xmrig | 55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
Size

3.3MB
MD5

55221eb56972f240fb8332b1dd3749fc
SHA1

550e50a19399ad4d874753022c6facb478661bf1
SHA256

55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330
SHA512

53b4cf469551d9401e3ad47df6bea55bee5dbb8a26ea91f72e04a6e6ddae803e338ff126d2e8b7742df7d93c3b2268131ab7fbcbedea9fb8f86eb3caa8f82784
SSDEEP

49152:EnCbL83y9FdfE0pZ0zCa4wI156uL3pgrCEdMKPFotsgEBr6GjvzWN:EniLf9FdfE0pZB156utgpPFotBER4

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2332-0-0x000000013FC10000-0x000000013FF64000-memory.dmp	xmrig
behavioral1/files/0x00080000000120f9-6.dat	xmrig
behavioral1/memory/3060-9-0x000000013F910000-0x000000013FC64000-memory.dmp	xmrig
behavioral1/files/0x000900000001707f-10.dat	xmrig
behavioral1/memory/1992-45-0x000000013F8C0000-0x000000013FC14000-memory.dmp	xmrig
behavioral1/files/0x00070000000175f1-30.dat	xmrig
behavioral1/memory/2296-49-0x000000013F9B0000-0x000000013FD04000-memory.dmp	xmrig
behavioral1/files/0x00050000000193f9-127.dat	xmrig
behavioral1/files/0x0005000000019502-163.dat	xmrig
behavioral1/files/0x00050000000194e1-160.dat	xmrig
behavioral1/files/0x000500000001952b-185.dat	xmrig
behavioral1/memory/2296-549-0x000000013F9B0000-0x000000013FD04000-memory.dmp	xmrig
behavioral1/memory/2624-1533-0x000000013F2A0000-0x000000013F5F4000-memory.dmp	xmrig
behavioral1/memory/2332-1531-0x0000000002130000-0x0000000002484000-memory.dmp	xmrig
behavioral1/memory/1956-1299-0x000000013F9E0000-0x000000013FD34000-memory.dmp	xmrig
behavioral1/memory/2760-1297-0x000000013FA90000-0x000000013FDE4000-memory.dmp	xmrig
behavioral1/memory/2172-672-0x000000013F530000-0x000000013F884000-memory.dmp	xmrig
behavioral1/files/0x000500000001952e-188.dat	xmrig
behavioral1/files/0x0005000000019508-178.dat	xmrig
behavioral1/files/0x0005000000019510-174.dat	xmrig
behavioral1/files/0x0005000000019518-173.dat	xmrig
behavioral1/files/0x0005000000019520-181.dat	xmrig
behavioral1/files/0x00050000000194c3-149.dat	xmrig
behavioral1/files/0x0005000000019428-139.dat	xmrig
behavioral1/files/0x00050000000194d5-153.dat	xmrig
behavioral1/files/0x00050000000194ad-144.dat	xmrig
behavioral1/files/0x0005000000019426-134.dat	xmrig
behavioral1/files/0x00050000000193d0-120.dat	xmrig
behavioral1/files/0x000500000001939f-118.dat	xmrig
behavioral1/files/0x0005000000019358-116.dat	xmrig
behavioral1/files/0x00050000000192a1-114.dat	xmrig
behavioral1/memory/2624-107-0x000000013F2A0000-0x000000013F5F4000-memory.dmp	xmrig
behavioral1/memory/2456-103-0x000000013FD60000-0x00000001400B4000-memory.dmp	xmrig
behavioral1/files/0x00050000000193dc-123.dat	xmrig
behavioral1/memory/2332-91-0x000000013F320000-0x000000013F674000-memory.dmp	xmrig
behavioral1/files/0x0005000000019354-85.dat	xmrig
behavioral1/files/0x0005000000019299-84.dat	xmrig
behavioral1/memory/2760-69-0x000000013FA90000-0x000000013FDE4000-memory.dmp	xmrig
behavioral1/memory/2332-68-0x000000013FC10000-0x000000013FF64000-memory.dmp	xmrig
behavioral1/files/0x000500000001927a-67.dat	xmrig
behavioral1/files/0x00050000000193cc-98.dat	xmrig
behavioral1/files/0x000500000001938e-97.dat	xmrig
behavioral1/memory/1956-95-0x000000013F9E0000-0x000000013FD34000-memory.dmp	xmrig
behavioral1/memory/2480-74-0x000000013FCB0000-0x0000000140004000-memory.dmp	xmrig
behavioral1/memory/2820-64-0x000000013F310000-0x000000013F664000-memory.dmp	xmrig
behavioral1/files/0x0005000000019274-60.dat	xmrig
behavioral1/memory/2172-54-0x000000013F530000-0x000000013F884000-memory.dmp	xmrig
behavioral1/files/0x0007000000018697-52.dat	xmrig
behavioral1/files/0x00080000000174b4-29.dat	xmrig
behavioral1/memory/2480-27-0x000000013FCB0000-0x0000000140004000-memory.dmp	xmrig
behavioral1/files/0x00070000000175f7-23.dat	xmrig
behavioral1/memory/2872-47-0x000000013F170000-0x000000013F4C4000-memory.dmp	xmrig
behavioral1/memory/2496-46-0x000000013FCA0000-0x000000013FFF4000-memory.dmp	xmrig
behavioral1/files/0x000f000000018683-40.dat	xmrig
behavioral1/memory/2332-39-0x000000013F170000-0x000000013F4C4000-memory.dmp	xmrig
behavioral1/files/0x0007000000017570-38.dat	xmrig
behavioral1/memory/2456-37-0x000000013FD60000-0x00000001400B4000-memory.dmp	xmrig
behavioral1/memory/3060-4011-0x000000013F910000-0x000000013FC64000-memory.dmp	xmrig
behavioral1/memory/1992-4012-0x000000013F8C0000-0x000000013FC14000-memory.dmp	xmrig
behavioral1/memory/2456-4014-0x000000013FD60000-0x00000001400B4000-memory.dmp	xmrig
behavioral1/memory/2480-4013-0x000000013FCB0000-0x0000000140004000-memory.dmp	xmrig
behavioral1/memory/2872-4015-0x000000013F170000-0x000000013F4C4000-memory.dmp	xmrig
behavioral1/memory/2820-4016-0x000000013F310000-0x000000013F664000-memory.dmp	xmrig
behavioral1/memory/2296-4018-0x000000013F9B0000-0x000000013FD04000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3060	qTHewPH.exe
2480	nNPKULG.exe
1992	hgHtXVR.exe
2456	xgBjMKd.exe
2496	aDBnoEb.exe
2872	EzsoGvj.exe
2296	xGawJQf.exe
2172	dmnhyQQ.exe
2820	qITNIZR.exe
2760	HxcjmXD.exe
2624	HfTLgae.exe
1956	ubdzLyc.exe
1952	guweAlw.exe
1404	JhGpXAw.exe
2672	EYnbOid.exe
2664	PuxUICO.exe
2816	eLWXXUC.exe
3036	nzJMfLg.exe
2948	kAErgcn.exe
3044	mEHrwQB.exe
332	HfcnfZW.exe
1800	sgPNFiy.exe
1848	nZGjgsF.exe
2592	RmyakoC.exe
1420	ChSEQbx.exe
1568	gzBhvVn.exe
1236	ExkUKTB.exe
2012	SfVcAZK.exe
1312	DBUnoNX.exe
1672	hqNAAsH.exe
1692	kstyPwk.exe
1936	THfEghi.exe
2152	IVKwxOV.exe
836	YeFUVPN.exe
1304	IlpyiAE.exe
2964	LMurUzb.exe
1224	aILvdJT.exe
1748	ytJdVSO.exe
1232	qJUSvlq.exe
896	sFIQpAj.exe
928	xJgzFrn.exe
2576	RIYAUqZ.exe
1876	VqZvGDl.exe
1652	gWcCNGO.exe
2588	MliYjKX.exe
2440	aVExNcT.exe
320	dEsxisf.exe
2232	kkVUDIS.exe
1744	eozcfwZ.exe
2552	YJVrBDD.exe
1428	LIpQnIa.exe
1912	HDAQPZu.exe
2140	oGuUBWR.exe
1496	emnlZtx.exe
1636	OSgcNqL.exe
2200	MPCygHf.exe
2772	wTbRcdC.exe
2484	wDiiCbU.exe
1448	vrISiFV.exe
2840	IsWjddX.exe
3028	GXdvRsB.exe
3068	cEiWUXk.exe
2144	cxWbUlt.exe
2956	xefPQww.exe

Loads dropped DLL 64 IoCs

pid	Process
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2332-0-0x000000013FC10000-0x000000013FF64000-memory.dmp	upx
behavioral1/files/0x00080000000120f9-6.dat	upx
behavioral1/memory/3060-9-0x000000013F910000-0x000000013FC64000-memory.dmp	upx
behavioral1/files/0x000900000001707f-10.dat	upx
behavioral1/memory/1992-45-0x000000013F8C0000-0x000000013FC14000-memory.dmp	upx
behavioral1/files/0x00070000000175f1-30.dat	upx
behavioral1/memory/2296-49-0x000000013F9B0000-0x000000013FD04000-memory.dmp	upx
behavioral1/files/0x00050000000193f9-127.dat	upx
behavioral1/files/0x0005000000019502-163.dat	upx
behavioral1/files/0x00050000000194e1-160.dat	upx
behavioral1/files/0x000500000001952b-185.dat	upx
behavioral1/memory/2296-549-0x000000013F9B0000-0x000000013FD04000-memory.dmp	upx
behavioral1/memory/2624-1533-0x000000013F2A0000-0x000000013F5F4000-memory.dmp	upx
behavioral1/memory/1956-1299-0x000000013F9E0000-0x000000013FD34000-memory.dmp	upx
behavioral1/memory/2760-1297-0x000000013FA90000-0x000000013FDE4000-memory.dmp	upx
behavioral1/memory/2172-672-0x000000013F530000-0x000000013F884000-memory.dmp	upx
behavioral1/files/0x000500000001952e-188.dat	upx
behavioral1/files/0x0005000000019508-178.dat	upx
behavioral1/files/0x0005000000019510-174.dat	upx
behavioral1/files/0x0005000000019518-173.dat	upx
behavioral1/files/0x0005000000019520-181.dat	upx
behavioral1/files/0x00050000000194c3-149.dat	upx
behavioral1/files/0x0005000000019428-139.dat	upx
behavioral1/files/0x00050000000194d5-153.dat	upx
behavioral1/files/0x00050000000194ad-144.dat	upx
behavioral1/files/0x0005000000019426-134.dat	upx
behavioral1/files/0x00050000000193d0-120.dat	upx
behavioral1/files/0x000500000001939f-118.dat	upx
behavioral1/files/0x0005000000019358-116.dat	upx
behavioral1/files/0x00050000000192a1-114.dat	upx
behavioral1/memory/2624-107-0x000000013F2A0000-0x000000013F5F4000-memory.dmp	upx
behavioral1/memory/2456-103-0x000000013FD60000-0x00000001400B4000-memory.dmp	upx
behavioral1/files/0x00050000000193dc-123.dat	upx
behavioral1/files/0x0005000000019354-85.dat	upx
behavioral1/files/0x0005000000019299-84.dat	upx
behavioral1/memory/2760-69-0x000000013FA90000-0x000000013FDE4000-memory.dmp	upx
behavioral1/memory/2332-68-0x000000013FC10000-0x000000013FF64000-memory.dmp	upx
behavioral1/files/0x000500000001927a-67.dat	upx
behavioral1/files/0x00050000000193cc-98.dat	upx
behavioral1/files/0x000500000001938e-97.dat	upx
behavioral1/memory/1956-95-0x000000013F9E0000-0x000000013FD34000-memory.dmp	upx
behavioral1/memory/2480-74-0x000000013FCB0000-0x0000000140004000-memory.dmp	upx
behavioral1/memory/2820-64-0x000000013F310000-0x000000013F664000-memory.dmp	upx
behavioral1/files/0x0005000000019274-60.dat	upx
behavioral1/memory/2172-54-0x000000013F530000-0x000000013F884000-memory.dmp	upx
behavioral1/files/0x0007000000018697-52.dat	upx
behavioral1/files/0x00080000000174b4-29.dat	upx
behavioral1/memory/2480-27-0x000000013FCB0000-0x0000000140004000-memory.dmp	upx
behavioral1/files/0x00070000000175f7-23.dat	upx
behavioral1/memory/2872-47-0x000000013F170000-0x000000013F4C4000-memory.dmp	upx
behavioral1/memory/2496-46-0x000000013FCA0000-0x000000013FFF4000-memory.dmp	upx
behavioral1/files/0x000f000000018683-40.dat	upx
