xmrig | 7cda03aee5e2a083f1e32a7f50fa420c1845a86f4765d0679a9e85cc0afb6b18

Analysis

max time kernel
149s
max time network
142s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
Size

1.8MB
MD5

343cf504842fbb5d313c498948ea1e07
SHA1

fd5a9bcb23c94d4e27779bd3b9ab92eb9e8ebd82
SHA256

7cda03aee5e2a083f1e32a7f50fa420c1845a86f4765d0679a9e85cc0afb6b18
SHA512

ae91a6c2617c0f106ecefc4cf0e9bef9b24920091282667f8c651d365002015048bf68e8891fd21dbf0ad722f9d486e20b85e526ec3937017505a1632e297154
SSDEEP

49152:Lz071uv4BPMkibTIA5I4TNrpDGgDQNmASO:NABf

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2572-147-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2364-157-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/3024-155-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	xmrig
behavioral1/memory/3008-154-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/2336-152-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/1964-142-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2536-141-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/2644-139-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/2920-137-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2808-135-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/2636-132-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/3008-4841-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/1964-4877-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/3024-4882-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	xmrig
behavioral1/memory/2636-4916-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/2644-4915-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/2336-5024-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/2808-5025-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/2688-5046-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2572-5047-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2536-5145-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/2364-5151-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2920-5161-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2352 powershell.exe

pid	process
2352	powershell.exe

Executes dropped EXE 64 IoCs

Processes:

uoASHgz.exeqKxWYPY.exeuytARWD.exejKyQlUv.exemwkOquV.exerjgVTdo.exeoohzAbi.exesLBqueg.exezpsjUKq.exerUscBiV.exeygvfOMX.exeTwsTQaF.exeHdEwHnT.exeCNUjKay.exeIKCYOQQ.exesnrjugz.exewssvXKj.exeDmJhQEN.exeTVkXSYK.exeQsyPrrQ.exeimZexha.exefCLvqlx.exeufXZBZX.exeEPtfgda.exeMlWVhKV.exepszyQTI.exevkLXNle.exeOkVicsc.exeHHRvKYw.exeusXWagA.exeUxsSKAc.exemPDwRBI.exesadNwUc.exeHLCVQEE.exeHAzxtju.exezMZHHBf.exeRgfUZym.exeCtKBNZN.exeVKPIVuC.exepYzJzNU.exeYiUxwrM.exeWhkxBPp.exeyQKoYqQ.exeFJKXGlG.exezlUTIPt.exeGycXLDT.exeRVBFNQP.exeZlsLUqJ.exeYOuQFQk.exeApNtkXF.exeEtLVhuF.exehQJwELu.exerWBKUOK.exeHvoizCM.exenFfAIyq.exeKFoAsar.exemAzBIBb.exeMjQOItX.exelbAKsbl.exeGIKFfDd.exejGzGfER.exeeOREytb.exefljDIok.exeSmJCyKR.exe

pid	process
2688	uoASHgz.exe
2364	qKxWYPY.exe
2636	uytARWD.exe
2808	jKyQlUv.exe
2920	mwkOquV.exe
2644	rjgVTdo.exe
2536	oohzAbi.exe
1964	sLBqueg.exe
2572	zpsjUKq.exe
2336	rUscBiV.exe
3008	ygvfOMX.exe
3024	TwsTQaF.exe
2700	HdEwHnT.exe
2876	CNUjKay.exe
2880	IKCYOQQ.exe
1060	snrjugz.exe
2996	wssvXKj.exe
1320	DmJhQEN.exe
1632	TVkXSYK.exe
2320	QsyPrrQ.exe
1444	imZexha.exe
1432	fCLvqlx.exe
2708	ufXZBZX.exe
2472	EPtfgda.exe
1744	MlWVhKV.exe
2936	pszyQTI.exe
484	vkLXNle.exe
1324	OkVicsc.exe
2396	HHRvKYw.exe
1516	usXWagA.exe
1036	UxsSKAc.exe
2384	mPDwRBI.exe
1528	sadNwUc.exe
1524	HLCVQEE.exe
952	HAzxtju.exe
1940	zMZHHBf.exe
1976	RgfUZym.exe
1620	CtKBNZN.exe
1772	VKPIVuC.exe
2064	pYzJzNU.exe
1596	YiUxwrM.exe
2192	WhkxBPp.exe
1192	yQKoYqQ.exe
572	FJKXGlG.exe
1696	zlUTIPt.exe
2600	GycXLDT.exe
2292	RVBFNQP.exe
2208	ZlsLUqJ.exe
2512	YOuQFQk.exe
860	ApNtkXF.exe
1936	EtLVhuF.exe
2980	hQJwELu.exe
1848	rWBKUOK.exe
1768	HvoizCM.exe
1056	nFfAIyq.exe
2576	KFoAsar.exe
1132	mAzBIBb.exe
332	MjQOItX.exe
1016	lbAKsbl.exe
992	GIKFfDd.exe
1992	jGzGfER.exe
1040	eOREytb.exe
2964	fljDIok.exe
1688	SmJCyKR.exe

Loads dropped DLL 64 IoCs

Processes:

343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe

pid	process
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1232-0-0x000000013FC30000-0x0000000140022000-memory.dmp	upx
\Windows\system\uoASHgz.exe	upx
\Windows\system\qKxWYPY.exe	upx
C:\Windows\system\uytARWD.exe	upx
C:\Windows\system\jKyQlUv.exe	upx
C:\Windows\system\rjgVTdo.exe	upx
C:\Windows\system\zpsjUKq.exe	upx
C:\Windows\system\rUscBiV.exe	upx
C:\Windows\system\mwkOquV.exe	upx
C:\Windows\system\HdEwHnT.exe	upx
C:\Windows\system\wssvXKj.exe	upx
C:\Windows\system\imZexha.exe	upx
C:\Windows\system\ufXZBZX.exe	upx
behavioral1/memory/2572-147-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
\Windows\system\MlWVhKV.exe	upx
\Windows\system\vkLXNle.exe	upx
C:\Windows\system\usXWagA.exe	upx
C:\Windows\system\mPDwRBI.exe	upx
\Windows\system\UxsSKAc.exe	upx
behavioral1/memory/2364-157-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/3024-155-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx
behavioral1/memory/3008-154-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/memory/2336-152-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
\Windows\system\HHRvKYw.exe	upx
behavioral1/memory/1964-142-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/2536-141-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/memory/2644-139-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/memory/2920-137-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/2808-135-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/memory/2636-132-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
C:\Windows\system\OkVicsc.exe	upx
C:\Windows\system\EPtfgda.exe	upx
C:\Windows\system\pszyQTI.exe	upx
C:\Windows\system\fCLvqlx.exe	upx
C:\Windows\system\QsyPrrQ.exe	upx
C:\Windows\system\DmJhQEN.exe	upx
C:\Windows\system\TVkXSYK.exe	upx
C:\Windows\system\snrjugz.exe	upx
C:\Windows\system\IKCYOQQ.exe	upx
C:\Windows\system\CNUjKay.exe	upx
C:\Windows\system\TwsTQaF.exe	upx
C:\Windows\system\ygvfOMX.exe	upx
C:\Windows\system\sLBqueg.exe	upx
C:\Windows\system\oohzAbi.exe	upx
behavioral1/memory/2688-16-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/3008-4841-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/memory/1964-4877-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/3024-4882-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx
behavioral1/memory/2636-4916-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/memory/2644-4915-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/memory/2336-5024-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/memory/2808-5025-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/memory/2688-5046-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2572-5047-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/memory/2536-5145-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/memory/2364-5151-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/2920-5161-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

Processes:

343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\System\IQKKhIz.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\nKXQthU.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\zASMNZt.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\utiwVrt.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\NrNjBuH.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\XpdGGeR.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\dCXkRGU.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\AyMaDNF.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\NrFwgsM.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\AiTDoGM.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\xVdtbMs.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\LAeAgXb.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\ZuVSCOx.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\gxFLnQY.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\sTYvLHR.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\tVloXZy.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\krGLTsz.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\mXQCBFB.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\uChXxge.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\dbVhkiU.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\uNsufDK.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\LYqqYio.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\uAHFrKv.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\NrVQJqG.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\PXAXlVk.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\ngHIZMF.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\WLowXDG.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\tMhOYhF.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\afAYKNZ.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\WVeKdmD.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\dEYRlrx.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\ujwzIOb.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\VJszfQX.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\QShasIS.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\tSqxCXc.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\VSQbNGo.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\grjBeKn.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\NltFaBI.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\MiLRwKc.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\iCKlHkL.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\bIebKOI.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\BDhGFyB.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\ofpVOAg.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\JmIXKbs.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\RStYiMy.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\SWfqUMz.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\hueTnlZ.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\HdkEyVI.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\fafkPDD.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\NICQSqo.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\FRidZqF.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\tBNvbCs.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\mhdEJeY.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\yHXVjUw.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\aBoHeIx.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\aiICykU.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\ZTWwkfg.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\DOYuRQd.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\UNmZcYg.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\teeuDQd.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\tClRKiY.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\zPlHyfs.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\JtnpYky.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
File created	C:\Windows\System\IbzLkOA.exe	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2352 powershell.exe

pid	process
2352	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exepowershell.exe

description	pid	process
Token: SeLockMemoryPrivilege	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
Token: SeDebugPrivilege	2352	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe

description	pid	process	target process
PID 1232 wrote to memory of 2352	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	powershell.exe
PID 1232 wrote to memory of 2352	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	powershell.exe
PID 1232 wrote to memory of 2352	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	powershell.exe
PID 1232 wrote to memory of 2688	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	uoASHgz.exe
PID 1232 wrote to memory of 2688	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	uoASHgz.exe
PID 1232 wrote to memory of 2688	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	uoASHgz.exe
PID 1232 wrote to memory of 2364	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	qKxWYPY.exe
PID 1232 wrote to memory of 2364	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	qKxWYPY.exe
PID 1232 wrote to memory of 2364	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	qKxWYPY.exe
PID 1232 wrote to memory of 2636	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	uytARWD.exe
PID 1232 wrote to memory of 2636	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	uytARWD.exe
PID 1232 wrote to memory of 2636	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	uytARWD.exe
PID 1232 wrote to memory of 2920	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	mwkOquV.exe
PID 1232 wrote to memory of 2920	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	mwkOquV.exe
PID 1232 wrote to memory of 2920	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	mwkOquV.exe
PID 1232 wrote to memory of 2808	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	jKyQlUv.exe
PID 1232 wrote to memory of 2808	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	jKyQlUv.exe
PID 1232 wrote to memory of 2808	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	jKyQlUv.exe
PID 1232 wrote to memory of 2536	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	oohzAbi.exe
PID 1232 wrote to memory of 2536	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	oohzAbi.exe
PID 1232 wrote to memory of 2536	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	oohzAbi.exe
PID 1232 wrote to memory of 2644	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	rjgVTdo.exe
PID 1232 wrote to memory of 2644	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	rjgVTdo.exe
PID 1232 wrote to memory of 2644	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	rjgVTdo.exe
PID 1232 wrote to memory of 1964	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	sLBqueg.exe
PID 1232 wrote to memory of 1964	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	sLBqueg.exe
PID 1232 wrote to memory of 1964	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	sLBqueg.exe
PID 1232 wrote to memory of 2572	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	zpsjUKq.exe
PID 1232 wrote to memory of 2572	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	zpsjUKq.exe
PID 1232 wrote to memory of 2572	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	zpsjUKq.exe
PID 1232 wrote to memory of 3008	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	ygvfOMX.exe
PID 1232 wrote to memory of 3008	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	ygvfOMX.exe
PID 1232 wrote to memory of 3008	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	ygvfOMX.exe
PID 1232 wrote to memory of 2336	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	rUscBiV.exe
PID 1232 wrote to memory of 2336	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	rUscBiV.exe
PID 1232 wrote to memory of 2336	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	rUscBiV.exe
PID 1232 wrote to memory of 3024	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	TwsTQaF.exe
PID 1232 wrote to memory of 3024	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	TwsTQaF.exe
PID 1232 wrote to memory of 3024	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	TwsTQaF.exe
PID 1232 wrote to memory of 2700	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	HdEwHnT.exe
PID 1232 wrote to memory of 2700	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	HdEwHnT.exe
PID 1232 wrote to memory of 2700	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	HdEwHnT.exe
PID 1232 wrote to memory of 2876	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	CNUjKay.exe
PID 1232 wrote to memory of 2876	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	CNUjKay.exe
PID 1232 wrote to memory of 2876	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	CNUjKay.exe
PID 1232 wrote to memory of 2880	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	IKCYOQQ.exe
PID 1232 wrote to memory of 2880	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	IKCYOQQ.exe
PID 1232 wrote to memory of 2880	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	IKCYOQQ.exe
PID 1232 wrote to memory of 1060	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	snrjugz.exe
PID 1232 wrote to memory of 1060	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	snrjugz.exe
PID 1232 wrote to memory of 1060	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	snrjugz.exe
PID 1232 wrote to memory of 2996	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	wssvXKj.exe
PID 1232 wrote to memory of 2996	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	wssvXKj.exe
PID 1232 wrote to memory of 2996	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	wssvXKj.exe
PID 1232 wrote to memory of 1320	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	DmJhQEN.exe
PID 1232 wrote to memory of 1320	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	DmJhQEN.exe
PID 1232 wrote to memory of 1320	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	DmJhQEN.exe
PID 1232 wrote to memory of 1632	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	TVkXSYK.exe
PID 1232 wrote to memory of 1632	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	TVkXSYK.exe
PID 1232 wrote to memory of 1632	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	TVkXSYK.exe
PID 1232 wrote to memory of 2320	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	QsyPrrQ.exe
PID 1232 wrote to memory of 2320	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	QsyPrrQ.exe
PID 1232 wrote to memory of 2320	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	QsyPrrQ.exe
PID 1232 wrote to memory of 1444	1232	343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe	imZexha.exe

C:\Users\Admin\AppData\Local\Temp\343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\343cf504842fbb5d313c498948ea1e07_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\Windows\System\uoASHgz.exe
C:\Windows\System\uoASHgz.exe
2⤵
- Executes dropped EXE
PID:2688

C:\Windows\System\qKxWYPY.exe
C:\Windows\System\qKxWYPY.exe
2⤵
- Executes dropped EXE
PID:2364

C:\Windows\System\uytARWD.exe
C:\Windows\System\uytARWD.exe
2⤵
- Executes dropped EXE
PID:2636

C:\Windows\System\mwkOquV.exe
C:\Windows\System\mwkOquV.exe
2⤵
- Executes dropped EXE
PID:2920

C:\Windows\System\jKyQlUv.exe
C:\Windows\System\jKyQlUv.exe
2⤵
- Executes dropped EXE
PID:2808

C:\Windows\System\oohzAbi.exe
C:\Windows\System\oohzAbi.exe
2⤵
- Executes dropped EXE
PID:2536

C:\Windows\System\rjgVTdo.exe
C:\Windows\System\rjgVTdo.exe
2⤵
- Executes dropped EXE
PID:2644

C:\Windows\System\sLBqueg.exe
C:\Windows\System\sLBqueg.exe
2⤵
- Executes dropped EXE
PID:1964

C:\Windows\System\zpsjUKq.exe
C:\Windows\System\zpsjUKq.exe
2⤵
- Executes dropped EXE
PID:2572

C:\Windows\System\ygvfOMX.exe
C:\Windows\System\ygvfOMX.exe
2⤵
- Executes dropped EXE
PID:3008

C:\Windows\System\rUscBiV.exe
C:\Windows\System\rUscBiV.exe
2⤵
- Executes dropped EXE
PID:2336

C:\Windows\System\TwsTQaF.exe
C:\Windows\System\TwsTQaF.exe
2⤵
- Executes dropped EXE
PID:3024

C:\Windows\System\HdEwHnT.exe
C:\Windows\System\HdEwHnT.exe
2⤵
- Executes dropped EXE
PID:2700

C:\Windows\System\CNUjKay.exe
C:\Windows\System\CNUjKay.exe
2⤵
- Executes dropped EXE
PID:2876

C:\Windows\System\IKCYOQQ.exe
C:\Windows\System\IKCYOQQ.exe
2⤵
- Executes dropped EXE
PID:2880

C:\Windows\System\snrjugz.exe
C:\Windows\System\snrjugz.exe
2⤵
- Executes dropped EXE
PID:1060

C:\Windows\System\wssvXKj.exe
C:\Windows\System\wssvXKj.exe
2⤵
- Executes dropped EXE
PID:2996

C:\Windows\System\DmJhQEN.exe
C:\Windows\System\DmJhQEN.exe
2⤵
- Executes dropped EXE
PID:1320

C:\Windows\System\TVkXSYK.exe
C:\Windows\System\TVkXSYK.exe
2⤵
- Executes dropped EXE
PID:1632

C:\Windows\System\QsyPrrQ.exe
C:\Windows\System\QsyPrrQ.exe
2⤵
- Executes dropped EXE
PID:2320

C:\Windows\System\imZexha.exe
C:\Windows\System\imZexha.exe
2⤵
- Executes dropped EXE
PID:1444

C:\Windows\System\fCLvqlx.exe
C:\Windows\System\fCLvqlx.exe
2⤵
- Executes dropped EXE
PID:1432

C:\Windows\System\ufXZBZX.exe
C:\Windows\System\ufXZBZX.exe
2⤵
- Executes dropped EXE
PID:2708

C:\Windows\System\EPtfgda.exe
C:\Windows\System\EPtfgda.exe
2⤵
- Executes dropped EXE
PID:2472

C:\Windows\System\MlWVhKV.exe
C:\Windows\System\MlWVhKV.exe
2⤵
- Executes dropped EXE
PID:1744

C:\Windows\System\HHRvKYw.exe
C:\Windows\System\HHRvKYw.exe
2⤵
- Executes dropped EXE
PID:2396

C:\Windows\System\pszyQTI.exe
C:\Windows\System\pszyQTI.exe
2⤵
- Executes dropped EXE
PID:2936

C:\Windows\System\usXWagA.exe
C:\Windows\System\usXWagA.exe
2⤵
- Executes dropped EXE
PID:1516

C:\Windows\System\vkLXNle.exe
C:\Windows\System\vkLXNle.exe
2⤵
- Executes dropped EXE
PID:484

C:\Windows\System\UxsSKAc.exe
C:\Windows\System\UxsSKAc.exe
2⤵
- Executes dropped EXE
PID:1036

C:\Windows\System\OkVicsc.exe
C:\Windows\System\OkVicsc.exe
2⤵
- Executes dropped EXE
PID:1324

C:\Windows\System\mPDwRBI.exe
C:\Windows\System\mPDwRBI.exe
2⤵
- Executes dropped EXE
PID:2384

C:\Windows\System\sadNwUc.exe
C:\Windows\System\sadNwUc.exe
2⤵
- Executes dropped EXE
PID:1528

C:\Windows\System\HLCVQEE.exe
C:\Windows\System\HLCVQEE.exe
2⤵
- Executes dropped EXE
PID:1524

C:\Windows\System\HAzxtju.exe
C:\Windows\System\HAzxtju.exe
2⤵
- Executes dropped EXE
PID:952

C:\Windows\System\zMZHHBf.exe
C:\Windows\System\zMZHHBf.exe
2⤵
- Executes dropped EXE
PID:1940

C:\Windows\System\RgfUZym.exe
C:\Windows\System\RgfUZym.exe
2⤵
- Executes dropped EXE
PID:1976

C:\Windows\System\jGzGfER.exe
C:\Windows\System\jGzGfER.exe
2⤵
- Executes dropped EXE
PID:1992

C:\Windows\System\CtKBNZN.exe
C:\Windows\System\CtKBNZN.exe
2⤵
- Executes dropped EXE
PID:1620

C:\Windows\System\eOREytb.exe
C:\Windows\System\eOREytb.exe
2⤵
- Executes dropped EXE
PID:1040

C:\Windows\System\VKPIVuC.exe
C:\Windows\System\VKPIVuC.exe
2⤵
- Executes dropped EXE
PID:1772

C:\Windows\System\fljDIok.exe
C:\Windows\System\fljDIok.exe
2⤵
- Executes dropped EXE
PID:2964

