xmrig | 2eea081ae68f0613765baa4642a00cfb759854e9329a41159496f79fd2ec4067

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
Size

2.0MB
MD5

945cfaf0f5e0ab23f7070ae4f55207e5
SHA1

41e187d181552f99dc1e51e70c3f2d6db420c847
SHA256

2eea081ae68f0613765baa4642a00cfb759854e9329a41159496f79fd2ec4067
SHA512

da55fb1e8ed20f44d6f54965a633e4c7f7b23ed639c0e41f4da20e23743af41796bd17fdb5a9f6cff3db28393716c5c37810dde7ad656b024f49d19b805332c6
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMx:NABp

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral1/memory/2776-60-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/1928-43-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	xmrig
behavioral1/memory/2080-70-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2964-69-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/2628-61-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2704-59-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/1836-35-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/2756-54-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/944-26-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	xmrig
behavioral1/memory/2040-19-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/944-1995-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig
behavioral1/memory/1928-5723-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	xmrig
behavioral1/memory/2040-5722-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/2628-5724-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2776-5726-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/1632-5727-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2704-5725-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2112-5728-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/1836-5730-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/2756-5729-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2964-5732-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/2080-5759-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1936	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2040	yeXqTmp.exe
1836	aVdVsWw.exe
1928	LrAtWmy.exe
2756	GdnCryc.exe
2704	JcgdWnu.exe
2776	ZawQElO.exe
2628	JFSgUMn.exe
2964	jRYNOtS.exe
2080	UwUIaEz.exe
2112	QQrDKSg.exe
1632	iXqWWjj.exe
2584	hhAUHbD.exe
2724	ZQvjSnh.exe
868	jvALKsp.exe
2932	MjpYjxI.exe
1952	StqUnMX.exe
2856	FrcAOhZ.exe
1248	OWuflYd.exe
2388	ayYccYo.exe
2024	KIsEoBp.exe
1480	AKbyVNw.exe
2064	RDvNTLq.exe
2876	RuHSrxm.exe
108	szbzJHZ.exe
1824	TPMzVeP.exe
2936	hZaMjmL.exe
2456	WDpKbrK.exe
3040	ETyFVsC.exe
2360	bWuKbmz.exe
1492	PwWaonW.exe
772	hRCpZTI.exe
1872	TlWLYfb.exe
412	MVKvGGH.exe
1228	ywJknOx.exe
1884	EYivPBI.exe
2408	coVXYnE.exe
960	eyKwYxA.exe
1128	LmSFRut.exe
1508	BTySSFG.exe
2032	yfWkFoq.exe
2016	JeKYICk.exe
1760	igtJcng.exe
2316	svIANlW.exe
1596	lnbTYox.exe
2632	mKzXFiE.exe
2972	wcCPhIY.exe
2500	HCbkUep.exe
2532	agXPMDN.exe
2808	EUIszsh.exe
2896	CGQmiyt.exe
2380	raLMjHx.exe
1956	hQwGWjh.exe
1608	ENEpHlf.exe
1092	sdrZNcT.exe
3044	DosnUgK.exe
1880	BcXCank.exe
2188	dykalFk.exe
2060	qDIYhix.exe
708	TvlAtOw.exe
1708	qFlXNTS.exe
2512	tqPOFFz.exe
1176	tyDXWrr.exe
2076	xPGxEEU.exe
896	cIzlBlS.exe

