xmrig | df5fef160f4fad381b42c846b90c5505035868f8054ed8899006075800d47366

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
Size

2.2MB
MD5

01e70e23260f4e9cb346b17767f9675b
SHA1

c17882d75e96fd443656b107b1daf854badce22d
SHA256

df5fef160f4fad381b42c846b90c5505035868f8054ed8899006075800d47366
SHA512

00a8079213480c9bcf819c0861b85f17b1819a9e9301f8dada75879377b25ebd54712df3ac6846a67f30352924f4e7f43e17c158d51128b6558cc3b99dc43995
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cbNs:NABa

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/2388-16-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/2664-228-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/2604-226-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/2892-224-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2964-222-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2612-221-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2708-219-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2792-217-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2744-216-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/620-215-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2816-214-0x000000013F640000-0x000000013FA32000-memory.dmp	xmrig
behavioral1/memory/2248-212-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/2700-211-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2664-5709-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/2708-5714-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2248-5722-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/2700-5721-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2612-5713-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2388-5744-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/2792-5743-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2816-5861-0x000000013F640000-0x000000013FA32000-memory.dmp	xmrig
behavioral1/memory/2964-5827-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2604-5915-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/2744-5914-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1948	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2388	COcEOSj.exe
2700	TieQCIc.exe
2248	okuzjdP.exe
2816	edJGnWI.exe
2744	sfEIADo.exe
2792	ZrZMYFI.exe
2708	XCeBQFw.exe
2612	aLHjgnG.exe
2964	TqrHxem.exe
2892	BgDSuGF.exe
2604	NHbajWZ.exe
2664	tZHuaqY.exe
2640	KkdHsBs.exe
2160	dEgKXVV.exe
2928	pgCquTZ.exe
2992	ydGNFOt.exe
2852	MTtubsI.exe
2932	JElqJjJ.exe
2960	lclWRSW.exe
2660	cOQQqvY.exe
680	SfnlqfJ.exe
1628	sEkchGQ.exe
1036	uhXmGbO.exe
1280	tDQxRSH.exe
2068	wRJucqF.exe
992	zkqLyby.exe
1748	uvJOLdt.exe
1540	PpdRgra.exe
444	KcsRgyM.exe
1668	oqSuGiu.exe
2120	GGRzBdO.exe
236	BbXFrtb.exe
988	cOAoCYD.exe
1316	uODflTT.exe
2484	hLlQfsc.exe
1792	wJdFprK.exe
1596	nuSBYmf.exe
2292	xmbjdbY.exe
2288	QPnmBaD.exe
2356	YzYwVoK.exe
2528	EWCwfeM.exe
1604	WkQEDkd.exe
2352	ACChfzi.exe
2828	tTUGqPi.exe
2776	wfQyXKO.exe
1984	XDlewSY.exe
2476	raVuHLZ.exe
2880	UMWqVIQ.exe
2948	YUfmZan.exe
2884	AqrqPzI.exe
2084	mJiVztQ.exe
2152	jfhMviu.exe
756	ounZhFy.exe
308	IHbhZcx.exe
2184	PwYzMPa.exe
1524	wGaLNeE.exe
2800	gZPlPSv.exe
3100	NEMBsMA.exe
3144	nqjBxIs.exe
3176	GqyYBjK.exe
3208	EixdLlL.exe
3256	wbQcjJb.exe
3288	kLiXhHK.exe
3320	oPiNIaO.exe

Loads dropped DLL 64 IoCs

pid	Process
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/620-0-0x000000013FF60000-0x0000000140352000-memory.dmp	upx
behavioral1/files/0x00080000000120f9-5.dat	upx
behavioral1/files/0x0008000000016c7c-23.dat	upx
behavioral1/files/0x0007000000004e74-22.dat	upx
behavioral1/files/0x0009000000016cb2-28.dat	upx
behavioral1/files/0x000500000001938e-47.dat	upx
behavioral1/files/0x00050000000193a8-57.dat	upx
behavioral1/files/0x000500000001948d-82.dat	upx
behavioral1/files/0x00050000000195c4-102.dat	upx
behavioral1/files/0x00050000000195e0-137.dat	upx
behavioral1/files/0x00050000000195c6-108.dat	upx
behavioral1/files/0x0005000000019bf2-164.dat	upx
behavioral1/files/0x00050000000195cc-121.dat	upx
behavioral1/files/0x00050000000195c8-126.dat	upx
behavioral1/files/0x00050000000195d0-130.dat	upx
behavioral1/files/0x00050000000195ce-132.dat	upx
behavioral1/files/0x0005000000019bf0-165.dat	upx
behavioral1/files/0x00050000000195c7-113.dat	upx
behavioral1/files/0x0005000000019bec-157.dat	upx
behavioral1/files/0x0005000000019624-138.dat	upx
behavioral1/files/0x00050000000196a0-147.dat	upx
behavioral1/files/0x0005000000019c0b-168.dat	upx
behavioral1/files/0x0005000000019931-155.dat	upx
behavioral1/files/0x0005000000019665-145.dat	upx
behavioral1/files/0x00050000000195c2-97.dat	upx
behavioral1/files/0x00050000000195ca-118.dat	upx
behavioral1/files/0x00050000000194e2-87.dat	upx
behavioral1/files/0x000500000001958b-92.dat	upx
behavioral1/files/0x000500000001945c-78.dat	upx
behavioral1/files/0x00050000000193e6-67.dat	upx
behavioral1/files/0x00050000000193f0-71.dat	upx
behavioral1/files/0x0006000000019382-43.dat	upx
behavioral1/files/0x00050000000193d1-62.dat	upx
behavioral1/files/0x0007000000016cd7-42.dat	upx
behavioral1/files/0x0007000000016ccd-37.dat	upx
behavioral1/files/0x0007000000016cc4-34.dat	upx
behavioral1/memory/2388-16-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/memory/2664-228-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/2604-226-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/memory/2892-224-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2964-222-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/2612-221-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2708-219-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2792-217-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2744-216-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2816-214-0x000000013F640000-0x000000013FA32000-memory.dmp	upx
behavioral1/memory/2248-212-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/memory/2700-211-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/2664-5709-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/2708-5714-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2248-5722-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/memory/2700-5721-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/2612-5713-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2388-5744-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/memory/2792-5743-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2816-5861-0x000000013F640000-0x000000013FA32000-memory.dmp	upx
behavioral1/memory/2964-5827-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/2604-5915-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/memory/2744-5914-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VQgGtko.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\TdSzZKn.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\NJWkAtZ.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\ucrRLnT.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\YMItnZT.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\wGaLNeE.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\NrNVrdW.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\DhBJsrT.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\cqRhwhR.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\RIgHNtX.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\PDDScsH.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\frUnhDd.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\IaCQdiF.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\HLknMLb.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\LvZoSZL.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\YKuiCTe.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\SIAEMbc.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\xQFvSyY.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\dRliEYM.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\SSoFKuC.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\iMbtiYy.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\NJICwYj.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\xZxUiKR.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\JDgPOOG.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\rAQDSfW.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\GgZZiSH.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\YXooMkf.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\AtBFRyg.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\tLzZjsY.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\gvtzYcO.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\YujwPFV.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\HYqzpUQ.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\WOPPAFR.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\KzJnCUL.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\jyRSvAK.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\xepFBUl.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\dmXfXaE.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\iOGKYKq.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\bvQMAos.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\TiGvYVz.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\hhEBFUS.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\jQUopFW.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\wSqzYGW.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\JshdUGl.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\RKGNPxo.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\mwBMdOy.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\YwjfMcy.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\QEHEvOM.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\nwfLuot.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\shQdbJC.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\oYReTHJ.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\piPqTuZ.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\lQfAWIo.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\akCXybK.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\dHDNcSm.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\MQOmqtT.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\gaaLblk.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\KBwEcup.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\wBrhtuF.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\rGpOqcb.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\CaukfQG.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\LAHuSCr.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\kvOSeeu.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
File created	C:\Windows\System\KsdlyDC.exe	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1948	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
Token: SeDebugPrivilege	1948	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1948	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	31
PID 620 wrote to memory of 1948	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	31
PID 620 wrote to memory of 1948	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	31
PID 620 wrote to memory of 2388	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	32
PID 620 wrote to memory of 2388	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	32
PID 620 wrote to memory of 2388	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	32
PID 620 wrote to memory of 2248	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	33
PID 620 wrote to memory of 2248	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	33
PID 620 wrote to memory of 2248	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	33
PID 620 wrote to memory of 2700	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	34
PID 620 wrote to memory of 2700	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	34
PID 620 wrote to memory of 2700	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	34
PID 620 wrote to memory of 2816	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	35
PID 620 wrote to memory of 2816	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	35
PID 620 wrote to memory of 2816	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	35
PID 620 wrote to memory of 2744	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	36
PID 620 wrote to memory of 2744	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	36
PID 620 wrote to memory of 2744	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	36
PID 620 wrote to memory of 2792	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	37
PID 620 wrote to memory of 2792	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	37
PID 620 wrote to memory of 2792	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	37
PID 620 wrote to memory of 2708	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	38
PID 620 wrote to memory of 2708	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	38
PID 620 wrote to memory of 2708	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	38
PID 620 wrote to memory of 2964	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	39
PID 620 wrote to memory of 2964	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	39
PID 620 wrote to memory of 2964	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	39
PID 620 wrote to memory of 2612	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	40
PID 620 wrote to memory of 2612	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	40
PID 620 wrote to memory of 2612	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	40
PID 620 wrote to memory of 2892	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	41
PID 620 wrote to memory of 2892	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	41
PID 620 wrote to memory of 2892	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	41
PID 620 wrote to memory of 2604	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	42
PID 620 wrote to memory of 2604	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	42
PID 620 wrote to memory of 2604	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	42
PID 620 wrote to memory of 2664	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	43
PID 620 wrote to memory of 2664	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	43
PID 620 wrote to memory of 2664	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	43
PID 620 wrote to memory of 2640	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	44
PID 620 wrote to memory of 2640	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	44
PID 620 wrote to memory of 2640	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	44
PID 620 wrote to memory of 2160	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	45
PID 620 wrote to memory of 2160	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	45
PID 620 wrote to memory of 2160	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	45
PID 620 wrote to memory of 2928	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	46
PID 620 wrote to memory of 2928	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	46
PID 620 wrote to memory of 2928	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	46
PID 620 wrote to memory of 2992	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	47
PID 620 wrote to memory of 2992	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	47
PID 620 wrote to memory of 2992	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	47
PID 620 wrote to memory of 2852	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	48
PID 620 wrote to memory of 2852	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	48
PID 620 wrote to memory of 2852	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	48
PID 620 wrote to memory of 2932	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	49
PID 620 wrote to memory of 2932	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	49
PID 620 wrote to memory of 2932	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	49
PID 620 wrote to memory of 2960	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	50
PID 620 wrote to memory of 2960	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	50
PID 620 wrote to memory of 2960	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	50
PID 620 wrote to memory of 2660	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	51
PID 620 wrote to memory of 2660	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	51
PID 620 wrote to memory of 2660	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	51
PID 620 wrote to memory of 680	620	01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe	52