C:\Windows\System\pYzJzNU.exe
C:\Windows\System\pYzJzNU.exe
2⤵
- Executes dropped EXE
PID:2064

C:\Windows\System\SmJCyKR.exe
C:\Windows\System\SmJCyKR.exe
2⤵
- Executes dropped EXE
PID:1688

C:\Windows\System\YiUxwrM.exe
C:\Windows\System\YiUxwrM.exe
2⤵
- Executes dropped EXE
PID:1596

C:\Windows\System\YYkZxub.exe
C:\Windows\System\YYkZxub.exe
2⤵
PID:2328

C:\Windows\System\WhkxBPp.exe
C:\Windows\System\WhkxBPp.exe
2⤵
- Executes dropped EXE
PID:2192

C:\Windows\System\MVxEIZj.exe
C:\Windows\System\MVxEIZj.exe
2⤵
PID:888

C:\Windows\System\yQKoYqQ.exe
C:\Windows\System\yQKoYqQ.exe
2⤵
- Executes dropped EXE
PID:1192

C:\Windows\System\nLmbIgx.exe
C:\Windows\System\nLmbIgx.exe
2⤵
PID:2444

C:\Windows\System\FJKXGlG.exe
C:\Windows\System\FJKXGlG.exe
2⤵
- Executes dropped EXE
PID:572

C:\Windows\System\bXRoxLm.exe
C:\Windows\System\bXRoxLm.exe
2⤵
PID:2096

C:\Windows\System\zlUTIPt.exe
C:\Windows\System\zlUTIPt.exe
2⤵
- Executes dropped EXE
PID:1696

C:\Windows\System\rCLcFbX.exe
C:\Windows\System\rCLcFbX.exe
2⤵
PID:1588

C:\Windows\System\GycXLDT.exe
C:\Windows\System\GycXLDT.exe
2⤵
- Executes dropped EXE
PID:2600

C:\Windows\System\uyIJWeJ.exe
C:\Windows\System\uyIJWeJ.exe
2⤵
PID:2768

C:\Windows\System\RVBFNQP.exe
C:\Windows\System\RVBFNQP.exe
2⤵
- Executes dropped EXE
PID:2292

C:\Windows\System\mNPqZwM.exe
C:\Windows\System\mNPqZwM.exe
2⤵
PID:2832

C:\Windows\System\ZlsLUqJ.exe
C:\Windows\System\ZlsLUqJ.exe
2⤵
- Executes dropped EXE
PID:2208

C:\Windows\System\MxElCWh.exe
C:\Windows\System\MxElCWh.exe
2⤵
PID:2804

C:\Windows\System\YOuQFQk.exe
C:\Windows\System\YOuQFQk.exe
2⤵
- Executes dropped EXE
PID:2512

C:\Windows\System\YIiFNDg.exe
C:\Windows\System\YIiFNDg.exe
2⤵
PID:2796

C:\Windows\System\ApNtkXF.exe
C:\Windows\System\ApNtkXF.exe
2⤵
- Executes dropped EXE
PID:860

C:\Windows\System\gAIxueL.exe
C:\Windows\System\gAIxueL.exe
2⤵
PID:2728

C:\Windows\System\EtLVhuF.exe
C:\Windows\System\EtLVhuF.exe
2⤵
- Executes dropped EXE
PID:1936

C:\Windows\System\opzHILR.exe
C:\Windows\System\opzHILR.exe
2⤵
PID:2864

C:\Windows\System\hQJwELu.exe
C:\Windows\System\hQJwELu.exe
2⤵
- Executes dropped EXE
PID:2980

C:\Windows\System\DiWTYZt.exe
C:\Windows\System\DiWTYZt.exe
2⤵
PID:1256

C:\Windows\System\rWBKUOK.exe
C:\Windows\System\rWBKUOK.exe
2⤵
- Executes dropped EXE
PID:1848

C:\Windows\System\YtOmXvj.exe
C:\Windows\System\YtOmXvj.exe
2⤵
PID:1944

C:\Windows\System\HvoizCM.exe
C:\Windows\System\HvoizCM.exe
2⤵
- Executes dropped EXE
PID:1768

C:\Windows\System\qVCEGnR.exe
C:\Windows\System\qVCEGnR.exe
2⤵
PID:2824

C:\Windows\System\nFfAIyq.exe
C:\Windows\System\nFfAIyq.exe
2⤵
- Executes dropped EXE
PID:1056

C:\Windows\System\NpXnqBX.exe
C:\Windows\System\NpXnqBX.exe
2⤵
PID:1576

C:\Windows\System\KFoAsar.exe
C:\Windows\System\KFoAsar.exe
2⤵
- Executes dropped EXE
PID:2576

C:\Windows\System\tbtrDwi.exe
C:\Windows\System\tbtrDwi.exe
2⤵
PID:1280

C:\Windows\System\mAzBIBb.exe
C:\Windows\System\mAzBIBb.exe
2⤵
- Executes dropped EXE
PID:1132

C:\Windows\System\yRhnFUU.exe
C:\Windows\System\yRhnFUU.exe
2⤵
PID:2380

C:\Windows\System\MjQOItX.exe
C:\Windows\System\MjQOItX.exe
2⤵
- Executes dropped EXE
PID:332

C:\Windows\System\tnzsHho.exe
C:\Windows\System\tnzsHho.exe
2⤵
PID:1840

C:\Windows\System\lbAKsbl.exe
C:\Windows\System\lbAKsbl.exe
2⤵
- Executes dropped EXE
PID:1016

C:\Windows\System\HUMSBQt.exe
C:\Windows\System\HUMSBQt.exe
2⤵
PID:2112

C:\Windows\System\GIKFfDd.exe
C:\Windows\System\GIKFfDd.exe
2⤵
- Executes dropped EXE
PID:992