Loads dropped DLL 64 IoCs

pid	Process
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/944-0-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/files/0x000c0000000122e4-3.dat	upx
behavioral1/files/0x000b000000012303-9.dat	upx
behavioral1/files/0x000900000001264d-15.dat	upx
behavioral1/files/0x000b0000000126e1-36.dat	upx
behavioral1/files/0x000a000000012d51-50.dat	upx
behavioral1/files/0x000f000000005578-40.dat	upx
behavioral1/memory/2776-60-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/memory/1928-43-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/files/0x00070000000133b9-97.dat	upx
behavioral1/files/0x0007000000013928-106.dat	upx
behavioral1/files/0x00070000000139d8-116.dat	upx
behavioral1/files/0x0007000000013a11-123.dat	upx
behavioral1/files/0x00070000000139b4-142.dat	upx
behavioral1/files/0x00060000000142c4-165.dat	upx
behavioral1/files/0x000600000001447e-191.dat	upx
behavioral1/files/0x00060000000141c0-185.dat	upx
behavioral1/files/0x0006000000014316-189.dat	upx
behavioral1/files/0x00060000000142b0-187.dat	upx
behavioral1/files/0x0006000000014120-183.dat	upx
behavioral1/files/0x0006000000014390-179.dat	upx
behavioral1/files/0x00060000000143ec-177.dat	upx
behavioral1/files/0x0007000000013a21-173.dat	upx
behavioral1/files/0x00060000000141e6-160.dat	upx
behavioral1/files/0x00070000000139e0-155.dat	upx
behavioral1/files/0x000700000001342b-135.dat	upx
behavioral1/files/0x00070000000133b0-133.dat	upx
behavioral1/files/0x000800000001329e-131.dat	upx
behavioral1/files/0x00070000000133a8-91.dat	upx
behavioral1/memory/2112-90-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/files/0x0008000000013172-82.dat	upx
behavioral1/files/0x0008000000013113-75.dat	upx
behavioral1/files/0x00060000000141a2-148.dat	upx
behavioral1/files/0x0007000000013a71-138.dat	upx
behavioral1/memory/1632-95-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2080-70-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2964-69-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/memory/2628-61-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/memory/2704-59-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/memory/1836-35-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/files/0x000800000001269d-34.dat	upx
behavioral1/files/0x00080000000126ab-55.dat	upx
behavioral1/memory/2756-54-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/files/0x0008000000012678-47.dat	upx
behavioral1/memory/2040-19-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/memory/944-1995-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/memory/1928-5723-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/memory/2040-5722-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/memory/2628-5724-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/memory/2776-5726-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/memory/1632-5727-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2704-5725-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/memory/2112-5728-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/1836-5730-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/memory/2756-5729-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2964-5732-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/memory/2080-5759-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GbHmwxx.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\PoWxpKZ.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\Hfvlvkd.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\izIOwXF.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\PpmCijQ.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\ASbhlQc.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\rAugUSZ.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\kKwazQz.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\HHecRxm.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\eFGXqeS.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\ZaAeEDf.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\rjdXMIu.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\ufPuEuN.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\yYvXfUB.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\FkUnshJ.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\DSHUyao.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\VGlSoHn.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\lsJXzxf.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\DyFGNfj.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\IqcSEbm.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\zZwvfxh.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\TFeNSSK.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\fPpUyig.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\cYRqBXz.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\ZeoJJEa.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\uMHwogw.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\nvcofRw.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\ozxrGyJ.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\PZLuJUA.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\nmZJuxe.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\bSMaVky.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\fRILrka.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\sZizXPD.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\cfflGtj.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\hYVpGrA.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\WQZytQO.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\RfSmIEL.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\ujreYPO.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\hZgbTRn.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\YnWgQoc.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\yomuokS.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\pxTmhdT.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\WVJmQYe.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\LbPQFIG.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\TzYSKoj.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\akGHoLv.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\oTLSSeB.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\BVppCCC.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\BnAvcVS.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\ylPUEaW.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\xbEbYiS.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\IoDBvgN.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\nCeAqfH.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\EUViSis.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\yGGrIqE.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\blfkbWn.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\coIItft.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\GbUjWAd.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\qpStwOv.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\aDzlxfm.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\OxYsNQS.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\UaKTcAL.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\OmZSnxN.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
File created	C:\Windows\System\QSQPWAP.exe	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1936	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
Token: SeDebugPrivilege	1936	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 1936	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	29
PID 944 wrote to memory of 1936	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	29
PID 944 wrote to memory of 1936	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	29
PID 944 wrote to memory of 1836	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	30
PID 944 wrote to memory of 1836	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	30
PID 944 wrote to memory of 1836	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	30
PID 944 wrote to memory of 2040	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	31
PID 944 wrote to memory of 2040	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	31
PID 944 wrote to memory of 2040	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	31
PID 944 wrote to memory of 1928	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	32
PID 944 wrote to memory of 1928	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	32
PID 944 wrote to memory of 1928	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	32
PID 944 wrote to memory of 2704	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	33
PID 944 wrote to memory of 2704	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	33
PID 944 wrote to memory of 2704	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	33
PID 944 wrote to memory of 2756	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	34
PID 944 wrote to memory of 2756	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	34
PID 944 wrote to memory of 2756	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	34
PID 944 wrote to memory of 2964	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	35
PID 944 wrote to memory of 2964	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	35
PID 944 wrote to memory of 2964	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	35
PID 944 wrote to memory of 2776	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	36
PID 944 wrote to memory of 2776	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	36
PID 944 wrote to memory of 2776	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	36
PID 944 wrote to memory of 2080	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	37
PID 944 wrote to memory of 2080	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	37
PID 944 wrote to memory of 2080	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	37
PID 944 wrote to memory of 2628	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	38
PID 944 wrote to memory of 2628	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	38
PID 944 wrote to memory of 2628	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	38
PID 944 wrote to memory of 2112	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	39
PID 944 wrote to memory of 2112	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	39
PID 944 wrote to memory of 2112	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	39
PID 944 wrote to memory of 1632	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	40
PID 944 wrote to memory of 1632	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	40
PID 944 wrote to memory of 1632	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	40
PID 944 wrote to memory of 2856	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	41
PID 944 wrote to memory of 2856	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	41
PID 944 wrote to memory of 2856	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	41
PID 944 wrote to memory of 2584	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	42
PID 944 wrote to memory of 2584	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	42
PID 944 wrote to memory of 2584	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	42
PID 944 wrote to memory of 1248	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	43
PID 944 wrote to memory of 1248	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	43
PID 944 wrote to memory of 1248	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	43
PID 944 wrote to memory of 2724	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	44
PID 944 wrote to memory of 2724	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	44
PID 944 wrote to memory of 2724	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	44
PID 944 wrote to memory of 2388	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	45
PID 944 wrote to memory of 2388	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	45
PID 944 wrote to memory of 2388	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	45
PID 944 wrote to memory of 868	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	46
PID 944 wrote to memory of 868	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	46
PID 944 wrote to memory of 868	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	46
PID 944 wrote to memory of 1480	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	47
PID 944 wrote to memory of 1480	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	47
PID 944 wrote to memory of 1480	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	47
PID 944 wrote to memory of 2932	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	48
PID 944 wrote to memory of 2932	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	48
PID 944 wrote to memory of 2932	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	48
PID 944 wrote to memory of 2876	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	49
PID 944 wrote to memory of 2876	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	49
PID 944 wrote to memory of 2876	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	49
PID 944 wrote to memory of 1952	944	945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\945cfaf0f5e0ab23f7070ae4f55207e5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1936
- C:\Windows\System\aVdVsWw.exe
  C:\Windows\System\aVdVsWw.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\yeXqTmp.exe
  C:\Windows\System\yeXqTmp.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\LrAtWmy.exe
  C:\Windows\System\LrAtWmy.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\JcgdWnu.exe
  C:\Windows\System\JcgdWnu.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\GdnCryc.exe
  C:\Windows\System\GdnCryc.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\jRYNOtS.exe
  C:\Windows\System\jRYNOtS.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\ZawQElO.exe
  C:\Windows\System\ZawQElO.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\UwUIaEz.exe
  C:\Windows\System\UwUIaEz.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\JFSgUMn.exe
  C:\Windows\System\JFSgUMn.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\QQrDKSg.exe
  C:\Windows\System\QQrDKSg.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\iXqWWjj.exe
  C:\Windows\System\iXqWWjj.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\FrcAOhZ.exe
  C:\Windows\System\FrcAOhZ.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\hhAUHbD.exe
  C:\Windows\System\hhAUHbD.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\OWuflYd.exe
  C:\Windows\System\OWuflYd.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\ZQvjSnh.exe
  C:\Windows\System\ZQvjSnh.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\ayYccYo.exe
  C:\Windows\System\ayYccYo.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\jvALKsp.exe
  C:\Windows\System\jvALKsp.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\AKbyVNw.exe
  C:\Windows\System\AKbyVNw.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\MjpYjxI.exe
  C:\Windows\System\MjpYjxI.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\RuHSrxm.exe
  C:\Windows\System\RuHSrxm.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\StqUnMX.exe
  C:\Windows\System\StqUnMX.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\hZaMjmL.exe
  C:\Windows\System\hZaMjmL.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\KIsEoBp.exe
  C:\Windows\System\KIsEoBp.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\ETyFVsC.exe
  C:\Windows\System\ETyFVsC.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\RDvNTLq.exe
  C:\Windows\System\RDvNTLq.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\bWuKbmz.exe
  C:\Windows\System\bWuKbmz.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\szbzJHZ.exe
  C:\Windows\System\szbzJHZ.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\PwWaonW.exe
  C:\Windows\System\PwWaonW.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\TPMzVeP.exe
  C:\Windows\System\TPMzVeP.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\hRCpZTI.exe