behavioral1/files/0x0007000000017570-38.dat	upx
behavioral1/memory/2456-37-0x000000013FD60000-0x00000001400B4000-memory.dmp	upx
behavioral1/memory/3060-4011-0x000000013F910000-0x000000013FC64000-memory.dmp	upx
behavioral1/memory/1992-4012-0x000000013F8C0000-0x000000013FC14000-memory.dmp	upx
behavioral1/memory/2456-4014-0x000000013FD60000-0x00000001400B4000-memory.dmp	upx
behavioral1/memory/2480-4013-0x000000013FCB0000-0x0000000140004000-memory.dmp	upx
behavioral1/memory/2872-4015-0x000000013F170000-0x000000013F4C4000-memory.dmp	upx
behavioral1/memory/2820-4016-0x000000013F310000-0x000000013F664000-memory.dmp	upx
behavioral1/memory/2296-4018-0x000000013F9B0000-0x000000013FD04000-memory.dmp	upx
behavioral1/memory/2172-4017-0x000000013F530000-0x000000013F884000-memory.dmp	upx
behavioral1/memory/2624-4019-0x000000013F2A0000-0x000000013F5F4000-memory.dmp	upx
behavioral1/memory/1956-4020-0x000000013F9E0000-0x000000013FD34000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\cPwjfIA.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\cEiWUXk.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\uMNszwT.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\onvKdIs.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\ODxZxtT.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\tzokCkN.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\zevLTpy.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\adLAoPf.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\nOmMKjp.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\OWMcRCT.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\qNyqkTj.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\mCGZnVB.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\yxvyHkV.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\zprUqrI.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\EYMsnhK.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\jZqqfvo.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\RIfitld.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\JKiSoIA.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\HzhFDJA.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\tZSTSdZ.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\eQPlvNL.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\jHSGSJM.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\iZhaMnf.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\JKJoDXF.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\TieVqJU.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\vtJAvQH.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\IUbpRtY.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\bsIdZhz.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\KnDyQCu.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\DNGrqZx.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\OcVOiKf.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\dkbSBsw.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\rDslVvC.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\pzRrnma.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\joUYDNu.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\hethmzD.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\kHpvJQn.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\UtKAAJC.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\rZoYIUJ.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\LMcNoom.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\UrNVfOp.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\MPCygHf.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\JplCAay.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\DfOZTnA.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\jUXBFJV.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\XuEsusY.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\ndUgkig.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\SfWYhME.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\QTKhCVF.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\hsbKGZf.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\efZPHyk.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\kYztwKW.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\SlBxvTG.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\BsvqLRL.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\HKnFtVn.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\OtVfeQU.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\pwsFLtv.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\gcWeQEp.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\BLnAIGb.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\zthjMnZ.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\xZMiPPu.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\KpsCijH.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\yMQNbsL.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
File created	C:\Windows\System\zApXVgB.exe	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 3060	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	32
PID 2332 wrote to memory of 3060	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	32
PID 2332 wrote to memory of 3060	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	32
PID 2332 wrote to memory of 2480	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	33
PID 2332 wrote to memory of 2480	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	33
PID 2332 wrote to memory of 2480	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	33
PID 2332 wrote to memory of 1992	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	34
PID 2332 wrote to memory of 1992	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	34
PID 2332 wrote to memory of 1992	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	34
PID 2332 wrote to memory of 2496	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	35
PID 2332 wrote to memory of 2496	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	35
PID 2332 wrote to memory of 2496	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	35
PID 2332 wrote to memory of 2456	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	36
PID 2332 wrote to memory of 2456	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	36
PID 2332 wrote to memory of 2456	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	36
PID 2332 wrote to memory of 2296	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	37
PID 2332 wrote to memory of 2296	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	37
PID 2332 wrote to memory of 2296	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	37
PID 2332 wrote to memory of 2872	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	38
PID 2332 wrote to memory of 2872	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	38
PID 2332 wrote to memory of 2872	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	38
PID 2332 wrote to memory of 2172	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	39
PID 2332 wrote to memory of 2172	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	39
PID 2332 wrote to memory of 2172	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	39
PID 2332 wrote to memory of 2820	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	40
PID 2332 wrote to memory of 2820	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	40
PID 2332 wrote to memory of 2820	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	40
PID 2332 wrote to memory of 2760	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	41
PID 2332 wrote to memory of 2760	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	41
PID 2332 wrote to memory of 2760	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	41
PID 2332 wrote to memory of 2624	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	42
PID 2332 wrote to memory of 2624	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	42
PID 2332 wrote to memory of 2624	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	42
PID 2332 wrote to memory of 2672	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	43
PID 2332 wrote to memory of 2672	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	43
PID 2332 wrote to memory of 2672	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	43
PID 2332 wrote to memory of 1956	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	44
PID 2332 wrote to memory of 1956	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	44
PID 2332 wrote to memory of 1956	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	44
PID 2332 wrote to memory of 2664	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	45
PID 2332 wrote to memory of 2664	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	45
PID 2332 wrote to memory of 2664	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	45
PID 2332 wrote to memory of 1952	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	46
PID 2332 wrote to memory of 1952	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	46
PID 2332 wrote to memory of 1952	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	46
PID 2332 wrote to memory of 2816	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	47