C:\Windows\System\mmfpdji.exe
C:\Windows\System\mmfpdji.exe
2⤵
PID:2412

C:\Windows\System\CUrLHZO.exe
C:\Windows\System\CUrLHZO.exe
2⤵
PID:1268

C:\Windows\System\CJqlXFq.exe
C:\Windows\System\CJqlXFq.exe
2⤵
PID:2160

C:\Windows\System\TeCbPpX.exe
C:\Windows\System\TeCbPpX.exe
2⤵
PID:2264

C:\Windows\System\oPGmoVh.exe
C:\Windows\System\oPGmoVh.exe
2⤵
PID:604

C:\Windows\System\XBLTcmS.exe
C:\Windows\System\XBLTcmS.exe
2⤵
PID:1148

C:\Windows\System\ZsDnrBk.exe
C:\Windows\System\ZsDnrBk.exe
2⤵
PID:1316

C:\Windows\System\nhcPjLl.exe
C:\Windows\System\nhcPjLl.exe
2⤵
PID:1804

C:\Windows\System\pnjbQGm.exe
C:\Windows\System\pnjbQGm.exe
2⤵
PID:2680

C:\Windows\System\DaugjTF.exe
C:\Windows\System\DaugjTF.exe
2⤵
PID:1708

C:\Windows\System\ZsLaHie.exe
C:\Windows\System\ZsLaHie.exe
2⤵
PID:1660

C:\Windows\System\pMyDswg.exe
C:\Windows\System\pMyDswg.exe
2⤵
PID:2260

C:\Windows\System\TtXcWcj.exe
C:\Windows\System\TtXcWcj.exe
2⤵
PID:2904

C:\Windows\System\mZFZQyB.exe
C:\Windows\System\mZFZQyB.exe
2⤵
PID:2080

C:\Windows\System\fNrcjNY.exe
C:\Windows\System\fNrcjNY.exe
2⤵
PID:2524

C:\Windows\System\oBlHiqU.exe
C:\Windows\System\oBlHiqU.exe
2⤵
PID:2608

C:\Windows\System\dpQRfbp.exe
C:\Windows\System\dpQRfbp.exe
2⤵
PID:2020

C:\Windows\System\cCueRGG.exe
C:\Windows\System\cCueRGG.exe
2⤵
PID:2024

C:\Windows\System\wlVVsQU.exe
C:\Windows\System\wlVVsQU.exe
2⤵
PID:2448

C:\Windows\System\WqSxkLk.exe
C:\Windows\System\WqSxkLk.exe
2⤵
PID:1384

C:\Windows\System\qAIZQOK.exe
C:\Windows\System\qAIZQOK.exe
2⤵
PID:1152

C:\Windows\System\PrNQYIX.exe
C:\Windows\System\PrNQYIX.exe
2⤵
PID:2764

C:\Windows\System\FkbrJEJ.exe
C:\Windows\System\FkbrJEJ.exe
2⤵
PID:1308

C:\Windows\System\DHIqmHS.exe
C:\Windows\System\DHIqmHS.exe
2⤵
PID:1540

C:\Windows\System\KdhtUqO.exe
C:\Windows\System\KdhtUqO.exe
2⤵
PID:916

C:\Windows\System\okGogur.exe
C:\Windows\System\okGogur.exe
2⤵
PID:1052

C:\Windows\System\gobsDdV.exe
C:\Windows\System\gobsDdV.exe
2⤵
PID:2388

C:\Windows\System\mJLIZTr.exe
C:\Windows\System\mJLIZTr.exe
2⤵
PID:872

C:\Windows\System\IeFoTox.exe
C:\Windows\System\IeFoTox.exe
2⤵
PID:1816

C:\Windows\System\sJfEaCc.exe
C:\Windows\System\sJfEaCc.exe
2⤵
PID:1624

C:\Windows\System\RELmnkk.exe
C:\Windows\System\RELmnkk.exe
2⤵
PID:776

C:\Windows\System\qeeAKlU.exe
C:\Windows\System\qeeAKlU.exe
2⤵
PID:2312

C:\Windows\System\GoLPsCK.exe
C:\Windows\System\GoLPsCK.exe
2⤵
PID:2092

C:\Windows\System\fRGDjqa.exe
C:\Windows\System\fRGDjqa.exe
2⤵
PID:2896

C:\Windows\System\LjbbImW.exe
C:\Windows\System\LjbbImW.exe
2⤵
PID:1972

C:\Windows\System\qReccNY.exe
C:\Windows\System\qReccNY.exe
2⤵
PID:1980

C:\Windows\System\kGYRRyv.exe
C:\Windows\System\kGYRRyv.exe
2⤵
PID:1728

C:\Windows\System\XpVyKJg.exe
C:\Windows\System\XpVyKJg.exe
2⤵
PID:844

C:\Windows\System\jDxbfLJ.exe
C:\Windows\System\jDxbfLJ.exe
2⤵
PID:1248

C:\Windows\System\bMhUwwP.exe
C:\Windows\System\bMhUwwP.exe
2⤵
PID:2860

C:\Windows\System\lDwozdr.exe
C:\Windows\System\lDwozdr.exe
2⤵
PID:2752

C:\Windows\System\ibYqVml.exe
C:\Windows\System\ibYqVml.exe
2⤵
PID:764

C:\Windows\System\czsNiiP.exe
C:\Windows\System\czsNiiP.exe
2⤵
PID:1952

C:\Windows\System\sPLkpae.exe
C:\Windows\System\sPLkpae.exe
2⤵
PID:2592

C:\Windows\System\pDrIMXf.exe
C:\Windows\System\pDrIMXf.exe
2⤵
PID:1800

C:\Windows\System\jmvqnPk.exe
C:\Windows\System\jmvqnPk.exe
2⤵
PID:2692

C:\Windows\System\qnqARNF.exe
C:\Windows\System\qnqARNF.exe
2⤵
PID:2628

C:\Windows\System\XIoxoeL.exe
C:\Windows\System\XIoxoeL.exe
2⤵
PID:2516

C:\Windows\System\NsWBSGB.exe
C:\Windows\System\NsWBSGB.exe
2⤵
PID:1560

C:\Windows\System\NaUvosK.exe
C:\Windows\System\NaUvosK.exe
2⤵
PID:2944

C:\Windows\System\WixXBvk.exe
C:\Windows\System\WixXBvk.exe
2⤵
PID:624

C:\Windows\System\BgPCdVb.exe
C:\Windows\System\BgPCdVb.exe
2⤵
PID:876

C:\Windows\System\kejScho.exe
C:\Windows\System\kejScho.exe
2⤵
PID:2520

C:\Windows\System\LawUuQP.exe
C:\Windows\System\LawUuQP.exe
2⤵
PID:2776

C:\Windows\System\TdQecKi.exe
C:\Windows\System\TdQecKi.exe
2⤵
PID:1988

C:\Windows\System\QVtJzuW.exe
C:\Windows\System\QVtJzuW.exe
2⤵
PID:1904

C:\Windows\System\wbRtFdL.exe
C:\Windows\System\wbRtFdL.exe
2⤵
PID:2460

C:\Windows\System\fmrRCRd.exe
C:\Windows\System\fmrRCRd.exe
2⤵
PID:1032

C:\Windows\System\URvFfMi.exe
C:\Windows\System\URvFfMi.exe
2⤵
PID:1600

C:\Windows\System\ZKNSNUv.exe
C:\Windows\System\ZKNSNUv.exe
2⤵
PID:1028

C:\Windows\System\NhzsOuQ.exe
C:\Windows\System\NhzsOuQ.exe
2⤵
PID:608

C:\Windows\System\jymGEmY.exe
C:\Windows\System\jymGEmY.exe
2⤵
PID:1984

C:\Windows\System\uwzraVT.exe
C:\Windows\System\uwzraVT.exe
2⤵
PID:1968

C:\Windows\System\QVnvZfn.exe
C:\Windows\System\QVnvZfn.exe
2⤵
PID:3092

C:\Windows\System\WIOxuVE.exe
C:\Windows\System\WIOxuVE.exe
2⤵
PID:3108

C:\Windows\System\tBNvbCs.exe
C:\Windows\System\tBNvbCs.exe
2⤵
PID:3128

C:\Windows\System\nluBrDv.exe
C:\Windows\System\nluBrDv.exe
2⤵
PID:3152

C:\Windows\System\FyPLMDw.exe
C:\Windows\System\FyPLMDw.exe
2⤵
PID:3172

C:\Windows\System\cTYEWSG.exe
C:\Windows\System\cTYEWSG.exe
2⤵
PID:3188

C:\Windows\System\ElrHFtc.exe
C:\Windows\System\ElrHFtc.exe
2⤵
PID:3208

C:\Windows\System\hLFQiPy.exe
C:\Windows\System\hLFQiPy.exe
2⤵
PID:3224

C:\Windows\System\UNmZcYg.exe
C:\Windows\System\UNmZcYg.exe
2⤵
PID:3240

C:\Windows\System\oGlhYaB.exe
C:\Windows\System\oGlhYaB.exe
2⤵
PID:3256

C:\Windows\System\vrCJBSd.exe
C:\Windows\System\vrCJBSd.exe
2⤵
PID:3284

C:\Windows\System\XLcJACt.exe
C:\Windows\System\XLcJACt.exe
2⤵
PID:3300

C:\Windows\System\esQWfdH.exe
C:\Windows\System\esQWfdH.exe
2⤵
PID:3316

C:\Windows\System\wBKrwos.exe
C:\Windows\System\wBKrwos.exe
2⤵
PID:3336

C:\Windows\System\iAeOHSZ.exe
C:\Windows\System\iAeOHSZ.exe
2⤵
PID:3352

C:\Windows\System\eKAuHPb.exe
C:\Windows\System\eKAuHPb.exe
2⤵
PID:3372

C:\Windows\System\HVWBJYQ.exe
C:\Windows\System\HVWBJYQ.exe
2⤵
PID:3392

C:\Windows\System\EZVHqTP.exe
C:\Windows\System\EZVHqTP.exe
2⤵
PID:3408

C:\Windows\System\yOlrNfH.exe
C:\Windows\System\yOlrNfH.exe
2⤵
PID:3424

C:\Windows\System\WVFHHfP.exe
C:\Windows\System\WVFHHfP.exe
2⤵
PID:3440

C:\Windows\System\yrfnWzs.exe
C:\Windows\System\yrfnWzs.exe
2⤵
PID:3456

C:\Windows\System\tUHZEsI.exe
C:\Windows\System\tUHZEsI.exe
2⤵
PID:3472

C:\Windows\System\aUhaCcP.exe
C:\Windows\System\aUhaCcP.exe
2⤵
PID:3488

C:\Windows\System\fAAWTMp.exe
C:\Windows\System\fAAWTMp.exe
2⤵
PID:3508

C:\Windows\System\FIkGCqn.exe
C:\Windows\System\FIkGCqn.exe
2⤵
PID:3524

C:\Windows\System\kFseNQb.exe
C:\Windows\System\kFseNQb.exe
2⤵
PID:3544

C:\Windows\System\fxLKESw.exe
C:\Windows\System\fxLKESw.exe
2⤵
PID:3564

C:\Windows\System\YVxFAvT.exe
C:\Windows\System\YVxFAvT.exe
2⤵
PID:3580

C:\Windows\System\UeRowZs.exe
C:\Windows\System\UeRowZs.exe
2⤵
PID:3596

C:\Windows\System\bKVkSzt.exe
C:\Windows\System\bKVkSzt.exe
2⤵
PID:3612

C:\Windows\System\jTuJkZZ.exe
C:\Windows\System\jTuJkZZ.exe
2⤵
PID:3628

C:\Windows\System\uQwQXpl.exe
C:\Windows\System\uQwQXpl.exe
2⤵
PID:3644

C:\Windows\System\xvxcixZ.exe
C:\Windows\System\xvxcixZ.exe
2⤵
PID:3660

C:\Windows\System\GpEHLnS.exe
C:\Windows\System\GpEHLnS.exe
2⤵
PID:3676

C:\Windows\System\ybIDfFh.exe
C:\Windows\System\ybIDfFh.exe
2⤵
PID:3692

C:\Windows\System\wFUkxol.exe
C:\Windows\System\wFUkxol.exe
2⤵
PID:3708

C:\Windows\System\HJhWtxI.exe
C:\Windows\System\HJhWtxI.exe
2⤵
PID:3724

C:\Windows\System\ZhzJlvD.exe
C:\Windows\System\ZhzJlvD.exe
2⤵
PID:3740

C:\Windows\System\uuoNvhV.exe
C:\Windows\System\uuoNvhV.exe
2⤵
PID:3756

C:\Windows\System\rsLHSss.exe
C:\Windows\System\rsLHSss.exe
2⤵
PID:3772

C:\Windows\System\HkPZprH.exe
C:\Windows\System\HkPZprH.exe
2⤵
PID:3792

C:\Windows\System\jXJFLnq.exe
C:\Windows\System\jXJFLnq.exe
2⤵
PID:3808

C:\Windows\System\DathaBB.exe
C:\Windows\System\DathaBB.exe
2⤵
PID:3824

C:\Windows\System\IHYuSvK.exe
C:\Windows\System\IHYuSvK.exe
2⤵
PID:3840

C:\Windows\System\SCekBPn.exe
C:\Windows\System\SCekBPn.exe
2⤵
PID:3856

C:\Windows\System\JsbXuZZ.exe
C:\Windows\System\JsbXuZZ.exe
2⤵
PID:3876

C:\Windows\System\rsydoyO.exe
C:\Windows\System\rsydoyO.exe
2⤵
PID:3900

C:\Windows\System\qXNoovq.exe
C:\Windows\System\qXNoovq.exe
2⤵
PID:3916

C:\Windows\System\UbccZZu.exe
C:\Windows\System\UbccZZu.exe
2⤵
PID:3936

C:\Windows\System\tsYMqmF.exe
C:\Windows\System\tsYMqmF.exe
2⤵
PID:3952

C:\Windows\System\rHLplct.exe
C:\Windows\System\rHLplct.exe
2⤵
PID:3968

C:\Windows\System\ccGpKlh.exe
C:\Windows\System\ccGpKlh.exe
2⤵
PID:3984

C:\Windows\System\QanLfqP.exe
C:\Windows\System\QanLfqP.exe
2⤵
PID:4000

C:\Windows\System\ZaAUeDV.exe
C:\Windows\System\ZaAUeDV.exe
2⤵
PID:4016

C:\Windows\System\pIsBISD.exe
C:\Windows\System\pIsBISD.exe
2⤵
PID:4032

C:\Windows\System\oTBReRi.exe
C:\Windows\System\oTBReRi.exe
2⤵
PID:4048

C:\Windows\System\mkedAjE.exe
C:\Windows\System\mkedAjE.exe
2⤵
PID:4064

C:\Windows\System\NEvcRsJ.exe
C:\Windows\System\NEvcRsJ.exe
2⤵
PID:4080

C:\Windows\System\wmeWedZ.exe
C:\Windows\System\wmeWedZ.exe
2⤵
PID:2940

C:\Windows\System\PGYADMc.exe
C:\Windows\System\PGYADMc.exe
2⤵
PID:1664

C:\Windows\System\kFYbhGa.exe
C:\Windows\System\kFYbhGa.exe
2⤵
PID:1808

C:\Windows\System\EKMMmgN.exe
C:\Windows\System\EKMMmgN.exe
2⤵
PID:3104

C:\Windows\System\LeKoyAO.exe
C:\Windows\System\LeKoyAO.exe
2⤵
PID:3140

C:\Windows\System\crCLNCX.exe
C:\Windows\System\crCLNCX.exe
2⤵
PID:3080

C:\Windows\System\lQxxBfy.exe
C:\Windows\System\lQxxBfy.exe
2⤵
PID:3180

C:\Windows\System\rYcundu.exe
C:\Windows\System\rYcundu.exe
2⤵
PID:3220

C:\Windows\System\csjXjrh.exe
C:\Windows\System\csjXjrh.exe
2⤵
PID:3296

C:\Windows\System\JxlnSgJ.exe
C:\Windows\System\JxlnSgJ.exe
2⤵
PID:3332

C:\Windows\System\crmwsQR.exe
C:\Windows\System\crmwsQR.exe
2⤵
PID:2196

C:\Windows\System\WdVZYPe.exe
C:\Windows\System\WdVZYPe.exe
2⤵
PID:3164

C:\Windows\System\iqZUVaJ.exe
C:\Windows\System\iqZUVaJ.exe
2⤵
PID:3400

C:\Windows\System\JdLspte.exe
C:\Windows\System\JdLspte.exe
2⤵
PID:3468

C:\Windows\System\InEOeJN.exe
C:\Windows\System\InEOeJN.exe
2⤵
PID:3532

C:\Windows\System\pGqpIFr.exe
C:\Windows\System\pGqpIFr.exe
2⤵
PID:4008

C:\Windows\System\RadNdZI.exe
C:\Windows\System\RadNdZI.exe
2⤵
PID:4072

C:\Windows\System\WfjljdY.exe
C:\Windows\System\WfjljdY.exe
2⤵
PID:2892

C:\Windows\System\oiljxGy.exe
C:\Windows\System\oiljxGy.exe
2⤵
PID:2240

C:\Windows\System\rsyOngP.exe
C:\Windows\System\rsyOngP.exe
2⤵
PID:3368

C:\Windows\System\CteKSMi.exe
C:\Windows\System\CteKSMi.exe
2⤵
PID:3540

C:\Windows\System\kKZQMdX.exe
C:\Windows\System\kKZQMdX.exe
2⤵
PID:3608

C:\Windows\System\KDovlsa.exe
C:\Windows\System\KDovlsa.exe
2⤵
PID:3672

C:\Windows\System\EjwYcOp.exe
C:\Windows\System\EjwYcOp.exe
2⤵
PID:3380

C:\Windows\System\rhAUvdD.exe
C:\Windows\System\rhAUvdD.exe
2⤵
PID:3124

C:\Windows\System\NhbSCYW.exe
C:\Windows\System\NhbSCYW.exe
2⤵
PID:3864

C:\Windows\System\wUDXnqk.exe
C:\Windows\System\wUDXnqk.exe
2⤵
PID:3912

C:\Windows\System\bHSAdGw.exe
C:\Windows\System\bHSAdGw.exe
2⤵
PID:3196

C:\Windows\System\uyvOAeb.exe
C:\Windows\System\uyvOAeb.exe
2⤵
PID:2540

C:\Windows\System\HYZhusy.exe
C:\Windows\System\HYZhusy.exe
2⤵
PID:3272

C:\Windows\System\SgxCzBh.exe
C:\Windows\System\SgxCzBh.exe
2⤵
PID:3276

C:\Windows\System\PehIlJA.exe
C:\Windows\System\PehIlJA.exe
2⤵
PID:3688

C:\Windows\System\ttkoGyo.exe
C:\Windows\System\ttkoGyo.exe
2⤵
PID:3752

C:\Windows\System\NKgbInZ.exe
C:\Windows\System\NKgbInZ.exe
2⤵
PID:804

C:\Windows\System\XvafSSp.exe
C:\Windows\System\XvafSSp.exe
2⤵
PID:3328

C:\Windows\System\GcqgCYQ.exe
C:\Windows\System\GcqgCYQ.exe
2⤵
PID:3732

C:\Windows\System\DVgAYah.exe
C:\Windows\System\DVgAYah.exe
2⤵
PID:3768

C:\Windows\System\BGBWILs.exe
C:\Windows\System\BGBWILs.exe
2⤵
PID:3704

C:\Windows\System\kCFnYxE.exe
C:\Windows\System\kCFnYxE.exe
2⤵
PID:3820

C:\Windows\System\QiOhdXq.exe
C:\Windows\System\QiOhdXq.exe
2⤵
PID:3884

C:\Windows\System\bMabQRq.exe
C:\Windows\System\bMabQRq.exe
2⤵
PID:4100

C:\Windows\System\uAouxEB.exe
C:\Windows\System\uAouxEB.exe
2⤵
PID:4116

C:\Windows\System\ZCUapbF.exe
C:\Windows\System\ZCUapbF.exe
2⤵
PID:4132

C:\Windows\System\hSWMDRC.exe
C:\Windows\System\hSWMDRC.exe
2⤵
PID:4148

C:\Windows\System\rvpVHnz.exe
C:\Windows\System\rvpVHnz.exe
2⤵
PID:4164

C:\Windows\System\nfZjDQh.exe
C:\Windows\System\nfZjDQh.exe
2⤵
PID:4180

C:\Windows\System\nghibSB.exe
C:\Windows\System\nghibSB.exe
2⤵
PID:4196

C:\Windows\System\yfVourM.exe
C:\Windows\System\yfVourM.exe
2⤵
PID:4216

C:\Windows\System\fBeTtlb.exe
C:\Windows\System\fBeTtlb.exe
2⤵
PID:4248

C:\Windows\System\mzyNdfd.exe
C:\Windows\System\mzyNdfd.exe
2⤵
PID:4264

C:\Windows\System\EiYdpGd.exe
C:\Windows\System\EiYdpGd.exe
2⤵
PID:4280

C:\Windows\System\hAeSyMR.exe
C:\Windows\System\hAeSyMR.exe
2⤵
PID:4300

C:\Windows\System\IWPJFkd.exe
C:\Windows\System\IWPJFkd.exe
2⤵
PID:4316

C:\Windows\System\qORYfdi.exe
C:\Windows\System\qORYfdi.exe
2⤵
PID:4332

C:\Windows\System\VdzUPxv.exe
C:\Windows\System\VdzUPxv.exe
2⤵
PID:4348

C:\Windows\System\hbEmucV.exe
C:\Windows\System\hbEmucV.exe
2⤵
PID:4364

C:\Windows\System\rcDpfTW.exe
C:\Windows\System\rcDpfTW.exe
2⤵
PID:4380

C:\Windows\System\MLFpfCS.exe
C:\Windows\System\MLFpfCS.exe
2⤵
PID:4396

C:\Windows\System\hHSBAHv.exe
C:\Windows\System\hHSBAHv.exe
2⤵
PID:4412

C:\Windows\System\UoyByGs.exe
C:\Windows\System\UoyByGs.exe
2⤵
PID:4428

C:\Windows\System\bbhnJCQ.exe
C:\Windows\System\bbhnJCQ.exe
2⤵
PID:4444

C:\Windows\System\IIOIZwR.exe
C:\Windows\System\IIOIZwR.exe
2⤵
PID:4460

C:\Windows\System\StToRlb.exe
C:\Windows\System\StToRlb.exe
2⤵
PID:4476

C:\Windows\System\mhLaxOa.exe
C:\Windows\System\mhLaxOa.exe
2⤵
PID:4492

C:\Windows\System\YdGOCWz.exe
C:\Windows\System\YdGOCWz.exe
2⤵
PID:4508

C:\Windows\System\PACiDla.exe
C:\Windows\System\PACiDla.exe
2⤵
PID:4524

C:\Windows\System\nJNSdaG.exe
C:\Windows\System\nJNSdaG.exe
2⤵
PID:4540

C:\Windows\System\SlUbXXp.exe
C:\Windows\System\SlUbXXp.exe
2⤵
PID:4560

