xmrig | 02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
Size

1.7MB
MD5

65d1c9e181474ded1d395b0dfd2ab1be
SHA1

8cb9f15aa8f421affdfcb8f6803656fcac3c993b
SHA256

02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3
SHA512

fc8d7a8637fed446885eee771d457e19980563359b726d2b266fe026c1910c778583a8fc8321a3546bdcaa083ea5954a512ad7915f92dba45e8b0829de3df3a8
SSDEEP

49152:EnCbL83y9FdfE0pZ0zCa4wI156uL3pgrCEdI:EniLf9FdfE0pZB156utgm

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2504-0-0x000000013F320000-0x000000013F674000-memory.dmp	xmrig
behavioral1/files/0x0008000000016cf8-14.dat	xmrig
behavioral1/files/0x0007000000016d33-19.dat	xmrig
behavioral1/memory/2100-53-0x000000013F3B0000-0x000000013F704000-memory.dmp	xmrig
behavioral1/files/0x00050000000194b4-52.dat	xmrig
behavioral1/memory/2080-32-0x000000013FB90000-0x000000013FEE4000-memory.dmp	xmrig
behavioral1/files/0x0007000000016d4a-29.dat	xmrig
behavioral1/files/0x0006000000019408-38.dat	xmrig
behavioral1/files/0x00050000000194a7-47.dat	xmrig
behavioral1/files/0x0009000000016db3-42.dat	xmrig
behavioral1/files/0x0007000000016d46-41.dat	xmrig
behavioral1/files/0x0008000000016c89-24.dat	xmrig
behavioral1/files/0x00050000000194f6-118.dat	xmrig
behavioral1/files/0x0005000000019589-148.dat	xmrig
behavioral1/files/0x0005000000019aec-184.dat	xmrig
behavioral1/memory/2504-960-0x000000013F320000-0x000000013F674000-memory.dmp	xmrig
behavioral1/files/0x0005000000019aee-188.dat	xmrig
behavioral1/files/0x0005000000019aea-177.dat	xmrig
behavioral1/files/0x00050000000197c1-173.dat	xmrig
behavioral1/files/0x0005000000019625-168.dat	xmrig
behavioral1/files/0x0005000000019624-164.dat	xmrig
behavioral1/files/0x000500000001961b-153.dat	xmrig
behavioral1/files/0x000500000001961f-158.dat	xmrig
behavioral1/files/0x000500000001957c-143.dat	xmrig
behavioral1/files/0x000500000001953a-138.dat	xmrig
behavioral1/files/0x0005000000019515-133.dat	xmrig
behavioral1/files/0x0005000000019503-128.dat	xmrig
behavioral1/files/0x0005000000019501-124.dat	xmrig
behavioral1/files/0x00050000000194f2-113.dat	xmrig
behavioral1/files/0x00050000000194e2-103.dat	xmrig
behavioral1/files/0x00050000000194ea-108.dat	xmrig
behavioral1/memory/2776-100-0x000000013FF10000-0x0000000140264000-memory.dmp	xmrig
behavioral1/files/0x00050000000194d4-99.dat	xmrig
behavioral1/memory/2628-98-0x000000013F770000-0x000000013FAC4000-memory.dmp	xmrig
behavioral1/memory/2764-97-0x000000013F6B0000-0x000000013FA04000-memory.dmp	xmrig
behavioral1/memory/2756-96-0x000000013F880000-0x000000013FBD4000-memory.dmp	xmrig
behavioral1/memory/2632-93-0x000000013F0F0000-0x000000013F444000-memory.dmp	xmrig
behavioral1/memory/2504-92-0x0000000001DE0000-0x0000000002134000-memory.dmp	xmrig
behavioral1/memory/2796-91-0x000000013FC00000-0x000000013FF54000-memory.dmp	xmrig
behavioral1/memory/2504-85-0x0000000001DE0000-0x0000000002134000-memory.dmp	xmrig
behavioral1/memory/2792-84-0x000000013F150000-0x000000013F4A4000-memory.dmp	xmrig
behavioral1/memory/2744-82-0x000000013FD70000-0x00000001400C4000-memory.dmp	xmrig
behavioral1/memory/2504-79-0x0000000001DE0000-0x0000000002134000-memory.dmp	xmrig
behavioral1/memory/2828-78-0x000000013F220000-0x000000013F574000-memory.dmp	xmrig
behavioral1/memory/2608-74-0x000000013F120000-0x000000013F474000-memory.dmp	xmrig
behavioral1/files/0x00050000000194da-73.dat	xmrig
behavioral1/memory/2832-72-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	xmrig
behavioral1/files/0x0005000000019494-60.dat	xmrig
behavioral1/memory/2920-46-0x000000013F8A0000-0x000000013FBF4000-memory.dmp	xmrig
behavioral1/files/0x0008000000016c81-17.dat	xmrig
behavioral1/files/0x000a00000001225a-13.dat	xmrig
behavioral1/memory/2504-2093-0x000000013FF10000-0x0000000140264000-memory.dmp	xmrig
behavioral1/memory/2776-2528-0x000000013FF10000-0x0000000140264000-memory.dmp	xmrig
behavioral1/memory/2920-4000-0x000000013F8A0000-0x000000013FBF4000-memory.dmp	xmrig
behavioral1/memory/2080-4001-0x000000013FB90000-0x000000013FEE4000-memory.dmp	xmrig
behavioral1/memory/2100-4002-0x000000013F3B0000-0x000000013F704000-memory.dmp	xmrig
behavioral1/memory/2792-4003-0x000000013F150000-0x000000013F4A4000-memory.dmp	xmrig
behavioral1/memory/2608-4004-0x000000013F120000-0x000000013F474000-memory.dmp	xmrig
behavioral1/memory/2832-4005-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	xmrig
behavioral1/memory/2828-4006-0x000000013F220000-0x000000013F574000-memory.dmp	xmrig
behavioral1/memory/2796-4007-0x000000013FC00000-0x000000013FF54000-memory.dmp	xmrig
behavioral1/memory/2744-4008-0x000000013FD70000-0x00000001400C4000-memory.dmp	xmrig
behavioral1/memory/2632-4009-0x000000013F0F0000-0x000000013F444000-memory.dmp	xmrig
behavioral1/memory/2756-4010-0x000000013F880000-0x000000013FBD4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2080	nGnvoUU.exe
2920	gXwzBkd.exe
2100	CaOLjjb.exe
2792	FzJDKvP.exe
2832	RbeVbVf.exe
2608	CoOOMBj.exe
2796	hgYCqyh.exe
2828	wrcrJoM.exe
2744	ueIlaNE.exe
2632	ZZWSqJM.exe
2756	bRTRtQV.exe
2764	DfFPQRY.exe
2628	maXrzXu.exe
2776	ZUBICzy.exe
2772	BTmNXuG.exe
1912	skZkkqL.exe
1980	SlyABMg.exe
1320	jkkhPvc.exe
2888	sdAxBgy.exe
2640	UbczIWl.exe
1996	woGDSSB.exe
1804	ysqHbbf.exe
1328	XCikwGD.exe
2276	oCIfoYg.exe
2216	VAvPHNg.exe
2288	DdkFbYA.exe
2016	LdThCan.exe
1368	fpvycjg.exe
696	nyBkrYu.exe
616	dCvYgBG.exe
2436	HJZCbTB.exe
1760	xXJNdLi.exe
1272	AEsEBVZ.exe
912	JjNITqE.exe
2244	hGfgUdQ.exe
2056	svxcbls.exe
548	uThovfM.exe
2568	FjNCelG.exe
2096	jwYksEx.exe
564	cYdFsXQ.exe
2356	QtcAcyd.exe
1776	hQFpQCL.exe
1032	YFqrvfG.exe
1016	tvIbWJL.exe
1500	JZjnwPM.exe
2184	FSqqrCH.exe
2076	TzerOPo.exe
2516	ZFDYLHz.exe
1704	agqVyKP.exe
2032	kxedOCJ.exe
2712	BaFZEot.exe
2860	lZupJaZ.exe
2908	gLEaYlK.exe
2708	hQAEWDb.exe
2736	OgWGCts.exe
2740	yGRkNrW.exe
2652	DTzYajS.exe
2112	pXucEpZ.exe
772	rEHjKHz.exe
1648	RClLASj.exe
1108	HrQFeky.exe
3052	chOeBlT.exe
1156	wiLcGdZ.exe
1736	RWQwlrr.exe

Loads dropped DLL 64 IoCs

pid	Process
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe

UPX packed file 63 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2504-0-0x000000013F320000-0x000000013F674000-memory.dmp	upx
behavioral1/files/0x0008000000016cf8-14.dat	upx
behavioral1/files/0x0007000000016d33-19.dat	upx
behavioral1/memory/2100-53-0x000000013F3B0000-0x000000013F704000-memory.dmp	upx
behavioral1/files/0x00050000000194b4-52.dat	upx
behavioral1/memory/2080-32-0x000000013FB90000-0x000000013FEE4000-memory.dmp	upx
behavioral1/files/0x0007000000016d4a-29.dat	upx
behavioral1/files/0x0006000000019408-38.dat	upx
behavioral1/files/0x00050000000194a7-47.dat	upx
behavioral1/files/0x0009000000016db3-42.dat	upx
behavioral1/files/0x0007000000016d46-41.dat	upx
behavioral1/files/0x0008000000016c89-24.dat	upx
behavioral1/files/0x00050000000194f6-118.dat	upx
behavioral1/files/0x0005000000019589-148.dat	upx
behavioral1/files/0x0005000000019aec-184.dat	upx
behavioral1/memory/2504-960-0x000000013F320000-0x000000013F674000-memory.dmp	upx
behavioral1/files/0x0005000000019aee-188.dat	upx
behavioral1/files/0x0005000000019aea-177.dat	upx
behavioral1/files/0x00050000000197c1-173.dat	upx
behavioral1/files/0x0005000000019625-168.dat	upx
behavioral1/files/0x0005000000019624-164.dat	upx
behavioral1/files/0x000500000001961b-153.dat	upx
behavioral1/files/0x000500000001961f-158.dat	upx
behavioral1/files/0x000500000001957c-143.dat	upx
behavioral1/files/0x000500000001953a-138.dat	upx
behavioral1/files/0x0005000000019515-133.dat	upx
behavioral1/files/0x0005000000019503-128.dat	upx
behavioral1/files/0x0005000000019501-124.dat	upx
behavioral1/files/0x00050000000194f2-113.dat	upx
behavioral1/files/0x00050000000194e2-103.dat	upx
behavioral1/files/0x00050000000194ea-108.dat	upx
behavioral1/memory/2776-100-0x000000013FF10000-0x0000000140264000-memory.dmp	upx
behavioral1/files/0x00050000000194d4-99.dat	upx
behavioral1/memory/2628-98-0x000000013F770000-0x000000013FAC4000-memory.dmp	upx
behavioral1/memory/2764-97-0x000000013F6B0000-0x000000013FA04000-memory.dmp	upx
behavioral1/memory/2756-96-0x000000013F880000-0x000000013FBD4000-memory.dmp	upx
behavioral1/memory/2632-93-0x000000013F0F0000-0x000000013F444000-memory.dmp	upx
behavioral1/memory/2796-91-0x000000013FC00000-0x000000013FF54000-memory.dmp	upx
behavioral1/memory/2792-84-0x000000013F150000-0x000000013F4A4000-memory.dmp	upx
behavioral1/memory/2744-82-0x000000013FD70000-0x00000001400C4000-memory.dmp	upx
behavioral1/memory/2828-78-0x000000013F220000-0x000000013F574000-memory.dmp	upx
behavioral1/memory/2608-74-0x000000013F120000-0x000000013F474000-memory.dmp	upx
behavioral1/files/0x00050000000194da-73.dat	upx
behavioral1/memory/2832-72-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	upx
behavioral1/files/0x0005000000019494-60.dat	upx
behavioral1/memory/2920-46-0x000000013F8A0000-0x000000013FBF4000-memory.dmp	upx
behavioral1/files/0x0008000000016c81-17.dat	upx
behavioral1/files/0x000a00000001225a-13.dat	upx
behavioral1/memory/2776-2528-0x000000013FF10000-0x0000000140264000-memory.dmp	upx
behavioral1/memory/2920-4000-0x000000013F8A0000-0x000000013FBF4000-memory.dmp	upx
behavioral1/memory/2080-4001-0x000000013FB90000-0x000000013FEE4000-memory.dmp	upx
behavioral1/memory/2100-4002-0x000000013F3B0000-0x000000013F704000-memory.dmp	upx
behavioral1/memory/2792-4003-0x000000013F150000-0x000000013F4A4000-memory.dmp	upx
behavioral1/memory/2608-4004-0x000000013F120000-0x000000013F474000-memory.dmp	upx
behavioral1/memory/2832-4005-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	upx
behavioral1/memory/2828-4006-0x000000013F220000-0x000000013F574000-memory.dmp	upx
behavioral1/memory/2796-4007-0x000000013FC00000-0x000000013FF54000-memory.dmp	upx
behavioral1/memory/2744-4008-0x000000013FD70000-0x00000001400C4000-memory.dmp	upx
behavioral1/memory/2632-4009-0x000000013F0F0000-0x000000013F444000-memory.dmp	upx
behavioral1/memory/2756-4010-0x000000013F880000-0x000000013FBD4000-memory.dmp	upx
behavioral1/memory/2764-4011-0x000000013F6B0000-0x000000013FA04000-memory.dmp	upx
behavioral1/memory/2776-4012-0x000000013FF10000-0x0000000140264000-memory.dmp	upx
behavioral1/memory/2628-4013-0x000000013F770000-0x000000013FAC4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\tEdmpmg.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\QfWMFsS.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\IvtxuAH.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\MwwWtyZ.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\BEtFDwk.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\sELVluv.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\KUmEtip.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\OCdXCUJ.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\ZYCkxmP.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\ysqHbbf.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\jwYksEx.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\PQwFfhu.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\uuglFxD.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\puvEYYv.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\MqcuDDs.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\VmoQBcc.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\giWzpnB.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\iQZTnVs.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\Medkueq.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\PpkPvMJ.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\iEMTDAp.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\UNndxaD.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\wkAwBTz.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\hHrRbVa.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\zdlCvcC.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\IKEsylA.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\eZOXXaK.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\CnNKoiJ.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\JQuiqXl.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\NLvqocs.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\qluseqD.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\yOKHrBc.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\NlhytVY.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\ZTOjkEg.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\bMRWOqJ.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\jjWTqXA.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\cpuEFDM.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\OPdlLyI.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\yuwfOwc.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\sWDiheP.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\uoXzLSv.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\MxXBFYR.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\eBSmwAM.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\LZvrFgK.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\aojhMCE.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\QznBjju.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\JgbPgHb.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\eYsLPgC.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\GNUkBpJ.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\aUASOWi.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\WOUMltr.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\JRWXlhg.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\wEsIjWa.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\xxRdfuJ.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\BTCPepJ.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\ZurkeDu.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\xXJNdLi.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\QrZEyLt.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\PeWbkGc.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\qeIkKnD.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\okvaVLk.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\sjYdLBX.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\YyzZBrX.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
File created	C:\Windows\System\lraKIOu.exe	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2080	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	31
PID 2504 wrote to memory of 2080	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	31
PID 2504 wrote to memory of 2080	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	31
PID 2504 wrote to memory of 2920	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	32
PID 2504 wrote to memory of 2920	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	32
PID 2504 wrote to memory of 2920	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	32
PID 2504 wrote to memory of 2792	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	33
PID 2504 wrote to memory of 2792	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	33
PID 2504 wrote to memory of 2792	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	33
PID 2504 wrote to memory of 2100	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	34
PID 2504 wrote to memory of 2100	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	34
PID 2504 wrote to memory of 2100	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	34
PID 2504 wrote to memory of 2744	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	35
PID 2504 wrote to memory of 2744	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	35
PID 2504 wrote to memory of 2744	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	35
PID 2504 wrote to memory of 2832	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	36
PID 2504 wrote to memory of 2832	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	36
PID 2504 wrote to memory of 2832	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	36
PID 2504 wrote to memory of 2756	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	37
PID 2504 wrote to memory of 2756	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	37
PID 2504 wrote to memory of 2756	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	37
PID 2504 wrote to memory of 2608	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	38
PID 2504 wrote to memory of 2608	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	38
PID 2504 wrote to memory of 2608	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	38
PID 2504 wrote to memory of 2764	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	39
PID 2504 wrote to memory of 2764	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	39
PID 2504 wrote to memory of 2764	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	39
PID 2504 wrote to memory of 2796	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	40
PID 2504 wrote to memory of 2796	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	40
PID 2504 wrote to memory of 2796	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	40
PID 2504 wrote to memory of 2628	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	41
PID 2504 wrote to memory of 2628	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	41
PID 2504 wrote to memory of 2628	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	41
PID 2504 wrote to memory of 2828	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	42
PID 2504 wrote to memory of 2828	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	42
PID 2504 wrote to memory of 2828	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	42
PID 2504 wrote to memory of 2776	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	43
PID 2504 wrote to memory of 2776	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	43
PID 2504 wrote to memory of 2776	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	43
PID 2504 wrote to memory of 2632	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	44
PID 2504 wrote to memory of 2632	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	44
PID 2504 wrote to memory of 2632	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	44
PID 2504 wrote to memory of 2772	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	45
PID 2504 wrote to memory of 2772	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	45
PID 2504 wrote to memory of 2772	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	45
PID 2504 wrote to memory of 1912	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	46
PID 2504 wrote to memory of 1912	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	46
PID 2504 wrote to memory of 1912	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	46
PID 2504 wrote to memory of 1980	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	47
PID 2504 wrote to memory of 1980	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	47
PID 2504 wrote to memory of 1980	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	47
PID 2504 wrote to memory of 1320	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	48
PID 2504 wrote to memory of 1320	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	48
PID 2504 wrote to memory of 1320	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	48
PID 2504 wrote to memory of 2888	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	49
PID 2504 wrote to memory of 2888	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	49
PID 2504 wrote to memory of 2888	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	49
PID 2504 wrote to memory of 2640	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	50
PID 2504 wrote to memory of 2640	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	50
PID 2504 wrote to memory of 2640	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	50
PID 2504 wrote to memory of 1996	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	51
PID 2504 wrote to memory of 1996	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	51
PID 2504 wrote to memory of 1996	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	51
PID 2504 wrote to memory of 1804	2504	JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe	52