PID 2332 wrote to memory of 2816	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	47
PID 2332 wrote to memory of 2816	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	47
PID 2332 wrote to memory of 1404	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	48
PID 2332 wrote to memory of 1404	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	48
PID 2332 wrote to memory of 1404	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	48
PID 2332 wrote to memory of 3036	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	49
PID 2332 wrote to memory of 3036	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	49
PID 2332 wrote to memory of 3036	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	49
PID 2332 wrote to memory of 2948	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	50
PID 2332 wrote to memory of 2948	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	50
PID 2332 wrote to memory of 2948	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	50
PID 2332 wrote to memory of 3044	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	51
PID 2332 wrote to memory of 3044	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	51
PID 2332 wrote to memory of 3044	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	51
PID 2332 wrote to memory of 332	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	52
PID 2332 wrote to memory of 332	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	52
PID 2332 wrote to memory of 332	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	52
PID 2332 wrote to memory of 1800	2332	JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe	53

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55c62a38e6eb3f25db53bc5bf70044139243ade21a88633a3e467b2134f7b330.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\System\qTHewPH.exe
  C:\Windows\System\qTHewPH.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\nNPKULG.exe
  C:\Windows\System\nNPKULG.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\hgHtXVR.exe
  C:\Windows\System\hgHtXVR.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\aDBnoEb.exe
  C:\Windows\System\aDBnoEb.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\xgBjMKd.exe
  C:\Windows\System\xgBjMKd.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\xGawJQf.exe
  C:\Windows\System\xGawJQf.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\EzsoGvj.exe
  C:\Windows\System\EzsoGvj.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\dmnhyQQ.exe
  C:\Windows\System\dmnhyQQ.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\qITNIZR.exe
  C:\Windows\System\qITNIZR.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\HxcjmXD.exe
  C:\Windows\System\HxcjmXD.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\HfTLgae.exe
  C:\Windows\System\HfTLgae.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\EYnbOid.exe
  C:\Windows\System\EYnbOid.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\ubdzLyc.exe
  C:\Windows\System\ubdzLyc.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\PuxUICO.exe
  C:\Windows\System\PuxUICO.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\guweAlw.exe
  C:\Windows\System\guweAlw.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\eLWXXUC.exe
  C:\Windows\System\eLWXXUC.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\JhGpXAw.exe
  C:\Windows\System\JhGpXAw.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\nzJMfLg.exe
  C:\Windows\System\nzJMfLg.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\kAErgcn.exe
  C:\Windows\System\kAErgcn.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\mEHrwQB.exe
  C:\Windows\System\mEHrwQB.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\HfcnfZW.exe
  C:\Windows\System\HfcnfZW.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\sgPNFiy.exe
  C:\Windows\System\sgPNFiy.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\nZGjgsF.exe
  C:\Windows\System\nZGjgsF.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\RmyakoC.exe
  C:\Windows\System\RmyakoC.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\ChSEQbx.exe
  C:\Windows\System\ChSEQbx.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\gzBhvVn.exe
  C:\Windows\System\gzBhvVn.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\ExkUKTB.exe
  C:\Windows\System\ExkUKTB.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\DBUnoNX.exe
  C:\Windows\System\DBUnoNX.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\SfVcAZK.exe
  C:\Windows\System\SfVcAZK.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\kstyPwk.exe
  C:\Windows\System\kstyPwk.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\hqNAAsH.exe
  C:\Windows\System\hqNAAsH.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\IVKwxOV.exe
  C:\Windows\System\IVKwxOV.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\THfEghi.exe
  C:\Windows\System\THfEghi.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\IlpyiAE.exe
  C:\Windows\System\IlpyiAE.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\YeFUVPN.exe
  C:\Windows\System\YeFUVPN.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\LMurUzb.exe
  C:\Windows\System\LMurUzb.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\aILvdJT.exe
  C:\Windows\System\aILvdJT.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\ytJdVSO.exe
  C:\Windows\System\ytJdVSO.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\qJUSvlq.exe
  C:\Windows\System\qJUSvlq.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\sFIQpAj.exe
  C:\Windows\System\sFIQpAj.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\xJgzFrn.exe
  C:\Windows\System\xJgzFrn.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\RIYAUqZ.exe
  C:\Windows\System\RIYAUqZ.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\VqZvGDl.exe
  C:\Windows\System\VqZvGDl.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\gWcCNGO.exe
  C:\Windows\System\gWcCNGO.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\MliYjKX.exe
  C:\Windows\System\MliYjKX.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\dEsxisf.exe
  C:\Windows\System\dEsxisf.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\aVExNcT.exe
  C:\Windows\System\aVExNcT.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\kkVUDIS.exe
  C:\Windows\System\kkVUDIS.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\eozcfwZ.exe
  C:\Windows\System\eozcfwZ.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\LIpQnIa.exe
  C:\Windows\System\LIpQnIa.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\YJVrBDD.exe
  C:\Windows\System\YJVrBDD.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\oGuUBWR.exe
  C:\Windows\System\oGuUBWR.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\HDAQPZu.exe
  C:\Windows\System\HDAQPZu.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\emnlZtx.exe
  C:\Windows\System\emnlZtx.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\OSgcNqL.exe
  C:\Windows\System\OSgcNqL.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\wDiiCbU.exe
  C:\Windows\System\wDiiCbU.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\MPCygHf.exe
  C:\Windows\System\MPCygHf.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\IsWjddX.exe
  C:\Windows\System\IsWjddX.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\wTbRcdC.exe
  C:\Windows\System\wTbRcdC.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\GXdvRsB.exe
  C:\Windows\System\GXdvRsB.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\vrISiFV.exe
  C:\Windows\System\vrISiFV.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\cEiWUXk.exe
  C:\Windows\System\cEiWUXk.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\cxWbUlt.exe
  C:\Windows\System\cxWbUlt.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\xefPQww.exe
  C:\Windows\System\xefPQww.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\CbKlEgT.exe
  C:\Windows\System\CbKlEgT.exe
  2⤵
  PID:2940
- C:\Windows\System\dBcQiSm.exe
  C:\Windows\System\dBcQiSm.exe
  2⤵
  PID:2960
- C:\Windows\System\wtsJQBF.exe
  C:\Windows\System\wtsJQBF.exe
  2⤵
  PID:2004
- C:\Windows\System\KqnQQLl.exe
  C:\Windows\System\KqnQQLl.exe
  2⤵
  PID:1360
- C:\Windows\System\icGDENL.exe
  C:\Windows\System\icGDENL.exe
  2⤵
  PID:2396
- C:\Windows\System\ZgbHegA.exe
  C:\Windows\System\ZgbHegA.exe
  2⤵
  PID:2248
- C:\Windows\System\pnvIjPV.exe
  C:\Windows\System\pnvIjPV.exe
  2⤵
  PID:2080
- C:\Windows\System\xiRPAmQ.exe
  C:\Windows\System\xiRPAmQ.exe
  2⤵
  PID:1760
- C:\Windows\System\TsVkUiD.exe
  C:\Windows\System\TsVkUiD.exe
  2⤵
  PID:2488
- C:\Windows\System\NkDlcMR.exe
  C:\Windows\System\NkDlcMR.exe
  2⤵
  PID:1560
- C:\Windows\System\GhVkAJA.exe
  C:\Windows\System\GhVkAJA.exe
  2⤵
  PID:2188
- C:\Windows\System\EakNOqc.exe
  C:\Windows\System\EakNOqc.exe
  2⤵
  PID:2376
- C:\Windows\System\ZXpUVjT.exe
  C:\Windows\System\ZXpUVjT.exe
  2⤵
  PID:1476
- C:\Windows\System\aMRJgwI.exe
  C:\Windows\System\aMRJgwI.exe
  2⤵
  PID:744
- C:\Windows\System\jaNbfWq.exe
  C:\Windows\System\jaNbfWq.exe
  2⤵
  PID:2416
- C:\Windows\System\kuwMmfj.exe
  C:\Windows\System\kuwMmfj.exe
  2⤵
  PID:760
- C:\Windows\System\HNJKRvX.exe
  C:\Windows\System\HNJKRvX.exe