C:\Windows\System\nngUEMl.exe
C:\Windows\System\nngUEMl.exe
2⤵
PID:4588

C:\Windows\System\dMhHdMl.exe
C:\Windows\System\dMhHdMl.exe
2⤵
PID:4608

C:\Windows\System\BneatYE.exe
C:\Windows\System\BneatYE.exe
2⤵
PID:4624

C:\Windows\System\dwPoeoI.exe
C:\Windows\System\dwPoeoI.exe
2⤵
PID:4640

C:\Windows\System\lKJbghH.exe
C:\Windows\System\lKJbghH.exe
2⤵
PID:4656

C:\Windows\System\MOWikLO.exe
C:\Windows\System\MOWikLO.exe
2⤵
PID:4672

C:\Windows\System\BwPnwAy.exe
C:\Windows\System\BwPnwAy.exe
2⤵
PID:4688

C:\Windows\System\QKKqotP.exe
C:\Windows\System\QKKqotP.exe
2⤵
PID:4704

C:\Windows\System\xwoDFRr.exe
C:\Windows\System\xwoDFRr.exe
2⤵
PID:4720

C:\Windows\System\cBNnGEY.exe
C:\Windows\System\cBNnGEY.exe
2⤵
PID:4736

C:\Windows\System\vgmKBHA.exe
C:\Windows\System\vgmKBHA.exe
2⤵
PID:4752

C:\Windows\System\TaNTCnl.exe
C:\Windows\System\TaNTCnl.exe
2⤵
PID:4768

C:\Windows\System\nnhReRd.exe
C:\Windows\System\nnhReRd.exe
2⤵
PID:4784

C:\Windows\System\nAQGWig.exe
C:\Windows\System\nAQGWig.exe
2⤵
PID:4800

C:\Windows\System\yYfOKRq.exe
C:\Windows\System\yYfOKRq.exe
2⤵
PID:4816

C:\Windows\System\KptYXtQ.exe
C:\Windows\System\KptYXtQ.exe
2⤵
PID:4832

C:\Windows\System\ENcPkKH.exe
C:\Windows\System\ENcPkKH.exe
2⤵
PID:4848

C:\Windows\System\pkTquoO.exe
C:\Windows\System\pkTquoO.exe
2⤵
PID:4864

C:\Windows\System\MMqMRoG.exe
C:\Windows\System\MMqMRoG.exe
2⤵
PID:4888

C:\Windows\System\JlxSxAD.exe
C:\Windows\System\JlxSxAD.exe
2⤵
PID:4904

C:\Windows\System\Pzjpirh.exe
C:\Windows\System\Pzjpirh.exe
2⤵
PID:4920

C:\Windows\System\xqcicMe.exe
C:\Windows\System\xqcicMe.exe
2⤵
PID:4936

C:\Windows\System\zXodMgn.exe
C:\Windows\System\zXodMgn.exe
2⤵
PID:4952

C:\Windows\System\JYWnrmm.exe
C:\Windows\System\JYWnrmm.exe
2⤵
PID:4968

C:\Windows\System\wdkTMIg.exe
C:\Windows\System\wdkTMIg.exe
2⤵
PID:4988

C:\Windows\System\LaezieC.exe
C:\Windows\System\LaezieC.exe
2⤵
PID:5004

C:\Windows\System\KeiVBdK.exe
C:\Windows\System\KeiVBdK.exe
2⤵
PID:5020

C:\Windows\System\rsMkNQq.exe
C:\Windows\System\rsMkNQq.exe
2⤵
PID:5036

C:\Windows\System\bnmqyzp.exe
C:\Windows\System\bnmqyzp.exe
2⤵
PID:5052

C:\Windows\System\sEOHUmn.exe
C:\Windows\System\sEOHUmn.exe
2⤵
PID:5072

C:\Windows\System\HScDLer.exe
C:\Windows\System\HScDLer.exe
2⤵
PID:5092

C:\Windows\System\HpPzAVE.exe
C:\Windows\System\HpPzAVE.exe
2⤵
PID:5108

C:\Windows\System\EATQgOK.exe
C:\Windows\System\EATQgOK.exe
2⤵
PID:2712

C:\Windows\System\MuSIzRt.exe
C:\Windows\System\MuSIzRt.exe
2⤵
PID:3788

C:\Windows\System\tDFevzA.exe
C:\Windows\System\tDFevzA.exe
2⤵
PID:3344

C:\Windows\System\yJrsOhz.exe
C:\Windows\System\yJrsOhz.exe
2⤵
PID:4112

C:\Windows\System\lXAvqBW.exe
C:\Windows\System\lXAvqBW.exe
2⤵
PID:4176

C:\Windows\System\KziyFeg.exe
C:\Windows\System\KziyFeg.exe
2⤵
PID:4256

C:\Windows\System\cIAcoAy.exe
C:\Windows\System\cIAcoAy.exe
2⤵
PID:3992

C:\Windows\System\gueHlLa.exe
C:\Windows\System\gueHlLa.exe
2⤵
PID:4060

C:\Windows\System\clMHrMc.exe
C:\Windows\System\clMHrMc.exe
2⤵
PID:3060

C:\Windows\System\pRXuMuw.exe
C:\Windows\System\pRXuMuw.exe
2⤵
PID:3088

C:\Windows\System\imHqvKt.exe
C:\Windows\System\imHqvKt.exe
2⤵
PID:912

C:\Windows\System\CDaRkWn.exe
C:\Windows\System\CDaRkWn.exe
2⤵
PID:4392

C:\Windows\System\WeUZQBz.exe
C:\Windows\System\WeUZQBz.exe
2⤵
PID:4456

C:\Windows\System\FYiJTeA.exe
C:\Windows\System\FYiJTeA.exe
2⤵
PID:4556

C:\Windows\System\zCkkYVq.exe
C:\Windows\System\zCkkYVq.exe
2⤵
PID:4632

C:\Windows\System\nGOsvDP.exe
C:\Windows\System\nGOsvDP.exe
2⤵
PID:4932

C:\Windows\System\rmmPkNo.exe
C:\Windows\System\rmmPkNo.exe
2⤵
PID:4944

C:\Windows\System\YPQzMpY.exe
C:\Windows\System\YPQzMpY.exe
2⤵
PID:5080

C:\Windows\System\INXjvxm.exe
C:\Windows\System\INXjvxm.exe
2⤵
PID:3516

C:\Windows\System\jseFpFJ.exe
C:\Windows\System\jseFpFJ.exe
2⤵
PID:3964

C:\Windows\System\PvumHAh.exe
C:\Windows\System\PvumHAh.exe
2⤵
PID:3232

C:\Windows\System\ImHqWhs.exe
C:\Windows\System\ImHqWhs.exe
2⤵
PID:3464

C:\Windows\System\mOXBAKm.exe
C:\Windows\System\mOXBAKm.exe
2⤵
PID:3908

C:\Windows\System\fwHyOVN.exe
C:\Windows\System\fwHyOVN.exe
2⤵
PID:4472

C:\Windows\System\TaIXRcs.exe
C:\Windows\System\TaIXRcs.exe
2⤵
PID:4684

C:\Windows\System\wbryCTC.exe
C:\Windows\System\wbryCTC.exe
2⤵
PID:2716

C:\Windows\System\aBIoIjl.exe
C:\Windows\System\aBIoIjl.exe
2⤵
PID:4024

C:\Windows\System\hPRVUDH.exe
C:\Windows\System\hPRVUDH.exe
2⤵
PID:4388

C:\Windows\System\DbdRMnw.exe
C:\Windows\System\DbdRMnw.exe
2⤵
PID:4548

C:\Windows\System\IKbsmud.exe
C:\Windows\System\IKbsmud.exe
2⤵
PID:5016

C:\Windows\System\MpBLbRR.exe
C:\Windows\System\MpBLbRR.exe
2⤵
PID:4700

C:\Windows\System\zolnNaf.exe
C:\Windows\System\zolnNaf.exe
2⤵
PID:4228

C:\Windows\System\xgthNUU.exe
C:\Windows\System\xgthNUU.exe
2⤵
PID:4288

C:\Windows\System\yQQqaiZ.exe
C:\Windows\System\yQQqaiZ.exe
2⤵
PID:1604

C:\Windows\System\wjAbzlE.exe
C:\Windows\System\wjAbzlE.exe
2⤵
PID:4452

C:\Windows\System\wQFdtqe.exe
C:\Windows\System\wQFdtqe.exe
2⤵
PID:5028

C:\Windows\System\KnTyjov.exe
C:\Windows\System\KnTyjov.exe
2⤵
PID:5104

C:\Windows\System\QkBTRVn.exe
C:\Windows\System\QkBTRVn.exe
2⤵
PID:3980

C:\Windows\System\WKOovjC.exe
C:\Windows\System\WKOovjC.exe
2⤵
PID:4568

C:\Windows\System\FhEbxwv.exe
C:\Windows\System\FhEbxwv.exe
2⤵
PID:2248

C:\Windows\System\JGioMoE.exe
C:\Windows\System\JGioMoE.exe
2⤵
PID:3280

C:\Windows\System\mZDSAkM.exe
C:\Windows\System\mZDSAkM.exe
2⤵
PID:3448

C:\Windows\System\mXQCBFB.exe
C:\Windows\System\mXQCBFB.exe
2⤵
PID:3452

C:\Windows\System\FDFOALc.exe
C:\Windows\System\FDFOALc.exe
2⤵
PID:2624

C:\Windows\System\oEkhAZQ.exe
C:\Windows\System\oEkhAZQ.exe
2⤵
PID:4828

C:\Windows\System\ohMigeH.exe
C:\Windows\System\ohMigeH.exe
2⤵
PID:3928

C:\Windows\System\musaGuO.exe
C:\Windows\System\musaGuO.exe
2⤵
PID:4192

C:\Windows\System\IBdiEKD.exe
C:\Windows\System\IBdiEKD.exe
2⤵
PID:3044

C:\Windows\System\DnUJhaQ.exe
C:\Windows\System\DnUJhaQ.exe
2⤵
PID:4856

C:\Windows\System\FsQwNzP.exe
C:\Windows\System\FsQwNzP.exe
2⤵
PID:3264

C:\Windows\System\FcoJHFE.exe
C:\Windows\System\FcoJHFE.exe
2⤵
PID:4044

C:\Windows\System\fsAepIi.exe
C:\Windows\System\fsAepIi.exe
2⤵
PID:4732

C:\Windows\System\XLTtqSp.exe
C:\Windows\System\XLTtqSp.exe
2⤵
PID:2188

C:\Windows\System\SUKkpHJ.exe
C:\Windows\System\SUKkpHJ.exe
2⤵
PID:3120

C:\Windows\System\OywgnMr.exe
C:\Windows\System\OywgnMr.exe
2⤵
PID:2488

C:\Windows\System\dkFCnNz.exe
C:\Windows\System\dkFCnNz.exe
2⤵
PID:1532

C:\Windows\System\OsGGQsB.exe
C:\Windows\System\OsGGQsB.exe
2⤵
PID:3268

C:\Windows\System\avXxPcU.exe
C:\Windows\System\avXxPcU.exe
2⤵
PID:2068

C:\Windows\System\lzvAtCF.exe
C:\Windows\System\lzvAtCF.exe
2⤵
PID:1900

C:\Windows\System\YmKqPqT.exe
C:\Windows\System\YmKqPqT.exe
2⤵
PID:4572

C:\Windows\System\rksvCpo.exe
C:\Windows\System\rksvCpo.exe
2⤵
PID:5088

C:\Windows\System\LuKpiUe.exe
C:\Windows\System\LuKpiUe.exe
2⤵
PID:3960

C:\Windows\System\RgcYfkp.exe
C:\Windows\System\RgcYfkp.exe
2⤵
PID:4128

C:\Windows\System\oJQKSmv.exe
C:\Windows\System\oJQKSmv.exe
2⤵
PID:4276

C:\Windows\System\CYVimFT.exe
C:\Windows\System\CYVimFT.exe
2⤵
PID:4440

C:\Windows\System\umARmPl.exe
C:\Windows\System\umARmPl.exe
2⤵
PID:4980

C:\Windows\System\WfZNUUf.exe
C:\Windows\System\WfZNUUf.exe
2⤵
PID:2836

C:\Windows\System\VDqBmSP.exe
C:\Windows\System\VDqBmSP.exe
2⤵
PID:4840

C:\Windows\System\hdTWJGj.exe
C:\Windows\System\hdTWJGj.exe
2⤵
PID:4808

C:\Windows\System\KfWIwYA.exe
C:\Windows\System\KfWIwYA.exe
2⤵
PID:4876

C:\Windows\System\YuuvvIr.exe
C:\Windows\System\YuuvvIr.exe
2⤵
PID:4780

C:\Windows\System\qlFSdWV.exe
C:\Windows\System\qlFSdWV.exe
2⤵
PID:4668

C:\Windows\System\vPpalwO.exe
C:\Windows\System\vPpalwO.exe
2⤵
PID:4172

C:\Windows\System\nRNRjEB.exe
C:\Windows\System\nRNRjEB.exe
2⤵
PID:4324

C:\Windows\System\kbVOvvE.exe
C:\Windows\System\kbVOvvE.exe
2⤵
PID:4424

C:\Windows\System\gQCfZYB.exe
C:\Windows\System\gQCfZYB.exe
2⤵
PID:4996

C:\Windows\System\QVGSRWt.exe
C:\Windows\System\QVGSRWt.exe
2⤵
PID:2960

C:\Windows\System\VyFvwfM.exe
C:\Windows\System\VyFvwfM.exe
2⤵
PID:1492

C:\Windows\System\YjyZKFM.exe
C:\Windows\System\YjyZKFM.exe
2⤵
PID:1564

C:\Windows\System\wgGOpec.exe
C:\Windows\System\wgGOpec.exe
2⤵
PID:2040

C:\Windows\System\idnKyQn.exe
C:\Windows\System\idnKyQn.exe
2⤵
PID:5012

C:\Windows\System\unrvuYk.exe
C:\Windows\System\unrvuYk.exe
2⤵
PID:768

C:\Windows\System\TQjVzCY.exe
C:\Windows\System\TQjVzCY.exe
2⤵
PID:4760

C:\Windows\System\mpKpvVd.exe
C:\Windows\System\mpKpvVd.exe
2⤵
PID:4796

C:\Windows\System\KBNivpG.exe
C:\Windows\System\KBNivpG.exe
2⤵
PID:2440

C:\Windows\System\SiOlwbe.exe
C:\Windows\System\SiOlwbe.exe
2⤵
PID:1612

C:\Windows\System\sJFfHbO.exe
C:\Windows\System\sJFfHbO.exe
2⤵
PID:4884

C:\Windows\System\JMJTohw.exe
C:\Windows\System\JMJTohw.exe
2⤵
PID:4224

C:\Windows\System\cJetkat.exe
C:\Windows\System\cJetkat.exe
2⤵
PID:4620

C:\Windows\System\SpAwkDN.exe
C:\Windows\System\SpAwkDN.exe
2⤵
PID:4744

C:\Windows\System\sLBGAGt.exe
C:\Windows\System\sLBGAGt.exe
2⤵
PID:1796

C:\Windows\System\kxepqWp.exe
C:\Windows\System\kxepqWp.exe
2⤵
PID:3892

C:\Windows\System\RDhVjBz.exe
C:\Windows\System\RDhVjBz.exe
2⤵
PID:4232

C:\Windows\System\WBOpMRv.exe
C:\Windows\System\WBOpMRv.exe
2⤵
PID:2508

C:\Windows\System\GWqZlep.exe
C:\Windows\System\GWqZlep.exe
2⤵
PID:4948

C:\Windows\System\TNOJUKK.exe
C:\Windows\System\TNOJUKK.exe
2⤵
PID:2528

C:\Windows\System\kibMuFH.exe
C:\Windows\System\kibMuFH.exe
2⤵
PID:4296

C:\Windows\System\GTwBIJQ.exe
C:\Windows\System\GTwBIJQ.exe
2⤵
PID:2016

C:\Windows\System\LrGAaQe.exe
C:\Windows\System\LrGAaQe.exe
2⤵
PID:3248

C:\Windows\System\MudzmWF.exe
C:\Windows\System\MudzmWF.exe
2⤵
PID:3364

C:\Windows\System\Zuuhbnm.exe
C:\Windows\System\Zuuhbnm.exe
2⤵
PID:328

C:\Windows\System\FyWJVid.exe
C:\Windows\System\FyWJVid.exe
2⤵
PID:3076

C:\Windows\System\RoMmIgj.exe
C:\Windows\System\RoMmIgj.exe
2⤵
PID:4360

C:\Windows\System\QzycjjN.exe
C:\Windows\System\QzycjjN.exe
2⤵
PID:4272

C:\Windows\System\OhGKOEq.exe
C:\Windows\System\OhGKOEq.exe
2⤵
PID:5044

C:\Windows\System\QCplvdH.exe
C:\Windows\System\QCplvdH.exe
2⤵
PID:5100

C:\Windows\System\DdmueUp.exe
C:\Windows\System\DdmueUp.exe
2⤵
PID:1912

C:\Windows\System\FIULteb.exe
C:\Windows\System\FIULteb.exe
2⤵
PID:5084

C:\Windows\System\wfEUjPN.exe
C:\Windows\System\wfEUjPN.exe
2⤵
PID:3784

C:\Windows\System\nLlidZe.exe
C:\Windows\System\nLlidZe.exe
2⤵
PID:4516

C:\Windows\System\AhjrqeZ.exe
C:\Windows\System\AhjrqeZ.exe
2⤵
PID:4880

C:\Windows\System\ZnBMDId.exe
C:\Windows\System\ZnBMDId.exe
2⤵
PID:4552

C:\Windows\System\jROlhwZ.exe
C:\Windows\System\jROlhwZ.exe
2⤵
PID:3236

C:\Windows\System\UcKZCIW.exe
C:\Windows\System\UcKZCIW.exe
2⤵
PID:4928

C:\Windows\System\duiByKZ.exe
C:\Windows\System\duiByKZ.exe
2⤵
PID:2856

C:\Windows\System\rnBrNzI.exe
C:\Windows\System\rnBrNzI.exe
2⤵
PID:5136

C:\Windows\System\pGipfdH.exe
C:\Windows\System\pGipfdH.exe
2⤵
PID:5152

C:\Windows\System\wGHwVQZ.exe
C:\Windows\System\wGHwVQZ.exe
2⤵
PID:5168

C:\Windows\System\zlusizw.exe
C:\Windows\System\zlusizw.exe
2⤵
PID:5184

C:\Windows\System\xjtADGB.exe
C:\Windows\System\xjtADGB.exe
2⤵
PID:5204

C:\Windows\System\GYzDGWd.exe
C:\Windows\System\GYzDGWd.exe
2⤵
PID:5220

C:\Windows\System\MyBLxuw.exe
C:\Windows\System\MyBLxuw.exe
2⤵
PID:5236

C:\Windows\System\TnNTlvG.exe
C:\Windows\System\TnNTlvG.exe
2⤵
PID:5252

C:\Windows\System\msVZBTx.exe
C:\Windows\System\msVZBTx.exe
2⤵
PID:5268

C:\Windows\System\DotAXrS.exe
C:\Windows\System\DotAXrS.exe
2⤵
PID:5284

C:\Windows\System\sOkgosI.exe
C:\Windows\System\sOkgosI.exe
2⤵
PID:5300

C:\Windows\System\roPHWBX.exe
C:\Windows\System\roPHWBX.exe
2⤵
PID:5316

C:\Windows\System\UzBxiZY.exe
C:\Windows\System\UzBxiZY.exe
2⤵
PID:5332

C:\Windows\System\mcIWYWs.exe
C:\Windows\System\mcIWYWs.exe
2⤵
PID:5348

C:\Windows\System\TctCzTe.exe
C:\Windows\System\TctCzTe.exe
2⤵
PID:5368

C:\Windows\System\yeNDxHY.exe
C:\Windows\System\yeNDxHY.exe
2⤵
PID:5384

C:\Windows\System\qnLQRej.exe
C:\Windows\System\qnLQRej.exe
2⤵
PID:5400

C:\Windows\System\MaxRNEr.exe
C:\Windows\System\MaxRNEr.exe
2⤵
PID:5416

C:\Windows\System\wQIHyQU.exe
C:\Windows\System\wQIHyQU.exe
2⤵
PID:5432

C:\Windows\System\tsLNUHY.exe
C:\Windows\System\tsLNUHY.exe
2⤵
PID:5448

C:\Windows\System\EaZoxmG.exe
C:\Windows\System\EaZoxmG.exe
2⤵
PID:5464

C:\Windows\System\nOwHOWE.exe
C:\Windows\System\nOwHOWE.exe
2⤵
PID:5480

C:\Windows\System\gITwiyV.exe
C:\Windows\System\gITwiyV.exe
2⤵
PID:5496

C:\Windows\System\FGTaFIs.exe
C:\Windows\System\FGTaFIs.exe
2⤵
PID:5512

C:\Windows\System\aiICykU.exe
C:\Windows\System\aiICykU.exe
2⤵
PID:5528

C:\Windows\System\OXMbWfx.exe
C:\Windows\System\OXMbWfx.exe
2⤵
PID:5544

C:\Windows\System\GoBrxTf.exe
C:\Windows\System\GoBrxTf.exe
2⤵
PID:5564

C:\Windows\System\CZCIzhW.exe
C:\Windows\System\CZCIzhW.exe
2⤵
PID:5580

C:\Windows\System\hLCLgrK.exe
C:\Windows\System\hLCLgrK.exe
2⤵
PID:5596

C:\Windows\System\rOCPIWy.exe
C:\Windows\System\rOCPIWy.exe
2⤵
PID:5612

C:\Windows\System\TWXptlW.exe
C:\Windows\System\TWXptlW.exe
2⤵
PID:5628

C:\Windows\System\oVfAJwI.exe
C:\Windows\System\oVfAJwI.exe
2⤵
PID:5644

C:\Windows\System\WDFLQnK.exe
C:\Windows\System\WDFLQnK.exe
2⤵
PID:5660

C:\Windows\System\EJtFpHh.exe
C:\Windows\System\EJtFpHh.exe
2⤵
PID:5676

C:\Windows\System\VnceyIH.exe
C:\Windows\System\VnceyIH.exe
2⤵
PID:5692

C:\Windows\System\cxSPVzT.exe
C:\Windows\System\cxSPVzT.exe
2⤵
PID:5708

C:\Windows\System\rNbrnaK.exe
C:\Windows\System\rNbrnaK.exe
2⤵
PID:5724

C:\Windows\System\iFyYaae.exe
C:\Windows\System\iFyYaae.exe
2⤵
PID:5740

C:\Windows\System\YOJajEW.exe
C:\Windows\System\YOJajEW.exe
2⤵
PID:5756

C:\Windows\System\aEyZpdj.exe
C:\Windows\System\aEyZpdj.exe
2⤵
PID:5772

C:\Windows\System\lQIPTUL.exe
C:\Windows\System\lQIPTUL.exe
2⤵
PID:5788

C:\Windows\System\qOlbPcT.exe
C:\Windows\System\qOlbPcT.exe
2⤵