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02ef147d5581f73c858b974b53c7d6c0fbeaa2823b10908f6f72a246524e69d3.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\System\nGnvoUU.exe
  C:\Windows\System\nGnvoUU.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\gXwzBkd.exe
  C:\Windows\System\gXwzBkd.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\FzJDKvP.exe
  C:\Windows\System\FzJDKvP.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\CaOLjjb.exe
  C:\Windows\System\CaOLjjb.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\ueIlaNE.exe
  C:\Windows\System\ueIlaNE.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\RbeVbVf.exe
  C:\Windows\System\RbeVbVf.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\bRTRtQV.exe
  C:\Windows\System\bRTRtQV.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\CoOOMBj.exe
  C:\Windows\System\CoOOMBj.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\DfFPQRY.exe
  C:\Windows\System\DfFPQRY.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\hgYCqyh.exe
  C:\Windows\System\hgYCqyh.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\maXrzXu.exe
  C:\Windows\System\maXrzXu.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\wrcrJoM.exe
  C:\Windows\System\wrcrJoM.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\ZUBICzy.exe
  C:\Windows\System\ZUBICzy.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\ZZWSqJM.exe
  C:\Windows\System\ZZWSqJM.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\BTmNXuG.exe
  C:\Windows\System\BTmNXuG.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\skZkkqL.exe
  C:\Windows\System\skZkkqL.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\SlyABMg.exe
  C:\Windows\System\SlyABMg.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\jkkhPvc.exe
  C:\Windows\System\jkkhPvc.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\sdAxBgy.exe
  C:\Windows\System\sdAxBgy.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\UbczIWl.exe
  C:\Windows\System\UbczIWl.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\woGDSSB.exe
  C:\Windows\System\woGDSSB.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\ysqHbbf.exe
  C:\Windows\System\ysqHbbf.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\XCikwGD.exe
  C:\Windows\System\XCikwGD.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\oCIfoYg.exe
  C:\Windows\System\oCIfoYg.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\VAvPHNg.exe
  C:\Windows\System\VAvPHNg.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\DdkFbYA.exe
  C:\Windows\System\DdkFbYA.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\LdThCan.exe
  C:\Windows\System\LdThCan.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\fpvycjg.exe
  C:\Windows\System\fpvycjg.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\nyBkrYu.exe
  C:\Windows\System\nyBkrYu.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\dCvYgBG.exe
  C:\Windows\System\dCvYgBG.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\HJZCbTB.exe
  C:\Windows\System\HJZCbTB.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\xXJNdLi.exe
  C:\Windows\System\xXJNdLi.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\AEsEBVZ.exe
  C:\Windows\System\AEsEBVZ.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\JjNITqE.exe
  C:\Windows\System\JjNITqE.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\hGfgUdQ.exe
  C:\Windows\System\hGfgUdQ.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\svxcbls.exe
  C:\Windows\System\svxcbls.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\uThovfM.exe
  C:\Windows\System\uThovfM.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\FjNCelG.exe
  C:\Windows\System\FjNCelG.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\jwYksEx.exe
  C:\Windows\System\jwYksEx.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\cYdFsXQ.exe
  C:\Windows\System\cYdFsXQ.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\QtcAcyd.exe
  C:\Windows\System\QtcAcyd.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\hQFpQCL.exe
  C:\Windows\System\hQFpQCL.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\YFqrvfG.exe
  C:\Windows\System\YFqrvfG.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\tvIbWJL.exe
  C:\Windows\System\tvIbWJL.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\JZjnwPM.exe
  C:\Windows\System\JZjnwPM.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\FSqqrCH.exe
  C:\Windows\System\FSqqrCH.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\TzerOPo.exe
  C:\Windows\System\TzerOPo.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\ZFDYLHz.exe
  C:\Windows\System\ZFDYLHz.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\agqVyKP.exe
  C:\Windows\System\agqVyKP.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\kxedOCJ.exe
  C:\Windows\System\kxedOCJ.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\BaFZEot.exe
  C:\Windows\System\BaFZEot.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\lZupJaZ.exe
  C:\Windows\System\lZupJaZ.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\gLEaYlK.exe
  C:\Windows\System\gLEaYlK.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\hQAEWDb.exe
  C:\Windows\System\hQAEWDb.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\OgWGCts.exe
  C:\Windows\System\OgWGCts.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\yGRkNrW.exe
  C:\Windows\System\yGRkNrW.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\DTzYajS.exe
  C:\Windows\System\DTzYajS.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\pXucEpZ.exe
  C:\Windows\System\pXucEpZ.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\rEHjKHz.exe
  C:\Windows\System\rEHjKHz.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\RClLASj.exe
  C:\Windows\System\RClLASj.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\HrQFeky.exe
  C:\Windows\System\HrQFeky.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\chOeBlT.exe
  C:\Windows\System\chOeBlT.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\wiLcGdZ.exe
  C:\Windows\System\wiLcGdZ.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\RWQwlrr.exe
  C:\Windows\System\RWQwlrr.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\PQwFfhu.exe
  C:\Windows\System\PQwFfhu.exe
  2⤵
  PID:1616
- C:\Windows\System\fmqcUXP.exe
  C:\Windows\System\fmqcUXP.exe
  2⤵
  PID:1292
- C:\Windows\System\GoZPVWM.exe
  C:\Windows\System\GoZPVWM.exe
  2⤵
  PID:1056
- C:\Windows\System\UdZjgSC.exe
  C:\Windows\System\UdZjgSC.exe
  2⤵
  PID:2940
- C:\Windows\System\laioTuL.exe
  C:\Windows\System\laioTuL.exe
  2⤵
  PID:492
- C:\Windows\System\YdKlVLa.exe
  C:\Windows\System\YdKlVLa.exe
  2⤵
  PID:776
- C:\Windows\System\kcavyJg.exe
  C:\Windows\System\kcavyJg.exe
  2⤵
  PID:788
- C:\Windows\System\ldHolrR.exe
  C:\Windows\System\ldHolrR.exe
  2⤵
  PID:2012
- C:\Windows\System\MKpDZmg.exe
  C:\Windows\System\MKpDZmg.exe
  2⤵
  PID:2108
- C:\Windows\System\ToQHGiZ.exe
  C:\Windows\System\ToQHGiZ.exe
  2⤵
  PID:2560
- C:\Windows\System\RpdMVMo.exe
  C:\Windows\System\RpdMVMo.exe
  2⤵
  PID:1960
- C:\Windows\System\noNLIUp.exe
  C:\Windows\System\noNLIUp.exe
  2⤵
  PID:3064
- C:\Windows\System\eIhzRdR.exe
  C:\Windows\System\eIhzRdR.exe
  2⤵
  PID:1816
- C:\Windows\System\sBxDOmM.exe
  C:\Windows\System\sBxDOmM.exe
  2⤵
  PID:1504
- C:\Windows\System\lUmgodF.exe
  C:\Windows\System\lUmgodF.exe
  2⤵
  PID:1596
- C:\Windows\System\LRHWvcc.exe
  C:\Windows\System\LRHWvcc.exe
  2⤵
  PID:2404
- C:\Windows\System\dnGoqwY.exe
  C:\Windows\System\dnGoqwY.exe
  2⤵
  PID:2800
- C:\Windows\System\IvXBSKn.exe
  C:\Windows\System\IvXBSKn.exe
  2⤵
  PID:2824
- C:\Windows\System\UvkRFZB.exe
  C:\Windows\System\UvkRFZB.exe
  2⤵
  PID:2476
- C:\Windows\System\XPRkAmo.exe
  C:\Windows\System\XPRkAmo.exe
  2⤵
  PID:2612
- C:\Windows\System\NCZHCJY.exe
  C:\Windows\System\NCZHCJY.exe
  2⤵
  PID:308
- C:\Windows\System\AkidjMz.exe
  C:\Windows\System\AkidjMz.exe
  2⤵
  PID:1684
- C:\Windows\System\AxJODPI.exe
  C:\Windows\System\AxJODPI.exe
  2⤵
  PID:276
- C:\Windows\System\lWDPJqH.exe
  C:\Windows\System\lWDPJqH.exe
  2⤵
  PID:1420
- C:\Windows\System\aLfeYOg.exe
  C:\Windows\System\aLfeYOg.exe
  2⤵
  PID:1036
- C:\Windows\System\XdjOEkV.exe
  C:\Windows\System\XdjOEkV.exe
  2⤵
  PID:1308
- C:\Windows\System\wfEdFAz.exe
  C:\Windows\System\wfEdFAz.exe
  2⤵
  PID:784
- C:\Windows\System\uWRqxJw.exe
  C:\Windows\System\uWRqxJw.exe
  2⤵
  PID:1624
- C:\Windows\System\BFOGeyi.exe
  C:\Windows\System\BFOGeyi.exe
  2⤵
  PID:2440
- C:\Windows\System\oaSQeWc.exe
  C:\Windows\System\oaSQeWc.exe
  2⤵
  PID:3088
- C:\Windows\System\CBAbqat.exe
  C:\Windows\System\CBAbqat.exe
  2⤵
  PID:3108
- C:\Windows\System\IKjgnsn.exe
  C:\Windows\System\IKjgnsn.exe
  2⤵
  PID:3128
- C:\Windows\System\QrZEyLt.exe
  C:\Windows\System\QrZEyLt.exe
  2⤵
  PID:3148
- C:\Windows\System\CTAtMTN.exe
  C:\Windows\System\CTAtMTN.exe
  2⤵
  PID:3168
- C:\Windows\System\XDATReH.exe
  C:\Windows\System\XDATReH.exe
  2⤵
  PID:3188
- C:\Windows\System\mREspRI.exe
  C:\Windows\System\mREspRI.exe
  2⤵
  PID:3204
- C:\Windows\System\cVPskrk.exe
  C:\Windows\System\cVPskrk.exe
  2⤵
  PID:3228
- C:\Windows\System\MsqFxwa.exe
  C:\Windows\System\MsqFxwa.exe
  2⤵
  PID:3248
- C:\Windows\System\XZdffbO.exe
  C:\Windows\System\XZdffbO.exe
  2⤵
  PID:3268
- C:\Windows\System\USAOTrU.exe
  C:\Windows\System\USAOTrU.exe
  2⤵
  PID:3284
- C:\Windows\System\nCWcpap.exe
  C:\Windows\System\nCWcpap.exe
  2⤵
  PID:3308
- C:\Windows\System\eHtwXqL.exe
  C:\Windows\System\eHtwXqL.exe
  2⤵
  PID:3324
- C:\Windows\System\pislhQh.exe
  C:\Windows\System\pislhQh.exe
  2⤵
  PID:3348
- C:\Windows\System\CxYQYlv.exe
  C:\Windows\System\CxYQYlv.exe
  2⤵
  PID:3364
- C:\Windows\System\rGohteq.exe
  C:\Windows\System\rGohteq.exe
  2⤵
  PID:3384
- C:\Windows\System\mQzDGeq.exe
  C:\Windows\System\mQzDGeq.exe
  2⤵
  PID:3408
- C:\Windows\System\cpuEFDM.exe
  C:\Windows\System\cpuEFDM.exe
  2⤵
  PID:3428
- C:\Windows\System\vQcHadZ.exe
  C:\Windows\System\vQcHadZ.exe
  2⤵
  PID:3448
- C:\Windows\System\hiKvgXM.exe
  C:\Windows\System\hiKvgXM.exe
  2⤵
  PID:3468
- C:\Windows\System\eVjsvaS.exe
  C:\Windows\System\eVjsvaS.exe
  2⤵
  PID:3484
- C:\Windows\System\aYqlHKu.exe
  C:\Windows\System\aYqlHKu.exe
  2⤵
  PID:3504
- C:\Windows\System\ZFDxGrm.exe
  C:\Windows\System\ZFDxGrm.exe
  2⤵
  PID:3524
- C:\Windows\System\nYPLQVB.exe
  C:\Windows\System\nYPLQVB.exe
  2⤵
  PID:3548
- C:\Windows\System\DgkpTNx.exe
  C:\Windows\System\DgkpTNx.exe
  2⤵
  PID:3564
- C:\Windows\System\ZJnQBth.exe
  C:\Windows\System\ZJnQBth.exe
  2⤵
  PID:3584
- C:\Windows\System\MzeUsXT.exe
  C:\Windows\System\MzeUsXT.exe
  2⤵
  PID:3604
- C:\Windows\System\GcVrpzp.exe
  C:\Windows\System\GcVrpzp.exe
  2⤵
  PID:3624
- C:\Windows\System\VCcCFBk.exe
  C:\Windows\System\VCcCFBk.exe
  2⤵
  PID:3644
- C:\Windows\System\DmTBFNP.exe
  C:\Windows\System\DmTBFNP.exe
  2⤵
  PID:3668
- C:\Windows\System\GUBDwOX.exe
  C:\Windows\System\GUBDwOX.exe
  2⤵
  PID:3684
- C:\Windows\System\Wsvurgw.exe
  C:\Windows\System\Wsvurgw.exe
  2⤵
  PID:3708
- C:\Windows\System\pvPuDFd.exe
  C:\Windows\System\pvPuDFd.exe
  2⤵
  PID:3728
- C:\Windows\System\naXfqQz.exe
  C:\Windows\System\naXfqQz.exe
  2⤵
  PID:3748
- C:\Windows\System\rUmtCoQ.exe
  C:\Windows\System\rUmtCoQ.exe
  2⤵
  PID:3764
- C:\Windows\System\nzlslzo.exe
  C:\Windows\System\nzlslzo.exe
  2⤵
  PID:3788
- C:\Windows\System\xLykMiv.exe
  C:\Windows\System\xLykMiv.exe
  2⤵
  PID:3808
- C:\Windows\System\ZecdMMy.exe
  C:\Windows\System\ZecdMMy.exe
  2⤵
  PID:3828
- C:\Windows\System\OPdlLyI.exe
  C:\Windows\System\OPdlLyI.exe
  2⤵
  PID:3844
- C:\Windows\System\XSMNoeX.exe
  C:\Windows\System\XSMNoeX.exe
  2⤵
  PID:3868
- C:\Windows\System\rRQqmGP.exe
  C:\Windows\System\rRQqmGP.exe
  2⤵
  PID:3888
- C:\Windows\System\SzxGAbd.exe
  C:\Windows\System\SzxGAbd.exe
  2⤵
  PID:3908
- C:\Windows\System\yffRigE.exe
  C:\Windows\System\yffRigE.exe
  2⤵
  PID:3928
- C:\Windows\System\JRWXlhg.exe
  C:\Windows\System\JRWXlhg.exe
  2⤵
  PID:3948
- C:\Windows\System\jZLjZBy.exe
  C:\Windows\System\jZLjZBy.exe
  2⤵
  PID:3964
- C:\Windows\System\qpKjbxU.exe
  C:\Windows\System\qpKjbxU.exe
  2⤵
  PID:3988
- C:\Windows\System\ykkEFvZ.exe
  C:\Windows\System\ykkEFvZ.exe
  2⤵
  PID:4004
- C:\Windows\System\hScRguW.exe
  C:\Windows\System\hScRguW.exe
  2⤵
  PID:4028
- C:\Windows\System\nxdRohb.exe
  C:\Windows\System\nxdRohb.exe
  2⤵
  PID:4044
- C:\Windows\System\GlbHPar.exe
  C:\Windows\System\GlbHPar.exe
  2⤵
  PID:4068
- C:\Windows\System\wvfCJSu.exe
  C:\Windows\System\wvfCJSu.exe
  2⤵
  PID:4084
- C:\Windows\System\sELVluv.exe
  C:\Windows\System\sELVluv.exe
  2⤵
  PID:2324
- C:\Windows\System\bfGnSoT.exe
  C:\Windows\System\bfGnSoT.exe
  2⤵
  PID:1552
- C:\Windows\System\yqOYaVN.exe
  C:\Windows\System\yqOYaVN.exe
  2⤵
  PID:2072
- C:\Windows\System\ODCFHAm.exe
  C:\Windows\System\ODCFHAm.exe
  2⤵
  PID:1732
- C:\Windows\System\XNMOWkT.exe
  C:\Windows\System\XNMOWkT.exe
  2⤵
  PID:2268
- C:\Windows\System\iYzoVPi.exe
  C:\Windows\System\iYzoVPi.exe
  2⤵
  PID:2684
- C:\Windows\System\JQZdMOU.exe
  C:\Windows\System\JQZdMOU.exe
  2⤵
  PID:2804
- C:\Windows\System\TEZXfPe.exe
  C:\Windows\System\TEZXfPe.exe
  2⤵
  PID:2024
- C:\Windows\System\Aishuyz.exe
  C:\Windows\System\Aishuyz.exe
  2⤵
  PID:1924
- C:\Windows\System\WzVCowE.exe
  C:\Windows\System\WzVCowE.exe
  2⤵
  PID:2732
- C:\Windows\System\occQgxX.exe
  C:\Windows\System\occQgxX.exe
  2⤵
  PID:1020
- C:\Windows\System\dqFSNfv.exe
  C:\Windows\System\dqFSNfv.exe
  2⤵
  PID:2492
- C:\Windows\System\NOfypfr.exe
  C:\Windows\System\NOfypfr.exe
  2⤵
  PID:2480
- C:\Windows\System\bCyhPaC.exe
  C:\Windows\System\bCyhPaC.exe
  2⤵
  PID:1276
- C:\Windows\System\eBccDuZ.exe
  C:\Windows\System\eBccDuZ.exe
  2⤵
  PID:3080
- C:\Windows\System\aDlOIVI.exe
  C:\Windows\System\aDlOIVI.exe
  2⤵
  PID:3176
- C:\Windows\System\YZDFEyr.exe
  C:\Windows\System\YZDFEyr.exe
  2⤵
  PID:3160
- C:\Windows\System\YlmUSkP.exe
  C:\Windows\System\YlmUSkP.exe
  2⤵
  PID:3224
- C:\Windows\System\LKhIqmQ.exe
  C:\Windows\System\LKhIqmQ.exe
  2⤵
  PID:3236
- C:\Windows\System\JoxjVKM.exe
  C:\Windows\System\JoxjVKM.exe
  2⤵
  PID:3300
- C:\Windows\System\RNBvFzU.exe
  C:\Windows\System\RNBvFzU.exe
  2⤵
  PID:3336
- C:\Windows\System\bsokPQZ.exe
  C:\Windows\System\bsokPQZ.exe
  2⤵
  PID:3380
- C:\Windows\System\WGnetBj.exe
  C:\Windows\System\WGnetBj.exe
  2⤵
  PID:3356
- C:\Windows\System\mpOCjOO.exe
  C:\Windows\System\mpOCjOO.exe
  2⤵
  PID:3392
- C:\Windows\System\autYQMJ.exe
  C:\Windows\System\autYQMJ.exe
  2⤵
  PID:3436
- C:\Windows\System\hHrRbVa.exe
  C:\Windows\System\hHrRbVa.exe
  2⤵
  PID:3476
- C:\Windows\System\hlEifop.exe
  C:\Windows\System\hlEifop.exe
  2⤵
  PID:3540
- C:\Windows\System\fnyFUmX.exe
  C:\Windows\System\fnyFUmX.exe
  2⤵
  PID:3512
- C:\Windows\System\TtcOKVB.exe
  C:\Windows\System\TtcOKVB.exe
  2⤵
  PID:3044
- C:\Windows\System\ftaNnYt.exe
  C:\Windows\System\ftaNnYt.exe
  2⤵
  PID:3560
- C:\Windows\System\suUNRpI.exe
  C:\Windows\System\suUNRpI.exe
  2⤵
  PID:2332
- C:\Windows\System\zCIsZzA.exe
  C:\Windows\System\zCIsZzA.exe
  2⤵
  PID:3700
- C:\Windows\System\krTqAJZ.exe
  C:\Windows\System\krTqAJZ.exe
  2⤵
  PID:3636
- C:\Windows\System\OiTGRbR.exe
  C:\Windows\System\OiTGRbR.exe
  2⤵
  PID:3772
- C:\Windows\System\hgKDOoh.exe
  C:\Windows\System\hgKDOoh.exe
  2⤵
  PID:3824
- C:\Windows\System\YMFhOuB.exe
  C:\Windows\System\YMFhOuB.exe
  2⤵
  PID:3680
- C:\Windows\System\FSxsEfR.exe
  C:\Windows\System\FSxsEfR.exe
  2⤵
  PID:3760
- C:\Windows\System\lfuuqpd.exe
  C:\Windows\System\lfuuqpd.exe
  2⤵
  PID:3896
- C:\Windows\System\giWzpnB.exe
  C:\Windows\System\giWzpnB.exe
  2⤵
  PID:3836
- C:\Windows\System\PeWbkGc.exe
  C:\Windows\System\PeWbkGc.exe
  2⤵
  PID:3884
- C:\Windows\System\iQZTnVs.exe
  C:\Windows\System\iQZTnVs.exe
  2⤵
  PID:3972
- C:\Windows\System\WOCTNhT.exe
  C:\Windows\System\WOCTNhT.exe
  2⤵
  PID:4024
- C:\Windows\System\qpOGoCU.exe
  C:\Windows\System\qpOGoCU.exe
  2⤵
  PID:3920
- C:\Windows\System\rSXfPkJ.exe
  C:\Windows\System\rSXfPkJ.exe
  2⤵
  PID:3960
- C:\Windows\System\nCqqAzr.exe
  C:\Windows\System\nCqqAzr.exe
  2⤵
  PID:4056
- C:\Windows\System\apKjLLC.exe
  C:\Windows\System\apKjLLC.exe
  2⤵
  PID:4036
- C:\Windows\System\TigqUOA.exe
  C:\Windows\System\TigqUOA.exe
  2⤵
  PID:1044
- C:\Windows\System\AXDAckP.exe
  C:\Windows\System\AXDAckP.exe
  2⤵
  PID:2896
- C:\Windows\System\TJbPsPw.exe
  C:\Windows\System\TJbPsPw.exe
  2⤵
  PID:2648
- C:\Windows\System\gOGSrEn.exe
  C:\Windows\System\gOGSrEn.exe
  2⤵
  PID:808
- C:\Windows\System\yZqZPuF.exe
