJFi.exe
  2⤵
  PID:548
- C:\Windows\System\fbhlJUt.exe
  C:\Windows\System\fbhlJUt.exe
  2⤵
  PID:3084
- C:\Windows\System\oPaHcQt.exe
  C:\Windows\System\oPaHcQt.exe
  2⤵
  PID:3104
- C:\Windows\System\IcrUSjB.exe
  C:\Windows\System\IcrUSjB.exe
  2⤵
  PID:3120
- C:\Windows\System\uXYRQqb.exe
  C:\Windows\System\uXYRQqb.exe
  2⤵
  PID:3136
- C:\Windows\System\ZtNmNGM.exe
  C:\Windows\System\ZtNmNGM.exe
  2⤵
  PID:3152
- C:\Windows\System\QkIhhHV.exe
  C:\Windows\System\QkIhhHV.exe
  2⤵
  PID:3168
- C:\Windows\System\wQRBiXz.exe
  C:\Windows\System\wQRBiXz.exe
  2⤵
  PID:3184
- C:\Windows\System\gztYiYf.exe
  C:\Windows\System\gztYiYf.exe
  2⤵
  PID:3252
- C:\Windows\System\MzNuoQC.exe
  C:\Windows\System\MzNuoQC.exe
  2⤵
  PID:3268
- C:\Windows\System\ejeOWda.exe
  C:\Windows\System\ejeOWda.exe
  2⤵
  PID:3324
- C:\Windows\System\KtLHXPR.exe
  C:\Windows\System\KtLHXPR.exe
  2⤵
  PID:3340
- C:\Windows\System\RbyGLGD.exe
  C:\Windows\System\RbyGLGD.exe
  2⤵
  PID:3356
- C:\Windows\System\oZCUicr.exe
  C:\Windows\System\oZCUicr.exe
  2⤵
  PID:3372
- C:\Windows\System\sRDErnG.exe
  C:\Windows\System\sRDErnG.exe
  2⤵
  PID:3392
- C:\Windows\System\OIfMKvJ.exe
  C:\Windows\System\OIfMKvJ.exe
  2⤵
  PID:3408
- C:\Windows\System\kJFvMOB.exe
  C:\Windows\System\kJFvMOB.exe
  2⤵
  PID:3424
- C:\Windows\System\WlvOYED.exe
  C:\Windows\System\WlvOYED.exe
  2⤵
  PID:3440
- C:\Windows\System\oCtjXkb.exe
  C:\Windows\System\oCtjXkb.exe
  2⤵
  PID:3456
- C:\Windows\System\TWDJcmP.exe
  C:\Windows\System\TWDJcmP.exe
  2⤵
  PID:3472
- C:\Windows\System\uKIvOap.exe
  C:\Windows\System\uKIvOap.exe
  2⤵
  PID:3488
- C:\Windows\System\gtUFjbU.exe
  C:\Windows\System\gtUFjbU.exe
  2⤵
  PID:3504
- C:\Windows\System\kzGtaCu.exe
  C:\Windows\System\kzGtaCu.exe
  2⤵
  PID:3520
- C:\Windows\System\BFVsYJb.exe
  C:\Windows\System\BFVsYJb.exe
  2⤵
  PID:3564
- C:\Windows\System\WkwhWHn.exe
  C:\Windows\System\WkwhWHn.exe
  2⤵
  PID:3580
- C:\Windows\System\HsePhiM.exe
  C:\Windows\System\HsePhiM.exe
  2⤵
  PID:3596
- C:\Windows\System\LvGbEnJ.exe
  C:\Windows\System\LvGbEnJ.exe
  2⤵
  PID:3612
- C:\Windows\System\rDsbYjU.exe
  C:\Windows\System\rDsbYjU.exe
  2⤵
  PID:3636
- C:\Windows\System\AASvoHj.exe
  C:\Windows\System\AASvoHj.exe
  2⤵
  PID:3652
- C:\Windows\System\wdpInJo.exe
  C:\Windows\System\wdpInJo.exe
  2⤵
  PID:3668
- C:\Windows\System\tbXWvss.exe
  C:\Windows\System\tbXWvss.exe
  2⤵
  PID:3704
- C:\Windows\System\QfiMBKR.exe
  C:\Windows\System\QfiMBKR.exe
  2⤵
  PID:3720
- C:\Windows\System\Qpbzrmr.exe
  C:\Windows\System\Qpbzrmr.exe
  2⤵
  PID:3736
- C:\Windows\System\LMtZWKh.exe
  C:\Windows\System\LMtZWKh.exe
  2⤵
  PID:3752
- C:\Windows\System\eqPUglA.exe
  C:\Windows\System\eqPUglA.exe
  2⤵
  PID:3768
- C:\Windows\System\RyjQCeG.exe
  C:\Windows\System\RyjQCeG.exe
  2⤵
  PID:3900
- C:\Windows\System\elyucwP.exe
  C:\Windows\System\elyucwP.exe
  2⤵
  PID:3964
- C:\Windows\System\zaoyZDm.exe
  C:\Windows\System\zaoyZDm.exe
  2⤵
  PID:3980
- C:\Windows\System\ThLyPnX.exe
  C:\Windows\System\ThLyPnX.exe
  2⤵
  PID:3996
- C:\Windows\System\MEfhEjk.exe
  C:\Windows\System\MEfhEjk.exe
  2⤵
  PID:4012
- C:\Windows\System\YkcknjG.exe
  C:\Windows\System\YkcknjG.exe
  2⤵
  PID:4028
- C:\Windows\System\lVPnGJJ.exe
  C:\Windows\System\lVPnGJJ.exe
  2⤵
  PID:4044
- C:\Windows\System\IUZKWDJ.exe
  C:\Windows\System\IUZKWDJ.exe
  2⤵
  PID:4060
- C:\Windows\System\ynigHPa.exe
  C:\Windows\System\ynigHPa.exe
  2⤵
  PID:4076
- C:\Windows\System\OeIGrqY.exe
  C:\Windows\System\OeIGrqY.exe
  2⤵
  PID:4092
- C:\Windows\System\ThjwvLm.exe
  C:\Windows\System\ThjwvLm.exe
  2⤵
  PID:2812
- C:\Windows\System\DnnhlNR.exe
  C:\Windows\System\DnnhlNR.exe
  2⤵
  PID:936
- C:\Windows\System\VHbqSMr.exe
  C:\Windows\System\VHbqSMr.exe
  2⤵
  PID:1304
- C:\Windows\System\qgSvxGR.exe
  C:\Windows\System\qgSvxGR.exe
  2⤵
  PID:3112
- C:\Windows\System\REjwXDB.exe
  C:\Windows\System\REjwXDB.exe
  2⤵
  PID:3176
- C:\Windows\System\tTzRwmc.exe
  C:\Windows\System\tTzRwmc.exe
  2⤵
  PID:1716
- C:\Windows\System\PHWMfSW.exe
  C:\Windows\System\PHWMfSW.exe
  2⤵
  PID:3204
- C:\Windows\System\Kycamgb.exe
  C:\Windows\System\Kycamgb.exe
  2⤵
  PID:3192
- C:\Windows\System\RgxuuVW.exe
  C:\Windows\System\RgxuuVW.exe
  2⤵
  PID:1892
- C:\Windows\System\bpaLoat.exe
  C:\Windows\System\bpaLoat.exe
  2⤵
  PID:2280
- C:\Windows\System\zRRyUWj.exe
  C:\Windows\System\zRRyUWj.exe
  2⤵
  PID:3132
- C:\Windows\System\aAxPKxq.exe
  C:\Windows\System\aAxPKxq.exe
  2⤵
  PID:3224
- C:\Windows\System\EpurKgi.exe
  C:\Windows\System\EpurKgi.exe
  2⤵
  PID:3244
- C:\Windows\System\LliqSdD.exe
  C:\Windows\System\LliqSdD.exe
  2⤵
  PID:3280
- C:\Windows\System\PRPWDCa.exe
  C:\Windows\System\PRPWDCa.exe
  2⤵
  PID:3008
- C:\Windows\System\EGaiYhm.exe
  C:\Windows\System\EGaiYhm.exe
  2⤵
  PID:3432
- C:\Windows\System\mVAKrmb.exe
  C:\Windows\System\mVAKrmb.exe
  2⤵
  PID:2708
- C:\Windows\System\mzntimA.exe
  C:\Windows\System\mzntimA.exe
  2⤵
  PID:3544
- C:\Windows\System\xBmFZdg.exe
  C:\Windows\System\xBmFZdg.exe
  2⤵
  PID:3532
- C:\Windows\System\YPwxYAR.exe
  C:\Windows\System\YPwxYAR.exe
  2⤵
  PID:3320
- C:\Windows\System\ItwiPUL.exe
  C:\Windows\System\ItwiPUL.exe
  2⤵
  PID:3416
- C:\Windows\System\ybTNOwl.exe
  C:\Windows\System\ybTNOwl.exe
  2⤵
  PID:3632
- C:\Windows\System\Qlfmovu.exe
  C:\Windows\System\Qlfmovu.exe
  2⤵
  PID:3660
- C:\Windows\System\eCnfyJU.exe
  C:\Windows\System\eCnfyJU.exe
  2⤵
  PID:3448
- C:\Windows\System\wyyiBcK.exe
  C:\Windows\System\wyyiBcK.exe
  2⤵
  PID:3516
- C:\Windows\System\XxQLIfl.exe
  C:\Windows\System\XxQLIfl.exe
  2⤵
  PID:3644
- C:\Windows\System\mJxFUms.exe
  C:\Windows\System\mJxFUms.exe
  2⤵
  PID:3744
- C:\Windows\System\bwUgpmQ.exe
  C:\Windows\System\bwUgpmQ.exe
  2⤵
  PID:3824
- C:\Windows\System\uvLMKVZ.exe
  C:\Windows\System\uvLMKVZ.exe
  2⤵
  PID:3852
- C:\Windows\System\ProOfQX.exe
  C:\Windows\System\ProOfQX.exe
  2⤵
  PID:3916
- C:\Windows\System\LHXhRqo.exe
  C:\Windows\System\LHXhRqo.exe
  2⤵
  PID:948
- C:\Windows\System\xkUkpoU.exe
  C:\Windows\System\xkUkpoU.exe
  2⤵
  PID:3928
- C:\Windows\System\bvIikNj.exe
  C:\Windows\System\bvIikNj.exe
  2⤵
  PID:1628
- C:\Windows\System\TtnrqIq.exe
  C:\Windows\System\TtnrqIq.exe
  2⤵
  PID:3988
- C:\Windows\System\DCFKXeU.exe
  C:\Windows\System\DCFKXeU.exe
  2⤵
  PID:4084
- C:\Windows\System\fNkWZtg.exe
  C:\Windows\System\fNkWZtg.exe
  2⤵
  PID:4056
- C:\Windows\System\EJIzhwD.exe
  C:\Windows\System\EJIzhwD.exe
  2⤵
  PID:3076
- C:\Windows\System\IMSZeoR.exe
  C:\Windows\System\IMSZeoR.exe
  2⤵
  PID:3248
- C:\Windows\System\YLJAVBu.exe
  C:\Windows\System\YLJAVBu.exe
  2⤵
  PID:3216
- C:\Windows\System\VwsQHfV.exe
  C:\Windows\System\VwsQHfV.exe
  2⤵
  PID:3276
- C:\Windows\System\jTMsuLP.exe
  C:\Windows\System\jTMsuLP.exe
  2⤵
  PID:3312
- C:\Windows\System\RYOUNfr.exe
  C:\Windows\System\RYOUNfr.exe
  2⤵
  PID:3972
- C:\Windows\System\insCQud.exe
  C:\Windows\System\insCQud.exe
  2⤵
  PID:4036
- C:\Windows\System\nrmEJVb.exe
  C:\Windows\System\nrmEJVb.exe
  2⤵
  PID:4072
- C:\Windows\System\gmqgUfP.exe
  C:\Windows\System\gmqgUfP.exe
  2⤵
  PID:3148
- C:\Windows\System\rvhgXvG.exe
  C:\Windows\System\rvhgXvG.exe
  2⤵
  PID:3200
- C:\Windows\System\yZDeCSs.exe
  C:\Windows\System\yZDeCSs.exe
  2⤵
  PID:3236
- C:\Windows\System\alFzoXD.exe
  C:\Windows\System\alFzoXD.exe
  2⤵
  PID:3436
- C:\Windows\System\TIQkUgY.exe
  C:\Windows\System\TIQkUgY.exe
  2⤵
  PID:3352
- C:\Windows\System\nRcvnzg.exe
  C:\Windows\System\nRcvnzg.exe
  2⤵
  PID:3576
- C:\Windows\System\eTOttLF.exe
  C:\Windows\System\eTOttLF.exe
  2⤵
  PID:3512
- C:\Windows\System\bmQwgbY.exe
  C:\Windows\System\bmQwgbY.exe
  2⤵
  PID:3808
- C:\Windows\System\nSvYwHn.exe
  C:\Windows\System\nSvYwHn.exe
  2⤵
  PID:3332
- C:\Windows\System\ONqgcmj.exe
  C:\Windows\System\ONqgcmj.exe
  2⤵
  PID:3848
- C:\Windows\System\vvycEWH.exe
  C:\Windows\System\vvycEWH.exe
  2⤵
  PID:3500
- C:\Windows\System\jyadgyN.exe
  C:\Windows\System\jyadgyN.exe
  2⤵
  PID:3592
- C:\Windows\System\CUoiabE.exe
  C:\Windows\System\CUoiabE.exe
  2⤵
  PID:3608
- C:\Windows\System\vNgQYPF.exe
  C:\Windows\System\vNgQYPF.exe
  2⤵
  PID:3800
- C:\Windows\System\jhBPJuQ.exe
  C:\Windows\System\jhBPJuQ.exe
  2⤵
  PID:3628
- C:\Windows\System\FUwhcuS.exe
  C:\Windows\System\FUwhcuS.exe
  2⤵
  PID:2084
- C:\Windows\System\LYGahly.exe
  C:\Windows\System\LYGahly.exe
  2⤵
  PID:3680
- C:\Windows\System\FafZwJr.exe
  C:\Windows\System\FafZwJr.exe
  2⤵
  PID:3684
- C:\Windows\System\fPjOrBq.exe
  C:\Windows\System\fPjOrBq.exe
  2⤵
  PID:1928
- C:\Windows\System\xHKWtet.exe
  C:\Windows\System\xHKWtet.exe
  2⤵
  PID:3300
- C:\Windows\System\vjPzdJp.exe
  C:\Windows\System\vjPzdJp.exe
  2⤵
  PID:3308
- C:\Windows\System\lQmrfod.exe
  C:\Windows\System\lQmrfod.exe
  2⤵
  PID:4008
- C:\Windows\System\OGkgDhr.exe
  C:\Windows\System\OGkgDhr.exe
  2⤵
  PID:3912
- C:\Windows\System\EwhhWzt.exe
  C:\Windows\System\EwhhWzt.exe
  2⤵
  PID:3944
- C:\Windows\System\hhnsHIc.exe
  C:\Windows\System\hhnsHIc.exe
  2⤵
  PID:3484
- C:\Windows\System\iBuNBWl.exe
  C:\Windows\System\iBuNBWl.exe
  2⤵
  PID:3160
- C:\Windows\System\SLsRXOw.exe
  C:\Windows\System\SLsRXOw.exe
  2⤵
  PID:1972
- C:\Windows\System\KKlwkwK.exe
  C:\Windows\System\KKlwkwK.exe
  2⤵
  PID:3384
- C:\Windows\System\dYVYRzm.exe
  C:\Windows\System\dYVYRzm.exe
  2⤵
  PID:3404
- C:\Windows\System\gJznIKp.exe
  C:\Windows\System\gJznIKp.exe
  2⤵
  PID:1524
- C:\Windows\System\mWNyzHw.exe
  C:\Windows\System\mWNyzHw.exe
  2⤵
  PID:1784
- C:\Windows\System\oPioMTx.exe
  C:\Windows\System\oPioMTx.exe
  2⤵
  PID:3816
- C:\Windows\System\SFvlfPn.exe
  C:\Windows\System\SFvlfPn.exe
  2⤵
  PID:1104
- C:\Windows\System\Hrtfpnd.exe
  C:\Windows\System\Hrtfpnd.exe
  2⤵
  PID:2736
- C:\Windows\System\KGcqCxN.exe
  C:\Windows\System\KGcqCxN.exe
  2⤵
  PID:1252
- C:\Windows\System\mQUdfeH.exe
  C:\Windows\System\mQUdfeH.exe
  2⤵
  PID:3936
- C:\Windows\System\GLtTHxK.exe
  C:\Windows\System\GLtTHxK.exe
  2⤵
  PID:3948
- C:\Windows\System\yNmdpWQ.exe
  C:\Windows\System\yNmdpWQ.exe
  2⤵
  PID:4052
- C:\Windows\System\OaaySYK.exe
  C:\Windows\System\OaaySYK.exe
  2⤵
  PID:944
- C:\Windows\System\SdqKNrL.exe
  C:\Windows\System\SdqKNrL.exe
  2⤵
  PID:3164
- C:\Windows\System\zPdMIzZ.exe
  C:\Windows\System\zPdMIzZ.exe
  2⤵
  PID:3956
- C:\Windows\System\vtJnJxC.exe
  C:\Windows\System\vtJnJxC.exe
  2⤵
  PID:3920
- C:\Windows\System\azpWpZM.exe
  C:\Windows\System\azpWpZM.exe
  2⤵
  PID:808
- C:\Windows\System\fGErgSk.exe
  C:\Windows\System\fGErgSk.exe
  2⤵
  PID:2104
- C:\Windows\System\apXyayx.exe
  C:\Windows\System\apXyayx.exe
  2⤵
  PID:3820
- C:\Windows\System\vrfuvyh.exe
  C:\Windows\System\vrfuvyh.exe
  2⤵
  PID:2164
- C:\Windows\System\Hcihrmw.exe
  C:\Windows\System\Hcihrmw.exe
  2⤵
  PID:3700
- C:\Windows\System\trCzRFs.exe
  C:\Windows\System\trCzRFs.exe
  2⤵
  PID:3624
- C:\Windows\System\IMgQqJo.exe
  C:\Windows\System\IMgQqJo.exe
  2⤵
  PID:3196
- C:\Windows\System\FPShBBG.exe
  C:\Windows\System\FPShBBG.exe
  2⤵
  PID:3556
- C:\Windows\System\JHRMTcS.exe
  C:\Windows\System\JHRMTcS.exe
  2⤵
  PID:1824
- C:\Windows\System\bBNYLxO.exe
  C:\Windows\System\bBNYLxO.exe
  2⤵
  PID:3696
- C:\Windows\System\YEJTkTo.exe
  C:\Windows\System\YEJTkTo.exe
  2⤵
  PID:2544
- C:\Windows\System\geNAsMv.exe
  C:\Windows\System\geNAsMv.exe
  2⤵
  PID:1924
- C:\Windows\System\YHaoVZe.exe
  C:\Windows\System\YHaoVZe.exe
  2⤵
  PID:1008
- C:\Windows\System\kDzEYhB.exe
  C:\Windows\System\kDzEYhB.exe
  2⤵
  PID:2040
- C:\Windows\System\uWYNEva.exe