  2⤵
  PID:1852
- C:\Windows\System\hsBUIcO.exe
  C:\Windows\System\hsBUIcO.exe
  2⤵
  PID:2564
- C:\Windows\System\eVGLqMu.exe
  C:\Windows\System\eVGLqMu.exe
  2⤵
  PID:1656
- C:\Windows\System\RSDZHfo.exe
  C:\Windows\System\RSDZHfo.exe
  2⤵
  PID:1536
- C:\Windows\System\zYHVqEg.exe
  C:\Windows\System\zYHVqEg.exe
  2⤵
  PID:1920
- C:\Windows\System\SnRdizr.exe
  C:\Windows\System\SnRdizr.exe
  2⤵
  PID:2124
- C:\Windows\System\fITGXef.exe
  C:\Windows\System\fITGXef.exe
  2⤵
  PID:1524
- C:\Windows\System\OMkLSgw.exe
  C:\Windows\System\OMkLSgw.exe
  2⤵
  PID:2312
- C:\Windows\System\SMmWWfu.exe
  C:\Windows\System\SMmWWfu.exe
  2⤵
  PID:2900
- C:\Windows\System\UhUrtJM.exe
  C:\Windows\System\UhUrtJM.exe
  2⤵
  PID:2212
- C:\Windows\System\ROBZqRZ.exe
  C:\Windows\System\ROBZqRZ.exe
  2⤵
  PID:612
- C:\Windows\System\StbFmYq.exe
  C:\Windows\System\StbFmYq.exe
  2⤵
  PID:2448
- C:\Windows\System\ahIoFoD.exe
  C:\Windows\System\ahIoFoD.exe
  2⤵
  PID:2724
- C:\Windows\System\vgGGoRB.exe
  C:\Windows\System\vgGGoRB.exe
  2⤵
  PID:3040
- C:\Windows\System\THXAEPM.exe
  C:\Windows\System\THXAEPM.exe
  2⤵
  PID:3088
- C:\Windows\System\JhlPLaP.exe
  C:\Windows\System\JhlPLaP.exe
  2⤵
  PID:3108
- C:\Windows\System\GzYSoYm.exe
  C:\Windows\System\GzYSoYm.exe
  2⤵
  PID:3128
- C:\Windows\System\VBawJtx.exe
  C:\Windows\System\VBawJtx.exe
  2⤵
  PID:3144
- C:\Windows\System\HtCMqFW.exe
  C:\Windows\System\HtCMqFW.exe
  2⤵
  PID:3172
- C:\Windows\System\xwPbwAN.exe
  C:\Windows\System\xwPbwAN.exe
  2⤵
  PID:3188
- C:\Windows\System\xjGJAEo.exe
  C:\Windows\System\xjGJAEo.exe
  2⤵
  PID:3204
- C:\Windows\System\xjxOOKo.exe
  C:\Windows\System\xjxOOKo.exe
  2⤵
  PID:3228
- C:\Windows\System\bIlaWcK.exe
  C:\Windows\System\bIlaWcK.exe
  2⤵
  PID:3248
- C:\Windows\System\gOzlkMk.exe
  C:\Windows\System\gOzlkMk.exe
  2⤵
  PID:3264
- C:\Windows\System\mIcTvfG.exe
  C:\Windows\System\mIcTvfG.exe
  2⤵
  PID:3288
- C:\Windows\System\JKdQEDH.exe
  C:\Windows\System\JKdQEDH.exe
  2⤵
  PID:3304
- C:\Windows\System\lEhGIrK.exe
  C:\Windows\System\lEhGIrK.exe
  2⤵
  PID:3324
- C:\Windows\System\wGehXyT.exe
  C:\Windows\System\wGehXyT.exe
  2⤵
  PID:3340
- C:\Windows\System\HKnFtVn.exe
  C:\Windows\System\HKnFtVn.exe
  2⤵
  PID:3360
- C:\Windows\System\KNiTzdD.exe
  C:\Windows\System\KNiTzdD.exe
  2⤵
  PID:3376
- C:\Windows\System\cNAtsSp.exe
  C:\Windows\System\cNAtsSp.exe
  2⤵
  PID:3392
- C:\Windows\System\gPprUkx.exe
  C:\Windows\System\gPprUkx.exe
  2⤵
  PID:3412
- C:\Windows\System\jZJocZN.exe
  C:\Windows\System\jZJocZN.exe
  2⤵
  PID:3444
- C:\Windows\System\lnaMRrU.exe
  C:\Windows\System\lnaMRrU.exe
  2⤵
  PID:3472
- C:\Windows\System\Grjcohc.exe
  C:\Windows\System\Grjcohc.exe
  2⤵
  PID:3488
- C:\Windows\System\CVOUUKY.exe
  C:\Windows\System\CVOUUKY.exe
  2⤵
  PID:3504
- C:\Windows\System\tuxoYJY.exe
  C:\Windows\System\tuxoYJY.exe
  2⤵
  PID:3520
- C:\Windows\System\SuwVOjd.exe
  C:\Windows\System\SuwVOjd.exe
  2⤵
  PID:3544
- C:\Windows\System\LzSUdTb.exe
  C:\Windows\System\LzSUdTb.exe
  2⤵
  PID:3560
- C:\Windows\System\Vyrmsec.exe
  C:\Windows\System\Vyrmsec.exe
  2⤵
  PID:3584
- C:\Windows\System\wAApEev.exe
  C:\Windows\System\wAApEev.exe
  2⤵
  PID:3612
- C:\Windows\System\uNjHWtE.exe
  C:\Windows\System\uNjHWtE.exe
  2⤵
  PID:3628
- C:\Windows\System\mfDByUm.exe
  C:\Windows\System\mfDByUm.exe
  2⤵
  PID:3648
- C:\Windows\System\JplCAay.exe
  C:\Windows\System\JplCAay.exe
  2⤵
  PID:3668
- C:\Windows\System\XGgqkWP.exe
  C:\Windows\System\XGgqkWP.exe
  2⤵
  PID:3684
- C:\Windows\System\nTlDnrY.exe
  C:\Windows\System\nTlDnrY.exe
  2⤵
  PID:3708
- C:\Windows\System\YizSYdJ.exe
  C:\Windows\System\YizSYdJ.exe
  2⤵
  PID:3724
- C:\Windows\System\pBIAgpU.exe
  C:\Windows\System\pBIAgpU.exe
  2⤵
  PID:3740
- C:\Windows\System\fPedkEb.exe
  C:\Windows\System\fPedkEb.exe
  2⤵
  PID:3768
- C:\Windows\System\GfilyBI.exe
  C:\Windows\System\GfilyBI.exe
  2⤵
  PID:3784
- C:\Windows\System\KFdoCaw.exe
  C:\Windows\System\KFdoCaw.exe
  2⤵
  PID:3804
- C:\Windows\System\SuLvAdv.exe
  C:\Windows\System\SuLvAdv.exe
  2⤵
  PID:3828
- C:\Windows\System\mOXfBfw.exe
  C:\Windows\System\mOXfBfw.exe
  2⤵
  PID:3848
- C:\Windows\System\qTnydSi.exe
  C:\Windows\System\qTnydSi.exe
  2⤵
  PID:3868
- C:\Windows\System\iUJJDkk.exe
  C:\Windows\System\iUJJDkk.exe
  2⤵
  PID:3884
- C:\Windows\System\BNskQFL.exe
  C:\Windows\System\BNskQFL.exe
  2⤵
  PID:3908
- C:\Windows\System\wWaUAuF.exe
  C:\Windows\System\wWaUAuF.exe
  2⤵
  PID:3928
- C:\Windows\System\aSiaXsG.exe
  C:\Windows\System\aSiaXsG.exe
  2⤵
  PID:3944
- C:\Windows\System\QiSdpVY.exe
  C:\Windows\System\QiSdpVY.exe
  2⤵
  PID:3968
- C:\Windows\System\RJjpCJr.exe
  C:\Windows\System\RJjpCJr.exe
  2⤵
  PID:3984
- C:\Windows\System\QemgYIM.exe
  C:\Windows\System\QemgYIM.exe
  2⤵
  PID:4008
- C:\Windows\System\znHwnFW.exe
  C:\Windows\System\znHwnFW.exe
  2⤵
  PID:4028
- C:\Windows\System\kmxfKSU.exe
  C:\Windows\System\kmxfKSU.exe
  2⤵
  PID:4048
- C:\Windows\System\pklRuoZ.exe
  C:\Windows\System\pklRuoZ.exe
  2⤵
  PID:4064
- C:\Windows\System\qCmlZtL.exe
  C:\Windows\System\qCmlZtL.exe
  2⤵
  PID:4084
- C:\Windows\System\XIqRvRR.exe
  C:\Windows\System\XIqRvRR.exe
  2⤵
  PID:1188
- C:\Windows\System\rUkoFBA.exe
  C:\Windows\System\rUkoFBA.exe
  2⤵
  PID:1452
- C:\Windows\System\KRdDuVH.exe
  C:\Windows\System\KRdDuVH.exe
  2⤵
  PID:2116
- C:\Windows\System\TLiqZMp.exe
  C:\Windows\System\TLiqZMp.exe
  2⤵
  PID:1296
- C:\Windows\System\yjArPuM.exe
  C:\Windows\System\yjArPuM.exe
  2⤵
  PID:1704
- C:\Windows\System\kfSTZfq.exe
  C:\Windows\System\kfSTZfq.exe
  2⤵
  PID:2804
- C:\Windows\System\HoFbMJA.exe
  C:\Windows\System\HoFbMJA.exe
  2⤵
  PID:1464
- C:\Windows\System\nTAFYFY.exe
  C:\Windows\System\nTAFYFY.exe
  2⤵
  PID:1104
- C:\Windows\System\blWIAxf.exe
  C:\Windows\System\blWIAxf.exe
  2⤵
  PID:1980
- C:\Windows\System\NGHDDpk.exe
  C:\Windows\System\NGHDDpk.exe
  2⤵
  PID:2280
- C:\Windows\System\KKglPVx.exe
  C:\Windows\System\KKglPVx.exe
  2⤵
  PID:2056
- C:\Windows\System\xBIYTnW.exe
  C:\Windows\System\xBIYTnW.exe
  2⤵
  PID:268
- C:\Windows\System\sOyJBwv.exe
  C:\Windows\System\sOyJBwv.exe
  2⤵
  PID:1892
- C:\Windows\System\yxvyHkV.exe
  C:\Windows\System\yxvyHkV.exe
  2⤵
  PID:2216
- C:\Windows\System\iwpWOcu.exe
  C:\Windows\System\iwpWOcu.exe
  2⤵
  PID:2700
- C:\Windows\System\BfYFfFv.exe
  C:\Windows\System\BfYFfFv.exe
  2⤵
  PID:3096
- C:\Windows\System\CRTZVWU.exe
  C:\Windows\System\CRTZVWU.exe
  2⤵
  PID:3140
- C:\Windows\System\xyXzRgB.exe
  C:\Windows\System\xyXzRgB.exe
  2⤵
  PID:3004
- C:\Windows\System\dQKsAXD.exe
  C:\Windows\System\dQKsAXD.exe
  2⤵
  PID:3080
- C:\Windows\System\SFRWLfn.exe
  C:\Windows\System\SFRWLfn.exe
  2⤵
  PID:3156
- C:\Windows\System\sOUMlmV.exe
  C:\Windows\System\sOUMlmV.exe
  2⤵
  PID:3216
- C:\Windows\System\mrcpHtv.exe
  C:\Windows\System\mrcpHtv.exe
  2⤵
  PID:3160
- C:\Windows\System\zLhLoSM.exe
  C:\Windows\System\zLhLoSM.exe
  2⤵
  PID:3296
- C:\Windows\System\pIhQhKm.exe
  C:\Windows\System\pIhQhKm.exe
  2⤵
  PID:3400
- C:\Windows\System\kHpvJQn.exe
  C:\Windows\System\kHpvJQn.exe
  2⤵
  PID:3420
- C:\Windows\System\NMNlLTG.exe
  C:\Windows\System\NMNlLTG.exe
  2⤵
  PID:3348
- C:\Windows\System\ejKOwIc.exe
  C:\Windows\System\ejKOwIc.exe
  2⤵
  PID:3456
- C:\Windows\System\JeAphAi.exe
  C:\Windows\System\JeAphAi.exe
  2⤵
  PID:3528
- C:\Windows\System\rPNbcJT.exe
  C:\Windows\System\rPNbcJT.exe
  2⤵
  PID:3436
- C:\Windows\System\opzwZnv.exe
  C:\Windows\System\opzwZnv.exe
  2⤵
  PID:3512
- C:\Windows\System\ncgmvlD.exe
  C:\Windows\System\ncgmvlD.exe
  2⤵
  PID:3656
- C:\Windows\System\ROpdgkQ.exe
  C:\Windows\System\ROpdgkQ.exe
  2⤵
  PID:3696
- C:\Windows\System\DgqhhPl.exe
  C:\Windows\System\DgqhhPl.exe
  2⤵
  PID:3596
- C:\Windows\System\uMNszwT.exe
  C:\Windows\System\uMNszwT.exe
  2⤵
  PID:3644
- C:\Windows\System\hsbKGZf.exe
  C:\Windows\System\hsbKGZf.exe
  2⤵
  PID:3636
- C:\Windows\System\GNKfGxg.exe
  C:\Windows\System\GNKfGxg.exe
  2⤵
  PID:3780
- C:\Windows\System\cGLSqsi.exe
  C:\Windows\System\cGLSqsi.exe
  2⤵
  PID:3824
- C:\Windows\System\wATJVrc.exe
  C:\Windows\System\wATJVrc.exe
  2⤵
  PID:3900
- C:\Windows\System\sYtevuR.exe
  C:\Windows\System\sYtevuR.exe
  2⤵
  PID:3976
- C:\Windows\System\KqvGbrP.exe
  C:\Windows\System\KqvGbrP.exe
  2⤵
  PID:3756
- C:\Windows\System\Kxfqzhi.exe
  C:\Windows\System\Kxfqzhi.exe
  2⤵
  PID:3796
- C:\Windows\System\YGjHubA.exe
  C:\Windows\System\YGjHubA.exe
  2⤵
  PID:3876
- C:\Windows\System\yxrujrz.exe
  C:\Windows\System\yxrujrz.exe
  2⤵
  PID:3924
- C:\Windows\System\yMQNbsL.exe
  C:\Windows\System\yMQNbsL.exe
  2⤵
  PID:3992
- C:\Windows\System\kPymltY.exe
  C:\Windows\System\kPymltY.exe
  2⤵
  PID:4056
- C:\Windows\System\aczbGXm.exe
  C:\Windows\System\aczbGXm.exe
  2⤵
  PID:2884
- C:\Windows\System\rXuNZnH.exe
  C:\Windows\System\rXuNZnH.exe
  2⤵
  PID:3996
- C:\Windows\System\tHdPefs.exe
  C:\Windows\System\tHdPefs.exe
  2⤵
  PID:4044
- C:\Windows\System\ujnWyRJ.exe
  C:\Windows\System\ujnWyRJ.exe
  2⤵
  PID:2412
- C:\Windows\System\rbKANXw.exe