  C:\Windows\System\yZqZPuF.exe
  2⤵
  PID:1052
- C:\Windows\System\FayDQsZ.exe
  C:\Windows\System\FayDQsZ.exe
  2⤵
  PID:2876
- C:\Windows\System\TtVldOY.exe
  C:\Windows\System\TtVldOY.exe
  2⤵
  PID:1544
- C:\Windows\System\OparNYz.exe
  C:\Windows\System\OparNYz.exe
  2⤵
  PID:316
- C:\Windows\System\zGKupPB.exe
  C:\Windows\System\zGKupPB.exe
  2⤵
  PID:3144
- C:\Windows\System\pnHEIdA.exe
  C:\Windows\System\pnHEIdA.exe
  2⤵
  PID:3156
- C:\Windows\System\vzsQPiv.exe
  C:\Windows\System\vzsQPiv.exe
  2⤵
  PID:3116
- C:\Windows\System\BcxGUIR.exe
  C:\Windows\System\BcxGUIR.exe
  2⤵
  PID:3196
- C:\Windows\System\BiOBlVY.exe
  C:\Windows\System\BiOBlVY.exe
  2⤵
  PID:3332
- C:\Windows\System\VEYuwjR.exe
  C:\Windows\System\VEYuwjR.exe
  2⤵
  PID:2872
- C:\Windows\System\CCWxnXI.exe
  C:\Windows\System\CCWxnXI.exe
  2⤵
  PID:3456
- C:\Windows\System\jEWQUxR.exe
  C:\Windows\System\jEWQUxR.exe
  2⤵
  PID:3500
- C:\Windows\System\LKZuFoE.exe
  C:\Windows\System\LKZuFoE.exe
  2⤵
  PID:3572
- C:\Windows\System\jfHdUbe.exe
  C:\Windows\System\jfHdUbe.exe
  2⤵
  PID:3656
- C:\Windows\System\vZEGSJd.exe
  C:\Windows\System\vZEGSJd.exe
  2⤵
  PID:3464
- C:\Windows\System\oNzQaag.exe
  C:\Windows\System\oNzQaag.exe
  2⤵
  PID:3776
- C:\Windows\System\zTwpzxS.exe
  C:\Windows\System\zTwpzxS.exe
  2⤵
  PID:3800
- C:\Windows\System\GqcDDsX.exe
  C:\Windows\System\GqcDDsX.exe
  2⤵
  PID:3880
- C:\Windows\System\EKFAOvM.exe
  C:\Windows\System\EKFAOvM.exe
  2⤵
  PID:3640
- C:\Windows\System\UzxsaMs.exe
  C:\Windows\System\UzxsaMs.exe
  2⤵
  PID:3860
- C:\Windows\System\LeCIfiv.exe
  C:\Windows\System\LeCIfiv.exe
  2⤵
  PID:3984
- C:\Windows\System\AXrZcka.exe
  C:\Windows\System\AXrZcka.exe
  2⤵
  PID:2636
- C:\Windows\System\BcLhnbU.exe
  C:\Windows\System\BcLhnbU.exe
  2⤵
  PID:1712
- C:\Windows\System\GnmUhYE.exe
  C:\Windows\System\GnmUhYE.exe
  2⤵
  PID:1248
- C:\Windows\System\thfijWx.exe
  C:\Windows\System\thfijWx.exe
  2⤵
  PID:2128
- C:\Windows\System\gZZubYh.exe
  C:\Windows\System\gZZubYh.exe
  2⤵
  PID:1424
- C:\Windows\System\MxXBFYR.exe
  C:\Windows\System\MxXBFYR.exe
  2⤵
  PID:1520
- C:\Windows\System\aRfmejS.exe
  C:\Windows\System\aRfmejS.exe
  2⤵
  PID:4000
- C:\Windows\System\hVmGxkI.exe
  C:\Windows\System\hVmGxkI.exe
  2⤵
  PID:4012
- C:\Windows\System\CBlbmlH.exe
  C:\Windows\System\CBlbmlH.exe
  2⤵
  PID:4060
- C:\Windows\System\RfaulLF.exe
  C:\Windows\System\RfaulLF.exe
  2⤵
  PID:956
- C:\Windows\System\FYHuMAb.exe
  C:\Windows\System\FYHuMAb.exe
  2⤵
  PID:372
- C:\Windows\System\ZOYUqtB.exe
  C:\Windows\System\ZOYUqtB.exe
  2⤵
  PID:648
- C:\Windows\System\PtykXJv.exe
  C:\Windows\System\PtykXJv.exe
  2⤵
  PID:2152
- C:\Windows\System\Medkueq.exe
  C:\Windows\System\Medkueq.exe
  2⤵
  PID:2136
- C:\Windows\System\WsDEfOO.exe
  C:\Windows\System\WsDEfOO.exe
  2⤵
  PID:2596
- C:\Windows\System\RavvZfL.exe
  C:\Windows\System\RavvZfL.exe
  2⤵
  PID:3136
- C:\Windows\System\aSXBWNM.exe
  C:\Windows\System\aSXBWNM.exe
  2⤵
  PID:3104
- C:\Windows\System\yqytlTj.exe
  C:\Windows\System\yqytlTj.exe
  2⤵
  PID:2280
- C:\Windows\System\KJtRqQh.exe
  C:\Windows\System\KJtRqQh.exe
  2⤵
  PID:3180
- C:\Windows\System\vREthcu.exe
  C:\Windows\System\vREthcu.exe
  2⤵
  PID:3124
- C:\Windows\System\oZQXPVS.exe
  C:\Windows\System\oZQXPVS.exe
  2⤵
  PID:3316
- C:\Windows\System\FRAKfMa.exe
  C:\Windows\System\FRAKfMa.exe
  2⤵
  PID:3420
- C:\Windows\System\JzdAffa.exe
  C:\Windows\System\JzdAffa.exe
  2⤵
  PID:1528
- C:\Windows\System\xifrnYa.exe
  C:\Windows\System\xifrnYa.exe
  2⤵
  PID:3596
- C:\Windows\System\dkbRDEg.exe
  C:\Windows\System\dkbRDEg.exe
  2⤵
  PID:3780
- C:\Windows\System\jUCRWul.exe
  C:\Windows\System\jUCRWul.exe
  2⤵
  PID:3816
- C:\Windows\System\gBSHHLM.exe
  C:\Windows\System\gBSHHLM.exe
  2⤵
  PID:2856
- C:\Windows\System\PChvJiN.exe
  C:\Windows\System\PChvJiN.exe
  2⤵
  PID:1324
- C:\Windows\System\cTkZDGQ.exe
  C:\Windows\System\cTkZDGQ.exe
  2⤵
  PID:4092
- C:\Windows\System\QWLfgGT.exe
  C:\Windows\System\QWLfgGT.exe
  2⤵
  PID:3804
- C:\Windows\System\rOAAcWd.exe
  C:\Windows\System\rOAAcWd.exe
  2⤵
  PID:3676
- C:\Windows\System\gmxKHaf.exe
  C:\Windows\System\gmxKHaf.exe
  2⤵
  PID:2604
- C:\Windows\System\tCcAPpn.exe
  C:\Windows\System\tCcAPpn.exe
  2⤵
  PID:2088
- C:\Windows\System\hQGzqFR.exe
  C:\Windows\System\hQGzqFR.exe
  2⤵
  PID:2052
- C:\Windows\System\WVODmRP.exe
  C:\Windows\System\WVODmRP.exe
  2⤵
  PID:3280
- C:\Windows\System\yltlzHu.exe
  C:\Windows\System\yltlzHu.exe
  2⤵
  PID:4020
- C:\Windows\System\IYiUsbP.exe
  C:\Windows\System\IYiUsbP.exe
  2⤵
  PID:2064
- C:\Windows\System\bpnMOJQ.exe
  C:\Windows\System\bpnMOJQ.exe
  2⤵
  PID:2816
- C:\Windows\System\USudpjn.exe
  C:\Windows\System\USudpjn.exe
  2⤵
  PID:2428
- C:\Windows\System\eBSmwAM.exe
  C:\Windows\System\eBSmwAM.exe
  2⤵
  PID:3372
- C:\Windows\System\DZPKecG.exe
  C:\Windows\System\DZPKecG.exe
  2⤵
  PID:3720
- C:\Windows\System\AKPSWhr.exe
  C:\Windows\System\AKPSWhr.exe
  2⤵
  PID:2572
- C:\Windows\System\GSBwzex.exe
  C:\Windows\System\GSBwzex.exe
  2⤵
  PID:2952
- C:\Windows\System\xiPMaHZ.exe
  C:\Windows\System\xiPMaHZ.exe
  2⤵
  PID:3936
- C:\Windows\System\XLJqjcx.exe
  C:\Windows\System\XLJqjcx.exe
  2⤵
  PID:1896
- C:\Windows\System\ZdhoOlT.exe
  C:\Windows\System\ZdhoOlT.exe
  2⤵
  PID:2004
- C:\Windows\System\JpKWiGL.exe
  C:\Windows\System\JpKWiGL.exe
  2⤵
  PID:4052
- C:\Windows\System\AUsLodF.exe
  C:\Windows\System\AUsLodF.exe
  2⤵
  PID:1592
- C:\Windows\System\aBdmVeq.exe
  C:\Windows\System\aBdmVeq.exe
  2⤵
  PID:2336
- C:\Windows\System\IVDFnwZ.exe
  C:\Windows\System\IVDFnwZ.exe
  2⤵
  PID:236
- C:\Windows\System\tFXDgDd.exe
  C:\Windows\System\tFXDgDd.exe
  2⤵
  PID:3220
- C:\Windows\System\GhpKbMt.exe
  C:\Windows\System\GhpKbMt.exe
  2⤵
  PID:1188
- C:\Windows\System\svtURoz.exe
  C:\Windows\System\svtURoz.exe
  2⤵
  PID:3340
- C:\Windows\System\BLvBOAL.exe
  C:\Windows\System\BLvBOAL.exe
  2⤵
  PID:3856
- C:\Windows\System\eYsLPgC.exe
  C:\Windows\System\eYsLPgC.exe
  2⤵
  PID:3008
- C:\Windows\System\bCdfoAc.exe
  C:\Windows\System\bCdfoAc.exe
  2⤵
  PID:3632
- C:\Windows\System\QJtTLQG.exe
  C:\Windows\System\QJtTLQG.exe
  2⤵
  PID:2328
- C:\Windows\System\LOPAtOL.exe
  C:\Windows\System\LOPAtOL.exe
  2⤵
  PID:1472
- C:\Windows\System\flQcFkW.exe
  C:\Windows\System\flQcFkW.exe
  2⤵
  PID:3024
- C:\Windows\System\WBlRokp.exe
  C:\Windows\System\WBlRokp.exe
  2⤵
  PID:3692
- C:\Windows\System\OEciSNf.exe
  C:\Windows\System\OEciSNf.exe
  2⤵
  PID:2168
- C:\Windows\System\yViUaxe.exe
  C:\Windows\System\yViUaxe.exe
  2⤵
  PID:2116
- C:\Windows\System\SGQgMmF.exe
  C:\Windows\System\SGQgMmF.exe
  2⤵
  PID:3536
- C:\Windows\System\kMonFph.exe
  C:\Windows\System\kMonFph.exe
  2⤵
  PID:1832
- C:\Windows\System\TMLpeNg.exe
  C:\Windows\System\TMLpeNg.exe
  2⤵
  PID:3056
- C:\Windows\System\jiyextl.exe
  C:\Windows\System\jiyextl.exe
  2⤵
  PID:3664
- C:\Windows\System\pwKRFkR.exe
  C:\Windows\System\pwKRFkR.exe
  2⤵
  PID:2780
- C:\Windows\System\VlBajfD.exe
  C:\Windows\System\VlBajfD.exe
  2⤵
  PID:3876
- C:\Windows\System\ABybqGK.exe
  C:\Windows\System\ABybqGK.exe
  2⤵
  PID:2616
- C:\Windows\System\xKSHYoQ.exe
  C:\Windows\System\xKSHYoQ.exe
  2⤵
  PID:2720
- C:\Windows\System\OcecrNW.exe
  C:\Windows\System\OcecrNW.exe
  2⤵
  PID:3028
- C:\Windows\System\VwYQyXa.exe
  C:\Windows\System\VwYQyXa.exe
  2⤵
  PID:3852
- C:\Windows\System\HNESwhr.exe
  C:\Windows\System\HNESwhr.exe
  2⤵
  PID:3440
- C:\Windows\System\lMuMntC.exe
  C:\Windows\System\lMuMntC.exe
  2⤵
  PID:4104
- C:\Windows\System\cZbTCfX.exe
  C:\Windows\System\cZbTCfX.exe
  2⤵
  PID:4120
- C:\Windows\System\RcLWcdM.exe
  C:\Windows\System\RcLWcdM.exe
  2⤵
  PID:4148
- C:\Windows\System\CLJNMil.exe
  C:\Windows\System\CLJNMil.exe
  2⤵
  PID:4164
- C:\Windows\System\ONxsjGK.exe
  C:\Windows\System\ONxsjGK.exe
  2⤵
  PID:4180
- C:\Windows\System\qQnUdRn.exe
  C:\Windows\System\qQnUdRn.exe
  2⤵
  PID:4196
- C:\Windows\System\pujHTEG.exe
  C:\Windows\System\pujHTEG.exe
  2⤵
  PID:4212
- C:\Windows\System\gwTiOks.exe
  C:\Windows\System\gwTiOks.exe
  2⤵
  PID:4232
- C:\Windows\System\dCfzsch.exe
  C:\Windows\System\dCfzsch.exe
  2⤵
  PID:4248
- C:\Windows\System\GMScWCh.exe
  C:\Windows\System\GMScWCh.exe
  2⤵
  PID:4296
- C:\Windows\System\IDfnQfg.exe
  C:\Windows\System\IDfnQfg.exe
  2⤵
  PID:4316
- C:\Windows\System\uqoJnFQ.exe
  C:\Windows\System\uqoJnFQ.exe
  2⤵
  PID:4336
- C:\Windows\System\hXLJxyH.exe
  C:\Windows\System\hXLJxyH.exe
  2⤵
  PID:4364
- C:\Windows\System\OTePUEP.exe
  C:\Windows\System\OTePUEP.exe
  2⤵
  PID:4380
- C:\Windows\System\yqvuMpM.exe
  C:\Windows\System\yqvuMpM.exe
  2⤵
  PID:4400
- C:\Windows\System\ZFRYutt.exe
  C:\Windows\System\ZFRYutt.exe
  2⤵
  PID:4420
- C:\Windows\System\aUlByIz.exe
  C:\Windows\System\aUlByIz.exe
  2⤵
  PID:4436
- C:\Windows\System\FVsGdSh.exe
  C:\Windows\System\FVsGdSh.exe
  2⤵
  PID:4452
- C:\Windows\System\PFEaYnO.exe
  C:\Windows\System\PFEaYnO.exe
  2⤵
  PID:4468
- C:\Windows\System\PpkPvMJ.exe
  C:\Windows\System\PpkPvMJ.exe
  2⤵
  PID:4488
- C:\Windows\System\qDHkQYx.exe
  C:\Windows\System\qDHkQYx.exe
  2⤵
  PID:4504
- C:\Windows\System\RZIbDRk.exe
  C:\Windows\System\RZIbDRk.exe
  2⤵
  PID:4524
- C:\Windows\System\PSSGovR.exe
  C:\Windows\System\PSSGovR.exe
  2⤵
  PID:4544
- C:\Windows\System\FsmATHU.exe
  C:\Windows\System\FsmATHU.exe
  2⤵
  PID:4560
- C:\Windows\System\NIDUsfx.exe
  C:\Windows\System\NIDUsfx.exe
  2⤵
  PID:4576
- C:\Windows\System\cVOVzkp.exe
  C:\Windows\System\cVOVzkp.exe
  2⤵
  PID:4592
- C:\Windows\System\NEGnWfh.exe
  C:\Windows\System\NEGnWfh.exe
  2⤵
  PID:4608
- C:\Windows\System\OpmVnEs.exe
  C:\Windows\System\OpmVnEs.exe
  2⤵
  PID:4628
- C:\Windows\System\Ffohnoe.exe
  C:\Windows\System\Ffohnoe.exe
  2⤵
  PID:4648
- C:\Windows\System\ZTDoxom.exe
  C:\Windows\System\ZTDoxom.exe
  2⤵
  PID:4664
- C:\Windows\System\SllHmZM.exe
  C:\Windows\System\SllHmZM.exe
  2⤵
  PID:4684
- C:\Windows\System\MDKzsUe.exe
  C:\Windows\System\MDKzsUe.exe
  2⤵
  PID:4700
- C:\Windows\System\cooHBYy.exe
  C:\Windows\System\cooHBYy.exe
  2⤵
  PID:4716
- C:\Windows\System\akHIngg.exe
  C:\Windows\System\akHIngg.exe
  2⤵
  PID:4732
- C:\Windows\System\GBTydla.exe
  C:\Windows\System\GBTydla.exe
  2⤵
  PID:4804
- C:\Windows\System\mtQRtFZ.exe
  C:\Windows\System\mtQRtFZ.exe
  2⤵
  PID:4824
- C:\Windows\System\qDAlfga.exe
  C:\Windows\System\qDAlfga.exe
  2⤵
  PID:4840
- C:\Windows\System\IpnwBHd.exe
  C:\Windows\System\IpnwBHd.exe
  2⤵
  PID:4856
- C:\Windows\System\uyzkhMQ.exe
  C:\Windows\System\uyzkhMQ.exe
  2⤵
  PID:4876
- C:\Windows\System\ZIvKLWM.exe
  C:\Windows\System\ZIvKLWM.exe
  2⤵
  PID:4900
- C:\Windows\System\iSDPGTb.exe
  C:\Windows\System\iSDPGTb.exe
  2⤵
  PID:4924
- C:\Windows\System\onTrERR.exe
  C:\Windows\System\onTrERR.exe
  2⤵
  PID:4944
- C:\Windows\System\lCQteAs.exe
  C:\Windows\System\lCQteAs.exe
  2⤵
  PID:4960
- C:\Windows\System\kOUiEwB.exe
  C:\Windows\System\kOUiEwB.exe
  2⤵
  PID:4976
- C:\Windows\System\OubCCgL.exe
  C:\Windows\System\OubCCgL.exe
  2⤵
  PID:4996
- C:\Windows\System\KCPKPLK.exe
  C:\Windows\System\KCPKPLK.exe
  2⤵
  PID:5020
- C:\Windows\System\AytQmGD.exe
  C:\Windows\System\AytQmGD.exe
  2⤵
  PID:5040
- C:\Windows\System\ccDLShc.exe
  C:\Windows\System\ccDLShc.exe
  2⤵
  PID:5060
- C:\Windows\System\WivKuJr.exe
  C:\Windows\System\WivKuJr.exe
  2⤵
  PID:5076
- C:\Windows\System\FObPBdp.exe
  C:\Windows\System\FObPBdp.exe
  2⤵
  PID:5096
- C:\Windows\System\WBVLVns.exe
  C:\Windows\System\WBVLVns.exe
  2⤵
  PID:856
- C:\Windows\System\piliLgC.exe
  C:\Windows\System\piliLgC.exe
  2⤵
  PID:4100
- C:\Windows\System\LliLOPt.exe
  C:\Windows\System\LliLOPt.exe
  2⤵
  PID:1972
- C:\Windows\System\FUIBJtN.exe
  C:\Windows\System\FUIBJtN.exe
  2⤵
  PID:2484
- C:\Windows\System\aeosQMT.exe
  C:\Windows\System\aeosQMT.exe
  2⤵
  PID:4128
- C:\Windows\System\UzmJDxH.exe
  C:\Windows\System\UzmJDxH.exe
  2⤵
  PID:4172
- C:\Windows\System\oziTSRJ.exe
  C:\Windows\System\oziTSRJ.exe
  2⤵
  PID:1492
- C:\Windows\System\SXWlaPT.exe
  C:\Windows\System\SXWlaPT.exe
  2⤵
  PID:4304
- C:\Windows\System\HeehWvT.exe
  C:\Windows\System\HeehWvT.exe
  2⤵
  PID:4324
- C:\Windows\System\TstZgir.exe
  C:\Windows\System\TstZgir.exe
  2⤵
  PID:4276
- C:\Windows\System\rMYjLMN.exe
  C:\Windows\System\rMYjLMN.exe
  2⤵
  PID:4220
- C:\Windows\System\eLhfSdZ.exe
  C:\Windows\System\eLhfSdZ.exe
  2⤵
  PID:4256
- C:\Windows\System\tjIXOAf.exe
  C:\Windows\System\tjIXOAf.exe
  2⤵
  PID:4284
- C:\Windows\System\DLHcaYA.exe
  C:\Windows\System\DLHcaYA.exe
  2⤵
  PID:4360
- C:\Windows\System\JlIiEND.exe
  C:\Windows\System\JlIiEND.exe
  2⤵
  PID:4408
- C:\Windows\System\BULqwPQ.exe
  C:\Windows\System\BULqwPQ.exe
  2⤵
  PID:4600
- C:\Windows\System\DgpDdYX.exe
  C:\Windows\System\DgpDdYX.exe
  2⤵
  PID:4412
- C:\Windows\System\NEtDqUi.exe
  C:\Windows\System\NEtDqUi.exe
  2⤵
  PID:4480
- C:\Windows\System\VmnSwIa.exe
  C:\Windows\System\VmnSwIa.exe
  2⤵
  PID:2840
- C:\Windows\System\tEdmpmg.exe
  C:\Windows\System\tEdmpmg.exe
  2⤵
  PID:4656
- C:\Windows\System\UaNNHSx.exe
  C:\Windows\System\UaNNHSx.exe
  2⤵
  PID:4760
- C:\Windows\System\tciqGix.exe
  C:\Windows\System\tciqGix.exe
  2⤵
  PID:4780
- C:\Windows\System\dtWiZuu.exe
  C:\Windows\System\dtWiZuu.exe
  2⤵
  PID:4728
- C:\Windows\System\rdmFWgm.exe
  C:\Windows\System\rdmFWgm.exe
  2⤵
  PID:4516
- C:\Windows\System\KiFkSuv.exe
  C:\Windows\System\KiFkSuv.exe
  2⤵
  PID:4552
- C:\Windows\System\rjVgVYB.exe
  C:\Windows\System\rjVgVYB.exe
  2⤵
  PID:4616
- C:\Windows\System\zfIKmIy.exe
  C:\Windows\System\zfIKmIy.exe
  2⤵
  PID:4620
- C:\Windows\System\kAUPoSL.exe
  C:\Windows\System\kAUPoSL.exe
  2⤵
  PID:4872
- C:\Windows\System\feQdWXV.exe
  C:\Windows\System\feQdWXV.exe
  2⤵
  PID:4884
- C:\Windows\System\IXDtVxk.exe
  C:\Windows\System\IXDtVxk.exe
  2⤵
  PID:4916
- C:\Windows\System\SsauELt.exe
  C:\Windows\System\SsauELt.exe
  2⤵
  PID:4936
- C:\Windows\System\PktszqP.exe
  C:\Windows\System\PktszqP.exe
  2⤵
  PID:5032
- C:\Windows\System\NeFovgg.exe
  C:\Windows\System\NeFovgg.exe
  2⤵
  PID:5016
- C:\Windows\System\PnhENYW.exe
  C:\Windows\System\PnhENYW.exe
  2⤵
  PID:5088
- C:\Windows\System\yOnAcZs.exe
  C:\Windows\System\yOnAcZs.exe
  2⤵
  PID:3096
- C:\Windows\System\MXUehyK.exe
  C:\Windows\System\MXUehyK.exe
  2⤵
  PID:5056
- C:\Windows\System\jJEbuFW.exe
  C:\Windows\System\jJEbuFW.exe
  2⤵
  PID:4156
- C:\Windows\System\ToLDztB.exe
  C:\Windows\System\ToLDztB.exe
  2⤵
  PID:4372
- C:\Windows\System\BbGGsZx.exe
  C:\Windows\System\BbGGsZx.exe
  2⤵
  PID:4332
- C:\Windows\System\MudqnHc.exe
  C:\Windows\System\MudqnHc.exe
  2⤵
  PID:4428
- C:\Windows\System\aIHzOva.exe
  C:\Windows\System\aIHzOva.exe
  2⤵
  PID:1752
- C:\Windows\System\TSDIgDw.exe
  C:\Windows\System\TSDIgDw.exe
  2⤵
  PID:4460
- C:\Windows\System\lWXBZVF.exe
  C:\Windows\System\lWXBZVF.exe
  2⤵
  PID:4644
- C:\Windows\System\PPdnnjd.exe
  C:\Windows\System\PPdnnjd.exe
  2⤵
  PID:4272
- C:\Windows\System\yfWNqGX.exe
  C:\Windows\System\yfWNqGX.exe
  2⤵
  PID:4268
- C:\Windows\System\nAYOuno.exe
  C:\Windows\System\nAYOuno.exe
  2⤵
  PID:4476
- C:\Windows\System\NxKXDpY.exe
  C:\Windows\System\NxKXDpY.exe
  2⤵
  PID:4756
- C:\Windows\System\AXQyjlo.exe
  C:\Windows\System\AXQyjlo.exe
  2⤵
  PID:4692
- C:\Windows\System\ZNbjQBo.exe
  C:\Windows\System\ZNbjQBo.exe
  2⤵
  PID:4888
- C:\Windows\System\NONhgQT.exe
  C:\Windows\System\NONhgQT.exe
  2⤵
  PID:4512
- C:\Windows\System\AiyEgrb.exe
  C:\Windows\System\AiyEgrb.exe
  2⤵
  PID:4740
- C:\Windows\System\wglQyEP.exe
  C:\Windows\System\wglQyEP.exe
  2⤵
  PID:4708
- C:\Windows\System\gHIKQxZ.exe
  C:\Windows\System\gHIKQxZ.exe
  2⤵
  PID:4744
- C:\Windows\System\nFUypqz.exe
  C:\Windows\System\nFUypqz.exe
  2⤵
  PID:5072
- C:\Windows\System\QrMqmFr.exe
  C:\Windows\System\QrMqmFr.exe
  2⤵
  PID:5104
- C:\Windows\System\ovzeQrn.exe
  C:\Windows\System\ovzeQrn.exe
  2⤵
  PID:2820
- C:\Windows\System\uotHAHY.exe
  C:\Windows\System\uotHAHY.exe
  2⤵
  PID:1844
- C:\Windows\System\TpzWexq.exe
  C:\Windows\System\TpzWexq.exe
  2⤵
  PID:4328
- C:\Windows\System\divrdsk.exe
  C:\Windows\System\divrdsk.exe
  2⤵
  PID:4396
- C:\Windows\System\xNsDidx.exe
  C:\Windows\System\xNsDidx.exe
  2⤵
  PID:4500
- C:\Windows\System\pKPNaVG.exe
  C:\Windows\System\pKPNaVG.exe
  2⤵
  PID:4680
- C:\Windows\System\lxcWBJL.exe
  C:\Windows\System\lxcWBJL.exe
  2⤵
  PID:4588
- C:\Windows\System\uuglFxD.exe
  C:\Windows\System\uuglFxD.exe
  2⤵
  PID:4144
- C:\Windows\System\kJGUCHV.exe
  C:\Windows\System\kJGUCHV.exe
