xmrig | 6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 05:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
Size

3.1MB
MD5

9ac6ce6e5809cfbc15230ac7cdd24696
SHA1

59db6b3fb9f066c69260af0f81834d596775d882
SHA256

6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad
SHA512

189f24ce790ea2310827fdf6b923e76f23cb5e6f33887a75ef5d83a6f1cd818ddfc7bd515cea8aaf8e0e12348411c6cd14a3e96b8253cac8e13d94a0b4fc5746
SSDEEP

49152:EnCbL83y9FdfE0pZ0zCa4wI156uL3pgrCEdMKPFotsgEBr6GQ:EniLf9FdfE0pZB156utgpPFotBEC

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2172-0-0x000000013F670000-0x000000013F9C4000-memory.dmp	xmrig
behavioral1/files/0x000c000000012280-3.dat	xmrig
behavioral1/files/0x0008000000016875-11.dat	xmrig
behavioral1/memory/844-14-0x000000013F2B0000-0x000000013F604000-memory.dmp	xmrig
behavioral1/memory/2388-10-0x000000013F130000-0x000000013F484000-memory.dmp	xmrig
behavioral1/files/0x0008000000016b47-9.dat	xmrig
behavioral1/files/0x0008000000016c66-22.dat	xmrig
behavioral1/memory/2376-27-0x000000013F890000-0x000000013FBE4000-memory.dmp	xmrig
behavioral1/files/0x0007000000016c88-37.dat	xmrig
behavioral1/memory/2968-33-0x000000013F340000-0x000000013F694000-memory.dmp	xmrig
behavioral1/files/0x00090000000164b1-32.dat	xmrig
behavioral1/memory/2896-45-0x000000013FF40000-0x0000000140294000-memory.dmp	xmrig
behavioral1/files/0x0007000000016cd7-44.dat	xmrig
behavioral1/memory/1032-43-0x000000013FB00000-0x000000013FE54000-memory.dmp	xmrig
behavioral1/memory/2388-38-0x000000013F130000-0x000000013F484000-memory.dmp	xmrig
behavioral1/memory/2172-35-0x000000013F670000-0x000000013F9C4000-memory.dmp	xmrig
behavioral1/memory/2360-21-0x000000013F030000-0x000000013F384000-memory.dmp	xmrig
behavioral1/files/0x0007000000017049-55.dat	xmrig
behavioral1/files/0x0007000000016cf5-53.dat	xmrig
behavioral1/files/0x0006000000017497-66.dat	xmrig
behavioral1/files/0x00050000000186e7-83.dat	xmrig
behavioral1/memory/2984-75-0x000000013F5A0000-0x000000013F8F4000-memory.dmp	xmrig
behavioral1/files/0x000600000001755b-73.dat	xmrig
behavioral1/memory/2172-71-0x0000000002000000-0x0000000002354000-memory.dmp	xmrig
behavioral1/files/0x00050000000186f4-113.dat	xmrig
behavioral1/files/0x0005000000019360-190.dat	xmrig
behavioral1/memory/2764-1262-0x000000013F2C0000-0x000000013F614000-memory.dmp	xmrig
behavioral1/memory/2740-970-0x000000013F620000-0x000000013F974000-memory.dmp	xmrig
behavioral1/memory/2172-969-0x000000013F2C0000-0x000000013F614000-memory.dmp	xmrig
behavioral1/memory/2172-601-0x000000013FA10000-0x000000013FD64000-memory.dmp	xmrig
behavioral1/memory/2896-464-0x000000013FF40000-0x0000000140294000-memory.dmp	xmrig
behavioral1/memory/2172-339-0x000000013FF40000-0x0000000140294000-memory.dmp	xmrig
behavioral1/memory/1032-223-0x000000013FB00000-0x000000013FE54000-memory.dmp	xmrig
behavioral1/files/0x000500000001933f-185.dat	xmrig
behavioral1/files/0x0005000000019297-180.dat	xmrig
behavioral1/files/0x0005000000019284-175.dat	xmrig
behavioral1/files/0x0005000000019278-170.dat	xmrig
behavioral1/files/0x0005000000019269-165.dat	xmrig
behavioral1/files/0x0005000000019250-160.dat	xmrig
behavioral1/files/0x0005000000019246-155.dat	xmrig
behavioral1/files/0x0006000000018c16-150.dat	xmrig
behavioral1/files/0x0006000000018b4e-145.dat	xmrig
behavioral1/files/0x000500000001878e-135.dat	xmrig
behavioral1/files/0x00050000000187a8-140.dat	xmrig
behavioral1/files/0x0005000000018744-130.dat	xmrig
behavioral1/files/0x0005000000018739-125.dat	xmrig
behavioral1/files/0x0005000000018704-120.dat	xmrig
behavioral1/memory/2764-104-0x000000013F2C0000-0x000000013F614000-memory.dmp	xmrig
behavioral1/memory/2968-103-0x000000013F340000-0x000000013F694000-memory.dmp	xmrig
behavioral1/files/0x0005000000018686-102.dat	xmrig
behavioral1/memory/2824-100-0x000000013F0B0000-0x000000013F404000-memory.dmp	xmrig
behavioral1/files/0x000600000001749c-99.dat	xmrig
behavioral1/memory/2740-98-0x000000013F620000-0x000000013F974000-memory.dmp	xmrig
behavioral1/memory/2376-96-0x000000013F890000-0x000000013FBE4000-memory.dmp	xmrig
behavioral1/memory/2700-95-0x000000013F6B0000-0x000000013FA04000-memory.dmp	xmrig
behavioral1/memory/2172-92-0x0000000002000000-0x0000000002354000-memory.dmp	xmrig
behavioral1/memory/2956-90-0x000000013FAB0000-0x000000013FE04000-memory.dmp	xmrig
behavioral1/files/0x00050000000186ed-86.dat	xmrig
behavioral1/files/0x00050000000186f1-107.dat	xmrig
behavioral1/memory/2696-67-0x000000013FA10000-0x000000013FD64000-memory.dmp	xmrig
behavioral1/memory/2360-62-0x000000013F030000-0x000000013F384000-memory.dmp	xmrig
behavioral1/memory/2172-64-0x000000013FA10000-0x000000013FD64000-memory.dmp	xmrig
behavioral1/memory/2388-4012-0x000000013F130000-0x000000013F484000-memory.dmp	xmrig
behavioral1/memory/2376-4014-0x000000013F890000-0x000000013FBE4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2388	mspywlP.exe
844	QWhvyEM.exe
2360	IZdEIgK.exe
2376	vWxDdpx.exe
2968	ipLtPsX.exe
1032	PLOgkZK.exe
2896	CkUkfCQ.exe
2696	yirlots.exe
2956	smfwWfR.exe
2984	dUEcakR.exe
2700	ZCssgcK.exe
2740	QIbwCib.exe
2824	GjcHVtz.exe
2764	zpZQMwd.exe
1728	EhpfCIl.exe
2320	KoYtZKt.exe
556	cjLjeXZ.exe
1876	DNGvsHf.exe
1168	aVPiXbo.exe
1336	VqDqYOp.exe
1720	SNbRwjc.exe
1684	IAQPKIX.exe
2864	DQxumor.exe
2872	ynvWfzA.exe
2256	ociSdEI.exe
2252	mrJRqJD.exe
2456	ivUnYTz.exe
584	sZWPZlI.exe
1048	DhCuLYm.exe
1144	TCxFOdY.exe
2104	TemsDWB.exe
2208	BlLFJBq.exe
1556	MgyvIer.exe
1620	GmqbAGf.exe
2656	HZvkDJa.exe
2296	dwiIvFr.exe
688	rgbKNKF.exe
1200	nsfkncf.exe
972	PQWztZI.exe
1396	peOUldf.exe
3052	AkHmGIs.exe
1820	dBndDTg.exe
2508	oPQVpNY.exe
2608	bcPXxIr.exe
1712	MywQalF.exe
2672	HehNEFg.exe
700	LAPqugS.exe
1008	HBToDVF.exe
2912	VleanTn.exe
2092	QBwddag.exe
1072	jlshHZw.exe
576	ELrvVTy.exe
2504	izTGDSH.exe
1608	rzMZOWC.exe
2532	yLkjIDI.exe
2772	bSkKoLR.exe
1776	cjMdHqm.exe
2500	ESzJnvx.exe
2908	FsfEgzH.exe
2936	SIIGgmL.exe
1780	RhnrtVc.exe
3036	srMkcDt.exe
1436	PgngBMM.exe
2684	sExLoGW.exe

Loads dropped DLL 64 IoCs

pid	Process
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2172-0-0x000000013F670000-0x000000013F9C4000-memory.dmp	upx
behavioral1/files/0x000c000000012280-3.dat	upx
behavioral1/files/0x0008000000016875-11.dat	upx
behavioral1/memory/844-14-0x000000013F2B0000-0x000000013F604000-memory.dmp	upx
behavioral1/memory/2388-10-0x000000013F130000-0x000000013F484000-memory.dmp	upx
behavioral1/files/0x0008000000016b47-9.dat	upx
behavioral1/files/0x0008000000016c66-22.dat	upx
behavioral1/memory/2376-27-0x000000013F890000-0x000000013FBE4000-memory.dmp	upx
behavioral1/files/0x0007000000016c88-37.dat	upx
behavioral1/memory/2968-33-0x000000013F340000-0x000000013F694000-memory.dmp	upx
behavioral1/files/0x00090000000164b1-32.dat	upx
behavioral1/memory/2896-45-0x000000013FF40000-0x0000000140294000-memory.dmp	upx
behavioral1/files/0x0007000000016cd7-44.dat	upx
behavioral1/memory/1032-43-0x000000013FB00000-0x000000013FE54000-memory.dmp	upx
behavioral1/memory/2388-38-0x000000013F130000-0x000000013F484000-memory.dmp	upx
behavioral1/memory/2172-35-0x000000013F670000-0x000000013F9C4000-memory.dmp	upx
behavioral1/memory/2360-21-0x000000013F030000-0x000000013F384000-memory.dmp	upx
behavioral1/files/0x0007000000017049-55.dat	upx
behavioral1/files/0x0007000000016cf5-53.dat	upx
behavioral1/files/0x0006000000017497-66.dat	upx
behavioral1/files/0x00050000000186e7-83.dat	upx
behavioral1/memory/2984-75-0x000000013F5A0000-0x000000013F8F4000-memory.dmp	upx
behavioral1/files/0x000600000001755b-73.dat	upx
behavioral1/files/0x00050000000186f4-113.dat	upx
behavioral1/files/0x0005000000019360-190.dat	upx
behavioral1/memory/2764-1262-0x000000013F2C0000-0x000000013F614000-memory.dmp	upx
behavioral1/memory/2740-970-0x000000013F620000-0x000000013F974000-memory.dmp	upx
behavioral1/memory/2896-464-0x000000013FF40000-0x0000000140294000-memory.dmp	upx
behavioral1/memory/1032-223-0x000000013FB00000-0x000000013FE54000-memory.dmp	upx
behavioral1/files/0x000500000001933f-185.dat	upx
behavioral1/files/0x0005000000019297-180.dat	upx
behavioral1/files/0x0005000000019284-175.dat	upx
behavioral1/files/0x0005000000019278-170.dat	upx
behavioral1/files/0x0005000000019269-165.dat	upx
behavioral1/files/0x0005000000019250-160.dat	upx
behavioral1/files/0x0005000000019246-155.dat	upx
behavioral1/files/0x0006000000018c16-150.dat	upx
behavioral1/files/0x0006000000018b4e-145.dat	upx
behavioral1/files/0x000500000001878e-135.dat	upx
behavioral1/files/0x00050000000187a8-140.dat	upx
behavioral1/files/0x0005000000018744-130.dat	upx
behavioral1/files/0x0005000000018739-125.dat	upx
behavioral1/files/0x0005000000018704-120.dat	upx
behavioral1/memory/2764-104-0x000000013F2C0000-0x000000013F614000-memory.dmp	upx
behavioral1/memory/2968-103-0x000000013F340000-0x000000013F694000-memory.dmp	upx
behavioral1/files/0x0005000000018686-102.dat	upx
behavioral1/memory/2824-100-0x000000013F0B0000-0x000000013F404000-memory.dmp	upx
behavioral1/files/0x000600000001749c-99.dat	upx
behavioral1/memory/2740-98-0x000000013F620000-0x000000013F974000-memory.dmp	upx
behavioral1/memory/2376-96-0x000000013F890000-0x000000013FBE4000-memory.dmp	upx
behavioral1/memory/2700-95-0x000000013F6B0000-0x000000013FA04000-memory.dmp	upx
behavioral1/memory/2956-90-0x000000013FAB0000-0x000000013FE04000-memory.dmp	upx
behavioral1/files/0x00050000000186ed-86.dat	upx
behavioral1/files/0x00050000000186f1-107.dat	upx
behavioral1/memory/2696-67-0x000000013FA10000-0x000000013FD64000-memory.dmp	upx
behavioral1/memory/2360-62-0x000000013F030000-0x000000013F384000-memory.dmp	upx
behavioral1/memory/2388-4012-0x000000013F130000-0x000000013F484000-memory.dmp	upx
behavioral1/memory/2376-4014-0x000000013F890000-0x000000013FBE4000-memory.dmp	upx
behavioral1/memory/1032-4013-0x000000013FB00000-0x000000013FE54000-memory.dmp	upx
behavioral1/memory/2896-4015-0x000000013FF40000-0x0000000140294000-memory.dmp	upx
behavioral1/memory/2968-4016-0x000000013F340000-0x000000013F694000-memory.dmp	upx
behavioral1/memory/2360-4018-0x000000013F030000-0x000000013F384000-memory.dmp	upx
behavioral1/memory/2696-4017-0x000000013FA10000-0x000000013FD64000-memory.dmp	upx
behavioral1/memory/2984-4020-0x000000013F5A0000-0x000000013F8F4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YzazulD.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\JdqNSir.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\uuWEZtx.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\KEydkLP.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\EnXbsmk.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\izTGDSH.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\laQEmWp.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\teASwWr.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\RdmujaD.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\MBqBvLx.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\rxtaJKZ.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\WDwcLrS.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\DbkNPVl.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\QUPSXai.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\bKofqPv.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\CUALxWA.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\eQmZqUK.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\ceURdPu.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\QPyYhUr.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\iyDqSHg.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\xnkKcxN.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\xcokhDH.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\GjcrKlZ.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\tRvrLlZ.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\wGnlmOo.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\AdCooDd.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\JHUEkwz.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\mklztdt.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\oTSKTdN.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\uDVJTTT.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\iyqAQVf.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\opbatPo.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\LAPqugS.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\oXQbKwD.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\EOEPnnp.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\uOLuvDP.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\KCXzzLU.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\nsfkncf.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\oesiTvB.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\NMkIQGa.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\KZaQKOF.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\iIDujok.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\uUbYTCu.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\HdoKTJJ.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\aeVDqqq.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\tEkQujQ.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\pisaRat.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\zxMIyCL.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\yvAAagL.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\cmRijQG.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\CVYdodP.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\EmLjkNC.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\MzaxDRO.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\bLNKnED.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\PziosZK.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\zAaEFkp.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\HInyRTT.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\iAboOtX.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\mZigpvG.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\KmErHnq.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\ZEiQIUR.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\apAfrSC.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\JKQHWhX.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
File created	C:\Windows\System\rWPfzPk.exe	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2388	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	31
PID 2172 wrote to memory of 2388	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	31
PID 2172 wrote to memory of 2388	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	31
PID 2172 wrote to memory of 844	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	32
PID 2172 wrote to memory of 844	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	32
PID 2172 wrote to memory of 844	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	32
PID 2172 wrote to memory of 2360	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	33
PID 2172 wrote to memory of 2360	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	33
PID 2172 wrote to memory of 2360	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	33
PID 2172 wrote to memory of 2376	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	34
PID 2172 wrote to memory of 2376	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	34
PID 2172 wrote to memory of 2376	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	34
PID 2172 wrote to memory of 2968	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	35
PID 2172 wrote to memory of 2968	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	35
PID 2172 wrote to memory of 2968	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	35
PID 2172 wrote to memory of 1032	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	36
PID 2172 wrote to memory of 1032	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	36
PID 2172 wrote to memory of 1032	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	36
PID 2172 wrote to memory of 2896	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	37
PID 2172 wrote to memory of 2896	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	37
PID 2172 wrote to memory of 2896	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	37
PID 2172 wrote to memory of 2696	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	38
PID 2172 wrote to memory of 2696	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	38
PID 2172 wrote to memory of 2696	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	38
PID 2172 wrote to memory of 2956	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	39
PID 2172 wrote to memory of 2956	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	39
PID 2172 wrote to memory of 2956	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	39
PID 2172 wrote to memory of 2984	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	40
PID 2172 wrote to memory of 2984	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	40
PID 2172 wrote to memory of 2984	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	40
PID 2172 wrote to memory of 2824	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	41
PID 2172 wrote to memory of 2824	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	41
PID 2172 wrote to memory of 2824	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	41
PID 2172 wrote to memory of 2700	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	42
PID 2172 wrote to memory of 2700	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	42
PID 2172 wrote to memory of 2700	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	42
PID 2172 wrote to memory of 2764	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	43
PID 2172 wrote to memory of 2764	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	43
PID 2172 wrote to memory of 2764	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	43
PID 2172 wrote to memory of 2740	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	44
PID 2172 wrote to memory of 2740	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	44
PID 2172 wrote to memory of 2740	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	44
PID 2172 wrote to memory of 2320	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	45
PID 2172 wrote to memory of 2320	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	45
PID 2172 wrote to memory of 2320	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	45
PID 2172 wrote to memory of 1728	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	46
PID 2172 wrote to memory of 1728	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	46
PID 2172 wrote to memory of 1728	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	46
PID 2172 wrote to memory of 556	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	47
PID 2172 wrote to memory of 556	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	47
PID 2172 wrote to memory of 556	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	47
PID 2172 wrote to memory of 1876	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	48
PID 2172 wrote to memory of 1876	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	48
PID 2172 wrote to memory of 1876	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	48
PID 2172 wrote to memory of 1168	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	49
PID 2172 wrote to memory of 1168	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	49
PID 2172 wrote to memory of 1168	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	49
PID 2172 wrote to memory of 1336	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	50
PID 2172 wrote to memory of 1336	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	50
PID 2172 wrote to memory of 1336	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	50
PID 2172 wrote to memory of 1720	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	51
PID 2172 wrote to memory of 1720	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	51
PID 2172 wrote to memory of 1720	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	51
PID 2172 wrote to memory of 1684	2172	JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe	52

