xmrig | 98a9d5596e122db5acf66c761f86f9cc410bbdc154bc3b99b623d188f1372768

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
Size

2.2MB
MD5

24d0a5b1c66a8716b897ab1db55304e0
SHA1

aef3141221522a824a16550dcb6587165fac6081
SHA256

98a9d5596e122db5acf66c761f86f9cc410bbdc154bc3b99b623d188f1372768
SHA512

dbbf35986612af0cdc9d9835a2bd21b4c34ffad3a1964a765ff6213967e8ae27aaab57a8ee940129b981112fef8cd24002ef865dc97d0f6f406195a055a28c0f
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cbRh:NABP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/2576-36-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2684-48-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/1772-392-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/1640-105-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2656-46-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2936-45-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	xmrig
behavioral1/memory/3020-40-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2548-33-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2476-4252-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	xmrig
behavioral1/memory/3020-5727-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2656-5745-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/1640-5755-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2576-5754-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2860-5749-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2520-5760-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/2548-5773-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2936-5774-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	xmrig
behavioral1/memory/2684-5780-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2236	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2656	UXLVbJp.exe
2548	mzltvjP.exe
2576	tbpUJkI.exe
3020	lEWAEzk.exe
2936	iMFBzaH.exe
2684	Gpipfuw.exe
2476	wACQipI.exe
2520	ccfuHej.exe
2860	cVpNyDH.exe
1640	ELjoWTu.exe
2628	sBxLozf.exe
1704	NnOFnJJ.exe
1300	vCXjnAj.exe
1932	RkyFCcn.exe
2404	LJNpopg.exe
2504	sXqNHjC.exe
2836	QcmFgBz.exe
1956	gUqbUKi.exe
1652	VjuFumc.exe
1684	OFuINzi.exe
1816	yoiCWcC.exe
2392	uovsryJ.exe
1532	wQAXJPA.exe
840	vkUOwwS.exe
2092	SUmQjev.exe
692	kCJjxiv.exe
3068	CMvfArM.exe
2316	UkThtAb.exe
2044	iHFHOSI.exe
2752	gKokHuy.exe
1592	VvXbReh.exe
1380	gWVedtt.exe
916	jXuNMdb.exe
2788	bYmmXRi.exe
880	uDNATOH.exe
2824	clabOzS.exe
1168	HtxeryH.exe
2344	mQrfuml.exe
888	rqxleSa.exe
2296	OGAJuKM.exe
2972	tkaBFFM.exe
2020	rRNypHN.exe
2944	NiqdHpA.exe
560	ZwxMZrm.exe
2700	htpfdmH.exe
1552	vEwLkns.exe
2056	XLVrDPA.exe
2168	LEuWKZG.exe
2452	gPiEunG.exe
568	PjeWhUA.exe
536	LRouNtt.exe
2156	Lrvoroo.exe
2644	FukSLaD.exe
2964	KbIBdgE.exe
1016	NVxXZxN.exe
3088	UjeqStv.exe
3148	GUlivkm.exe
3180	FaIAgNu.exe
3244	NnrqwXb.exe
1492	ThaiaYv.exe
1800	AImATQq.exe
708	fAhsDRv.exe
3284	ZRkMaPS.exe
2000	zLFdrYn.exe