  C:\Windows\System\rbKANXw.exe
  2⤵
  PID:1240
- C:\Windows\System\YDYbrFR.exe
  C:\Windows\System\YDYbrFR.exe
  2⤵
  PID:1480
- C:\Windows\System\BHgmXXW.exe
  C:\Windows\System\BHgmXXW.exe
  2⤵
  PID:2780
- C:\Windows\System\cGkwsCr.exe
  C:\Windows\System\cGkwsCr.exe
  2⤵
  PID:3136
- C:\Windows\System\BaVsqRf.exe
  C:\Windows\System\BaVsqRf.exe
  2⤵
  PID:3212
- C:\Windows\System\jjDNQxk.exe
  C:\Windows\System\jjDNQxk.exe
  2⤵
  PID:872
- C:\Windows\System\rHleyoC.exe
  C:\Windows\System\rHleyoC.exe
  2⤵
  PID:2744
- C:\Windows\System\jmYsrCB.exe
  C:\Windows\System\jmYsrCB.exe
  2⤵
  PID:3120
- C:\Windows\System\JmcuDyD.exe
  C:\Windows\System\JmcuDyD.exe
  2⤵
  PID:3116
- C:\Windows\System\fUorxvy.exe
  C:\Windows\System\fUorxvy.exe
  2⤵
  PID:2136
- C:\Windows\System\ijXIAWg.exe
  C:\Windows\System\ijXIAWg.exe
  2⤵
  PID:3280
- C:\Windows\System\JHTshog.exe
  C:\Windows\System\JHTshog.exe
  2⤵
  PID:3372
- C:\Windows\System\KTLMrkm.exe
  C:\Windows\System\KTLMrkm.exe
  2⤵
  PID:3540
- C:\Windows\System\Bhjeodu.exe
  C:\Windows\System\Bhjeodu.exe
  2⤵
  PID:3576
- C:\Windows\System\yUNxMtS.exe
  C:\Windows\System\yUNxMtS.exe
  2⤵
  PID:3464
- C:\Windows\System\ICicPTr.exe
  C:\Windows\System\ICicPTr.exe
  2⤵
  PID:3568
- C:\Windows\System\rmqcqjI.exe
  C:\Windows\System\rmqcqjI.exe
  2⤵
  PID:3556
- C:\Windows\System\UtKAAJC.exe
  C:\Windows\System\UtKAAJC.exe
  2⤵
  PID:3608
- C:\Windows\System\OtVfeQU.exe
  C:\Windows\System\OtVfeQU.exe
  2⤵
  PID:3776
- C:\Windows\System\afGjbEM.exe
  C:\Windows\System\afGjbEM.exe
  2⤵
  PID:3764
- C:\Windows\System\fTUKaaR.exe
  C:\Windows\System\fTUKaaR.exe
  2⤵
  PID:3860
- C:\Windows\System\KAjDwPe.exe
  C:\Windows\System\KAjDwPe.exe
  2⤵
  PID:4020
- C:\Windows\System\pfYjkiW.exe
  C:\Windows\System\pfYjkiW.exe
  2⤵
  PID:3964
- C:\Windows\System\hkNlMOg.exe
  C:\Windows\System\hkNlMOg.exe
  2⤵
  PID:236
- C:\Windows\System\zApXVgB.exe
  C:\Windows\System\zApXVgB.exe
  2⤵
  PID:3748
- C:\Windows\System\IICiIuU.exe
  C:\Windows\System\IICiIuU.exe
  2⤵
  PID:4004
- C:\Windows\System\sAQXjna.exe
  C:\Windows\System\sAQXjna.exe
  2⤵
  PID:1888
- C:\Windows\System\RTMpFeF.exe
  C:\Windows\System\RTMpFeF.exe
  2⤵
  PID:1160
- C:\Windows\System\eXetFIO.exe
  C:\Windows\System\eXetFIO.exe
  2⤵
  PID:4116
- C:\Windows\System\CxMRxaH.exe
  C:\Windows\System\CxMRxaH.exe
  2⤵
  PID:4132
- C:\Windows\System\CgSKlVr.exe
  C:\Windows\System\CgSKlVr.exe
  2⤵
  PID:4156
- C:\Windows\System\qjROiYR.exe
  C:\Windows\System\qjROiYR.exe
  2⤵
  PID:4172
- C:\Windows\System\WSwWsIz.exe
  C:\Windows\System\WSwWsIz.exe
  2⤵
  PID:4188
- C:\Windows\System\tZSTSdZ.exe
  C:\Windows\System\tZSTSdZ.exe
  2⤵
  PID:4212
- C:\Windows\System\zdULgzg.exe
  C:\Windows\System\zdULgzg.exe
  2⤵
  PID:4228
- C:\Windows\System\FqUVTLX.exe
  C:\Windows\System\FqUVTLX.exe
  2⤵
  PID:4244
- C:\Windows\System\NrwBwlk.exe
  C:\Windows\System\NrwBwlk.exe
  2⤵
  PID:4268
- C:\Windows\System\JCozVTm.exe
  C:\Windows\System\JCozVTm.exe
  2⤵
  PID:4284
- C:\Windows\System\wkhGxTe.exe
  C:\Windows\System\wkhGxTe.exe
  2⤵
  PID:4308
- C:\Windows\System\eriOwKZ.exe
  C:\Windows\System\eriOwKZ.exe
  2⤵
  PID:4328
- C:\Windows\System\DbxYEcv.exe
  C:\Windows\System\DbxYEcv.exe
  2⤵
  PID:4380
- C:\Windows\System\cVREUBt.exe
  C:\Windows\System\cVREUBt.exe
  2⤵
  PID:4400
- C:\Windows\System\WooJyUC.exe
  C:\Windows\System\WooJyUC.exe
  2⤵
  PID:4416
- C:\Windows\System\hZWILwP.exe
  C:\Windows\System\hZWILwP.exe
  2⤵
  PID:4432
- C:\Windows\System\ATwXSvl.exe
  C:\Windows\System\ATwXSvl.exe
  2⤵
  PID:4452
- C:\Windows\System\YQsATiv.exe
  C:\Windows\System\YQsATiv.exe
  2⤵
  PID:4472
- C:\Windows\System\PYrwbpQ.exe
  C:\Windows\System\PYrwbpQ.exe
  2⤵
  PID:4496
- C:\Windows\System\EjrotHw.exe
  C:\Windows\System\EjrotHw.exe
  2⤵
  PID:4512
- C:\Windows\System\SvbQgUw.exe
  C:\Windows\System\SvbQgUw.exe
  2⤵
  PID:4536
- C:\Windows\System\aIetzrG.exe
  C:\Windows\System\aIetzrG.exe
  2⤵
  PID:4552
- C:\Windows\System\fiXSRqq.exe
  C:\Windows\System\fiXSRqq.exe
  2⤵
  PID:4568
- C:\Windows\System\zvvIdcL.exe
  C:\Windows\System\zvvIdcL.exe
  2⤵
  PID:4588
- C:\Windows\System\LylcTmV.exe
  C:\Windows\System\LylcTmV.exe
  2⤵
  PID:4608
- C:\Windows\System\LETOsyI.exe
  C:\Windows\System\LETOsyI.exe
  2⤵
  PID:4624
- C:\Windows\System\pAUoNIC.exe
  C:\Windows\System\pAUoNIC.exe
  2⤵
  PID:4648
- C:\Windows\System\SDIZeia.exe
  C:\Windows\System\SDIZeia.exe
  2⤵
  PID:4664
- C:\Windows\System\IYXKHcg.exe
  C:\Windows\System\IYXKHcg.exe
  2⤵
  PID:4680
- C:\Windows\System\EEvgteI.exe
  C:\Windows\System\EEvgteI.exe
  2⤵
  PID:4696
- C:\Windows\System\wskcLKl.exe
  C:\Windows\System\wskcLKl.exe
  2⤵
  PID:4712
- C:\Windows\System\efZPHyk.exe
  C:\Windows\System\efZPHyk.exe
  2⤵
  PID:4728
- C:\Windows\System\oKUFUxf.exe
  C:\Windows\System\oKUFUxf.exe
  2⤵
  PID:4744
- C:\Windows\System\pwsFLtv.exe
  C:\Windows\System\pwsFLtv.exe
  2⤵
  PID:4760
- C:\Windows\System\gcWeQEp.exe
  C:\Windows\System\gcWeQEp.exe
  2⤵
  PID:4788
- C:\Windows\System\CftTYJj.exe
  C:\Windows\System\CftTYJj.exe
  2⤵
  PID:4808
- C:\Windows\System\okgShBK.exe
  C:\Windows\System\okgShBK.exe
  2⤵
  PID:4828
- C:\Windows\System\bsIdZhz.exe
  C:\Windows\System\bsIdZhz.exe
  2⤵
  PID:4844
- C:\Windows\System\HzFpTnS.exe
  C:\Windows\System\HzFpTnS.exe
  2⤵
  PID:4868
- C:\Windows\System\TezzypV.exe
  C:\Windows\System\TezzypV.exe
  2⤵
  PID:4888
- C:\Windows\System\qIXBdMB.exe
  C:\Windows\System\qIXBdMB.exe
  2⤵
  PID:4940
- C:\Windows\System\ZjuaiJH.exe
  C:\Windows\System\ZjuaiJH.exe
  2⤵
  PID:4960
- C:\Windows\System\rKyBANQ.exe
  C:\Windows\System\rKyBANQ.exe
  2⤵
  PID:4980
- C:\Windows\System\mtPcggW.exe
  C:\Windows\System\mtPcggW.exe
  2⤵
  PID:5000
- C:\Windows\System\VombGvv.exe
  C:\Windows\System\VombGvv.exe
  2⤵
  PID:5016
- C:\Windows\System\ysMOKvF.exe
  C:\Windows\System\ysMOKvF.exe
  2⤵
  PID:5040
- C:\Windows\System\DzIoukB.exe
  C:\Windows\System\DzIoukB.exe
  2⤵
  PID:5060
- C:\Windows\System\YPumKmK.exe
  C:\Windows\System\YPumKmK.exe
  2⤵
  PID:5076
- C:\Windows\System\ZUjmYpM.exe
  C:\Windows\System\ZUjmYpM.exe
  2⤵
  PID:5096
- C:\Windows\System\JMgGmmN.exe
  C:\Windows\System\JMgGmmN.exe
  2⤵
  PID:5112
- C:\Windows\System\MmzfLMO.exe
  C:\Windows\System\MmzfLMO.exe
  2⤵
  PID:2204
- C:\Windows\System\BLnAIGb.exe
  C:\Windows\System\BLnAIGb.exe
  2⤵
  PID:3260
- C:\Windows\System\GvUkXFm.exe
  C:\Windows\System\GvUkXFm.exe
  2⤵
  PID:3300
- C:\Windows\System\jhEKRjZ.exe
  C:\Windows\System\jhEKRjZ.exe
  2⤵
  PID:3352
- C:\Windows\System\YRIUwGN.exe
  C:\Windows\System\YRIUwGN.exe
  2⤵
  PID:3536
- C:\Windows\System\jVipSBh.exe
  C:\Windows\System\jVipSBh.exe
  2⤵
  PID:2528
- C:\Windows\System\OHXeGcQ.exe
  C:\Windows\System\OHXeGcQ.exe
  2⤵
  PID:3936
- C:\Windows\System\JllCNJP.exe
  C:\Windows\System\JllCNJP.exe
  2⤵
  PID:3940
- C:\Windows\System\IQLWINY.exe
  C:\Windows\System\IQLWINY.exe
  2⤵
  PID:2320
- C:\Windows\System\emwamrA.exe
  C:\Windows\System\emwamrA.exe
  2⤵
  PID:4076
- C:\Windows\System\xZTsUhQ.exe
  C:\Windows\System\xZTsUhQ.exe
  2⤵
  PID:4168
- C:\Windows\System\SSPArEf.exe
  C:\Windows\System\SSPArEf.exe
  2⤵
  PID:3284
- C:\Windows\System\VCwBggy.exe
  C:\Windows\System\VCwBggy.exe
  2⤵
  PID:4196
- C:\Windows\System\bSgKsuX.exe
  C:\Windows\System\bSgKsuX.exe
  2⤵
  PID:3640
- C:\Windows\System\AZyKLqj.exe
  C:\Windows\System\AZyKLqj.exe
  2⤵
  PID:3880
- C:\Windows\System\GREPuNq.exe
  C:\Windows\System\GREPuNq.exe
  2⤵
  PID:3800
- C:\Windows\System\LZqcnsQ.exe
  C:\Windows\System\LZqcnsQ.exe
  2⤵
  PID:4200
- C:\Windows\System\FjLiYDB.exe
  C:\Windows\System\FjLiYDB.exe
  2⤵
  PID:4240
- C:\Windows\System\mYNVJIK.exe
  C:\Windows\System\mYNVJIK.exe
  2⤵
  PID:3956
- C:\Windows\System\azRIgRs.exe
  C:\Windows\System\azRIgRs.exe
  2⤵
  PID:4144
- C:\Windows\System\zprUqrI.exe
  C:\Windows\System\zprUqrI.exe
  2⤵
  PID:4220
- C:\Windows\System\KiOzJoB.exe
  C:\Windows\System\KiOzJoB.exe
  2⤵
  PID:4260
- C:\Windows\System\GAjScTs.exe
  C:\Windows\System\GAjScTs.exe
  2⤵
  PID:4396
- C:\Windows\System\DfXETyi.exe
  C:\Windows\System\DfXETyi.exe
  2⤵
  PID:4460
- C:\Windows\System\dRXLcEe.exe
  C:\Windows\System\dRXLcEe.exe
  2⤵
  PID:4508
- C:\Windows\System\XxLJfZg.exe
  C:\Windows\System\XxLJfZg.exe
  2⤵
  PID:4360
- C:\Windows\System\hAZWdCT.exe
  C:\Windows\System\hAZWdCT.exe
  2⤵
  PID:4584
- C:\Windows\System\cnNoXgu.exe
  C:\Windows\System\cnNoXgu.exe
  2⤵
  PID:4616
- C:\Windows\System\vOtIgxt.exe
  C:\Windows\System\vOtIgxt.exe
  2⤵
  PID:4440
- C:\Windows\System\xLiTOZH.exe
  C:\Windows\System\xLiTOZH.exe
  2⤵
  PID:4660
- C:\Windows\System\eQPlvNL.exe
  C:\Windows\System\eQPlvNL.exe
  2⤵
  PID:4520
- C:\Windows\System\NiMTBwl.exe
  C:\Windows\System\NiMTBwl.exe
  2⤵
  PID:4692
- C:\Windows\System\LToVhKw.exe
  C:\Windows\System\LToVhKw.exe
  2⤵
  PID:4800
- C:\Windows\System\rmcoTsh.exe
  C:\Windows\System\rmcoTsh.exe
  2⤵
  PID:4564
- C:\Windows\System\NVSbONn.exe
  C:\Windows\System\NVSbONn.exe
  2⤵
  PID:4676
- C:\Windows\System\DJYmQDB.exe
  C:\Windows\System\DJYmQDB.exe
  2⤵
  PID:4780
- C:\Windows\System\WmElePe.exe
