xmrig | 499099814d838592ea0df39fb8d408a3cd64e5c1e1a05892346a14df5b7a6a3c

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
Size

2.0MB
MD5

224e57fbadf6b2a5f81c5ea8a7b22485
SHA1

c9453e924abc7e77d5297d2e5fbf6299fcf03021
SHA256

499099814d838592ea0df39fb8d408a3cd64e5c1e1a05892346a14df5b7a6a3c
SHA512

4adc27ed82faf49cd44aa9134becbab48ea920c2a6d6fb8f09d33988347acd7b3d187d60594c58e2bc53d28053c73d18a6baa279321c4f2c1b5d914c26a7cf59
SSDEEP

49152:Lz071uv4BPMkibTIA5I4TNrpDGgDQzA9Mv:NABN

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral1/memory/2540-29-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/1472-97-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/2860-1071-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2512-55-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/1556-87-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2796-44-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2808-43-0x000000013F500000-0x000000013F8F2000-memory.dmp	xmrig
behavioral1/memory/2508-40-0x000000013FA90000-0x000000013FE82000-memory.dmp	xmrig
behavioral1/memory/3024-13-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/2540-4530-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/1472-4543-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/2796-4547-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2808-4549-0x000000013F500000-0x000000013F8F2000-memory.dmp	xmrig
behavioral1/memory/2512-4541-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2684-4558-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/1556-4686-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2784	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3024	UqSXsrT.exe
2540	tSQtNIg.exe
2808	RjmTNPT.exe
2508	XlOKdHP.exe
2796	FlXKStL.exe
2684	ftpWGxb.exe
2512	TRvHAAe.exe
1556	MeePtCW.exe
1472	eyCJQrZ.exe
2572	UDJMiJg.exe
1864	omLMevE.exe
2876	qKQAEtZ.exe
1508	zfhTFEj.exe
2608	xjiOYHI.exe
1880	iRHKsyL.exe
2120	lVTvHPr.exe
2620	zIGEOjn.exe
812	JGmnjRX.exe
2180	mbbfrCL.exe
1452	FScxDxF.exe
772	PifnPRX.exe
2912	YltbkAZ.exe
2196	tRlNJMf.exe
852	lkpusAq.exe
1436	ORFXWPh.exe
1724	WPOslJf.exe
2892	hBIxgFt.exe
3036	yaQixiF.exe
2972	NLscOqE.exe
1708	aXZNsDL.exe
2032	YrgOeDw.exe
1792	QfIwaHJ.exe
832	XvnPgUi.exe
2360	TRsEYIw.exe
344	AivifkE.exe
3064	UNXEKmn.exe
1956	KSLOcBT.exe
1996	ogQhwTJ.exe
876	gssdNPi.exe
1208	ImmadTd.exe
2264	MZTYvVh.exe
1344	rNcASaN.exe
1236	evYfLkr.exe
1640	LyxqPpo.exe
540	AGSoQpT.exe
2312	LKEquix.exe
2252	CzHUzGJ.exe
2976	AtbRliv.exe
2960	nNkFSiq.exe
2564	DRoZnqj.exe
2576	pnhYHvs.exe
356	MAQqYGd.exe
1648	BMbxKtr.exe
2136	aAXMUil.exe
2268	wNZKUEq.exe
1688	fTRGKLm.exe
2408	kiwGrHc.exe
2812	uPdbZnh.exe
816	bcgrdQI.exe
2932	YByrckK.exe
2172	nUWIcJA.exe
1180	mQCXNCm.exe
1028	xokafTL.exe
2068	uqVkKVp.exe