  C:\Windows\System\uWYNEva.exe
  2⤵
  PID:3692
- C:\Windows\System\PpIyZwx.exe
  C:\Windows\System\PpIyZwx.exe
  2⤵
  PID:4116
- C:\Windows\System\NUKbFrs.exe
  C:\Windows\System\NUKbFrs.exe
  2⤵
  PID:4136
- C:\Windows\System\BmbzObm.exe
  C:\Windows\System\BmbzObm.exe
  2⤵
  PID:4152
- C:\Windows\System\KYHSSQx.exe
  C:\Windows\System\KYHSSQx.exe
  2⤵
  PID:4176
- C:\Windows\System\SPsJcjN.exe
  C:\Windows\System\SPsJcjN.exe
  2⤵
  PID:4248
- C:\Windows\System\efyouHp.exe
  C:\Windows\System\efyouHp.exe
  2⤵
  PID:4304
- C:\Windows\System\XZZHazF.exe
  C:\Windows\System\XZZHazF.exe
  2⤵
  PID:4320
- C:\Windows\System\yZoEKhC.exe
  C:\Windows\System\yZoEKhC.exe
  2⤵
  PID:4340
- C:\Windows\System\fCIQqsx.exe
  C:\Windows\System\fCIQqsx.exe
  2⤵
  PID:4368
- C:\Windows\System\dhtLTNh.exe
  C:\Windows\System\dhtLTNh.exe
  2⤵
  PID:4384
- C:\Windows\System\nUXVHGk.exe
  C:\Windows\System\nUXVHGk.exe
  2⤵
  PID:4400
- C:\Windows\System\oNnTuPK.exe
  C:\Windows\System\oNnTuPK.exe
  2⤵
  PID:4420
- C:\Windows\System\ZfKKREn.exe
  C:\Windows\System\ZfKKREn.exe
  2⤵
  PID:4440
- C:\Windows\System\rdjGrJg.exe
  C:\Windows\System\rdjGrJg.exe
  2⤵
  PID:4468
- C:\Windows\System\NSGBNBe.exe
  C:\Windows\System\NSGBNBe.exe
  2⤵
  PID:4580
- C:\Windows\System\oYXRAga.exe
  C:\Windows\System\oYXRAga.exe
  2⤵
  PID:4596
- C:\Windows\System\hHyAyPD.exe
  C:\Windows\System\hHyAyPD.exe
  2⤵
  PID:4612
- C:\Windows\System\fNbaFOk.exe
  C:\Windows\System\fNbaFOk.exe
  2⤵
  PID:4628
- C:\Windows\System\ENcRfOc.exe
  C:\Windows\System\ENcRfOc.exe
  2⤵
  PID:4644
- C:\Windows\System\HBBhjUR.exe
  C:\Windows\System\HBBhjUR.exe
  2⤵
  PID:4660
- C:\Windows\System\fVIFcJm.exe
  C:\Windows\System\fVIFcJm.exe
  2⤵
  PID:4676
- C:\Windows\System\hEzpzLL.exe
  C:\Windows\System\hEzpzLL.exe
  2⤵
  PID:4692
- C:\Windows\System\dStVqNx.exe
  C:\Windows\System\dStVqNx.exe
  2⤵
  PID:4708
- C:\Windows\System\CDwGjZb.exe
  C:\Windows\System\CDwGjZb.exe
  2⤵
  PID:4724
- C:\Windows\System\ieNRWIs.exe
  C:\Windows\System\ieNRWIs.exe
  2⤵
  PID:4740
- C:\Windows\System\etqDeGT.exe
  C:\Windows\System\etqDeGT.exe
  2⤵
  PID:4784
- C:\Windows\System\plmtzAn.exe
  C:\Windows\System\plmtzAn.exe
  2⤵
  PID:4800
- C:\Windows\System\KLmunLx.exe
  C:\Windows\System\KLmunLx.exe
  2⤵
  PID:4820
- C:\Windows\System\cFrfJJO.exe
  C:\Windows\System\cFrfJJO.exe
  2⤵
  PID:4836
- C:\Windows\System\SEhimSZ.exe
  C:\Windows\System\SEhimSZ.exe
  2⤵
  PID:4852
- C:\Windows\System\iYoPFWP.exe
  C:\Windows\System\iYoPFWP.exe
  2⤵
  PID:4868
- C:\Windows\System\bCCmvYs.exe
  C:\Windows\System\bCCmvYs.exe
  2⤵
  PID:4892
- C:\Windows\System\PdexPrE.exe
  C:\Windows\System\PdexPrE.exe
  2⤵
  PID:4916
- C:\Windows\System\KdnzDFW.exe
  C:\Windows\System\KdnzDFW.exe
  2⤵
  PID:4932
- C:\Windows\System\iyRINgU.exe
  C:\Windows\System\iyRINgU.exe
  2⤵
  PID:4948
- C:\Windows\System\nKEOKCs.exe
  C:\Windows\System\nKEOKCs.exe
  2⤵
  PID:4964
- C:\Windows\System\idmVEZB.exe
  C:\Windows\System\idmVEZB.exe
  2⤵
  PID:4980
- C:\Windows\System\suWOTZT.exe
  C:\Windows\System\suWOTZT.exe
  2⤵
  PID:5004
- C:\Windows\System\GELsvxT.exe
  C:\Windows\System\GELsvxT.exe
  2⤵
  PID:5020
- C:\Windows\System\UDWpjZB.exe
  C:\Windows\System\UDWpjZB.exe
  2⤵
  PID:5036
- C:\Windows\System\HLVHdGR.exe
  C:\Windows\System\HLVHdGR.exe
  2⤵
  PID:5056
- C:\Windows\System\SMjbxig.exe
  C:\Windows\System\SMjbxig.exe
  2⤵
  PID:5072
- C:\Windows\System\gvBGSGQ.exe
  C:\Windows\System\gvBGSGQ.exe
  2⤵
  PID:5088
- C:\Windows\System\lXjMLMz.exe
  C:\Windows\System\lXjMLMz.exe
  2⤵
  PID:5104
- C:\Windows\System\YbEHcpP.exe
  C:\Windows\System\YbEHcpP.exe
  2⤵
  PID:4124
- C:\Windows\System\POLOQEC.exe
  C:\Windows\System\POLOQEC.exe
  2⤵
  PID:4164
- C:\Windows\System\QuAfHgS.exe
  C:\Windows\System\QuAfHgS.exe
  2⤵
  PID:3780
- C:\Windows\System\GWsAgJg.exe
  C:\Windows\System\GWsAgJg.exe
  2⤵
  PID:1976
- C:\Windows\System\gSyQuPB.exe
  C:\Windows\System\gSyQuPB.exe
  2⤵
  PID:2172
- C:\Windows\System\IyhnShh.exe
  C:\Windows\System\IyhnShh.exe
  2⤵
  PID:4276
- C:\Windows\System\lqvodOl.exe
  C:\Windows\System\lqvodOl.exe
  2⤵
  PID:3840
- C:\Windows\System\nHXtAZX.exe
  C:\Windows\System\nHXtAZX.exe
  2⤵
  PID:4108
- C:\Windows\System\QOvPUwF.exe
  C:\Windows\System\QOvPUwF.exe
  2⤵
  PID:4292
- C:\Windows\System\yziJELR.exe
  C:\Windows\System\yziJELR.exe
  2⤵
  PID:4336
- C:\Windows\System\PpNxxtq.exe
  C:\Windows\System\PpNxxtq.exe
  2⤵
  PID:4196
- C:\Windows\System\EaXNuQn.exe
  C:\Windows\System\EaXNuQn.exe
  2⤵
  PID:4232
- C:\Windows\System\BJJUgik.exe
  C:\Windows\System\BJJUgik.exe
  2⤵
  PID:4316
- C:\Windows\System\ECRVPop.exe
  C:\Windows\System\ECRVPop.exe
  2⤵
  PID:4376
- C:\Windows\System\qrdlYhY.exe
  C:\Windows\System\qrdlYhY.exe
  2⤵
  PID:4416
- C:\Windows\System\lXzgNCE.exe
  C:\Windows\System\lXzgNCE.exe
  2⤵
  PID:4464
- C:\Windows\System\FEhPuXM.exe
  C:\Windows\System\FEhPuXM.exe
  2⤵
  PID:4480
- C:\Windows\System\HKvikFm.exe
  C:\Windows\System\HKvikFm.exe
  2⤵
  PID:4396
- C:\Windows\System\VbGGHlg.exe
  C:\Windows\System\VbGGHlg.exe
  2⤵
  PID:4492
- C:\Windows\System\KsKiXwa.exe
  C:\Windows\System\KsKiXwa.exe
  2⤵
  PID:4504
- C:\Windows\System\uEFcudf.exe
  C:\Windows\System\uEFcudf.exe
  2⤵
  PID:4524
- C:\Windows\System\YRYtAjn.exe
  C:\Windows\System\YRYtAjn.exe
  2⤵
  PID:4536
- C:\Windows\System\GokUBem.exe
  C:\Windows\System\GokUBem.exe
  2⤵
  PID:4560
- C:\Windows\System\kgvYUSY.exe
  C:\Windows\System\kgvYUSY.exe
  2⤵
  PID:4588
- C:\Windows\System\JxEjBxv.exe
  C:\Windows\System\JxEjBxv.exe
  2⤵
  PID:4620
- C:\Windows\System\eyNawAP.exe
  C:\Windows\System\eyNawAP.exe
  2⤵
  PID:4640
- C:\Windows\System\iKzlPBx.exe
  C:\Windows\System\iKzlPBx.exe
  2⤵
  PID:4716
- C:\Windows\System\dplUcHq.exe
  C:\Windows\System\dplUcHq.exe
  2⤵
  PID:4752
- C:\Windows\System\GYwUWVW.exe
  C:\Windows\System\GYwUWVW.exe
  2⤵
  PID:4812
- C:\Windows\System\iNZaHFG.exe
  C:\Windows\System\iNZaHFG.exe
  2⤵
  PID:4876
- C:\Windows\System\IzrJkLB.exe
  C:\Windows\System\IzrJkLB.exe
  2⤵
  PID:4832
- C:\Windows\System\lRnCCuD.exe
  C:\Windows\System\lRnCCuD.exe
  2⤵
  PID:4860
- C:\Windows\System\xxDXIhL.exe
  C:\Windows\System\xxDXIhL.exe
  2⤵
  PID:4792
- C:\Windows\System\kaXDhfq.exe
  C:\Windows\System\kaXDhfq.exe
  2⤵
  PID:4956
- C:\Windows\System\DoYuMYL.exe
  C:\Windows\System\DoYuMYL.exe
  2⤵
  PID:5016
- C:\Windows\System\efxEbvQ.exe
  C:\Windows\System\efxEbvQ.exe
  2⤵
  PID:5028
- C:\Windows\System\zjKjtdO.exe
  C:\Windows\System\zjKjtdO.exe
  2⤵
  PID:5116
- C:\Windows\System\oMSCQsi.exe
  C:\Windows\System\oMSCQsi.exe
  2⤵
  PID:1948
- C:\Windows\System\fDwnCOO.exe
  C:\Windows\System\fDwnCOO.exe
  2⤵
  PID:4264
- C:\Windows\System\kIiUySE.exe
  C:\Windows\System\kIiUySE.exe
  2⤵
  PID:2500
- C:\Windows\System\VKVCjSE.exe
  C:\Windows\System\VKVCjSE.exe
  2⤵
  PID:1664
- C:\Windows\System\GtqeCMj.exe
  C:\Windows\System\GtqeCMj.exe
  2⤵
  PID:3976
- C:\Windows\System\YLymSNa.exe
  C:\Windows\System\YLymSNa.exe
  2⤵
  PID:2504
- C:\Windows\System\vbMgsDk.exe
  C:\Windows\System\vbMgsDk.exe
  2⤵
  PID:4204
- C:\Windows\System\tSUoCfK.exe
  C:\Windows\System\tSUoCfK.exe
  2⤵
  PID:4228
- C:\Windows\System\SvDQcCg.exe
  C:\Windows\System\SvDQcCg.exe
  2⤵
  PID:4360
- C:\Windows\System\bDcJzZV.exe
  C:\Windows\System\bDcJzZV.exe
  2⤵
  PID:4484
- C:\Windows\System\pJSBSKw.exe
  C:\Windows\System\pJSBSKw.exe
  2⤵
  PID:4592
- C:\Windows\System\YjOESNj.exe
  C:\Windows\System\YjOESNj.exe
  2⤵
  PID:4364
- C:\Windows\System\wxLzixu.exe
  C:\Windows\System\wxLzixu.exe
  2⤵
  PID:4544
- C:\Windows\System\ShvgZYf.exe
  C:\Windows\System\ShvgZYf.exe
  2⤵
  PID:4608
- C:\Windows\System\txntBfb.exe
  C:\Windows\System\txntBfb.exe
  2⤵
  PID:4568
- C:\Windows\System\LAKEGsZ.exe
  C:\Windows\System\LAKEGsZ.exe
  2⤵
  PID:4704
- C:\Windows\System\PWlIVnp.exe
  C:\Windows\System\PWlIVnp.exe
  2⤵
  PID:2180
- C:\Windows\System\YTneNuv.exe
  C:\Windows\System\YTneNuv.exe
  2⤵
  PID:4520
- C:\Windows\System\IzkEwSE.exe
  C:\Windows\System\IzkEwSE.exe
  2⤵
  PID:4884
- C:\Windows\System\ZrTAzyx.exe
  C:\Windows\System\ZrTAzyx.exe
  2⤵
  PID:5096
- C:\Windows\System\RUbRMbw.exe
  C:\Windows\System\RUbRMbw.exe
  2⤵
  PID:4940
- C:\Windows\System\LsrxmEy.exe
  C:\Windows\System\LsrxmEy.exe
  2⤵
  PID:4132
- C:\Windows\System\QRECiCS.exe
  C:\Windows\System\QRECiCS.exe
  2⤵
  PID:4828
- C:\Windows\System\RuUPqxz.exe
  C:\Windows\System\RuUPqxz.exe
  2⤵
  PID:5064
- C:\Windows\System\DKzCTmD.exe
  C:\Windows\System\DKzCTmD.exe
  2⤵
  PID:2956
- C:\Windows\System\guopjdU.exe
  C:\Windows\System\guopjdU.exe
  2⤵
  PID:4244
- C:\Windows\System\jTAgdAC.exe
  C:\Windows\System\jTAgdAC.exe
  2⤵
  PID:4328
- C:\Windows\System\iSbbRXz.exe
  C:\Windows\System\iSbbRXz.exe
  2⤵
  PID:4516
- C:\Windows\System\CxLLjRQ.exe
  C:\Windows\System\CxLLjRQ.exe
  2⤵
  PID:4508
- C:\Windows\System\NeaHPhI.exe
  C:\Windows\System\NeaHPhI.exe
  2⤵
  PID:4240
- C:\Windows\System\jJmljln.exe
  C:\Windows\System\jJmljln.exe
  2⤵
  PID:4532
- C:\Windows\System\bGEVfhb.exe
  C:\Windows\System\bGEVfhb.exe
  2⤵
  PID:4988
- C:\Windows\System\DhgBpNz.exe
  C:\Windows\System\DhgBpNz.exe
  2⤵
  PID:5052
- C:\Windows\System\QfMnlxR.exe
  C:\Windows\System\QfMnlxR.exe
  2⤵
  PID:4888
- C:\Windows\System\fgoMgVX.exe
  C:\Windows\System\fgoMgVX.exe
  2⤵
  PID:4144
- C:\Windows\System\uhOuJQd.exe
  C:\Windows\System\uhOuJQd.exe
  2⤵
  PID:4224
- C:\Windows\System\FkrBdgt.exe
  C:\Windows\System\FkrBdgt.exe
  2⤵
  PID:4408
- C:\Windows\System\LakbwJd.exe
  C:\Windows\System\LakbwJd.exe
  2⤵
  PID:4976
- C:\Windows\System\ZYgopRm.exe
  C:\Windows\System\ZYgopRm.exe
  2⤵
  PID:4656
- C:\Windows\System\UtLjgnI.exe
  C:\Windows\System\UtLjgnI.exe
  2⤵
  PID:5048
- C:\Windows\System\svgQvfA.exe
  C:\Windows\System\svgQvfA.exe
  2⤵
  PID:4700
- C:\Windows\System\mlKwIfa.exe
  C:\Windows\System\mlKwIfa.exe
  2⤵
  PID:4808
- C:\Windows\System\dtIwnFS.exe
  C:\Windows\System\dtIwnFS.exe
  2⤵
  PID:4512
- C:\Windows\System\kyHXGIc.exe
  C:\Windows\System\kyHXGIc.exe
  2⤵
  PID:4688
- C:\Windows\System\CsJvtJz.exe
  C:\Windows\System\CsJvtJz.exe
  2⤵
  PID:108
- C:\Windows\System\JytzYOh.exe
  C:\Windows\System\JytzYOh.exe
  2⤵
  PID:4572
- C:\Windows\System\jnmflwh.exe
  C:\Windows\System\jnmflwh.exe
  2⤵
  PID:5112
- C:\Windows\System\TnbBTiL.exe
  C:\Windows\System\TnbBTiL.exe
  2⤵
  PID:5128
- C:\Windows\System\gcRYymF.exe
  C:\Windows\System\gcRYymF.exe
  2⤵
  PID:5148
- C:\Windows\System\UHuqWfP.exe
  C:\Windows\System\UHuqWfP.exe
  2⤵
  PID:5164
- C:\Windows\System\NjHWmAJ.exe
  C:\Windows\System\NjHWmAJ.exe
  2⤵
  PID:5192
- C:\Windows\System\QZOXqep.exe
  C:\Windows\System\QZOXqep.exe
  2⤵
  PID:5208
- C:\Windows\System\QHoPofz.exe
  C:\Windows\System\QHoPofz.exe
  2⤵
  PID:5224
- C:\Windows\System\oRGzNxk.exe
  C:\Windows\System\oRGzNxk.exe
  2⤵
  PID:5240
- C:\Windows\System\yanPAPp.exe
  C:\Windows\System\yanPAPp.exe
  2⤵
  PID:5256
- C:\Windows\System\wsrEgiJ.exe
  C:\Windows\System\wsrEgiJ.exe
  2⤵
  PID:5272
- C:\Windows\System\TNvqbhD.exe
  C:\Windows\System\TNvqbhD.exe
  2⤵
  PID:5292
- C:\Windows\System\yycOJfi.exe
  C:\Windows\System\yycOJfi.exe
  2⤵
  PID:5312
- C:\Windows\System\MwLAabh.exe
  C:\Windows\System\MwLAabh.exe
  2⤵
  PID:5328
- C:\Windows\System\yRRqhUz.exe
  C:\Windows\System\yRRqhUz.exe
  2⤵
  PID:5348
- C:\Windows\System\rKIiRCl.exe
  C:\Windows\System\rKIiRCl.exe
  2⤵
  PID:5368
- C:\Windows\System\fAqCEvW.exe
  C:\Windows\System\fAqCEvW.exe
  2⤵
  PID:5404
- C:\Windows\System\tfGEaEv.exe
  C:\Windows\System\tfGEaEv.exe
  2⤵
  PID:5420