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6565ad960faa34c8adebe43121409312f3ea053a2d82ac793433ffc3001f18ad.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\System\mspywlP.exe
  C:\Windows\System\mspywlP.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\QWhvyEM.exe
  C:\Windows\System\QWhvyEM.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\IZdEIgK.exe
  C:\Windows\System\IZdEIgK.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\vWxDdpx.exe
  C:\Windows\System\vWxDdpx.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\ipLtPsX.exe
  C:\Windows\System\ipLtPsX.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\PLOgkZK.exe
  C:\Windows\System\PLOgkZK.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\CkUkfCQ.exe
  C:\Windows\System\CkUkfCQ.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\yirlots.exe
  C:\Windows\System\yirlots.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\smfwWfR.exe
  C:\Windows\System\smfwWfR.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\dUEcakR.exe
  C:\Windows\System\dUEcakR.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\GjcHVtz.exe
  C:\Windows\System\GjcHVtz.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\ZCssgcK.exe
  C:\Windows\System\ZCssgcK.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\zpZQMwd.exe
  C:\Windows\System\zpZQMwd.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\QIbwCib.exe
  C:\Windows\System\QIbwCib.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\KoYtZKt.exe
  C:\Windows\System\KoYtZKt.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\EhpfCIl.exe
  C:\Windows\System\EhpfCIl.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\cjLjeXZ.exe
  C:\Windows\System\cjLjeXZ.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\DNGvsHf.exe
  C:\Windows\System\DNGvsHf.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\aVPiXbo.exe
  C:\Windows\System\aVPiXbo.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\VqDqYOp.exe
  C:\Windows\System\VqDqYOp.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\SNbRwjc.exe
  C:\Windows\System\SNbRwjc.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\IAQPKIX.exe
  C:\Windows\System\IAQPKIX.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\DQxumor.exe
  C:\Windows\System\DQxumor.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\ynvWfzA.exe
  C:\Windows\System\ynvWfzA.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\ociSdEI.exe
  C:\Windows\System\ociSdEI.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\mrJRqJD.exe
  C:\Windows\System\mrJRqJD.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\ivUnYTz.exe
  C:\Windows\System\ivUnYTz.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\sZWPZlI.exe
  C:\Windows\System\sZWPZlI.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\DhCuLYm.exe
  C:\Windows\System\DhCuLYm.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\TCxFOdY.exe
  C:\Windows\System\TCxFOdY.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\TemsDWB.exe
  C:\Windows\System\TemsDWB.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\BlLFJBq.exe
  C:\Windows\System\BlLFJBq.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\MgyvIer.exe
  C:\Windows\System\MgyvIer.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\GmqbAGf.exe
  C:\Windows\System\GmqbAGf.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\HZvkDJa.exe
  C:\Windows\System\HZvkDJa.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\dwiIvFr.exe
  C:\Windows\System\dwiIvFr.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\rgbKNKF.exe
  C:\Windows\System\rgbKNKF.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\nsfkncf.exe
  C:\Windows\System\nsfkncf.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\PQWztZI.exe
  C:\Windows\System\PQWztZI.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\peOUldf.exe
  C:\Windows\System\peOUldf.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\AkHmGIs.exe
  C:\Windows\System\AkHmGIs.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\dBndDTg.exe
  C:\Windows\System\dBndDTg.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\oPQVpNY.exe
  C:\Windows\System\oPQVpNY.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\bcPXxIr.exe
  C:\Windows\System\bcPXxIr.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\MywQalF.exe
  C:\Windows\System\MywQalF.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\HehNEFg.exe
  C:\Windows\System\HehNEFg.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\LAPqugS.exe
  C:\Windows\System\LAPqugS.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\HBToDVF.exe
  C:\Windows\System\HBToDVF.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\VleanTn.exe
  C:\Windows\System\VleanTn.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\QBwddag.exe
  C:\Windows\System\QBwddag.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\jlshHZw.exe
  C:\Windows\System\jlshHZw.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\ELrvVTy.exe
  C:\Windows\System\ELrvVTy.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\izTGDSH.exe
  C:\Windows\System\izTGDSH.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\rzMZOWC.exe
  C:\Windows\System\rzMZOWC.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\yLkjIDI.exe
  C:\Windows\System\yLkjIDI.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\bSkKoLR.exe
  C:\Windows\System\bSkKoLR.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\cjMdHqm.exe
  C:\Windows\System\cjMdHqm.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\ESzJnvx.exe
  C:\Windows\System\ESzJnvx.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\FsfEgzH.exe
  C:\Windows\System\FsfEgzH.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\SIIGgmL.exe
  C:\Windows\System\SIIGgmL.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\RhnrtVc.exe
  C:\Windows\System\RhnrtVc.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\srMkcDt.exe
  C:\Windows\System\srMkcDt.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\PgngBMM.exe
  C:\Windows\System\PgngBMM.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\sExLoGW.exe
  C:\Windows\System\sExLoGW.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\yBAWPqE.exe
  C:\Windows\System\yBAWPqE.exe
  2⤵
  PID:2336
- C:\Windows\System\VOoXLyz.exe
  C:\Windows\System\VOoXLyz.exe
  2⤵
  PID:2436
- C:\Windows\System\SBCVsoQ.exe
  C:\Windows\System\SBCVsoQ.exe
  2⤵
  PID:1940
- C:\Windows\System\znECVkX.exe
  C:\Windows\System\znECVkX.exe
  2⤵
  PID:1248
- C:\Windows\System\DGftSdx.exe
  C:\Windows\System\DGftSdx.exe
  2⤵
  PID:1560
- C:\Windows\System\uOWZeOJ.exe
  C:\Windows\System\uOWZeOJ.exe
  2⤵
  PID:2996
- C:\Windows\System\jYByWDN.exe
  C:\Windows\System\jYByWDN.exe
  2⤵
  PID:2304
- C:\Windows\System\HIBNUlW.exe
  C:\Windows\System\HIBNUlW.exe
  2⤵
  PID:2288
- C:\Windows\System\ZMEvYBh.exe
  C:\Windows\System\ZMEvYBh.exe
  2⤵
  PID:2124
- C:\Windows\System\iWUzUhL.exe
  C:\Windows\System\iWUzUhL.exe
  2⤵
  PID:1448
- C:\Windows\System\kpNxkjW.exe
  C:\Windows\System\kpNxkjW.exe
  2⤵
  PID:912
- C:\Windows\System\cPOBhVP.exe
  C:\Windows\System\cPOBhVP.exe
  2⤵
  PID:1988
- C:\Windows\System\Enopwze.exe
  C:\Windows\System\Enopwze.exe
  2⤵
  PID:2484
- C:\Windows\System\PGRHTgD.exe
  C:\Windows\System\PGRHTgD.exe
  2⤵
  PID:2300
- C:\Windows\System\qfRnlkW.exe
  C:\Windows\System\qfRnlkW.exe
  2⤵
  PID:1288
- C:\Windows\System\PKICSdM.exe
  C:\Windows\System\PKICSdM.exe
  2⤵
  PID:1768
- C:\Windows\System\EbIducl.exe
  C:\Windows\System\EbIducl.exe
  2⤵
  PID:1068
- C:\Windows\System\SdmIeQt.exe
  C:\Windows\System\SdmIeQt.exe
  2⤵
  PID:2380
- C:\Windows\System\HwQmKoY.exe
  C:\Windows\System\HwQmKoY.exe
  2⤵
  PID:2552
- C:\Windows\System\JHiaPRH.exe
  C:\Windows\System\JHiaPRH.exe
  2⤵
  PID:1908
- C:\Windows\System\btNRHfg.exe
  C:\Windows\System\btNRHfg.exe
  2⤵
  PID:2564
- C:\Windows\System\ABDOJlQ.exe
  C:\Windows\System\ABDOJlQ.exe
  2⤵
  PID:608
- C:\Windows\System\ukNjCHn.exe
  C:\Windows\System\ukNjCHn.exe
  2⤵
  PID:316
- C:\Windows\System\wVHeFiY.exe
  C:\Windows\System\wVHeFiY.exe
  2⤵
  PID:2144
- C:\Windows\System\KZqQpcr.exe
  C:\Windows\System\KZqQpcr.exe
  2⤵
  PID:2408
- C:\Windows\System\xztxnKY.exe
  C:\Windows\System\xztxnKY.exe
  2⤵
  PID:1440
- C:\Windows\System\CCcPCqZ.exe
  C:\Windows\System\CCcPCqZ.exe
  2⤵
  PID:2888
- C:\Windows\System\RVbMgAl.exe
  C:\Windows\System\RVbMgAl.exe
  2⤵
  PID:2536
- C:\Windows\System\qSXXZGO.exe
  C:\Windows\System\qSXXZGO.exe
  2⤵
  PID:2820
- C:\Windows\System\QgKUtkL.exe
  C:\Windows\System\QgKUtkL.exe
  2⤵
  PID:2340
- C:\Windows\System\kzptQxc.exe
  C:\Windows\System\kzptQxc.exe
  2⤵
  PID:1524
- C:\Windows\System\JJDYycv.exe
  C:\Windows\System\JJDYycv.exe
  2⤵
  PID:2676
- C:\Windows\System\HnPBjRz.exe
  C:\Windows\System\HnPBjRz.exe
  2⤵
  PID:1740
- C:\Windows\System\QVTDasi.exe
  C:\Windows\System\QVTDasi.exe
  2⤵
  PID:2148
- C:\Windows\System\RFzZlhQ.exe
  C:\Windows\System\RFzZlhQ.exe
  2⤵
  PID:2788
- C:\Windows\System\FHbqPoY.exe
  C:\Windows\System\FHbqPoY.exe
  2⤵
  PID:2204
- C:\Windows\System\KWEfaNh.exe
  C:\Windows\System\KWEfaNh.exe
  2⤵
  PID:2056
- C:\Windows\System\dNCrVQA.exe
  C:\Windows\System\dNCrVQA.exe
  2⤵
  PID:408
- C:\Windows\System\CcPxdYG.exe
  C:\Windows\System\CcPxdYG.exe
  2⤵
  PID:1364
- C:\Windows\System\urzzOpE.exe
  C:\Windows\System\urzzOpE.exe
  2⤵
  PID:1004
- C:\Windows\System\iyDqSHg.exe
  C:\Windows\System\iyDqSHg.exe
  2⤵
  PID:1700
- C:\Windows\System\ckQFkHk.exe
  C:\Windows\System\ckQFkHk.exe
  2⤵
  PID:916
- C:\Windows\System\UyeFHqM.exe
  C:\Windows\System\UyeFHqM.exe
  2⤵
  PID:2464
- C:\Windows\System\cqVNkip.exe
  C:\Windows\System\cqVNkip.exe
  2⤵
  PID:1744
- C:\Windows\System\RrNRLAB.exe
  C:\Windows\System\RrNRLAB.exe
  2⤵
  PID:564
- C:\Windows\System\sdDAfQp.exe
  C:\Windows\System\sdDAfQp.exe
  2⤵
  PID:1492
- C:\Windows\System\ntujqFC.exe
  C:\Windows\System\ntujqFC.exe
  2⤵
  PID:2084
- C:\Windows\System\BXztLUi.exe
  C:\Windows\System\BXztLUi.exe
  2⤵
  PID:2920
- C:\Windows\System\hnNTLKO.exe
  C:\Windows\System\hnNTLKO.exe
  2⤵
  PID:1992
- C:\Windows\System\KQgFNHy.exe
  C:\Windows\System\KQgFNHy.exe
  2⤵
  PID:3028
- C:\Windows\System\QXMoMan.exe
  C:\Windows\System\QXMoMan.exe
  2⤵
  PID:2184
- C:\Windows\System\XGzlYMr.exe
  C:\Windows\System\XGzlYMr.exe
  2⤵
  PID:3088
- C:\Windows\System\qAtAdfh.exe
  C:\Windows\System\qAtAdfh.exe
  2⤵
  PID:3108
- C:\Windows\System\aeVDqqq.exe
  C:\Windows\System\aeVDqqq.exe
  2⤵
  PID:3128
- C:\Windows\System\uHQtmwF.exe
  C:\Windows\System\uHQtmwF.exe
  2⤵
  PID:3148
- C:\Windows\System\drvxnma.exe
  C:\Windows\System\drvxnma.exe
  2⤵
  PID:3168
- C:\Windows\System\HEbYmft.exe
  C:\Windows\System\HEbYmft.exe
  2⤵
  PID:3188
- C:\Windows\System\FOMrvrc.exe
  C:\Windows\System\FOMrvrc.exe
  2⤵
  PID:3208
- C:\Windows\System\MNYSNYr.exe
  C:\Windows\System\MNYSNYr.exe
  2⤵
  PID:3232
- C:\Windows\System\wQIQtSx.exe
  C:\Windows\System\wQIQtSx.exe
  2⤵
  PID:3252
- C:\Windows\System\MmboILk.exe
  C:\Windows\System\MmboILk.exe
  2⤵
  PID:3272
- C:\Windows\System\OVwjdrl.exe
  C:\Windows\System\OVwjdrl.exe
  2⤵
  PID:3288
- C:\Windows\System\UfbjmBO.exe
  C:\Windows\System\UfbjmBO.exe
  2⤵
  PID:3312
- C:\Windows\System\epivhnp.exe
  C:\Windows\System\epivhnp.exe
  2⤵
  PID:3332
- C:\Windows\System\EGrLbMH.exe
  C:\Windows\System\EGrLbMH.exe
  2⤵
  PID:3352
- C:\Windows\System\PDsnCkG.exe
  C:\Windows\System\PDsnCkG.exe
  2⤵
  PID:3372
- C:\Windows\System\YMtErIK.exe
  C:\Windows\System\YMtErIK.exe
  2⤵
  PID:3392
- C:\Windows\System\ncmuJmv.exe
  C:\Windows\System\ncmuJmv.exe
  2⤵
  PID:3412
- C:\Windows\System\llpsjHP.exe
  C:\Windows\System\llpsjHP.exe
  2⤵
  PID:3432
- C:\Windows\System\MZzDVNJ.exe
  C:\Windows\System\MZzDVNJ.exe
  2⤵
  PID:3448
- C:\Windows\System\jlOAAns.exe
  C:\Windows\System\jlOAAns.exe
  2⤵
  PID:3472
- C:\Windows\System\YHMLflz.exe
  C:\Windows\System\YHMLflz.exe
  2⤵
  PID:3488
- C:\Windows\System\QSAvORq.exe
  C:\Windows\System\QSAvORq.exe
  2⤵
  PID:3512
- C:\Windows\System\vqKkFrA.exe
  C:\Windows\System\vqKkFrA.exe
  2⤵
  PID:3532
- C:\Windows\System\XVnvmuD.exe
  C:\Windows\System\XVnvmuD.exe
  2⤵
  PID:3552
- C:\Windows\System\HkoIGlP.exe
  C:\Windows\System\HkoIGlP.exe
  2⤵
  PID:3568
- C:\Windows\System\SeYhzza.exe
  C:\Windows\System\SeYhzza.exe
  2⤵
  PID:3588
- C:\Windows\System\hFmnsAV.exe
  C:\Windows\System\hFmnsAV.exe
  2⤵
  PID:3604
- C:\Windows\System\NyBeZsF.exe
  C:\Windows\System\NyBeZsF.exe
  2⤵
  PID:3632
- C:\Windows\System\zxMIyCL.exe
  C:\Windows\System\zxMIyCL.exe
  2⤵
  PID:3652
- C:\Windows\System\jmwYDfG.exe
  C:\Windows\System\jmwYDfG.exe
  2⤵
  PID:3672
- C:\Windows\System\JkRkzGP.exe
  C:\Windows\System\JkRkzGP.exe
  2⤵
  PID:3688
- C:\Windows\System\clrFFJC.exe
  C:\Windows\System\clrFFJC.exe
  2⤵
  PID:3704
- C:\Windows\System\DkwnfZn.exe
  C:\Windows\System\DkwnfZn.exe
  2⤵
  PID:3720
- C:\Windows\System\pfAIVuA.exe
  C:\Windows\System\pfAIVuA.exe
  2⤵
  PID:3752
- C:\Windows\System\OihzBxT.exe
  C:\Windows\System\OihzBxT.exe
  2⤵
  PID:3772
- C:\Windows\System\bYMZbpK.exe
  C:\Windows\System\bYMZbpK.exe
  2⤵
  PID:3792
- C:\Windows\System\WBZFVpR.exe
  C:\Windows\System\WBZFVpR.exe
  2⤵
  PID:3812
- C:\Windows\System\nqNzCGg.exe
  C:\Windows\System\nqNzCGg.exe
  2⤵
  PID:3832
- C:\Windows\System\oIzwqcV.exe
  C:\Windows\System\oIzwqcV.exe
  2⤵
  PID:3848
- C:\Windows\System\bAaWXBL.exe
  C:\Windows\System\bAaWXBL.exe
  2⤵
  PID:3872
- C:\Windows\System\IFgKcNX.exe
  C:\Windows\System\IFgKcNX.exe
  2⤵
  PID:3888
- C:\Windows\System\wOegyAZ.exe
  C:\Windows\System\wOegyAZ.exe
  2⤵
  PID:3908
- C:\Windows\System\DtajQKQ.exe
  C:\Windows\System\DtajQKQ.exe
  2⤵
  PID:3928
- C:\Windows\System\jUTDVBl.exe
  C:\Windows\System\jUTDVBl.exe
  2⤵
  PID:3952
- C:\Windows\System\hElVvTM.exe
  C:\Windows\System\hElVvTM.exe
  2⤵
  PID:3972
- C:\Windows\System\JWHtyjR.exe
  C:\Windows\System\JWHtyjR.exe
  2⤵
  PID:3992
- C:\Windows\System\qGuqGLk.exe
  C:\Windows\System\qGuqGLk.exe
  2⤵
  PID:4008
- C:\Windows\System\ziFUVha.exe
  C:\Windows\System\ziFUVha.exe
  2⤵
  PID:4032
- C:\Windows\System\oCHBoVT.exe
  C:\Windows\System\oCHBoVT.exe
  2⤵
  PID:4052
- C:\Windows\System\PuXwPJR.exe
  C:\Windows\System\PuXwPJR.exe
  2⤵
  PID:4072
- C:\Windows\System\OGAQEqU.exe
  C:\Windows\System\OGAQEqU.exe
  2⤵
  PID:4088
- C:\Windows\System\LxQwHxq.exe
  C:\Windows\System\LxQwHxq.exe
  2⤵
  PID:2928
- C:\Windows\System\cxJtWxK.exe
  C:\Windows\System\cxJtWxK.exe
  2⤵
  PID:2212
- C:\Windows\System\Dkzujsy.exe
  C:\Windows\System\Dkzujsy.exe
  2⤵
  PID:2316
- C:\Windows\System\LlHEQuP.exe
  C:\Windows\System\LlHEQuP.exe
  2⤵
  PID:2224
- C:\Windows\System\VbFIIfH.exe
  C:\Windows\System\VbFIIfH.exe
  2⤵
  PID:2404
- C:\Windows\System\cXSgsXZ.exe
  C:\Windows\System\cXSgsXZ.exe
  2⤵
  PID:2040
- C:\Windows\System\fNkAQHZ.exe
  C:\Windows\System\fNkAQHZ.exe
  2⤵
  PID:1388
- C:\Windows\System\uIQZmxL.exe
  C:\Windows\System\uIQZmxL.exe
  2⤵
  PID:1512
- C:\Windows\System\NnIliAD.exe
  C:\Windows\System\NnIliAD.exe
  2⤵
  PID:2720
- C:\Windows\System\ffwkibL.exe
  C:\Windows\System\ffwkibL.exe
  2⤵
  PID:2940
- C:\Windows\System\rQbhIkW.exe
  C:\Windows\System\rQbhIkW.exe
  2⤵
  PID:1252
- C:\Windows\System\aJlVbkQ.exe
  C:\Windows\System\aJlVbkQ.exe
  2⤵
  PID:3100
- C:\Windows\System\iMenMrG.exe
  C:\Windows\System\iMenMrG.exe
  2⤵
  PID:3084
- C:\Windows\System\YVgYwwy.exe
  C:\Windows\System\YVgYwwy.exe
  2⤵
  PID:3140
- C:\Windows\System\mcZsOta.exe
  C:\Windows\System\mcZsOta.exe
  2⤵
  PID:3164
- C:\Windows\System\YVRqKdM.exe
  C:\Windows\System\YVRqKdM.exe
  2⤵
  PID:2832
- C:\Windows\System\tiTLKWQ.exe
  C:\Windows\System\tiTLKWQ.exe
  2⤵
  PID:3200
- C:\Windows\System\YOXMgti.exe
  C:\Windows\System\YOXMgti.exe
  2⤵
  PID:3304
- C:\Windows\System\qdSXtOb.exe
  C:\Windows\System\qdSXtOb.exe
  2⤵
  PID:3340
- C:\Windows\System\jQeUtWz.exe
  C:\Windows\System\jQeUtWz.exe
  2⤵
  PID:3380
- C:\Windows\System\PnarRZS.exe
  C:\Windows\System\PnarRZS.exe
  2⤵
  PID:3364
- C:\Windows\System\lphKLUM.exe
  C:\Windows\System\lphKLUM.exe
  2⤵
  PID:3464
- C:\Windows\System\XRIFWGX.exe
  C:\Windows\System\XRIFWGX.exe
  2⤵
  PID:3404
- C:\Windows\System\rGUDrun.exe
  C:\Windows\System\rGUDrun.exe
  2⤵
  PID:3504
- C:\Windows\System\PTXzgZm.exe
  C:\Windows\System\PTXzgZm.exe
  2⤵
  PID:3548
- C:\Windows\System\wBlykLk.exe
  C:\Windows\System\wBlykLk.exe
  2⤵
  PID:3524
- C:\Windows\System\ZkJxDZw.exe
  C:\Windows\System\ZkJxDZw.exe
  2⤵
  PID:3616
- C:\Windows\System\mzdhvbp.exe
  C:\Windows\System\mzdhvbp.exe
  2⤵
  PID:3564
- C:\Windows\System\mAyYQoI.exe