Loads dropped DLL 64 IoCs

pid	Process
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2860-0-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/files/0x000a000000014f57-3.dat	upx
behavioral1/files/0x0034000000015662-11.dat	upx
behavioral1/files/0x0007000000015c9a-16.dat	upx
behavioral1/files/0x0007000000015ca8-22.dat	upx
behavioral1/files/0x0008000000015b85-14.dat	upx
behavioral1/memory/2540-29-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/files/0x0007000000015cc5-47.dat	upx
behavioral1/files/0x0009000000016122-67.dat	upx
behavioral1/files/0x0006000000016c1f-86.dat	upx
behavioral1/memory/1472-97-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/files/0x0006000000016c38-106.dat	upx
behavioral1/files/0x0006000000016cb5-112.dat	upx
behavioral1/files/0x0006000000016a28-118.dat	upx
behavioral1/files/0x000600000001737b-187.dat	upx
behavioral1/files/0x0006000000016c84-124.dat	upx
behavioral1/files/0x0006000000016ce0-135.dat	upx
behavioral1/memory/2860-1071-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/files/0x0006000000016e56-185.dat	upx
behavioral1/files/0x0006000000016f7e-182.dat	upx
behavioral1/files/0x0006000000016d85-177.dat	upx
behavioral1/files/0x0006000000016da9-175.dat	upx
behavioral1/files/0x0006000000016d06-170.dat	upx
behavioral1/files/0x0006000000016d81-166.dat	upx
behavioral1/files/0x0006000000016d29-158.dat	upx
behavioral1/files/0x0006000000016cf3-153.dat	upx
behavioral1/files/0x0006000000016d18-148.dat	upx
behavioral1/files/0x0006000000016cfd-140.dat	upx
behavioral1/files/0x0006000000016d31-163.dat	upx
behavioral1/files/0x0006000000016c30-100.dat	upx
behavioral1/files/0x0006000000016d21-157.dat	upx
behavioral1/files/0x0006000000016d10-145.dat	upx
behavioral1/files/0x0006000000016ced-129.dat	upx
behavioral1/files/0x0006000000016575-71.dat	upx
behavioral1/files/0x00060000000163eb-63.dat	upx
behavioral1/memory/2512-55-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/files/0x0016000000005586-88.dat	upx
behavioral1/memory/1556-87-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/files/0x00060000000167bf-85.dat	upx
behavioral1/files/0x00060000000164ec-84.dat	upx
behavioral1/memory/2684-46-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/files/0x0007000000015cb1-45.dat	upx
behavioral1/memory/2796-44-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/2808-43-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx
behavioral1/memory/2508-40-0x000000013FA90000-0x000000013FE82000-memory.dmp	upx
behavioral1/memory/3024-13-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/memory/2540-4530-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/1472-4543-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/memory/2796-4547-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/2808-4549-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx
behavioral1/memory/2512-4541-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/2684-4558-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/memory/1556-4686-0x000000013FF30000-0x0000000140322000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LXToLNj.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\nPiCbsJ.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\FKbrLWN.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\TZXAFNY.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\aGCncyQ.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\HBaNgVz.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\SASHfUe.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\DIQfbiQ.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\EgWAntC.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\VHdAxcs.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\qwuJZYs.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\drRCprk.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\hfPJTed.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\YWDnPlH.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\cMXSZiM.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\NpKsaJa.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\TTgnntr.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\kYwRpCW.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\Ydvtuuj.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\twAGohO.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\mEpSgXq.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\ydXlQCa.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\ihUhKTZ.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\ywYHsVy.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\PgwsGYU.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\UWinpIR.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\sQqaKJb.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\yTxtoSw.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\BYtjoYy.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\ubltBvy.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\xMcYTOi.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\puHDunH.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\zIKZePl.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\KNlzCHR.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\aXxbsJM.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\sAPAelH.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\YlsVwHk.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\CKCMUHU.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\vqjYRRn.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\ctVdOKc.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\fkWrBaP.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\KRaFmjd.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\GhRIzWS.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\KqcCoSk.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\iVsQIFv.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\XaPktBT.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\QqSBZsc.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\ZXKRxrq.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\SFDtHtv.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\VDFsmKv.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\uiQUeaX.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\zgKsdbe.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\RgciDcS.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\ngLobBf.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\iTaUKlJ.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\mAzAyAm.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\oUkVWJH.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\DyeSEJd.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\BvnFpok.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\wSxCvbH.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\bERXige.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\gNyQDfM.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\uNknRLY.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
File created	C:\Windows\System\adlhSNK.exe	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2784	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
Token: SeDebugPrivilege	2784	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2784	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	29
PID 2860 wrote to memory of 2784	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	29
PID 2860 wrote to memory of 2784	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	29
PID 2860 wrote to memory of 3024	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	30
PID 2860 wrote to memory of 3024	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	30
PID 2860 wrote to memory of 3024	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2540	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	31
PID 2860 wrote to memory of 2540	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	31
PID 2860 wrote to memory of 2540	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	31
PID 2860 wrote to memory of 2808	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	32
PID 2860 wrote to memory of 2808	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	32
PID 2860 wrote to memory of 2808	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	32
PID 2860 wrote to memory of 2796	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	33
PID 2860 wrote to memory of 2796	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	33
PID 2860 wrote to memory of 2796	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	33
PID 2860 wrote to memory of 2508	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	34
PID 2860 wrote to memory of 2508	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	34
PID 2860 wrote to memory of 2508	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	34
PID 2860 wrote to memory of 2684	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	35
PID 2860 wrote to memory of 2684	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	35
PID 2860 wrote to memory of 2684	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	35
PID 2860 wrote to memory of 2512	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	36
PID 2860 wrote to memory of 2512	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	36
PID 2860 wrote to memory of 2512	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	36
PID 2860 wrote to memory of 2876	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	37
PID 2860 wrote to memory of 2876	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	37
PID 2860 wrote to memory of 2876	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	37
PID 2860 wrote to memory of 1556	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	38
PID 2860 wrote to memory of 1556	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	38
PID 2860 wrote to memory of 1556	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	38
PID 2860 wrote to memory of 1508	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	39
PID 2860 wrote to memory of 1508	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	39
PID 2860 wrote to memory of 1508	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	39
PID 2860 wrote to memory of 1472	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	40
PID 2860 wrote to memory of 1472	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	40
PID 2860 wrote to memory of 1472	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	40
PID 2860 wrote to memory of 2608	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	41
PID 2860 wrote to memory of 2608	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	41
PID 2860 wrote to memory of 2608	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	41
PID 2860 wrote to memory of 2572	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	42
PID 2860 wrote to memory of 2572	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	42
PID 2860 wrote to memory of 2572	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	42
PID 2860 wrote to memory of 2620	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	43
PID 2860 wrote to memory of 2620	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	43
PID 2860 wrote to memory of 2620	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	43
PID 2860 wrote to memory of 1864	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	44
PID 2860 wrote to memory of 1864	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	44
PID 2860 wrote to memory of 1864	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	44
PID 2860 wrote to memory of 812	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	45
PID 2860 wrote to memory of 812	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	45
PID 2860 wrote to memory of 812	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	45
PID 2860 wrote to memory of 1880	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	46
PID 2860 wrote to memory of 1880	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	46
PID 2860 wrote to memory of 1880	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	46
PID 2860 wrote to memory of 2180	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	47
PID 2860 wrote to memory of 2180	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	47
PID 2860 wrote to memory of 2180	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	47
PID 2860 wrote to memory of 2120	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	48
PID 2860 wrote to memory of 2120	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	48
PID 2860 wrote to memory of 2120	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	48
PID 2860 wrote to memory of 772	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	49
PID 2860 wrote to memory of 772	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	49
PID 2860 wrote to memory of 772	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	49
PID 2860 wrote to memory of 1452	2860	224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\224e57fbadf6b2a5f81c5ea8a7b22485_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2784
- C:\Windows\System\UqSXsrT.exe
  C:\Windows\System\UqSXsrT.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\tSQtNIg.exe
  C:\Windows\System\tSQtNIg.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\RjmTNPT.exe
  C:\Windows\System\RjmTNPT.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\FlXKStL.exe
  C:\Windows\System\FlXKStL.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\XlOKdHP.exe
  C:\Windows\System\XlOKdHP.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\ftpWGxb.exe
  C:\Windows\System\ftpWGxb.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\TRvHAAe.exe
  C:\Windows\System\TRvHAAe.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\qKQAEtZ.exe
  C:\Windows\System\qKQAEtZ.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\MeePtCW.exe
  C:\Windows\System\MeePtCW.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\zfhTFEj.exe
  C:\Windows\System\zfhTFEj.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\eyCJQrZ.exe
  C:\Windows\System\eyCJQrZ.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\xjiOYHI.exe
  C:\Windows\System\xjiOYHI.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\UDJMiJg.exe
  C:\Windows\System\UDJMiJg.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\zIGEOjn.exe
  C:\Windows\System\zIGEOjn.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\omLMevE.exe
  C:\Windows\System\omLMevE.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\JGmnjRX.exe
  C:\Windows\System\JGmnjRX.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\iRHKsyL.exe
  C:\Windows\System\iRHKsyL.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\mbbfrCL.exe
  C:\Windows\System\mbbfrCL.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\lVTvHPr.exe
  C:\Windows\System\lVTvHPr.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\PifnPRX.exe
  C:\Windows\System\PifnPRX.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\FScxDxF.exe
  C:\Windows\System\FScxDxF.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\lkpusAq.exe
  C:\Windows\System\lkpusAq.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\YltbkAZ.exe
  C:\Windows\System\YltbkAZ.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\hBIxgFt.exe
  C:\Windows\System\hBIxgFt.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\tRlNJMf.exe
  C:\Windows\System\tRlNJMf.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\YrgOeDw.exe
  C:\Windows\System\YrgOeDw.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\ORFXWPh.exe
  C:\Windows\System\ORFXWPh.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\XvnPgUi.exe
  C:\Windows\System\XvnPgUi.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\WPOslJf.exe
  C:\Windows\System\WPOslJf.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\TRsEYIw.exe
  C:\Windows\System\TRsEYIw.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\yaQixiF.exe
  C:\Windows\System\yaQixiF.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\AivifkE.exe