  2⤵
  PID:4776
- C:\Windows\System\pDkoCOF.exe
  C:\Windows\System\pDkoCOF.exe
  2⤵
  PID:4988
- C:\Windows\System\dkemCsR.exe
  C:\Windows\System\dkemCsR.exe
  2⤵
  PID:4832
- C:\Windows\System\KPJICIJ.exe
  C:\Windows\System\KPJICIJ.exe
  2⤵
  PID:4932
- C:\Windows\System\TSBnDLh.exe
  C:\Windows\System\TSBnDLh.exe
  2⤵
  PID:5012
- C:\Windows\System\rncpOtv.exe
  C:\Windows\System\rncpOtv.exe
  2⤵
  PID:4392
- C:\Windows\System\jjNmVhm.exe
  C:\Windows\System\jjNmVhm.exe
  2⤵
  PID:4240
- C:\Windows\System\eEAFBHJ.exe
  C:\Windows\System\eEAFBHJ.exe
  2⤵
  PID:4672
- C:\Windows\System\RLcvDKu.exe
  C:\Windows\System\RLcvDKu.exe
  2⤵
  PID:4640
- C:\Windows\System\HJqrGDw.exe
  C:\Windows\System\HJqrGDw.exe
  2⤵
  PID:4820
- C:\Windows\System\byIIQbO.exe
  C:\Windows\System\byIIQbO.exe
  2⤵
  PID:4712
- C:\Windows\System\EYlGTAO.exe
  C:\Windows\System\EYlGTAO.exe
  2⤵
  PID:4556
- C:\Windows\System\dBurPnT.exe
  C:\Windows\System\dBurPnT.exe
  2⤵
  PID:5092
- C:\Windows\System\xVZzbnr.exe
  C:\Windows\System\xVZzbnr.exe
  2⤵
  PID:5136
- C:\Windows\System\myxAoHa.exe
  C:\Windows\System\myxAoHa.exe
  2⤵
  PID:5156
- C:\Windows\System\muCufnS.exe
  C:\Windows\System\muCufnS.exe
  2⤵
  PID:5172
- C:\Windows\System\okVoquH.exe
  C:\Windows\System\okVoquH.exe
  2⤵
  PID:5192
- C:\Windows\System\kVijOaU.exe
  C:\Windows\System\kVijOaU.exe
  2⤵
  PID:5212
- C:\Windows\System\ThCxLby.exe
  C:\Windows\System\ThCxLby.exe
  2⤵
  PID:5228
- C:\Windows\System\SEdHyrj.exe
  C:\Windows\System\SEdHyrj.exe
  2⤵
  PID:5244
- C:\Windows\System\dPovnBX.exe
  C:\Windows\System\dPovnBX.exe
  2⤵
  PID:5312
- C:\Windows\System\UdcbRuq.exe
  C:\Windows\System\UdcbRuq.exe
  2⤵
  PID:5328
- C:\Windows\System\rKQVBIn.exe
  C:\Windows\System\rKQVBIn.exe
  2⤵
  PID:5348
- C:\Windows\System\xQKBJjO.exe
  C:\Windows\System\xQKBJjO.exe
  2⤵
  PID:5364
- C:\Windows\System\zABJaWl.exe
  C:\Windows\System\zABJaWl.exe
  2⤵
  PID:5384
- C:\Windows\System\CTOfNVT.exe
  C:\Windows\System\CTOfNVT.exe
  2⤵
  PID:5404
- C:\Windows\System\hMfkWDe.exe
  C:\Windows\System\hMfkWDe.exe
  2⤵
  PID:5424
- C:\Windows\System\QYpxUKJ.exe
  C:\Windows\System\QYpxUKJ.exe
  2⤵
  PID:5440
- C:\Windows\System\KYHkWDO.exe
  C:\Windows\System\KYHkWDO.exe
  2⤵
  PID:5460
- C:\Windows\System\oKGNzsd.exe
  C:\Windows\System\oKGNzsd.exe
  2⤵
  PID:5480
- C:\Windows\System\EHLVxxP.exe
  C:\Windows\System\EHLVxxP.exe
  2⤵
  PID:5508
- C:\Windows\System\yYvTdQe.exe
  C:\Windows\System\yYvTdQe.exe
  2⤵
  PID:5528
- C:\Windows\System\QfWMFsS.exe
  C:\Windows\System\QfWMFsS.exe
  2⤵
  PID:5556
- C:\Windows\System\FlGgXAP.exe
  C:\Windows\System\FlGgXAP.exe
  2⤵
  PID:5572
- C:\Windows\System\rREvBFS.exe
  C:\Windows\System\rREvBFS.exe
  2⤵
  PID:5588
- C:\Windows\System\sjhDdDp.exe
  C:\Windows\System\sjhDdDp.exe
  2⤵
  PID:5608
- C:\Windows\System\KtWOJYP.exe
  C:\Windows\System\KtWOJYP.exe
  2⤵
  PID:5628
- C:\Windows\System\bAnMPFW.exe
  C:\Windows\System\bAnMPFW.exe
  2⤵
  PID:5644
- C:\Windows\System\bBfwjXf.exe
  C:\Windows\System\bBfwjXf.exe
  2⤵
  PID:5660
- C:\Windows\System\NiuoSOc.exe
  C:\Windows\System\NiuoSOc.exe
  2⤵
  PID:5680
- C:\Windows\System\ytfxQqf.exe
  C:\Windows\System\ytfxQqf.exe
  2⤵
  PID:5704
- C:\Windows\System\ttLuZzn.exe
  C:\Windows\System\ttLuZzn.exe
  2⤵
  PID:5720
- C:\Windows\System\hylaPTP.exe
  C:\Windows\System\hylaPTP.exe
  2⤵
  PID:5736
- C:\Windows\System\PSKvWfp.exe
  C:\Windows\System\PSKvWfp.exe
  2⤵
  PID:5756
- C:\Windows\System\hDsXzUC.exe
  C:\Windows\System\hDsXzUC.exe
  2⤵
  PID:5780
- C:\Windows\System\OCHTEeR.exe
  C:\Windows\System\OCHTEeR.exe
  2⤵
  PID:5796
- C:\Windows\System\cKlEEiH.exe
  C:\Windows\System\cKlEEiH.exe
  2⤵
  PID:5812
- C:\Windows\System\BJBtrzh.exe
  C:\Windows\System\BJBtrzh.exe
  2⤵
  PID:5848
- C:\Windows\System\QMgroBJ.exe
  C:\Windows\System\QMgroBJ.exe
  2⤵
  PID:5864
- C:\Windows\System\jHlSvKQ.exe
  C:\Windows\System\jHlSvKQ.exe
  2⤵
  PID:5888
- C:\Windows\System\omOmClN.exe
  C:\Windows\System\omOmClN.exe
  2⤵
  PID:5904
- C:\Windows\System\gfIruZh.exe
  C:\Windows\System\gfIruZh.exe
  2⤵
  PID:5920
- C:\Windows\System\HXkYZAE.exe
  C:\Windows\System\HXkYZAE.exe
  2⤵
  PID:5944
- C:\Windows\System\dEBIeIy.exe
  C:\Windows\System\dEBIeIy.exe
  2⤵
  PID:5964
- C:\Windows\System\rvPrXec.exe
  C:\Windows\System\rvPrXec.exe
  2⤵
  PID:5980
- C:\Windows\System\ScPBRwH.exe
  C:\Windows\System\ScPBRwH.exe
  2⤵
  PID:6012
- C:\Windows\System\vRuHIBH.exe
  C:\Windows\System\vRuHIBH.exe
  2⤵
  PID:6028
- C:\Windows\System\ukywntU.exe
  C:\Windows\System\ukywntU.exe
  2⤵
  PID:6048
- C:\Windows\System\fXkKGfl.exe
  C:\Windows\System\fXkKGfl.exe
  2⤵
  PID:6072
- C:\Windows\System\HYxRxjq.exe
  C:\Windows\System\HYxRxjq.exe
  2⤵
  PID:6088
- C:\Windows\System\Jnlnrww.exe
  C:\Windows\System\Jnlnrww.exe
  2⤵
  PID:6104
- C:\Windows\System\epWMTiz.exe
  C:\Windows\System\epWMTiz.exe
  2⤵
  PID:6120
- C:\Windows\System\lEEboNr.exe
  C:\Windows\System\lEEboNr.exe
  2⤵
  PID:6140
- C:\Windows\System\qFLBjbt.exe
  C:\Windows\System\qFLBjbt.exe
  2⤵
  PID:5132
- C:\Windows\System\qeIkKnD.exe
  C:\Windows\System\qeIkKnD.exe
  2⤵
  PID:5008
- C:\Windows\System\eLPcsYW.exe
  C:\Windows\System\eLPcsYW.exe
  2⤵
  PID:5052
- C:\Windows\System\hedXfOy.exe
  C:\Windows\System\hedXfOy.exe
  2⤵
  PID:5144
- C:\Windows\System\zujgzZi.exe
  C:\Windows\System\zujgzZi.exe
  2⤵
  PID:5188
- C:\Windows\System\aUYNMis.exe
  C:\Windows\System\aUYNMis.exe
  2⤵
  PID:5164
- C:\Windows\System\ZoGmSAr.exe
  C:\Windows\System\ZoGmSAr.exe
  2⤵
  PID:5236
- C:\Windows\System\khiTroL.exe
  C:\Windows\System\khiTroL.exe
  2⤵
  PID:5280
- C:\Windows\System\YdazaaD.exe
  C:\Windows\System\YdazaaD.exe
  2⤵
  PID:5296
- C:\Windows\System\mlygQUT.exe
  C:\Windows\System\mlygQUT.exe
  2⤵
  PID:5320
- C:\Windows\System\ptyTtqK.exe
  C:\Windows\System\ptyTtqK.exe
  2⤵
  PID:5360
- C:\Windows\System\zZBbmOZ.exe
  C:\Windows\System\zZBbmOZ.exe
  2⤵
  PID:5224
- C:\Windows\System\jJVgXbd.exe
  C:\Windows\System\jJVgXbd.exe
  2⤵
  PID:5476
- C:\Windows\System\hjAnDix.exe
  C:\Windows\System\hjAnDix.exe
  2⤵
  PID:5336
- C:\Windows\System\FgfnSLn.exe
  C:\Windows\System\FgfnSLn.exe
  2⤵
  PID:5376
- C:\Windows\System\unpXuWO.exe
  C:\Windows\System\unpXuWO.exe
  2⤵
  PID:5452
- C:\Windows\System\PqKBAOI.exe
  C:\Windows\System\PqKBAOI.exe
  2⤵
  PID:5504
- C:\Windows\System\puvEYYv.exe
  C:\Windows\System\puvEYYv.exe
  2⤵
  PID:5600
- C:\Windows\System\qUSuoci.exe
  C:\Windows\System\qUSuoci.exe
  2⤵
  PID:5672
- C:\Windows\System\GNUkBpJ.exe
  C:\Windows\System\GNUkBpJ.exe
  2⤵
  PID:5580
- C:\Windows\System\aEyzvRe.exe
  C:\Windows\System\aEyzvRe.exe
  2⤵
  PID:5744
- C:\Windows\System\kpTuIpt.exe
  C:\Windows\System\kpTuIpt.exe
  2⤵
  PID:5824
- C:\Windows\System\AAYeSPC.exe
  C:\Windows\System\AAYeSPC.exe
  2⤵
  PID:5732
- C:\Windows\System\ARauZBG.exe
  C:\Windows\System\ARauZBG.exe
  2⤵
  PID:5836
- C:\Windows\System\ZPLkKoh.exe
  C:\Windows\System\ZPLkKoh.exe
  2⤵
  PID:5656
- C:\Windows\System\YhgfqHc.exe
  C:\Windows\System\YhgfqHc.exe
  2⤵
  PID:5772
- C:\Windows\System\ZaulDnk.exe
  C:\Windows\System\ZaulDnk.exe
  2⤵
  PID:5884
- C:\Windows\System\vIOIdJR.exe
  C:\Windows\System\vIOIdJR.exe
  2⤵
  PID:5860
- C:\Windows\System\eLhDOTS.exe
  C:\Windows\System\eLhDOTS.exe
  2⤵
  PID:5988
- C:\Windows\System\QEfhdYc.exe
  C:\Windows\System\QEfhdYc.exe
  2⤵
  PID:6000
- C:\Windows\System\ptFhShU.exe
  C:\Windows\System\ptFhShU.exe
  2⤵
  PID:5936
- C:\Windows\System\rIrYwNY.exe
  C:\Windows\System\rIrYwNY.exe
  2⤵
  PID:6008
- C:\Windows\System\BPuxTXL.exe
  C:\Windows\System\BPuxTXL.exe
  2⤵
  PID:6112
- C:\Windows\System\qldfMDS.exe
  C:\Windows\System\qldfMDS.exe
  2⤵
  PID:4604
- C:\Windows\System\vxKHmIz.exe
  C:\Windows\System\vxKHmIz.exe
  2⤵
  PID:4848
- C:\Windows\System\PjLWcHV.exe
  C:\Windows\System\PjLWcHV.exe
  2⤵
  PID:6024
- C:\Windows\System\ctrEtoT.exe
  C:\Windows\System\ctrEtoT.exe
  2⤵
  PID:6136
- C:\Windows\System\BHNnSsH.exe
  C:\Windows\System\BHNnSsH.exe
  2⤵
  PID:4852
- C:\Windows\System\HnYCqDi.exe
  C:\Windows\System\HnYCqDi.exe
  2⤵
  PID:5264
- C:\Windows\System\pIGMTIf.exe
  C:\Windows\System\pIGMTIf.exe
  2⤵
  PID:5124
- C:\Windows\System\JAkjKYG.exe
  C:\Windows\System\JAkjKYG.exe
  2⤵
  PID:5204
- C:\Windows\System\yqATSMQ.exe
  C:\Windows\System\yqATSMQ.exe
  2⤵
  PID:5356
- C:\Windows\System\GcSntqm.exe
  C:\Windows\System\GcSntqm.exe
  2⤵
  PID:5300
- C:\Windows\System\PeZWwhl.exe
  C:\Windows\System\PeZWwhl.exe
  2⤵
  PID:5256
- C:\Windows\System\vhgoYwq.exe
  C:\Windows\System\vhgoYwq.exe
  2⤵
  PID:5448
- C:\Windows\System\XzVrimj.exe
  C:\Windows\System\XzVrimj.exe
  2⤵
  PID:5596
- C:\Windows\System\SwalRHh.exe
  C:\Windows\System\SwalRHh.exe
  2⤵
  PID:5716
- C:\Windows\System\LSZMiMf.exe
  C:\Windows\System\LSZMiMf.exe
  2⤵
  PID:5844
- C:\Windows\System\GJlrNcZ.exe
  C:\Windows\System\GJlrNcZ.exe
  2⤵
  PID:5880
- C:\Windows\System\WTLjIqQ.exe
  C:\Windows\System\WTLjIqQ.exe
  2⤵
  PID:6044
- C:\Windows\System\ODbzzag.exe
  C:\Windows\System\ODbzzag.exe
  2⤵
  PID:5616
- C:\Windows\System\fXpTejO.exe
  C:\Windows\System\fXpTejO.exe
  2⤵
  PID:5116
- C:\Windows\System\bysEPDI.exe
  C:\Windows\System\bysEPDI.exe
  2⤵
  PID:5152
- C:\Windows\System\PxJtHto.exe
  C:\Windows\System\PxJtHto.exe
  2⤵
  PID:5276
- C:\Windows\System\LZvrFgK.exe
  C:\Windows\System\LZvrFgK.exe
  2⤵
  PID:5292
- C:\Windows\System\wYWgxtO.exe
  C:\Windows\System\wYWgxtO.exe
  2⤵
  PID:5520
- C:\Windows\System\MMehxcx.exe
  C:\Windows\System\MMehxcx.exe
  2⤵
  PID:5808
- C:\Windows\System\YwUqgOz.exe
  C:\Windows\System\YwUqgOz.exe
  2⤵
  PID:5996
- C:\Windows\System\kmyHKba.exe
  C:\Windows\System\kmyHKba.exe
  2⤵
  PID:6096
- C:\Windows\System\LphWvLA.exe
  C:\Windows\System\LphWvLA.exe
  2⤵
  PID:6056
- C:\Windows\System\vczXlGy.exe
  C:\Windows\System\vczXlGy.exe
  2⤵
  PID:5396
- C:\Windows\System\VoExawt.exe
  C:\Windows\System\VoExawt.exe
  2⤵
  PID:5492
- C:\Windows\System\XsBWLtE.exe
  C:\Windows\System\XsBWLtE.exe
  2⤵
  PID:5308
- C:\Windows\System\PUbPssY.exe
  C:\Windows\System\PUbPssY.exe
  2⤵
  PID:5540
- C:\Windows\System\RsCtHfH.exe
  C:\Windows\System\RsCtHfH.exe
  2⤵
  PID:5568
- C:\Windows\System\GslemIB.exe
  C:\Windows\System\GslemIB.exe
  2⤵
  PID:5932
- C:\Windows\System\JIwiVKB.exe
  C:\Windows\System\JIwiVKB.exe
  2⤵
  PID:5436
- C:\Windows\System\VbtEXGv.exe
  C:\Windows\System\VbtEXGv.exe
  2⤵
  PID:5960
- C:\Windows\System\iPMDTGM.exe
  C:\Windows\System\iPMDTGM.exe
  2⤵
  PID:6116
- C:\Windows\System\slvEbOx.exe
  C:\Windows\System\slvEbOx.exe
  2⤵
  PID:5696
- C:\Windows\System\PZhwARW.exe
  C:\Windows\System\PZhwARW.exe
  2⤵
  PID:5896
- C:\Windows\System\vpbqVPN.exe
  C:\Windows\System\vpbqVPN.exe
  2⤵
  PID:5916
- C:\Windows\System\CteCdYo.exe
  C:\Windows\System\CteCdYo.exe
  2⤵
  PID:6040
- C:\Windows\System\BlmLpSw.exe
  C:\Windows\System\BlmLpSw.exe
  2⤵
  PID:4796
- C:\Windows\System\FXgexNC.exe
  C:\Windows\System\FXgexNC.exe
  2⤵
  PID:4972
- C:\Windows\System\SWHDzHD.exe
  C:\Windows\System\SWHDzHD.exe
  2⤵
  PID:5420
- C:\Windows\System\RcJkXeo.exe
  C:\Windows\System\RcJkXeo.exe
  2⤵
  PID:5524
- C:\Windows\System\lMbjMHx.exe
  C:\Windows\System\lMbjMHx.exe
  2⤵
  PID:5640
- C:\Windows\System\BByUEhh.exe
  C:\Windows\System\BByUEhh.exe
  2⤵
  PID:5652
- C:\Windows\System\YWRNRJa.exe
  C:\Windows\System\YWRNRJa.exe
  2⤵
  PID:6020
- C:\Windows\System\kyuWvXO.exe
  C:\Windows\System\kyuWvXO.exe
  2⤵
  PID:5776
- C:\Windows\System\cKAPfOs.exe
  C:\Windows\System\cKAPfOs.exe
  2⤵
  PID:6132
- C:\Windows\System\bIFPtKd.exe
  C:\Windows\System\bIFPtKd.exe
  2⤵
  PID:5288
- C:\Windows\System\yuwfOwc.exe
  C:\Windows\System\yuwfOwc.exe
  2⤵
  PID:6148
- C:\Windows\System\keStxax.exe
  C:\Windows\System\keStxax.exe
  2⤵
  PID:6164
- C:\Windows\System\kPYJmXH.exe
  C:\Windows\System\kPYJmXH.exe
  2⤵
  PID:6180
- C:\Windows\System\cfNlYCm.exe
  C:\Windows\System\cfNlYCm.exe
  2⤵
  PID:6196
- C:\Windows\System\jCeGyez.exe
  C:\Windows\System\jCeGyez.exe
  2⤵
  PID:6212
- C:\Windows\System\RVxgyMT.exe
  C:\Windows\System\RVxgyMT.exe
  2⤵
  PID:6228
- C:\Windows\System\sPxcakh.exe
  C:\Windows\System\sPxcakh.exe
  2⤵
  PID:6248
- C:\Windows\System\OXVaShz.exe
  C:\Windows\System\OXVaShz.exe
  2⤵
  PID:6264
- C:\Windows\System\ZjCdasc.exe
  C:\Windows\System\ZjCdasc.exe
  2⤵
  PID:6304
- C:\Windows\System\jPRIXIU.exe
  C:\Windows\System\jPRIXIU.exe
  2⤵
  PID:6328
- C:\Windows\System\ePcLzMp.exe
  C:\Windows\System\ePcLzMp.exe
  2⤵
  PID:6348
- C:\Windows\System\KTKbnhK.exe
  C:\Windows\System\KTKbnhK.exe
  2⤵
  PID:6364
- C:\Windows\System\grNRTMF.exe
  C:\Windows\System\grNRTMF.exe
  2⤵
  PID:6384
- C:\Windows\System\taakQXa.exe
  C:\Windows\System\taakQXa.exe
  2⤵
  PID:6400
- C:\Windows\System\TgodyBb.exe
  C:\Windows\System\TgodyBb.exe
  2⤵
  PID:6428
- C:\Windows\System\bbxpikh.exe
  C:\Windows\System\bbxpikh.exe
  2⤵
  PID:6452
- C:\Windows\System\rYIGcAD.exe
  C:\Windows\System\rYIGcAD.exe
  2⤵
  PID:6472
- C:\Windows\System\GFYUGcq.exe
  C:\Windows\System\GFYUGcq.exe
  2⤵
  PID:6488
- C:\Windows\System\sIJwmNe.exe
  C:\Windows\System\sIJwmNe.exe
  2⤵
  PID:6504
- C:\Windows\System\ThtRziE.exe
  C:\Windows\System\ThtRziE.exe
  2⤵
  PID:6524
- C:\Windows\System\mQpKHNv.exe
  C:\Windows\System\mQpKHNv.exe
  2⤵
  PID:6552
- C:\Windows\System\pWGCoAn.exe
  C:\Windows\System\pWGCoAn.exe
  2⤵
  PID:6568
- C:\Windows\System\wEsIjWa.exe
  C:\Windows\System\wEsIjWa.exe
  2⤵
  PID:6584
- C:\Windows\System\RFgMhJq.exe
  C:\Windows\System\RFgMhJq.exe
  2⤵
  PID:6600
- C:\Windows\System\tiNeTcq.exe
  C:\Windows\System\tiNeTcq.exe
  2⤵
  PID:6616
- C:\Windows\System\RgxoyZE.exe
  C:\Windows\System\RgxoyZE.exe
  2⤵
  PID:6632
- C:\Windows\System\hSOAyen.exe
  C:\Windows\System\hSOAyen.exe
  2⤵
  PID:6648
- C:\Windows\System\rlpRLyx.exe
  C:\Windows\System\rlpRLyx.exe
  2⤵
  PID:6668
- C:\Windows\System\dHFblPY.exe
  C:\Windows\System\dHFblPY.exe
  2⤵
  PID:6684
- C:\Windows\System\rJuGaVs.exe
  C:\Windows\System\rJuGaVs.exe
  2⤵
  PID:6700
- C:\Windows\System\zHVphKP.exe
  C:\Windows\System\zHVphKP.exe
  2⤵
  PID:6716
- C:\Windows\System\kYcrWJa.exe
  C:\Windows\System\kYcrWJa.exe
  2⤵
  PID:6788
- C:\Windows\System\SupRPrC.exe
  C:\Windows\System\SupRPrC.exe
  2⤵
  PID:6804
- C:\Windows\System\wucjFgQ.exe
  C:\Windows\System\wucjFgQ.exe
  2⤵
  PID:6828
- C:\Windows\System\jjuWKkj.exe
  C:\Windows\System\jjuWKkj.exe
  2⤵
  PID:6844
- C:\Windows\System\uRPbHaO.exe
  C:\Windows\System\uRPbHaO.exe
  2⤵
  PID:6860
- C:\Windows\System\YlhLvIR.exe
  C:\Windows\System\YlhLvIR.exe
  2⤵
  PID:6876
- C:\Windows\System\SEbqIfH.exe
  C:\Windows\System\SEbqIfH.exe
  2⤵
  PID:6896
- C:\Windows\System\CRdJQuk.exe
  C:\Windows\System\CRdJQuk.exe
  2⤵
  PID:6920
- C:\Windows\System\HVMdBtW.exe
  C:\Windows\System\HVMdBtW.exe
  2⤵
  PID:6936
- C:\Windows\System\XPUnPRn.exe
  C:\Windows\System\XPUnPRn.exe
  2⤵
  PID:6952
- C:\Windows\System\gdDDpxO.exe
  C:\Windows\System\gdDDpxO.exe
  2⤵
  PID:6968
- C:\Windows\System\duoHDnC.exe
  C:\Windows\System\duoHDnC.exe
  2⤵
  PID:6988
- C:\Windows\System\dPiSVRg.exe
  C:\Windows\System\dPiSVRg.exe
  2⤵
  PID:7008
- C:\Windows\System\ztJKzwj.exe
  C:\Windows\System\ztJKzwj.exe
  2⤵
  PID:7032
- C:\Windows\System\NLvqocs.exe
  C:\Windows\System\NLvqocs.exe
  2⤵
  PID:7048
- C:\Windows\System\ocxfTDJ.exe
  C:\Windows\System\ocxfTDJ.exe
  2⤵
  PID:7064
- C:\Windows\System\XaYTzDd.exe
  C:\Windows\System\XaYTzDd.exe
  2⤵
  PID:7080
- C:\Windows\System\aUmGkfj.exe
  C:\Windows\System\aUmGkfj.exe
  2⤵
  PID:7100
- C:\Windows\System\HutgECo.exe
  C:\Windows\System\HutgECo.exe
  2⤵
  PID:7116
- C:\Windows\System\besjAAS.exe
  C:\Windows\System\besjAAS.exe
  2⤵
  PID:7136
- C:\Windows\System\xlBLczQ.exe
  C:\Windows\System\xlBLczQ.exe
  2⤵
  PID:7156
- C:\Windows\System\hKXcwGA.exe
  C:\Windows\System\hKXcwGA.exe
  2⤵
  PID:5564
- C:\Windows\System\AVXOOyd.exe
  C:\Windows\System\AVXOOyd.exe
  2⤵
  PID:6192
- C:\Windows\System\rSuxqgH.exe
  C:\Windows\System\rSuxqgH.exe
  2⤵
  PID:5856
- C:\Windows\System\LHawVsi.exe
  C:\Windows\System\LHawVsi.exe
  2⤵
  PID:6236
- C:\Windows\System\ekabldY.exe
  C:\Windows\System\ekabldY.exe
  2⤵
  PID:6280
- C:\Windows\System\sZrzndN.exe
  C:\Windows\System\sZrzndN.exe
  2⤵
  PID:6324
- C:\Windows\System\FFvBACt.exe
  C:\Windows\System\FFvBACt.exe
  2⤵
  PID:6356
- C:\Windows\System\OzTOTNH.exe
  C:\Windows\System\OzTOTNH.exe
  2⤵
  PID:6444
- C:\Windows\System\MqcuDDs.exe
  C:\Windows\System\MqcuDDs.exe
  2⤵
  PID:6520
- C:\Windows\System\lSwzdqf.exe
  C:\Windows\System\lSwzdqf.exe
  2⤵
  PID:6344
- C:\Windows\System\KnMhtEG.exe