Loads dropped DLL 64 IoCs

pid	Process
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1772-0-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/files/0x000b000000014323-3.dat	upx
behavioral1/files/0x00070000000149e1-16.dat	upx
behavioral1/files/0x0007000000014b36-23.dat	upx
behavioral1/files/0x0035000000014502-11.dat	upx
behavioral1/files/0x000700000001480e-19.dat	upx
behavioral1/memory/2576-36-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/files/0x0008000000014dae-49.dat	upx
behavioral1/memory/2684-48-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/files/0x0007000000015c93-61.dat	upx
behavioral1/files/0x0006000000015cb0-70.dat	upx
behavioral1/files/0x0006000000015d0c-104.dat	upx
behavioral1/files/0x0006000000015c9c-113.dat	upx
behavioral1/files/0x0006000000015d24-120.dat	upx
behavioral1/files/0x00060000000160cc-140.dat	upx
behavioral1/files/0x0006000000015f3c-132.dat	upx
behavioral1/files/0x0035000000014662-151.dat	upx
behavioral1/files/0x0006000000015e6d-128.dat	upx
behavioral1/files/0x0006000000015cf5-119.dat	upx
behavioral1/files/0x0006000000015cd9-118.dat	upx
behavioral1/files/0x0006000000015cbd-117.dat	upx
behavioral1/files/0x0006000000015d4c-114.dat	upx
behavioral1/files/0x0006000000015e09-123.dat	upx
behavioral1/files/0x0006000000016476-160.dat	upx
behavioral1/files/0x0006000000016a6f-174.dat	upx
behavioral1/files/0x0006000000016c3a-179.dat	upx
behavioral1/files/0x0006000000015fa7-136.dat	upx
behavioral1/files/0x00060000000161b3-143.dat	upx
behavioral1/files/0x00060000000162c9-155.dat	upx
behavioral1/files/0x0006000000016813-169.dat	upx
behavioral1/files/0x0006000000016c1d-176.dat	upx
behavioral1/files/0x000600000001654a-162.dat	upx
behavioral1/memory/1772-392-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/files/0x00060000000165f0-167.dat	upx
behavioral1/files/0x0006000000015cce-87.dat	upx
behavioral1/memory/2860-85-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/files/0x0006000000015d44-112.dat	upx
behavioral1/memory/2520-60-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/memory/1640-105-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/files/0x0006000000015ce3-103.dat	upx
behavioral1/files/0x001800000000558a-59.dat	upx
behavioral1/memory/2476-58-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	upx
behavioral1/memory/1772-55-0x00000000035F0000-0x00000000039E2000-memory.dmp	upx
behavioral1/memory/2656-46-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/2936-45-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/memory/3020-40-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/2548-33-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/files/0x0007000000014b10-25.dat	upx
behavioral1/memory/2476-4252-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	upx
behavioral1/memory/3020-5727-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/2656-5745-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/1640-5755-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2576-5754-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2860-5749-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/2520-5760-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/memory/2548-5773-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2936-5774-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/memory/2684-5780-0x000000013F860000-0x000000013FC52000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PRLNCpd.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\ByeAGRt.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\ixiDPpG.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\ppbWabh.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\blXWNwO.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\zKMOzzX.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\RFpABIR.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\QOsXaKv.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\lHqGlpF.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\Ocfyafz.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\IaBmHlL.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\ktaQicq.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\RfyoJIp.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\BbUqIAq.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\xYqGrjH.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\WIVsASI.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\OcCrFkc.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\OcVSpSk.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\VvXbReh.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\AQTGZKF.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\nvcoyEV.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\kTAXjgo.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\uTbyHld.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\UYkgIdh.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\MdJrcAA.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\bkEvlPo.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\eOvsEUI.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\gooacZG.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\IzFJoyw.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\LhhfmKr.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\EdAcYIo.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\tHkjIlQ.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\axurrUH.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\vsQpHWw.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\RYECAEJ.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\lhCHNdL.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\ykFhabx.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\mRphIXP.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\JDFiJGi.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\KptkLrm.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\eISkcQt.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\aeqNnce.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\HawQWeG.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\SyETMQk.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\jftKrGs.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\pHnpTEF.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\zCOiOXU.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\Gtceguf.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\yOeVWGx.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\ZGXTGIu.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\fTuLfwE.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\WtdvhKn.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\qUAgUDX.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\URlOzGe.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\azEyATE.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\GUlivkm.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\xQKbcux.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\LwPBfhA.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\xdVFLEG.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\uFfqVJD.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\UeLANiz.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\hRryeIO.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\rEzteqo.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
File created	C:\Windows\System\rrFwCVw.exe	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2236	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
Token: SeDebugPrivilege	2236	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 2236	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	29
PID 1772 wrote to memory of 2236	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	29
PID 1772 wrote to memory of 2236	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	29
PID 1772 wrote to memory of 2656	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	30
PID 1772 wrote to memory of 2656	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	30
PID 1772 wrote to memory of 2656	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	30
PID 1772 wrote to memory of 2548	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	31
PID 1772 wrote to memory of 2548	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	31
PID 1772 wrote to memory of 2548	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	31
PID 1772 wrote to memory of 2576	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	32
PID 1772 wrote to memory of 2576	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	32
PID 1772 wrote to memory of 2576	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	32
PID 1772 wrote to memory of 2936	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	33
PID 1772 wrote to memory of 2936	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	33
PID 1772 wrote to memory of 2936	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	33
PID 1772 wrote to memory of 3020	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	34
PID 1772 wrote to memory of 3020	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	34
PID 1772 wrote to memory of 3020	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	34
PID 1772 wrote to memory of 2684	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	35
PID 1772 wrote to memory of 2684	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	35
PID 1772 wrote to memory of 2684	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	35
PID 1772 wrote to memory of 2476	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	36
PID 1772 wrote to memory of 2476	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	36
PID 1772 wrote to memory of 2476	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	36
PID 1772 wrote to memory of 2520	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	37
PID 1772 wrote to memory of 2520	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	37
PID 1772 wrote to memory of 2520	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	37
PID 1772 wrote to memory of 2860	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	38
PID 1772 wrote to memory of 2860	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	38
PID 1772 wrote to memory of 2860	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	38
PID 1772 wrote to memory of 2404	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	39
PID 1772 wrote to memory of 2404	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	39
PID 1772 wrote to memory of 2404	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	39
PID 1772 wrote to memory of 1640	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	40
PID 1772 wrote to memory of 1640	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	40
PID 1772 wrote to memory of 1640	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	40
PID 1772 wrote to memory of 2504	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	41
PID 1772 wrote to memory of 2504	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	41
PID 1772 wrote to memory of 2504	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	41
PID 1772 wrote to memory of 2628	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	42
PID 1772 wrote to memory of 2628	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	42
PID 1772 wrote to memory of 2628	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	42
PID 1772 wrote to memory of 2836	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	43
PID 1772 wrote to memory of 2836	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	43
PID 1772 wrote to memory of 2836	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	43
PID 1772 wrote to memory of 1704	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	44
PID 1772 wrote to memory of 1704	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	44
PID 1772 wrote to memory of 1704	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	44
PID 1772 wrote to memory of 1956	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	45
PID 1772 wrote to memory of 1956	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	45
PID 1772 wrote to memory of 1956	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	45
PID 1772 wrote to memory of 1300	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	46
PID 1772 wrote to memory of 1300	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	46
PID 1772 wrote to memory of 1300	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	46
PID 1772 wrote to memory of 1652	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	47
PID 1772 wrote to memory of 1652	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	47
PID 1772 wrote to memory of 1652	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	47
PID 1772 wrote to memory of 1932	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	48
PID 1772 wrote to memory of 1932	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	48
PID 1772 wrote to memory of 1932	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	48
PID 1772 wrote to memory of 1816	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	49
PID 1772 wrote to memory of 1816	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	49
PID 1772 wrote to memory of 1816	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	49
PID 1772 wrote to memory of 1684	1772	24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\24d0a5b1c66a8716b897ab1db55304e0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2236
- C:\Windows\System\UXLVbJp.exe
  C:\Windows\System\UXLVbJp.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\mzltvjP.exe
  C:\Windows\System\mzltvjP.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\tbpUJkI.exe
  C:\Windows\System\tbpUJkI.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\iMFBzaH.exe
  C:\Windows\System\iMFBzaH.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\lEWAEzk.exe
  C:\Windows\System\lEWAEzk.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\Gpipfuw.exe
  C:\Windows\System\Gpipfuw.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\wACQipI.exe
  C:\Windows\System\wACQipI.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\ccfuHej.exe
  C:\Windows\System\ccfuHej.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\cVpNyDH.exe
  C:\Windows\System\cVpNyDH.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\LJNpopg.exe
  C:\Windows\System\LJNpopg.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\ELjoWTu.exe
  C:\Windows\System\ELjoWTu.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\sXqNHjC.exe
  C:\Windows\System\sXqNHjC.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\sBxLozf.exe
  C:\Windows\System\sBxLozf.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\QcmFgBz.exe
  C:\Windows\System\QcmFgBz.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\NnOFnJJ.exe
  C:\Windows\System\NnOFnJJ.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\gUqbUKi.exe
  C:\Windows\System\gUqbUKi.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\vCXjnAj.exe
  C:\Windows\System\vCXjnAj.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\VjuFumc.exe
  C:\Windows\System\VjuFumc.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\RkyFCcn.exe
  C:\Windows\System\RkyFCcn.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\yoiCWcC.exe
  C:\Windows\System\yoiCWcC.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\OFuINzi.exe
  C:\Windows\System\OFuINzi.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\uovsryJ.exe
  C:\Windows\System\uovsryJ.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\wQAXJPA.exe
  C:\Windows\System\wQAXJPA.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\vkUOwwS.exe
  C:\Windows\System\vkUOwwS.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\SUmQjev.exe
  C:\Windows\System\SUmQjev.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\LRouNtt.exe
  C:\Windows\System\LRouNtt.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\kCJjxiv.exe
  C:\Windows\System\kCJjxiv.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\ThaiaYv.exe
  C:\Windows\System\ThaiaYv.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\CMvfArM.exe