  C:\Windows\System\mAyYQoI.exe
  2⤵
  PID:3664
- C:\Windows\System\legsSuI.exe
  C:\Windows\System\legsSuI.exe
  2⤵
  PID:3644
- C:\Windows\System\zeIzWIA.exe
  C:\Windows\System\zeIzWIA.exe
  2⤵
  PID:3740
- C:\Windows\System\wsDWAOX.exe
  C:\Windows\System\wsDWAOX.exe
  2⤵
  PID:3784
- C:\Windows\System\BNCAgNs.exe
  C:\Windows\System\BNCAgNs.exe
  2⤵
  PID:3868
- C:\Windows\System\KNFMkak.exe
  C:\Windows\System\KNFMkak.exe
  2⤵
  PID:3680
- C:\Windows\System\mgkgaYd.exe
  C:\Windows\System\mgkgaYd.exe
  2⤵
  PID:3944
- C:\Windows\System\tQidwpp.exe
  C:\Windows\System\tQidwpp.exe
  2⤵
  PID:3988
- C:\Windows\System\KILvWVc.exe
  C:\Windows\System\KILvWVc.exe
  2⤵
  PID:4068
- C:\Windows\System\TiloAHb.exe
  C:\Windows\System\TiloAHb.exe
  2⤵
  PID:2068
- C:\Windows\System\QIenxOm.exe
  C:\Windows\System\QIenxOm.exe
  2⤵
  PID:3768
- C:\Windows\System\NQLlunI.exe
  C:\Windows\System\NQLlunI.exe
  2⤵
  PID:3800
- C:\Windows\System\DyRvaup.exe
  C:\Windows\System\DyRvaup.exe
  2⤵
  PID:3844
- C:\Windows\System\kyXpYPW.exe
  C:\Windows\System\kyXpYPW.exe
  2⤵
  PID:1764
- C:\Windows\System\tJMVcYa.exe
  C:\Windows\System\tJMVcYa.exe
  2⤵
  PID:3924
- C:\Windows\System\ZMtYKvJ.exe
  C:\Windows\System\ZMtYKvJ.exe
  2⤵
  PID:3964
- C:\Windows\System\accSWqh.exe
  C:\Windows\System\accSWqh.exe
  2⤵
  PID:2024
- C:\Windows\System\AtmEXwB.exe
  C:\Windows\System\AtmEXwB.exe
  2⤵
  PID:4080
- C:\Windows\System\MMhqxSL.exe
  C:\Windows\System\MMhqxSL.exe
  2⤵
  PID:2432
- C:\Windows\System\TfrcCvA.exe
  C:\Windows\System\TfrcCvA.exe
  2⤵
  PID:3120
- C:\Windows\System\MLwUtIa.exe
  C:\Windows\System\MLwUtIa.exe
  2⤵
  PID:3176
- C:\Windows\System\GvkfwkF.exe
  C:\Windows\System\GvkfwkF.exe
  2⤵
  PID:1112
- C:\Windows\System\bsXgziK.exe
  C:\Windows\System\bsXgziK.exe
  2⤵
  PID:3144
- C:\Windows\System\AvGzgSG.exe
  C:\Windows\System\AvGzgSG.exe
  2⤵
  PID:3268
- C:\Windows\System\dIJFmkE.exe
  C:\Windows\System\dIJFmkE.exe
  2⤵
  PID:3244
- C:\Windows\System\TCcNMYX.exe
  C:\Windows\System\TCcNMYX.exe
  2⤵
  PID:3180
- C:\Windows\System\wcGzpDg.exe
  C:\Windows\System\wcGzpDg.exe
  2⤵
  PID:3324
- C:\Windows\System\xbFIgZK.exe
  C:\Windows\System\xbFIgZK.exe
  2⤵
  PID:3400
- C:\Windows\System\yWtlTQo.exe
  C:\Windows\System\yWtlTQo.exe
  2⤵
  PID:3584
- C:\Windows\System\yoZGqJl.exe
  C:\Windows\System\yoZGqJl.exe
  2⤵
  PID:3424
- C:\Windows\System\xyfmHml.exe
  C:\Windows\System\xyfmHml.exe
  2⤵
  PID:2972
- C:\Windows\System\NtCQFhL.exe
  C:\Windows\System\NtCQFhL.exe
  2⤵
  PID:3700
- C:\Windows\System\KmMXoNr.exe
  C:\Windows\System\KmMXoNr.exe
  2⤵
  PID:3560
- C:\Windows\System\aCrlVsT.exe
  C:\Windows\System\aCrlVsT.exe
  2⤵
  PID:2620
- C:\Windows\System\vYPcyhM.exe
  C:\Windows\System\vYPcyhM.exe
  2⤵
  PID:3904
- C:\Windows\System\FEiSQOJ.exe
  C:\Windows\System\FEiSQOJ.exe
  2⤵
  PID:3948
- C:\Windows\System\LKwYEIj.exe
  C:\Windows\System\LKwYEIj.exe
  2⤵
  PID:3980
- C:\Windows\System\SicqMim.exe
  C:\Windows\System\SicqMim.exe
  2⤵
  PID:3760
- C:\Windows\System\Kjnwxku.exe
  C:\Windows\System\Kjnwxku.exe
  2⤵
  PID:548
- C:\Windows\System\LEHODSJ.exe
  C:\Windows\System\LEHODSJ.exe
  2⤵
  PID:3880
- C:\Windows\System\XrqWoAS.exe
  C:\Windows\System\XrqWoAS.exe
  2⤵
  PID:4004
- C:\Windows\System\qcTIsJK.exe
  C:\Windows\System\qcTIsJK.exe
  2⤵
  PID:2952
- C:\Windows\System\qSJnDbR.exe
  C:\Windows\System\qSJnDbR.exe
  2⤵
  PID:3968
- C:\Windows\System\oXQbKwD.exe
  C:\Windows\System\oXQbKwD.exe
  2⤵
  PID:3104
- C:\Windows\System\mQuYcxX.exe
  C:\Windows\System\mQuYcxX.exe
  2⤵
  PID:2900
- C:\Windows\System\uVDbkef.exe
  C:\Windows\System\uVDbkef.exe
  2⤵
  PID:3136
- C:\Windows\System\omNYuxl.exe
  C:\Windows\System\omNYuxl.exe
  2⤵
  PID:3388
- C:\Windows\System\OVMkYyd.exe
  C:\Windows\System\OVMkYyd.exe
  2⤵
  PID:4108
- C:\Windows\System\sGGcqhM.exe
  C:\Windows\System\sGGcqhM.exe
  2⤵
  PID:4132
- C:\Windows\System\QEzkRGr.exe
  C:\Windows\System\QEzkRGr.exe
  2⤵
  PID:4152
- C:\Windows\System\XRDcxzb.exe
  C:\Windows\System\XRDcxzb.exe
  2⤵
  PID:4172
- C:\Windows\System\sEYurGf.exe
  C:\Windows\System\sEYurGf.exe
  2⤵
  PID:4192
- C:\Windows\System\bOyTyjt.exe
  C:\Windows\System\bOyTyjt.exe
  2⤵
  PID:4212
- C:\Windows\System\bDlqEhh.exe
  C:\Windows\System\bDlqEhh.exe
  2⤵
  PID:4228
- C:\Windows\System\vWBUZAa.exe
  C:\Windows\System\vWBUZAa.exe
  2⤵
  PID:4252
- C:\Windows\System\BNGYGKl.exe
  C:\Windows\System\BNGYGKl.exe
  2⤵
  PID:4268
- C:\Windows\System\PQGTECJ.exe
  C:\Windows\System\PQGTECJ.exe
  2⤵
  PID:4292
- C:\Windows\System\tVFimZp.exe
  C:\Windows\System\tVFimZp.exe
  2⤵
  PID:4308
- C:\Windows\System\HaXkDIa.exe
  C:\Windows\System\HaXkDIa.exe
  2⤵
  PID:4328
- C:\Windows\System\CMDwZfe.exe
  C:\Windows\System\CMDwZfe.exe
  2⤵
  PID:4348
- C:\Windows\System\wGnlmOo.exe
  C:\Windows\System\wGnlmOo.exe
  2⤵
  PID:4372
- C:\Windows\System\THVhqYi.exe
  C:\Windows\System\THVhqYi.exe
  2⤵
  PID:4388
- C:\Windows\System\thfornH.exe
  C:\Windows\System\thfornH.exe
  2⤵
  PID:4416
- C:\Windows\System\RJJTAxT.exe
  C:\Windows\System\RJJTAxT.exe
  2⤵
  PID:4436
- C:\Windows\System\xnkKcxN.exe
  C:\Windows\System\xnkKcxN.exe
  2⤵
  PID:4456
- C:\Windows\System\SjqqQxP.exe
  C:\Windows\System\SjqqQxP.exe
  2⤵
  PID:4472
- C:\Windows\System\LBGQVWx.exe
  C:\Windows\System\LBGQVWx.exe
  2⤵
  PID:4496
- C:\Windows\System\aoyfoxT.exe
  C:\Windows\System\aoyfoxT.exe
  2⤵
  PID:4512
- C:\Windows\System\bGelUVv.exe
  C:\Windows\System\bGelUVv.exe
  2⤵
  PID:4536
- C:\Windows\System\pZLtbSl.exe
  C:\Windows\System\pZLtbSl.exe
  2⤵
  PID:4552
- C:\Windows\System\nLLueFh.exe
  C:\Windows\System\nLLueFh.exe
  2⤵
  PID:4576
- C:\Windows\System\Tsbpeil.exe
  C:\Windows\System\Tsbpeil.exe
  2⤵
  PID:4592
- C:\Windows\System\boJPWpV.exe
  C:\Windows\System\boJPWpV.exe
  2⤵
  PID:4616
- C:\Windows\System\nnCdLqq.exe
  C:\Windows\System\nnCdLqq.exe
  2⤵
  PID:4632
- C:\Windows\System\ffFudWm.exe
  C:\Windows\System\ffFudWm.exe
  2⤵
  PID:4656
- C:\Windows\System\ATvTQbI.exe
  C:\Windows\System\ATvTQbI.exe
  2⤵
  PID:4672
- C:\Windows\System\jBBVDyf.exe
  C:\Windows\System\jBBVDyf.exe
  2⤵
  PID:4696
- C:\Windows\System\ZtWVJAE.exe
  C:\Windows\System\ZtWVJAE.exe
  2⤵
  PID:4712
- C:\Windows\System\ZBcSavr.exe
  C:\Windows\System\ZBcSavr.exe
  2⤵
  PID:4736
- C:\Windows\System\RPeSMcO.exe
  C:\Windows\System\RPeSMcO.exe
  2⤵
  PID:4752
- C:\Windows\System\AZLbaoD.exe
  C:\Windows\System\AZLbaoD.exe
  2⤵
  PID:4776
- C:\Windows\System\LOkLclU.exe
  C:\Windows\System\LOkLclU.exe
  2⤵
  PID:4796
- C:\Windows\System\PbfzMme.exe
  C:\Windows\System\PbfzMme.exe
  2⤵
  PID:4816
- C:\Windows\System\WEFzPuW.exe
  C:\Windows\System\WEFzPuW.exe
  2⤵
  PID:4832
- C:\Windows\System\qzWMzqv.exe
  C:\Windows\System\qzWMzqv.exe
  2⤵
  PID:4856
- C:\Windows\System\hbcANLg.exe
  C:\Windows\System\hbcANLg.exe
  2⤵
  PID:4876
- C:\Windows\System\JNGhiQK.exe
  C:\Windows\System\JNGhiQK.exe
  2⤵
  PID:4896
- C:\Windows\System\NlyYRLm.exe
  C:\Windows\System\NlyYRLm.exe
  2⤵
  PID:4916
- C:\Windows\System\DhmOXzp.exe
  C:\Windows\System\DhmOXzp.exe
  2⤵
  PID:4936
- C:\Windows\System\wuclBCR.exe
  C:\Windows\System\wuclBCR.exe
  2⤵
  PID:4956
- C:\Windows\System\EJUGrCL.exe
  C:\Windows\System\EJUGrCL.exe
  2⤵
  PID:4976
- C:\Windows\System\CZFFNPi.exe
  C:\Windows\System\CZFFNPi.exe
  2⤵
  PID:4996
- C:\Windows\System\fcKBGQh.exe
  C:\Windows\System\fcKBGQh.exe
  2⤵
  PID:5016
- C:\Windows\System\oTSKTdN.exe
  C:\Windows\System\oTSKTdN.exe
  2⤵
  PID:5032
- C:\Windows\System\cWHwEIq.exe
  C:\Windows\System\cWHwEIq.exe
  2⤵
  PID:5056
- C:\Windows\System\oesiTvB.exe
  C:\Windows\System\oesiTvB.exe
  2⤵
  PID:5080
- C:\Windows\System\lkRkhCc.exe
  C:\Windows\System\lkRkhCc.exe
  2⤵
  PID:5104
- C:\Windows\System\aFOyHNE.exe
  C:\Windows\System\aFOyHNE.exe
  2⤵
  PID:2948
- C:\Windows\System\hAJvHhH.exe
  C:\Windows\System\hAJvHhH.exe
  2⤵
  PID:3280
- C:\Windows\System\vNAFcAT.exe
  C:\Windows\System\vNAFcAT.exe
  2⤵
  PID:3408
- C:\Windows\System\RjANDdS.exe
  C:\Windows\System\RjANDdS.exe
  2⤵
  PID:3520
- C:\Windows\System\ZBFiJKr.exe
  C:\Windows\System\ZBFiJKr.exe
  2⤵
  PID:3660
- C:\Windows\System\wleazab.exe
  C:\Windows\System\wleazab.exe
  2⤵
  PID:3896
- C:\Windows\System\IxFcgyf.exe
  C:\Windows\System\IxFcgyf.exe
  2⤵
  PID:4020
- C:\Windows\System\NsErvep.exe
  C:\Windows\System\NsErvep.exe
  2⤵
  PID:1012
- C:\Windows\System\OyoSlyR.exe
  C:\Windows\System\OyoSlyR.exe
  2⤵
  PID:1268
- C:\Windows\System\NsDcADB.exe
  C:\Windows\System\NsDcADB.exe
  2⤵
  PID:2488
- C:\Windows\System\keYufuI.exe
  C:\Windows\System\keYufuI.exe
  2⤵
  PID:2032
- C:\Windows\System\OirwdoQ.exe
  C:\Windows\System\OirwdoQ.exe
  2⤵
  PID:3156
- C:\Windows\System\CSwRIJY.exe
  C:\Windows\System\CSwRIJY.exe
  2⤵
  PID:1660
- C:\Windows\System\UfykADw.exe
  C:\Windows\System\UfykADw.exe
  2⤵
  PID:4100
- C:\Windows\System\mLYGHbq.exe
  C:\Windows\System\mLYGHbq.exe
  2⤵
  PID:4104
- C:\Windows\System\bSHAnaW.exe
  C:\Windows\System\bSHAnaW.exe
  2⤵
  PID:4148
- C:\Windows\System\XnTqSVt.exe
  C:\Windows\System\XnTqSVt.exe
  2⤵
  PID:4180
- C:\Windows\System\AtKjoZw.exe
  C:\Windows\System\AtKjoZw.exe
  2⤵
  PID:4224
- C:\Windows\System\WQgfpRE.exe
  C:\Windows\System\WQgfpRE.exe
  2⤵
  PID:4240
- C:\Windows\System\LqRLGFz.exe
  C:\Windows\System\LqRLGFz.exe
  2⤵
  PID:4260
- C:\Windows\System\PXJTrAh.exe
  C:\Windows\System\PXJTrAh.exe
  2⤵
  PID:4304
- C:\Windows\System\HInyRTT.exe
  C:\Windows\System\HInyRTT.exe
  2⤵
  PID:4344
- C:\Windows\System\AgHvOCo.exe
  C:\Windows\System\AgHvOCo.exe
  2⤵
  PID:4396
- C:\Windows\System\ozwetXU.exe
  C:\Windows\System\ozwetXU.exe
  2⤵
  PID:4404
- C:\Windows\System\jWQDpPI.exe
  C:\Windows\System\jWQDpPI.exe
  2⤵
  PID:4448
- C:\Windows\System\zBweKHU.exe
  C:\Windows\System\zBweKHU.exe
  2⤵
  PID:4484
- C:\Windows\System\UTyzoGj.exe
  C:\Windows\System\UTyzoGj.exe
  2⤵
  PID:4520
- C:\Windows\System\tOiXdqT.exe
  C:\Windows\System\tOiXdqT.exe
  2⤵
  PID:4508
- C:\Windows\System\XSDKnqQ.exe
  C:\Windows\System\XSDKnqQ.exe
  2⤵
  PID:4564
- C:\Windows\System\LTYJwcr.exe
  C:\Windows\System\LTYJwcr.exe
  2⤵
  PID:4548
- C:\Windows\System\UeRcHIt.exe
  C:\Windows\System\UeRcHIt.exe
  2⤵
  PID:4624
- C:\Windows\System\dgTDvVa.exe
  C:\Windows\System\dgTDvVa.exe
  2⤵
  PID:4684
- C:\Windows\System\hIXuGtv.exe
  C:\Windows\System\hIXuGtv.exe
  2⤵
  PID:4732
- C:\Windows\System\quwtRcV.exe
  C:\Windows\System\quwtRcV.exe
  2⤵
  PID:4708
- C:\Windows\System\gjeMNfJ.exe
  C:\Windows\System\gjeMNfJ.exe
  2⤵
  PID:4748
- C:\Windows\System\rLxDFgm.exe
  C:\Windows\System\rLxDFgm.exe
  2⤵
  PID:4840
- C:\Windows\System\UeHFSKF.exe
  C:\Windows\System\UeHFSKF.exe
  2⤵
  PID:4784
- C:\Windows\System\iJiNujb.exe
  C:\Windows\System\iJiNujb.exe
  2⤵
  PID:4864
- C:\Windows\System\iyiILod.exe
  C:\Windows\System\iyiILod.exe
  2⤵
  PID:4924
- C:\Windows\System\DqQCnAW.exe
  C:\Windows\System\DqQCnAW.exe
  2⤵
  PID:4964
- C:\Windows\System\IxmveQF.exe
  C:\Windows\System\IxmveQF.exe
  2⤵
  PID:4952
- C:\Windows\System\LpTXQhh.exe
  C:\Windows\System\LpTXQhh.exe
  2⤵
  PID:4992
- C:\Windows\System\RWzXDdv.exe
  C:\Windows\System\RWzXDdv.exe
  2⤵
  PID:5044
- C:\Windows\System\qtcLtof.exe
  C:\Windows\System\qtcLtof.exe
  2⤵
  PID:5096
- C:\Windows\System\AXklYlO.exe
  C:\Windows\System\AXklYlO.exe
  2⤵
  PID:3384
- C:\Windows\System\khHtsQp.exe
  C:\Windows\System\khHtsQp.exe
  2⤵
  PID:2924
- C:\Windows\System\qEaUVme.exe
  C:\Windows\System\qEaUVme.exe
  2⤵
  PID:3824
- C:\Windows\System\TNTjYBF.exe
  C:\Windows\System\TNTjYBF.exe
  2⤵
  PID:3936
- C:\Windows\System\NIxTmIt.exe
  C:\Windows\System\NIxTmIt.exe
  2⤵
  PID:3808
- C:\Windows\System\rgLLpSU.exe
  C:\Windows\System\rgLLpSU.exe
  2⤵
  PID:4048
- C:\Windows\System\semDVIt.exe
  C:\Windows\System\semDVIt.exe
  2⤵
  PID:4024
- C:\Windows\System\czpBWhK.exe
  C:\Windows\System\czpBWhK.exe
  2⤵
  PID:3260
- C:\Windows\System\eKXZNLT.exe
  C:\Windows\System\eKXZNLT.exe
  2⤵
  PID:2732
- C:\Windows\System\OKYkAYE.exe
  C:\Windows\System\OKYkAYE.exe
  2⤵
  PID:4280
- C:\Windows\System\ylsdkxa.exe
  C:\Windows\System\ylsdkxa.exe
  2⤵
  PID:4356
- C:\Windows\System\aphrsLF.exe
  C:\Windows\System\aphrsLF.exe
  2⤵
  PID:4432
- C:\Windows\System\PPvDaxE.exe
  C:\Windows\System\PPvDaxE.exe
  2⤵
  PID:2004
- C:\Windows\System\RrjIQkN.exe
  C:\Windows\System\RrjIQkN.exe
  2⤵
  PID:3308
- C:\Windows\System\tEkQujQ.exe
  C:\Windows\System\tEkQujQ.exe
  2⤵
  PID:4128
- C:\Windows\System\uVgmJzL.exe
  C:\Windows\System\uVgmJzL.exe
  2⤵
  PID:644
- C:\Windows\System\aEVRTId.exe
  C:\Windows\System\aEVRTId.exe
  2⤵
  PID:4324
- C:\Windows\System\SxmnBwF.exe
  C:\Windows\System\SxmnBwF.exe
  2⤵
  PID:4364
- C:\Windows\System\JlkyHGm.exe
  C:\Windows\System\JlkyHGm.exe
  2⤵
  PID:4728
- C:\Windows\System\CkLxRiN.exe
  C:\Windows\System\CkLxRiN.exe
  2⤵
  PID:4808
- C:\Windows\System\oJdkiIk.exe
  C:\Windows\System\oJdkiIk.exe
  2⤵
  PID:4664
- C:\Windows\System\DbkNPVl.exe
  C:\Windows\System\DbkNPVl.exe
  2⤵
  PID:4828
- C:\Windows\System\ouBlRRP.exe
  C:\Windows\System\ouBlRRP.exe
  2⤵
  PID:1504
- C:\Windows\System\iAboOtX.exe
  C:\Windows\System\iAboOtX.exe
  2⤵
  PID:4908
- C:\Windows\System\xWQRNTv.exe
  C:\Windows\System\xWQRNTv.exe
  2⤵
  PID:4988
- C:\Windows\System\BQpOGSa.exe
  C:\Windows\System\BQpOGSa.exe
  2⤵
  PID:5088
- C:\Windows\System\iwhUsCB.exe
  C:\Windows\System\iwhUsCB.exe
  2⤵
  PID:4868
- C:\Windows\System\QLkssXg.exe
  C:\Windows\System\QLkssXg.exe
  2⤵
  PID:1920
- C:\Windows\System\tYUhKZa.exe
  C:\Windows\System\tYUhKZa.exe
  2⤵
  PID:2220
- C:\Windows\System\xtnZFOI.exe
  C:\Windows\System\xtnZFOI.exe
  2⤵
  PID:3628
- C:\Windows\System\rVkaAFz.exe
  C:\Windows\System\rVkaAFz.exe
  2⤵
  PID:3528
- C:\Windows\System\cMYWUJK.exe
  C:\Windows\System\cMYWUJK.exe
  2⤵
  PID:3540
- C:\Windows\System\GIOuHYv.exe
  C:\Windows\System\GIOuHYv.exe
  2⤵
  PID:2884
- C:\Windows\System\KpXlfHu.exe
  C:\Windows\System\KpXlfHu.exe
  2⤵
  PID:4060
- C:\Windows\System\bGzLZhb.exe
  C:\Windows\System\bGzLZhb.exe
  2⤵
  PID:852
- C:\Windows\System\apWwHco.exe
  C:\Windows\System\apWwHco.exe
  2⤵
  PID:4164
- C:\Windows\System\hXqAQTg.exe
  C:\Windows\System\hXqAQTg.exe
  2⤵
  PID:4140
- C:\Windows\System\DXbpUvU.exe
  C:\Windows\System\DXbpUvU.exe
  2⤵
  PID:4400
- C:\Windows\System\gPvuPmy.exe
  C:\Windows\System\gPvuPmy.exe
  2⤵
  PID:3368
- C:\Windows\System\WuvBjOX.exe
  C:\Windows\System\WuvBjOX.exe
  2⤵
  PID:4248
- C:\Windows\System\kgODYrM.exe
  C:\Windows\System\kgODYrM.exe
  2⤵
  PID:4648
- C:\Windows\System\htgdGER.exe
  C:\Windows\System\htgdGER.exe
  2⤵
  PID:4504
- C:\Windows\System\roOGZuV.exe
  C:\Windows\System\roOGZuV.exe
  2⤵
  PID:4608
- C:\Windows\System\xgsowBG.exe
  C:\Windows\System\xgsowBG.exe
  2⤵
  PID:2748
- C:\Windows\System\ginpMPo.exe
  C:\Windows\System\ginpMPo.exe
  2⤵
  PID:4368
- C:\Windows\System\UqOMkSe.exe
  C:\Windows\System\UqOMkSe.exe
  2⤵
  PID:2852
- C:\Windows\System\UhNCjXh.exe
  C:\Windows\System\UhNCjXh.exe
  2⤵
  PID:4772
- C:\Windows\System\rqNPJAU.exe
  C:\Windows\System\rqNPJAU.exe
  2⤵
  PID:1040
- C:\Windows\System\EgDvXjW.exe
  C:\Windows\System\EgDvXjW.exe
  2⤵
  PID:4892
- C:\Windows\System\YhVGCDZ.exe
  C:\Windows\System\YhVGCDZ.exe
  2⤵
  PID:5116
- C:\Windows\System\NMkIQGa.exe
  C:\Windows\System\NMkIQGa.exe
  2⤵
  PID:1824
- C:\Windows\System\SnNbAGq.exe
  C:\Windows\System\SnNbAGq.exe
  2⤵
  PID:1752
- C:\Windows\System\zmcbhXl.exe
  C:\Windows\System\zmcbhXl.exe
  2⤵
  PID:1868
- C:\Windows\System\nKwwpGK.exe
  C:\Windows\System\nKwwpGK.exe
  2⤵
  PID:4688
- C:\Windows\System\QvlzaCD.exe
  C:\Windows\System\QvlzaCD.exe
  2⤵
  PID:4928
- C:\Windows\System\dsweeAU.exe
  C:\Windows\System\dsweeAU.exe
  2⤵
  PID:3008
- C:\Windows\System\EOEPnnp.exe
  C:\Windows\System\EOEPnnp.exe
  2⤵
  PID:2800
- C:\Windows\System\MMBOrgD.exe
  C:\Windows\System\MMBOrgD.exe
  2⤵
  PID:4588
- C:\Windows\System\eLaySus.exe
  C:\Windows\System\eLaySus.exe
  2⤵
  PID:5012
- C:\Windows\System\NjtEwDi.exe
  C:\Windows\System\NjtEwDi.exe
  2⤵
  PID:2756
- C:\Windows\System\BjSSyor.exe
  C:\Windows\System\BjSSyor.exe
  2⤵
  PID:5136
- C:\Windows\System\bVVzmlM.exe
  C:\Windows\System\bVVzmlM.exe
  2⤵
  PID:5152
- C:\Windows\System\FWPDrqv.exe
  C:\Windows\System\FWPDrqv.exe
  2⤵
  PID:5172
- C:\Windows\System\QtjzwcM.exe
  C:\Windows\System\QtjzwcM.exe
  2⤵
  PID:5256
- C:\Windows\System\uybzPiI.exe
  C:\Windows\System\uybzPiI.exe
  2⤵
  PID:5272
- C:\Windows\System\OJWhrIt.exe
  C:\Windows\System\OJWhrIt.exe
  2⤵
  PID:5288
- C:\Windows\System\TPbpUEf.exe
  C:\Windows\System\TPbpUEf.exe