  C:\Windows\System\hRCpZTI.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\WDpKbrK.exe
  C:\Windows\System\WDpKbrK.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\MVKvGGH.exe
  C:\Windows\System\MVKvGGH.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\TlWLYfb.exe
  C:\Windows\System\TlWLYfb.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\ywJknOx.exe
  C:\Windows\System\ywJknOx.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\EYivPBI.exe
  C:\Windows\System\EYivPBI.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\jVIXTsH.exe
  C:\Windows\System\jVIXTsH.exe
  2⤵
  PID:1116
- C:\Windows\System\coVXYnE.exe
  C:\Windows\System\coVXYnE.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\mvnMIsW.exe
  C:\Windows\System\mvnMIsW.exe
  2⤵
  PID:1752
- C:\Windows\System\eyKwYxA.exe
  C:\Windows\System\eyKwYxA.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\LTYmyfN.exe
  C:\Windows\System\LTYmyfN.exe
  2⤵
  PID:1700
- C:\Windows\System\LmSFRut.exe
  C:\Windows\System\LmSFRut.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\yvVHMTW.exe
  C:\Windows\System\yvVHMTW.exe
  2⤵
  PID:2992
- C:\Windows\System\BTySSFG.exe
  C:\Windows\System\BTySSFG.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\hjKqNul.exe
  C:\Windows\System\hjKqNul.exe
  2⤵
  PID:2404
- C:\Windows\System\yfWkFoq.exe
  C:\Windows\System\yfWkFoq.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\SKvsYuT.exe
  C:\Windows\System\SKvsYuT.exe
  2⤵
  PID:2148
- C:\Windows\System\JeKYICk.exe
  C:\Windows\System\JeKYICk.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\MFPSFoM.exe
  C:\Windows\System\MFPSFoM.exe
  2⤵
  PID:892
- C:\Windows\System\igtJcng.exe
  C:\Windows\System\igtJcng.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\eGGxpFK.exe
  C:\Windows\System\eGGxpFK.exe
  2⤵
  PID:3004
- C:\Windows\System\svIANlW.exe
  C:\Windows\System\svIANlW.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\zJLeXih.exe
  C:\Windows\System\zJLeXih.exe
  2⤵
  PID:1592
- C:\Windows\System\lnbTYox.exe
  C:\Windows\System\lnbTYox.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\fLplIbw.exe
  C:\Windows\System\fLplIbw.exe
  2⤵
  PID:1840
- C:\Windows\System\mKzXFiE.exe
  C:\Windows\System\mKzXFiE.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\xpzczhv.exe
  C:\Windows\System\xpzczhv.exe
  2⤵
  PID:2700
- C:\Windows\System\wcCPhIY.exe
  C:\Windows\System\wcCPhIY.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\FgAApvu.exe
  C:\Windows\System\FgAApvu.exe
  2⤵
  PID:2660
- C:\Windows\System\HCbkUep.exe
  C:\Windows\System\HCbkUep.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\wtqZjrZ.exe
  C:\Windows\System\wtqZjrZ.exe
  2⤵
  PID:2536
- C:\Windows\System\agXPMDN.exe
  C:\Windows\System\agXPMDN.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\grIpWSM.exe
  C:\Windows\System\grIpWSM.exe
  2⤵
  PID:2720
- C:\Windows\System\EUIszsh.exe
  C:\Windows\System\EUIszsh.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\rYCjXQx.exe
  C:\Windows\System\rYCjXQx.exe
  2⤵
  PID:2800
- C:\Windows\System\CGQmiyt.exe
  C:\Windows\System\CGQmiyt.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\XvqJmce.exe
  C:\Windows\System\XvqJmce.exe
  2⤵
  PID:3048
- C:\Windows\System\raLMjHx.exe
  C:\Windows\System\raLMjHx.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\oshfdjQ.exe
  C:\Windows\System\oshfdjQ.exe
  2⤵
  PID:584
- C:\Windows\System\hQwGWjh.exe
  C:\Windows\System\hQwGWjh.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\nWLyAsM.exe
  C:\Windows\System\nWLyAsM.exe
  2⤵
  PID:1720
- C:\Windows\System\ENEpHlf.exe
  C:\Windows\System\ENEpHlf.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\VGlSoHn.exe
  C:\Windows\System\VGlSoHn.exe
  2⤵
  PID:2668
- C:\Windows\System\sdrZNcT.exe
  C:\Windows\System\sdrZNcT.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\IJPfaOK.exe
  C:\Windows\System\IJPfaOK.exe
  2⤵
  PID:3032
- C:\Windows\System\DosnUgK.exe
  C:\Windows\System\DosnUgK.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\XjfBzbT.exe
  C:\Windows\System\XjfBzbT.exe
  2⤵
  PID:856
- C:\Windows\System\BcXCank.exe
  C:\Windows\System\BcXCank.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\pXqklOR.exe
  C:\Windows\System\pXqklOR.exe
  2⤵
  PID:696
- C:\Windows\System\dykalFk.exe
  C:\Windows\System\dykalFk.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\QsGTGqa.exe
  C:\Windows\System\QsGTGqa.exe
  2⤵
  PID:1552
- C:\Windows\System\qDIYhix.exe
  C:\Windows\System\qDIYhix.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\TmeBvav.exe
  C:\Windows\System\TmeBvav.exe
  2⤵
  PID:2144
- C:\Windows\System\TvlAtOw.exe
  C:\Windows\System\TvlAtOw.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\VXbihCW.exe
  C:\Windows\System\VXbihCW.exe
  2⤵
  PID:1544
- C:\Windows\System\qFlXNTS.exe
  C:\Windows\System\qFlXNTS.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\lczSLwh.exe
  C:\Windows\System\lczSLwh.exe
  2⤵
  PID:2528
- C:\Windows\System\tqPOFFz.exe
  C:\Windows\System\tqPOFFz.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\XsMrDjt.exe
  C:\Windows\System\XsMrDjt.exe
  2⤵
  PID:1940
- C:\Windows\System\tyDXWrr.exe
  C:\Windows\System\tyDXWrr.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\ejbTRyN.exe
  C:\Windows\System\ejbTRyN.exe
  2⤵
  PID:1860
- C:\Windows\System\xPGxEEU.exe
  C:\Windows\System\xPGxEEU.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\JAPDodE.exe
  C:\Windows\System\JAPDodE.exe
  2⤵
  PID:940
- C:\Windows\System\cIzlBlS.exe
  C:\Windows\System\cIzlBlS.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\EytPPlG.exe
  C:\Windows\System\EytPPlG.exe
  2⤵
  PID:3080
- C:\Windows\System\hrzxnog.exe
  C:\Windows\System\hrzxnog.exe
  2⤵
  PID:3096
- C:\Windows\System\GEwkCGb.exe
  C:\Windows\System\GEwkCGb.exe
  2⤵
  PID:3112
- C:\Windows\System\vxKIoeJ.exe
  C:\Windows\System\vxKIoeJ.exe
  2⤵
  PID:3128
- C:\Windows\System\hIuJwFx.exe
  C:\Windows\System\hIuJwFx.exe
  2⤵
  PID:3144
- C:\Windows\System\OWXvyer.exe
  C:\Windows\System\OWXvyer.exe
  2⤵
  PID:3160
- C:\Windows\System\uNWioID.exe
  C:\Windows\System\uNWioID.exe
  2⤵
  PID:3176
- C:\Windows\System\iQRXnzH.exe
  C:\Windows\System\iQRXnzH.exe
  2⤵
  PID:3192
- C:\Windows\System\PeDfkvt.exe
  C:\Windows\System\PeDfkvt.exe
  2⤵
  PID:3208
- C:\Windows\System\TtqMFOo.exe
  C:\Windows\System\TtqMFOo.exe
  2⤵
  PID:3224
- C:\Windows\System\WBciLgQ.exe
  C:\Windows\System\WBciLgQ.exe
  2⤵
  PID:3240
- C:\Windows\System\RiyZuEp.exe
  C:\Windows\System\RiyZuEp.exe
  2⤵
  PID:3256
- C:\Windows\System\tWkvNpl.exe
  C:\Windows\System\tWkvNpl.exe
  2⤵
  PID:3272
- C:\Windows\System\ixQmInT.exe
  C:\Windows\System\ixQmInT.exe
  2⤵
  PID:3288
- C:\Windows\System\FoMxmla.exe
  C:\Windows\System\FoMxmla.exe
  2⤵
  PID:3304
- C:\Windows\System\YSTTDNe.exe
  C:\Windows\System\YSTTDNe.exe
  2⤵
  PID:3320
- C:\Windows\System\vHXAnWw.exe
  C:\Windows\System\vHXAnWw.exe
  2⤵
  PID:3336
- C:\Windows\System\pycYQfw.exe
  C:\Windows\System\pycYQfw.exe
  2⤵
  PID:3352
- C:\Windows\System\RctHLoL.exe
  C:\Windows\System\RctHLoL.exe
  2⤵
  PID:3368
- C:\Windows\System\eKrSepm.exe
  C:\Windows\System\eKrSepm.exe
  2⤵
  PID:3384
- C:\Windows\System\vRXSjLg.exe
  C:\Windows\System\vRXSjLg.exe
  2⤵
  PID:3400
- C:\Windows\System\hmDOjDp.exe
  C:\Windows\System\hmDOjDp.exe
  2⤵
  PID:3416
- C:\Windows\System\rkhznKX.exe
  C:\Windows\System\rkhznKX.exe
  2⤵
  PID:3432
- C:\Windows\System\gFffvuJ.exe
  C:\Windows\System\gFffvuJ.exe
  2⤵
  PID:3448
- C:\Windows\System\vUybBBX.exe
  C:\Windows\System\vUybBBX.exe
  2⤵
  PID:3464
- C:\Windows\System\fIRzOny.exe
  C:\Windows\System\fIRzOny.exe
  2⤵
  PID:3480
- C:\Windows\System\GBHsfkQ.exe
  C:\Windows\System\GBHsfkQ.exe
  2⤵
  PID:3496
- C:\Windows\System\eLxAYeJ.exe
  C:\Windows\System\eLxAYeJ.exe
  2⤵
  PID:3512
- C:\Windows\System\PyEgnWM.exe
  C:\Windows\System\PyEgnWM.exe
  2⤵
  PID:3528
- C:\Windows\System\MUGdoNm.exe
  C:\Windows\System\MUGdoNm.exe
  2⤵
  PID:3544
- C:\Windows\System\FpOdPGw.exe
  C:\Windows\System\FpOdPGw.exe
  2⤵
  PID:3560
- C:\Windows\System\hhsfPPP.exe
  C:\Windows\System\hhsfPPP.exe
  2⤵
  PID:3576
- C:\Windows\System\BoySQZh.exe
  C:\Windows\System\BoySQZh.exe
  2⤵
  PID:3592
- C:\Windows\System\kHkgRcK.exe
  C:\Windows\System\kHkgRcK.exe
  2⤵
  PID:3608
- C:\Windows\System\NhwwQGS.exe
  C:\Windows\System\NhwwQGS.exe
  2⤵
  PID:3624
- C:\Windows\System\zhBhvhR.exe
  C:\Windows\System\zhBhvhR.exe
  2⤵
  PID:3640
- C:\Windows\System\ALSYdne.exe
  C:\Windows\System\ALSYdne.exe
  2⤵
  PID:3656
- C:\Windows\System\yomuokS.exe
  C:\Windows\System\yomuokS.exe
  2⤵
  PID:3672
- C:\Windows\System\QGAwvWi.exe
  C:\Windows\System\QGAwvWi.exe
  2⤵
  PID:3688
- C:\Windows\System\HtheDEN.exe
  C:\Windows\System\HtheDEN.exe
  2⤵
  PID:3704
- C:\Windows\System\Nrcydmq.exe
  C:\Windows\System\Nrcydmq.exe
  2⤵
  PID:3720
- C:\Windows\System\vAvwsXI.exe
  C:\Windows\System\vAvwsXI.exe
  2⤵
  PID:3736
- C:\Windows\System\FfLrvIZ.exe
  C:\Windows\System\FfLrvIZ.exe
  2⤵
  PID:3752
- C:\Windows\System\FBLYBfH.exe
  C:\Windows\System\FBLYBfH.exe
  2⤵
  PID:3772
- C:\Windows\System\ktiWkEC.exe
  C:\Windows\System\ktiWkEC.exe
  2⤵
  PID:3788
- C:\Windows\System\ojeQrEc.exe
  C:\Windows\System\ojeQrEc.exe
  2⤵
  PID:3804
- C:\Windows\System\WUYLEkU.exe
  C:\Windows\System\WUYLEkU.exe
  2⤵
  PID:3820
- C:\Windows\System\fSmvbQK.exe
  C:\Windows\System\fSmvbQK.exe
  2⤵
  PID:3840
- C:\Windows\System\ZFYPMPS.exe
  C:\Windows\System\ZFYPMPS.exe
  2⤵
  PID:3856
- C:\Windows\System\SKbvXKq.exe
  C:\Windows\System\SKbvXKq.exe
  2⤵
  PID:3872
- C:\Windows\System\sslkYlj.exe
  C:\Windows\System\sslkYlj.exe
  2⤵
  PID:3888
- C:\Windows\System\zYzVgod.exe
  C:\Windows\System\zYzVgod.exe
  2⤵
  PID:3904
- C:\Windows\System\tIOsfwd.exe
  C:\Windows\System\tIOsfwd.exe
  2⤵
  PID:3928
- C:\Windows\System\SVqFCxm.exe
  C:\Windows\System\SVqFCxm.exe
  2⤵
  PID:3944
- C:\Windows\System\SoKMHuG.exe
  C:\Windows\System\SoKMHuG.exe
  2⤵
  PID:3960
- C:\Windows\System\cYRqBXz.exe
  C:\Windows\System\cYRqBXz.exe
  2⤵
  PID:3976
- C:\Windows\System\KvtMqVf.exe
  C:\Windows\System\KvtMqVf.exe
  2⤵
  PID:3992
- C:\Windows\System\FUwkJTt.exe
  C:\Windows\System\FUwkJTt.exe
  2⤵
  PID:4012
- C:\Windows\System\VXJAnvd.exe
  C:\Windows\System\VXJAnvd.exe
  2⤵
  PID:4028
- C:\Windows\System\WBKehVY.exe
  C:\Windows\System\WBKehVY.exe
  2⤵
  PID:4044
- C:\Windows\System\QuPHIUU.exe
  C:\Windows\System\QuPHIUU.exe
  2⤵
  PID:4060
- C:\Windows\System\kiJqBly.exe
  C:\Windows\System\kiJqBly.exe
  2⤵
  PID:4076
- C:\Windows\System\IQDuDVD.exe
  C:\Windows\System\IQDuDVD.exe
  2⤵
  PID:4092
- C:\Windows\System\ttKCqFb.exe
  C:\Windows\System\ttKCqFb.exe
  2⤵
  PID:1364
- C:\Windows\System\QfOmNab.exe
  C:\Windows\System\QfOmNab.exe
  2⤵
  PID:3076
- C:\Windows\System\pNIdjzz.exe
  C:\Windows\System\pNIdjzz.exe
  2⤵
  PID:3136
- C:\Windows\System\PWetMDF.exe
  C:\Windows\System\PWetMDF.exe
  2⤵
  PID:3172
- C:\Windows\System\BmBbXNM.exe
  C:\Windows\System\BmBbXNM.exe
  2⤵
  PID:3232
- C:\Windows\System\TgslmoD.exe
  C:\Windows\System\TgslmoD.exe
  2⤵
  PID:3268
- C:\Windows\System\ergLmfT.exe
  C:\Windows\System\ergLmfT.exe
  2⤵
  PID:3328
- C:\Windows\System\fsuYbGL.exe
  C:\Windows\System\fsuYbGL.exe
  2⤵
  PID:3364
- C:\Windows\System\fCCTMvX.exe
  C:\Windows\System\fCCTMvX.exe
  2⤵
  PID:3428
- C:\Windows\System\JBBPvsd.exe
  C:\Windows\System\JBBPvsd.exe
  2⤵
  PID:3488
- C:\Windows\System\ZwwtmKV.exe
  C:\Windows\System\ZwwtmKV.exe
  2⤵
  PID:3556
- C:\Windows\System\LRbxscN.exe
  C:\Windows\System\LRbxscN.exe
  2⤵
  PID:2560
- C:\Windows\System\ESVKJYV.exe
  C:\Windows\System\ESVKJYV.exe
  2⤵
  PID:352
- C:\Windows\System\EfoGXZC.exe
  C:\Windows\System\EfoGXZC.exe
  2⤵
  PID:1452
- C:\Windows\System\PiuTkPG.exe
  C:\Windows\System\PiuTkPG.exe
  2⤵
  PID:3620
- C:\Windows\System\bFADpfU.exe
  C:\Windows\System\bFADpfU.exe
  2⤵
  PID:2412
- C:\Windows\System\MLkumBw.exe
  C:\Windows\System\MLkumBw.exe
  2⤵
  PID:4448
- C:\Windows\System\CVQqaQI.exe
  C:\Windows\System\CVQqaQI.exe
  2⤵
  PID:4464
- C:\Windows\System\rcAukfF.exe
  C:\Windows\System\rcAukfF.exe
  2⤵
  PID:4480
- C:\Windows\System\RWINOol.exe
  C:\Windows\System\RWINOol.exe
  2⤵
  PID:4496
- C:\Windows\System\EdLJqOZ.exe
  C:\Windows\System\EdLJqOZ.exe
  2⤵
  PID:4512
- C:\Windows\System\mndnNFV.exe
  C:\Windows\System\mndnNFV.exe
  2⤵
  PID:4528
- C:\Windows\System\mEuQuCu.exe
  C:\Windows\System\mEuQuCu.exe
  2⤵
  PID:4544
- C:\Windows\System\ZIFdCpW.exe
  C:\Windows\System\ZIFdCpW.exe
  2⤵
  PID:4560
- C:\Windows\System\mlfpfcr.exe
  C:\Windows\System\mlfpfcr.exe
  2⤵
  PID:4576
- C:\Windows\System\pRiGCUf.exe
  C:\Windows\System\pRiGCUf.exe
  2⤵
  PID:4592
- C:\Windows\System\mrRVGWE.exe
  C:\Windows\System\mrRVGWE.exe
  2⤵
  PID:4608
- C:\Windows\System\pLaTVYw.exe
  C:\Windows\System\pLaTVYw.exe
  2⤵
  PID:4624
- C:\Windows\System\aXaOqli.exe
  C:\Windows\System\aXaOqli.exe
  2⤵
  PID:4640
- C:\Windows\System\MTQoHiN.exe
  C:\Windows\System\MTQoHiN.exe
  2⤵
  PID:4656
- C:\Windows\System\vkBftwY.exe
  C:\Windows\System\vkBftwY.exe
  2⤵
  PID:4672
- C:\Windows\System\OhtXpTi.exe
  C:\Windows\System\OhtXpTi.exe
  2⤵
  PID:4688
- C:\Windows\System\rJtySfL.exe
  C:\Windows\System\rJtySfL.exe
  2⤵
  PID:4704
- C:\Windows\System\wdlEdXn.exe
  C:\Windows\System\wdlEdXn.exe
  2⤵
  PID:4720
- C:\Windows\System\tfFlOrD.exe
  C:\Windows\System\tfFlOrD.exe
  2⤵
  PID:4736
- C:\Windows\System\KEZgWph.exe
  C:\Windows\System\KEZgWph.exe
  2⤵
  PID:4752
- C:\Windows\System\uUhhTeR.exe
  C:\Windows\System\uUhhTeR.exe
  2⤵
  PID:4768
- C:\Windows\System\XeiWmfn.exe
  C:\Windows\System\XeiWmfn.exe
  2⤵
  PID:4784
- C:\Windows\System\UwRIDBF.exe
  C:\Windows\System\UwRIDBF.exe
  2⤵
  PID:4800
- C:\Windows\System\FwtyUoc.exe
  C:\Windows\System\FwtyUoc.exe
  2⤵
  PID:4816
- C:\Windows\System\ApeKMbq.exe
  C:\Windows\System\ApeKMbq.exe
  2⤵
  PID:4832
- C:\Windows\System\vceHpbk.exe
  C:\Windows\System\vceHpbk.exe
  2⤵
  PID:4848
- C:\Windows\System\QkYEspN.exe
  C:\Windows\System\QkYEspN.exe
  2⤵
  PID:4864
- C:\Windows\System\piMwHBV.exe
  C:\Windows\System\piMwHBV.exe
  2⤵
  PID:4880
- C:\Windows\System\Lapksgj.exe
  C:\Windows\System\Lapksgj.exe
  2⤵
  PID:4896
- C:\Windows\System\OseRTFJ.exe
  C:\Windows\System\OseRTFJ.exe
  2⤵
  PID:4912
- C:\Windows\System\leEEcWo.exe
  C:\Windows\System\leEEcWo.exe
  2⤵
  PID:4936
- C:\Windows\System\iWMPvnR.exe
  C:\Windows\System\iWMPvnR.exe
  2⤵
  PID:4964
- C:\Windows\System\yydYFtQ.exe
  C:\Windows\System\yydYFtQ.exe
  2⤵
  PID:4996
- C:\Windows\System\SrFwCXL.exe
  C:\Windows\System\SrFwCXL.exe
  2⤵
  PID:5016
- C:\Windows\System\EBgxohJ.exe
  C:\Windows\System\EBgxohJ.exe
  2⤵
  PID:5032
- C:\Windows\System\THLmEnO.exe
  C:\Windows\System\THLmEnO.exe
  2⤵
  PID:5052
- C:\Windows\System\dRsJnQS.exe
  C:\Windows\System\dRsJnQS.exe
  2⤵
  PID:2092
- C:\Windows\System\LiGGsTh.exe
  C:\Windows\System\LiGGsTh.exe
  2⤵
  PID:2644
- C:\Windows\System\QKrMzfu.exe
  C:\Windows\System\QKrMzfu.exe
  2⤵
  PID:2892
- C:\Windows\System\tLKjIoC.exe
  C:\Windows\System\tLKjIoC.exe
  2⤵
  PID:2480
- C:\Windows\System\SxNRqwm.exe
  C:\Windows\System\SxNRqwm.exe
  2⤵
  PID:1084
- C:\Windows\System\ETFZsgV.exe
  C:\Windows\System\ETFZsgV.exe
  2⤵
  PID:2088
- C:\Windows\System\irYBgED.exe
  C:\Windows\System\irYBgED.exe
  2⤵
  PID:3152
- C:\Windows\System\CJadjzE.exe
  C:\Windows\System\CJadjzE.exe
  2⤵
  PID:3216
- C:\Windows\System\QNeDzey.exe
  C:\Windows\System\QNeDzey.exe
  2⤵
  PID:3280
- C:\Windows\System\dNEbMOS.exe
  C:\Windows\System\dNEbMOS.exe
  2⤵
  PID:3684
- C:\Windows\System\rAojKOx.exe
  C:\Windows\System\rAojKOx.exe
  2⤵
  PID:3952
- C:\Windows\System\kAYXBgt.exe
  C:\Windows\System\kAYXBgt.exe
  2⤵
  PID:3784
- C:\Windows\System\ZQRvsZT.exe
  C:\Windows\System\ZQRvsZT.exe
  2⤵
  PID:3852
- C:\Windows\System\aUNfqJp.exe
  C:\Windows\System\aUNfqJp.exe
  2⤵
  PID:3924
- C:\Windows\System\bmjfelW.exe
  C:\Windows\System\bmjfelW.exe
  2⤵
  PID:3988
- C:\Windows\System\cuTFvEJ.exe