  C:\Windows\System\CMvfArM.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\AImATQq.exe
  C:\Windows\System\AImATQq.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\UkThtAb.exe
  C:\Windows\System\UkThtAb.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\fAhsDRv.exe
  C:\Windows\System\fAhsDRv.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\iHFHOSI.exe
  C:\Windows\System\iHFHOSI.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\zLFdrYn.exe
  C:\Windows\System\zLFdrYn.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\gKokHuy.exe
  C:\Windows\System\gKokHuy.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\CykfQwX.exe
  C:\Windows\System\CykfQwX.exe
  2⤵
  PID:1916
- C:\Windows\System\VvXbReh.exe
  C:\Windows\System\VvXbReh.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\IFkUyNo.exe
  C:\Windows\System\IFkUyNo.exe
  2⤵
  PID:1992
- C:\Windows\System\gWVedtt.exe
  C:\Windows\System\gWVedtt.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\cvxAMLg.exe
  C:\Windows\System\cvxAMLg.exe
  2⤵
  PID:1868
- C:\Windows\System\jXuNMdb.exe
  C:\Windows\System\jXuNMdb.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\uCTzPxC.exe
  C:\Windows\System\uCTzPxC.exe
  2⤵
  PID:1032
- C:\Windows\System\bYmmXRi.exe
  C:\Windows\System\bYmmXRi.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\VwblrHL.exe
  C:\Windows\System\VwblrHL.exe
  2⤵
  PID:856
- C:\Windows\System\uDNATOH.exe
  C:\Windows\System\uDNATOH.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\PYCAFRV.exe
  C:\Windows\System\PYCAFRV.exe
  2⤵
  PID:2232
- C:\Windows\System\clabOzS.exe
  C:\Windows\System\clabOzS.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\FzdItPd.exe
  C:\Windows\System\FzdItPd.exe
  2⤵
  PID:2832
- C:\Windows\System\HtxeryH.exe
  C:\Windows\System\HtxeryH.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\jkYjTHj.exe
  C:\Windows\System\jkYjTHj.exe
  2⤵
  PID:2320
- C:\Windows\System\mQrfuml.exe
  C:\Windows\System\mQrfuml.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\UCyyVbO.exe
  C:\Windows\System\UCyyVbO.exe
  2⤵
  PID:2996
- C:\Windows\System\rqxleSa.exe
  C:\Windows\System\rqxleSa.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\VzRFvto.exe
  C:\Windows\System\VzRFvto.exe
  2⤵
  PID:1516
- C:\Windows\System\OGAJuKM.exe
  C:\Windows\System\OGAJuKM.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\hsDJqbK.exe
  C:\Windows\System\hsDJqbK.exe
  2⤵
  PID:2884
- C:\Windows\System\tkaBFFM.exe
  C:\Windows\System\tkaBFFM.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\iOSSCzJ.exe
  C:\Windows\System\iOSSCzJ.exe
  2⤵
  PID:1612
- C:\Windows\System\rRNypHN.exe
  C:\Windows\System\rRNypHN.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\YmygKZx.exe
  C:\Windows\System\YmygKZx.exe
  2⤵
  PID:2668
- C:\Windows\System\NiqdHpA.exe
  C:\Windows\System\NiqdHpA.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\sNYmxkz.exe
  C:\Windows\System\sNYmxkz.exe
  2⤵
  PID:2620
- C:\Windows\System\ZwxMZrm.exe
  C:\Windows\System\ZwxMZrm.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\NUyMoDN.exe
  C:\Windows\System\NUyMoDN.exe
  2⤵
  PID:3016
- C:\Windows\System\htpfdmH.exe
  C:\Windows\System\htpfdmH.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\HNTNdEK.exe
  C:\Windows\System\HNTNdEK.exe
  2⤵
  PID:2516
- C:\Windows\System\vEwLkns.exe
  C:\Windows\System\vEwLkns.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\CmRkoQV.exe
  C:\Windows\System\CmRkoQV.exe
  2⤵
  PID:2840
- C:\Windows\System\XLVrDPA.exe
  C:\Windows\System\XLVrDPA.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\HQlLQZa.exe
  C:\Windows\System\HQlLQZa.exe
  2⤵
  PID:2596
- C:\Windows\System\LEuWKZG.exe
  C:\Windows\System\LEuWKZG.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\uuqsucr.exe
  C:\Windows\System\uuqsucr.exe
  2⤵
  PID:2588
- C:\Windows\System\gPiEunG.exe
  C:\Windows\System\gPiEunG.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\qlvuIkV.exe
  C:\Windows\System\qlvuIkV.exe
  2⤵
  PID:2088
- C:\Windows\System\PjeWhUA.exe
  C:\Windows\System\PjeWhUA.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\dDevesw.exe
  C:\Windows\System\dDevesw.exe
  2⤵
  PID:2804
- C:\Windows\System\Lrvoroo.exe
  C:\Windows\System\Lrvoroo.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\vyHPqdK.exe
  C:\Windows\System\vyHPqdK.exe
  2⤵
  PID:1152
- C:\Windows\System\FukSLaD.exe
  C:\Windows\System\FukSLaD.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\WgbdNsN.exe
  C:\Windows\System\WgbdNsN.exe
  2⤵
  PID:1408
- C:\Windows\System\KbIBdgE.exe
  C:\Windows\System\KbIBdgE.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\GlGePLk.exe
  C:\Windows\System\GlGePLk.exe
  2⤵
  PID:2820
- C:\Windows\System\NVxXZxN.exe
  C:\Windows\System\NVxXZxN.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\eDkrlDh.exe
  C:\Windows\System\eDkrlDh.exe
  2⤵
  PID:2808
- C:\Windows\System\UjeqStv.exe
  C:\Windows\System\UjeqStv.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\wCNKwsu.exe
  C:\Windows\System\wCNKwsu.exe
  2⤵
  PID:3104
- C:\Windows\System\GUlivkm.exe
  C:\Windows\System\GUlivkm.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\yxdoZhb.exe
  C:\Windows\System\yxdoZhb.exe
  2⤵
  PID:3164
- C:\Windows\System\FaIAgNu.exe
  C:\Windows\System\FaIAgNu.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\fBaNZAA.exe
  C:\Windows\System\fBaNZAA.exe
  2⤵
  PID:3212
- C:\Windows\System\NnrqwXb.exe
  C:\Windows\System\NnrqwXb.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\gZDZaKZ.exe
  C:\Windows\System\gZDZaKZ.exe
  2⤵
  PID:3264
- C:\Windows\System\ZRkMaPS.exe
  C:\Windows\System\ZRkMaPS.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\dWxfyEQ.exe
  C:\Windows\System\dWxfyEQ.exe
  2⤵
  PID:3312
- C:\Windows\System\mpNGNob.exe
  C:\Windows\System\mpNGNob.exe
  2⤵
  PID:3344
- C:\Windows\System\htbWSxH.exe
  C:\Windows\System\htbWSxH.exe
  2⤵
  PID:3372
- C:\Windows\System\RhwbfcV.exe
  C:\Windows\System\RhwbfcV.exe
  2⤵
  PID:3400
- C:\Windows\System\nlqQFnZ.exe
  C:\Windows\System\nlqQFnZ.exe
  2⤵
  PID:3428
- C:\Windows\System\JDFiJGi.exe
  C:\Windows\System\JDFiJGi.exe
  2⤵
  PID:3456
- C:\Windows\System\XUqAQGk.exe
  C:\Windows\System\XUqAQGk.exe
  2⤵
  PID:3484
- C:\Windows\System\UhjKauj.exe
  C:\Windows\System\UhjKauj.exe
  2⤵
  PID:3512
- C:\Windows\System\bsIIyMm.exe
  C:\Windows\System\bsIIyMm.exe
  2⤵
  PID:3540
- C:\Windows\System\bAZouDp.exe
  C:\Windows\System\bAZouDp.exe
  2⤵
  PID:3560
- C:\Windows\System\yhKtrdA.exe
  C:\Windows\System\yhKtrdA.exe
  2⤵
  PID:3608
- C:\Windows\System\LGHrcDf.exe
  C:\Windows\System\LGHrcDf.exe
  2⤵
  PID:3640
- C:\Windows\System\egzVQqs.exe
  C:\Windows\System\egzVQqs.exe
  2⤵
  PID:3664
- C:\Windows\System\jLCUwtZ.exe
  C:\Windows\System\jLCUwtZ.exe
  2⤵
  PID:3680
- C:\Windows\System\KWnHTza.exe
  C:\Windows\System\KWnHTza.exe
  2⤵
  PID:3696
- C:\Windows\System\HRyLhQF.exe
  C:\Windows\System\HRyLhQF.exe
  2⤵
  PID:3712
- C:\Windows\System\FbQejsx.exe
  C:\Windows\System\FbQejsx.exe
  2⤵
  PID:3728
- C:\Windows\System\Viuaphn.exe
  C:\Windows\System\Viuaphn.exe
  2⤵
  PID:3744
- C:\Windows\System\zcwCMcP.exe
  C:\Windows\System\zcwCMcP.exe
  2⤵
  PID:3760
- C:\Windows\System\gBhqcOL.exe
  C:\Windows\System\gBhqcOL.exe
  2⤵
  PID:3776
- C:\Windows\System\rNYbUNv.exe
  C:\Windows\System\rNYbUNv.exe
  2⤵
  PID:3792
- C:\Windows\System\BTZwoUY.exe
  C:\Windows\System\BTZwoUY.exe
  2⤵
  PID:3808
- C:\Windows\System\CQLxjCP.exe
  C:\Windows\System\CQLxjCP.exe
  2⤵
  PID:3824
- C:\Windows\System\ByGwFMN.exe
  C:\Windows\System\ByGwFMN.exe
  2⤵
  PID:3840
- C:\Windows\System\GwaBbQI.exe
  C:\Windows\System\GwaBbQI.exe
  2⤵
  PID:3856
- C:\Windows\System\gMdwEZb.exe
  C:\Windows\System\gMdwEZb.exe
  2⤵
  PID:3872
- C:\Windows\System\vZUKDxv.exe
  C:\Windows\System\vZUKDxv.exe
  2⤵
  PID:3888
- C:\Windows\System\wYwVmeU.exe
  C:\Windows\System\wYwVmeU.exe
  2⤵
  PID:3904
- C:\Windows\System\LlyibKG.exe
  C:\Windows\System\LlyibKG.exe
  2⤵
  PID:3920
- C:\Windows\System\QUNWtkS.exe
  C:\Windows\System\QUNWtkS.exe
  2⤵
  PID:3936
- C:\Windows\System\ZCHuvVQ.exe
  C:\Windows\System\ZCHuvVQ.exe
  2⤵
  PID:3952
- C:\Windows\System\XUxRUnj.exe
  C:\Windows\System\XUxRUnj.exe
  2⤵
  PID:3968
- C:\Windows\System\VUzlVaa.exe
  C:\Windows\System\VUzlVaa.exe
  2⤵
  PID:3984
- C:\Windows\System\MssTFfx.exe
  C:\Windows\System\MssTFfx.exe
  2⤵
  PID:4000
- C:\Windows\System\rMNCZOb.exe
  C:\Windows\System\rMNCZOb.exe
  2⤵
  PID:4016
- C:\Windows\System\OquBITf.exe
  C:\Windows\System\OquBITf.exe
  2⤵
  PID:4032
- C:\Windows\System\CbbXfcp.exe
  C:\Windows\System\CbbXfcp.exe
  2⤵
  PID:4048
- C:\Windows\System\SVoQJAH.exe
  C:\Windows\System\SVoQJAH.exe
  2⤵
  PID:4064
- C:\Windows\System\lXaPauN.exe
  C:\Windows\System\lXaPauN.exe
  2⤵
  PID:4080
- C:\Windows\System\GHKAiud.exe
  C:\Windows\System\GHKAiud.exe
  2⤵
  PID:676
- C:\Windows\System\PpzVehY.exe
  C:\Windows\System\PpzVehY.exe
  2⤵
  PID:2968
- C:\Windows\System\KnyBAnT.exe
  C:\Windows\System\KnyBAnT.exe
  2⤵
  PID:1268
- C:\Windows\System\mYangsm.exe
  C:\Windows\System\mYangsm.exe
  2⤵
  PID:2624
- C:\Windows\System\LYgvzen.exe
  C:\Windows\System\LYgvzen.exe
  2⤵
  PID:3156
- C:\Windows\System\qCwRnou.exe
  C:\Windows\System\qCwRnou.exe
  2⤵
  PID:632
- C:\Windows\System\EwnBTgF.exe
  C:\Windows\System\EwnBTgF.exe
  2⤵
  PID:3188
- C:\Windows\System\TxqIyjV.exe
  C:\Windows\System\TxqIyjV.exe
  2⤵
  PID:3208
- C:\Windows\System\bKjeFPK.exe
  C:\Windows\System\bKjeFPK.exe
  2⤵
  PID:1456
- C:\Windows\System\cTgpVmT.exe
  C:\Windows\System\cTgpVmT.exe
  2⤵
  PID:1272
- C:\Windows\System\wDmrNbf.exe
  C:\Windows\System\wDmrNbf.exe
  2⤵
  PID:828
- C:\Windows\System\VsXUusB.exe
  C:\Windows\System\VsXUusB.exe
  2⤵
  PID:3304
- C:\Windows\System\kLGnkhu.exe
  C:\Windows\System\kLGnkhu.exe
  2⤵
  PID:3296
- C:\Windows\System\haMEYXI.exe
  C:\Windows\System\haMEYXI.exe
  2⤵
  PID:3352
- C:\Windows\System\aUiyfUo.exe
  C:\Windows\System\aUiyfUo.exe
  2⤵
  PID:3356
- C:\Windows\System\AhrMuKu.exe
  C:\Windows\System\AhrMuKu.exe
  2⤵
  PID:1736
- C:\Windows\System\aJQaDPo.exe
  C:\Windows\System\aJQaDPo.exe
  2⤵
  PID:3464
- C:\Windows\System\KOMcDPG.exe
  C:\Windows\System\KOMcDPG.exe
  2⤵
  PID:328
- C:\Windows\System\TuOaWpn.exe
  C:\Windows\System\TuOaWpn.exe
  2⤵
  PID:2412
- C:\Windows\System\yzAvKov.exe
  C:\Windows\System\yzAvKov.exe
  2⤵
  PID:768
- C:\Windows\System\iyWXbhq.exe
  C:\Windows\System\iyWXbhq.exe
  2⤵
  PID:3080
- C:\Windows\System\ZiOZzRL.exe
  C:\Windows\System\ZiOZzRL.exe
  2⤵
  PID:3584
- C:\Windows\System\HkIbige.exe
  C:\Windows\System\HkIbige.exe
  2⤵
  PID:3572
- C:\Windows\System\jjIrHgJ.exe
  C:\Windows\System\jjIrHgJ.exe
  2⤵
  PID:852
- C:\Windows\System\GbKvHXx.exe
  C:\Windows\System\GbKvHXx.exe
  2⤵
  PID:3236
- C:\Windows\System\paHRSJd.exe
  C:\Windows\System\paHRSJd.exe
  2⤵
  PID:1044
- C:\Windows\System\jdvrLtZ.exe
  C:\Windows\System\jdvrLtZ.exe
  2⤵
  PID:3276
- C:\Windows\System\PMUZFoG.exe
  C:\Windows\System\PMUZFoG.exe
  2⤵
  PID:1784
- C:\Windows\System\zBkCoxk.exe
  C:\Windows\System\zBkCoxk.exe
  2⤵
  PID:3660
- C:\Windows\System\kUZVLBI.exe
  C:\Windows\System\kUZVLBI.exe
  2⤵
  PID:3176
- C:\Windows\System\OZNCrhp.exe
  C:\Windows\System\OZNCrhp.exe
  2⤵
  PID:2524
- C:\Windows\System\vYhFkhA.exe
  C:\Windows\System\vYhFkhA.exe
  2⤵
  PID:956
- C:\Windows\System\IrJgOUO.exe
  C:\Windows\System\IrJgOUO.exe
  2⤵
  PID:1028
- C:\Windows\System\ExpUSsO.exe
  C:\Windows\System\ExpUSsO.exe
  2⤵
  PID:2024
- C:\Windows\System\toJKEDf.exe
  C:\Windows\System\toJKEDf.exe
  2⤵
  PID:2872
- C:\Windows\System\AMuLAmj.exe
  C:\Windows\System\AMuLAmj.exe
  2⤵
  PID:668
- C:\Windows\System\yVUeCNS.exe
  C:\Windows\System\yVUeCNS.exe
  2⤵
  PID:2640
- C:\Windows\System\jvExZSU.exe
  C:\Windows\System\jvExZSU.exe
  2⤵
  PID:2556
- C:\Windows\System\obwBgQI.exe
  C:\Windows\System\obwBgQI.exe
  2⤵
  PID:1280
- C:\Windows\System\DNjwrEs.exe
  C:\Windows\System\DNjwrEs.exe
  2⤵
  PID:2852
- C:\Windows\System\qclMHtT.exe
  C:\Windows\System\qclMHtT.exe
  2⤵
  PID:1588
- C:\Windows\System\eOhLrDP.exe
  C:\Windows\System\eOhLrDP.exe
  2⤵
  PID:2484
- C:\Windows\System\eaSxyPS.exe
  C:\Windows\System\eaSxyPS.exe
  2⤵
  PID:1296
- C:\Windows\System\bLAnOvg.exe
  C:\Windows\System\bLAnOvg.exe
  2⤵
  PID:2540
- C:\Windows\System\LUENGHl.exe
  C:\Windows\System\LUENGHl.exe
  2⤵
  PID:1260
- C:\Windows\System\kHdQsiX.exe
  C:\Windows\System\kHdQsiX.exe
  2⤵
  PID:816
- C:\Windows\System\ZVKmSFz.exe
  C:\Windows\System\ZVKmSFz.exe
  2⤵
  PID:2948
- C:\Windows\System\WpQoCeL.exe
  C:\Windows\System\WpQoCeL.exe
  2⤵
  PID:1580
- C:\Windows\System\EvldjlQ.exe
  C:\Windows\System\EvldjlQ.exe
  2⤵
  PID:1484
- C:\Windows\System\ZsCQoDb.exe
  C:\Windows\System\ZsCQoDb.exe
  2⤵
  PID:3124
- C:\Windows\System\FfyLkkJ.exe
  C:\Windows\System\FfyLkkJ.exe
  2⤵
  PID:3320
- C:\Windows\System\lrmonOc.exe
  C:\Windows\System\lrmonOc.exe
  2⤵
  PID:3336
- C:\Windows\System\VuKoBpB.exe
  C:\Windows\System\VuKoBpB.exe
  2⤵
  PID:3928
- C:\Windows\System\tsXPkqz.exe
  C:\Windows\System\tsXPkqz.exe
  2⤵
  PID:3948
- C:\Windows\System\GQSABDP.exe
  C:\Windows\System\GQSABDP.exe
  2⤵
  PID:3980
- C:\Windows\System\MOgUUqV.exe
  C:\Windows\System\MOgUUqV.exe
  2⤵
  PID:4012
- C:\Windows\System\CWPKBzJ.exe
  C:\Windows\System\CWPKBzJ.exe
  2⤵
  PID:4076
- C:\Windows\System\VVNvZOM.exe
  C:\Windows\System\VVNvZOM.exe
  2⤵
  PID:4028
- C:\Windows\System\rLUqxsv.exe
  C:\Windows\System\rLUqxsv.exe
  2⤵
  PID:4092
- C:\Windows\System\aFzSlol.exe
  C:\Windows\System\aFzSlol.exe
  2⤵
  PID:3160
- C:\Windows\System\pKQugNm.exe
  C:\Windows\System\pKQugNm.exe
  2⤵
  PID:580
- C:\Windows\System\BrVDInM.exe
  C:\Windows\System\BrVDInM.exe
  2⤵
  PID:1968
- C:\Windows\System\uDTbiQP.exe
  C:\Windows\System\uDTbiQP.exe
  2⤵
  PID:2408
- C:\Windows\System\TCPeyZY.exe
  C:\Windows\System\TCPeyZY.exe
  2⤵
  PID:3416
- C:\Windows\System\bUgiPPG.exe
  C:\Windows\System\bUgiPPG.exe
  2⤵
  PID:3528
- C:\Windows\System\qtCuVhz.exe
  C:\Windows\System\qtCuVhz.exe
  2⤵
  PID:3580
- C:\Windows\System\kxyGrVe.exe
  C:\Windows\System\kxyGrVe.exe
  2⤵
  PID:2060
- C:\Windows\System\LHNExWW.exe
  C:\Windows\System\LHNExWW.exe
  2⤵
  PID:480
- C:\Windows\System\eUJVZTy.exe
  C:\Windows\System\eUJVZTy.exe
  2⤵
  PID:3140
- C:\Windows\System\MYbhhcL.exe
  C:\Windows\System\MYbhhcL.exe
  2⤵
  PID:3524
- C:\Windows\System\GCiaRiH.exe
  C:\Windows\System\GCiaRiH.exe
  2⤵
  PID:3412
- C:\Windows\System\HiuluWA.exe
  C:\Windows\System\HiuluWA.exe
  2⤵
  PID:1548
- C:\Windows\System\YVBZvSA.exe
  C:\Windows\System\YVBZvSA.exe
  2⤵
  PID:3228
- C:\Windows\System\VfuuBzm.exe
  C:\Windows\System\VfuuBzm.exe
  2⤵
  PID:2152
- C:\Windows\System\Dawwwyt.exe
  C:\Windows\System\Dawwwyt.exe
  2⤵
  PID:2132
- C:\Windows\System\phgSaqV.exe
  C:\Windows\System\phgSaqV.exe
  2⤵
  PID:1076
- C:\Windows\System\yZwsYmv.exe
  C:\Windows\System\yZwsYmv.exe
  2⤵
  PID:2612
- C:\Windows\System\UdFkoyc.exe
  C:\Windows\System\UdFkoyc.exe
  2⤵
  PID:1760
- C:\Windows\System\VDRnliP.exe
  C:\Windows\System\VDRnliP.exe
  2⤵
  PID:1584
- C:\Windows\System\StaJAil.exe
  C:\Windows\System\StaJAil.exe
  2⤵
  PID:1668
- C:\Windows\System\KsVIyXt.exe
  C:\Windows\System\KsVIyXt.exe
  2⤵
  PID:3036
- C:\Windows\System\zlSVyeQ.exe
  C:\Windows\System\zlSVyeQ.exe
  2⤵
  PID:2348
- C:\Windows\System\MzjMWDV.exe
  C:\Windows\System\MzjMWDV.exe
  2⤵
  PID:2448
- C:\Windows\System\nZmBqaw.exe
  C:\Windows\System\nZmBqaw.exe
  2⤵
  PID:3120
- C:\Windows\System\ciZjKCF.exe
  C:\Windows\System\ciZjKCF.exe
  2⤵
  PID:2928
- C:\Windows\System\HQpDtFG.exe
  C:\Windows\System\HQpDtFG.exe
  2⤵
  PID:2512
- C:\Windows\System\KmbRHDK.exe
  C:\Windows\System\KmbRHDK.exe
  2⤵
  PID:2376
- C:\Windows\System\WYVdNrY.exe
  C:\Windows\System\WYVdNrY.exe
  2⤵
  PID:3380
- C:\Windows\System\LSDfvhU.exe
  C:\Windows\System\LSDfvhU.exe
  2⤵
  PID:3396
- C:\Windows\System\FppvLbP.exe
  C:\Windows\System\FppvLbP.exe
  2⤵
  PID:3448