- C:\Windows\System\UKyyJMS.exe
  C:\Windows\System\UKyyJMS.exe
  2⤵
  PID:5436
- C:\Windows\System\WAjoHcA.exe
  C:\Windows\System\WAjoHcA.exe
  2⤵
  PID:5456
- C:\Windows\System\mfbLvwt.exe
  C:\Windows\System\mfbLvwt.exe
  2⤵
  PID:5476
- C:\Windows\System\MrLbugN.exe
  C:\Windows\System\MrLbugN.exe
  2⤵
  PID:5492
- C:\Windows\System\EYpuamf.exe
  C:\Windows\System\EYpuamf.exe
  2⤵
  PID:5508
- C:\Windows\System\TalQmNa.exe
  C:\Windows\System\TalQmNa.exe
  2⤵
  PID:5524
- C:\Windows\System\irPSjll.exe
  C:\Windows\System\irPSjll.exe
  2⤵
  PID:5540
- C:\Windows\System\gQSEQcm.exe
  C:\Windows\System\gQSEQcm.exe
  2⤵
  PID:5560
- C:\Windows\System\IsLKvjD.exe
  C:\Windows\System\IsLKvjD.exe
  2⤵
  PID:5576
- C:\Windows\System\rGPQdYN.exe
  C:\Windows\System\rGPQdYN.exe
  2⤵
  PID:5592
- C:\Windows\System\NVZqjAD.exe
  C:\Windows\System\NVZqjAD.exe
  2⤵
  PID:5608
- C:\Windows\System\GTOLHqd.exe
  C:\Windows\System\GTOLHqd.exe
  2⤵
  PID:5624
- C:\Windows\System\ytTPCco.exe
  C:\Windows\System\ytTPCco.exe
  2⤵
  PID:5640
- C:\Windows\System\CYEESwV.exe
  C:\Windows\System\CYEESwV.exe
  2⤵
  PID:5660
- C:\Windows\System\VGOSqEm.exe
  C:\Windows\System\VGOSqEm.exe
  2⤵
  PID:5676
- C:\Windows\System\pjCRiMf.exe
  C:\Windows\System\pjCRiMf.exe
  2⤵
  PID:5692
- C:\Windows\System\udeaSRE.exe
  C:\Windows\System\udeaSRE.exe
  2⤵
  PID:5708
- C:\Windows\System\BpxeTnw.exe
  C:\Windows\System\BpxeTnw.exe
  2⤵
  PID:5724
- C:\Windows\System\PJDdcOS.exe
  C:\Windows\System\PJDdcOS.exe
  2⤵
  PID:5740
- C:\Windows\System\xLEinmf.exe
  C:\Windows\System\xLEinmf.exe
  2⤵
  PID:5756
- C:\Windows\System\CwepJKl.exe
  C:\Windows\System\CwepJKl.exe
  2⤵
  PID:5772
- C:\Windows\System\tJbArJr.exe
  C:\Windows\System\tJbArJr.exe
  2⤵
  PID:5788
- C:\Windows\System\PvQQjgb.exe
  C:\Windows\System\PvQQjgb.exe
  2⤵
  PID:5804
- C:\Windows\System\hUTJMpX.exe
  C:\Windows\System\hUTJMpX.exe
  2⤵
  PID:5820
- C:\Windows\System\bEciAFA.exe
  C:\Windows\System\bEciAFA.exe
  2⤵
  PID:5836
- C:\Windows\System\qFiTzRy.exe
  C:\Windows\System\qFiTzRy.exe
  2⤵
  PID:5852
- C:\Windows\System\BaEFvWd.exe
  C:\Windows\System\BaEFvWd.exe
  2⤵
  PID:5868
- C:\Windows\System\MNSBwJE.exe
  C:\Windows\System\MNSBwJE.exe
  2⤵
  PID:5884
- C:\Windows\System\aBxQSHD.exe
  C:\Windows\System\aBxQSHD.exe
  2⤵
  PID:5900
- C:\Windows\System\JiwWXag.exe
  C:\Windows\System\JiwWXag.exe
  2⤵
  PID:5916
- C:\Windows\System\tYYfnuo.exe
  C:\Windows\System\tYYfnuo.exe
  2⤵
  PID:5932
- C:\Windows\System\dxRdlcF.exe
  C:\Windows\System\dxRdlcF.exe
  2⤵
  PID:5948
- C:\Windows\System\iMyaakb.exe
  C:\Windows\System\iMyaakb.exe
  2⤵
  PID:5964
- C:\Windows\System\QhkOkLg.exe
  C:\Windows\System\QhkOkLg.exe
  2⤵
  PID:5980
- C:\Windows\System\ZJALAqe.exe
  C:\Windows\System\ZJALAqe.exe
  2⤵
  PID:5996
- C:\Windows\System\yEJmYed.exe
  C:\Windows\System\yEJmYed.exe
  2⤵
  PID:6012
- C:\Windows\System\GpWCJXx.exe
  C:\Windows\System\GpWCJXx.exe
  2⤵
  PID:6028
- C:\Windows\System\XDYsIOH.exe
  C:\Windows\System\XDYsIOH.exe
  2⤵
  PID:6044
- C:\Windows\System\LJzFrSr.exe
  C:\Windows\System\LJzFrSr.exe
  2⤵
  PID:6060
- C:\Windows\System\MnigCle.exe
  C:\Windows\System\MnigCle.exe
  2⤵
  PID:6076
- C:\Windows\System\WBaxqqZ.exe
  C:\Windows\System\WBaxqqZ.exe
  2⤵
  PID:6092
- C:\Windows\System\GgMUllX.exe
  C:\Windows\System\GgMUllX.exe
  2⤵
  PID:6108
- C:\Windows\System\jkpswMo.exe
  C:\Windows\System\jkpswMo.exe
  2⤵
  PID:6124
- C:\Windows\System\YCWQaha.exe
  C:\Windows\System\YCWQaha.exe
  2⤵
  PID:6140
- C:\Windows\System\EYbwKoF.exe
  C:\Windows\System\EYbwKoF.exe
  2⤵
  PID:5156
- C:\Windows\System\ftenWLr.exe
  C:\Windows\System\ftenWLr.exe
  2⤵
  PID:4736
- C:\Windows\System\rsIYRId.exe
  C:\Windows\System\rsIYRId.exe
  2⤵
  PID:5144
- C:\Windows\System\ReAzCmB.exe
  C:\Windows\System\ReAzCmB.exe
  2⤵
  PID:5176
- C:\Windows\System\AfNVKNN.exe
  C:\Windows\System\AfNVKNN.exe
  2⤵
  PID:5340
- C:\Windows\System\QjYxYMU.exe
  C:\Windows\System\QjYxYMU.exe
  2⤵
  PID:5236
- C:\Windows\System\kTXmXfP.exe
  C:\Windows\System\kTXmXfP.exe
  2⤵
  PID:5308
- C:\Windows\System\NcnjOex.exe
  C:\Windows\System\NcnjOex.exe
  2⤵
  PID:5248
- C:\Windows\System\tRSNGdc.exe
  C:\Windows\System\tRSNGdc.exe
  2⤵
  PID:5324
- C:\Windows\System\KYmINid.exe
  C:\Windows\System\KYmINid.exe
  2⤵
  PID:5252
- C:\Windows\System\uHRlNlk.exe
  C:\Windows\System\uHRlNlk.exe
  2⤵
  PID:5360
- C:\Windows\System\LDcHgJZ.exe
  C:\Windows\System\LDcHgJZ.exe
  2⤵
  PID:5388
- C:\Windows\System\JPbDfNT.exe
  C:\Windows\System\JPbDfNT.exe
  2⤵
  PID:5416
- C:\Windows\System\aqqbxfo.exe
  C:\Windows\System\aqqbxfo.exe
  2⤵
  PID:5448
- C:\Windows\System\lCsdRKr.exe
  C:\Windows\System\lCsdRKr.exe
  2⤵
  PID:5520
- C:\Windows\System\fVPenQe.exe
  C:\Windows\System\fVPenQe.exe
  2⤵
  PID:5536
- C:\Windows\System\xgSSFFj.exe
  C:\Windows\System\xgSSFFj.exe
  2⤵
  PID:5472
- C:\Windows\System\hwYultS.exe
  C:\Windows\System\hwYultS.exe
  2⤵
  PID:5568
- C:\Windows\System\bgYikPH.exe
  C:\Windows\System\bgYikPH.exe
  2⤵
  PID:5616
- C:\Windows\System\iUMGQNe.exe
  C:\Windows\System\iUMGQNe.exe
  2⤵
  PID:5604
- C:\Windows\System\BkupOjx.exe
  C:\Windows\System\BkupOjx.exe
  2⤵
  PID:5684
- C:\Windows\System\twHTdbZ.exe
  C:\Windows\System\twHTdbZ.exe
  2⤵
  PID:5672
- C:\Windows\System\vnDwUYU.exe
  C:\Windows\System\vnDwUYU.exe
  2⤵
  PID:5732
- C:\Windows\System\zTMNmTI.exe
  C:\Windows\System\zTMNmTI.exe
  2⤵
  PID:5780
- C:\Windows\System\UmfrrIx.exe
  C:\Windows\System\UmfrrIx.exe
  2⤵
  PID:5844
- C:\Windows\System\yEwwTvv.exe
  C:\Windows\System\yEwwTvv.exe
  2⤵
  PID:5908
- C:\Windows\System\TqUhYOG.exe
  C:\Windows\System\TqUhYOG.exe
  2⤵
  PID:5768
- C:\Windows\System\vZKFTHX.exe
  C:\Windows\System\vZKFTHX.exe
  2⤵
  PID:5944
- C:\Windows\System\ycBQpfG.exe
  C:\Windows\System\ycBQpfG.exe
  2⤵
  PID:5860
- C:\Windows\System\NZMNNVK.exe
  C:\Windows\System\NZMNNVK.exe
  2⤵
  PID:5976
- C:\Windows\System\hxfGyip.exe
  C:\Windows\System\hxfGyip.exe
  2⤵
  PID:6036
- C:\Windows\System\fmJZxic.exe
  C:\Windows\System\fmJZxic.exe
  2⤵
  PID:5992
- C:\Windows\System\gQnzBlh.exe
  C:\Windows\System\gQnzBlh.exe
  2⤵
  PID:6020
- C:\Windows\System\YymlYrm.exe
  C:\Windows\System\YymlYrm.exe
  2⤵
  PID:6104
- C:\Windows\System\QBZKEYC.exe
  C:\Windows\System\QBZKEYC.exe
  2⤵
  PID:6136
- C:\Windows\System\trPozEb.exe
  C:\Windows\System\trPozEb.exe
  2⤵
  PID:5124
- C:\Windows\System\QtuBnsN.exe
  C:\Windows\System\QtuBnsN.exe
  2⤵
  PID:4188
- C:\Windows\System\ZYDdkuH.exe
  C:\Windows\System\ZYDdkuH.exe
  2⤵
  PID:5344
- C:\Windows\System\fXMJfBM.exe
  C:\Windows\System\fXMJfBM.exe
  2⤵
  PID:5200
- C:\Windows\System\RqoLrXD.exe
  C:\Windows\System\RqoLrXD.exe
  2⤵
  PID:5288
- C:\Windows\System\bjjTrld.exe
  C:\Windows\System\bjjTrld.exe
  2⤵
  PID:5380
- C:\Windows\System\cQEvOFF.exe
  C:\Windows\System\cQEvOFF.exe
  2⤵
  PID:5464
- C:\Windows\System\GMhclEf.exe
  C:\Windows\System\GMhclEf.exe
  2⤵
  PID:5556
- C:\Windows\System\PThGJTF.exe
  C:\Windows\System\PThGJTF.exe
  2⤵
  PID:5516
- C:\Windows\System\Ucktzqq.exe
  C:\Windows\System\Ucktzqq.exe
  2⤵
  PID:5588
- C:\Windows\System\JJnyDTN.exe
  C:\Windows\System\JJnyDTN.exe
  2⤵
  PID:5716
- C:\Windows\System\XvPCTum.exe
  C:\Windows\System\XvPCTum.exe
  2⤵
  PID:5752
- C:\Windows\System\UFIkgef.exe
  C:\Windows\System\UFIkgef.exe
  2⤵
  PID:5924
- C:\Windows\System\PuFbCOb.exe
  C:\Windows\System\PuFbCOb.exe
  2⤵
  PID:5972
- C:\Windows\System\rFJOsDn.exe
  C:\Windows\System\rFJOsDn.exe
  2⤵
  PID:5816
- C:\Windows\System\tNqzYMK.exe
  C:\Windows\System\tNqzYMK.exe
  2⤵
  PID:5940
- C:\Windows\System\UeXlWKM.exe
  C:\Windows\System\UeXlWKM.exe
  2⤵
  PID:6072
- C:\Windows\System\QBEahMd.exe
  C:\Windows\System\QBEahMd.exe
  2⤵
  PID:4460
- C:\Windows\System\WhPgRbK.exe
  C:\Windows\System\WhPgRbK.exe
  2⤵
  PID:5084
- C:\Windows\System\SAFJGOH.exe
  C:\Windows\System\SAFJGOH.exe
  2⤵
  PID:5300
- C:\Windows\System\hWGsZTF.exe
  C:\Windows\System\hWGsZTF.exe
  2⤵
  PID:5188
- C:\Windows\System\nmNsoEG.exe
  C:\Windows\System\nmNsoEG.exe
  2⤵
  PID:5500
- C:\Windows\System\AJBqTZj.exe
  C:\Windows\System\AJBqTZj.exe
  2⤵
  PID:5572
- C:\Windows\System\KfmirLP.exe
  C:\Windows\System\KfmirLP.exe
  2⤵
  PID:5748
- C:\Windows\System\jWMPnwO.exe
  C:\Windows\System\jWMPnwO.exe
  2⤵
  PID:5812
- C:\Windows\System\sndHEwV.exe
  C:\Windows\System\sndHEwV.exe
  2⤵
  PID:5828
- C:\Windows\System\kCraXBq.exe
  C:\Windows\System\kCraXBq.exe
  2⤵
  PID:6088
- C:\Windows\System\acTSyPu.exe
  C:\Windows\System\acTSyPu.exe
  2⤵
  PID:5232
- C:\Windows\System\eVoonFA.exe
  C:\Windows\System\eVoonFA.exe
  2⤵
  PID:5392
- C:\Windows\System\hIKfAyS.exe
  C:\Windows\System\hIKfAyS.exe
  2⤵
  PID:5184
- C:\Windows\System\ssYsdhR.exe
  C:\Windows\System\ssYsdhR.exe
  2⤵
  PID:5832
- C:\Windows\System\hILBwSS.exe
  C:\Windows\System\hILBwSS.exe
  2⤵
  PID:5704
- C:\Windows\System\syUIeUh.exe
  C:\Windows\System\syUIeUh.exe
  2⤵
  PID:6148
- C:\Windows\System\DLHhyDp.exe
  C:\Windows\System\DLHhyDp.exe
  2⤵
  PID:6164
- C:\Windows\System\uuFnwsn.exe
  C:\Windows\System\uuFnwsn.exe
  2⤵
  PID:6180
- C:\Windows\System\pUSHvyE.exe
  C:\Windows\System\pUSHvyE.exe
  2⤵
  PID:6196
- C:\Windows\System\YADUfWu.exe
  C:\Windows\System\YADUfWu.exe
  2⤵
  PID:6212
- C:\Windows\System\DyJUIHy.exe
  C:\Windows\System\DyJUIHy.exe
  2⤵
  PID:6228
- C:\Windows\System\rCtRXym.exe
  C:\Windows\System\rCtRXym.exe
  2⤵
  PID:6244
- C:\Windows\System\HbMmteb.exe
  C:\Windows\System\HbMmteb.exe
  2⤵
  PID:6260
- C:\Windows\System\WMKUbTg.exe
  C:\Windows\System\WMKUbTg.exe
  2⤵
  PID:6276
- C:\Windows\System\GNnKSAW.exe
  C:\Windows\System\GNnKSAW.exe
  2⤵
  PID:6292
- C:\Windows\System\qIJfDUp.exe
  C:\Windows\System\qIJfDUp.exe
  2⤵
  PID:6308
- C:\Windows\System\OjalgjY.exe
  C:\Windows\System\OjalgjY.exe
  2⤵
  PID:6324
- C:\Windows\System\dNncCdg.exe
  C:\Windows\System\dNncCdg.exe
  2⤵
  PID:6344
- C:\Windows\System\UtRjlhr.exe
  C:\Windows\System\UtRjlhr.exe
  2⤵
  PID:6360
- C:\Windows\System\DddNXRe.exe
  C:\Windows\System\DddNXRe.exe
  2⤵
  PID:6376
- C:\Windows\System\yebFebu.exe
  C:\Windows\System\yebFebu.exe
  2⤵
  PID:6392
- C:\Windows\System\XcdaZvl.exe
  C:\Windows\System\XcdaZvl.exe
  2⤵
  PID:6408
- C:\Windows\System\oMGLova.exe
  C:\Windows\System\oMGLova.exe
  2⤵
  PID:6424
- C:\Windows\System\mksAnRX.exe
  C:\Windows\System\mksAnRX.exe
  2⤵
  PID:6440
- C:\Windows\System\NTurMwr.exe
  C:\Windows\System\NTurMwr.exe
  2⤵
  PID:6456
- C:\Windows\System\ZnVHEuF.exe
  C:\Windows\System\ZnVHEuF.exe
  2⤵
  PID:6472
- C:\Windows\System\phnpAIX.exe
  C:\Windows\System\phnpAIX.exe
  2⤵
  PID:6488
- C:\Windows\System\pqPFNuO.exe
  C:\Windows\System\pqPFNuO.exe
  2⤵
  PID:6504
- C:\Windows\System\UzNMLQB.exe
  C:\Windows\System\UzNMLQB.exe
  2⤵
  PID:6520
- C:\Windows\System\PXwsClp.exe
  C:\Windows\System\PXwsClp.exe
  2⤵
  PID:6536
- C:\Windows\System\zzwGUJD.exe
  C:\Windows\System\zzwGUJD.exe
  2⤵
  PID:6552
- C:\Windows\System\IlUwsEv.exe
  C:\Windows\System\IlUwsEv.exe
  2⤵
  PID:6568
- C:\Windows\System\mBcSUfn.exe
  C:\Windows\System\mBcSUfn.exe
  2⤵
  PID:6584
- C:\Windows\System\KtNOUDV.exe
  C:\Windows\System\KtNOUDV.exe
  2⤵
  PID:6600
- C:\Windows\System\EYcpvhy.exe
  C:\Windows\System\EYcpvhy.exe
  2⤵
  PID:6616
- C:\Windows\System\ELwBXnB.exe
  C:\Windows\System\ELwBXnB.exe
  2⤵
  PID:6632
- C:\Windows\System\BjdPQMp.exe
  C:\Windows\System\BjdPQMp.exe
  2⤵
  PID:6652
- C:\Windows\System\vbSIzOz.exe
  C:\Windows\System\vbSIzOz.exe
  2⤵
  PID:6668
- C:\Windows\System\xMavSHl.exe
  C:\Windows\System\xMavSHl.exe
  2⤵