C:\Users\Admin\AppData\Local\Temp\01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01e70e23260f4e9cb346b17767f9675b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- C:\Windows\System\COcEOSj.exe
  C:\Windows\System\COcEOSj.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\okuzjdP.exe
  C:\Windows\System\okuzjdP.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\TieQCIc.exe
  C:\Windows\System\TieQCIc.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\edJGnWI.exe
  C:\Windows\System\edJGnWI.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\sfEIADo.exe
  C:\Windows\System\sfEIADo.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\ZrZMYFI.exe
  C:\Windows\System\ZrZMYFI.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\XCeBQFw.exe
  C:\Windows\System\XCeBQFw.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\TqrHxem.exe
  C:\Windows\System\TqrHxem.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\aLHjgnG.exe
  C:\Windows\System\aLHjgnG.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\BgDSuGF.exe
  C:\Windows\System\BgDSuGF.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\NHbajWZ.exe
  C:\Windows\System\NHbajWZ.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\tZHuaqY.exe
  C:\Windows\System\tZHuaqY.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\KkdHsBs.exe
  C:\Windows\System\KkdHsBs.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\dEgKXVV.exe
  C:\Windows\System\dEgKXVV.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\pgCquTZ.exe
  C:\Windows\System\pgCquTZ.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\ydGNFOt.exe
  C:\Windows\System\ydGNFOt.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\MTtubsI.exe
  C:\Windows\System\MTtubsI.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\JElqJjJ.exe
  C:\Windows\System\JElqJjJ.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\lclWRSW.exe
  C:\Windows\System\lclWRSW.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\cOQQqvY.exe
  C:\Windows\System\cOQQqvY.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\SfnlqfJ.exe
  C:\Windows\System\SfnlqfJ.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\uhXmGbO.exe
  C:\Windows\System\uhXmGbO.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\sEkchGQ.exe
  C:\Windows\System\sEkchGQ.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\uvJOLdt.exe
  C:\Windows\System\uvJOLdt.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\tDQxRSH.exe
  C:\Windows\System\tDQxRSH.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\GGRzBdO.exe
  C:\Windows\System\GGRzBdO.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\wRJucqF.exe
  C:\Windows\System\wRJucqF.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\uODflTT.exe
  C:\Windows\System\uODflTT.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\zkqLyby.exe
  C:\Windows\System\zkqLyby.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\nuSBYmf.exe
  C:\Windows\System\nuSBYmf.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\PpdRgra.exe
  C:\Windows\System\PpdRgra.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\NWnKAby.exe
  C:\Windows\System\NWnKAby.exe
  2⤵
  PID:896
- C:\Windows\System\KcsRgyM.exe
  C:\Windows\System\KcsRgyM.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\vtWfnis.exe
  C:\Windows\System\vtWfnis.exe
  2⤵
  PID:2320
- C:\Windows\System\oqSuGiu.exe
  C:\Windows\System\oqSuGiu.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\ycHgRLW.exe
  C:\Windows\System\ycHgRLW.exe
  2⤵
  PID:1352
- C:\Windows\System\BbXFrtb.exe
  C:\Windows\System\BbXFrtb.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\PlqGHEu.exe
  C:\Windows\System\PlqGHEu.exe
  2⤵
  PID:1976
- C:\Windows\System\cOAoCYD.exe
  C:\Windows\System\cOAoCYD.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\iKONPXe.exe
  C:\Windows\System\iKONPXe.exe
  2⤵
  PID:1764
- C:\Windows\System\hLlQfsc.exe
  C:\Windows\System\hLlQfsc.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\VToMcMI.exe
  C:\Windows\System\VToMcMI.exe
  2⤵
  PID:1752
- C:\Windows\System\wJdFprK.exe
  C:\Windows\System\wJdFprK.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\dmgTaSg.exe
  C:\Windows\System\dmgTaSg.exe
  2⤵
  PID:848
- C:\Windows\System\xmbjdbY.exe
  C:\Windows\System\xmbjdbY.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\JDgPOOG.exe
  C:\Windows\System\JDgPOOG.exe
  2⤵
  PID:832
- C:\Windows\System\QPnmBaD.exe
  C:\Windows\System\QPnmBaD.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\LmkhOPm.exe
  C:\Windows\System\LmkhOPm.exe
  2⤵
  PID:2556
- C:\Windows\System\YzYwVoK.exe
  C:\Windows\System\YzYwVoK.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\lelkLTl.exe
  C:\Windows\System\lelkLTl.exe
  2⤵
  PID:2336
- C:\Windows\System\EWCwfeM.exe
  C:\Windows\System\EWCwfeM.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\lpVFuWL.exe
  C:\Windows\System\lpVFuWL.exe
  2⤵
  PID:2368
- C:\Windows\System\WkQEDkd.exe
  C:\Windows\System\WkQEDkd.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\hNiRqTN.exe
  C:\Windows\System\hNiRqTN.exe
  2⤵
  PID:1708
- C:\Windows\System\ACChfzi.exe
  C:\Windows\System\ACChfzi.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\SBMaOHE.exe
  C:\Windows\System\SBMaOHE.exe
  2⤵
  PID:2836
- C:\Windows\System\tTUGqPi.exe
  C:\Windows\System\tTUGqPi.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\hRLydeN.exe
  C:\Windows\System\hRLydeN.exe
  2⤵
  PID:2848
- C:\Windows\System\wfQyXKO.exe
  C:\Windows\System\wfQyXKO.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\TAcUqWQ.exe
  C:\Windows\System\TAcUqWQ.exe
  2⤵
  PID:2308
- C:\Windows\System\XDlewSY.exe
  C:\Windows\System\XDlewSY.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\iiuLvUX.exe
  C:\Windows\System\iiuLvUX.exe
  2⤵
  PID:2952
- C:\Windows\System\raVuHLZ.exe
  C:\Windows\System\raVuHLZ.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\JUQjYIP.exe
  C:\Windows\System\JUQjYIP.exe
  2⤵
  PID:2156
- C:\Windows\System\UMWqVIQ.exe
  C:\Windows\System\UMWqVIQ.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\RRMBvQw.exe
  C:\Windows\System\RRMBvQw.exe
  2⤵
  PID:2380
- C:\Windows\System\YUfmZan.exe
  C:\Windows\System\YUfmZan.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\EInuyLG.exe
  C:\Windows\System\EInuyLG.exe
  2⤵
  PID:1856
- C:\Windows\System\AqrqPzI.exe
  C:\Windows\System\AqrqPzI.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\EEEimOj.exe
  C:\Windows\System\EEEimOj.exe
  2⤵
  PID:2228
- C:\Windows\System\mJiVztQ.exe
  C:\Windows\System\mJiVztQ.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\xAxqPYr.exe
  C:\Windows\System\xAxqPYr.exe
  2⤵
  PID:952
- C:\Windows\System\jfhMviu.exe
  C:\Windows\System\jfhMviu.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\mjckDen.exe
  C:\Windows\System\mjckDen.exe
  2⤵
  PID:1660
- C:\Windows\System\ounZhFy.exe
  C:\Windows\System\ounZhFy.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\KbXSsMW.exe
  C:\Windows\System\KbXSsMW.exe
  2⤵
  PID:2268
- C:\Windows\System\IHbhZcx.exe
  C:\Windows\System\IHbhZcx.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\gXSgNTy.exe
  C:\Windows\System\gXSgNTy.exe
  2⤵
  PID:2520
- C:\Windows\System\PwYzMPa.exe
  C:\Windows\System\PwYzMPa.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\ULdLTvi.exe
  C:\Windows\System\ULdLTvi.exe
  2⤵
  PID:2956
- C:\Windows\System\wGaLNeE.exe
  C:\Windows\System\wGaLNeE.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\dSCeaAq.exe
  C:\Windows\System\dSCeaAq.exe
  2⤵
  PID:1816
- C:\Windows\System\gZPlPSv.exe
  C:\Windows\System\gZPlPSv.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\smKbnaj.exe
  C:\Windows\System\smKbnaj.exe
  2⤵
  PID:3084
- C:\Windows\System\NEMBsMA.exe
  C:\Windows\System\NEMBsMA.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\pThxEMg.exe
  C:\Windows\System\pThxEMg.exe
  2⤵
  PID:3128
- C:\Windows\System\nqjBxIs.exe
  C:\Windows\System\nqjBxIs.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\wGenVyS.exe
  C:\Windows\System\wGenVyS.exe
  2⤵
  PID:3160
- C:\Windows\System\GqyYBjK.exe
  C:\Windows\System\GqyYBjK.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\JKOZcoB.exe
  C:\Windows\System\JKOZcoB.exe
  2⤵
  PID:3192
- C:\Windows\System\EixdLlL.exe
  C:\Windows\System\EixdLlL.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\zbbMgWJ.exe
  C:\Windows\System\zbbMgWJ.exe
  2⤵
  PID:3232
- C:\Windows\System\wbQcjJb.exe
  C:\Windows\System\wbQcjJb.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\ODcfLZj.exe
  C:\Windows\System\ODcfLZj.exe
  2⤵
  PID:3272
- C:\Windows\System\kLiXhHK.exe
  C:\Windows\System\kLiXhHK.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\CUJFuSe.exe
  C:\Windows\System\CUJFuSe.exe
  2⤵
  PID:3304
- C:\Windows\System\oPiNIaO.exe
  C:\Windows\System\oPiNIaO.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\xRgkaUv.exe
  C:\Windows\System\xRgkaUv.exe
  2⤵
  PID:3344
- C:\Windows\System\jSPbAoy.exe
  C:\Windows\System\jSPbAoy.exe
  2⤵
  PID:3364
- C:\Windows\System\llBbSjc.exe
  C:\Windows\System\llBbSjc.exe
  2⤵
  PID:3380
- C:\Windows\System\lOcAqSe.exe
  C:\Windows\System\lOcAqSe.exe
  2⤵
  PID:3396
- C:\Windows\System\McQCIAW.exe
  C:\Windows\System\McQCIAW.exe
  2⤵
  PID:3412
- C:\Windows\System\KVVQtZm.exe
  C:\Windows\System\KVVQtZm.exe
  2⤵
  PID:3428
- C:\Windows\System\Zvcjkeh.exe
  C:\Windows\System\Zvcjkeh.exe
  2⤵
  PID:3444
- C:\Windows\System\NWlJmpe.exe
  C:\Windows\System\NWlJmpe.exe
  2⤵
  PID:3464
- C:\Windows\System\LzDcSui.exe
  C:\Windows\System\LzDcSui.exe
  2⤵
  PID:3484
- C:\Windows\System\PRjZvHv.exe
  C:\Windows\System\PRjZvHv.exe
  2⤵
  PID:3504
- C:\Windows\System\ILSDjJk.exe
  C:\Windows\System\ILSDjJk.exe
  2⤵
  PID:3520
- C:\Windows\System\tbepAia.exe
  C:\Windows\System\tbepAia.exe
  2⤵
  PID:3536
- C:\Windows\System\bJjYcEM.exe
  C:\Windows\System\bJjYcEM.exe
  2⤵
  PID:3552
- C:\Windows\System\CAdqIFs.exe
  C:\Windows\System\CAdqIFs.exe
  2⤵
  PID:3568
- C:\Windows\System\hwGDdyi.exe
  C:\Windows\System\hwGDdyi.exe
  2⤵
  PID:3584
- C:\Windows\System\RIgHNtX.exe
  C:\Windows\System\RIgHNtX.exe
  2⤵
  PID:3612
- C:\Windows\System\vWLMCcb.exe
  C:\Windows\System\vWLMCcb.exe
  2⤵
  PID:3632
- C:\Windows\System\xBktrVa.exe
  C:\Windows\System\xBktrVa.exe
  2⤵
  PID:3648
- C:\Windows\System\WqHWFYC.exe
  C:\Windows\System\WqHWFYC.exe
  2⤵
  PID:3664
- C:\Windows\System\VuABqPD.exe
  C:\Windows\System\VuABqPD.exe
  2⤵
  PID:3680
- C:\Windows\System\VJDVevn.exe
  C:\Windows\System\VJDVevn.exe
  2⤵
  PID:3696
- C:\Windows\System\OQnuaym.exe
  C:\Windows\System\OQnuaym.exe
  2⤵
  PID:3720
- C:\Windows\System\xuhGHoz.exe
  C:\Windows\System\xuhGHoz.exe
  2⤵
  PID:3736
- C:\Windows\System\mpUcVpI.exe
  C:\Windows\System\mpUcVpI.exe
  2⤵
  PID:3752
- C:\Windows\System\rCZJJXv.exe
  C:\Windows\System\rCZJJXv.exe
  2⤵
  PID:3768
- C:\Windows\System\DQDyfnr.exe
  C:\Windows\System\DQDyfnr.exe
  2⤵
  PID:3784
- C:\Windows\System\HcBldjx.exe
  C:\Windows\System\HcBldjx.exe
  2⤵
  PID:3804
- C:\Windows\System\PxWywzS.exe
  C:\Windows\System\PxWywzS.exe
  2⤵
  PID:3820
- C:\Windows\System\sLyJNIJ.exe
  C:\Windows\System\sLyJNIJ.exe
  2⤵
  PID:3836
- C:\Windows\System\stByCDx.exe
  C:\Windows\System\stByCDx.exe
  2⤵
  PID:3852
- C:\Windows\System\FaQrmhC.exe
  C:\Windows\System\FaQrmhC.exe
  2⤵
  PID:3872
- C:\Windows\System\CYDvKXV.exe
  C:\Windows\System\CYDvKXV.exe
  2⤵
  PID:3896
- C:\Windows\System\VLrlNat.exe
  C:\Windows\System\VLrlNat.exe
  2⤵
  PID:3912
- C:\Windows\System\YXomagd.exe
  C:\Windows\System\YXomagd.exe
  2⤵
  PID:3928
- C:\Windows\System\YrgnNuU.exe
  C:\Windows\System\YrgnNuU.exe
  2⤵
  PID:3944
- C:\Windows\System\ldnPwGC.exe
  C:\Windows\System\ldnPwGC.exe
  2⤵
  PID:3960
- C:\Windows\System\FUuRUwO.exe
  C:\Windows\System\FUuRUwO.exe
  2⤵
  PID:3976
- C:\Windows\System\HollNjh.exe
  C:\Windows\System\HollNjh.exe
  2⤵
  PID:3992
- C:\Windows\System\GobjCOT.exe
  C:\Windows\System\GobjCOT.exe
  2⤵
  PID:4008
- C:\Windows\System\qXqlZrB.exe
  C:\Windows\System\qXqlZrB.exe
  2⤵
  PID:4040
- C:\Windows\System\PDJVCRA.exe
  C:\Windows\System\PDJVCRA.exe
  2⤵
  PID:4060
- C:\Windows\System\bGJeADB.exe
  C:\Windows\System\bGJeADB.exe
  2⤵
  PID:4076
- C:\Windows\System\IUVGxUM.exe
  C:\Windows\System\IUVGxUM.exe
  2⤵
  PID:4092
- C:\Windows\System\FXOprCJ.exe
  C:\Windows\System\FXOprCJ.exe
  2⤵
  PID:2772
- C:\Windows\System\doHxbqa.exe
  C:\Windows\System\doHxbqa.exe
  2⤵
  PID:2412
- C:\Windows\System\uHJpxtf.exe
  C:\Windows\System\uHJpxtf.exe
  2⤵
  PID:2728
- C:\Windows\System\eqOCnMK.exe
  C:\Windows\System\eqOCnMK.exe
  2⤵
  PID:3080
- C:\Windows\System\isChylx.exe
  C:\Windows\System\isChylx.exe
  2⤵
  PID:3116
- C:\Windows\System\KIcNQsO.exe
  C:\Windows\System\KIcNQsO.exe
  2⤵
  PID:3156
- C:\Windows\System\iaReuoq.exe
  C:\Windows\System\iaReuoq.exe
  2⤵
  PID:3224
- C:\Windows\System\RFwqgnu.exe
  C:\Windows\System\RFwqgnu.exe
  2⤵
  PID:3300
- C:\Windows\System\NjCUMMl.exe
  C:\Windows\System\NjCUMMl.exe
  2⤵
  PID:3340
- C:\Windows\System\ddBvJDn.exe
  C:\Windows\System\ddBvJDn.exe
  2⤵
  PID:3404
- C:\Windows\System\YjaSIDS.exe
  C:\Windows\System\YjaSIDS.exe
  2⤵
  PID:3480
- C:\Windows\System\pCHSUfq.exe
  C:\Windows\System\pCHSUfq.exe
  2⤵
  PID:3548
- C:\Windows\System\KQLqotS.exe
  C:\Windows\System\KQLqotS.exe
  2⤵
  PID:3624
- C:\Windows\System\LrTtULT.exe
  C:\Windows\System\LrTtULT.exe
  2⤵
  PID:3660
- C:\Windows\System\fDTloXv.exe
  C:\Windows\System\fDTloXv.exe
  2⤵
  PID:3728
- C:\Windows\System\yTdWSLD.exe
  C:\Windows\System\yTdWSLD.exe
  2⤵
  PID:2760
- C:\Windows\System\CXGXumG.exe
  C:\Windows\System\CXGXumG.exe
  2⤵
  PID:3832
- C:\Windows\System\fjEKdpY.exe
  C:\Windows\System\fjEKdpY.exe
  2⤵
  PID:3868
- C:\Windows\System\fIqQKpn.exe
  C:\Windows\System\fIqQKpn.exe
  2⤵
  PID:3940
- C:\Windows\System\iCXxdUp.exe