- C:\Windows\System\XHdvOWm.exe
  C:\Windows\System\XHdvOWm.exe
  2⤵
  PID:3500
- C:\Windows\System\vXvyaxK.exe
  C:\Windows\System\vXvyaxK.exe
  2⤵
  PID:3552
- C:\Windows\System\EIfdHgx.exe
  C:\Windows\System\EIfdHgx.exe
  2⤵
  PID:3632
- C:\Windows\System\uTikHZX.exe
  C:\Windows\System\uTikHZX.exe
  2⤵
  PID:3672
- C:\Windows\System\NjLLvLV.exe
  C:\Windows\System\NjLLvLV.exe
  2⤵
  PID:3688
- C:\Windows\System\DfQePkx.exe
  C:\Windows\System\DfQePkx.exe
  2⤵
  PID:3720
- C:\Windows\System\xaobaYh.exe
  C:\Windows\System\xaobaYh.exe
  2⤵
  PID:3724
- C:\Windows\System\ZQKfQMJ.exe
  C:\Windows\System\ZQKfQMJ.exe
  2⤵
  PID:3784
- C:\Windows\System\aumsIPn.exe
  C:\Windows\System\aumsIPn.exe
  2⤵
  PID:3816
- C:\Windows\System\LLwmRWT.exe
  C:\Windows\System\LLwmRWT.exe
  2⤵
  PID:3836
- C:\Windows\System\HWeAUYq.exe
  C:\Windows\System\HWeAUYq.exe
  2⤵
  PID:3868
- C:\Windows\System\lXBmYBn.exe
  C:\Windows\System\lXBmYBn.exe
  2⤵
  PID:3900
- C:\Windows\System\CbEiryE.exe
  C:\Windows\System\CbEiryE.exe
  2⤵
  PID:3976
- C:\Windows\System\eYUpEFU.exe
  C:\Windows\System\eYUpEFU.exe
  2⤵
  PID:1872
- C:\Windows\System\FcvGoJo.exe
  C:\Windows\System\FcvGoJo.exe
  2⤵
  PID:2148
- C:\Windows\System\eufgDmX.exe
  C:\Windows\System\eufgDmX.exe
  2⤵
  PID:4060
- C:\Windows\System\OVKUbJL.exe
  C:\Windows\System\OVKUbJL.exe
  2⤵
  PID:3292
- C:\Windows\System\cGutQli.exe
  C:\Windows\System\cGutQli.exe
  2⤵
  PID:3576
- C:\Windows\System\uOskllx.exe
  C:\Windows\System\uOskllx.exe
  2⤵
  PID:3468
- C:\Windows\System\SGxrryH.exe
  C:\Windows\System\SGxrryH.exe
  2⤵
  PID:1244
- C:\Windows\System\SNQaDcR.exe
  C:\Windows\System\SNQaDcR.exe
  2⤵
  PID:3600
- C:\Windows\System\FplGezR.exe
  C:\Windows\System\FplGezR.exe
  2⤵
  PID:360
- C:\Windows\System\tonzosn.exe
  C:\Windows\System\tonzosn.exe
  2⤵
  PID:2480
- C:\Windows\System\fmrkeys.exe
  C:\Windows\System\fmrkeys.exe
  2⤵
  PID:3424
- C:\Windows\System\dawyhxY.exe
  C:\Windows\System\dawyhxY.exe
  2⤵
  PID:3656
- C:\Windows\System\ppvQqFZ.exe
  C:\Windows\System\ppvQqFZ.exe
  2⤵
  PID:1980
- C:\Windows\System\OyZjtoR.exe
  C:\Windows\System\OyZjtoR.exe
  2⤵
  PID:2904
- C:\Windows\System\oILKLqM.exe
  C:\Windows\System\oILKLqM.exe
  2⤵
  PID:2444
- C:\Windows\System\xQKbcux.exe
  C:\Windows\System\xQKbcux.exe
  2⤵
  PID:1976
- C:\Windows\System\CYGiHAl.exe
  C:\Windows\System\CYGiHAl.exe
  2⤵
  PID:3492
- C:\Windows\System\WhbVxbg.exe
  C:\Windows\System\WhbVxbg.exe
  2⤵
  PID:2604
- C:\Windows\System\UyYpPqc.exe
  C:\Windows\System\UyYpPqc.exe
  2⤵
  PID:2104
- C:\Windows\System\sEksnqu.exe
  C:\Windows\System\sEksnqu.exe
  2⤵
  PID:3388
- C:\Windows\System\CGjEcMe.exe
  C:\Windows\System\CGjEcMe.exe
  2⤵
  PID:3996
- C:\Windows\System\wcCjlky.exe
  C:\Windows\System\wcCjlky.exe
  2⤵
  PID:3756
- C:\Windows\System\qeVgYlX.exe
  C:\Windows\System\qeVgYlX.exe
  2⤵
  PID:3384
- C:\Windows\System\PxInqDL.exe
  C:\Windows\System\PxInqDL.exe
  2⤵
  PID:3880
- C:\Windows\System\ARIACJI.exe
  C:\Windows\System\ARIACJI.exe
  2⤵
  PID:1808
- C:\Windows\System\Rddmkvr.exe
  C:\Windows\System\Rddmkvr.exe
  2⤵
  PID:3848
- C:\Windows\System\wUpvydk.exe
  C:\Windows\System\wUpvydk.exe
  2⤵
  PID:4072
- C:\Windows\System\cJbcnbz.exe
  C:\Windows\System\cJbcnbz.exe
  2⤵
  PID:2068
- C:\Windows\System\xXumtLe.exe
  C:\Windows\System\xXumtLe.exe
  2⤵
  PID:3364
- C:\Windows\System\DajTAog.exe
  C:\Windows\System\DajTAog.exe
  2⤵
  PID:1332
- C:\Windows\System\yWgoWCU.exe
  C:\Windows\System\yWgoWCU.exe
  2⤵
  PID:2924
- C:\Windows\System\IMvdlTY.exe
  C:\Windows\System\IMvdlTY.exe
  2⤵
  PID:2368
- C:\Windows\System\iuHqsNt.exe
  C:\Windows\System\iuHqsNt.exe
  2⤵
  PID:3136
- C:\Windows\System\GRObfnt.exe
  C:\Windows\System\GRObfnt.exe
  2⤵
  PID:3788
- C:\Windows\System\hdPCmNn.exe
  C:\Windows\System\hdPCmNn.exe
  2⤵
  PID:4024
- C:\Windows\System\okCYHwh.exe
  C:\Windows\System\okCYHwh.exe
  2⤵
  PID:3252
- C:\Windows\System\DuXJEnE.exe
  C:\Windows\System\DuXJEnE.exe
  2⤵
  PID:1740
- C:\Windows\System\imGlmEy.exe
  C:\Windows\System\imGlmEy.exe
  2⤵
  PID:2352
- C:\Windows\System\xXkGqXo.exe
  C:\Windows\System\xXkGqXo.exe
  2⤵
  PID:332
- C:\Windows\System\hLWGiCy.exe
  C:\Windows\System\hLWGiCy.exe
  2⤵
  PID:2216
- C:\Windows\System\DIFxefO.exe
  C:\Windows\System\DIFxefO.exe
  2⤵
  PID:1664
- C:\Windows\System\vPHPNpa.exe
  C:\Windows\System\vPHPNpa.exe
  2⤵
  PID:2420
- C:\Windows\System\vHVqPGQ.exe
  C:\Windows\System\vHVqPGQ.exe
  2⤵
  PID:3444
- C:\Windows\System\TfQnMay.exe
  C:\Windows\System\TfQnMay.exe
  2⤵
  PID:4100
- C:\Windows\System\mDNslby.exe
  C:\Windows\System\mDNslby.exe
  2⤵
  PID:4116
- C:\Windows\System\ocjRiDS.exe
  C:\Windows\System\ocjRiDS.exe
  2⤵
  PID:4132
- C:\Windows\System\PaavWUK.exe
  C:\Windows\System\PaavWUK.exe
  2⤵
  PID:4148
- C:\Windows\System\qJoFHMh.exe
  C:\Windows\System\qJoFHMh.exe
  2⤵
  PID:4164
- C:\Windows\System\YviSNbE.exe
  C:\Windows\System\YviSNbE.exe
  2⤵
  PID:4180
- C:\Windows\System\dJuYuhD.exe
  C:\Windows\System\dJuYuhD.exe
  2⤵
  PID:4196
- C:\Windows\System\ffYVexI.exe
  C:\Windows\System\ffYVexI.exe
  2⤵
  PID:4212
- C:\Windows\System\ewzUzgc.exe
  C:\Windows\System\ewzUzgc.exe
  2⤵
  PID:4228
- C:\Windows\System\bWwEutS.exe
  C:\Windows\System\bWwEutS.exe
  2⤵
  PID:4244
- C:\Windows\System\NirQHPJ.exe
  C:\Windows\System\NirQHPJ.exe
  2⤵
  PID:4260
- C:\Windows\System\xklMrgC.exe
  C:\Windows\System\xklMrgC.exe
  2⤵
  PID:4276
- C:\Windows\System\hueSSXp.exe
  C:\Windows\System\hueSSXp.exe
  2⤵
  PID:4292
- C:\Windows\System\qYfSqsh.exe
  C:\Windows\System\qYfSqsh.exe
  2⤵
  PID:4308
- C:\Windows\System\vBKsMDA.exe
  C:\Windows\System\vBKsMDA.exe
  2⤵
  PID:4324
- C:\Windows\System\JOfuPll.exe
  C:\Windows\System\JOfuPll.exe
  2⤵
  PID:4340
- C:\Windows\System\DYulwQN.exe
  C:\Windows\System\DYulwQN.exe
  2⤵
  PID:4356
- C:\Windows\System\ojwAoJM.exe
  C:\Windows\System\ojwAoJM.exe
  2⤵
  PID:4372
- C:\Windows\System\sFTtgPY.exe
  C:\Windows\System\sFTtgPY.exe
  2⤵
  PID:4388
- C:\Windows\System\oIDdbXy.exe
  C:\Windows\System\oIDdbXy.exe
  2⤵
  PID:4404
- C:\Windows\System\VTbStGg.exe
  C:\Windows\System\VTbStGg.exe
  2⤵
  PID:4460
- C:\Windows\System\llMRLXu.exe
  C:\Windows\System\llMRLXu.exe
  2⤵
  PID:4480
- C:\Windows\System\iAKOUrS.exe
  C:\Windows\System\iAKOUrS.exe
  2⤵
  PID:4496
- C:\Windows\System\CBwldPi.exe
  C:\Windows\System\CBwldPi.exe
  2⤵
  PID:4516
- C:\Windows\System\ZHqaBAi.exe
  C:\Windows\System\ZHqaBAi.exe
  2⤵
  PID:4532
- C:\Windows\System\yxrRApQ.exe
  C:\Windows\System\yxrRApQ.exe
  2⤵
  PID:4548
- C:\Windows\System\gGYzRHH.exe
  C:\Windows\System\gGYzRHH.exe
  2⤵
  PID:4564
- C:\Windows\System\WFmzpxr.exe
  C:\Windows\System\WFmzpxr.exe
  2⤵
  PID:4580
- C:\Windows\System\EJYnIOw.exe
  C:\Windows\System\EJYnIOw.exe
  2⤵
  PID:4596
- C:\Windows\System\wLWpsMR.exe
  C:\Windows\System\wLWpsMR.exe
  2⤵
  PID:4616
- C:\Windows\System\OhSXgqG.exe
  C:\Windows\System\OhSXgqG.exe
  2⤵
  PID:4632
- C:\Windows\System\hbUqByj.exe
  C:\Windows\System\hbUqByj.exe
  2⤵
  PID:4648
- C:\Windows\System\kTZUzay.exe
  C:\Windows\System\kTZUzay.exe
  2⤵
  PID:4664
- C:\Windows\System\WIZyVEO.exe
  C:\Windows\System\WIZyVEO.exe
  2⤵
  PID:4680
- C:\Windows\System\FCsRCbL.exe
  C:\Windows\System\FCsRCbL.exe
  2⤵
  PID:4696
- C:\Windows\System\AphuuUi.exe
  C:\Windows\System\AphuuUi.exe
  2⤵
  PID:4712
- C:\Windows\System\uRswVvX.exe
  C:\Windows\System\uRswVvX.exe
  2⤵
  PID:4728
- C:\Windows\System\whjDvtu.exe
  C:\Windows\System\whjDvtu.exe
  2⤵
  PID:4744
- C:\Windows\System\TZJZMAb.exe
  C:\Windows\System\TZJZMAb.exe
  2⤵
  PID:4760
- C:\Windows\System\aVabuGa.exe
  C:\Windows\System\aVabuGa.exe
  2⤵
  PID:4776
- C:\Windows\System\xtBKSgg.exe
  C:\Windows\System\xtBKSgg.exe
  2⤵
  PID:4792
- C:\Windows\System\rsBfaoE.exe
  C:\Windows\System\rsBfaoE.exe
  2⤵
  PID:4808
- C:\Windows\System\uVcMggt.exe
  C:\Windows\System\uVcMggt.exe
  2⤵
  PID:4824
- C:\Windows\System\DjbXXxS.exe
  C:\Windows\System\DjbXXxS.exe
  2⤵
  PID:4840
- C:\Windows\System\KJntNxX.exe
  C:\Windows\System\KJntNxX.exe
  2⤵
  PID:4856
- C:\Windows\System\QthecFj.exe
  C:\Windows\System\QthecFj.exe
  2⤵
  PID:4872
- C:\Windows\System\YzcQIRt.exe
  C:\Windows\System\YzcQIRt.exe
  2⤵
  PID:4888
- C:\Windows\System\iqccrnP.exe
  C:\Windows\System\iqccrnP.exe
  2⤵
  PID:4904
- C:\Windows\System\cvTZAqL.exe
  C:\Windows\System\cvTZAqL.exe
  2⤵
  PID:4920
- C:\Windows\System\wHFisTD.exe
  C:\Windows\System\wHFisTD.exe
  2⤵
  PID:4936
- C:\Windows\System\XvIUYZP.exe
  C:\Windows\System\XvIUYZP.exe
  2⤵
  PID:4952
- C:\Windows\System\yxwfiPl.exe
  C:\Windows\System\yxwfiPl.exe
  2⤵
  PID:4968
- C:\Windows\System\sPfZRDq.exe
  C:\Windows\System\sPfZRDq.exe
  2⤵
  PID:4984
- C:\Windows\System\UEnuQdU.exe
  C:\Windows\System\UEnuQdU.exe
  2⤵
  PID:5000
- C:\Windows\System\tKIWTCr.exe
  C:\Windows\System\tKIWTCr.exe
  2⤵
  PID:5016
- C:\Windows\System\IFZPgcX.exe
  C:\Windows\System\IFZPgcX.exe
  2⤵
  PID:5032
- C:\Windows\System\BBMkpAD.exe
  C:\Windows\System\BBMkpAD.exe
  2⤵
  PID:5048
- C:\Windows\System\VwdpeDM.exe
  C:\Windows\System\VwdpeDM.exe
  2⤵
  PID:5064
- C:\Windows\System\uhPGRyr.exe
  C:\Windows\System\uhPGRyr.exe
  2⤵
  PID:5080
- C:\Windows\System\jzYpwvo.exe
  C:\Windows\System\jzYpwvo.exe
  2⤵
  PID:5096
- C:\Windows\System\VXqqZKd.exe
  C:\Windows\System\VXqqZKd.exe
  2⤵
  PID:5112
- C:\Windows\System\LhYxuJZ.exe
  C:\Windows\System\LhYxuJZ.exe
  2⤵
  PID:1908
- C:\Windows\System\CbcYTab.exe
  C:\Windows\System\CbcYTab.exe
  2⤵
  PID:4156
- C:\Windows\System\mfcHULZ.exe
  C:\Windows\System\mfcHULZ.exe
  2⤵
  PID:4220
- C:\Windows\System\qVqtGdc.exe
  C:\Windows\System\qVqtGdc.exe
  2⤵
  PID:4284
- C:\Windows\System\lvPgLfL.exe
  C:\Windows\System\lvPgLfL.exe
  2⤵
  PID:320
- C:\Windows\System\bUSwYRx.exe
  C:\Windows\System\bUSwYRx.exe
  2⤵
  PID:4320
- C:\Windows\System\kJsQSFh.exe
  C:\Windows\System\kJsQSFh.exe
  2⤵
  PID:4192
- C:\Windows\System\nsSbPwx.exe
  C:\Windows\System\nsSbPwx.exe
  2⤵
  PID:4208
- C:\Windows\System\ZRwHZjD.exe
  C:\Windows\System\ZRwHZjD.exe
  2⤵
  PID:3820
- C:\Windows\System\BRrYxwS.exe
  C:\Windows\System\BRrYxwS.exe
  2⤵
  PID:3172
- C:\Windows\System\ZjDClUr.exe
  C:\Windows\System\ZjDClUr.exe
  2⤵
  PID:3620
- C:\Windows\System\NfJToXR.exe
  C:\Windows\System\NfJToXR.exe
  2⤵
  PID:2888
- C:\Windows\System\tKrUKsO.exe
  C:\Windows\System\tKrUKsO.exe
  2⤵
  PID:3864
- C:\Windows\System\gevnUCW.exe
  C:\Windows\System\gevnUCW.exe
  2⤵
  PID:4108
- C:\Windows\System\JQHtttV.exe
  C:\Windows\System\JQHtttV.exe
  2⤵
  PID:4172
- C:\Windows\System\auYjxid.exe
  C:\Windows\System\auYjxid.exe
  2⤵
  PID:4332
- C:\Windows\System\vwbCKMK.exe
  C:\Windows\System\vwbCKMK.exe
  2⤵
  PID:4396
- C:\Windows\System\HSyqihg.exe
  C:\Windows\System\HSyqihg.exe
  2⤵
  PID:4488
- C:\Windows\System\EnMRDrf.exe
  C:\Windows\System\EnMRDrf.exe
  2⤵
  PID:4508
- C:\Windows\System\qgbiSVJ.exe
  C:\Windows\System\qgbiSVJ.exe
  2⤵
  PID:4540
- C:\Windows\System\CTamXeg.exe
  C:\Windows\System\CTamXeg.exe
  2⤵
  PID:4588
- C:\Windows\System\AcVLVbV.exe
  C:\Windows\System\AcVLVbV.exe
  2⤵
  PID:4628
- C:\Windows\System\sNjONDx.exe
  C:\Windows\System\sNjONDx.exe
  2⤵
  PID:4656
- C:\Windows\System\lhTHyhg.exe
  C:\Windows\System\lhTHyhg.exe
  2⤵
  PID:4644
- C:\Windows\System\voABfdm.exe
  C:\Windows\System\voABfdm.exe
  2⤵
  PID:4692
- C:\Windows\System\EdAcYIo.exe
  C:\Windows\System\EdAcYIo.exe
  2⤵
  PID:4752
- C:\Windows\System\cfGBEYS.exe
  C:\Windows\System\cfGBEYS.exe
  2⤵
  PID:4820
- C:\Windows\System\DTHjRck.exe
  C:\Windows\System\DTHjRck.exe
  2⤵
  PID:4880
- C:\Windows\System\ZymKbNa.exe
  C:\Windows\System\ZymKbNa.exe
  2⤵
  PID:4916
- C:\Windows\System\CBIiiKf.exe
  C:\Windows\System\CBIiiKf.exe
  2⤵
  PID:4976
- C:\Windows\System\eFWxfKr.exe
  C:\Windows\System\eFWxfKr.exe
  2⤵
  PID:4960
- C:\Windows\System\cFrGjiY.exe
  C:\Windows\System\cFrGjiY.exe
  2⤵
  PID:4800
- C:\Windows\System\dIEKuyU.exe
  C:\Windows\System\dIEKuyU.exe
  2⤵
  PID:4252
- C:\Windows\System\BQsFMOR.exe
  C:\Windows\System\BQsFMOR.exe
  2⤵
  PID:4412
- C:\Windows\System\OvZFRfE.exe
  C:\Windows\System\OvZFRfE.exe
  2⤵
  PID:3132
- C:\Windows\System\qeHqmHu.exe
  C:\Windows\System\qeHqmHu.exe
  2⤵
  PID:3676
- C:\Windows\System\IfGBGcj.exe
  C:\Windows\System\IfGBGcj.exe
  2⤵
  PID:4992
- C:\Windows\System\EAGMIvb.exe
  C:\Windows\System\EAGMIvb.exe
  2⤵
  PID:2580
- C:\Windows\System\SecsXRn.exe
  C:\Windows\System\SecsXRn.exe
  2⤵
  PID:5024
- C:\Windows\System\EOsXmeF.exe
  C:\Windows\System\EOsXmeF.exe
  2⤵
  PID:5088
- C:\Windows\System\tgJEcsO.exe
  C:\Windows\System\tgJEcsO.exe
  2⤵
  PID:3368
- C:\Windows\System\pVZIiNO.exe
  C:\Windows\System\pVZIiNO.exe
  2⤵
  PID:780
- C:\Windows\System\cSRMGfu.exe
  C:\Windows\System\cSRMGfu.exe
  2⤵
  PID:4380
- C:\Windows\System\ZzFABLQ.exe
  C:\Windows\System\ZzFABLQ.exe
  2⤵
  PID:356
- C:\Windows\System\SuWDDhG.exe
  C:\Windows\System\SuWDDhG.exe
  2⤵
  PID:4432
- C:\Windows\System\LEionTd.exe
  C:\Windows\System\LEionTd.exe
  2⤵
  PID:4492
- C:\Windows\System\GEonNsZ.exe
  C:\Windows\System\GEonNsZ.exe
  2⤵
  PID:4512
- C:\Windows\System\xxUJHJz.exe
  C:\Windows\System\xxUJHJz.exe
  2⤵
  PID:4640
- C:\Windows\System\sNvEDGs.exe
  C:\Windows\System\sNvEDGs.exe
  2⤵
  PID:4944
- C:\Windows\System\ItFDUea.exe
  C:\Windows\System\ItFDUea.exe
  2⤵
  PID:4572
- C:\Windows\System\qarkGpJ.exe
  C:\Windows\System\qarkGpJ.exe
  2⤵
  PID:4676
- C:\Windows\System\PtEWWCo.exe
  C:\Windows\System\PtEWWCo.exe
  2⤵
  PID:4912
- C:\Windows\System\YTXUeFb.exe
  C:\Windows\System\YTXUeFb.exe
  2⤵
  PID:4740
- C:\Windows\System\jjyJakl.exe
  C:\Windows\System\jjyJakl.exe
  2⤵
  PID:5040
- C:\Windows\System\CIFhuCP.exe
  C:\Windows\System\CIFhuCP.exe
  2⤵
  PID:5104
- C:\Windows\System\tHkjIlQ.exe
  C:\Windows\System\tHkjIlQ.exe
  2⤵
  PID:4864
- C:\Windows\System\qtYqMWd.exe
  C:\Windows\System\qtYqMWd.exe
  2⤵
  PID:4124
- C:\Windows\System\KXBOOAV.exe
  C:\Windows\System\KXBOOAV.exe
  2⤵
  PID:3800
- C:\Windows\System\uAPvcvA.exe
  C:\Windows\System\uAPvcvA.exe
  2⤵
  PID:5056
- C:\Windows\System\QgCPTQk.exe
  C:\Windows\System\QgCPTQk.exe
  2⤵
  PID:4188
- C:\Windows\System\tfBfjaU.exe
  C:\Windows\System\tfBfjaU.exe
  2⤵
  PID:2680
- C:\Windows\System\JkeuEam.exe
  C:\Windows\System\JkeuEam.exe
  2⤵
  PID:4352
- C:\Windows\System\CXTWZVM.exe
  C:\Windows\System\CXTWZVM.exe
  2⤵
  PID:4304
- C:\Windows\System\TMbksTA.exe
  C:\Windows\System\TMbksTA.exe
  2⤵
  PID:4268
- C:\Windows\System\GhkUIHC.exe
  C:\Windows\System\GhkUIHC.exe
  2⤵
  PID:4604
- C:\Windows\System\BneHsiU.exe
  C:\Windows\System\BneHsiU.exe
  2⤵
  PID:4756
- C:\Windows\System\kOHDrwa.exe
  C:\Windows\System\kOHDrwa.exe
  2⤵
  PID:4816
- C:\Windows\System\ACPOChB.exe
  C:\Windows\System\ACPOChB.exe
  2⤵
  PID:2256
- C:\Windows\System\aaTukBw.exe
  C:\Windows\System\aaTukBw.exe
  2⤵
  PID:4832
- C:\Windows\System\NsJtPDS.exe
  C:\Windows\System\NsJtPDS.exe
  2⤵
  PID:5076
- C:\Windows\System\idxLdRA.exe
  C:\Windows\System\idxLdRA.exe
  2⤵
  PID:592
- C:\Windows\System\tgwOVfB.exe
  C:\Windows\System\tgwOVfB.exe
  2⤵
  PID:4300
- C:\Windows\System\audMvwQ.exe
  C:\Windows\System\audMvwQ.exe
  2⤵
  PID:616
- C:\Windows\System\KxiZGuR.exe
  C:\Windows\System\KxiZGuR.exe
  2⤵
  PID:4204
- C:\Windows\System\SCmDeEU.exe
  C:\Windows\System\SCmDeEU.exe
  2⤵
  PID:5128
- C:\Windows\System\mNUnyCk.exe
  C:\Windows\System\mNUnyCk.exe
  2⤵
  PID:5144
- C:\Windows\System\AXlBdZq.exe
  C:\Windows\System\AXlBdZq.exe
  2⤵
  PID:5160
- C:\Windows\System\jRbtmPW.exe
  C:\Windows\System\jRbtmPW.exe
  2⤵
  PID:5176
- C:\Windows\System\bGuUzBB.exe
  C:\Windows\System\bGuUzBB.exe
  2⤵
  PID:5192
- C:\Windows\System\ImEJbHF.exe
  C:\Windows\System\ImEJbHF.exe
  2⤵
  PID:5212
- C:\Windows\System\cfiRnum.exe
  C:\Windows\System\cfiRnum.exe
  2⤵
  PID:5228
- C:\Windows\System\fWZWSdT.exe
  C:\Windows\System\fWZWSdT.exe
  2⤵
  PID:5244
- C:\Windows\System\efVrABY.exe
  C:\Windows\System\efVrABY.exe
  2⤵
  PID:5260
- C:\Windows\System\JGPLJbH.exe