  C:\Windows\System\cuTFvEJ.exe
  2⤵
  PID:4084
- C:\Windows\System\wTBsRxy.exe
  C:\Windows\System\wTBsRxy.exe
  2⤵
  PID:2640
- C:\Windows\System\UWWdhko.exe
  C:\Windows\System\UWWdhko.exe
  2⤵
  PID:3264
- C:\Windows\System\uDRzIWt.exe
  C:\Windows\System\uDRzIWt.exe
  2⤵
  PID:2664
- C:\Windows\System\NJgjqUk.exe
  C:\Windows\System\NJgjqUk.exe
  2⤵
  PID:1612
- C:\Windows\System\IErSSgq.exe
  C:\Windows\System\IErSSgq.exe
  2⤵
  PID:4456
- C:\Windows\System\ApxBksB.exe
  C:\Windows\System\ApxBksB.exe
  2⤵
  PID:4520
- C:\Windows\System\JALwOEK.exe
  C:\Windows\System\JALwOEK.exe
  2⤵
  PID:4584
- C:\Windows\System\sUaMjKx.exe
  C:\Windows\System\sUaMjKx.exe
  2⤵
  PID:2940
- C:\Windows\System\VvuykfV.exe
  C:\Windows\System\VvuykfV.exe
  2⤵
  PID:4840
- C:\Windows\System\WvvxOBC.exe
  C:\Windows\System\WvvxOBC.exe
  2⤵
  PID:4904
- C:\Windows\System\mSMWxCH.exe
  C:\Windows\System\mSMWxCH.exe
  2⤵
  PID:4956
- C:\Windows\System\lTmxQIR.exe
  C:\Windows\System\lTmxQIR.exe
  2⤵
  PID:3344
- C:\Windows\System\gnylODY.exe
  C:\Windows\System\gnylODY.exe
  2⤵
  PID:3440
- C:\Windows\System\RgDZXtl.exe
  C:\Windows\System\RgDZXtl.exe
  2⤵
  PID:3540
- C:\Windows\System\KmbdWGW.exe
  C:\Windows\System\KmbdWGW.exe
  2⤵
  PID:3696
- C:\Windows\System\AOvSCSl.exe
  C:\Windows\System\AOvSCSl.exe
  2⤵
  PID:3764
- C:\Windows\System\ywZdqdH.exe
  C:\Windows\System\ywZdqdH.exe
  2⤵
  PID:3800
- C:\Windows\System\hYDHdYw.exe
  C:\Windows\System\hYDHdYw.exe
  2⤵
  PID:5048
- C:\Windows\System\xIZytZR.exe
  C:\Windows\System\xIZytZR.exe
  2⤵
  PID:2812
- C:\Windows\System\gACiFrE.exe
  C:\Windows\System\gACiFrE.exe
  2⤵
  PID:288
- C:\Windows\System\UIDowbP.exe
  C:\Windows\System\UIDowbP.exe
  2⤵
  PID:5128
- C:\Windows\System\TjPIRfP.exe
  C:\Windows\System\TjPIRfP.exe
  2⤵
  PID:5144
- C:\Windows\System\ieoQEAm.exe
  C:\Windows\System\ieoQEAm.exe
  2⤵
  PID:5164
- C:\Windows\System\kBaaAFN.exe
  C:\Windows\System\kBaaAFN.exe
  2⤵
  PID:5180
- C:\Windows\System\vHKybcH.exe
  C:\Windows\System\vHKybcH.exe
  2⤵
  PID:5196
- C:\Windows\System\trdYbio.exe
  C:\Windows\System\trdYbio.exe
  2⤵
  PID:5212
- C:\Windows\System\JDgLPod.exe
  C:\Windows\System\JDgLPod.exe
  2⤵
  PID:5228
- C:\Windows\System\BGhSnEg.exe
  C:\Windows\System\BGhSnEg.exe
  2⤵
  PID:5244
- C:\Windows\System\BXqQfny.exe
  C:\Windows\System\BXqQfny.exe
  2⤵
  PID:5260
- C:\Windows\System\kjvXynZ.exe
  C:\Windows\System\kjvXynZ.exe
  2⤵
  PID:5276
- C:\Windows\System\bPJEDsz.exe
  C:\Windows\System\bPJEDsz.exe
  2⤵
  PID:5296
- C:\Windows\System\yGfkSUe.exe
  C:\Windows\System\yGfkSUe.exe
  2⤵
  PID:5312
- C:\Windows\System\ZHjGLqS.exe
  C:\Windows\System\ZHjGLqS.exe
  2⤵
  PID:5328
- C:\Windows\System\eDRgAPm.exe
  C:\Windows\System\eDRgAPm.exe
  2⤵
  PID:5344
- C:\Windows\System\xQMRTIX.exe
  C:\Windows\System\xQMRTIX.exe
  2⤵
  PID:5360
- C:\Windows\System\XjAGFNi.exe
  C:\Windows\System\XjAGFNi.exe
  2⤵
  PID:5376
- C:\Windows\System\kjPRLyW.exe
  C:\Windows\System\kjPRLyW.exe
  2⤵
  PID:5392
- C:\Windows\System\jCTiZqu.exe
  C:\Windows\System\jCTiZqu.exe
  2⤵
  PID:5408
- C:\Windows\System\CRDBcIC.exe
  C:\Windows\System\CRDBcIC.exe
  2⤵
  PID:5424
- C:\Windows\System\zAmNILA.exe
  C:\Windows\System\zAmNILA.exe
  2⤵
  PID:5440
- C:\Windows\System\CHNiuAM.exe
  C:\Windows\System\CHNiuAM.exe
  2⤵
  PID:5456
- C:\Windows\System\LlhIqoV.exe
  C:\Windows\System\LlhIqoV.exe
  2⤵
  PID:5472
- C:\Windows\System\AyTbhYC.exe
  C:\Windows\System\AyTbhYC.exe
  2⤵
  PID:5488
- C:\Windows\System\XcNtZRP.exe
  C:\Windows\System\XcNtZRP.exe
  2⤵
  PID:5504
- C:\Windows\System\zNxRovb.exe
  C:\Windows\System\zNxRovb.exe
  2⤵
  PID:5520
- C:\Windows\System\UuzCbdb.exe
  C:\Windows\System\UuzCbdb.exe
  2⤵
  PID:5536
- C:\Windows\System\sSQdEro.exe
  C:\Windows\System\sSQdEro.exe
  2⤵
  PID:5552
- C:\Windows\System\uwCiYre.exe
  C:\Windows\System\uwCiYre.exe
  2⤵
  PID:5568
- C:\Windows\System\UvQCgeu.exe
  C:\Windows\System\UvQCgeu.exe
  2⤵
  PID:5584
- C:\Windows\System\nCOIWiT.exe
  C:\Windows\System\nCOIWiT.exe
  2⤵
  PID:5600
- C:\Windows\System\RmQwJzo.exe
  C:\Windows\System\RmQwJzo.exe
  2⤵
  PID:5620
- C:\Windows\System\oZlIkRT.exe
  C:\Windows\System\oZlIkRT.exe
  2⤵
  PID:5636
- C:\Windows\System\nhVrzJr.exe
  C:\Windows\System\nhVrzJr.exe
  2⤵
  PID:5652
- C:\Windows\System\XDsftGv.exe
  C:\Windows\System\XDsftGv.exe
  2⤵
  PID:5668
- C:\Windows\System\IjFbuDJ.exe
  C:\Windows\System\IjFbuDJ.exe
  2⤵
  PID:5684
- C:\Windows\System\bWoulgJ.exe
  C:\Windows\System\bWoulgJ.exe
  2⤵
  PID:5700
- C:\Windows\System\LyJiseD.exe
  C:\Windows\System\LyJiseD.exe
  2⤵
  PID:5716
- C:\Windows\System\lWIvREa.exe
  C:\Windows\System\lWIvREa.exe
  2⤵
  PID:5732
- C:\Windows\System\VVAchlH.exe
  C:\Windows\System\VVAchlH.exe
  2⤵
  PID:5748
- C:\Windows\System\OCwNvSI.exe
  C:\Windows\System\OCwNvSI.exe
  2⤵
  PID:5768
- C:\Windows\System\wuUbHCV.exe
  C:\Windows\System\wuUbHCV.exe
  2⤵
  PID:5784
- C:\Windows\System\EGuZtjT.exe
  C:\Windows\System\EGuZtjT.exe
  2⤵
  PID:5800
- C:\Windows\System\mVQKENY.exe
  C:\Windows\System\mVQKENY.exe
  2⤵
  PID:5816
- C:\Windows\System\vChVDKj.exe
  C:\Windows\System\vChVDKj.exe
  2⤵
  PID:5832
- C:\Windows\System\tNYvqVh.exe
  C:\Windows\System\tNYvqVh.exe
  2⤵
  PID:5848
- C:\Windows\System\ZeoJJEa.exe
  C:\Windows\System\ZeoJJEa.exe
  2⤵
  PID:5864
- C:\Windows\System\ASWeiIu.exe
  C:\Windows\System\ASWeiIu.exe
  2⤵
  PID:5940
- C:\Windows\System\HOFrIbQ.exe
  C:\Windows\System\HOFrIbQ.exe
  2⤵
  PID:5956
- C:\Windows\System\frgeJdy.exe
  C:\Windows\System\frgeJdy.exe
  2⤵
  PID:5972
- C:\Windows\System\RlLQFGV.exe
  C:\Windows\System\RlLQFGV.exe
  2⤵
  PID:5988
- C:\Windows\System\VFhQxxI.exe
  C:\Windows\System\VFhQxxI.exe
  2⤵
  PID:6004
- C:\Windows\System\IZmPnku.exe
  C:\Windows\System\IZmPnku.exe
  2⤵
  PID:6020
- C:\Windows\System\udyCdIu.exe
  C:\Windows\System\udyCdIu.exe
  2⤵
  PID:6036
- C:\Windows\System\riLvCOb.exe
  C:\Windows\System\riLvCOb.exe
  2⤵
  PID:6052
- C:\Windows\System\hELWnrS.exe
  C:\Windows\System\hELWnrS.exe
  2⤵
  PID:4052
- C:\Windows\System\xVfSiXH.exe
  C:\Windows\System\xVfSiXH.exe
  2⤵
  PID:4488
- C:\Windows\System\idzDEFb.exe
  C:\Windows\System\idzDEFb.exe
  2⤵
  PID:4652
- C:\Windows\System\inpiggO.exe
  C:\Windows\System\inpiggO.exe
  2⤵
  PID:4648
- C:\Windows\System\exDSgjT.exe
  C:\Windows\System\exDSgjT.exe
  2⤵
  PID:3200
- C:\Windows\System\CJmfjEb.exe
  C:\Windows\System\CJmfjEb.exe
  2⤵
  PID:3524
- C:\Windows\System\hsBjpbi.exe
  C:\Windows\System\hsBjpbi.exe
  2⤵
  PID:3536
- C:\Windows\System\sTBWFkF.exe
  C:\Windows\System\sTBWFkF.exe
  2⤵
  PID:5008
- C:\Windows\System\DUIHCxa.exe
  C:\Windows\System\DUIHCxa.exe
  2⤵
  PID:5140
- C:\Windows\System\wKCEjHS.exe
  C:\Windows\System\wKCEjHS.exe
  2⤵
  PID:5208
- C:\Windows\System\YCjunGi.exe
  C:\Windows\System\YCjunGi.exe
  2⤵
  PID:5468
- C:\Windows\System\ninvcgI.exe
  C:\Windows\System\ninvcgI.exe
  2⤵
  PID:5664
- C:\Windows\System\SOYJylU.exe
  C:\Windows\System\SOYJylU.exe
  2⤵
  PID:5756
- C:\Windows\System\OlpYEqJ.exe
  C:\Windows\System\OlpYEqJ.exe
  2⤵
  PID:5796
- C:\Windows\System\lkUvIVZ.exe
  C:\Windows\System\lkUvIVZ.exe
  2⤵
  PID:2220
- C:\Windows\System\JBWHUzV.exe
  C:\Windows\System\JBWHUzV.exe
  2⤵
  PID:1536
- C:\Windows\System\vNPcvpP.exe
  C:\Windows\System\vNPcvpP.exe
  2⤵
  PID:3092
- C:\Windows\System\dTgHwzj.exe
  C:\Windows\System\dTgHwzj.exe
  2⤵
  PID:3284
- C:\Windows\System\BMzTlRz.exe
  C:\Windows\System\BMzTlRz.exe
  2⤵
  PID:3796
- C:\Windows\System\tiTxVLH.exe
  C:\Windows\System\tiTxVLH.exe
  2⤵
  PID:5320
- C:\Windows\System\mcbYiwg.exe
  C:\Windows\System\mcbYiwg.exe
  2⤵
  PID:5416
- C:\Windows\System\QyxEicZ.exe
  C:\Windows\System\QyxEicZ.exe
  2⤵
  PID:5484
- C:\Windows\System\uImWRdb.exe
  C:\Windows\System\uImWRdb.exe
  2⤵
  PID:5580
- C:\Windows\System\kfZpjnQ.exe
  C:\Windows\System\kfZpjnQ.exe
  2⤵
  PID:5648
- C:\Windows\System\lBjyMLT.exe
  C:\Windows\System\lBjyMLT.exe
  2⤵
  PID:5896
- C:\Windows\System\iepfYAZ.exe
  C:\Windows\System\iepfYAZ.exe
  2⤵
  PID:5880
- C:\Windows\System\fsYEKJc.exe
  C:\Windows\System\fsYEKJc.exe
  2⤵
  PID:5920
- C:\Windows\System\MBGGLQY.exe
  C:\Windows\System\MBGGLQY.exe
  2⤵
  PID:1640
- C:\Windows\System\JaUlHHv.exe
  C:\Windows\System\JaUlHHv.exe
  2⤵
  PID:2104
- C:\Windows\System\JlvCfVs.exe
  C:\Windows\System\JlvCfVs.exe
  2⤵
  PID:3120
- C:\Windows\System\WVYOHDE.exe
  C:\Windows\System\WVYOHDE.exe
  2⤵
  PID:1268
- C:\Windows\System\cppynHc.exe
  C:\Windows\System\cppynHc.exe
  2⤵
  PID:1528
- C:\Windows\System\KGVLETK.exe
  C:\Windows\System\KGVLETK.exe
  2⤵
  PID:1756
- C:\Windows\System\xqYwTyV.exe
  C:\Windows\System\xqYwTyV.exe
  2⤵
  PID:644
- C:\Windows\System\vvUdQtM.exe
  C:\Windows\System\vvUdQtM.exe
  2⤵
  PID:5256
- C:\Windows\System\bOAeTmc.exe
  C:\Windows\System\bOAeTmc.exe
  2⤵
  PID:5916
- C:\Windows\System\gnVLTvr.exe
  C:\Windows\System\gnVLTvr.exe
  2⤵
  PID:5996
- C:\Windows\System\oZJfaPh.exe
  C:\Windows\System\oZJfaPh.exe
  2⤵
  PID:3936
- C:\Windows\System\ctFBUkX.exe
  C:\Windows\System\ctFBUkX.exe
  2⤵
  PID:3396
- C:\Windows\System\XgeJaCH.exe
  C:\Windows\System\XgeJaCH.exe
  2⤵
  PID:6084
- C:\Windows\System\BBRLpfQ.exe
  C:\Windows\System\BBRLpfQ.exe
  2⤵
  PID:6096
- C:\Windows\System\hlavQRf.exe
  C:\Windows\System\hlavQRf.exe
  2⤵
  PID:6128
- C:\Windows\System\TAxNuXT.exe
  C:\Windows\System\TAxNuXT.exe
  2⤵
  PID:4732
- C:\Windows\System\DgYreKJ.exe
  C:\Windows\System\DgYreKJ.exe
  2⤵
  PID:4124
- C:\Windows\System\sLRaUyn.exe
  C:\Windows\System\sLRaUyn.exe
  2⤵
  PID:4140
- C:\Windows\System\CNaSDuI.exe
  C:\Windows\System\CNaSDuI.exe
  2⤵
  PID:4156
- C:\Windows\System\InyqowI.exe
  C:\Windows\System\InyqowI.exe
  2⤵
  PID:4172
- C:\Windows\System\cNRGPjM.exe
  C:\Windows\System\cNRGPjM.exe
  2⤵
  PID:4196
- C:\Windows\System\mQzABwm.exe
  C:\Windows\System\mQzABwm.exe
  2⤵
  PID:4212
- C:\Windows\System\AnmMXqP.exe
  C:\Windows\System\AnmMXqP.exe
  2⤵
  PID:4232
- C:\Windows\System\aWsnXHI.exe
  C:\Windows\System\aWsnXHI.exe
  2⤵
  PID:4244
- C:\Windows\System\chpOsHN.exe
  C:\Windows\System\chpOsHN.exe
  2⤵
  PID:4260
- C:\Windows\System\hEDwFUL.exe
  C:\Windows\System\hEDwFUL.exe
  2⤵
  PID:4280
- C:\Windows\System\uMHwogw.exe
  C:\Windows\System\uMHwogw.exe
  2⤵
  PID:4300
- C:\Windows\System\OXBrGOc.exe
  C:\Windows\System\OXBrGOc.exe
  2⤵
  PID:4316
- C:\Windows\System\gxCIPlb.exe
  C:\Windows\System\gxCIPlb.exe
  2⤵
  PID:4332
- C:\Windows\System\unztOjV.exe
  C:\Windows\System\unztOjV.exe
  2⤵
  PID:4348
- C:\Windows\System\PIDdVaJ.exe
  C:\Windows\System\PIDdVaJ.exe
  2⤵
  PID:4364
- C:\Windows\System\OCmgufV.exe
  C:\Windows\System\OCmgufV.exe
  2⤵
  PID:4380
- C:\Windows\System\qCvWqbK.exe
  C:\Windows\System\qCvWqbK.exe
  2⤵
  PID:4400
- C:\Windows\System\bfqigBB.exe
  C:\Windows\System\bfqigBB.exe
  2⤵
  PID:4416
- C:\Windows\System\oRqRUPh.exe
  C:\Windows\System\oRqRUPh.exe
  2⤵
  PID:4432
- C:\Windows\System\hIThaQK.exe
  C:\Windows\System\hIThaQK.exe
  2⤵
  PID:4472
- C:\Windows\System\DHvJkjn.exe
  C:\Windows\System\DHvJkjn.exe
  2⤵
  PID:4540
- C:\Windows\System\PENxCcH.exe
  C:\Windows\System\PENxCcH.exe
  2⤵
  PID:4604
- C:\Windows\System\OcpscBB.exe
  C:\Windows\System\OcpscBB.exe
  2⤵
  PID:4696
- C:\Windows\System\UqQBykj.exe
  C:\Windows\System\UqQBykj.exe
  2⤵
  PID:4764
- C:\Windows\System\cHwxcmT.exe
  C:\Windows\System\cHwxcmT.exe
  2⤵
  PID:4828
- C:\Windows\System\zQKptTo.exe
  C:\Windows\System\zQKptTo.exe
  2⤵
  PID:4920
- C:\Windows\System\vnFXZqy.exe
  C:\Windows\System\vnFXZqy.exe
  2⤵
  PID:4980
- C:\Windows\System\aRrDXsl.exe
  C:\Windows\System\aRrDXsl.exe
  2⤵
  PID:5072
- C:\Windows\System\hdjJrQg.exe
  C:\Windows\System\hdjJrQg.exe
  2⤵
  PID:5088
- C:\Windows\System\dhrUQxp.exe
  C:\Windows\System\dhrUQxp.exe
  2⤵
  PID:5100
- C:\Windows\System\GDMvcCh.exe
  C:\Windows\System\GDMvcCh.exe
  2⤵
  PID:3236
- C:\Windows\System\HakAqKq.exe
  C:\Windows\System\HakAqKq.exe
  2⤵
  PID:5176
- C:\Windows\System\QdMjCMs.exe
  C:\Windows\System\QdMjCMs.exe
  2⤵
  PID:4008
- C:\Windows\System\IzbHzBG.exe
  C:\Windows\System\IzbHzBG.exe
  2⤵
  PID:3056
- C:\Windows\System\TrhWqcL.exe
  C:\Windows\System\TrhWqcL.exe
  2⤵
  PID:2544
- C:\Windows\System\MOkmDAm.exe
  C:\Windows\System\MOkmDAm.exe
  2⤵
  PID:2216
- C:\Windows\System\UirSXNw.exe
  C:\Windows\System\UirSXNw.exe
  2⤵
  PID:4620
- C:\Windows\System\IBLILiA.exe
  C:\Windows\System\IBLILiA.exe
  2⤵
  PID:3504
- C:\Windows\System\OmVpUAu.exe
  C:\Windows\System\OmVpUAu.exe
  2⤵
  PID:5292
- C:\Windows\System\hMNwriW.exe
  C:\Windows\System\hMNwriW.exe
  2⤵
  PID:2944
- C:\Windows\System\HhZcgIV.exe
  C:\Windows\System\HhZcgIV.exe
  2⤵
  PID:5404
- C:\Windows\System\DBsiNWi.exe
  C:\Windows\System\DBsiNWi.exe
  2⤵
  PID:5368
- C:\Windows\System\ztvPoxz.exe
  C:\Windows\System\ztvPoxz.exe
  2⤵
  PID:2488
- C:\Windows\System\AowifeH.exe
  C:\Windows\System\AowifeH.exe
  2⤵
  PID:5560
- C:\Windows\System\pFqTfxr.exe
  C:\Windows\System\pFqTfxr.exe
  2⤵
  PID:5628
- C:\Windows\System\YGqrPCA.exe
  C:\Windows\System\YGqrPCA.exe
  2⤵
  PID:5660
- C:\Windows\System\fatuHtv.exe
  C:\Windows\System\fatuHtv.exe
  2⤵
  PID:5724
- C:\Windows\System\lsJXzxf.exe
  C:\Windows\System\lsJXzxf.exe
  2⤵
  PID:2688
- C:\Windows\System\OxYsNQS.exe
  C:\Windows\System\OxYsNQS.exe
  2⤵
  PID:3060
- C:\Windows\System\GEblYIg.exe
  C:\Windows\System\GEblYIg.exe
  2⤵
  PID:5948
- C:\Windows\System\VwVaWAm.exe
  C:\Windows\System\VwVaWAm.exe
  2⤵
  PID:2924
- C:\Windows\System\vcgXfgR.exe
  C:\Windows\System\vcgXfgR.exe
  2⤵
  PID:1704
- C:\Windows\System\XEdQFGQ.exe
  C:\Windows\System\XEdQFGQ.exe
  2⤵
  PID:6012
- C:\Windows\System\UErmvyI.exe
  C:\Windows\System\UErmvyI.exe
  2⤵
  PID:1292
- C:\Windows\System\gqWJoJe.exe
  C:\Windows\System\gqWJoJe.exe
  2⤵
  PID:4924
- C:\Windows\System\SbQtFQz.exe
  C:\Windows\System\SbQtFQz.exe
  2⤵
  PID:6068
- C:\Windows\System\cKCHuSZ.exe
  C:\Windows\System\cKCHuSZ.exe
  2⤵
  PID:3700
- C:\Windows\System\WwtbyGi.exe
  C:\Windows\System\WwtbyGi.exe
  2⤵
  PID:3460
- C:\Windows\System\lXkLlwG.exe
  C:\Windows\System\lXkLlwG.exe
  2⤵
  PID:4556
- C:\Windows\System\dkwRkjg.exe
  C:\Windows\System\dkwRkjg.exe
  2⤵
  PID:2292
- C:\Windows\System\GpyamCp.exe
  C:\Windows\System\GpyamCp.exe
  2⤵
  PID:320
- C:\Windows\System\MSKdZAa.exe
  C:\Windows\System\MSKdZAa.exe
  2⤵
  PID:5252
- C:\Windows\System\HNNziPQ.exe
  C:\Windows\System\HNNziPQ.exe
  2⤵
  PID:3380
- C:\Windows\System\WuaSmlM.exe
  C:\Windows\System\WuaSmlM.exe
  2⤵
  PID:5284
- C:\Windows\System\YuLUVps.exe
  C:\Windows\System\YuLUVps.exe
  2⤵
  PID:5448
- C:\Windows\System\MAHQQeB.exe
  C:\Windows\System\MAHQQeB.exe
  2⤵
  PID:2960
- C:\Windows\System\ZjEWPUp.exe
  C:\Windows\System\ZjEWPUp.exe
  2⤵
  PID:5420
- C:\Windows\System\ZtlgHZe.exe
  C:\Windows\System\ZtlgHZe.exe
  2⤵
  PID:5516
- C:\Windows\System\LXaxaTc.exe
  C:\Windows\System\LXaxaTc.exe
  2⤵
  PID:5612
- C:\Windows\System\rZXgmrY.exe
  C:\Windows\System\rZXgmrY.exe
  2⤵
  PID:1804
- C:\Windows\System\EeOuvxN.exe
  C:\Windows\System\EeOuvxN.exe
  2⤵
  PID:1120
- C:\Windows\System\PFTfZum.exe
  C:\Windows\System\PFTfZum.exe
  2⤵
  PID:5884
- C:\Windows\System\ElyTXSr.exe
  C:\Windows\System\ElyTXSr.exe
  2⤵
  PID:5912
- C:\Windows\System\GkgOBGP.exe
  C:\Windows\System\GkgOBGP.exe
  2⤵
  PID:4552
- C:\Windows\System\bwJgejS.exe
  C:\Windows\System\bwJgejS.exe
  2⤵
  PID:3716
- C:\Windows\System\MjoZpDW.exe
  C:\Windows\System\MjoZpDW.exe
  2⤵
  PID:3020
- C:\Windows\System\DTAbebB.exe
  C:\Windows\System\DTAbebB.exe
  2⤵
  PID:1140
- C:\Windows\System\rTooTHu.exe
  C:\Windows\System\rTooTHu.exe
  2⤵
  PID:5084
- C:\Windows\System\sasJFrp.exe
  C:\Windows\System\sasJFrp.exe
  2⤵
  PID:5324
- C:\Windows\System\sLPfLpW.exe
  C:\Windows\System\sLPfLpW.exe
  2⤵
  PID:5872
- C:\Windows\System\JoBUNHW.exe
  C:\Windows\System\JoBUNHW.exe
  2⤵
  PID:6064
- C:\Windows\System\yhUuNrO.exe
  C:\Windows\System\yhUuNrO.exe
  2⤵
  PID:6080
- C:\Windows\System\SHqDiKv.exe