  PID:6684
- C:\Windows\System\ZEneALO.exe
  C:\Windows\System\ZEneALO.exe
  2⤵
  PID:6700
- C:\Windows\System\sKBcITj.exe
  C:\Windows\System\sKBcITj.exe
  2⤵
  PID:6716
- C:\Windows\System\rnBgcVi.exe
  C:\Windows\System\rnBgcVi.exe
  2⤵
  PID:6732
- C:\Windows\System\KqDnnTi.exe
  C:\Windows\System\KqDnnTi.exe
  2⤵
  PID:6748
- C:\Windows\System\TuxFfBk.exe
  C:\Windows\System\TuxFfBk.exe
  2⤵
  PID:6764
- C:\Windows\System\kISfMtk.exe
  C:\Windows\System\kISfMtk.exe
  2⤵
  PID:6780
- C:\Windows\System\ajEBlcj.exe
  C:\Windows\System\ajEBlcj.exe
  2⤵
  PID:6796
- C:\Windows\System\jfUQEjX.exe
  C:\Windows\System\jfUQEjX.exe
  2⤵
  PID:6812
- C:\Windows\System\dBKavrw.exe
  C:\Windows\System\dBKavrw.exe
  2⤵
  PID:6828
- C:\Windows\System\ykhKGIk.exe
  C:\Windows\System\ykhKGIk.exe
  2⤵
  PID:6844
- C:\Windows\System\MIuMFEB.exe
  C:\Windows\System\MIuMFEB.exe
  2⤵
  PID:6860
- C:\Windows\System\hijLVTP.exe
  C:\Windows\System\hijLVTP.exe
  2⤵
  PID:6876
- C:\Windows\System\EfNZKKv.exe
  C:\Windows\System\EfNZKKv.exe
  2⤵
  PID:6892
- C:\Windows\System\rYhmPjS.exe
  C:\Windows\System\rYhmPjS.exe
  2⤵
  PID:6912
- C:\Windows\System\ovnQLKL.exe
  C:\Windows\System\ovnQLKL.exe
  2⤵
  PID:6928
- C:\Windows\System\lomqCEJ.exe
  C:\Windows\System\lomqCEJ.exe
  2⤵
  PID:6944
- C:\Windows\System\xqzfCas.exe
  C:\Windows\System\xqzfCas.exe
  2⤵
  PID:6960
- C:\Windows\System\EXVpoxg.exe
  C:\Windows\System\EXVpoxg.exe
  2⤵
  PID:6976
- C:\Windows\System\SPEKcFb.exe
  C:\Windows\System\SPEKcFb.exe
  2⤵
  PID:6992
- C:\Windows\System\UvCfmQq.exe
  C:\Windows\System\UvCfmQq.exe
  2⤵
  PID:7008
- C:\Windows\System\gyesUMB.exe
  C:\Windows\System\gyesUMB.exe
  2⤵
  PID:7024
- C:\Windows\System\YHtrJxW.exe
  C:\Windows\System\YHtrJxW.exe
  2⤵
  PID:7040
- C:\Windows\System\bKjGjlR.exe
  C:\Windows\System\bKjGjlR.exe
  2⤵
  PID:7056
- C:\Windows\System\lfwZwkn.exe
  C:\Windows\System\lfwZwkn.exe
  2⤵
  PID:7072
- C:\Windows\System\AobqMEJ.exe
  C:\Windows\System\AobqMEJ.exe
  2⤵
  PID:7088
- C:\Windows\System\RgGuruc.exe
  C:\Windows\System\RgGuruc.exe
  2⤵
  PID:7104
- C:\Windows\System\TzCUgSI.exe
  C:\Windows\System\TzCUgSI.exe
  2⤵
  PID:7120
- C:\Windows\System\nkWkuTk.exe
  C:\Windows\System\nkWkuTk.exe
  2⤵
  PID:7136
- C:\Windows\System\AymkcPB.exe
  C:\Windows\System\AymkcPB.exe
  2⤵
  PID:7152
- C:\Windows\System\TLuFYlq.exe
  C:\Windows\System\TLuFYlq.exe
  2⤵
  PID:5988
- C:\Windows\System\xGavJHl.exe
  C:\Windows\System\xGavJHl.exe
  2⤵
  PID:5364
- C:\Windows\System\aRtZfDA.exe
  C:\Windows\System\aRtZfDA.exe
  2⤵
  PID:6208
- C:\Windows\System\OGsLgre.exe
  C:\Windows\System\OGsLgre.exe
  2⤵
  PID:6236
- C:\Windows\System\GdzCirR.exe
  C:\Windows\System\GdzCirR.exe
  2⤵
  PID:6160
- C:\Windows\System\GeUZMlm.exe
  C:\Windows\System\GeUZMlm.exe
  2⤵
  PID:6252
- C:\Windows\System\iXZduMN.exe
  C:\Windows\System\iXZduMN.exe
  2⤵
  PID:6300
- C:\Windows\System\DoJhqqw.exe
  C:\Windows\System\DoJhqqw.exe
  2⤵
  PID:6288
- C:\Windows\System\TeLTfvs.exe
  C:\Windows\System\TeLTfvs.exe
  2⤵
  PID:6340
- C:\Windows\System\iyTLkzU.exe
  C:\Windows\System\iyTLkzU.exe
  2⤵
  PID:6404
- C:\Windows\System\tdzwrQc.exe
  C:\Windows\System\tdzwrQc.exe
  2⤵
  PID:6384
- C:\Windows\System\rHNwTXC.exe
  C:\Windows\System\rHNwTXC.exe
  2⤵
  PID:6496
- C:\Windows\System\oxifXat.exe
  C:\Windows\System\oxifXat.exe
  2⤵
  PID:6352
- C:\Windows\System\aPfVyEF.exe
  C:\Windows\System\aPfVyEF.exe
  2⤵
  PID:6532
- C:\Windows\System\kmOrfkw.exe
  C:\Windows\System\kmOrfkw.exe
  2⤵
  PID:6560
- C:\Windows\System\nEmMqyr.exe
  C:\Windows\System\nEmMqyr.exe
  2⤵
  PID:6564
- C:\Windows\System\QXRNWMT.exe
  C:\Windows\System\QXRNWMT.exe
  2⤵
  PID:6624
- C:\Windows\System\ySMfVFg.exe
  C:\Windows\System\ySMfVFg.exe
  2⤵
  PID:6612
- C:\Windows\System\TfqgDLp.exe
  C:\Windows\System\TfqgDLp.exe
  2⤵
  PID:6676
- C:\Windows\System\DWEKXqt.exe
  C:\Windows\System\DWEKXqt.exe
  2⤵
  PID:6744
- C:\Windows\System\ENqIalu.exe
  C:\Windows\System\ENqIalu.exe
  2⤵
  PID:6728
- C:\Windows\System\KNyIMGk.exe
  C:\Windows\System\KNyIMGk.exe
  2⤵
  PID:6792
- C:\Windows\System\wgNikMC.exe
  C:\Windows\System\wgNikMC.exe
  2⤵
  PID:6772
- C:\Windows\System\LSGZYiX.exe
  C:\Windows\System\LSGZYiX.exe
  2⤵
  PID:6852
- C:\Windows\System\bLmTDHm.exe
  C:\Windows\System\bLmTDHm.exe
  2⤵
  PID:6840
- C:\Windows\System\IlgVYVP.exe
  C:\Windows\System\IlgVYVP.exe
  2⤵
  PID:6900
- C:\Windows\System\UdDDYam.exe
  C:\Windows\System\UdDDYam.exe
  2⤵
  PID:6968
- C:\Windows\System\UaFcPqN.exe
  C:\Windows\System\UaFcPqN.exe
  2⤵
  PID:7016
- C:\Windows\System\ghWVZPh.exe
  C:\Windows\System\ghWVZPh.exe
  2⤵
  PID:7080
- C:\Windows\System\RKucAUV.exe
  C:\Windows\System\RKucAUV.exe
  2⤵
  PID:7112
- C:\Windows\System\YcMVRnb.exe
  C:\Windows\System\YcMVRnb.exe
  2⤵
  PID:7064
- C:\Windows\System\fCWZsEC.exe
  C:\Windows\System\fCWZsEC.exe
  2⤵
  PID:7144
- C:\Windows\System\yvIDcKG.exe
  C:\Windows\System\yvIDcKG.exe
  2⤵
  PID:7164
- C:\Windows\System\awzBRXP.exe
  C:\Windows\System\awzBRXP.exe
  2⤵
  PID:1620
- C:\Windows\System\auWkWSH.exe
  C:\Windows\System\auWkWSH.exe
  2⤵
  PID:6240
- C:\Windows\System\TQNpjTN.exe
  C:\Windows\System\TQNpjTN.exe
  2⤵
  PID:6272
- C:\Windows\System\zhXkZEy.exe
  C:\Windows\System\zhXkZEy.exe
  2⤵
  PID:5956
- C:\Windows\System\lmZcfXv.exe
  C:\Windows\System\lmZcfXv.exe
  2⤵
  PID:6500
- C:\Windows\System\pVBRGfu.exe
  C:\Windows\System\pVBRGfu.exe
  2⤵
  PID:6528
- C:\Windows\System\QzbDsNy.exe
  C:\Windows\System\QzbDsNy.exe
  2⤵
  PID:6484
- C:\Windows\System\GSEeZTA.exe
  C:\Windows\System\GSEeZTA.exe
  2⤵
  PID:6904
- C:\Windows\System\LLutxbZ.exe
  C:\Windows\System\LLutxbZ.exe
  2⤵
  PID:6640
- C:\Windows\System\yoASZlB.exe
  C:\Windows\System\yoASZlB.exe
  2⤵
  PID:6824
- C:\Windows\System\TukApRz.exe
  C:\Windows\System\TukApRz.exe
  2⤵
  PID:6920
- C:\Windows\System\ymAKbFN.exe
  C:\Windows\System\ymAKbFN.exe
  2⤵
  PID:6804
- C:\Windows\System\WukjMHt.exe
  C:\Windows\System\WukjMHt.exe
  2⤵
  PID:6924
- C:\Windows\System\cgrRXfU.exe
  C:\Windows\System\cgrRXfU.exe
  2⤵
  PID:7000
- C:\Windows\System\ssybqJq.exe
  C:\Windows\System\ssybqJq.exe
  2⤵
  PID:6176
- C:\Windows\System\wqXVnnB.exe
  C:\Windows\System\wqXVnnB.exe
  2⤵
  PID:6192
- C:\Windows\System\ZdsYOtW.exe
  C:\Windows\System\ZdsYOtW.exe
  2⤵
  PID:7048
- C:\Windows\System\RepOgFv.exe
  C:\Windows\System\RepOgFv.exe
  2⤵
  PID:6204
- C:\Windows\System\hjGMmAy.exe
  C:\Windows\System\hjGMmAy.exe
  2⤵
  PID:6320
- C:\Windows\System\IiOmMuh.exe
  C:\Windows\System\IiOmMuh.exe
  2⤵
  PID:6468
- C:\Windows\System\XaRHUns.exe
  C:\Windows\System\XaRHUns.exe
  2⤵
  PID:6664
- C:\Windows\System\LNSIAjn.exe
  C:\Windows\System\LNSIAjn.exe
  2⤵
  PID:6596
- C:\Windows\System\UibOikR.exe
  C:\Windows\System\UibOikR.exe
  2⤵
  PID:6416
- C:\Windows\System\lWoofwq.exe
  C:\Windows\System\lWoofwq.exe
  2⤵
  PID:6988
- C:\Windows\System\JnYMDZh.exe
  C:\Windows\System\JnYMDZh.exe
  2⤵
  PID:6516
- C:\Windows\System\kSPaVsv.exe
  C:\Windows\System\kSPaVsv.exe
  2⤵
  PID:6608
- C:\Windows\System\ZLeHkRB.exe
  C:\Windows\System\ZLeHkRB.exe
  2⤵
  PID:7148
- C:\Windows\System\idkXUWG.exe
  C:\Windows\System\idkXUWG.exe
  2⤵
  PID:6692
- C:\Windows\System\UXwnnoX.exe
  C:\Windows\System\UXwnnoX.exe
  2⤵
  PID:7184
- C:\Windows\System\jkRbfXF.exe
  C:\Windows\System\jkRbfXF.exe
  2⤵
  PID:7204
- C:\Windows\System\bagPRiP.exe
  C:\Windows\System\bagPRiP.exe
  2⤵
  PID:7224
- C:\Windows\System\ztKdlhQ.exe
  C:\Windows\System\ztKdlhQ.exe
  2⤵
  PID:7248
- C:\Windows\System\qnWLTax.exe
  C:\Windows\System\qnWLTax.exe
  2⤵
  PID:7264
- C:\Windows\System\YGsJNmZ.exe
  C:\Windows\System\YGsJNmZ.exe
  2⤵
  PID:7280
- C:\Windows\System\qjlhush.exe
  C:\Windows\System\qjlhush.exe
  2⤵
  PID:7296
- C:\Windows\System\NTHPJzO.exe
  C:\Windows\System\NTHPJzO.exe
  2⤵
  PID:7312
- C:\Windows\System\UrQJjOI.exe
  C:\Windows\System\UrQJjOI.exe
  2⤵
  PID:7328
- C:\Windows\System\eZAzvbD.exe
  C:\Windows\System\eZAzvbD.exe
  2⤵
  PID:7344
- C:\Windows\System\egEdKzp.exe
  C:\Windows\System\egEdKzp.exe
  2⤵
  PID:7364
- C:\Windows\System\hwbPixG.exe
  C:\Windows\System\hwbPixG.exe
  2⤵
  PID:7380
- C:\Windows\System\ixOAJZc.exe
  C:\Windows\System\ixOAJZc.exe
  2⤵
  PID:7396
- C:\Windows\System\UQrDlob.exe
  C:\Windows\System\UQrDlob.exe
  2⤵
  PID:7412
- C:\Windows\System\FSDOPtA.exe
  C:\Windows\System\FSDOPtA.exe
  2⤵
  PID:7428
- C:\Windows\System\yHlXAFn.exe
  C:\Windows\System\yHlXAFn.exe
  2⤵
  PID:7444
- C:\Windows\System\WEzmXmQ.exe
  C:\Windows\System\WEzmXmQ.exe
  2⤵
  PID:7460
- C:\Windows\System\GspIZdY.exe
  C:\Windows\System\GspIZdY.exe
  2⤵
  PID:7476
- C:\Windows\System\XDDjabD.exe
  C:\Windows\System\XDDjabD.exe
  2⤵
  PID:7492
- C:\Windows\System\ZOQPWCu.exe
  C:\Windows\System\ZOQPWCu.exe
  2⤵
  PID:7508
- C:\Windows\System\doRSQFD.exe
  C:\Windows\System\doRSQFD.exe
  2⤵
  PID:7528
- C:\Windows\System\VoyKYUG.exe
  C:\Windows\System\VoyKYUG.exe
  2⤵
  PID:7544
- C:\Windows\System\NneyeBk.exe
  C:\Windows\System\NneyeBk.exe
  2⤵
  PID:7560
- C:\Windows\System\QLhioCR.exe
  C:\Windows\System\QLhioCR.exe
  2⤵
  PID:7576
- C:\Windows\System\yWIZMrp.exe
  C:\Windows\System\yWIZMrp.exe
  2⤵
  PID:7592
- C:\Windows\System\vwJwuyI.exe
  C:\Windows\System\vwJwuyI.exe
  2⤵
  PID:7608
- C:\Windows\System\ItlVpue.exe
  C:\Windows\System\ItlVpue.exe
  2⤵
  PID:7624
- C:\Windows\System\SZnSUGR.exe
  C:\Windows\System\SZnSUGR.exe
  2⤵
  PID:7640
- C:\Windows\System\uYjbIcd.exe
  C:\Windows\System\uYjbIcd.exe
  2⤵
  PID:7656
- C:\Windows\System\TmDEeBb.exe
  C:\Windows\System\TmDEeBb.exe
  2⤵
  PID:7672
- C:\Windows\System\WDxeUTW.exe
  C:\Windows\System\WDxeUTW.exe
  2⤵
  PID:7696
- C:\Windows\System\PXbdVdU.exe
  C:\Windows\System\PXbdVdU.exe
  2⤵
  PID:7716
- C:\Windows\System\bCCQxem.exe
  C:\Windows\System\bCCQxem.exe
  2⤵
  PID:7732
- C:\Windows\System\yxhKVAt.exe
  C:\Windows\System\yxhKVAt.exe
  2⤵
  PID:7752
- C:\Windows\System\OEwEllV.exe
  C:\Windows\System\OEwEllV.exe
  2⤵
  PID:7772
- C:\Windows\System\mmgeOnQ.exe
  C:\Windows\System\mmgeOnQ.exe
  2⤵
  PID:7788
- C:\Windows\System\yxLBnLr.exe
  C:\Windows\System\yxLBnLr.exe
  2⤵
  PID:7804
- C:\Windows\System\NuvaaDe.exe
  C:\Windows\System\NuvaaDe.exe
  2⤵
  PID:7820
- C:\Windows\System\WhZaNWk.exe
  C:\Windows\System\WhZaNWk.exe
  2⤵
  PID:7836
- C:\Windows\System\aZzVFby.exe
  C:\Windows\System\aZzVFby.exe
  2⤵
  PID:7852
- C:\Windows\System\adGguOi.exe
  C:\Windows\System\adGguOi.exe
  2⤵
  PID:7868
- C:\Windows\System\GaYsRJz.exe
  C:\Windows\System\GaYsRJz.exe
  2⤵
  PID:7884
- C:\Windows\System\JLIJbfq.exe
  C:\Windows\System\JLIJbfq.exe
  2⤵
  PID:7900
- C:\Windows\System\WbNQWhG.exe
  C:\Windows\System\WbNQWhG.exe
  2⤵
  PID:7916
- C:\Windows\System\skyWPtD.exe
  C:\Windows\System\skyWPtD.exe
  2⤵
  PID:7932
- C:\Windows\System\VkMIkQm.exe
  C:\Windows\System\VkMIkQm.exe
  2⤵
  PID:7948
- C:\Windows\System\evDHavT.exe
  C:\Windows\System\evDHavT.exe
  2⤵
  PID:7964
- C:\Windows\System\QglZIpy.exe
  C:\Windows\System\QglZIpy.exe
  2⤵
  PID:7980
- C:\Windows\System\gXWunaL.exe
  C:\Windows\System\gXWunaL.exe
  2⤵
  PID:7996
- C:\Windows\System\QOxlAWk.exe
  C:\Windows\System\QOxlAWk.exe
  2⤵
  PID:8012
- C:\Windows\System\QMTCnsX.exe
  C:\Windows\System\QMTCnsX.exe
  2⤵
  PID:8028
- C:\Windows\System\tbGYfrt.exe
  C:\Windows\System\tbGYfrt.exe
  2⤵
  PID:8044
- C:\Windows\System\bQIltaS.exe
  C:\Windows\System\bQIltaS.exe
  2⤵
  PID:8060
- C:\Windows\System\FLTtvCz.exe
  C:\Windows\System\FLTtvCz.exe
  2⤵
  PID:8076
- C:\Windows\System\iWDDhIZ.exe