  C:\Windows\System\JGPLJbH.exe
  2⤵
  PID:5276
- C:\Windows\System\kszPZyU.exe
  C:\Windows\System\kszPZyU.exe
  2⤵
  PID:5292
- C:\Windows\System\UNTbHsY.exe
  C:\Windows\System\UNTbHsY.exe
  2⤵
  PID:5308
- C:\Windows\System\xqOgSJp.exe
  C:\Windows\System\xqOgSJp.exe
  2⤵
  PID:5324
- C:\Windows\System\TXmWebU.exe
  C:\Windows\System\TXmWebU.exe
  2⤵
  PID:5344
- C:\Windows\System\YPNUfwd.exe
  C:\Windows\System\YPNUfwd.exe
  2⤵
  PID:5360
- C:\Windows\System\Tjcwabm.exe
  C:\Windows\System\Tjcwabm.exe
  2⤵
  PID:5376
- C:\Windows\System\awcRMJl.exe
  C:\Windows\System\awcRMJl.exe
  2⤵
  PID:5392
- C:\Windows\System\glXJWgL.exe
  C:\Windows\System\glXJWgL.exe
  2⤵
  PID:5408
- C:\Windows\System\dPTJGKs.exe
  C:\Windows\System\dPTJGKs.exe
  2⤵
  PID:5424
- C:\Windows\System\GaQQUhx.exe
  C:\Windows\System\GaQQUhx.exe
  2⤵
  PID:5440
- C:\Windows\System\MmUZXKv.exe
  C:\Windows\System\MmUZXKv.exe
  2⤵
  PID:5456
- C:\Windows\System\oDXbhFT.exe
  C:\Windows\System\oDXbhFT.exe
  2⤵
  PID:5472
- C:\Windows\System\eztviMs.exe
  C:\Windows\System\eztviMs.exe
  2⤵
  PID:5488
- C:\Windows\System\tfnVaJZ.exe
  C:\Windows\System\tfnVaJZ.exe
  2⤵
  PID:5504
- C:\Windows\System\NZeDihL.exe
  C:\Windows\System\NZeDihL.exe
  2⤵
  PID:5520
- C:\Windows\System\btkPutc.exe
  C:\Windows\System\btkPutc.exe
  2⤵
  PID:5536
- C:\Windows\System\HMFOjgN.exe
  C:\Windows\System\HMFOjgN.exe
  2⤵
  PID:5552
- C:\Windows\System\qgxJjUu.exe
  C:\Windows\System\qgxJjUu.exe
  2⤵
  PID:5568
- C:\Windows\System\osyoQUF.exe
  C:\Windows\System\osyoQUF.exe
  2⤵
  PID:5584
- C:\Windows\System\axurrUH.exe
  C:\Windows\System\axurrUH.exe
  2⤵
  PID:5600
- C:\Windows\System\luKkSHw.exe
  C:\Windows\System\luKkSHw.exe
  2⤵
  PID:5616
- C:\Windows\System\AprzHch.exe
  C:\Windows\System\AprzHch.exe
  2⤵
  PID:5632
- C:\Windows\System\wCgEkFM.exe
  C:\Windows\System\wCgEkFM.exe
  2⤵
  PID:5648
- C:\Windows\System\stxxmPO.exe
  C:\Windows\System\stxxmPO.exe
  2⤵
  PID:5664
- C:\Windows\System\plwSouQ.exe
  C:\Windows\System\plwSouQ.exe
  2⤵
  PID:5680
- C:\Windows\System\jusEQUg.exe
  C:\Windows\System\jusEQUg.exe
  2⤵
  PID:5696
- C:\Windows\System\WiCBPxk.exe
  C:\Windows\System\WiCBPxk.exe
  2⤵
  PID:5712
- C:\Windows\System\itnSQIA.exe
  C:\Windows\System\itnSQIA.exe
  2⤵
  PID:5728
- C:\Windows\System\GrQFLAy.exe
  C:\Windows\System\GrQFLAy.exe
  2⤵
  PID:5744
- C:\Windows\System\tYZrKCX.exe
  C:\Windows\System\tYZrKCX.exe
  2⤵
  PID:5760
- C:\Windows\System\SFCQRbx.exe
  C:\Windows\System\SFCQRbx.exe
  2⤵
  PID:5776
- C:\Windows\System\KBtGSuT.exe
  C:\Windows\System\KBtGSuT.exe
  2⤵
  PID:5792
- C:\Windows\System\WlGvMSj.exe
  C:\Windows\System\WlGvMSj.exe
  2⤵
  PID:5808
- C:\Windows\System\iZsycrB.exe
  C:\Windows\System\iZsycrB.exe
  2⤵
  PID:5824
- C:\Windows\System\gwhEcYQ.exe
  C:\Windows\System\gwhEcYQ.exe
  2⤵
  PID:5840
- C:\Windows\System\HboHeCO.exe
  C:\Windows\System\HboHeCO.exe
  2⤵
  PID:5856
- C:\Windows\System\KRYFFbJ.exe
  C:\Windows\System\KRYFFbJ.exe
  2⤵
  PID:5872
- C:\Windows\System\fFsIYpQ.exe
  C:\Windows\System\fFsIYpQ.exe
  2⤵
  PID:5888
- C:\Windows\System\TqFvgDM.exe
  C:\Windows\System\TqFvgDM.exe
  2⤵
  PID:5904
- C:\Windows\System\DWVLixy.exe
  C:\Windows\System\DWVLixy.exe
  2⤵
  PID:5920
- C:\Windows\System\aqffzvV.exe
  C:\Windows\System\aqffzvV.exe
  2⤵
  PID:5936
- C:\Windows\System\eYMudlP.exe
  C:\Windows\System\eYMudlP.exe
  2⤵
  PID:5952
- C:\Windows\System\uAYQVaA.exe
  C:\Windows\System\uAYQVaA.exe
  2⤵
  PID:5968
- C:\Windows\System\Smjbewj.exe
  C:\Windows\System\Smjbewj.exe
  2⤵
  PID:5984
- C:\Windows\System\MovXyel.exe
  C:\Windows\System\MovXyel.exe
  2⤵
  PID:6000
- C:\Windows\System\ZxHXQIq.exe
  C:\Windows\System\ZxHXQIq.exe
  2⤵
  PID:6016
- C:\Windows\System\hLOjfOA.exe
  C:\Windows\System\hLOjfOA.exe
  2⤵
  PID:6032
- C:\Windows\System\tCRcCBg.exe
  C:\Windows\System\tCRcCBg.exe
  2⤵
  PID:6048
- C:\Windows\System\vjkqQZK.exe
  C:\Windows\System\vjkqQZK.exe
  2⤵
  PID:6064
- C:\Windows\System\HNsPaOS.exe
  C:\Windows\System\HNsPaOS.exe
  2⤵
  PID:6080
- C:\Windows\System\JNIXbUA.exe
  C:\Windows\System\JNIXbUA.exe
  2⤵
  PID:6096
- C:\Windows\System\AsTXvVx.exe
  C:\Windows\System\AsTXvVx.exe
  2⤵
  PID:6112
- C:\Windows\System\ZBfAtmL.exe
  C:\Windows\System\ZBfAtmL.exe
  2⤵
  PID:6128
- C:\Windows\System\nOEvrfw.exe
  C:\Windows\System\nOEvrfw.exe
  2⤵
  PID:2692
- C:\Windows\System\eYJUUwg.exe
  C:\Windows\System\eYJUUwg.exe
  2⤵
  PID:3048
- C:\Windows\System\rWauiiF.exe
  C:\Windows\System\rWauiiF.exe
  2⤵
  PID:5072
- C:\Windows\System\gEwRvti.exe
  C:\Windows\System\gEwRvti.exe
  2⤵
  PID:5124
- C:\Windows\System\UWgvZsg.exe
  C:\Windows\System\UWgvZsg.exe
  2⤵
  PID:5044
- C:\Windows\System\JwEJcMw.exe
  C:\Windows\System\JwEJcMw.exe
  2⤵
  PID:1764
- C:\Windows\System\XCPpPDi.exe
  C:\Windows\System\XCPpPDi.exe
  2⤵
  PID:4772
- C:\Windows\System\YUtYGsM.exe
  C:\Windows\System\YUtYGsM.exe
  2⤵
  PID:5140
- C:\Windows\System\FIxjuML.exe
  C:\Windows\System\FIxjuML.exe
  2⤵
  PID:5208
- C:\Windows\System\blqIiUv.exe
  C:\Windows\System\blqIiUv.exe
  2⤵
  PID:5252
- C:\Windows\System\SkAvxqI.exe
  C:\Windows\System\SkAvxqI.exe
  2⤵
  PID:5316
- C:\Windows\System\ISxtasx.exe
  C:\Windows\System\ISxtasx.exe
  2⤵
  PID:5268
- C:\Windows\System\mMVoSpc.exe
  C:\Windows\System\mMVoSpc.exe
  2⤵
  PID:5332
- C:\Windows\System\AZKQKHl.exe
  C:\Windows\System\AZKQKHl.exe
  2⤵
  PID:5236
- C:\Windows\System\GJSOCfc.exe
  C:\Windows\System\GJSOCfc.exe
  2⤵
  PID:5404
- C:\Windows\System\cgOctId.exe
  C:\Windows\System\cgOctId.exe
  2⤵
  PID:5464
- C:\Windows\System\XtBBHlh.exe
  C:\Windows\System\XtBBHlh.exe
  2⤵
  PID:5448
- C:\Windows\System\nvecdEx.exe
  C:\Windows\System\nvecdEx.exe
  2⤵
  PID:1972
- C:\Windows\System\xnHBgVt.exe
  C:\Windows\System\xnHBgVt.exe
  2⤵
  PID:5512
- C:\Windows\System\WoKOory.exe
  C:\Windows\System\WoKOory.exe
  2⤵
  PID:5532
- C:\Windows\System\KWsVEJR.exe
  C:\Windows\System\KWsVEJR.exe
  2⤵
  PID:5592
- C:\Windows\System\zzkmjEQ.exe
  C:\Windows\System\zzkmjEQ.exe
  2⤵
  PID:5624
- C:\Windows\System\VReNvbG.exe
  C:\Windows\System\VReNvbG.exe
  2⤵
  PID:2488
- C:\Windows\System\KtPADHu.exe
  C:\Windows\System\KtPADHu.exe
  2⤵
  PID:5692
- C:\Windows\System\SSxygrQ.exe
  C:\Windows\System\SSxygrQ.exe
  2⤵
  PID:2440
- C:\Windows\System\UiwotPw.exe
  C:\Windows\System\UiwotPw.exe
  2⤵
  PID:5752
- C:\Windows\System\wWGIfQw.exe
  C:\Windows\System\wWGIfQw.exe
  2⤵
  PID:5676
- C:\Windows\System\nouFjee.exe
  C:\Windows\System\nouFjee.exe
  2⤵
  PID:5740
- C:\Windows\System\PfIPMtq.exe
  C:\Windows\System\PfIPMtq.exe
  2⤵
  PID:5820
- C:\Windows\System\kzjpcaj.exe
  C:\Windows\System\kzjpcaj.exe
  2⤵
  PID:5640
- C:\Windows\System\GfOYyZR.exe
  C:\Windows\System\GfOYyZR.exe
  2⤵
  PID:5848
- C:\Windows\System\QTYQRDA.exe
  C:\Windows\System\QTYQRDA.exe
  2⤵
  PID:5832
- C:\Windows\System\wnQRzel.exe
  C:\Windows\System\wnQRzel.exe
  2⤵
  PID:5864
- C:\Windows\System\UxvhKrw.exe
  C:\Windows\System\UxvhKrw.exe
  2⤵
  PID:5912
- C:\Windows\System\CZGdVna.exe
  C:\Windows\System\CZGdVna.exe
  2⤵
  PID:5896
- C:\Windows\System\KtxKnVP.exe
  C:\Windows\System\KtxKnVP.exe
  2⤵
  PID:6008
- C:\Windows\System\qDKAGpl.exe
  C:\Windows\System\qDKAGpl.exe
  2⤵
  PID:5900
- C:\Windows\System\LwPBfhA.exe
  C:\Windows\System\LwPBfhA.exe
  2⤵
  PID:6060
- C:\Windows\System\wmUkdxU.exe
  C:\Windows\System\wmUkdxU.exe
  2⤵
  PID:6136
- C:\Windows\System\UfeqISX.exe
  C:\Windows\System\UfeqISX.exe
  2⤵
  PID:6024
- C:\Windows\System\rgCyrIl.exe
  C:\Windows\System\rgCyrIl.exe
  2⤵
  PID:6056
- C:\Windows\System\JaJQCve.exe
  C:\Windows\System\JaJQCve.exe
  2⤵
  PID:3588
- C:\Windows\System\nnJCCbZ.exe
  C:\Windows\System\nnJCCbZ.exe
  2⤵
  PID:2356
- C:\Windows\System\wDcMQOo.exe
  C:\Windows\System\wDcMQOo.exe
  2⤵
  PID:2468
- C:\Windows\System\AiaSEqf.exe
  C:\Windows\System\AiaSEqf.exe
  2⤵
  PID:5184
- C:\Windows\System\XxGgada.exe
  C:\Windows\System\XxGgada.exe
  2⤵
  PID:5220
- C:\Windows\System\OoGMLtg.exe
  C:\Windows\System\OoGMLtg.exe
  2⤵
  PID:5352
- C:\Windows\System\mjZUYJC.exe
  C:\Windows\System\mjZUYJC.exe
  2⤵
  PID:5340
- C:\Windows\System\GUxwVou.exe
  C:\Windows\System\GUxwVou.exe
  2⤵
  PID:5420
- C:\Windows\System\YrjyKgG.exe
  C:\Windows\System\YrjyKgG.exe
  2⤵
  PID:5436
- C:\Windows\System\VPfhGeb.exe
  C:\Windows\System\VPfhGeb.exe
  2⤵
  PID:5560
- C:\Windows\System\zKvhDHh.exe
  C:\Windows\System\zKvhDHh.exe
  2⤵
  PID:5660
- C:\Windows\System\voKdHKn.exe
  C:\Windows\System\voKdHKn.exe
  2⤵
  PID:5756
- C:\Windows\System\gqPltWd.exe
  C:\Windows\System\gqPltWd.exe
  2⤵
  PID:2464
- C:\Windows\System\eEhkMrX.exe
  C:\Windows\System\eEhkMrX.exe
  2⤵
  PID:5772
- C:\Windows\System\uFfqVJD.exe
  C:\Windows\System\uFfqVJD.exe
  2⤵
  PID:5724
- C:\Windows\System\nvmZztf.exe
  C:\Windows\System\nvmZztf.exe
  2⤵
  PID:5804
- C:\Windows\System\WPyLIIk.exe
  C:\Windows\System\WPyLIIk.exe
  2⤵
  PID:5976
- C:\Windows\System\ZsjRIqp.exe
  C:\Windows\System\ZsjRIqp.exe
  2⤵
  PID:5992
- C:\Windows\System\OkcbsFf.exe
  C:\Windows\System\OkcbsFf.exe
  2⤵
  PID:796
- C:\Windows\System\YSfUTaD.exe
  C:\Windows\System\YSfUTaD.exe
  2⤵
  PID:5964
- C:\Windows\System\BKJpFJw.exe
  C:\Windows\System\BKJpFJw.exe
  2⤵
  PID:6104
- C:\Windows\System\hVMmMZp.exe
  C:\Windows\System\hVMmMZp.exe
  2⤵
  PID:6088
- C:\Windows\System\srNsJYc.exe
  C:\Windows\System\srNsJYc.exe
  2⤵
  PID:5136
- C:\Windows\System\KobgjaT.exe
  C:\Windows\System\KobgjaT.exe
  2⤵
  PID:5388
- C:\Windows\System\VgogTAJ.exe
  C:\Windows\System\VgogTAJ.exe
  2⤵
  PID:5720
- C:\Windows\System\fBlgveo.exe
  C:\Windows\System\fBlgveo.exe
  2⤵
  PID:5736
- C:\Windows\System\BOmJgvC.exe
  C:\Windows\System\BOmJgvC.exe
  2⤵
  PID:4688
- C:\Windows\System\hCIoZBc.exe
  C:\Windows\System\hCIoZBc.exe
  2⤵
  PID:5400
- C:\Windows\System\BOnAApk.exe
  C:\Windows\System\BOnAApk.exe
  2⤵
  PID:5288
- C:\Windows\System\QonTveK.exe
  C:\Windows\System\QonTveK.exe
  2⤵
  PID:5612
- C:\Windows\System\kERDWuI.exe
  C:\Windows\System\kERDWuI.exe
  2⤵
  PID:6148
- C:\Windows\System\QGfDBqC.exe
  C:\Windows\System\QGfDBqC.exe
  2⤵
  PID:6164
- C:\Windows\System\DhbytLY.exe
  C:\Windows\System\DhbytLY.exe
  2⤵
  PID:6180
- C:\Windows\System\LvhPCJf.exe
  C:\Windows\System\LvhPCJf.exe
  2⤵
  PID:6196
- C:\Windows\System\poOBSBZ.exe
  C:\Windows\System\poOBSBZ.exe
  2⤵
  PID:6212
- C:\Windows\System\rSnEOTb.exe
  C:\Windows\System\rSnEOTb.exe
  2⤵
  PID:6228
- C:\Windows\System\XAJZVml.exe
  C:\Windows\System\XAJZVml.exe
  2⤵
  PID:6244
- C:\Windows\System\NcFwkVI.exe
  C:\Windows\System\NcFwkVI.exe
  2⤵
  PID:6260
- C:\Windows\System\QPHeooU.exe
  C:\Windows\System\QPHeooU.exe
  2⤵
  PID:6276
- C:\Windows\System\AMVnQCz.exe
  C:\Windows\System\AMVnQCz.exe
  2⤵
  PID:6292
- C:\Windows\System\GdUnXvA.exe
  C:\Windows\System\GdUnXvA.exe
  2⤵
  PID:6308
- C:\Windows\System\MfYaGfQ.exe
  C:\Windows\System\MfYaGfQ.exe
  2⤵
  PID:6324
- C:\Windows\System\diHocKR.exe
  C:\Windows\System\diHocKR.exe
  2⤵
  PID:6340
- C:\Windows\System\EpJLMSM.exe
  C:\Windows\System\EpJLMSM.exe
  2⤵
  PID:6356
- C:\Windows\System\iJSBeBU.exe
  C:\Windows\System\iJSBeBU.exe
  2⤵
  PID:6372
- C:\Windows\System\gLDVUzi.exe
  C:\Windows\System\gLDVUzi.exe
  2⤵
  PID:6388
- C:\Windows\System\hxUptTP.exe
  C:\Windows\System\hxUptTP.exe
  2⤵
  PID:6404
- C:\Windows\System\wuNkJLg.exe
  C:\Windows\System\wuNkJLg.exe
  2⤵
  PID:6420
- C:\Windows\System\mllqkJA.exe
  C:\Windows\System\mllqkJA.exe
  2⤵
  PID:6436
- C:\Windows\System\UxAtFQG.exe
  C:\Windows\System\UxAtFQG.exe
  2⤵
  PID:6452
- C:\Windows\System\kyRlaGg.exe
  C:\Windows\System\kyRlaGg.exe
  2⤵
  PID:6468
- C:\Windows\System\chwIpXw.exe
  C:\Windows\System\chwIpXw.exe
  2⤵
  PID:6484
- C:\Windows\System\tyVIvqw.exe
  C:\Windows\System\tyVIvqw.exe
  2⤵
  PID:6500
- C:\Windows\System\bDpUEAj.exe
  C:\Windows\System\bDpUEAj.exe
  2⤵
  PID:6516
- C:\Windows\System\KGOcZoe.exe
  C:\Windows\System\KGOcZoe.exe
  2⤵
  PID:6532
- C:\Windows\System\WdqUGWM.exe
  C:\Windows\System\WdqUGWM.exe
  2⤵
  PID:6548
- C:\Windows\System\OrytGKW.exe
  C:\Windows\System\OrytGKW.exe
  2⤵
  PID:6564
- C:\Windows\System\cDTWUIU.exe
  C:\Windows\System\cDTWUIU.exe
  2⤵
  PID:6580
- C:\Windows\System\nVTTGrR.exe
  C:\Windows\System\nVTTGrR.exe
  2⤵
  PID:6596
- C:\Windows\System\FbJnBvo.exe
  C:\Windows\System\FbJnBvo.exe
  2⤵
  PID:6612
- C:\Windows\System\NXdmbkP.exe
  C:\Windows\System\NXdmbkP.exe
  2⤵
  PID:6628
- C:\Windows\System\XAnZQZw.exe
  C:\Windows\System\XAnZQZw.exe
  2⤵
  PID:6644
- C:\Windows\System\ADvyKkf.exe
  C:\Windows\System\ADvyKkf.exe
  2⤵
  PID:6660
- C:\Windows\System\DRtCYVz.exe
  C:\Windows\System\DRtCYVz.exe
  2⤵
  PID:6676
- C:\Windows\System\KmNzkGi.exe
  C:\Windows\System\KmNzkGi.exe
  2⤵
  PID:6692
- C:\Windows\System\HEuiYhN.exe
  C:\Windows\System\HEuiYhN.exe
  2⤵
  PID:6708
- C:\Windows\System\MdnPsUB.exe
  C:\Windows\System\MdnPsUB.exe
  2⤵
  PID:6724
- C:\Windows\System\JRAKFuf.exe
  C:\Windows\System\JRAKFuf.exe
  2⤵
  PID:6740
- C:\Windows\System\jCajPYk.exe
  C:\Windows\System\jCajPYk.exe
  2⤵
  PID:6756
- C:\Windows\System\HiprLnn.exe
  C:\Windows\System\HiprLnn.exe
  2⤵
  PID:6772
- C:\Windows\System\dwybfUG.exe
  C:\Windows\System\dwybfUG.exe
  2⤵
  PID:6788
- C:\Windows\System\yvImFuU.exe
  C:\Windows\System\yvImFuU.exe
  2⤵
  PID:6804
- C:\Windows\System\XWBxJFC.exe
  C:\Windows\System\XWBxJFC.exe
  2⤵
  PID:6820
- C:\Windows\System\qOSckQl.exe
  C:\Windows\System\qOSckQl.exe
  2⤵
  PID:6836
- C:\Windows\System\OWNYRxZ.exe
  C:\Windows\System\OWNYRxZ.exe
  2⤵
  PID:6852
- C:\Windows\System\UGhVLnM.exe
  C:\Windows\System\UGhVLnM.exe
  2⤵
  PID:6868
- C:\Windows\System\qAtejMS.exe
  C:\Windows\System\qAtejMS.exe
  2⤵
  PID:6884
- C:\Windows\System\rfNrMwW.exe
  C:\Windows\System\rfNrMwW.exe
  2⤵
  PID:6900
- C:\Windows\System\SJXsGZT.exe
  C:\Windows\System\SJXsGZT.exe
  2⤵
  PID:6916
- C:\Windows\System\eRLgtZR.exe
  C:\Windows\System\eRLgtZR.exe
  2⤵
  PID:6932
- C:\Windows\System\aeBuOXL.exe
  C:\Windows\System\aeBuOXL.exe
  2⤵
  PID:6948
- C:\Windows\System\UdZlvAV.exe
  C:\Windows\System\UdZlvAV.exe
  2⤵
  PID:6964
- C:\Windows\System\WOzqOHF.exe
  C:\Windows\System\WOzqOHF.exe
  2⤵
  PID:6980
- C:\Windows\System\vNWRVaX.exe
  C:\Windows\System\vNWRVaX.exe
  2⤵
  PID:6996
- C:\Windows\System\jrRpZBU.exe
  C:\Windows\System\jrRpZBU.exe
  2⤵
  PID:7012
- C:\Windows\System\CbDuMIu.exe
  C:\Windows\System\CbDuMIu.exe
  2⤵
  PID:7028
- C:\Windows\System\NjLomjT.exe
  C:\Windows\System\NjLomjT.exe
  2⤵
  PID:7044
- C:\Windows\System\uWltKPH.exe
  C:\Windows\System\uWltKPH.exe
  2⤵
  PID:7060
- C:\Windows\System\jyjcriY.exe
  C:\Windows\System\jyjcriY.exe
  2⤵
  PID:7076
- C:\Windows\System\dPUScny.exe
  C:\Windows\System\dPUScny.exe
  2⤵
  PID:7092
- C:\Windows\System\wttcgwj.exe
  C:\Windows\System\wttcgwj.exe
  2⤵
  PID:7108
- C:\Windows\System\dhhJfzi.exe
  C:\Windows\System\dhhJfzi.exe
  2⤵
  PID:7124
- C:\Windows\System\dlZETdz.exe
  C:\Windows\System\dlZETdz.exe
  2⤵
  PID:7140
- C:\Windows\System\ZKViSbv.exe
  C:\Windows\System\ZKViSbv.exe
  2⤵
  PID:7156
- C:\Windows\System\ijdxydK.exe
  C:\Windows\System\ijdxydK.exe
  2⤵
  PID:6160
- C:\Windows\System\kwUXzGS.exe
  C:\Windows\System\kwUXzGS.exe
  2⤵
  PID:5544
- C:\Windows\System\itJzGIL.exe
  C:\Windows\System\itJzGIL.exe
  2⤵
  PID:5836
- C:\Windows\System\nKCmoJL.exe
  C:\Windows\System\nKCmoJL.exe
  2⤵
  PID:6028
- C:\Windows\System\crMOaoe.exe
  C:\Windows\System\crMOaoe.exe
  2⤵
  PID:2004
- C:\Windows\System\sjuAIJk.exe
  C:\Windows\System\sjuAIJk.exe
  2⤵
  PID:5528
- C:\Windows\System\AHisHBE.exe
  C:\Windows\System\AHisHBE.exe
  2⤵
  PID:6108
- C:\Windows\System\SgasSbo.exe
  C:\Windows\System\SgasSbo.exe
  2⤵
  PID:5200
- C:\Windows\System\CZAVpRo.exe
  C:\Windows\System\CZAVpRo.exe
  2⤵
  PID:6268
- C:\Windows\System\TvfUYtu.exe
  C:\Windows\System\TvfUYtu.exe
  2⤵
  PID:6272
- C:\Windows\System\FZyOuqB.exe
  C:\Windows\System\FZyOuqB.exe
  2⤵
  PID:6320
- C:\Windows\System\DhlSLBG.exe
  C:\Windows\System\DhlSLBG.exe