  C:\Windows\System\iCXxdUp.exe
  2⤵
  PID:2656
- C:\Windows\System\vxWxIkf.exe
  C:\Windows\System\vxWxIkf.exe
  2⤵
  PID:4052
- C:\Windows\System\ElTvvBZ.exe
  C:\Windows\System\ElTvvBZ.exe
  2⤵
  PID:2440
- C:\Windows\System\pcIjYdt.exe
  C:\Windows\System\pcIjYdt.exe
  2⤵
  PID:1648
- C:\Windows\System\WmFqbYb.exe
  C:\Windows\System\WmFqbYb.exe
  2⤵
  PID:3124
- C:\Windows\System\KebKACE.exe
  C:\Windows\System\KebKACE.exe
  2⤵
  PID:3220
- C:\Windows\System\KpVHvEN.exe
  C:\Windows\System\KpVHvEN.exe
  2⤵
  PID:3372
- C:\Windows\System\FvNITPe.exe
  C:\Windows\System\FvNITPe.exe
  2⤵
  PID:4112
- C:\Windows\System\YKuiCTe.exe
  C:\Windows\System\YKuiCTe.exe
  2⤵
  PID:4128
- C:\Windows\System\DpbCYis.exe
  C:\Windows\System\DpbCYis.exe
  2⤵
  PID:4144
- C:\Windows\System\kvOSeeu.exe
  C:\Windows\System\kvOSeeu.exe
  2⤵
  PID:4160
- C:\Windows\System\ZSvPXXm.exe
  C:\Windows\System\ZSvPXXm.exe
  2⤵
  PID:4184
- C:\Windows\System\RkxXcBl.exe
  C:\Windows\System\RkxXcBl.exe
  2⤵
  PID:4200
- C:\Windows\System\FipwlwP.exe
  C:\Windows\System\FipwlwP.exe
  2⤵
  PID:4216
- C:\Windows\System\OeheZUf.exe
  C:\Windows\System\OeheZUf.exe
  2⤵
  PID:4232
- C:\Windows\System\SppyLGS.exe
  C:\Windows\System\SppyLGS.exe
  2⤵
  PID:4248
- C:\Windows\System\CcsvFEG.exe
  C:\Windows\System\CcsvFEG.exe
  2⤵
  PID:4264
- C:\Windows\System\skLHpnv.exe
  C:\Windows\System\skLHpnv.exe
  2⤵
  PID:4280
- C:\Windows\System\hDdlYMt.exe
  C:\Windows\System\hDdlYMt.exe
  2⤵
  PID:4296
- C:\Windows\System\hlXemrb.exe
  C:\Windows\System\hlXemrb.exe
  2⤵
  PID:4364
- C:\Windows\System\tSYXgTO.exe
  C:\Windows\System\tSYXgTO.exe
  2⤵
  PID:4380
- C:\Windows\System\klAwPlb.exe
  C:\Windows\System\klAwPlb.exe
  2⤵
  PID:4396
- C:\Windows\System\WkzmCQq.exe
  C:\Windows\System\WkzmCQq.exe
  2⤵
  PID:4540
- C:\Windows\System\mhzzVVF.exe
  C:\Windows\System\mhzzVVF.exe
  2⤵
  PID:4556
- C:\Windows\System\wNzglgz.exe
  C:\Windows\System\wNzglgz.exe
  2⤵
  PID:4572
- C:\Windows\System\UeOiRrm.exe
  C:\Windows\System\UeOiRrm.exe
  2⤵
  PID:4588
- C:\Windows\System\poBWevE.exe
  C:\Windows\System\poBWevE.exe
  2⤵
  PID:4612
- C:\Windows\System\HPSnRWX.exe
  C:\Windows\System\HPSnRWX.exe
  2⤵
  PID:4628
- C:\Windows\System\EfgCjgV.exe
  C:\Windows\System\EfgCjgV.exe
  2⤵
  PID:4644
- C:\Windows\System\WQBjZMn.exe
  C:\Windows\System\WQBjZMn.exe
  2⤵
  PID:4660
- C:\Windows\System\gzzoPpU.exe
  C:\Windows\System\gzzoPpU.exe
  2⤵
  PID:4676
- C:\Windows\System\YAgilLW.exe
  C:\Windows\System\YAgilLW.exe
  2⤵
  PID:4692
- C:\Windows\System\dZkVytg.exe
  C:\Windows\System\dZkVytg.exe
  2⤵
  PID:4708
- C:\Windows\System\iUjRobA.exe
  C:\Windows\System\iUjRobA.exe
  2⤵
  PID:4728
- C:\Windows\System\VzqrQrE.exe
  C:\Windows\System\VzqrQrE.exe
  2⤵
  PID:4744
- C:\Windows\System\QUaZFgp.exe
  C:\Windows\System\QUaZFgp.exe
  2⤵
  PID:4760
- C:\Windows\System\OVEwsJD.exe
  C:\Windows\System\OVEwsJD.exe
  2⤵
  PID:4776
- C:\Windows\System\pyTOiLY.exe
  C:\Windows\System\pyTOiLY.exe
  2⤵
  PID:4792
- C:\Windows\System\cjqghvy.exe
  C:\Windows\System\cjqghvy.exe
  2⤵
  PID:4808
- C:\Windows\System\hqihbev.exe
  C:\Windows\System\hqihbev.exe
  2⤵
  PID:4824
- C:\Windows\System\zpmebfm.exe
  C:\Windows\System\zpmebfm.exe
  2⤵
  PID:4844
- C:\Windows\System\fxGrDJi.exe
  C:\Windows\System\fxGrDJi.exe
  2⤵
  PID:4860
- C:\Windows\System\koOcKHX.exe
  C:\Windows\System\koOcKHX.exe
  2⤵
  PID:4876
- C:\Windows\System\dUyNlAI.exe
  C:\Windows\System\dUyNlAI.exe
  2⤵
  PID:4892
- C:\Windows\System\MQOmqtT.exe
  C:\Windows\System\MQOmqtT.exe
  2⤵
  PID:4908
- C:\Windows\System\fYOMWAP.exe
  C:\Windows\System\fYOMWAP.exe
  2⤵
  PID:4924
- C:\Windows\System\TFOuACc.exe
  C:\Windows\System\TFOuACc.exe
  2⤵
  PID:4940
- C:\Windows\System\nOdflsR.exe
  C:\Windows\System\nOdflsR.exe
  2⤵
  PID:4960
- C:\Windows\System\vmCHkXF.exe
  C:\Windows\System\vmCHkXF.exe
  2⤵
  PID:4976
- C:\Windows\System\mOMuMOO.exe
  C:\Windows\System\mOMuMOO.exe
  2⤵
  PID:4992
- C:\Windows\System\KAiRcoc.exe
  C:\Windows\System\KAiRcoc.exe
  2⤵
  PID:1728
- C:\Windows\System\gFYVDGo.exe
  C:\Windows\System\gFYVDGo.exe
  2⤵
  PID:4376
- C:\Windows\System\lykRQBr.exe
  C:\Windows\System\lykRQBr.exe
  2⤵
  PID:900
- C:\Windows\System\vfVwCcd.exe
  C:\Windows\System\vfVwCcd.exe
  2⤵
  PID:4456
- C:\Windows\System\kCImfOG.exe
  C:\Windows\System\kCImfOG.exe
  2⤵
  PID:4476
- C:\Windows\System\joHUfTc.exe
  C:\Windows\System\joHUfTc.exe
  2⤵
  PID:4492
- C:\Windows\System\arVEinE.exe
  C:\Windows\System\arVEinE.exe
  2⤵
  PID:3456
- C:\Windows\System\TBCpvgn.exe
  C:\Windows\System\TBCpvgn.exe
  2⤵
  PID:3528
- C:\Windows\System\YCIAupj.exe
  C:\Windows\System\YCIAupj.exe
  2⤵
  PID:4524
- C:\Windows\System\amVomkW.exe
  C:\Windows\System\amVomkW.exe
  2⤵
  PID:2600
- C:\Windows\System\SGWfDGy.exe
  C:\Windows\System\SGWfDGy.exe
  2⤵
  PID:1940
- C:\Windows\System\XhEbWSI.exe
  C:\Windows\System\XhEbWSI.exe
  2⤵
  PID:2028
- C:\Windows\System\WHLEvau.exe
  C:\Windows\System\WHLEvau.exe
  2⤵
  PID:828
- C:\Windows\System\vsQCfQA.exe
  C:\Windows\System\vsQCfQA.exe
  2⤵
  PID:3924
- C:\Windows\System\CWqQGCm.exe
  C:\Windows\System\CWqQGCm.exe
  2⤵
  PID:4016
- C:\Windows\System\MzRofyu.exe
  C:\Windows\System\MzRofyu.exe
  2⤵
  PID:4068
- C:\Windows\System\dHjIpOR.exe
  C:\Windows\System\dHjIpOR.exe
  2⤵
  PID:3188
- C:\Windows\System\bTKpBeD.exe
  C:\Windows\System\bTKpBeD.exe
  2⤵
  PID:3436
- C:\Windows\System\lJgpTKO.exe
  C:\Windows\System\lJgpTKO.exe
  2⤵
  PID:3580
- C:\Windows\System\JsKKHNl.exe
  C:\Windows\System\JsKKHNl.exe
  2⤵
  PID:3796
- C:\Windows\System\xaRbGqy.exe
  C:\Windows\System\xaRbGqy.exe
  2⤵
  PID:4564
- C:\Windows\System\GgskUfC.exe
  C:\Windows\System\GgskUfC.exe
  2⤵
  PID:4604
- C:\Windows\System\rdBktvm.exe
  C:\Windows\System\rdBktvm.exe
  2⤵
  PID:4668
- C:\Windows\System\TbgcSZb.exe
  C:\Windows\System\TbgcSZb.exe
  2⤵
  PID:4740
- C:\Windows\System\ElGqTCw.exe
  C:\Windows\System\ElGqTCw.exe
  2⤵
  PID:4804
- C:\Windows\System\rYLDZSP.exe
  C:\Windows\System\rYLDZSP.exe
  2⤵
  PID:4868
- C:\Windows\System\YwAXpPm.exe
  C:\Windows\System\YwAXpPm.exe
  2⤵
  PID:5016
- C:\Windows\System\IZRRfFS.exe
  C:\Windows\System\IZRRfFS.exe
  2⤵
  PID:5036
- C:\Windows\System\QmuHKcj.exe
  C:\Windows\System\QmuHKcj.exe
  2⤵
  PID:5052
- C:\Windows\System\sRQSdXR.exe
  C:\Windows\System\sRQSdXR.exe
  2⤵
  PID:5068
- C:\Windows\System\TdTmTFb.exe
  C:\Windows\System\TdTmTFb.exe
  2⤵
  PID:5084
- C:\Windows\System\AnlHgmR.exe
  C:\Windows\System\AnlHgmR.exe
  2⤵
  PID:5100
- C:\Windows\System\HOTJmMh.exe
  C:\Windows\System\HOTJmMh.exe
  2⤵
  PID:5116
- C:\Windows\System\NmSsJIa.exe
  C:\Windows\System\NmSsJIa.exe
  2⤵
  PID:2008
- C:\Windows\System\NFkoycn.exe
  C:\Windows\System\NFkoycn.exe
  2⤵
  PID:2628
- C:\Windows\System\zKJWteC.exe
  C:\Windows\System\zKJWteC.exe
  2⤵
  PID:1200
- C:\Windows\System\VCNHtCe.exe
  C:\Windows\System\VCNHtCe.exe
  2⤵
  PID:1492
- C:\Windows\System\nlOYEyu.exe
  C:\Windows\System\nlOYEyu.exe
  2⤵
  PID:3512
- C:\Windows\System\OZhplnL.exe
  C:\Windows\System\OZhplnL.exe
  2⤵
  PID:2784
- C:\Windows\System\EjTxLLh.exe
  C:\Windows\System\EjTxLLh.exe
  2⤵
  PID:2704
- C:\Windows\System\ObxicbP.exe
  C:\Windows\System\ObxicbP.exe
  2⤵
  PID:3972
- C:\Windows\System\iKyPQNB.exe
  C:\Windows\System\iKyPQNB.exe
  2⤵
  PID:2768
- C:\Windows\System\nauTAvL.exe
  C:\Windows\System\nauTAvL.exe
  2⤵
  PID:4124
- C:\Windows\System\lTszkUq.exe
  C:\Windows\System\lTszkUq.exe
  2⤵
  PID:2452
- C:\Windows\System\ZiwyJmg.exe
  C:\Windows\System\ZiwyJmg.exe
  2⤵
  PID:3952
- C:\Windows\System\pJxqHxs.exe
  C:\Windows\System\pJxqHxs.exe
  2⤵
  PID:2264
- C:\Windows\System\FNhxwQd.exe
  C:\Windows\System\FNhxwQd.exe
  2⤵
  PID:1776
- C:\Windows\System\cqZvdBi.exe
  C:\Windows\System\cqZvdBi.exe
  2⤵
  PID:3064
- C:\Windows\System\VniDqzN.exe
  C:\Windows\System\VniDqzN.exe
  2⤵
  PID:2108
- C:\Windows\System\kNtGJwA.exe
  C:\Windows\System\kNtGJwA.exe
  2⤵
  PID:1312
- C:\Windows\System\yuOBCCL.exe
  C:\Windows\System\yuOBCCL.exe
  2⤵
  PID:692
- C:\Windows\System\MsJfGAP.exe
  C:\Windows\System\MsJfGAP.exe
  2⤵
  PID:2136
- C:\Windows\System\hiVWmcH.exe
  C:\Windows\System\hiVWmcH.exe
  2⤵
  PID:3096
- C:\Windows\System\dHDNcSm.exe
  C:\Windows\System\dHDNcSm.exe
  2⤵
  PID:3240
- C:\Windows\System\MHpLpPb.exe
  C:\Windows\System\MHpLpPb.exe
  2⤵
  PID:3280
- C:\Windows\System\xKAclgH.exe
  C:\Windows\System\xKAclgH.exe
  2⤵
  PID:3352
- C:\Windows\System\AnQBYol.exe
  C:\Windows\System\AnQBYol.exe
  2⤵
  PID:3392
- C:\Windows\System\PnFGIZZ.exe
  C:\Windows\System\PnFGIZZ.exe
  2⤵
  PID:3500
- C:\Windows\System\FfSLaXG.exe
  C:\Windows\System\FfSLaXG.exe
  2⤵
  PID:3596
- C:\Windows\System\XySkgoI.exe
  C:\Windows\System\XySkgoI.exe
  2⤵
  PID:3640
- C:\Windows\System\vtcAlHq.exe
  C:\Windows\System\vtcAlHq.exe
  2⤵
  PID:3704
- C:\Windows\System\VDLJWYQ.exe
  C:\Windows\System\VDLJWYQ.exe
  2⤵
  PID:1516
- C:\Windows\System\LXcfrWK.exe
  C:\Windows\System\LXcfrWK.exe
  2⤵
  PID:3028
- C:\Windows\System\bupUlDE.exe
  C:\Windows\System\bupUlDE.exe
  2⤵
  PID:880
- C:\Windows\System\NdBICTJ.exe
  C:\Windows\System\NdBICTJ.exe
  2⤵
  PID:1656
- C:\Windows\System\ewgKNCV.exe
  C:\Windows\System\ewgKNCV.exe
  2⤵
  PID:4948
- C:\Windows\System\BPDgRcX.exe
  C:\Windows\System\BPDgRcX.exe
  2⤵
  PID:4108
- C:\Windows\System\iYoyZrA.exe
  C:\Windows\System\iYoyZrA.exe
  2⤵
  PID:4176
- C:\Windows\System\XWSRkzG.exe
  C:\Windows\System\XWSRkzG.exe
  2⤵
  PID:4244
- C:\Windows\System\nDrRNNO.exe
  C:\Windows\System\nDrRNNO.exe
  2⤵
  PID:4308
- C:\Windows\System\SdIfFOB.exe
  C:\Windows\System\SdIfFOB.exe
  2⤵
  PID:4324
- C:\Windows\System\qtgniFI.exe
  C:\Windows\System\qtgniFI.exe
  2⤵
  PID:4340
- C:\Windows\System\OamBxxl.exe
  C:\Windows\System\OamBxxl.exe
  2⤵
  PID:4360
- C:\Windows\System\dmLlOVE.exe
  C:\Windows\System\dmLlOVE.exe
  2⤵
  PID:4580
- C:\Windows\System\ggZYJxu.exe
  C:\Windows\System\ggZYJxu.exe
  2⤵
  PID:4624
- C:\Windows\System\QzPOfxV.exe
  C:\Windows\System\QzPOfxV.exe
  2⤵
  PID:4716
- C:\Windows\System\qlFrhZo.exe
  C:\Windows\System\qlFrhZo.exe
  2⤵
  PID:4756
- C:\Windows\System\NrNVrdW.exe
  C:\Windows\System\NrNVrdW.exe
  2⤵
  PID:4140
- C:\Windows\System\qeSBgea.exe
  C:\Windows\System\qeSBgea.exe
  2⤵
  PID:3024
- C:\Windows\System\frPweyV.exe
  C:\Windows\System\frPweyV.exe
  2⤵
  PID:4428
- C:\Windows\System\bbrXdJU.exe
  C:\Windows\System\bbrXdJU.exe
  2⤵
  PID:2324
- C:\Windows\System\sbhBAtP.exe
  C:\Windows\System\sbhBAtP.exe
  2⤵
  PID:4472
- C:\Windows\System\JQNMzxi.exe
  C:\Windows\System\JQNMzxi.exe
  2⤵
  PID:4520
- C:\Windows\System\xKFAsEU.exe
  C:\Windows\System\xKFAsEU.exe
  2⤵
  PID:1720
- C:\Windows\System\GODElRP.exe
  C:\Windows\System\GODElRP.exe
  2⤵
  PID:1304
- C:\Windows\System\dBWlyrj.exe
  C:\Windows\System\dBWlyrj.exe
  2⤵
  PID:3744
- C:\Windows\System\tCBcDjI.exe
  C:\Windows\System\tCBcDjI.exe
  2⤵
  PID:3844
- C:\Windows\System\kcohAwK.exe
  C:\Windows\System\kcohAwK.exe
  2⤵
  PID:1500
- C:\Windows\System\AQaEaYy.exe
  C:\Windows\System\AQaEaYy.exe
  2⤵
  PID:3892
- C:\Windows\System\VQgGtko.exe
  C:\Windows\System\VQgGtko.exe
  2⤵
  PID:1092
- C:\Windows\System\sTpgRZo.exe
  C:\Windows\System\sTpgRZo.exe
  2⤵
  PID:3920
- C:\Windows\System\CCddEJJ.exe
  C:\Windows\System\CCddEJJ.exe
  2⤵
  PID:600
- C:\Windows\System\eytFLCA.exe
  C:\Windows\System\eytFLCA.exe
  2⤵
  PID:4972
- C:\Windows\System\XsCSvpo.exe
  C:\Windows\System\XsCSvpo.exe
  2⤵
  PID:2512
- C:\Windows\System\kvLOPeg.exe
  C:\Windows\System\kvLOPeg.exe
  2⤵
  PID:4028
- C:\Windows\System\uFlHnSz.exe
  C:\Windows\System\uFlHnSz.exe
  2⤵
  PID:4596
- C:\Windows\System\MpPCzGf.exe
  C:\Windows\System\MpPCzGf.exe
  2⤵
  PID:4736
- C:\Windows\System\YcCkXwI.exe
  C:\Windows\System\YcCkXwI.exe
  2⤵
  PID:5080
- C:\Windows\System\awmFEBY.exe
  C:\Windows\System\awmFEBY.exe
  2⤵
  PID:2396
- C:\Windows\System\lLnZGqo.exe
  C:\Windows\System\lLnZGqo.exe
  2⤵
  PID:3848
- C:\Windows\System\ewiQwJq.exe
  C:\Windows\System\ewiQwJq.exe
  2⤵
  PID:3092
- C:\Windows\System\mcvWmsS.exe
  C:\Windows\System\mcvWmsS.exe
  2⤵
  PID:3360
- C:\Windows\System\ZRoTPSp.exe
  C:\Windows\System\ZRoTPSp.exe
  2⤵
  PID:2280
- C:\Windows\System\FbizKsU.exe
  C:\Windows\System\FbizKsU.exe
  2⤵
  PID:4208
- C:\Windows\System\rjdUpJR.exe
  C:\Windows\System\rjdUpJR.exe
  2⤵
  PID:4584
- C:\Windows\System\xrzZRLC.exe
  C:\Windows\System\xrzZRLC.exe
  2⤵
  PID:3252
- C:\Windows\System\kbLhpjx.exe
  C:\Windows\System\kbLhpjx.exe
  2⤵
  PID:628
- C:\Windows\System\DgzlMrM.exe
  C:\Windows\System\DgzlMrM.exe
  2⤵
  PID:3424
- C:\Windows\System\cUPJTdJ.exe
  C:\Windows\System\cUPJTdJ.exe
  2⤵
  PID:1580
- C:\Windows\System\TadGRUa.exe
  C:\Windows\System\TadGRUa.exe
  2⤵
  PID:4168
- C:\Windows\System\QCjrHqo.exe
  C:\Windows\System\QCjrHqo.exe
  2⤵
  PID:4332
- C:\Windows\System\wASFWLK.exe
  C:\Windows\System\wASFWLK.exe
  2⤵
  PID:4684
- C:\Windows\System\ghKNsex.exe
  C:\Windows\System\ghKNsex.exe
  2⤵
  PID:4856
- C:\Windows\System\vLEdPfd.exe
  C:\Windows\System\vLEdPfd.exe
  2⤵
  PID:1968
- C:\Windows\System\ryWmUEr.exe
  C:\Windows\System\ryWmUEr.exe
  2⤵
  PID:2208
- C:\Windows\System\brfyUwS.exe
  C:\Windows\System\brfyUwS.exe
  2⤵
  PID:2540
- C:\Windows\System\vzPNvVp.exe
  C:\Windows\System\vzPNvVp.exe
  2⤵
  PID:4088
- C:\Windows\System\fSZCVTV.exe
  C:\Windows\System\fSZCVTV.exe
  2⤵
  PID:4988
- C:\Windows\System\IapOhzD.exe
  C:\Windows\System\IapOhzD.exe
  2⤵
  PID:4048
- C:\Windows\System\RXVOfpQ.exe
  C:\Windows\System\RXVOfpQ.exe
  2⤵
  PID:4260
- C:\Windows\System\EmPdwoW.exe
  C:\Windows\System\EmPdwoW.exe
  2⤵
  PID:4292
- C:\Windows\System\ZbYWwwA.exe
  C:\Windows\System\ZbYWwwA.exe
  2⤵
  PID:2944
- C:\Windows\System\AKgviOe.exe
  C:\Windows\System\AKgviOe.exe
  2⤵
  PID:4004