  C:\Windows\System\iWDDhIZ.exe
  2⤵
  PID:8092
- C:\Windows\System\hmSJQFe.exe
  C:\Windows\System\hmSJQFe.exe
  2⤵
  PID:8108
- C:\Windows\System\bYDwUma.exe
  C:\Windows\System\bYDwUma.exe
  2⤵
  PID:8124
- C:\Windows\System\jzXXQsb.exe
  C:\Windows\System\jzXXQsb.exe
  2⤵
  PID:8140
- C:\Windows\System\ekUkNUv.exe
  C:\Windows\System\ekUkNUv.exe
  2⤵
  PID:8156
- C:\Windows\System\BUPgPIc.exe
  C:\Windows\System\BUPgPIc.exe
  2⤵
  PID:8172
- C:\Windows\System\kcsLZwN.exe
  C:\Windows\System\kcsLZwN.exe
  2⤵
  PID:8188
- C:\Windows\System\PImbTVW.exe
  C:\Windows\System\PImbTVW.exe
  2⤵
  PID:6788
- C:\Windows\System\fyvuXRI.exe
  C:\Windows\System\fyvuXRI.exe
  2⤵
  PID:7068
- C:\Windows\System\TeEmEmV.exe
  C:\Windows\System\TeEmEmV.exe
  2⤵
  PID:7176
- C:\Windows\System\vOqdyiz.exe
  C:\Windows\System\vOqdyiz.exe
  2⤵
  PID:7196
- C:\Windows\System\fqCDHGj.exe
  C:\Windows\System\fqCDHGj.exe
  2⤵
  PID:7216
- C:\Windows\System\NpymzeY.exe
  C:\Windows\System\NpymzeY.exe
  2⤵
  PID:7256
- C:\Windows\System\mxeAzpM.exe
  C:\Windows\System\mxeAzpM.exe
  2⤵
  PID:7320
- C:\Windows\System\BthhJzy.exe
  C:\Windows\System\BthhJzy.exe
  2⤵
  PID:7244
- C:\Windows\System\dxuclbT.exe
  C:\Windows\System\dxuclbT.exe
  2⤵
  PID:7356
- C:\Windows\System\LYpsYMF.exe
  C:\Windows\System\LYpsYMF.exe
  2⤵
  PID:7304
- C:\Windows\System\VJouCVU.exe
  C:\Windows\System\VJouCVU.exe
  2⤵
  PID:7456
- C:\Windows\System\ZLltILk.exe
  C:\Windows\System\ZLltILk.exe
  2⤵
  PID:7488
- C:\Windows\System\onJzItW.exe
  C:\Windows\System\onJzItW.exe
  2⤵
  PID:7472
- C:\Windows\System\sHTorgE.exe
  C:\Windows\System\sHTorgE.exe
  2⤵
  PID:7540
- C:\Windows\System\PgOsGvz.exe
  C:\Windows\System\PgOsGvz.exe
  2⤵
  PID:7616
- C:\Windows\System\EtjTaao.exe
  C:\Windows\System\EtjTaao.exe
  2⤵
  PID:7500
- C:\Windows\System\RNPghVV.exe
  C:\Windows\System\RNPghVV.exe
  2⤵
  PID:7568
- C:\Windows\System\ERTWyqB.exe
  C:\Windows\System\ERTWyqB.exe
  2⤵
  PID:7632
- C:\Windows\System\qJdogCI.exe
  C:\Windows\System\qJdogCI.exe
  2⤵
  PID:7680
- C:\Windows\System\dEvKZON.exe
  C:\Windows\System\dEvKZON.exe
  2⤵
  PID:7724
- C:\Windows\System\lqvOSdg.exe
  C:\Windows\System\lqvOSdg.exe
  2⤵
  PID:7760
- C:\Windows\System\mHYVfxZ.exe
  C:\Windows\System\mHYVfxZ.exe
  2⤵
  PID:7796
- C:\Windows\System\hwuyDcE.exe
  C:\Windows\System\hwuyDcE.exe
  2⤵
  PID:7740
- C:\Windows\System\abkKOcC.exe
  C:\Windows\System\abkKOcC.exe
  2⤵
  PID:7832
- C:\Windows\System\dAfLJSa.exe
  C:\Windows\System\dAfLJSa.exe
  2⤵
  PID:7864
- C:\Windows\System\BSqclra.exe
  C:\Windows\System\BSqclra.exe
  2⤵
  PID:7924
- C:\Windows\System\KlqFeBo.exe
  C:\Windows\System\KlqFeBo.exe
  2⤵
  PID:7880
- C:\Windows\System\pJJuFAd.exe
  C:\Windows\System\pJJuFAd.exe
  2⤵
  PID:7992
- C:\Windows\System\EpDDIOf.exe
  C:\Windows\System\EpDDIOf.exe
  2⤵
  PID:8024
- C:\Windows\System\QuBEKWg.exe
  C:\Windows\System\QuBEKWg.exe
  2⤵
  PID:8036
- C:\Windows\System\gSNEzFv.exe
  C:\Windows\System\gSNEzFv.exe
  2⤵
  PID:8100
- C:\Windows\System\mIrbICr.exe
  C:\Windows\System\mIrbICr.exe
  2⤵
  PID:8120
- C:\Windows\System\pRCVswr.exe
  C:\Windows\System\pRCVswr.exe
  2⤵
  PID:8152
- C:\Windows\System\AFDqReo.exe
  C:\Windows\System\AFDqReo.exe
  2⤵
  PID:5668
- C:\Windows\System\fUWTotW.exe
  C:\Windows\System\fUWTotW.exe
  2⤵
  PID:6956
- C:\Windows\System\AwqRfFi.exe
  C:\Windows\System\AwqRfFi.exe
  2⤵
  PID:7192
- C:\Windows\System\lbFhpgW.exe
  C:\Windows\System\lbFhpgW.exe
  2⤵
  PID:7240
- C:\Windows\System\sIGPMXj.exe
  C:\Windows\System\sIGPMXj.exe
  2⤵
  PID:7288
- C:\Windows\System\ZsUKIeB.exe
  C:\Windows\System\ZsUKIeB.exe
  2⤵
  PID:7392
- C:\Windows\System\frQNwNg.exe
  C:\Windows\System\frQNwNg.exe
  2⤵
  PID:7308
- C:\Windows\System\YMPfEQQ.exe
  C:\Windows\System\YMPfEQQ.exe
  2⤵
  PID:7468
- C:\Windows\System\eXAcfbP.exe
  C:\Windows\System\eXAcfbP.exe
  2⤵
  PID:7620
- C:\Windows\System\HiZQktl.exe
  C:\Windows\System\HiZQktl.exe
  2⤵
  PID:7588
- C:\Windows\System\rqyXHhH.exe
  C:\Windows\System\rqyXHhH.exe
  2⤵
  PID:7652
- C:\Windows\System\omeZTCk.exe
  C:\Windows\System\omeZTCk.exe
  2⤵
  PID:5180
- C:\Windows\System\lRJyXAQ.exe
  C:\Windows\System\lRJyXAQ.exe
  2⤵
  PID:7892
- C:\Windows\System\ibOmxoq.exe
  C:\Windows\System\ibOmxoq.exe
  2⤵
  PID:7784
- C:\Windows\System\bWIRtlV.exe
  C:\Windows\System\bWIRtlV.exe
  2⤵
  PID:7860
- C:\Windows\System\SjAmgDF.exe
  C:\Windows\System\SjAmgDF.exe
  2⤵
  PID:7944
- C:\Windows\System\hRogPjS.exe
  C:\Windows\System\hRogPjS.exe
  2⤵
  PID:8088
- C:\Windows\System\GnIVQvY.exe
  C:\Windows\System\GnIVQvY.exe
  2⤵
  PID:8004
- C:\Windows\System\ZCNIoOH.exe
  C:\Windows\System\ZCNIoOH.exe
  2⤵
  PID:8164
- C:\Windows\System\FZaDxPp.exe
  C:\Windows\System\FZaDxPp.exe
  2⤵
  PID:8020
- C:\Windows\System\qelkwEG.exe
  C:\Windows\System\qelkwEG.exe
  2⤵
  PID:7236
- C:\Windows\System\VypGJXP.exe
  C:\Windows\System\VypGJXP.exe
  2⤵
  PID:8132
- C:\Windows\System\bTGQDKZ.exe
  C:\Windows\System\bTGQDKZ.exe
  2⤵
  PID:7408
- C:\Windows\System\HaKwjMi.exe
  C:\Windows\System\HaKwjMi.exe
  2⤵
  PID:7556
- C:\Windows\System\EwWgHTT.exe
  C:\Windows\System\EwWgHTT.exe
  2⤵
  PID:7484
- C:\Windows\System\nbwamAb.exe
  C:\Windows\System\nbwamAb.exe
  2⤵
  PID:7708
- C:\Windows\System\epMcCqD.exe
  C:\Windows\System\epMcCqD.exe
  2⤵
  PID:7928
- C:\Windows\System\xievHAM.exe
  C:\Windows\System\xievHAM.exe
  2⤵
  PID:8056
- C:\Windows\System\EkKFFZk.exe
  C:\Windows\System\EkKFFZk.exe
  2⤵
  PID:7160
- C:\Windows\System\BQnUgrJ.exe
  C:\Windows\System\BQnUgrJ.exe
  2⤵
  PID:8008
- C:\Windows\System\QChoeBC.exe
  C:\Windows\System\QChoeBC.exe
  2⤵
  PID:8068
- C:\Windows\System\BkZjeKS.exe
  C:\Windows\System\BkZjeKS.exe
  2⤵
  PID:7604
- C:\Windows\System\GGaCuLA.exe
  C:\Windows\System\GGaCuLA.exe
  2⤵
  PID:8184
- C:\Windows\System\mtqnbMT.exe
  C:\Windows\System\mtqnbMT.exe
  2⤵
  PID:7896
- C:\Windows\System\SENbLRy.exe
  C:\Windows\System\SENbLRy.exe
  2⤵
  PID:7584
- C:\Windows\System\RoYlymM.exe
  C:\Windows\System\RoYlymM.exe
  2⤵
  PID:7912
- C:\Windows\System\mbYJKmy.exe
  C:\Windows\System\mbYJKmy.exe
  2⤵
  PID:8196
- C:\Windows\System\VQyHiWO.exe
  C:\Windows\System\VQyHiWO.exe
  2⤵
  PID:8212
- C:\Windows\System\xXBxpjW.exe
  C:\Windows\System\xXBxpjW.exe
  2⤵
  PID:8228
- C:\Windows\System\pvxWxAA.exe
  C:\Windows\System\pvxWxAA.exe
  2⤵
  PID:8244
- C:\Windows\System\iuythjY.exe
  C:\Windows\System\iuythjY.exe
  2⤵
  PID:8260
- C:\Windows\System\nIXCSuZ.exe
  C:\Windows\System\nIXCSuZ.exe
  2⤵
  PID:8276
- C:\Windows\System\ctmspNu.exe
  C:\Windows\System\ctmspNu.exe
  2⤵
  PID:8292
- C:\Windows\System\aXcVvdd.exe
  C:\Windows\System\aXcVvdd.exe
  2⤵
  PID:8308
- C:\Windows\System\KIPnSDh.exe
  C:\Windows\System\KIPnSDh.exe
  2⤵
  PID:8324
- C:\Windows\System\JzaLfmS.exe
  C:\Windows\System\JzaLfmS.exe
  2⤵
  PID:8352
- C:\Windows\System\kJiXZOk.exe
  C:\Windows\System\kJiXZOk.exe
  2⤵
  PID:8372
- C:\Windows\System\iFsKNet.exe
  C:\Windows\System\iFsKNet.exe
  2⤵
  PID:8392
- C:\Windows\System\FuqsUJj.exe
  C:\Windows\System\FuqsUJj.exe
  2⤵
  PID:8412
- C:\Windows\System\bNcjINe.exe
  C:\Windows\System\bNcjINe.exe
  2⤵
  PID:8428
- C:\Windows\System\wPUeACM.exe
  C:\Windows\System\wPUeACM.exe
  2⤵
  PID:8444
- C:\Windows\System\NlKauEZ.exe
  C:\Windows\System\NlKauEZ.exe
  2⤵
  PID:8468
- C:\Windows\System\wnxGeHZ.exe
  C:\Windows\System\wnxGeHZ.exe
  2⤵
  PID:8488
- C:\Windows\System\YINAKvs.exe
  C:\Windows\System\YINAKvs.exe
  2⤵
  PID:8504
- C:\Windows\System\QLNkLZi.exe
  C:\Windows\System\QLNkLZi.exe
  2⤵
  PID:8520
- C:\Windows\System\RLbzwoT.exe
  C:\Windows\System\RLbzwoT.exe
  2⤵
  PID:8536
- C:\Windows\System\qdsXTrI.exe
  C:\Windows\System\qdsXTrI.exe
  2⤵
  PID:8552
- C:\Windows\System\wARzSLg.exe
  C:\Windows\System\wARzSLg.exe
  2⤵
  PID:8568
- C:\Windows\System\ErzWoCr.exe
  C:\Windows\System\ErzWoCr.exe
  2⤵
  PID:8584
- C:\Windows\System\WCkkBlC.exe
  C:\Windows\System\WCkkBlC.exe
  2⤵
  PID:8600
- C:\Windows\System\byUzNAH.exe
  C:\Windows\System\byUzNAH.exe
  2⤵
  PID:8616
- C:\Windows\System\ZaWVGSO.exe
  C:\Windows\System\ZaWVGSO.exe
  2⤵
  PID:8632
- C:\Windows\System\ecqhrHd.exe
  C:\Windows\System\ecqhrHd.exe
  2⤵
  PID:8648
- C:\Windows\System\nnJVkEk.exe
  C:\Windows\System\nnJVkEk.exe
  2⤵
  PID:8668
- C:\Windows\System\ETPzVEV.exe
  C:\Windows\System\ETPzVEV.exe
  2⤵
  PID:8684
- C:\Windows\System\IzPiTph.exe
  C:\Windows\System\IzPiTph.exe
  2⤵
  PID:8700
- C:\Windows\System\QhvVzQL.exe
  C:\Windows\System\QhvVzQL.exe
  2⤵
  PID:8720
- C:\Windows\System\dVHeYGY.exe
  C:\Windows\System\dVHeYGY.exe
  2⤵
  PID:8736
- C:\Windows\System\QPYaTSS.exe
  C:\Windows\System\QPYaTSS.exe
  2⤵
  PID:8756
- C:\Windows\System\XErZgpQ.exe
  C:\Windows\System\XErZgpQ.exe
  2⤵
  PID:8776
- C:\Windows\System\dqIYMyk.exe
  C:\Windows\System\dqIYMyk.exe
  2⤵
  PID:8792
- C:\Windows\System\WiArTNc.exe
  C:\Windows\System\WiArTNc.exe
  2⤵
  PID:8808
- C:\Windows\System\DlhvXPP.exe
  C:\Windows\System\DlhvXPP.exe
  2⤵
  PID:8824
- C:\Windows\System\BbmBmZI.exe
  C:\Windows\System\BbmBmZI.exe
  2⤵
  PID:8840
- C:\Windows\System\ClPPFmu.exe
  C:\Windows\System\ClPPFmu.exe
  2⤵
  PID:8856
- C:\Windows\System\boynYud.exe
  C:\Windows\System\boynYud.exe
  2⤵
  PID:8872
- C:\Windows\System\YxfrIjQ.exe
  C:\Windows\System\YxfrIjQ.exe
  2⤵
  PID:8888
- C:\Windows\System\IdMMwjI.exe
  C:\Windows\System\IdMMwjI.exe
  2⤵
  PID:8904
- C:\Windows\System\SlMWqEX.exe
  C:\Windows\System\SlMWqEX.exe
  2⤵
  PID:8920
- C:\Windows\System\ycdrNPq.exe
  C:\Windows\System\ycdrNPq.exe
  2⤵
  PID:8936
- C:\Windows\System\CIQraRq.exe
  C:\Windows\System\CIQraRq.exe
  2⤵
  PID:8952
- C:\Windows\System\uXWDQEm.exe
  C:\Windows\System\uXWDQEm.exe
  2⤵
  PID:8968
- C:\Windows\System\RfzyByl.exe
  C:\Windows\System\RfzyByl.exe
  2⤵
  PID:8984
- C:\Windows\System\XsMqonF.exe
  C:\Windows\System\XsMqonF.exe
  2⤵
  PID:9000
- C:\Windows\System\QHyVLln.exe
  C:\Windows\System\QHyVLln.exe
  2⤵
  PID:9016
- C:\Windows\System\AEMcAtw.exe
  C:\Windows\System\AEMcAtw.exe
  2⤵
  PID:9032
- C:\Windows\System\XWrVoBB.exe
  C:\Windows\System\XWrVoBB.exe
  2⤵
  PID:9052
- C:\Windows\System\FIEiILy.exe
  C:\Windows\System\FIEiILy.exe
  2⤵
  PID:9068
- C:\Windows\System\XMryMpK.exe
  C:\Windows\System\XMryMpK.exe
  2⤵
  PID:9084
- C:\Windows\System\aFUMMFp.exe
  C:\Windows\System\aFUMMFp.exe
  2⤵
  PID:9100
- C:\Windows\System\UYuAlih.exe
  C:\Windows\System\UYuAlih.exe
  2⤵
  PID:9116
- C:\Windows\System\jWodGmZ.exe
  C:\Windows\System\jWodGmZ.exe
  2⤵
  PID:9132
- C:\Windows\System\xYjqSLm.exe
  C:\Windows\System\xYjqSLm.exe
  2⤵
  PID:9152
- C:\Windows\System\TzXEikT.exe
  C:\Windows\System\TzXEikT.exe
  2⤵
  PID:9168
- C:\Windows\System\xZxyzMu.exe
  C:\Windows\System\xZxyzMu.exe
  2⤵
  PID:9184
- C:\Windows\System\SvpvmAF.exe
  C:\Windows\System\SvpvmAF.exe
  2⤵
  PID:9200
- C:\Windows\System\eHvsbFA.exe
  C:\Windows\System\eHvsbFA.exe
  2⤵
  PID:7424
- C:\Windows\System\WXatoUe.exe
  C:\Windows\System\WXatoUe.exe
  2⤵
  PID:8204
- C:\Windows\System\rEXhttC.exe
  C:\Windows\System\rEXhttC.exe
  2⤵
  PID:8252
- C:\Windows\System\vGJoFCe.exe
  C:\Windows\System\vGJoFCe.exe
  2⤵
  PID:8288
- C:\Windows\System\nkmUiHf.exe
  C:\Windows\System\nkmUiHf.exe
  2⤵
  PID:8316
- C:\Windows\System\PaVyqDu.exe
  C:\Windows\System\PaVyqDu.exe
  2⤵
  PID:8332
- C:\Windows\System\SWYWpdz.exe
  C:\Windows\System\SWYWpdz.exe
  2⤵
  PID:8340
- C:\Windows\System\RQMhfKT.exe
  C:\Windows\System\RQMhfKT.exe
  2⤵
  PID:8384
- C:\Windows\System\dBOjtgc.exe
  C:\Windows\System\dBOjtgc.exe
  2⤵
  PID:8456
- C:\Windows\System\dUxfiir.exe