  2⤵
  PID:5308
- C:\Windows\System\naZnBnG.exe
  C:\Windows\System\naZnBnG.exe
  2⤵
  PID:5328
- C:\Windows\System\yZSootT.exe
  C:\Windows\System\yZSootT.exe
  2⤵
  PID:5344
- C:\Windows\System\DGtvJyG.exe
  C:\Windows\System\DGtvJyG.exe
  2⤵
  PID:5368
- C:\Windows\System\hDTcrwP.exe
  C:\Windows\System\hDTcrwP.exe
  2⤵
  PID:5384
- C:\Windows\System\oHrbyHX.exe
  C:\Windows\System\oHrbyHX.exe
  2⤵
  PID:5400
- C:\Windows\System\LuDhgaG.exe
  C:\Windows\System\LuDhgaG.exe
  2⤵
  PID:5420
- C:\Windows\System\WwxTsPT.exe
  C:\Windows\System\WwxTsPT.exe
  2⤵
  PID:5440
- C:\Windows\System\gzYdWLN.exe
  C:\Windows\System\gzYdWLN.exe
  2⤵
  PID:5468
- C:\Windows\System\JbtbzOt.exe
  C:\Windows\System\JbtbzOt.exe
  2⤵
  PID:5484
- C:\Windows\System\WYqloGp.exe
  C:\Windows\System\WYqloGp.exe
  2⤵
  PID:5504
- C:\Windows\System\uDVJTTT.exe
  C:\Windows\System\uDVJTTT.exe
  2⤵
  PID:5520
- C:\Windows\System\iyqAQVf.exe
  C:\Windows\System\iyqAQVf.exe
  2⤵
  PID:5544
- C:\Windows\System\grINtwH.exe
  C:\Windows\System\grINtwH.exe
  2⤵
  PID:5560
- C:\Windows\System\BrlQqLY.exe
  C:\Windows\System\BrlQqLY.exe
  2⤵
  PID:5580
- C:\Windows\System\uRhDzSu.exe
  C:\Windows\System\uRhDzSu.exe
  2⤵
  PID:5608
- C:\Windows\System\VydGCpo.exe
  C:\Windows\System\VydGCpo.exe
  2⤵
  PID:5628
- C:\Windows\System\mSURbfR.exe
  C:\Windows\System\mSURbfR.exe
  2⤵
  PID:5652
- C:\Windows\System\CUALxWA.exe
  C:\Windows\System\CUALxWA.exe
  2⤵
  PID:5668
- C:\Windows\System\KjJmqRj.exe
  C:\Windows\System\KjJmqRj.exe
  2⤵
  PID:5700
- C:\Windows\System\LgWajPF.exe
  C:\Windows\System\LgWajPF.exe
  2⤵
  PID:5720
- C:\Windows\System\KZaQKOF.exe
  C:\Windows\System\KZaQKOF.exe
  2⤵
  PID:5740
- C:\Windows\System\RhwMjzr.exe
  C:\Windows\System\RhwMjzr.exe
  2⤵
  PID:5756
- C:\Windows\System\EiTbGEe.exe
  C:\Windows\System\EiTbGEe.exe
  2⤵
  PID:5780
- C:\Windows\System\spqgeiT.exe
  C:\Windows\System\spqgeiT.exe
  2⤵
  PID:5800
- C:\Windows\System\otCPTFe.exe
  C:\Windows\System\otCPTFe.exe
  2⤵
  PID:5820
- C:\Windows\System\HegQkSs.exe
  C:\Windows\System\HegQkSs.exe
  2⤵
  PID:5836
- C:\Windows\System\xkldnqa.exe
  C:\Windows\System\xkldnqa.exe
  2⤵
  PID:5852
- C:\Windows\System\wkEXmbE.exe
  C:\Windows\System\wkEXmbE.exe
  2⤵
  PID:5872
- C:\Windows\System\ZCNArpG.exe
  C:\Windows\System\ZCNArpG.exe
  2⤵
  PID:5892
- C:\Windows\System\fReScLT.exe
  C:\Windows\System\fReScLT.exe
  2⤵
  PID:5916
- C:\Windows\System\DvAUCuR.exe
  C:\Windows\System\DvAUCuR.exe
  2⤵
  PID:5932
- C:\Windows\System\VAKUFHn.exe
  C:\Windows\System\VAKUFHn.exe
  2⤵
  PID:5956
- C:\Windows\System\qFrnBqV.exe
  C:\Windows\System\qFrnBqV.exe
  2⤵
  PID:5980
- C:\Windows\System\oWYciHC.exe
  C:\Windows\System\oWYciHC.exe
  2⤵
  PID:6000
- C:\Windows\System\VbVKQZg.exe
  C:\Windows\System\VbVKQZg.exe
  2⤵
  PID:6020
- C:\Windows\System\sjixypz.exe
  C:\Windows\System\sjixypz.exe
  2⤵
  PID:6036
- C:\Windows\System\LPxYBNJ.exe
  C:\Windows\System\LPxYBNJ.exe
  2⤵
  PID:6052
- C:\Windows\System\BkxWArK.exe
  C:\Windows\System\BkxWArK.exe
  2⤵
  PID:6068
- C:\Windows\System\uvaecwV.exe
  C:\Windows\System\uvaecwV.exe
  2⤵
  PID:6088
- C:\Windows\System\ELbTmeL.exe
  C:\Windows\System\ELbTmeL.exe
  2⤵
  PID:6104
- C:\Windows\System\bDJyDyY.exe
  C:\Windows\System\bDJyDyY.exe
  2⤵
  PID:6124
- C:\Windows\System\wDiENma.exe
  C:\Windows\System\wDiENma.exe
  2⤵
  PID:4852
- C:\Windows\System\SaiYoVb.exe
  C:\Windows\System\SaiYoVb.exe
  2⤵
  PID:1340
- C:\Windows\System\DHneXiy.exe
  C:\Windows\System\DHneXiy.exe
  2⤵
  PID:4208
- C:\Windows\System\NeQYVsL.exe
  C:\Windows\System\NeQYVsL.exe
  2⤵
  PID:2072
- C:\Windows\System\tkQndUD.exe
  C:\Windows\System\tkQndUD.exe
  2⤵
  PID:4408
- C:\Windows\System\ETOhJIE.exe
  C:\Windows\System\ETOhJIE.exe
  2⤵
  PID:3428
- C:\Windows\System\KkgvUpr.exe
  C:\Windows\System\KkgvUpr.exe
  2⤵
  PID:2260
- C:\Windows\System\noQPEfu.exe
  C:\Windows\System\noQPEfu.exe
  2⤵
  PID:1836
- C:\Windows\System\ITIZBwN.exe
  C:\Windows\System\ITIZBwN.exe
  2⤵
  PID:4652
- C:\Windows\System\EXuTHJJ.exe
  C:\Windows\System\EXuTHJJ.exe
  2⤵
  PID:2876
- C:\Windows\System\uiLfEEs.exe
  C:\Windows\System\uiLfEEs.exe
  2⤵
  PID:4144
- C:\Windows\System\qmPqouX.exe
  C:\Windows\System\qmPqouX.exe
  2⤵
  PID:5192
- C:\Windows\System\gkURefQ.exe
  C:\Windows\System\gkURefQ.exe
  2⤵
  PID:4744
- C:\Windows\System\VfrHNDY.exe
  C:\Windows\System\VfrHNDY.exe
  2⤵
  PID:1076
- C:\Windows\System\CBxXsEc.exe
  C:\Windows\System\CBxXsEc.exe
  2⤵
  PID:2420
- C:\Windows\System\WajBLfW.exe
  C:\Windows\System\WajBLfW.exe
  2⤵
  PID:5224
- C:\Windows\System\AByziyC.exe
  C:\Windows\System\AByziyC.exe
  2⤵
  PID:5244
- C:\Windows\System\YzazulD.exe
  C:\Windows\System\YzazulD.exe
  2⤵
  PID:5300
- C:\Windows\System\gVyVbEQ.exe
  C:\Windows\System\gVyVbEQ.exe
  2⤵
  PID:2028
- C:\Windows\System\kZVgnnP.exe
  C:\Windows\System\kZVgnnP.exe
  2⤵
  PID:5336
- C:\Windows\System\dorZnMt.exe
  C:\Windows\System\dorZnMt.exe
  2⤵
  PID:5448
- C:\Windows\System\GtJKzhT.exe
  C:\Windows\System\GtJKzhT.exe
  2⤵
  PID:5464
- C:\Windows\System\xDRYmaP.exe
  C:\Windows\System\xDRYmaP.exe
  2⤵
  PID:5496
- C:\Windows\System\rWwdAVv.exe
  C:\Windows\System\rWwdAVv.exe
  2⤵
  PID:5568
- C:\Windows\System\pTiTzss.exe
  C:\Windows\System\pTiTzss.exe
  2⤵
  PID:5620
- C:\Windows\System\hEodknI.exe
  C:\Windows\System\hEodknI.exe
  2⤵
  PID:5324
- C:\Windows\System\chHGujm.exe
  C:\Windows\System\chHGujm.exe
  2⤵
  PID:5360
- C:\Windows\System\PYNTizN.exe
  C:\Windows\System\PYNTizN.exe
  2⤵
  PID:5396
- C:\Windows\System\shkPFiw.exe
  C:\Windows\System\shkPFiw.exe
  2⤵
  PID:5600
- C:\Windows\System\MWWsMjz.exe
  C:\Windows\System\MWWsMjz.exe
  2⤵
  PID:5640
- C:\Windows\System\afqcGVp.exe
  C:\Windows\System\afqcGVp.exe
  2⤵
  PID:5688
- C:\Windows\System\dwvygOF.exe
  C:\Windows\System\dwvygOF.exe
  2⤵
  PID:5716
- C:\Windows\System\alRtLGM.exe
  C:\Windows\System\alRtLGM.exe
  2⤵
  PID:3228
- C:\Windows\System\ouXZRiI.exe
  C:\Windows\System\ouXZRiI.exe
  2⤵
  PID:5768
- C:\Windows\System\rEMtWRc.exe
  C:\Windows\System\rEMtWRc.exe
  2⤵
  PID:5776
- C:\Windows\System\pVhoBrI.exe
  C:\Windows\System\pVhoBrI.exe
  2⤵
  PID:5812
- C:\Windows\System\EUjZbzP.exe
  C:\Windows\System\EUjZbzP.exe
  2⤵
  PID:5808
- C:\Windows\System\RVnAGOk.exe
  C:\Windows\System\RVnAGOk.exe
  2⤵
  PID:5900
- C:\Windows\System\jmcQsEU.exe
  C:\Windows\System\jmcQsEU.exe
  2⤵
  PID:5908
- C:\Windows\System\IOREFIp.exe
  C:\Windows\System\IOREFIp.exe
  2⤵
  PID:720
- C:\Windows\System\uEWYRGj.exe
  C:\Windows\System\uEWYRGj.exe
  2⤵
  PID:5992
- C:\Windows\System\VSkfXpJ.exe
  C:\Windows\System\VSkfXpJ.exe
  2⤵
  PID:5964
- C:\Windows\System\BmClpsQ.exe
  C:\Windows\System\BmClpsQ.exe
  2⤵
  PID:6016
- C:\Windows\System\laQEmWp.exe
  C:\Windows\System\laQEmWp.exe
  2⤵
  PID:6100
- C:\Windows\System\GuKxwMy.exe
  C:\Windows\System\GuKxwMy.exe
  2⤵
  PID:6140
- C:\Windows\System\SFdlCYZ.exe
  C:\Windows\System\SFdlCYZ.exe
  2⤵
  PID:6116
- C:\Windows\System\CNRTTCw.exe
  C:\Windows\System\CNRTTCw.exe
  2⤵
  PID:4300
- C:\Windows\System\MBFWyGL.exe
  C:\Windows\System\MBFWyGL.exe
  2⤵
  PID:2692
- C:\Windows\System\wgwVfxw.exe
  C:\Windows\System\wgwVfxw.exe
  2⤵
  PID:5128
- C:\Windows\System\fFwUlmp.exe
  C:\Windows\System\fFwUlmp.exe
  2⤵
  PID:4204
- C:\Windows\System\QMLVtTW.exe
  C:\Windows\System\QMLVtTW.exe
  2⤵
  PID:5208
- C:\Windows\System\YIZQieQ.exe
  C:\Windows\System\YIZQieQ.exe
  2⤵
  PID:2776
- C:\Windows\System\RrDJwPC.exe
  C:\Windows\System\RrDJwPC.exe
  2⤵
  PID:4220
- C:\Windows\System\zRsnKuF.exe
  C:\Windows\System\zRsnKuF.exe
  2⤵
  PID:5236
- C:\Windows\System\AIEnxsj.exe
  C:\Windows\System\AIEnxsj.exe
  2⤵
  PID:2856
- C:\Windows\System\OEVRCIO.exe
  C:\Windows\System\OEVRCIO.exe
  2⤵
  PID:5264
- C:\Windows\System\fOLRRGN.exe
  C:\Windows\System\fOLRRGN.exe
  2⤵
  PID:5376
- C:\Windows\System\ZFWGGfD.exe
  C:\Windows\System\ZFWGGfD.exe
  2⤵
  PID:5320
- C:\Windows\System\iPIKJiM.exe
  C:\Windows\System\iPIKJiM.exe
  2⤵
  PID:5576
- C:\Windows\System\fjukkaw.exe
  C:\Windows\System\fjukkaw.exe
  2⤵
  PID:5556
- C:\Windows\System\zVNQHTx.exe
  C:\Windows\System\zVNQHTx.exe
  2⤵
  PID:5648
- C:\Windows\System\hpLTmFW.exe
  C:\Windows\System\hpLTmFW.exe
  2⤵
  PID:5364
- C:\Windows\System\owZASiQ.exe
  C:\Windows\System\owZASiQ.exe
  2⤵
  PID:5392
- C:\Windows\System\VZzmIkN.exe
  C:\Windows\System\VZzmIkN.exe
  2⤵
  PID:1788
- C:\Windows\System\GINQevB.exe
  C:\Windows\System\GINQevB.exe
  2⤵
  PID:5636
- C:\Windows\System\AUkovgR.exe
  C:\Windows\System\AUkovgR.exe
  2⤵
  PID:5456
- C:\Windows\System\ZqBUYjf.exe
  C:\Windows\System\ZqBUYjf.exe
  2⤵
  PID:5680
- C:\Windows\System\FiWqCuj.exe
  C:\Windows\System\FiWqCuj.exe
  2⤵
  PID:896
- C:\Windows\System\LbjiROg.exe
  C:\Windows\System\LbjiROg.exe
  2⤵
  PID:4412
- C:\Windows\System\eJmdgDl.exe
  C:\Windows\System\eJmdgDl.exe
  2⤵
  PID:5948
- C:\Windows\System\DjuNnMo.exe
  C:\Windows\System\DjuNnMo.exe
  2⤵
  PID:5952
- C:\Windows\System\FfgWeTS.exe
  C:\Windows\System\FfgWeTS.exe
  2⤵
  PID:6044
- C:\Windows\System\HRhMlDG.exe
  C:\Windows\System\HRhMlDG.exe
  2⤵
  PID:4888
- C:\Windows\System\pbCpIzh.exe
  C:\Windows\System\pbCpIzh.exe
  2⤵
  PID:6060
- C:\Windows\System\YmZAXIW.exe
  C:\Windows\System\YmZAXIW.exe
  2⤵
  PID:5204
- C:\Windows\System\SLivvLv.exe
  C:\Windows\System\SLivvLv.exe
  2⤵
  PID:2760
- C:\Windows\System\tlQHFgk.exe
  C:\Windows\System\tlQHFgk.exe
  2⤵
  PID:5164
- C:\Windows\System\chBWodv.exe
  C:\Windows\System\chBWodv.exe
  2⤵
  PID:2136
- C:\Windows\System\PmETwuz.exe
  C:\Windows\System\PmETwuz.exe
  2⤵
  PID:5040
- C:\Windows\System\luLmMjp.exe
  C:\Windows\System\luLmMjp.exe
  2⤵
  PID:2044
- C:\Windows\System\ybtAPKf.exe
  C:\Windows\System\ybtAPKf.exe
  2⤵
  PID:1648
- C:\Windows\System\BDARFdZ.exe
  C:\Windows\System\BDARFdZ.exe
  2⤵
  PID:5752
- C:\Windows\System\FVdkUFj.exe
  C:\Windows\System\FVdkUFj.exe
  2⤵
  PID:5516
- C:\Windows\System\rdMbLvU.exe
  C:\Windows\System\rdMbLvU.exe
  2⤵
  PID:5536
- C:\Windows\System\ZQCSfhm.exe
  C:\Windows\System\ZQCSfhm.exe
  2⤵
  PID:5708
- C:\Windows\System\hVjgHxr.exe
  C:\Windows\System\hVjgHxr.exe
  2⤵
  PID:5512
- C:\Windows\System\svdXWvq.exe
  C:\Windows\System\svdXWvq.exe
  2⤵
  PID:5880
- C:\Windows\System\YglqXnc.exe
  C:\Windows\System\YglqXnc.exe
  2⤵
  PID:2736
- C:\Windows\System\ThSSelF.exe
  C:\Windows\System\ThSSelF.exe
  2⤵
  PID:5868
- C:\Windows\System\afhzRju.exe
  C:\Windows\System\afhzRju.exe
  2⤵
  PID:5924
- C:\Windows\System\evDRCny.exe
  C:\Windows\System\evDRCny.exe
  2⤵
  PID:5968
- C:\Windows\System\gYenHON.exe
  C:\Windows\System\gYenHON.exe
  2⤵
  PID:5180
- C:\Windows\System\nNbFlST.exe
  C:\Windows\System\nNbFlST.exe
  2⤵
  PID:4600
- C:\Windows\System\hgHWMiO.exe
  C:\Windows\System\hgHWMiO.exe
  2⤵
  PID:5500
- C:\Windows\System\hdxGZsv.exe
  C:\Windows\System\hdxGZsv.exe
  2⤵
  PID:5476
- C:\Windows\System\aSGkllY.exe
  C:\Windows\System\aSGkllY.exe
  2⤵
  PID:2248
- C:\Windows\System\OyLZasc.exe
  C:\Windows\System\OyLZasc.exe
  2⤵
  PID:5540
- C:\Windows\System\TTktFlB.exe
  C:\Windows\System\TTktFlB.exe
  2⤵
  PID:2944
- C:\Windows\System\qDmftcf.exe
  C:\Windows\System\qDmftcf.exe
  2⤵
  PID:6008
- C:\Windows\System\JrZYawf.exe
  C:\Windows\System\JrZYawf.exe
  2⤵
  PID:6136
- C:\Windows\System\QUPSXai.exe
  C:\Windows\System\QUPSXai.exe
  2⤵
  PID:5076
- C:\Windows\System\ypxOukY.exe
  C:\Windows\System\ypxOukY.exe
  2⤵
  PID:5228
- C:\Windows\System\xQZmArt.exe
  C:\Windows\System\xQZmArt.exe
  2⤵
  PID:5596
- C:\Windows\System\mklztdt.exe
  C:\Windows\System\mklztdt.exe
  2⤵
  PID:5712
- C:\Windows\System\EMMeWLX.exe
  C:\Windows\System\EMMeWLX.exe
  2⤵
  PID:6132
- C:\Windows\System\hngaruq.exe
  C:\Windows\System\hngaruq.exe
  2⤵
  PID:5460
- C:\Windows\System\eoWkkrF.exe
  C:\Windows\System\eoWkkrF.exe
  2⤵
  PID:5888
- C:\Windows\System\CkjKvXS.exe
  C:\Windows\System\CkjKvXS.exe
  2⤵
  PID:5168
- C:\Windows\System\HxieQNR.exe
  C:\Windows\System\HxieQNR.exe
  2⤵
  PID:5828
- C:\Windows\System\jkjBXKU.exe
  C:\Windows\System\jkjBXKU.exe
  2⤵
  PID:5416
- C:\Windows\System\VrGBXCY.exe
  C:\Windows\System\VrGBXCY.exe
  2⤵
  PID:5944
- C:\Windows\System\dDOkfoI.exe
  C:\Windows\System\dDOkfoI.exe
  2⤵
  PID:2012
- C:\Windows\System\TGXLfmq.exe
  C:\Windows\System\TGXLfmq.exe
  2⤵
  PID:5864
- C:\Windows\System\sdZitrb.exe
  C:\Windows\System\sdZitrb.exe
  2⤵
  PID:6148
- C:\Windows\System\PTlVUYW.exe
  C:\Windows\System\PTlVUYW.exe
  2⤵
  PID:6164
- C:\Windows\System\HSJRPWf.exe
  C:\Windows\System\HSJRPWf.exe
  2⤵
  PID:6184
- C:\Windows\System\bIGvjqp.exe
  C:\Windows\System\bIGvjqp.exe
  2⤵
  PID:6200
- C:\Windows\System\lTEUutX.exe
  C:\Windows\System\lTEUutX.exe
  2⤵
  PID:6216
- C:\Windows\System\fCnaWPu.exe
  C:\Windows\System\fCnaWPu.exe
  2⤵
  PID:6248
- C:\Windows\System\wJVeymK.exe
  C:\Windows\System\wJVeymK.exe
  2⤵
  PID:6264
- C:\Windows\System\EWwWdWN.exe
  C:\Windows\System\EWwWdWN.exe
  2⤵
  PID:6280
- C:\Windows\System\lJbdTKT.exe
  C:\Windows\System\lJbdTKT.exe
  2⤵
  PID:6296
- C:\Windows\System\LiOgFlY.exe
  C:\Windows\System\LiOgFlY.exe
  2⤵
  PID:6312
- C:\Windows\System\qHLBXtJ.exe
  C:\Windows\System\qHLBXtJ.exe
  2⤵
  PID:6328
- C:\Windows\System\idDGYHO.exe
  C:\Windows\System\idDGYHO.exe
  2⤵
  PID:6344
- C:\Windows\System\IrcuZFS.exe
  C:\Windows\System\IrcuZFS.exe
  2⤵
  PID:6368
- C:\Windows\System\CIlEImo.exe
  C:\Windows\System\CIlEImo.exe
  2⤵
  PID:6408
- C:\Windows\System\sosmHmX.exe
  C:\Windows\System\sosmHmX.exe
  2⤵
  PID:6424
- C:\Windows\System\nejNHmi.exe
  C:\Windows\System\nejNHmi.exe
  2⤵
  PID:6448
- C:\Windows\System\fDzTNHK.exe
  C:\Windows\System\fDzTNHK.exe
  2⤵
  PID:6464
- C:\Windows\System\poDTqCn.exe
  C:\Windows\System\poDTqCn.exe
  2⤵
  PID:6480
- C:\Windows\System\wScJDuB.exe
  C:\Windows\System\wScJDuB.exe
  2⤵
  PID:6500
- C:\Windows\System\hjHYdHx.exe
  C:\Windows\System\hjHYdHx.exe
  2⤵
  PID:6520
- C:\Windows\System\brOlIQs.exe
  C:\Windows\System\brOlIQs.exe
  2⤵
  PID:6544
- C:\Windows\System\ugVjNzA.exe
  C:\Windows\System\ugVjNzA.exe
  2⤵
  PID:6564
- C:\Windows\System\jpDTPxt.exe
  C:\Windows\System\jpDTPxt.exe
  2⤵
  PID:6584
- C:\Windows\System\hvEMiER.exe
  C:\Windows\System\hvEMiER.exe
  2⤵
  PID:6604
- C:\Windows\System\YhDGbtc.exe
  C:\Windows\System\YhDGbtc.exe
  2⤵
  PID:6624
- C:\Windows\System\AWTCOFW.exe
  C:\Windows\System\AWTCOFW.exe
  2⤵
  PID:6644
- C:\Windows\System\wYghmuy.exe
  C:\Windows\System\wYghmuy.exe
  2⤵
  PID:6672
- C:\Windows\System\bHbbKpK.exe
  C:\Windows\System\bHbbKpK.exe
  2⤵
  PID:6688
- C:\Windows\System\iIDujok.exe
  C:\Windows\System\iIDujok.exe
  2⤵
  PID:6704
- C:\Windows\System\VUKLHJR.exe
  C:\Windows\System\VUKLHJR.exe
  2⤵
  PID:6728
- C:\Windows\System\QZRdAao.exe
  C:\Windows\System\QZRdAao.exe
  2⤵
  PID:6752
- C:\Windows\System\SNgTFNR.exe
  C:\Windows\System\SNgTFNR.exe
  2⤵
  PID:6768
- C:\Windows\System\vCvTKmS.exe
  C:\Windows\System\vCvTKmS.exe
  2⤵
  PID:6784
- C:\Windows\System\lofsCQc.exe
  C:\Windows\System\lofsCQc.exe
  2⤵
  PID:6808
- C:\Windows\System\YhNKMeq.exe
  C:\Windows\System\YhNKMeq.exe
  2⤵
  PID:6828
- C:\Windows\System\adqasry.exe
  C:\Windows\System\adqasry.exe
  2⤵
  PID:6852
- C:\Windows\System\alYXwzQ.exe
  C:\Windows\System\alYXwzQ.exe
  2⤵
  PID:6888
- C:\Windows\System\ccfOdCd.exe
  C:\Windows\System\ccfOdCd.exe
  2⤵
  PID:6904
- C:\Windows\System\ZQwzjJY.exe
  C:\Windows\System\ZQwzjJY.exe
  2⤵
  PID:6920
- C:\Windows\System\vDyaOsl.exe
  C:\Windows\System\vDyaOsl.exe
  2⤵
  PID:6936
- C:\Windows\System\xcokhDH.exe
  C:\Windows\System\xcokhDH.exe
  2⤵
  PID:6952
- C:\Windows\System\LJHSHlh.exe
  C:\Windows\System\LJHSHlh.exe
  2⤵
  PID:6972
- C:\Windows\System\MxTVQmv.exe
  C:\Windows\System\MxTVQmv.exe
  2⤵
  PID:6992
- C:\Windows\System\hggeIqU.exe
  C:\Windows\System\hggeIqU.exe
  2⤵
  PID:7012
- C:\Windows\System\BKAFtrC.exe
  C:\Windows\System\BKAFtrC.exe
  2⤵
  PID:7028
- C:\Windows\System\BVCoTyG.exe
  C:\Windows\System\BVCoTyG.exe
  2⤵
  PID:7068
- C:\Windows\System\XyjpApz.exe
  C:\Windows\System\XyjpApz.exe
  2⤵
  PID:7084
- C:\Windows\System\kbZnqsy.exe
  C:\Windows\System\kbZnqsy.exe
  2⤵
  PID:7100
- C:\Windows\System\euOHYlK.exe
  C:\Windows\System\euOHYlK.exe
  2⤵
  PID:7116
- C:\Windows\System\Heoadon.exe
  C:\Windows\System\Heoadon.exe
  2⤵
  PID:7136
- C:\Windows\System\HSgikkw.exe
  C:\Windows\System\HSgikkw.exe
  2⤵
  PID:7152
- C:\Windows\System\ddkxuuo.exe
  C:\Windows\System\ddkxuuo.exe
  2⤵
  PID:5188
- C:\Windows\System\uCfeKIZ.exe
  C:\Windows\System\uCfeKIZ.exe
  2⤵
  PID:6160
- C:\Windows\System\vrzbHyR.exe