  C:\Windows\System\KnMhtEG.exe
  2⤵
  PID:6468
- C:\Windows\System\KvTqnzS.exe
  C:\Windows\System\KvTqnzS.exe
  2⤵
  PID:6536
- C:\Windows\System\xJAMNNN.exe
  C:\Windows\System\xJAMNNN.exe
  2⤵
  PID:6376
- C:\Windows\System\zdlCvcC.exe
  C:\Windows\System\zdlCvcC.exe
  2⤵
  PID:6628
- C:\Windows\System\YhGUHff.exe
  C:\Windows\System\YhGUHff.exe
  2⤵
  PID:6728
- C:\Windows\System\sVnFtPp.exe
  C:\Windows\System\sVnFtPp.exe
  2⤵
  PID:6744
- C:\Windows\System\QVKQCns.exe
  C:\Windows\System\QVKQCns.exe
  2⤵
  PID:6760
- C:\Windows\System\xictgdB.exe
  C:\Windows\System\xictgdB.exe
  2⤵
  PID:6776
- C:\Windows\System\yOScSxn.exe
  C:\Windows\System\yOScSxn.exe
  2⤵
  PID:6612
- C:\Windows\System\oJcBxTq.exe
  C:\Windows\System\oJcBxTq.exe
  2⤵
  PID:6664
- C:\Windows\System\jHzulcF.exe
  C:\Windows\System\jHzulcF.exe
  2⤵
  PID:6796
- C:\Windows\System\OhTgBIb.exe
  C:\Windows\System\OhTgBIb.exe
  2⤵
  PID:6820
- C:\Windows\System\QOTdMRV.exe
  C:\Windows\System\QOTdMRV.exe
  2⤵
  PID:6884
- C:\Windows\System\Dinkeag.exe
  C:\Windows\System\Dinkeag.exe
  2⤵
  PID:7004
- C:\Windows\System\TvTRXvk.exe
  C:\Windows\System\TvTRXvk.exe
  2⤵
  PID:7072
- C:\Windows\System\REbPDVV.exe
  C:\Windows\System\REbPDVV.exe
  2⤵
  PID:7144
- C:\Windows\System\OcBdxbB.exe
  C:\Windows\System\OcBdxbB.exe
  2⤵
  PID:7016
- C:\Windows\System\hWvRZjj.exe
  C:\Windows\System\hWvRZjj.exe
  2⤵
  PID:6908
- C:\Windows\System\MQVenyB.exe
  C:\Windows\System\MQVenyB.exe
  2⤵
  PID:7092
- C:\Windows\System\SnUTbgW.exe
  C:\Windows\System\SnUTbgW.exe
  2⤵
  PID:7132
- C:\Windows\System\jRzSxMd.exe
  C:\Windows\System\jRzSxMd.exe
  2⤵
  PID:6836
- C:\Windows\System\PzbcWnq.exe
  C:\Windows\System\PzbcWnq.exe
  2⤵
  PID:6100
- C:\Windows\System\caaTvGV.exe
  C:\Windows\System\caaTvGV.exe
  2⤵
  PID:6156
- C:\Windows\System\tICGgSD.exe
  C:\Windows\System\tICGgSD.exe
  2⤵
  PID:6188
- C:\Windows\System\dRczoHO.exe
  C:\Windows\System\dRczoHO.exe
  2⤵
  PID:6288
- C:\Windows\System\nEpOBvL.exe
  C:\Windows\System\nEpOBvL.exe
  2⤵
  PID:6260
- C:\Windows\System\PlrqhJv.exe
  C:\Windows\System\PlrqhJv.exe
  2⤵
  PID:6336
- C:\Windows\System\JaRmohH.exe
  C:\Windows\System\JaRmohH.exe
  2⤵
  PID:6512
- C:\Windows\System\nRBSJgi.exe
  C:\Windows\System\nRBSJgi.exe
  2⤵
  PID:6560
- C:\Windows\System\jWWxQLx.exe
  C:\Windows\System\jWWxQLx.exe
  2⤵
  PID:6624
- C:\Windows\System\QCoNPkS.exe
  C:\Windows\System\QCoNPkS.exe
  2⤵
  PID:6740
- C:\Windows\System\MoshYJe.exe
  C:\Windows\System\MoshYJe.exe
  2⤵
  PID:6640
- C:\Windows\System\dVHSFyw.exe
  C:\Windows\System\dVHSFyw.exe
  2⤵
  PID:6892
- C:\Windows\System\YnLuiwF.exe
  C:\Windows\System\YnLuiwF.exe
  2⤵
  PID:6996
- C:\Windows\System\CuqzLAN.exe
  C:\Windows\System\CuqzLAN.exe
  2⤵
  PID:6660
- C:\Windows\System\LELWDdy.exe
  C:\Windows\System\LELWDdy.exe
  2⤵
  PID:7044
- C:\Windows\System\jZcQAIV.exe
  C:\Windows\System\jZcQAIV.exe
  2⤵
  PID:6712
- C:\Windows\System\oJUXOxc.exe
  C:\Windows\System\oJUXOxc.exe
  2⤵
  PID:6708
- C:\Windows\System\qRaRajx.exe
  C:\Windows\System\qRaRajx.exe
  2⤵
  PID:7040
- C:\Windows\System\cwQzdLw.exe
  C:\Windows\System\cwQzdLw.exe
  2⤵
  PID:7124
- C:\Windows\System\XPRuZHn.exe
  C:\Windows\System\XPRuZHn.exe
  2⤵
  PID:6916
- C:\Windows\System\tKyqMLW.exe
  C:\Windows\System\tKyqMLW.exe
  2⤵
  PID:6160
- C:\Windows\System\PUoNBJk.exe
  C:\Windows\System\PUoNBJk.exe
  2⤵
  PID:6172
- C:\Windows\System\okvaVLk.exe
  C:\Windows\System\okvaVLk.exe
  2⤵
  PID:6440
- C:\Windows\System\pGNyOby.exe
  C:\Windows\System\pGNyOby.exe
  2⤵
  PID:6272
- C:\Windows\System\etdmeTX.exe
  C:\Windows\System\etdmeTX.exe
  2⤵
  PID:6532
- C:\Windows\System\tpfvfiC.exe
  C:\Windows\System\tpfvfiC.exe
  2⤵
  PID:6372
- C:\Windows\System\lpcLcPs.exe
  C:\Windows\System\lpcLcPs.exe
  2⤵
  PID:6724
- C:\Windows\System\wdMrTLO.exe
  C:\Windows\System\wdMrTLO.exe
  2⤵
  PID:6692
- C:\Windows\System\SrYbxoO.exe
  C:\Windows\System\SrYbxoO.exe
  2⤵
  PID:6816
- C:\Windows\System\eQFhwuS.exe
  C:\Windows\System\eQFhwuS.exe
  2⤵
  PID:6948
- C:\Windows\System\DSQcxmA.exe
  C:\Windows\System\DSQcxmA.exe
  2⤵
  PID:6608
- C:\Windows\System\iDKzrYm.exe
  C:\Windows\System\iDKzrYm.exe
  2⤵
  PID:6680
- C:\Windows\System\wBCTKLN.exe
  C:\Windows\System\wBCTKLN.exe
  2⤵
  PID:7060
- C:\Windows\System\AVqMWFB.exe
  C:\Windows\System\AVqMWFB.exe
  2⤵
  PID:6208
- C:\Windows\System\bMRWOqJ.exe
  C:\Windows\System\bMRWOqJ.exe
  2⤵
  PID:6960
- C:\Windows\System\KNNCAZn.exe
  C:\Windows\System\KNNCAZn.exe
  2⤵
  PID:7172
- C:\Windows\System\gwHcpiT.exe
  C:\Windows\System\gwHcpiT.exe
  2⤵
  PID:7192
- C:\Windows\System\PxisCdI.exe
  C:\Windows\System\PxisCdI.exe
  2⤵
  PID:7236
- C:\Windows\System\xDtpDzD.exe
  C:\Windows\System\xDtpDzD.exe
  2⤵
  PID:7252
- C:\Windows\System\SaoveuD.exe
  C:\Windows\System\SaoveuD.exe
  2⤵
  PID:7268
- C:\Windows\System\GYAsRyr.exe
  C:\Windows\System\GYAsRyr.exe
  2⤵
  PID:7288
- C:\Windows\System\TkvYqMa.exe
  C:\Windows\System\TkvYqMa.exe
  2⤵
  PID:7336
- C:\Windows\System\uBHxMWm.exe
  C:\Windows\System\uBHxMWm.exe
  2⤵
  PID:7360
- C:\Windows\System\FiTRgGB.exe
  C:\Windows\System\FiTRgGB.exe
  2⤵
  PID:7380
- C:\Windows\System\jCtwJMv.exe
  C:\Windows\System\jCtwJMv.exe
  2⤵
  PID:7400
- C:\Windows\System\cJSoiXO.exe
  C:\Windows\System\cJSoiXO.exe
  2⤵
  PID:7420
- C:\Windows\System\hBQWpBg.exe
  C:\Windows\System\hBQWpBg.exe
  2⤵
  PID:7440
- C:\Windows\System\IvtxuAH.exe
  C:\Windows\System\IvtxuAH.exe
  2⤵
  PID:7460
- C:\Windows\System\seOlgRv.exe
  C:\Windows\System\seOlgRv.exe
  2⤵
  PID:7484
- C:\Windows\System\nFNxufT.exe
  C:\Windows\System\nFNxufT.exe
  2⤵
  PID:7504
- C:\Windows\System\uYQPEkx.exe
  C:\Windows\System\uYQPEkx.exe
  2⤵
  PID:7520
- C:\Windows\System\qYSOfZS.exe
  C:\Windows\System\qYSOfZS.exe
  2⤵
  PID:7540
- C:\Windows\System\lohfAgD.exe
  C:\Windows\System\lohfAgD.exe
  2⤵
  PID:7556
- C:\Windows\System\BKWAmqy.exe
  C:\Windows\System\BKWAmqy.exe
  2⤵
  PID:7576
- C:\Windows\System\DREiwpU.exe
  C:\Windows\System\DREiwpU.exe
  2⤵
  PID:7596
- C:\Windows\System\qJeYywc.exe
  C:\Windows\System\qJeYywc.exe
  2⤵
  PID:7624
- C:\Windows\System\BYqrskk.exe
  C:\Windows\System\BYqrskk.exe
  2⤵
  PID:7640
- C:\Windows\System\IKEsylA.exe
  C:\Windows\System\IKEsylA.exe
  2⤵
  PID:7656
- C:\Windows\System\NqmXEpi.exe
  C:\Windows\System\NqmXEpi.exe
  2⤵
  PID:7676
- C:\Windows\System\HyWgrIk.exe
  C:\Windows\System\HyWgrIk.exe
  2⤵
  PID:7696
- C:\Windows\System\mfYEtGj.exe
  C:\Windows\System\mfYEtGj.exe
  2⤵
  PID:7712
- C:\Windows\System\gAYDDSd.exe
  C:\Windows\System\gAYDDSd.exe
  2⤵
  PID:7740
- C:\Windows\System\ByfMbcX.exe
  C:\Windows\System\ByfMbcX.exe
  2⤵
  PID:7760
- C:\Windows\System\GdtoFZq.exe
  C:\Windows\System\GdtoFZq.exe
  2⤵
  PID:7784
- C:\Windows\System\LdDvQum.exe
  C:\Windows\System\LdDvQum.exe
  2⤵
  PID:7804
- C:\Windows\System\RqPnYOk.exe
  C:\Windows\System\RqPnYOk.exe
  2⤵
  PID:7824
- C:\Windows\System\VxunjBO.exe
  C:\Windows\System\VxunjBO.exe
  2⤵
  PID:7840
- C:\Windows\System\IeCZOUC.exe
  C:\Windows\System\IeCZOUC.exe
  2⤵
  PID:7860
- C:\Windows\System\KUmEtip.exe
  C:\Windows\System\KUmEtip.exe
  2⤵
  PID:7876
- C:\Windows\System\FQhYwQe.exe
  C:\Windows\System\FQhYwQe.exe
  2⤵
  PID:7896
- C:\Windows\System\EVsHGFw.exe
  C:\Windows\System\EVsHGFw.exe
  2⤵
  PID:7912
- C:\Windows\System\ZEZoyTY.exe
  C:\Windows\System\ZEZoyTY.exe
  2⤵
  PID:7928
- C:\Windows\System\sjYdLBX.exe
  C:\Windows\System\sjYdLBX.exe
  2⤵
  PID:7948
- C:\Windows\System\qjZVCCN.exe
  C:\Windows\System\qjZVCCN.exe
  2⤵
  PID:7968
- C:\Windows\System\ZzopleM.exe
  C:\Windows\System\ZzopleM.exe
  2⤵
  PID:7988
- C:\Windows\System\WhzqGFx.exe
  C:\Windows\System\WhzqGFx.exe
  2⤵
  PID:8008
- C:\Windows\System\WwiMajF.exe
  C:\Windows\System\WwiMajF.exe
  2⤵
  PID:8024
- C:\Windows\System\xlEKOgD.exe
  C:\Windows\System\xlEKOgD.exe
  2⤵
  PID:8040
- C:\Windows\System\YQADweA.exe
  C:\Windows\System\YQADweA.exe
  2⤵
  PID:8064
- C:\Windows\System\LWcOwqK.exe
  C:\Windows\System\LWcOwqK.exe
  2⤵
  PID:8080
- C:\Windows\System\qlOgcGd.exe
  C:\Windows\System\qlOgcGd.exe
  2⤵
  PID:8096
- C:\Windows\System\uuuRshy.exe
  C:\Windows\System\uuuRshy.exe
  2⤵
  PID:8120
- C:\Windows\System\KTnpsEc.exe
  C:\Windows\System\KTnpsEc.exe
  2⤵
  PID:8140
- C:\Windows\System\LzsiBHq.exe
  C:\Windows\System\LzsiBHq.exe
  2⤵
  PID:8156
- C:\Windows\System\pgIhHAD.exe
  C:\Windows\System\pgIhHAD.exe
  2⤵
  PID:5788
- C:\Windows\System\TJJINuo.exe
  C:\Windows\System\TJJINuo.exe
  2⤵
  PID:5488
- C:\Windows\System\GEWXJRD.exe
  C:\Windows\System\GEWXJRD.exe
  2⤵
  PID:6464
- C:\Windows\System\qXfpzEp.exe
  C:\Windows\System\qXfpzEp.exe
  2⤵
  PID:6276
- C:\Windows\System\wSAvkal.exe
  C:\Windows\System\wSAvkal.exe
  2⤵
  PID:7152
- C:\Windows\System\dKLTGZG.exe
  C:\Windows\System\dKLTGZG.exe
  2⤵
  PID:7212
- C:\Windows\System\SHfWWrj.exe
  C:\Windows\System\SHfWWrj.exe
  2⤵
  PID:7188
- C:\Windows\System\aojhMCE.exe
  C:\Windows\System\aojhMCE.exe
  2⤵
  PID:6436
- C:\Windows\System\cdzRHFI.exe
  C:\Windows\System\cdzRHFI.exe
  2⤵
  PID:7232
- C:\Windows\System\iwAkxqc.exe
  C:\Windows\System\iwAkxqc.exe
  2⤵
  PID:7304
- C:\Windows\System\IsXmqGa.exe
  C:\Windows\System\IsXmqGa.exe
  2⤵
  PID:7324
- C:\Windows\System\NvJItOV.exe
  C:\Windows\System\NvJItOV.exe
  2⤵
  PID:7356
- C:\Windows\System\iEMTDAp.exe
  C:\Windows\System\iEMTDAp.exe
  2⤵
  PID:7396
- C:\Windows\System\CNwzVve.exe
  C:\Windows\System\CNwzVve.exe
  2⤵
  PID:7468
- C:\Windows\System\xjIPXYL.exe
  C:\Windows\System\xjIPXYL.exe
  2⤵
  PID:7408
- C:\Windows\System\UNndxaD.exe
  C:\Windows\System\UNndxaD.exe
  2⤵
  PID:7452
- C:\Windows\System\aTGHVka.exe
  C:\Windows\System\aTGHVka.exe
  2⤵
  PID:7552
- C:\Windows\System\LiAmICX.exe
  C:\Windows\System\LiAmICX.exe
  2⤵
  PID:7500
- C:\Windows\System\BjyhftS.exe
  C:\Windows\System\BjyhftS.exe
  2⤵
  PID:7568
- C:\Windows\System\SLvVJEN.exe
  C:\Windows\System\SLvVJEN.exe
  2⤵
  PID:7612
- C:\Windows\System\fwnTxlH.exe
  C:\Windows\System\fwnTxlH.exe
  2⤵
  PID:7692
- C:\Windows\System\YbEelRq.exe
  C:\Windows\System\YbEelRq.exe
  2⤵
  PID:7704
- C:\Windows\System\jgzHSwh.exe
  C:\Windows\System\jgzHSwh.exe
  2⤵
  PID:7724
- C:\Windows\System\bmloXjZ.exe
  C:\Windows\System\bmloXjZ.exe
  2⤵
  PID:7768
- C:\Windows\System\yQxpnJe.exe
  C:\Windows\System\yQxpnJe.exe
  2⤵
  PID:7792
- C:\Windows\System\cPIOZXa.exe
  C:\Windows\System\cPIOZXa.exe
  2⤵
  PID:7812
- C:\Windows\System\toFsHlv.exe
  C:\Windows\System\toFsHlv.exe
  2⤵
  PID:7936
- C:\Windows\System\QodxSHK.exe
  C:\Windows\System\QodxSHK.exe
  2⤵
  PID:7976
- C:\Windows\System\REHvQBw.exe
  C:\Windows\System\REHvQBw.exe
  2⤵
  PID:8016
- C:\Windows\System\QznBjju.exe
  C:\Windows\System\QznBjju.exe
  2⤵
  PID:8056
- C:\Windows\System\mFGlSwN.exe
  C:\Windows\System\mFGlSwN.exe
  2⤵
  PID:7920
- C:\Windows\System\BycHnli.exe
  C:\Windows\System\BycHnli.exe
  2⤵
  PID:8132
- C:\Windows\System\FxCrHVN.exe
  C:\Windows\System\FxCrHVN.exe
  2⤵
  PID:8180
- C:\Windows\System\jMxrtmu.exe
  C:\Windows\System\jMxrtmu.exe
  2⤵
  PID:8116
- C:\Windows\System\OCdXCUJ.exe
  C:\Windows\System\OCdXCUJ.exe
  2⤵
  PID:8004
- C:\Windows\System\Azboisv.exe
  C:\Windows\System\Azboisv.exe
  2⤵
  PID:7852
- C:\Windows\System\fdayThc.exe
  C:\Windows\System\fdayThc.exe
  2⤵
  PID:7996
- C:\Windows\System\nRERaQJ.exe
  C:\Windows\System\nRERaQJ.exe
  2⤵
  PID:8112
- C:\Windows\System\KQlPvGn.exe
  C:\Windows\System\KQlPvGn.exe
  2⤵
  PID:6912
- C:\Windows\System\vqmJCVh.exe
  C:\Windows\System\vqmJCVh.exe
  2⤵
  PID:6812
- C:\Windows\System\cmMadNr.exe
  C:\Windows\System\cmMadNr.exe
  2⤵
  PID:7200
- C:\Windows\System\hEcFmLd.exe
  C:\Windows\System\hEcFmLd.exe
  2⤵
  PID:7248
- C:\Windows\System\dmZYNQt.exe
  C:\Windows\System\dmZYNQt.exe
  2⤵
  PID:7312
- C:\Windows\System\hZNnnjn.exe
  C:\Windows\System\hZNnnjn.exe
  2⤵
  PID:7260
- C:\Windows\System\QiooPme.exe
  C:\Windows\System\QiooPme.exe
  2⤵
  PID:7476
- C:\Windows\System\rHvRUCo.exe
  C:\Windows\System\rHvRUCo.exe
  2⤵
  PID:7516
- C:\Windows\System\uiMwXVk.exe
  C:\Windows\System\uiMwXVk.exe
  2⤵
  PID:7456
- C:\Windows\System\QJMuThr.exe
  C:\Windows\System\QJMuThr.exe
  2⤵
  PID:7604
- C:\Windows\System\AdxQRfU.exe
  C:\Windows\System\AdxQRfU.exe
  2⤵
  PID:7684
- C:\Windows\System\neJGOot.exe
  C:\Windows\System\neJGOot.exe
  2⤵
  PID:7720
- C:\Windows\System\YGSONJp.exe
  C:\Windows\System\YGSONJp.exe
  2⤵
  PID:7664
- C:\Windows\System\QWajBLB.exe
  C:\Windows\System\QWajBLB.exe
  2⤵
  PID:7184
- C:\Windows\System\MIniwwM.exe
  C:\Windows\System\MIniwwM.exe
  2⤵
  PID:7736
- C:\Windows\System\ZxSoBzZ.exe
  C:\Windows\System\ZxSoBzZ.exe
  2⤵
  PID:7984
- C:\Windows\System\Tuherpg.exe
  C:\Windows\System\Tuherpg.exe
  2⤵
  PID:8172
- C:\Windows\System\FCHILEM.exe
  C:\Windows\System\FCHILEM.exe
  2⤵
  PID:8052
- C:\Windows\System\uKNUGyO.exe
  C:\Windows\System\uKNUGyO.exe
  2⤵
  PID:7884
- C:\Windows\System\pgzyGUJ.exe
  C:\Windows\System\pgzyGUJ.exe
  2⤵
  PID:7076
- C:\Windows\System\nJhGTaP.exe
  C:\Windows\System\nJhGTaP.exe
  2⤵
  PID:6204
- C:\Windows\System\XLJKmaP.exe
  C:\Windows\System\XLJKmaP.exe
  2⤵
  PID:8188
- C:\Windows\System\QQhyIJq.exe
  C:\Windows\System\QQhyIJq.exe
  2⤵
  PID:7208
- C:\Windows\System\ZYGkPfQ.exe
  C:\Windows\System\ZYGkPfQ.exe
  2⤵
  PID:7296
- C:\Windows\System\tCDnJPL.exe
  C:\Windows\System\tCDnJPL.exe
  2⤵
  PID:7416
- C:\Windows\System\sBasyaP.exe
  C:\Windows\System\sBasyaP.exe
  2⤵
  PID:6872
- C:\Windows\System\zssSaMV.exe
  C:\Windows\System\zssSaMV.exe
  2⤵
  PID:7332
- C:\Windows\System\klHHYYo.exe
  C:\Windows\System\klHHYYo.exe
  2⤵
  PID:7496
- C:\Windows\System\yqJACrG.exe
  C:\Windows\System\yqJACrG.exe
  2⤵
  PID:7616
- C:\Windows\System\qnChXfr.exe
  C:\Windows\System\qnChXfr.exe
  2⤵
  PID:7732
- C:\Windows\System\tMQYJvm.exe
  C:\Windows\System\tMQYJvm.exe
  2⤵
  PID:8000
- C:\Windows\System\HoHKaLM.exe
  C:\Windows\System\HoHKaLM.exe
  2⤵
  PID:7748
- C:\Windows\System\qZrUKlt.exe
  C:\Windows\System\qZrUKlt.exe
  2⤵
  PID:5876
- C:\Windows\System\WhkydFz.exe
  C:\Windows\System\WhkydFz.exe
  2⤵
  PID:7836
- C:\Windows\System\voJClGU.exe
  C:\Windows\System\voJClGU.exe
  2⤵
  PID:7848
- C:\Windows\System\HsFQtQR.exe
  C:\Windows\System\HsFQtQR.exe
  2⤵
  PID:6564
- C:\Windows\System\EslUDFt.exe
  C:\Windows\System\EslUDFt.exe
  2⤵
  PID:7532
- C:\Windows\System\NvZFYBr.exe
  C:\Windows\System\NvZFYBr.exe
  2⤵
  PID:6256
- C:\Windows\System\cPXjxXh.exe
  C:\Windows\System\cPXjxXh.exe
  2⤵
  PID:7536
- C:\Windows\System\eDCVXAZ.exe
  C:\Windows\System\eDCVXAZ.exe
  2⤵
  PID:7780
- C:\Windows\System\IWtNPwZ.exe
  C:\Windows\System\IWtNPwZ.exe
  2⤵
  PID:7816
- C:\Windows\System\cjcPTSZ.exe
  C:\Windows\System\cjcPTSZ.exe
  2⤵
  PID:8048
- C:\Windows\System\zHSsNuO.exe
  C:\Windows\System\zHSsNuO.exe
  2⤵
  PID:6932
- C:\Windows\System\TOKkdxh.exe
  C:\Windows\System\TOKkdxh.exe
  2⤵
  PID:7320
- C:\Windows\System\eZOXXaK.exe
  C:\Windows\System\eZOXXaK.exe
  2⤵
  PID:8092
- C:\Windows\System\mXqcrIG.exe
  C:\Windows\System\mXqcrIG.exe
  2⤵
  PID:7800
- C:\Windows\System\ENGjLWe.exe
  C:\Windows\System\ENGjLWe.exe
  2⤵
  PID:8200
- C:\Windows\System\zkUizej.exe
  C:\Windows\System\zkUizej.exe
  2⤵
  PID:8220
- C:\Windows\System\QWIGtzX.exe
  C:\Windows\System\QWIGtzX.exe
  2⤵
  PID:8236
- C:\Windows\System\PoGlOzO.exe
  C:\Windows\System\PoGlOzO.exe
  2⤵
  PID:8280
- C:\Windows\System\jGFlBxB.exe
  C:\Windows\System\jGFlBxB.exe
  2⤵
  PID:8300
- C:\Windows\System\DCkIPkt.exe
  C:\Windows\System\DCkIPkt.exe
  2⤵
  PID:8316
- C:\Windows\System\oAuBZBD.exe
  C:\Windows\System\oAuBZBD.exe
  2⤵
  PID:8332
- C:\Windows\System\sYTrBoM.exe
  C:\Windows\System\sYTrBoM.exe
  2⤵
  PID:8348
- C:\Windows\System\xtUsPSA.exe
  C:\Windows\System\xtUsPSA.exe
  2⤵
  PID:8364
- C:\Windows\System\kigvbzn.exe
  C:\Windows\System\kigvbzn.exe
  2⤵
  PID:8380
- C:\Windows\System\nCooSqH.exe
  C:\Windows\System\nCooSqH.exe
  2⤵
  PID:8404
- C:\Windows\System\ZTOjkEg.exe
  C:\Windows\System\ZTOjkEg.exe
  2⤵
  PID:8452
- C:\Windows\System\SQeKPqk.exe
  C:\Windows\System\SQeKPqk.exe
  2⤵
  PID:8468
- C:\Windows\System\BfCySoZ.exe
  C:\Windows\System\BfCySoZ.exe
  2⤵
  PID:8484
- C:\Windows\System\XhFyAAD.exe
  C:\Windows\System\XhFyAAD.exe
  2⤵
  PID:8512
- C:\Windows\System\zVgNZGV.exe
  C:\Windows\System\zVgNZGV.exe
  2⤵
  PID:8528
- C:\Windows\System\AGPlNnz.exe
  C:\Windows\System\AGPlNnz.exe
  2⤵
  PID:8544
- C:\Windows\System\FvHxCdr.exe
  C:\Windows\System\FvHxCdr.exe
  2⤵
  PID:8564
- C:\Windows\System\yNxhcxH.exe
  C:\Windows\System\yNxhcxH.exe