  C:\Windows\System\dUxfiir.exe
  2⤵
  PID:8528
- C:\Windows\System\LuKPjHq.exe
  C:\Windows\System\LuKPjHq.exe
  2⤵
  PID:8564
- C:\Windows\System\WGNQxNQ.exe
  C:\Windows\System\WGNQxNQ.exe
  2⤵
  PID:8464
- C:\Windows\System\yESClNs.exe
  C:\Windows\System\yESClNs.exe
  2⤵
  PID:8408
- C:\Windows\System\RZFXZSw.exe
  C:\Windows\System\RZFXZSw.exe
  2⤵
  PID:8480
- C:\Windows\System\oSbwbQl.exe
  C:\Windows\System\oSbwbQl.exe
  2⤵
  PID:8544
- C:\Windows\System\eUYfuEn.exe
  C:\Windows\System\eUYfuEn.exe
  2⤵
  PID:8608
- C:\Windows\System\uLTAhrx.exe
  C:\Windows\System\uLTAhrx.exe
  2⤵
  PID:8676
- C:\Windows\System\ypQcbEc.exe
  C:\Windows\System\ypQcbEc.exe
  2⤵
  PID:8656
- C:\Windows\System\NMwasrx.exe
  C:\Windows\System\NMwasrx.exe
  2⤵
  PID:8696
- C:\Windows\System\qNMMhBu.exe
  C:\Windows\System\qNMMhBu.exe
  2⤵
  PID:8748
- C:\Windows\System\VNLcxuD.exe
  C:\Windows\System\VNLcxuD.exe
  2⤵
  PID:8784
- C:\Windows\System\vMIpJXd.exe
  C:\Windows\System\vMIpJXd.exe
  2⤵
  PID:8820
- C:\Windows\System\gXUEEZN.exe
  C:\Windows\System\gXUEEZN.exe
  2⤵
  PID:9176
- C:\Windows\System\oMIEwLf.exe
  C:\Windows\System\oMIEwLf.exe
  2⤵
  PID:9160
- C:\Windows\System\wBwwsen.exe
  C:\Windows\System\wBwwsen.exe
  2⤵
  PID:8236
- C:\Windows\System\kcOmdDL.exe
  C:\Windows\System\kcOmdDL.exe
  2⤵
  PID:8268
- C:\Windows\System\qLRavdO.exe
  C:\Windows\System\qLRavdO.exe
  2⤵
  PID:8272
- C:\Windows\System\wsWvCrd.exe
  C:\Windows\System\wsWvCrd.exe
  2⤵
  PID:8320
- C:\Windows\System\dZUtlGt.exe
  C:\Windows\System\dZUtlGt.exe
  2⤵
  PID:8424
- C:\Windows\System\ZIIXLLQ.exe
  C:\Windows\System\ZIIXLLQ.exe
  2⤵
  PID:8592
- C:\Windows\System\ctnwtaA.exe
  C:\Windows\System\ctnwtaA.exe
  2⤵
  PID:8640
- C:\Windows\System\onZNEQU.exe
  C:\Windows\System\onZNEQU.exe
  2⤵
  PID:8496
- C:\Windows\System\RWtGcdX.exe
  C:\Windows\System\RWtGcdX.exe
  2⤵
  PID:8476
- C:\Windows\System\nuizUWo.exe
  C:\Windows\System\nuizUWo.exe
  2⤵
  PID:8800
- C:\Windows\System\DZLAPgL.exe
  C:\Windows\System\DZLAPgL.exe
  2⤵
  PID:8764
- C:\Windows\System\TbncNLO.exe
  C:\Windows\System\TbncNLO.exe
  2⤵
  PID:8460
- C:\Windows\System\wRHAEtg.exe
  C:\Windows\System\wRHAEtg.exe
  2⤵
  PID:9024
- C:\Windows\System\krDXNde.exe
  C:\Windows\System\krDXNde.exe
  2⤵
  PID:8976
- C:\Windows\System\ttmMwax.exe
  C:\Windows\System\ttmMwax.exe
  2⤵
  PID:8960
- C:\Windows\System\uBFPTnC.exe
  C:\Windows\System\uBFPTnC.exe
  2⤵
  PID:8992
- C:\Windows\System\lkjRHuW.exe
  C:\Windows\System\lkjRHuW.exe
  2⤵
  PID:9076
- C:\Windows\System\nlhAzEs.exe
  C:\Windows\System\nlhAzEs.exe
  2⤵
  PID:9096
- C:\Windows\System\QrkiICz.exe
  C:\Windows\System\QrkiICz.exe
  2⤵
  PID:8360
- C:\Windows\System\bKYQIdu.exe
  C:\Windows\System\bKYQIdu.exe
  2⤵
  PID:8948
- C:\Windows\System\qMZHOei.exe
  C:\Windows\System\qMZHOei.exe
  2⤵
  PID:7036
- C:\Windows\System\CSOllPA.exe
  C:\Windows\System\CSOllPA.exe
  2⤵
  PID:9316
- C:\Windows\System\zInhtuK.exe
  C:\Windows\System\zInhtuK.exe
  2⤵
  PID:9332
- C:\Windows\System\KMpkbDl.exe
  C:\Windows\System\KMpkbDl.exe
  2⤵
  PID:9348
- C:\Windows\System\truHRDi.exe
  C:\Windows\System\truHRDi.exe
  2⤵
  PID:9364
- C:\Windows\System\rLiausY.exe
  C:\Windows\System\rLiausY.exe
  2⤵
  PID:9380
- C:\Windows\System\UAKTQfl.exe
  C:\Windows\System\UAKTQfl.exe
  2⤵
  PID:9400
- C:\Windows\System\bkJOvCC.exe
  C:\Windows\System\bkJOvCC.exe
  2⤵
  PID:9416
- C:\Windows\System\xGzeHPO.exe
  C:\Windows\System\xGzeHPO.exe
  2⤵
  PID:9432
- C:\Windows\System\KETpBWv.exe
  C:\Windows\System\KETpBWv.exe
  2⤵
  PID:9448
- C:\Windows\System\RbdkoqI.exe
  C:\Windows\System\RbdkoqI.exe
  2⤵
  PID:9860
- C:\Windows\System\pxnAjCl.exe
  C:\Windows\System\pxnAjCl.exe
  2⤵
  PID:9944
- C:\Windows\System\QMaiVRI.exe
  C:\Windows\System\QMaiVRI.exe
  2⤵
  PID:9960
- C:\Windows\System\eHiwJJS.exe
  C:\Windows\System\eHiwJJS.exe
  2⤵
  PID:9980
- C:\Windows\System\JusMmHq.exe
  C:\Windows\System\JusMmHq.exe
  2⤵
  PID:9996
- C:\Windows\System\CWvZcIS.exe
  C:\Windows\System\CWvZcIS.exe
  2⤵
  PID:10012
- C:\Windows\System\pGZiNNf.exe
  C:\Windows\System\pGZiNNf.exe
  2⤵
  PID:10028
- C:\Windows\System\RlWDVpg.exe
  C:\Windows\System\RlWDVpg.exe
  2⤵
  PID:10044
- C:\Windows\System\bwfWHbC.exe
  C:\Windows\System\bwfWHbC.exe
  2⤵
  PID:10060
- C:\Windows\System\LNVPfHl.exe
  C:\Windows\System\LNVPfHl.exe
  2⤵
  PID:10076
- C:\Windows\System\MpKkcFI.exe
  C:\Windows\System\MpKkcFI.exe
  2⤵
  PID:2748
- C:\Windows\System\XbYxODp.exe
  C:\Windows\System\XbYxODp.exe
  2⤵
  PID:8380
- C:\Windows\System\YbajUJN.exe
  C:\Windows\System\YbajUJN.exe
  2⤵
  PID:9148
- C:\Windows\System\zlNdaYU.exe
  C:\Windows\System\zlNdaYU.exe
  2⤵
  PID:9108
- C:\Windows\System\GHVKABe.exe
  C:\Windows\System\GHVKABe.exe
  2⤵
  PID:8852
- C:\Windows\System\nuqsgZc.exe
  C:\Windows\System\nuqsgZc.exe
  2⤵
  PID:7728
- C:\Windows\System\XutZUyb.exe
  C:\Windows\System\XutZUyb.exe
  2⤵
  PID:8996
- C:\Windows\System\zbznBQJ.exe
  C:\Windows\System\zbznBQJ.exe
  2⤵
  PID:8884
- C:\Windows\System\eEErEIv.exe
  C:\Windows\System\eEErEIv.exe
  2⤵
  PID:9388
- C:\Windows\System\YkNqhgs.exe
  C:\Windows\System\YkNqhgs.exe
  2⤵
  PID:9424
- C:\Windows\System\RKzijCl.exe
  C:\Windows\System\RKzijCl.exe
  2⤵
  PID:8664
- C:\Windows\System\qncZXyv.exe
  C:\Windows\System\qncZXyv.exe
  2⤵
  PID:8516
- C:\Windows\System\GPWYKFB.exe
  C:\Windows\System\GPWYKFB.exe
  2⤵
  PID:8932
- C:\Windows\System\cdletST.exe
  C:\Windows\System\cdletST.exe
  2⤵
  PID:2404
- C:\Windows\System\pPLYBZF.exe
  C:\Windows\System\pPLYBZF.exe
  2⤵
  PID:2840
- C:\Windows\System\lltzxLP.exe
  C:\Windows\System\lltzxLP.exe
  2⤵
  PID:9488
- C:\Windows\System\tgGJikq.exe
  C:\Windows\System\tgGJikq.exe
  2⤵
  PID:9504
- C:\Windows\System\NpryhFV.exe
  C:\Windows\System\NpryhFV.exe
  2⤵
  PID:9524
- C:\Windows\System\ejVuZYF.exe
  C:\Windows\System\ejVuZYF.exe
  2⤵
  PID:9536
- C:\Windows\System\AFHMzVv.exe
  C:\Windows\System\AFHMzVv.exe
  2⤵
  PID:9552
- C:\Windows\System\WCclGaj.exe
  C:\Windows\System\WCclGaj.exe
  2⤵
  PID:9560
- C:\Windows\System\MBzzaPp.exe
  C:\Windows\System\MBzzaPp.exe
  2⤵
  PID:9408
- C:\Windows\System\ofBZgMZ.exe
  C:\Windows\System\ofBZgMZ.exe
  2⤵
  PID:9264
- C:\Windows\System\LwJTlXA.exe
  C:\Windows\System\LwJTlXA.exe
  2⤵
  PID:9280
- C:\Windows\System\XhSKgkK.exe
  C:\Windows\System\XhSKgkK.exe
  2⤵
  PID:9292
- C:\Windows\System\gVFzIin.exe
  C:\Windows\System\gVFzIin.exe
  2⤵
  PID:9244
- C:\Windows\System\CPzqAko.exe
  C:\Windows\System\CPzqAko.exe
  2⤵
  PID:9248
- C:\Windows\System\QzfvNEU.exe
  C:\Windows\System\QzfvNEU.exe
  2⤵
  PID:9300
- C:\Windows\System\fGIomIR.exe
  C:\Windows\System\fGIomIR.exe
  2⤵
  PID:9588
- C:\Windows\System\UlesQwQ.exe
  C:\Windows\System\UlesQwQ.exe
  2⤵
  PID:9616
- C:\Windows\System\SqCMTHy.exe
  C:\Windows\System\SqCMTHy.exe
  2⤵
  PID:9644
- C:\Windows\System\oCwNOdp.exe
  C:\Windows\System\oCwNOdp.exe
  2⤵
  PID:9648
- C:\Windows\System\XuWiqYp.exe
  C:\Windows\System\XuWiqYp.exe
  2⤵
  PID:9668
- C:\Windows\System\WWYmVDm.exe
  C:\Windows\System\WWYmVDm.exe
  2⤵
  PID:9684
- C:\Windows\System\aHIoFIV.exe
  C:\Windows\System\aHIoFIV.exe
  2⤵
  PID:9772
- C:\Windows\System\pTCISao.exe
  C:\Windows\System\pTCISao.exe
  2⤵
  PID:9716
- C:\Windows\System\fpRuqZg.exe
  C:\Windows\System\fpRuqZg.exe
  2⤵
  PID:9720
- C:\Windows\System\UYElvJh.exe
  C:\Windows\System\UYElvJh.exe
  2⤵
  PID:9736
- C:\Windows\System\hJeKSIO.exe
  C:\Windows\System\hJeKSIO.exe
  2⤵
  PID:9756
- C:\Windows\System\ukZfRev.exe
  C:\Windows\System\ukZfRev.exe
  2⤵
  PID:9784
- C:\Windows\System\MMgPtne.exe
  C:\Windows\System\MMgPtne.exe
  2⤵
  PID:9816
- C:\Windows\System\zgmcLmI.exe
  C:\Windows\System\zgmcLmI.exe
  2⤵
  PID:2236
- C:\Windows\System\KQxMYsr.exe
  C:\Windows\System\KQxMYsr.exe
  2⤵
  PID:9916
- C:\Windows\System\MFkljCL.exe
  C:\Windows\System\MFkljCL.exe
  2⤵
  PID:9968
- C:\Windows\System\Lqmrhei.exe
  C:\Windows\System\Lqmrhei.exe
  2⤵
  PID:10008
- C:\Windows\System\XGUOPEL.exe
  C:\Windows\System\XGUOPEL.exe
  2⤵
  PID:9888
- C:\Windows\System\lHPlNKU.exe
  C:\Windows\System\lHPlNKU.exe
  2⤵
  PID:9896
- C:\Windows\System\sDidGgC.exe
  C:\Windows\System\sDidGgC.exe
  2⤵
  PID:9904
- C:\Windows\System\gbexnCi.exe
  C:\Windows\System\gbexnCi.exe
  2⤵
  PID:10112
- C:\Windows\System\tokbXiN.exe
  C:\Windows\System\tokbXiN.exe
  2⤵
  PID:9192
- C:\Windows\System\GmVZEJw.exe
  C:\Windows\System\GmVZEJw.exe
  2⤵
  PID:8864
- C:\Windows\System\kVMItPL.exe
  C:\Windows\System\kVMItPL.exe
  2⤵
  PID:9480
- C:\Windows\System\cwlboRT.exe
  C:\Windows\System\cwlboRT.exe
  2⤵
  PID:10160
- C:\Windows\System\vfeeapQ.exe
  C:\Windows\System\vfeeapQ.exe
  2⤵
  PID:10176
- C:\Windows\System\AoxUjWg.exe
  C:\Windows\System\AoxUjWg.exe
  2⤵
  PID:10196
- C:\Windows\System\BsOieKy.exe
  C:\Windows\System\BsOieKy.exe
  2⤵
  PID:10216
- C:\Windows\System\xRcfMAP.exe
  C:\Windows\System\xRcfMAP.exe
  2⤵
  PID:10232
- C:\Windows\System\vFvxtvQ.exe
  C:\Windows\System\vFvxtvQ.exe
  2⤵
  PID:9060
- C:\Windows\System\dyiArkF.exe
  C:\Windows\System\dyiArkF.exe
  2⤵
  PID:9164
- C:\Windows\System\nXtWdXj.exe
  C:\Windows\System\nXtWdXj.exe
  2⤵
  PID:8804
- C:\Windows\System\fyziAAW.exe
  C:\Windows\System\fyziAAW.exe
  2⤵
  PID:8224
- C:\Windows\System\ihGadLL.exe
  C:\Windows\System\ihGadLL.exe
  2⤵
  PID:9356
- C:\Windows\System\qcTzCwP.exe
  C:\Windows\System\qcTzCwP.exe
  2⤵
  PID:7972
- C:\Windows\System\CVMLOWA.exe
  C:\Windows\System\CVMLOWA.exe
  2⤵
  PID:9228
- C:\Windows\System\aLMpLzs.exe
  C:\Windows\System\aLMpLzs.exe
  2⤵
  PID:9496
- C:\Windows\System\FjNKitI.exe
  C:\Windows\System\FjNKitI.exe
  2⤵
  PID:9256
- C:\Windows\System\wdhMJGO.exe
  C:\Windows\System\wdhMJGO.exe
  2⤵
  PID:9472
- C:\Windows\System\QlmQvBy.exe
  C:\Windows\System\QlmQvBy.exe
  2⤵
  PID:9544
- C:\Windows\System\VUkDaLe.exe
  C:\Windows\System\VUkDaLe.exe
  2⤵
  PID:8348
- C:\Windows\System\nBiGmwR.exe
  C:\Windows\System\nBiGmwR.exe
  2⤵
  PID:9692
- C:\Windows\System\vKwKiZk.exe
  C:\Windows\System\vKwKiZk.exe
  2⤵
  PID:9340
- C:\Windows\System\xpFstQU.exe
  C:\Windows\System\xpFstQU.exe
  2⤵
  PID:9696
- C:\Windows\System\EkQBifr.exe
  C:\Windows\System\EkQBifr.exe
  2⤵
  PID:9744
- C:\Windows\System\dBTDntu.exe
  C:\Windows\System\dBTDntu.exe
  2⤵
  PID:9276
- C:\Windows\System\awYYbqp.exe
  C:\Windows\System\awYYbqp.exe
  2⤵
  PID:9608
- C:\Windows\System\IsNgcPe.exe
  C:\Windows\System\IsNgcPe.exe
  2⤵
  PID:9288
- C:\Windows\System\xsyekdh.exe
  C:\Windows\System\xsyekdh.exe
  2⤵
  PID:9848
- C:\Windows\System\jUJZZUk.exe
  C:\Windows\System\jUJZZUk.exe
  2⤵
  PID:9676
- C:\Windows\System\odkRBxG.exe
  C:\Windows\System\odkRBxG.exe
  2⤵
  PID:9852
- C:\Windows\System\XNBAVbC.exe
  C:\Windows\System\XNBAVbC.exe
  2⤵
  PID:9808
- C:\Windows\System\lKibxzl.exe
  C:\Windows\System\lKibxzl.exe
  2⤵
  PID:2832
- C:\Windows\System\tfUKmYc.exe
  C:\Windows\System\tfUKmYc.exe
  2⤵
  PID:9844
- C:\Windows\System\JhKVgqi.exe
  C:\Windows\System\JhKVgqi.exe
  2⤵
  PID:9732
- C:\Windows\System\PeRpIME.exe
  C:\Windows\System\PeRpIME.exe
  2⤵
  PID:10084
- C:\Windows\System\xtuZTey.exe
  C:\Windows\System\xtuZTey.exe
  2⤵
  PID:9868
- C:\Windows\System\RSHvQYr.exe
  C:\Windows\System\RSHvQYr.exe
  2⤵
  PID:10092
- C:\Windows\System\NxFwOBt.exe
  C:\Windows\System\NxFwOBt.exe
  2⤵
  PID:10108
- C:\Windows\System\kuyDDPY.exe
  C:\Windows\System\kuyDDPY.exe
  2⤵
  PID:9040
- C:\Windows\System\XmbTfUQ.exe
  C:\Windows\System\XmbTfUQ.exe
  2⤵
  PID:10156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AKFNpvU.exe