PID:5804

C:\Windows\System\ScEzSCB.exe
C:\Windows\System\ScEzSCB.exe
2⤵
PID:5820

C:\Windows\System\dYiNWvB.exe
C:\Windows\System\dYiNWvB.exe
2⤵
PID:5836

C:\Windows\System\OQPgNeI.exe
C:\Windows\System\OQPgNeI.exe
2⤵
PID:5852

C:\Windows\System\AhowRGy.exe
C:\Windows\System\AhowRGy.exe
2⤵
PID:5868

C:\Windows\System\gEnsbBU.exe
C:\Windows\System\gEnsbBU.exe
2⤵
PID:5884

C:\Windows\System\ctkkGWS.exe
C:\Windows\System\ctkkGWS.exe
2⤵
PID:5904

C:\Windows\System\hzvujRL.exe
C:\Windows\System\hzvujRL.exe
2⤵
PID:5920

C:\Windows\System\MoJYYjH.exe
C:\Windows\System\MoJYYjH.exe
2⤵
PID:5936

C:\Windows\System\fFdlJRb.exe
C:\Windows\System\fFdlJRb.exe
2⤵
PID:5952

C:\Windows\System\FfbuNUB.exe
C:\Windows\System\FfbuNUB.exe
2⤵
PID:5968

C:\Windows\System\fbvwOvp.exe
C:\Windows\System\fbvwOvp.exe
2⤵
PID:5984

C:\Windows\System\BIdebEA.exe
C:\Windows\System\BIdebEA.exe
2⤵
PID:6000

C:\Windows\System\cXLAjGs.exe
C:\Windows\System\cXLAjGs.exe
2⤵
PID:6016

C:\Windows\System\wGxKwYC.exe
C:\Windows\System\wGxKwYC.exe
2⤵
PID:6032

C:\Windows\System\HjBJtEZ.exe
C:\Windows\System\HjBJtEZ.exe
2⤵
PID:6048

C:\Windows\System\DMgPrEo.exe
C:\Windows\System\DMgPrEo.exe
2⤵
PID:6064

C:\Windows\System\KqJVNWK.exe
C:\Windows\System\KqJVNWK.exe
2⤵
PID:6080

C:\Windows\System\CJcPoht.exe
C:\Windows\System\CJcPoht.exe
2⤵
PID:6096

C:\Windows\System\BQVtjTE.exe
C:\Windows\System\BQVtjTE.exe
2⤵
PID:6112

C:\Windows\System\xYGzQFe.exe
C:\Windows\System\xYGzQFe.exe
2⤵
PID:6128

C:\Windows\System\juXtHYP.exe
C:\Windows\System\juXtHYP.exe
2⤵
PID:3324

C:\Windows\System\UvYZTok.exe
C:\Windows\System\UvYZTok.exe
2⤵
PID:4872

C:\Windows\System\ffVaPBr.exe
C:\Windows\System\ffVaPBr.exe
2⤵
PID:5164

C:\Windows\System\PMCYtaH.exe
C:\Windows\System\PMCYtaH.exe
2⤵
PID:4376

C:\Windows\System\AZCiQst.exe
C:\Windows\System\AZCiQst.exe
2⤵
PID:5196

C:\Windows\System\uVerncA.exe
C:\Windows\System\uVerncA.exe
2⤵
PID:3816

C:\Windows\System\fYJehLq.exe
C:\Windows\System\fYJehLq.exe
2⤵
PID:5200

C:\Windows\System\yJqVojC.exe
C:\Windows\System\yJqVojC.exe
2⤵
PID:5232

C:\Windows\System\Jkigdxi.exe
C:\Windows\System\Jkigdxi.exe
2⤵
PID:5328

C:\Windows\System\tiSFLpt.exe
C:\Windows\System\tiSFLpt.exe
2⤵
PID:5324

C:\Windows\System\qsPqGqj.exe
C:\Windows\System\qsPqGqj.exe
2⤵
PID:5312

C:\Windows\System\CyLRKGi.exe
C:\Windows\System\CyLRKGi.exe
2⤵
PID:5356

C:\Windows\System\atAtZjb.exe
C:\Windows\System\atAtZjb.exe
2⤵
PID:5396

C:\Windows\System\GMfMcgN.exe
C:\Windows\System\GMfMcgN.exe
2⤵
PID:5460

C:\Windows\System\jcWnDHz.exe
C:\Windows\System\jcWnDHz.exe
2⤵
PID:5520

C:\Windows\System\GtmDpSt.exe
C:\Windows\System\GtmDpSt.exe
2⤵
PID:5560

C:\Windows\System\sUTrhLC.exe
C:\Windows\System\sUTrhLC.exe
2⤵
PID:5412

C:\Windows\System\BQdNEWj.exe
C:\Windows\System\BQdNEWj.exe
2⤵
PID:5476

C:\Windows\System\YLqUIMQ.exe
C:\Windows\System\YLqUIMQ.exe
2⤵
PID:5620

C:\Windows\System\iNIXyOp.exe
C:\Windows\System\iNIXyOp.exe
2⤵
PID:5572

C:\Windows\System\jRsATyb.exe
C:\Windows\System\jRsATyb.exe
2⤵
PID:5748

C:\Windows\System\UYpXMUd.exe
C:\Windows\System\UYpXMUd.exe
2⤵
PID:5576

C:\Windows\System\YKxqfel.exe
C:\Windows\System\YKxqfel.exe
2⤵
PID:5784

C:\Windows\System\geBerLy.exe
C:\Windows\System\geBerLy.exe
2⤵
PID:5640

C:\Windows\System\oieuvqr.exe
C:\Windows\System\oieuvqr.exe
2⤵
PID:5704

C:\Windows\System\hAeZUCb.exe
C:\Windows\System\hAeZUCb.exe
2⤵
PID:5796

C:\Windows\System\WBMIRHL.exe
C:\Windows\System\WBMIRHL.exe
2⤵
PID:4680

C:\Windows\System\mUezhxT.exe
C:\Windows\System\mUezhxT.exe
2⤵
PID:5864

C:\Windows\System\IHwARSn.exe
C:\Windows\System\IHwARSn.exe
2⤵
PID:5876

C:\Windows\System\kPcovjk.exe
C:\Windows\System\kPcovjk.exe
2⤵
PID:5932

C:\Windows\System\xmyhQIH.exe
C:\Windows\System\xmyhQIH.exe
2⤵
PID:5996

C:\Windows\System\BPnixuN.exe
C:\Windows\System\BPnixuN.exe
2⤵
PID:6088

C:\Windows\System\XTTEdWm.exe
C:\Windows\System\XTTEdWm.exe
2⤵
PID:6124

C:\Windows\System\NGPGoyZ.exe
C:\Windows\System\NGPGoyZ.exe
2⤵
PID:4344

C:\Windows\System\bxRXUEL.exe
C:\Windows\System\bxRXUEL.exe
2⤵
PID:5228

C:\Windows\System\xoxxLha.exe
C:\Windows\System\xoxxLha.exe
2⤵
PID:5344

C:\Windows\System\NMowrnF.exe
C:\Windows\System\NMowrnF.exe
2⤵
PID:5556

C:\Windows\System\puuAGaL.exe
C:\Windows\System\puuAGaL.exe
2⤵
PID:5160

C:\Windows\System\PuYXPPB.exe
C:\Windows\System\PuYXPPB.exe
2⤵
PID:5812

C:\Windows\System\SWfqUMz.exe
C:\Windows\System\SWfqUMz.exe
2⤵
PID:5492

C:\Windows\System\YNXjTaZ.exe
C:\Windows\System\YNXjTaZ.exe
2⤵
PID:5624

C:\Windows\System\vUkHjFI.exe
C:\Windows\System\vUkHjFI.exe
2⤵
PID:5608

C:\Windows\System\PcNnwop.exe
C:\Windows\System\PcNnwop.exe
2⤵
PID:5768

C:\Windows\System\qUhOQza.exe
C:\Windows\System\qUhOQza.exe
2⤵
PID:5992

C:\Windows\System\KoDHOrw.exe
C:\Windows\System\KoDHOrw.exe
2⤵
PID:4040

C:\Windows\System\RmbvdFF.exe
C:\Windows\System\RmbvdFF.exe
2⤵
PID:5860

C:\Windows\System\FykWebk.exe
C:\Windows\System\FykWebk.exe
2⤵
PID:5216

C:\Windows\System\RYnCsdm.exe
C:\Windows\System\RYnCsdm.exe
2⤵
PID:5540

C:\Windows\System\iQHfQtX.exe
C:\Windows\System\iQHfQtX.exe
2⤵
PID:5376

C:\Windows\System\xSeQvug.exe
C:\Windows\System\xSeQvug.exe
2⤵
PID:6040

C:\Windows\System\PqPbTLW.exe
C:\Windows\System\PqPbTLW.exe
2⤵
PID:5948

C:\Windows\System\qdbCekm.exe
C:\Windows\System\qdbCekm.exe
2⤵
PID:6140

C:\Windows\System\GkGHbXJ.exe
C:\Windows\System\GkGHbXJ.exe
2⤵
PID:5364

C:\Windows\System\uqRcJqe.exe
C:\Windows\System\uqRcJqe.exe
2⤵
PID:4984

C:\Windows\System\SHtTPXT.exe
C:\Windows\System\SHtTPXT.exe
2⤵
PID:5392

C:\Windows\System\AkRTnSS.exe
C:\Windows\System\AkRTnSS.exe
2⤵
PID:5964

C:\Windows\System\EKOytDS.exe
C:\Windows\System\EKOytDS.exe
2⤵
PID:5816

C:\Windows\System\kVvJcgu.exe
C:\Windows\System\kVvJcgu.exe
2⤵
PID:6060

C:\Windows\System\pdUhkcE.exe
C:\Windows\System\pdUhkcE.exe
2⤵
PID:5928

C:\Windows\System\dEYRlrx.exe
C:\Windows\System\dEYRlrx.exe
2⤵
PID:5508

C:\Windows\System\XpbFYOF.exe
C:\Windows\System\XpbFYOF.exe
2⤵
PID:5916

C:\Windows\System\lmnACjZ.exe
C:\Windows\System\lmnACjZ.exe
2⤵
PID:6008

C:\Windows\System\UIVKXqC.exe
C:\Windows\System\UIVKXqC.exe
2⤵
PID:5280

C:\Windows\System\jnpmiln.exe
C:\Windows\System\jnpmiln.exe
2⤵
PID:5720

C:\Windows\System\ROlhCme.exe
C:\Windows\System\ROlhCme.exe
2⤵
PID:5296

C:\Windows\System\XuylMLc.exe
C:\Windows\System\XuylMLc.exe
2⤵
PID:5176

C:\Windows\System\NAnLNFx.exe
C:\Windows\System\NAnLNFx.exe
2⤵
PID:5308

C:\Windows\System\gwqjsCO.exe
C:\Windows\System\gwqjsCO.exe
2⤵
PID:5672

C:\Windows\System\xNOBufZ.exe
C:\Windows\System\xNOBufZ.exe
2⤵
PID:6104

C:\Windows\System\RiZekMc.exe
C:\Windows\System\RiZekMc.exe
2⤵
PID:5764

C:\Windows\System\psJkvAM.exe
C:\Windows\System\psJkvAM.exe
2⤵
PID:6160

C:\Windows\System\UCTRtfz.exe
C:\Windows\System\UCTRtfz.exe
2⤵
PID:6184

C:\Windows\System\JdDVBdW.exe
C:\Windows\System\JdDVBdW.exe
2⤵
PID:6200

C:\Windows\System\VPcfCju.exe
C:\Windows\System\VPcfCju.exe
2⤵
PID:6216

C:\Windows\System\CEOtlgZ.exe
C:\Windows\System\CEOtlgZ.exe
2⤵
PID:6236

C:\Windows\System\kjddReQ.exe
C:\Windows\System\kjddReQ.exe
2⤵
PID:6252

C:\Windows\System\VmLcJtZ.exe
C:\Windows\System\VmLcJtZ.exe
2⤵
PID:6268

C:\Windows\System\Hsumiqv.exe
C:\Windows\System\Hsumiqv.exe
2⤵
PID:6284

C:\Windows\System\tDTVZjk.exe
C:\Windows\System\tDTVZjk.exe
2⤵
PID:6300

C:\Windows\System\kqyWBUz.exe
C:\Windows\System\kqyWBUz.exe
2⤵
PID:6316

C:\Windows\System\zoRPADE.exe
C:\Windows\System\zoRPADE.exe
2⤵
PID:6332

C:\Windows\System\zctzPCh.exe
C:\Windows\System\zctzPCh.exe
2⤵
PID:6348

C:\Windows\System\LIHKNVN.exe
C:\Windows\System\LIHKNVN.exe
2⤵
PID:6364

C:\Windows\System\kbbptpZ.exe
C:\Windows\System\kbbptpZ.exe
2⤵
PID:6380

C:\Windows\System\miLGfDn.exe
C:\Windows\System\miLGfDn.exe
2⤵
PID:6396

C:\Windows\System\LAeAgXb.exe
C:\Windows\System\LAeAgXb.exe
2⤵
PID:6412

C:\Windows\System\sNFQGby.exe
C:\Windows\System\sNFQGby.exe
2⤵
PID:6428

C:\Windows\System\aOVSqaU.exe
C:\Windows\System\aOVSqaU.exe
2⤵
PID:6444

C:\Windows\System\zSEcZKS.exe
C:\Windows\System\zSEcZKS.exe
2⤵
PID:6460

C:\Windows\System\AtscEpM.exe
C:\Windows\System\AtscEpM.exe
2⤵
PID:6476

C:\Windows\System\DoWPIYi.exe
C:\Windows\System\DoWPIYi.exe
2⤵
PID:6492

C:\Windows\System\egIoJwX.exe
C:\Windows\System\egIoJwX.exe
2⤵
PID:6508

C:\Windows\System\vLRbbfa.exe
C:\Windows\System\vLRbbfa.exe
2⤵
PID:6524

C:\Windows\System\wCsOmIe.exe
C:\Windows\System\wCsOmIe.exe
2⤵
PID:6540

C:\Windows\System\zTzBVRt.exe
C:\Windows\System\zTzBVRt.exe
2⤵
PID:6556

C:\Windows\System\wdPWEJx.exe
C:\Windows\System\wdPWEJx.exe
2⤵
PID:6572

C:\Windows\System\bDWKScQ.exe
C:\Windows\System\bDWKScQ.exe
2⤵
PID:6588

C:\Windows\System\howrQVZ.exe
C:\Windows\System\howrQVZ.exe
2⤵
PID:6604

C:\Windows\System\RUoovYv.exe
C:\Windows\System\RUoovYv.exe
2⤵
PID:6620

C:\Windows\System\utlQXsK.exe
C:\Windows\System\utlQXsK.exe
2⤵
PID:6636

C:\Windows\System\qmekHxb.exe
C:\Windows\System\qmekHxb.exe
2⤵
PID:6652

C:\Windows\System\CDnGKvf.exe
C:\Windows\System\CDnGKvf.exe
2⤵
PID:6668

C:\Windows\System\yJaWUJz.exe
C:\Windows\System\yJaWUJz.exe
2⤵
PID:6684

C:\Windows\System\SYfEMNI.exe
C:\Windows\System\SYfEMNI.exe
2⤵
PID:6700

C:\Windows\System\AfwwEEa.exe
C:\Windows\System\AfwwEEa.exe
2⤵
PID:6716

C:\Windows\System\vehlKGu.exe
C:\Windows\System\vehlKGu.exe
2⤵
PID:6732

C:\Windows\System\KEPkPUz.exe
C:\Windows\System\KEPkPUz.exe
2⤵
PID:6748

C:\Windows\System\eUZYKzn.exe
C:\Windows\System\eUZYKzn.exe
2⤵
PID:6764

C:\Windows\System\QhgoOur.exe
C:\Windows\System\QhgoOur.exe
2⤵
PID:6780

C:\Windows\System\KRLCEjZ.exe
C:\Windows\System\KRLCEjZ.exe
2⤵
PID:6796

C:\Windows\System\GrWjpBT.exe
C:\Windows\System\GrWjpBT.exe
2⤵
PID:6812

C:\Windows\System\rsQOhTF.exe
C:\Windows\System\rsQOhTF.exe
2⤵
PID:6832

C:\Windows\System\fnXBNiw.exe
C:\Windows\System\fnXBNiw.exe
2⤵
PID:6848

C:\Windows\System\shJPBex.exe
C:\Windows\System\shJPBex.exe
2⤵
PID:6864

C:\Windows\System\vZxiGbN.exe
C:\Windows\System\vZxiGbN.exe
2⤵
PID:6880

C:\Windows\System\TYOwJhW.exe
C:\Windows\System\TYOwJhW.exe
2⤵
PID:6896

C:\Windows\System\vYSWZDf.exe
C:\Windows\System\vYSWZDf.exe
2⤵
PID:6912

C:\Windows\System\InhPMzP.exe
C:\Windows\System\InhPMzP.exe
2⤵
PID:6928

C:\Windows\System\rsPnkkj.exe
C:\Windows\System\rsPnkkj.exe
2⤵
PID:6948

C:\Windows\System\llUeqHk.exe
C:\Windows\System\llUeqHk.exe
2⤵
PID:6964

C:\Windows\System\GzYXLVH.exe
C:\Windows\System\GzYXLVH.exe
2⤵
PID:6980

C:\Windows\System\yPSjcBs.exe
C:\Windows\System\yPSjcBs.exe
2⤵
PID:6996

C:\Windows\System\cZWveHr.exe
C:\Windows\System\cZWveHr.exe
2⤵
PID:7012

C:\Windows\System\WrYPLqJ.exe
C:\Windows\System\WrYPLqJ.exe
2⤵
PID:7032

C:\Windows\System\xxbbWpB.exe
C:\Windows\System\xxbbWpB.exe
2⤵
PID:7048

C:\Windows\System\ynNyfni.exe
C:\Windows\System\ynNyfni.exe
2⤵
PID:7064

C:\Windows\System\GTKbduW.exe
C:\Windows\System\GTKbduW.exe
2⤵
PID:7080

C:\Windows\System\fXtjjHx.exe
C:\Windows\System\fXtjjHx.exe
2⤵
PID:7096

C:\Windows\System\FlLdekH.exe
C:\Windows\System\FlLdekH.exe
2⤵
PID:7112

C:\Windows\System\gYwUuuD.exe
C:\Windows\System\gYwUuuD.exe
2⤵
PID:7128

C:\Windows\System\TtOxqkg.exe
C:\Windows\System\TtOxqkg.exe
2⤵
PID:7144

C:\Windows\System\DjOyMAy.exe
C:\Windows\System\DjOyMAy.exe
2⤵
PID:7160

C:\Windows\System\yxhJIIB.exe
C:\Windows\System\yxhJIIB.exe
2⤵
PID:4748

C:\Windows\System\drxEMPR.exe
C:\Windows\System\drxEMPR.exe
2⤵
PID:6172

C:\Windows\System\aiRJPLF.exe
C:\Windows\System\aiRJPLF.exe
2⤵
PID:6212

C:\Windows\System\LgmjRed.exe
C:\Windows\System\LgmjRed.exe
2⤵
PID:1476

C:\Windows\System\ZMxeblB.exe
C:\Windows\System\ZMxeblB.exe
2⤵
PID:6312

C:\Windows\System\ZqNtlmm.exe
C:\Windows\System\ZqNtlmm.exe
2⤵
PID:6404

C:\Windows\System\AEohUcL.exe
C:\Windows\System\AEohUcL.exe
2⤵
PID:6468

C:\Windows\System\dyItWyI.exe
C:\Windows\System\dyItWyI.exe
2⤵
PID:6224

C:\Windows\System\NbPkURI.exe
C:\Windows\System\NbPkURI.exe
2⤵
PID:6292

C:\Windows\System\FpnaSTZ.exe
C:\Windows\System\FpnaSTZ.exe
2⤵
PID:6328

C:\Windows\System\SRcSoTA.exe
C:\Windows\System\SRcSoTA.exe
2⤵
PID:6228

C:\Windows\System\XVwuYNo.exe
C:\Windows\System\XVwuYNo.exe
2⤵
PID:6260

C:\Windows\System\COCzYAQ.exe
C:\Windows\System\COCzYAQ.exe
2⤵
PID:6388

C:\Windows\System\QWeQsmI.exe
C:\Windows\System\QWeQsmI.exe
2⤵
PID:6516

C:\Windows\System\DZqCOJS.exe
C:\Windows\System\DZqCOJS.exe
2⤵
PID:6628

C:\Windows\System\tTGrdMb.exe
C:\Windows\System\tTGrdMb.exe
2⤵
PID:6548

C:\Windows\System\cdPWWzf.exe
C:\Windows\System\cdPWWzf.exe
2⤵
PID:6612

C:\Windows\System\MkRRryw.exe
C:\Windows\System\MkRRryw.exe
2⤵
PID:6664

C:\Windows\System\zSlNagi.exe
C:\Windows\System\zSlNagi.exe
2⤵
PID:6728

C:\Windows\System\ZDGEVkK.exe
C:\Windows\System\ZDGEVkK.exe
2⤵
PID:6820

C:\Windows\System\lpnNkKs.exe
C:\Windows\System\lpnNkKs.exe
2⤵
PID:6860

C:\Windows\System\vATSlgn.exe
C:\Windows\System\vATSlgn.exe
2⤵
PID:6676

C:\Windows\System\pgrbiIp.exe
C:\Windows\System\pgrbiIp.exe
2⤵
PID:6744

C:\Windows\System\pCqfKbS.exe
C:\Windows\System\pCqfKbS.exe
2⤵
PID:6840

C:\Windows\System\EDQQNfe.exe
C:\Windows\System\EDQQNfe.exe
2⤵
PID:6904

C:\Windows\System\ZNKdAnA.exe
C:\Windows\System\ZNKdAnA.exe
2⤵
PID:6988

C:\Windows\System\ljjOrUW.exe
C:\Windows\System\ljjOrUW.exe
2⤵
PID:7056

C:\Windows\System\MPgQrDU.exe
C:\Windows\System\MPgQrDU.exe
2⤵
PID:7120

C:\Windows\System\tOGUdiI.exe
C:\Windows\System\tOGUdiI.exe
2⤵
PID:6960

C:\Windows\System\kqIclhf.exe
C:\Windows\System\kqIclhf.exe
2⤵
PID:6344

C:\Windows\System\APJEiOI.exe
C:\Windows\System\APJEiOI.exe
2⤵
PID:6472

C:\Windows\System\lhVqoIz.exe
C:\Windows\System\lhVqoIz.exe
2⤵
PID:6456

C:\Windows\System\xRWFahl.exe
C:\Windows\System\xRWFahl.exe
2⤵
PID:6976

C:\Windows\System\hIyXezM.exe
C:\Windows\System\hIyXezM.exe
2⤵
PID:7104

C:\Windows\System\hDRZzkL.exe
C:\Windows\System\hDRZzkL.exe
2⤵
PID:7108

C:\Windows\System\zqZhklp.exe
C:\Windows\System\zqZhklp.exe
2⤵
PID:6280

C:\Windows\System\DYqgKma.exe
C:\Windows\System\DYqgKma.exe