  C:\Windows\System\vrzbHyR.exe
  2⤵
  PID:6232
- C:\Windows\System\QRmITCc.exe
  C:\Windows\System\QRmITCc.exe
  2⤵
  PID:6272
- C:\Windows\System\tAuIXbl.exe
  C:\Windows\System\tAuIXbl.exe
  2⤵
  PID:6212
- C:\Windows\System\JdqNSir.exe
  C:\Windows\System\JdqNSir.exe
  2⤵
  PID:6256
- C:\Windows\System\ZRpBIgs.exe
  C:\Windows\System\ZRpBIgs.exe
  2⤵
  PID:6336
- C:\Windows\System\hRwZoXx.exe
  C:\Windows\System\hRwZoXx.exe
  2⤵
  PID:6384
- C:\Windows\System\RXPeuek.exe
  C:\Windows\System\RXPeuek.exe
  2⤵
  PID:6352
- C:\Windows\System\CfJNAWy.exe
  C:\Windows\System\CfJNAWy.exe
  2⤵
  PID:6456
- C:\Windows\System\pisaRat.exe
  C:\Windows\System\pisaRat.exe
  2⤵
  PID:6516
- C:\Windows\System\nPcNmWp.exe
  C:\Windows\System\nPcNmWp.exe
  2⤵
  PID:6560
- C:\Windows\System\NMWePyZ.exe
  C:\Windows\System\NMWePyZ.exe
  2⤵
  PID:6592
- C:\Windows\System\rCPzAjs.exe
  C:\Windows\System\rCPzAjs.exe
  2⤵
  PID:6496
- C:\Windows\System\kTUlEMo.exe
  C:\Windows\System\kTUlEMo.exe
  2⤵
  PID:6636
- C:\Windows\System\jYhezww.exe
  C:\Windows\System\jYhezww.exe
  2⤵
  PID:6620
- C:\Windows\System\GHnJkyf.exe
  C:\Windows\System\GHnJkyf.exe
  2⤵
  PID:6716
- C:\Windows\System\teASwWr.exe
  C:\Windows\System\teASwWr.exe
  2⤵
  PID:6792
- C:\Windows\System\jvHTDBd.exe
  C:\Windows\System\jvHTDBd.exe
  2⤵
  PID:6744
- C:\Windows\System\xomGEki.exe
  C:\Windows\System\xomGEki.exe
  2⤵
  PID:6700
- C:\Windows\System\MyGaKAr.exe
  C:\Windows\System\MyGaKAr.exe
  2⤵
  PID:6780
- C:\Windows\System\WoDwyYV.exe
  C:\Windows\System\WoDwyYV.exe
  2⤵
  PID:6820
- C:\Windows\System\XOzjinB.exe
  C:\Windows\System\XOzjinB.exe
  2⤵
  PID:6900
- C:\Windows\System\TQcLrXM.exe
  C:\Windows\System\TQcLrXM.exe
  2⤵
  PID:6868
- C:\Windows\System\ZvTiQTE.exe
  C:\Windows\System\ZvTiQTE.exe
  2⤵
  PID:6884
- C:\Windows\System\EVwZVHe.exe
  C:\Windows\System\EVwZVHe.exe
  2⤵
  PID:7020
- C:\Windows\System\opbatPo.exe
  C:\Windows\System\opbatPo.exe
  2⤵
  PID:7060
- C:\Windows\System\oCppZUT.exe
  C:\Windows\System\oCppZUT.exe
  2⤵
  PID:7040
- C:\Windows\System\GjosRbt.exe
  C:\Windows\System\GjosRbt.exe
  2⤵
  PID:7128
- C:\Windows\System\XdEluOy.exe
  C:\Windows\System\XdEluOy.exe
  2⤵
  PID:6224
- C:\Windows\System\gXEKkYU.exe
  C:\Windows\System\gXEKkYU.exe
  2⤵
  PID:6392
- C:\Windows\System\lqxRpJg.exe
  C:\Windows\System\lqxRpJg.exe
  2⤵
  PID:6244
- C:\Windows\System\IpShLBR.exe
  C:\Windows\System\IpShLBR.exe
  2⤵
  PID:6180
- C:\Windows\System\uZBrsko.exe
  C:\Windows\System\uZBrsko.exe
  2⤵
  PID:6404
- C:\Windows\System\ZraTxfA.exe
  C:\Windows\System\ZraTxfA.exe
  2⤵
  PID:6376
- C:\Windows\System\SISAbeg.exe
  C:\Windows\System\SISAbeg.exe
  2⤵
  PID:6400
- C:\Windows\System\FdgaMPO.exe
  C:\Windows\System\FdgaMPO.exe
  2⤵
  PID:6440
- C:\Windows\System\yRiyhcD.exe
  C:\Windows\System\yRiyhcD.exe
  2⤵
  PID:6512
- C:\Windows\System\OOxVeBg.exe
  C:\Windows\System\OOxVeBg.exe
  2⤵
  PID:6640
- C:\Windows\System\liRpanN.exe
  C:\Windows\System\liRpanN.exe
  2⤵
  PID:6796
- C:\Windows\System\JcLytqZ.exe
  C:\Windows\System\JcLytqZ.exe
  2⤵
  PID:6540
- C:\Windows\System\ucYnKpu.exe
  C:\Windows\System\ucYnKpu.exe
  2⤵
  PID:6760
- C:\Windows\System\PNdStTH.exe
  C:\Windows\System\PNdStTH.exe
  2⤵
  PID:6876
- C:\Windows\System\IaQsjqX.exe
  C:\Windows\System\IaQsjqX.exe
  2⤵
  PID:6576
- C:\Windows\System\ynHqXZJ.exe
  C:\Windows\System\ynHqXZJ.exe
  2⤵
  PID:6960
- C:\Windows\System\CysAOyA.exe
  C:\Windows\System\CysAOyA.exe
  2⤵
  PID:6980
- C:\Windows\System\kYidcRW.exe
  C:\Windows\System\kYidcRW.exe
  2⤵
  PID:7056
- C:\Windows\System\gCTypLm.exe
  C:\Windows\System\gCTypLm.exe
  2⤵
  PID:7124
- C:\Windows\System\Pdzotdq.exe
  C:\Windows\System\Pdzotdq.exe
  2⤵
  PID:6208
- C:\Windows\System\mZigpvG.exe
  C:\Windows\System\mZigpvG.exe
  2⤵
  PID:6240
- C:\Windows\System\QLDrjsA.exe
  C:\Windows\System\QLDrjsA.exe
  2⤵
  PID:6176
- C:\Windows\System\QekjHTg.exe
  C:\Windows\System\QekjHTg.exe
  2⤵
  PID:6444
- C:\Windows\System\jRlQfCO.exe
  C:\Windows\System\jRlQfCO.exe
  2⤵
  PID:6572
- C:\Windows\System\swgIwgL.exe
  C:\Windows\System\swgIwgL.exe
  2⤵
  PID:6476
- C:\Windows\System\ybKnYmR.exe
  C:\Windows\System\ybKnYmR.exe
  2⤵
  PID:6896
- C:\Windows\System\LBrQSwi.exe
  C:\Windows\System\LBrQSwi.exe
  2⤵
  PID:6836
- C:\Windows\System\lxDCJOt.exe
  C:\Windows\System\lxDCJOt.exe
  2⤵
  PID:6848
- C:\Windows\System\LwkuPub.exe
  C:\Windows\System\LwkuPub.exe
  2⤵
  PID:6948
- C:\Windows\System\avsUXcw.exe
  C:\Windows\System\avsUXcw.exe
  2⤵
  PID:6916
- C:\Windows\System\xxylxZu.exe
  C:\Windows\System\xxylxZu.exe
  2⤵
  PID:6308
- C:\Windows\System\xISKuOe.exe
  C:\Windows\System\xISKuOe.exe
  2⤵
  PID:7080
- C:\Windows\System\uiZpOgq.exe
  C:\Windows\System\uiZpOgq.exe
  2⤵
  PID:6320
- C:\Windows\System\HtxThLl.exe
  C:\Windows\System\HtxThLl.exe
  2⤵
  PID:6740
- C:\Windows\System\fMMhnFO.exe
  C:\Windows\System\fMMhnFO.exe
  2⤵
  PID:7148
- C:\Windows\System\uUbYTCu.exe
  C:\Windows\System\uUbYTCu.exe
  2⤵
  PID:6596
- C:\Windows\System\JWgeWbI.exe
  C:\Windows\System\JWgeWbI.exe
  2⤵
  PID:6696
- C:\Windows\System\mVnncdV.exe
  C:\Windows\System\mVnncdV.exe
  2⤵
  PID:7004
- C:\Windows\System\MAVQsXX.exe
  C:\Windows\System\MAVQsXX.exe
  2⤵
  PID:7184
- C:\Windows\System\hwLEhdc.exe
  C:\Windows\System\hwLEhdc.exe
  2⤵
  PID:7200
- C:\Windows\System\XKOjDvH.exe
  C:\Windows\System\XKOjDvH.exe
  2⤵
  PID:7256
- C:\Windows\System\rodrsXM.exe
  C:\Windows\System\rodrsXM.exe
  2⤵
  PID:7272
- C:\Windows\System\MzaxDRO.exe
  C:\Windows\System\MzaxDRO.exe
  2⤵
  PID:7300
- C:\Windows\System\QyOsfTq.exe
  C:\Windows\System\QyOsfTq.exe
  2⤵
  PID:7316
- C:\Windows\System\geyfCtJ.exe
  C:\Windows\System\geyfCtJ.exe
  2⤵
  PID:7332
- C:\Windows\System\KEQOODl.exe
  C:\Windows\System\KEQOODl.exe
  2⤵
  PID:7356
- C:\Windows\System\xlsRUMe.exe
  C:\Windows\System\xlsRUMe.exe
  2⤵
  PID:7376
- C:\Windows\System\RKgLznq.exe
  C:\Windows\System\RKgLznq.exe
  2⤵
  PID:7392
- C:\Windows\System\WtDgZfV.exe
  C:\Windows\System\WtDgZfV.exe
  2⤵
  PID:7416
- C:\Windows\System\szSXpvj.exe
  C:\Windows\System\szSXpvj.exe
  2⤵
  PID:7432
- C:\Windows\System\XvcdBUr.exe
  C:\Windows\System\XvcdBUr.exe
  2⤵
  PID:7448
- C:\Windows\System\poxJkWF.exe
  C:\Windows\System\poxJkWF.exe
  2⤵
  PID:7468
- C:\Windows\System\BwHlJhd.exe
  C:\Windows\System\BwHlJhd.exe
  2⤵
  PID:7488
- C:\Windows\System\TFFQyHI.exe
  C:\Windows\System\TFFQyHI.exe
  2⤵
  PID:7512
- C:\Windows\System\EVRpAGK.exe
  C:\Windows\System\EVRpAGK.exe
  2⤵
  PID:7528
- C:\Windows\System\zuXGLlf.exe
  C:\Windows\System\zuXGLlf.exe
  2⤵
  PID:7548
- C:\Windows\System\jcgdUDw.exe
  C:\Windows\System\jcgdUDw.exe
  2⤵
  PID:7576
- C:\Windows\System\iOIrrCg.exe
  C:\Windows\System\iOIrrCg.exe
  2⤵
  PID:7592
- C:\Windows\System\DBtjfqc.exe
  C:\Windows\System\DBtjfqc.exe
  2⤵
  PID:7608
- C:\Windows\System\RDgmSHp.exe
  C:\Windows\System\RDgmSHp.exe
  2⤵
  PID:7632
- C:\Windows\System\YTEqBDB.exe
  C:\Windows\System\YTEqBDB.exe
  2⤵
  PID:7652
- C:\Windows\System\nUWYBbM.exe
  C:\Windows\System\nUWYBbM.exe
  2⤵
  PID:7676
- C:\Windows\System\EhNzqGs.exe
  C:\Windows\System\EhNzqGs.exe
  2⤵
  PID:7692
- C:\Windows\System\AwarkmB.exe
  C:\Windows\System\AwarkmB.exe
  2⤵
  PID:7708
- C:\Windows\System\rJSedui.exe
  C:\Windows\System\rJSedui.exe
  2⤵
  PID:7728
- C:\Windows\System\qmZfmca.exe
  C:\Windows\System\qmZfmca.exe
  2⤵
  PID:7748
- C:\Windows\System\NzHuoNd.exe
  C:\Windows\System\NzHuoNd.exe
  2⤵
  PID:7768
- C:\Windows\System\ECBurnV.exe
  C:\Windows\System\ECBurnV.exe
  2⤵
  PID:7784
- C:\Windows\System\IokPNlW.exe
  C:\Windows\System\IokPNlW.exe
  2⤵
  PID:7812
- C:\Windows\System\UjNXUaz.exe
  C:\Windows\System\UjNXUaz.exe
  2⤵
  PID:7832
- C:\Windows\System\GeEcmTr.exe
  C:\Windows\System\GeEcmTr.exe
  2⤵
  PID:7848
- C:\Windows\System\YXrYyYc.exe
  C:\Windows\System\YXrYyYc.exe
  2⤵
  PID:7868
- C:\Windows\System\ajGOWrZ.exe
  C:\Windows\System\ajGOWrZ.exe
  2⤵
  PID:7892
- C:\Windows\System\zCeeeUP.exe
  C:\Windows\System\zCeeeUP.exe
  2⤵
  PID:7912
- C:\Windows\System\psPeKSj.exe
  C:\Windows\System\psPeKSj.exe
  2⤵
  PID:7928
- C:\Windows\System\IWxRbLX.exe
  C:\Windows\System\IWxRbLX.exe
  2⤵
  PID:7948
- C:\Windows\System\mvJpfRy.exe
  C:\Windows\System\mvJpfRy.exe
  2⤵
  PID:7972
- C:\Windows\System\msFjtqN.exe
  C:\Windows\System\msFjtqN.exe
  2⤵
  PID:7988
- C:\Windows\System\siVBVmR.exe
  C:\Windows\System\siVBVmR.exe
  2⤵
  PID:8004
- C:\Windows\System\HiJHCkX.exe
  C:\Windows\System\HiJHCkX.exe
  2⤵
  PID:8036
- C:\Windows\System\lwPwxfR.exe
  C:\Windows\System\lwPwxfR.exe
  2⤵
  PID:8052
- C:\Windows\System\tovjLMe.exe
  C:\Windows\System\tovjLMe.exe
  2⤵
  PID:8072
- C:\Windows\System\vCMALqX.exe
  C:\Windows\System\vCMALqX.exe
  2⤵
  PID:8092
- C:\Windows\System\JIKPIny.exe
  C:\Windows\System\JIKPIny.exe
  2⤵
  PID:8112
- C:\Windows\System\xSTJsRj.exe
  C:\Windows\System\xSTJsRj.exe
  2⤵
  PID:8136
- C:\Windows\System\IhIPHav.exe
  C:\Windows\System\IhIPHav.exe
  2⤵
  PID:8156
- C:\Windows\System\WOixJJz.exe
  C:\Windows\System\WOixJJz.exe
  2⤵
  PID:8172
- C:\Windows\System\ovMjAJw.exe
  C:\Windows\System\ovMjAJw.exe
  2⤵
  PID:7048
- C:\Windows\System\LNyfhJn.exe
  C:\Windows\System\LNyfhJn.exe
  2⤵
  PID:7112
- C:\Windows\System\XtxKdpa.exe
  C:\Windows\System\XtxKdpa.exe
  2⤵
  PID:6712
- C:\Windows\System\sWUoRNr.exe
  C:\Windows\System\sWUoRNr.exe
  2⤵
  PID:7196
- C:\Windows\System\RFTuFym.exe
  C:\Windows\System\RFTuFym.exe
  2⤵
  PID:6668
- C:\Windows\System\bKofqPv.exe
  C:\Windows\System\bKofqPv.exe
  2⤵
  PID:1724
- C:\Windows\System\vkEDWzZ.exe
  C:\Windows\System\vkEDWzZ.exe
  2⤵
  PID:7216
- C:\Windows\System\AuyZtdA.exe
  C:\Windows\System\AuyZtdA.exe
  2⤵
  PID:7240
- C:\Windows\System\MWvaTaL.exe
  C:\Windows\System\MWvaTaL.exe
  2⤵
  PID:7264
- C:\Windows\System\qqHiCgC.exe
  C:\Windows\System\qqHiCgC.exe
  2⤵
  PID:7284
- C:\Windows\System\ucNMmDY.exe
  C:\Windows\System\ucNMmDY.exe
  2⤵
  PID:7312
- C:\Windows\System\bbmpGVq.exe
  C:\Windows\System\bbmpGVq.exe
  2⤵
  PID:7328
- C:\Windows\System\wCAqPes.exe
  C:\Windows\System\wCAqPes.exe
  2⤵
  PID:7388
- C:\Windows\System\STRcIHt.exe
  C:\Windows\System\STRcIHt.exe
  2⤵
  PID:7408
- C:\Windows\System\aFMCUlM.exe
  C:\Windows\System\aFMCUlM.exe
  2⤵
  PID:7460
- C:\Windows\System\QAxMkhN.exe
  C:\Windows\System\QAxMkhN.exe
  2⤵
  PID:7508
- C:\Windows\System\UIghHql.exe
  C:\Windows\System\UIghHql.exe
  2⤵
  PID:7544
- C:\Windows\System\QWPEfcn.exe
  C:\Windows\System\QWPEfcn.exe
  2⤵
  PID:7588
- C:\Windows\System\nmEeVIa.exe
  C:\Windows\System\nmEeVIa.exe
  2⤵
  PID:7564
- C:\Windows\System\wlXCRFA.exe
  C:\Windows\System\wlXCRFA.exe
  2⤵
  PID:7600
- C:\Windows\System\nsSWmso.exe
  C:\Windows\System\nsSWmso.exe
  2⤵
  PID:7556
- C:\Windows\System\IZGlBZG.exe
  C:\Windows\System\IZGlBZG.exe
  2⤵
  PID:7668
- C:\Windows\System\zIllCYc.exe
  C:\Windows\System\zIllCYc.exe
  2⤵
  PID:7776
- C:\Windows\System\jdmcNSW.exe
  C:\Windows\System\jdmcNSW.exe
  2⤵
  PID:7760
- C:\Windows\System\AdCooDd.exe
  C:\Windows\System\AdCooDd.exe
  2⤵
  PID:7792
- C:\Windows\System\RDpjBMy.exe
  C:\Windows\System\RDpjBMy.exe
  2⤵
  PID:7860
- C:\Windows\System\WvDayPk.exe
  C:\Windows\System\WvDayPk.exe
  2⤵
  PID:7796
- C:\Windows\System\RdmujaD.exe
  C:\Windows\System\RdmujaD.exe
  2⤵
  PID:7936
- C:\Windows\System\OvhFauC.exe
  C:\Windows\System\OvhFauC.exe
  2⤵
  PID:7984
- C:\Windows\System\rLeVoqk.exe
  C:\Windows\System\rLeVoqk.exe
  2⤵
  PID:7876
- C:\Windows\System\kSVIQRC.exe
  C:\Windows\System\kSVIQRC.exe
  2⤵
  PID:7880
- C:\Windows\System\jwqAwNN.exe
  C:\Windows\System\jwqAwNN.exe
  2⤵
  PID:7996
- C:\Windows\System\EOIvwIN.exe
  C:\Windows\System\EOIvwIN.exe
  2⤵
  PID:8060
- C:\Windows\System\lLWeQuW.exe
  C:\Windows\System\lLWeQuW.exe
  2⤵
  PID:7960
- C:\Windows\System\XLJIlsg.exe
  C:\Windows\System\XLJIlsg.exe
  2⤵
  PID:8124
- C:\Windows\System\ehZfkAF.exe
  C:\Windows\System\ehZfkAF.exe
  2⤵
  PID:8128
- C:\Windows\System\VJXtbjS.exe
  C:\Windows\System\VJXtbjS.exe
  2⤵
  PID:8188
- C:\Windows\System\WxDguFl.exe
  C:\Windows\System\WxDguFl.exe
  2⤵
  PID:6680
- C:\Windows\System\mOXRXkk.exe
  C:\Windows\System\mOXRXkk.exe
  2⤵
  PID:7212
- C:\Windows\System\VXqwWkE.exe
  C:\Windows\System\VXqwWkE.exe
  2⤵
  PID:7292
- C:\Windows\System\BOXscTD.exe
  C:\Windows\System\BOXscTD.exe
  2⤵
  PID:7368
- C:\Windows\System\snyPOpu.exe
  C:\Windows\System\snyPOpu.exe
  2⤵
  PID:7540
- C:\Windows\System\qxhBJFi.exe
  C:\Windows\System\qxhBJFi.exe
  2⤵
  PID:7568
- C:\Windows\System\cXLMXMw.exe
  C:\Windows\System\cXLMXMw.exe
  2⤵
  PID:7744
- C:\Windows\System\YtPhutE.exe
  C:\Windows\System\YtPhutE.exe
  2⤵
  PID:7904
- C:\Windows\System\FiDfLtu.exe
  C:\Windows\System\FiDfLtu.exe
  2⤵
  PID:7944
- C:\Windows\System\QPZJRRX.exe
  C:\Windows\System\QPZJRRX.exe
  2⤵
  PID:8080
- C:\Windows\System\yijfLcp.exe
  C:\Windows\System\yijfLcp.exe
  2⤵
  PID:7208
- C:\Windows\System\aKlstno.exe
  C:\Windows\System\aKlstno.exe
  2⤵
  PID:7560
- C:\Windows\System\evUslev.exe
  C:\Windows\System\evUslev.exe
  2⤵
  PID:7900
- C:\Windows\System\fKKzPIn.exe
  C:\Windows\System\fKKzPIn.exe
  2⤵
  PID:7352
- C:\Windows\System\jqXbEXC.exe
  C:\Windows\System\jqXbEXC.exe
  2⤵
  PID:7480
- C:\Windows\System\sTcmEtY.exe
  C:\Windows\System\sTcmEtY.exe
  2⤵
  PID:8208
- C:\Windows\System\LixgszL.exe
  C:\Windows\System\LixgszL.exe
  2⤵
  PID:8236
- C:\Windows\System\RZjsUku.exe
  C:\Windows\System\RZjsUku.exe
  2⤵
  PID:8252
- C:\Windows\System\KfEClvv.exe
  C:\Windows\System\KfEClvv.exe
  2⤵
  PID:8276
- C:\Windows\System\IQXFKVq.exe
  C:\Windows\System\IQXFKVq.exe
  2⤵
  PID:8300
- C:\Windows\System\ZJYvCDO.exe
  C:\Windows\System\ZJYvCDO.exe
  2⤵
  PID:8316
- C:\Windows\System\BwxiyWM.exe
  C:\Windows\System\BwxiyWM.exe
  2⤵
  PID:8332
- C:\Windows\System\svATZfz.exe
  C:\Windows\System\svATZfz.exe
  2⤵
  PID:8360
- C:\Windows\System\fALMGBV.exe
  C:\Windows\System\fALMGBV.exe
  2⤵
  PID:8380
- C:\Windows\System\ubXwexR.exe
  C:\Windows\System\ubXwexR.exe
  2⤵
  PID:8400
- C:\Windows\System\OYmbvpN.exe
  C:\Windows\System\OYmbvpN.exe
  2⤵
  PID:8420
- C:\Windows\System\GUiLKEb.exe
  C:\Windows\System\GUiLKEb.exe
  2⤵
  PID:8444
- C:\Windows\System\FJCvGfF.exe
  C:\Windows\System\FJCvGfF.exe
  2⤵
  PID:8496
- C:\Windows\System\YNJRBer.exe
  C:\Windows\System\YNJRBer.exe
  2⤵
  PID:8520
- C:\Windows\System\oLEKfxZ.exe
  C:\Windows\System\oLEKfxZ.exe
  2⤵
  PID:8540
- C:\Windows\System\EDvdgPO.exe
  C:\Windows\System\EDvdgPO.exe
  2⤵
  PID:8564
- C:\Windows\System\mGlwniD.exe
  C:\Windows\System\mGlwniD.exe
  2⤵
  PID:8580
- C:\Windows\System\HozFRWQ.exe
  C:\Windows\System\HozFRWQ.exe
  2⤵
  PID:8596
- C:\Windows\System\orSykiL.exe
  C:\Windows\System\orSykiL.exe
  2⤵
  PID:8620
- C:\Windows\System\HBgPUOG.exe
  C:\Windows\System\HBgPUOG.exe
  2⤵
  PID:8640
- C:\Windows\System\KLAcpsl.exe
  C:\Windows\System\KLAcpsl.exe
  2⤵
  PID:8656
- C:\Windows\System\XLdBVDa.exe
  C:\Windows\System\XLdBVDa.exe
  2⤵
  PID:8676
- C:\Windows\System\UXKbkGl.exe
  C:\Windows\System\UXKbkGl.exe
  2⤵
  PID:8700
- C:\Windows\System\ZVRaxSb.exe
  C:\Windows\System\ZVRaxSb.exe
  2⤵
  PID:8716
- C:\Windows\System\bqKrxyx.exe
  C:\Windows\System\bqKrxyx.exe
  2⤵
  PID:8732
- C:\Windows\System\WzGziWv.exe
  C:\Windows\System\WzGziWv.exe
  2⤵
  PID:8756
- C:\Windows\System\DPjUjcP.exe
  C:\Windows\System\DPjUjcP.exe
  2⤵
  PID:8772
- C:\Windows\System\EHLDGSn.exe
  C:\Windows\System\EHLDGSn.exe
  2⤵
  PID:8788
- C:\Windows\System\Vwkjqgw.exe
  C:\Windows\System\Vwkjqgw.exe
  2⤵
  PID:8808
- C:\Windows\System\PfGsaBb.exe
  C:\Windows\System\PfGsaBb.exe
  2⤵
  PID:8844
- C:\Windows\System\SQGKaXK.exe
  C:\Windows\System\SQGKaXK.exe
  2⤵
  PID:8860
- C:\Windows\System\IjslJPA.exe
  C:\Windows\System\IjslJPA.exe
  2⤵
  PID:8884
- C:\Windows\System\DkhMUdN.exe
  C:\Windows\System\DkhMUdN.exe
  2⤵
  PID:8900
- C:\Windows\System\DxaRIck.exe
  C:\Windows\System\DxaRIck.exe
  2⤵
  PID:8920
- C:\Windows\System\JHUEkwz.exe
  C:\Windows\System\JHUEkwz.exe
  2⤵
  PID:8944
- C:\Windows\System\bfGvIUi.exe
  C:\Windows\System\bfGvIUi.exe
  2⤵
  PID:8968
- C:\Windows\System\GjcrKlZ.exe
  C:\Windows\System\GjcrKlZ.exe
  2⤵
  PID:8984
- C:\Windows\System\GfYmolv.exe
  C:\Windows\System\GfYmolv.exe
  2⤵
  PID:9000
- C:\Windows\System\QbkOzVe.exe
  C:\Windows\System\QbkOzVe.exe
  2⤵
  PID:9024
- C:\Windows\System\ZQFPuSt.exe
  C:\Windows\System\ZQFPuSt.exe
  2⤵
  PID:9060
- C:\Windows\System\GNXIfuz.exe
  C:\Windows\System\GNXIfuz.exe
  2⤵
  PID:9076
- C:\Windows\System\HdoKTJJ.exe
  C:\Windows\System\HdoKTJJ.exe