- C:\Windows\System\kRebHUI.exe
  C:\Windows\System\kRebHUI.exe
  2⤵
  PID:1584
- C:\Windows\System\BcpeFRh.exe
  C:\Windows\System\BcpeFRh.exe
  2⤵
  PID:2460
- C:\Windows\System\lQMjFFY.exe
  C:\Windows\System\lQMjFFY.exe
  2⤵
  PID:2584
- C:\Windows\System\ACKQLMK.exe
  C:\Windows\System\ACKQLMK.exe
  2⤵
  PID:5032
- C:\Windows\System\qGkmJOy.exe
  C:\Windows\System\qGkmJOy.exe
  2⤵
  PID:4464
- C:\Windows\System\kLUsFpB.exe
  C:\Windows\System\kLUsFpB.exe
  2⤵
  PID:4500
- C:\Windows\System\zFEWGyI.exe
  C:\Windows\System\zFEWGyI.exe
  2⤵
  PID:2924
- C:\Windows\System\wrsjskF.exe
  C:\Windows\System\wrsjskF.exe
  2⤵
  PID:1644
- C:\Windows\System\AqYjeAJ.exe
  C:\Windows\System\AqYjeAJ.exe
  2⤵
  PID:760
- C:\Windows\System\hZGsIMD.exe
  C:\Windows\System\hZGsIMD.exe
  2⤵
  PID:3816
- C:\Windows\System\xexGrzu.exe
  C:\Windows\System\xexGrzu.exe
  2⤵
  PID:2832
- C:\Windows\System\qFbZxIM.exe
  C:\Windows\System\qFbZxIM.exe
  2⤵
  PID:2560
- C:\Windows\System\OAMKwqS.exe
  C:\Windows\System\OAMKwqS.exe
  2⤵
  PID:1772
- C:\Windows\System\SHJjDOf.exe
  C:\Windows\System\SHJjDOf.exe
  2⤵
  PID:4772
- C:\Windows\System\YrasYIY.exe
  C:\Windows\System\YrasYIY.exe
  2⤵
  PID:3440
- C:\Windows\System\fJvSehi.exe
  C:\Windows\System\fJvSehi.exe
  2⤵
  PID:4800
- C:\Windows\System\UTTPDsQ.exe
  C:\Windows\System\UTTPDsQ.exe
  2⤵
  PID:3472
- C:\Windows\System\QfhRGIv.exe
  C:\Windows\System\QfhRGIv.exe
  2⤵
  PID:3328
- C:\Windows\System\cGYTvik.exe
  C:\Windows\System\cGYTvik.exe
  2⤵
  PID:4704
- C:\Windows\System\hcKRwyI.exe
  C:\Windows\System\hcKRwyI.exe
  2⤵
  PID:5048
- C:\Windows\System\LynYcrU.exe
  C:\Windows\System\LynYcrU.exe
  2⤵
  PID:1904
- C:\Windows\System\wrcpfMF.exe
  C:\Windows\System\wrcpfMF.exe
  2⤵
  PID:3968
- C:\Windows\System\lENmhMu.exe
  C:\Windows\System\lENmhMu.exe
  2⤵
  PID:2720
- C:\Windows\System\bWtPrRT.exe
  C:\Windows\System\bWtPrRT.exe
  2⤵
  PID:4316
- C:\Windows\System\IlBsyJF.exe
  C:\Windows\System\IlBsyJF.exe
  2⤵
  PID:3388
- C:\Windows\System\lRklodp.exe
  C:\Windows\System\lRklodp.exe
  2⤵
  PID:3812
- C:\Windows\System\pciRvZg.exe
  C:\Windows\System\pciRvZg.exe
  2⤵
  PID:4724
- C:\Windows\System\fHazmWp.exe
  C:\Windows\System\fHazmWp.exe
  2⤵
  PID:2648
- C:\Windows\System\HwCrVli.exe
  C:\Windows\System\HwCrVli.exe
  2⤵
  PID:908
- C:\Windows\System\cBjEHSe.exe
  C:\Windows\System\cBjEHSe.exe
  2⤵
  PID:572
- C:\Windows\System\LIFWiBq.exe
  C:\Windows\System\LIFWiBq.exe
  2⤵
  PID:3316
- C:\Windows\System\KogcJlq.exe
  C:\Windows\System\KogcJlq.exe
  2⤵
  PID:3172
- C:\Windows\System\EkOOxgt.exe
  C:\Windows\System\EkOOxgt.exe
  2⤵
  PID:1624
- C:\Windows\System\jIrfnRJ.exe
  C:\Windows\System\jIrfnRJ.exe
  2⤵
  PID:4276
- C:\Windows\System\gqiChdI.exe
  C:\Windows\System\gqiChdI.exe
  2⤵
  PID:4548
- C:\Windows\System\UGXhMpP.exe
  C:\Windows\System\UGXhMpP.exe
  2⤵
  PID:4916
- C:\Windows\System\GmIndfi.exe
  C:\Windows\System\GmIndfi.exe
  2⤵
  PID:5060
- C:\Windows\System\VSuqZnw.exe
  C:\Windows\System\VSuqZnw.exe
  2⤵
  PID:4952
- C:\Windows\System\LjjnGos.exe
  C:\Windows\System\LjjnGos.exe
  2⤵
  PID:5092
- C:\Windows\System\aZjSOMC.exe
  C:\Windows\System\aZjSOMC.exe
  2⤵
  PID:3656
- C:\Windows\System\raZzruV.exe
  C:\Windows\System\raZzruV.exe
  2⤵
  PID:4652
- C:\Windows\System\QZBtWND.exe
  C:\Windows\System\QZBtWND.exe
  2⤵
  PID:4256
- C:\Windows\System\DGyXADQ.exe
  C:\Windows\System\DGyXADQ.exe
  2⤵
  PID:2804
- C:\Windows\System\WLckerO.exe
  C:\Windows\System\WLckerO.exe
  2⤵
  PID:2244
- C:\Windows\System\heMqsKQ.exe
  C:\Windows\System\heMqsKQ.exe
  2⤵
  PID:4420
- C:\Windows\System\okvYnbG.exe
  C:\Windows\System\okvYnbG.exe
  2⤵
  PID:2712
- C:\Windows\System\DoRBDUN.exe
  C:\Windows\System\DoRBDUN.exe
  2⤵
  PID:2296
- C:\Windows\System\aUuiiUz.exe
  C:\Windows\System\aUuiiUz.exe
  2⤵
  PID:1936
- C:\Windows\System\xXPxrRh.exe
  C:\Windows\System\xXPxrRh.exe
  2⤵
  PID:3108
- C:\Windows\System\RiUsAiG.exe
  C:\Windows\System\RiUsAiG.exe
  2⤵
  PID:1768
- C:\Windows\System\nKEvXzJ.exe
  C:\Windows\System\nKEvXzJ.exe
  2⤵
  PID:3264
- C:\Windows\System\UYWngzu.exe
  C:\Windows\System\UYWngzu.exe
  2⤵
  PID:3140
- C:\Windows\System\BRNvufy.exe
  C:\Windows\System\BRNvufy.exe
  2⤵
  PID:3032
- C:\Windows\System\jMXeBoA.exe
  C:\Windows\System\jMXeBoA.exe
  2⤵
  PID:2344
- C:\Windows\System\qHEuCqB.exe
  C:\Windows\System\qHEuCqB.exe
  2⤵
  PID:2868
- C:\Windows\System\OCaENCE.exe
  C:\Windows\System\OCaENCE.exe
  2⤵
  PID:4120
- C:\Windows\System\WHBfPLf.exe
  C:\Windows\System\WHBfPLf.exe
  2⤵
  PID:4412
- C:\Windows\System\mrzYvgr.exe
  C:\Windows\System\mrzYvgr.exe
  2⤵
  PID:4672
- C:\Windows\System\OWLSmZN.exe
  C:\Windows\System\OWLSmZN.exe
  2⤵
  PID:1284
- C:\Windows\System\ESePnJd.exe
  C:\Windows\System\ESePnJd.exe
  2⤵
  PID:3608
- C:\Windows\System\HWlIkWT.exe
  C:\Windows\System\HWlIkWT.exe
  2⤵
  PID:2132
- C:\Windows\System\UnKyujt.exe
  C:\Windows\System\UnKyujt.exe
  2⤵
  PID:4820
- C:\Windows\System\SUzrWbu.exe
  C:\Windows\System\SUzrWbu.exe
  2⤵
  PID:1832
- C:\Windows\System\dLBkyiH.exe
  C:\Windows\System\dLBkyiH.exe
  2⤵
  PID:1144
- C:\Windows\System\wKoHnLS.exe
  C:\Windows\System\wKoHnLS.exe
  2⤵
  PID:4532
- C:\Windows\System\MSonJho.exe
  C:\Windows\System\MSonJho.exe
  2⤵
  PID:2420
- C:\Windows\System\LTviZnU.exe
  C:\Windows\System\LTviZnU.exe
  2⤵
  PID:2844
- C:\Windows\System\kisMNVU.exe
  C:\Windows\System\kisMNVU.exe
  2⤵
  PID:4416
- C:\Windows\System\DJrASWu.exe
  C:\Windows\System\DJrASWu.exe
  2⤵
  PID:4448
- C:\Windows\System\XOFjWeY.exe
  C:\Windows\System\XOFjWeY.exe
  2⤵
  PID:4036
- C:\Windows\System\ETRrgJS.exe
  C:\Windows\System\ETRrgJS.exe
  2⤵
  PID:1308
- C:\Windows\System\wuUXIVb.exe
  C:\Windows\System\wuUXIVb.exe
  2⤵
  PID:3864
- C:\Windows\System\qadlRRI.exe
  C:\Windows\System\qadlRRI.exe
  2⤵
  PID:348
- C:\Windows\System\EnhrVnI.exe
  C:\Windows\System\EnhrVnI.exe
  2⤵
  PID:2596
- C:\Windows\System\ZgWwJru.exe
  C:\Windows\System\ZgWwJru.exe
  2⤵
  PID:5132
- C:\Windows\System\OZDNnFS.exe
  C:\Windows\System\OZDNnFS.exe
  2⤵
  PID:5152
- C:\Windows\System\kLIReRU.exe
  C:\Windows\System\kLIReRU.exe
  2⤵
  PID:5168
- C:\Windows\System\vNdwFpL.exe
  C:\Windows\System\vNdwFpL.exe
  2⤵
  PID:5184
- C:\Windows\System\yRGpfrL.exe
  C:\Windows\System\yRGpfrL.exe
  2⤵
  PID:5200
- C:\Windows\System\AhkXfnn.exe
  C:\Windows\System\AhkXfnn.exe
  2⤵
  PID:5216
- C:\Windows\System\oLQvARO.exe
  C:\Windows\System\oLQvARO.exe
  2⤵
  PID:5236
- C:\Windows\System\jUAoHZq.exe
  C:\Windows\System\jUAoHZq.exe
  2⤵
  PID:5252
- C:\Windows\System\NzCRiEI.exe
  C:\Windows\System\NzCRiEI.exe
  2⤵
  PID:5276
- C:\Windows\System\wDmmlRV.exe
  C:\Windows\System\wDmmlRV.exe
  2⤵
  PID:5300
- C:\Windows\System\dVekjtV.exe
  C:\Windows\System\dVekjtV.exe
  2⤵
  PID:5316
- C:\Windows\System\lQxYyWx.exe
  C:\Windows\System\lQxYyWx.exe
  2⤵
  PID:5332
- C:\Windows\System\OKxvvJH.exe
  C:\Windows\System\OKxvvJH.exe
  2⤵
  PID:5348
- C:\Windows\System\zHEXfrA.exe
  C:\Windows\System\zHEXfrA.exe
  2⤵
  PID:5364
- C:\Windows\System\qOWWmSu.exe
  C:\Windows\System\qOWWmSu.exe
  2⤵
  PID:5380
- C:\Windows\System\CvLeSmX.exe
  C:\Windows\System\CvLeSmX.exe
  2⤵
  PID:5400
- C:\Windows\System\jXoqvQG.exe
  C:\Windows\System\jXoqvQG.exe
  2⤵
  PID:5416
- C:\Windows\System\pePPqYp.exe
  C:\Windows\System\pePPqYp.exe
  2⤵
  PID:5476
- C:\Windows\System\zXrpObf.exe
  C:\Windows\System\zXrpObf.exe
  2⤵
  PID:5492
- C:\Windows\System\salndbF.exe
  C:\Windows\System\salndbF.exe
  2⤵
  PID:5516
- C:\Windows\System\AFLFVyg.exe
  C:\Windows\System\AFLFVyg.exe
  2⤵
  PID:5532
- C:\Windows\System\tSXpJSR.exe
  C:\Windows\System\tSXpJSR.exe
  2⤵
  PID:5552
- C:\Windows\System\mzEmdzJ.exe
  C:\Windows\System\mzEmdzJ.exe
  2⤵
  PID:5568
- C:\Windows\System\FmwYfJe.exe
  C:\Windows\System\FmwYfJe.exe
  2⤵
  PID:5588
- C:\Windows\System\GjoWGCY.exe
  C:\Windows\System\GjoWGCY.exe
  2⤵
  PID:5604
- C:\Windows\System\IicmXAB.exe
  C:\Windows\System\IicmXAB.exe
  2⤵
  PID:5620
- C:\Windows\System\cGVHrKF.exe
  C:\Windows\System\cGVHrKF.exe
  2⤵
  PID:5636
- C:\Windows\System\SPTcIEU.exe
  C:\Windows\System\SPTcIEU.exe
  2⤵
  PID:5656
- C:\Windows\System\ujAvPGs.exe
  C:\Windows\System\ujAvPGs.exe
  2⤵
  PID:5672
- C:\Windows\System\DCugDDU.exe
  C:\Windows\System\DCugDDU.exe
  2⤵
  PID:5688
- C:\Windows\System\MqUvTcs.exe
  C:\Windows\System\MqUvTcs.exe
  2⤵
  PID:5704
- C:\Windows\System\sIAGEyw.exe
  C:\Windows\System\sIAGEyw.exe
  2⤵
  PID:5720
- C:\Windows\System\qLoxZXe.exe
  C:\Windows\System\qLoxZXe.exe
  2⤵
  PID:5736
- C:\Windows\System\UPsTbEl.exe
  C:\Windows\System\UPsTbEl.exe
  2⤵
  PID:5752
- C:\Windows\System\dAsJuCt.exe
  C:\Windows\System\dAsJuCt.exe
  2⤵
  PID:5768
- C:\Windows\System\onwCqLV.exe
  C:\Windows\System\onwCqLV.exe
  2⤵
  PID:5784
- C:\Windows\System\JnfXzcs.exe
  C:\Windows\System\JnfXzcs.exe
  2⤵
  PID:5800
- C:\Windows\System\SEMMXKC.exe
  C:\Windows\System\SEMMXKC.exe
  2⤵
  PID:5816
- C:\Windows\System\DqgDmqo.exe
  C:\Windows\System\DqgDmqo.exe
  2⤵
  PID:5836
- C:\Windows\System\XaorxHY.exe
  C:\Windows\System\XaorxHY.exe
  2⤵
  PID:5852
- C:\Windows\System\ZZVXAMs.exe
  C:\Windows\System\ZZVXAMs.exe
  2⤵
  PID:5868
- C:\Windows\System\SoRhKve.exe
  C:\Windows\System\SoRhKve.exe
  2⤵
  PID:5884
- C:\Windows\System\AtsROHS.exe
  C:\Windows\System\AtsROHS.exe
  2⤵
  PID:5900
- C:\Windows\System\pANgPNZ.exe
  C:\Windows\System\pANgPNZ.exe
  2⤵
  PID:5916
- C:\Windows\System\VogpHvY.exe
  C:\Windows\System\VogpHvY.exe
  2⤵
  PID:5932
- C:\Windows\System\KoQNHWe.exe
  C:\Windows\System\KoQNHWe.exe
  2⤵
  PID:5948
- C:\Windows\System\JUUCbKP.exe
  C:\Windows\System\JUUCbKP.exe
  2⤵
  PID:5964
- C:\Windows\System\EjiQrbx.exe
  C:\Windows\System\EjiQrbx.exe
  2⤵
  PID:5980
- C:\Windows\System\XUqnGtF.exe
  C:\Windows\System\XUqnGtF.exe
  2⤵
  PID:5996
- C:\Windows\System\vcriqTG.exe
  C:\Windows\System\vcriqTG.exe
  2⤵
  PID:6024
- C:\Windows\System\mxXyMtm.exe
  C:\Windows\System\mxXyMtm.exe
  2⤵
  PID:6040
- C:\Windows\System\fJCeliL.exe
  C:\Windows\System\fJCeliL.exe
  2⤵
  PID:6056
- C:\Windows\System\TWYLZZz.exe
  C:\Windows\System\TWYLZZz.exe
  2⤵
  PID:6072
- C:\Windows\System\XIJgGgI.exe
  C:\Windows\System\XIJgGgI.exe
  2⤵
  PID:6088
- C:\Windows\System\nveutxf.exe
  C:\Windows\System\nveutxf.exe
  2⤵
  PID:6108
- C:\Windows\System\FzCpxlM.exe
  C:\Windows\System\FzCpxlM.exe
  2⤵
  PID:6128
- C:\Windows\System\WqJIgms.exe
  C:\Windows\System\WqJIgms.exe
  2⤵
  PID:608
- C:\Windows\System\bSXGhtN.exe
  C:\Windows\System\bSXGhtN.exe
  2⤵
  PID:5140
- C:\Windows\System\pHDbCDl.exe
  C:\Windows\System\pHDbCDl.exe
  2⤵
  PID:5064
- C:\Windows\System\amFUYat.exe
  C:\Windows\System\amFUYat.exe
  2⤵
  PID:2716
- C:\Windows\System\lerbTjO.exe
  C:\Windows\System\lerbTjO.exe
  2⤵
  PID:4968
- C:\Windows\System\ONfCbvy.exe
  C:\Windows\System\ONfCbvy.exe
  2⤵
  PID:5096
- C:\Windows\System\TuyORdv.exe
  C:\Windows\System\TuyORdv.exe
  2⤵
  PID:1160
- C:\Windows\System\FpiKwbF.exe
  C:\Windows\System\FpiKwbF.exe
  2⤵
  PID:5128
- C:\Windows\System\ONayije.exe
  C:\Windows\System\ONayije.exe
  2⤵
  PID:5164
- C:\Windows\System\xPcHTpv.exe
  C:\Windows\System\xPcHTpv.exe
  2⤵
  PID:5224
- C:\Windows\System\gQOYYJH.exe
  C:\Windows\System\gQOYYJH.exe
  2⤵
  PID:5424
- C:\Windows\System\bkpHizR.exe
  C:\Windows\System\bkpHizR.exe
  2⤵
  PID:5412
- C:\Windows\System\oRvYYgY.exe
  C:\Windows\System\oRvYYgY.exe
  2⤵
  PID:5340
- C:\Windows\System\PtXFnCx.exe
  C:\Windows\System\PtXFnCx.exe
  2⤵
  PID:5408
- C:\Windows\System\zdBEqWa.exe
  C:\Windows\System\zdBEqWa.exe
  2⤵
  PID:5472
- C:\Windows\System\JQhHgbG.exe
  C:\Windows\System\JQhHgbG.exe
  2⤵
  PID:5312
- C:\Windows\System\kcjEhoz.exe
  C:\Windows\System\kcjEhoz.exe
  2⤵
  PID:5444
- C:\Windows\System\GrERhPF.exe
  C:\Windows\System\GrERhPF.exe
  2⤵
  PID:5540
- C:\Windows\System\pfzNAMy.exe
  C:\Windows\System\pfzNAMy.exe
  2⤵
  PID:5584
- C:\Windows\System\dnnWLjM.exe
  C:\Windows\System\dnnWLjM.exe
  2⤵
  PID:5680
- C:\Windows\System\ztqZfWT.exe
  C:\Windows\System\ztqZfWT.exe
  2⤵
  PID:5744
- C:\Windows\System\AvhaitC.exe
  C:\Windows\System\AvhaitC.exe
  2⤵
  PID:5488
- C:\Windows\System\VobqnWZ.exe
  C:\Windows\System\VobqnWZ.exe
  2⤵
  PID:5848
- C:\Windows\System\UkOkEcy.exe
  C:\Windows\System\UkOkEcy.exe
  2⤵
  PID:6052
- C:\Windows\System\nERvbAB.exe
  C:\Windows\System\nERvbAB.exe
  2⤵
  PID:6012
- C:\Windows\System\SeYhUVb.exe
  C:\Windows\System\SeYhUVb.exe
  2⤵
  PID:5972
- C:\Windows\System\NtOjSeU.exe
  C:\Windows\System\NtOjSeU.exe
  2⤵
  PID:5652
- C:\Windows\System\rkLfpLq.exe
  C:\Windows\System\rkLfpLq.exe
  2⤵
  PID:4516
- C:\Windows\System\oMiBBRA.exe
  C:\Windows\System\oMiBBRA.exe
  2⤵
  PID:3216
- C:\Windows\System\aSQaMQV.exe
  C:\Windows\System\aSQaMQV.exe
  2⤵
  PID:5176
- C:\Windows\System\czKsCcb.exe
  C:\Windows\System\czKsCcb.exe
  2⤵
  PID:5748
- C:\Windows\System\cTDizyM.exe
  C:\Windows\System\cTDizyM.exe
  2⤵
  PID:6152
- C:\Windows\System\GEyLXct.exe
  C:\Windows\System\GEyLXct.exe
  2⤵
  PID:6168
- C:\Windows\System\XDCtMJh.exe
  C:\Windows\System\XDCtMJh.exe
  2⤵
  PID:6184
- C:\Windows\System\TOZXthB.exe
  C:\Windows\System\TOZXthB.exe
  2⤵
  PID:6200
- C:\Windows\System\iyAgeAO.exe
  C:\Windows\System\iyAgeAO.exe
  2⤵
  PID:6216
- C:\Windows\System\wBCeNUJ.exe
  C:\Windows\System\wBCeNUJ.exe
  2⤵
  PID:6232
- C:\Windows\System\pOURkYv.exe
  C:\Windows\System\pOURkYv.exe
  2⤵
  PID:6248
- C:\Windows\System\absEgqV.exe
  C:\Windows\System\absEgqV.exe
  2⤵
  PID:6264
- C:\Windows\System\Gnwnyhz.exe
  C:\Windows\System\Gnwnyhz.exe
  2⤵
  PID:6280
- C:\Windows\System\uoFXqQF.exe
  C:\Windows\System\uoFXqQF.exe
  2⤵
  PID:6296
- C:\Windows\System\BfRcKkP.exe
  C:\Windows\System\BfRcKkP.exe
  2⤵
  PID:6312
- C:\Windows\System\kNLgTaa.exe
  C:\Windows\System\kNLgTaa.exe
  2⤵
  PID:6340