  C:\Windows\System\AivifkE.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\NLscOqE.exe
  C:\Windows\System\NLscOqE.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\UNXEKmn.exe
  C:\Windows\System\UNXEKmn.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\aXZNsDL.exe
  C:\Windows\System\aXZNsDL.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\KSLOcBT.exe
  C:\Windows\System\KSLOcBT.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\QfIwaHJ.exe
  C:\Windows\System\QfIwaHJ.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\ogQhwTJ.exe
  C:\Windows\System\ogQhwTJ.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\gssdNPi.exe
  C:\Windows\System\gssdNPi.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\BMbxKtr.exe
  C:\Windows\System\BMbxKtr.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\ImmadTd.exe
  C:\Windows\System\ImmadTd.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\wNZKUEq.exe
  C:\Windows\System\wNZKUEq.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\MZTYvVh.exe
  C:\Windows\System\MZTYvVh.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\fTRGKLm.exe
  C:\Windows\System\fTRGKLm.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\rNcASaN.exe
  C:\Windows\System\rNcASaN.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\mQCXNCm.exe
  C:\Windows\System\mQCXNCm.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\evYfLkr.exe
  C:\Windows\System\evYfLkr.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\xokafTL.exe
  C:\Windows\System\xokafTL.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\LyxqPpo.exe
  C:\Windows\System\LyxqPpo.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\uqVkKVp.exe
  C:\Windows\System\uqVkKVp.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\AGSoQpT.exe
  C:\Windows\System\AGSoQpT.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\RUlDPOn.exe
  C:\Windows\System\RUlDPOn.exe
  2⤵
  PID:1676
- C:\Windows\System\LKEquix.exe
  C:\Windows\System\LKEquix.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\yiMNIzf.exe
  C:\Windows\System\yiMNIzf.exe
  2⤵
  PID:1500
- C:\Windows\System\CzHUzGJ.exe
  C:\Windows\System\CzHUzGJ.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\KPWYVYp.exe
  C:\Windows\System\KPWYVYp.exe
  2⤵
  PID:888
- C:\Windows\System\AtbRliv.exe
  C:\Windows\System\AtbRliv.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\cmeLCgY.exe
  C:\Windows\System\cmeLCgY.exe
  2⤵
  PID:2220
- C:\Windows\System\nNkFSiq.exe
  C:\Windows\System\nNkFSiq.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\IkIiukN.exe
  C:\Windows\System\IkIiukN.exe
  2⤵
  PID:2764
- C:\Windows\System\DRoZnqj.exe
  C:\Windows\System\DRoZnqj.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\HOBRlKX.exe
  C:\Windows\System\HOBRlKX.exe
  2⤵
  PID:2772
- C:\Windows\System\pnhYHvs.exe
  C:\Windows\System\pnhYHvs.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\VWYVNQB.exe
  C:\Windows\System\VWYVNQB.exe
  2⤵
  PID:2492
- C:\Windows\System\MAQqYGd.exe
  C:\Windows\System\MAQqYGd.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\rVhMBug.exe
  C:\Windows\System\rVhMBug.exe
  2⤵
  PID:2324
- C:\Windows\System\aAXMUil.exe
  C:\Windows\System\aAXMUil.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\gkIyKSa.exe
  C:\Windows\System\gkIyKSa.exe
  2⤵
  PID:1488
- C:\Windows\System\kiwGrHc.exe
  C:\Windows\System\kiwGrHc.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\WTvdWgq.exe
  C:\Windows\System\WTvdWgq.exe
  2⤵
  PID:2044
- C:\Windows\System\uPdbZnh.exe
  C:\Windows\System\uPdbZnh.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\Zljptsy.exe
  C:\Windows\System\Zljptsy.exe
  2⤵
  PID:2640
- C:\Windows\System\bcgrdQI.exe
  C:\Windows\System\bcgrdQI.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\NVBTaqf.exe
  C:\Windows\System\NVBTaqf.exe
  2⤵
  PID:2348
- C:\Windows\System\YByrckK.exe
  C:\Windows\System\YByrckK.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\lbEBjGL.exe
  C:\Windows\System\lbEBjGL.exe
  2⤵
  PID:3044
- C:\Windows\System\nUWIcJA.exe
  C:\Windows\System\nUWIcJA.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\TRgnpEd.exe
  C:\Windows\System\TRgnpEd.exe
  2⤵
  PID:2668
- C:\Windows\System\DWoXNEV.exe
  C:\Windows\System\DWoXNEV.exe
  2⤵
  PID:1092
- C:\Windows\System\ipOjHbF.exe
  C:\Windows\System\ipOjHbF.exe
  2⤵
  PID:1728
- C:\Windows\System\oBDZlzK.exe
  C:\Windows\System\oBDZlzK.exe
  2⤵
  PID:2688
- C:\Windows\System\wUocKrL.exe
  C:\Windows\System\wUocKrL.exe
  2⤵
  PID:1872
- C:\Windows\System\pjarSPL.exe
  C:\Windows\System\pjarSPL.exe
  2⤵
  PID:568
- C:\Windows\System\tJRqZXJ.exe
  C:\Windows\System\tJRqZXJ.exe
  2⤵
  PID:1316
- C:\Windows\System\dguJEiJ.exe
  C:\Windows\System\dguJEiJ.exe
  2⤵
  PID:1836
- C:\Windows\System\ezVOlli.exe
  C:\Windows\System\ezVOlli.exe
  2⤵
  PID:1928
- C:\Windows\System\WGXRnHC.exe
  C:\Windows\System\WGXRnHC.exe
  2⤵
  PID:916
- C:\Windows\System\ZagAEKh.exe
  C:\Windows\System\ZagAEKh.exe
  2⤵
  PID:2948
- C:\Windows\System\LKOLXVX.exe
  C:\Windows\System\LKOLXVX.exe
  2⤵
  PID:708
- C:\Windows\System\oJDArqR.exe
  C:\Windows\System\oJDArqR.exe
  2⤵
  PID:1440
- C:\Windows\System\pnHgNAT.exe
  C:\Windows\System\pnHgNAT.exe
  2⤵
  PID:2632
- C:\Windows\System\fzUnlTK.exe
  C:\Windows\System\fzUnlTK.exe
  2⤵
  PID:988
- C:\Windows\System\RLLNWgS.exe
  C:\Windows\System\RLLNWgS.exe
  2⤵
  PID:3088
- C:\Windows\System\SIudkFw.exe
  C:\Windows\System\SIudkFw.exe
  2⤵
  PID:3104
- C:\Windows\System\UsnjdOT.exe
  C:\Windows\System\UsnjdOT.exe
  2⤵
  PID:3120
- C:\Windows\System\puAzdwc.exe
  C:\Windows\System\puAzdwc.exe
  2⤵
  PID:3140
- C:\Windows\System\vbgQhHi.exe
  C:\Windows\System\vbgQhHi.exe
  2⤵
  PID:3156
- C:\Windows\System\qmXZCYM.exe
  C:\Windows\System\qmXZCYM.exe
  2⤵
  PID:3172
- C:\Windows\System\XDNDGuy.exe
  C:\Windows\System\XDNDGuy.exe
  2⤵
  PID:3188
- C:\Windows\System\mbnOftZ.exe
  C:\Windows\System\mbnOftZ.exe
  2⤵
  PID:3208
- C:\Windows\System\CFfDGcF.exe
  C:\Windows\System\CFfDGcF.exe
  2⤵
  PID:3224
- C:\Windows\System\szMAfJk.exe
  C:\Windows\System\szMAfJk.exe
  2⤵
  PID:3240
- C:\Windows\System\bCynPgK.exe
  C:\Windows\System\bCynPgK.exe
  2⤵
  PID:3256
- C:\Windows\System\PpVYYnY.exe
  C:\Windows\System\PpVYYnY.exe
  2⤵
  PID:3272
- C:\Windows\System\jYJdWyM.exe
  C:\Windows\System\jYJdWyM.exe
  2⤵
  PID:3520
- C:\Windows\System\norhvAI.exe
  C:\Windows\System\norhvAI.exe
  2⤵
  PID:3540
- C:\Windows\System\CZNZJEg.exe
  C:\Windows\System\CZNZJEg.exe
  2⤵
  PID:3560
- C:\Windows\System\UjQDDuX.exe
  C:\Windows\System\UjQDDuX.exe
  2⤵
  PID:3576
- C:\Windows\System\yFhcAah.exe
  C:\Windows\System\yFhcAah.exe
  2⤵
  PID:3600
- C:\Windows\System\zMxIJpi.exe
  C:\Windows\System\zMxIJpi.exe
  2⤵
  PID:3616
- C:\Windows\System\YcsaNcw.exe
  C:\Windows\System\YcsaNcw.exe
  2⤵
  PID:3636
- C:\Windows\System\nsWZhyP.exe
  C:\Windows\System\nsWZhyP.exe
  2⤵
  PID:3652
- C:\Windows\System\HgUvfsy.exe
  C:\Windows\System\HgUvfsy.exe
  2⤵
  PID:3668
- C:\Windows\System\IhdPFWN.exe
  C:\Windows\System\IhdPFWN.exe
  2⤵
  PID:3684
- C:\Windows\System\Xzddgln.exe
  C:\Windows\System\Xzddgln.exe
  2⤵
  PID:3704
- C:\Windows\System\ZJZGFzM.exe
  C:\Windows\System\ZJZGFzM.exe
  2⤵
  PID:3724
- C:\Windows\System\UJcRoFU.exe
  C:\Windows\System\UJcRoFU.exe
  2⤵
  PID:3748
- C:\Windows\System\gTzFDvv.exe
  C:\Windows\System\gTzFDvv.exe
  2⤵
  PID:3776
- C:\Windows\System\coFcbCX.exe
  C:\Windows\System\coFcbCX.exe
  2⤵
  PID:3792
- C:\Windows\System\tXFkVVW.exe
  C:\Windows\System\tXFkVVW.exe
  2⤵
  PID:3812
- C:\Windows\System\maBFERl.exe
  C:\Windows\System\maBFERl.exe
  2⤵
  PID:3840
- C:\Windows\System\hsmBFkb.exe
  C:\Windows\System\hsmBFkb.exe
  2⤵
  PID:3860
- C:\Windows\System\rATJvBm.exe
  C:\Windows\System\rATJvBm.exe
  2⤵
  PID:3876
- C:\Windows\System\DPmlAHw.exe
  C:\Windows\System\DPmlAHw.exe
  2⤵
  PID:3896
- C:\Windows\System\CLNPchS.exe
  C:\Windows\System\CLNPchS.exe
  2⤵
  PID:3916
- C:\Windows\System\uZToCUk.exe
  C:\Windows\System\uZToCUk.exe
  2⤵
  PID:3940
- C:\Windows\System\AarFmql.exe
  C:\Windows\System\AarFmql.exe
  2⤵
  PID:3960
- C:\Windows\System\fGWtZdg.exe
  C:\Windows\System\fGWtZdg.exe
  2⤵
  PID:3980
- C:\Windows\System\oHSpuVO.exe
  C:\Windows\System\oHSpuVO.exe
  2⤵
  PID:4000
- C:\Windows\System\ApgrZse.exe
  C:\Windows\System\ApgrZse.exe
  2⤵
  PID:4016
- C:\Windows\System\mjuHCVB.exe
  C:\Windows\System\mjuHCVB.exe
  2⤵
  PID:4040
- C:\Windows\System\yrPDMJt.exe
  C:\Windows\System\yrPDMJt.exe
  2⤵
  PID:4060
- C:\Windows\System\LgmAmyj.exe
  C:\Windows\System\LgmAmyj.exe
  2⤵
  PID:4084
- C:\Windows\System\MYLcfYt.exe
  C:\Windows\System\MYLcfYt.exe
  2⤵
  PID:2256
- C:\Windows\System\NUkLYUy.exe
  C:\Windows\System\NUkLYUy.exe
  2⤵
  PID:1448
- C:\Windows\System\LtNdmFU.exe
  C:\Windows\System\LtNdmFU.exe
  2⤵
  PID:2228
- C:\Windows\System\GmgYETZ.exe
  C:\Windows\System\GmgYETZ.exe
  2⤵
  PID:1292
- C:\Windows\System\WtptkYt.exe
  C:\Windows\System\WtptkYt.exe
  2⤵
  PID:904
- C:\Windows\System\zpCXDwE.exe
  C:\Windows\System\zpCXDwE.exe
  2⤵
  PID:2824
- C:\Windows\System\GDwsVzh.exe
  C:\Windows\System\GDwsVzh.exe
  2⤵
  PID:3132
- C:\Windows\System\wvnCeBM.exe
  C:\Windows\System\wvnCeBM.exe
  2⤵
  PID:3204
- C:\Windows\System\AhHaKQH.exe
  C:\Windows\System\AhHaKQH.exe
  2⤵
  PID:2544
- C:\Windows\System\nJjXSPw.exe
  C:\Windows\System\nJjXSPw.exe
  2⤵
  PID:2380
- C:\Windows\System\ZFGdjxg.exe
  C:\Windows\System\ZFGdjxg.exe
  2⤵
  PID:1628
- C:\Windows\System\ylwyzBc.exe
  C:\Windows\System\ylwyzBc.exe
  2⤵
  PID:1196
- C:\Windows\System\CSJEhow.exe
  C:\Windows\System\CSJEhow.exe
  2⤵
  PID:2460
- C:\Windows\System\DWBWJvH.exe
  C:\Windows\System\DWBWJvH.exe
  2⤵
  PID:1900
- C:\Windows\System\cMpxOam.exe
  C:\Windows\System\cMpxOam.exe
  2⤵
  PID:2596
- C:\Windows\System\csrDsXy.exe
  C:\Windows\System\csrDsXy.exe
  2⤵
  PID:2364
- C:\Windows\System\OSXqbUB.exe
  C:\Windows\System\OSXqbUB.exe
  2⤵
  PID:1484
- C:\Windows\System\cjFMEjx.exe
  C:\Windows\System\cjFMEjx.exe
  2⤵
  PID:560
- C:\Windows\System\gpmRwjm.exe
  C:\Windows\System\gpmRwjm.exe
  2⤵
  PID:2076
- C:\Windows\System\ZahezNu.exe
  C:\Windows\System\ZahezNu.exe
  2⤵
  PID:892
- C:\Windows\System\uMUVMYm.exe
  C:\Windows\System\uMUVMYm.exe
  2⤵
  PID:2072
- C:\Windows\System\uXsroct.exe
  C:\Windows\System\uXsroct.exe
  2⤵
  PID:1624
- C:\Windows\System\ydXlQCa.exe
  C:\Windows\System\ydXlQCa.exe
  2⤵
  PID:3116
- C:\Windows\System\Xcownze.exe
  C:\Windows\System\Xcownze.exe
  2⤵
  PID:3184
- C:\Windows\System\CjAXeED.exe
  C:\Windows\System\CjAXeED.exe
  2⤵
  PID:3252
- C:\Windows\System\OFcrDzT.exe
  C:\Windows\System\OFcrDzT.exe
  2⤵
  PID:3292
- C:\Windows\System\XPTuLsR.exe
  C:\Windows\System\XPTuLsR.exe
  2⤵
  PID:3308
- C:\Windows\System\RHFnjRe.exe
  C:\Windows\System\RHFnjRe.exe
  2⤵
  PID:3324
- C:\Windows\System\phqRiqP.exe
  C:\Windows\System\phqRiqP.exe
  2⤵
  PID:3344
- C:\Windows\System\upIAhRi.exe
  C:\Windows\System\upIAhRi.exe
  2⤵
  PID:3360
- C:\Windows\System\KHlnlvz.exe
  C:\Windows\System\KHlnlvz.exe
  2⤵
  PID:3376
- C:\Windows\System\ewmYSta.exe
  C:\Windows\System\ewmYSta.exe
  2⤵
  PID:2452
- C:\Windows\System\FeuIUUm.exe
  C:\Windows\System\FeuIUUm.exe
  2⤵
  PID:3404
- C:\Windows\System\SzGCDJR.exe
  C:\Windows\System\SzGCDJR.exe
  2⤵
  PID:2852
- C:\Windows\System\MVvYhAX.exe
  C:\Windows\System\MVvYhAX.exe
  2⤵
  PID:1644
- C:\Windows\System\eqBwCvr.exe
  C:\Windows\System\eqBwCvr.exe
  2⤵
  PID:3436
- C:\Windows\System\BkQbbYE.exe
  C:\Windows\System\BkQbbYE.exe
  2⤵
  PID:3448
- C:\Windows\System\TyKpSKZ.exe
  C:\Windows\System\TyKpSKZ.exe
  2⤵
  PID:3472
- C:\Windows\System\EnIdegO.exe
  C:\Windows\System\EnIdegO.exe
  2⤵
  PID:1248
- C:\Windows\System\SCwciiS.exe
  C:\Windows\System\SCwciiS.exe
  2⤵
  PID:848
- C:\Windows\System\zYBmXtx.exe
  C:\Windows\System\zYBmXtx.exe
  2⤵
  PID:3568
- C:\Windows\System\ShlSZab.exe
  C:\Windows\System\ShlSZab.exe
  2⤵
  PID:2056
- C:\Windows\System\fkXDzKo.exe
  C:\Windows\System\fkXDzKo.exe
  2⤵
  PID:3612
- C:\Windows\System\vqjYRRn.exe
  C:\Windows\System\vqjYRRn.exe
  2⤵
  PID:3676
- C:\Windows\System\MGBEsSv.exe
  C:\Windows\System\MGBEsSv.exe
  2⤵
  PID:3552
- C:\Windows\System\dtHGLhA.exe
  C:\Windows\System\dtHGLhA.exe
  2⤵
  PID:3756
- C:\Windows\System\VKrisdJ.exe
  C:\Windows\System\VKrisdJ.exe
  2⤵
  PID:3764
- C:\Windows\System\QRjvLIX.exe
  C:\Windows\System\QRjvLIX.exe
  2⤵
  PID:3700
- C:\Windows\System\nUTRAlB.exe
  C:\Windows\System\nUTRAlB.exe
  2⤵
  PID:3852
- C:\Windows\System\qEoBFfQ.exe
  C:\Windows\System\qEoBFfQ.exe
  2⤵
  PID:3832
- C:\Windows\System\uwgGBOQ.exe
  C:\Windows\System\uwgGBOQ.exe
  2⤵
  PID:3892
- C:\Windows\System\grkXddF.exe
  C:\Windows\System\grkXddF.exe
  2⤵
  PID:2024
- C:\Windows\System\IMpVEsv.exe
  C:\Windows\System\IMpVEsv.exe
  2⤵
  PID:3936
- C:\Windows\System\VkSPkrL.exe
  C:\Windows\System\VkSPkrL.exe
  2⤵
  PID:2036
- C:\Windows\System\TuypBkZ.exe
  C:\Windows\System\TuypBkZ.exe
  2⤵
  PID:2692
- C:\Windows\System\WnpwlkC.exe
  C:\Windows\System\WnpwlkC.exe
  2⤵
  PID:3988
- C:\Windows\System\mYCQtsR.exe
  C:\Windows\System\mYCQtsR.exe
  2⤵
  PID:4012
- C:\Windows\System\YhiazGt.exe
  C:\Windows\System\YhiazGt.exe
  2⤵
  PID:4024
- C:\Windows\System\DETfdDU.exe
  C:\Windows\System\DETfdDU.exe
  2⤵
  PID:4036
- C:\Windows\System\oQldbLC.exe
  C:\Windows\System\oQldbLC.exe
  2⤵
  PID:4076
- C:\Windows\System\PKfgRtB.exe
  C:\Windows\System\PKfgRtB.exe
  2⤵
  PID:2456
- C:\Windows\System\ggpxRsd.exe
  C:\Windows\System\ggpxRsd.exe
  2⤵
  PID:1620
- C:\Windows\System\YxsEtSO.exe
  C:\Windows\System\YxsEtSO.exe
  2⤵
  PID:2880
- C:\Windows\System\sIKBANv.exe
  C:\Windows\System\sIKBANv.exe
  2⤵
  PID:2488
- C:\Windows\System\ndnYvim.exe
  C:\Windows\System\ndnYvim.exe
  2⤵
  PID:1504
- C:\Windows\System\MGxAlfP.exe
  C:\Windows\System\MGxAlfP.exe
  2⤵
  PID:3164
- C:\Windows\System\XjarQLn.exe
  C:\Windows\System\XjarQLn.exe
  2⤵
  PID:3196
- C:\Windows\System\tzABgZx.exe
  C:\Windows\System\tzABgZx.exe
  2⤵
  PID:2872
- C:\Windows\System\JaUuFyz.exe
  C:\Windows\System\JaUuFyz.exe
  2⤵
  PID:1568
- C:\Windows\System\lvMOSJM.exe
  C:\Windows\System\lvMOSJM.exe
  2⤵
  PID:1184
- C:\Windows\System\SPUAVNq.exe
  C:\Windows\System\SPUAVNq.exe
  2⤵
  PID:2464
- C:\Windows\System\fvWCQJG.exe
  C:\Windows\System\fvWCQJG.exe
  2⤵
  PID:1348
- C:\Windows\System\oJYTwNb.exe
  C:\Windows\System\oJYTwNb.exe
  2⤵
  PID:2372
- C:\Windows\System\TAOXOIf.exe
  C:\Windows\System\TAOXOIf.exe
  2⤵
  PID:2104
- C:\Windows\System\uaxWPuY.exe
  C:\Windows\System\uaxWPuY.exe
  2⤵
  PID:2284
- C:\Windows\System\cZhfQds.exe
  C:\Windows\System\cZhfQds.exe
  2⤵
  PID:2992
- C:\Windows\System\NesLQdi.exe
  C:\Windows\System\NesLQdi.exe
  2⤵
  PID:776
- C:\Windows\System\sjvIpTx.exe
  C:\Windows\System\sjvIpTx.exe
  2⤵
  PID:628
- C:\Windows\System\ubltBvy.exe
  C:\Windows\System\ubltBvy.exe
  2⤵
  PID:2776
- C:\Windows\System\oRThtwU.exe
  C:\Windows\System\oRThtwU.exe
  2⤵
  PID:2516
- C:\Windows\System\bJefnRX.exe
  C:\Windows\System\bJefnRX.exe
  2⤵
  PID:2756
- C:\Windows\System\mnlHWFk.exe
  C:\Windows\System\mnlHWFk.exe
  2⤵
  PID:2368
- C:\Windows\System\olItpXM.exe
  C:\Windows\System\olItpXM.exe
  2⤵
  PID:1212
- C:\Windows\System\DXAOxxE.exe
  C:\Windows\System\DXAOxxE.exe
  2⤵
  PID:3080
- C:\Windows\System\OZVwdxF.exe
  C:\Windows\System\OZVwdxF.exe
  2⤵
  PID:1272
- C:\Windows\System\RoUpnJh.exe
  C:\Windows\System\RoUpnJh.exe
  2⤵
  PID:3316
- C:\Windows\System\OUnPOsF.exe
  C:\Windows\System\OUnPOsF.exe
  2⤵
  PID:108
- C:\Windows\System\XnUzIFP.exe
  C:\Windows\System\XnUzIFP.exe
  2⤵
  PID:3464
- C:\Windows\System\GlEJXgm.exe
  C:\Windows\System\GlEJXgm.exe
  2⤵
  PID:2496
- C:\Windows\System\cCOdvGD.exe
  C:\Windows\System\cCOdvGD.exe
  2⤵
  PID:3648
- C:\Windows\System\sqKYtHX.exe
  C:\Windows\System\sqKYtHX.exe
  2⤵
  PID:3800
- C:\Windows\System\oGTMGOq.exe
  C:\Windows\System\oGTMGOq.exe
  2⤵
  PID:3736