  2⤵
  PID:9096
- C:\Windows\System\qoXHUQs.exe
  C:\Windows\System\qoXHUQs.exe
  2⤵
  PID:9112
- C:\Windows\System\ziMByXM.exe
  C:\Windows\System\ziMByXM.exe
  2⤵
  PID:9128
- C:\Windows\System\DrkROIA.exe
  C:\Windows\System\DrkROIA.exe
  2⤵
  PID:9156
- C:\Windows\System\MHvhAVT.exe
  C:\Windows\System\MHvhAVT.exe
  2⤵
  PID:9172
- C:\Windows\System\jrmScUO.exe
  C:\Windows\System\jrmScUO.exe
  2⤵
  PID:9188
- C:\Windows\System\LiURlMN.exe
  C:\Windows\System\LiURlMN.exe
  2⤵
  PID:8244
- C:\Windows\System\KmErHnq.exe
  C:\Windows\System\KmErHnq.exe
  2⤵
  PID:8284
- C:\Windows\System\msKrHpH.exe
  C:\Windows\System\msKrHpH.exe
  2⤵
  PID:8296
- C:\Windows\System\KOhuMhD.exe
  C:\Windows\System\KOhuMhD.exe
  2⤵
  PID:7000
- C:\Windows\System\anlYYaT.exe
  C:\Windows\System\anlYYaT.exe
  2⤵
  PID:7704
- C:\Windows\System\kzPSImy.exe
  C:\Windows\System\kzPSImy.exe
  2⤵
  PID:7232
- C:\Windows\System\NQUWXlN.exe
  C:\Windows\System\NQUWXlN.exe
  2⤵
  PID:7740
- C:\Windows\System\JgipJBU.exe
  C:\Windows\System\JgipJBU.exe
  2⤵
  PID:8416
- C:\Windows\System\JMcwvUg.exe
  C:\Windows\System\JMcwvUg.exe
  2⤵
  PID:7504
- C:\Windows\System\xWqAkDn.exe
  C:\Windows\System\xWqAkDn.exe
  2⤵
  PID:8476
- C:\Windows\System\ghNktTH.exe
  C:\Windows\System\ghNktTH.exe
  2⤵
  PID:7644
- C:\Windows\System\hYzHJtN.exe
  C:\Windows\System\hYzHJtN.exe
  2⤵
  PID:8484
- C:\Windows\System\fQUCGqP.exe
  C:\Windows\System\fQUCGqP.exe
  2⤵
  PID:6432
- C:\Windows\System\vIsgUEB.exe
  C:\Windows\System\vIsgUEB.exe
  2⤵
  PID:7724
- C:\Windows\System\fxMqLJc.exe
  C:\Windows\System\fxMqLJc.exe
  2⤵
  PID:8016
- C:\Windows\System\pPDmpWS.exe
  C:\Windows\System\pPDmpWS.exe
  2⤵
  PID:8104
- C:\Windows\System\QUkqFKf.exe
  C:\Windows\System\QUkqFKf.exe
  2⤵
  PID:8224
- C:\Windows\System\IOJXbqe.exe
  C:\Windows\System\IOJXbqe.exe
  2⤵
  PID:8088
- C:\Windows\System\gqJIxeD.exe
  C:\Windows\System\gqJIxeD.exe
  2⤵
  PID:8268
- C:\Windows\System\dQLMSPf.exe
  C:\Windows\System\dQLMSPf.exe
  2⤵
  PID:7252
- C:\Windows\System\niMyYvB.exe
  C:\Windows\System\niMyYvB.exe
  2⤵
  PID:7428
- C:\Windows\System\yvAAagL.exe
  C:\Windows\System\yvAAagL.exe
  2⤵
  PID:7180
- C:\Windows\System\eQmZqUK.exe
  C:\Windows\System\eQmZqUK.exe
  2⤵
  PID:7864
- C:\Windows\System\jQaHqtX.exe
  C:\Windows\System\jQaHqtX.exe
  2⤵
  PID:8536
- C:\Windows\System\okwypTz.exe
  C:\Windows\System\okwypTz.exe
  2⤵
  PID:8344
- C:\Windows\System\qqFULzg.exe
  C:\Windows\System\qqFULzg.exe
  2⤵
  PID:8356
- C:\Windows\System\yPAfmDU.exe
  C:\Windows\System\yPAfmDU.exe
  2⤵
  PID:8548
- C:\Windows\System\YSDNsnG.exe
  C:\Windows\System\YSDNsnG.exe
  2⤵
  PID:8556
- C:\Windows\System\WdHYxql.exe
  C:\Windows\System\WdHYxql.exe
  2⤵
  PID:8612
- C:\Windows\System\UYlQlTq.exe
  C:\Windows\System\UYlQlTq.exe
  2⤵
  PID:8764
- C:\Windows\System\ZPGXsLb.exe
  C:\Windows\System\ZPGXsLb.exe
  2⤵
  PID:8588
- C:\Windows\System\LOqGqAO.exe
  C:\Windows\System\LOqGqAO.exe
  2⤵
  PID:8632
- C:\Windows\System\mMbnQMO.exe
  C:\Windows\System\mMbnQMO.exe
  2⤵
  PID:8740
- C:\Windows\System\ndMNEfv.exe
  C:\Windows\System\ndMNEfv.exe
  2⤵
  PID:8672
- C:\Windows\System\NfSpNfq.exe
  C:\Windows\System\NfSpNfq.exe
  2⤵
  PID:8816
- C:\Windows\System\ijJgodM.exe
  C:\Windows\System\ijJgodM.exe
  2⤵
  PID:8892
- C:\Windows\System\vWghZyL.exe
  C:\Windows\System\vWghZyL.exe
  2⤵
  PID:8936
- C:\Windows\System\jxIijFu.exe
  C:\Windows\System\jxIijFu.exe
  2⤵
  PID:8824
- C:\Windows\System\xiKITzV.exe
  C:\Windows\System\xiKITzV.exe
  2⤵
  PID:8880
- C:\Windows\System\cylvOjk.exe
  C:\Windows\System\cylvOjk.exe
  2⤵
  PID:8956
- C:\Windows\System\NkzYtyG.exe
  C:\Windows\System\NkzYtyG.exe
  2⤵
  PID:9016
- C:\Windows\System\CsGXKGa.exe
  C:\Windows\System\CsGXKGa.exe
  2⤵
  PID:8804
- C:\Windows\System\lUuzwXr.exe
  C:\Windows\System\lUuzwXr.exe
  2⤵
  PID:9108
- C:\Windows\System\oIUCcwG.exe
  C:\Windows\System\oIUCcwG.exe
  2⤵
  PID:9140
- C:\Windows\System\VYqhDUJ.exe
  C:\Windows\System\VYqhDUJ.exe
  2⤵
  PID:9184
- C:\Windows\System\YxgveYM.exe
  C:\Windows\System\YxgveYM.exe
  2⤵
  PID:9124
- C:\Windows\System\CiqfzyL.exe
  C:\Windows\System\CiqfzyL.exe
  2⤵
  PID:9212
- C:\Windows\System\QbgnIND.exe
  C:\Windows\System\QbgnIND.exe
  2⤵
  PID:7584
- C:\Windows\System\mdoAtkS.exe
  C:\Windows\System\mdoAtkS.exe
  2⤵
  PID:7716
- C:\Windows\System\rRYopvG.exe
  C:\Windows\System\rRYopvG.exe
  2⤵
  PID:8408
- C:\Windows\System\dQqGctE.exe
  C:\Windows\System\dQqGctE.exe
  2⤵
  PID:7824
- C:\Windows\System\zTlhJBG.exe
  C:\Windows\System\zTlhJBG.exe
  2⤵
  PID:7484
- C:\Windows\System\PULEyPt.exe
  C:\Windows\System\PULEyPt.exe
  2⤵
  PID:7684
- C:\Windows\System\iqdmphy.exe
  C:\Windows\System\iqdmphy.exe
  2⤵
  PID:8388
- C:\Windows\System\SJBYBJf.exe
  C:\Windows\System\SJBYBJf.exe
  2⤵
  PID:8032
- C:\Windows\System\rXNvSCf.exe
  C:\Windows\System\rXNvSCf.exe
  2⤵
  PID:8068
- C:\Windows\System\krrRRMt.exe
  C:\Windows\System\krrRRMt.exe
  2⤵
  PID:8228
- C:\Windows\System\kICCPyI.exe
  C:\Windows\System\kICCPyI.exe
  2⤵
  PID:8264
- C:\Windows\System\XYeczXz.exe
  C:\Windows\System\XYeczXz.exe
  2⤵
  PID:7736
- C:\Windows\System\MBqBvLx.exe
  C:\Windows\System\MBqBvLx.exe
  2⤵
  PID:8184
- C:\Windows\System\vJQKymP.exe
  C:\Windows\System\vJQKymP.exe
  2⤵
  PID:8532
- C:\Windows\System\iPMdRvZ.exe
  C:\Windows\System\iPMdRvZ.exe
  2⤵
  PID:8352
- C:\Windows\System\DuswtMF.exe
  C:\Windows\System\DuswtMF.exe
  2⤵
  PID:7908
- C:\Windows\System\pQKyLqZ.exe
  C:\Windows\System\pQKyLqZ.exe
  2⤵
  PID:8684
- C:\Windows\System\TTfkgVq.exe
  C:\Windows\System\TTfkgVq.exe
  2⤵
  PID:8752
- C:\Windows\System\ssCsBQu.exe
  C:\Windows\System\ssCsBQu.exe
  2⤵
  PID:8708
- C:\Windows\System\iyZfNEe.exe
  C:\Windows\System\iyZfNEe.exe
  2⤵
  PID:8932
- C:\Windows\System\mYtdwad.exe
  C:\Windows\System\mYtdwad.exe
  2⤵
  PID:9008
- C:\Windows\System\lBNrNFz.exe
  C:\Windows\System\lBNrNFz.exe
  2⤵
  PID:8852
- C:\Windows\System\eBXxYkf.exe
  C:\Windows\System\eBXxYkf.exe
  2⤵
  PID:8856
- C:\Windows\System\LaDtFJQ.exe
  C:\Windows\System\LaDtFJQ.exe
  2⤵
  PID:9032
- C:\Windows\System\KrVFqvU.exe
  C:\Windows\System\KrVFqvU.exe
  2⤵
  PID:9120
- C:\Windows\System\dlwpQXW.exe
  C:\Windows\System\dlwpQXW.exe
  2⤵
  PID:9152
- C:\Windows\System\SdWNwuG.exe
  C:\Windows\System\SdWNwuG.exe
  2⤵
  PID:7536
- C:\Windows\System\ewzHsbe.exe
  C:\Windows\System\ewzHsbe.exe
  2⤵
  PID:8292
- C:\Windows\System\eLXckZg.exe
  C:\Windows\System\eLXckZg.exe
  2⤵
  PID:8328
- C:\Windows\System\UwiTJIY.exe
  C:\Windows\System\UwiTJIY.exe
  2⤵
  PID:7372
- C:\Windows\System\irqiQAV.exe
  C:\Windows\System\irqiQAV.exe
  2⤵
  PID:7648
- C:\Windows\System\cmRijQG.exe
  C:\Windows\System\cmRijQG.exe
  2⤵
  PID:6416
- C:\Windows\System\eTvRnHK.exe
  C:\Windows\System\eTvRnHK.exe
  2⤵
  PID:7964
- C:\Windows\System\DGIuEzt.exe
  C:\Windows\System\DGIuEzt.exe
  2⤵
  PID:7324
- C:\Windows\System\VTXnlgf.exe
  C:\Windows\System\VTXnlgf.exe
  2⤵
  PID:8440
- C:\Windows\System\XNNmTIv.exe
  C:\Windows\System\XNNmTIv.exe
  2⤵
  PID:8560
- C:\Windows\System\CGFDKeY.exe
  C:\Windows\System\CGFDKeY.exe
  2⤵
  PID:7296
- C:\Windows\System\CoupZzq.exe
  C:\Windows\System\CoupZzq.exe
  2⤵
  PID:8796
- C:\Windows\System\wiRJnsW.exe
  C:\Windows\System\wiRJnsW.exe
  2⤵
  PID:8744
- C:\Windows\System\XxyOBly.exe
  C:\Windows\System\XxyOBly.exe
  2⤵
  PID:8800
- C:\Windows\System\oEiJTXI.exe
  C:\Windows\System\oEiJTXI.exe
  2⤵
  PID:8912
- C:\Windows\System\vVcjQES.exe
  C:\Windows\System\vVcjQES.exe
  2⤵
  PID:8976
- C:\Windows\System\eHVAGpj.exe
  C:\Windows\System\eHVAGpj.exe
  2⤵
  PID:9144
- C:\Windows\System\dEYkmUl.exe
  C:\Windows\System\dEYkmUl.exe
  2⤵
  PID:9164
- C:\Windows\System\WuxzEqE.exe
  C:\Windows\System\WuxzEqE.exe
  2⤵
  PID:7720
- C:\Windows\System\ebZdjZU.exe
  C:\Windows\System\ebZdjZU.exe
  2⤵
  PID:7524
- C:\Windows\System\dyaKQZW.exe
  C:\Windows\System\dyaKQZW.exe
  2⤵
  PID:7956
- C:\Windows\System\efZnVgq.exe
  C:\Windows\System\efZnVgq.exe
  2⤵
  PID:8120
- C:\Windows\System\lwcIKxA.exe
  C:\Windows\System\lwcIKxA.exe
  2⤵
  PID:8232
- C:\Windows\System\nxyupHc.exe
  C:\Windows\System\nxyupHc.exe
  2⤵
  PID:7228
- C:\Windows\System\NLtmcLP.exe
  C:\Windows\System\NLtmcLP.exe
  2⤵
  PID:4488
- C:\Windows\System\xycKxDC.exe
  C:\Windows\System\xycKxDC.exe
  2⤵
  PID:8592
- C:\Windows\System\FWuxfIQ.exe
  C:\Windows\System\FWuxfIQ.exe
  2⤵
  PID:8876
- C:\Windows\System\rxtaJKZ.exe
  C:\Windows\System\rxtaJKZ.exe
  2⤵
  PID:9052
- C:\Windows\System\SnYyuLA.exe
  C:\Windows\System\SnYyuLA.exe
  2⤵
  PID:7404
- C:\Windows\System\PoITnnI.exe
  C:\Windows\System\PoITnnI.exe
  2⤵
  PID:8044
- C:\Windows\System\DltklOM.exe
  C:\Windows\System\DltklOM.exe
  2⤵
  PID:8312
- C:\Windows\System\ITtjOgf.exe
  C:\Windows\System\ITtjOgf.exe
  2⤵
  PID:8696
- C:\Windows\System\GsvuOCX.exe
  C:\Windows\System\GsvuOCX.exe
  2⤵
  PID:9104
- C:\Windows\System\qNGgLmJ.exe
  C:\Windows\System\qNGgLmJ.exe
  2⤵
  PID:8168
- C:\Windows\System\dyWukXY.exe
  C:\Windows\System\dyWukXY.exe
  2⤵
  PID:8464
- C:\Windows\System\rTfCfyy.exe
  C:\Windows\System\rTfCfyy.exe
  2⤵
  PID:8652
- C:\Windows\System\bVwHKPe.exe
  C:\Windows\System\bVwHKPe.exe
  2⤵
  PID:4468
- C:\Windows\System\ZEwFjrW.exe
  C:\Windows\System\ZEwFjrW.exe
  2⤵
  PID:9204
- C:\Windows\System\cRixnAS.exe
  C:\Windows\System\cRixnAS.exe
  2⤵
  PID:8260
- C:\Windows\System\vXApiel.exe
  C:\Windows\System\vXApiel.exe
  2⤵
  PID:8928
- C:\Windows\System\wyurMEr.exe
  C:\Windows\System\wyurMEr.exe
  2⤵
  PID:7808
- C:\Windows\System\ZEiQIUR.exe
  C:\Windows\System\ZEiQIUR.exe
  2⤵
  PID:9092
- C:\Windows\System\qtjGFeN.exe
  C:\Windows\System\qtjGFeN.exe
  2⤵
  PID:8952
- C:\Windows\System\DnptDlE.exe
  C:\Windows\System\DnptDlE.exe
  2⤵
  PID:9232
- C:\Windows\System\xteDkTW.exe
  C:\Windows\System\xteDkTW.exe
  2⤵
  PID:9248
- C:\Windows\System\MZUotaS.exe
  C:\Windows\System\MZUotaS.exe
  2⤵
  PID:9268
- C:\Windows\System\ukmVNYY.exe
  C:\Windows\System\ukmVNYY.exe
  2⤵
  PID:9284
- C:\Windows\System\imZtxBq.exe
  C:\Windows\System\imZtxBq.exe
  2⤵
  PID:9304
- C:\Windows\System\KKzjGTt.exe
  C:\Windows\System\KKzjGTt.exe
  2⤵
  PID:9332
- C:\Windows\System\hvwTDar.exe
  C:\Windows\System\hvwTDar.exe
  2⤵
  PID:9360
- C:\Windows\System\zsfrdxK.exe
  C:\Windows\System\zsfrdxK.exe
  2⤵
  PID:9388
- C:\Windows\System\knOdOdR.exe
  C:\Windows\System\knOdOdR.exe
  2⤵
  PID:9404
- C:\Windows\System\zUkupEj.exe
  C:\Windows\System\zUkupEj.exe
  2⤵
  PID:9420
- C:\Windows\System\HbYGqji.exe
  C:\Windows\System\HbYGqji.exe
  2⤵
  PID:9436
- C:\Windows\System\SQxOHqa.exe
  C:\Windows\System\SQxOHqa.exe
  2⤵
  PID:9452
- C:\Windows\System\JtinTNg.exe
  C:\Windows\System\JtinTNg.exe
  2⤵
  PID:9484
- C:\Windows\System\OdJUGFO.exe
  C:\Windows\System\OdJUGFO.exe
  2⤵
  PID:9500
- C:\Windows\System\UdIcAQz.exe
  C:\Windows\System\UdIcAQz.exe
  2⤵
  PID:9520
- C:\Windows\System\UfDvenk.exe
  C:\Windows\System\UfDvenk.exe
  2⤵
  PID:9540
- C:\Windows\System\PRjpofl.exe
  C:\Windows\System\PRjpofl.exe
  2⤵
  PID:9560
- C:\Windows\System\qvLheLu.exe
  C:\Windows\System\qvLheLu.exe
  2⤵
  PID:9576
- C:\Windows\System\GDcKHlP.exe
  C:\Windows\System\GDcKHlP.exe
  2⤵
  PID:9592
- C:\Windows\System\OvBKDDt.exe
  C:\Windows\System\OvBKDDt.exe
  2⤵
  PID:9608
- C:\Windows\System\QibWdgG.exe
  C:\Windows\System\QibWdgG.exe
  2⤵
  PID:9628
- C:\Windows\System\VWgSLMQ.exe
  C:\Windows\System\VWgSLMQ.exe
  2⤵
  PID:9648
- C:\Windows\System\aPRbTNy.exe
  C:\Windows\System\aPRbTNy.exe
  2⤵
  PID:9696
- C:\Windows\System\URQkhAW.exe
  C:\Windows\System\URQkhAW.exe
  2⤵
  PID:9716
- C:\Windows\System\uuWEZtx.exe
  C:\Windows\System\uuWEZtx.exe
  2⤵
  PID:9732
- C:\Windows\System\flnRlxJ.exe
  C:\Windows\System\flnRlxJ.exe
  2⤵
  PID:9760
- C:\Windows\System\WAUKWDe.exe
  C:\Windows\System\WAUKWDe.exe
  2⤵
  PID:9776
- C:\Windows\System\aEaSqFz.exe
  C:\Windows\System\aEaSqFz.exe
  2⤵
  PID:9792
- C:\Windows\System\VgUUbvN.exe
  C:\Windows\System\VgUUbvN.exe
  2⤵
  PID:9816
- C:\Windows\System\WuXeWRP.exe
  C:\Windows\System\WuXeWRP.exe
  2⤵
  PID:9836
- C:\Windows\System\ABogSUO.exe
  C:\Windows\System\ABogSUO.exe
  2⤵
  PID:9852
- C:\Windows\System\oNwptVs.exe
  C:\Windows\System\oNwptVs.exe
  2⤵
  PID:9880
- C:\Windows\System\QspLtkb.exe
  C:\Windows\System\QspLtkb.exe
  2⤵
  PID:9900
- C:\Windows\System\oceuQsG.exe
  C:\Windows\System\oceuQsG.exe
  2⤵
  PID:9920
- C:\Windows\System\hAfbaut.exe
  C:\Windows\System\hAfbaut.exe
  2⤵
  PID:9940
- C:\Windows\System\UxbHQKH.exe
  C:\Windows\System\UxbHQKH.exe
  2⤵
  PID:9964
- C:\Windows\System\ceURdPu.exe
  C:\Windows\System\ceURdPu.exe
  2⤵
  PID:9980
- C:\Windows\System\SJHKTvZ.exe
  C:\Windows\System\SJHKTvZ.exe
  2⤵
  PID:9996
- C:\Windows\System\ytbquCc.exe
  C:\Windows\System\ytbquCc.exe
  2⤵
  PID:10012
- C:\Windows\System\tIIULhl.exe
  C:\Windows\System\tIIULhl.exe
  2⤵
  PID:10032
- C:\Windows\System\ccKUHoC.exe
  C:\Windows\System\ccKUHoC.exe
  2⤵
  PID:10052
- C:\Windows\System\CVYdodP.exe
  C:\Windows\System\CVYdodP.exe
  2⤵
  PID:10068
- C:\Windows\System\QllDEtk.exe
  C:\Windows\System\QllDEtk.exe
  2⤵
  PID:10084
- C:\Windows\System\FLhoaIk.exe
  C:\Windows\System\FLhoaIk.exe
  2⤵
  PID:10120
- C:\Windows\System\bqtrSEv.exe
  C:\Windows\System\bqtrSEv.exe
  2⤵
  PID:10140
- C:\Windows\System\QGTOqQC.exe
  C:\Windows\System\QGTOqQC.exe
  2⤵
  PID:10156
- C:\Windows\System\FobcmYA.exe
  C:\Windows\System\FobcmYA.exe
  2⤵
  PID:10172
- C:\Windows\System\BLkNULI.exe
  C:\Windows\System\BLkNULI.exe
  2⤵
  PID:10192
- C:\Windows\System\ACgWgXl.exe
  C:\Windows\System\ACgWgXl.exe
  2⤵
  PID:10208
- C:\Windows\System\cJEqKIf.exe
  C:\Windows\System\cJEqKIf.exe
  2⤵
  PID:10236
- C:\Windows\System\mPgcKnO.exe
  C:\Windows\System\mPgcKnO.exe
  2⤵
  PID:9244
- C:\Windows\System\klQSgjO.exe
  C:\Windows\System\klQSgjO.exe
  2⤵
  PID:9224
- C:\Windows\System\yiqvgER.exe
  C:\Windows\System\yiqvgER.exe
  2⤵
  PID:9292
- C:\Windows\System\uyuxgDH.exe
  C:\Windows\System\uyuxgDH.exe
  2⤵
  PID:9324
- C:\Windows\System\yaRyPnE.exe
  C:\Windows\System\yaRyPnE.exe
  2⤵
  PID:9344
- C:\Windows\System\sLiyiLO.exe
  C:\Windows\System\sLiyiLO.exe
  2⤵
  PID:9368
- C:\Windows\System\mkCWZXT.exe
  C:\Windows\System\mkCWZXT.exe
  2⤵
  PID:9412
- C:\Windows\System\vmLxvLa.exe
  C:\Windows\System\vmLxvLa.exe
  2⤵
  PID:9444
- C:\Windows\System\OvgiVgU.exe
  C:\Windows\System\OvgiVgU.exe
  2⤵
  PID:9468
- C:\Windows\System\nArhWOG.exe
  C:\Windows\System\nArhWOG.exe
  2⤵
  PID:9508
- C:\Windows\System\apAfrSC.exe
  C:\Windows\System\apAfrSC.exe
  2⤵
  PID:9536
- C:\Windows\System\ukliySz.exe
  C:\Windows\System\ukliySz.exe
  2⤵
  PID:9636
- C:\Windows\System\YYZPtxk.exe
  C:\Windows\System\YYZPtxk.exe
  2⤵
  PID:9584
- C:\Windows\System\uOLuvDP.exe
  C:\Windows\System\uOLuvDP.exe
  2⤵
  PID:9656
- C:\Windows\System\FHqNyMC.exe
  C:\Windows\System\FHqNyMC.exe
  2⤵
  PID:9624
- C:\Windows\System\KEydkLP.exe
  C:\Windows\System\KEydkLP.exe
  2⤵
  PID:9680
- C:\Windows\System\WDwcLrS.exe
  C:\Windows\System\WDwcLrS.exe
  2⤵
  PID:9708
- C:\Windows\System\bgikslA.exe
  C:\Windows\System\bgikslA.exe
  2⤵
  PID:9748
- C:\Windows\System\zhetOnR.exe
  C:\Windows\System\zhetOnR.exe
  2⤵
  PID:9808
- C:\Windows\System\klNfzXV.exe
  C:\Windows\System\klNfzXV.exe
  2⤵
  PID:9872
- C:\Windows\System\xuVsUMZ.exe
  C:\Windows\System\xuVsUMZ.exe
  2⤵
  PID:9908
- C:\Windows\System\WhNvRQr.exe
  C:\Windows\System\WhNvRQr.exe
  2⤵
  PID:9936
- C:\Windows\System\GXpMMTL.exe
  C:\Windows\System\GXpMMTL.exe
  2⤵
  PID:9988
- C:\Windows\System\iNrHRsr.exe
  C:\Windows\System\iNrHRsr.exe
  2⤵
  PID:10028
- C:\Windows\System\XWRMBuO.exe
  C:\Windows\System\XWRMBuO.exe
  2⤵
  PID:10008
- C:\Windows\System\hhwwfYF.exe
  C:\Windows\System\hhwwfYF.exe
  2⤵
  PID:10080
- C:\Windows\System\uKdYuXF.exe
  C:\Windows\System\uKdYuXF.exe
  2⤵
  PID:10100
- C:\Windows\System\drrTCVV.exe
  C:\Windows\System\drrTCVV.exe
  2⤵
  PID:10148
- C:\Windows\System\EcizfzF.exe
  C:\Windows\System\EcizfzF.exe
  2⤵
  PID:10188
- C:\Windows\System\lWutHgy.exe
  C:\Windows\System\lWutHgy.exe
  2⤵
  PID:10232
- C:\Windows\System\nvjbuCk.exe
  C:\Windows\System\nvjbuCk.exe
  2⤵
  PID:9084
- C:\Windows\System\udnmQdz.exe
  C:\Windows\System\udnmQdz.exe
  2⤵
  PID:9240
- C:\Windows\System\tRvrLlZ.exe
  C:\Windows\System\tRvrLlZ.exe
  2⤵
  PID:9432
- C:\Windows\System\FaEpdCE.exe
  C:\Windows\System\FaEpdCE.exe
  2⤵
  PID:9464
- C:\Windows\System\hvmRbTz.exe
  C:\Windows\System\hvmRbTz.exe
  2⤵
  PID:9372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BlLFJBq.exe