- C:\Windows\System\kDTeYLz.exe
  C:\Windows\System\kDTeYLz.exe
  2⤵
  PID:6356
- C:\Windows\System\KrWDZTE.exe
  C:\Windows\System\KrWDZTE.exe
  2⤵
  PID:6376
- C:\Windows\System\XPBmjFy.exe
  C:\Windows\System\XPBmjFy.exe
  2⤵
  PID:6392
- C:\Windows\System\pqtIoWt.exe
  C:\Windows\System\pqtIoWt.exe
  2⤵
  PID:6408
- C:\Windows\System\HKXqBRO.exe
  C:\Windows\System\HKXqBRO.exe
  2⤵
  PID:6424
- C:\Windows\System\FbBAdTR.exe
  C:\Windows\System\FbBAdTR.exe
  2⤵
  PID:6452
- C:\Windows\System\YwwuqDy.exe
  C:\Windows\System\YwwuqDy.exe
  2⤵
  PID:6472
- C:\Windows\System\clALetT.exe
  C:\Windows\System\clALetT.exe
  2⤵
  PID:6492
- C:\Windows\System\HBHZfqp.exe
  C:\Windows\System\HBHZfqp.exe
  2⤵
  PID:6516
- C:\Windows\System\vtZqeHF.exe
  C:\Windows\System\vtZqeHF.exe
  2⤵
  PID:6532
- C:\Windows\System\gWkXrbo.exe
  C:\Windows\System\gWkXrbo.exe
  2⤵
  PID:6548
- C:\Windows\System\XisTWnR.exe
  C:\Windows\System\XisTWnR.exe
  2⤵
  PID:6564
- C:\Windows\System\zmjDPAo.exe
  C:\Windows\System\zmjDPAo.exe
  2⤵
  PID:6584
- C:\Windows\System\ZxNcCpO.exe
  C:\Windows\System\ZxNcCpO.exe
  2⤵
  PID:6600
- C:\Windows\System\uCZYPne.exe
  C:\Windows\System\uCZYPne.exe
  2⤵
  PID:6616
- C:\Windows\System\ffockcR.exe
  C:\Windows\System\ffockcR.exe
  2⤵
  PID:6632
- C:\Windows\System\CgjzFHo.exe
  C:\Windows\System\CgjzFHo.exe
  2⤵
  PID:6648
- C:\Windows\System\fNJtjer.exe
  C:\Windows\System\fNJtjer.exe
  2⤵
  PID:6664
- C:\Windows\System\vHvVVGG.exe
  C:\Windows\System\vHvVVGG.exe
  2⤵
  PID:6680
- C:\Windows\System\nqcXRaW.exe
  C:\Windows\System\nqcXRaW.exe
  2⤵
  PID:6696
- C:\Windows\System\HAuXMLQ.exe
  C:\Windows\System\HAuXMLQ.exe
  2⤵
  PID:6712
- C:\Windows\System\fouTfyu.exe
  C:\Windows\System\fouTfyu.exe
  2⤵
  PID:6728
- C:\Windows\System\esfebsJ.exe
  C:\Windows\System\esfebsJ.exe
  2⤵
  PID:6744
- C:\Windows\System\xMTZttK.exe
  C:\Windows\System\xMTZttK.exe
  2⤵
  PID:6760
- C:\Windows\System\EzvAQBQ.exe
  C:\Windows\System\EzvAQBQ.exe
  2⤵
  PID:6848
- C:\Windows\System\xqltosp.exe
  C:\Windows\System\xqltosp.exe
  2⤵
  PID:6864
- C:\Windows\System\luUyijp.exe
  C:\Windows\System\luUyijp.exe
  2⤵
  PID:6880
- C:\Windows\System\YkclTxM.exe
  C:\Windows\System\YkclTxM.exe
  2⤵
  PID:6896
- C:\Windows\System\jdSxkAA.exe
  C:\Windows\System\jdSxkAA.exe
  2⤵
  PID:6912
- C:\Windows\System\ddoIHND.exe
  C:\Windows\System\ddoIHND.exe
  2⤵
  PID:6928
- C:\Windows\System\kyNbMQy.exe
  C:\Windows\System\kyNbMQy.exe
  2⤵
  PID:6944
- C:\Windows\System\dpWbJeX.exe
  C:\Windows\System\dpWbJeX.exe
  2⤵
  PID:6960
- C:\Windows\System\nUaIwcP.exe
  C:\Windows\System\nUaIwcP.exe
  2⤵
  PID:6976
- C:\Windows\System\ttMVvBU.exe
  C:\Windows\System\ttMVvBU.exe
  2⤵
  PID:6992
- C:\Windows\System\nTVvPlX.exe
  C:\Windows\System\nTVvPlX.exe
  2⤵
  PID:7008
- C:\Windows\System\DceHTeJ.exe
  C:\Windows\System\DceHTeJ.exe
  2⤵
  PID:7024
- C:\Windows\System\bnVKgqL.exe
  C:\Windows\System\bnVKgqL.exe
  2⤵
  PID:7040
- C:\Windows\System\Qcqecxc.exe
  C:\Windows\System\Qcqecxc.exe
  2⤵
  PID:7056
- C:\Windows\System\UYaLWkk.exe
  C:\Windows\System\UYaLWkk.exe
  2⤵
  PID:7072
- C:\Windows\System\GEPxahb.exe
  C:\Windows\System\GEPxahb.exe
  2⤵
  PID:7088
- C:\Windows\System\FOSlanN.exe
  C:\Windows\System\FOSlanN.exe
  2⤵
  PID:7104
- C:\Windows\System\bBHZdWW.exe
  C:\Windows\System\bBHZdWW.exe
  2⤵
  PID:7120
- C:\Windows\System\euhiYxk.exe
  C:\Windows\System\euhiYxk.exe
  2⤵
  PID:7136
- C:\Windows\System\bmVNDta.exe
  C:\Windows\System\bmVNDta.exe
  2⤵
  PID:7152
- C:\Windows\System\YsaFlrB.exe
  C:\Windows\System\YsaFlrB.exe
  2⤵
  PID:5388
- C:\Windows\System\MRpDHxU.exe
  C:\Windows\System\MRpDHxU.exe
  2⤵
  PID:5268
- C:\Windows\System\jrrakxw.exe
  C:\Windows\System\jrrakxw.exe
  2⤵
  PID:5448
- C:\Windows\System\ljUtqPS.exe
  C:\Windows\System\ljUtqPS.exe
  2⤵
  PID:5560
- C:\Windows\System\RMyayKW.exe
  C:\Windows\System\RMyayKW.exe
  2⤵
  PID:5976
- C:\Windows\System\scFovAb.exe
  C:\Windows\System\scFovAb.exe
  2⤵
  PID:4900
- C:\Windows\System\xFvLjjx.exe
  C:\Windows\System\xFvLjjx.exe
  2⤵
  PID:6180
- C:\Windows\System\VElkglU.exe
  C:\Windows\System\VElkglU.exe
  2⤵
  PID:6272
- C:\Windows\System\FDNZSMb.exe
  C:\Windows\System\FDNZSMb.exe
  2⤵
  PID:6348
- C:\Windows\System\wTSYjPv.exe
  C:\Windows\System\wTSYjPv.exe
  2⤵
  PID:6416
- C:\Windows\System\eiYyuOU.exe
  C:\Windows\System\eiYyuOU.exe
  2⤵
  PID:6468
- C:\Windows\System\jAccuSy.exe
  C:\Windows\System\jAccuSy.exe
  2⤵
  PID:6512
- C:\Windows\System\miiuhTX.exe
  C:\Windows\System\miiuhTX.exe
  2⤵
  PID:5296
- C:\Windows\System\ukxPpwG.exe
  C:\Windows\System\ukxPpwG.exe
  2⤵
  PID:5328
- C:\Windows\System\BNZfYKH.exe
  C:\Windows\System\BNZfYKH.exe
  2⤵
  PID:5732
- C:\Windows\System\WFoEaWG.exe
  C:\Windows\System\WFoEaWG.exe
  2⤵
  PID:5792
- C:\Windows\System\JZIcPkZ.exe
  C:\Windows\System\JZIcPkZ.exe
  2⤵
  PID:5832
- C:\Windows\System\LQxVPmU.exe
  C:\Windows\System\LQxVPmU.exe
  2⤵
  PID:5928
- C:\Windows\System\KQzbGDA.exe
  C:\Windows\System\KQzbGDA.exe
  2⤵
  PID:5992
- C:\Windows\System\sJBfEEo.exe
  C:\Windows\System\sJBfEEo.exe
  2⤵
  PID:6068
- C:\Windows\System\gcuQuGY.exe
  C:\Windows\System\gcuQuGY.exe
  2⤵
  PID:6136
- C:\Windows\System\zgNalOI.exe
  C:\Windows\System\zgNalOI.exe
  2⤵
  PID:6572
- C:\Windows\System\mlggryD.exe
  C:\Windows\System\mlggryD.exe
  2⤵
  PID:5468
- C:\Windows\System\OQTOjFK.exe
  C:\Windows\System\OQTOjFK.exe
  2⤵
  PID:6256
- C:\Windows\System\BEpVNBV.exe
  C:\Windows\System\BEpVNBV.exe
  2⤵
  PID:6336
- C:\Windows\System\apAgpuF.exe
  C:\Windows\System\apAgpuF.exe
  2⤵
  PID:6448
- C:\Windows\System\WCJVMhn.exe
  C:\Windows\System\WCJVMhn.exe
  2⤵
  PID:5632
- C:\Windows\System\enAORgh.exe
  C:\Windows\System\enAORgh.exe
  2⤵
  PID:5112
- C:\Windows\System\xLiTElI.exe
  C:\Windows\System\xLiTElI.exe
  2⤵
  PID:5244
- C:\Windows\System\ZAPeubt.exe
  C:\Windows\System\ZAPeubt.exe
  2⤵
  PID:6164
- C:\Windows\System\TDAUgqT.exe
  C:\Windows\System\TDAUgqT.exe
  2⤵
  PID:5284
- C:\Windows\System\EVEzmEe.exe
  C:\Windows\System\EVEzmEe.exe
  2⤵
  PID:5616
- C:\Windows\System\TDDmCCA.exe
  C:\Windows\System\TDDmCCA.exe
  2⤵
  PID:5308
- C:\Windows\System\hFalybA.exe
  C:\Windows\System\hFalybA.exe
  2⤵
  PID:5940
- C:\Windows\System\VOswiTg.exe
  C:\Windows\System\VOswiTg.exe
  2⤵
  PID:5192
- C:\Windows\System\OAHiwpd.exe
  C:\Windows\System\OAHiwpd.exe
  2⤵
  PID:6404
- C:\Windows\System\EMgPHEb.exe
  C:\Windows\System\EMgPHEb.exe
  2⤵
  PID:6556
- C:\Windows\System\LluchGF.exe
  C:\Windows\System\LluchGF.exe
  2⤵
  PID:6368
- C:\Windows\System\lSoizCJ.exe
  C:\Windows\System\lSoizCJ.exe
  2⤵
  PID:6224
- C:\Windows\System\WqHGHew.exe
  C:\Windows\System\WqHGHew.exe
  2⤵
  PID:6524
- C:\Windows\System\PjemnCm.exe
  C:\Windows\System\PjemnCm.exe
  2⤵
  PID:5124
- C:\Windows\System\xdFyZMU.exe
  C:\Windows\System\xdFyZMU.exe
  2⤵
  PID:6624
- C:\Windows\System\tvAEirD.exe
  C:\Windows\System\tvAEirD.exe
  2⤵
  PID:6688
- C:\Windows\System\qwxXIEP.exe
  C:\Windows\System\qwxXIEP.exe
  2⤵
  PID:6752
- C:\Windows\System\liZJOkD.exe
  C:\Windows\System\liZJOkD.exe
  2⤵
  PID:6640
- C:\Windows\System\RzslfYD.exe
  C:\Windows\System\RzslfYD.exe
  2⤵
  PID:6776
- C:\Windows\System\yPIBont.exe
  C:\Windows\System\yPIBont.exe
  2⤵
  PID:6740
- C:\Windows\System\JGruiXj.exe
  C:\Windows\System\JGruiXj.exe
  2⤵
  PID:5076
- C:\Windows\System\jdRFDqj.exe
  C:\Windows\System\jdRFDqj.exe
  2⤵
  PID:6888
- C:\Windows\System\pEZybcZ.exe
  C:\Windows\System\pEZybcZ.exe
  2⤵
  PID:6800
- C:\Windows\System\qKuRHjk.exe
  C:\Windows\System\qKuRHjk.exe
  2⤵
  PID:6920
- C:\Windows\System\QRpaCwf.exe
  C:\Windows\System\QRpaCwf.exe
  2⤵
  PID:6952
- C:\Windows\System\SxXAHtq.exe
  C:\Windows\System\SxXAHtq.exe
  2⤵
  PID:6904
- C:\Windows\System\qHZRbJP.exe
  C:\Windows\System\qHZRbJP.exe
  2⤵
  PID:6936
- C:\Windows\System\hlpBSOi.exe
  C:\Windows\System\hlpBSOi.exe
  2⤵
  PID:6984
- C:\Windows\System\pclppRz.exe
  C:\Windows\System\pclppRz.exe
  2⤵
  PID:6968
- C:\Windows\System\UdwVoSN.exe
  C:\Windows\System\UdwVoSN.exe
  2⤵
  PID:7084
- C:\Windows\System\GjIdmWt.exe
  C:\Windows\System\GjIdmWt.exe
  2⤵
  PID:5452
- C:\Windows\System\qKcXAIh.exe
  C:\Windows\System\qKcXAIh.exe
  2⤵
  PID:6828
- C:\Windows\System\JzydHuN.exe
  C:\Windows\System\JzydHuN.exe
  2⤵
  PID:7064
- C:\Windows\System\kXVDaqt.exe
  C:\Windows\System\kXVDaqt.exe
  2⤵
  PID:7100
- C:\Windows\System\iPdMcBP.exe
  C:\Windows\System\iPdMcBP.exe
  2⤵
  PID:7132
- C:\Windows\System\zUoeCCb.exe
  C:\Windows\System\zUoeCCb.exe
  2⤵
  PID:7032
- C:\Windows\System\cyUpzDj.exe
  C:\Windows\System\cyUpzDj.exe
  2⤵
  PID:6176
- C:\Windows\System\NzWzuEl.exe
  C:\Windows\System\NzWzuEl.exe
  2⤵
  PID:5712
- C:\Windows\System\bJAkHXw.exe
  C:\Windows\System\bJAkHXw.exe
  2⤵
  PID:6500
- C:\Windows\System\nqSldkQ.exe
  C:\Windows\System\nqSldkQ.exe
  2⤵
  PID:6460
- C:\Windows\System\GXxbako.exe
  C:\Windows\System\GXxbako.exe
  2⤵
  PID:5824
- C:\Windows\System\QomnZhM.exe
  C:\Windows\System\QomnZhM.exe
  2⤵
  PID:5988
- C:\Windows\System\odpJSWk.exe
  C:\Windows\System\odpJSWk.exe
  2⤵
  PID:6104
- C:\Windows\System\VXNgJDq.exe
  C:\Windows\System\VXNgJDq.exe
  2⤵
  PID:6328
- C:\Windows\System\hKESdgP.exe
  C:\Windows\System\hKESdgP.exe
  2⤵
  PID:1912
- C:\Windows\System\AOxvgHz.exe
  C:\Windows\System\AOxvgHz.exe
  2⤵
  PID:5760
- C:\Windows\System\jGQYnLt.exe
  C:\Windows\System\jGQYnLt.exe
  2⤵
  PID:5864
- C:\Windows\System\pZzJuOm.exe
  C:\Windows\System\pZzJuOm.exe
  2⤵
  PID:2688
- C:\Windows\System\BStcHbD.exe
  C:\Windows\System\BStcHbD.exe
  2⤵
  PID:5528
- C:\Windows\System\VXgTtNT.exe
  C:\Windows\System\VXgTtNT.exe
  2⤵
  PID:5248
- C:\Windows\System\wvcKuoV.exe
  C:\Windows\System\wvcKuoV.exe
  2⤵
  PID:5292
- C:\Windows\System\XLwlFBT.exe
  C:\Windows\System\XLwlFBT.exe
  2⤵
  PID:5228
- C:\Windows\System\LoJXeyt.exe
  C:\Windows\System\LoJXeyt.exe
  2⤵
  PID:4816
- C:\Windows\System\qDCqANl.exe
  C:\Windows\System\qDCqANl.exe
  2⤵
  PID:6192
- C:\Windows\System\WanbMqx.exe
  C:\Windows\System\WanbMqx.exe
  2⤵
  PID:6576
- C:\Windows\System\STBIYZn.exe
  C:\Windows\System\STBIYZn.exe
  2⤵
  PID:6596
- C:\Windows\System\egebBmv.exe
  C:\Windows\System\egebBmv.exe
  2⤵
  PID:6660
- C:\Windows\System\rRKIrgr.exe
  C:\Windows\System\rRKIrgr.exe
  2⤵
  PID:6676
- C:\Windows\System\QydiurC.exe
  C:\Windows\System\QydiurC.exe
  2⤵
  PID:6612
- C:\Windows\System\TuWWCPE.exe
  C:\Windows\System\TuWWCPE.exe
  2⤵
  PID:6860
- C:\Windows\System\qCiLAAJ.exe
  C:\Windows\System\qCiLAAJ.exe
  2⤵
  PID:6876
- C:\Windows\System\saRgJNR.exe
  C:\Windows\System\saRgJNR.exe
  2⤵
  PID:7036
- C:\Windows\System\wdBZFab.exe
  C:\Windows\System\wdBZFab.exe
  2⤵
  PID:7112
- C:\Windows\System\UxhFjjc.exe
  C:\Windows\System\UxhFjjc.exe
  2⤵
  PID:6124
- C:\Windows\System\ehSsQMg.exe
  C:\Windows\System\ehSsQMg.exe
  2⤵
  PID:5960
- C:\Windows\System\DuSIbsZ.exe
  C:\Windows\System\DuSIbsZ.exe
  2⤵
  PID:5324
- C:\Windows\System\DcRTEJc.exe
  C:\Windows\System\DcRTEJc.exe
  2⤵
  PID:6444
- C:\Windows\System\VDGywxu.exe
  C:\Windows\System\VDGywxu.exe
  2⤵
  PID:6324
- C:\Windows\System\WOBgbvd.exe
  C:\Windows\System\WOBgbvd.exe
  2⤵
  PID:6768
- C:\Windows\System\JUmWVNF.exe
  C:\Windows\System\JUmWVNF.exe
  2⤵
  PID:7020
- C:\Windows\System\HJiSBGm.exe
  C:\Windows\System\HJiSBGm.exe
  2⤵
  PID:6320
- C:\Windows\System\nTXNyWZ.exe
  C:\Windows\System\nTXNyWZ.exe
  2⤵
  PID:6736
- C:\Windows\System\GYRlQfq.exe
  C:\Windows\System\GYRlQfq.exe
  2⤵
  PID:7172
- C:\Windows\System\vlWtTMJ.exe
  C:\Windows\System\vlWtTMJ.exe
  2⤵
  PID:7188
- C:\Windows\System\zvgDKSR.exe
  C:\Windows\System\zvgDKSR.exe
  2⤵
  PID:7204
- C:\Windows\System\AgvvdKE.exe
  C:\Windows\System\AgvvdKE.exe
  2⤵
  PID:7220
- C:\Windows\System\wubnmpN.exe
  C:\Windows\System\wubnmpN.exe
  2⤵
  PID:7236
- C:\Windows\System\xqbQKOv.exe
  C:\Windows\System\xqbQKOv.exe
  2⤵
  PID:7252
- C:\Windows\System\VyDADDm.exe
  C:\Windows\System\VyDADDm.exe
  2⤵
  PID:7268
- C:\Windows\System\ULtxqAE.exe
  C:\Windows\System\ULtxqAE.exe
  2⤵
  PID:7284
- C:\Windows\System\VXhifoQ.exe
  C:\Windows\System\VXhifoQ.exe
  2⤵
  PID:7300
- C:\Windows\System\LdUUFVI.exe
  C:\Windows\System\LdUUFVI.exe
  2⤵
  PID:7316
- C:\Windows\System\opUTDUn.exe
  C:\Windows\System\opUTDUn.exe
  2⤵
  PID:7332
- C:\Windows\System\dOvdCZR.exe
  C:\Windows\System\dOvdCZR.exe
  2⤵
  PID:7348
- C:\Windows\System\leuJLIB.exe
  C:\Windows\System\leuJLIB.exe
  2⤵
  PID:7364
- C:\Windows\System\hbOMqBe.exe
  C:\Windows\System\hbOMqBe.exe
  2⤵
  PID:7380
- C:\Windows\System\vrggMsf.exe
  C:\Windows\System\vrggMsf.exe
  2⤵
  PID:7396
- C:\Windows\System\hPVhAZN.exe
  C:\Windows\System\hPVhAZN.exe
  2⤵
  PID:7412
- C:\Windows\System\dEbJuPk.exe
  C:\Windows\System\dEbJuPk.exe
  2⤵
  PID:7428
- C:\Windows\System\dEFNxVF.exe
  C:\Windows\System\dEFNxVF.exe
  2⤵
  PID:7444
- C:\Windows\System\eiEatYs.exe
  C:\Windows\System\eiEatYs.exe
  2⤵
  PID:7460
- C:\Windows\System\BeQDpoV.exe
  C:\Windows\System\BeQDpoV.exe
  2⤵
  PID:7476
- C:\Windows\System\IlwBkjP.exe
  C:\Windows\System\IlwBkjP.exe
  2⤵
  PID:7492
- C:\Windows\System\avOpbPP.exe
  C:\Windows\System\avOpbPP.exe
  2⤵
  PID:7508
- C:\Windows\System\NpAwoFb.exe
  C:\Windows\System\NpAwoFb.exe
  2⤵
  PID:7528
- C:\Windows\System\giYgEDY.exe
  C:\Windows\System\giYgEDY.exe
  2⤵
  PID:7544
- C:\Windows\System\NDvSHtU.exe
  C:\Windows\System\NDvSHtU.exe
  2⤵
  PID:7560
- C:\Windows\System\IJJPTwM.exe
  C:\Windows\System\IJJPTwM.exe
  2⤵
  PID:7576
- C:\Windows\System\SZcgxvr.exe
  C:\Windows\System\SZcgxvr.exe
  2⤵
  PID:7592
- C:\Windows\System\pOtOgID.exe
  C:\Windows\System\pOtOgID.exe
  2⤵
  PID:7608
- C:\Windows\System\lkPcSQK.exe
  C:\Windows\System\lkPcSQK.exe
  2⤵
  PID:7624
- C:\Windows\System\QuUgvlC.exe
  C:\Windows\System\QuUgvlC.exe