Filesize
1.8MB

MD5
8d541380e50430bb02f776dac5d16330

SHA1
ce481bf99396b17f9c5fd29bee6cca2fbf917261

SHA256
003de53e71bc3fce6c790a2495108316b9fae81ff835f7eb1eb137f0b76a5ef6

SHA512
f6ed33250dbc4758250630a9904346511002cdbc31f17a29cd3b0e202ccaf30f546bdf1448e2ec12072387089f8771da268f53a57a98f240dc250b800e8ca29f

Download Submit
C:\Windows\system\AUfZUJF.exe

Filesize
1.8MB

MD5
10aecd754c3ed4619884873086a56564

SHA1
02e8964ec922fdfbcb3070ccdfcbb3a0bf033a51

SHA256
6c79af2b194553bf6d6fbae135091fbcc38c84745f60da86f5c040bc31598d4f

SHA512
6aacf0e5f130620abe07374cd279c27b4fadcc6859b00bdbc146fa5840faa0d1feaaca1ac1c6921a55e547f1015e14b3f23ac1f6dec99136dae34b60c61c3c0a

Download Submit
C:\Windows\system\AiqpnXV.exe

Filesize
1.8MB

MD5
340e544fe8e3b3efc984b664d5211338

SHA1
c71980a9e27da687407b5d6f4d40e47197bd91a6

SHA256
aaf57fe3ccaec697cfd2697b608ed44972ac76e288dbb09af02e604e4813d17d

SHA512
d7f8cacad5cfcf8dab817174afce64515727dfa2bbcfe4c64c7d37b2958a8e3d654e66888e43d70fa1c090442b0fe1d37ae93b56f1166ac4e626571963b9ba6d

Download Submit
C:\Windows\system\DOzePBO.exe

Filesize
1.8MB

MD5
9b7686fa92172787f38a5808b71792fa

SHA1
76ced6672cb6606bb64132ff7c9824f99884c5c4

SHA256
fccbf52bb678913fa7b774b1e2e8f94b09076e252164f0838c3f4e987f6fb0a2

SHA512
5cd81588ab7cbf5b6c62f359a4721e7a7afcc3fcbbf522844237f4ca71b0c05cae2679b5d558b4cd26ed4b6b523eda03f77181eefeb0c26c6c20d64c3084196a