Filesize
3.1MB

MD5
a411d19a3f7d586413c13c670f79a773

SHA1
20d91ff422ef4c08ef0dc603670e65faa2892413

SHA256
47af1a349b716af2e4a5271fdc05777fdb08d540c444e5d8f630c0e3bf9288af

SHA512
4743af093775a3fc0ca65da6e4c5484431076d14ed0d2a77c0e29a3c29b24764a9995399c3a92e9ab041aa977f64dc3095b3cced2cb4fe1a0a312ce9ec72491d

Download Submit
C:\Windows\system\CkUkfCQ.exe

Filesize
3.1MB

MD5
5916d0c603106f64f3efd3a843166425

SHA1
03fffbc19002c8a7b11d3e8237df731537393e84

SHA256
cade289cc361a1f15ae83cd23e5f45252c5bdabca6c010d0304a1c2aab1af629

SHA512
377a7e7d9ed7cb67d05385d65203d221a7204347ac04132f348877c68d6989f684e9fcb0847a785c522750681b0e3530a1c7e4054eeb4601fa80ce35711546a3

Download Submit
C:\Windows\system\DNGvsHf.exe

Filesize
3.1MB

MD5
ba1c85e33b9e80f2bda791e82389c62e

SHA1
5c1e7bf5241c96ca84e536499e2185da8b20bd9e

SHA256
4cc079a364d45c4519068a1cfd97356deef7d26ebd348f08388c49355d7c656d

SHA512
a5dba2987e2f6be77009278155350a2bf3dc189c79dacb92fc8d54b54ba2433b25000326c324c32f89c5657a8e38301f5f51f5d3851466a7ce96983af6487f78

Download Submit
C:\Windows\system\DQxumor.exe

Filesize
3.1MB

MD5
d5c967dcf40a9c952d6c7d64ac3672f0

SHA1
ee578d1d96d8f2fc969d36db25a9b60f1e0b14e4

SHA256
fb662fbce0daebb8728e2c8279f6fd767506f5dad3e9fe93451647a94e145908

SHA512
dd8e0b40bb7ec422476a459c75147c961963830af2310cc4d329c270e824187f4e8c0055db2cb0670b9297215426727d71446552a59f2f90c691c06427f5fe86

Download Submit
C:\Windows\system\DhCuLYm.exe

Filesize
3.1MB

MD5
49e23b2eccf8a99eea65c78e7fa48081

SHA1
bec9c06750424291df7055ed7df9d9ba5cff089a

SHA256
c7543975d830fddeb6c412cd3e2c03ec8d4d2bdb1080ef6ccb43293689003860

SHA512
94aded78875b94ebcc5bfd7c4a65bcec9af3d67dad6fea41c70c5101f39a1e724cac560e83001c8a176f3a53afd1f2ed66d457539d5052543fa5c79295fdc7db