  2⤵
  PID:8588
- C:\Windows\System\wMxqleH.exe
  C:\Windows\System\wMxqleH.exe
  2⤵
  PID:8604
- C:\Windows\System\JmweVnh.exe
  C:\Windows\System\JmweVnh.exe
  2⤵
  PID:8620
- C:\Windows\System\xgxTbic.exe
  C:\Windows\System\xgxTbic.exe
  2⤵
  PID:8648
- C:\Windows\System\YluCyLY.exe
  C:\Windows\System\YluCyLY.exe
  2⤵
  PID:8664
- C:\Windows\System\MBxXcLL.exe
  C:\Windows\System\MBxXcLL.exe
  2⤵
  PID:8680
- C:\Windows\System\YvuJtcB.exe
  C:\Windows\System\YvuJtcB.exe
  2⤵
  PID:8696
- C:\Windows\System\IClKBux.exe
  C:\Windows\System\IClKBux.exe
  2⤵
  PID:8712
- C:\Windows\System\zrTWmsG.exe
  C:\Windows\System\zrTWmsG.exe
  2⤵
  PID:8728
- C:\Windows\System\zmBxZtu.exe
  C:\Windows\System\zmBxZtu.exe
  2⤵
  PID:8748
- C:\Windows\System\XxEHCFE.exe
  C:\Windows\System\XxEHCFE.exe
  2⤵
  PID:8792
- C:\Windows\System\qluseqD.exe
  C:\Windows\System\qluseqD.exe
  2⤵
  PID:8808
- C:\Windows\System\jcgAbQM.exe
  C:\Windows\System\jcgAbQM.exe
  2⤵
  PID:8836
- C:\Windows\System\aUASOWi.exe
  C:\Windows\System\aUASOWi.exe
  2⤵
  PID:8852
- C:\Windows\System\lAoorqp.exe
  C:\Windows\System\lAoorqp.exe
  2⤵
  PID:8868
- C:\Windows\System\TNKxcsn.exe
  C:\Windows\System\TNKxcsn.exe
  2⤵
  PID:8888
- C:\Windows\System\kUercJs.exe
  C:\Windows\System\kUercJs.exe
  2⤵
  PID:8912
- C:\Windows\System\WpiNkmQ.exe
  C:\Windows\System\WpiNkmQ.exe
  2⤵
  PID:8932
- C:\Windows\System\oOqPikw.exe
  C:\Windows\System\oOqPikw.exe
  2⤵
  PID:8960
- C:\Windows\System\sqofcbV.exe
  C:\Windows\System\sqofcbV.exe
  2⤵
  PID:8980
- C:\Windows\System\AMOkxGQ.exe
  C:\Windows\System\AMOkxGQ.exe
  2⤵
  PID:8996
- C:\Windows\System\vovRuPi.exe
  C:\Windows\System\vovRuPi.exe
  2⤵
  PID:9020
- C:\Windows\System\jThACZW.exe
  C:\Windows\System\jThACZW.exe
  2⤵
  PID:9036
- C:\Windows\System\pxUehsr.exe
  C:\Windows\System\pxUehsr.exe
  2⤵
  PID:9052
- C:\Windows\System\YgsWost.exe
  C:\Windows\System\YgsWost.exe
  2⤵
  PID:9068
- C:\Windows\System\jMUtONp.exe
  C:\Windows\System\jMUtONp.exe
  2⤵
  PID:9104
- C:\Windows\System\IGrzeFx.exe
  C:\Windows\System\IGrzeFx.exe
  2⤵
  PID:9120
- C:\Windows\System\kRCiQtO.exe
  C:\Windows\System\kRCiQtO.exe
  2⤵
  PID:9136
- C:\Windows\System\ZqmWWAP.exe
  C:\Windows\System\ZqmWWAP.exe
  2⤵
  PID:9152
- C:\Windows\System\zzGecgk.exe
  C:\Windows\System\zzGecgk.exe
  2⤵
  PID:9168
- C:\Windows\System\PxGWfGu.exe
  C:\Windows\System\PxGWfGu.exe
  2⤵
  PID:9196
- C:\Windows\System\ENSvSQf.exe
  C:\Windows\System\ENSvSQf.exe
  2⤵
  PID:8152
- C:\Windows\System\WOUMltr.exe
  C:\Windows\System\WOUMltr.exe
  2⤵
  PID:8232
- C:\Windows\System\cbllubT.exe
  C:\Windows\System\cbllubT.exe
  2⤵
  PID:8208
- C:\Windows\System\thWtPWs.exe
  C:\Windows\System\thWtPWs.exe
  2⤵
  PID:8216
- C:\Windows\System\InyJTsR.exe
  C:\Windows\System\InyJTsR.exe
  2⤵
  PID:7592
- C:\Windows\System\qFyjccI.exe
  C:\Windows\System\qFyjccI.exe
  2⤵
  PID:8268
- C:\Windows\System\wqWryux.exe
  C:\Windows\System\wqWryux.exe
  2⤵
  PID:7112
- C:\Windows\System\burlmEn.exe
  C:\Windows\System\burlmEn.exe
  2⤵
  PID:8412
- C:\Windows\System\gfGJCCs.exe
  C:\Windows\System\gfGJCCs.exe
  2⤵
  PID:8312
- C:\Windows\System\bUSzVFO.exe
  C:\Windows\System\bUSzVFO.exe
  2⤵
  PID:8264
- C:\Windows\System\iLhIZeF.exe
  C:\Windows\System\iLhIZeF.exe
  2⤵
  PID:8424
- C:\Windows\System\uJYUOvH.exe
  C:\Windows\System\uJYUOvH.exe
  2⤵
  PID:8440
- C:\Windows\System\cSKTwyX.exe
  C:\Windows\System\cSKTwyX.exe
  2⤵
  PID:8476
- C:\Windows\System\mYRVsjI.exe
  C:\Windows\System\mYRVsjI.exe
  2⤵
  PID:8504
- C:\Windows\System\DiTwDJO.exe
  C:\Windows\System\DiTwDJO.exe
  2⤵
  PID:8536
- C:\Windows\System\QVnzLsQ.exe
  C:\Windows\System\QVnzLsQ.exe
  2⤵
  PID:8612
- C:\Windows\System\gnEJivN.exe
  C:\Windows\System\gnEJivN.exe
  2⤵
  PID:8640
- C:\Windows\System\OUrhfth.exe
  C:\Windows\System\OUrhfth.exe
  2⤵
  PID:8632
- C:\Windows\System\NYTORoV.exe
  C:\Windows\System\NYTORoV.exe
  2⤵
  PID:8688
- C:\Windows\System\evYrbZK.exe
  C:\Windows\System\evYrbZK.exe
  2⤵
  PID:8756
- C:\Windows\System\nEJmuDr.exe
  C:\Windows\System\nEJmuDr.exe
  2⤵
  PID:8676
- C:\Windows\System\wxRcbRI.exe
  C:\Windows\System\wxRcbRI.exe
  2⤵
  PID:8772
- C:\Windows\System\xxRdfuJ.exe
  C:\Windows\System\xxRdfuJ.exe
  2⤵
  PID:3032
- C:\Windows\System\ydHDhBL.exe
  C:\Windows\System\ydHDhBL.exe
  2⤵
  PID:8816
- C:\Windows\System\dgkUIaJ.exe
  C:\Windows\System\dgkUIaJ.exe
  2⤵
  PID:8844
- C:\Windows\System\ESILYVd.exe
  C:\Windows\System\ESILYVd.exe
  2⤵
  PID:8896
- C:\Windows\System\fZDFdjq.exe
  C:\Windows\System\fZDFdjq.exe
  2⤵
  PID:8904
- C:\Windows\System\Ndhkyqk.exe
  C:\Windows\System\Ndhkyqk.exe
  2⤵
  PID:8940
- C:\Windows\System\wVkyCvD.exe
  C:\Windows\System\wVkyCvD.exe
  2⤵
  PID:8972
- C:\Windows\System\rmQQXDH.exe
  C:\Windows\System\rmQQXDH.exe
  2⤵
  PID:9028
- C:\Windows\System\ePbFpFh.exe
  C:\Windows\System\ePbFpFh.exe
  2⤵
  PID:9064
- C:\Windows\System\CnNKoiJ.exe
  C:\Windows\System\CnNKoiJ.exe
  2⤵
  PID:9088
- C:\Windows\System\gSibyLj.exe
  C:\Windows\System\gSibyLj.exe
  2⤵
  PID:9128
- C:\Windows\System\jKfCMmG.exe
  C:\Windows\System\jKfCMmG.exe
  2⤵
  PID:9176
- C:\Windows\System\nzYgQyJ.exe
  C:\Windows\System\nzYgQyJ.exe
  2⤵
  PID:9208
- C:\Windows\System\IIuhqNo.exe
  C:\Windows\System\IIuhqNo.exe
  2⤵
  PID:8108
- C:\Windows\System\CDoKaiR.exe
  C:\Windows\System\CDoKaiR.exe
  2⤵
  PID:8228
- C:\Windows\System\BNDnzJN.exe
  C:\Windows\System\BNDnzJN.exe
  2⤵
  PID:8164
- C:\Windows\System\AoPTCRC.exe
  C:\Windows\System\AoPTCRC.exe
  2⤵
  PID:8252
- C:\Windows\System\ZQYqoUj.exe
  C:\Windows\System\ZQYqoUj.exe
  2⤵
  PID:8324
- C:\Windows\System\vKbyydf.exe
  C:\Windows\System\vKbyydf.exe
  2⤵
  PID:8360
- C:\Windows\System\zDblXIr.exe
  C:\Windows\System\zDblXIr.exe
  2⤵
  PID:8344
- C:\Windows\System\sVtXfFy.exe
  C:\Windows\System\sVtXfFy.exe
  2⤵
  PID:8500
- C:\Windows\System\ZuFECiB.exe
  C:\Windows\System\ZuFECiB.exe
  2⤵
  PID:8552
- C:\Windows\System\UmoDcBs.exe
  C:\Windows\System\UmoDcBs.exe
  2⤵
  PID:8596
- C:\Windows\System\sUZFmPY.exe
  C:\Windows\System\sUZFmPY.exe
  2⤵
  PID:8672
- C:\Windows\System\JRfCBKh.exe
  C:\Windows\System\JRfCBKh.exe
  2⤵
  PID:8768
- C:\Windows\System\yDhTsRZ.exe
  C:\Windows\System\yDhTsRZ.exe
  2⤵
  PID:8436
- C:\Windows\System\nOhqLER.exe
  C:\Windows\System\nOhqLER.exe
  2⤵
  PID:8920
- C:\Windows\System\FaJRzzO.exe
  C:\Windows\System\FaJRzzO.exe
  2⤵
  PID:8824
- C:\Windows\System\BOgEBMh.exe
  C:\Windows\System\BOgEBMh.exe
  2⤵
  PID:8764
- C:\Windows\System\tDKQKyn.exe
  C:\Windows\System\tDKQKyn.exe
  2⤵
  PID:8876
- C:\Windows\System\MgZIxLZ.exe
  C:\Windows\System\MgZIxLZ.exe
  2⤵
  PID:9060
- C:\Windows\System\HsxdzKe.exe
  C:\Windows\System\HsxdzKe.exe
  2⤵
  PID:9044
- C:\Windows\System\sISWgWZ.exe
  C:\Windows\System\sISWgWZ.exe
  2⤵
  PID:9164
- C:\Windows\System\qpmaCLY.exe
  C:\Windows\System\qpmaCLY.exe
  2⤵
  PID:9188
- C:\Windows\System\IHCKols.exe
  C:\Windows\System\IHCKols.exe
  2⤵
  PID:8272
- C:\Windows\System\bKvaqmX.exe
  C:\Windows\System\bKvaqmX.exe
  2⤵
  PID:7564
- C:\Windows\System\BNpgHAQ.exe
  C:\Windows\System\BNpgHAQ.exe
  2⤵
  PID:8196
- C:\Windows\System\WVyGtVC.exe
  C:\Windows\System\WVyGtVC.exe
  2⤵
  PID:8340
- C:\Windows\System\xVrvXig.exe
  C:\Windows\System\xVrvXig.exe
  2⤵
  PID:8496
- C:\Windows\System\FnawHQa.exe
  C:\Windows\System\FnawHQa.exe
  2⤵
  PID:8520
- C:\Windows\System\HmAnYqY.exe
  C:\Windows\System\HmAnYqY.exe
  2⤵
  PID:8720
- C:\Windows\System\dhoNYjy.exe
  C:\Windows\System\dhoNYjy.exe
  2⤵
  PID:8864
- C:\Windows\System\GTwDqNT.exe
  C:\Windows\System\GTwDqNT.exe
  2⤵
  PID:8956
- C:\Windows\System\nbeAden.exe
  C:\Windows\System\nbeAden.exe
  2⤵
  PID:8976
- C:\Windows\System\lvxrnll.exe
  C:\Windows\System\lvxrnll.exe
  2⤵
  PID:9032
- C:\Windows\System\FUGvhxS.exe
  C:\Windows\System\FUGvhxS.exe
  2⤵
  PID:8036
- C:\Windows\System\ZuNuTVB.exe
  C:\Windows\System\ZuNuTVB.exe
  2⤵
  PID:9192
- C:\Windows\System\GsKuKHt.exe
  C:\Windows\System\GsKuKHt.exe
  2⤵
  PID:7376
- C:\Windows\System\PFIqaQx.exe
  C:\Windows\System\PFIqaQx.exe
  2⤵
  PID:8580
- C:\Windows\System\moBuIyh.exe
  C:\Windows\System\moBuIyh.exe
  2⤵
  PID:2992
- C:\Windows\System\coGkhvh.exe
  C:\Windows\System\coGkhvh.exe
  2⤵
  PID:8928
- C:\Windows\System\VSFapgK.exe
  C:\Windows\System\VSFapgK.exe
  2⤵
  PID:8948
- C:\Windows\System\KsEnfeJ.exe
  C:\Windows\System\KsEnfeJ.exe
  2⤵
  PID:9084
- C:\Windows\System\LJFXicV.exe
  C:\Windows\System\LJFXicV.exe
  2⤵
  PID:9004
- C:\Windows\System\cqKuFoH.exe
  C:\Windows\System\cqKuFoH.exe
  2⤵
  PID:9184
- C:\Windows\System\kMrRsQO.exe
  C:\Windows\System\kMrRsQO.exe
  2⤵
  PID:9100
- C:\Windows\System\khMVyMJ.exe
  C:\Windows\System\khMVyMJ.exe
  2⤵
  PID:8448
- C:\Windows\System\RwVAVIi.exe
  C:\Windows\System\RwVAVIi.exe
  2⤵
  PID:8708
- C:\Windows\System\jjWTqXA.exe
  C:\Windows\System\jjWTqXA.exe
  2⤵
  PID:8460
- C:\Windows\System\PeiKTHZ.exe
  C:\Windows\System\PeiKTHZ.exe
  2⤵
  PID:8908
- C:\Windows\System\JNCAYEN.exe
  C:\Windows\System\JNCAYEN.exe
  2⤵
  PID:9292
- C:\Windows\System\EpxANxU.exe
  C:\Windows\System\EpxANxU.exe
  2⤵
  PID:9308
- C:\Windows\System\PKjGUos.exe
  C:\Windows\System\PKjGUos.exe
  2⤵
  PID:9328
- C:\Windows\System\OgEuZEC.exe
  C:\Windows\System\OgEuZEC.exe
  2⤵
  PID:9344
- C:\Windows\System\VNFwepd.exe
  C:\Windows\System\VNFwepd.exe
  2⤵
  PID:9360
- C:\Windows\System\HuLGUuJ.exe
  C:\Windows\System\HuLGUuJ.exe
  2⤵
  PID:9380
- C:\Windows\System\pKXQdJI.exe
  C:\Windows\System\pKXQdJI.exe
  2⤵
  PID:9412
- C:\Windows\System\oGpzRDO.exe
  C:\Windows\System\oGpzRDO.exe
  2⤵
  PID:9428
- C:\Windows\System\oVAaGii.exe
  C:\Windows\System\oVAaGii.exe
  2⤵
  PID:9444
- C:\Windows\System\DPrgmZi.exe
  C:\Windows\System\DPrgmZi.exe
  2⤵
  PID:9460
- C:\Windows\System\HuDbzMV.exe
  C:\Windows\System\HuDbzMV.exe
  2⤵
  PID:9480
- C:\Windows\System\QoSxhJM.exe
  C:\Windows\System\QoSxhJM.exe
  2⤵
  PID:9500
- C:\Windows\System\QQfzUjJ.exe
  C:\Windows\System\QQfzUjJ.exe
  2⤵
  PID:9520
- C:\Windows\System\UYgTyze.exe
  C:\Windows\System\UYgTyze.exe
  2⤵
  PID:9544
- C:\Windows\System\yzvdawP.exe
  C:\Windows\System\yzvdawP.exe
  2⤵
  PID:9560
- C:\Windows\System\rXOFFQA.exe
  C:\Windows\System\rXOFFQA.exe
  2⤵
  PID:9576
- C:\Windows\System\twtSfWB.exe
  C:\Windows\System\twtSfWB.exe
  2⤵
  PID:9616
- C:\Windows\System\JQEiueh.exe
  C:\Windows\System\JQEiueh.exe
  2⤵
  PID:9632
- C:\Windows\System\PNzRjhS.exe
  C:\Windows\System\PNzRjhS.exe
  2⤵
  PID:9652
- C:\Windows\System\cWabwQq.exe
  C:\Windows\System\cWabwQq.exe
  2⤵
  PID:9668
- C:\Windows\System\LvukjMs.exe
  C:\Windows\System\LvukjMs.exe
  2⤵
  PID:9688
- C:\Windows\System\KAVhOps.exe
  C:\Windows\System\KAVhOps.exe
  2⤵
  PID:9708
- C:\Windows\System\swVYTXu.exe
  C:\Windows\System\swVYTXu.exe
  2⤵
  PID:9728
- C:\Windows\System\QjkQKlG.exe
  C:\Windows\System\QjkQKlG.exe
  2⤵
  PID:9748
- C:\Windows\System\Ppgsltm.exe
  C:\Windows\System\Ppgsltm.exe
  2⤵
  PID:9768
- C:\Windows\System\ZUekPGM.exe
  C:\Windows\System\ZUekPGM.exe
  2⤵
  PID:9796
- C:\Windows\System\fYAXwmU.exe
  C:\Windows\System\fYAXwmU.exe
  2⤵
  PID:9812
- C:\Windows\System\zRMsopZ.exe
  C:\Windows\System\zRMsopZ.exe
  2⤵
  PID:9828
- C:\Windows\System\MGrDyfE.exe
  C:\Windows\System\MGrDyfE.exe
  2⤵
  PID:9848
- C:\Windows\System\PvXqztr.exe
  C:\Windows\System\PvXqztr.exe
  2⤵
  PID:9876
- C:\Windows\System\RRTUagh.exe
  C:\Windows\System\RRTUagh.exe
  2⤵
  PID:9892
- C:\Windows\System\HgNzkCI.exe
  C:\Windows\System\HgNzkCI.exe
  2⤵
  PID:9916
- C:\Windows\System\KIlKOGT.exe
  C:\Windows\System\KIlKOGT.exe
  2⤵
  PID:9936
- C:\Windows\System\rGaEzLA.exe
  C:\Windows\System\rGaEzLA.exe
  2⤵
  PID:9952
- C:\Windows\System\Uewdfcg.exe
  C:\Windows\System\Uewdfcg.exe
  2⤵
  PID:9980
- C:\Windows\System\hKrcppl.exe
  C:\Windows\System\hKrcppl.exe
  2⤵
  PID:9996
- C:\Windows\System\UQCvIXL.exe
  C:\Windows\System\UQCvIXL.exe
  2⤵
  PID:10012
- C:\Windows\System\JzsClmK.exe
  C:\Windows\System\JzsClmK.exe
  2⤵
  PID:10032
- C:\Windows\System\QKHZbOK.exe
  C:\Windows\System\QKHZbOK.exe
  2⤵
  PID:10048
- C:\Windows\System\hUqeJCj.exe
  C:\Windows\System\hUqeJCj.exe
  2⤵
  PID:10068
- C:\Windows\System\oYEboPE.exe
  C:\Windows\System\oYEboPE.exe
  2⤵
  PID:10104
- C:\Windows\System\zaXXNAE.exe
  C:\Windows\System\zaXXNAE.exe
  2⤵
  PID:10120
- C:\Windows\System\dIcovmF.exe
  C:\Windows\System\dIcovmF.exe
  2⤵
  PID:10136
- C:\Windows\System\baibPlh.exe
  C:\Windows\System\baibPlh.exe
  2⤵
  PID:10164
- C:\Windows\System\chyxmms.exe
  C:\Windows\System\chyxmms.exe
  2⤵
  PID:10180
- C:\Windows\System\HqcQHMw.exe
  C:\Windows\System\HqcQHMw.exe
  2⤵
  PID:10200
- C:\Windows\System\felxbyY.exe
  C:\Windows\System\felxbyY.exe
  2⤵
  PID:10216
- C:\Windows\System\wflFANn.exe
  C:\Windows\System\wflFANn.exe
  2⤵
  PID:10236
- C:\Windows\System\wkAwBTz.exe
  C:\Windows\System\wkAwBTz.exe
  2⤵
  PID:8740
- C:\Windows\System\PcVwYsV.exe
  C:\Windows\System\PcVwYsV.exe
  2⤵
  PID:9224
- C:\Windows\System\ytVUdwz.exe
  C:\Windows\System\ytVUdwz.exe
  2⤵
  PID:9240
- C:\Windows\System\kgpzbJw.exe
  C:\Windows\System\kgpzbJw.exe
  2⤵
  PID:9324
- C:\Windows\System\fEglHQd.exe
  C:\Windows\System\fEglHQd.exe
  2⤵
  PID:9356
- C:\Windows\System\BSohlCJ.exe
  C:\Windows\System\BSohlCJ.exe
  2⤵
  PID:9392
- C:\Windows\System\KzkOMXL.exe
  C:\Windows\System\KzkOMXL.exe
  2⤵
  PID:8420
- C:\Windows\System\wskWvYW.exe
  C:\Windows\System\wskWvYW.exe
  2⤵
  PID:9468
- C:\Windows\System\UzLVJWW.exe
  C:\Windows\System\UzLVJWW.exe
  2⤵
  PID:9476
- C:\Windows\System\evdUjRY.exe
  C:\Windows\System\evdUjRY.exe
  2⤵
  PID:9552
- C:\Windows\System\lxQaQsH.exe
  C:\Windows\System\lxQaQsH.exe
  2⤵
  PID:9536
- C:\Windows\System\UDAPFEq.exe
  C:\Windows\System\UDAPFEq.exe
  2⤵
  PID:9568
- C:\Windows\System\pkTOqUD.exe
  C:\Windows\System\pkTOqUD.exe
  2⤵
  PID:9608
- C:\Windows\System\bjAZqFK.exe
  C:\Windows\System\bjAZqFK.exe
  2⤵
  PID:9644
- C:\Windows\System\IpUXxDE.exe
  C:\Windows\System\IpUXxDE.exe
  2⤵
  PID:9700
- C:\Windows\System\dzLyxss.exe
  C:\Windows\System\dzLyxss.exe
  2⤵
  PID:9696
- C:\Windows\System\jkBejnd.exe
  C:\Windows\System\jkBejnd.exe
  2⤵
  PID:9764
- C:\Windows\System\jBrTkgX.exe
  C:\Windows\System\jBrTkgX.exe
  2⤵
  PID:9780
- C:\Windows\System\HriqYHc.exe
  C:\Windows\System\HriqYHc.exe
  2⤵
  PID:9820
- C:\Windows\System\PtifQPi.exe
  C:\Windows\System\PtifQPi.exe
  2⤵
  PID:9840
- C:\Windows\System\SIJvXjF.exe
  C:\Windows\System\SIJvXjF.exe
  2⤵
  PID:9900
- C:\Windows\System\PNQadQf.exe
  C:\Windows\System\PNQadQf.exe
  2⤵
  PID:9912
- C:\Windows\System\mjeKODg.exe
  C:\Windows\System\mjeKODg.exe
  2⤵
  PID:9944
- C:\Windows\System\BJLoXdC.exe
  C:\Windows\System\BJLoXdC.exe
  2⤵
  PID:9972
- C:\Windows\System\HGLqPES.exe
  C:\Windows\System\HGLqPES.exe
  2⤵
  PID:10020
- C:\Windows\System\WfAjeVI.exe
  C:\Windows\System\WfAjeVI.exe
  2⤵
  PID:10064
- C:\Windows\System\pjHYDKZ.exe
  C:\Windows\System\pjHYDKZ.exe
  2⤵
  PID:10028
- C:\Windows\System\AAjswXV.exe
  C:\Windows\System\AAjswXV.exe
  2⤵
  PID:10116
- C:\Windows\System\HtUFdJc.exe
  C:\Windows\System\HtUFdJc.exe
  2⤵
  PID:10160
- C:\Windows\System\WcEQCKq.exe
  C:\Windows\System\WcEQCKq.exe
  2⤵
  PID:10188
- C:\Windows\System\WlYYLAF.exe
  C:\Windows\System\WlYYLAF.exe
  2⤵
  PID:10212
- C:\Windows\System\czhYxDh.exe
  C:\Windows\System\czhYxDh.exe
  2⤵
  PID:8784
- C:\Windows\System\NaZijNO.exe
  C:\Windows\System\NaZijNO.exe
  2⤵
  PID:8388
- C:\Windows\System\cdJKWvi.exe
  C:\Windows\System\cdJKWvi.exe
  2⤵
  PID:9304
- C:\Windows\System\AYTdWYy.exe
  C:\Windows\System\AYTdWYy.exe
  2⤵
  PID:9372
- C:\Windows\System\BGJJiyl.exe
  C:\Windows\System\BGJJiyl.exe
  2⤵
  PID:1556
- C:\Windows\System\vBqCSAd.exe
  C:\Windows\System\vBqCSAd.exe
  2⤵
  PID:9456
- C:\Windows\System\HsyQWTg.exe
  C:\Windows\System\HsyQWTg.exe
  2⤵
  PID:9492
- C:\Windows\System\IkpxUGT.exe
  C:\Windows\System\IkpxUGT.exe
  2⤵
  PID:9496
- C:\Windows\System\FKGoDAR.exe
  C:\Windows\System\FKGoDAR.exe
  2⤵
  PID:9640
- C:\Windows\System\oXanfYE.exe
  C:\Windows\System\oXanfYE.exe
  2⤵
  PID:9684
- C:\Windows\System\HseboXo.exe
  C:\Windows\System\HseboXo.exe
  2⤵
  PID:9756
- C:\Windows\System\WlcYOBT.exe
  C:\Windows\System\WlcYOBT.exe
  2⤵
  PID:9844
- C:\Windows\System\MdfOnET.exe
  C:\Windows\System\MdfOnET.exe
  2⤵
  PID:9860
- C:\Windows\System\zzMICXC.exe
  C:\Windows\System\zzMICXC.exe
  2⤵
  PID:9908
- C:\Windows\System\QKXxxzl.exe
  C:\Windows\System\QKXxxzl.exe
  2⤵
  PID:9968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BTmNXuG.exe