- C:\Windows\System\PtskGTK.exe
  C:\Windows\System\PtskGTK.exe
  2⤵
  PID:3432
- C:\Windows\System\HoOjroT.exe
  C:\Windows\System\HoOjroT.exe
  2⤵
  PID:3592
- C:\Windows\System\DsMxgSY.exe
  C:\Windows\System\DsMxgSY.exe
  2⤵
  PID:1456
- C:\Windows\System\gVhADSp.exe
  C:\Windows\System\gVhADSp.exe
  2⤵
  PID:3556
- C:\Windows\System\yZhwKNv.exe
  C:\Windows\System\yZhwKNv.exe
  2⤵
  PID:3632
- C:\Windows\System\VwzRytU.exe
  C:\Windows\System\VwzRytU.exe
  2⤵
  PID:3304
- C:\Windows\System\LqjYiRf.exe
  C:\Windows\System\LqjYiRf.exe
  2⤵
  PID:3368
- C:\Windows\System\NPykbRB.exe
  C:\Windows\System\NPykbRB.exe
  2⤵
  PID:3420
- C:\Windows\System\ZDBzqfh.exe
  C:\Windows\System\ZDBzqfh.exe
  2⤵
  PID:3516
- C:\Windows\System\NtqPDEj.exe
  C:\Windows\System\NtqPDEj.exe
  2⤵
  PID:3712
- C:\Windows\System\tzlfHjR.exe
  C:\Windows\System\tzlfHjR.exe
  2⤵
  PID:1608
- C:\Windows\System\oiLmUVU.exe
  C:\Windows\System\oiLmUVU.exe
  2⤵
  PID:1984
- C:\Windows\System\cPNpPLT.exe
  C:\Windows\System\cPNpPLT.exe
  2⤵
  PID:3976
- C:\Windows\System\DSvXsph.exe
  C:\Windows\System\DSvXsph.exe
  2⤵
  PID:4052
- C:\Windows\System\WPPndxP.exe
  C:\Windows\System\WPPndxP.exe
  2⤵
  PID:4108
- C:\Windows\System\IDfpRMc.exe
  C:\Windows\System\IDfpRMc.exe
  2⤵
  PID:4124
- C:\Windows\System\rxZBbby.exe
  C:\Windows\System\rxZBbby.exe
  2⤵
  PID:4140
- C:\Windows\System\gRoxrMS.exe
  C:\Windows\System\gRoxrMS.exe
  2⤵
  PID:4156
- C:\Windows\System\SuiLapZ.exe
  C:\Windows\System\SuiLapZ.exe
  2⤵
  PID:4172
- C:\Windows\System\dHJMWTU.exe
  C:\Windows\System\dHJMWTU.exe
  2⤵
  PID:4188
- C:\Windows\System\SxMXgYn.exe
  C:\Windows\System\SxMXgYn.exe
  2⤵
  PID:4204
- C:\Windows\System\QcoipOc.exe
  C:\Windows\System\QcoipOc.exe
  2⤵
  PID:4224
- C:\Windows\System\NAtzmGD.exe
  C:\Windows\System\NAtzmGD.exe
  2⤵
  PID:4240
- C:\Windows\System\ebBoDLV.exe
  C:\Windows\System\ebBoDLV.exe
  2⤵
  PID:4256
- C:\Windows\System\ayXbTjM.exe
  C:\Windows\System\ayXbTjM.exe
  2⤵
  PID:4272
- C:\Windows\System\hCMsatW.exe
  C:\Windows\System\hCMsatW.exe
  2⤵
  PID:4288
- C:\Windows\System\XIeGnqq.exe
  C:\Windows\System\XIeGnqq.exe
  2⤵
  PID:4304
- C:\Windows\System\dFRwvOI.exe
  C:\Windows\System\dFRwvOI.exe
  2⤵
  PID:4320
- C:\Windows\System\tXyJPFt.exe
  C:\Windows\System\tXyJPFt.exe
  2⤵
  PID:4340
- C:\Windows\System\AoegSUg.exe
  C:\Windows\System\AoegSUg.exe
  2⤵
  PID:4356
- C:\Windows\System\Qczkyzo.exe
  C:\Windows\System\Qczkyzo.exe
  2⤵
  PID:4372
- C:\Windows\System\QNamZuW.exe
  C:\Windows\System\QNamZuW.exe
  2⤵
  PID:4388
- C:\Windows\System\nNtQtSK.exe
  C:\Windows\System\nNtQtSK.exe
  2⤵
  PID:4404
- C:\Windows\System\oifCwST.exe
  C:\Windows\System\oifCwST.exe
  2⤵
  PID:4424
- C:\Windows\System\nXNdDMX.exe
  C:\Windows\System\nXNdDMX.exe
  2⤵
  PID:4440
- C:\Windows\System\fKOYzIU.exe
  C:\Windows\System\fKOYzIU.exe
  2⤵
  PID:4456
- C:\Windows\System\KONAFKf.exe
  C:\Windows\System\KONAFKf.exe
  2⤵
  PID:4472
- C:\Windows\System\jvKyFbL.exe
  C:\Windows\System\jvKyFbL.exe
  2⤵
  PID:4488
- C:\Windows\System\FPXjhcH.exe
  C:\Windows\System\FPXjhcH.exe
  2⤵
  PID:4504
- C:\Windows\System\sMWPrkl.exe
  C:\Windows\System\sMWPrkl.exe
  2⤵
  PID:4520
- C:\Windows\System\JOGNazf.exe
  C:\Windows\System\JOGNazf.exe
  2⤵
  PID:4536
- C:\Windows\System\ovOculw.exe
  C:\Windows\System\ovOculw.exe
  2⤵
  PID:4772
- C:\Windows\System\jqWtLJq.exe
  C:\Windows\System\jqWtLJq.exe
  2⤵
  PID:4788
- C:\Windows\System\RRAubUJ.exe
  C:\Windows\System\RRAubUJ.exe
  2⤵
  PID:4888
- C:\Windows\System\JApElrj.exe
  C:\Windows\System\JApElrj.exe
  2⤵
  PID:4904
- C:\Windows\System\bvmAPax.exe
  C:\Windows\System\bvmAPax.exe
  2⤵
  PID:4920
- C:\Windows\System\iNzarSV.exe
  C:\Windows\System\iNzarSV.exe
  2⤵
  PID:4936
- C:\Windows\System\uwcVDWo.exe
  C:\Windows\System\uwcVDWo.exe
  2⤵
  PID:4952
- C:\Windows\System\WkDhTFW.exe
  C:\Windows\System\WkDhTFW.exe
  2⤵
  PID:4968
- C:\Windows\System\OKLgxaI.exe
  C:\Windows\System\OKLgxaI.exe
  2⤵
  PID:4984
- C:\Windows\System\pNnWSWt.exe
  C:\Windows\System\pNnWSWt.exe
  2⤵
  PID:5000
- C:\Windows\System\XIfptdP.exe
  C:\Windows\System\XIfptdP.exe
  2⤵
  PID:5016
- C:\Windows\System\wkahObZ.exe
  C:\Windows\System\wkahObZ.exe
  2⤵
  PID:5032
- C:\Windows\System\InyTbBZ.exe
  C:\Windows\System\InyTbBZ.exe
  2⤵
  PID:5048
- C:\Windows\System\mYFPhno.exe
  C:\Windows\System\mYFPhno.exe
  2⤵
  PID:5064
- C:\Windows\System\xbFOdIJ.exe
  C:\Windows\System\xbFOdIJ.exe
  2⤵
  PID:5080
- C:\Windows\System\sYxuLeN.exe
  C:\Windows\System\sYxuLeN.exe
  2⤵
  PID:5100
- C:\Windows\System\SvQBfkS.exe
  C:\Windows\System\SvQBfkS.exe
  2⤵
  PID:5116
- C:\Windows\System\myIOljj.exe
  C:\Windows\System\myIOljj.exe
  2⤵
  PID:3168
- C:\Windows\System\tvzIWXN.exe
  C:\Windows\System\tvzIWXN.exe
  2⤵
  PID:2080
- C:\Windows\System\BYVghOn.exe
  C:\Windows\System\BYVghOn.exe
  2⤵
  PID:3948
- C:\Windows\System\qHUjVzq.exe
  C:\Windows\System\qHUjVzq.exe
  2⤵
  PID:2308
- C:\Windows\System\LXToLNj.exe
  C:\Windows\System\LXToLNj.exe
  2⤵
  PID:1896
- C:\Windows\System\ChihkAh.exe
  C:\Windows\System\ChihkAh.exe
  2⤵
  PID:1572
- C:\Windows\System\jnWJyUr.exe
  C:\Windows\System\jnWJyUr.exe
  2⤵
  PID:3412
- C:\Windows\System\ONMdamt.exe
  C:\Windows\System\ONMdamt.exe
  2⤵
  PID:3320
- C:\Windows\System\jYnLtot.exe
  C:\Windows\System\jYnLtot.exe
  2⤵
  PID:1632
- C:\Windows\System\ArejQyk.exe
  C:\Windows\System\ArejQyk.exe
  2⤵
  PID:4028
- C:\Windows\System\PYuBbzz.exe
  C:\Windows\System\PYuBbzz.exe
  2⤵
  PID:3296
- C:\Windows\System\wVdRWih.exe
  C:\Windows\System\wVdRWih.exe
  2⤵
  PID:3400
- C:\Windows\System\EMfGQWc.exe
  C:\Windows\System\EMfGQWc.exe
  2⤵
  PID:2520
- C:\Windows\System\RsMsbZq.exe
  C:\Windows\System\RsMsbZq.exe
  2⤵
  PID:3828
- C:\Windows\System\vLsVdyg.exe
  C:\Windows\System\vLsVdyg.exe
  2⤵
  PID:4152
- C:\Windows\System\yRlExya.exe
  C:\Windows\System\yRlExya.exe
  2⤵
  PID:4248
- C:\Windows\System\qyzqmfr.exe
  C:\Windows\System\qyzqmfr.exe
  2⤵
  PID:2724
- C:\Windows\System\BuZmHkI.exe
  C:\Windows\System\BuZmHkI.exe
  2⤵
  PID:4168
- C:\Windows\System\ZWkMBWQ.exe
  C:\Windows\System\ZWkMBWQ.exe
  2⤵
  PID:4556
- C:\Windows\System\JreQQif.exe
  C:\Windows\System\JreQQif.exe
  2⤵
  PID:1216
- C:\Windows\System\OjHqQLT.exe
  C:\Windows\System\OjHqQLT.exe
  2⤵
  PID:4008
- C:\Windows\System\UwZLTEH.exe
  C:\Windows\System\UwZLTEH.exe
  2⤵
  PID:3696
- C:\Windows\System\fGzzzGC.exe
  C:\Windows\System\fGzzzGC.exe
  2⤵
  PID:4072
- C:\Windows\System\OiMWHzG.exe
  C:\Windows\System\OiMWHzG.exe
  2⤵
  PID:3032
- C:\Windows\System\WqewCGw.exe
  C:\Windows\System\WqewCGw.exe
  2⤵
  PID:1868
- C:\Windows\System\RPKDodi.exe
  C:\Windows\System\RPKDodi.exe
  2⤵
  PID:1596
- C:\Windows\System\VWvxVNA.exe
  C:\Windows\System\VWvxVNA.exe
  2⤵
  PID:1588
- C:\Windows\System\uIipTaT.exe
  C:\Windows\System\uIipTaT.exe
  2⤵
  PID:1704
- C:\Windows\System\LtmnaKT.exe
  C:\Windows\System\LtmnaKT.exe
  2⤵
  PID:3356
- C:\Windows\System\AqWDBig.exe
  C:\Windows\System\AqWDBig.exe
  2⤵
  PID:3644
- C:\Windows\System\xtBVLWT.exe
  C:\Windows\System\xtBVLWT.exe
  2⤵
  PID:3440
- C:\Windows\System\HaJczjd.exe
  C:\Windows\System\HaJczjd.exe
  2⤵
  PID:1536
- C:\Windows\System\XKULAmV.exe
  C:\Windows\System\XKULAmV.exe
  2⤵
  PID:4104
- C:\Windows\System\aEMqUAH.exe
  C:\Windows\System\aEMqUAH.exe
  2⤵
  PID:4236
- C:\Windows\System\RJcuWcI.exe
  C:\Windows\System\RJcuWcI.exe
  2⤵
  PID:4756
- C:\Windows\System\sDUjTjX.exe
  C:\Windows\System\sDUjTjX.exe
  2⤵
  PID:4296
- C:\Windows\System\wZWQuwC.exe
  C:\Windows\System\wZWQuwC.exe
  2⤵
  PID:4400
- C:\Windows\System\JCoTCDE.exe
  C:\Windows\System\JCoTCDE.exe
  2⤵
  PID:4568
- C:\Windows\System\iSqCJzT.exe
  C:\Windows\System\iSqCJzT.exe
  2⤵
  PID:4588
- C:\Windows\System\XOwhjMi.exe
  C:\Windows\System\XOwhjMi.exe
  2⤵
  PID:4620
- C:\Windows\System\ppjwMou.exe
  C:\Windows\System\ppjwMou.exe
  2⤵
  PID:4604
- C:\Windows\System\sJhGGKu.exe
  C:\Windows\System\sJhGGKu.exe
  2⤵
  PID:4632
- C:\Windows\System\lSEhJTH.exe
  C:\Windows\System\lSEhJTH.exe
  2⤵
  PID:4648
- C:\Windows\System\qDdUylS.exe
  C:\Windows\System\qDdUylS.exe
  2⤵
  PID:4668
- C:\Windows\System\RBSfTFc.exe
  C:\Windows\System\RBSfTFc.exe
  2⤵
  PID:4684
- C:\Windows\System\vVIKvtz.exe
  C:\Windows\System\vVIKvtz.exe
  2⤵
  PID:4700
- C:\Windows\System\gSTTIQA.exe
  C:\Windows\System\gSTTIQA.exe
  2⤵
  PID:4720
- C:\Windows\System\yELAtsu.exe
  C:\Windows\System\yELAtsu.exe
  2⤵
  PID:4732
- C:\Windows\System\sVhOXum.exe
  C:\Windows\System\sVhOXum.exe
  2⤵
  PID:4748
- C:\Windows\System\wNygNDl.exe
  C:\Windows\System\wNygNDl.exe
  2⤵
  PID:4412
- C:\Windows\System\unUJYsG.exe
  C:\Windows\System\unUJYsG.exe
  2⤵
  PID:4420
- C:\Windows\System\DtcufqL.exe
  C:\Windows\System\DtcufqL.exe
  2⤵
  PID:4496
- C:\Windows\System\rmokHPP.exe
  C:\Windows\System\rmokHPP.exe
  2⤵
  PID:4532
- C:\Windows\System\tvMIMuw.exe
  C:\Windows\System\tvMIMuw.exe
  2⤵
  PID:4512
- C:\Windows\System\NblBuwO.exe
  C:\Windows\System\NblBuwO.exe
  2⤵
  PID:4480
- C:\Windows\System\HynzlVI.exe
  C:\Windows\System\HynzlVI.exe
  2⤵
  PID:4768
- C:\Windows\System\bepoRCk.exe
  C:\Windows\System\bepoRCk.exe
  2⤵
  PID:4812
- C:\Windows\System\jBCHmdI.exe
  C:\Windows\System\jBCHmdI.exe
  2⤵
  PID:4824
- C:\Windows\System\xGzrmql.exe
  C:\Windows\System\xGzrmql.exe
  2⤵
  PID:4840
- C:\Windows\System\avYbeWO.exe
  C:\Windows\System\avYbeWO.exe
  2⤵
  PID:4852
- C:\Windows\System\rfmIiGN.exe
  C:\Windows\System\rfmIiGN.exe
  2⤵
  PID:4868
- C:\Windows\System\TiHPjsR.exe
  C:\Windows\System\TiHPjsR.exe
  2⤵
  PID:2656
- C:\Windows\System\tIUHIru.exe
  C:\Windows\System\tIUHIru.exe
  2⤵
  PID:2432
- C:\Windows\System\pwaEzUE.exe
  C:\Windows\System\pwaEzUE.exe
  2⤵
  PID:4916
- C:\Windows\System\uMKVDcw.exe
  C:\Windows\System\uMKVDcw.exe
  2⤵
  PID:4980
- C:\Windows\System\VFmzjxB.exe
  C:\Windows\System\VFmzjxB.exe
  2⤵
  PID:5044
- C:\Windows\System\xeXoOGQ.exe
  C:\Windows\System\xeXoOGQ.exe
  2⤵
  PID:5108
- C:\Windows\System\wbsyZdI.exe
  C:\Windows\System\wbsyZdI.exe
  2⤵
  PID:1748
- C:\Windows\System\EBwbyIb.exe
  C:\Windows\System\EBwbyIb.exe
  2⤵
  PID:3288
- C:\Windows\System\xUuCrzb.exe
  C:\Windows\System\xUuCrzb.exe
  2⤵
  PID:4896
- C:\Windows\System\ZDedCYN.exe
  C:\Windows\System\ZDedCYN.exe
  2⤵
  PID:4992
- C:\Windows\System\bEBGdAt.exe
  C:\Windows\System\bEBGdAt.exe
  2⤵
  PID:3824
- C:\Windows\System\ETQVFOg.exe
  C:\Windows\System\ETQVFOg.exe
  2⤵
  PID:2828
- C:\Windows\System\WPawZmh.exe
  C:\Windows\System\WPawZmh.exe
  2⤵
  PID:4148
- C:\Windows\System\AGfGvEa.exe
  C:\Windows\System\AGfGvEa.exe
  2⤵
  PID:4744
- C:\Windows\System\ARRipEC.exe
  C:\Windows\System\ARRipEC.exe
  2⤵
  PID:4528
- C:\Windows\System\LkeatfR.exe
  C:\Windows\System\LkeatfR.exe
  2⤵
  PID:4800
- C:\Windows\System\sgLVAPW.exe
  C:\Windows\System\sgLVAPW.exe
  2⤵
  PID:4860
- C:\Windows\System\ikrbJNb.exe
  C:\Windows\System\ikrbJNb.exe
  2⤵
  PID:4380
- C:\Windows\System\ZrfMbzT.exe
  C:\Windows\System\ZrfMbzT.exe
  2⤵
  PID:4468
- C:\Windows\System\mkSdPhc.exe
  C:\Windows\System\mkSdPhc.exe
  2⤵
  PID:4848
- C:\Windows\System\bVaypLA.exe
  C:\Windows\System\bVaypLA.exe
  2⤵
  PID:5012
- C:\Windows\System\RlLTRng.exe
  C:\Windows\System\RlLTRng.exe
  2⤵
  PID:4516
- C:\Windows\System\YXSyvJY.exe
  C:\Windows\System\YXSyvJY.exe
  2⤵
  PID:5040
- C:\Windows\System\psJUqVQ.exe
  C:\Windows\System\psJUqVQ.exe
  2⤵
  PID:2404
- C:\Windows\System\FdvKXqa.exe
  C:\Windows\System\FdvKXqa.exe
  2⤵
  PID:4964
- C:\Windows\System\BIAhCCj.exe
  C:\Windows\System\BIAhCCj.exe
  2⤵
  PID:5088
- C:\Windows\System\WNsiPOH.exe
  C:\Windows\System\WNsiPOH.exe
  2⤵
  PID:3100
- C:\Windows\System\XZEOwey.exe
  C:\Windows\System\XZEOwey.exe
  2⤵
  PID:2868
- C:\Windows\System\mtGlbDB.exe
  C:\Windows\System\mtGlbDB.exe
  2⤵
  PID:3284
- C:\Windows\System\cBizRzY.exe
  C:\Windows\System\cBizRzY.exe
  2⤵
  PID:3056
- C:\Windows\System\ETgvbYu.exe
  C:\Windows\System\ETgvbYu.exe
  2⤵
  PID:400
- C:\Windows\System\OTxVjRs.exe
  C:\Windows\System\OTxVjRs.exe
  2⤵
  PID:2652
- C:\Windows\System\aaEKsbB.exe
  C:\Windows\System\aaEKsbB.exe
  2⤵
  PID:2896
- C:\Windows\System\rehJnVS.exe
  C:\Windows\System\rehJnVS.exe
  2⤵
  PID:2232
- C:\Windows\System\cwteBcu.exe
  C:\Windows\System\cwteBcu.exe
  2⤵
  PID:1360
- C:\Windows\System\mYyUmMk.exe
  C:\Windows\System\mYyUmMk.exe
  2⤵
  PID:1680
- C:\Windows\System\ORGviif.exe
  C:\Windows\System\ORGviif.exe
  2⤵
  PID:3484
- C:\Windows\System\NWekkUi.exe
  C:\Windows\System\NWekkUi.exe
  2⤵
  PID:4548
- C:\Windows\System\YxOGyEM.exe
  C:\Windows\System\YxOGyEM.exe
  2⤵
  PID:2296
- C:\Windows\System\HEdWqkC.exe
  C:\Windows\System\HEdWqkC.exe
  2⤵
  PID:3528
- C:\Windows\System\OzPlsJF.exe
  C:\Windows\System\OzPlsJF.exe
  2⤵
  PID:4200
- C:\Windows\System\zFCDCbN.exe
  C:\Windows\System\zFCDCbN.exe
  2⤵
  PID:4264
- C:\Windows\System\zrJHuVC.exe
  C:\Windows\System\zrJHuVC.exe
  2⤵
  PID:4552
- C:\Windows\System\MGzHCGR.exe
  C:\Windows\System\MGzHCGR.exe
  2⤵
  PID:4696
- C:\Windows\System\XSXudQN.exe
  C:\Windows\System\XSXudQN.exe
  2⤵
  PID:4608
- C:\Windows\System\QecLceF.exe
  C:\Windows\System\QecLceF.exe
  2⤵
  PID:4584
- C:\Windows\System\NYlTOIg.exe
  C:\Windows\System\NYlTOIg.exe
  2⤵
  PID:4716
- C:\Windows\System\nogVoZn.exe
  C:\Windows\System\nogVoZn.exe
  2⤵
  PID:4712
- C:\Windows\System\rBchCjZ.exe
  C:\Windows\System\rBchCjZ.exe
  2⤵
  PID:4500
- C:\Windows\System\xNvEVJl.exe
  C:\Windows\System\xNvEVJl.exe
  2⤵
  PID:4836
- C:\Windows\System\CjTflYZ.exe
  C:\Windows\System\CjTflYZ.exe
  2⤵
  PID:4396
- C:\Windows\System\NoZMhFQ.exe
  C:\Windows\System\NoZMhFQ.exe
  2⤵
  PID:5132
- C:\Windows\System\qaScQdy.exe
  C:\Windows\System\qaScQdy.exe
  2⤵
  PID:5148
- C:\Windows\System\rRMPqJA.exe
  C:\Windows\System\rRMPqJA.exe
  2⤵
  PID:5164
- C:\Windows\System\jXXgUDb.exe
  C:\Windows\System\jXXgUDb.exe
  2⤵
  PID:5180
- C:\Windows\System\DhwBonL.exe
  C:\Windows\System\DhwBonL.exe
  2⤵
  PID:5196
- C:\Windows\System\cZJnUSW.exe
  C:\Windows\System\cZJnUSW.exe
  2⤵
  PID:5212
- C:\Windows\System\bsqDybA.exe
  C:\Windows\System\bsqDybA.exe
  2⤵
  PID:5228
- C:\Windows\System\aYCkRDF.exe
  C:\Windows\System\aYCkRDF.exe
  2⤵
  PID:5248
- C:\Windows\System\ajBSOQO.exe
  C:\Windows\System\ajBSOQO.exe
  2⤵
  PID:5264
- C:\Windows\System\iPnkvYp.exe
  C:\Windows\System\iPnkvYp.exe
  2⤵
  PID:5280
- C:\Windows\System\zkZuZMZ.exe
  C:\Windows\System\zkZuZMZ.exe
  2⤵
  PID:5296
- C:\Windows\System\tOjpUZu.exe
  C:\Windows\System\tOjpUZu.exe
  2⤵
  PID:5312
- C:\Windows\System\aFVnzuq.exe
  C:\Windows\System\aFVnzuq.exe
  2⤵
  PID:5332
- C:\Windows\System\CBSoTOd.exe
  C:\Windows\System\CBSoTOd.exe
  2⤵
  PID:5348
- C:\Windows\System\HqSiGko.exe
  C:\Windows\System\HqSiGko.exe
  2⤵
  PID:5364
- C:\Windows\System\TqISmDX.exe
  C:\Windows\System\TqISmDX.exe
  2⤵
  PID:5380
- C:\Windows\System\aJlFWOo.exe
  C:\Windows\System\aJlFWOo.exe
  2⤵
  PID:5400
- C:\Windows\System\YJTCNiJ.exe
  C:\Windows\System\YJTCNiJ.exe
  2⤵
  PID:5416
- C:\Windows\System\NvGIRbk.exe
  C:\Windows\System\NvGIRbk.exe
  2⤵
  PID:5432
- C:\Windows\System\OjRVvBV.exe
  C:\Windows\System\OjRVvBV.exe
  2⤵
  PID:5448
- C:\Windows\System\bBoVwuh.exe
  C:\Windows\System\bBoVwuh.exe
  2⤵
  PID:5464
- C:\Windows\System\AfsBpUw.exe
  C:\Windows\System\AfsBpUw.exe
  2⤵
  PID:5480
- C:\Windows\System\toiXrkg.exe
  C:\Windows\System\toiXrkg.exe
  2⤵
  PID:5500
- C:\Windows\System\fQkJsFt.exe
  C:\Windows\System\fQkJsFt.exe
  2⤵
  PID:5516
- C:\Windows\System\hSekbvK.exe
  C:\Windows\System\hSekbvK.exe
  2⤵
  PID:5532
- C:\Windows\System\WZWUqWf.exe
  C:\Windows\System\WZWUqWf.exe
  2⤵
  PID:5548
- C:\Windows\System\eDOYclA.exe
  C:\Windows\System\eDOYclA.exe
  2⤵
  PID:5564
- C:\Windows\System\DxJrWBh.exe
  C:\Windows\System\DxJrWBh.exe
  2⤵
  PID:5580
- C:\Windows\System\kuYNHPZ.exe
  C:\Windows\System\kuYNHPZ.exe
  2⤵
  PID:5600
- C:\Windows\System\zQHiQCN.exe
  C:\Windows\System\zQHiQCN.exe