  C:\Windows\System\WmElePe.exe
  2⤵
  PID:4824
- C:\Windows\System\rofNgSQ.exe
  C:\Windows\System\rofNgSQ.exe
  2⤵
  PID:4864
- C:\Windows\System\HZCptHy.exe
  C:\Windows\System\HZCptHy.exe
  2⤵
  PID:4956
- C:\Windows\System\SzRRReW.exe
  C:\Windows\System\SzRRReW.exe
  2⤵
  PID:4996
- C:\Windows\System\tbIAWCH.exe
  C:\Windows\System\tbIAWCH.exe
  2⤵
  PID:4912
- C:\Windows\System\xoBUSUx.exe
  C:\Windows\System\xoBUSUx.exe
  2⤵
  PID:4928
- C:\Windows\System\rQDcVMS.exe
  C:\Windows\System\rQDcVMS.exe
  2⤵
  PID:4976
- C:\Windows\System\PNtXOIZ.exe
  C:\Windows\System\PNtXOIZ.exe
  2⤵
  PID:5036
- C:\Windows\System\tTUeEJx.exe
  C:\Windows\System\tTUeEJx.exe
  2⤵
  PID:3200
- C:\Windows\System\ZgOpjGk.exe
  C:\Windows\System\ZgOpjGk.exe
  2⤵
  PID:3592
- C:\Windows\System\MBwRtQd.exe
  C:\Windows\System\MBwRtQd.exe
  2⤵
  PID:5092
- C:\Windows\System\NvpFDoa.exe
  C:\Windows\System\NvpFDoa.exe
  2⤵
  PID:3164
- C:\Windows\System\MeNEVUl.exe
  C:\Windows\System\MeNEVUl.exe
  2⤵
  PID:3428
- C:\Windows\System\EtCTDiL.exe
  C:\Windows\System\EtCTDiL.exe
  2⤵
  PID:5048
- C:\Windows\System\HIRBfkz.exe
  C:\Windows\System\HIRBfkz.exe
  2⤵
  PID:4036
- C:\Windows\System\zquorCq.exe
  C:\Windows\System\zquorCq.exe
  2⤵
  PID:3312
- C:\Windows\System\FCSIbnt.exe
  C:\Windows\System\FCSIbnt.exe
  2⤵
  PID:2364
- C:\Windows\System\rbhAEzP.exe
  C:\Windows\System\rbhAEzP.exe
  2⤵
  PID:4108
- C:\Windows\System\TjrbuOs.exe
  C:\Windows\System\TjrbuOs.exe
  2⤵
  PID:2708
- C:\Windows\System\Cmpmhyw.exe
  C:\Windows\System\Cmpmhyw.exe
  2⤵
  PID:3732
- C:\Windows\System\EpJDRUC.exe
  C:\Windows\System\EpJDRUC.exe
  2⤵
  PID:4316
- C:\Windows\System\NGaFqrt.exe
  C:\Windows\System\NGaFqrt.exe
  2⤵
  PID:4180
- C:\Windows\System\oBsLqdm.exe
  C:\Windows\System\oBsLqdm.exe
  2⤵
  PID:4124
- C:\Windows\System\uFFPnyQ.exe
  C:\Windows\System\uFFPnyQ.exe
  2⤵
  PID:4304
- C:\Windows\System\zthjMnZ.exe
  C:\Windows\System\zthjMnZ.exe
  2⤵
  PID:4424
- C:\Windows\System\EomazKs.exe
  C:\Windows\System\EomazKs.exe
  2⤵
  PID:4376
- C:\Windows\System\lXZPnAK.exe
  C:\Windows\System\lXZPnAK.exe
  2⤵
  PID:4836
- C:\Windows\System\DOWuaga.exe
  C:\Windows\System\DOWuaga.exe
  2⤵
  PID:4876
- C:\Windows\System\CdbvAWq.exe
  C:\Windows\System\CdbvAWq.exe
  2⤵
  PID:4488
- C:\Windows\System\wjILmdR.exe
  C:\Windows\System\wjILmdR.exe
  2⤵
  PID:4752
- C:\Windows\System\BCTzOMe.exe
  C:\Windows\System\BCTzOMe.exe
  2⤵
  PID:4644
- C:\Windows\System\bqpiNJh.exe
  C:\Windows\System\bqpiNJh.exe
  2⤵
  PID:4772
- C:\Windows\System\FUDVHfM.exe
  C:\Windows\System\FUDVHfM.exe
  2⤵
  PID:4988
- C:\Windows\System\yykIoFW.exe
  C:\Windows\System\yykIoFW.exe
  2⤵
  PID:4816
- C:\Windows\System\CAprtsr.exe
  C:\Windows\System\CAprtsr.exe
  2⤵
  PID:4904
- C:\Windows\System\uSTKogF.exe
  C:\Windows\System\uSTKogF.exe
  2⤵
  PID:4900
- C:\Windows\System\xZMiPPu.exe
  C:\Windows\System\xZMiPPu.exe
  2⤵
  PID:4972
- C:\Windows\System\vGPOsBF.exe
  C:\Windows\System\vGPOsBF.exe
  2⤵
  PID:1860
- C:\Windows\System\CEdsNGt.exe
  C:\Windows\System\CEdsNGt.exe
  2⤵
  PID:4236
- C:\Windows\System\KlepCeq.exe
  C:\Windows\System\KlepCeq.exe
  2⤵
  PID:5056
- C:\Windows\System\qqYPtVj.exe
  C:\Windows\System\qqYPtVj.exe
  2⤵
  PID:3184
- C:\Windows\System\DhCpedK.exe
  C:\Windows\System\DhCpedK.exe
  2⤵
  PID:3704
- C:\Windows\System\GtZpHnk.exe
  C:\Windows\System\GtZpHnk.exe
  2⤵
  PID:3692
- C:\Windows\System\IEAFosc.exe
  C:\Windows\System\IEAFosc.exe
  2⤵
  PID:5136
- C:\Windows\System\inIwzJR.exe
  C:\Windows\System\inIwzJR.exe
  2⤵
  PID:5152
- C:\Windows\System\HPcywGG.exe
  C:\Windows\System\HPcywGG.exe
  2⤵
  PID:5168
- C:\Windows\System\tpTjHpw.exe
  C:\Windows\System\tpTjHpw.exe
  2⤵
  PID:5192
- C:\Windows\System\RhnyVEa.exe
  C:\Windows\System\RhnyVEa.exe
  2⤵
  PID:5208
- C:\Windows\System\WiexKsi.exe
  C:\Windows\System\WiexKsi.exe
  2⤵
  PID:5228
- C:\Windows\System\Brfeibz.exe
  C:\Windows\System\Brfeibz.exe
  2⤵
  PID:5248
- C:\Windows\System\gxFBXdV.exe
  C:\Windows\System\gxFBXdV.exe
  2⤵
  PID:5272
- C:\Windows\System\jzyonFI.exe
  C:\Windows\System\jzyonFI.exe
  2⤵
  PID:5288
- C:\Windows\System\uSwJzqO.exe
  C:\Windows\System\uSwJzqO.exe
  2⤵
  PID:5304
- C:\Windows\System\XCkvEQH.exe
  C:\Windows\System\XCkvEQH.exe
  2⤵
  PID:5320
- C:\Windows\System\SZNwcUA.exe
  C:\Windows\System\SZNwcUA.exe
  2⤵
  PID:5344
- C:\Windows\System\VqwWSnD.exe
  C:\Windows\System\VqwWSnD.exe
  2⤵
  PID:5360
- C:\Windows\System\KlLInyl.exe
  C:\Windows\System\KlLInyl.exe
  2⤵
  PID:5380
- C:\Windows\System\CTvfcFY.exe
  C:\Windows\System\CTvfcFY.exe
  2⤵
  PID:5396
- C:\Windows\System\EbYomiR.exe
  C:\Windows\System\EbYomiR.exe
  2⤵
  PID:5420
- C:\Windows\System\KEcYPfd.exe
  C:\Windows\System\KEcYPfd.exe
  2⤵
  PID:5440
- C:\Windows\System\UmfvSsQ.exe
  C:\Windows\System\UmfvSsQ.exe
  2⤵
  PID:5456
- C:\Windows\System\ibgeVdM.exe
  C:\Windows\System\ibgeVdM.exe
  2⤵
  PID:5476
- C:\Windows\System\viAmhys.exe
  C:\Windows\System\viAmhys.exe
  2⤵
  PID:5516
- C:\Windows\System\yanpHpd.exe
  C:\Windows\System\yanpHpd.exe
  2⤵
  PID:5536
- C:\Windows\System\JECQvtE.exe
  C:\Windows\System\JECQvtE.exe
  2⤵
  PID:5552
- C:\Windows\System\kugLRXd.exe
  C:\Windows\System\kugLRXd.exe
  2⤵
  PID:5568
- C:\Windows\System\MwIwyXH.exe
  C:\Windows\System\MwIwyXH.exe
  2⤵
  PID:5584
- C:\Windows\System\rZoYIUJ.exe
  C:\Windows\System\rZoYIUJ.exe
  2⤵
  PID:5600
- C:\Windows\System\tPadCkb.exe
  C:\Windows\System\tPadCkb.exe
  2⤵
  PID:5616
- C:\Windows\System\rUKiTyB.exe
  C:\Windows\System\rUKiTyB.exe
  2⤵
  PID:5636
- C:\Windows\System\KnDyQCu.exe
  C:\Windows\System\KnDyQCu.exe
  2⤵
  PID:5652
- C:\Windows\System\bOVQOde.exe
  C:\Windows\System\bOVQOde.exe
  2⤵
  PID:5676
- C:\Windows\System\dEkILMf.exe
  C:\Windows\System\dEkILMf.exe
  2⤵
  PID:5696
- C:\Windows\System\VpJZrkU.exe
  C:\Windows\System\VpJZrkU.exe
  2⤵
  PID:5712
- C:\Windows\System\FZZPZPO.exe
  C:\Windows\System\FZZPZPO.exe
  2⤵
  PID:5728
- C:\Windows\System\pFLVzAS.exe
  C:\Windows\System\pFLVzAS.exe
  2⤵
  PID:5748
- C:\Windows\System\ZhnKFTi.exe
  C:\Windows\System\ZhnKFTi.exe
  2⤵
  PID:5764
- C:\Windows\System\aBEbXMa.exe
  C:\Windows\System\aBEbXMa.exe
  2⤵
  PID:5780
- C:\Windows\System\iyyLlXa.exe
  C:\Windows\System\iyyLlXa.exe
  2⤵
  PID:5796
- C:\Windows\System\cwyJDDI.exe
  C:\Windows\System\cwyJDDI.exe
  2⤵
  PID:5812
- C:\Windows\System\tvUuxxW.exe
  C:\Windows\System\tvUuxxW.exe
  2⤵
  PID:5832
- C:\Windows\System\VYtqoMx.exe
  C:\Windows\System\VYtqoMx.exe
  2⤵
  PID:5848
- C:\Windows\System\VGRnnjf.exe
  C:\Windows\System\VGRnnjf.exe
  2⤵
  PID:5864
- C:\Windows\System\erUGtrH.exe
  C:\Windows\System\erUGtrH.exe
  2⤵
  PID:5880
- C:\Windows\System\vBitxuh.exe
  C:\Windows\System\vBitxuh.exe
  2⤵
  PID:5904
- C:\Windows\System\zCRBODK.exe
  C:\Windows\System\zCRBODK.exe
  2⤵
  PID:5928
- C:\Windows\System\uEXbTkO.exe
  C:\Windows\System\uEXbTkO.exe
  2⤵
  PID:5944
- C:\Windows\System\IeZlTXf.exe
  C:\Windows\System\IeZlTXf.exe
  2⤵
  PID:5960
- C:\Windows\System\SSqeYvi.exe
  C:\Windows\System\SSqeYvi.exe
  2⤵
  PID:5980
- C:\Windows\System\uKFnyRG.exe
  C:\Windows\System\uKFnyRG.exe
  2⤵
  PID:6060
- C:\Windows\System\yBdlmSQ.exe
  C:\Windows\System\yBdlmSQ.exe
  2⤵
  PID:6076
- C:\Windows\System\JfgqznB.exe
  C:\Windows\System\JfgqznB.exe
  2⤵
  PID:6100
- C:\Windows\System\uxgQpqu.exe
  C:\Windows\System\uxgQpqu.exe
  2⤵
  PID:6116
- C:\Windows\System\upxihJp.exe
  C:\Windows\System\upxihJp.exe
  2⤵
  PID:4348
- C:\Windows\System\agxWlTt.exe
  C:\Windows\System\agxWlTt.exe
  2⤵
  PID:3896
- C:\Windows\System\UIPwgBI.exe
  C:\Windows\System\UIPwgBI.exe
  2⤵
  PID:4292
- C:\Windows\System\pCPtfKJ.exe
  C:\Windows\System\pCPtfKJ.exe
  2⤵
  PID:4104
- C:\Windows\System\OJRhVXb.exe
  C:\Windows\System\OJRhVXb.exe
  2⤵
  PID:4408
- C:\Windows\System\kiAPIjG.exe
  C:\Windows\System\kiAPIjG.exe
  2⤵
  PID:4504
- C:\Windows\System\nRagXQa.exe
  C:\Windows\System\nRagXQa.exe
  2⤵
  PID:4756
- C:\Windows\System\SfWYhME.exe
  C:\Windows\System\SfWYhME.exe
  2⤵
  PID:4884
- C:\Windows\System\KdSmcEF.exe
  C:\Windows\System\KdSmcEF.exe
  2⤵
  PID:4580
- C:\Windows\System\WCcXWsB.exe
  C:\Windows\System\WCcXWsB.exe
  2⤵
  PID:4484
- C:\Windows\System\aQEjACR.exe
  C:\Windows\System\aQEjACR.exe
  2⤵
  PID:5012
- C:\Windows\System\qlMJEeG.exe
  C:\Windows\System\qlMJEeG.exe
  2⤵
  PID:5108
- C:\Windows\System\jZqqfvo.exe
  C:\Windows\System\jZqqfvo.exe
  2⤵
  PID:5124
- C:\Windows\System\SlBxvTG.exe
  C:\Windows\System\SlBxvTG.exe
  2⤵
  PID:5204
- C:\Windows\System\plcGEoE.exe
  C:\Windows\System\plcGEoE.exe
  2⤵
  PID:5284
- C:\Windows\System\GixSnZS.exe
  C:\Windows\System\GixSnZS.exe
  2⤵
  PID:5388
- C:\Windows\System\MwyOoGa.exe
  C:\Windows\System\MwyOoGa.exe
  2⤵
  PID:5432
- C:\Windows\System\LRoxyDI.exe
  C:\Windows\System\LRoxyDI.exe
  2⤵
  PID:5524
- C:\Windows\System\QfySRWg.exe
  C:\Windows\System\QfySRWg.exe
  2⤵
  PID:5564
- C:\Windows\System\QTKhCVF.exe
  C:\Windows\System\QTKhCVF.exe
  2⤵
  PID:5624
- C:\Windows\System\BVmPCdd.exe
  C:\Windows\System\BVmPCdd.exe
  2⤵
  PID:5664