  C:\Windows\System\SHqDiKv.exe
  2⤵
  PID:6100
- C:\Windows\System\FriFabz.exe
  C:\Windows\System\FriFabz.exe
  2⤵
  PID:6120
- C:\Windows\System\ybbryxI.exe
  C:\Windows\System\ybbryxI.exe
  2⤵
  PID:4116
- C:\Windows\System\MgIsPyC.exe
  C:\Windows\System\MgIsPyC.exe
  2⤵
  PID:4180
- C:\Windows\System\wcKoImu.exe
  C:\Windows\System\wcKoImu.exe
  2⤵
  PID:4168
- C:\Windows\System\lKSPuTF.exe
  C:\Windows\System\lKSPuTF.exe
  2⤵
  PID:4308
- C:\Windows\System\PASFrXY.exe
  C:\Windows\System\PASFrXY.exe
  2⤵
  PID:4240
- C:\Windows\System\lwbVBVt.exe
  C:\Windows\System\lwbVBVt.exe
  2⤵
  PID:4288
- C:\Windows\System\AzYjJFp.exe
  C:\Windows\System\AzYjJFp.exe
  2⤵
  PID:4376
- C:\Windows\System\oiAocHU.exe
  C:\Windows\System\oiAocHU.exe
  2⤵
  PID:4440
- C:\Windows\System\thJAutZ.exe
  C:\Windows\System\thJAutZ.exe
  2⤵
  PID:4600
- C:\Windows\System\qCngzmK.exe
  C:\Windows\System\qCngzmK.exe
  2⤵
  PID:4228
- C:\Windows\System\cCAgzkT.exe
  C:\Windows\System\cCAgzkT.exe
  2⤵
  PID:4424
- C:\Windows\System\CMYFjbk.exe
  C:\Windows\System\CMYFjbk.exe
  2⤵
  PID:5080
- C:\Windows\System\VhUhDqg.exe
  C:\Windows\System\VhUhDqg.exe
  2⤵
  PID:4264
- C:\Windows\System\jMcUzrl.exe
  C:\Windows\System\jMcUzrl.exe
  2⤵
  PID:4296
- C:\Windows\System\HQNUcen.exe
  C:\Windows\System\HQNUcen.exe
  2⤵
  PID:4392
- C:\Windows\System\UAJniTY.exe
  C:\Windows\System\UAJniTY.exe
  2⤵
  PID:4796
- C:\Windows\System\WdsNnrd.exe
  C:\Windows\System\WdsNnrd.exe
  2⤵
  PID:3896
- C:\Windows\System\UkSrBUX.exe
  C:\Windows\System\UkSrBUX.exe
  2⤵
  PID:6028
- C:\Windows\System\FosFLcx.exe
  C:\Windows\System\FosFLcx.exe
  2⤵
  PID:1644
- C:\Windows\System\MGfaLNn.exe
  C:\Windows\System\MGfaLNn.exe
  2⤵
  PID:4712
- C:\Windows\System\HsuMVxD.exe
  C:\Windows\System\HsuMVxD.exe
  2⤵
  PID:3296
- C:\Windows\System\YDapPsr.exe
  C:\Windows\System\YDapPsr.exe
  2⤵
  PID:3940
- C:\Windows\System\UbtSryC.exe
  C:\Windows\System\UbtSryC.exe
  2⤵
  PID:2396
- C:\Windows\System\PCkFYeo.exe
  C:\Windows\System\PCkFYeo.exe
  2⤵
  PID:3108
- C:\Windows\System\pKGfsnl.exe
  C:\Windows\System\pKGfsnl.exe
  2⤵
  PID:5564
- C:\Windows\System\TlZzaak.exe
  C:\Windows\System\TlZzaak.exe
  2⤵
  PID:5792
- C:\Windows\System\Unfzkqe.exe
  C:\Windows\System\Unfzkqe.exe
  2⤵
  PID:2564
- C:\Windows\System\GeHlpGx.exe
  C:\Windows\System\GeHlpGx.exe
  2⤵
  PID:1144
- C:\Windows\System\xRDzGDV.exe
  C:\Windows\System\xRDzGDV.exe
  2⤵
  PID:3508
- C:\Windows\System\jSwsBgK.exe
  C:\Windows\System\jSwsBgK.exe
  2⤵
  PID:3444
- C:\Windows\System\taHpjQr.exe
  C:\Windows\System\taHpjQr.exe
  2⤵
  PID:1988
- C:\Windows\System\KnuCzop.exe
  C:\Windows\System\KnuCzop.exe
  2⤵
  PID:5024
- C:\Windows\System\elphIrH.exe
  C:\Windows\System\elphIrH.exe
  2⤵
  PID:1100
- C:\Windows\System\sEeQQid.exe
  C:\Windows\System\sEeQQid.exe
  2⤵
  PID:3572
- C:\Windows\System\RaNcUzA.exe
  C:\Windows\System\RaNcUzA.exe
  2⤵
  PID:2372
- C:\Windows\System\VeDwfAB.exe
  C:\Windows\System\VeDwfAB.exe
  2⤵
  PID:4944
- C:\Windows\System\xDnKNIb.exe
  C:\Windows\System\xDnKNIb.exe
  2⤵
  PID:5388
- C:\Windows\System\taXwXYN.exe
  C:\Windows\System\taXwXYN.exe
  2⤵
  PID:3668
- C:\Windows\System\ptQbpmt.exe
  C:\Windows\System\ptQbpmt.exe
  2⤵
  PID:1196
- C:\Windows\System\bcGnLOR.exe
  C:\Windows\System\bcGnLOR.exe
  2⤵
  PID:3300
- C:\Windows\System\IdKDnDZ.exe
  C:\Windows\System\IdKDnDZ.exe
  2⤵
  PID:1980
- C:\Windows\System\iNEoLNS.exe
  C:\Windows\System\iNEoLNS.exe
  2⤵
  PID:5160
- C:\Windows\System\iymdIok.exe
  C:\Windows\System\iymdIok.exe
  2⤵
  PID:2684
- C:\Windows\System\UaKTcAL.exe
  C:\Windows\System\UaKTcAL.exe
  2⤵
  PID:5644
- C:\Windows\System\bYEjsLe.exe
  C:\Windows\System\bYEjsLe.exe
  2⤵
  PID:5900
- C:\Windows\System\KSnncOY.exe
  C:\Windows\System\KSnncOY.exe
  2⤵
  PID:6048
- C:\Windows\System\ecWNQHU.exe
  C:\Windows\System\ecWNQHU.exe
  2⤵
  PID:2900
- C:\Windows\System\wjOXRlc.exe
  C:\Windows\System\wjOXRlc.exe
  2⤵
  PID:6072
- C:\Windows\System\EcDbejC.exe
  C:\Windows\System\EcDbejC.exe
  2⤵
  PID:4136
- C:\Windows\System\eeOHwvQ.exe
  C:\Windows\System\eeOHwvQ.exe
  2⤵
  PID:4192
- C:\Windows\System\ZhUBtmY.exe
  C:\Windows\System\ZhUBtmY.exe
  2⤵
  PID:4224
- C:\Windows\System\HTrirca.exe
  C:\Windows\System\HTrirca.exe
  2⤵
  PID:3900
- C:\Windows\System\OlpboQd.exe
  C:\Windows\System\OlpboQd.exe
  2⤵
  PID:5812
- C:\Windows\System\QwgjlLC.exe
  C:\Windows\System\QwgjlLC.exe
  2⤵
  PID:4932
- C:\Windows\System\szEaNbz.exe
  C:\Windows\System\szEaNbz.exe
  2⤵
  PID:5192
- C:\Windows\System\USNYgaZ.exe
  C:\Windows\System\USNYgaZ.exe
  2⤵
  PID:4164
- C:\Windows\System\sbuKdNC.exe
  C:\Windows\System\sbuKdNC.exe
  2⤵
  PID:4372
- C:\Windows\System\jxSGlwp.exe
  C:\Windows\System\jxSGlwp.exe
  2⤵
  PID:4396
- C:\Windows\System\bxCKRSq.exe
  C:\Windows\System\bxCKRSq.exe
  2⤵
  PID:4356
- C:\Windows\System\xjxBRwZ.exe
  C:\Windows\System\xjxBRwZ.exe
  2⤵
  PID:3920
- C:\Windows\System\IbVhLZu.exe
  C:\Windows\System\IbVhLZu.exe
  2⤵
  PID:3760
- C:\Windows\System\yrYPJIo.exe
  C:\Windows\System\yrYPJIo.exe
  2⤵
  PID:5236
- C:\Windows\System\bECgNOn.exe
  C:\Windows\System\bECgNOn.exe
  2⤵
  PID:2840
- C:\Windows\System\mKILNcY.exe
  C:\Windows\System\mKILNcY.exe
  2⤵
  PID:2000
- C:\Windows\System\EqDAKvE.exe
  C:\Windows\System\EqDAKvE.exe
  2⤵
  PID:2708
- C:\Windows\System\sWqKIsc.exe
  C:\Windows\System\sWqKIsc.exe
  2⤵
  PID:1300
- C:\Windows\System\rYdpDlk.exe
  C:\Windows\System\rYdpDlk.exe
  2⤵
  PID:5952
- C:\Windows\System\BYYIrfG.exe
  C:\Windows\System\BYYIrfG.exe
  2⤵
  PID:2568
- C:\Windows\System\bxGfxfd.exe
  C:\Windows\System\bxGfxfd.exe
  2⤵
  PID:2572
- C:\Windows\System\UYafofG.exe
  C:\Windows\System\UYafofG.exe
  2⤵
  PID:5984
- C:\Windows\System\XxHTBdh.exe
  C:\Windows\System\XxHTBdh.exe
  2⤵
  PID:1316
- C:\Windows\System\bgKyYJv.exe
  C:\Windows\System\bgKyYJv.exe
  2⤵
  PID:948
- C:\Windows\System\ZEUfyOR.exe
  C:\Windows\System\ZEUfyOR.exe
  2⤵
  PID:904
- C:\Windows\System\JRGEYcu.exe
  C:\Windows\System\JRGEYcu.exe
  2⤵
  PID:764
- C:\Windows\System\fFKDbIG.exe
  C:\Windows\System\fFKDbIG.exe
  2⤵
  PID:3476
- C:\Windows\System\ASMqFkN.exe
  C:\Windows\System\ASMqFkN.exe
  2⤵
  PID:2012
- C:\Windows\System\EmKFfrx.exe
  C:\Windows\System\EmKFfrx.exe
  2⤵
  PID:3984
- C:\Windows\System\QyrtrHf.exe
  C:\Windows\System\QyrtrHf.exe
  2⤵
  PID:5044
- C:\Windows\System\qYtyXRK.exe
  C:\Windows\System\qYtyXRK.exe
  2⤵
  PID:2928
- C:\Windows\System\hbKZsMO.exe
  C:\Windows\System\hbKZsMO.exe
  2⤵
  PID:3036
- C:\Windows\System\fAJDYJs.exe
  C:\Windows\System\fAJDYJs.exe
  2⤵
  PID:4344
- C:\Windows\System\fuinXSI.exe
  C:\Windows\System\fuinXSI.exe
  2⤵
  PID:5856
- C:\Windows\System\wEOrlfI.exe
  C:\Windows\System\wEOrlfI.exe
  2⤵
  PID:5304
- C:\Windows\System\WTsblwG.exe
  C:\Windows\System\WTsblwG.exe
  2⤵
  PID:5436
- C:\Windows\System\PJcDGod.exe
  C:\Windows\System\PJcDGod.exe
  2⤵
  PID:2136
- C:\Windows\System\PWqbrLo.exe
  C:\Windows\System\PWqbrLo.exe
  2⤵
  PID:5696
- C:\Windows\System\MwEcuMA.exe
  C:\Windows\System\MwEcuMA.exe
  2⤵
  PID:2904
- C:\Windows\System\bMGJoMl.exe
  C:\Windows\System\bMGJoMl.exe
  2⤵
  PID:1684
- C:\Windows\System\JaeoepF.exe
  C:\Windows\System\JaeoepF.exe
  2⤵
  PID:2672
- C:\Windows\System\gThnPXS.exe
  C:\Windows\System\gThnPXS.exe
  2⤵
  PID:5904
- C:\Windows\System\fgOxZkN.exe
  C:\Windows\System\fgOxZkN.exe
  2⤵
  PID:6076
- C:\Windows\System\rDETwou.exe
  C:\Windows\System\rDETwou.exe
  2⤵
  PID:3600
- C:\Windows\System\CJgNqtH.exe
  C:\Windows\System\CJgNqtH.exe
  2⤵
  PID:4312
- C:\Windows\System\KtgUNiQ.exe
  C:\Windows\System\KtgUNiQ.exe
  2⤵
  PID:5840
- C:\Windows\System\QjdEJYW.exe
  C:\Windows\System\QjdEJYW.exe
  2⤵
  PID:2116
- C:\Windows\System\ZnvnqXO.exe
  C:\Windows\System\ZnvnqXO.exe
  2⤵
  PID:5076
- C:\Windows\System\ElZawzk.exe
  C:\Windows\System\ElZawzk.exe
  2⤵
  PID:4508
- C:\Windows\System\IotySXn.exe
  C:\Windows\System\IotySXn.exe
  2⤵
  PID:3848
- C:\Windows\System\DuLIzzO.exe
  C:\Windows\System\DuLIzzO.exe
  2⤵
  PID:4104
- C:\Windows\System\SYDLuUM.exe
  C:\Windows\System\SYDLuUM.exe
  2⤵
  PID:4412
- C:\Windows\System\YxyTacQ.exe
  C:\Windows\System\YxyTacQ.exe
  2⤵
  PID:2156
- C:\Windows\System\tlzuotI.exe
  C:\Windows\System\tlzuotI.exe
  2⤵
  PID:2728
- C:\Windows\System\URnziMf.exe
  C:\Windows\System\URnziMf.exe
  2⤵
  PID:5728
- C:\Windows\System\agByUXm.exe
  C:\Windows\System\agByUXm.exe
  2⤵
  PID:404
- C:\Windows\System\hPqrKtj.exe
  C:\Windows\System\hPqrKtj.exe
  2⤵
  PID:4892
- C:\Windows\System\wolqynZ.exe
  C:\Windows\System\wolqynZ.exe
  2⤵
  PID:2348
- C:\Windows\System\WrJBAoZ.exe
  C:\Windows\System\WrJBAoZ.exe
  2⤵
  PID:1712
- C:\Windows\System\JoDAaUF.exe
  C:\Windows\System\JoDAaUF.exe
  2⤵
  PID:4668
- C:\Windows\System\SfnQNDx.exe
  C:\Windows\System\SfnQNDx.exe
  2⤵
  PID:5268
- C:\Windows\System\BAFrTcm.exe
  C:\Windows\System\BAFrTcm.exe
  2⤵
  PID:4108
- C:\Windows\System\DfohiCx.exe
  C:\Windows\System\DfohiCx.exe
  2⤵
  PID:4120
- C:\Windows\System\kuFIPDu.exe
  C:\Windows\System\kuFIPDu.exe
  2⤵
  PID:2768
- C:\Windows\System\FwsBcgT.exe
  C:\Windows\System\FwsBcgT.exe
  2⤵
  PID:4616
- C:\Windows\System\ptyqfom.exe
  C:\Windows\System\ptyqfom.exe
  2⤵
  PID:808
- C:\Windows\System\KNRVzvo.exe
  C:\Windows\System\KNRVzvo.exe
  2⤵
  PID:5968
- C:\Windows\System\Hfvlvkd.exe
  C:\Windows\System\Hfvlvkd.exe
  2⤵
  PID:4428
- C:\Windows\System\pFvkQQf.exe
  C:\Windows\System\pFvkQQf.exe
  2⤵
  PID:4760
- C:\Windows\System\bVZRPKB.exe
  C:\Windows\System\bVZRPKB.exe
  2⤵
  PID:4408
- C:\Windows\System\whyBiTy.exe
  C:\Windows\System\whyBiTy.exe
  2⤵
  PID:6160
- C:\Windows\System\BbwVhcZ.exe
  C:\Windows\System\BbwVhcZ.exe
  2⤵
  PID:6176
- C:\Windows\System\JqxcScl.exe
  C:\Windows\System\JqxcScl.exe
  2⤵
  PID:6192
- C:\Windows\System\SObMYBS.exe
  C:\Windows\System\SObMYBS.exe
  2⤵
  PID:6208
- C:\Windows\System\GELdnEn.exe
  C:\Windows\System\GELdnEn.exe
  2⤵
  PID:6224
- C:\Windows\System\hdSOdkm.exe
  C:\Windows\System\hdSOdkm.exe
  2⤵
  PID:6240
- C:\Windows\System\NGADxSn.exe
  C:\Windows\System\NGADxSn.exe
  2⤵
  PID:6256
- C:\Windows\System\vTjSJst.exe
  C:\Windows\System\vTjSJst.exe
  2⤵
  PID:6272
- C:\Windows\System\kIWRFSV.exe
  C:\Windows\System\kIWRFSV.exe
  2⤵
  PID:6288
- C:\Windows\System\ALUyYoF.exe
  C:\Windows\System\ALUyYoF.exe
  2⤵
  PID:6308
- C:\Windows\System\CjzZXfW.exe
  C:\Windows\System\CjzZXfW.exe
  2⤵
  PID:6324
- C:\Windows\System\AepUCbn.exe
  C:\Windows\System\AepUCbn.exe
  2⤵
  PID:6340
- C:\Windows\System\vtdkCfD.exe
  C:\Windows\System\vtdkCfD.exe
  2⤵
  PID:6356
- C:\Windows\System\ExupVMd.exe
  C:\Windows\System\ExupVMd.exe
  2⤵
  PID:6372
- C:\Windows\System\IvseyFL.exe
  C:\Windows\System\IvseyFL.exe
  2⤵
  PID:6388
- C:\Windows\System\FJbeWys.exe
  C:\Windows\System\FJbeWys.exe
  2⤵
  PID:6408
- C:\Windows\System\iPHSfhL.exe
  C:\Windows\System\iPHSfhL.exe
  2⤵
  PID:6428
- C:\Windows\System\jHbTzJK.exe
  C:\Windows\System\jHbTzJK.exe
  2⤵
  PID:6448
- C:\Windows\System\viuxrgm.exe
  C:\Windows\System\viuxrgm.exe
  2⤵
  PID:6464
- C:\Windows\System\AOyMpmo.exe
  C:\Windows\System\AOyMpmo.exe
  2⤵
  PID:6480
- C:\Windows\System\clnfNrl.exe
  C:\Windows\System\clnfNrl.exe
  2⤵
  PID:6496
- C:\Windows\System\RqxmHWw.exe
  C:\Windows\System\RqxmHWw.exe
  2⤵
  PID:6512
- C:\Windows\System\xvueqrF.exe
  C:\Windows\System\xvueqrF.exe
  2⤵
  PID:6528
- C:\Windows\System\VcYRxfC.exe
  C:\Windows\System\VcYRxfC.exe
  2⤵
  PID:6544
- C:\Windows\System\drVSgBW.exe
  C:\Windows\System\drVSgBW.exe
  2⤵
  PID:6560
- C:\Windows\System\HmYBBDc.exe
  C:\Windows\System\HmYBBDc.exe
  2⤵
  PID:6576
- C:\Windows\System\HQqFWNq.exe
  C:\Windows\System\HQqFWNq.exe
  2⤵
  PID:6592
- C:\Windows\System\tuCivFT.exe
  C:\Windows\System\tuCivFT.exe
  2⤵
  PID:6612
- C:\Windows\System\ksJarRD.exe
  C:\Windows\System\ksJarRD.exe
  2⤵
  PID:6628
- C:\Windows\System\POeELUT.exe
  C:\Windows\System\POeELUT.exe
  2⤵
  PID:6644
- C:\Windows\System\cStqSqo.exe
  C:\Windows\System\cStqSqo.exe
  2⤵
  PID:6660
- C:\Windows\System\ydppIeZ.exe
  C:\Windows\System\ydppIeZ.exe
  2⤵
  PID:6676
- C:\Windows\System\szejHfs.exe
  C:\Windows\System\szejHfs.exe
  2⤵
  PID:6692
- C:\Windows\System\AzKLjJL.exe
  C:\Windows\System\AzKLjJL.exe
  2⤵
  PID:6708
- C:\Windows\System\vYzsykX.exe
  C:\Windows\System\vYzsykX.exe
  2⤵
  PID:6724
- C:\Windows\System\BnAvcVS.exe
  C:\Windows\System\BnAvcVS.exe
  2⤵
  PID:6744
- C:\Windows\System\LaIVZqo.exe
  C:\Windows\System\LaIVZqo.exe
  2⤵
  PID:6760
- C:\Windows\System\fXOQYqc.exe
  C:\Windows\System\fXOQYqc.exe
  2⤵
  PID:6776
- C:\Windows\System\XngvZxS.exe
  C:\Windows\System\XngvZxS.exe
  2⤵
  PID:6796
- C:\Windows\System\FphqNLl.exe
  C:\Windows\System\FphqNLl.exe
  2⤵
  PID:6812
- C:\Windows\System\uuIjndj.exe
  C:\Windows\System\uuIjndj.exe
  2⤵
  PID:6828
- C:\Windows\System\SkSRnAf.exe
  C:\Windows\System\SkSRnAf.exe
  2⤵
  PID:6848
- C:\Windows\System\JvdLKFr.exe
  C:\Windows\System\JvdLKFr.exe
  2⤵
  PID:6868
- C:\Windows\System\bJUwNUg.exe
  C:\Windows\System\bJUwNUg.exe
  2⤵
  PID:6892
- C:\Windows\System\Znfmxqx.exe
  C:\Windows\System\Znfmxqx.exe
  2⤵
  PID:6908
- C:\Windows\System\PMTSPBm.exe
  C:\Windows\System\PMTSPBm.exe
  2⤵
  PID:6924
- C:\Windows\System\MTvZvsN.exe
  C:\Windows\System\MTvZvsN.exe
  2⤵
  PID:6940
- C:\Windows\System\StdegIk.exe
  C:\Windows\System\StdegIk.exe
  2⤵
  PID:6956
- C:\Windows\System\OIeKASi.exe
  C:\Windows\System\OIeKASi.exe
  2⤵
  PID:6996
- C:\Windows\System\XtrkpTn.exe
  C:\Windows\System\XtrkpTn.exe
  2⤵
  PID:7020
- C:\Windows\System\dUTXero.exe
  C:\Windows\System\dUTXero.exe
  2⤵
  PID:7036
- C:\Windows\System\AVLXmea.exe
  C:\Windows\System\AVLXmea.exe
  2⤵
  PID:7052
- C:\Windows\System\bZDWQCG.exe
  C:\Windows\System\bZDWQCG.exe
  2⤵
  PID:7072
- C:\Windows\System\yOEcJIZ.exe
  C:\Windows\System\yOEcJIZ.exe
  2⤵
  PID:7088
- C:\Windows\System\XuYamaL.exe
  C:\Windows\System\XuYamaL.exe
  2⤵
  PID:7104
- C:\Windows\System\ZPBdVkN.exe
  C:\Windows\System\ZPBdVkN.exe
  2⤵
  PID:7120
- C:\Windows\System\bICvpCo.exe
  C:\Windows\System\bICvpCo.exe
  2⤵
  PID:7136
- C:\Windows\System\IienDgc.exe
  C:\Windows\System\IienDgc.exe
  2⤵
  PID:7152
- C:\Windows\System\VqCXCel.exe
  C:\Windows\System\VqCXCel.exe
  2⤵
  PID:5480
- C:\Windows\System\GaCxsua.exe
  C:\Windows\System\GaCxsua.exe
  2⤵
  PID:3412
- C:\Windows\System\ytfrstL.exe
  C:\Windows\System\ytfrstL.exe
  2⤵
  PID:5828
- C:\Windows\System\hOXsIMp.exe
  C:\Windows\System\hOXsIMp.exe
  2⤵
  PID:6124
- C:\Windows\System\FXWekLS.exe
  C:\Windows\System\FXWekLS.exe
  2⤵
  PID:6232
- C:\Windows\System\kbhgFbV.exe
  C:\Windows\System\kbhgFbV.exe
  2⤵
  PID:5064
- C:\Windows\System\XpIHnsX.exe
  C:\Windows\System\XpIHnsX.exe
  2⤵
  PID:6268
- C:\Windows\System\mURzqkw.exe
  C:\Windows\System\mURzqkw.exe
  2⤵
  PID:3252
- C:\Windows\System\NoHKkra.exe
  C:\Windows\System\NoHKkra.exe
  2⤵
  PID:2908
- C:\Windows\System\RFRpAzx.exe
  C:\Windows\System\RFRpAzx.exe
  2⤵
  PID:6368
- C:\Windows\System\KBOWRpw.exe
  C:\Windows\System\KBOWRpw.exe
  2⤵
  PID:6436
- C:\Windows\System\cGkAehK.exe
  C:\Windows\System\cGkAehK.exe
  2⤵
  PID:6476
- C:\Windows\System\ztEGhOc.exe
  C:\Windows\System\ztEGhOc.exe
  2⤵
  PID:6540
- C:\Windows\System\RrzTgKn.exe
  C:\Windows\System\RrzTgKn.exe
  2⤵
  PID:6604
- C:\Windows\System\AfGGDUx.exe
  C:\Windows\System\AfGGDUx.exe
  2⤵
  PID:6668
- C:\Windows\System\DvJERuy.exe
  C:\Windows\System\DvJERuy.exe
  2⤵
  PID:6732
- C:\Windows\System\qGDphKW.exe
  C:\Windows\System\qGDphKW.exe
  2⤵
  PID:6772
- C:\Windows\System\ylwuOPp.exe
  C:\Windows\System\ylwuOPp.exe
  2⤵
  PID:6840
- C:\Windows\System\xOkxYPd.exe
  C:\Windows\System\xOkxYPd.exe
  2⤵
  PID:6884
- C:\Windows\System\PQcGAxd.exe
  C:\Windows\System\PQcGAxd.exe
  2⤵
  PID:6920
- C:\Windows\System\fBcLOhI.exe
  C:\Windows\System\fBcLOhI.exe
  2⤵
  PID:6552
- C:\Windows\System\KPifgBF.exe
  C:\Windows\System\KPifgBF.exe
  2⤵
  PID:6280
- C:\Windows\System\QzeRmeo.exe