  2⤵
  PID:5616
- C:\Windows\System\hghjJcv.exe
  C:\Windows\System\hghjJcv.exe
  2⤵
  PID:5632
- C:\Windows\System\qLNSYcA.exe
  C:\Windows\System\qLNSYcA.exe
  2⤵
  PID:5648
- C:\Windows\System\wDjpqFc.exe
  C:\Windows\System\wDjpqFc.exe
  2⤵
  PID:5672
- C:\Windows\System\ohyoIZC.exe
  C:\Windows\System\ohyoIZC.exe
  2⤵
  PID:5688
- C:\Windows\System\nsfAXSY.exe
  C:\Windows\System\nsfAXSY.exe
  2⤵
  PID:5716
- C:\Windows\System\mLXJTNI.exe
  C:\Windows\System\mLXJTNI.exe
  2⤵
  PID:5732
- C:\Windows\System\eUfYlzR.exe
  C:\Windows\System\eUfYlzR.exe
  2⤵
  PID:5908
- C:\Windows\System\qFLNtmQ.exe
  C:\Windows\System\qFLNtmQ.exe
  2⤵
  PID:5952
- C:\Windows\System\mnVNJRd.exe
  C:\Windows\System\mnVNJRd.exe
  2⤵
  PID:6008
- C:\Windows\System\IGGBDcQ.exe
  C:\Windows\System\IGGBDcQ.exe
  2⤵
  PID:6048
- C:\Windows\System\UEWstKD.exe
  C:\Windows\System\UEWstKD.exe
  2⤵
  PID:6064
- C:\Windows\System\yQFuuYh.exe
  C:\Windows\System\yQFuuYh.exe
  2⤵
  PID:6080
- C:\Windows\System\MVXzrHj.exe
  C:\Windows\System\MVXzrHj.exe
  2⤵
  PID:6096
- C:\Windows\System\TukLhAL.exe
  C:\Windows\System\TukLhAL.exe
  2⤵
  PID:6112
- C:\Windows\System\kkoSwkv.exe
  C:\Windows\System\kkoSwkv.exe
  2⤵
  PID:6128
- C:\Windows\System\RNQupxK.exe
  C:\Windows\System\RNQupxK.exe
  2⤵
  PID:1796
- C:\Windows\System\uhdrOrz.exe
  C:\Windows\System\uhdrOrz.exe
  2⤵
  PID:2800
- C:\Windows\System\KPETflD.exe
  C:\Windows\System\KPETflD.exe
  2⤵
  PID:2416
- C:\Windows\System\LhyGPvu.exe
  C:\Windows\System\LhyGPvu.exe
  2⤵
  PID:4056
- C:\Windows\System\ngSLsvA.exe
  C:\Windows\System\ngSLsvA.exe
  2⤵
  PID:4912
- C:\Windows\System\VsyzQmI.exe
  C:\Windows\System\VsyzQmI.exe
  2⤵
  PID:5512
- C:\Windows\System\teyBfTF.exe
  C:\Windows\System\teyBfTF.exe
  2⤵
  PID:5444
- C:\Windows\System\zpazLwq.exe
  C:\Windows\System\zpazLwq.exe
  2⤵
  PID:5372
- C:\Windows\System\mfzgtpC.exe
  C:\Windows\System\mfzgtpC.exe
  2⤵
  PID:5304
- C:\Windows\System\KluLGjx.exe
  C:\Windows\System\KluLGjx.exe
  2⤵
  PID:5236
- C:\Windows\System\WyMnJKj.exe
  C:\Windows\System\WyMnJKj.exe
  2⤵
  PID:5640
- C:\Windows\System\frHyXhz.exe
  C:\Windows\System\frHyXhz.exe
  2⤵
  PID:5612
- C:\Windows\System\wUUhIZO.exe
  C:\Windows\System\wUUhIZO.exe
  2⤵
  PID:5496
- C:\Windows\System\MGNCoqX.exe
  C:\Windows\System\MGNCoqX.exe
  2⤵
  PID:5660
- C:\Windows\System\JLqnIFW.exe
  C:\Windows\System\JLqnIFW.exe
  2⤵
  PID:5664
- C:\Windows\System\bweRiZP.exe
  C:\Windows\System\bweRiZP.exe
  2⤵
  PID:5356
- C:\Windows\System\qhdhPvO.exe
  C:\Windows\System\qhdhPvO.exe
  2⤵
  PID:4820
- C:\Windows\System\MRDXHBc.exe
  C:\Windows\System\MRDXHBc.exe
  2⤵
  PID:5488
- C:\Windows\System\UjeFNyJ.exe
  C:\Windows\System\UjeFNyJ.exe
  2⤵
  PID:4976
- C:\Windows\System\KymaxCa.exe
  C:\Windows\System\KymaxCa.exe
  2⤵
  PID:5060
- C:\Windows\System\KxKUPvU.exe
  C:\Windows\System\KxKUPvU.exe
  2⤵
  PID:4216
- C:\Windows\System\gMZqdJZ.exe
  C:\Windows\System\gMZqdJZ.exe
  2⤵
  PID:2468
- C:\Windows\System\zZjjQyK.exe
  C:\Windows\System\zZjjQyK.exe
  2⤵
  PID:5192
- C:\Windows\System\xNztUzj.exe
  C:\Windows\System\xNztUzj.exe
  2⤵
  PID:4664
- C:\Windows\System\nXcORtX.exe
  C:\Windows\System\nXcORtX.exe
  2⤵
  PID:2224
- C:\Windows\System\HCCRxGX.exe
  C:\Windows\System\HCCRxGX.exe
  2⤵
  PID:4436
- C:\Windows\System\vboghxA.exe
  C:\Windows\System\vboghxA.exe
  2⤵
  PID:5244
- C:\Windows\System\JoudNIi.exe
  C:\Windows\System\JoudNIi.exe
  2⤵
  PID:1888
- C:\Windows\System\LXskUIc.exe
  C:\Windows\System\LXskUIc.exe
  2⤵
  PID:5156
- C:\Windows\System\UJUWyOr.exe
  C:\Windows\System\UJUWyOr.exe
  2⤵
  PID:5724
- C:\Windows\System\TozenRR.exe
  C:\Windows\System\TozenRR.exe
  2⤵
  PID:5748
- C:\Windows\System\uYrWXBN.exe
  C:\Windows\System\uYrWXBN.exe
  2⤵
  PID:5764
- C:\Windows\System\sQqaKJb.exe
  C:\Windows\System\sQqaKJb.exe
  2⤵
  PID:5784
- C:\Windows\System\MdjgsYT.exe
  C:\Windows\System\MdjgsYT.exe
  2⤵
  PID:5920
- C:\Windows\System\iSpmiKP.exe
  C:\Windows\System\iSpmiKP.exe
  2⤵
  PID:5932
- C:\Windows\System\yTxtoSw.exe
  C:\Windows\System\yTxtoSw.exe
  2⤵
  PID:5940
- C:\Windows\System\UOwfXzH.exe
  C:\Windows\System\UOwfXzH.exe
  2⤵
  PID:5800
- C:\Windows\System\lsqphWG.exe
  C:\Windows\System\lsqphWG.exe
  2⤵
  PID:5816
- C:\Windows\System\YWbhzKl.exe
  C:\Windows\System\YWbhzKl.exe
  2⤵
  PID:5832
- C:\Windows\System\pCfJTrM.exe
  C:\Windows\System\pCfJTrM.exe
  2⤵
  PID:5848
- C:\Windows\System\yVGjBHs.exe
  C:\Windows\System\yVGjBHs.exe
  2⤵
  PID:5876
- C:\Windows\System\HjpQnwE.exe
  C:\Windows\System\HjpQnwE.exe
  2⤵
  PID:5888
- C:\Windows\System\oqDCnab.exe
  C:\Windows\System\oqDCnab.exe
  2⤵
  PID:5972
- C:\Windows\System\KNmsftE.exe
  C:\Windows\System\KNmsftE.exe
  2⤵
  PID:5968
- C:\Windows\System\VgFeLxq.exe
  C:\Windows\System\VgFeLxq.exe
  2⤵
  PID:5996
- C:\Windows\System\zpZnnNa.exe
  C:\Windows\System\zpZnnNa.exe
  2⤵
  PID:6032
- C:\Windows\System\jJTZEjY.exe
  C:\Windows\System\jJTZEjY.exe
  2⤵
  PID:5988
- C:\Windows\System\EeCLNXB.exe
  C:\Windows\System\EeCLNXB.exe
  2⤵
  PID:6104
- C:\Windows\System\rsFlGGj.exe
  C:\Windows\System\rsFlGGj.exe
  2⤵
  PID:3956
- C:\Windows\System\pgKNBZN.exe
  C:\Windows\System\pgKNBZN.exe
  2⤵
  PID:6108
- C:\Windows\System\VodDaJu.exe
  C:\Windows\System\VodDaJu.exe
  2⤵
  PID:6072
- C:\Windows\System\dZIaDrX.exe
  C:\Windows\System\dZIaDrX.exe
  2⤵
  PID:3532
- C:\Windows\System\vzSYjjp.exe
  C:\Windows\System\vzSYjjp.exe
  2⤵
  PID:6060
- C:\Windows\System\IadFrGz.exe
  C:\Windows\System\IadFrGz.exe
  2⤵
  PID:4136
- C:\Windows\System\sayEKjL.exe
  C:\Windows\System\sayEKjL.exe
  2⤵
  PID:5472
- C:\Windows\System\VsQHflZ.exe
  C:\Windows\System\VsQHflZ.exe
  2⤵
  PID:5340
- C:\Windows\System\ihUhKTZ.exe
  C:\Windows\System\ihUhKTZ.exe
  2⤵
  PID:5424
- C:\Windows\System\hRMnBcJ.exe
  C:\Windows\System\hRMnBcJ.exe
  2⤵
  PID:5360
- C:\Windows\System\QIIXLmX.exe
  C:\Windows\System\QIIXLmX.exe
  2⤵
  PID:5260
- C:\Windows\System\lnFDXZc.exe
  C:\Windows\System\lnFDXZc.exe
  2⤵
  PID:3868
- C:\Windows\System\kYwRpCW.exe
  C:\Windows\System\kYwRpCW.exe
  2⤵
  PID:5388
- C:\Windows\System\Hwpvnhq.exe
  C:\Windows\System\Hwpvnhq.exe
  2⤵
  PID:5056
- C:\Windows\System\mtRnZNc.exe
  C:\Windows\System\mtRnZNc.exe
  2⤵
  PID:1604
- C:\Windows\System\kNqSNDy.exe
  C:\Windows\System\kNqSNDy.exe
  2⤵
  PID:4576
- C:\Windows\System\vXxGRJz.exe
  C:\Windows\System\vXxGRJz.exe
  2⤵
  PID:5392
- C:\Windows\System\cRcFOlN.exe
  C:\Windows\System\cRcFOlN.exe
  2⤵
  PID:5528
- C:\Windows\System\jzGyhaG.exe
  C:\Windows\System\jzGyhaG.exe
  2⤵
  PID:5684
- C:\Windows\System\vOjJKAT.exe
  C:\Windows\System\vOjJKAT.exe
  2⤵
  PID:5224
- C:\Windows\System\qIHxGQq.exe
  C:\Windows\System\qIHxGQq.exe
  2⤵
  PID:5256
- C:\Windows\System\dBXSWiU.exe
  C:\Windows\System\dBXSWiU.exe
  2⤵
  PID:4332
- C:\Windows\System\VrWezXt.exe
  C:\Windows\System\VrWezXt.exe
  2⤵
  PID:4232
- C:\Windows\System\VrLnkLD.exe
  C:\Windows\System\VrLnkLD.exe
  2⤵
  PID:4680
- C:\Windows\System\bXYLgji.exe
  C:\Windows\System\bXYLgji.exe
  2⤵
  PID:5916
- C:\Windows\System\gSsdznK.exe
  C:\Windows\System\gSsdznK.exe
  2⤵
  PID:5808
- C:\Windows\System\CfeOgTZ.exe
  C:\Windows\System\CfeOgTZ.exe
  2⤵
  PID:5948
- C:\Windows\System\SclmGOU.exe
  C:\Windows\System\SclmGOU.exe
  2⤵
  PID:5768
- C:\Windows\System\cIYnLuX.exe
  C:\Windows\System\cIYnLuX.exe
  2⤵
  PID:5204
- C:\Windows\System\nlzRKgM.exe
  C:\Windows\System\nlzRKgM.exe
  2⤵
  PID:5844
- C:\Windows\System\hTAXIEm.exe
  C:\Windows\System\hTAXIEm.exe
  2⤵
  PID:5872
- C:\Windows\System\quPsAAv.exe
  C:\Windows\System\quPsAAv.exe
  2⤵
  PID:5960
- C:\Windows\System\itLJSsu.exe
  C:\Windows\System\itLJSsu.exe
  2⤵
  PID:5904
- C:\Windows\System\eeRlpFE.exe
  C:\Windows\System\eeRlpFE.exe
  2⤵
  PID:4164
- C:\Windows\System\kBwxphq.exe
  C:\Windows\System\kBwxphq.exe
  2⤵
  PID:4884
- C:\Windows\System\ngUtoAv.exe
  C:\Windows\System\ngUtoAv.exe
  2⤵
  PID:5544
- C:\Windows\System\QClZxVo.exe
  C:\Windows\System\QClZxVo.exe
  2⤵
  PID:5272
- C:\Windows\System\FtftiWJ.exe
  C:\Windows\System\FtftiWJ.exe
  2⤵
  PID:5576
- C:\Windows\System\QKoXqTB.exe
  C:\Windows\System\QKoXqTB.exe
  2⤵
  PID:4932
- C:\Windows\System\FvWPNGJ.exe
  C:\Windows\System\FvWPNGJ.exe
  2⤵
  PID:5440
- C:\Windows\System\xhPnAhI.exe
  C:\Windows\System\xhPnAhI.exe
  2⤵
  PID:5292
- C:\Windows\System\AWBJJBz.exe
  C:\Windows\System\AWBJJBz.exe
  2⤵
  PID:2424
- C:\Windows\System\KYWvhnD.exe
  C:\Windows\System\KYWvhnD.exe
  2⤵
  PID:2716
- C:\Windows\System\YJkYHlW.exe
  C:\Windows\System\YJkYHlW.exe
  2⤵
  PID:5324
- C:\Windows\System\KoMDBmY.exe
  C:\Windows\System\KoMDBmY.exe
  2⤵
  PID:5328
- C:\Windows\System\RaxGVbJ.exe
  C:\Windows\System\RaxGVbJ.exe
  2⤵
  PID:5144
- C:\Windows\System\uThZUjo.exe
  C:\Windows\System\uThZUjo.exe
  2⤵
  PID:5928
- C:\Windows\System\BMFaoXd.exe
  C:\Windows\System\BMFaoXd.exe
  2⤵
  PID:5900
- C:\Windows\System\bWXdump.exe
  C:\Windows\System\bWXdump.exe
  2⤵
  PID:5772
- C:\Windows\System\DCLNGjM.exe
  C:\Windows\System\DCLNGjM.exe
  2⤵
  PID:5776
- C:\Windows\System\YDZZSYA.exe
  C:\Windows\System\YDZZSYA.exe
  2⤵
  PID:6124
- C:\Windows\System\ejXnEcG.exe
  C:\Windows\System\ejXnEcG.exe
  2⤵
  PID:6028
- C:\Windows\System\WlzyFEB.exe
  C:\Windows\System\WlzyFEB.exe
  2⤵
  PID:3660
- C:\Windows\System\ixweQec.exe
  C:\Windows\System\ixweQec.exe
  2⤵
  PID:3628
- C:\Windows\System\TpfKqhA.exe
  C:\Windows\System\TpfKqhA.exe
  2⤵
  PID:5428
- C:\Windows\System\gRJIiQo.exe
  C:\Windows\System\gRJIiQo.exe
  2⤵
  PID:4448
- C:\Windows\System\xyavXHP.exe
  C:\Windows\System\xyavXHP.exe
  2⤵
  PID:4564
- C:\Windows\System\MHDYwcl.exe
  C:\Windows\System\MHDYwcl.exe
  2⤵
  PID:5572
- C:\Windows\System\MBxfvXh.exe
  C:\Windows\System\MBxfvXh.exe
  2⤵
  PID:5696
- C:\Windows\System\jXGZNgd.exe
  C:\Windows\System\jXGZNgd.exe
  2⤵
  PID:5984
- C:\Windows\System\lRKYYkO.exe
  C:\Windows\System\lRKYYkO.exe
  2⤵
  PID:6148
- C:\Windows\System\QWSudWf.exe
  C:\Windows\System\QWSudWf.exe
  2⤵
  PID:6164
- C:\Windows\System\voNUNWC.exe
  C:\Windows\System\voNUNWC.exe
  2⤵
  PID:6180
- C:\Windows\System\FLqgjeq.exe
  C:\Windows\System\FLqgjeq.exe
  2⤵
  PID:6200
- C:\Windows\System\TbrXehp.exe
  C:\Windows\System\TbrXehp.exe
  2⤵
  PID:6216
- C:\Windows\System\fLiSlvb.exe
  C:\Windows\System\fLiSlvb.exe
  2⤵
  PID:6232
- C:\Windows\System\KLxzVpW.exe
  C:\Windows\System\KLxzVpW.exe
  2⤵
  PID:6248
- C:\Windows\System\eeDjfmd.exe
  C:\Windows\System\eeDjfmd.exe
  2⤵
  PID:6264
- C:\Windows\System\MyAvGVl.exe
  C:\Windows\System\MyAvGVl.exe
  2⤵
  PID:6280
- C:\Windows\System\pnXPKEU.exe
  C:\Windows\System\pnXPKEU.exe
  2⤵
  PID:6296
- C:\Windows\System\XltYLKh.exe
  C:\Windows\System\XltYLKh.exe
  2⤵
  PID:6316
- C:\Windows\System\evABaSp.exe
  C:\Windows\System\evABaSp.exe
  2⤵
  PID:6332
- C:\Windows\System\vEeSsqx.exe
  C:\Windows\System\vEeSsqx.exe
  2⤵
  PID:6348
- C:\Windows\System\GMHBpeh.exe
  C:\Windows\System\GMHBpeh.exe
  2⤵
  PID:6364
- C:\Windows\System\CcNjzIT.exe
  C:\Windows\System\CcNjzIT.exe
  2⤵
  PID:6380
- C:\Windows\System\OlGPEdb.exe
  C:\Windows\System\OlGPEdb.exe
  2⤵
  PID:6396
- C:\Windows\System\oXliBGw.exe
  C:\Windows\System\oXliBGw.exe
  2⤵
  PID:6412
- C:\Windows\System\LDMjRwX.exe
  C:\Windows\System\LDMjRwX.exe
  2⤵
  PID:6428
- C:\Windows\System\krzTEEQ.exe
  C:\Windows\System\krzTEEQ.exe
  2⤵
  PID:6444
- C:\Windows\System\SBXcKBH.exe
  C:\Windows\System\SBXcKBH.exe
  2⤵
  PID:6460
- C:\Windows\System\CtHLSPC.exe
  C:\Windows\System\CtHLSPC.exe
  2⤵
  PID:6476
- C:\Windows\System\QLuYqrM.exe
  C:\Windows\System\QLuYqrM.exe
  2⤵
  PID:6492
- C:\Windows\System\xKkQDqq.exe
  C:\Windows\System\xKkQDqq.exe
  2⤵
  PID:6508
- C:\Windows\System\biNxnmv.exe
  C:\Windows\System\biNxnmv.exe
  2⤵
  PID:6524
- C:\Windows\System\gqiuYst.exe
  C:\Windows\System\gqiuYst.exe
  2⤵
  PID:6540
- C:\Windows\System\WNhKmnE.exe
  C:\Windows\System\WNhKmnE.exe
  2⤵
  PID:6556
- C:\Windows\System\tcsrIxc.exe
  C:\Windows\System\tcsrIxc.exe
  2⤵
  PID:6572
- C:\Windows\System\aHzdcam.exe
  C:\Windows\System\aHzdcam.exe
  2⤵
  PID:6588
- C:\Windows\System\giCrtWJ.exe
  C:\Windows\System\giCrtWJ.exe
  2⤵
  PID:6604
- C:\Windows\System\XymiDOc.exe
  C:\Windows\System\XymiDOc.exe
  2⤵
  PID:6620
- C:\Windows\System\RBoYfgk.exe
  C:\Windows\System\RBoYfgk.exe
  2⤵
  PID:6636
- C:\Windows\System\lUcrjYZ.exe
  C:\Windows\System\lUcrjYZ.exe
  2⤵
  PID:6652
- C:\Windows\System\hyosOHO.exe
  C:\Windows\System\hyosOHO.exe
  2⤵
  PID:6668
- C:\Windows\System\vTGUTcB.exe
  C:\Windows\System\vTGUTcB.exe
  2⤵
  PID:6684
- C:\Windows\System\dWTIKId.exe
  C:\Windows\System\dWTIKId.exe
  2⤵
  PID:6700
- C:\Windows\System\mqDyywt.exe
  C:\Windows\System\mqDyywt.exe
  2⤵
  PID:6716
- C:\Windows\System\esafXMF.exe
  C:\Windows\System\esafXMF.exe
  2⤵
  PID:6732
- C:\Windows\System\pGbNjcm.exe
  C:\Windows\System\pGbNjcm.exe
  2⤵
  PID:6748
- C:\Windows\System\Gltoxvo.exe
  C:\Windows\System\Gltoxvo.exe
  2⤵
  PID:6764
- C:\Windows\System\pdDtwsz.exe
  C:\Windows\System\pdDtwsz.exe
  2⤵
  PID:6780
- C:\Windows\System\cMXSZiM.exe
  C:\Windows\System\cMXSZiM.exe
  2⤵
  PID:6796
- C:\Windows\System\bviluFR.exe
  C:\Windows\System\bviluFR.exe
  2⤵
  PID:6812
- C:\Windows\System\AHmvqxv.exe
  C:\Windows\System\AHmvqxv.exe
  2⤵
  PID:6832
- C:\Windows\System\jqXYeBE.exe
  C:\Windows\System\jqXYeBE.exe
  2⤵
  PID:6852
- C:\Windows\System\lXfIGWT.exe
  C:\Windows\System\lXfIGWT.exe
  2⤵
  PID:6868
- C:\Windows\System\sUDjZPU.exe
  C:\Windows\System\sUDjZPU.exe
  2⤵
  PID:6888
- C:\Windows\System\cjGNyEw.exe
  C:\Windows\System\cjGNyEw.exe
  2⤵
  PID:6904
- C:\Windows\System\bBPoakZ.exe
  C:\Windows\System\bBPoakZ.exe
  2⤵
  PID:6920
- C:\Windows\System\fLrgrBs.exe
  C:\Windows\System\fLrgrBs.exe
  2⤵
  PID:6940
- C:\Windows\System\jPyGuZK.exe
  C:\Windows\System\jPyGuZK.exe
  2⤵
  PID:6956
- C:\Windows\System\RhnEgbN.exe
  C:\Windows\System\RhnEgbN.exe
  2⤵
  PID:6972
- C:\Windows\System\CfuqaND.exe
  C:\Windows\System\CfuqaND.exe
  2⤵
  PID:6992
- C:\Windows\System\asKYtZK.exe
  C:\Windows\System\asKYtZK.exe
  2⤵
  PID:7008
- C:\Windows\System\wxXcIrN.exe
  C:\Windows\System\wxXcIrN.exe
  2⤵
  PID:7024
- C:\Windows\System\sfcaDav.exe
  C:\Windows\System\sfcaDav.exe
  2⤵
  PID:7040
- C:\Windows\System\mYFQGLY.exe
  C:\Windows\System\mYFQGLY.exe
  2⤵
  PID:7056
- C:\Windows\System\bOGMLEF.exe
  C:\Windows\System\bOGMLEF.exe
  2⤵
  PID:7072
- C:\Windows\System\eduVaFq.exe
  C:\Windows\System\eduVaFq.exe
  2⤵
  PID:7092
- C:\Windows\System\ZgrTOCj.exe
  C:\Windows\System\ZgrTOCj.exe
  2⤵
  PID:7108
- C:\Windows\System\qWfmQRJ.exe
  C:\Windows\System\qWfmQRJ.exe
  2⤵
  PID:7124
- C:\Windows\System\ULPnDWO.exe
  C:\Windows\System\ULPnDWO.exe
  2⤵
  PID:7140
- C:\Windows\System\KiwClvA.exe
  C:\Windows\System\KiwClvA.exe
  2⤵
  PID:7156
- C:\Windows\System\ujCieLF.exe
  C:\Windows\System\ujCieLF.exe
  2⤵
  PID:5588
- C:\Windows\System\gJXGpRR.exe
  C:\Windows\System\gJXGpRR.exe
  2⤵
  PID:6176
- C:\Windows\System\YoDfhKv.exe
  C:\Windows\System\YoDfhKv.exe
  2⤵
  PID:6240
- C:\Windows\System\aWUOAcC.exe
  C:\Windows\System\aWUOAcC.exe
  2⤵
  PID:6304
- C:\Windows\System\SbBHRbz.exe
  C:\Windows\System\SbBHRbz.exe
  2⤵
  PID:6344
- C:\Windows\System\BRNLNNp.exe
  C:\Windows\System\BRNLNNp.exe
  2⤵
  PID:6628
- C:\Windows\System\DKPvMth.exe
  C:\Windows\System\DKPvMth.exe
  2⤵
  PID:6664
- C:\Windows\System\svlKRYz.exe
  C:\Windows\System\svlKRYz.exe
  2⤵
  PID:5712
- C:\Windows\System\VcodnFj.exe
  C:\Windows\System\VcodnFj.exe
  2⤵
  PID:6728
- C:\Windows\System\TonxAWr.exe
  C:\Windows\System\TonxAWr.exe
  2⤵
  PID:6516
- C:\Windows\System\ffOJpOC.exe
  C:\Windows\System\ffOJpOC.exe
  2⤵
  PID:6580
- C:\Windows\System\mInFvsp.exe
  C:\Windows\System\mInFvsp.exe
  2⤵
  PID:6616
- C:\Windows\System\pMKkTXm.exe
  C:\Windows\System\pMKkTXm.exe
  2⤵
  PID:6488
- C:\Windows\System\dfXFtfG.exe
  C:\Windows\System\dfXFtfG.exe
  2⤵
  PID:6712