  2⤵
  PID:6352
- C:\Windows\System\INSYIgT.exe
  C:\Windows\System\INSYIgT.exe
  2⤵
  PID:6416
- C:\Windows\System\aKlnyPQ.exe
  C:\Windows\System\aKlnyPQ.exe
  2⤵
  PID:6480
- C:\Windows\System\jzTJUIB.exe
  C:\Windows\System\jzTJUIB.exe
  2⤵
  PID:6544
- C:\Windows\System\gWmjMWJ.exe
  C:\Windows\System\gWmjMWJ.exe
  2⤵
  PID:6336
- C:\Windows\System\PlSNALC.exe
  C:\Windows\System\PlSNALC.exe
  2⤵
  PID:6608
- C:\Windows\System\jjvIkWI.exe
  C:\Windows\System\jjvIkWI.exe
  2⤵
  PID:6400
- C:\Windows\System\ADGnFNB.exe
  C:\Windows\System\ADGnFNB.exe
  2⤵
  PID:6672
- C:\Windows\System\eLadJAe.exe
  C:\Windows\System\eLadJAe.exe
  2⤵
  PID:6496
- C:\Windows\System\LYuPYZy.exe
  C:\Windows\System\LYuPYZy.exe
  2⤵
  PID:6588
- C:\Windows\System\jCfociR.exe
  C:\Windows\System\jCfociR.exe
  2⤵
  PID:6464
- C:\Windows\System\XRlsNya.exe
  C:\Windows\System\XRlsNya.exe
  2⤵
  PID:6560
- C:\Windows\System\mXBxGrB.exe
  C:\Windows\System\mXBxGrB.exe
  2⤵
  PID:6764
- C:\Windows\System\nssbTBK.exe
  C:\Windows\System\nssbTBK.exe
  2⤵
  PID:6768
- C:\Windows\System\UvXUNlI.exe
  C:\Windows\System\UvXUNlI.exe
  2⤵
  PID:6796
- C:\Windows\System\orqYqGn.exe
  C:\Windows\System\orqYqGn.exe
  2⤵
  PID:6784
- C:\Windows\System\oQzCspE.exe
  C:\Windows\System\oQzCspE.exe
  2⤵
  PID:6848
- C:\Windows\System\SiIXHzw.exe
  C:\Windows\System\SiIXHzw.exe
  2⤵
  PID:6896
- C:\Windows\System\eFjWtax.exe
  C:\Windows\System\eFjWtax.exe
  2⤵
  PID:6912
- C:\Windows\System\lmCpeZT.exe
  C:\Windows\System\lmCpeZT.exe
  2⤵
  PID:6956
- C:\Windows\System\POZjPkJ.exe
  C:\Windows\System\POZjPkJ.exe
  2⤵
  PID:6976
- C:\Windows\System\wptiagI.exe
  C:\Windows\System\wptiagI.exe
  2⤵
  PID:7020
- C:\Windows\System\nRvHbBg.exe
  C:\Windows\System\nRvHbBg.exe
  2⤵
  PID:7008
- C:\Windows\System\fBgyXjg.exe
  C:\Windows\System\fBgyXjg.exe
  2⤵
  PID:7116
- C:\Windows\System\boTxrLv.exe
  C:\Windows\System\boTxrLv.exe
  2⤵
  PID:7072
- C:\Windows\System\ZFljnpq.exe
  C:\Windows\System\ZFljnpq.exe
  2⤵
  PID:7152
- C:\Windows\System\ZfflvvN.exe
  C:\Windows\System\ZfflvvN.exe
  2⤵
  PID:5500
- C:\Windows\System\lgYWTuS.exe
  C:\Windows\System\lgYWTuS.exe
  2⤵
  PID:6220
- C:\Windows\System\wIXjOMt.exe
  C:\Windows\System\wIXjOMt.exe
  2⤵
  PID:6176
- C:\Windows\System\jLnBwTo.exe
  C:\Windows\System\jLnBwTo.exe
  2⤵
  PID:6348
- C:\Windows\System\HyRtAfL.exe
  C:\Windows\System\HyRtAfL.exe
  2⤵
  PID:1964
- C:\Windows\System\qvbThrE.exe
  C:\Windows\System\qvbThrE.exe
  2⤵
  PID:6012
- C:\Windows\System\uglqDqi.exe
  C:\Windows\System\uglqDqi.exe
  2⤵
  PID:6624
- C:\Windows\System\vnFAuSS.exe
  C:\Windows\System\vnFAuSS.exe
  2⤵
  PID:6368
- C:\Windows\System\fKHvHAs.exe
  C:\Windows\System\fKHvHAs.exe
  2⤵
  PID:6076
- C:\Windows\System\aOgKpte.exe
  C:\Windows\System\aOgKpte.exe
  2⤵
  PID:6412
- C:\Windows\System\yyrHvNy.exe
  C:\Windows\System\yyrHvNy.exe
  2⤵
  PID:6716
- C:\Windows\System\asCerFA.exe
  C:\Windows\System\asCerFA.exe
  2⤵
  PID:6780
- C:\Windows\System\hIqVTXr.exe
  C:\Windows\System\hIqVTXr.exe
  2⤵
  PID:6524
- C:\Windows\System\gPVhtfb.exe
  C:\Windows\System\gPVhtfb.exe
  2⤵
  PID:6832
- C:\Windows\System\mYXFvqi.exe
  C:\Windows\System\mYXFvqi.exe
  2⤵
  PID:6924
- C:\Windows\System\TQDvUXP.exe
  C:\Windows\System\TQDvUXP.exe
  2⤵
  PID:7004
- C:\Windows\System\qHGhVnQ.exe
  C:\Windows\System\qHGhVnQ.exe
  2⤵
  PID:7164
- C:\Windows\System\NxuCJMY.exe
  C:\Windows\System\NxuCJMY.exe
  2⤵
  PID:6940
- C:\Windows\System\xdRYXFu.exe
  C:\Windows\System\xdRYXFu.exe
  2⤵
  PID:6576
- C:\Windows\System\GWVnICQ.exe
  C:\Windows\System\GWVnICQ.exe
  2⤵
  PID:4504
- C:\Windows\System\sxgRcEG.exe
  C:\Windows\System\sxgRcEG.exe
  2⤵
  PID:7104
- C:\Windows\System\dEmnwEy.exe
  C:\Windows\System\dEmnwEy.exe
  2⤵
  PID:6720
- C:\Windows\System\fkWQXBh.exe
  C:\Windows\System\fkWQXBh.exe
  2⤵
  PID:6992
- C:\Windows\System\XwHwHQY.exe
  C:\Windows\System\XwHwHQY.exe
  2⤵
  PID:6688
- C:\Windows\System\cyVqZGK.exe
  C:\Windows\System\cyVqZGK.exe
  2⤵
  PID:7148
- C:\Windows\System\nZVeCkr.exe
  C:\Windows\System\nZVeCkr.exe
  2⤵
  PID:7036
- C:\Windows\System\cgmvJnc.exe
  C:\Windows\System\cgmvJnc.exe
  2⤵
  PID:6828
- C:\Windows\System\DktTwlH.exe
  C:\Windows\System\DktTwlH.exe
  2⤵
  PID:6908
- C:\Windows\System\xIbyEVe.exe
  C:\Windows\System\xIbyEVe.exe
  2⤵
  PID:6192
- C:\Windows\System\xvXUzYo.exe
  C:\Windows\System\xvXUzYo.exe
  2⤵
  PID:6476
- C:\Windows\System\uzrRfmu.exe
  C:\Windows\System\uzrRfmu.exe
  2⤵
  PID:6732
- C:\Windows\System\nvlxYjz.exe
  C:\Windows\System\nvlxYjz.exe
  2⤵
  PID:6540
- C:\Windows\System\UqUfCAw.exe
  C:\Windows\System\UqUfCAw.exe
  2⤵
  PID:6240
- C:\Windows\System\uLNNZqA.exe
  C:\Windows\System\uLNNZqA.exe
  2⤵
  PID:6972
- C:\Windows\System\IpBVPPx.exe
  C:\Windows\System\IpBVPPx.exe
  2⤵
  PID:5916
- C:\Windows\System\QKxLijv.exe
  C:\Windows\System\QKxLijv.exe
  2⤵
  PID:7056
- C:\Windows\System\KoclTXc.exe
  C:\Windows\System\KoclTXc.exe
  2⤵
  PID:7180
- C:\Windows\System\YUNkbeM.exe
  C:\Windows\System\YUNkbeM.exe
  2⤵
  PID:7196
- C:\Windows\System\VveaEMu.exe
  C:\Windows\System\VveaEMu.exe
  2⤵
  PID:7212
- C:\Windows\System\FsPVbUG.exe
  C:\Windows\System\FsPVbUG.exe
  2⤵
  PID:7228
- C:\Windows\System\HeWMZhD.exe
  C:\Windows\System\HeWMZhD.exe
  2⤵
  PID:7244
- C:\Windows\System\iWRbdTa.exe
  C:\Windows\System\iWRbdTa.exe
  2⤵
  PID:7260
- C:\Windows\System\BGDqfol.exe
  C:\Windows\System\BGDqfol.exe
  2⤵
  PID:7276
- C:\Windows\System\oTMRgsv.exe
  C:\Windows\System\oTMRgsv.exe
  2⤵
  PID:7292
- C:\Windows\System\wEXSjoD.exe
  C:\Windows\System\wEXSjoD.exe
  2⤵
  PID:7308
- C:\Windows\System\ArAjHZt.exe
  C:\Windows\System\ArAjHZt.exe
  2⤵
  PID:7324
- C:\Windows\System\socdZwZ.exe
  C:\Windows\System\socdZwZ.exe
  2⤵
  PID:7340
- C:\Windows\System\ifFqpzU.exe
  C:\Windows\System\ifFqpzU.exe
  2⤵
  PID:7356
- C:\Windows\System\OViVoZY.exe
  C:\Windows\System\OViVoZY.exe
  2⤵
  PID:7372
- C:\Windows\System\ySIiaLw.exe
  C:\Windows\System\ySIiaLw.exe
  2⤵
  PID:7388
- C:\Windows\System\hDcrCDs.exe
  C:\Windows\System\hDcrCDs.exe
  2⤵
  PID:7404
- C:\Windows\System\TUaihCw.exe
  C:\Windows\System\TUaihCw.exe
  2⤵
  PID:7420
- C:\Windows\System\UvpDPzD.exe
  C:\Windows\System\UvpDPzD.exe
  2⤵
  PID:7436
- C:\Windows\System\JlFskOW.exe
  C:\Windows\System\JlFskOW.exe
  2⤵
  PID:7452
- C:\Windows\System\AQUaqLD.exe
  C:\Windows\System\AQUaqLD.exe
  2⤵
  PID:7468
- C:\Windows\System\WPvwgOC.exe
  C:\Windows\System\WPvwgOC.exe
  2⤵
  PID:7484
- C:\Windows\System\npuASZc.exe
  C:\Windows\System\npuASZc.exe
  2⤵
  PID:7500
- C:\Windows\System\VDdKrhX.exe
  C:\Windows\System\VDdKrhX.exe
  2⤵
  PID:7516
- C:\Windows\System\MtZSUJy.exe
  C:\Windows\System\MtZSUJy.exe
  2⤵
  PID:7536
- C:\Windows\System\LBTeCwP.exe
  C:\Windows\System\LBTeCwP.exe
  2⤵
  PID:7552
- C:\Windows\System\hHvrKnS.exe
  C:\Windows\System\hHvrKnS.exe
  2⤵
  PID:7568
- C:\Windows\System\LCYkbwp.exe
  C:\Windows\System\LCYkbwp.exe
  2⤵
  PID:7584
- C:\Windows\System\irxMyKL.exe
  C:\Windows\System\irxMyKL.exe
  2⤵
  PID:7600
- C:\Windows\System\flRFJpu.exe
  C:\Windows\System\flRFJpu.exe
  2⤵
  PID:7616
- C:\Windows\System\MUtlalN.exe
  C:\Windows\System\MUtlalN.exe
  2⤵
  PID:7636
- C:\Windows\System\XCcACiU.exe
  C:\Windows\System\XCcACiU.exe
  2⤵
  PID:7652
- C:\Windows\System\HfghIbP.exe
  C:\Windows\System\HfghIbP.exe
  2⤵
  PID:7668
- C:\Windows\System\wtBrODP.exe
  C:\Windows\System\wtBrODP.exe
  2⤵
  PID:7688
- C:\Windows\System\VrIVjOG.exe
  C:\Windows\System\VrIVjOG.exe
  2⤵
  PID:7704
- C:\Windows\System\nEWpORE.exe
  C:\Windows\System\nEWpORE.exe
  2⤵
  PID:7720
- C:\Windows\System\CNADCWZ.exe
  C:\Windows\System\CNADCWZ.exe
  2⤵
  PID:7736
- C:\Windows\System\QxobvRH.exe
  C:\Windows\System\QxobvRH.exe
  2⤵
  PID:7752
- C:\Windows\System\BCeCkWO.exe
  C:\Windows\System\BCeCkWO.exe
  2⤵
  PID:7768
- C:\Windows\System\LiKTRVj.exe
  C:\Windows\System\LiKTRVj.exe
  2⤵
  PID:7784
- C:\Windows\System\RCrxSQy.exe
  C:\Windows\System\RCrxSQy.exe
  2⤵
  PID:7800
- C:\Windows\System\ZFqQmTA.exe
  C:\Windows\System\ZFqQmTA.exe
  2⤵
  PID:7816
- C:\Windows\System\eMvkHUJ.exe
  C:\Windows\System\eMvkHUJ.exe
  2⤵
  PID:7832
- C:\Windows\System\CTkTqHK.exe
  C:\Windows\System\CTkTqHK.exe
  2⤵
  PID:7848
- C:\Windows\System\kiZVwhK.exe
  C:\Windows\System\kiZVwhK.exe
  2⤵
  PID:7864
- C:\Windows\System\ZXlBlOh.exe
  C:\Windows\System\ZXlBlOh.exe
  2⤵
  PID:7912
- C:\Windows\System\UvBeVZI.exe
  C:\Windows\System\UvBeVZI.exe
  2⤵
  PID:7936
- C:\Windows\System\lkypINM.exe
  C:\Windows\System\lkypINM.exe
  2⤵
  PID:7996
- C:\Windows\System\FgRnhJn.exe
  C:\Windows\System\FgRnhJn.exe
  2⤵
  PID:8096
- C:\Windows\System\iEDCDKX.exe
  C:\Windows\System\iEDCDKX.exe
  2⤵
  PID:7364
- C:\Windows\System\OpqmFXi.exe
  C:\Windows\System\OpqmFXi.exe
  2⤵
  PID:7960
- C:\Windows\System\pwCmOGy.exe
  C:\Windows\System\pwCmOGy.exe
  2⤵
  PID:8132
- C:\Windows\System\BXRmLPq.exe
  C:\Windows\System\BXRmLPq.exe
  2⤵
  PID:7380
- C:\Windows\System\soPKiOg.exe
  C:\Windows\System\soPKiOg.exe
  2⤵
  PID:7400
- C:\Windows\System\OOOWlRI.exe
  C:\Windows\System\OOOWlRI.exe
  2⤵
  PID:7496
- C:\Windows\System\uqTdnBz.exe
  C:\Windows\System\uqTdnBz.exe
  2⤵
  PID:7480
- C:\Windows\System\AcxlGxk.exe
  C:\Windows\System\AcxlGxk.exe
  2⤵
  PID:7580
- C:\Windows\System\EoJUrhB.exe
  C:\Windows\System\EoJUrhB.exe
  2⤵
  PID:7512
- C:\Windows\System\DkYWVPS.exe
  C:\Windows\System\DkYWVPS.exe
  2⤵
  PID:7716
- C:\Windows\System\fncgmaj.exe
  C:\Windows\System\fncgmaj.exe
  2⤵
  PID:7660
- C:\Windows\System\NbgAQDP.exe
  C:\Windows\System\NbgAQDP.exe
  2⤵
  PID:7632
- C:\Windows\System\Dncqevo.exe
  C:\Windows\System\Dncqevo.exe
  2⤵
  PID:7560
- C:\Windows\System\PYWKuMJ.exe
  C:\Windows\System\PYWKuMJ.exe
  2⤵
  PID:4964
- C:\Windows\System\kkmvZqt.exe
  C:\Windows\System\kkmvZqt.exe
  2⤵
  PID:7780
- C:\Windows\System\HWGYvGp.exe
  C:\Windows\System\HWGYvGp.exe
  2⤵
  PID:7828
- C:\Windows\System\wSiRsVc.exe
  C:\Windows\System\wSiRsVc.exe
  2⤵
  PID:7904
- C:\Windows\System\jAihBwv.exe
  C:\Windows\System\jAihBwv.exe
  2⤵
  PID:7928
- C:\Windows\System\Veriwvm.exe
  C:\Windows\System\Veriwvm.exe
  2⤵
  PID:7236
- C:\Windows\System\mOzVKDY.exe
  C:\Windows\System\mOzVKDY.exe
  2⤵
  PID:7300
- C:\Windows\System\XMzIufd.exe
  C:\Windows\System\XMzIufd.exe
  2⤵
  PID:7336
- C:\Windows\System\rRnQlQk.exe
  C:\Windows\System\rRnQlQk.exe
  2⤵
  PID:8172
- C:\Windows\System\tKCPVYP.exe
  C:\Windows\System\tKCPVYP.exe
  2⤵
  PID:7172
- C:\Windows\System\zrqbNQx.exe
  C:\Windows\System\zrqbNQx.exe
  2⤵
  PID:1196
- C:\Windows\System\QPegJJO.exe
  C:\Windows\System\QPegJJO.exe
  2⤵
  PID:7492
- C:\Windows\System\lLOWqMA.exe
  C:\Windows\System\lLOWqMA.exe
  2⤵
  PID:7696
- C:\Windows\System\TjGTqNW.exe
  C:\Windows\System\TjGTqNW.exe
  2⤵
  PID:7528
- C:\Windows\System\ZDvtDOt.exe
  C:\Windows\System\ZDvtDOt.exe
  2⤵
  PID:8104
- C:\Windows\System\HirLaYC.exe
  C:\Windows\System\HirLaYC.exe
  2⤵
  PID:7432
- C:\Windows\System\HiKoINF.exe
  C:\Windows\System\HiKoINF.exe
  2⤵
  PID:8052
- C:\Windows\System\KbseegX.exe
  C:\Windows\System\KbseegX.exe
  2⤵
  PID:7812
- C:\Windows\System\RFAQOWn.exe
  C:\Windows\System\RFAQOWn.exe
  2⤵
  PID:8164
- C:\Windows\System\XDRlBFJ.exe
  C:\Windows\System\XDRlBFJ.exe
  2⤵
  PID:8028
- C:\Windows\System\BzSjvXH.exe
  C:\Windows\System\BzSjvXH.exe
  2⤵
  PID:7792
- C:\Windows\System\NDhLXru.exe
  C:\Windows\System\NDhLXru.exe
  2⤵
  PID:8180
- C:\Windows\System\WnqBseT.exe
  C:\Windows\System\WnqBseT.exe
  2⤵
  PID:7476
- C:\Windows\System\zeUyUPt.exe
  C:\Windows\System\zeUyUPt.exe
  2⤵
  PID:7684
- C:\Windows\System\LwNvAcW.exe
  C:\Windows\System\LwNvAcW.exe
  2⤵
  PID:6316
- C:\Windows\System\HfeEoDb.exe
  C:\Windows\System\HfeEoDb.exe
  2⤵
  PID:8068
- C:\Windows\System\GxGTNdP.exe
  C:\Windows\System\GxGTNdP.exe
  2⤵
  PID:7220
- C:\Windows\System\ZQpFkNx.exe
  C:\Windows\System\ZQpFkNx.exe
  2⤵
  PID:8116
- C:\Windows\System\fdpvgMU.exe
  C:\Windows\System\fdpvgMU.exe
  2⤵
  PID:7824
- C:\Windows\System\TWoSICr.exe
  C:\Windows\System\TWoSICr.exe
  2⤵
  PID:7188
- C:\Windows\System\nkCSnth.exe
  C:\Windows\System\nkCSnth.exe
  2⤵
  PID:7952
- C:\Windows\System\elbMeDU.exe
  C:\Windows\System\elbMeDU.exe
  2⤵
  PID:7948
- C:\Windows\System\nbEHenT.exe
  C:\Windows\System\nbEHenT.exe
  2⤵
  PID:7612
- C:\Windows\System\ClCfkZe.exe
  C:\Windows\System\ClCfkZe.exe
  2⤵
  PID:8060
- C:\Windows\System\uGOJKtK.exe
  C:\Windows\System\uGOJKtK.exe
  2⤵
  PID:7992
- C:\Windows\System\sGGwtQF.exe
  C:\Windows\System\sGGwtQF.exe
  2⤵
  PID:7224
- C:\Windows\System\YMZYMIR.exe
  C:\Windows\System\YMZYMIR.exe
  2⤵
  PID:8088
- C:\Windows\System\UvcfEYm.exe
  C:\Windows\System\UvcfEYm.exe
  2⤵
  PID:8400
- C:\Windows\System\YMDEbpu.exe
  C:\Windows\System\YMDEbpu.exe
  2⤵
  PID:8416
- C:\Windows\System\mjMiXkM.exe
  C:\Windows\System\mjMiXkM.exe
  2⤵
  PID:8432
- C:\Windows\System\XLNMPNW.exe
  C:\Windows\System\XLNMPNW.exe
  2⤵
  PID:8604
- C:\Windows\System\caplZPQ.exe
  C:\Windows\System\caplZPQ.exe
  2⤵
  PID:8636
- C:\Windows\System\CbZBfpq.exe
  C:\Windows\System\CbZBfpq.exe
  2⤵
  PID:8652
- C:\Windows\System\rtuxWQm.exe
  C:\Windows\System\rtuxWQm.exe
  2⤵
  PID:8668
- C:\Windows\System\wcnMPbv.exe
  C:\Windows\System\wcnMPbv.exe
  2⤵
  PID:8688
- C:\Windows\System\HuQdXcH.exe
  C:\Windows\System\HuQdXcH.exe
  2⤵
  PID:8704
- C:\Windows\System\BjEsudz.exe
  C:\Windows\System\BjEsudz.exe
  2⤵
  PID:8720
- C:\Windows\System\oDWBkEf.exe
  C:\Windows\System\oDWBkEf.exe
  2⤵
  PID:8736
- C:\Windows\System\iiFNSLa.exe
  C:\Windows\System\iiFNSLa.exe
  2⤵
  PID:8752
- C:\Windows\System\iLfRixc.exe
  C:\Windows\System\iLfRixc.exe
  2⤵
  PID:8768
- C:\Windows\System\qozQqML.exe
  C:\Windows\System\qozQqML.exe
  2⤵
  PID:8788
- C:\Windows\System\FFGwvXh.exe
  C:\Windows\System\FFGwvXh.exe
  2⤵
  PID:8804
- C:\Windows\System\JVqZdwK.exe
  C:\Windows\System\JVqZdwK.exe
  2⤵
  PID:8828
- C:\Windows\System\RuZpqms.exe
  C:\Windows\System\RuZpqms.exe
  2⤵
  PID:8844
- C:\Windows\System\VlZrYOO.exe
  C:\Windows\System\VlZrYOO.exe
  2⤵
  PID:8864
- C:\Windows\System\VMFpbHN.exe
  C:\Windows\System\VMFpbHN.exe
  2⤵
  PID:8956
- C:\Windows\System\YEHCqZh.exe
  C:\Windows\System\YEHCqZh.exe
  2⤵
  PID:9128
- C:\Windows\System\avXCcFD.exe
  C:\Windows\System\avXCcFD.exe
  2⤵
  PID:7416
- C:\Windows\System\QwuJKbF.exe
  C:\Windows\System\QwuJKbF.exe
  2⤵
  PID:2140
- C:\Windows\System\MSZlAqS.exe
  C:\Windows\System\MSZlAqS.exe
  2⤵
  PID:8084
- C:\Windows\System\WQGsMPq.exe
  C:\Windows\System\WQGsMPq.exe
  2⤵
  PID:7240
- C:\Windows\System\rrOsuEY.exe
  C:\Windows\System\rrOsuEY.exe
  2⤵
  PID:8112
- C:\Windows\System\KxyyxpK.exe
  C:\Windows\System\KxyyxpK.exe
  2⤵
  PID:7968
- C:\Windows\System\dbVYCbt.exe
  C:\Windows\System\dbVYCbt.exe
  2⤵
  PID:7796
- C:\Windows\System\BJhheEs.exe
  C:\Windows\System\BJhheEs.exe
  2⤵
  PID:7920
- C:\Windows\System\QeZrJcl.exe
  C:\Windows\System\QeZrJcl.exe
  2⤵
  PID:8212
- C:\Windows\System\sICUWDG.exe
  C:\Windows\System\sICUWDG.exe
  2⤵
  PID:8228
- C:\Windows\System\oAweAIb.exe
  C:\Windows\System\oAweAIb.exe
  2⤵
  PID:8244
- C:\Windows\System\AyeWCzm.exe
  C:\Windows\System\AyeWCzm.exe
  2⤵
  PID:8264
- C:\Windows\System\ZeeITUh.exe
  C:\Windows\System\ZeeITUh.exe
  2⤵
  PID:8280
- C:\Windows\System\qpssmHU.exe
  C:\Windows\System\qpssmHU.exe
  2⤵
  PID:8296
- C:\Windows\System\uZcVrsA.exe
  C:\Windows\System\uZcVrsA.exe
  2⤵
  PID:8312
- C:\Windows\System\qygEuTb.exe
  C:\Windows\System\qygEuTb.exe
  2⤵
  PID:8328
- C:\Windows\System\lqspJHg.exe
  C:\Windows\System\lqspJHg.exe
  2⤵
  PID:8344
- C:\Windows\System\uELVqrh.exe
  C:\Windows\System\uELVqrh.exe
  2⤵
  PID:8364
- C:\Windows\System\UKQzIYv.exe
  C:\Windows\System\UKQzIYv.exe
  2⤵
  PID:8380
- C:\Windows\System\oBGjvCE.exe
  C:\Windows\System\oBGjvCE.exe
  2⤵
  PID:8392
- C:\Windows\System\etUXGya.exe
  C:\Windows\System\etUXGya.exe
  2⤵
  PID:8156
- C:\Windows\System\eRlQKEk.exe
  C:\Windows\System\eRlQKEk.exe