  C:\Windows\System\QzeRmeo.exe
  2⤵
  PID:6460
- C:\Windows\System\IuaJukJ.exe
  C:\Windows\System\IuaJukJ.exe
  2⤵
  PID:6624
- C:\Windows\System\RaxfGHq.exe
  C:\Windows\System\RaxfGHq.exe
  2⤵
  PID:6820
- C:\Windows\System\yTdHYFf.exe
  C:\Windows\System\yTdHYFf.exe
  2⤵
  PID:6976
- C:\Windows\System\WhZmSFc.exe
  C:\Windows\System\WhZmSFc.exe
  2⤵
  PID:6348
- C:\Windows\System\sgaWXFR.exe
  C:\Windows\System\sgaWXFR.exe
  2⤵
  PID:6984
- C:\Windows\System\WlUNRxC.exe
  C:\Windows\System\WlUNRxC.exe
  2⤵
  PID:6684
- C:\Windows\System\jYTmPIF.exe
  C:\Windows\System\jYTmPIF.exe
  2⤵
  PID:6788
- C:\Windows\System\OYqjmhc.exe
  C:\Windows\System\OYqjmhc.exe
  2⤵
  PID:6904
- C:\Windows\System\LKIipVu.exe
  C:\Windows\System\LKIipVu.exe
  2⤵
  PID:1456
- C:\Windows\System\WovGtZd.exe
  C:\Windows\System\WovGtZd.exe
  2⤵
  PID:7044
- C:\Windows\System\ytuEQtM.exe
  C:\Windows\System\ytuEQtM.exe
  2⤵
  PID:7112
- C:\Windows\System\CEvUzJy.exe
  C:\Windows\System\CEvUzJy.exe
  2⤵
  PID:7016
- C:\Windows\System\HNQkeES.exe
  C:\Windows\System\HNQkeES.exe
  2⤵
  PID:7064
- C:\Windows\System\fTfEBqm.exe
  C:\Windows\System\fTfEBqm.exe
  2⤵
  PID:7164
- C:\Windows\System\nFqyDzv.exe
  C:\Windows\System\nFqyDzv.exe
  2⤵
  PID:7100
- C:\Windows\System\OsZYaee.exe
  C:\Windows\System\OsZYaee.exe
  2⤵
  PID:6184
- C:\Windows\System\LatWdtU.exe
  C:\Windows\System\LatWdtU.exe
  2⤵
  PID:6304
- C:\Windows\System\ENTfCoL.exe
  C:\Windows\System\ENTfCoL.exe
  2⤵
  PID:3408
- C:\Windows\System\lmIuXnF.exe
  C:\Windows\System\lmIuXnF.exe
  2⤵
  PID:6152
- C:\Windows\System\YYwSAqL.exe
  C:\Windows\System\YYwSAqL.exe
  2⤵
  PID:6600
- C:\Windows\System\xRYxVEw.exe
  C:\Windows\System\xRYxVEw.exe
  2⤵
  PID:6400
- C:\Windows\System\WtKkDAB.exe
  C:\Windows\System\WtKkDAB.exe
  2⤵
  PID:6640
- C:\Windows\System\SRhNLWf.exe
  C:\Windows\System\SRhNLWf.exe
  2⤵
  PID:6716
- C:\Windows\System\ErSyjSe.exe
  C:\Windows\System\ErSyjSe.exe
  2⤵
  PID:6932
- C:\Windows\System\stHxMIE.exe
  C:\Windows\System\stHxMIE.exe
  2⤵
  PID:6880
- C:\Windows\System\hsiskvI.exe
  C:\Windows\System\hsiskvI.exe
  2⤵
  PID:6420
- C:\Windows\System\VqHBJuz.exe
  C:\Windows\System\VqHBJuz.exe
  2⤵
  PID:6320
- C:\Windows\System\RBRRCcn.exe
  C:\Windows\System\RBRRCcn.exe
  2⤵
  PID:6488
- C:\Windows\System\nDnEdHO.exe
  C:\Windows\System\nDnEdHO.exe
  2⤵
  PID:6968
- C:\Windows\System\tiTBzGb.exe
  C:\Windows\System\tiTBzGb.exe
  2⤵
  PID:2004
- C:\Windows\System\QBFAbxI.exe
  C:\Windows\System\QBFAbxI.exe
  2⤵
  PID:6140
- C:\Windows\System\kJWUYGQ.exe
  C:\Windows\System\kJWUYGQ.exe
  2⤵
  PID:6220
- C:\Windows\System\xHnSNFE.exe
  C:\Windows\System\xHnSNFE.exe
  2⤵
  PID:7148
- C:\Windows\System\gMInrmb.exe
  C:\Windows\System\gMInrmb.exe
  2⤵
  PID:7012
- C:\Windows\System\YkxUPRw.exe
  C:\Windows\System\YkxUPRw.exe
  2⤵
  PID:6172
- C:\Windows\System\BAWFXLP.exe
  C:\Windows\System\BAWFXLP.exe
  2⤵
  PID:6536
- C:\Windows\System\RpMAaRj.exe
  C:\Windows\System\RpMAaRj.exe
  2⤵
  PID:6808
- C:\Windows\System\tObmGsm.exe
  C:\Windows\System\tObmGsm.exe
  2⤵
  PID:6876
- C:\Windows\System\iyDROjg.exe
  C:\Windows\System\iyDROjg.exe
  2⤵
  PID:6756
- C:\Windows\System\KNAiyzu.exe
  C:\Windows\System\KNAiyzu.exe
  2⤵
  PID:6916
- C:\Windows\System\fnKHXna.exe
  C:\Windows\System\fnKHXna.exe
  2⤵
  PID:7084
- C:\Windows\System\kWLouUS.exe
  C:\Windows\System\kWLouUS.exe
  2⤵
  PID:6248
- C:\Windows\System\ziCnNcl.exe
  C:\Windows\System\ziCnNcl.exe
  2⤵
  PID:6900
- C:\Windows\System\OCIHEfK.exe
  C:\Windows\System\OCIHEfK.exe
  2⤵
  PID:7144
- C:\Windows\System\nzjuapr.exe
  C:\Windows\System\nzjuapr.exe
  2⤵
  PID:7160
- C:\Windows\System\iconORt.exe
  C:\Windows\System\iconORt.exe
  2⤵
  PID:6416
- C:\Windows\System\BlPaJoQ.exe
  C:\Windows\System\BlPaJoQ.exe
  2⤵
  PID:5340
- C:\Windows\System\JILsOFy.exe
  C:\Windows\System\JILsOFy.exe
  2⤵
  PID:6988
- C:\Windows\System\dCpQujP.exe
  C:\Windows\System\dCpQujP.exe
  2⤵
  PID:6656
- C:\Windows\System\QYicPXZ.exe
  C:\Windows\System\QYicPXZ.exe
  2⤵
  PID:6472
- C:\Windows\System\WgbOWtO.exe
  C:\Windows\System\WgbOWtO.exe
  2⤵
  PID:7176
- C:\Windows\System\YdXYFFl.exe
  C:\Windows\System\YdXYFFl.exe
  2⤵
  PID:7192
- C:\Windows\System\ONiRrSj.exe
  C:\Windows\System\ONiRrSj.exe
  2⤵
  PID:7208
- C:\Windows\System\WRjEZUt.exe
  C:\Windows\System\WRjEZUt.exe
  2⤵
  PID:7224
- C:\Windows\System\cfaZmXt.exe
  C:\Windows\System\cfaZmXt.exe
  2⤵
  PID:7240
- C:\Windows\System\jAfmVhP.exe
  C:\Windows\System\jAfmVhP.exe
  2⤵
  PID:7256
- C:\Windows\System\wBpWNfv.exe
  C:\Windows\System\wBpWNfv.exe
  2⤵
  PID:7272
- C:\Windows\System\ylMuEXY.exe
  C:\Windows\System\ylMuEXY.exe
  2⤵
  PID:7288
- C:\Windows\System\UPbDznt.exe
  C:\Windows\System\UPbDznt.exe
  2⤵
  PID:7304
- C:\Windows\System\TAhLwSj.exe
  C:\Windows\System\TAhLwSj.exe
  2⤵
  PID:7320
- C:\Windows\System\EaSaMLk.exe
  C:\Windows\System\EaSaMLk.exe
  2⤵
  PID:7336
- C:\Windows\System\SEOqute.exe
  C:\Windows\System\SEOqute.exe
  2⤵
  PID:7352
- C:\Windows\System\dmLeEhr.exe
  C:\Windows\System\dmLeEhr.exe
  2⤵
  PID:7368
- C:\Windows\System\ZVSoaQq.exe
  C:\Windows\System\ZVSoaQq.exe
  2⤵
  PID:7384
- C:\Windows\System\mWnlDeR.exe
  C:\Windows\System\mWnlDeR.exe
  2⤵
  PID:7400
- C:\Windows\System\yxXUROD.exe
  C:\Windows\System\yxXUROD.exe
  2⤵
  PID:7416
- C:\Windows\System\YClyrVF.exe
  C:\Windows\System\YClyrVF.exe
  2⤵
  PID:7432
- C:\Windows\System\JqCdrNX.exe
  C:\Windows\System\JqCdrNX.exe
  2⤵
  PID:7448
- C:\Windows\System\YlrWxso.exe
  C:\Windows\System\YlrWxso.exe
  2⤵
  PID:7464
- C:\Windows\System\ovkiuWj.exe
  C:\Windows\System\ovkiuWj.exe
  2⤵
  PID:7480
- C:\Windows\System\nvcofRw.exe
  C:\Windows\System\nvcofRw.exe
  2⤵
  PID:7496
- C:\Windows\System\rrqvtCh.exe
  C:\Windows\System\rrqvtCh.exe
  2⤵
  PID:7512
- C:\Windows\System\zXnFMiU.exe
  C:\Windows\System\zXnFMiU.exe
  2⤵
  PID:7528
- C:\Windows\System\ReVrVJD.exe
  C:\Windows\System\ReVrVJD.exe
  2⤵
  PID:7544
- C:\Windows\System\eyKyyBv.exe
  C:\Windows\System\eyKyyBv.exe
  2⤵
  PID:7560
- C:\Windows\System\dGaCbLG.exe
  C:\Windows\System\dGaCbLG.exe
  2⤵
  PID:7576
- C:\Windows\System\uJfwXJE.exe
  C:\Windows\System\uJfwXJE.exe
  2⤵
  PID:7592
- C:\Windows\System\HmETbxx.exe
  C:\Windows\System\HmETbxx.exe
  2⤵
  PID:7608
- C:\Windows\System\tuYsVOx.exe
  C:\Windows\System\tuYsVOx.exe
  2⤵
  PID:7624
- C:\Windows\System\kNbiZqm.exe
  C:\Windows\System\kNbiZqm.exe
  2⤵
  PID:7640
- C:\Windows\System\GuhffLB.exe
  C:\Windows\System\GuhffLB.exe
  2⤵
  PID:7656
- C:\Windows\System\JRALQRp.exe
  C:\Windows\System\JRALQRp.exe
  2⤵
  PID:7672
- C:\Windows\System\UToBbmt.exe
  C:\Windows\System\UToBbmt.exe
  2⤵
  PID:7688
- C:\Windows\System\CMqBDBy.exe
  C:\Windows\System\CMqBDBy.exe
  2⤵
  PID:7704
- C:\Windows\System\bSWykAv.exe
  C:\Windows\System\bSWykAv.exe
  2⤵
  PID:7720
- C:\Windows\System\pXlyYyA.exe
  C:\Windows\System\pXlyYyA.exe
  2⤵
  PID:7736
- C:\Windows\System\YSfmAph.exe
  C:\Windows\System\YSfmAph.exe
  2⤵
  PID:7752
- C:\Windows\System\UMIsFtr.exe
  C:\Windows\System\UMIsFtr.exe
  2⤵
  PID:7768
- C:\Windows\System\DLSPQSd.exe
  C:\Windows\System\DLSPQSd.exe
  2⤵
  PID:7784
- C:\Windows\System\xEGTImX.exe
  C:\Windows\System\xEGTImX.exe
  2⤵
  PID:7800
- C:\Windows\System\aVWLjRY.exe
  C:\Windows\System\aVWLjRY.exe
  2⤵
  PID:7816
- C:\Windows\System\OENGTsx.exe
  C:\Windows\System\OENGTsx.exe
  2⤵
  PID:7832
- C:\Windows\System\qwYyjBo.exe
  C:\Windows\System\qwYyjBo.exe
  2⤵
  PID:7848
- C:\Windows\System\HJIqmaF.exe
  C:\Windows\System\HJIqmaF.exe
  2⤵
  PID:7864
- C:\Windows\System\fSYAhpv.exe
  C:\Windows\System\fSYAhpv.exe
  2⤵
  PID:7880
- C:\Windows\System\MZKzUKD.exe
  C:\Windows\System\MZKzUKD.exe
  2⤵
  PID:7896
- C:\Windows\System\vVhPgWi.exe
  C:\Windows\System\vVhPgWi.exe
  2⤵
  PID:7912
- C:\Windows\System\eCgKVKD.exe
  C:\Windows\System\eCgKVKD.exe
  2⤵
  PID:7928
- C:\Windows\System\KKnNFNJ.exe
  C:\Windows\System\KKnNFNJ.exe
  2⤵
  PID:7944
- C:\Windows\System\AfomJaQ.exe
  C:\Windows\System\AfomJaQ.exe
  2⤵
  PID:7960
- C:\Windows\System\QkFgsyH.exe
  C:\Windows\System\QkFgsyH.exe
  2⤵
  PID:7976
- C:\Windows\System\Avondwl.exe
  C:\Windows\System\Avondwl.exe
  2⤵
  PID:7992
- C:\Windows\System\omzzqZj.exe
  C:\Windows\System\omzzqZj.exe
  2⤵
  PID:8008
- C:\Windows\System\koXcXUq.exe
  C:\Windows\System\koXcXUq.exe
  2⤵
  PID:8024
- C:\Windows\System\uEHpKZM.exe
  C:\Windows\System\uEHpKZM.exe
  2⤵
  PID:8040
- C:\Windows\System\CmAVLzd.exe
  C:\Windows\System\CmAVLzd.exe
  2⤵
  PID:8056
- C:\Windows\System\HRyFsmB.exe
  C:\Windows\System\HRyFsmB.exe
  2⤵
  PID:8072
- C:\Windows\System\rsaVjzi.exe
  C:\Windows\System\rsaVjzi.exe
  2⤵
  PID:8088
- C:\Windows\System\czzsVCg.exe
  C:\Windows\System\czzsVCg.exe
  2⤵
  PID:8104
- C:\Windows\System\VjAtglz.exe
  C:\Windows\System\VjAtglz.exe
  2⤵
  PID:8120
- C:\Windows\System\MEnlhvA.exe
  C:\Windows\System\MEnlhvA.exe
  2⤵
  PID:8136
- C:\Windows\System\TOOxKjT.exe
  C:\Windows\System\TOOxKjT.exe
  2⤵
  PID:8152
- C:\Windows\System\xISiRxz.exe
  C:\Windows\System\xISiRxz.exe
  2⤵
  PID:8168
- C:\Windows\System\bzFlckn.exe
  C:\Windows\System\bzFlckn.exe
  2⤵
  PID:8184
- C:\Windows\System\DdlvkEq.exe
  C:\Windows\System\DdlvkEq.exe
  2⤵
  PID:7184
- C:\Windows\System\zPKoBby.exe
  C:\Windows\System\zPKoBby.exe
  2⤵
  PID:6444
- C:\Windows\System\IrERmrD.exe
  C:\Windows\System\IrERmrD.exe
  2⤵
  PID:7200
- C:\Windows\System\uikCYNS.exe
  C:\Windows\System\uikCYNS.exe
  2⤵
  PID:7236
- C:\Windows\System\BQzdrDz.exe
  C:\Windows\System\BQzdrDz.exe
  2⤵
  PID:7300
- C:\Windows\System\cDrKlAT.exe
  C:\Windows\System\cDrKlAT.exe
  2⤵
  PID:7312
- C:\Windows\System\tjDChjA.exe
  C:\Windows\System\tjDChjA.exe
  2⤵
  PID:7344
- C:\Windows\System\NyQxIkt.exe
  C:\Windows\System\NyQxIkt.exe
  2⤵
  PID:7380
- C:\Windows\System\IwDMNgj.exe
  C:\Windows\System\IwDMNgj.exe
  2⤵
  PID:7412
- C:\Windows\System\rjdXMIu.exe
  C:\Windows\System\rjdXMIu.exe
  2⤵
  PID:7428
- C:\Windows\System\dzMJKRh.exe
  C:\Windows\System\dzMJKRh.exe
  2⤵
  PID:7460
- C:\Windows\System\fwHKgXz.exe
  C:\Windows\System\fwHKgXz.exe
  2⤵
  PID:7128
- C:\Windows\System\ZlvWUBB.exe
  C:\Windows\System\ZlvWUBB.exe
  2⤵
  PID:7520
- C:\Windows\System\tTGWDOP.exe
  C:\Windows\System\tTGWDOP.exe
  2⤵
  PID:7556
- C:\Windows\System\tLSiAGs.exe
  C:\Windows\System\tLSiAGs.exe
  2⤵
  PID:7540
- C:\Windows\System\OzOdeyj.exe
  C:\Windows\System\OzOdeyj.exe
  2⤵
  PID:7616
- C:\Windows\System\wfBpQdp.exe
  C:\Windows\System\wfBpQdp.exe
  2⤵
  PID:7668
- C:\Windows\System\dwxTiYL.exe
  C:\Windows\System\dwxTiYL.exe
  2⤵
  PID:7652
- C:\Windows\System\iVcefsV.exe
  C:\Windows\System\iVcefsV.exe
  2⤵
  PID:7744
- C:\Windows\System\cCTILxA.exe
  C:\Windows\System\cCTILxA.exe
  2⤵
  PID:7728
- C:\Windows\System\oMccnYL.exe
  C:\Windows\System\oMccnYL.exe
  2⤵
  PID:7776
- C:\Windows\System\GqDDNQQ.exe
  C:\Windows\System\GqDDNQQ.exe
  2⤵
  PID:7808
- C:\Windows\System\JgDezxC.exe
  C:\Windows\System\JgDezxC.exe
  2⤵
  PID:7876
- C:\Windows\System\raSQnyD.exe
  C:\Windows\System\raSQnyD.exe
  2⤵
  PID:7908
- C:\Windows\System\WCGUdiR.exe
  C:\Windows\System\WCGUdiR.exe
  2⤵
  PID:7856
- C:\Windows\System\lcASWdZ.exe
  C:\Windows\System\lcASWdZ.exe
  2⤵
  PID:7920
- C:\Windows\System\cVhMIDn.exe
  C:\Windows\System\cVhMIDn.exe
  2⤵
  PID:8004
- C:\Windows\System\QxjMtaM.exe
  C:\Windows\System\QxjMtaM.exe
  2⤵
  PID:8068
- C:\Windows\System\IbpYiwH.exe
  C:\Windows\System\IbpYiwH.exe
  2⤵
  PID:8048
- C:\Windows\System\JbinlWA.exe
  C:\Windows\System\JbinlWA.exe
  2⤵
  PID:8016
- C:\Windows\System\vPQurgH.exe
  C:\Windows\System\vPQurgH.exe
  2⤵
  PID:8132
- C:\Windows\System\ZjlxnaW.exe
  C:\Windows\System\ZjlxnaW.exe
  2⤵
  PID:6284
- C:\Windows\System\qDkQktA.exe
  C:\Windows\System\qDkQktA.exe
  2⤵
  PID:8148
- C:\Windows\System\JnTKQup.exe
  C:\Windows\System\JnTKQup.exe
  2⤵
  PID:6424
- C:\Windows\System\kKwazQz.exe
  C:\Windows\System\kKwazQz.exe
  2⤵
  PID:7296
- C:\Windows\System\eKzdFSv.exe
  C:\Windows\System\eKzdFSv.exe
  2⤵
  PID:7248
- C:\Windows\System\rvvVhFv.exe
  C:\Windows\System\rvvVhFv.exe
  2⤵
  PID:7364
- C:\Windows\System\YLDSfXe.exe
  C:\Windows\System\YLDSfXe.exe
  2⤵
  PID:7492
- C:\Windows\System\vFfGTDD.exe
  C:\Windows\System\vFfGTDD.exe
  2⤵
  PID:7636
- C:\Windows\System\HOrvwtp.exe
  C:\Windows\System\HOrvwtp.exe
  2⤵
  PID:7280
- C:\Windows\System\CzBzhgj.exe
  C:\Windows\System\CzBzhgj.exe
  2⤵
  PID:7424
- C:\Windows\System\cnINKnA.exe
  C:\Windows\System\cnINKnA.exe
  2⤵
  PID:7552
- C:\Windows\System\AgEsPUU.exe
  C:\Windows\System\AgEsPUU.exe
  2⤵
  PID:7648
- C:\Windows\System\OFbugxK.exe
  C:\Windows\System\OFbugxK.exe
  2⤵
  PID:7004
- C:\Windows\System\bXAdmAn.exe
  C:\Windows\System\bXAdmAn.exe
  2⤵
  PID:7936
- C:\Windows\System\ATiFWit.exe
  C:\Windows\System\ATiFWit.exe
  2⤵
  PID:7952
- C:\Windows\System\jzVBzCj.exe
  C:\Windows\System\jzVBzCj.exe
  2⤵
  PID:7840
- C:\Windows\System\wfdJIGW.exe
  C:\Windows\System\wfdJIGW.exe
  2⤵
  PID:7796
- C:\Windows\System\crpNAhE.exe
  C:\Windows\System\crpNAhE.exe
  2⤵
  PID:7984
- C:\Windows\System\xzsUOge.exe
  C:\Windows\System\xzsUOge.exe
  2⤵
  PID:7316
- C:\Windows\System\aVSHqsB.exe
  C:\Windows\System\aVSHqsB.exe
  2⤵
  PID:7888
- C:\Windows\System\MsQCkDE.exe
  C:\Windows\System\MsQCkDE.exe
  2⤵
  PID:7376
- C:\Windows\System\jDGmOSq.exe
  C:\Windows\System\jDGmOSq.exe
  2⤵
  PID:8180
- C:\Windows\System\xJpJRuj.exe
  C:\Windows\System\xJpJRuj.exe
  2⤵
  PID:7456
- C:\Windows\System\ylPUEaW.exe
  C:\Windows\System\ylPUEaW.exe
  2⤵
  PID:7664
- C:\Windows\System\foGhdDK.exe
  C:\Windows\System\foGhdDK.exe
  2⤵
  PID:8128
- C:\Windows\System\WaHDriI.exe
  C:\Windows\System\WaHDriI.exe
  2⤵
  PID:7968
- C:\Windows\System\BWPUqdx.exe
  C:\Windows\System\BWPUqdx.exe
  2⤵
  PID:8080
- C:\Windows\System\gSglZwn.exe
  C:\Windows\System\gSglZwn.exe
  2⤵
  PID:8084
- C:\Windows\System\sqyAdkW.exe
  C:\Windows\System\sqyAdkW.exe
  2⤵
  PID:7536
- C:\Windows\System\HndRIQw.exe
  C:\Windows\System\HndRIQw.exe
  2⤵
  PID:8200
- C:\Windows\System\nulafCK.exe
  C:\Windows\System\nulafCK.exe
  2⤵
  PID:8216
- C:\Windows\System\ffKBfxW.exe
  C:\Windows\System\ffKBfxW.exe
  2⤵
  PID:8232
- C:\Windows\System\UlUptdG.exe
  C:\Windows\System\UlUptdG.exe
  2⤵
  PID:8248
- C:\Windows\System\ioXjcsz.exe
  C:\Windows\System\ioXjcsz.exe
  2⤵
  PID:8264
- C:\Windows\System\GhYisnw.exe
  C:\Windows\System\GhYisnw.exe
  2⤵
  PID:8280
- C:\Windows\System\wcaNWhA.exe
  C:\Windows\System\wcaNWhA.exe
  2⤵
  PID:8296
- C:\Windows\System\UMnrasL.exe
  C:\Windows\System\UMnrasL.exe
  2⤵
  PID:8312
- C:\Windows\System\qSWmDxR.exe
  C:\Windows\System\qSWmDxR.exe
  2⤵
  PID:8328
- C:\Windows\System\uSsCOTp.exe
  C:\Windows\System\uSsCOTp.exe
  2⤵
  PID:8344
- C:\Windows\System\gSwoUex.exe
  C:\Windows\System\gSwoUex.exe
  2⤵
  PID:8360
- C:\Windows\System\zxBhxun.exe
  C:\Windows\System\zxBhxun.exe
  2⤵
  PID:8376
- C:\Windows\System\ADeYkJv.exe
  C:\Windows\System\ADeYkJv.exe
  2⤵
  PID:8392
- C:\Windows\System\XLaMHII.exe
  C:\Windows\System\XLaMHII.exe
  2⤵
  PID:8408
- C:\Windows\System\tXzRIcF.exe
  C:\Windows\System\tXzRIcF.exe
  2⤵
  PID:8424
- C:\Windows\System\wApEWTJ.exe
  C:\Windows\System\wApEWTJ.exe
  2⤵
  PID:8440
- C:\Windows\System\WcowDfL.exe
  C:\Windows\System\WcowDfL.exe
  2⤵
  PID:8456
- C:\Windows\System\ErlLBBO.exe
  C:\Windows\System\ErlLBBO.exe
  2⤵
  PID:8472
- C:\Windows\System\KcvVIxY.exe
  C:\Windows\System\KcvVIxY.exe
  2⤵
  PID:8488
- C:\Windows\System\NnViPqZ.exe
  C:\Windows\System\NnViPqZ.exe
  2⤵
  PID:8504
- C:\Windows\System\LbJXKKz.exe
  C:\Windows\System\LbJXKKz.exe
  2⤵
  PID:8520
- C:\Windows\System\aiqBVZa.exe
  C:\Windows\System\aiqBVZa.exe
  2⤵
  PID:8536
- C:\Windows\System\XkFRaQk.exe
  C:\Windows\System\XkFRaQk.exe
  2⤵
  PID:8552
- C:\Windows\System\kWHYjfV.exe
  C:\Windows\System\kWHYjfV.exe
  2⤵
  PID:8568
- C:\Windows\System\yZNmWCK.exe
  C:\Windows\System\yZNmWCK.exe
  2⤵
  PID:8584