  2⤵
  PID:7640
- C:\Windows\System\rUpmmiN.exe
  C:\Windows\System\rUpmmiN.exe
  2⤵
  PID:7660
- C:\Windows\System\fRNWQLK.exe
  C:\Windows\System\fRNWQLK.exe
  2⤵
  PID:7676
- C:\Windows\System\ZbseCKn.exe
  C:\Windows\System\ZbseCKn.exe
  2⤵
  PID:7692
- C:\Windows\System\FWqyaex.exe
  C:\Windows\System\FWqyaex.exe
  2⤵
  PID:7708
- C:\Windows\System\ILpcwCE.exe
  C:\Windows\System\ILpcwCE.exe
  2⤵
  PID:7724
- C:\Windows\System\rVixzEI.exe
  C:\Windows\System\rVixzEI.exe
  2⤵
  PID:7740
- C:\Windows\System\GWIeSLJ.exe
  C:\Windows\System\GWIeSLJ.exe
  2⤵
  PID:7756
- C:\Windows\System\ZoABPsr.exe
  C:\Windows\System\ZoABPsr.exe
  2⤵
  PID:7772
- C:\Windows\System\cItxPIs.exe
  C:\Windows\System\cItxPIs.exe
  2⤵
  PID:7788
- C:\Windows\System\zeeyfha.exe
  C:\Windows\System\zeeyfha.exe
  2⤵
  PID:7804
- C:\Windows\System\NrltgWp.exe
  C:\Windows\System\NrltgWp.exe
  2⤵
  PID:7820
- C:\Windows\System\FNXhfmd.exe
  C:\Windows\System\FNXhfmd.exe
  2⤵
  PID:7836
- C:\Windows\System\xgAfSni.exe
  C:\Windows\System\xgAfSni.exe
  2⤵
  PID:7852
- C:\Windows\System\HESXoNg.exe
  C:\Windows\System\HESXoNg.exe
  2⤵
  PID:7868
- C:\Windows\System\nsejktO.exe
  C:\Windows\System\nsejktO.exe
  2⤵
  PID:7884
- C:\Windows\System\YXeUJTZ.exe
  C:\Windows\System\YXeUJTZ.exe
  2⤵
  PID:7900
- C:\Windows\System\PcMJnuF.exe
  C:\Windows\System\PcMJnuF.exe
  2⤵
  PID:7916
- C:\Windows\System\OWTYDuB.exe
  C:\Windows\System\OWTYDuB.exe
  2⤵
  PID:7932
- C:\Windows\System\hfRaNaK.exe
  C:\Windows\System\hfRaNaK.exe
  2⤵
  PID:7948
- C:\Windows\System\qsaPZOt.exe
  C:\Windows\System\qsaPZOt.exe
  2⤵
  PID:7964
- C:\Windows\System\lFSxAEe.exe
  C:\Windows\System\lFSxAEe.exe
  2⤵
  PID:7980
- C:\Windows\System\uvWAtGF.exe
  C:\Windows\System\uvWAtGF.exe
  2⤵
  PID:7996
- C:\Windows\System\amFmWVi.exe
  C:\Windows\System\amFmWVi.exe
  2⤵
  PID:8012
- C:\Windows\System\NnPIIXl.exe
  C:\Windows\System\NnPIIXl.exe
  2⤵
  PID:8028
- C:\Windows\System\ZNJGlcx.exe
  C:\Windows\System\ZNJGlcx.exe
  2⤵
  PID:8044
- C:\Windows\System\hdnoIwq.exe
  C:\Windows\System\hdnoIwq.exe
  2⤵
  PID:8060
- C:\Windows\System\LVKzaNb.exe
  C:\Windows\System\LVKzaNb.exe
  2⤵
  PID:8076
- C:\Windows\System\MXOzPyd.exe
  C:\Windows\System\MXOzPyd.exe
  2⤵
  PID:8092
- C:\Windows\System\QywXMnB.exe
  C:\Windows\System\QywXMnB.exe
  2⤵
  PID:8108
- C:\Windows\System\sKGoMWS.exe
  C:\Windows\System\sKGoMWS.exe
  2⤵
  PID:8124
- C:\Windows\System\TLHELGT.exe
  C:\Windows\System\TLHELGT.exe
  2⤵
  PID:8140
- C:\Windows\System\tsTVzdG.exe
  C:\Windows\System\tsTVzdG.exe
  2⤵
  PID:8156
- C:\Windows\System\KwUDcGN.exe
  C:\Windows\System\KwUDcGN.exe
  2⤵
  PID:8172
- C:\Windows\System\xEbxgoA.exe
  C:\Windows\System\xEbxgoA.exe
  2⤵
  PID:8188
- C:\Windows\System\oYWXfGU.exe
  C:\Windows\System\oYWXfGU.exe
  2⤵
  PID:7212
- C:\Windows\System\cjZdtvd.exe
  C:\Windows\System\cjZdtvd.exe
  2⤵
  PID:7280
- C:\Windows\System\mVjDQQp.exe
  C:\Windows\System\mVjDQQp.exe
  2⤵
  PID:7344
- C:\Windows\System\tqGYfIU.exe
  C:\Windows\System\tqGYfIU.exe
  2⤵
  PID:7404
- C:\Windows\System\OIDuDjw.exe
  C:\Windows\System\OIDuDjw.exe
  2⤵
  PID:6840
- C:\Windows\System\AHkqoXy.exe
  C:\Windows\System\AHkqoXy.exe
  2⤵
  PID:7004
- C:\Windows\System\LJjzMOt.exe
  C:\Windows\System\LJjzMOt.exe
  2⤵
  PID:6384
- C:\Windows\System\mFqXNlw.exe
  C:\Windows\System\mFqXNlw.exe
  2⤵
  PID:6480
- C:\Windows\System\iGZRxKv.exe
  C:\Windows\System\iGZRxKv.exe
  2⤵
  PID:6816
- C:\Windows\System\vWnOqiT.exe
  C:\Windows\System\vWnOqiT.exe
  2⤵
  PID:6836
- C:\Windows\System\rxsXJGm.exe
  C:\Windows\System\rxsXJGm.exe
  2⤵
  PID:7324
- C:\Windows\System\FtoNYfz.exe
  C:\Windows\System\FtoNYfz.exe
  2⤵
  PID:5628
- C:\Windows\System\xrmjeVe.exe
  C:\Windows\System\xrmjeVe.exe
  2⤵
  PID:6372
- C:\Windows\System\cdyIkKP.exe
  C:\Windows\System\cdyIkKP.exe
  2⤵
  PID:6720
- C:\Windows\System\TEWKXxW.exe
  C:\Windows\System\TEWKXxW.exe
  2⤵
  PID:7096
- C:\Windows\System\KJMMSdk.exe
  C:\Windows\System\KJMMSdk.exe
  2⤵
  PID:5548
- C:\Windows\System\zeTFaXa.exe
  C:\Windows\System\zeTFaXa.exe
  2⤵
  PID:5464
- C:\Windows\System\czwlczW.exe
  C:\Windows\System\czwlczW.exe
  2⤵
  PID:7264
- C:\Windows\System\XRDOcaE.exe
  C:\Windows\System\XRDOcaE.exe
  2⤵
  PID:7360
- C:\Windows\System\KtGlsbR.exe
  C:\Windows\System\KtGlsbR.exe
  2⤵
  PID:7436
- C:\Windows\System\CQrSBAW.exe
  C:\Windows\System\CQrSBAW.exe
  2⤵
  PID:7500
- C:\Windows\System\STucbVR.exe
  C:\Windows\System\STucbVR.exe
  2⤵
  PID:7504
- C:\Windows\System\eCgrdVd.exe
  C:\Windows\System\eCgrdVd.exe
  2⤵
  PID:7540
- C:\Windows\System\RubkauG.exe
  C:\Windows\System\RubkauG.exe
  2⤵
  PID:7524
- C:\Windows\System\ohDDgFH.exe
  C:\Windows\System\ohDDgFH.exe
  2⤵
  PID:7552
- C:\Windows\System\LgBdDuB.exe
  C:\Windows\System\LgBdDuB.exe
  2⤵
  PID:7616
- C:\Windows\System\JlLDLtm.exe
  C:\Windows\System\JlLDLtm.exe
  2⤵
  PID:7600
- C:\Windows\System\JiNyyXf.exe
  C:\Windows\System\JiNyyXf.exe
  2⤵
  PID:7668
- C:\Windows\System\KSvxylT.exe
  C:\Windows\System\KSvxylT.exe
  2⤵
  PID:7732
- C:\Windows\System\RwsyDIg.exe
  C:\Windows\System\RwsyDIg.exe
  2⤵
  PID:7748
- C:\Windows\System\Gntfsru.exe
  C:\Windows\System\Gntfsru.exe
  2⤵
  PID:7684
- C:\Windows\System\jlJIVoj.exe
  C:\Windows\System\jlJIVoj.exe
  2⤵
  PID:7780
- C:\Windows\System\mCaABWT.exe
  C:\Windows\System\mCaABWT.exe
  2⤵
  PID:7832
- C:\Windows\System\LFbvMzF.exe
  C:\Windows\System\LFbvMzF.exe
  2⤵
  PID:7864
- C:\Windows\System\vyiaOOn.exe
  C:\Windows\System\vyiaOOn.exe
  2⤵
  PID:7956
- C:\Windows\System\LauCdby.exe
  C:\Windows\System\LauCdby.exe
  2⤵
  PID:8020
- C:\Windows\System\WKlsKZR.exe
  C:\Windows\System\WKlsKZR.exe
  2⤵
  PID:7816
- C:\Windows\System\HhuQhOg.exe
  C:\Windows\System\HhuQhOg.exe
  2⤵
  PID:7844
- C:\Windows\System\KFxyLGj.exe
  C:\Windows\System\KFxyLGj.exe
  2⤵
  PID:7972
- C:\Windows\System\RsiSevN.exe
  C:\Windows\System\RsiSevN.exe
  2⤵
  PID:8036
- C:\Windows\System\zzIaIyM.exe
  C:\Windows\System\zzIaIyM.exe
  2⤵
  PID:8088
- C:\Windows\System\nwziLaC.exe
  C:\Windows\System\nwziLaC.exe
  2⤵
  PID:8116
- C:\Windows\System\GisWiFq.exe
  C:\Windows\System\GisWiFq.exe
  2⤵
  PID:8180
- C:\Windows\System\MhWpATF.exe
  C:\Windows\System\MhWpATF.exe
  2⤵
  PID:8132
- C:\Windows\System\jOwlsbC.exe
  C:\Windows\System\jOwlsbC.exe
  2⤵
  PID:7228
- C:\Windows\System\EquRVut.exe
  C:\Windows\System\EquRVut.exe
  2⤵
  PID:7184
- C:\Windows\System\OBrHDIv.exe
  C:\Windows\System\OBrHDIv.exe
  2⤵
  PID:7144
- C:\Windows\System\KHvNsmp.exe
  C:\Windows\System\KHvNsmp.exe
  2⤵
  PID:7216
- C:\Windows\System\uoaqdbq.exe
  C:\Windows\System\uoaqdbq.exe
  2⤵
  PID:6792
- C:\Windows\System\UBTTdaV.exe
  C:\Windows\System\UBTTdaV.exe
  2⤵
  PID:5844
- C:\Windows\System\hivJkca.exe
  C:\Windows\System\hivJkca.exe
  2⤵
  PID:7000
- C:\Windows\System\KGFeDpk.exe
  C:\Windows\System\KGFeDpk.exe
  2⤵
  PID:6972
- C:\Windows\System\GzBfySf.exe
  C:\Windows\System\GzBfySf.exe
  2⤵
  PID:6672
- C:\Windows\System\MXNnnWC.exe
  C:\Windows\System\MXNnnWC.exe
  2⤵
  PID:7356
- C:\Windows\System\vDAXker.exe
  C:\Windows\System\vDAXker.exe
  2⤵
  PID:1740
- C:\Windows\System\yOBJaMM.exe
  C:\Windows\System\yOBJaMM.exe
  2⤵
  PID:7584
- C:\Windows\System\uNtOYLm.exe
  C:\Windows\System\uNtOYLm.exe
  2⤵
  PID:7764
- C:\Windows\System\IwzQJbQ.exe
  C:\Windows\System\IwzQJbQ.exe
  2⤵
  PID:7768
- C:\Windows\System\IEcItAx.exe
  C:\Windows\System\IEcItAx.exe
  2⤵
  PID:7892
- C:\Windows\System\kUNaXnD.exe
  C:\Windows\System\kUNaXnD.exe
  2⤵
  PID:7912
- C:\Windows\System\jCNWgAs.exe
  C:\Windows\System\jCNWgAs.exe
  2⤵
  PID:7488
- C:\Windows\System\vwvBiKU.exe
  C:\Windows\System\vwvBiKU.exe
  2⤵
  PID:7800
- C:\Windows\System\nWZJLrk.exe
  C:\Windows\System\nWZJLrk.exe
  2⤵
  PID:8100
- C:\Windows\System\ufMDIBS.exe
  C:\Windows\System\ufMDIBS.exe
  2⤵
  PID:7568
- C:\Windows\System\LqNyaue.exe
  C:\Windows\System\LqNyaue.exe
  2⤵
  PID:7896
- C:\Windows\System\CfITkZN.exe
  C:\Windows\System\CfITkZN.exe
  2⤵
  PID:8056
- C:\Windows\System\NVCVQRj.exe
  C:\Windows\System\NVCVQRj.exe
  2⤵
  PID:8104
- C:\Windows\System\TmyuNXR.exe
  C:\Windows\System\TmyuNXR.exe
  2⤵
  PID:6212
- C:\Windows\System\cIkMRNK.exe
  C:\Windows\System\cIkMRNK.exe
  2⤵
  PID:6100
- C:\Windows\System\VMvdKlJ.exe
  C:\Windows\System\VMvdKlJ.exe
  2⤵
  PID:7408
- C:\Windows\System\ynDeSLB.exe
  C:\Windows\System\ynDeSLB.exe
  2⤵
  PID:5428
- C:\Windows\System\kvtfpda.exe
  C:\Windows\System\kvtfpda.exe
  2⤵
  PID:5376
- C:\Windows\System\ITDUjUN.exe
  C:\Windows\System\ITDUjUN.exe
  2⤵
  PID:6488
- C:\Windows\System\QsHtJOR.exe
  C:\Windows\System\QsHtJOR.exe
  2⤵
  PID:7632
- C:\Windows\System\iBMBJYT.exe
  C:\Windows\System\iBMBJYT.exe
  2⤵
  PID:7420
- C:\Windows\System\XnUFVHk.exe
  C:\Windows\System\XnUFVHk.exe
  2⤵
  PID:7276
- C:\Windows\System\IFCuaZu.exe
  C:\Windows\System\IFCuaZu.exe
  2⤵
  PID:7944
- C:\Windows\System\hKZUiPE.exe
  C:\Windows\System\hKZUiPE.exe
  2⤵
  PID:8152
- C:\Windows\System\gZXIzDW.exe
  C:\Windows\System\gZXIzDW.exe
  2⤵
  PID:5600
- C:\Windows\System\wQEsKFS.exe
  C:\Windows\System\wQEsKFS.exe
  2⤵
  PID:1576
- C:\Windows\System\LTusaRk.exe
  C:\Windows\System\LTusaRk.exe
  2⤵
  PID:7472
- C:\Windows\System\iQvmUBy.exe
  C:\Windows\System\iQvmUBy.exe
  2⤵
  PID:7652
- C:\Windows\System\CaSchQb.exe
  C:\Windows\System\CaSchQb.exe
  2⤵
  PID:8084
- C:\Windows\System\dArgzIu.exe
  C:\Windows\System\dArgzIu.exe
  2⤵
  PID:7992
- C:\Windows\System\kHvaAQM.exe
  C:\Windows\System\kHvaAQM.exe
  2⤵
  PID:8208
- C:\Windows\System\DvAslpY.exe
  C:\Windows\System\DvAslpY.exe
  2⤵
  PID:8224
- C:\Windows\System\xKFyKHk.exe
  C:\Windows\System\xKFyKHk.exe
  2⤵
  PID:8240
- C:\Windows\System\pwgGdrD.exe
  C:\Windows\System\pwgGdrD.exe
  2⤵
  PID:8256
- C:\Windows\System\XeGocxL.exe
  C:\Windows\System\XeGocxL.exe
  2⤵
  PID:8272
- C:\Windows\System\RYupkqF.exe
  C:\Windows\System\RYupkqF.exe
  2⤵
  PID:8288
- C:\Windows\System\LuvonlT.exe
  C:\Windows\System\LuvonlT.exe
  2⤵
  PID:8304
- C:\Windows\System\aGjiDfw.exe
  C:\Windows\System\aGjiDfw.exe
  2⤵
  PID:8320
- C:\Windows\System\GJAwsUb.exe
  C:\Windows\System\GJAwsUb.exe
  2⤵
  PID:8336
- C:\Windows\System\rYfojoG.exe
  C:\Windows\System\rYfojoG.exe
  2⤵
  PID:8352
- C:\Windows\System\NgLkXsI.exe
  C:\Windows\System\NgLkXsI.exe
  2⤵
  PID:8368
- C:\Windows\System\uTeyvZK.exe
  C:\Windows\System\uTeyvZK.exe
  2⤵
  PID:8384
- C:\Windows\System\gIfXHHz.exe
  C:\Windows\System\gIfXHHz.exe
  2⤵
  PID:8400
- C:\Windows\System\QRIyczc.exe
  C:\Windows\System\QRIyczc.exe
  2⤵
  PID:8416
- C:\Windows\System\SSAxzJw.exe
  C:\Windows\System\SSAxzJw.exe
  2⤵
  PID:8436
- C:\Windows\System\EmAbmiJ.exe
  C:\Windows\System\EmAbmiJ.exe
  2⤵
  PID:8456
- C:\Windows\System\hoixbKZ.exe
  C:\Windows\System\hoixbKZ.exe
  2⤵
  PID:8472
- C:\Windows\System\KdyeGgp.exe
  C:\Windows\System\KdyeGgp.exe
  2⤵
  PID:8488
- C:\Windows\System\TdUIyOP.exe
  C:\Windows\System\TdUIyOP.exe
  2⤵
  PID:8504
- C:\Windows\System\aHrgTlf.exe
  C:\Windows\System\aHrgTlf.exe
  2⤵
  PID:8520
- C:\Windows\System\aStbsLf.exe
  C:\Windows\System\aStbsLf.exe
  2⤵
  PID:8536
- C:\Windows\System\KRnYANZ.exe
  C:\Windows\System\KRnYANZ.exe
  2⤵
  PID:8552
- C:\Windows\System\SepgZOR.exe
  C:\Windows\System\SepgZOR.exe
  2⤵
  PID:8568
- C:\Windows\System\egBLvho.exe
  C:\Windows\System\egBLvho.exe
  2⤵
  PID:8584
- C:\Windows\System\iBjyxVl.exe
  C:\Windows\System\iBjyxVl.exe
  2⤵
  PID:8600
- C:\Windows\System\qxfzZqu.exe
  C:\Windows\System\qxfzZqu.exe
  2⤵
  PID:8616
- C:\Windows\System\imxOqnk.exe
  C:\Windows\System\imxOqnk.exe
  2⤵
  PID:8632
- C:\Windows\System\RBHNviQ.exe
  C:\Windows\System\RBHNviQ.exe
  2⤵
  PID:8648
- C:\Windows\System\BdLNMRT.exe
  C:\Windows\System\BdLNMRT.exe
  2⤵
  PID:8664
- C:\Windows\System\KOtCiRY.exe
  C:\Windows\System\KOtCiRY.exe
  2⤵
  PID:8680
- C:\Windows\System\QnNMyyY.exe
  C:\Windows\System\QnNMyyY.exe
  2⤵
  PID:8696
- C:\Windows\System\fhnJqmj.exe
  C:\Windows\System\fhnJqmj.exe
  2⤵
  PID:8712
- C:\Windows\System\atOGbyt.exe
  C:\Windows\System\atOGbyt.exe
  2⤵
  PID:8728
- C:\Windows\System\cqpnJic.exe
  C:\Windows\System\cqpnJic.exe
  2⤵
  PID:8744
- C:\Windows\System\qBFoHez.exe
  C:\Windows\System\qBFoHez.exe
  2⤵
  PID:8760
- C:\Windows\System\WcgYKbo.exe
  C:\Windows\System\WcgYKbo.exe
  2⤵
  PID:8776
- C:\Windows\System\vgHdybP.exe
  C:\Windows\System\vgHdybP.exe
  2⤵
  PID:8792
- C:\Windows\System\ZbMwVbJ.exe
  C:\Windows\System\ZbMwVbJ.exe
  2⤵
  PID:8812
- C:\Windows\System\BXAMwog.exe
  C:\Windows\System\BXAMwog.exe
  2⤵
  PID:8828
- C:\Windows\System\uVrYaqw.exe
  C:\Windows\System\uVrYaqw.exe
  2⤵
  PID:8844
- C:\Windows\System\DWYymNA.exe
  C:\Windows\System\DWYymNA.exe
  2⤵
  PID:8860
- C:\Windows\System\uSlRrtq.exe
  C:\Windows\System\uSlRrtq.exe
  2⤵
  PID:8876
- C:\Windows\System\VKZeJVs.exe
  C:\Windows\System\VKZeJVs.exe
  2⤵
  PID:8892
- C:\Windows\System\bclDBBP.exe
  C:\Windows\System\bclDBBP.exe
  2⤵
  PID:8908
- C:\Windows\System\crbcsDI.exe
  C:\Windows\System\crbcsDI.exe
  2⤵
  PID:8928
- C:\Windows\System\rrbDZfu.exe
  C:\Windows\System\rrbDZfu.exe
  2⤵
  PID:8944
- C:\Windows\System\EGuFdyL.exe
  C:\Windows\System\EGuFdyL.exe
  2⤵
  PID:8960
- C:\Windows\System\ThuHSPC.exe
  C:\Windows\System\ThuHSPC.exe
  2⤵
  PID:8976
- C:\Windows\System\qYWPFCS.exe
  C:\Windows\System\qYWPFCS.exe
  2⤵
  PID:8992
- C:\Windows\System\vowEbMh.exe
  C:\Windows\System\vowEbMh.exe
  2⤵
  PID:9012
- C:\Windows\System\XdgCyJa.exe
  C:\Windows\System\XdgCyJa.exe
  2⤵
  PID:9036
- C:\Windows\System\hzUeOsP.exe
  C:\Windows\System\hzUeOsP.exe
  2⤵
  PID:9052
- C:\Windows\System\oAHCZIh.exe
  C:\Windows\System\oAHCZIh.exe
  2⤵
  PID:9068
- C:\Windows\System\ozvnlJq.exe
  C:\Windows\System\ozvnlJq.exe
  2⤵
  PID:9084
- C:\Windows\System\oTyKudU.exe