- C:\Windows\System\VIhjxSo.exe
  C:\Windows\System\VIhjxSo.exe
  2⤵
  PID:6424
- C:\Windows\System\BUFQtsL.exe
  C:\Windows\System\BUFQtsL.exe
  2⤵
  PID:6788
- C:\Windows\System\SlFhUdQ.exe
  C:\Windows\System\SlFhUdQ.exe
  2⤵
  PID:6828
- C:\Windows\System\LfgbeiC.exe
  C:\Windows\System\LfgbeiC.exe
  2⤵
  PID:6900
- C:\Windows\System\uHGXQfo.exe
  C:\Windows\System\uHGXQfo.exe
  2⤵
  PID:7000
- C:\Windows\System\KewIBJc.exe
  C:\Windows\System\KewIBJc.exe
  2⤵
  PID:6848
- C:\Windows\System\DpmJxsf.exe
  C:\Windows\System\DpmJxsf.exe
  2⤵
  PID:6948
- C:\Windows\System\WKkJXPl.exe
  C:\Windows\System\WKkJXPl.exe
  2⤵
  PID:6776
- C:\Windows\System\BjWpuGo.exe
  C:\Windows\System\BjWpuGo.exe
  2⤵
  PID:6880
- C:\Windows\System\CHrjWAk.exe
  C:\Windows\System\CHrjWAk.exe
  2⤵
  PID:7020
- C:\Windows\System\KqsZNaX.exe
  C:\Windows\System\KqsZNaX.exe
  2⤵
  PID:7104
- C:\Windows\System\ArAhSWW.exe
  C:\Windows\System\ArAhSWW.exe
  2⤵
  PID:5076
- C:\Windows\System\QdgBmQh.exe
  C:\Windows\System\QdgBmQh.exe
  2⤵
  PID:7116
- C:\Windows\System\SlwGgyC.exe
  C:\Windows\System\SlwGgyC.exe
  2⤵
  PID:3444
- C:\Windows\System\OlHYoQO.exe
  C:\Windows\System\OlHYoQO.exe
  2⤵
  PID:6004
- C:\Windows\System\AleaphR.exe
  C:\Windows\System\AleaphR.exe
  2⤵
  PID:6276
- C:\Windows\System\iVJTBnT.exe
  C:\Windows\System\iVJTBnT.exe
  2⤵
  PID:5376
- C:\Windows\System\pbyesVa.exe
  C:\Windows\System\pbyesVa.exe
  2⤵
  PID:6196
- C:\Windows\System\SJBUHcJ.exe
  C:\Windows\System\SJBUHcJ.exe
  2⤵
  PID:6376
- C:\Windows\System\kEApaoQ.exe
  C:\Windows\System\kEApaoQ.exe
  2⤵
  PID:6404
- C:\Windows\System\JdWLRry.exe
  C:\Windows\System\JdWLRry.exe
  2⤵
  PID:6260
- C:\Windows\System\COTAuiE.exe
  C:\Windows\System\COTAuiE.exe
  2⤵
  PID:6436
- C:\Windows\System\wFrROmc.exe
  C:\Windows\System\wFrROmc.exe
  2⤵
  PID:6472
- C:\Windows\System\tISKsng.exe
  C:\Windows\System\tISKsng.exe
  2⤵
  PID:6536
- C:\Windows\System\mqGgqEH.exe
  C:\Windows\System\mqGgqEH.exe
  2⤵
  PID:6632
- C:\Windows\System\vvUsBPc.exe
  C:\Windows\System\vvUsBPc.exe
  2⤵
  PID:6612
- C:\Windows\System\rLVtZlj.exe
  C:\Windows\System\rLVtZlj.exe
  2⤵
  PID:7032
- C:\Windows\System\aSfBbhC.exe
  C:\Windows\System\aSfBbhC.exe
  2⤵
  PID:4948
- C:\Windows\System\aoIhYvW.exe
  C:\Windows\System\aoIhYvW.exe
  2⤵
  PID:6676
- C:\Windows\System\QQCaMZH.exe
  C:\Windows\System\QQCaMZH.exe
  2⤵
  PID:6896
- C:\Windows\System\JTtQcFb.exe
  C:\Windows\System\JTtQcFb.exe
  2⤵
  PID:6680
- C:\Windows\System\HDEEnXk.exe
  C:\Windows\System\HDEEnXk.exe
  2⤵
  PID:6744
- C:\Windows\System\oXJpONG.exe
  C:\Windows\System\oXJpONG.exe
  2⤵
  PID:6964
- C:\Windows\System\iwAExxi.exe
  C:\Windows\System\iwAExxi.exe
  2⤵
  PID:6808
- C:\Windows\System\bHORiJV.exe
  C:\Windows\System\bHORiJV.exe
  2⤵
  PID:7164
- C:\Windows\System\GlsoUQo.exe
  C:\Windows\System\GlsoUQo.exe
  2⤵
  PID:6912
- C:\Windows\System\aQGnAni.exe
  C:\Windows\System\aQGnAni.exe
  2⤵
  PID:7100
- C:\Windows\System\ZPFsdVu.exe
  C:\Windows\System\ZPFsdVu.exe
  2⤵
  PID:5824
- C:\Windows\System\QKTPuEt.exe
  C:\Windows\System\QKTPuEt.exe
  2⤵
  PID:6468
- C:\Windows\System\izpYPrV.exe
  C:\Windows\System\izpYPrV.exe
  2⤵
  PID:6328
- C:\Windows\System\RWhMlRx.exe
  C:\Windows\System\RWhMlRx.exe
  2⤵
  PID:5744
- C:\Windows\System\LBhuaGE.exe
  C:\Windows\System\LBhuaGE.exe
  2⤵
  PID:6504
- C:\Windows\System\ZXiePUW.exe
  C:\Windows\System\ZXiePUW.exe
  2⤵
  PID:6696
- C:\Windows\System\XLJLeYt.exe
  C:\Windows\System\XLJLeYt.exe
  2⤵
  PID:6420
- C:\Windows\System\eQgRhoS.exe
  C:\Windows\System\eQgRhoS.exe
  2⤵
  PID:6876
- C:\Windows\System\PhmHRUm.exe
  C:\Windows\System\PhmHRUm.exe
  2⤵
  PID:6936
- C:\Windows\System\gmZddwE.exe
  C:\Windows\System\gmZddwE.exe
  2⤵
  PID:3772
- C:\Windows\System\WQfyHaf.exe
  C:\Windows\System\WQfyHaf.exe
  2⤵
  PID:6988
- C:\Windows\System\copIxJX.exe
  C:\Windows\System\copIxJX.exe
  2⤵
  PID:7088
- C:\Windows\System\nlcLypD.exe
  C:\Windows\System\nlcLypD.exe
  2⤵
  PID:6600
- C:\Windows\System\xtzoCvK.exe
  C:\Windows\System\xtzoCvK.exe
  2⤵
  PID:6192
- C:\Windows\System\xHGgjMk.exe
  C:\Windows\System\xHGgjMk.exe
  2⤵
  PID:7052
- C:\Windows\System\lsLmDoV.exe
  C:\Windows\System\lsLmDoV.exe
  2⤵
  PID:6984
- C:\Windows\System\EaXbeox.exe
  C:\Windows\System\EaXbeox.exe
  2⤵
  PID:7068
- C:\Windows\System\emqbSCE.exe
  C:\Windows\System\emqbSCE.exe
  2⤵
  PID:7184
- C:\Windows\System\OKotAgo.exe
  C:\Windows\System\OKotAgo.exe
  2⤵
  PID:7200
- C:\Windows\System\fxEfpaJ.exe
  C:\Windows\System\fxEfpaJ.exe
  2⤵
  PID:7216
- C:\Windows\System\CBPdFJk.exe
  C:\Windows\System\CBPdFJk.exe
  2⤵
  PID:7232
- C:\Windows\System\fyaFhlx.exe
  C:\Windows\System\fyaFhlx.exe
  2⤵
  PID:7248
- C:\Windows\System\NwAMcxD.exe
  C:\Windows\System\NwAMcxD.exe
  2⤵
  PID:7264
- C:\Windows\System\JuKKsrM.exe
  C:\Windows\System\JuKKsrM.exe
  2⤵
  PID:7280
- C:\Windows\System\IpoIlNl.exe
  C:\Windows\System\IpoIlNl.exe
  2⤵
  PID:7300
- C:\Windows\System\gOcVUmG.exe
  C:\Windows\System\gOcVUmG.exe
  2⤵
  PID:7316
- C:\Windows\System\KZRgkrN.exe
  C:\Windows\System\KZRgkrN.exe
  2⤵
  PID:7332
- C:\Windows\System\uaNNYke.exe
  C:\Windows\System\uaNNYke.exe
  2⤵
  PID:7348
- C:\Windows\System\iKajFxq.exe
  C:\Windows\System\iKajFxq.exe
  2⤵
  PID:7364
- C:\Windows\System\ZdwzMhD.exe
  C:\Windows\System\ZdwzMhD.exe
  2⤵
  PID:7380
- C:\Windows\System\MdXMbWL.exe
  C:\Windows\System\MdXMbWL.exe
  2⤵
  PID:7400
- C:\Windows\System\XEiCPXY.exe
  C:\Windows\System\XEiCPXY.exe
  2⤵
  PID:7416
- C:\Windows\System\iwJyjkP.exe
  C:\Windows\System\iwJyjkP.exe
  2⤵
  PID:7432
- C:\Windows\System\yqGrjXh.exe
  C:\Windows\System\yqGrjXh.exe
  2⤵
  PID:7452
- C:\Windows\System\thnQMFP.exe
  C:\Windows\System\thnQMFP.exe
  2⤵
  PID:7468
- C:\Windows\System\YFavcbe.exe
  C:\Windows\System\YFavcbe.exe
  2⤵
  PID:7484
- C:\Windows\System\CYXErsx.exe
  C:\Windows\System\CYXErsx.exe
  2⤵
  PID:7500
- C:\Windows\System\RjExnRl.exe
  C:\Windows\System\RjExnRl.exe
  2⤵
  PID:7516
- C:\Windows\System\cGwezoB.exe
  C:\Windows\System\cGwezoB.exe
  2⤵
  PID:7532
- C:\Windows\System\mWOvYIr.exe
  C:\Windows\System\mWOvYIr.exe
  2⤵
  PID:7548
- C:\Windows\System\rdAvMnY.exe
  C:\Windows\System\rdAvMnY.exe
  2⤵
  PID:7564
- C:\Windows\System\zlLXaJr.exe
  C:\Windows\System\zlLXaJr.exe
  2⤵
  PID:7580
- C:\Windows\System\VcsZnzC.exe
  C:\Windows\System\VcsZnzC.exe
  2⤵
  PID:7596
- C:\Windows\System\zgSEKdA.exe
  C:\Windows\System\zgSEKdA.exe
  2⤵
  PID:7620
- C:\Windows\System\gxGMNTf.exe
  C:\Windows\System\gxGMNTf.exe
  2⤵
  PID:7636
- C:\Windows\System\ZvpTCjW.exe
  C:\Windows\System\ZvpTCjW.exe
  2⤵
  PID:7652
- C:\Windows\System\jLZXvOz.exe
  C:\Windows\System\jLZXvOz.exe
  2⤵
  PID:7668
- C:\Windows\System\DmEEhbi.exe
  C:\Windows\System\DmEEhbi.exe
  2⤵
  PID:7684
- C:\Windows\System\qUcRSRe.exe
  C:\Windows\System\qUcRSRe.exe
  2⤵
  PID:7700
- C:\Windows\System\hvxbUue.exe
  C:\Windows\System\hvxbUue.exe
  2⤵
  PID:7716
- C:\Windows\System\KTQuTxM.exe
  C:\Windows\System\KTQuTxM.exe
  2⤵
  PID:7732
- C:\Windows\System\KdYbLfg.exe
  C:\Windows\System\KdYbLfg.exe
  2⤵
  PID:7748
- C:\Windows\System\KVIWMSI.exe
  C:\Windows\System\KVIWMSI.exe
  2⤵
  PID:7768
- C:\Windows\System\lSpdyKb.exe
  C:\Windows\System\lSpdyKb.exe
  2⤵
  PID:7784
- C:\Windows\System\gXJSMQU.exe
  C:\Windows\System\gXJSMQU.exe
  2⤵
  PID:7804
- C:\Windows\System\HJcvvUB.exe
  C:\Windows\System\HJcvvUB.exe
  2⤵
  PID:7820
- C:\Windows\System\iFQronZ.exe
  C:\Windows\System\iFQronZ.exe
  2⤵
  PID:7836
- C:\Windows\System\yzpZJSf.exe
  C:\Windows\System\yzpZJSf.exe
  2⤵
  PID:7856
- C:\Windows\System\ZRUucRN.exe
  C:\Windows\System\ZRUucRN.exe
  2⤵
  PID:7872
- C:\Windows\System\DAkfIiw.exe
  C:\Windows\System\DAkfIiw.exe
  2⤵
  PID:7888
- C:\Windows\System\vxhQZmS.exe
  C:\Windows\System\vxhQZmS.exe
  2⤵
  PID:7908
- C:\Windows\System\ENgrjKw.exe
  C:\Windows\System\ENgrjKw.exe
  2⤵
  PID:7928
- C:\Windows\System\GsBqEeR.exe
  C:\Windows\System\GsBqEeR.exe
  2⤵
  PID:7944
- C:\Windows\System\oPzeeZC.exe
  C:\Windows\System\oPzeeZC.exe
  2⤵
  PID:7960
- C:\Windows\System\LzhWrSm.exe
  C:\Windows\System\LzhWrSm.exe
  2⤵
  PID:7976
- C:\Windows\System\jcMfeDB.exe
  C:\Windows\System\jcMfeDB.exe
  2⤵
  PID:7996
- C:\Windows\System\jIEBUQE.exe
  C:\Windows\System\jIEBUQE.exe
  2⤵
  PID:8016
- C:\Windows\System\ILetcHQ.exe
  C:\Windows\System\ILetcHQ.exe
  2⤵
  PID:8032
- C:\Windows\System\YrTSIMM.exe
  C:\Windows\System\YrTSIMM.exe
  2⤵
  PID:8048
- C:\Windows\System\FyvZDVb.exe
  C:\Windows\System\FyvZDVb.exe
  2⤵
  PID:8064
- C:\Windows\System\wvmapvx.exe
  C:\Windows\System\wvmapvx.exe
  2⤵
  PID:8080
- C:\Windows\System\bMtUvDk.exe
  C:\Windows\System\bMtUvDk.exe
  2⤵
  PID:8096
- C:\Windows\System\LdaTeGx.exe
  C:\Windows\System\LdaTeGx.exe
  2⤵
  PID:8112
- C:\Windows\System\vUnoKkF.exe
  C:\Windows\System\vUnoKkF.exe
  2⤵
  PID:8128
- C:\Windows\System\fsHRLCq.exe
  C:\Windows\System\fsHRLCq.exe
  2⤵
  PID:8144
- C:\Windows\System\LhIRaSk.exe
  C:\Windows\System\LhIRaSk.exe
  2⤵
  PID:8160
- C:\Windows\System\lbQqrEA.exe
  C:\Windows\System\lbQqrEA.exe
  2⤵
  PID:8176
- C:\Windows\System\zSmgZSc.exe
  C:\Windows\System\zSmgZSc.exe
  2⤵
  PID:5596
- C:\Windows\System\vQaiDFS.exe
  C:\Windows\System\vQaiDFS.exe
  2⤵
  PID:7172
- C:\Windows\System\UpHvQmV.exe
  C:\Windows\System\UpHvQmV.exe
  2⤵
  PID:6772
- C:\Windows\System\mqjsWWz.exe
  C:\Windows\System\mqjsWWz.exe
  2⤵
  PID:7208
- C:\Windows\System\rIUThCL.exe
  C:\Windows\System\rIUThCL.exe
  2⤵
  PID:6756
- C:\Windows\System\qwaxuGN.exe
  C:\Windows\System\qwaxuGN.exe
  2⤵
  PID:7312
- C:\Windows\System\nLqIfiI.exe
  C:\Windows\System\nLqIfiI.exe
  2⤵
  PID:7376
- C:\Windows\System\XotSVma.exe
  C:\Windows\System\XotSVma.exe
  2⤵
  PID:7440
- C:\Windows\System\uaPhnsE.exe
  C:\Windows\System\uaPhnsE.exe
  2⤵
  PID:6804
- C:\Windows\System\XdufSZn.exe
  C:\Windows\System\XdufSZn.exe
  2⤵
  PID:7228
- C:\Windows\System\YeqhYfL.exe
  C:\Windows\System\YeqhYfL.exe
  2⤵
  PID:7328
- C:\Windows\System\ueejaYJ.exe
  C:\Windows\System\ueejaYJ.exe
  2⤵
  PID:7392
- C:\Windows\System\jobzHam.exe
  C:\Windows\System\jobzHam.exe
  2⤵
  PID:7464
- C:\Windows\System\pcrRzTc.exe
  C:\Windows\System\pcrRzTc.exe
  2⤵
  PID:7476
- C:\Windows\System\TpWAZEA.exe
  C:\Windows\System\TpWAZEA.exe
  2⤵
  PID:7556
- C:\Windows\System\JOqMpre.exe
  C:\Windows\System\JOqMpre.exe
  2⤵
  PID:7540
- C:\Windows\System\RZKPBKW.exe
  C:\Windows\System\RZKPBKW.exe
  2⤵
  PID:7576
- C:\Windows\System\KqPmmyg.exe
  C:\Windows\System\KqPmmyg.exe
  2⤵
  PID:7660
- C:\Windows\System\xzFvXOK.exe
  C:\Windows\System\xzFvXOK.exe
  2⤵
  PID:7724
- C:\Windows\System\ydwgkgO.exe
  C:\Windows\System\ydwgkgO.exe
  2⤵
  PID:7744
- C:\Windows\System\xnspgCG.exe
  C:\Windows\System\xnspgCG.exe
  2⤵
  PID:7764
- C:\Windows\System\NJROOuD.exe
  C:\Windows\System\NJROOuD.exe
  2⤵
  PID:7828
- C:\Windows\System\DCDyIGi.exe
  C:\Windows\System\DCDyIGi.exe
  2⤵
  PID:7776
- C:\Windows\System\EvuwHFL.exe
  C:\Windows\System\EvuwHFL.exe
  2⤵
  PID:7868
- C:\Windows\System\OfvfCAk.exe
  C:\Windows\System\OfvfCAk.exe
  2⤵
  PID:7916
- C:\Windows\System\xKuDfsG.exe
  C:\Windows\System\xKuDfsG.exe
  2⤵
  PID:7940
- C:\Windows\System\dhGIbvV.exe
  C:\Windows\System\dhGIbvV.exe
  2⤵
  PID:7972
- C:\Windows\System\Awdlflx.exe
  C:\Windows\System\Awdlflx.exe
  2⤵
  PID:8024
- C:\Windows\System\wNhxesf.exe
  C:\Windows\System\wNhxesf.exe
  2⤵
  PID:8088
- C:\Windows\System\QxdUwRU.exe
  C:\Windows\System\QxdUwRU.exe
  2⤵
  PID:8152
- C:\Windows\System\UKTahRc.exe
  C:\Windows\System\UKTahRc.exe
  2⤵
  PID:7180
- C:\Windows\System\yhNdqCw.exe
  C:\Windows\System\yhNdqCw.exe
  2⤵
  PID:7344
- C:\Windows\System\eqwJGTV.exe
  C:\Windows\System\eqwJGTV.exe
  2⤵
  PID:7288
- C:\Windows\System\bGLyHNw.exe
  C:\Windows\System\bGLyHNw.exe
  2⤵
  PID:7524
- C:\Windows\System\TJcdteg.exe
  C:\Windows\System\TJcdteg.exe
  2⤵
  PID:7632
- C:\Windows\System\SlPzRhQ.exe
  C:\Windows\System\SlPzRhQ.exe
  2⤵
  PID:7680
- C:\Windows\System\FFkCZLD.exe
  C:\Windows\System\FFkCZLD.exe
  2⤵
  PID:7956
- C:\Windows\System\UsNXJPm.exe
  C:\Windows\System\UsNXJPm.exe
  2⤵
  PID:7588
- C:\Windows\System\yTSivfQ.exe
  C:\Windows\System\yTSivfQ.exe
  2⤵
  PID:7016
- C:\Windows\System\ghLvyIM.exe
  C:\Windows\System\ghLvyIM.exe
  2⤵
  PID:7696
- C:\Windows\System\CWfkuzl.exe
  C:\Windows\System\CWfkuzl.exe
  2⤵
  PID:7900
- C:\Windows\System\erYXrdJ.exe
  C:\Windows\System\erYXrdJ.exe
  2⤵
  PID:8184
- C:\Windows\System\RQwfqMh.exe
  C:\Windows\System\RQwfqMh.exe
  2⤵
  PID:8004
- C:\Windows\System\fdWlOfZ.exe
  C:\Windows\System\fdWlOfZ.exe
  2⤵
  PID:8108
- C:\Windows\System\LLfLDxW.exe
  C:\Windows\System\LLfLDxW.exe
  2⤵
  PID:8172
- C:\Windows\System\eqKbBDn.exe
  C:\Windows\System\eqKbBDn.exe
  2⤵
  PID:7512
- C:\Windows\System\CQAyMVZ.exe
  C:\Windows\System\CQAyMVZ.exe
  2⤵
  PID:7800
- C:\Windows\System\BfVPRbS.exe
  C:\Windows\System\BfVPRbS.exe
  2⤵
  PID:7428
- C:\Windows\System\wdSAkSM.exe
  C:\Windows\System\wdSAkSM.exe
  2⤵
  PID:8076
- C:\Windows\System\FfkwGSp.exe
  C:\Windows\System\FfkwGSp.exe
  2⤵
  PID:5880
- C:\Windows\System\fXYDnue.exe
  C:\Windows\System\fXYDnue.exe
  2⤵
  PID:7324
- C:\Windows\System\tTipCdo.exe
  C:\Windows\System\tTipCdo.exe
  2⤵
  PID:7496
- C:\Windows\System\ixGwgAk.exe
  C:\Windows\System\ixGwgAk.exe
  2⤵
  PID:7852
- C:\Windows\System\iTaUKlJ.exe
  C:\Windows\System\iTaUKlJ.exe
  2⤵
  PID:7448
- C:\Windows\System\DkQGRuj.exe
  C:\Windows\System\DkQGRuj.exe
  2⤵
  PID:7592
- C:\Windows\System\TbcZfeF.exe
  C:\Windows\System\TbcZfeF.exe
  2⤵
  PID:7844
- C:\Windows\System\ICDiciN.exe
  C:\Windows\System\ICDiciN.exe
  2⤵
  PID:7796
- C:\Windows\System\kGMtVDQ.exe
  C:\Windows\System\kGMtVDQ.exe
  2⤵
  PID:7756
- C:\Windows\System\yBJqmTr.exe
  C:\Windows\System\yBJqmTr.exe
  2⤵
  PID:7408
- C:\Windows\System\MEQbClE.exe
  C:\Windows\System\MEQbClE.exe
  2⤵
  PID:6552
- C:\Windows\System\uWDDNWJ.exe
  C:\Windows\System\uWDDNWJ.exe
  2⤵
  PID:7740
- C:\Windows\System\HGRSWRj.exe
  C:\Windows\System\HGRSWRj.exe
  2⤵
  PID:7884
- C:\Windows\System\SJkXgFc.exe
  C:\Windows\System\SJkXgFc.exe
  2⤵
  PID:5028
- C:\Windows\System\Oyikgme.exe
  C:\Windows\System\Oyikgme.exe
  2⤵
  PID:7424
- C:\Windows\System\swJfhZb.exe
  C:\Windows\System\swJfhZb.exe
  2⤵
  PID:8072
- C:\Windows\System\oRjJWvH.exe
  C:\Windows\System\oRjJWvH.exe
  2⤵
  PID:7864
- C:\Windows\System\NZdmCrV.exe
  C:\Windows\System\NZdmCrV.exe
  2⤵
  PID:7196
- C:\Windows\System\EJsewSB.exe
  C:\Windows\System\EJsewSB.exe
  2⤵
  PID:8208
- C:\Windows\System\zqzgvQy.exe
  C:\Windows\System\zqzgvQy.exe
  2⤵
  PID:8224
- C:\Windows\System\EjbUZkn.exe
  C:\Windows\System\EjbUZkn.exe
  2⤵
  PID:8240
- C:\Windows\System\flpRLmC.exe
  C:\Windows\System\flpRLmC.exe
  2⤵
  PID:8256
- C:\Windows\System\SJWRWGx.exe
  C:\Windows\System\SJWRWGx.exe
  2⤵
  PID:8272
- C:\Windows\System\YLTPqzA.exe
  C:\Windows\System\YLTPqzA.exe
  2⤵
  PID:8288
- C:\Windows\System\wZJnqiu.exe
  C:\Windows\System\wZJnqiu.exe
  2⤵
  PID:8304
- C:\Windows\System\SwBuXfA.exe
  C:\Windows\System\SwBuXfA.exe
  2⤵
  PID:8320
- C:\Windows\System\rmNrhQn.exe
  C:\Windows\System\rmNrhQn.exe
  2⤵
  PID:8336
- C:\Windows\System\eZjdlwF.exe
  C:\Windows\System\eZjdlwF.exe
  2⤵
  PID:8352
- C:\Windows\System\LpXFXqh.exe
  C:\Windows\System\LpXFXqh.exe
  2⤵
  PID:8368
- C:\Windows\System\RHVPApg.exe
  C:\Windows\System\RHVPApg.exe
  2⤵
  PID:8384
- C:\Windows\System\qAJclnD.exe
  C:\Windows\System\qAJclnD.exe
  2⤵
  PID:8400
- C:\Windows\System\goflieq.exe
  C:\Windows\System\goflieq.exe
  2⤵
  PID:8416
- C:\Windows\System\PHAUzlE.exe
  C:\Windows\System\PHAUzlE.exe
  2⤵
  PID:8432
- C:\Windows\System\aIboLBZ.exe
  C:\Windows\System\aIboLBZ.exe
  2⤵
  PID:8448
- C:\Windows\System\ejTnqGo.exe
  C:\Windows\System\ejTnqGo.exe
  2⤵
  PID:8464
- C:\Windows\System\pcCoXEK.exe
  C:\Windows\System\pcCoXEK.exe
  2⤵
  PID:8480
- C:\Windows\System\vPbXPrZ.exe