Download Submit
C:\Windows\system\EhpfCIl.exe

Filesize
3.1MB

MD5
d7cc923fed2182cec63ad8c7392a96d1

SHA1
bbd17d83dfed59c45c956b820a8767f39d215719

SHA256
71a82db28aca9a4b266a4a627811a55f34065f3144f1f6bec9e12c0c4132efe8

SHA512
c028ad4c6fd2d20a72ef31eba0856bf4954bc92406ae355806e6d8ea3f02ddb036616b519b869c2f6f9478db9e90daf1940c014f00e9674b4aa46694511753c0

Download Submit
C:\Windows\system\GjcHVtz.exe

Filesize
3.1MB

MD5
a8d95c15367e0e311130b20cc2297100

SHA1
8d04641fcab56eb265cd9855cbdb9dc03197af4b

SHA256
324303df007f0eda3d47365b1cc6d8acbcb94d32c25ee42ad6eb65770e163342

SHA512
c74c7e0cc9024b15bbdb8f0f8eb51758c912d50cffdc162b57dba04bdfc26a25cfecddf5109a0b2892db995ac4aa09b2d905ddd7f147742a15a6f494d6c3fdf9

Download Submit
C:\Windows\system\IAQPKIX.exe

Filesize
3.1MB

MD5
973883502438c990d9957425198cc6ab

SHA1
7ab842cca7ed03ca1e6e166707fc0753770dcf30

SHA256
55abcdb90192b3c07fe3301527c776d3cd1ab0641e386274992dd13fe9cae364

SHA512
2de4d1501a33458df95adafb9700d99138225ee59634ad3968bb0033f4576777ec7608b37da337cbef7f37d9bdf2a7cce898885fe9765b6a6083b44f0c57d893

Download Submit
C:\Windows\system\IZdEIgK.exe

Filesize
3.1MB

MD5
f6258d349872da8cfa9cfa027e3a3605

SHA1
0f3a30250a9499026100da7c5440293a21ca6994

SHA256
7dc26f8adbafe64cf25adb12796a0da659be21da96f9946b7c13cdecb5c08c19

SHA512
6da0da2369d1848f2cd35bf3634a7e4913cb0030c9aae5f05d799e514828d75dba16a216969419b463326df01bc39e3b43b512ad0a62a66b21422dbcebd4bbb6

Download Submit
C:\Windows\system\PLOgkZK.exe

Filesize
3.1MB

MD5
deda46e580709be2d47fb4a86b889f9b

SHA1
4af506e76a9420fc540d057c8485e9c50ad943bc

SHA256
9c42bd381ba4c79a3bb76c23bfa9d08b000f4944dda2ebda6d96ce7aed146ae4

SHA512
590cae1c87a18c4673f1ceb0caad2509734ee9e84912eae3b607bee438ddb34de1f2784e4d29fff04c646ffeef7e35b5da9d2b891bac0bf3eeedc6f187f450a5

Download Submit
C:\Windows\system\QWhvyEM.exe

Filesize
3.1MB

MD5
9c2d0eda04227778293fb3b0cbcbfd68

SHA1
ec10fceb775732b252eaeecfbd9151cc55fd605d

SHA256
dc1440f587ca6f83ff5286ce4fe8eb061f86ac296ac4cb461dbf0527494abb9d

SHA512
da2e54bbd1721fea1a5aa3ed0c16e1e40d7ce74a98471cbf85b227e2b923c29bbd14a9820099a891362900a8ecbf33db55979b2ae4508549d58d88577d69823f

Download Submit
C:\Windows\system\SNbRwjc.exe

Filesize
3.1MB

MD5
27093f7437bb3083cd9097bf79c0ac4c

SHA1
b79673e5f4faaeed05cd44876158c5c3cb40cd9c

SHA256
d93be8d13e552a872228b846822db65c3ac8e0b7afdff7e77af31fc63cd8dcd2

SHA512
ffec9131f46f4591d314793743e31904680da8c52723cf4a9e79053d8a2174540391074b257337eff6f922e59e7bfb85c991d7c1488b4e3706aeb3ce9eb0ed56

Download Submit
C:\Windows\system\TCxFOdY.exe

Filesize
3.1MB

MD5
4751d4b94be7e2df7adeeb42099766e4

SHA1
d98f92087e8c8ea3f39bfe8bf140df415be8ac49

SHA256
52dc2725f32258b159da1fef95d660af859d466a854e6be41894aa6c7ff547b6

SHA512
018b8d241c0862ee34518fe83b51afbb5898183bf8d5356e51cf0104f6114c3af1b455be5120417bd2116471b55add66e1d6f1bde7ec5921fb65d58873c0f896

Download Submit
C:\Windows\system\TemsDWB.exe

Filesize
3.1MB

MD5
e1b84a5b661c8a8f2a7d368b95e538fc

SHA1
6c208b80284f98af558670d684d7413d8285cbae

SHA256
0eca328783c3b0bf21b2cb66fc9633e2a3f6c256169408235f6f9c7bfc2ff34a

SHA512
4ce53dee9961ae9db0bc2d0c4077f2a17cd5972469986478bfa9cad962d92be8d885e3044f08e129bf52321eed2657d44fc7ed03a8a287b0c79356cd0bbc5b4e

Download Submit
C:\Windows\system\VqDqYOp.exe

Filesize
3.1MB

MD5
545108fe0f6714c9e062c9e5de6a8824

SHA1
78119b2bf3d6d5e3c07d6e27915648e338275b4e

SHA256
3f9d551598c9ff2f90e0efaaad72dcab5d0c6a75175595888ec70f9ee12acc4c

SHA512
d8242b08706966ac315b6e360029678adc6d0e46edab187c970c8b1041ec6584b135557d448e46a7d33e691adaa1d733673984165c11e31610e76f4186d6e34b

Download Submit
C:\Windows\system\aVPiXbo.exe

Filesize
3.1MB

MD5
37efb48127cb6a8842dcda248704ca3e

SHA1
ca50bc48e5daf51441d2358451454f0dd58515ef

SHA256
48444878ed1d5a8eebbaa18e9504a40772f56b8b2840c2df8af267edbb5cb626

SHA512
e2c9eecfdef6c6742a985a0c3fc3ff159af9d1de495d42f61a6f9b5a9faae42571cde980b00d4b5ade51b3853c4adcec77195263d04a190ae396a8a83dd66aed

Download Submit
C:\Windows\system\dUEcakR.exe

Filesize
3.1MB

MD5
dceb3b325613cae4ff93c72244f390df

SHA1
4b96aa3e850e0ba10568efc9237436e1ea5bc7ba

SHA256
8b975526d62cde10ffc65d33a9d746185fc9cd38f1a036a7dc915670fe5ec5aa

SHA512
b981a770be3763315b66fc7cbbb1af94a2bb0117534e47e9e3ff2dbdaab9fd884fc4cd35f063ce21119c63ecf5e4f06146d080d296db6a703c27a83ba19f0182

Download Submit
C:\Windows\system\ipLtPsX.exe

Filesize
3.1MB

MD5
b14edb369245983a4da311f4407a20be

SHA1
15a26decb489b7bae331e3a6e125cbccd9740d3d

SHA256
dde748c25d337da6cf3460ab9bd1672be5f19c21dcf62b208c3f60dc4bd2071f

SHA512
049390b2eca89a0ed01b8fe68de994b7308ebfc7ec6d178d209456ac84f00c3275880ee5c8bab21908e1701d5649311c784a29800725955cca1b6d34065347b7

Download Submit
C:\Windows\system\ivUnYTz.exe

Filesize
3.1MB

MD5
9ed8d6e97cdeb1a423afde7d809c454b

SHA1
f1c51c46028184fb1b8004ce86838fe98af23a59

SHA256
9b4bb8f75f067f826db576e528e3eb0f1d6fd05099e944959d2c61e8b6d3b47e

SHA512
a01db52a950e8f6ca08967d971c06c97d50faacae6f62530082fc1d738afcde2a7e4a634c9456e4d03ba3c3ac503acddf84882f64e4f3cce4d2eacd432b82fb6

Download Submit
C:\Windows\system\mrJRqJD.exe

Filesize
3.1MB

MD5
3cfb4ff3568fac7d8229efbda40da87d

SHA1
5313636be8003a87a4ef399659e08fa9ee2981c7

SHA256
4c94db05978641ac2e0ffb3556bef5e4bee684576a72b44ee58a3e9f65f18f31

SHA512
ac21e759c0f747dc84f1571c9f9f5a9d013d96ec5ab587aba53aaf52c7e7a88bc3e7f8af3fc19f598c4965cb04723d5f093d0acc58ff0c0d41f3529d9a829f0b

Download Submit
C:\Windows\system\ociSdEI.exe

Filesize
3.1MB

MD5
3ae09b992cda2feb0d504ee16d2fe1b5

SHA1
1381c579fde558de5812c45a44d93593f0caa414

SHA256
e2f3915d97a6cc03fd52ee6095fb47a9c8d7aa9999be71fa9a5a0f3dc823316e

SHA512
3ad34dacaeb63869660323fd3353eedd3e368e860483708b4568b6d674621864ae0e9d28603bfdc962d002ce0d78afc00a24fed36c1e5d2f2f858099349bf2c8

Download Submit
C:\Windows\system\sZWPZlI.exe

Filesize
3.1MB

MD5
ac90dd5e8bc33429457fed7de7c02d97

SHA1
cdfe08b26f46d4e59619eb738942d082b87bd993

SHA256
21f5c8fe79cb4ede39c19f6a616e41e23eb6556f7686cb9d66a48804404b54ad

SHA512
2d7e579e1f4e0eb160b0864e6aa39a8610075f8775e4519fc7318866dc52fdf5cf6852dd3443cb4d199a5b69f7e37b3be60462e1f8c3d85f0f54cf3431e98564

Download Submit
C:\Windows\system\yirlots.exe

Filesize
3.1MB

MD5
1cc148943d4cd7fb77857bbccff2d16c

SHA1
bdeb0fc298cd0b5092164f4851ccf8f8c5cbd363

SHA256
772fada53c0f82fac5c93b44200db7651aa9def213d7dcfaa467abf6bc7e5ef8

SHA512
60693d409c7d6797553eea6870377b952f6c835263717d40ae87f4b38ae21d95d3a45b8048bee693d034be113d6fc36c6b311b19f21917b785c2e7355ea0a1c9

Download Submit
C:\Windows\system\ynvWfzA.exe

Filesize
3.1MB

MD5
c4d7953262584464777178d629aca105

SHA1
3d422cf929b4d541177b3a4ad7163287fac84b88

SHA256
2dc7fa74c0d8a445f72d21e9babf84e2961977e2359d18a315529063fcb91dfe

SHA512
836ceabfe11f521bd3c27ae8f42967fa45de36ec191c5fe5f19c1a13a7632be19de3fec64a48acdd83e739b4bb1a0dcde412c94311d6c4e8f529bbbe7ea0ac4a

Download Submit
C:\Windows\system\zpZQMwd.exe

Filesize
3.1MB

MD5
dc9fe832eb3b284cfa66ef0e35dadaed

SHA1
d0fcc6d06cbad79ee45884ea8d8606d2534d5084

SHA256
653838ae7e8aaf22de9d59c53bbc10f8f8a29067e61b7f68c8df745733a67b12

SHA512
20895526dfacc2221ac3a53e324ff3f4475e5b0fe27095693916cb69cda9453f366dd60c37cec744bc491a714ca1e2a276664757ca378237c51cff0098e45f41

Download Submit
\Windows\system\KoYtZKt.exe

Filesize
3.1MB

MD5
21d113a08ec216319f33851a58d8153f

SHA1
3f3dd270d9f2fddd5c164213dbc2f3e25eb0fd5a

SHA256
a878e5e22076da14d558c3416edd9fab81bc87b4570fd0ea9c7c3c28d5ef8e75

SHA512
7bb2262f3e26c4d2d5004dbd9365fcd078f84e60ec655bd0c83f617610c6800864d22c190e0fb3bc9f690cbd0892cf20279b1297806e4816102bee9fba25271b

Download Submit
\Windows\system\QIbwCib.exe

Filesize
3.1MB

MD5
2e086a0fc510f6bc0542219114a93184

SHA1
81a19456536531de6857bca56d39f3576d0467a2

SHA256
356c695e88a82827fc1dceb62bf6348dcde9f0cb487efefd2983249d8185954a

SHA512
0fb9c3b02f083badec34cdd0a7283f9a0d77dc9738dc5fe7385ef51629042f1d047ed7d32d3e9d94233c65f865e01e3acd2a8e42ec177260ef490bdea4eabbd5

Download Submit
\Windows\system\ZCssgcK.exe

Filesize
3.1MB

MD5
1d54ac9cc8235fa2ecac980e3b40fde9

SHA1
0f62770a256c5cc53f397b2e154aeb1ed5676cf7

SHA256
12f538b4af43f7e8d42361e4e9c6dce77f59b1776466d4afe6db31eb313f2c36

SHA512
b7fc87064fb95460ff783f70d1fe9154b2cfc47f2fc3652a2d53f227bb3fe23eab79900606db0a47964da2134edd10d21249f838dcf0612735eda265a2928037

Download Submit
\Windows\system\cjLjeXZ.exe

Filesize
3.1MB

MD5
2034abec37e7653112dc4a50c56b0091

SHA1
8717bb046a1779d039e9d28490d7013f90d0c41f

SHA256
498671c77c26862ae8be9fcaebc7ea79fe20ff018f83bc835ab35db7e476eb82

SHA512
b0018fa63067cb718141f55bc3eac018dcee08b20e82d8dd2678677ab5bf84834b933036f8616f8aeffa8a41238003ab4b8c8ff4ff256c7d90dae5680e8dd3cf

Download Submit
\Windows\system\mspywlP.exe

Filesize
3.1MB

MD5
891d07e5e044c82e13e7fcec4d9810ef

SHA1
b13468408190bc351f0474e8d2b3ecb94df5b5a6

SHA256
99c525c3024209ab8912a5c550e7bcff8b896ce94432c0678aeb50d73cf7e1dc

SHA512
b6cd94363296b78bab42f555acb0a9c4ca9278d86c576acb6dc9785129b0aff506bb0551b8ed213ab962b4fce9e9e4703150362cae131fbf714ca4f6fe9bb00a

Download Submit
\Windows\system\smfwWfR.exe

Filesize
3.1MB

MD5
7a203b92a0c243364e40a41c2a05bae2

SHA1
479c3bea5b99f6faf60ffa2011f7612f3b1fcf0c

SHA256
f2e34b875a752dc202d9ab33c16dd77d83713b675c37997e5f9890dced7b0024

SHA512
24a7353fe9f70487e43e95ab087deaea5a55139e88804bc9e5477b56da85dcc4139071da9d2cdf619245973630ddc4b785415b229a03224ec96c97dc637eb703

Download Submit
\Windows\system\vWxDdpx.exe

Filesize
3.1MB

MD5
deb26b334612b721a0f84c32b2ce5393

SHA1
fbbfbaf445fc5fdba14a08fd82dbd2bcf04993d4

SHA256
177e9cf63f0d8829aeaae6db5e29972945fad1082abeea8d92b0bc70ad14cff3

SHA512
f1b83f2baf1f828f1263029ea2089a93aeb48bba73832e30ad8f521bfb25a8b591595e42eb64f52155c152eeea40de338d5025e6436cee9cf5cf13f4992c64d7

Download Submit
memory/844-14-0x000000013F2B0000-0x000000013F604000-memory.dmp

Filesize
3.3MB

Download
memory/1032-223-0x000000013FB00000-0x000000013FE54000-memory.dmp

Filesize
3.3MB

Download
memory/1032-4013-0x000000013FB00000-0x000000013FE54000-memory.dmp

Filesize
3.3MB

Download
memory/1032-43-0x000000013FB00000-0x000000013FE54000-memory.dmp

Filesize
3.3MB

Download
memory/2172-77-0x000000013FAB0000-0x000000013FE04000-memory.dmp

Filesize
3.3MB

Download
memory/2172-15-0x000000013F2B0000-0x000000013F604000-memory.dmp

Filesize
3.3MB

Download
memory/2172-601-0x000000013FA10000-0x000000013FD64000-memory.dmp

Filesize
3.3MB

Download
memory/2172-71-0x0000000002000000-0x0000000002354000-memory.dmp

Filesize
3.3MB

Download
memory/2172-339-0x000000013FF40000-0x0000000140294000-memory.dmp

Filesize
3.3MB

Download
memory/2172-747-0x000000013F0B0000-0x000000013F404000-memory.dmp

Filesize
3.3MB

Download
memory/2172-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2172-870-0x0000000002000000-0x0000000002354000-memory.dmp

Filesize
3.3MB

Download
memory/2172-0-0x000000013F670000-0x000000013F9C4000-memory.dmp

Filesize
3.3MB

Download
memory/2172-23-0x0000000002000000-0x0000000002354000-memory.dmp

Filesize
3.3MB

Download
memory/2172-19-0x000000013F030000-0x000000013F384000-memory.dmp

Filesize
3.3MB

Download
memory/2172-746-0x0000000002000000-0x0000000002354000-memory.dmp

Filesize
3.3MB

Download
memory/2172-35-0x000000013F670000-0x000000013F9C4000-memory.dmp

Filesize
3.3MB

Download
memory/2172-89-0x000000013F0B0000-0x000000013F404000-memory.dmp

Filesize
3.3MB

Download
memory/2172-29-0x0000000002000000-0x0000000002354000-memory.dmp

Filesize
3.3MB

Download
memory/2172-969-0x000000013F2C0000-0x000000013F614000-memory.dmp

Filesize
3.3MB

Download
memory/2172-92-0x0000000002000000-0x0000000002354000-memory.dmp

Filesize
3.3MB

Download
memory/2172-93-0x0000000002000000-0x0000000002354000-memory.dmp

Filesize
3.3MB

Download
memory/2172-94-0x000000013FD00000-0x0000000140054000-memory.dmp

Filesize
3.3MB

Download
memory/2172-64-0x000000013FA10000-0x000000013FD64000-memory.dmp

Filesize
3.3MB

Download
memory/2172-97-0x000000013F2C0000-0x000000013F614000-memory.dmp

Filesize
3.3MB

Download
memory/2360-62-0x000000013F030000-0x000000013F384000-memory.dmp

Filesize
3.3MB

Download
memory/2360-4018-0x000000013F030000-0x000000013F384000-memory.dmp

Filesize
3.3MB

Download
memory/2360-21-0x000000013F030000-0x000000013F384000-memory.dmp

Filesize
3.3MB

Download
memory/2376-4014-0x000000013F890000-0x000000013FBE4000-memory.dmp

Filesize
3.3MB

Download
memory/2376-96-0x000000013F890000-0x000000013FBE4000-memory.dmp

Filesize
3.3MB

Download
memory/2376-27-0x000000013F890000-0x000000013FBE4000-memory.dmp

Filesize
3.3MB

Download
memory/2388-38-0x000000013F130000-0x000000013F484000-memory.dmp

Filesize
3.3MB

Download
memory/2388-4012-0x000000013F130000-0x000000013F484000-memory.dmp

Filesize
3.3MB

Download
memory/2388-10-0x000000013F130000-0x000000013F484000-memory.dmp

Filesize
3.3MB

Download
memory/2696-67-0x000000013FA10000-0x000000013FD64000-memory.dmp

Filesize
3.3MB

Download
memory/2696-4017-0x000000013FA10000-0x000000013FD64000-memory.dmp

Filesize
3.3MB

Download
memory/2700-4019-0x000000013F6B0000-0x000000013FA04000-memory.dmp

Filesize
3.3MB

Download
memory/2700-95-0x000000013F6B0000-0x000000013FA04000-memory.dmp

Filesize
3.3MB

Download
memory/2740-970-0x000000013F620000-0x000000013F974000-memory.dmp

Filesize
3.3MB

Download
memory/2740-4022-0x000000013F620000-0x000000013F974000-memory.dmp

Filesize
3.3MB

Download
memory/2740-98-0x000000013F620000-0x000000013F974000-memory.dmp

Filesize
3.3MB

Download
memory/2764-1262-0x000000013F2C0000-0x000000013F614000-memory.dmp

Filesize
3.3MB

Download
memory/2764-104-0x000000013F2C0000-0x000000013F614000-memory.dmp

Filesize
3.3MB

Download
memory/2764-4021-0x000000013F2C0000-0x000000013F614000-memory.dmp

Filesize
3.3MB

Download
memory/2824-100-0x000000013F0B0000-0x000000013F404000-memory.dmp

Filesize
3.3MB

Download
memory/2824-4024-0x000000013F0B0000-0x000000013F404000-memory.dmp

Filesize
3.3MB

Download
memory/2896-45-0x000000013FF40000-0x0000000140294000-memory.dmp

Filesize
3.3MB

Download
memory/2896-4015-0x000000013FF40000-0x0000000140294000-memory.dmp

Filesize
3.3MB

Download
memory/2896-464-0x000000013FF40000-0x0000000140294000-memory.dmp

Filesize
3.3MB

Download
memory/2956-90-0x000000013FAB0000-0x000000013FE04000-memory.dmp

Filesize
3.3MB

Download
memory/2956-4023-0x000000013FAB0000-0x000000013FE04000-memory.dmp

Filesize
3.3MB

Download
memory/2968-4016-0x000000013F340000-0x000000013F694000-memory.dmp

Filesize
3.3MB

Download
memory/2968-33-0x000000013F340000-0x000000013F694000-memory.dmp

Filesize
3.3MB

Download
memory/2968-103-0x000000013F340000-0x000000013F694000-memory.dmp

Filesize
3.3MB

Download
memory/2984-75-0x000000013F5A0000-0x000000013F8F4000-memory.dmp

Filesize
3.3MB

Download
memory/2984-4020-0x000000013F5A0000-0x000000013F8F4000-memory.dmp

Filesize
3.3MB

Download