  C:\Windows\System\oTyKudU.exe
  2⤵
  PID:9112
- C:\Windows\System\WoiKKcv.exe
  C:\Windows\System\WoiKKcv.exe
  2⤵
  PID:9152
- C:\Windows\System\zInogTk.exe
  C:\Windows\System\zInogTk.exe
  2⤵
  PID:9172
- C:\Windows\System\PWOIIaZ.exe
  C:\Windows\System\PWOIIaZ.exe
  2⤵
  PID:9188
- C:\Windows\System\zUmLefO.exe
  C:\Windows\System\zUmLefO.exe
  2⤵
  PID:8284
- C:\Windows\System\JZIHTYS.exe
  C:\Windows\System\JZIHTYS.exe
  2⤵
  PID:5700
- C:\Windows\System\cHIAVjz.exe
  C:\Windows\System\cHIAVjz.exe
  2⤵
  PID:8200
- C:\Windows\System\oCTCeOc.exe
  C:\Windows\System\oCTCeOc.exe
  2⤵
  PID:6808
- C:\Windows\System\KBKkYck.exe
  C:\Windows\System\KBKkYck.exe
  2⤵
  PID:8376
- C:\Windows\System\JvKqJpz.exe
  C:\Windows\System\JvKqJpz.exe
  2⤵
  PID:8268
- C:\Windows\System\xIUsQUE.exe
  C:\Windows\System\xIUsQUE.exe
  2⤵
  PID:8300
- C:\Windows\System\GuaAopM.exe
  C:\Windows\System\GuaAopM.exe
  2⤵
  PID:8360
- C:\Windows\System\CJONnZM.exe
  C:\Windows\System\CJONnZM.exe
  2⤵
  PID:8428
- C:\Windows\System\ZrxLuwr.exe
  C:\Windows\System\ZrxLuwr.exe
  2⤵
  PID:8480
- C:\Windows\System\ZyLhfrg.exe
  C:\Windows\System\ZyLhfrg.exe
  2⤵
  PID:8544
- C:\Windows\System\XhAwCOr.exe
  C:\Windows\System\XhAwCOr.exe
  2⤵
  PID:8464
- C:\Windows\System\RkXvdRP.exe
  C:\Windows\System\RkXvdRP.exe
  2⤵
  PID:8644
- C:\Windows\System\VZEyYQq.exe
  C:\Windows\System\VZEyYQq.exe
  2⤵
  PID:8468
- C:\Windows\System\OBFxPHe.exe
  C:\Windows\System\OBFxPHe.exe
  2⤵
  PID:8736
- C:\Windows\System\DkxumNs.exe
  C:\Windows\System\DkxumNs.exe
  2⤵
  PID:8628
- C:\Windows\System\DdgeVXW.exe
  C:\Windows\System\DdgeVXW.exe
  2⤵
  PID:8772
- C:\Windows\System\hObJvZZ.exe
  C:\Windows\System\hObJvZZ.exe
  2⤵
  PID:8808
- C:\Windows\System\QlOehMw.exe
  C:\Windows\System\QlOehMw.exe
  2⤵
  PID:8720
- C:\Windows\System\NamHSFZ.exe
  C:\Windows\System\NamHSFZ.exe
  2⤵
  PID:8756
- C:\Windows\System\UQuOVwk.exe
  C:\Windows\System\UQuOVwk.exe
  2⤵
  PID:8752
- C:\Windows\System\DJcFfrA.exe
  C:\Windows\System\DJcFfrA.exe
  2⤵
  PID:8824
- C:\Windows\System\BzUzynr.exe
  C:\Windows\System\BzUzynr.exe
  2⤵
  PID:8872
- C:\Windows\System\AVVVoID.exe
  C:\Windows\System\AVVVoID.exe
  2⤵
  PID:8888
- C:\Windows\System\AgFRsak.exe
  C:\Windows\System\AgFRsak.exe
  2⤵
  PID:8936
- C:\Windows\System\PDEXVNb.exe
  C:\Windows\System\PDEXVNb.exe
  2⤵
  PID:9000
- C:\Windows\System\LQtorqX.exe
  C:\Windows\System\LQtorqX.exe
  2⤵
  PID:9044
- C:\Windows\System\wCIFnoX.exe
  C:\Windows\System\wCIFnoX.exe
  2⤵
  PID:9020
- C:\Windows\System\CWTzJzT.exe
  C:\Windows\System\CWTzJzT.exe
  2⤵
  PID:9064
- C:\Windows\System\XrzVdVG.exe
  C:\Windows\System\XrzVdVG.exe
  2⤵
  PID:9080
- C:\Windows\System\FkKYfNm.exe
  C:\Windows\System\FkKYfNm.exe
  2⤵
  PID:9128
- C:\Windows\System\xDcJkns.exe
  C:\Windows\System\xDcJkns.exe
  2⤵
  PID:9144
- C:\Windows\System\oteMtXT.exe
  C:\Windows\System\oteMtXT.exe
  2⤵
  PID:9108
- C:\Windows\System\kcrjPYu.exe
  C:\Windows\System\kcrjPYu.exe
  2⤵
  PID:9184
- C:\Windows\System\pRVpcYw.exe
  C:\Windows\System\pRVpcYw.exe
  2⤵
  PID:8280
- C:\Windows\System\gIvvZAK.exe
  C:\Windows\System\gIvvZAK.exe
  2⤵
  PID:7232
- C:\Windows\System\MavlOUI.exe
  C:\Windows\System\MavlOUI.exe
  2⤵
  PID:8072
- C:\Windows\System\qavToAK.exe
  C:\Windows\System\qavToAK.exe
  2⤵
  PID:8136
- C:\Windows\System\RADnexL.exe
  C:\Windows\System\RADnexL.exe
  2⤵
  PID:8444
- C:\Windows\System\JVPjUfS.exe
  C:\Windows\System\JVPjUfS.exe
  2⤵
  PID:8296
- C:\Windows\System\zOsyyvb.exe
  C:\Windows\System\zOsyyvb.exe
  2⤵
  PID:8580
- C:\Windows\System\uEbWAtr.exe
  C:\Windows\System\uEbWAtr.exe
  2⤵
  PID:8640
- C:\Windows\System\NyMYXbQ.exe
  C:\Windows\System\NyMYXbQ.exe
  2⤵
  PID:8740
- C:\Windows\System\ULyJXux.exe
  C:\Windows\System\ULyJXux.exe
  2⤵
  PID:8592
- C:\Windows\System\ZcZiwHR.exe
  C:\Windows\System\ZcZiwHR.exe
  2⤵
  PID:8768
- C:\Windows\System\udjDcOu.exe
  C:\Windows\System\udjDcOu.exe
  2⤵
  PID:8692
- C:\Windows\System\TjDQSJe.exe
  C:\Windows\System\TjDQSJe.exe
  2⤵
  PID:8972
- C:\Windows\System\qLXxVcd.exe
  C:\Windows\System\qLXxVcd.exe
  2⤵
  PID:8920
- C:\Windows\System\NHjcHgV.exe
  C:\Windows\System\NHjcHgV.exe
  2⤵
  PID:9136
- C:\Windows\System\cdmeTFP.exe
  C:\Windows\System\cdmeTFP.exe
  2⤵
  PID:9032
- C:\Windows\System\jMkHGCM.exe
  C:\Windows\System\jMkHGCM.exe
  2⤵
  PID:9140
- C:\Windows\System\vZkWPjf.exe
  C:\Windows\System\vZkWPjf.exe
  2⤵
  PID:9104
- C:\Windows\System\iQnwsGS.exe
  C:\Windows\System\iQnwsGS.exe
  2⤵
  PID:9208
- C:\Windows\System\dUcRjxj.exe
  C:\Windows\System\dUcRjxj.exe
  2⤵
  PID:9228
- C:\Windows\System\fhwRStN.exe
  C:\Windows\System\fhwRStN.exe
  2⤵
  PID:9260
- C:\Windows\System\HngXsgB.exe
  C:\Windows\System\HngXsgB.exe
  2⤵
  PID:9276
- C:\Windows\System\GCZpXEb.exe
  C:\Windows\System\GCZpXEb.exe
  2⤵
  PID:9292
- C:\Windows\System\yTzDJCr.exe
  C:\Windows\System\yTzDJCr.exe
  2⤵
  PID:9308
- C:\Windows\System\msGqWFJ.exe
  C:\Windows\System\msGqWFJ.exe
  2⤵
  PID:9332
- C:\Windows\System\YbhnDzN.exe
  C:\Windows\System\YbhnDzN.exe
  2⤵
  PID:9348
- C:\Windows\System\KSMoNFy.exe
  C:\Windows\System\KSMoNFy.exe
  2⤵
  PID:9364
- C:\Windows\System\bgrqGjO.exe
  C:\Windows\System\bgrqGjO.exe
  2⤵
  PID:9380
- C:\Windows\System\CpILHdh.exe
  C:\Windows\System\CpILHdh.exe
  2⤵
  PID:9400
- C:\Windows\System\vWeEheT.exe
  C:\Windows\System\vWeEheT.exe
  2⤵
  PID:9416
- C:\Windows\System\gDsVITP.exe
  C:\Windows\System\gDsVITP.exe
  2⤵
  PID:9432
- C:\Windows\System\WSxcrOx.exe
  C:\Windows\System\WSxcrOx.exe
  2⤵
  PID:9448
- C:\Windows\System\bPQcgzq.exe
  C:\Windows\System\bPQcgzq.exe
  2⤵
  PID:9464
- C:\Windows\System\pdIQqfB.exe
  C:\Windows\System\pdIQqfB.exe
  2⤵
  PID:9480
- C:\Windows\System\lgDWwAQ.exe
  C:\Windows\System\lgDWwAQ.exe
  2⤵
  PID:9496
- C:\Windows\System\TgfpawR.exe
  C:\Windows\System\TgfpawR.exe
  2⤵
  PID:9512
- C:\Windows\System\qlKgGSX.exe
  C:\Windows\System\qlKgGSX.exe
  2⤵
  PID:9528
- C:\Windows\System\arVMRHF.exe
  C:\Windows\System\arVMRHF.exe
  2⤵
  PID:9544
- C:\Windows\System\McVJHAk.exe
  C:\Windows\System\McVJHAk.exe
  2⤵
  PID:9560
- C:\Windows\System\RPzlVEZ.exe
  C:\Windows\System\RPzlVEZ.exe
  2⤵
  PID:9576
- C:\Windows\System\kCTmeyh.exe
  C:\Windows\System\kCTmeyh.exe
  2⤵
  PID:9592
- C:\Windows\System\NoqQrBw.exe
  C:\Windows\System\NoqQrBw.exe
  2⤵
  PID:9612
- C:\Windows\System\XrtgkPt.exe
  C:\Windows\System\XrtgkPt.exe
  2⤵
  PID:9628
- C:\Windows\System\JzsuoHg.exe
  C:\Windows\System\JzsuoHg.exe
  2⤵
  PID:9656
- C:\Windows\System\WrfQwoP.exe
  C:\Windows\System\WrfQwoP.exe
  2⤵
  PID:9672
- C:\Windows\System\MvasyDM.exe
  C:\Windows\System\MvasyDM.exe
  2⤵
  PID:9688
- C:\Windows\System\OkELSXl.exe
  C:\Windows\System\OkELSXl.exe
  2⤵
  PID:9704
- C:\Windows\System\YZGKNsd.exe
  C:\Windows\System\YZGKNsd.exe
  2⤵
  PID:9720
- C:\Windows\System\JlItjLS.exe
  C:\Windows\System\JlItjLS.exe
  2⤵
  PID:9744
- C:\Windows\System\NcVPJPI.exe
  C:\Windows\System\NcVPJPI.exe
  2⤵
  PID:9760
- C:\Windows\System\uWFSpRy.exe
  C:\Windows\System\uWFSpRy.exe
  2⤵
  PID:9776
- C:\Windows\System\YbEDEBA.exe
  C:\Windows\System\YbEDEBA.exe
  2⤵
  PID:9796
- C:\Windows\System\TvfYmuj.exe
  C:\Windows\System\TvfYmuj.exe
  2⤵
  PID:9888
- C:\Windows\System\XYPEkBe.exe
  C:\Windows\System\XYPEkBe.exe
  2⤵
  PID:9904
- C:\Windows\System\MqYeSwJ.exe
  C:\Windows\System\MqYeSwJ.exe
  2⤵
  PID:9920
- C:\Windows\System\QIqtJtW.exe
  C:\Windows\System\QIqtJtW.exe
  2⤵
  PID:9936
- C:\Windows\System\JyntGZn.exe
  C:\Windows\System\JyntGZn.exe
  2⤵
  PID:9952
- C:\Windows\System\tNeMoJI.exe
  C:\Windows\System\tNeMoJI.exe
  2⤵
  PID:9968
- C:\Windows\System\GDhNvmb.exe
  C:\Windows\System\GDhNvmb.exe
  2⤵
  PID:9984
- C:\Windows\System\NkDkgSS.exe
  C:\Windows\System\NkDkgSS.exe
  2⤵
  PID:10000
- C:\Windows\System\XJmtcUG.exe
  C:\Windows\System\XJmtcUG.exe
  2⤵
  PID:10016
- C:\Windows\System\ybTQjSf.exe
  C:\Windows\System\ybTQjSf.exe
  2⤵
  PID:10032
- C:\Windows\System\nHxbwIq.exe
  C:\Windows\System\nHxbwIq.exe
  2⤵
  PID:10048
- C:\Windows\System\ewQSJyz.exe
  C:\Windows\System\ewQSJyz.exe
  2⤵
  PID:10064
- C:\Windows\System\TorFSou.exe
  C:\Windows\System\TorFSou.exe
  2⤵
  PID:10080
- C:\Windows\System\FgmaSeG.exe
  C:\Windows\System\FgmaSeG.exe
  2⤵
  PID:10096
- C:\Windows\System\GyuUHij.exe
  C:\Windows\System\GyuUHij.exe
  2⤵
  PID:10112
- C:\Windows\System\nTiCtzv.exe
  C:\Windows\System\nTiCtzv.exe
  2⤵
  PID:10128
- C:\Windows\System\EItqbHr.exe
  C:\Windows\System\EItqbHr.exe
  2⤵
  PID:10144
- C:\Windows\System\BKMelJl.exe
  C:\Windows\System\BKMelJl.exe
  2⤵
  PID:10160
- C:\Windows\System\uGfvoNL.exe
  C:\Windows\System\uGfvoNL.exe
  2⤵
  PID:10176
- C:\Windows\System\CszBPDA.exe
  C:\Windows\System\CszBPDA.exe
  2⤵
  PID:10192
- C:\Windows\System\RPbTYJV.exe
  C:\Windows\System\RPbTYJV.exe
  2⤵
  PID:10208
- C:\Windows\System\coFgSNv.exe
  C:\Windows\System\coFgSNv.exe
  2⤵
  PID:10224
- C:\Windows\System\gaaLblk.exe
  C:\Windows\System\gaaLblk.exe
  2⤵
  PID:1248
- C:\Windows\System\bheNyjg.exe
  C:\Windows\System\bheNyjg.exe
  2⤵
  PID:8576
- C:\Windows\System\fZLgMAu.exe
  C:\Windows\System\fZLgMAu.exe
  2⤵
  PID:8676
- C:\Windows\System\JMOBKlF.exe
  C:\Windows\System\JMOBKlF.exe
  2⤵
  PID:8788
- C:\Windows\System\faQlYsy.exe
  C:\Windows\System\faQlYsy.exe
  2⤵
  PID:9096
- C:\Windows\System\YrNuQnR.exe
  C:\Windows\System\YrNuQnR.exe
  2⤵
  PID:9272
- C:\Windows\System\XsLuoRX.exe
  C:\Windows\System\XsLuoRX.exe
  2⤵
  PID:9344
- C:\Windows\System\nAdifGu.exe
  C:\Windows\System\nAdifGu.exe
  2⤵
  PID:8660
- C:\Windows\System\EzgZwVk.exe
  C:\Windows\System\EzgZwVk.exe
  2⤵
  PID:9440
- C:\Windows\System\sBwGbXu.exe
  C:\Windows\System\sBwGbXu.exe
  2⤵
  PID:9504
- C:\Windows\System\fAHVWAr.exe
  C:\Windows\System\fAHVWAr.exe
  2⤵
  PID:9568
- C:\Windows\System\dqfpFOO.exe
  C:\Windows\System\dqfpFOO.exe
  2⤵
  PID:9608
- C:\Windows\System\eZgBLhE.exe
  C:\Windows\System\eZgBLhE.exe
  2⤵
  PID:9644
- C:\Windows\System\GFruWzZ.exe
  C:\Windows\System\GFruWzZ.exe
  2⤵
  PID:9712
- C:\Windows\System\hLUdzzm.exe
  C:\Windows\System\hLUdzzm.exe
  2⤵
  PID:9784
- C:\Windows\System\HMTBecz.exe
  C:\Windows\System\HMTBecz.exe
  2⤵
  PID:8216
- C:\Windows\System\zumFpsM.exe
  C:\Windows\System\zumFpsM.exe
  2⤵
  PID:9700
- C:\Windows\System\CTfeOqy.exe
  C:\Windows\System\CTfeOqy.exe
  2⤵
  PID:8220
- C:\Windows\System\BOHJZeE.exe
  C:\Windows\System\BOHJZeE.exe
  2⤵
  PID:8452
- C:\Windows\System\VEUkWHy.exe
  C:\Windows\System\VEUkWHy.exe
  2⤵
  PID:8904
- C:\Windows\System\iJNMTlt.exe
  C:\Windows\System\iJNMTlt.exe
  2⤵
  PID:9120
- C:\Windows\System\qtGTXIv.exe
  C:\Windows\System\qtGTXIv.exe
  2⤵
  PID:9204
- C:\Windows\System\EtbAPsq.exe
  C:\Windows\System\EtbAPsq.exe
  2⤵
  PID:9248
- C:\Windows\System\fRNQPaF.exe
  C:\Windows\System\fRNQPaF.exe
  2⤵
  PID:9288
- C:\Windows\System\oEteCqO.exe
  C:\Windows\System\oEteCqO.exe
  2⤵
  PID:9328
- C:\Windows\System\zoXXgTP.exe
  C:\Windows\System\zoXXgTP.exe
  2⤵
  PID:9392
- C:\Windows\System\mwoDucY.exe
  C:\Windows\System\mwoDucY.exe
  2⤵
  PID:9456
- C:\Windows\System\FEYHfGu.exe
  C:\Windows\System\FEYHfGu.exe
  2⤵
  PID:9520
- C:\Windows\System\DhqcrdN.exe
  C:\Windows\System\DhqcrdN.exe
  2⤵
  PID:9584
- C:\Windows\System\FwlRhOi.exe
  C:\Windows\System\FwlRhOi.exe
  2⤵
  PID:9664
- C:\Windows\System\stZnxPT.exe
  C:\Windows\System\stZnxPT.exe
  2⤵
  PID:9740
- C:\Windows\System\qLdygTY.exe
  C:\Windows\System\qLdygTY.exe
  2⤵
  PID:9808
- C:\Windows\System\VnyrJNK.exe
  C:\Windows\System\VnyrJNK.exe
  2⤵
  PID:9824
- C:\Windows\System\TQqvYeD.exe
  C:\Windows\System\TQqvYeD.exe
  2⤵
  PID:9852
- C:\Windows\System\NmxZGxr.exe
  C:\Windows\System\NmxZGxr.exe
  2⤵
  PID:9860
- C:\Windows\System\XtNOYak.exe
  C:\Windows\System\XtNOYak.exe
  2⤵
  PID:9896
- C:\Windows\System\KbShnQF.exe
  C:\Windows\System\KbShnQF.exe
  2⤵
  PID:9960
- C:\Windows\System\aKgWoOF.exe
  C:\Windows\System\aKgWoOF.exe
  2⤵
  PID:10024
- C:\Windows\System\kkBsVUI.exe
  C:\Windows\System\kkBsVUI.exe
  2⤵
  PID:9944
- C:\Windows\System\ZIssqkH.exe
  C:\Windows\System\ZIssqkH.exe
  2⤵
  PID:9976
- C:\Windows\System\gOFIaZc.exe
  C:\Windows\System\gOFIaZc.exe
  2⤵
  PID:10056
- C:\Windows\System\yAJoscl.exe
  C:\Windows\System\yAJoscl.exe
  2⤵
  PID:10076
- C:\Windows\System\WUeTcAC.exe
  C:\Windows\System\WUeTcAC.exe
  2⤵
  PID:10104
- C:\Windows\System\jZnvpbl.exe
  C:\Windows\System\jZnvpbl.exe
  2⤵
  PID:10156
- C:\Windows\System\ljzkYDP.exe
  C:\Windows\System\ljzkYDP.exe
  2⤵
  PID:10188
- C:\Windows\System\pmoVvXD.exe
  C:\Windows\System\pmoVvXD.exe
  2⤵
  PID:10236
- C:\Windows\System\lSIihtA.exe
  C:\Windows\System\lSIihtA.exe
  2⤵
  PID:8232
- C:\Windows\System\OhMZaCH.exe
  C:\Windows\System\OhMZaCH.exe
  2⤵
  PID:8560
- C:\Windows\System\xSIsmBh.exe
  C:\Windows\System\xSIsmBh.exe
  2⤵
  PID:9304
- C:\Windows\System\kVCmJfW.exe
  C:\Windows\System\kVCmJfW.exe
  2⤵
  PID:8988
- C:\Windows\System\CnfMGfN.exe
  C:\Windows\System\CnfMGfN.exe
  2⤵
  PID:9476
- C:\Windows\System\cLdiehe.exe
  C:\Windows\System\cLdiehe.exe
  2⤵
  PID:9536
- C:\Windows\System\YdveSOm.exe
  C:\Windows\System\YdveSOm.exe
  2⤵
  PID:9788
- C:\Windows\System\YRyMdja.exe
  C:\Windows\System\YRyMdja.exe
  2⤵
  PID:8316
- C:\Windows\System\eaLptZM.exe
  C:\Windows\System\eaLptZM.exe
  2⤵
  PID:8624
- C:\Windows\System\eFxLgnF.exe
  C:\Windows\System\eFxLgnF.exe
  2⤵
  PID:9284
- C:\Windows\System\JHmaCSV.exe
  C:\Windows\System\JHmaCSV.exe
  2⤵
  PID:9492
- C:\Windows\System\CPAhOgj.exe
  C:\Windows\System\CPAhOgj.exe
  2⤵
  PID:9804
- C:\Windows\System\KijPCEi.exe
  C:\Windows\System\KijPCEi.exe
  2⤵
  PID:9884
- C:\Windows\System\KLkrjxQ.exe
  C:\Windows\System\KLkrjxQ.exe
  2⤵
  PID:9428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BgDSuGF.exe