  C:\Windows\System\vPbXPrZ.exe
  2⤵
  PID:8496
- C:\Windows\System\nrJxSaO.exe
  C:\Windows\System\nrJxSaO.exe
  2⤵
  PID:8512
- C:\Windows\System\NTkWzlX.exe
  C:\Windows\System\NTkWzlX.exe
  2⤵
  PID:8528
- C:\Windows\System\eLtnNHB.exe
  C:\Windows\System\eLtnNHB.exe
  2⤵
  PID:8544
- C:\Windows\System\GRklAML.exe
  C:\Windows\System\GRklAML.exe
  2⤵
  PID:8560
- C:\Windows\System\cFiDFyx.exe
  C:\Windows\System\cFiDFyx.exe
  2⤵
  PID:8580
- C:\Windows\System\EjLfvJN.exe
  C:\Windows\System\EjLfvJN.exe
  2⤵
  PID:8596
- C:\Windows\System\NkLpoIz.exe
  C:\Windows\System\NkLpoIz.exe
  2⤵
  PID:8612
- C:\Windows\System\JrxcZqj.exe
  C:\Windows\System\JrxcZqj.exe
  2⤵
  PID:8628
- C:\Windows\System\GAewbDX.exe
  C:\Windows\System\GAewbDX.exe
  2⤵
  PID:8644
- C:\Windows\System\WLjQwXe.exe
  C:\Windows\System\WLjQwXe.exe
  2⤵
  PID:8660
- C:\Windows\System\pfipGyV.exe
  C:\Windows\System\pfipGyV.exe
  2⤵
  PID:8676
- C:\Windows\System\ihXFIex.exe
  C:\Windows\System\ihXFIex.exe
  2⤵
  PID:8692
- C:\Windows\System\tlQfMRb.exe
  C:\Windows\System\tlQfMRb.exe
  2⤵
  PID:8708
- C:\Windows\System\urLpebZ.exe
  C:\Windows\System\urLpebZ.exe
  2⤵
  PID:8724
- C:\Windows\System\pDLFzib.exe
  C:\Windows\System\pDLFzib.exe
  2⤵
  PID:8740
- C:\Windows\System\myCzQdI.exe
  C:\Windows\System\myCzQdI.exe
  2⤵
  PID:8756
- C:\Windows\System\qwuJZYs.exe
  C:\Windows\System\qwuJZYs.exe
  2⤵
  PID:8772
- C:\Windows\System\MvBeUeC.exe
  C:\Windows\System\MvBeUeC.exe
  2⤵
  PID:8788
- C:\Windows\System\YstdXEQ.exe
  C:\Windows\System\YstdXEQ.exe
  2⤵
  PID:8804
- C:\Windows\System\DLPysnW.exe
  C:\Windows\System\DLPysnW.exe
  2⤵
  PID:8820
- C:\Windows\System\WZiuKQi.exe
  C:\Windows\System\WZiuKQi.exe
  2⤵
  PID:8836
- C:\Windows\System\NNKnuIp.exe
  C:\Windows\System\NNKnuIp.exe
  2⤵
  PID:8852
- C:\Windows\System\siiKQyh.exe
  C:\Windows\System\siiKQyh.exe
  2⤵
  PID:8868
- C:\Windows\System\UnRirJG.exe
  C:\Windows\System\UnRirJG.exe
  2⤵
  PID:8884
- C:\Windows\System\aYRGWZJ.exe
  C:\Windows\System\aYRGWZJ.exe
  2⤵
  PID:8900
- C:\Windows\System\FbIghok.exe
  C:\Windows\System\FbIghok.exe
  2⤵
  PID:8916
- C:\Windows\System\OGPcsiR.exe
  C:\Windows\System\OGPcsiR.exe
  2⤵
  PID:8932
- C:\Windows\System\habKqzp.exe
  C:\Windows\System\habKqzp.exe
  2⤵
  PID:8948
- C:\Windows\System\FEHuxHr.exe
  C:\Windows\System\FEHuxHr.exe
  2⤵
  PID:8964
- C:\Windows\System\jCcoMyy.exe
  C:\Windows\System\jCcoMyy.exe
  2⤵
  PID:8980
- C:\Windows\System\lllOAqJ.exe
  C:\Windows\System\lllOAqJ.exe
  2⤵
  PID:8996
- C:\Windows\System\IQAmfiH.exe
  C:\Windows\System\IQAmfiH.exe
  2⤵
  PID:9012
- C:\Windows\System\StzwZbE.exe
  C:\Windows\System\StzwZbE.exe
  2⤵
  PID:9028
- C:\Windows\System\NQYTVsz.exe
  C:\Windows\System\NQYTVsz.exe
  2⤵
  PID:9044
- C:\Windows\System\ErbmYHg.exe
  C:\Windows\System\ErbmYHg.exe
  2⤵
  PID:9060
- C:\Windows\System\llnSgRe.exe
  C:\Windows\System\llnSgRe.exe
  2⤵
  PID:9076
- C:\Windows\System\TIRTQZT.exe
  C:\Windows\System\TIRTQZT.exe
  2⤵
  PID:9096
- C:\Windows\System\xHjrbRJ.exe
  C:\Windows\System\xHjrbRJ.exe
  2⤵
  PID:9112
- C:\Windows\System\JnsXuJw.exe
  C:\Windows\System\JnsXuJw.exe
  2⤵
  PID:9128
- C:\Windows\System\CtXOVFo.exe
  C:\Windows\System\CtXOVFo.exe
  2⤵
  PID:9144
- C:\Windows\System\qtFSlyD.exe
  C:\Windows\System\qtFSlyD.exe
  2⤵
  PID:9160
- C:\Windows\System\RKEldXx.exe
  C:\Windows\System\RKEldXx.exe
  2⤵
  PID:9176
- C:\Windows\System\GjCwhAE.exe
  C:\Windows\System\GjCwhAE.exe
  2⤵
  PID:9192
- C:\Windows\System\GikhOLX.exe
  C:\Windows\System\GikhOLX.exe
  2⤵
  PID:9208
- C:\Windows\System\EeyMMYv.exe
  C:\Windows\System\EeyMMYv.exe
  2⤵
  PID:8220
- C:\Windows\System\OJeocjR.exe
  C:\Windows\System\OJeocjR.exe
  2⤵
  PID:8284
- C:\Windows\System\XHAqKYP.exe
  C:\Windows\System\XHAqKYP.exe
  2⤵
  PID:8348
- C:\Windows\System\kMiKXVm.exe
  C:\Windows\System\kMiKXVm.exe
  2⤵
  PID:8412
- C:\Windows\System\fyZvWhf.exe
  C:\Windows\System\fyZvWhf.exe
  2⤵
  PID:8476
- C:\Windows\System\vQlkGWq.exe
  C:\Windows\System\vQlkGWq.exe
  2⤵
  PID:8540
- C:\Windows\System\MiSnNRR.exe
  C:\Windows\System\MiSnNRR.exe
  2⤵
  PID:8204
- C:\Windows\System\ihiroRg.exe
  C:\Windows\System\ihiroRg.exe
  2⤵
  PID:8428
- C:\Windows\System\JHjnzPZ.exe
  C:\Windows\System\JHjnzPZ.exe
  2⤵
  PID:7360
- C:\Windows\System\RmZsnao.exe
  C:\Windows\System\RmZsnao.exe
  2⤵
  PID:8232
- C:\Windows\System\ticUAAC.exe
  C:\Windows\System\ticUAAC.exe
  2⤵
  PID:7244
- C:\Windows\System\OsTguyD.exe
  C:\Windows\System\OsTguyD.exe
  2⤵
  PID:7988
- C:\Windows\System\GMkHRAw.exe
  C:\Windows\System\GMkHRAw.exe
  2⤵
  PID:8300
- C:\Windows\System\iLQOhAB.exe
  C:\Windows\System\iLQOhAB.exe
  2⤵
  PID:8460
- C:\Windows\System\BskmTVI.exe
  C:\Windows\System\BskmTVI.exe
  2⤵
  PID:8552
- C:\Windows\System\dzqXyVz.exe
  C:\Windows\System\dzqXyVz.exe
  2⤵
  PID:8588
- C:\Windows\System\YLMynER.exe
  C:\Windows\System\YLMynER.exe
  2⤵
  PID:8576
- C:\Windows\System\acwfvmx.exe
  C:\Windows\System\acwfvmx.exe
  2⤵
  PID:8668
- C:\Windows\System\ocawxnS.exe
  C:\Windows\System\ocawxnS.exe
  2⤵
  PID:8608
- C:\Windows\System\gekmlzL.exe
  C:\Windows\System\gekmlzL.exe
  2⤵
  PID:8768
- C:\Windows\System\ezVtaER.exe
  C:\Windows\System\ezVtaER.exe
  2⤵
  PID:8684
- C:\Windows\System\ndqTINv.exe
  C:\Windows\System\ndqTINv.exe
  2⤵
  PID:8656
- C:\Windows\System\LuGuXxK.exe
  C:\Windows\System\LuGuXxK.exe
  2⤵
  PID:8796
- C:\Windows\System\bfogsju.exe
  C:\Windows\System\bfogsju.exe
  2⤵
  PID:8816
- C:\Windows\System\ALlJgZO.exe
  C:\Windows\System\ALlJgZO.exe
  2⤵
  PID:8848
- C:\Windows\System\BSfOiOo.exe
  C:\Windows\System\BSfOiOo.exe
  2⤵
  PID:8896
- C:\Windows\System\aHOJEep.exe
  C:\Windows\System\aHOJEep.exe
  2⤵
  PID:8912
- C:\Windows\System\Ifgwzkj.exe
  C:\Windows\System\Ifgwzkj.exe
  2⤵
  PID:8944
- C:\Windows\System\PWaLnyS.exe
  C:\Windows\System\PWaLnyS.exe
  2⤵
  PID:9024
- C:\Windows\System\gDcGBJq.exe
  C:\Windows\System\gDcGBJq.exe
  2⤵
  PID:9092
- C:\Windows\System\WdXsWgp.exe
  C:\Windows\System\WdXsWgp.exe
  2⤵
  PID:9156
- C:\Windows\System\ObvxERp.exe
  C:\Windows\System\ObvxERp.exe
  2⤵
  PID:9184
- C:\Windows\System\tLDFAEY.exe
  C:\Windows\System\tLDFAEY.exe
  2⤵
  PID:7984
- C:\Windows\System\LLTMunZ.exe
  C:\Windows\System\LLTMunZ.exe
  2⤵
  PID:8972
- C:\Windows\System\VAQtgyy.exe
  C:\Windows\System\VAQtgyy.exe
  2⤵
  PID:9136
- C:\Windows\System\leperOL.exe
  C:\Windows\System\leperOL.exe
  2⤵
  PID:9204
- C:\Windows\System\XmWGkUi.exe
  C:\Windows\System\XmWGkUi.exe
  2⤵
  PID:8344
- C:\Windows\System\eeOLzEB.exe
  C:\Windows\System\eeOLzEB.exe
  2⤵
  PID:8508
- C:\Windows\System\dgylEoI.exe
  C:\Windows\System\dgylEoI.exe
  2⤵
  PID:8168
- C:\Windows\System\dKEMnjF.exe
  C:\Windows\System\dKEMnjF.exe
  2⤵
  PID:8364
- C:\Windows\System\BzEACLU.exe
  C:\Windows\System\BzEACLU.exe
  2⤵
  PID:8520
- C:\Windows\System\PALSArQ.exe
  C:\Windows\System\PALSArQ.exe
  2⤵
  PID:8700
- C:\Windows\System\ZFxBKZG.exe
  C:\Windows\System\ZFxBKZG.exe
  2⤵
  PID:8752
- C:\Windows\System\pzWUcqL.exe
  C:\Windows\System\pzWUcqL.exe
  2⤵
  PID:8928
- C:\Windows\System\mYDKKnN.exe
  C:\Windows\System\mYDKKnN.exe
  2⤵
  PID:8572
- C:\Windows\System\sNxvNIL.exe
  C:\Windows\System\sNxvNIL.exe
  2⤵
  PID:9140
- C:\Windows\System\ehvTZln.exe
  C:\Windows\System\ehvTZln.exe
  2⤵
  PID:8880
- C:\Windows\System\BQgJEiw.exe
  C:\Windows\System\BQgJEiw.exe
  2⤵
  PID:8456
- C:\Windows\System\RzCADke.exe
  C:\Windows\System\RzCADke.exe
  2⤵
  PID:8892
- C:\Windows\System\NszQTIG.exe
  C:\Windows\System\NszQTIG.exe
  2⤵
  PID:8956
- C:\Windows\System\ttVUmuy.exe
  C:\Windows\System\ttVUmuy.exe
  2⤵
  PID:8536
- C:\Windows\System\UisDtSd.exe
  C:\Windows\System\UisDtSd.exe
  2⤵
  PID:8828
- C:\Windows\System\ixLqaKQ.exe
  C:\Windows\System\ixLqaKQ.exe
  2⤵
  PID:8472
- C:\Windows\System\sbrfkaC.exe
  C:\Windows\System\sbrfkaC.exe
  2⤵
  PID:9200
- C:\Windows\System\yXytFfQ.exe
  C:\Windows\System\yXytFfQ.exe
  2⤵
  PID:9104
- C:\Windows\System\aXfvYAv.exe
  C:\Windows\System\aXfvYAv.exe
  2⤵
  PID:8236
- C:\Windows\System\aFXavoB.exe
  C:\Windows\System\aFXavoB.exe
  2⤵
  PID:9008
- C:\Windows\System\ORfpXQy.exe
  C:\Windows\System\ORfpXQy.exe
  2⤵
  PID:8992
- C:\Windows\System\UwGbpKW.exe
  C:\Windows\System\UwGbpKW.exe
  2⤵
  PID:9068
- C:\Windows\System\uisVxgb.exe
  C:\Windows\System\uisVxgb.exe
  2⤵
  PID:8316
- C:\Windows\System\KsUhMkx.exe
  C:\Windows\System\KsUhMkx.exe
  2⤵
  PID:8380
- C:\Windows\System\yJoUfMh.exe
  C:\Windows\System\yJoUfMh.exe
  2⤵
  PID:8396
- C:\Windows\System\GobkxKZ.exe
  C:\Windows\System\GobkxKZ.exe
  2⤵
  PID:8764
- C:\Windows\System\gykNxwz.exe
  C:\Windows\System\gykNxwz.exe
  2⤵
  PID:8864
- C:\Windows\System\RdzhCJy.exe
  C:\Windows\System\RdzhCJy.exe
  2⤵
  PID:9228
- C:\Windows\System\kXWXXxk.exe
  C:\Windows\System\kXWXXxk.exe
  2⤵
  PID:9244
- C:\Windows\System\EAFUIFU.exe
  C:\Windows\System\EAFUIFU.exe
  2⤵
  PID:9284
- C:\Windows\System\rjCuSrO.exe
  C:\Windows\System\rjCuSrO.exe
  2⤵
  PID:9304
- C:\Windows\System\kXClDVH.exe
  C:\Windows\System\kXClDVH.exe
  2⤵
  PID:9320
- C:\Windows\System\mAURfhb.exe
  C:\Windows\System\mAURfhb.exe
  2⤵
  PID:9336
- C:\Windows\System\OXVLknn.exe
  C:\Windows\System\OXVLknn.exe
  2⤵
  PID:9352
- C:\Windows\System\ogfAIKR.exe
  C:\Windows\System\ogfAIKR.exe
  2⤵
  PID:9372
- C:\Windows\System\TEMKnGc.exe
  C:\Windows\System\TEMKnGc.exe
  2⤵
  PID:9388
- C:\Windows\System\LZPWOuh.exe
  C:\Windows\System\LZPWOuh.exe
  2⤵
  PID:9404
- C:\Windows\System\oXGYmtf.exe
  C:\Windows\System\oXGYmtf.exe
  2⤵
  PID:9420
- C:\Windows\System\coZZCBi.exe
  C:\Windows\System\coZZCBi.exe
  2⤵
  PID:9444
- C:\Windows\System\UmdTYpv.exe
  C:\Windows\System\UmdTYpv.exe
  2⤵
  PID:9460
- C:\Windows\System\bPhHyEE.exe
  C:\Windows\System\bPhHyEE.exe
  2⤵
  PID:9480
- C:\Windows\System\IhDSUxf.exe
  C:\Windows\System\IhDSUxf.exe
  2⤵
  PID:9500
- C:\Windows\System\fXVmXTC.exe
  C:\Windows\System\fXVmXTC.exe
  2⤵
  PID:9516
- C:\Windows\System\hDZIDza.exe
  C:\Windows\System\hDZIDza.exe
  2⤵
  PID:9532
- C:\Windows\System\HIeXaXl.exe
  C:\Windows\System\HIeXaXl.exe
  2⤵
  PID:9548
- C:\Windows\System\okqZUHY.exe
  C:\Windows\System\okqZUHY.exe
  2⤵
  PID:9648
- C:\Windows\System\bggoPHm.exe
  C:\Windows\System\bggoPHm.exe
  2⤵
  PID:9668
- C:\Windows\System\JPpKwEn.exe
  C:\Windows\System\JPpKwEn.exe
  2⤵
  PID:9684
- C:\Windows\System\opzzJst.exe
  C:\Windows\System\opzzJst.exe
  2⤵
  PID:9700
- C:\Windows\System\CGyQunh.exe
  C:\Windows\System\CGyQunh.exe
  2⤵
  PID:9716
- C:\Windows\System\MOoPybR.exe
  C:\Windows\System\MOoPybR.exe
  2⤵
  PID:9732
- C:\Windows\System\SyPWXnY.exe
  C:\Windows\System\SyPWXnY.exe
  2⤵
  PID:9748
- C:\Windows\System\iwoazRb.exe
  C:\Windows\System\iwoazRb.exe
  2⤵
  PID:9768
- C:\Windows\System\nyPOeiL.exe
  C:\Windows\System\nyPOeiL.exe
  2⤵
  PID:9784
- C:\Windows\System\WZzawIU.exe
  C:\Windows\System\WZzawIU.exe
  2⤵
  PID:9804
- C:\Windows\System\BDHftbD.exe
  C:\Windows\System\BDHftbD.exe
  2⤵
  PID:9820
- C:\Windows\System\EggfPGO.exe
  C:\Windows\System\EggfPGO.exe
  2⤵
  PID:9836
- C:\Windows\System\eVPJmGr.exe
  C:\Windows\System\eVPJmGr.exe
  2⤵
  PID:9852
- C:\Windows\System\aNllmNY.exe
  C:\Windows\System\aNllmNY.exe
  2⤵
  PID:9868
- C:\Windows\System\HeFpMWx.exe
  C:\Windows\System\HeFpMWx.exe
  2⤵
  PID:9884
- C:\Windows\System\nohjfNI.exe
  C:\Windows\System\nohjfNI.exe
  2⤵
  PID:9900
- C:\Windows\System\mdmyfYA.exe
  C:\Windows\System\mdmyfYA.exe
  2⤵
  PID:9916
- C:\Windows\System\msoUdPc.exe
  C:\Windows\System\msoUdPc.exe
  2⤵
  PID:9932
- C:\Windows\System\XbMSuZM.exe
  C:\Windows\System\XbMSuZM.exe
  2⤵
  PID:9948
- C:\Windows\System\azTzitJ.exe
  C:\Windows\System\azTzitJ.exe
  2⤵
  PID:9964
- C:\Windows\System\EGiAkwo.exe
  C:\Windows\System\EGiAkwo.exe
  2⤵
  PID:9980
- C:\Windows\System\IyisoZo.exe
  C:\Windows\System\IyisoZo.exe
  2⤵
  PID:9996
- C:\Windows\System\VDFsmKv.exe
  C:\Windows\System\VDFsmKv.exe
  2⤵
  PID:10012
- C:\Windows\System\dctGUPG.exe
  C:\Windows\System\dctGUPG.exe
  2⤵
  PID:10028
- C:\Windows\System\jQiNXNG.exe
  C:\Windows\System\jQiNXNG.exe
  2⤵
  PID:10044
- C:\Windows\System\IkyJyeY.exe
  C:\Windows\System\IkyJyeY.exe
  2⤵
  PID:10060
- C:\Windows\System\JzebYGv.exe
  C:\Windows\System\JzebYGv.exe
  2⤵
  PID:10076
- C:\Windows\System\xNPqykq.exe
  C:\Windows\System\xNPqykq.exe
  2⤵
  PID:10092
- C:\Windows\System\QdycbUP.exe
  C:\Windows\System\QdycbUP.exe
  2⤵
  PID:10108
- C:\Windows\System\gKiBMbZ.exe
  C:\Windows\System\gKiBMbZ.exe
  2⤵
  PID:10124
- C:\Windows\System\aUYdZYu.exe
  C:\Windows\System\aUYdZYu.exe
  2⤵
  PID:10140
- C:\Windows\System\nrIoVwG.exe
  C:\Windows\System\nrIoVwG.exe
  2⤵
  PID:10164
- C:\Windows\System\gVaqmzO.exe
  C:\Windows\System\gVaqmzO.exe
  2⤵
  PID:10180
- C:\Windows\System\eKzynuh.exe
  C:\Windows\System\eKzynuh.exe
  2⤵
  PID:10196
- C:\Windows\System\FVsRRuI.exe
  C:\Windows\System\FVsRRuI.exe
  2⤵
  PID:10212
- C:\Windows\System\yDlWrbK.exe
  C:\Windows\System\yDlWrbK.exe
  2⤵
  PID:10228
- C:\Windows\System\TkjKavx.exe
  C:\Windows\System\TkjKavx.exe
  2⤵
  PID:9056
- C:\Windows\System\jFUYzVo.exe
  C:\Windows\System\jFUYzVo.exe
  2⤵
  PID:9264
- C:\Windows\System\MDIguav.exe
  C:\Windows\System\MDIguav.exe
  2⤵
  PID:8624
- C:\Windows\System\fPMOFXG.exe
  C:\Windows\System\fPMOFXG.exe
  2⤵
  PID:7936
- C:\Windows\System\DkpIvEL.exe
  C:\Windows\System\DkpIvEL.exe
  2⤵
  PID:7992
- C:\Windows\System\cAgmYST.exe
  C:\Windows\System\cAgmYST.exe
  2⤵
  PID:9272
- C:\Windows\System\CjvVFoG.exe
  C:\Windows\System\CjvVFoG.exe
  2⤵
  PID:9276
- C:\Windows\System\NMcycJG.exe
  C:\Windows\System\NMcycJG.exe
  2⤵
  PID:9344
- C:\Windows\System\VjPPZoY.exe
  C:\Windows\System\VjPPZoY.exe
  2⤵
  PID:9328
- C:\Windows\System\iSMuqLp.exe
  C:\Windows\System\iSMuqLp.exe
  2⤵
  PID:9380
- C:\Windows\System\YJXdgpm.exe
  C:\Windows\System\YJXdgpm.exe
  2⤵
  PID:9452
- C:\Windows\System\POKbHuD.exe
  C:\Windows\System\POKbHuD.exe
  2⤵
  PID:9496
- C:\Windows\System\IVgvYss.exe
  C:\Windows\System\IVgvYss.exe
  2⤵
  PID:9508
- C:\Windows\System\fUINVDj.exe
  C:\Windows\System\fUINVDj.exe
  2⤵
  PID:9400
- C:\Windows\System\IIRROrq.exe
  C:\Windows\System\IIRROrq.exe
  2⤵
  PID:9436
- C:\Windows\System\LmeMgUi.exe
  C:\Windows\System\LmeMgUi.exe
  2⤵
  PID:9512
- C:\Windows\System\yNCACRj.exe
  C:\Windows\System\yNCACRj.exe
  2⤵
  PID:1496
- C:\Windows\System\nPiCbsJ.exe
  C:\Windows\System\nPiCbsJ.exe
  2⤵
  PID:9588
- C:\Windows\System\PnVnGhY.exe
  C:\Windows\System\PnVnGhY.exe
  2⤵
  PID:9604
- C:\Windows\System\eQFoXjt.exe
  C:\Windows\System\eQFoXjt.exe
  2⤵
  PID:9620
- C:\Windows\System\onlceET.exe
  C:\Windows\System\onlceET.exe
  2⤵
  PID:9640
- C:\Windows\System\kyztxji.exe
  C:\Windows\System\kyztxji.exe
  2⤵
  PID:9680
- C:\Windows\System\KLLgevt.exe
  C:\Windows\System\KLLgevt.exe
  2⤵
  PID:9744
- C:\Windows\System\HyiTSEZ.exe
  C:\Windows\System\HyiTSEZ.exe
  2⤵
  PID:9816
- C:\Windows\System\RRWkJQb.exe
  C:\Windows\System\RRWkJQb.exe
  2⤵
  PID:9880
- C:\Windows\System\VvuWrGP.exe
  C:\Windows\System\VvuWrGP.exe
  2⤵
  PID:9724
- C:\Windows\System\EEMQXBA.exe
  C:\Windows\System\EEMQXBA.exe
  2⤵
  PID:9656
- C:\Windows\System\vUpESpI.exe
  C:\Windows\System\vUpESpI.exe
  2⤵
  PID:9940
- C:\Windows\System\jocmZKa.exe
  C:\Windows\System\jocmZKa.exe
  2⤵
  PID:9660
- C:\Windows\System\gXjMpPP.exe
  C:\Windows\System\gXjMpPP.exe
  2⤵
  PID:9728
- C:\Windows\System\hKPHtxA.exe
  C:\Windows\System\hKPHtxA.exe
  2⤵
  PID:9924
- C:\Windows\System\OmWBWXk.exe
  C:\Windows\System\OmWBWXk.exe
  2⤵
  PID:10036
- C:\Windows\System\AERBFpp.exe
  C:\Windows\System\AERBFpp.exe
  2⤵
  PID:9956
- C:\Windows\System\xPGfZNr.exe
  C:\Windows\System\xPGfZNr.exe
  2⤵
  PID:10072
- C:\Windows\System\zjwFZVL.exe
  C:\Windows\System\zjwFZVL.exe
  2⤵
  PID:10024
- C:\Windows\System\siNqGCI.exe
  C:\Windows\System\siNqGCI.exe
  2⤵
  PID:9992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\FScxDxF.exe