- C:\Windows\System\dXzfqmR.exe
  C:\Windows\System\dXzfqmR.exe
  2⤵
  PID:8600
- C:\Windows\System\wSecYYw.exe
  C:\Windows\System\wSecYYw.exe
  2⤵
  PID:8616
- C:\Windows\System\raIoFsN.exe
  C:\Windows\System\raIoFsN.exe
  2⤵
  PID:8632
- C:\Windows\System\wFzyukd.exe
  C:\Windows\System\wFzyukd.exe
  2⤵
  PID:8648
- C:\Windows\System\qWYkHBB.exe
  C:\Windows\System\qWYkHBB.exe
  2⤵
  PID:8664
- C:\Windows\System\CPTvTZV.exe
  C:\Windows\System\CPTvTZV.exe
  2⤵
  PID:8680
- C:\Windows\System\mQYmtbr.exe
  C:\Windows\System\mQYmtbr.exe
  2⤵
  PID:8696
- C:\Windows\System\xlIRnhI.exe
  C:\Windows\System\xlIRnhI.exe
  2⤵
  PID:8712
- C:\Windows\System\VtJEDzF.exe
  C:\Windows\System\VtJEDzF.exe
  2⤵
  PID:8732
- C:\Windows\System\lkNyzEZ.exe
  C:\Windows\System\lkNyzEZ.exe
  2⤵
  PID:8748
- C:\Windows\System\MIisnPM.exe
  C:\Windows\System\MIisnPM.exe
  2⤵
  PID:8764
- C:\Windows\System\PCsCOxM.exe
  C:\Windows\System\PCsCOxM.exe
  2⤵
  PID:8780
- C:\Windows\System\GsRIZKx.exe
  C:\Windows\System\GsRIZKx.exe
  2⤵
  PID:8796
- C:\Windows\System\gEWuwAC.exe
  C:\Windows\System\gEWuwAC.exe
  2⤵
  PID:8812
- C:\Windows\System\MuXnoFS.exe
  C:\Windows\System\MuXnoFS.exe
  2⤵
  PID:8828
- C:\Windows\System\vdJpltt.exe
  C:\Windows\System\vdJpltt.exe
  2⤵
  PID:8844
- C:\Windows\System\iMePKDE.exe
  C:\Windows\System\iMePKDE.exe
  2⤵
  PID:8868
- C:\Windows\System\IwymSLo.exe
  C:\Windows\System\IwymSLo.exe
  2⤵
  PID:8884
- C:\Windows\System\ZbnGaRk.exe
  C:\Windows\System\ZbnGaRk.exe
  2⤵
  PID:8900
- C:\Windows\System\qPRAdkA.exe
  C:\Windows\System\qPRAdkA.exe
  2⤵
  PID:8916
- C:\Windows\System\cKcZZNr.exe
  C:\Windows\System\cKcZZNr.exe
  2⤵
  PID:8932
- C:\Windows\System\yvMlMfD.exe
  C:\Windows\System\yvMlMfD.exe
  2⤵
  PID:8948
- C:\Windows\System\GiduFHQ.exe
  C:\Windows\System\GiduFHQ.exe
  2⤵
  PID:8964
- C:\Windows\System\tJbTWqr.exe
  C:\Windows\System\tJbTWqr.exe
  2⤵
  PID:8980
- C:\Windows\System\rkVmZjh.exe
  C:\Windows\System\rkVmZjh.exe
  2⤵
  PID:8996
- C:\Windows\System\kjnJIox.exe
  C:\Windows\System\kjnJIox.exe
  2⤵
  PID:9012
- C:\Windows\System\JHSrQjv.exe
  C:\Windows\System\JHSrQjv.exe
  2⤵
  PID:9028
- C:\Windows\System\tHrtFOW.exe
  C:\Windows\System\tHrtFOW.exe
  2⤵
  PID:9044
- C:\Windows\System\fAaUSVv.exe
  C:\Windows\System\fAaUSVv.exe
  2⤵
  PID:9060
- C:\Windows\System\PZceqrR.exe
  C:\Windows\System\PZceqrR.exe
  2⤵
  PID:9076
- C:\Windows\System\tidvVQj.exe
  C:\Windows\System\tidvVQj.exe
  2⤵
  PID:9092
- C:\Windows\System\roqywhp.exe
  C:\Windows\System\roqywhp.exe
  2⤵
  PID:9108
- C:\Windows\System\ySkLZgn.exe
  C:\Windows\System\ySkLZgn.exe
  2⤵
  PID:9124
- C:\Windows\System\XblSduV.exe
  C:\Windows\System\XblSduV.exe
  2⤵
  PID:9140
- C:\Windows\System\TIwNAbJ.exe
  C:\Windows\System\TIwNAbJ.exe
  2⤵
  PID:9156
- C:\Windows\System\UuPQAOc.exe
  C:\Windows\System\UuPQAOc.exe
  2⤵
  PID:9172
- C:\Windows\System\xpWEnLd.exe
  C:\Windows\System\xpWEnLd.exe
  2⤵
  PID:9188
- C:\Windows\System\vTgeuST.exe
  C:\Windows\System\vTgeuST.exe
  2⤵
  PID:9204
- C:\Windows\System\deiVdSN.exe
  C:\Windows\System\deiVdSN.exe
  2⤵
  PID:8196
- C:\Windows\System\EkxjukU.exe
  C:\Windows\System\EkxjukU.exe
  2⤵
  PID:8260
- C:\Windows\System\PJMfZhA.exe
  C:\Windows\System\PJMfZhA.exe
  2⤵
  PID:8324
- C:\Windows\System\ZqMiIYm.exe
  C:\Windows\System\ZqMiIYm.exe
  2⤵
  PID:7792
- C:\Windows\System\INvGYLg.exe
  C:\Windows\System\INvGYLg.exe
  2⤵
  PID:8416
- C:\Windows\System\FeNjAMf.exe
  C:\Windows\System\FeNjAMf.exe
  2⤵
  PID:8116
- C:\Windows\System\HMbFKjN.exe
  C:\Windows\System\HMbFKjN.exe
  2⤵
  PID:8448
- C:\Windows\System\QAQpscM.exe
  C:\Windows\System\QAQpscM.exe
  2⤵
  PID:8244
- C:\Windows\System\iCkVLGk.exe
  C:\Windows\System\iCkVLGk.exe
  2⤵
  PID:8368
- C:\Windows\System\tlLluNX.exe
  C:\Windows\System\tlLluNX.exe
  2⤵
  PID:6836
- C:\Windows\System\KfhdIbC.exe
  C:\Windows\System\KfhdIbC.exe
  2⤵
  PID:8240
- C:\Windows\System\rZmkdTT.exe
  C:\Windows\System\rZmkdTT.exe
  2⤵
  PID:8340
- C:\Windows\System\cUasgUw.exe
  C:\Windows\System\cUasgUw.exe
  2⤵
  PID:8464
- C:\Windows\System\HkJpgHR.exe
  C:\Windows\System\HkJpgHR.exe
  2⤵
  PID:8496
- C:\Windows\System\lrhXGjr.exe
  C:\Windows\System\lrhXGjr.exe
  2⤵
  PID:8548
- C:\Windows\System\vxtMMEO.exe
  C:\Windows\System\vxtMMEO.exe
  2⤵
  PID:8564
- C:\Windows\System\rJyIuKX.exe
  C:\Windows\System\rJyIuKX.exe
  2⤵
  PID:8608
- C:\Windows\System\QhQjVcR.exe
  C:\Windows\System\QhQjVcR.exe
  2⤵
  PID:8596
- C:\Windows\System\jZWdxZr.exe
  C:\Windows\System\jZWdxZr.exe
  2⤵
  PID:8660
- C:\Windows\System\rhSdrPU.exe
  C:\Windows\System\rhSdrPU.exe
  2⤵
  PID:8708
- C:\Windows\System\XyQeiHd.exe
  C:\Windows\System\XyQeiHd.exe
  2⤵
  PID:8772
- C:\Windows\System\miCVRfH.exe
  C:\Windows\System\miCVRfH.exe
  2⤵
  PID:8836
- C:\Windows\System\QRlenlG.exe
  C:\Windows\System\QRlenlG.exe
  2⤵
  PID:8788
- C:\Windows\System\gpyXTBZ.exe
  C:\Windows\System\gpyXTBZ.exe
  2⤵
  PID:8760
- C:\Windows\System\OGSqewz.exe
  C:\Windows\System\OGSqewz.exe
  2⤵
  PID:8876
- C:\Windows\System\lStewGB.exe
  C:\Windows\System\lStewGB.exe
  2⤵
  PID:8940
- C:\Windows\System\nKEWgZI.exe
  C:\Windows\System\nKEWgZI.exe
  2⤵
  PID:9004
- C:\Windows\System\odbkBwv.exe
  C:\Windows\System\odbkBwv.exe
  2⤵
  PID:9068
- C:\Windows\System\jQqsVrZ.exe
  C:\Windows\System\jQqsVrZ.exe
  2⤵
  PID:9132
- C:\Windows\System\Oaznjuy.exe
  C:\Windows\System\Oaznjuy.exe
  2⤵
  PID:9196
- C:\Windows\System\AJWkcnl.exe
  C:\Windows\System\AJWkcnl.exe
  2⤵
  PID:8256
- C:\Windows\System\mDCuPwx.exe
  C:\Windows\System\mDCuPwx.exe
  2⤵
  PID:9180
- C:\Windows\System\JEXORFa.exe
  C:\Windows\System\JEXORFa.exe
  2⤵
  PID:8384
- C:\Windows\System\anaQntb.exe
  C:\Windows\System\anaQntb.exe
  2⤵
  PID:8924
- C:\Windows\System\INkMZVL.exe
  C:\Windows\System\INkMZVL.exe
  2⤵
  PID:8988
- C:\Windows\System\wmEYOWW.exe
  C:\Windows\System\wmEYOWW.exe
  2⤵
  PID:9052
- C:\Windows\System\ufPuEuN.exe
  C:\Windows\System\ufPuEuN.exe
  2⤵
  PID:9148
- C:\Windows\System\UclvqBb.exe
  C:\Windows\System\UclvqBb.exe
  2⤵
  PID:7700
- C:\Windows\System\nFGIUJs.exe
  C:\Windows\System\nFGIUJs.exe
  2⤵
  PID:8164
- C:\Windows\System\kYMKCqP.exe
  C:\Windows\System\kYMKCqP.exe
  2⤵
  PID:8304
- C:\Windows\System\jnamrOl.exe
  C:\Windows\System\jnamrOl.exe
  2⤵
  PID:8560
- C:\Windows\System\sMdvzfE.exe
  C:\Windows\System\sMdvzfE.exe
  2⤵
  PID:8676
- C:\Windows\System\sMsYLjz.exe
  C:\Windows\System\sMsYLjz.exe
  2⤵
  PID:8064
- C:\Windows\System\eknJHBC.exe
  C:\Windows\System\eknJHBC.exe
  2⤵
  PID:8580
- C:\Windows\System\xvUhtOC.exe
  C:\Windows\System\xvUhtOC.exe
  2⤵
  PID:8628
- C:\Windows\System\YCkXFQr.exe
  C:\Windows\System\YCkXFQr.exe
  2⤵
  PID:8468
- C:\Windows\System\QnvfaFe.exe
  C:\Windows\System\QnvfaFe.exe
  2⤵
  PID:8720
- C:\Windows\System\uQNCiHv.exe
  C:\Windows\System\uQNCiHv.exe
  2⤵
  PID:8908
- C:\Windows\System\UrNVese.exe
  C:\Windows\System\UrNVese.exe
  2⤵
  PID:9040
- C:\Windows\System\rHHAOab.exe
  C:\Windows\System\rHHAOab.exe
  2⤵
  PID:9100
- C:\Windows\System\wkqblFX.exe
  C:\Windows\System\wkqblFX.exe
  2⤵
  PID:8892
- C:\Windows\System\WjISFpb.exe
  C:\Windows\System\WjISFpb.exe
  2⤵
  PID:8224
- C:\Windows\System\kNTdJgO.exe
  C:\Windows\System\kNTdJgO.exe
  2⤵
  PID:8960
- C:\Windows\System\dthByYZ.exe
  C:\Windows\System\dthByYZ.exe
  2⤵
  PID:7220
- C:\Windows\System\dNSdCId.exe
  C:\Windows\System\dNSdCId.exe
  2⤵
  PID:7604
- C:\Windows\System\HbBZHWM.exe
  C:\Windows\System\HbBZHWM.exe
  2⤵
  PID:8640
- C:\Windows\System\LNtppIT.exe
  C:\Windows\System\LNtppIT.exe
  2⤵
  PID:7332
- C:\Windows\System\VuBpOGp.exe
  C:\Windows\System\VuBpOGp.exe
  2⤵
  PID:8688
- C:\Windows\System\xhPUqHl.exe
  C:\Windows\System\xhPUqHl.exe
  2⤵
  PID:8824
- C:\Windows\System\OaEwpDT.exe
  C:\Windows\System\OaEwpDT.exe
  2⤵
  PID:7712
- C:\Windows\System\PjmNsQO.exe
  C:\Windows\System\PjmNsQO.exe
  2⤵
  PID:8512
- C:\Windows\System\yBkRSGj.exe
  C:\Windows\System\yBkRSGj.exe
  2⤵
  PID:8896
- C:\Windows\System\icbfLSd.exe
  C:\Windows\System\icbfLSd.exe
  2⤵
  PID:9228
- C:\Windows\System\tnxbxCq.exe
  C:\Windows\System\tnxbxCq.exe
  2⤵
  PID:9244
- C:\Windows\System\qikYUaY.exe
  C:\Windows\System\qikYUaY.exe
  2⤵
  PID:9260
- C:\Windows\System\qsbjAPY.exe
  C:\Windows\System\qsbjAPY.exe
  2⤵
  PID:9276
- C:\Windows\System\ViLDgBz.exe
  C:\Windows\System\ViLDgBz.exe
  2⤵
  PID:9292
- C:\Windows\System\QXIBICm.exe
  C:\Windows\System\QXIBICm.exe
  2⤵
  PID:9308
- C:\Windows\System\QUKGjSb.exe
  C:\Windows\System\QUKGjSb.exe
  2⤵
  PID:9324
- C:\Windows\System\vzPvWBJ.exe
  C:\Windows\System\vzPvWBJ.exe
  2⤵
  PID:9340
- C:\Windows\System\xHZKbtn.exe
  C:\Windows\System\xHZKbtn.exe
  2⤵
  PID:9356
- C:\Windows\System\nivoykq.exe
  C:\Windows\System\nivoykq.exe
  2⤵
  PID:9372
- C:\Windows\System\qtnVPDx.exe
  C:\Windows\System\qtnVPDx.exe
  2⤵
  PID:9388
- C:\Windows\System\JgOKlpK.exe
  C:\Windows\System\JgOKlpK.exe
  2⤵
  PID:9404
- C:\Windows\System\FiBkbrk.exe
  C:\Windows\System\FiBkbrk.exe
  2⤵
  PID:9420
- C:\Windows\System\EhOxquo.exe
  C:\Windows\System\EhOxquo.exe
  2⤵
  PID:9436
- C:\Windows\System\IAburHW.exe
  C:\Windows\System\IAburHW.exe
  2⤵
  PID:9452
- C:\Windows\System\RBtwVSW.exe
  C:\Windows\System\RBtwVSW.exe
  2⤵
  PID:9468
- C:\Windows\System\gTDIXYW.exe
  C:\Windows\System\gTDIXYW.exe
  2⤵
  PID:9484
- C:\Windows\System\dNcaMwV.exe
  C:\Windows\System\dNcaMwV.exe
  2⤵
  PID:9504
- C:\Windows\System\rnNNWEi.exe
  C:\Windows\System\rnNNWEi.exe
  2⤵
  PID:9520
- C:\Windows\System\bpSJuIT.exe
  C:\Windows\System\bpSJuIT.exe
  2⤵
  PID:9536
- C:\Windows\System\EGuWdNm.exe
  C:\Windows\System\EGuWdNm.exe
  2⤵
  PID:9552
- C:\Windows\System\OosrBTz.exe
  C:\Windows\System\OosrBTz.exe
  2⤵
  PID:9568
- C:\Windows\System\ZXomWVb.exe
  C:\Windows\System\ZXomWVb.exe
  2⤵
  PID:9584
- C:\Windows\System\MzWiFVK.exe
  C:\Windows\System\MzWiFVK.exe
  2⤵
  PID:9600
- C:\Windows\System\nkqkUTF.exe
  C:\Windows\System\nkqkUTF.exe
  2⤵
  PID:9616
- C:\Windows\System\HIguwrh.exe
  C:\Windows\System\HIguwrh.exe
  2⤵
  PID:9632
- C:\Windows\System\tnbNUkk.exe
  C:\Windows\System\tnbNUkk.exe
  2⤵
  PID:9648
- C:\Windows\System\loLHBlc.exe
  C:\Windows\System\loLHBlc.exe
  2⤵
  PID:9664
- C:\Windows\System\EMZoHQN.exe
  C:\Windows\System\EMZoHQN.exe
  2⤵
  PID:9680
- C:\Windows\System\VQaWNXm.exe
  C:\Windows\System\VQaWNXm.exe
  2⤵
  PID:9696
- C:\Windows\System\aUYoaun.exe
  C:\Windows\System\aUYoaun.exe
  2⤵
  PID:9712
- C:\Windows\System\HyMnSBW.exe
  C:\Windows\System\HyMnSBW.exe
  2⤵
  PID:9728
- C:\Windows\System\XhaRYEt.exe
  C:\Windows\System\XhaRYEt.exe
  2⤵
  PID:9744
- C:\Windows\System\Wvlcwnn.exe
  C:\Windows\System\Wvlcwnn.exe
  2⤵
  PID:9760
- C:\Windows\System\BdZgzjN.exe
  C:\Windows\System\BdZgzjN.exe
  2⤵
  PID:9780
- C:\Windows\System\wmxgZrR.exe
  C:\Windows\System\wmxgZrR.exe
  2⤵
  PID:9796
- C:\Windows\System\GojAVjg.exe
  C:\Windows\System\GojAVjg.exe
  2⤵
  PID:9812
- C:\Windows\System\kIlswPg.exe
  C:\Windows\System\kIlswPg.exe
  2⤵
  PID:9828
- C:\Windows\System\vukgewL.exe
  C:\Windows\System\vukgewL.exe
  2⤵
  PID:9844
- C:\Windows\System\PAhNivc.exe
  C:\Windows\System\PAhNivc.exe
  2⤵
  PID:9860
- C:\Windows\System\CeIGHag.exe
  C:\Windows\System\CeIGHag.exe
  2⤵
  PID:9876
- C:\Windows\System\mUbZpfW.exe
  C:\Windows\System\mUbZpfW.exe
  2⤵
  PID:9892
- C:\Windows\System\zMKmdaN.exe
  C:\Windows\System\zMKmdaN.exe
  2⤵
  PID:9908
- C:\Windows\System\eIXPlfm.exe
  C:\Windows\System\eIXPlfm.exe
  2⤵
  PID:9924
- C:\Windows\System\dXfZQzl.exe
  C:\Windows\System\dXfZQzl.exe
  2⤵
  PID:9940
- C:\Windows\System\ZlnJUKX.exe
  C:\Windows\System\ZlnJUKX.exe
  2⤵
  PID:9956
- C:\Windows\System\VpRIdjN.exe
  C:\Windows\System\VpRIdjN.exe
  2⤵
  PID:9972
- C:\Windows\System\OkAzTNJ.exe
  C:\Windows\System\OkAzTNJ.exe
  2⤵
  PID:9988
- C:\Windows\System\yYvXfUB.exe
  C:\Windows\System\yYvXfUB.exe
  2⤵
  PID:10004
- C:\Windows\System\yMmuOAF.exe
  C:\Windows\System\yMmuOAF.exe
  2⤵
  PID:10020
- C:\Windows\System\qNyxVnF.exe
  C:\Windows\System\qNyxVnF.exe
  2⤵
  PID:10036
- C:\Windows\System\zveqoJL.exe
  C:\Windows\System\zveqoJL.exe
  2⤵
  PID:10052
- C:\Windows\System\BrOkKsn.exe
  C:\Windows\System\BrOkKsn.exe
  2⤵
  PID:10072
- C:\Windows\System\uUGpAll.exe
  C:\Windows\System\uUGpAll.exe
  2⤵
  PID:10088
- C:\Windows\System\blpLwyE.exe
  C:\Windows\System\blpLwyE.exe
  2⤵
  PID:10104
- C:\Windows\System\hxYAZbi.exe
  C:\Windows\System\hxYAZbi.exe
  2⤵
  PID:10120
- C:\Windows\System\RbMQwab.exe
  C:\Windows\System\RbMQwab.exe
  2⤵
  PID:10136
- C:\Windows\System\GsCPdGU.exe
  C:\Windows\System\GsCPdGU.exe
  2⤵
  PID:10152
- C:\Windows\System\LIHVtTm.exe
  C:\Windows\System\LIHVtTm.exe
  2⤵
  PID:10168
- C:\Windows\System\ghSVKTA.exe
  C:\Windows\System\ghSVKTA.exe
  2⤵
  PID:10184
- C:\Windows\System\QamcATq.exe
  C:\Windows\System\QamcATq.exe
  2⤵
  PID:10200
- C:\Windows\System\mGTJMgi.exe
  C:\Windows\System\mGTJMgi.exe
  2⤵
  PID:10216
- C:\Windows\System\ppccqRJ.exe
  C:\Windows\System\ppccqRJ.exe
  2⤵
  PID:10232
- C:\Windows\System\yWcxVvg.exe
  C:\Windows\System\yWcxVvg.exe
  2⤵
  PID:9240
- C:\Windows\System\boazLRF.exe
  C:\Windows\System\boazLRF.exe
  2⤵
  PID:9304
- C:\Windows\System\WWhngBb.exe
  C:\Windows\System\WWhngBb.exe
  2⤵
  PID:8276
- C:\Windows\System\xrlxqxD.exe
  C:\Windows\System\xrlxqxD.exe
  2⤵
  PID:8756
- C:\Windows\System\VmzYUYM.exe
  C:\Windows\System\VmzYUYM.exe
  2⤵
  PID:8744
- C:\Windows\System\DOuLkGd.exe
  C:\Windows\System\DOuLkGd.exe
  2⤵
  PID:9168
- C:\Windows\System\xrmNoSa.exe
  C:\Windows\System\xrmNoSa.exe
  2⤵
  PID:8912
- C:\Windows\System\TtdxIpx.exe
  C:\Windows\System\TtdxIpx.exe
  2⤵
  PID:9288
- C:\Windows\System\kimqZyV.exe
  C:\Windows\System\kimqZyV.exe
  2⤵
  PID:9396
- C:\Windows\System\RfkUPFw.exe
  C:\Windows\System\RfkUPFw.exe
  2⤵
  PID:9428
- C:\Windows\System\xuZrloW.exe
  C:\Windows\System\xuZrloW.exe
  2⤵
  PID:9492
- C:\Windows\System\KclaXWz.exe
  C:\Windows\System\KclaXWz.exe
  2⤵
  PID:8692
- C:\Windows\System\eEgceLI.exe
  C:\Windows\System\eEgceLI.exe
  2⤵
  PID:9416
- C:\Windows\System\HEmKPAx.exe
  C:\Windows\System\HEmKPAx.exe
  2⤵
  PID:9512
- C:\Windows\System\KKxcLka.exe
  C:\Windows\System\KKxcLka.exe
  2⤵
  PID:9576
- C:\Windows\System\IEIlsuj.exe
  C:\Windows\System\IEIlsuj.exe
  2⤵
  PID:9564
- C:\Windows\System\eAhobZU.exe
  C:\Windows\System\eAhobZU.exe
  2⤵
  PID:9628
- C:\Windows\System\IkPyXxd.exe
  C:\Windows\System\IkPyXxd.exe
  2⤵
  PID:9660
- C:\Windows\System\WMGUGpv.exe
  C:\Windows\System\WMGUGpv.exe
  2⤵
  PID:9724
- C:\Windows\System\Ypyglgc.exe
  C:\Windows\System\Ypyglgc.exe
  2⤵
  PID:9676
- C:\Windows\System\ozxrGyJ.exe
  C:\Windows\System\ozxrGyJ.exe
  2⤵
  PID:9824
- C:\Windows\System\VCCyHuf.exe
  C:\Windows\System\VCCyHuf.exe
  2⤵
  PID:9704
- C:\Windows\System\aXHfCCD.exe
  C:\Windows\System\aXHfCCD.exe
  2⤵
  PID:9920
- C:\Windows\System\ZnHtboE.exe
  C:\Windows\System\ZnHtboE.exe
  2⤵
  PID:9984
- C:\Windows\System\dTyLqga.exe
  C:\Windows\System\dTyLqga.exe
  2⤵
  PID:10044
- C:\Windows\System\AcRsMhN.exe
  C:\Windows\System\AcRsMhN.exe
  2⤵
  PID:10112
- C:\Windows\System\artYfNq.exe
  C:\Windows\System\artYfNq.exe
  2⤵
  PID:9740
- C:\Windows\System\lomClOF.exe
  C:\Windows\System\lomClOF.exe
  2⤵
  PID:10176
- C:\Windows\System\GPDKivA.exe
  C:\Windows\System\GPDKivA.exe
  2⤵
  PID:9804
- C:\Windows\System\lhSLYIw.exe
  C:\Windows\System\lhSLYIw.exe
  2⤵
  PID:9840
- C:\Windows\System\DQHRHdw.exe
  C:\Windows\System\DQHRHdw.exe
  2⤵
  PID:9968
- C:\Windows\System\ETerguk.exe
  C:\Windows\System\ETerguk.exe
  2⤵
  PID:10032
- C:\Windows\System\HtdDFtE.exe
  C:\Windows\System\HtdDFtE.exe
  2⤵
  PID:9904
- C:\Windows\System\HqcIYwR.exe
  C:\Windows\System\HqcIYwR.exe
  2⤵
  PID:10068
- C:\Windows\System\RprfKED.exe
  C:\Windows\System\RprfKED.exe
  2⤵
  PID:10208
- C:\Windows\System\yaYzxbI.exe
  C:\Windows\System\yaYzxbI.exe
  2⤵
  PID:8956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AKbyVNw.exe