- C:\Windows\System\jLcKSMX.exe
  C:\Windows\System\jLcKSMX.exe
  2⤵
  PID:2752
- C:\Windows\System\vqGTzlc.exe
  C:\Windows\System\vqGTzlc.exe
  2⤵
  PID:1112
- C:\Windows\System\JEaQhYW.exe
  C:\Windows\System\JEaQhYW.exe
  2⤵
  PID:5180
- C:\Windows\System\PZiVmAv.exe
  C:\Windows\System\PZiVmAv.exe
  2⤵
  PID:5744
- C:\Windows\System\WjxugzU.exe
  C:\Windows\System\WjxugzU.exe
  2⤵
  PID:2472
- C:\Windows\System\byQRjDw.exe
  C:\Windows\System\byQRjDw.exe
  2⤵
  PID:2540
- C:\Windows\System\BMkyzIM.exe
  C:\Windows\System\BMkyzIM.exe
  2⤵
  PID:5216
- C:\Windows\System\QGzqJzA.exe
  C:\Windows\System\QGzqJzA.exe
  2⤵
  PID:5264
- C:\Windows\System\YScVMVT.exe
  C:\Windows\System\YScVMVT.exe
  2⤵
  PID:5336
- C:\Windows\System\NDUqWqb.exe
  C:\Windows\System\NDUqWqb.exe
  2⤵
  PID:5376
- C:\Windows\System\HiwguyI.exe
  C:\Windows\System\HiwguyI.exe
  2⤵
  PID:5448
- C:\Windows\System\cadJxXF.exe
  C:\Windows\System\cadJxXF.exe
  2⤵
  PID:5488
- C:\Windows\System\ABrNyIb.exe
  C:\Windows\System\ABrNyIb.exe
  2⤵
  PID:5924
- C:\Windows\System\ioBNabU.exe
  C:\Windows\System\ioBNabU.exe
  2⤵
  PID:5692
- C:\Windows\System\rxjeKkk.exe
  C:\Windows\System\rxjeKkk.exe
  2⤵
  PID:5892
- C:\Windows\System\SZHyeGG.exe
  C:\Windows\System\SZHyeGG.exe
  2⤵
  PID:5940
- C:\Windows\System\iQhMqVk.exe
  C:\Windows\System\iQhMqVk.exe
  2⤵
  PID:5724
- C:\Windows\System\Lyqqcdr.exe
  C:\Windows\System\Lyqqcdr.exe
  2⤵
  PID:5644
- C:\Windows\System\sPpgqMr.exe
  C:\Windows\System\sPpgqMr.exe
  2⤵
  PID:5548
- C:\Windows\System\cWjkNBs.exe
  C:\Windows\System\cWjkNBs.exe
  2⤵
  PID:5976
- C:\Windows\System\sIDUIYx.exe
  C:\Windows\System\sIDUIYx.exe
  2⤵
  PID:6004
- C:\Windows\System\EozbGhz.exe
  C:\Windows\System\EozbGhz.exe
  2⤵
  PID:6024
- C:\Windows\System\NIgaekv.exe
  C:\Windows\System\NIgaekv.exe
  2⤵
  PID:6044
- C:\Windows\System\KHynKFN.exe
  C:\Windows\System\KHynKFN.exe
  2⤵
  PID:6084
- C:\Windows\System\vhdmQsz.exe
  C:\Windows\System\vhdmQsz.exe
  2⤵
  PID:6108
- C:\Windows\System\MdCQxoF.exe
  C:\Windows\System\MdCQxoF.exe
  2⤵
  PID:2768
- C:\Windows\System\AUGLoIj.exe
  C:\Windows\System\AUGLoIj.exe
  2⤵
  PID:4336
- C:\Windows\System\foaCsaz.exe
  C:\Windows\System\foaCsaz.exe
  2⤵
  PID:4252
- C:\Windows\System\MTAotXD.exe
  C:\Windows\System\MTAotXD.exe
  2⤵
  PID:4936
- C:\Windows\System\KbBgvKz.exe
  C:\Windows\System\KbBgvKz.exe
  2⤵
  PID:4300
- C:\Windows\System\BeRAMOJ.exe
  C:\Windows\System\BeRAMOJ.exe
  2⤵
  PID:4948
- C:\Windows\System\LufOrDT.exe
  C:\Windows\System\LufOrDT.exe
  2⤵
  PID:4768
- C:\Windows\System\hiFlbqD.exe
  C:\Windows\System\hiFlbqD.exe
  2⤵
  PID:4860
- C:\Windows\System\VDHdCls.exe
  C:\Windows\System\VDHdCls.exe
  2⤵
  PID:2620
- C:\Windows\System\elaehnn.exe
  C:\Windows\System\elaehnn.exe
  2⤵
  PID:5436
- C:\Windows\System\EBxoejB.exe
  C:\Windows\System\EBxoejB.exe
  2⤵
  PID:5560
- C:\Windows\System\YuZCOXR.exe
  C:\Windows\System\YuZCOXR.exe
  2⤵
  PID:2824
- C:\Windows\System\KgjiyDm.exe
  C:\Windows\System\KgjiyDm.exe
  2⤵
  PID:5592
- C:\Windows\System\gePJlLy.exe
  C:\Windows\System\gePJlLy.exe
  2⤵
  PID:5052
- C:\Windows\System\IwOOZTZ.exe
  C:\Windows\System\IwOOZTZ.exe
  2⤵
  PID:5148
- C:\Windows\System\RhzAkvb.exe
  C:\Windows\System\RhzAkvb.exe
  2⤵
  PID:2808
- C:\Windows\System\KuuVdSX.exe
  C:\Windows\System\KuuVdSX.exe
  2⤵
  PID:5740
- C:\Windows\System\vFgzlZC.exe
  C:\Windows\System\vFgzlZC.exe
  2⤵
  PID:5772
- C:\Windows\System\gGaklFY.exe
  C:\Windows\System\gGaklFY.exe
  2⤵
  PID:5368
- C:\Windows\System\zRIoiPB.exe
  C:\Windows\System\zRIoiPB.exe
  2⤵
  PID:5372
- C:\Windows\System\nesnSLM.exe
  C:\Windows\System\nesnSLM.exe
  2⤵
  PID:5408
- C:\Windows\System\pSyxEZp.exe
  C:\Windows\System\pSyxEZp.exe
  2⤵
  PID:5916
- C:\Windows\System\agbDRIA.exe
  C:\Windows\System\agbDRIA.exe
  2⤵
  PID:5500
- C:\Windows\System\XsyoNlB.exe
  C:\Windows\System\XsyoNlB.exe
  2⤵
  PID:5920
- C:\Windows\System\fzMbvgR.exe
  C:\Windows\System\fzMbvgR.exe
  2⤵
  PID:5820
- C:\Windows\System\hejgCbT.exe
  C:\Windows\System\hejgCbT.exe
  2⤵
  PID:5688
- C:\Windows\System\RCuaMLX.exe
  C:\Windows\System\RCuaMLX.exe
  2⤵
  PID:5508
- C:\Windows\System\qXWXxGG.exe
  C:\Windows\System\qXWXxGG.exe
  2⤵
  PID:5576
- C:\Windows\System\kIrWpNM.exe
  C:\Windows\System\kIrWpNM.exe
  2⤵
  PID:6056
- C:\Windows\System\VaUTgtD.exe
  C:\Windows\System\VaUTgtD.exe
  2⤵
  PID:6140
- C:\Windows\System\hBhIAXS.exe
  C:\Windows\System\hBhIAXS.exe
  2⤵
  PID:3356
- C:\Windows\System\aZQTFtn.exe
  C:\Windows\System\aZQTFtn.exe
  2⤵
  PID:2316
- C:\Windows\System\mBMnQAW.exe
  C:\Windows\System\mBMnQAW.exe
  2⤵
  PID:4736
- C:\Windows\System\LRPlJXf.exe
  C:\Windows\System\LRPlJXf.exe
  2⤵
  PID:5128
- C:\Windows\System\dxotWro.exe
  C:\Windows\System\dxotWro.exe
  2⤵
  PID:4412
- C:\Windows\System\MDaSWxm.exe
  C:\Windows\System\MDaSWxm.exe
  2⤵
  PID:4576
- C:\Windows\System\RTHrcOH.exe
  C:\Windows\System\RTHrcOH.exe
  2⤵
  PID:4920
- C:\Windows\System\FeWUXIr.exe
  C:\Windows\System\FeWUXIr.exe
  2⤵
  PID:3572
- C:\Windows\System\qLzmpVT.exe
  C:\Windows\System\qLzmpVT.exe
  2⤵
  PID:5316
- C:\Windows\System\bNpoXjM.exe
  C:\Windows\System\bNpoXjM.exe
  2⤵
  PID:1092
- C:\Windows\System\avtHBtj.exe
  C:\Windows\System\avtHBtj.exe
  2⤵
  PID:5776
- C:\Windows\System\RfmalAP.exe
  C:\Windows\System\RfmalAP.exe
  2⤵
  PID:5956
- C:\Windows\System\VbbTJsh.exe
  C:\Windows\System\VbbTJsh.exe
  2⤵
  PID:5808
- C:\Windows\System\RVWXFLi.exe
  C:\Windows\System\RVWXFLi.exe
  2⤵
  PID:5872
- C:\Windows\System\WuDKUnZ.exe
  C:\Windows\System\WuDKUnZ.exe
  2⤵
  PID:5416
- C:\Windows\System\zFhpsnt.exe
  C:\Windows\System\zFhpsnt.exe
  2⤵
  PID:5888
- C:\Windows\System\zLZVhwU.exe
  C:\Windows\System\zLZVhwU.exe
  2⤵
  PID:5580
- C:\Windows\System\VSxbqLK.exe
  C:\Windows\System\VSxbqLK.exe
  2⤵
  PID:6020
- C:\Windows\System\TKEzfdU.exe
  C:\Windows\System\TKEzfdU.exe
  2⤵
  PID:6096
- C:\Windows\System\ejyJiGQ.exe
  C:\Windows\System\ejyJiGQ.exe
  2⤵
  PID:6156
- C:\Windows\System\dQGTmac.exe
  C:\Windows\System\dQGTmac.exe
  2⤵
  PID:6176
- C:\Windows\System\QXBXbGl.exe
  C:\Windows\System\QXBXbGl.exe
  2⤵
  PID:6196
- C:\Windows\System\XTtXsXY.exe
  C:\Windows\System\XTtXsXY.exe
  2⤵
  PID:6216
- C:\Windows\System\QlxfRPP.exe
  C:\Windows\System\QlxfRPP.exe
  2⤵
  PID:6236
- C:\Windows\System\StIASMT.exe
  C:\Windows\System\StIASMT.exe
  2⤵
  PID:6256
- C:\Windows\System\OBweVOJ.exe
  C:\Windows\System\OBweVOJ.exe
  2⤵
  PID:6276
- C:\Windows\System\ztQBpUz.exe
  C:\Windows\System\ztQBpUz.exe
  2⤵
  PID:6296
- C:\Windows\System\vELVknv.exe
  C:\Windows\System\vELVknv.exe
  2⤵
  PID:6316
- C:\Windows\System\sCVRtVF.exe
  C:\Windows\System\sCVRtVF.exe
  2⤵
  PID:6336
- C:\Windows\System\UocFRmZ.exe
  C:\Windows\System\UocFRmZ.exe
  2⤵
  PID:6356
- C:\Windows\System\PiHnAHR.exe
  C:\Windows\System\PiHnAHR.exe
  2⤵
  PID:6376
- C:\Windows\System\Djhfzxe.exe
  C:\Windows\System\Djhfzxe.exe
  2⤵
  PID:6396
- C:\Windows\System\gqGKAdh.exe
  C:\Windows\System\gqGKAdh.exe
  2⤵
  PID:6416
- C:\Windows\System\qarmKDZ.exe
  C:\Windows\System\qarmKDZ.exe
  2⤵
  PID:6436
- C:\Windows\System\GEMXotC.exe
  C:\Windows\System\GEMXotC.exe
  2⤵
  PID:6456
- C:\Windows\System\krfRSrh.exe
  C:\Windows\System\krfRSrh.exe
  2⤵
  PID:6476
- C:\Windows\System\CaQdWNq.exe
  C:\Windows\System\CaQdWNq.exe
  2⤵
  PID:6496
- C:\Windows\System\JPaiVci.exe
  C:\Windows\System\JPaiVci.exe
  2⤵
  PID:6516
- C:\Windows\System\hbtsVnh.exe
  C:\Windows\System\hbtsVnh.exe
  2⤵
  PID:6536
- C:\Windows\System\sZLawJG.exe
  C:\Windows\System\sZLawJG.exe
  2⤵
  PID:6556
- C:\Windows\System\btywiZq.exe
  C:\Windows\System\btywiZq.exe
  2⤵
  PID:6576
- C:\Windows\System\hnkQKXa.exe
  C:\Windows\System\hnkQKXa.exe
  2⤵
  PID:6596
- C:\Windows\System\oCLIoMz.exe
  C:\Windows\System\oCLIoMz.exe
  2⤵
  PID:6616
- C:\Windows\System\zuTYDWh.exe
  C:\Windows\System\zuTYDWh.exe
  2⤵
  PID:6636
- C:\Windows\System\MPQQMfz.exe
  C:\Windows\System\MPQQMfz.exe
  2⤵
  PID:6652
- C:\Windows\System\UDstZHG.exe
  C:\Windows\System\UDstZHG.exe
  2⤵
  PID:6672
- C:\Windows\System\aPDbJqe.exe
  C:\Windows\System\aPDbJqe.exe
  2⤵
  PID:6696
- C:\Windows\System\VYlvCEo.exe
  C:\Windows\System\VYlvCEo.exe
  2⤵
  PID:6716
- C:\Windows\System\MPBLOPD.exe
  C:\Windows\System\MPBLOPD.exe
  2⤵
  PID:6736
- C:\Windows\System\QZgBVSd.exe
  C:\Windows\System\QZgBVSd.exe
  2⤵
  PID:6756
- C:\Windows\System\NEZbImq.exe
  C:\Windows\System\NEZbImq.exe
  2⤵
  PID:6776
- C:\Windows\System\FmOzEeK.exe
  C:\Windows\System\FmOzEeK.exe
  2⤵
  PID:6796
- C:\Windows\System\ttzabCo.exe
  C:\Windows\System\ttzabCo.exe
  2⤵
  PID:6816
- C:\Windows\System\DYrXQIz.exe
  C:\Windows\System\DYrXQIz.exe
  2⤵
  PID:6836
- C:\Windows\System\eRHfHxU.exe
  C:\Windows\System\eRHfHxU.exe
  2⤵
  PID:6856
- C:\Windows\System\zNqgawW.exe
  C:\Windows\System\zNqgawW.exe
  2⤵
  PID:6872
- C:\Windows\System\UjrjwTu.exe
  C:\Windows\System\UjrjwTu.exe
  2⤵
  PID:6896
- C:\Windows\System\jHSGSJM.exe
  C:\Windows\System\jHSGSJM.exe
  2⤵
  PID:6916
- C:\Windows\System\SbzZJRW.exe
  C:\Windows\System\SbzZJRW.exe
  2⤵
  PID:6936