2⤵
PID:6424

C:\Windows\System\mznmXba.exe
C:\Windows\System\mznmXba.exe
2⤵
PID:6568

C:\Windows\System\nVQnCFB.exe
C:\Windows\System\nVQnCFB.exe
2⤵
PID:6308

C:\Windows\System\UqhOKzK.exe
C:\Windows\System\UqhOKzK.exe
2⤵
PID:6484

C:\Windows\System\easPYzq.exe
C:\Windows\System\easPYzq.exe
2⤵
PID:6648

C:\Windows\System\kNBfrzm.exe
C:\Windows\System\kNBfrzm.exe
2⤵
PID:6580

C:\Windows\System\fivlIkv.exe
C:\Windows\System\fivlIkv.exe
2⤵
PID:6808

C:\Windows\System\agXbqHR.exe
C:\Windows\System\agXbqHR.exe
2⤵
PID:6696

C:\Windows\System\LwnOkvP.exe
C:\Windows\System\LwnOkvP.exe
2⤵
PID:6828

C:\Windows\System\nzvKgHX.exe
C:\Windows\System\nzvKgHX.exe
2⤵
PID:6296

C:\Windows\System\PpuXYes.exe
C:\Windows\System\PpuXYes.exe
2⤵
PID:5592

C:\Windows\System\IydhBnu.exe
C:\Windows\System\IydhBnu.exe
2⤵
PID:6940

C:\Windows\System\kdHnuKx.exe
C:\Windows\System\kdHnuKx.exe
2⤵
PID:6376

C:\Windows\System\bUboDvh.exe
C:\Windows\System\bUboDvh.exe
2⤵
PID:6712

C:\Windows\System\PBqSnem.exe
C:\Windows\System\PBqSnem.exe
2⤵
PID:7028

C:\Windows\System\WGEXIOO.exe
C:\Windows\System\WGEXIOO.exe
2⤵
PID:6944

C:\Windows\System\YEjxfAy.exe
C:\Windows\System\YEjxfAy.exe
2⤵
PID:6788

C:\Windows\System\ogkhuqw.exe
C:\Windows\System\ogkhuqw.exe
2⤵
PID:6156

C:\Windows\System\ltZjfQb.exe
C:\Windows\System\ltZjfQb.exe
2⤵
PID:6152

C:\Windows\System\OIRpndT.exe
C:\Windows\System\OIRpndT.exe
2⤵
PID:6180

C:\Windows\System\ghVmcit.exe
C:\Windows\System\ghVmcit.exe
2⤵
PID:6600

C:\Windows\System\bAMmTCu.exe
C:\Windows\System\bAMmTCu.exe
2⤵
PID:7072

C:\Windows\System\ksGnwan.exe
C:\Windows\System\ksGnwan.exe
2⤵
PID:7004

C:\Windows\System\vwESkcy.exe
C:\Windows\System\vwESkcy.exe
2⤵
PID:7140

C:\Windows\System\JXJZjrH.exe
C:\Windows\System\JXJZjrH.exe
2⤵
PID:6584

C:\Windows\System\thfLumI.exe
C:\Windows\System\thfLumI.exe
2⤵
PID:6660

C:\Windows\System\HXIFqWj.exe
C:\Windows\System\HXIFqWj.exe
2⤵
PID:7024

C:\Windows\System\vgOIiKF.exe
C:\Windows\System\vgOIiKF.exe
2⤵
PID:7044

C:\Windows\System\piqIwUl.exe
C:\Windows\System\piqIwUl.exe
2⤵
PID:7156

C:\Windows\System\nVLLDsd.exe
C:\Windows\System\nVLLDsd.exe
2⤵
PID:7188

C:\Windows\System\iHRmMtQ.exe
C:\Windows\System\iHRmMtQ.exe
2⤵
PID:7204

C:\Windows\System\TubigLG.exe
C:\Windows\System\TubigLG.exe
2⤵
PID:7220

C:\Windows\System\zuvuGqJ.exe
C:\Windows\System\zuvuGqJ.exe
2⤵
PID:7236

C:\Windows\System\wAnOuGL.exe
C:\Windows\System\wAnOuGL.exe
2⤵
PID:7252

C:\Windows\System\vtoTHbZ.exe
C:\Windows\System\vtoTHbZ.exe
2⤵
PID:7268

C:\Windows\System\NIulcXa.exe
C:\Windows\System\NIulcXa.exe
2⤵
PID:7284

C:\Windows\System\nEqCOEj.exe
C:\Windows\System\nEqCOEj.exe
2⤵
PID:7300

C:\Windows\System\UXSMOPf.exe
C:\Windows\System\UXSMOPf.exe
2⤵
PID:7316

C:\Windows\System\Caqjtwp.exe
C:\Windows\System\Caqjtwp.exe
2⤵
PID:7332

C:\Windows\System\TPYMiFi.exe
C:\Windows\System\TPYMiFi.exe
2⤵
PID:7348

C:\Windows\System\XisKxOS.exe
C:\Windows\System\XisKxOS.exe
2⤵
PID:7364

C:\Windows\System\BQmxCzW.exe
C:\Windows\System\BQmxCzW.exe
2⤵
PID:7404

C:\Windows\System\UjUnGTL.exe
C:\Windows\System\UjUnGTL.exe
2⤵
PID:7420

C:\Windows\System\wrtYNRz.exe
C:\Windows\System\wrtYNRz.exe
2⤵
PID:7436

C:\Windows\System\GkWAMJI.exe
C:\Windows\System\GkWAMJI.exe
2⤵
PID:7460

C:\Windows\System\OVuFpHq.exe
C:\Windows\System\OVuFpHq.exe
2⤵
PID:7480

C:\Windows\System\UuFODab.exe
C:\Windows\System\UuFODab.exe
2⤵
PID:7496

C:\Windows\System\xFSffhl.exe
C:\Windows\System\xFSffhl.exe
2⤵
PID:7516

C:\Windows\System\KLOuUXs.exe
C:\Windows\System\KLOuUXs.exe
2⤵
PID:7532

C:\Windows\System\oyeMTYI.exe
C:\Windows\System\oyeMTYI.exe
2⤵
PID:7548

C:\Windows\System\AUNtnrg.exe
C:\Windows\System\AUNtnrg.exe
2⤵
PID:7564

C:\Windows\System\DjwnYHv.exe
C:\Windows\System\DjwnYHv.exe
2⤵
PID:7580

C:\Windows\System\hcROuOO.exe
C:\Windows\System\hcROuOO.exe
2⤵
PID:7596

C:\Windows\System\fVveepX.exe
C:\Windows\System\fVveepX.exe
2⤵
PID:7612

C:\Windows\System\GpbSzqJ.exe
C:\Windows\System\GpbSzqJ.exe
2⤵
PID:7628

C:\Windows\System\RKsLFvo.exe
C:\Windows\System\RKsLFvo.exe
2⤵
PID:7648

C:\Windows\System\SPCRANX.exe
C:\Windows\System\SPCRANX.exe
2⤵
PID:7664

C:\Windows\System\mWxBPdX.exe
C:\Windows\System\mWxBPdX.exe
2⤵
PID:7680

C:\Windows\System\BEMMbLN.exe
C:\Windows\System\BEMMbLN.exe
2⤵
PID:7700

C:\Windows\System\cwFMWQD.exe
C:\Windows\System\cwFMWQD.exe
2⤵
PID:7716

C:\Windows\System\YIIoYIk.exe
C:\Windows\System\YIIoYIk.exe
2⤵
PID:7732

C:\Windows\System\FHktoyo.exe
C:\Windows\System\FHktoyo.exe
2⤵
PID:7752

C:\Windows\System\TTLoeXF.exe
C:\Windows\System\TTLoeXF.exe
2⤵
PID:7768

C:\Windows\System\WlKWKvj.exe
C:\Windows\System\WlKWKvj.exe
2⤵
PID:7784

C:\Windows\System\JbUwOGP.exe
C:\Windows\System\JbUwOGP.exe
2⤵
PID:7844

C:\Windows\System\tLFHkVN.exe
C:\Windows\System\tLFHkVN.exe
2⤵
PID:7860

C:\Windows\System\EmvEHCL.exe
C:\Windows\System\EmvEHCL.exe
2⤵
PID:7880

C:\Windows\System\CoKfOsf.exe
C:\Windows\System\CoKfOsf.exe
2⤵
PID:7896

C:\Windows\System\qQlwCLd.exe
C:\Windows\System\qQlwCLd.exe
2⤵
PID:7912

C:\Windows\System\cxxRYSS.exe
C:\Windows\System\cxxRYSS.exe
2⤵
PID:7928

C:\Windows\System\jQxaFzV.exe
C:\Windows\System\jQxaFzV.exe
2⤵
PID:7944

C:\Windows\System\TGcGyeU.exe
C:\Windows\System\TGcGyeU.exe
2⤵
PID:7960

C:\Windows\System\iMDzQNg.exe
C:\Windows\System\iMDzQNg.exe
2⤵
PID:7976

C:\Windows\System\RgOBgAY.exe
C:\Windows\System\RgOBgAY.exe
2⤵
PID:7996

C:\Windows\System\RhsFGPX.exe
C:\Windows\System\RhsFGPX.exe
2⤵
PID:8012

C:\Windows\System\zKMSyRz.exe
C:\Windows\System\zKMSyRz.exe
2⤵
PID:8028

C:\Windows\System\LiLxKgv.exe
C:\Windows\System\LiLxKgv.exe
2⤵
PID:8048

C:\Windows\System\btnysJP.exe
C:\Windows\System\btnysJP.exe
2⤵
PID:8064

C:\Windows\System\nosoPEu.exe
C:\Windows\System\nosoPEu.exe
2⤵
PID:8080

C:\Windows\System\pADdawx.exe
C:\Windows\System\pADdawx.exe
2⤵
PID:8096

C:\Windows\System\dquObMn.exe
C:\Windows\System\dquObMn.exe
2⤵
PID:8112

C:\Windows\System\hTvnhsO.exe
C:\Windows\System\hTvnhsO.exe
2⤵
PID:8132

C:\Windows\System\uVmAsBS.exe
C:\Windows\System\uVmAsBS.exe
2⤵
PID:8148

C:\Windows\System\GkdCXSm.exe
C:\Windows\System\GkdCXSm.exe
2⤵
PID:8164

C:\Windows\System\UKdLYaV.exe
C:\Windows\System\UKdLYaV.exe
2⤵
PID:8180

C:\Windows\System\qjWIyfG.exe
C:\Windows\System\qjWIyfG.exe
2⤵
PID:7180

C:\Windows\System\RvvecsP.exe
C:\Windows\System\RvvecsP.exe
2⤵
PID:6856

C:\Windows\System\RBdaMcQ.exe
C:\Windows\System\RBdaMcQ.exe
2⤵
PID:7200

C:\Windows\System\MAXkFmt.exe
C:\Windows\System\MAXkFmt.exe
2⤵
PID:7248

C:\Windows\System\tchOHqX.exe
C:\Windows\System\tchOHqX.exe
2⤵
PID:7308

C:\Windows\System\cNgexKK.exe
C:\Windows\System\cNgexKK.exe
2⤵
PID:7340

C:\Windows\System\dByGpAF.exe
C:\Windows\System\dByGpAF.exe
2⤵
PID:7360

C:\Windows\System\tfSokmt.exe
C:\Windows\System\tfSokmt.exe
2⤵
PID:7380

C:\Windows\System\tYoodsi.exe
C:\Windows\System\tYoodsi.exe
2⤵
PID:7388

C:\Windows\System\qLSbaZB.exe
C:\Windows\System\qLSbaZB.exe
2⤵
PID:7428

C:\Windows\System\cBqnSqr.exe
C:\Windows\System\cBqnSqr.exe
2⤵
PID:7504

C:\Windows\System\lDlSusA.exe
C:\Windows\System\lDlSusA.exe
2⤵
PID:7488

C:\Windows\System\ytFbcaz.exe
C:\Windows\System\ytFbcaz.exe
2⤵
PID:7416

C:\Windows\System\yfaGANz.exe
C:\Windows\System\yfaGANz.exe
2⤵
PID:7456

C:\Windows\System\IhIsnEC.exe
C:\Windows\System\IhIsnEC.exe
2⤵
PID:7576

C:\Windows\System\ZjqZQdu.exe
C:\Windows\System\ZjqZQdu.exe
2⤵
PID:7644

C:\Windows\System\AGLnRJG.exe
C:\Windows\System\AGLnRJG.exe
2⤵
PID:7708

C:\Windows\System\RxbwWNJ.exe
C:\Windows\System\RxbwWNJ.exe
2⤵
PID:7624

C:\Windows\System\QHCQojM.exe
C:\Windows\System\QHCQojM.exe
2⤵
PID:7696

C:\Windows\System\MxjJMpW.exe
C:\Windows\System\MxjJMpW.exe
2⤵
PID:7688

C:\Windows\System\QITildt.exe
C:\Windows\System\QITildt.exe
2⤵
PID:7728

C:\Windows\System\COzWNQM.exe
C:\Windows\System\COzWNQM.exe
2⤵
PID:7792

C:\Windows\System\HskxXFt.exe
C:\Windows\System\HskxXFt.exe
2⤵
PID:7808

C:\Windows\System\RrOXWvc.exe
C:\Windows\System\RrOXWvc.exe
2⤵
PID:7824

C:\Windows\System\oTROuOk.exe
C:\Windows\System\oTROuOk.exe
2⤵
PID:7840

C:\Windows\System\uImOJlD.exe
C:\Windows\System\uImOJlD.exe
2⤵
PID:7924

C:\Windows\System\PbjJUYX.exe
C:\Windows\System\PbjJUYX.exe
2⤵
PID:7956

C:\Windows\System\brwbZVG.exe
C:\Windows\System\brwbZVG.exe
2⤵
PID:7876

C:\Windows\System\pfdGbMr.exe
C:\Windows\System\pfdGbMr.exe
2⤵
PID:7940

C:\Windows\System\olaRbdo.exe
C:\Windows\System\olaRbdo.exe
2⤵
PID:8008

C:\Windows\System\UCTWkUN.exe
C:\Windows\System\UCTWkUN.exe
2⤵
PID:8072

C:\Windows\System\EFEuefC.exe
C:\Windows\System\EFEuefC.exe
2⤵
PID:8176

C:\Windows\System\rCpheGV.exe
C:\Windows\System\rCpheGV.exe
2⤵
PID:7244

C:\Windows\System\reQtIeS.exe
C:\Windows\System\reQtIeS.exe
2⤵
PID:7232

C:\Windows\System\XNqojOP.exe
C:\Windows\System\XNqojOP.exe
2⤵
PID:5736

C:\Windows\System\TWPWxxM.exe
C:\Windows\System\TWPWxxM.exe
2⤵
PID:7476

C:\Windows\System\YclaeVV.exe
C:\Windows\System\YclaeVV.exe
2⤵
PID:7524

C:\Windows\System\KkNmAuO.exe
C:\Windows\System\KkNmAuO.exe
2⤵
PID:7740

C:\Windows\System\dadOVJF.exe
C:\Windows\System\dadOVJF.exe
2⤵
PID:7796

C:\Windows\System\lPcplWa.exe
C:\Windows\System\lPcplWa.exe
2⤵
PID:7356

C:\Windows\System\aijIqfl.exe
C:\Windows\System\aijIqfl.exe
2⤵
PID:7448

C:\Windows\System\YSBeznR.exe
C:\Windows\System\YSBeznR.exe
2⤵
PID:7592

C:\Windows\System\GcMWUgI.exe
C:\Windows\System\GcMWUgI.exe
2⤵
PID:7764

C:\Windows\System\zZuMeqT.exe
C:\Windows\System\zZuMeqT.exe
2⤵
PID:7856

C:\Windows\System\OFLArkq.exe
C:\Windows\System\OFLArkq.exe
2⤵
PID:7936

C:\Windows\System\iggSkBS.exe
C:\Windows\System\iggSkBS.exe
2⤵
PID:8104

C:\Windows\System\jcKMcSv.exe
C:\Windows\System\jcKMcSv.exe
2⤵
PID:7972

C:\Windows\System\rPFmXmw.exe
C:\Windows\System\rPFmXmw.exe
2⤵
PID:8060

C:\Windows\System\AWDlQzi.exe
C:\Windows\System\AWDlQzi.exe
2⤵
PID:8124

C:\Windows\System\ylyqXey.exe
C:\Windows\System\ylyqXey.exe
2⤵
PID:7512

C:\Windows\System\EvnuBEE.exe
C:\Windows\System\EvnuBEE.exe
2⤵
PID:7412

C:\Windows\System\puLsJoz.exe
C:\Windows\System\puLsJoz.exe
2⤵
PID:7216

C:\Windows\System\SPRHiqX.exe
C:\Windows\System\SPRHiqX.exe
2⤵
PID:8140

C:\Windows\System\MedkmMC.exe
C:\Windows\System\MedkmMC.exe
2⤵
PID:7984

C:\Windows\System\xVQTxMm.exe
C:\Windows\System\xVQTxMm.exe
2⤵
PID:7276

C:\Windows\System\XgNeJtW.exe
C:\Windows\System\XgNeJtW.exe
2⤵
PID:8156

C:\Windows\System\VntStaI.exe
C:\Windows\System\VntStaI.exe
2⤵
PID:7280

C:\Windows\System\FCuHLnl.exe
C:\Windows\System\FCuHLnl.exe
2⤵
PID:7676

C:\Windows\System\hncNqFP.exe
C:\Windows\System\hncNqFP.exe
2⤵
PID:7640

C:\Windows\System\xYlWpwK.exe
C:\Windows\System\xYlWpwK.exe
2⤵
PID:7952

C:\Windows\System\Cxuppja.exe
C:\Windows\System\Cxuppja.exe
2⤵
PID:7396

C:\Windows\System\pTeCTPh.exe
C:\Windows\System\pTeCTPh.exe
2⤵
PID:7656

C:\Windows\System\UnlnlXo.exe
C:\Windows\System\UnlnlXo.exe
2⤵
PID:7372

C:\Windows\System\NkXmkUB.exe
C:\Windows\System\NkXmkUB.exe
2⤵
PID:7344

C:\Windows\System\aahgMPz.exe
C:\Windows\System\aahgMPz.exe
2⤵
PID:7608

C:\Windows\System\IpvWRVm.exe
C:\Windows\System\IpvWRVm.exe
2⤵
PID:7832

C:\Windows\System\wDrIGmi.exe
C:\Windows\System\wDrIGmi.exe
2⤵
PID:8056

C:\Windows\System\ufZnUmc.exe
C:\Windows\System\ufZnUmc.exe
2⤵
PID:8196

C:\Windows\System\HSMcEDZ.exe
C:\Windows\System\HSMcEDZ.exe
2⤵
PID:8216

C:\Windows\System\mQadfdl.exe
C:\Windows\System\mQadfdl.exe
2⤵
PID:8232

C:\Windows\System\ynCowDc.exe
C:\Windows\System\ynCowDc.exe
2⤵
PID:8248

C:\Windows\System\SVHdjXi.exe
C:\Windows\System\SVHdjXi.exe
2⤵
PID:8268

C:\Windows\System\tHHavzv.exe
C:\Windows\System\tHHavzv.exe
2⤵
PID:8284

C:\Windows\System\sluXlBI.exe
C:\Windows\System\sluXlBI.exe
2⤵
PID:8304

C:\Windows\System\Shfpkhp.exe
C:\Windows\System\Shfpkhp.exe
2⤵
PID:8320

C:\Windows\System\CWXNzuJ.exe
C:\Windows\System\CWXNzuJ.exe
2⤵
PID:8336

C:\Windows\System\TdHrwvZ.exe
C:\Windows\System\TdHrwvZ.exe
2⤵
PID:8360

C:\Windows\System\fuqvkNK.exe
C:\Windows\System\fuqvkNK.exe
2⤵
PID:8376

C:\Windows\System\vovbrqh.exe
C:\Windows\System\vovbrqh.exe
2⤵
PID:8392

C:\Windows\System\xyhGMqB.exe
C:\Windows\System\xyhGMqB.exe
2⤵
PID:8420

C:\Windows\System\VlyYTdE.exe
C:\Windows\System\VlyYTdE.exe
2⤵
PID:8436

C:\Windows\System\cnFoojm.exe
C:\Windows\System\cnFoojm.exe
2⤵
PID:8452

C:\Windows\System\yrLpQgl.exe
C:\Windows\System\yrLpQgl.exe
2⤵
PID:8468

C:\Windows\System\YfBwbYw.exe
C:\Windows\System\YfBwbYw.exe
2⤵
PID:8484

C:\Windows\System\zqYyNXf.exe
C:\Windows\System\zqYyNXf.exe
2⤵
PID:8500

C:\Windows\System\OptbXXJ.exe
C:\Windows\System\OptbXXJ.exe
2⤵
PID:8516

C:\Windows\System\pVbxSDq.exe
C:\Windows\System\pVbxSDq.exe
2⤵
PID:8532

C:\Windows\System\RkxcGGg.exe
C:\Windows\System\RkxcGGg.exe
2⤵
PID:8552

C:\Windows\System\UFWJqJJ.exe
C:\Windows\System\UFWJqJJ.exe
2⤵
PID:8568

C:\Windows\System\SRuSBok.exe
C:\Windows\System\SRuSBok.exe
2⤵
PID:8584

C:\Windows\System\VGHrYyW.exe
C:\Windows\System\VGHrYyW.exe
2⤵
PID:8600

C:\Windows\System\yurrvkz.exe
C:\Windows\System\yurrvkz.exe
2⤵
PID:8616

C:\Windows\System\gWkYjdg.exe
C:\Windows\System\gWkYjdg.exe
2⤵
PID:8632

C:\Windows\System\JLMrClD.exe
C:\Windows\System\JLMrClD.exe
2⤵
PID:8648

C:\Windows\System\kwRRoVy.exe
C:\Windows\System\kwRRoVy.exe
2⤵
PID:8664

C:\Windows\System\AnifiaP.exe
C:\Windows\System\AnifiaP.exe
2⤵
PID:8680

C:\Windows\System\rPGRalI.exe
C:\Windows\System\rPGRalI.exe
2⤵
PID:8760

C:\Windows\System\SWJwmyR.exe
C:\Windows\System\SWJwmyR.exe
2⤵
PID:8780

C:\Windows\System\zGGjHQr.exe
C:\Windows\System\zGGjHQr.exe
2⤵
PID:8796

C:\Windows\System\LBvDrlW.exe
C:\Windows\System\LBvDrlW.exe
2⤵
PID:8812

C:\Windows\System\gFueyjm.exe
C:\Windows\System\gFueyjm.exe
2⤵
PID:8828

C:\Windows\System\lKwecos.exe
C:\Windows\System\lKwecos.exe
2⤵
PID:8844

C:\Windows\System\eydPSHF.exe
C:\Windows\System\eydPSHF.exe
2⤵
PID:8860

C:\Windows\System\eQSgOyg.exe
C:\Windows\System\eQSgOyg.exe
2⤵
PID:8876

C:\Windows\System\Btdqrza.exe