  2⤵
  PID:8444
- C:\Windows\System\tCuOZPc.exe
  C:\Windows\System\tCuOZPc.exe
  2⤵
  PID:8468
- C:\Windows\System\sCtEWec.exe
  C:\Windows\System\sCtEWec.exe
  2⤵
  PID:8488
- C:\Windows\System\fwHTaPt.exe
  C:\Windows\System\fwHTaPt.exe
  2⤵
  PID:8460
- C:\Windows\System\bSXmdQp.exe
  C:\Windows\System\bSXmdQp.exe
  2⤵
  PID:8472
- C:\Windows\System\tZHHeIU.exe
  C:\Windows\System\tZHHeIU.exe
  2⤵
  PID:8504
- C:\Windows\System\bztkXmz.exe
  C:\Windows\System\bztkXmz.exe
  2⤵
  PID:8524
- C:\Windows\System\EncFbJR.exe
  C:\Windows\System\EncFbJR.exe
  2⤵
  PID:8556
- C:\Windows\System\MwLcwxq.exe
  C:\Windows\System\MwLcwxq.exe
  2⤵
  PID:7252
- C:\Windows\System\SwLCvEM.exe
  C:\Windows\System\SwLCvEM.exe
  2⤵
  PID:8660
- C:\Windows\System\eOwIDdl.exe
  C:\Windows\System\eOwIDdl.exe
  2⤵
  PID:8728
- C:\Windows\System\JRKHFVX.exe
  C:\Windows\System\JRKHFVX.exe
  2⤵
  PID:8796
- C:\Windows\System\KZWSlXw.exe
  C:\Windows\System\KZWSlXw.exe
  2⤵
  PID:8644
- C:\Windows\System\rSgQPKY.exe
  C:\Windows\System\rSgQPKY.exe
  2⤵
  PID:8944
- C:\Windows\System\LcBOhjz.exe
  C:\Windows\System\LcBOhjz.exe
  2⤵
  PID:8612
- C:\Windows\System\FtEwnwL.exe
  C:\Windows\System\FtEwnwL.exe
  2⤵
  PID:8632
- C:\Windows\System\MDfYalV.exe
  C:\Windows\System\MDfYalV.exe
  2⤵
  PID:8884
- C:\Windows\System\CqfyqcB.exe
  C:\Windows\System\CqfyqcB.exe
  2⤵
  PID:8896
- C:\Windows\System\AlSezpY.exe
  C:\Windows\System\AlSezpY.exe
  2⤵
  PID:8920
- C:\Windows\System\LlOsFnp.exe
  C:\Windows\System\LlOsFnp.exe
  2⤵
  PID:8580
- C:\Windows\System\feWivaR.exe
  C:\Windows\System\feWivaR.exe
  2⤵
  PID:8812
- C:\Windows\System\AuLtNhi.exe
  C:\Windows\System\AuLtNhi.exe
  2⤵
  PID:8592
- C:\Windows\System\MaVkFdY.exe
  C:\Windows\System\MaVkFdY.exe
  2⤵
  PID:8780
- C:\Windows\System\kQflLQH.exe
  C:\Windows\System\kQflLQH.exe
  2⤵
  PID:8712
- C:\Windows\System\aJORVGG.exe
  C:\Windows\System\aJORVGG.exe
  2⤵
  PID:8648
- C:\Windows\System\aajYSsF.exe
  C:\Windows\System\aajYSsF.exe
  2⤵
  PID:8988
- C:\Windows\System\AcsBbtA.exe
  C:\Windows\System\AcsBbtA.exe
  2⤵
  PID:9004
- C:\Windows\System\rabpAQx.exe
  C:\Windows\System\rabpAQx.exe
  2⤵
  PID:9020
- C:\Windows\System\vwtikNK.exe
  C:\Windows\System\vwtikNK.exe
  2⤵
  PID:8972
- C:\Windows\System\cnTODTm.exe
  C:\Windows\System\cnTODTm.exe
  2⤵
  PID:9068
- C:\Windows\System\rlUaKxF.exe
  C:\Windows\System\rlUaKxF.exe
  2⤵
  PID:9064
- C:\Windows\System\DXgyeBi.exe
  C:\Windows\System\DXgyeBi.exe
  2⤵
  PID:9092
- C:\Windows\System\wemDapX.exe
  C:\Windows\System\wemDapX.exe
  2⤵
  PID:9084
- C:\Windows\System\RbpSnsR.exe
  C:\Windows\System\RbpSnsR.exe
  2⤵
  PID:9116
- C:\Windows\System\yEclliq.exe
  C:\Windows\System\yEclliq.exe
  2⤵
  PID:9124
- C:\Windows\System\DzboPPl.exe
  C:\Windows\System\DzboPPl.exe
  2⤵
  PID:9148
- C:\Windows\System\EoiHapc.exe
  C:\Windows\System\EoiHapc.exe
  2⤵
  PID:9164
- C:\Windows\System\bcoOtAx.exe
  C:\Windows\System\bcoOtAx.exe
  2⤵
  PID:9180
- C:\Windows\System\KCIFJMC.exe
  C:\Windows\System\KCIFJMC.exe
  2⤵
  PID:9196
- C:\Windows\System\MshDKlE.exe
  C:\Windows\System\MshDKlE.exe
  2⤵
  PID:7284
- C:\Windows\System\kVEUfOg.exe
  C:\Windows\System\kVEUfOg.exe
  2⤵
  PID:7332
- C:\Windows\System\gdlSYWG.exe
  C:\Windows\System\gdlSYWG.exe
  2⤵
  PID:8092
- C:\Windows\System\IeQZsWX.exe
  C:\Windows\System\IeQZsWX.exe
  2⤵
  PID:8056
- C:\Windows\System\ctdwvXf.exe
  C:\Windows\System\ctdwvXf.exe
  2⤵
  PID:7256
- C:\Windows\System\iwNnGGW.exe
  C:\Windows\System\iwNnGGW.exe
  2⤵
  PID:8260
- C:\Windows\System\SbluhII.exe
  C:\Windows\System\SbluhII.exe
  2⤵
  PID:8324
- C:\Windows\System\DlALLFy.exe
  C:\Windows\System\DlALLFy.exe
  2⤵
  PID:8208
- C:\Windows\System\zwgLzjg.exe
  C:\Windows\System\zwgLzjg.exe
  2⤵
  PID:7744
- C:\Windows\System\XKvkUHw.exe
  C:\Windows\System\XKvkUHw.exe
  2⤵
  PID:8336
- C:\Windows\System\khsQChC.exe
  C:\Windows\System\khsQChC.exe
  2⤵
  PID:7448
- C:\Windows\System\WEkrYtG.exe
  C:\Windows\System\WEkrYtG.exe
  2⤵
  PID:8080
- C:\Windows\System\GISpMVV.exe
  C:\Windows\System\GISpMVV.exe
  2⤵
  PID:8236
- C:\Windows\System\RCzusTj.exe
  C:\Windows\System\RCzusTj.exe
  2⤵
  PID:8128
- C:\Windows\System\DkNTNHQ.exe
  C:\Windows\System\DkNTNHQ.exe
  2⤵
  PID:8480
- C:\Windows\System\DgpJWtF.exe
  C:\Windows\System\DgpJWtF.exe
  2⤵
  PID:8532
- C:\Windows\System\dlthLer.exe
  C:\Windows\System\dlthLer.exe
  2⤵
  PID:8572
- C:\Windows\System\VClHWgW.exe
  C:\Windows\System\VClHWgW.exe
  2⤵
  PID:8492
- C:\Windows\System\CWsffYz.exe
  C:\Windows\System\CWsffYz.exe
  2⤵
  PID:8700
- C:\Windows\System\Qilzgbo.exe
  C:\Windows\System\Qilzgbo.exe
  2⤵
  PID:8624
- C:\Windows\System\HrZEvpl.exe
  C:\Windows\System\HrZEvpl.exe
  2⤵
  PID:8840
- C:\Windows\System\qlrlGoV.exe
  C:\Windows\System\qlrlGoV.exe
  2⤵
  PID:8876
- C:\Windows\System\mMyykCu.exe
  C:\Windows\System\mMyykCu.exe
  2⤵
  PID:8600
- C:\Windows\System\zdVZTAY.exe
  C:\Windows\System\zdVZTAY.exe
  2⤵
  PID:8916
- C:\Windows\System\rlKbLUw.exe
  C:\Windows\System\rlKbLUw.exe
  2⤵
  PID:8940
- C:\Windows\System\JuUfSax.exe
  C:\Windows\System\JuUfSax.exe
  2⤵
  PID:8784
- C:\Windows\System\QbciYFm.exe
  C:\Windows\System\QbciYFm.exe
  2⤵
  PID:8680
- C:\Windows\System\odpjWbN.exe
  C:\Windows\System\odpjWbN.exe
  2⤵
  PID:8716
- C:\Windows\System\mjwOQFr.exe
  C:\Windows\System\mjwOQFr.exe
  2⤵
  PID:8968
- C:\Windows\System\dlYtDdk.exe
  C:\Windows\System\dlYtDdk.exe
  2⤵
  PID:9060
- C:\Windows\System\nBuJsTw.exe
  C:\Windows\System\nBuJsTw.exe
  2⤵
  PID:9052
- C:\Windows\System\KIivOjf.exe
  C:\Windows\System\KIivOjf.exe
  2⤵
  PID:9080
- C:\Windows\System\LJcfcfW.exe
  C:\Windows\System\LJcfcfW.exe
  2⤵
  PID:9160
- C:\Windows\System\NUgydRj.exe
  C:\Windows\System\NUgydRj.exe
  2⤵
  PID:1576
- C:\Windows\System\tEcwByz.exe
  C:\Windows\System\tEcwByz.exe
  2⤵
  PID:8252
- C:\Windows\System\sDLqoiz.exe
  C:\Windows\System\sDLqoiz.exe
  2⤵
  PID:8304
- C:\Windows\System\NPXVAMj.exe
  C:\Windows\System\NPXVAMj.exe
  2⤵
  PID:8356
- C:\Windows\System\KiMzAIh.exe
  C:\Windows\System\KiMzAIh.exe
  2⤵
  PID:8428
- C:\Windows\System\bOCvSIq.exe
  C:\Windows\System\bOCvSIq.exe
  2⤵
  PID:8932
- C:\Windows\System\osLqVJB.exe
  C:\Windows\System\osLqVJB.exe
  2⤵
  PID:7972
- C:\Windows\System\aisdefe.exe
  C:\Windows\System\aisdefe.exe
  2⤵
  PID:9340
- C:\Windows\System\wOlyNef.exe
  C:\Windows\System\wOlyNef.exe
  2⤵
  PID:9356
- C:\Windows\System\jURIarW.exe
  C:\Windows\System\jURIarW.exe
  2⤵
  PID:9372
- C:\Windows\System\lOxYWxr.exe
  C:\Windows\System\lOxYWxr.exe
  2⤵
  PID:9388
- C:\Windows\System\ByZqdrb.exe
  C:\Windows\System\ByZqdrb.exe
  2⤵
  PID:9404
- C:\Windows\System\trldSRo.exe
  C:\Windows\System\trldSRo.exe
  2⤵
  PID:9420
- C:\Windows\System\CANuiic.exe
  C:\Windows\System\CANuiic.exe
  2⤵
  PID:9440
- C:\Windows\System\qIfFNQP.exe
  C:\Windows\System\qIfFNQP.exe
  2⤵
  PID:9456
- C:\Windows\System\bBaiXAV.exe
  C:\Windows\System\bBaiXAV.exe
  2⤵
  PID:9472
- C:\Windows\System\zuxyYXf.exe
  C:\Windows\System\zuxyYXf.exe
  2⤵
  PID:9488
- C:\Windows\System\qKoLUUq.exe
  C:\Windows\System\qKoLUUq.exe
  2⤵
  PID:9508
- C:\Windows\System\zLTbzxY.exe
  C:\Windows\System\zLTbzxY.exe
  2⤵
  PID:9524
- C:\Windows\System\gvjTinn.exe
  C:\Windows\System\gvjTinn.exe
  2⤵
  PID:9540
- C:\Windows\System\aisZYoy.exe
  C:\Windows\System\aisZYoy.exe
  2⤵
  PID:9556
- C:\Windows\System\AQTGZKF.exe
  C:\Windows\System\AQTGZKF.exe
  2⤵
  PID:9572
- C:\Windows\System\cbolXys.exe
  C:\Windows\System\cbolXys.exe
  2⤵
  PID:9596
- C:\Windows\System\qzEwSfH.exe
  C:\Windows\System\qzEwSfH.exe
  2⤵
  PID:9612
- C:\Windows\System\bwliWqZ.exe
  C:\Windows\System\bwliWqZ.exe
  2⤵
  PID:9628
- C:\Windows\System\iQdSKsz.exe
  C:\Windows\System\iQdSKsz.exe
  2⤵
  PID:9644
- C:\Windows\System\dskzNVI.exe
  C:\Windows\System\dskzNVI.exe
  2⤵
  PID:9660
- C:\Windows\System\ajlDLQt.exe
  C:\Windows\System\ajlDLQt.exe
  2⤵
  PID:9676
- C:\Windows\System\blxPaFl.exe
  C:\Windows\System\blxPaFl.exe
  2⤵
  PID:9692
- C:\Windows\System\tZLgTWC.exe
  C:\Windows\System\tZLgTWC.exe
  2⤵
  PID:9708
- C:\Windows\System\IfEDXbS.exe
  C:\Windows\System\IfEDXbS.exe
  2⤵
  PID:9724
- C:\Windows\System\RsBlIeG.exe
  C:\Windows\System\RsBlIeG.exe
  2⤵
  PID:9744
- C:\Windows\System\XcPIqqc.exe
  C:\Windows\System\XcPIqqc.exe
  2⤵
  PID:9760
- C:\Windows\System\oTggsMr.exe
  C:\Windows\System\oTggsMr.exe
  2⤵
  PID:9776
- C:\Windows\System\oltlTvU.exe
  C:\Windows\System\oltlTvU.exe
  2⤵
  PID:9792
- C:\Windows\System\ePOpqoH.exe
  C:\Windows\System\ePOpqoH.exe
  2⤵
  PID:9808
- C:\Windows\System\GVaShtc.exe
  C:\Windows\System\GVaShtc.exe
  2⤵
  PID:9824
- C:\Windows\System\ArmifKZ.exe
  C:\Windows\System\ArmifKZ.exe
  2⤵
  PID:9840
- C:\Windows\System\szToQLz.exe
  C:\Windows\System\szToQLz.exe
  2⤵
  PID:9856
- C:\Windows\System\KBiWRap.exe
  C:\Windows\System\KBiWRap.exe
  2⤵
  PID:9872
- C:\Windows\System\yyxOQyr.exe
  C:\Windows\System\yyxOQyr.exe
  2⤵
  PID:9888
- C:\Windows\System\MzOCRSg.exe
  C:\Windows\System\MzOCRSg.exe
  2⤵
  PID:9904
- C:\Windows\System\KqDVXnu.exe
  C:\Windows\System\KqDVXnu.exe
  2⤵
  PID:9920
- C:\Windows\System\kOSgOpq.exe
  C:\Windows\System\kOSgOpq.exe
  2⤵
  PID:9936
- C:\Windows\System\DljmJhc.exe
  C:\Windows\System\DljmJhc.exe
  2⤵
  PID:9952
- C:\Windows\System\RHPHmng.exe
  C:\Windows\System\RHPHmng.exe
  2⤵
  PID:9972
- C:\Windows\System\DKWxRtQ.exe
  C:\Windows\System\DKWxRtQ.exe
  2⤵
  PID:9988
- C:\Windows\System\DvPyYhu.exe
  C:\Windows\System\DvPyYhu.exe
  2⤵
  PID:10004
- C:\Windows\System\LerdUyf.exe
  C:\Windows\System\LerdUyf.exe
  2⤵
  PID:10044
- C:\Windows\System\fYmDbjS.exe
  C:\Windows\System\fYmDbjS.exe
  2⤵
  PID:10076
- C:\Windows\System\lkqeUvz.exe
  C:\Windows\System\lkqeUvz.exe
  2⤵
  PID:10104
- C:\Windows\System\GQoAhyW.exe
  C:\Windows\System\GQoAhyW.exe
  2⤵
  PID:10144
- C:\Windows\System\osZfeIZ.exe
  C:\Windows\System\osZfeIZ.exe
  2⤵
  PID:10184
- C:\Windows\System\sstsYyj.exe
  C:\Windows\System\sstsYyj.exe
  2⤵
  PID:10204
- C:\Windows\System\EcuqLoA.exe
  C:\Windows\System\EcuqLoA.exe
  2⤵
  PID:10220
- C:\Windows\System\cEwuSLF.exe
  C:\Windows\System\cEwuSLF.exe
  2⤵
  PID:10236
- C:\Windows\System\HpadvRs.exe
  C:\Windows\System\HpadvRs.exe
  2⤵
  PID:8900
- C:\Windows\System\kMYoRdF.exe
  C:\Windows\System\kMYoRdF.exe
  2⤵
  PID:9016
- C:\Windows\System\PDhSapE.exe
  C:\Windows\System\PDhSapE.exe
  2⤵
  PID:7320
- C:\Windows\System\hhXvytq.exe
  C:\Windows\System\hhXvytq.exe
  2⤵
  PID:8224
- C:\Windows\System\dArOQMH.exe
  C:\Windows\System\dArOQMH.exe
  2⤵
  PID:8440
- C:\Windows\System\soECvbz.exe
  C:\Windows\System\soECvbz.exe
  2⤵
  PID:8508
- C:\Windows\System\OGukcjP.exe
  C:\Windows\System\OGukcjP.exe
  2⤵
  PID:8676
- C:\Windows\System\gbkhOuh.exe
  C:\Windows\System\gbkhOuh.exe
  2⤵
  PID:9104
- C:\Windows\System\VexNPRK.exe
  C:\Windows\System\VexNPRK.exe
  2⤵
  PID:8240
- C:\Windows\System\tcsjnoq.exe
  C:\Windows\System\tcsjnoq.exe
  2⤵
  PID:8200
- C:\Windows\System\JiijaPK.exe
  C:\Windows\System\JiijaPK.exe
  2⤵
  PID:8696
- C:\Windows\System\WFCUynI.exe
  C:\Windows\System\WFCUynI.exe
  2⤵
  PID:8256
- C:\Windows\System\IHIlfAi.exe
  C:\Windows\System\IHIlfAi.exe
  2⤵
  PID:9240
- C:\Windows\System\CBUlPSK.exe
  C:\Windows\System\CBUlPSK.exe
  2⤵
  PID:9256
- C:\Windows\System\yIjQIKn.exe
  C:\Windows\System\yIjQIKn.exe
  2⤵
  PID:9272
- C:\Windows\System\zKMOzzX.exe
  C:\Windows\System\zKMOzzX.exe
  2⤵
  PID:8516
- C:\Windows\System\IjTspLU.exe
  C:\Windows\System\IjTspLU.exe
  2⤵
  PID:9192
- C:\Windows\System\xuCRkhL.exe
  C:\Windows\System\xuCRkhL.exe
  2⤵
  PID:9048
- C:\Windows\System\tFkVNAz.exe
  C:\Windows\System\tFkVNAz.exe
  2⤵
  PID:8860
- C:\Windows\System\njlihGW.exe
  C:\Windows\System\njlihGW.exe
  2⤵
  PID:9280
- C:\Windows\System\kcJxBHv.exe
  C:\Windows\System\kcJxBHv.exe
  2⤵
  PID:9296
- C:\Windows\System\EgLqBBE.exe
  C:\Windows\System\EgLqBBE.exe
  2⤵
  PID:9312
- C:\Windows\System\ozGsgSW.exe
  C:\Windows\System\ozGsgSW.exe
  2⤵
  PID:9328
- C:\Windows\System\ZXlCtBO.exe
  C:\Windows\System\ZXlCtBO.exe
  2⤵
  PID:9352
- C:\Windows\System\qhxWFMK.exe
  C:\Windows\System\qhxWFMK.exe
  2⤵
  PID:9428
- C:\Windows\System\UeLANiz.exe
  C:\Windows\System\UeLANiz.exe
  2⤵
  PID:9412
- C:\Windows\System\mFSXhqK.exe
  C:\Windows\System\mFSXhqK.exe
  2⤵
  PID:9480
- C:\Windows\System\hFFrHNw.exe
  C:\Windows\System\hFFrHNw.exe
  2⤵
  PID:9580
- C:\Windows\System\uFdKbte.exe
  C:\Windows\System\uFdKbte.exe
  2⤵
  PID:9468
- C:\Windows\System\fEsDAGR.exe
  C:\Windows\System\fEsDAGR.exe
  2⤵
  PID:9496
- C:\Windows\System\RRiXhVC.exe
  C:\Windows\System\RRiXhVC.exe
  2⤵
  PID:9688
- C:\Windows\System\JhdtHai.exe
  C:\Windows\System\JhdtHai.exe
  2⤵
  PID:9568
- C:\Windows\System\FJYcAAx.exe
  C:\Windows\System\FJYcAAx.exe
  2⤵
  PID:9636
- C:\Windows\System\tWoCDhe.exe
  C:\Windows\System\tWoCDhe.exe
  2⤵
  PID:9732
- C:\Windows\System\AXgWdhA.exe
  C:\Windows\System\AXgWdhA.exe
  2⤵
  PID:9752
- C:\Windows\System\PRhByUy.exe
  C:\Windows\System\PRhByUy.exe
  2⤵
  PID:9816
- C:\Windows\System\ECxhxrW.exe
  C:\Windows\System\ECxhxrW.exe
  2⤵
  PID:9536
- C:\Windows\System\tpiVXMe.exe
  C:\Windows\System\tpiVXMe.exe
  2⤵
  PID:9916
- C:\Windows\System\adqTREG.exe
  C:\Windows\System\adqTREG.exe
  2⤵
  PID:9980
- C:\Windows\System\qeNfrja.exe
  C:\Windows\System\qeNfrja.exe
  2⤵
  PID:9800
- C:\Windows\System\QmHEPLO.exe
  C:\Windows\System\QmHEPLO.exe
  2⤵
  PID:9996
- C:\Windows\System\JSEJLRR.exe
  C:\Windows\System\JSEJLRR.exe
  2⤵
  PID:9832
- C:\Windows\System\KYijHdz.exe
  C:\Windows\System\KYijHdz.exe
  2⤵
  PID:9932
- C:\Windows\System\SyETMQk.exe
  C:\Windows\System\SyETMQk.exe
  2⤵
  PID:10028
- C:\Windows\System\mDFrDyJ.exe
  C:\Windows\System\mDFrDyJ.exe
  2⤵
  PID:10036
- C:\Windows\System\VxqSHRM.exe
  C:\Windows\System\VxqSHRM.exe
  2⤵
  PID:10040
- C:\Windows\System\jtcOBnj.exe
  C:\Windows\System\jtcOBnj.exe
  2⤵
  PID:10084
- C:\Windows\System\UoRZkul.exe
  C:\Windows\System\UoRZkul.exe
  2⤵
  PID:10100
- C:\Windows\System\NQvrRiJ.exe
  C:\Windows\System\NQvrRiJ.exe
  2⤵
  PID:10124
- C:\Windows\System\ImtxvxR.exe
  C:\Windows\System\ImtxvxR.exe
  2⤵
  PID:10128
- C:\Windows\System\JHGKrZs.exe
  C:\Windows\System\JHGKrZs.exe
  2⤵
  PID:10164
- C:\Windows\System\LyDhnvb.exe
  C:\Windows\System\LyDhnvb.exe
  2⤵
  PID:10180
- C:\Windows\System\nENfKql.exe
  C:\Windows\System\nENfKql.exe
  2⤵
  PID:10216
- C:\Windows\System\qhNEhsl.exe
  C:\Windows\System\qhNEhsl.exe
  2⤵
  PID:7856
- C:\Windows\System\cRgPQAH.exe
  C:\Windows\System\cRgPQAH.exe
  2⤵
  PID:7776
- C:\Windows\System\hHuzOog.exe
  C:\Windows\System\hHuzOog.exe
  2⤵
  PID:8564
- C:\Windows\System\MswPPUV.exe
  C:\Windows\System\MswPPUV.exe
  2⤵
  PID:9232
- C:\Windows\System\mTCBiVh.exe
  C:\Windows\System\mTCBiVh.exe
  2⤵
  PID:8076
- C:\Windows\System\ytnNEsV.exe
  C:\Windows\System\ytnNEsV.exe
  2⤵
  PID:8464
- C:\Windows\System\ZqRaBBg.exe
  C:\Windows\System\ZqRaBBg.exe
  2⤵
  PID:7316
- C:\Windows\System\WjgWgPe.exe
  C:\Windows\System\WjgWgPe.exe
  2⤵
  PID:6460
- C:\Windows\System\BHbyqaL.exe
  C:\Windows\System\BHbyqaL.exe
  2⤵
  PID:7576
- C:\Windows\System\ahQgJLl.exe
  C:\Windows\System\ahQgJLl.exe
  2⤵
  PID:8628
- C:\Windows\System\kWKkNuX.exe
  C:\Windows\System\kWKkNuX.exe
  2⤵
  PID:9320
- C:\Windows\System\ZDdfxNZ.exe
  C:\Windows\System\ZDdfxNZ.exe
  2⤵
  PID:9396
- C:\Windows\System\JCuMSUH.exe
  C:\Windows\System\JCuMSUH.exe
  2⤵
  PID:9096
- C:\Windows\System\ZzBUDnh.exe
  C:\Windows\System\ZzBUDnh.exe
  2⤵
  PID:9072
- C:\Windows\System\ihEZfIl.exe
  C:\Windows\System\ihEZfIl.exe
  2⤵
  PID:9308
- C:\Windows\System\KohFMme.exe
  C:\Windows\System\KohFMme.exe
  2⤵
  PID:9464
- C:\Windows\System\EeTEjMo.exe
  C:\Windows\System\EeTEjMo.exe
  2⤵
  PID:9620
- C:\Windows\System\okjniSw.exe
  C:\Windows\System\okjniSw.exe
  2⤵
  PID:9684
- C:\Windows\System\hyQGFRX.exe
  C:\Windows\System\hyQGFRX.exe
  2⤵
  PID:9604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CMvfArM.exe