Filesize
2.2MB

MD5
7eccb9f3730fced6fc20809e427fa3ef

SHA1
2fb5f887b148279b11a859d368dc7ca7949d38a6

SHA256
1370089fc4a45f03a79d29fc084d63b03f533dee78391e0fde243d3c00a3b805

SHA512
915ab852a28b2fb631e73a62931030cd53171695e8ba46a9f81d5accdf5393e6d4eb5cdf1a3d104f1898fb2817c6816ae380849bdf1991f5658e6cdb4f860362

Download Submit
C:\Windows\system\COcEOSj.exe

Filesize
2.2MB

MD5
29ad251ef9105158eefa95730a197bbf

SHA1
e73a14f6a7090a713ecda68b7a68387e506342d0

SHA256
8d8a71e21227b99519298cfbc229daae855f2d508de3f3d56702c25485253af2

SHA512
5c7eeb7ee41dc553fd143210b7dc83d4f204f1cdda73e813f1715b9def25a166baaa4765bc961167237983dff5b395a0ca8ed70ed726a904024fa5257b814a20

Download Submit
C:\Windows\system\JElqJjJ.exe

Filesize
2.2MB

MD5
48c25944ff35461790e0db3225787b7d

SHA1
6515a7bf36c541bdf00f672d2084dcb0f5455bcf

SHA256
ad5d3a39b14bc28cbd11cb01e276eaa91acf38adafe7dc6d60c3546e4db23cea

SHA512
c4ffcbc5450c7debf25d68a10a36537f731354de05bba2315fdd302b8e623fcf72450c2cdba4a8a0addcfaf04eaa1cbded2a05c8366d586c01175c7b26aa5640

Download Submit
C:\Windows\system\KcsRgyM.exe

Filesize
2.2MB

MD5
b828b72679e808689ab905a9f5db5b61

SHA1
4cc317f5ec64e18cb23004aca9a18a350ad3a6e9

SHA256
086a546ba79639af09041244ff6c48f38301713e2c42a4163b7264f42ff559c0

SHA512
89a8c7e5098d4fb043a1ab69f0ed37be07e9d579239c9ad35608e7152a14e0a3c0d86d557f30030b6399caa85a0fe23542623beff39dbf76b05a8faf238d5121

Download Submit
C:\Windows\system\KkdHsBs.exe

Filesize
2.2MB

MD5
59a0e0429bb0677323827382da791770

SHA1
0f5628c254d364852dd274d6222461710c5c5b39

SHA256
4b5db175181e00139ac031c4615a7a866d8dd0c9d637b11ab91286256766340a

SHA512
63026a0de3403cdba61c0978d140b91ed6b67ec20e4f88273be0345e2b3d4b109f2848dab5fd249c7a126b9075e82b948adec4218b40343dd23ba1bd1e5648ec

Download Submit
C:\Windows\system\MTtubsI.exe

Filesize
2.2MB

MD5
07ced42721efdfc4cfaf0b8637f8b7c0

SHA1
bfa207dadb82452e20a109c0b326360794821e18

SHA256
fb433835e80a3fe912f9eeba4e4fd7b7b5093c8f5af1a7fe212eda57d54e6edc

SHA512
f7e07138fecac985015db69d263c08b12b1f3b982dd7fe869759295acaa5bdae8e3ea1e6cb3a55d602b5c7b39cb59091b13148392db4ff19e1e9d74baccffbb3

Download Submit
C:\Windows\system\NHbajWZ.exe

Filesize
2.2MB

MD5
e3e633c4edb95b117a31e82b6d4265de

SHA1
9aa92b4e1222f93937a102fede31dafbd52d8dd0

SHA256
b00029d3ce8cc850f32fa18de4775ee062f0e381e58c1759831f0666218ff06a

SHA512
77477bb6b283a5660fb4f988e09739b8d1833aa601e56cd3a7f8bfe3b07168a2b9d0632b1c6935a2cf0b1c70fcd685ee954c99375fee94f3d8996143936dc56f

Download Submit
C:\Windows\system\PpdRgra.exe

Filesize
2.2MB

MD5
f51f8c40c61487aad8999b40d29e3a66

SHA1
028dfe26a0046ab46917a75155f04cbdf41b1045

SHA256
29225eb582572762feaf64a59cf584cb640472794d202a637ff046d6ce8a61ae

SHA512
65af7062cf681df6245191c59db2f06b4f29065792d296d1caad8d27617bc066507c0d0163b0f04eb85122c61a018a8dd13a9fb23ac342832bdcffcd3d08fc3b

Download Submit
C:\Windows\system\SfnlqfJ.exe

Filesize
2.2MB

MD5
325015681064a0c1b30b3c261679c498

SHA1
88cc94f8fb950cee1eb86e4a84747f189653a3a4

SHA256
338a219ac63cbbab314c0baa8bee1f3c43e2df14dfab547c0ff31c35033d3b1b

SHA512
b4979583d9b8ee884e16c0bc66768d60a7bbf4fe56ed640728d8bdaad03683e8b7753a6e41738812a6cb7a71ed135f924ed852685304f89540ec59a36a77f29c

Download Submit
C:\Windows\system\TieQCIc.exe

Filesize
2.2MB

MD5
8dbc37bde6817e5d75e0eec3c1d68281

SHA1
36d56c8e7b74a9ab10482b224184a1d001a5c5f4

SHA256
9ad5642103552ba8788734677b0dbfe37ab2af5986d058c3943e1deea4fbb84c

SHA512
ec8afffad7b810a2d2665f499fb150470edede746c61debdb417a72a032e7ff69a1ec04a6ed5155ccbd274b1b9cd5cc83123dc26a991ae3907cd7af5946eb699

Download Submit
C:\Windows\system\XCeBQFw.exe

Filesize
2.2MB

MD5
bf26d2acdb823f119ce87a46a2c0e84a

SHA1
8974d888432e88f8fa16362d21254ea03703f3b1

SHA256
67c9eaa5f7f23da5c765de30688654674d7dcde9a2dd281f874d223e2b2ba33f

SHA512
4d9812bce956ad189c5fddab3babd4b9be273863adc6dd0a662a7659e8ff040a9d18d0982107342612b5c823be9b13557445f986c4a42aeb12b49bdc2f65667e

Download Submit
C:\Windows\system\ZrZMYFI.exe

Filesize
2.2MB

MD5
948362da0f6bcce32a8cb682777b717a

SHA1
e07c0df714b527338916effd8769d3255d1a6475

SHA256
392668294e75cb8cd87e8499a2a5889f8e459fa89ac2106425fa5ca04360a2be

SHA512
8bb08267093fc175dae0513c6e92b8ba253dd51688d3b82fe695679ddeb2875d6d5439b75573d6ef28b0eb768717ba6f5923d94199a8df64417648a67222ca82

Download Submit
C:\Windows\system\cOQQqvY.exe

Filesize
2.2MB

MD5
f2ab95cad9ae4ce37afa8e8f86d8a40a

SHA1
3c4ecb1cbd53df0f13ead39b394d10f30356fd92

SHA256
b39e283073aae83b2e1c8f9c851b97921ec4934abede0975bea0e41b58b935a3

SHA512
7e2538e7640dfdb92f9a58fa0f58ebb9282be9142a543f7692752e0dae170fed6961629a0c296f042aa087fb4d7827f1968ed1314fdb526fe256bbe92762160c

Download Submit
C:\Windows\system\dEgKXVV.exe

Filesize
2.2MB

MD5
d9d85d2c7c745a9b59b7331f9d8bcadc

SHA1
8543ee6612fb6068e21b4d00f0c60ba586fe1a00

SHA256
51807a12d99fe711a85c00b3e644b833771b2ce0465e63be508aac42d4467ebb

SHA512
6bfd4596008f305f128ad4f851539ea253dc2b0e09528d05375f2d2728c369227d4f5d45ed7b330a94dfd780137300365473b6526aecf74c88b24ba92aac0803

Download Submit
C:\Windows\system\edJGnWI.exe

Filesize
2.2MB

MD5
d60480f127661b9c5853af157a0cb5d7

SHA1
7c78b27bc145150fe299890181bc915d75981530

SHA256
758b11614840e851dd272f7993d8a139ee6331f2e07ad02ded05b932a197a876

SHA512
fb0daba157ecfe2c66b3edb0644f2dbcbd50aac7153e9daa37caae13318ed9179cc8da29cfe53e722a4dc6a04ef7077ce7985cf6d84dd1d82e12de1fe762b626

Download Submit
C:\Windows\system\lclWRSW.exe

Filesize
2.2MB

MD5
bdf8af058c2093635adfff4af97659bd

SHA1
a3234c53da9443f245d8307dfe11bf3f7d92a0ec

SHA256
1e79dfbc9252ba6b10a06785dfdd3b32096fb7e4435efd69c212d6b4d108c902

SHA512
a215b0309042bb6c96ee0250b0e2b9327367cfa754c78466f599b7f822ebb01126bff4a87ceed18f7663aab0b7640e5789ef30265c63bdedb621f3810966404a

Download Submit
C:\Windows\system\okuzjdP.exe

Filesize
2.2MB

MD5
c469a629a9afd5c315c436ab72513869

SHA1
e3771195e57678a246a5ab3b6b0f43afc33fe8a4

SHA256
36fe6eba1a2fa758b59ba48bcdacb130132a0603f60f297dbd5a02ea9f1d0e5c

SHA512
0b3e14bd44514e108e5dbccb9d06302538fa8f0799d0881027f6219d629ce617b7562941d2b2e3570da707ce8a8de956e1e9ddcb2c9e8ec2da87899118290551

Download Submit
C:\Windows\system\pgCquTZ.exe

Filesize
2.2MB

MD5
03e3410092acfe9b01a96aee67252f86

SHA1
f740ae4fde7b6bcce04f80e1a8fd573a50fbfa2d

SHA256
919ebcd7ea600a5a9ec4e38d377a53bc1f61955a03f5c2aede325e975e06cad6

SHA512
aeb6e8dbb4bb22372eeebb23889a4a2adaf013a6546dd77f50cea6cf57304fa285e35d882813f829f19828de988956f98f33074d912c63c7107df7fac56c7717

Download Submit
C:\Windows\system\sEkchGQ.exe

Filesize
2.2MB

MD5
f2b6097610a257d9c430c0cc15a43bcd

SHA1
82bc312c3804675018ea292ba0231a1a802503fc

SHA256
6b0c9aa093ca0f63c46ae0df1746b4116e723d5a9e816c99043057b4d04ba241

SHA512
f92316b70d495a31dd319c0dbb2a02eb42e1a6b39ec35a74abb7e56b5ff645d7511f13499564a9e31c30ca8b3b148336490a3b0115cf25763ac056f2172fd75b

Download Submit
C:\Windows\system\sfEIADo.exe

Filesize
2.2MB

MD5
af50e5540a502c45a45783795cbb5176

SHA1
779708bcec4066456d1425108e7ddbdc336e22a7

SHA256
d14db8f7e2aaa5eebef229164d0b813424e2fbe069f92d039650fb371bc13b41

SHA512
19949ae34175d6e382105f21db2e28284d5f0ddfebe34046d623b4c59410c7d812156e3345cf046d8f2eb343bf74c95e4be5677337653f3d7ae7c17614190388

Download Submit
C:\Windows\system\tDQxRSH.exe

Filesize
2.2MB

MD5
4983219f8829afa1740a02035925a380

SHA1
72f0aad52fa9c0e31ff9b33542695a6c7cb8793d

SHA256
67074ed6c20b4dd3fce3f1cc4549f5cb9e4f5314cc5e05742fe359430305129a

SHA512
105dd58704d958f80fd5fdce29f64cf8da3af880760fd9e02d8f80e9bb61c09742e4ab3b4634824b64bff5af6082ab39f002719a9ee41a425551e94e0bac0579

Download Submit
C:\Windows\system\tJXYhnU.exe

Filesize
18B

MD5
12d764af0242c5e9d5789b2b47191cab

SHA1
27c955d8895a3dd74067d2c8c2ddd4db89461025

SHA256
22fad68840942c3468f5bd85214408fef29e825f9fa4402f948647dd9bfcfbbf

SHA512
345f6542208a71772d6f12acd8a7a946bff3a5b0364922fdfdbb97f70b74edd2676762bb63e6f4b3817ce1c84a3d722837cfba2c47e6d30027d13c7c41912d58

Download Submit
C:\Windows\system\tZHuaqY.exe

Filesize
2.2MB

MD5
b9fa37d0f33c3b9fda6cf6303fd0e55c

SHA1
4a0d1c5daa288c0affbfe733733b4b08af2fe8f3

SHA256
be7851a28ff7886e2b84317e92aa2a9969e9e746c5e769f5f2f0a0cd4cebecf3

SHA512
636398386bd914eebd5ce46f2dcecc1e001929ab64b76c0677ba9b21bd0e572338b0d21a08c7dbc883845eefbd17286466ad4cf813d6014a986e896f0c9adf03

Download Submit
C:\Windows\system\uhXmGbO.exe

Filesize
2.2MB

MD5
574faf1f403d1da211b032d844a62823

SHA1
95c340de9f1cbf886fe5c928028175f6c9afd258

SHA256
ab9230f7e2d42fdc48addabb2d82623406f2114f980baff876c1ca2ee38b0b86

SHA512
63bc36315cf61282cfe14306649dc5ec997fc1ee7137c20e31a8e91e1cdab668f5ce3d0ba91223f951f99d58f2bf7112bbb83db4ff437d8226c6e3a27db425b2

Download Submit
C:\Windows\system\wRJucqF.exe

Filesize
2.2MB

MD5
5e3a3c57d74dbaecde7c1d88b3ae6059

SHA1
42c988b9f8ce12c4341b2a56dbe889ae3fbaa45e

SHA256
3d16001e692e0bf0fd67e93e24db9dc4800c4c27cfd20dc57437938b7f5bf32d

SHA512
31b6bd653602138687e39f4ccc1b8342c5079236fd045b32a98faddba2ffbd1765a9f3c2ea9cebb83e0047eb369bd76716d1d84f96917bbba11036c6d973aa2b

Download Submit
C:\Windows\system\ydGNFOt.exe

Filesize
2.2MB

MD5
b97b0015fea4ab290d418938a38b6524

SHA1
a1f7aa019de219aebd9e42da44a026f8eaa0ddbb

SHA256
7a030637f59f74888e533b15c61c04eb908b25255e77e684b70a33a38477cf97

SHA512
41c754fe2fdd5b29eb8b982680cc3e8f5ef4b0ae0cea8a4056452787e8ed61b4b6e42a2eb690a9256877ff7660ae8294b55184a9c63b0f99e81b01899a55f214

Download Submit
C:\Windows\system\zkqLyby.exe

Filesize
2.2MB

MD5
9de7c69ab312eba39a09906105f8f32a

SHA1
d30081fee143db4e75f8c1b9e04a18572f9dbf81

SHA256
54889b0e797bf3e2db242b5b1e83642c1087f9bfe61c313cc260a21030536a07

SHA512
e5fb6f6f0300b1bf796f140ff48181b835605f652f67a4d51b01bc8f335b74f01715425ba206ca669cfc1a1c31120d1cdf001b19581ed53b916c8a41bef19acd

Download Submit
\Windows\system\GGRzBdO.exe

Filesize
2.2MB

MD5
06f028b92573ef8dd40dbddef6f83955

SHA1
fd30c34c7d1b12906514e9b9e0298a7e6861fd75

SHA256
7a7e78a42a39518783007affa8caae0616ad42e591ce1e70604993ab499c5388

SHA512
81e3437f6c128baf3a25fb4eaa863178336e4166a3c109b1d160a2c0a624cf18a8737b1f9b0feaaa502a1329aa516b75a829068d07924ee255d131c182bb2e82

Download Submit
\Windows\system\NWnKAby.exe

Filesize
2.2MB

MD5
dc08ef03a74f871a2ea00eece47122f8

SHA1
7442856d5a38ae4eed757f05e9c46f1fae949b75

SHA256
3587f9a019641b31eb22da10e89126ced8df5eed118a3079e15cab5d10f46cce

SHA512
3e81d253f32a1f678c10c48a119b292eda51bd9aaa42697286a3c09c5a3082ce5d31e2c049d9eae7b9a3e409450c13c4a17355c61a41eab45017721cf0dba4cb

Download Submit
\Windows\system\TqrHxem.exe

Filesize
2.2MB

MD5
5c0a95207db0714023225af33e4ba17f

SHA1
5c0ff38f54dba9300df48665e2d743bcfc1c2fca

SHA256
c55fe34f1be2a73f38ead5d186ca4fede534918408ef1d09310c9273963f5899

SHA512
5bb5313860fab18309361cd7d286f6aecbb22da5398d65021c7f0398a9de4712ecf0aa92821b0929d8b143677c9612454f9345dc3cefa68736cf5456b2bd41cd

Download Submit
\Windows\system\aLHjgnG.exe

Filesize
2.2MB

MD5
d3a8514aea0081d04ef022addd22c6f6

SHA1
336a3f6067041eb50af7352d6eb7c96e0875b82f

SHA256
0af20862fc05622a7fdabb0ce4180c47c899b30825bd850294df47a948f3e85d

SHA512
e8402a089c08a1d4abe6fa6b29ffdeb8af568f8e356fad94e6adffcaa40d53759729143c356ad57a4b67cf4f532d580ed7efcbbd93076dd03a80a0f2c0c74ab3

Download Submit
\Windows\system\nuSBYmf.exe

Filesize
2.2MB

MD5
d99420e94fdb66f431d91040d694c8c2

SHA1
fadbb4e0843d473b5aad0115fc3227b6ca45bed7

SHA256
3699a3df333f86fceb8d3e8eb59bd7696a77d161e354afc8482d05363398ac11

SHA512
9eba1cdebc68a37b43ed5018f032924d6e1dcb830452190462f89a4526db5e1090695e370cda75498a09c89b49f549250bafd3f7810aa11cd1d558f08eab0ee0

Download Submit
\Windows\system\oqSuGiu.exe

Filesize
2.2MB

MD5
17dee860fc17ef17aff7b9e22abfafe9

SHA1
217a3abc9874ca50aecd59b01a3954262662d8c7

SHA256
14e60da1260295a5a55a087de480b3b5c475a0cc84fd68f975b112789645331e

SHA512
8a248d34acaacea445f6465cf6178b8ee8c680870f7f64499d9fd76a02d6227ad3a2f1dcab29e0cd2068ade2b71e0a870aa0b67cb2c0659cdf69b2606f31d27a

Download Submit
\Windows\system\uODflTT.exe

Filesize
2.2MB

MD5
e1953aab4a80c034e1cf6a7a9e94414f

SHA1
06e08fccc87e3cc0d312d8415c240f1eb39d48ad

SHA256
3e21e41df2d2da1c527692c95eadea52c927adb68fc47fb51f7118de631f7ca0

SHA512
f36f582910be1cd4b7ac436ea8dbb6864fd94cff6a969f61b154c97a2eec9b184489304b9afb8e6b1658fc50a72aaf166082f49d536742677dcb5acc82294076

Download Submit
\Windows\system\uvJOLdt.exe

Filesize
2.2MB

MD5
fe7700ccc82838f31ac768a18873e41a

SHA1
b1457709c93fafdba8e83c5f32eddb80687b9c71

SHA256
dbf675573c54a8274326bcdaca9b735096cf31ee76881b030d8981851f8c6b31

SHA512
ee4a748aaf8bc855934f12e7fbdf7676c1d7ccafbbc2679a65dc617e3eae264c5f6a8b39f17a085f86cd9bdb1e57042f227763eb2c4ae8976ddaa7399578d9f7

Download Submit
\Windows\system\vtWfnis.exe

Filesize
2.2MB

MD5
7cf240dd470ad381f10fa169859620b5

SHA1
edb67cb5704979d151ab4ace6488b2659482f155

SHA256
db51496631f840f7c739665ba81d4c5a9bfdf2f9d39afd4c2d46f68a28c1db9a

SHA512
2708b76b31747f9544d2e0f538fd83221770f8b12f36b4a0664708861317a9326ec5d32eef404b140bd128f6b42697cc868afb8259903334a0ca036346027017

Download Submit
memory/620-223-0x0000000003700000-0x0000000003AF2000-memory.dmp

Filesize
3.9MB

Download
memory/620-215-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/620-0-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/620-213-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/620-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/620-218-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/620-230-0x0000000003100000-0x00000000034F2000-memory.dmp

Filesize
3.9MB

Download
memory/620-229-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/620-220-0x0000000003700000-0x0000000003AF2000-memory.dmp

Filesize
3.9MB

Download
memory/620-227-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/620-12-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/620-225-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-18-0x000007FEF570E000-0x000007FEF570F000-memory.dmp

Filesize
4KB

Download
memory/1948-505-0x000000001B810000-0x000000001BAF2000-memory.dmp

Filesize
2.9MB

Download
memory/1948-2700-0x000007FEF5450000-0x000007FEF5DED000-memory.dmp

Filesize
9.6MB

Download
memory/1948-760-0x0000000002870000-0x0000000002878000-memory.dmp

Filesize
32KB

Download
memory/1948-210-0x000007FEF5450000-0x000007FEF5DED000-memory.dmp

Filesize
9.6MB

Download
memory/1948-17-0x0000000002D00000-0x0000000002D80000-memory.dmp

Filesize
512KB

Download
memory/2248-212-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2248-5722-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2388-5744-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2388-16-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2604-226-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2604-5915-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-5713-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2612-221-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2664-228-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-5709-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-211-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-5721-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-219-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2708-5714-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2744-216-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-5914-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2792-217-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2792-5743-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2816-214-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/2816-5861-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/2892-224-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-5827-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2964-222-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download