C:\Windows\System\Btdqrza.exe
2⤵
PID:8892

C:\Windows\System\zEIIkzz.exe
C:\Windows\System\zEIIkzz.exe
2⤵
PID:8908

C:\Windows\System\uIEbNMC.exe
C:\Windows\System\uIEbNMC.exe
2⤵
PID:8924

C:\Windows\System\nuUTAyZ.exe
C:\Windows\System\nuUTAyZ.exe
2⤵
PID:8940

C:\Windows\System\Tixgnjt.exe
C:\Windows\System\Tixgnjt.exe
2⤵
PID:8956

C:\Windows\System\KDgSECc.exe
C:\Windows\System\KDgSECc.exe
2⤵
PID:8972

C:\Windows\System\viXdyEs.exe
C:\Windows\System\viXdyEs.exe
2⤵
PID:8988

C:\Windows\System\RuvinwT.exe
C:\Windows\System\RuvinwT.exe
2⤵
PID:9004

C:\Windows\System\OzzTAfj.exe
C:\Windows\System\OzzTAfj.exe
2⤵
PID:9020

C:\Windows\System\gYQmWnB.exe
C:\Windows\System\gYQmWnB.exe
2⤵
PID:9036

C:\Windows\System\TytwfEw.exe
C:\Windows\System\TytwfEw.exe
2⤵
PID:9052

C:\Windows\System\KPshfUU.exe
C:\Windows\System\KPshfUU.exe
2⤵
PID:9068

C:\Windows\System\ONPddkv.exe
C:\Windows\System\ONPddkv.exe
2⤵
PID:9084

C:\Windows\System\cQoGmCV.exe
C:\Windows\System\cQoGmCV.exe
2⤵
PID:9100

C:\Windows\System\fjXfQko.exe
C:\Windows\System\fjXfQko.exe
2⤵
PID:9116

C:\Windows\System\kqAfvkw.exe
C:\Windows\System\kqAfvkw.exe
2⤵
PID:9136

C:\Windows\System\HSdvMSC.exe
C:\Windows\System\HSdvMSC.exe
2⤵
PID:9156

C:\Windows\System\LexwNbV.exe
C:\Windows\System\LexwNbV.exe
2⤵
PID:9172

C:\Windows\System\yirfqsS.exe
C:\Windows\System\yirfqsS.exe
2⤵
PID:9188

C:\Windows\System\cwwysII.exe
C:\Windows\System\cwwysII.exe
2⤵
PID:9204

C:\Windows\System\dBBOePt.exe
C:\Windows\System\dBBOePt.exe
2⤵
PID:7472

C:\Windows\System\ltIiiBR.exe
C:\Windows\System\ltIiiBR.exe
2⤵
PID:8024

C:\Windows\System\isCnUcM.exe
C:\Windows\System\isCnUcM.exe
2⤵
PID:8256

C:\Windows\System\wPombxO.exe
C:\Windows\System\wPombxO.exe
2⤵
PID:8264

C:\Windows\System\nRTpdtA.exe
C:\Windows\System\nRTpdtA.exe
2⤵
PID:7672

C:\Windows\System\PWcdAAy.exe
C:\Windows\System\PWcdAAy.exe
2⤵
PID:8240

C:\Windows\System\ohEkETQ.exe
C:\Windows\System\ohEkETQ.exe
2⤵
PID:8316

C:\Windows\System\oZghEGW.exe
C:\Windows\System\oZghEGW.exe
2⤵
PID:8384

C:\Windows\System\RnjqfVo.exe
C:\Windows\System\RnjqfVo.exe
2⤵
PID:8372

C:\Windows\System\eMfWJSB.exe
C:\Windows\System\eMfWJSB.exe
2⤵
PID:8432

C:\Windows\System\OdTdZTV.exe
C:\Windows\System\OdTdZTV.exe
2⤵
PID:8368

C:\Windows\System\RQKMhry.exe
C:\Windows\System\RQKMhry.exe
2⤵
PID:8492

C:\Windows\System\aLjuTQQ.exe
C:\Windows\System\aLjuTQQ.exe
2⤵
PID:8560

C:\Windows\System\CSrWRed.exe
C:\Windows\System\CSrWRed.exe
2⤵
PID:8624

C:\Windows\System\SxjBwCb.exe
C:\Windows\System\SxjBwCb.exe
2⤵
PID:8688

C:\Windows\System\mchQphk.exe
C:\Windows\System\mchQphk.exe
2⤵
PID:8580

C:\Windows\System\zDtfElF.exe
C:\Windows\System\zDtfElF.exe
2⤵
PID:8672

C:\Windows\System\WFgWYAQ.exe
C:\Windows\System\WFgWYAQ.exe
2⤵
PID:8724

C:\Windows\System\UmmNtpp.exe
C:\Windows\System\UmmNtpp.exe
2⤵
PID:8740

C:\Windows\System\RtiBIwl.exe
C:\Windows\System\RtiBIwl.exe
2⤵
PID:8772

C:\Windows\System\LNDmwEP.exe
C:\Windows\System\LNDmwEP.exe
2⤵
PID:8932

C:\Windows\System\CwvcYJG.exe
C:\Windows\System\CwvcYJG.exe
2⤵
PID:8856

C:\Windows\System\BYVYsPz.exe
C:\Windows\System\BYVYsPz.exe
2⤵
PID:8996

C:\Windows\System\vnXiMos.exe
C:\Windows\System\vnXiMos.exe
2⤵
PID:8888

C:\Windows\System\BXYayGj.exe
C:\Windows\System\BXYayGj.exe
2⤵
PID:9012

C:\Windows\System\mFBJslG.exe
C:\Windows\System\mFBJslG.exe
2⤵
PID:9076

C:\Windows\System\OwHZjZM.exe
C:\Windows\System\OwHZjZM.exe
2⤵
PID:9144

C:\Windows\System\fsuvixR.exe
C:\Windows\System\fsuvixR.exe
2⤵
PID:9212

C:\Windows\System\KVCZVFf.exe
C:\Windows\System\KVCZVFf.exe
2⤵
PID:7748

C:\Windows\System\VZfCFIo.exe
C:\Windows\System\VZfCFIo.exe
2⤵
PID:9028

C:\Windows\System\VGJQcDs.exe
C:\Windows\System\VGJQcDs.exe
2⤵
PID:9096

C:\Windows\System\FPnnLfp.exe
C:\Windows\System\FPnnLfp.exe
2⤵
PID:9164

C:\Windows\System\nkTANDA.exe
C:\Windows\System\nkTANDA.exe
2⤵
PID:8044

C:\Windows\System\IFxigHz.exe
C:\Windows\System\IFxigHz.exe
2⤵
PID:8300

C:\Windows\System\HgMvqfl.exe
C:\Windows\System\HgMvqfl.exe
2⤵
PID:8348

C:\Windows\System\pqhCklv.exe
C:\Windows\System\pqhCklv.exe
2⤵
PID:8448

C:\Windows\System\FVRrdrH.exe
C:\Windows\System\FVRrdrH.exe
2⤵
PID:8524

C:\Windows\System\QwWXkTT.exe
C:\Windows\System\QwWXkTT.exe
2⤵
PID:8596

C:\Windows\System\rSgzGQH.exe
C:\Windows\System\rSgzGQH.exe
2⤵
PID:8660

C:\Windows\System\JCDPpuX.exe
C:\Windows\System\JCDPpuX.exe
2⤵
PID:8608

C:\Windows\System\AtzJYNU.exe
C:\Windows\System\AtzJYNU.exe
2⤵
PID:8732

C:\Windows\System\FQOAXpd.exe
C:\Windows\System\FQOAXpd.exe
2⤵
PID:8840

C:\Windows\System\yAugLFv.exe
C:\Windows\System\yAugLFv.exe
2⤵
PID:8508

C:\Windows\System\tFPsdlD.exe
C:\Windows\System\tFPsdlD.exe
2⤵
PID:8576

C:\Windows\System\YhBMPNT.exe
C:\Windows\System\YhBMPNT.exe
2⤵
PID:8748

C:\Windows\System\rceOvMf.exe
C:\Windows\System\rceOvMf.exe
2⤵
PID:8820

C:\Windows\System\olHeFyU.exe
C:\Windows\System\olHeFyU.exe
2⤵
PID:8868

C:\Windows\System\uNuevDl.exe
C:\Windows\System\uNuevDl.exe
2⤵
PID:8984

C:\Windows\System\mJfUvPC.exe
C:\Windows\System\mJfUvPC.exe
2⤵
PID:9180

C:\Windows\System\rCNTbff.exe
C:\Windows\System\rCNTbff.exe
2⤵
PID:8920

C:\Windows\System\WckVCnE.exe
C:\Windows\System\WckVCnE.exe
2⤵
PID:8160

C:\Windows\System\oSXvSQS.exe
C:\Windows\System\oSXvSQS.exe
2⤵
PID:9128

C:\Windows\System\VtOWmWo.exe
C:\Windows\System\VtOWmWo.exe
2⤵
PID:7872

C:\Windows\System\NeySunS.exe
C:\Windows\System\NeySunS.exe
2⤵
PID:9196

C:\Windows\System\vpssQnk.exe
C:\Windows\System\vpssQnk.exe
2⤵
PID:8280

C:\Windows\System\TLkNWUs.exe
C:\Windows\System\TLkNWUs.exe
2⤵
PID:7804

C:\Windows\System\yGmLczy.exe
C:\Windows\System\yGmLczy.exe
2⤵
PID:8460

C:\Windows\System\ZGsQZoU.exe
C:\Windows\System\ZGsQZoU.exe
2⤵
PID:8640

C:\Windows\System\kjLHlQD.exe
C:\Windows\System\kjLHlQD.exe
2⤵
PID:8836

C:\Windows\System\eyaHEJP.exe
C:\Windows\System\eyaHEJP.exe
2⤵
PID:8788

C:\Windows\System\LVQbzMg.exe
C:\Windows\System\LVQbzMg.exe
2⤵
PID:8512

C:\Windows\System\kNHCBjU.exe
C:\Windows\System\kNHCBjU.exe
2⤵
PID:8720

C:\Windows\System\xusaJOV.exe
C:\Windows\System\xusaJOV.exe
2⤵
PID:8872

C:\Windows\System\qHDuESn.exe
C:\Windows\System\qHDuESn.exe
2⤵
PID:9184

C:\Windows\System\QsZbEDd.exe
C:\Windows\System\QsZbEDd.exe
2⤵
PID:8208

C:\Windows\System\STMEgAk.exe
C:\Windows\System\STMEgAk.exe
2⤵
PID:8144

C:\Windows\System\Lwvjsuu.exe
C:\Windows\System\Lwvjsuu.exe
2⤵
PID:8708

C:\Windows\System\zumcBFe.exe
C:\Windows\System\zumcBFe.exe
2⤵
PID:8952

C:\Windows\System\BZLnGvd.exe
C:\Windows\System\BZLnGvd.exe
2⤵
PID:8548

C:\Windows\System\dOlYrLM.exe
C:\Windows\System\dOlYrLM.exe
2⤵
PID:9112

C:\Windows\System\xdMJRGa.exe
C:\Windows\System\xdMJRGa.exe
2⤵
PID:8092

C:\Windows\System\UdCfqvC.exe
C:\Windows\System\UdCfqvC.exe
2⤵
PID:8296

C:\Windows\System\XWmgfHi.exe
C:\Windows\System\XWmgfHi.exe
2⤵
PID:9232

C:\Windows\System\mhdEJeY.exe
C:\Windows\System\mhdEJeY.exe
2⤵
PID:9248

C:\Windows\System\GVXKngM.exe
C:\Windows\System\GVXKngM.exe
2⤵
PID:9264

C:\Windows\System\IPwReFf.exe
C:\Windows\System\IPwReFf.exe
2⤵
PID:9280

C:\Windows\System\YkuUnMp.exe
C:\Windows\System\YkuUnMp.exe
2⤵
PID:9296

C:\Windows\System\GmjuLnt.exe
C:\Windows\System\GmjuLnt.exe
2⤵
PID:9316

C:\Windows\System\yKALElN.exe
C:\Windows\System\yKALElN.exe
2⤵
PID:9332

C:\Windows\System\NozjUBt.exe
C:\Windows\System\NozjUBt.exe
2⤵
PID:9348

C:\Windows\System\SEvfJXD.exe
C:\Windows\System\SEvfJXD.exe
2⤵
PID:9364

C:\Windows\System\ZYZeKGj.exe
C:\Windows\System\ZYZeKGj.exe
2⤵
PID:9380

C:\Windows\System\pTVvPMU.exe
C:\Windows\System\pTVvPMU.exe
2⤵
PID:9396

C:\Windows\System\DFVxeig.exe
C:\Windows\System\DFVxeig.exe
2⤵
PID:9412

C:\Windows\System\TRvyQye.exe
C:\Windows\System\TRvyQye.exe
2⤵
PID:9432

C:\Windows\System\qHBsxtM.exe
C:\Windows\System\qHBsxtM.exe
2⤵
PID:9448

C:\Windows\System\tdCRvdN.exe
C:\Windows\System\tdCRvdN.exe
2⤵
PID:9464

C:\Windows\System\dGyopYb.exe
C:\Windows\System\dGyopYb.exe
2⤵
PID:9480

C:\Windows\System\qXRZIdF.exe
C:\Windows\System\qXRZIdF.exe
2⤵
PID:9496

C:\Windows\System\MiLRwKc.exe
C:\Windows\System\MiLRwKc.exe
2⤵
PID:9512

C:\Windows\System\fNqtgHt.exe
C:\Windows\System\fNqtgHt.exe
2⤵
PID:9528

C:\Windows\System\KWFrhJG.exe
C:\Windows\System\KWFrhJG.exe
2⤵
PID:9548

C:\Windows\System\kgjbHlZ.exe
C:\Windows\System\kgjbHlZ.exe
2⤵
PID:9568

C:\Windows\System\zbzhzkO.exe
C:\Windows\System\zbzhzkO.exe
2⤵
PID:9584

C:\Windows\System\uuSWOyf.exe
C:\Windows\System\uuSWOyf.exe
2⤵
PID:9600

C:\Windows\System\HrKroGq.exe
C:\Windows\System\HrKroGq.exe
2⤵
PID:9616

C:\Windows\System\pEmZbRN.exe
C:\Windows\System\pEmZbRN.exe
2⤵
PID:9632

C:\Windows\System\nwIqSIC.exe
C:\Windows\System\nwIqSIC.exe
2⤵
PID:9648

C:\Windows\System\SszZctv.exe
C:\Windows\System\SszZctv.exe
2⤵
PID:9664

C:\Windows\System\zhDbFiD.exe
C:\Windows\System\zhDbFiD.exe
2⤵
PID:9680

C:\Windows\System\TTOmjYB.exe
C:\Windows\System\TTOmjYB.exe
2⤵
PID:9704

C:\Windows\System\ypLeIAS.exe
C:\Windows\System\ypLeIAS.exe
2⤵
PID:9720

C:\Windows\System\xMoJxLD.exe
C:\Windows\System\xMoJxLD.exe
2⤵
PID:9736

C:\Windows\System\TioTxfW.exe
C:\Windows\System\TioTxfW.exe
2⤵
PID:9752

C:\Windows\System\GoIZSgl.exe
C:\Windows\System\GoIZSgl.exe
2⤵
PID:9768

C:\Windows\System\CzRXBRe.exe
C:\Windows\System\CzRXBRe.exe
2⤵
PID:9784

C:\Windows\System\BmrdiED.exe
C:\Windows\System\BmrdiED.exe
2⤵
PID:9808

C:\Windows\System\NSVpULC.exe
C:\Windows\System\NSVpULC.exe
2⤵
PID:9824

C:\Windows\System\pqfxObU.exe
C:\Windows\System\pqfxObU.exe
2⤵
PID:9840

C:\Windows\System\BHdfHiO.exe
C:\Windows\System\BHdfHiO.exe
2⤵
PID:9860

C:\Windows\System\XqkioHZ.exe
C:\Windows\System\XqkioHZ.exe
2⤵
PID:9876

C:\Windows\System\RqEUeNn.exe
C:\Windows\System\RqEUeNn.exe
2⤵
PID:9892

C:\Windows\System\VDpPRsh.exe
C:\Windows\System\VDpPRsh.exe
2⤵
PID:9908

C:\Windows\System\MTkGFOu.exe
C:\Windows\System\MTkGFOu.exe
2⤵
PID:9924

C:\Windows\System\kYlpffB.exe
C:\Windows\System\kYlpffB.exe
2⤵
PID:9940

C:\Windows\System\ZidywqO.exe
C:\Windows\System\ZidywqO.exe
2⤵
PID:9956

C:\Windows\System\pcWLoHd.exe
C:\Windows\System\pcWLoHd.exe
2⤵
PID:9972

C:\Windows\System\NWUhQZN.exe
C:\Windows\System\NWUhQZN.exe
2⤵
PID:9992

C:\Windows\System\oEKRQQg.exe
C:\Windows\System\oEKRQQg.exe
2⤵
PID:10008

C:\Windows\System\ztRZuch.exe
C:\Windows\System\ztRZuch.exe
2⤵
PID:10024

C:\Windows\System\YZGwVbn.exe
C:\Windows\System\YZGwVbn.exe
2⤵
PID:10040

C:\Windows\System\PZHxCkg.exe
C:\Windows\System\PZHxCkg.exe
2⤵
PID:10056

C:\Windows\System\gOGjTFx.exe
C:\Windows\System\gOGjTFx.exe
2⤵
PID:10072

C:\Windows\System\JxXkVxW.exe
C:\Windows\System\JxXkVxW.exe
2⤵
PID:10088

C:\Windows\System\ENUAlRH.exe
C:\Windows\System\ENUAlRH.exe
2⤵
PID:10104

C:\Windows\System\EfSXlgl.exe
C:\Windows\System\EfSXlgl.exe
2⤵
PID:10120

C:\Windows\System\MCXPXvA.exe
C:\Windows\System\MCXPXvA.exe
2⤵
PID:10136

C:\Windows\System\XAjOVcp.exe
C:\Windows\System\XAjOVcp.exe
2⤵
PID:10152

C:\Windows\System\hqUvXbQ.exe
C:\Windows\System\hqUvXbQ.exe
2⤵
PID:10168

C:\Windows\System\cSqYlvM.exe
C:\Windows\System\cSqYlvM.exe
2⤵
PID:10184

C:\Windows\System\PHMzaxv.exe
C:\Windows\System\PHMzaxv.exe
2⤵
PID:10200

C:\Windows\System\wRzPWzr.exe
C:\Windows\System\wRzPWzr.exe
2⤵
PID:10216

C:\Windows\System\Midohrx.exe
C:\Windows\System\Midohrx.exe
2⤵
PID:10232

C:\Windows\System\usqucfZ.exe
C:\Windows\System\usqucfZ.exe
2⤵
PID:9220

C:\Windows\System\bYNgdAc.exe
C:\Windows\System\bYNgdAc.exe
2⤵
PID:9260

C:\Windows\System\kotpMNc.exe
C:\Windows\System\kotpMNc.exe
2⤵
PID:9328

C:\Windows\System\HLpdlCV.exe
C:\Windows\System\HLpdlCV.exe
2⤵
PID:8356

C:\Windows\System\oeJAdBc.exe
C:\Windows\System\oeJAdBc.exe
2⤵
PID:8752

C:\Windows\System\Qfkuadm.exe
C:\Windows\System\Qfkuadm.exe
2⤵
PID:9044

C:\Windows\System\VfUESOc.exe
C:\Windows\System\VfUESOc.exe
2⤵
PID:9304

C:\Windows\System\HRfHdKy.exe
C:\Windows\System\HRfHdKy.exe
2⤵
PID:9420

C:\Windows\System\CIshNdu.exe
C:\Windows\System\CIshNdu.exe
2⤵
PID:9340

C:\Windows\System\AMMSHjK.exe
C:\Windows\System\AMMSHjK.exe
2⤵
PID:9440

C:\Windows\System\zLxmFNY.exe
C:\Windows\System\zLxmFNY.exe
2⤵
PID:9476

C:\Windows\System\EXuSgab.exe
C:\Windows\System\EXuSgab.exe
2⤵
PID:9592

C:\Windows\System\dlzsIaS.exe
C:\Windows\System\dlzsIaS.exe
2⤵
PID:9508

C:\Windows\System\AmbFnUZ.exe
C:\Windows\System\AmbFnUZ.exe
2⤵
PID:9728

C:\Windows\System\yyvbcqI.exe
C:\Windows\System\yyvbcqI.exe
2⤵
PID:9608

C:\Windows\System\TyUEHTZ.exe
C:\Windows\System\TyUEHTZ.exe
2⤵
PID:9920

C:\Windows\System\GZTXHQE.exe
C:\Windows\System\GZTXHQE.exe
2⤵
PID:9984

C:\Windows\System\vPxDlOM.exe
C:\Windows\System\vPxDlOM.exe
2⤵
PID:10064

C:\Windows\System\jsISwtc.exe
C:\Windows\System\jsISwtc.exe
2⤵
PID:10128

C:\Windows\System\GaPMwxd.exe
C:\Windows\System\GaPMwxd.exe
2⤵
PID:10164

C:\Windows\System\PLfmblJ.exe
C:\Windows\System\PLfmblJ.exe
2⤵
PID:10144

C:\Windows\System\iaCkmGI.exe
C:\Windows\System\iaCkmGI.exe
2⤵
PID:10084

C:\Windows\System\BArhHRz.exe
C:\Windows\System\BArhHRz.exe
2⤵
PID:10212

C:\Windows\System\vUHjprg.exe
C:\Windows\System\vUHjprg.exe
2⤵
PID:9256

C:\Windows\System\FIoIuiS.exe
C:\Windows\System\FIoIuiS.exe
2⤵
PID:8964

C:\Windows\System\wXExEcm.exe
C:\Windows\System\wXExEcm.exe
2⤵
PID:9324

C:\Windows\System\UOJSJWs.exe
C:\Windows\System\UOJSJWs.exe
2⤵
PID:9692

C:\Windows\System\HbWxTUZ.exe
C:\Windows\System\HbWxTUZ.exe
2⤵
PID:9536

C:\Windows\System\QbBVKEe.exe
C:\Windows\System\QbBVKEe.exe
2⤵
PID:9624

C:\Windows\System\HaqGEVK.exe
C:\Windows\System\HaqGEVK.exe
2⤵
PID:9676

C:\Windows\System\OdHBWuY.exe
C:\Windows\System\OdHBWuY.exe
2⤵
PID:9748

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CNUjKay.exe
Filesize
1.8MB

MD5
4239de228a98a38968eec3887c7be977

SHA1
8dddb320b900997047a35bd3ced0a9cbfa70f773

SHA256
31c9ecfe461663eb854c11491d1d7475c17606829d344013cc988012ad545767

SHA512
4705188b130645307de20053c828d284b453a738d565c81b80c866f3154def598767aa335b61d07a43b83a9afae5a4ce098e063e9e13f4e323d37bcaabe256d4