Filesize
1.7MB

MD5
b5b81a72cae5b2301d19c4bb46cbea93

SHA1
5483318c7d91004da192022e4c7f3744aa82570b

SHA256
d5c4f673f0319a44215ef8fc1195894bd5bb7e7c6b6f2bd63eded4a5c02650b1

SHA512
aa14e95a8d016ff548fb61db7df802a1ac782e1b9f4fcbe61de12f1fc9d11599b73d86fb55da6052b22d2b8c3c709d9d2b7a7eac2d887bd0e9049e8d1a11b1c7

Download Submit
C:\Windows\system\CoOOMBj.exe

Filesize
1.7MB

MD5
c8181c17d8f3c3343e342d147b4007f5

SHA1
016ce641e802dd74b91722c0ec6ae959b3f05d19

SHA256
ca595494136d78dcaecbf8cb32ee6b8f12b9d60ecc74b36de59e07cb51ed2ece

SHA512
ba9771674343db00dd5dda3c835999f24d426514399fc17e476889325476d7f88922c1f8276a313a33ad115fd3a9620d7149daa56a038b2616ac0812640ad640

Download Submit
C:\Windows\system\DdkFbYA.exe

Filesize
1.7MB

MD5
9e73881b64939143b0d3b95478376ca7

SHA1
e70ed8f8ec79eec187f45bfd9df4a3697e03bfca

SHA256
2f35e7a97d282faec79023c9992d5533ceddd339b3728677a50aa67b1f6a61b5

SHA512
1cc4f0d381801f857a69c95838e6de5c51a545500582b51ed20f59f822cb405d464ef4133450a80693fc421a4b93b3b3e8fb40835b12f765f14e9b9213497fd3

Download Submit
C:\Windows\system\FzJDKvP.exe

Filesize
1.7MB

MD5
741e9aa6570a17b8f0aea24b51349a2d

SHA1
bfbe1679a2827e6784e40489eb08f3a259c0d688

SHA256
09938f389df40e0fe87ec2931bf27407d724afbc16402fff4f4e4d5abfc1ae7e

SHA512
64500dedb980f09080c44e614008162293244022f9994486c472e99d3757c33f3863a25ebee192a79e301c090e18c0cf02dbf993294e2d92d9772455389a93ea