Filesize
2.2MB

MD5
4246a6f3fa661e3780d37fa85a9d2560

SHA1
5f1877cd14511e73b544e03b8e1c14d221b6c6f6

SHA256
77678bb686df00c9db7586b08db34f930ecfbf2178b07d2b5e11fb246571bbad

SHA512
4ff051f19e606b1beb4903d6a66603a55b3aeecaf90d5746ac5595f40148dcccbca6da685b4d3f22d754c97aa339c1cf6c2b539dcebdb7cdf756ee128e593975

Download Submit
C:\Windows\system\LJNpopg.exe

Filesize
2.2MB

MD5
c41216b6c0f461192e64be493893cb4f

SHA1
792e5d253710e0cfe94342b55118f267548ad62f

SHA256
00a9fe55e0f8141e9622de348908ed27bb85463911b98c785d85288a98a5b364

SHA512
87d1f89ba1259329fae80d74f601f6357d1a8513411f853c5d097465c2d20de7f634c1bbc0ca0e19151c4ae6f3c34baac1cfce73fa0bdd24766187b6b84497f5

Download Submit
C:\Windows\system\NnOFnJJ.exe

Filesize
2.2MB

MD5
b80d20d1405b09444fac84feb871d7fb

SHA1
e8070228b3fd92b9dc7335cd3c030c07bc21ed28

SHA256
5f62046f3a456751d98f208a2841ce0eee2e8c8680ab7473c0e0cc46715abcc6

SHA512
f784e7a5bfea7fbfef3ea0f08ca4f4cc89df9cd58d0ce4ae6488fdd2c0fc96d7eaa46486bec788fcdec2af400660c0057dc4c978ec20a3750bd29dc48e18c7e1

Download Submit
C:\Windows\system\OFuINzi.exe

Filesize
2.2MB

MD5
ca688a64774b08aeb011a7638e813da6

SHA1
753ca41babef6d6c3acb5a67306b496af2d90ac3

SHA256
0c955293eaf38524fa746594e281324ac524047596cfd03b8ee00fb04eafcf14

SHA512
3ec083c23e6b94ce38cba0ea7fa4830adcc87107a54fc1f82f02c11b5b11c798e452a262ce2423b1b66eb613805d470fcac008a4153392f901ab10a3829bc246

Download Submit
C:\Windows\system\QcmFgBz.exe

Filesize
2.2MB

MD5
9cda76dc8895459c521cfb582fe37224

SHA1
2267064a3d99905f5c8e3c91a7f4e281ef7e2e70

SHA256
7edba513409053bcdc343ec7d7ecafa9fac5b0de8f50a7e307d4008d6d4f208b

SHA512
d60aceb408cc5c5dd22085e730c1f7018a381bca4274eac09a464225f7e141de5c014108469b3ce8782fc9f9e36d55fe6442a62e58e3b121695de7e1cf2d65c9

Download Submit
C:\Windows\system\RkyFCcn.exe

Filesize
2.2MB

MD5
1b68b877ca2387966202b672982bee86

SHA1
034e672653329fc85d70bc39d8a07b3996e8e38e

SHA256
dccea45df84aef23f5ffe21b52eed7260bbb53b427342880534e8f19dbc71ce1

SHA512
295153e310fb6cb946ddd36b716be5d4f230da58f1396f1721b6cb72063bc6ebca07b3ce084ca6146279f884eadb6089f40a29e624b818d781aedbf2c256f817

Download Submit
C:\Windows\system\SUmQjev.exe

Filesize
2.2MB

MD5
75d7c1e5723507b02a17339791027c15

SHA1
56b8b00e35ef03f524c5baab19a3db7a34c32e30

SHA256
8d8ec62788f222873801ae93a3cdee69fc7b90cab3fa50d870617f0c1114c646

SHA512
eb3cd0ebbb199083a3cf877d985264f99d41dc480f359b7d503006875dff6d02ab61c39db6a31a6a6b42af4f7cf6166bb3d9242ee2fe9a779a7b75fb40acc821

Download Submit
C:\Windows\system\UkThtAb.exe

Filesize
2.2MB

MD5
66251fa07589b7e0996bdc3247d5f393

SHA1
0a395520c90b95a68449362238ec394e621205dd

SHA256
1dcc6ba147010c179082d0f0d4b90c3513ed5c2c97ac770e7406924de2aad679

SHA512
45be224f4ef425aa5d11f419865ab9e76e75fad35627b0f68f9f040b3953366262df3c2c34fffa56ab380ec59f27e91d868537e0450ce0caef0b79e0ccb9d544

Download Submit
C:\Windows\system\VjuFumc.exe

Filesize
2.2MB

MD5
e7476f160c13adc218e1a55b2f29e208

SHA1
934c3daf584beb1d5f10cba0a56151d89dbec9f0

SHA256
fd0ae005b019621221f40e4ecd3cfcd559da881617f31474c6b2ead244ab19ba

SHA512
6c63fb2e770cb065776fea87bc46e7fe18bc9dbb812c8eb113975595a2416ec6db896fa3e596ebc52cb2791916c3f1718dd38dceb17ae47115993ca261b3efd2

Download Submit
C:\Windows\system\ccfuHej.exe

Filesize
2.2MB

MD5
af0419e6d7991d2327c10e88379a40d0

SHA1
fb2d8715ceb142b3c974b2d9c0d4c2e06c24684a

SHA256
5594def392d58010ac32411f15ed564dc109b69622e2fd3b31e4104b09c3acd6

SHA512
cda90e09f341982974a1ef468f3d701f7fdc25e99a0c551de62ea2849eb9dddb92d8fe70dfff09da326e0f0e7331e37a08408481205ab15106ec6cf0c854f43c

Download Submit
C:\Windows\system\eEvySQV.exe

Filesize
18B

MD5
9fa2f2bc2c83847fc483e3e7b126834c

SHA1
8b6462d325e2f1ce3be472e3b52dd110ec77edc6

SHA256
2cfeba3b82f25cdebb02f8d4e5a1f9c8b06dd44b398a3a1e6c4b2e3889cd64d2

SHA512
cdf8d08cfa397a3c63f4ef05a58f2b05a8fdc5e71478c30ce0b29540695413920edc291f08e9c0e713496591adc5707c1c01f6e7f0baaad502181c860050f52f

Download Submit
C:\Windows\system\gUqbUKi.exe

Filesize
2.2MB

MD5
74030160f3ec27c7cedd4957bffc3567

SHA1
e3e6be10de2b31978bfc0d90630064d1b8d7aacb

SHA256
459bed60bb055096618a8c1e46fd65d54293a69a4d6fa936148617583a0619c1

SHA512
1f97d25d0281ddd9e24858681c2e078c0ddb2145209579b96b3328d0754d43972abcd848eff8dc4969dc0d8c1213031e09ee24731120da9e8ed125651a8c282a

Download Submit
C:\Windows\system\iHFHOSI.exe

Filesize
2.2MB

MD5
fd86e432de83d4c82a069b68f9297a7d

SHA1
c0eb5c115c400670259dff470925c06137e6e6e4

SHA256
d71152ea74ce0fe6d69c60a8c145b2a4b7693dd650a64be780a8e8eef0db4ffe

SHA512
2a748afe3f327b5bc128f7adfbd098080247a9a24f14ec1ccb736a6eb1a1d2c8ea4490190597a34d0045b87d6541f1406cbb4dc3058b576ca76da4e545524085

Download Submit
C:\Windows\system\lEWAEzk.exe

Filesize
2.2MB

MD5
173a32e4d316026f5e643cf2abc69406

SHA1
95cb4945de138e9eabb86206c1b6fee10faf29e2

SHA256
4361b86b4b62a88a14d24b8714487d0a413e90a380713f990a9645675e56d6ad

SHA512
652ef98988c1ec84163c1e2335dd29656d43ca7adb8e42e69630ef18e36ce36184264e099f44ec4c2b99e0b28749f603032f9f126202137ab050d37ecb8a5d44

Download Submit
C:\Windows\system\mzltvjP.exe

Filesize
2.2MB

MD5
5564dd2bb87c13dc9febeca11978e914

SHA1
468a35b351e8a020b927de9de6f758d485a0d95c

SHA256
f5b6f66c55aed66a2d7e3bea81d0a21e7a875e4c711204d26ac75f452f9fc144

SHA512
6a1dcd1754e6f2d4376e2efc13fad2d80a6caeee0c3936961c24bdf501bec665ce7b0cc6f3fabe7c564dd9ae0b5e96a16538b92a10fb9727c8db7fa3733df3f6

Download Submit
C:\Windows\system\sBxLozf.exe

Filesize
2.2MB

MD5
109ac09a0bf9f25ccd52a743b6720eec

SHA1
6371363c8513ecf01cba6f994e520f1aeb59897f

SHA256
b2e5a3420552b94a667f363c149c98d1f375fdd4b1108207398cb4ba80e3a6bb

SHA512
d8250f4a9c7a7464ca3d83ff343868b251f686d423ebc6aa96ab774fd2f97aff641e969224782e31d31fb5fe32c3e23d3aafee00c5d094ab20b745cdfff1743a

Download Submit
C:\Windows\system\sXqNHjC.exe

Filesize
2.2MB

MD5
e543854782bd48c1f9210bf619a8ee41

SHA1
0f170b83e5c9cdf3d9eb502cc6ad1d934d2f4441

SHA256
c1db3d0325d1b9efc2e9185b90002658f8f3be07daf08169678a62ce6f3a5546

SHA512
6d2b6ed0357d613ba96299b5873d4b36bcd73fc1b2cc154e812a944d4547bf0a6569a5f65dc1ee2ed93bdd6208cf5ec3becc39f60e4f036b65cedde99fa96791

Download Submit
C:\Windows\system\tbpUJkI.exe

Filesize
2.2MB

MD5
0d0c8bc4d8c8038a39209a6c4acc2761

SHA1
7bed4fb8479c546ac7720ace655fc09c44a431a7

SHA256
36ac8cf482007c44582cb7f0209c0abc5df82ab6df77be9ada931c7fa80d1561

SHA512
0fa669b666c2dba82bb19ed17a7100598b891fde79148e464416514e6074e5b8beb6fa6123b6eeec68450fa48b8f41a082c7e16bf88045621d87fa716f4501be

Download Submit
C:\Windows\system\uovsryJ.exe

Filesize
2.2MB

MD5
59e3d0b50fec9fb746ffc96c9c703602

SHA1
be2080f25f99a0233ea7c48f3cd38b37fd93817f

SHA256
1343346e590b3a5d91ec348c81f368a72466f55f696e3d1d31342b00d6b956d3

SHA512
b96f7be7aaf025a29018da17f783bd90be7db27bdaff64042219ed2ee3c9b5f23df8a01a41b4d53949826b9f92a4fd37ada71a10a227fdee9f634b948bfbdf3f

Download Submit
C:\Windows\system\vCXjnAj.exe

Filesize
2.2MB

MD5
c948398341b9c5b34ce438bf6a6322a6

SHA1
60a905e8d360fa9cfff484b7931b9eef552ca6fd

SHA256
069c0cd7a80763a57f1ffe00170ef66beea8787c2f666188be76f633cf64d28d

SHA512
68f190f6bf0ddb7af8f1ace9f094e39d56cf0406887bef22c459f3912ffc6938811f0e67e794733af35f8de62e36e513d9f5e8e8d630a9eee775273ae2a1a8e3

Download Submit
C:\Windows\system\vkUOwwS.exe

Filesize
2.2MB

MD5
5fa87141a8e559b7bd21a4c8e9726841

SHA1
0224da825e06c893ffbb18149afc33baf059fefa

SHA256
4c032acb5098f0603628884c7378932c030509d3956a604fc2e8b91090f0e4d0

SHA512
da3ad3a559436365ac63985728e0df77a8650f55d2a676646bda87332b032de88f835df87a93642256b39f0706a733f6a4ac864e7f003f5af008532086946778

Download Submit
C:\Windows\system\wQAXJPA.exe

Filesize
2.2MB

MD5
97fbab1a4de471b2cf519936bfeeb0ec

SHA1
8dc50a7087b9afea9a65167b883aa96e66e009f4

SHA256
ad07b0c107b60bed799525787c45fdc616e2c013a426bfa0062e5c7d2ea5f507

SHA512
2d73080560a924e200f205c429615241f7d1d70c22a855fedf5516b70c7f68e5571cd587a9b37e9a631727d9c2f98e10b5e35d96f30815b26f9eb444ebb764eb

Download Submit
\Windows\system\AImATQq.exe

Filesize
2.2MB

MD5
836699b3288f962095a83dc656c3fa32

SHA1
5368d714bcea5e8221ad20ece3771b5b1687d71e

SHA256
2b2b131dea1f2a5aca3757eb4e7672a7ddfcf13d8425663451b1a13268618b95

SHA512
3b4751202e7b09b2c71b78f3972110ac075aa182d5a308ecedf43f286ffdfa1bb7c479fffe8949e80bc9bacdcc726a4b56283dd68568bc8e20fcba298814a89e

Download Submit
\Windows\system\ELjoWTu.exe

Filesize
2.2MB

MD5
0fa330d494c788969dd2b2fe4d44476e

SHA1
a6e4750f33232841b967808371e3f7a2b3045b11

SHA256
1269a3e07680f846de093a8a36a5195473ce34ca94992dd84fae0e6f545906e5

SHA512
31ae6e6b066a92867a0103ed21c1b229e17e1a1c98b1ab03a33f07b3952d656f0081ae81015ce8a7afe1b5554055d1590c448d05b7b698f600d4a43b4cb9b762

Download Submit
\Windows\system\Gpipfuw.exe

Filesize
2.2MB

MD5
14d2dbab44df13c20b6069d1c2da91bf

SHA1
2dc7409864ab8b4ad384eb5096226dd292e3af6b

SHA256
ab4ff56986edb081903659b603c31de3fb8dd567d7b9fe7d2a30f6e4e0d2e3b0

SHA512
4b832631d73871adffa3a32a65cb89ded72cc5f4120212cccf112aeb4563e81ac3dfadcca5f5b8d37328e8879e8b89c9f32f7a310f310a04804415ca1a12b901

Download Submit
\Windows\system\LRouNtt.exe

Filesize
2.2MB

MD5
0eeac0ead4d7ac317ac81f9f503013c2

SHA1
4897f25f61a94d633f1a9a03f16c7b648bb529e4

SHA256
5a4842e30155e49ed12ec3e26bf0adb6abf04480f3ef379896e82b08792f6097

SHA512
580a304266b3cf250999aeda2d3f815e2ca783ba610ec3e94b56b2f5ba968e058bc2174abeecc38509051cbc3d41287dc8d3803330be18e28e3da6e833ead05a

Download Submit
\Windows\system\ThaiaYv.exe

Filesize
2.2MB

MD5
71c045a34b6fadb243a8672521d444ba

SHA1
9beab468a7d0968644ee51e3307251af08822491

SHA256
2f10ee4d604dffd7c9b9583e6c0c6471dd577bb4df58483bef26befcb5ccf1d2

SHA512
8fac42bb1b09288a0d1b0315a37f22acd09c090ef960d721c9f62c4625b2d8fc4339882677ca4f15c22361d55baece074c93f47c8d17e7cc6ff3aed41e81582b

Download Submit
\Windows\system\UXLVbJp.exe

Filesize
2.2MB

MD5
e98e8fe6eeaeb27673fd1367945396d3

SHA1
a2a154ebda10aae2f8ff5b077ae62f2a8357ad51

SHA256
4409826fd76728203d3773a0a6d5d4b4792226a7967a2fd38d1ee2fecf60a114

SHA512
b25b243eb6dd9477957b3d3770dff47c89c8366637edeb500da682db2075dd2855f60cc272f6f2f33b82646757e3caa9d20558bf0b1e7c7bc28cd82a6224a393

Download Submit
\Windows\system\cVpNyDH.exe

Filesize
2.2MB

MD5
9dd52e62ed4ae33245fbdff2559d882a

SHA1
c7c18a54792f54b7d36d88e9af018d5a2800774a

SHA256
46a5b85f2af0c8202c328b8c06881574d34bb00860642e9db98e71c007eca49b

SHA512
13a0875ac6ccefc2a2bbb63dc9410756729060c7dab129a9f2113cb4e35f7a32b030fde3e0d548a7626af91b724cfce225347bd10ec77726e5c4c0d90b50459d

Download Submit
\Windows\system\fAhsDRv.exe

Filesize
2.2MB

MD5
1afc991cb8cfdb10f8e3f3959ab7c9a0

SHA1
8d27b76af3bac2df5913a55e95f6914dcf581141

SHA256
815bb7c2f562804541980794a17905f613d60c2b72e5fa7b0091c7d7d09e2183

SHA512
e0e10ae9160214c4e04b982fc29ecb7484fc20d2c842720ca953187657871402d578ad49dbf4e006f53458120f8ca4d5baa8bc673a009a8ade69f6d201823729

Download Submit
\Windows\system\gKokHuy.exe

Filesize
2.2MB

MD5
f91397aa5ef334aa5da347a8a0d0642c

SHA1
4b15804ff7b16e0d55d8dcc648bfb0be99531e80

SHA256
868737397d72a8242595f29ed782256bc9326c3a7b151776209a8409dff82e32

SHA512
08202eb54315dcda8546ef3eca5e0dae03dc2c972b14ac65598dae383adde44bec28233225455db9d14de0f0a8ad8af7de4a0e0b22f4cde5036adee2b8a4218c

Download Submit
\Windows\system\iMFBzaH.exe

Filesize
2.2MB

MD5
d4a30b6ecc80944f25af1e23315ba32c

SHA1
ac87b08939f3a847d81d2f4cc9f56ec19f98a30f

SHA256
23716830aa88c1d58958f28b467bdafa26e187db96d9922d2e9c494efad67c45

SHA512
559644c3aead450f181a5c6404ed402cf14358210fbdb77314d9e78afe38a046fe00c6ce68e5cf43a4eb0b6890d4a13d128a38b8fe729960a768419d597f85de

Download Submit
\Windows\system\kCJjxiv.exe

Filesize
2.2MB

MD5
d4dcb2915ef210d5969f3238fa7d48dc

SHA1
c4dd82f8a0a13c765645bda1f112bf3cd2c21021

SHA256
f3fe2d7eff95b5afd6833c2b69eedb83824fac44cbdad8598a8b644d8b0fc294

SHA512
ca06caa2b3f81711851c2b06e87ae3eaf7620bba059c317b9e296614595639c1c8e93863bd588ca2d84171464ddf688703444f63d2b95714e254ed57de3ef3aa

Download Submit
\Windows\system\wACQipI.exe

Filesize
2.2MB

MD5
a2b76d4216d5e65b743a9c87abf43bb2

SHA1
1e892ef1b57110ebb8d4bbd7ffdabeab02cd605d

SHA256
8066679f48406fdc216ba2be28c57e13dd05e230336a7389e180cfb705fae863

SHA512
ff9585746c529cd0c391489f0c01b3726f857dfad9896fc9b70c784194c11378e651025ff96d6f9a6fcbf0533ff4d8cccf09f0c3184a06b1a749e98a33375f9b

Download Submit
\Windows\system\yoiCWcC.exe

Filesize
2.2MB

MD5
ac4b7cf7a6989bf797249496d6c85f15

SHA1
469a500dbbc35b61225dfa53c4f8fd4e49f7293a

SHA256
0d3b75798ce0432d8b390dc45fef6ba098c1d5733399f0fac9ff3a44baf42791

SHA512
d212360273a418bda246c9897634dc8cac1fc943ebaec96bcc268b404728619f73bb5fe78bfb4562a7fa72a7ea1ca8c61d0bc046b50e80419537a14fd4770c9c

Download Submit
\Windows\system\zLFdrYn.exe

Filesize
2.2MB

MD5
681c5a0cac2f26880be90837d5461e2f

SHA1
b0ca8eba06a58aa3ccc082ce1a6ebcf7c76267cc

SHA256
4411e3aaf1ad06b699d8e0ba656924a5c698f4cc9a1a8ef3679e0c48f9d17309

SHA512
403763369651f3416afe4dbb12536268a1b8bff350046a03fc193e2c5fcf9b59c82a1a1f4affa629a4e5b5e5bd5752051ae1df4867678f49fe2aed82a9cffb89

Download Submit
memory/1640-105-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/1640-5755-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/1772-4225-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download
memory/1772-88-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/1772-0-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/1772-47-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/1772-62-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download
memory/1772-11917-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download
memory/1772-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1772-1690-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download
memory/1772-15-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/1772-92-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/1772-35-0x0000000003180000-0x0000000003572000-memory.dmp

Filesize
3.9MB

Download
memory/1772-38-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/1772-32-0x0000000003180000-0x0000000003572000-memory.dmp

Filesize
3.9MB

Download
memory/1772-39-0x0000000003180000-0x0000000003572000-memory.dmp

Filesize
3.9MB

Download
memory/1772-55-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download
memory/1772-392-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/1772-99-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/1772-89-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download
memory/2236-84-0x00000000022E0000-0x00000000022E8000-memory.dmp

Filesize
32KB

Download
memory/2236-65-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/2476-4252-0x000000013F3C0000-0x000000013F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-58-0x000000013F3C0000-0x000000013F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-60-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-5760-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-33-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-5773-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-36-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-5754-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-46-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2656-5745-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2684-48-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2684-5780-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2860-85-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-5749-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-5774-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-45-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/3020-40-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/3020-5727-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download