Download Submit
C:\Windows\system\DmJhQEN.exe
Filesize
1.8MB

MD5
f446c91a548f15cf773092990c4e4c8f

SHA1
c04420b372d925f5b173b5fd1dce2071824b40c2

SHA256
4364f4a99535eccb95893684131a8cdf146975931b12a473c57ea700629bb1f2

SHA512
12b969ecc3122f33b6cf72cc34a52f82e6dba68f1cc017a763f4be3fe9300a37f535fe5c00b2e6a9b82d23877abf073359048077f030ecf059f6dc2ae9cf2871

Download Submit
C:\Windows\system\EPtfgda.exe
Filesize
1.8MB

MD5
0c4612cd8b8ec3acb3c5fadae1cfd7f9

SHA1
c05817439a21ef436e82d7533fe8f8e14bf83e7e

SHA256
2aebf682e6737428db9b6137f74f74d25e33fe9b1acb2a4d87f566a61e0daba4

SHA512
21d2a7bd305fd238ee4e614e119e8e68890ad39ff15ba21f58ff64552214fb8f63df94ab68eecaba412951502a61295120c86dfd62ea7614525a5cdf8fde6100

Download Submit
C:\Windows\system\EfAflRG.exe
Filesize
8B

MD5
20f50227b408431507e9e4298a89a7d5

SHA1
021be5cef03ca413a261257f3fa674d51e4eaecb

SHA256
f053af72ebaae8c20b4aa760dccbaa50d5e8c1b0612207e6dff562e592b0ee16

SHA512
a69e9f155961cdfb2c580f410cf1f9148255cadde0f420c64800ffc84ebbf2c4fc4d8c24eda7cee14ae357ad0398853cbe4f84f9db0bb9573e1f43351f2da9c0

Download Submit
C:\Windows\system\HdEwHnT.exe
Filesize
1.8MB

MD5
609f07cfcf489305f6dfd4efbe488091

SHA1
c5a5f89e69f00a94acf5cfe4783c602f2cdfa73d

SHA256
5a33f6485a41328f409622cec69544002e8b7ba64391388dac9d897f0f9cdbc9

SHA512
3b102d377f8211e054b9c7b1eee8534caf62014be219500025a4270aba708d0e901dec95c1ea8690616cb729d04f52a3b5a1d0fc51f30f5d7bb39b6396351460

Download Submit
C:\Windows\system\IKCYOQQ.exe
Filesize
1.8MB

MD5
c0c93235851e5078224af0d5c91978c8

SHA1
749eb91e9b565cd7dc96588499d46b2e9c60156f

SHA256
58c47ebe43d02d86b620413389275bac5bc3d8cd4f8ca403ef66ea66d6eb7711

SHA512
76eb604d762f9caf7f4007d293a9784648d28888cc45a612aa45f727e9c48a82d96041eac9227e8993d3c579517d94349a7f3652400ecf9391eccdb56f47e5a4

Download Submit
C:\Windows\system\OkVicsc.exe
Filesize
1.8MB

MD5
d7f182d35c2e30296479f3478ab4c028

SHA1
ec0e3d21ce4902168af1e829c567f1f0c3099538

SHA256
9f3a6a79424ddf712297caa6df592fa7571490c6dba3aa8c42b70593adeaed8a

SHA512
f1e0c3bf49c0f9d899292f3a434c28ce5a3b92ee4313fea9f3af55ef4923067a98809cefe97398012c3542772ff6b547e64af828d2a660994ae22928fac97fb3

Download Submit
C:\Windows\system\QsyPrrQ.exe
Filesize
1.8MB

MD5
3ea3495cce898c4a087021da3aa0198c

SHA1
d80de84bc3642c8c85c165f8878ecf0d1395af99

SHA256
9b88cfb8cfa3d46a3240a89a0ff1aea813f4a7754fe323f67da46d23b45746c6

SHA512
debdfaeac46173b39f1f3ab2e0b48931382498fad937e29f1b575c6458b8ab0d1d473c2adb660b738ef7660f40bb262927239c7b45f21a9193a0c8b7e066ddb1

Download Submit
C:\Windows\system\TVkXSYK.exe
Filesize
1.8MB

MD5
9f96c0580f9c613e910523341ca1d157

SHA1
417a63cbf1053a44164e950ebef07ab6647df14a

SHA256
f4144aa7c9e888c713234dd1eb2e4d5ff3f4b7e4c8001bb0671ece7a034303bd

SHA512
77a542fcf88b1c49c829130a0408f30a44afb72866f6f4bd388b682b521a0b16e65cff66c46d637bbe87e055ce9ab479aecdf070a4db9595f08dc05b7107aa2c

Download Submit
C:\Windows\system\TwsTQaF.exe
Filesize
1.8MB

MD5
8eb795a6ae4403319010a3a7491c736d

SHA1
17d032b8689eafa06af1bc4d31478ac838003f58

SHA256
070a466849092534d7c8fabc088f570f417184eff2b0bdee124d4b52cf1c5251

SHA512
7c8f05d7fcfbbedc72760c1d143f0810598318ade42f227ddc5f199e0f6c52b017ec888d6238d7466b06533015255bf6d4783a9eacb77090537e024d68101229

Download Submit
C:\Windows\system\fCLvqlx.exe
Filesize
1.8MB

MD5
02e92ca4c688d54c386e8d8dc0d08f8b

SHA1
f5f8f7f4f1c902bf451721afc1a35035b1109029

SHA256
d26b6f91728b0f981360a3847857510ae4aac699f9e654ced8a0b9d0c89a885d

SHA512
488f8f66e32476c9933a586053b9711763fc729ed3d70c88765864d5606639418cad5f6ce5bf5acf79a56dff25943962c0165a9c7de221e889f275dcf9d792f0

Download Submit
C:\Windows\system\imZexha.exe
Filesize
1.8MB

MD5
e40cef7bb69744f1c0e5e553f55cb069

SHA1
1eebef37166dce63ceaf254ad5aba803755afe01

SHA256
4df440efc76f62435abda160b99f6074d50adf33928acfae4ffb1c5cb2ffdc85

SHA512
e716ade016ed63f1bd63ff223c36f465b0fec462708e956e2c8bd02674e4f30bd46fdbe67548ad55a81e87ab0a2b6ecc30ff958276eb9df4b5820a2445c12185

Download Submit
C:\Windows\system\jKyQlUv.exe
Filesize
1.8MB

MD5
873262d92869e05129c9d8df26e7e40a

SHA1
565fcfbed4e3b1a089ec138c7a22069f3518552c

SHA256
40d8b7cbc2e7fbc637d9d63bf1e3810c055393959fe4afc7e20e1eda1933bea7

SHA512
4beb74e1ad87f36dce981858065881791b4b90a865560c05d69ce294a759aef4861a204455585a0ea74cce9bc47b151a168aca6065ee72d662a452c11c6d6241

Download Submit
C:\Windows\system\mPDwRBI.exe
Filesize
1.8MB

MD5
cd6436da48a69191b0921fbd2c3b748e

SHA1
34fde8f961420a7d10fdbded246a2e73f7dd7f38

SHA256
999cc2afad8e7ce12ee539330075d23f21de4dea6e43485ee0122e2d791a7f5f

SHA512
a2de1e06e6e2ce50a3c02a83e2a34c48e342db9f44a684ced6d2b27a3db6fd28d3447cee3b9777d6f10cde2916395222d90a9315dfeb5de3d46a28a6add2fb5e

Download Submit
C:\Windows\system\mwkOquV.exe
Filesize
1.8MB

MD5
fb4f146be055ab8216b3873b91a0bd11

SHA1
d39e632c62ae90340f4bca825ad235e324107931

SHA256
6f03e0ff57c11f127f23a47bde70dcbabb48ea1f8ddf42a2aca0b168a0475c5f

SHA512
d6066b62d8b139d64e7744566a4f0e365c4c3a8638c22ccf7d685f856aaea4d20871aee7bc3e4895e897f704de0ebbf9a62873a32d4457fc9defb8a03f65c061

Download Submit
C:\Windows\system\oohzAbi.exe
Filesize
1.8MB

MD5
04a649f3d9e267aa87e43b4ce2069146

SHA1
3e6dcb0fc4cb71b7e47f475f3b9dc9108583ace6

SHA256
196d3b5d8e7fbf8158f4480589c95cd8bda7cf0e7ed870c40170ffd32b6b76df

SHA512
2a28416abd37f2d19ba801efc530f9842540e70bea0e1ee611559a6ce192e39ca720aa30e38ae78747b2ffb7492079b1240c9f768c6bffd93a020df5e524b018

Download Submit
C:\Windows\system\pszyQTI.exe
Filesize
1.8MB

MD5
db750dfe897aaaf46444580c02467095

SHA1
c7aa6995c6e53748c63c14b0757829cc75ad95fa

SHA256
f41d11038c8824c8fd92ef90b360961482525b90dc7959bf83daa1b6cfa173f6

SHA512
523de46a2e3a4e288c63381235b1c820b9d0141ee63cf78d522053905a74a5230f3366227cda61c6612582ee72166bc467e57038a092dd5146bc6afa974bfa84

Download Submit
C:\Windows\system\rUscBiV.exe
Filesize
1.8MB

MD5
5b435b7d02da045149ab85fe247539b6

SHA1
042a3eb81d69c95b1b1abdf0873898528381b589

SHA256
e06eb18a3d2a5af3314ad5a93b62bb3fe76a5978333b6baf2bc46624db295d40

SHA512
255a2bd5359e1844925576c66023549dbba2c662021af900559e4bc386e6ee0bc3242e2be63a3a1b4554464626a9a1ece745a97390b2817eefd1eb6c028dc697

Download Submit
C:\Windows\system\rjgVTdo.exe
Filesize
1.8MB

MD5
2d742a475208494cf1ba8108aa1f9f6c

SHA1
cdd13f4f75771c390f9bab9a86a3dacff67f0a54

SHA256
65abf20bbae66f3152d502c3dfd793a9859da888fcf5392ba6d4664bb5bb3ad4

SHA512
830d753d2e3c2eece88ea9989c7e7642f6406ffe17d2e99699164e020e3aaa862fa27059194e82aea035de744a4f4f88d0dfd066a2fd87c7b4e0f70e2e6324d2

Download Submit
C:\Windows\system\sLBqueg.exe
Filesize
1.8MB

MD5
6bfba6cbe4d43c1c9a6050751cc9d21d

SHA1
ec02a27fa003b36744fb877925c2ddf0e4c6aac0

SHA256
96d1506cfd29cae603d0e0a3340edb101b5bae817350de1fe3c42d4bae6e0081

SHA512
6c80d6c22260b10adbaa3487dbcbc1ad0405f232bf78f26d60661dc5f4ff9d55de9b10cd801e3ab97453e2dc936fd8731d46e7708a8c34d62a924f99754e37dd

Download Submit
C:\Windows\system\snrjugz.exe
Filesize
1.8MB

MD5
a9a6cb37a36e6736a472569f3bc984f0

SHA1
8a8cdacb8d1bc007f41b4d0b4e3ec95ec9146245

SHA256
780d2aff933d38693b503e2b038e289d2b7990cb0db7dfcbc24809ea540dee42

SHA512
650f721cae27bcb5753ad6ec7e91d11a0b20ef4c2e84a4389413c370d8836afbd36c196b5bdfd7902954b019f89165b78b1654761cdad4fde5d7ce09d32e49fa

Download Submit
C:\Windows\system\ufXZBZX.exe
Filesize
1.8MB

MD5
7204d205c6987dc9fb832ac870dd34cf

SHA1
27c5dfc9431038bcd591aea1983dda477333ed9f

SHA256
8d553144b05307849abeb6beaefd041adf7c004247e84fc7275f9348d1259cfa

SHA512
7ac2885a62b6615bb2576f52dadc36d9c23bd311f52a49fd8f28f2d0103aad7cd405a59e0a31f649e896b849eba97b1419d75b6b83958a3f7c53b8ae7c4b92cd

Download Submit
C:\Windows\system\usXWagA.exe
Filesize
1.8MB

MD5
a281dfa8fe2b0606b1938d4a0a6d0696

SHA1
206dcdfd6fff389462c9fe5fa1a813ff2568e896

SHA256
cae1d4342a5da36019a517ce3f1b918110b538d0c3ba04969c8a83f5e82d8073

SHA512
c8088338273594647fce7203e8c49b9b29065145f1b671f6475cdf11c5764875ea8e08b2e1d347157bf9f7a42f8ea23e6f0e2b6ddecb7c48a4a43f77b1c66985

Download Submit
C:\Windows\system\uytARWD.exe
Filesize
1.8MB

MD5
1832213611f1967325c419f242fa35e1

SHA1
978588284a5e608690dd9c7ef4f4b9a0d4b9e7af

SHA256
a9532a6a29be39d65126becb8b2923d7a676c0da91fa3aa10c9cae62d6545e46

SHA512
7424758896ed43bbaf78fd5f662d0237a389c67b5b1bdfa6c487ad1bd89dc49862e4d5486f323a71617e760c9ff870f5329bcc97d99494b77a956dcf89c0aaa9

Download Submit
C:\Windows\system\wssvXKj.exe
Filesize
1.8MB

MD5
9536ea196c14dba530d44c8bd3e2c25b

SHA1
ad32ba612165a92de65df7a184e38f971fc67df3

SHA256
85b6dcb9eb1e13cdaa2fd5bae9ecab27cf065dd7cd80626da383a1c6ef33f451

SHA512
08e9cbdcb58dfc19b3f8627114dc3ee75b458f6e7d211b173b2fae4428044eb08b0c79dd34a68ee09fb4f87e99fe87d496e65de7f228ed463881a8a5c58b1109

Download Submit
C:\Windows\system\ygvfOMX.exe
Filesize
1.8MB

MD5
7c6389d8cb23c780dfa0fa0bdca767dc

SHA1
9e1de54628e661966f12a61e7d3c938c69f45a4e

SHA256
795cffbb58eac271da9c8161e0083a65cdfefdd023ec9c87674c3344ac83fb08

SHA512
b0198104f86a7f20d2dac8affa1e4f87d0b8470fdf73ebc652d7c739313ab0b3f33bb4b0381d6b53444acd3c4cb6a9f1078d450ccb17143e890b1062aa09753f

Download Submit
C:\Windows\system\zpsjUKq.exe
Filesize
1.8MB

MD5
57c071dd8a3190e16f8c33031ae0b645

SHA1
4bb225afc06a8c0e9fa242abd2102752cbf5358b

SHA256
853d8b46a01c1f323da9c434f3fa6ca6f3851eb51acfe58894eca02baf6b1d97

SHA512
9227b3ed8f2fba909a12626386e3fad84e6359cbabf403c9f3a798a0e889996a9fb9b56d84fdfcc91152d1e2a94038dbb0bd0d19697d8dda4aa3136afed0a289

Download Submit
\Windows\system\HHRvKYw.exe
Filesize
1.8MB

MD5
0c348013585776923a4300d8b09c4b23

SHA1
3518a6d4e25c565b044314328a9d695921a07530

SHA256
bec0f98cb95a970d3d41cfe1da874db63c11015e6619a55cc979d327fd4a9710

SHA512
d5d5b5f41e24ff15ddf082f3755da74c216d1a252dc15d4c994327b4f728d9cb0c5fb167da12f0320d96f8ed3683ecd418ce59eb1c8cd3f787d9812830071328

Download Submit
\Windows\system\MlWVhKV.exe
Filesize
1.8MB

MD5
46aaf823e0f02afd04f79b1eec40e0e7

SHA1
c0e895aaaaa67ac0ff0b8ae6376b0bbeaac0bb45

SHA256
ae2d6f240a33565bcc3dad08e3b7573850680dfbf3c9de6ab795a9d9a47f39d2

SHA512
22a72bf74e4f06be10e96dead59c2952b30b55d3a38e427ab4c0eba6c2ba0158e0057f6addab70597977bc35445b1409e96b6cbd2b7389e4d32f04a285d82654

Download Submit
\Windows\system\UxsSKAc.exe
Filesize
1.8MB

MD5
70a0bbd93458b65b588208ba80142fb6

SHA1
5d941a4842c512dbb01621922127621465fda990

SHA256
7bac5a62d09350bbac46cb0fce1b58c6e271603a79690f40046e48a716a89079

SHA512
2b5b144b79f2fcc2cc77190570f3a18d1606520ff9de3bed4173a9cc950695ba7f2178a38590e09dc8e4f17d5f57de3ede73c2605c25f4e493ac52ab81bf995d

Download Submit
\Windows\system\qKxWYPY.exe
Filesize
1.8MB

MD5
62e1e0711c687f214a4496c9b054e334

SHA1
bbc39304ba72ec2bd7fdabb4fae68512ecc750e3

SHA256
518a595f03d0179c6d7e9387784bab5fe3540f051056fc2533442e4244a60424

SHA512
f2590b5c8d8869882922d89c10306e036e2a72ed1b930dbc35264472625a8abf1a429d1c67451968763d1f867a05d95b74f91e29e08dc761ca354b9c50528508

Download Submit
\Windows\system\uoASHgz.exe
Filesize
1.8MB

MD5
9a656e0e83fa36b1743062a535ae9425

SHA1
0ffa6018a16c548db93a17ffa56ae8cfa5b9370b

SHA256
7d488d94ec230e1a7d77b0753bc498340691b495221289639db50c77cca0bb24

SHA512
cf1a805f272f8ea030e89d9f5dd508322afadc03fce10b92158a961746eeb49da55148253f3f2c388f401f3118ccfbbcb871906dc9936898df65c88a40eacbc8

Download Submit
\Windows\system\vkLXNle.exe
Filesize
1.8MB

MD5
af80e0dd6be423675d588d07ad58fdf9

SHA1
03d3b345a23e668421a25d201467a0c2eb3d83b6

SHA256
e6fa29711b42a59851183b574a16c11a328506dfeca3060dfa223a0aed5db2c2

SHA512
9c29d1810cb0bccb8eff00b79af2645bdd923ddc746f6459abcfdd93fa01d65e5e9b94daf3079b2e9eb0b18290a525668f9e9e754e60445a8b6f52a25263660b

Download Submit
memory/1232-138-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/1232-151-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/1232-153-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/1232-156-0x0000000002F50000-0x0000000003342000-memory.dmp

Filesize
3.9MB

Download
memory/1232-140-0x0000000003470000-0x0000000003862000-memory.dmp

Filesize
3.9MB

Download
memory/1232-0-0x000000013FC30000-0x0000000140022000-memory.dmp

Filesize
3.9MB

Download
memory/1232-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1232-149-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/1232-136-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/1232-143-0x0000000003470000-0x0000000003862000-memory.dmp

Filesize
3.9MB

Download
memory/1232-134-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/1232-133-0x0000000003470000-0x0000000003862000-memory.dmp

Filesize
3.9MB

Download
memory/1232-8-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/1232-131-0x0000000003470000-0x0000000003862000-memory.dmp

Filesize
3.9MB

Download
memory/1964-4877-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/1964-142-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2336-5024-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2336-152-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2352-204-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/2352-18-0x000007FEF5F2E000-0x000007FEF5F2F000-memory.dmp

Filesize
4KB

Download
memory/2352-203-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/2352-358-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

Filesize
9.6MB

Download
memory/2352-130-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

Filesize
9.6MB

Download
memory/2352-17-0x0000000002D10000-0x0000000002D90000-memory.dmp

Filesize
512KB

Download
memory/2364-5151-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2364-157-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2536-141-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-5145-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-147-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-5047-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2636-132-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2636-4916-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-139-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-4915-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2688-16-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2688-5046-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-5025-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2808-135-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2920-137-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2920-5161-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/3008-4841-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/3008-154-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/3024-4882-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/3024-155-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download