Download Submit
C:\Windows\system\HJZCbTB.exe

Filesize
1.7MB

MD5
be802a87754d53139554446522b34a0d

SHA1
50ddc2cac7d996937836e343bc83038f67683153

SHA256
efacd5823eb2a67364ed9b7d29141b0350571eb2dd416b958ff8054ab350c38f

SHA512
18f0495218950d55f504381b3fc07abd2e2ae42a0ef76778e42745f03f448c77cdaa9ec31f432e0fc38375f4b59101433a7814fd5c1e08392de02f0e360eeaad

Download Submit
C:\Windows\system\LdThCan.exe

Filesize
1.7MB

MD5
122e29f17bc23563f2a56f4ee7b40090

SHA1
fb0e805e417700b483f7e1a3c75ccd7d875094fe

SHA256
c112324b57a1e36a923f5c539102bced323d508920cd49c4785ff5c224cd7758

SHA512
d7762ab7d470f6f5441b0d44f195c8a1e9d2aaaf529d64802a538f9e1c48ea12974498e1da130dff158a96a1ecbe04fc2a9228ba99f5de7e455a2d3ba1de62cf

Download Submit
C:\Windows\system\RbeVbVf.exe

Filesize
1.7MB

MD5
e5597c7720e5825d06be66426050c1cd

SHA1
3acccc6d2bc002a64dc982e0c30556fae049b239

SHA256
49d13afae9b900f59f2272c963e75da8c57a70051992fd8b853315740bd594c4

SHA512
5dcdb9e16df6565b1cfc9f8135af3acb84e89016262faea273e5a4217f2a05817f813df55a4866f14fbfb892e0db6ecb901fc5ff156560ed2795513ddf42a317

Download Submit
C:\Windows\system\SlyABMg.exe

Filesize
1.7MB

MD5
3fa275ffadb1c1e69056a9681fb64db2

SHA1
84c8ef27afae99456ce387ae241bdddc4272cb87

SHA256
7616a236ce51806c7d71cfc5f26f5d9b8e120cf120842c8251f694997d379779

SHA512
ab0183de2d040e5f4a83c0bb42a7ae8968e142e0f8b193f6d8d82fd5087c9a7ece2a7c83c80131c6b1c756804c7384ba8dfad5d5cdd05aafe83f1c50df444f83

Download Submit
C:\Windows\system\UbczIWl.exe

Filesize
1.7MB

MD5
d80ebe35cd339b68ef1593afceb9569e

SHA1
bc45c1727fdb9abb4239656a738c40a686139d86

SHA256
7d4ac1da64b393cad21e29c230b28f0308f0621fc7ace12033926cf6354944f5

SHA512
5ccbf6e73fe76ba363354a1452d11537e80def902a6d42f04d8c668b07622c165e0511dd9b73da98bae7ba290c248076670914bda1157d129489f6539e0d9f70

Download Submit
C:\Windows\system\VAvPHNg.exe

Filesize
1.7MB

MD5
f8e4e4a12f0fded5f5037c15fbdd0201

SHA1
ead7fde487381547767e90c8015730bab3c4be64

SHA256
636b0dcad64c77f48f32e365de28e7ba1d04b72cce5ae2a66ea758c51dfeec65

SHA512
761e29047501c3c410f3424b2aff2b05587d64e53b60cbd88bce41edee99b5cebef9bf076a5466543733185222711379d212738723aa8e43086922e95f3e5c86

Download Submit
C:\Windows\system\XCikwGD.exe

Filesize
1.7MB

MD5
ae54acdea5b58d61db3ebbc7e7cb4b75

SHA1
d08ae9cb73d2913979186f66733b4352c1f9b55d

SHA256
85deecc910fa4dc557ee28bae072af16a044581e50ba5fbdfd32b3febd526151

SHA512
45310991fd449aceed3967cb335374bb839c7e2fcb983ece3298abcdc4b07983439b27d6f906f049f8401b12899a4957fb59b6b8941d11e22dc0919211bf5793

Download Submit
C:\Windows\system\ZUBICzy.exe

Filesize
1.7MB

MD5
67332989efa8faf99c6ee799df80ecdd

SHA1
de43119dfb126931414135a8a43c07906093ec1c

SHA256
4b1a6b9ff37efd9cbc0406f2067694774ad6ddf337cc5b036d55b59f2765541f

SHA512
eec2e658c1901ee9a7bc797c803fae65550a97ccd720c728bb87bb5355a484694b9c4adc9eab8f394d9b61c6ced7d2756d49112e550f3b0c7c050a83274a9c50

Download Submit
C:\Windows\system\ZZWSqJM.exe

Filesize
1.7MB

MD5
440cdb9aa2017142b8fc5b88bfe5355d

SHA1
c172f0f9912b0d404491cbcab43a9b20d999d6bd

SHA256
3d61f12cb31b0fed621927a6b122ff41709c5efc4f1a2a1c2f8edeb01a683bf2

SHA512
5a69c8fda69ccb19edbf38cf55e7211c8f5d6dd22bee977698c9eed4da3e7c960b682de65450f44355ee0c400bcad499ea853ff10bc28372af51bb3c0e642532

Download Submit
C:\Windows\system\dCvYgBG.exe

Filesize
1.7MB

MD5
bbae4a08be2a4f2267ad12ae6377c65a

SHA1
b15846ae28c62da2baa0408b8c68d2e58b453531

SHA256
a31eeb2da7b78590cc177f909333c807b3dd1bff7a2b55de60af5cec87072f7f

SHA512
eea24848b5923f6de92161d57b650a8ea725c468af94524f5219a12da3a710e7c9c83e6032ab3bc2ff145a2691c08bde579e5e05a28e8f6ecf8d5528a046486b

Download Submit
C:\Windows\system\fpvycjg.exe

Filesize
1.7MB

MD5
389004bb1665bcf1ececa585ce1ee5b5

SHA1
8aaf2e2f013cd448a38d4017d5822a1f7761caa1

SHA256
9f163cd750d5e74f1a1e18d7f35158c7b0aa1b5ef1198a76191de58ad988b302

SHA512
dc9efd2fdeab279fd01dff3673892ddd82bda28a12a81e0593f182440019629a2e4367be9abd6333831665390d884f69643df9877771e9c9bfe849971d6dfabd

Download Submit
C:\Windows\system\gXwzBkd.exe

Filesize
1.7MB

MD5
8767c202aef8e236c44b1110da5f30b5

SHA1
f9137729e3ba922a8f6727dd4acdc6335814eecd

SHA256
f1dc0d425e0f97f0fa654af4b8811227e0208daa1777670da6b3ec1bcc6eff57

SHA512
fe4de5f4d5fa59a0d2801e4fe25a7872a0f2b37a77c066522c1e0a3a2edb38de6cfcbba5461ed0b2d12e87c8ad3567702e29be5d9fec1e3225cfc3c128443fb2

Download Submit
C:\Windows\system\hgYCqyh.exe

Filesize
1.7MB

MD5
5e48e242978a976d1fea46bbcd224bf1

SHA1
a7f9870d5986cade81a25ae12f58779c4c83e7ac

SHA256
d4b3debd878e576e982d646095318f74d7dcc52b90d8160ee9b45e04c4aa75f7

SHA512
e95c212e55cb4a976c1cded918841b9d13f01dd0dbfd11af2da8594c30d9c07d6ad40fd62b2dcae8e69b0c5b46fa06aea3c4802fef9335eefe3aa60eb96d890d

Download Submit
C:\Windows\system\jkkhPvc.exe

Filesize
1.7MB

MD5
987b05bf010496d5f0a39885a21fbe29

SHA1
ea5cadc74fadd4fe40f42d475af87a8b3c4f627d

SHA256
946bc83504915f6b0ca8d42825e44a4ea73bad4223b0c587c88ff29252241212

SHA512
b1c57a4396f0703bdefe636a05e93c03a2cebb74fc2f1564d01522df976f3dcb7dcbe05354cbb48e10b113abc9bfbefd72b21d69b1baf47126b1c7942fd3984c

Download Submit
C:\Windows\system\nGnvoUU.exe

Filesize
1.7MB

MD5
1277ac71ccc239567f7429b5f7f67fe3

SHA1
70c3115ce988e5e7865491e11aac2f8284421079

SHA256
792369febc2e2df8e4537805994b3b658898a247b4ad856903b1c58f84ddbf40

SHA512
f2e09b6f18cf50e8e2df6fa234d8b4e3e1d3de2f2ea460a710241b3e32ab7b3cb55157e4c1033f63e2cc400725d203f27517fba440684deef71695c1c6d4b640

Download Submit
C:\Windows\system\nyBkrYu.exe

Filesize
1.7MB

MD5
c9a9a745e78d1d31e1f79a40de2cfd85

SHA1
ac963431d8250f4105c9814957e59eb5455fb7ac

SHA256
90fb24d24287e0b35dc79d4fd219ee8f6af36a4fc98c8b1c04302b1bb0c7a641

SHA512
45af180ffe18d231221b3012fc0dc6d89a2e6593b649af8ba1d4df105b20ebe21cc90a82e6b6730a42927a9fd9fa7143af3f3f88b24d9a4dcfbeeb2d2b7be597

Download Submit
C:\Windows\system\oCIfoYg.exe

Filesize
1.7MB

MD5
0952d72da99fc483b5eeabcc52ab6896

SHA1
48a3889337548de2df88c42bfaf59cd962ca6b20

SHA256
ac9615df8ab580fc50da887ca99fcdeb554692267edbb8fd0796304f74dcf821

SHA512
0e25896e9bf36341f1209d6b7d9a497c26e9edf109d223e4cd012dbed130db1895e7cd68679aea5cfe0c10442db87f8fb81b1cb9913ee8afb5b2671abd7196cf

Download Submit
C:\Windows\system\sdAxBgy.exe

Filesize
1.7MB

MD5
d6c25a57dd0c04bf88db771382bd1b15

SHA1
c9d8984def2e88bb36d4a0dc64df8f4533c327bf

SHA256
480deaff097ecbfebfb445dd3f95db99a6cbf79739b0207eb865dfe18bc4477c

SHA512
c8d26d719b8b357cf7ed881e60675131d6fb196c0c5f223a6e971df568761f4fb365d8490fbd25162554433e8cfd8e5f39718a9e805fc376a2f7aae4c87a7650

Download Submit
C:\Windows\system\skZkkqL.exe

Filesize
1.7MB

MD5
89b8c9cbe0e4a14bbd363cc4f104faa1

SHA1
c0c989d6aac951dfeb6620fde0c38718c4a898be

SHA256
c96504601feb9c2c7666aa3b37ce4f41a7525afabaac1bba5fe4132eada04ace

SHA512
f4580ee52f6dd19088b8ee18eeb13e6456fae209b3d531aecf67dd30391e9f65ed804679e18885fe5543983476a627072fae41ff2a534d54f0605e039f635ac4

Download Submit
C:\Windows\system\woGDSSB.exe

Filesize
1.7MB

MD5
78d131fd30bea5f85009660ff8b1d435

SHA1
cad755f91bda74cbc99f1a30ea637fe2846bf52b

SHA256
bff55ea0e1717961ef56d4e4c67c25465a8159c52c30b1d3883cf5925875bde0

SHA512
03edef86daf93966603b0d71d42245c088008ed722014db3b7c1ce31bddc5cc732c08f131298580b19ceb20173dbf36871a7d334dde7d36252d8b4e54e3ddd9f

Download Submit
C:\Windows\system\xXJNdLi.exe

Filesize
1.7MB

MD5
6f91662ba26c26b00da01b276f0ecfd0

SHA1
4874cd17563ce714933dfafbccd073fd7d920970

SHA256
eb8c402431e5d4a542ee686e74465fed107c4dced05ac27f69eef33908ba4437

SHA512
d35f5fc21899e340abb07ea816c1a48062fa061641ff66ce59b8a445993cb10121479b72c5077a848ed97e9ee62f86985c4aeb82948b0281782318e35dadac9a

Download Submit
C:\Windows\system\ysqHbbf.exe

Filesize
1.7MB

MD5
d73edb96d860aa428046849aca2fd112

SHA1
852590f1080c6fe1892490de49324366e798a184

SHA256
d99d9f4241866b4f3f560eb332a12dbff6b758c2e977fe33eff3ee7801e542a0

SHA512
c7a444b347a49989d98b80da3c3eb33b820c2b23586804fbfd401162df2f436e952e391dab2ae4f15a6cdd44f46f029a676f2150b8d0142d7108a2b2bee401b3

Download Submit
\Windows\system\CaOLjjb.exe

Filesize
1.7MB

MD5
7f98ccb06ac88bf6dafee29adec75957

SHA1
25d5af48c389a3b2d3955f3c43ac3f9509008c4d

SHA256
73cfcde2a29d088f9848ef780ab24c3a26b344ab7c5f7421d8b3a2747f7ed7d4

SHA512
2d659926ef8e2a97fb144fd062034c7983100b61d641b66e70f23a485e7f665e12049b951c95bfff1174b5f4103cf439891244ec6d40b0dee19acb4dc94fa702

Download Submit
\Windows\system\DfFPQRY.exe

Filesize
1.7MB

MD5
7fa7ab4561cd5e59da501a017635825e

SHA1
8c1e4eb97d10c2fcbf4a36d71672c019f1d70554

SHA256
18f2fc85fa3ee7494df04b16e94076d967e5772d6c22dc50abb886e5cc61d7ae

SHA512
c5c53454e10615234b3580a6d72466865fe601fbe41ab2ac747c5ed05d293b4de3b30da21b078cf20985c3424a8bb9a8f5a50b1239d23942798ad2937bef867b

Download Submit
\Windows\system\bRTRtQV.exe

Filesize
1.7MB

MD5
b4af0fb1e1b103ab8523ceb102729b2a

SHA1
57035f42d479fdcc9faaa7f4062f172b26359b23

SHA256
5b584facc7a18f5f4d3043328a428767ff72c22efbfa4240bd4c3d2a9dfceb63

SHA512
fdd878fdbbe18a9d95af8ae5dd7486364a0dc8c910111e9e1636e7e56c5f30c42f2677d3ba293b9edcb509013c55784d779b9a48a8211f4db1a5a1f807f6914d

Download Submit
\Windows\system\maXrzXu.exe

Filesize
1.7MB

MD5
87ff91a47667b12ffb1d8f5072c77fe9

SHA1
5f87c128961a144b6d6a6ab778f82a75afa1e457

SHA256
bd0499364c97b91966b9e7cf53293aff1f38526f7b3e45868091b5bb4f7c9f11

SHA512
6d52317407253efca2bb3f2623319b51f26053bdc6e90175caa0da9fc03d68dcb099b5d81b273ffec865241720c9e8ac0623e8ffb2b61c6ab5463a14b26df4e2

Download Submit
\Windows\system\ueIlaNE.exe

Filesize
1.7MB

MD5
8320f390a76cf82574304c1c0ec4b1ca

SHA1
59764fdc0d1a416423740220dc5ef017fbbe0989

SHA256
5149360913ba1607b41e2a4ad60f05e26e7842ec99115a36c1c153fe4cde8d7f

SHA512
a780b4af5eb158551dc240a10f7ad18b360e59ea9dd2433dba5b648b40e36dc0ce3433daa6eddc08e70a4fecaebefa50a429c1ea709559ef7d4651a273a61d17

Download Submit
\Windows\system\wrcrJoM.exe

Filesize
1.7MB

MD5
5bbb745c19c8ce39c6ea722933836b1d

SHA1
74be671cbaa82b804be39eff7f9e8b07ba8bd9db

SHA256
95efd64383148f0451c06717a7dd7f2dff20274ce5c1fe177bd709666a98474d

SHA512
5718f17ef06abcc7eda0626c0ad82965fab7a919b73664ca2c201b065d4aed21e514a965089f70898c6bb60795c3c13f62072076a64eb2ac3818618f50bc053a

Download Submit
memory/2080-32-0x000000013FB90000-0x000000013FEE4000-memory.dmp

Filesize
3.3MB

Download
memory/2080-4001-0x000000013FB90000-0x000000013FEE4000-memory.dmp

Filesize
3.3MB

Download
memory/2100-53-0x000000013F3B0000-0x000000013F704000-memory.dmp

Filesize
3.3MB

Download
memory/2100-4002-0x000000013F3B0000-0x000000013F704000-memory.dmp

Filesize
3.3MB

Download
memory/2504-87-0x000000013F6B0000-0x000000013FA04000-memory.dmp

Filesize
3.3MB

Download
memory/2504-63-0x000000013F9A0000-0x000000013FCF4000-memory.dmp

Filesize
3.3MB

Download
memory/2504-92-0x0000000001DE0000-0x0000000002134000-memory.dmp

Filesize
3.3MB

Download
memory/2504-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2504-90-0x000000013FF10000-0x0000000140264000-memory.dmp

Filesize
3.3MB

Download
memory/2504-88-0x000000013F770000-0x000000013FAC4000-memory.dmp

Filesize
3.3MB

Download
memory/2504-0-0x000000013F320000-0x000000013F674000-memory.dmp

Filesize
3.3MB

Download
memory/2504-85-0x0000000001DE0000-0x0000000002134000-memory.dmp

Filesize
3.3MB

Download
memory/2504-960-0x000000013F320000-0x000000013F674000-memory.dmp

Filesize
3.3MB

Download
memory/2504-83-0x0000000001DE0000-0x0000000002134000-memory.dmp

Filesize
3.3MB

Download
memory/2504-2084-0x0000000001DE0000-0x0000000002134000-memory.dmp

Filesize
3.3MB

Download
memory/2504-79-0x0000000001DE0000-0x0000000002134000-memory.dmp

Filesize
3.3MB

Download
memory/2504-2101-0x0000000001DE0000-0x0000000002134000-memory.dmp

Filesize
3.3MB

Download
memory/2504-76-0x0000000001DE0000-0x0000000002134000-memory.dmp

Filesize
3.3MB

Download
memory/2504-75-0x000000013FC00000-0x000000013FF54000-memory.dmp

Filesize
3.3MB

Download
memory/2504-2093-0x000000013FF10000-0x0000000140264000-memory.dmp

Filesize
3.3MB

Download
memory/2504-1746-0x0000000001DE0000-0x0000000002134000-memory.dmp

Filesize
3.3MB

Download
memory/2504-1364-0x0000000001DE0000-0x0000000002134000-memory.dmp

Filesize
3.3MB

Download
memory/2504-67-0x000000013F880000-0x000000013FBD4000-memory.dmp

Filesize
3.3MB

Download
memory/2504-1349-0x0000000001DE0000-0x0000000002134000-memory.dmp

Filesize
3.3MB

Download
memory/2504-59-0x000000013FD70000-0x00000001400C4000-memory.dmp

Filesize
3.3MB

Download
memory/2504-9-0x000000013FB90000-0x000000013FEE4000-memory.dmp

Filesize
3.3MB

Download
memory/2504-37-0x0000000001DE0000-0x0000000002134000-memory.dmp

Filesize
3.3MB

Download
memory/2608-4004-0x000000013F120000-0x000000013F474000-memory.dmp

Filesize
3.3MB

Download
memory/2608-74-0x000000013F120000-0x000000013F474000-memory.dmp

Filesize
3.3MB

Download
memory/2628-98-0x000000013F770000-0x000000013FAC4000-memory.dmp

Filesize
3.3MB

Download
memory/2628-4013-0x000000013F770000-0x000000013FAC4000-memory.dmp

Filesize
3.3MB

Download
memory/2632-4009-0x000000013F0F0000-0x000000013F444000-memory.dmp

Filesize
3.3MB

Download
memory/2632-93-0x000000013F0F0000-0x000000013F444000-memory.dmp

Filesize
3.3MB

Download
memory/2744-4008-0x000000013FD70000-0x00000001400C4000-memory.dmp

Filesize
3.3MB

Download
memory/2744-82-0x000000013FD70000-0x00000001400C4000-memory.dmp

Filesize
3.3MB

Download
memory/2756-4010-0x000000013F880000-0x000000013FBD4000-memory.dmp

Filesize
3.3MB

Download
memory/2756-96-0x000000013F880000-0x000000013FBD4000-memory.dmp

Filesize
3.3MB

Download
memory/2764-97-0x000000013F6B0000-0x000000013FA04000-memory.dmp

Filesize
3.3MB

Download
memory/2764-4011-0x000000013F6B0000-0x000000013FA04000-memory.dmp

Filesize
3.3MB

Download
memory/2776-2528-0x000000013FF10000-0x0000000140264000-memory.dmp

Filesize
3.3MB

Download
memory/2776-4012-0x000000013FF10000-0x0000000140264000-memory.dmp

Filesize
3.3MB

Download
memory/2776-100-0x000000013FF10000-0x0000000140264000-memory.dmp

Filesize
3.3MB

Download
memory/2792-84-0x000000013F150000-0x000000013F4A4000-memory.dmp

Filesize
3.3MB

Download
memory/2792-4003-0x000000013F150000-0x000000013F4A4000-memory.dmp

Filesize
3.3MB

Download
memory/2796-91-0x000000013FC00000-0x000000013FF54000-memory.dmp

Filesize
3.3MB

Download
memory/2796-4007-0x000000013FC00000-0x000000013FF54000-memory.dmp

Filesize
3.3MB

Download
memory/2828-78-0x000000013F220000-0x000000013F574000-memory.dmp

Filesize
3.3MB

Download
memory/2828-4006-0x000000013F220000-0x000000013F574000-memory.dmp

Filesize
3.3MB

Download
memory/2832-4005-0x000000013F9A0000-0x000000013FCF4000-memory.dmp

Filesize
3.3MB

Download
memory/2832-72-0x000000013F9A0000-0x000000013FCF4000-memory.dmp

Filesize
3.3MB

Download
memory/2920-4000-0x000000013F8A0000-0x000000013FBF4000-memory.dmp

Filesize
3.3MB

Download
memory/2920-46-0x000000013F8A0000-0x000000013FBF4000-memory.dmp

Filesize
3.3MB

Download