Filesize
2.0MB

MD5
a04b1672fb498993933ba81c5b7b21b7

SHA1
f4d291f1998a675c84c36777f3d3df3dcb1192af

SHA256
82a859dc2e404f3ae67f516b048b80d3ffbf15b8bd73e1d44ce6c81915d97e72

SHA512
ef8798609709887c50e19cc47b03df4fe50d7f6ad3fa3f7db69d9b465d12187ab73e2c4e1b50eb37fb3ad13bf35f691834d214710a721ecec51b544f4e93a6df

Download Submit
C:\Windows\system\ETyFVsC.exe

Filesize
2.0MB

MD5
1270a9afcbb63efc3ccee01eb4e63384

SHA1
368bd947f8c40f9ccded85818c4b558a0bb3ebbf

SHA256
d0c18ac5737df8a8bacba857d77583a8d23ed74f8cb949542cfcbcc4e3a027ea

SHA512
82fe08ba240ac0b485ec6367c15c575813d789753e6938d7f9e49feaf0aed6be848e86afcee2fe2e8f7a1553b8a75bb0f1be0daa609b1766d5a96a937d7d2448

Download Submit
C:\Windows\system\EcxtEYr.exe

Filesize
18B

MD5
ef758e56e906b9892f08e5e0fd0f13b2

SHA1
5d91983aa1bb61c5754ee9a01242f0bb098e7d43

SHA256
55949f339b372645d839eaa0847f4e244396f7e39c4586ddc776fb793deda110

SHA512
efd8bb7ef71cf583c97f5d0eac4e2fae239c80d85643b80c586971498ace127bb0c9565e46052e55211bb3dead5ae54145b84fc68e9ff4a6be2a5f6b0f086760

Download Submit
C:\Windows\system\FrcAOhZ.exe

Filesize
2.0MB

MD5
91c9fde770a7b296082533f0981b2fbb

SHA1
9500b7145e1b59ce5a8ba6b30275b54cfbdba055

SHA256
12a20128cde69781bf7e69171293609a391f72d214c19f8936f1c75649c83acb

SHA512
72a7ff8e834ab720c47717c5d65592c59ac8f656886c00499503a042c4a76f2c96f29247185edb97263973b0a5f0355cde04331652d50bee7d6d2f9f43ea3956

Download Submit
C:\Windows\system\GdnCryc.exe

Filesize
2.0MB

MD5
0b67ed33d5fc4261f33c5d073c8a3b91

SHA1
b4b9f58da3b86fd301df6560d17a9bf14757e670

SHA256
56db7bde53aa8bbfa9dd98aeacbd01ff4ce59e9433031378aa1c585e375f0236

SHA512
1d916602f00c68e3f1ced034d7d9c98611faa52de8ef275638daf8ab00f1ae22cd7cfd82ab5544fa29bf0b3cf65952b1bdca616989341ebb9c7193502036e266

Download Submit
C:\Windows\system\JFSgUMn.exe

Filesize
2.0MB

MD5
77900d7cd84714c68b8bfc76b33a9824

SHA1
4c047eab913919d6fc71357caab78a4042d6c931

SHA256
3c55128e8a1a04eec855bd098e02432faac7db62c0851f6d3b749b917c592c5c

SHA512
a067e3a93e59899a475a48e8133cb28f383120f1fbfd1195e051acdcbb5756abdbb9d616f897bbc2bec6328a0ec74b8b4605b383655f4db13d981e2f22830337

Download Submit
C:\Windows\system\JcgdWnu.exe

Filesize
2.0MB

MD5
1a9ebe9b7f917838b31edcc2f7aecfb0

SHA1
a1d8feb20f59c061d4f2446f7b409166b9f65dc4

SHA256
336f90020abb683d31b41b939e10d732bb06c63d6388641ed4872dba6ee4da19

SHA512
c43274ff3f07b655f8b01c6619adcb71721891e88643bba19cf51dd839c59223dc6b3b6a333eea7f57e335419a9c4a08c105c1a8826aeeb56b70304bf96c1eca

Download Submit
C:\Windows\system\KIsEoBp.exe

Filesize
2.0MB

MD5
f560140c98793b2a50e0c7869926e445

SHA1
6b7d73e062ab70e1e85445abccd30f2cac6325a8

SHA256
0e35dfc404e991f494e0a15259d07bf2698a6b0a5e7bd35ab6f70b130d0e8004

SHA512
a68867c3752504ee54e761d6b357f44d8fbd9c0c93801aa892d98219f1765ec9bf7b247bf85825d1771dfa9dfde3acfe29c846a8380d62cb2445466d888e4334

Download Submit
C:\Windows\system\LrAtWmy.exe

Filesize
2.0MB

MD5
0eb4939469ce68130ab697ccacfc5455

SHA1
1f5891d367258fbe27fe1387b2ba57c9498cd44f

SHA256
9003dcef0586167420f294bbd89c4678e7a51fa5421649289d97d38973dcd264

SHA512
9c836a44ea9b3953756dcda33584a13f4e789d8ce7fc5b375dade31536e523988f5d7ab22c68b29e5f7a8752029e53859f61f98aba7d1b30976435d54302ddc9

Download Submit
C:\Windows\system\MjpYjxI.exe

Filesize
2.0MB

MD5
3ee2580438bcfdb83314802be64d0287

SHA1
4aaaa68e8da2948f86d7381208996fc0c76d04ed

SHA256
8f9b32ca34fe0c2cc4df08abbe2f00984108753e5ff1074ce0cd88db29a0ced4

SHA512
f9db88ffaa4ede1d3179c143edf3670701b238571adc8543633483b60dc6eda2bf82346e8656f83fcb9630030bb32830482fdaf06d3bf91ec0764fe9fec55ce8

Download Submit
C:\Windows\system\OWuflYd.exe

Filesize
2.0MB

MD5
9d917ca866b17551b2bd8c38f682780b

SHA1
da29ace4a25b8f50c4382a059ab318b28fce3b72

SHA256
7423cf4096ac82f7e5b5e905e845ebfdd65ed6b04f66afe8c0262f12f48df20b

SHA512
3c5bd6845188c56e09057e1ca4adfc06168b241e0ff1e903805c1cab8e9a62a3b0b908f615d9fc2ea30d440f3180d2fe0cab8fb46d4af2e4fc2f0282de898360

Download Submit
C:\Windows\system\PwWaonW.exe

Filesize
2.0MB

MD5
450810793e6c3cb7ec12f721005e6c62

SHA1
80416a43081f8c849d6727c473b456480e8d8c3f

SHA256
3803a57cb4802747e6ec10989ce079c9da391ded2d3c90f5c91fc35f19c6f0f0

SHA512
417ec4af03c4e83d3c0b10f1957db931624136b8146422b7555b9c66879f46d24f10bb643f46ab303cc343d0faf1124157d6569b5ab164c21b581dca51240a88

Download Submit
C:\Windows\system\QQrDKSg.exe

Filesize
2.0MB

MD5
1cdd2584f8969f30123e742f84b2239a

SHA1
d390101340615fb0d6464bed38a0f04790f1ca72

SHA256
6175bca4a01d5cb73c81b9bc824e2e07a0814c3afed9ed9ea0b30185a9ac667c

SHA512
612ff330cdb0b08991b61199a0a1c4deda57fa960a3980f52634767f27f9a5bbed475eef1baff6e940e4d7b479592c2fdd5487828aec4bebe73789702e7d4e50

Download Submit
C:\Windows\system\RDvNTLq.exe

Filesize
2.0MB

MD5
a32603858da5efba48a8692e6ca68d59

SHA1
fd35c0a0844741314be8d15d220574adf728752e

SHA256
186e390c93ed44961b4e9805c5aa549e1ef70bcc7443b19de2b57fe7b5fa2115

SHA512
7ad87054e45b1636573a1cb72e7df398180b1a7a6fed68fa7ae22b11bb91e10bfc30f6c93a33a0873543feac621ee2581fa1f85dc665849eedec396587cd2e2f

Download Submit
C:\Windows\system\RuHSrxm.exe

Filesize
2.0MB

MD5
a7080f357bc89b9c40c9259df78f7796

SHA1
f29d0f3e527cda54d115d47e7d6c4a3815700b29

SHA256
dc3a4f485be8bb263ec0808955426fc0e2f3a9fa3eeb158787c0779f307ab9bb

SHA512
1b6a44a0dd13828c648acedc480de6582b475a0e7cb7a094ba41a7e3e801d495ee2b1f33dc4c34a435def5e4074b147ad2dfadfbbf1f0af377daa94443e9d08d

Download Submit
C:\Windows\system\TPMzVeP.exe

Filesize
2.0MB

MD5
621fc8511dd6edb4339d58f6b8c41630

SHA1
34d245c1d8d9c6865815f96896fd3e50d8ce0613

SHA256
36c6e81e4dc1c12581d72d625230f7d4217c0d5736678eef3b971bb0629c63bf

SHA512
05d2c837356d84226ade2ec0180474194b33f6a02eb96c09c68f93cb462ccb358085f194ab234a0fe107b05045f2a870c4f4642baac5de3b4532f5bb92162d40

Download Submit
C:\Windows\system\WDpKbrK.exe

Filesize
2.0MB

MD5
8098ff921eb8b96bfb7df3b196718acd

SHA1
2e8e1db533523669257e49b16f0ad4357107c261

SHA256
64eae22c967713a9d6ab8f3699f62154478f49a982af466aeb9b23924430aaac

SHA512
6f19d5db59d1bd6daf40d28c51f4eaa9b79fa093c0cb85c57e9138186e42451f4fa09e0668087a3a7661e06b228e48fe5b26a0e6fb762839447cf7cfa1e3e49e

Download Submit
C:\Windows\system\ZQvjSnh.exe

Filesize
2.0MB

MD5
58b662ccaf7d8c1a0db4c86afdbaca14

SHA1
96b04eaa5235c98fde5f0cf9cb3dc85907cebe5a

SHA256
77e8fcc9ad435154f5f7603ca9ed3e0814f756f288b109881d8e5af927bf09ec

SHA512
2b055501303149e93ca63eab4ffaeb28362095319a1b865a74d222d93dbcc275b8f7bbe126ffb7dc3927be4eb65fefdc241cc9560e83ea3d613cabe2ec31ca9e

Download Submit
C:\Windows\system\ayYccYo.exe

Filesize
2.0MB

MD5
802d31b4732e266712a4b6c76bad5195

SHA1
3a73e39011dd58d9aec322a291e81ac67626ec57

SHA256
cae40c06bf1acc62758442c5b782679f1a30cdc772a272e4c93274d5626e5c34

SHA512
9348030e2210a7a81d3bb86bcf239217dff23886b7059820c2e982d3766f230260254e94f80ba3495a974988a27ed755d182a29edc49953b6a943498c1fb6365

Download Submit
C:\Windows\system\bWuKbmz.exe

Filesize
2.0MB

MD5
84044cdad97b7aad1e137027221961a9

SHA1
d8f0f94595d84b2db6bf2afe337187e725351845

SHA256
d5b4c21f0cf89a236a603f840099a2e15c968e595837a3e05a17a50b957ad9f6

SHA512
205024f68294feef27cbff326fcf2b25273b41499e699db616b1f98e32a421b18337bdc54d907b82b18687a546583d6a90c3281f01bf74da845b1e03de8fbfa3

Download Submit
C:\Windows\system\hRCpZTI.exe

Filesize
2.0MB

MD5
3b08fcac226aac55c9c34166b3fc2f2b

SHA1
35965a2bc11df65915456fafb4500e96a5f1e4c4

SHA256
8bffaa511116a38ccd0fee3b4edee23ac27f61460b9087e3ddde4721511a6aae

SHA512
81c081de23a65826cdc6d7fee159f8abb86460d74404566247ae8eb95693ada8ab93d42ee749db94ff340825db3246277e42005a0fb86e5e8e0713f71f8bde0c

Download Submit
C:\Windows\system\hZaMjmL.exe

Filesize
2.0MB

MD5
91f0edfb2ea39f81d47e03be07e9b1a7

SHA1
454bfeebad4cbd7426c83bc29b3e5a3bf2513000

SHA256
80d9c3c09649990c9b55fd4b82c11dd3c1609b53581e87199a6a5fb27c6f2e5c

SHA512
f48267a47eb9bc801f0e7b3e030b88ec8d6b7ef64ca4a17f106a2cd238526f11a677528b58c3224e9f04cd6e32164fb85e21d1efb6c7b963921819d526b22b87

Download Submit
C:\Windows\system\hhAUHbD.exe

Filesize
2.0MB

MD5
659b065d6eb8434c93b3ba23b3fff592

SHA1
863aa34b5aadf9929d51661890b2535f7e6a7756

SHA256
86c7b21fb7877a4aed73fc3f3b814e98f1cae10e87418c72ed11397dbbf61acd

SHA512
f3514a73754e338c310a50572c69c5f3af0b2dd8f2ece18fd6fa56f6937748dd24e03f257d0dd8c56fa6a923de9ce2470b1678b862668b96b2c5be82dce4262c

Download Submit
C:\Windows\system\iXqWWjj.exe

Filesize
2.0MB

MD5
c8ad6bd903dbfb2d3c518dc1c5df89fd

SHA1
278568a5712478302c57b8262dd47568ae3e13c1

SHA256
b2a20547ed615b966f8db556d2fbc0df7c70e945fcafb47a9c76a72160edc1f3

SHA512
db3c06cff828744c54544091f910dcef084378a02002f15910349a6c9aa53f87feedd1de0d63136876fdc7a1df7b4cae06919057249602c71e939bd0384a0e48

Download Submit
C:\Windows\system\jRYNOtS.exe

Filesize
2.0MB

MD5
89628af7f9332394cc4464fe076a54c3

SHA1
d10204c2414398eac9f957d8fbdc208a8d3cc140

SHA256
af0e9b85c06f5ecee842823e5d36cf18c547f88e7b54ef28618b28d857843676

SHA512
b522867c2da8993de233f27e790a22a017dcdd7b8de27082d52c86e5efdf14b5830aa539d122b50d2e44155e77160c0565b334de6399bcf0ea521abbef38184c

Download Submit
C:\Windows\system\szbzJHZ.exe

Filesize
2.0MB

MD5
765d45ec1565b8c38b47b7a5ddc94942

SHA1
7333b286a0d06355a3a5d9f9c39c3c51770226f2

SHA256
290ad1290bca390bc947a1324d17860312bb324066104c658a52cec6c6d0543d

SHA512
cfeba66aed6325936355511930fedc7b137477209a9915ae437d487a50b9bc48b51abece6fee72df25a34c6bb4cb308ecc580cc637e6c14c44ffdffd6adcc8c8

Download Submit
C:\Windows\system\yeXqTmp.exe

Filesize
2.0MB

MD5
208659b84f00de749bff44731164bf61

SHA1
00b2ca9c01b6e259556047d8c883c9bb6188755a

SHA256
66677744de97b50328b13fe01146eb7d0d54867c96a3377669cf142cb174b5e6

SHA512
c420afeec66729e395a417cda4d150347013367837f8546ee35c94445583c9e3688a243431beba9f21a878c96db91280514555d2cba377487b5c87a86890433d

Download Submit
\Windows\system\MVKvGGH.exe

Filesize
2.0MB

MD5
27c348ad37fb0b157be993f09080262f

SHA1
ef2611f4b3a69fa74deb61944c1ae8139ce10921

SHA256
5269363820ea594fe8a0161a824c02701372cac5d08f729bfa9161a260745654

SHA512
fa08efa5a5cb36239ccfdf0e01e0debb8384890ea1fe46054dc6de73b1898e4d6b4caf3595432297c75d8876357aaa81d0fda395ea98cb9417afc91fb1c6d107

Download Submit
\Windows\system\StqUnMX.exe

Filesize
2.0MB

MD5
be4631035968f28883f5d0d44f1fe631

SHA1
38ef2182ab59d9edcab6e479aa01d2a9dd51270a

SHA256
6b9fdbdae7b8b28cc8bc0b5f27da488891dac99f521a77197d905e2f1ac068e5

SHA512
e9f3488ddc9bad26602eb3e307cb883e66e4f3151495bbce81359a2575171556b2c93dffe89b5a9808ef4bb1497a2b24af95d404ee4eb87bd5f32d60bcd30bf9

Download Submit
\Windows\system\TlWLYfb.exe

Filesize
2.0MB

MD5
236d1e691ac3e7bff9b19b71dac06d12

SHA1
ad6f8539509e51bb9bb185b755f0d13372852428

SHA256
58e08b57b3d86e955b44ca070ad13cc6a7d52c3abde522f3aeaffdf5a0a8389f

SHA512
50601bc55c899257dd500cc5e2edabdad285173d307734cea779c4e70c1ecae585c67e5474cb79ae38426d0d3b5c3c1eabfdf30ff023db8b2e9096fa7eb045e5

Download Submit
\Windows\system\UwUIaEz.exe

Filesize
2.0MB

MD5
8b200e39bc6321bcfeb1b9b8c67de7fe

SHA1
9b0f3ce89d8221d02c42d4aa0104e90262f06beb

SHA256
ec88d27ad50bf67bc20a651ae8b7071efdb9075506440b146618c04f90875125

SHA512
4062324043c4f80affc0bdb182c9437db34f7af288f680d10cffc92cb18e605fb468eaea41699b17dfa8b6ce476ec26281dd48d8aa95c905bc22e0a0155fc104

Download Submit
\Windows\system\ZawQElO.exe

Filesize
2.0MB

MD5
b237097df89878c216727979982854b9

SHA1
39f4a7b787357ff37cb1ccbf3ccac9d69ca85f9f

SHA256
29f212d6a40172a8765ce0e02bd3f55638b4fca4dafcb4c7b7e934d3b91b1360

SHA512
e0f08755a6901dade2ab8086ca0028cb675b8e02e3892ca1808866172e3da0a67d5b1e58f86318be27c3577c30a69fdc856004efa4b6bac472fcdfac1854f208

Download Submit
\Windows\system\aVdVsWw.exe

Filesize
2.0MB

MD5
5a040444f7bf08620cd3f9717601c694

SHA1
2b3a11e645cf5fbaadd9b801559ae1f2e491b0d2

SHA256
dcc9fa71db5d875bfc22fc22e041e0e1a6c6c7187e2c51a5864a54708f259b17

SHA512
5176d961c63eb891f64c2eed88f226714219a23fc090d520c1809c1463726e5d8db99ac495ad96f1a7cb0eccf358c1ef5828e9d0a36bf4380f0c845b8b648351

Download Submit
\Windows\system\jvALKsp.exe

Filesize
2.0MB

MD5
917693b6ccf20b207c2d279bda19dbd5

SHA1
6819518a32d2871cdf7fb1693866a743e4a2b772

SHA256
efd0f151a89aaa96343e5b63d86141fdf683b581fc67d8ec1af1a13281d22a0a

SHA512
94720951181d1b5724ae8e5ec84d973691f3b3191a34b633b5a60a50774fc79b2e2814c81d161fcfda243a77775ee8bf9feff66a2b429733b0fd4680252a1a39

Download Submit
memory/944-1995-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/944-56-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/944-0-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/944-10-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/944-26-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/944-98-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/944-96-0x0000000003520000-0x0000000003912000-memory.dmp

Filesize
3.9MB

Download
memory/944-86-0x0000000003520000-0x0000000003912000-memory.dmp

Filesize
3.9MB

Download
memory/944-48-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/944-13750-0x0000000003520000-0x0000000003912000-memory.dmp

Filesize
3.9MB

Download
memory/944-68-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/944-65-0x0000000002F00000-0x00000000032F2000-memory.dmp

Filesize
3.9MB

Download
memory/944-64-0x0000000002F00000-0x00000000032F2000-memory.dmp

Filesize
3.9MB

Download
memory/944-63-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/944-11478-0x0000000003520000-0x0000000003912000-memory.dmp

Filesize
3.9MB

Download
memory/944-1-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/944-57-0x0000000002F00000-0x00000000032F2000-memory.dmp

Filesize
3.9MB

Download
memory/1632-5727-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/1632-95-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/1836-35-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/1836-5730-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/1928-43-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/1928-5723-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-66-0x0000000002AF0000-0x0000000002B70000-memory.dmp

Filesize
512KB

Download
memory/1936-105-0x0000000001D20000-0x0000000001D28000-memory.dmp

Filesize
32KB

Download
memory/1936-74-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2040-19-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2040-5722-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-70-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-5759-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-90-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2112-5728-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2628-5724-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2628-61-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2704-5725-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2704-59-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2756-54-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2756-5729-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2776-5726-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2776-60-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2964-5732-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-69-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download