Download Submit
C:\Windows\system\DUnPqlp.exe

Filesize
1.8MB

MD5
559342164dde4834a509eeb4e61e98cf

SHA1
7edeeda869ae7ee0f545664132084cf2831dc6c7

SHA256
f675850ae01873331fb4cc33353a07453f345ad64347c427a31a7ca966f25346

SHA512
d0743151915114a1c5f1641b22a6f5c6d56bf9c14c455164a3e0c88a3db370833f17cb2ef2a7077645e6ec2e4e418e5471512c0f6c057bde83d1814290719ded

Download Submit
C:\Windows\system\DaWQJPz.exe

Filesize
1.8MB

MD5
2d915de0edd8e2bf17da2d0010368daa

SHA1
82cad2e3136a35fd703fb5514fe883ce4eac5957

SHA256
6c038d488c00ce2f37b7546b16e2bafbbbb1f9d879f4603479f26c6d961b6958

SHA512
66a83f98f1c27355379cd2825f92862a2b9f9fb987c5132581536d3c2fec17a2674dfeede47dbd004f5487393f1b15fbf53dbafa766aff651d4861b8f9e0f5a7

Download Submit
C:\Windows\system\KSpiMNH.exe

Filesize
1.8MB

MD5
85c8ff5fa96d6ed598b052af0b583a11

SHA1
7314af9196723ee4fa4ece7400424fc9ab0ec4f6

SHA256
35cbaf077f0c22f54d455d94c564ffea3b2a50c687173a28ffabcd96938ac659

SHA512
2cdbc9fa99572ee71e71061fa556770da3f6f871a83c58817528dc8e7a4a2a1ac1ca90b08bea09d1e0108e61911d206b3ef0661fe227a9e306000ee19736add9

Download Submit
C:\Windows\system\KtbUNJL.exe

Filesize
1.8MB

MD5
be248436d3e0f00c67d7d56f704bfb5c

SHA1
a68eb93d2f7393cf670c37b43b4c21b788d798b6

SHA256
f75aac314c60d9b1a9169db11113fd56daa28b493a3df2ba98c96db9ff26d7d2

SHA512
ff7b698f5077af05438b4182df01acf275765660a4d7bbf75b345f4a957c021cc75881e88a7747a8b2dccc22a0f24ebdfac4a3f3944b47479d1d1725f0853c26

Download Submit
C:\Windows\system\NIqSEQT.exe

Filesize
1.8MB

MD5
8c11367dec942db983b77d7d1883743f

SHA1
82421a19b3b384b92333744ddcb608610d6f59fa

SHA256
20877c87f545c5046063649d9fa48e696cbb81245da97d86c3b6e3acb0500158

SHA512
fdc54e7565d6cc7b6296612ead8a8e38f234ae84b7d509cd3b16035407390c4caa920a19dc90dca6455f4531988bc089f29aac2de08eb205b032dd85ae12a319

Download Submit
C:\Windows\system\OgMjEhp.exe

Filesize
1.8MB

MD5
92d1e7ffd219177b54fb3113ba7d3a80

SHA1
92799e47e7ec22b1ce8833f7b641763f97a2c9db

SHA256
578157cc48648319715ad416a6c9961b6223af2ecbcc0789abc06d0677794476

SHA512
d40764128bb8e1d9bccfccf5e30fc0012f2f5e1a57da496b31798c7065bf0fe31809c4bdef9b0cb8b5893ba83e55f6991a5cdc4122ab7ffca088449edef4e053

Download Submit
C:\Windows\system\UHHCiHJ.exe

Filesize
1.8MB

MD5
62ae0e6f488668e9943df70fd28322c0

SHA1
3edb48a22398f65d8c6082c88a30c67f5f79da46

SHA256
e374a190700d938c6622d90fac51abf02d742687d1ab9b5059095d553e85be34

SHA512
98c9e15e025e36f15244f1e75dfef8ce3e01a9a87c854e1ecf416e2eb927ce7549bc3c4250017b7b1547c6620da338eb1ac57f1a56c61d472ad18eb51d124367

Download Submit
C:\Windows\system\XDvRfrk.exe

Filesize
1.8MB

MD5
312dd13e60d6a4d5186a89382ca0725d

SHA1
f2513b92d94530537ffd0af78ee2c0570549a42b

SHA256
ea0c5703535052edc2193d79e3a2fa31f54ad6317e138dcf33c0c0089d8c7da6

SHA512
2bda232b3bfcd06f1aeb217abb68129db9c484ccf0af9ec3a9dccbd513eb38f85818632d511712f406ec79e48b6958106a22017fb056c111754fe771fe3a19af

Download Submit
C:\Windows\system\XFKPiaI.exe

Filesize
1.8MB

MD5
42238e31b36899482dc7138096c1f2c5

SHA1
52b94739a64ecb57675ca231a0bfa436c17938d3

SHA256
66760ee0d1a918de16acf6666309560ae3384de785089daebb3ed40e02e8aa7d

SHA512
9db2b784e8a252db54a48c0c5317e6a75183dd2731e4269de8cb9b3d32499579204f0278bd38c10e30f276281bf62c718af09d3c2efa0305100295cb3c7ec515

Download Submit
C:\Windows\system\XOnUnxi.exe

Filesize
1.8MB

MD5
e41cfef4f6760fd08740bc768d637aa1

SHA1
7edad7373ce1900e4f56dda510d661ea9f5da990

SHA256
2d57667a459537c5991a1217af478566d66000db65c63aaa48be375d9d7a6d20

SHA512
c660968228fb31a40397978df0087215c0818f0b7071f1eab52dd705351a7a8677985f5e8676374c5fb46eb4a753484502ab5ebdab2ab3c39317b37214386636

Download Submit
C:\Windows\system\YRMFwly.exe

Filesize
1.8MB

MD5
d59a4ba50c45cfac3b9b103b6434e9eb

SHA1
e93c49692ca61d20b3659103d0b27688c3555de5

SHA256
5b30ab4b4013bb9ec31b6d9cefa1aeafc152b1c9f9f52222d4c36e63ac521d0e

SHA512
846a63614ee5e74ff37fadf6057898be2021db0793c8f268083d63178400a9c51af8c3e2611f2206d7ace129d0edf6df66caa36e61e3a672b138fffce50e3d72

Download Submit
C:\Windows\system\YhfNQxo.exe

Filesize
1.8MB

MD5
8cffa9a08118e812aa2f8c2b9689f7f3

SHA1
d53db312fad0f9d0ff0af7ab2c1140e7f779460e

SHA256
38617c8d16071c90d62cd3cd04a7b74651b1ca05895829d1a0ebac21ab60de04

SHA512
303cd9b3366de33d4cbe8a1c86d5d4ce3d948c5e0db02cedcef20930fb6d7a8c77e7749cb99f9812c30d4a348d516e012c265c4a2f1f519cee70a0ed47563bab

Download Submit
C:\Windows\system\eKbvLwf.exe

Filesize
1.8MB

MD5
2de6faa9f79b277a95e6559bc48dc9af

SHA1
16a66974d8426cc2a755221a6d890e32de652711

SHA256
ac29b20d829fcacc80a24bcf821f4e3d7053e6655de94f50db2b51259ed93f29

SHA512
51cf3222264a88e6f4bbdf424db3ab273bd829a8ef7c6dfde6fe3a757a9ffb7924b20e65fd9a52c1d63d46ebcd7ff3403cb0f1037cf7287b3914ae0bf8e1eaac

Download Submit
C:\Windows\system\ebAxrBJ.exe

Filesize
1.8MB

MD5
269d489561eca170022e24697a38e044

SHA1
09b47fbc71ec855b8e690798cde21be9264757c2

SHA256
171b9fae6e74f6c158e37c3143a6608d671422aac069eb2acfb7ecf7ea802040

SHA512
4ef73ed540603f88097eec1a7de14dd1a74e436b74bee3c485d73afbdd36da077f31b58f016ef1a4754fc0bf71e70be5814419547b3329c7209e1abc2afa5825

Download Submit
C:\Windows\system\hLxaBmX.exe

Filesize
1.8MB

MD5
85992945ec261b7145a60dc464cae66f

SHA1
a528dd1f4a27ed7b191770310fe050114b4181a0

SHA256
b270c4a8b3b82c15d14da1c90afeb69258020d07edf0585a0b6c1c386e8ff936

SHA512
d7ec543dabaf4108f3ad8744f22436966054b2dd6e6a31e261e9c2c408631e3e353368b5fad000737d4cc15a7afb02f93081d81b874c5f0227f4b0bf02717f6c

Download Submit
C:\Windows\system\jgWuXIP.exe

Filesize
1.8MB

MD5
b1944dc09244c51405ae32d417a20cc9

SHA1
21b29ad595c97974d6af632942376c4607cff806

SHA256
496301cb5029371c4ad40217ffdb341a1561d6bbb973965b0cfaea33270f4ce8

SHA512
bf601167867f0a63d3bb7494f491e53858ddaec4b06988cd80d26b5e0e72ed7e67b0f34c0210bb458663cedff0bc383a94577885917d43d0ddd0e1316711adb6

Download Submit
C:\Windows\system\nOhzgiq.exe

Filesize
1.8MB

MD5
ce95eb43bf2372bf28833a3bf4ead161

SHA1
71cf03176ea595d6859e3f480574e119d039c894

SHA256
0dd074a3049203b59f608d056f110c01de182945dfcb0a634bd8e8ad101a78d4

SHA512
b092b1780f9a711858b193f1cf9e92bce07771dbe1baac314192b697a8d8c5e90b4606e91742b42448f72c5dd6d90f1a088475f31825ac7c60a0cd9b86d91f55

Download Submit
C:\Windows\system\rDDPhlu.exe

Filesize
1.8MB

MD5
87f379391e5359bf68e94f04c655de92

SHA1
bf84a02cdb8ff4b3632da0cad9432f4337e2f61c

SHA256
fc4581e15cd7db108d4da6d76c4b58e1eded8b03181e79d1d8f773881189757a

SHA512
2b7da9bd1f393386f40c75489dcd0ddbfa6567a6b5fda54bbe3af882fbd50f3d6f9f698e3f451502aed569346954ebc61d18e6327da4442817e4237d980c37e5

Download Submit
C:\Windows\system\uFyzSuT.exe

Filesize
1.8MB

MD5
e3c436661c1cd737fb53e7aa42fda192

SHA1
45eab296c5dcd3e1c8a35bfbf0cd0ed70a55c685

SHA256
4a33d0857a8041c593bb19b41ad10247ccc4c632bf5666a7913c5d9bc2e559e3

SHA512
f748203809c38411896b3a2f6ce9ea7b7732d30f25e9faa3735a55add1d29e750ec641588389ef07b188f0bdac0fa329d6b53a9abbd2531eef1d217f14098512

Download Submit
C:\Windows\system\wmplyxy.exe

Filesize
1.8MB

MD5
1082795658020ad2bc95db671a3cf1b8

SHA1
c2b2fe31df67022dce623009716ad500fd81929f

SHA256
0c8644023791fcc943ed0c2ac17e01506b38e10997bcaa8e0d0e97f6fbedeff8

SHA512
083460a0d62193e3ff02c3fde4cf423275b8c8e2e82df647dde093c54494c0e0854f6dfd42b626f117f2eb1147133e6b10a304d5784a60ddf9ab7203bddc7a5c

Download Submit
C:\Windows\system\xIlOorG.exe

Filesize
1.8MB

MD5
988570e1623965942f37a2f32784a416

SHA1
ad6089a88a0128f6a8d867cc0be8effd1384b2dd

SHA256
cff67ef0181108f084533ffee609e201b8be333299d53cc6609678eef7e17026

SHA512
5eb4680eadf19b2bb8a7d34461453f2d69ea118c1d283f2c6b572900416600582d150a1bdbc407fb7b29c002cd43d6c0cefeec8f77b3b8eb9f99261892e3384a

Download Submit
C:\Windows\system\xmYfyTN.exe

Filesize
1.8MB

MD5
9ac70e9244eabe437090417904ccb5bd

SHA1
f0d88c40f699afc8f5db3e97fa763e3912f81a14

SHA256
2fcb2faaf50131d53a6694cd76e87e899035f52cfba4091bb36c6f2f688e67a2

SHA512
a03d00e739bd7966243c32a9161c86341eddf62f6ecac1abb0226eaa45ed52ffa184db7152be5ec038b40598052941c5a19095af92e43085a07589d9a0885a89

Download Submit
C:\Windows\system\yOUNPVw.exe

Filesize
1.8MB

MD5
2b79febdb203adf97109c966ff5ad267

SHA1
580618474c4f77f70051bb2fbff335a4013311c6

SHA256
e1b06c87ee8330a96a569aaa293dda33770608651eecea0b669e6340b49e5da1

SHA512
812492b1abf6de145881e5f41d2d46730a21e2055f2accc1081da853124a6e4019fd43b62f4511099cc0d5a2dac985fe07b48c3be4e522b1d63c28b8ca7a8e5a

Download Submit
\Windows\system\EwYqnQd.exe

Filesize
1.8MB

MD5
2ccc87acedbd427a725fc8baaf45d4d7

SHA1
d809bf78ab75d1d3bafb8979d7ddea6f2030d8c0

SHA256
03a90c33c4c0f5dceb14a46c05daae384655b362c8b47264944152886a557ff9

SHA512
9802137e261d2d1deaae25eb19e609e8149f38674ce6a4115680679225ff92e96a6ea016aff127bc454ec1e32e4bc945dd12444f2771d01704248511318bc939

Download Submit
\Windows\system\UdtMMee.exe

Filesize
1.8MB

MD5
22afdeb83728608c51f9f672eaff966d

SHA1
379eec2dc431914210b59da2d721492be5d0c848

SHA256
18537a116ec8e6cc7c2b90fa12f9972436378fbdd30b06a3e9bc8d1920641bcd

SHA512
cb299b0a4649653599f9ef780eaeb3eaacdde1916bc11aa51fbfede23a5caa6e38cb3ea2ad35f2344a2ea7473ba4b1b940ad9dc2b41249f31ef38dffdeb02629

Download Submit
\Windows\system\deMXTWe.exe

Filesize
1.8MB

MD5
b94ec3e0cac1650719916605a2415238

SHA1
38ca29ffae956166f561d97cb9cba6c9cb3286de

SHA256
d04cd52781f048da2bf3ef62e6c2b5200177d24f6c42133405fa78c9069a8ec1

SHA512
5d348f2be89622773a015ab2beeda169d8a32e2073214665e7218ff2b9b1a3856bda8cb21b47ff30bce6544b2b9a89634338bc1138a9651e253d79c5b184245a

Download Submit
\Windows\system\mYUOYIy.exe

Filesize
1.8MB

MD5
933477514a0c39a6a5038e97da436e76

SHA1
f6a524fadc3a06fef23bae953f68c98c02c822f1

SHA256
bbfdf8e369530bafe7e2bfa8fc42c1eb00773ca72b81710d1964efb577dd24a7

SHA512
33e22d0c85e89a05fc0ceec2325b8ebbcd687a442546e05011140eab2e36e0e8f13a3255bc82a779f77767909c94092356942e459c80f12fb22e4741300c80fa

Download Submit
\Windows\system\xPMARfX.exe

Filesize
1.8MB

MD5
39538015434707711bfcfabfd809cae0

SHA1
20d119c30cdfc0308abb4000e40c6891b8fd68d7

SHA256
6c848b422d486130209023e317fcf0079099ab02f030ebfa5b680a8119750953

SHA512
5816820c1c8e4c871206f7d41ccc16391a56f68254b4cf267d462a8966143d88ede8309dc4d587c1f10998cfb4d122032c40457ad713295538e9d6949af630cc

Download Submit
memory/292-126-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/292-3147-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/1160-3453-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/1160-120-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/1740-77-0x00000000022E0000-0x00000000022E8000-memory.dmp

Filesize
32KB

Download
memory/1740-73-0x000000001B330000-0x000000001B612000-memory.dmp

Filesize
2.9MB

Download
memory/1740-128-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/1740-98-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/1740-97-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/1740-13-0x000007FEF628E000-0x000007FEF628F000-memory.dmp

Filesize
4KB

Download
memory/1740-1114-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/2148-106-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2148-3345-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2408-3142-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2408-122-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2468-3472-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2468-117-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2528-114-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2528-3471-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2620-2986-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2620-100-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2676-102-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2676-3211-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-113-0x0000000002DC0000-0x00000000031B2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2696-99-0x0000000002DC0000-0x00000000031B2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-101-0x0000000002DC0000-0x00000000031B2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-103-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2696-115-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2696-105-0x0000000002DC0000-0x00000000031B2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-12-0x0000000002DC0000-0x00000000031B2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-109-0x0000000002DC0000-0x00000000031B2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-0-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2696-118-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2696-119-0x00000000032C0000-0x00000000036B2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-111-0x0000000002DC0000-0x00000000031B2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-125-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2696-424-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2724-3452-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-112-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-3207-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-127-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2756-3146-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2756-110-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2760-2983-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2760-104-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download