Filesize
2.0MB

MD5
7d5a442ca469304cefba9e1dc756eac9

SHA1
204540d6686c833ff2a62520a673decfd651d26a

SHA256
4cc764de95cf99e95cc8c27ad56664a81ddf48c6752deaeb6660f61fe63b6cb3

SHA512
d34a54bb97fdc5f9402b072e6a711adcb25aab37ffc1a3de7d75329b67e2d7276cfa19007b9cbff82f63c2c3340648d6e28ad3d8d467ec2dcdd81cec578c75bf

Download Submit
C:\Windows\system\FlXKStL.exe

Filesize
2.0MB

MD5
e3267314a1b07722e4e0fc6b43aea920

SHA1
34b046124a745f3fd7b9ef6dc15b5bd7c05a7e63

SHA256
6d05de9196406d776b6361bc0be3e641742acfb9ae3d4540b8c5eb14a65c0710

SHA512
ce6d59d4493270246a2f359db0e0ccef39a4005e0edc22931ba6de9188973c79585e3ffe44fd9648a8f20df44b32eb5cd70aacd9f8483ff4c52f12d6637fc8aa

Download Submit
C:\Windows\system\IXRswmc.exe

Filesize
8B

MD5
d8f939ee099285eb5299be97436baa4d

SHA1
e982a1f84114c575869e996a9a214509ee9e0e66

SHA256
e7c262920797c23676b4311de18f70723dfd833b4d38ec2d89ac9d49b2f67690

SHA512
e31bd5edb5ca774adb6b49128eb293ef2a9394fca94c3def6901a7d4903de06386842bbd81ce1630fc901df52644e493a263be2bc59bd514aa7a1f110b251fe2

Download Submit
C:\Windows\system\MeePtCW.exe

Filesize
2.0MB

MD5
28be24ddd409355a0a366870b12e63cc

SHA1
63e838a7ede7e61a5a3ce8c1b79fb0d66a38f7cb

SHA256
14b5a3f8bc0f133b1ddb7e6a10df9ce514163b7cc485be4a389a814edc1585d9

SHA512
5cedf94ba2ff3562837fb857d5dd2de7a0e99850c2e35412b460ef1ef8feb42ebd5f253b6f29915d5bc6024689736ea849dde449dc36fff3c2932ced4c7183be

Download Submit
C:\Windows\system\NLscOqE.exe

Filesize
2.0MB

MD5
dfbb3975c85c77bdc3e93925c90354dd

SHA1
99b2a1e32fd8c3a10676b0436e19c3645a7efd89

SHA256
d7de01da27897349e621eb9b6435e0d7b5c6bd36a9f2d7f35bc3c5d4f6f76882

SHA512
9fc99d8f11ba2db0788ad1a5f0283338b69ea209355d276e1bd08535f962406b9f1132049b0760821ffd33ee96217e1b4c476497d4652117559ad88f98e9478b

Download Submit
C:\Windows\system\ORFXWPh.exe

Filesize
2.0MB

MD5
8dc6bff472ddf410d6dd4ab08c7cc84b

SHA1
6032a8457585672a60083c9e86d40bc4c94cf0c5

SHA256
c7a562331264458d59ac2efc7ef9eb8b4d8dfdd654d05fa082bce66145354fea

SHA512
a7b4b98239ea8e389e90f91f76bbe76c44c733debbd57f9f6123b3613d5485863137dc4239be18195cd9347d073944cb263655d66445f71d7d729a038164b2a8

Download Submit
C:\Windows\system\PifnPRX.exe

Filesize
2.0MB

MD5
4666a8f7a028b79b94ce600b75dcb5d6

SHA1
4917cdb85f3bdb4d9a2f8f1385caf622e7ef8076

SHA256
aa5e02eb91c76ca9e355a14e88dd60ad4ecc9c40f209613e77ffd42b03c068fe

SHA512
b080ddfa17edeee5e227424105385e2de5dbb5b33884932d77465790885710dddeeed9a8f1e0039526dc10035119c2def1f8d8290ec6bbf55e59b84a5b70e514

Download Submit
C:\Windows\system\UDJMiJg.exe

Filesize
2.0MB

MD5
a82d377bce515827e3ec5ce79dfc42f8

SHA1
39d71035be563574a6960b45511175fc806af734

SHA256
ae0d65732d008e221882806d5a20ac11f39d58af1e1b59fd401337b28ecfb1d1

SHA512
5cb51b6be2a7875d09aded8f60ef6127ef74ba9d7489a8d53040c1da7dce720ad99ba141bbd0d2c3a2e7b809593782fcb7edccc78bc7c3c61502690874275259

Download Submit
C:\Windows\system\WPOslJf.exe

Filesize
2.0MB

MD5
11fe9ab421de418725d73842e02e4e7a

SHA1
8819554e56779a6d82efa99bbdd9be2e6550f650

SHA256
a0862ae0e98a20d86ef514f08d3768eacf301ce65f8d409db8a67ac8a2afc10d

SHA512
3e31da63de883786430fae6c617a181d5824971e1a7a6af0f1cb685820fa58030b799c64f10074cd318aaa711ab3d8825e7f8c0638d8bb637bcb52c0d11f8151

Download Submit
C:\Windows\system\YltbkAZ.exe

Filesize
2.0MB

MD5
41866b43d7cb24849166ddd99e00a308

SHA1
57df281f18ac271623d714966163ad4b5e05c7b4

SHA256
e010cfd4c54ad6735c7588af1eb9a4f5fb1306a88fbc85d45b6e0729cd2070ca

SHA512
9f102fe017ffa16bb14e3bf677d655965aac97de3d9147f34348d27a7e9ddcd8c62fdea5fdd2ce0db6c0cc4fc8cb4c93d9aafe7732e218160e79e82476adb2c9

Download Submit
C:\Windows\system\eyCJQrZ.exe

Filesize
2.0MB

MD5
4bd98a77abd40a3702fd7ddbd0393ae9

SHA1
552610eadec8e1397d3512c9268547ba769f1744

SHA256
8356ff457261bddae1f9ab02bcae80254924fa10498f3fefac881b0fcbe55767

SHA512
c8d3308b18b1397d88643b0250b5fa34f4d8ba1b01004503720627396b0d6e217af9221e856265688fd3a56c175a5eabb8307bd5b91de5702f6307d74df4bd5c

Download Submit
C:\Windows\system\ftpWGxb.exe

Filesize
2.0MB

MD5
09c1d8574c689650b8591c90c8fbcf66

SHA1
1a9fede565f32557eae6ddf63225167a3c1b37cb

SHA256
2a282fb37e6564542a13308dbce266c522fa980fe30a53f78734da1e2fef9758

SHA512
22d2be59b285f7193c720c2bc8f72cd637929089f6a54e0f5d042987982dea51df10a1955de304b3fb1fe262023eb529a718517ac7ec6dd03145c64c489b5594

Download Submit
C:\Windows\system\hBIxgFt.exe

Filesize
2.0MB

MD5
aa10086a530b2eafbb13a2a9d4f0a069

SHA1
e34f485c96dd6b3d6cf8359b791b6c56b57ca0fe

SHA256
7de55e73d358f884ae0a1bae668991b4c24de3cebd45348ed0e11daf95811aff

SHA512
2bc2ed1735a146740f0d07d8327576f9c67d958ae21e2545e4a54de4757aedc5e5a54b9cfc19a51da40980ba9063b3b8a72371578c32b5ad56dbd5ad9edb48aa

Download Submit
C:\Windows\system\iRHKsyL.exe

Filesize
2.0MB

MD5
1dc83bd46fea740b6777aca5937dab8b

SHA1
dad60eb7280364b93c266545f488b8290c3d7cff

SHA256
f2691ca5e07185266eab8af1680cad05cb13efa5a150df0b32d9d83b750d240c

SHA512
397b23640ba5d52656218ddb78cd5905192f342b58f5339795f40933b25c2ad154921c3b36ae34d8317244bf77931217dbd988f7316ce36a413494a734a61085

Download Submit
C:\Windows\system\lkpusAq.exe

Filesize
2.0MB

MD5
c8ecf1e0696fb8d4ec4037f86977a649

SHA1
dfb37b3e4427c6df3d243dc2032a4f57878d9ced

SHA256
01a69e684c86c05a58a9bb939e8c688c74e77a1746d370d18490add4a4cd94d4

SHA512
1e0567c6233dcefd38a1160909b3dde2ac5393ab7d9b1a8904b43ba6743e6615f838ee4acf485c75b96de34bddfb4e02fd761773f04e0ee0f7e81615f152469d

Download Submit
C:\Windows\system\mbbfrCL.exe

Filesize
2.0MB

MD5
15312c349a4e98d8128d416566a244ed

SHA1
f50e8f477e32d3e46fa9cd186f2291c690468bb1

SHA256
7f950d6f849aace852e8098a9ab6a0bf3a7ca2afdf599170a8cf18256630be76

SHA512
ff78b18b1477c3a101ec547cba01760d6fb714f06d2a47db2a6e6182b99d6e740f7d10b5c00f1476ade4c6d47220ba4251fd224b8db250ade7ee77de0e310313

Download Submit
C:\Windows\system\omLMevE.exe

Filesize
2.0MB

MD5
eeec5492357dacc9cd598eba61dfc4a9

SHA1
dea2f5d695876918ca313299742b0c5ba3010ac1

SHA256
68a0735adc045d6a755516edabbbac36409610f54a01f9a721dff3d349ed9120

SHA512
b9ffe3f96fc1eb265d3f564faf6525deeae8afbfeb775c72968c32c766b7da085583a63b723ec35d3c7692252b51039df9a5ce4ddd792706134d509a07de6899

Download Submit
C:\Windows\system\qKQAEtZ.exe

Filesize
2.0MB

MD5
b45cbec39e9dc567c4444b17d34bde6a

SHA1
d17b55f22795c6043dc9eac879512c445920a360

SHA256
682ca943ac99703b5a4f5663517a1543392415203e1a6cad7c616ab8f019d22f

SHA512
2f4cb75ecd6613177a038e4aa9a7a932628bff8357acedda1102bbc1b3e08ec23b077646c00337f7bd5939ea81cfd3e2150a4bd7f986b37ef76ed7c29395f490

Download Submit
C:\Windows\system\tRlNJMf.exe

Filesize
2.0MB

MD5
75d5de3601ceb509898fc24668c7a730

SHA1
2e1d3bb313e556c70a56f18039c622ba384e4eb3

SHA256
e17b7bfee222c8f921fecc4cb4c945a0aa18cb42003ec525f2707100a20850e3

SHA512
63e1ad38bdf3c71ae476675db1ab5a0f35d53860f6e049596a9164d22e49f3a630a553a34905811482336928b8a753624f41929bde36139f133da95d1f9ba198

Download Submit
C:\Windows\system\tSQtNIg.exe

Filesize
2.0MB

MD5
c9f63cbbcd3b4f6cc01d591809e9a3e1

SHA1
b94cf8ed914a4ee3afff4a1615abbff17aeb6b9c

SHA256
f666d799b292077515a010c6aced12b9ba19688d1fad0d0a6a434b03d7a1c5fc

SHA512
f242fc824b3b27ff94625bd51d0a68080214f87ca483b4c8584a36f509b72bcc16ab8f6039adba0fd1ae0aba8c38fc6b3a4f1155aca23d1c39f0b18be609108a

Download Submit
C:\Windows\system\yaQixiF.exe

Filesize
2.0MB

MD5
2b9440b271b70821aa97c8815cae8e49

SHA1
dfb14aa1328d7ab0bc6de2ba0dbb04efaec1c4d4

SHA256
d9cfbe33fbbfdcb194e6e6f68dddb39c9fe36f8d0d2fbb5dd930db5d2faa6cbb

SHA512
1f630d2379f9dc672957b92008e0e6461b6990b5df379a6ec63f2d55df81cdf257c722b4595139d269d965b71a48aae1462337da833da59aea54c26b2aae85d2

Download Submit
C:\Windows\system\zIGEOjn.exe

Filesize
2.0MB

MD5
de6ea955dc8ab48dab4238e9d4278e45

SHA1
bd4eaed31d950cf8799676866961560cc664c111

SHA256
a40b5b3e3a3b5106f5fe8440169b4933aee6247aeeeff405e9c05d1c361ad8b5

SHA512
f28da093ff58372682d7cd47b811d172d8a3a150e5cf13dd5263367f59429c15a50166696a00bda1d2a339b620efe0feacad33fa91e238541b00619b1a44ae4d

Download Submit
\Windows\system\AivifkE.exe

Filesize
2.0MB

MD5
df6b8aeca59c118c553108a885f0020f

SHA1
cad14d0ae22b29d9322715ab67ed8fb60b62af3e

SHA256
bdfccfffb7aaca8f96fb2fe63fd4d1e759468110cc92a8819b88fc47a7809183

SHA512
262b7e09d6f1c8bf520dbe12ca122cdc4bd56f2d677461f66ce1468ee933350c339ea08f90684f7db1aff368890c4f212317d6bc038756252c3ca6310efac454

Download Submit
\Windows\system\JGmnjRX.exe

Filesize
2.0MB

MD5
2a6d9d8ea227f945e5a2cbef3833363b

SHA1
4495aed42e87a4c043e703c2f0b666335ef760c7

SHA256
9a766e764b1a6e9944da678aa4007f98efeddace71fdf58b801aaa4930dabdaa

SHA512
1d4d63dfc83ed5c8d1b42279370bd090c59abcab985118886417d845cacc03cf38567b2d471e1a3a897f958c63197e0844899e11d007819a5f0570e4b92550a7

Download Submit
\Windows\system\RjmTNPT.exe

Filesize
2.0MB

MD5
150da6cb48b79d9d0c38cd8b75bc8cc6

SHA1
14ff0a9f46b99aee2cdcf68a3f962719c99a026c

SHA256
97597c5de7c09f301b8e9d24392a54abc5b82115c930f3aa4979c999bf93dfea

SHA512
27d2393f553b99d738a0f36bd4eb9c52ba9d5303cd8e1f51f76fb3bb049c9dbaa806c57b4529cdb69a61f8fe3e82898088bb00caa658726e6bc0ae1b075843b6

Download Submit
\Windows\system\TRsEYIw.exe

Filesize
2.0MB

MD5
11e02840564e67f4ac27fdc66931968f

SHA1
2f7b677b8730d8f8b8621a7b1d5b578c71404675

SHA256
676d55835dd8b4b1eb6101246660d761ba748165bdccb3791247912ac7efd1ca

SHA512
54a86474f2390218a4088d641b297cb32f2d2d92f1e3759dae6e5340d2ea96728c349d04fee8da8cb3fc139d20382d9470b9fc2909774f657814ca58a5555743

Download Submit
\Windows\system\TRvHAAe.exe

Filesize
2.0MB

MD5
cad50700df42c9e8264ce53f0fffba16

SHA1
bb9bb164099d667111264b70e3a39478b29f396d

SHA256
bfded25418c0f7a7f7e702e309e32f506da496e8c2fbcc077a1fb19682a2681c

SHA512
71f1697b26d0c254b6329bd905cad24d30e30401f65a912a9a31f125dd3bd6a4b961701cdb87067cac1adb83ca89d2035a951e8021e77d9550897568b68cb57c

Download Submit
\Windows\system\UNXEKmn.exe

Filesize
2.0MB

MD5
736df13ff60216fd8ca1e06cd2379cef

SHA1
4a714e222fb8ea57f48a8c77e0918f54b3a15498

SHA256
35511cb2f1af8e34ac73f6d75642475f08716af49bff3dfa2c633b49df1f5c91

SHA512
712ddbeef2c8ee2c83a68b2b2272efad1f9524581a97f6ac6de0c77fa1517832231e5f257b40e07a1121787e7edab35338e06d60c38917b7b732baeccecd44ed

Download Submit
\Windows\system\UqSXsrT.exe

Filesize
2.0MB

MD5
e74a73c4cf541e0f965ed84710f40eba

SHA1
27ed4050ed6400ce8feb7f45f40e442eed7c4b5d

SHA256
c24b250baa1758922a41fb708f91eae050842529725cfcd887ee5b45964ed319

SHA512
38965d83ba0633ed23148a2340d018c845d3172ac639c44783c22a951b5069935caa1fc0f1e9ed4dc1702c5ed65bab1602080750a772e31fa36e53c231ffd013

Download Submit
\Windows\system\XlOKdHP.exe

Filesize
2.0MB

MD5
d30e10a22ca739268cea5b310db37a97

SHA1
c9aed8bab164c4e830019242d802ab881eca1206

SHA256
9688bc36a4c1bb37cdfdcf43cd7e056f6bb788b140240221eafe17dbb832cf41

SHA512
10b06e69de8bfdc0c15295a9206f61fde5db6c979c37f920b752d71537ba7431e008eb1c6314e0f19addb95e402b5fdf8fce6525f7f2fdc20f8e4f45ce863ee3

Download Submit
\Windows\system\XvnPgUi.exe

Filesize
2.0MB

MD5
f8ecf1fbe790c71a68aecb4e93bb94fd

SHA1
850431d23ad90afe1215d20190c025b41710d21d

SHA256
554739295c95a338a68f2c719f2925291a066b3105c78858b2e743712b51d87b

SHA512
d2cde53631678338fa3dc52b1dfa1b30dd7d1f9ae6ee3f26d82caa21ff3a8f179f729e6871b7176620be2318b58c760641df2444dbb4fc1ab6df34b7ddff6e83

Download Submit
\Windows\system\YrgOeDw.exe

Filesize
2.0MB

MD5
2ca30daccb5cf9db848c70b44fc1359b

SHA1
f8b5ee366ffa13a0b2b4ebf87b4963752fa9d316

SHA256
7c019b2a6dc9d765defa02544d714b7e933edf3d10fdd31a625d89a07f9e9aaf

SHA512
8f8ae28003ef4003aa8a6f472e64eba5560ba3d57fed93e1b868ffb6a37365d8c167b70e51dea2df98f3b4a134438c6590604f4de8b074c4b5b0ee7df4e5f085

Download Submit
\Windows\system\aXZNsDL.exe

Filesize
2.0MB

MD5
ced54e458e8d1374aa44545534631fc2

SHA1
43f0093db0aca2b5cc736d12598008a79b18be48

SHA256
d33ae2f3c26cef1d8d49d0b9f46a72593c88047707ab78d19b5a7a3560e77a1f

SHA512
c61a633e67ee9f18013b41661ec8da99f2e4ee206583df4cf5484f2f50dc73e2cb4068c0924822b0008aef12f687fefd14181599f8ce546da4cdc7f429922f46

Download Submit
\Windows\system\lVTvHPr.exe

Filesize
2.0MB

MD5
6c4b469dce1e829f890dbb388533efae

SHA1
8a78b4035e79859823d667697ebab7fc9e8396f1

SHA256
9b5137b377e7e9fbf2305f72cfa3d40d2c88f8476205c3cb0dd97cec389105c1

SHA512
cadd7be1f015fadb9f027c46cde7c38ab82ec94d6f35ed69a912b4a15ea5d6f0ef4fad91a4f83d7e1a75166564c937a971126e9e2e8f8b329f7aa605ff1fa58a

Download Submit
\Windows\system\xjiOYHI.exe

Filesize
2.0MB

MD5
2605be4ebc229372a859c1b71a74a5d8

SHA1
bdd9652187ff3332f89cbb2ef328467b6fd3716a

SHA256
88ea9985035046630c180e770b10b88662a8f02dd608286b4aea6c091829fa95

SHA512
1c15e62660c20b5a184ee062d51d540e500e049e8b445c0662472d27e33d881628b27f8841c0d071a4e7a41da69620f9c55394f8a841dd1bcf89338182087afe

Download Submit
\Windows\system\zfhTFEj.exe

Filesize
2.0MB

MD5
7da86809ab507906f9d344002c2e6e4c

SHA1
8506cc8e04a11040314961a6dd7dc7d413ae83c8

SHA256
05ea6e545986b7ff7cc0fb2399c19fc2fecca5171f03c15af6cddbd992af186b

SHA512
3529e4e6c69f28e604d767cef4fc41df4e24fdd91c810aa1ca7aa3adc3d914ee4ada4bfdbaf38476001ff323ed2f0d3e37a20b7b72a8b728024ad15c4d38d098

Download Submit
memory/1472-97-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/1472-4543-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/1556-4686-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/1556-87-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2508-40-0x000000013FA90000-0x000000013FE82000-memory.dmp

Filesize
3.9MB

Download
memory/2512-4541-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-55-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2540-4530-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2540-29-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2684-46-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-4558-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-94-0x0000000001F70000-0x0000000001F78000-memory.dmp

Filesize
32KB

Download
memory/2784-38-0x0000000002CC0000-0x0000000002D40000-memory.dmp

Filesize
512KB

Download
memory/2784-52-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/2796-4547-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2796-44-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2808-4549-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-43-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-41-0x0000000002F40000-0x0000000003332000-memory.dmp

Filesize
3.9MB

Download
memory/2860-93-0x0000000003310000-0x0000000003702000-memory.dmp

Filesize
3.9MB

Download
memory/2860-37-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-21-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2860-13200-0x0000000003310000-0x0000000003702000-memory.dmp

Filesize
3.9MB

Download
memory/2860-9-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2860-95-0x0000000003310000-0x0000000003702000-memory.dmp

Filesize
3.9MB

Download
memory/2860-96-0x0000000003310000-0x0000000003702000-memory.dmp

Filesize
3.9MB

Download
memory/2860-62-0x0000000003310000-0x0000000003702000-memory.dmp

Filesize
3.9MB

Download
memory/2860-53-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-69-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2860-1-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/2860-1071-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-0-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/3024-13-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download