- C:\Windows\System\lJWWaNh.exe
  C:\Windows\System\lJWWaNh.exe
  2⤵
  PID:6952
- C:\Windows\System\rORxSjv.exe
  C:\Windows\System\rORxSjv.exe
  2⤵
  PID:6968
- C:\Windows\System\EiRRBxG.exe
  C:\Windows\System\EiRRBxG.exe
  2⤵
  PID:6996
- C:\Windows\System\zxkbpaM.exe
  C:\Windows\System\zxkbpaM.exe
  2⤵
  PID:7012
- C:\Windows\System\Duxkioj.exe
  C:\Windows\System\Duxkioj.exe
  2⤵
  PID:7032
- C:\Windows\System\wKNorSR.exe
  C:\Windows\System\wKNorSR.exe
  2⤵
  PID:7048
- C:\Windows\System\weBnTSt.exe
  C:\Windows\System\weBnTSt.exe
  2⤵
  PID:7072
- C:\Windows\System\mPYAhiC.exe
  C:\Windows\System\mPYAhiC.exe
  2⤵
  PID:7092
- C:\Windows\System\dxPqPos.exe
  C:\Windows\System\dxPqPos.exe
  2⤵
  PID:7108
- C:\Windows\System\IwLcVUU.exe
  C:\Windows\System\IwLcVUU.exe
  2⤵
  PID:7124
- C:\Windows\System\FIcXjQW.exe
  C:\Windows\System\FIcXjQW.exe
  2⤵
  PID:7148
- C:\Windows\System\vzTeaBK.exe
  C:\Windows\System\vzTeaBK.exe
  2⤵
  PID:7164
- C:\Windows\System\pTBgWCr.exe
  C:\Windows\System\pTBgWCr.exe
  2⤵
  PID:4532
- C:\Windows\System\huCLLAO.exe
  C:\Windows\System\huCLLAO.exe
  2⤵
  PID:4448
- C:\Windows\System\kIBYvAp.exe
  C:\Windows\System\kIBYvAp.exe
  2⤵
  PID:1016
- C:\Windows\System\rbdOAWT.exe
  C:\Windows\System\rbdOAWT.exe
  2⤵
  PID:1212
- C:\Windows\System\WixIRDH.exe
  C:\Windows\System\WixIRDH.exe
  2⤵
  PID:5428
- C:\Windows\System\fcQcNtK.exe
  C:\Windows\System\fcQcNtK.exe
  2⤵
  PID:2632
- C:\Windows\System\vNOEbHO.exe
  C:\Windows\System\vNOEbHO.exe
  2⤵
  PID:5704
- C:\Windows\System\KvsNwhP.exe
  C:\Windows\System\KvsNwhP.exe
  2⤵
  PID:2844
- C:\Windows\System\YRrvraw.exe
  C:\Windows\System\YRrvraw.exe
  2⤵
  PID:2068
- C:\Windows\System\nMNncQR.exe
  C:\Windows\System\nMNncQR.exe
  2⤵
  PID:5684
- C:\Windows\System\POcDOMB.exe
  C:\Windows\System\POcDOMB.exe
  2⤵
  PID:6016
- C:\Windows\System\dnEnlqC.exe
  C:\Windows\System\dnEnlqC.exe
  2⤵
  PID:6012
- C:\Windows\System\uoUlUNs.exe
  C:\Windows\System\uoUlUNs.exe
  2⤵
  PID:6168
- C:\Windows\System\SxUpwle.exe
  C:\Windows\System\SxUpwle.exe
  2⤵
  PID:6204
- C:\Windows\System\PAsJaJJ.exe
  C:\Windows\System\PAsJaJJ.exe
  2⤵
  PID:6252
- C:\Windows\System\RijbZpQ.exe
  C:\Windows\System\RijbZpQ.exe
  2⤵
  PID:6284
- C:\Windows\System\YbnwufL.exe
  C:\Windows\System\YbnwufL.exe
  2⤵
  PID:6304
- C:\Windows\System\KhgvNFw.exe
  C:\Windows\System\KhgvNFw.exe
  2⤵
  PID:6328
- C:\Windows\System\GmJpcKy.exe
  C:\Windows\System\GmJpcKy.exe
  2⤵
  PID:6352
- C:\Windows\System\ZajGXPt.exe
  C:\Windows\System\ZajGXPt.exe
  2⤵
  PID:6412
- C:\Windows\System\nFsjGQU.exe
  C:\Windows\System\nFsjGQU.exe
  2⤵
  PID:2764
- C:\Windows\System\gaWadNo.exe
  C:\Windows\System\gaWadNo.exe
  2⤵
  PID:6448
- C:\Windows\System\MbUBEGQ.exe
  C:\Windows\System\MbUBEGQ.exe
  2⤵
  PID:6464
- C:\Windows\System\etKxury.exe
  C:\Windows\System\etKxury.exe
  2⤵
  PID:6528
- C:\Windows\System\NcVYNCy.exe
  C:\Windows\System\NcVYNCy.exe
  2⤵
  PID:6572
- C:\Windows\System\PhHvhXy.exe
  C:\Windows\System\PhHvhXy.exe
  2⤵
  PID:6548
- C:\Windows\System\zPThAOn.exe
  C:\Windows\System\zPThAOn.exe
  2⤵
  PID:6584
- C:\Windows\System\YKWtEyJ.exe
  C:\Windows\System\YKWtEyJ.exe
  2⤵
  PID:6624
- C:\Windows\System\kYztwKW.exe
  C:\Windows\System\kYztwKW.exe
  2⤵
  PID:6684
- C:\Windows\System\hXjYagL.exe
  C:\Windows\System\hXjYagL.exe
  2⤵
  PID:6724
- C:\Windows\System\JhAjPVT.exe
  C:\Windows\System\JhAjPVT.exe
  2⤵
  PID:6768
- C:\Windows\System\VrsCzLY.exe
  C:\Windows\System\VrsCzLY.exe
  2⤵
  PID:6812
- C:\Windows\System\WJtzZMV.exe
  C:\Windows\System\WJtzZMV.exe
  2⤵
  PID:6844
- C:\Windows\System\csVHglk.exe
  C:\Windows\System\csVHglk.exe
  2⤵
  PID:6880
- C:\Windows\System\LMsFwAZ.exe
  C:\Windows\System\LMsFwAZ.exe
  2⤵
  PID:6744
- C:\Windows\System\hnvXYvZ.exe
  C:\Windows\System\hnvXYvZ.exe
  2⤵
  PID:6792
- C:\Windows\System\osTDBck.exe
  C:\Windows\System\osTDBck.exe
  2⤵
  PID:6864
- C:\Windows\System\TDMLupG.exe
  C:\Windows\System\TDMLupG.exe
  2⤵
  PID:7004
- C:\Windows\System\YmWgOvS.exe
  C:\Windows\System\YmWgOvS.exe
  2⤵
  PID:7044
- C:\Windows\System\DyhLWXV.exe
  C:\Windows\System\DyhLWXV.exe
  2⤵
  PID:7116
- C:\Windows\System\mZadZRY.exe
  C:\Windows\System\mZadZRY.exe
  2⤵
  PID:6908
- C:\Windows\System\YKyJHCO.exe
  C:\Windows\System\YKyJHCO.exe
  2⤵
  PID:6948
- C:\Windows\System\xtyQFQI.exe
  C:\Windows\System\xtyQFQI.exe
  2⤵
  PID:7028
- C:\Windows\System\xQnKBng.exe
  C:\Windows\System\xQnKBng.exe
  2⤵
  PID:2092
- C:\Windows\System\YAONeye.exe
  C:\Windows\System\YAONeye.exe
  2⤵
  PID:5660
- C:\Windows\System\wfkIiAC.exe
  C:\Windows\System\wfkIiAC.exe
  2⤵
  PID:7068
- C:\Windows\System\ummIHVI.exe
  C:\Windows\System\ummIHVI.exe
  2⤵
  PID:7136
- C:\Windows\System\LVECwpQ.exe
  C:\Windows\System\LVECwpQ.exe
  2⤵
  PID:1072
- C:\Windows\System\RnqjRpi.exe
  C:\Windows\System\RnqjRpi.exe
  2⤵
  PID:5328
- C:\Windows\System\fAuJntb.exe
  C:\Windows\System\fAuJntb.exe
  2⤵
  PID:2796
- C:\Windows\System\MqoLSQc.exe
  C:\Windows\System\MqoLSQc.exe
  2⤵
  PID:6032
- C:\Windows\System\smdCsXp.exe
  C:\Windows\System\smdCsXp.exe
  2⤵
  PID:4112
- C:\Windows\System\KxLFFqM.exe
  C:\Windows\System\KxLFFqM.exe
  2⤵
  PID:2936
- C:\Windows\System\gpNcFDl.exe
  C:\Windows\System\gpNcFDl.exe
  2⤵
  PID:2928
- C:\Windows\System\eYHgGhz.exe
  C:\Windows\System\eYHgGhz.exe
  2⤵
  PID:6232
- C:\Windows\System\fOgioCM.exe
  C:\Windows\System\fOgioCM.exe
  2⤵
  PID:6164
- C:\Windows\System\RNlZUXF.exe
  C:\Windows\System\RNlZUXF.exe
  2⤵
  PID:6372
- C:\Windows\System\MsQWqkY.exe
  C:\Windows\System\MsQWqkY.exe
  2⤵
  PID:6244
- C:\Windows\System\vgogEWS.exe
  C:\Windows\System\vgogEWS.exe
  2⤵
  PID:2668
- C:\Windows\System\REZAQPE.exe
  C:\Windows\System\REZAQPE.exe
  2⤵
  PID:6452
- C:\Windows\System\pOGxMou.exe
  C:\Windows\System\pOGxMou.exe
  2⤵
  PID:6532
- C:\Windows\System\bmpGBOe.exe
  C:\Windows\System\bmpGBOe.exe
  2⤵
  PID:6484
- C:\Windows\System\RHiMxrA.exe
  C:\Windows\System\RHiMxrA.exe
  2⤵
  PID:6544
- C:\Windows\System\mrwvESV.exe
  C:\Windows\System\mrwvESV.exe
  2⤵
  PID:6508
- C:\Windows\System\tLNrmay.exe
  C:\Windows\System\tLNrmay.exe
  2⤵
  PID:2868
- C:\Windows\System\sxPJEmY.exe
  C:\Windows\System\sxPJEmY.exe
  2⤵
  PID:2984
- C:\Windows\System\KECSLHb.exe
  C:\Windows\System\KECSLHb.exe
  2⤵
  PID:6628
- C:\Windows\System\kOQYkwa.exe
  C:\Windows\System\kOQYkwa.exe
  2⤵
  PID:532
- C:\Windows\System\UORFlkU.exe
  C:\Windows\System\UORFlkU.exe
  2⤵
  PID:1440
- C:\Windows\System\DfOZTnA.exe
  C:\Windows\System\DfOZTnA.exe
  2⤵
  PID:6648
- C:\Windows\System\MTHoqIs.exe
  C:\Windows\System\MTHoqIs.exe
  2⤵
  PID:6852
- C:\Windows\System\TQzFnhB.exe
  C:\Windows\System\TQzFnhB.exe
  2⤵
  PID:692
- C:\Windows\System\YzccWxl.exe
  C:\Windows\System\YzccWxl.exe
  2⤵
  PID:6704
- C:\Windows\System\oujyfWm.exe
  C:\Windows\System\oujyfWm.exe
  2⤵
  PID:6924
- C:\Windows\System\OzOIybX.exe
  C:\Windows\System\OzOIybX.exe
  2⤵
  PID:6928
- C:\Windows\System\VnlrYzz.exe
  C:\Windows\System\VnlrYzz.exe
  2⤵
  PID:6964
- C:\Windows\System\oxDRumw.exe
  C:\Windows\System\oxDRumw.exe
  2⤵
  PID:1696
- C:\Windows\System\lktynhy.exe
  C:\Windows\System\lktynhy.exe
  2⤵
  PID:6984
- C:\Windows\System\yHrTxoe.exe
  C:\Windows\System\yHrTxoe.exe
  2⤵
  PID:5164
- C:\Windows\System\QhfkVnU.exe
  C:\Windows\System\QhfkVnU.exe
  2⤵
  PID:7120
- C:\Windows\System\LMcNoom.exe
  C:\Windows\System\LMcNoom.exe
  2⤵
  PID:1664
- C:\Windows\System\EpGzLoG.exe
  C:\Windows\System\EpGzLoG.exe
  2⤵
  PID:6988
- C:\Windows\System\QcwWxck.exe
  C:\Windows\System\QcwWxck.exe
  2⤵
  PID:4632
- C:\Windows\System\nOmMKjp.exe
  C:\Windows\System\nOmMKjp.exe
  2⤵
  PID:2728
- C:\Windows\System\VzinnYR.exe
  C:\Windows\System\VzinnYR.exe
  2⤵
  PID:5512
- C:\Windows\System\iosDHWR.exe
  C:\Windows\System\iosDHWR.exe
  2⤵
  PID:2196
- C:\Windows\System\fIBKbSA.exe
  C:\Windows\System\fIBKbSA.exe
  2⤵
  PID:1512
- C:\Windows\System\HNbVrqM.exe
  C:\Windows\System\HNbVrqM.exe
  2⤵
  PID:2652
- C:\Windows\System\igydjIB.exe
  C:\Windows\System\igydjIB.exe
  2⤵
  PID:5352
- C:\Windows\System\ghXZpUb.exe
  C:\Windows\System\ghXZpUb.exe
  2⤵
  PID:6368
- C:\Windows\System\QdhJIvI.exe
  C:\Windows\System\QdhJIvI.exe
  2⤵
  PID:2628
- C:\Windows\System\AepQdgy.exe
  C:\Windows\System\AepQdgy.exe
  2⤵
  PID:6444
- C:\Windows\System\iZhaMnf.exe
  C:\Windows\System\iZhaMnf.exe
  2⤵
  PID:6428
- C:\Windows\System\kitDypW.exe
  C:\Windows\System\kitDypW.exe
  2⤵
  PID:2368
- C:\Windows\System\QCKXany.exe
  C:\Windows\System\QCKXany.exe
  2⤵
  PID:6344
- C:\Windows\System\TQoCMij.exe
  C:\Windows\System\TQoCMij.exe
  2⤵
  PID:6608
- C:\Windows\System\XlrTPYW.exe
  C:\Windows\System\XlrTPYW.exe
  2⤵
  PID:2736
- C:\Windows\System\ifxQtwL.exe
  C:\Windows\System\ifxQtwL.exe
  2⤵
  PID:6712
- C:\Windows\System\emDHBnp.exe
  C:\Windows\System\emDHBnp.exe
  2⤵
  PID:7088
- C:\Windows\System\qPCVMzx.exe
  C:\Windows\System\qPCVMzx.exe
  2⤵
  PID:2100
- C:\Windows\System\zSBRlRr.exe
  C:\Windows\System\zSBRlRr.exe
  2⤵
  PID:5280
- C:\Windows\System\xNfxaHs.exe
  C:\Windows\System\xNfxaHs.exe
  2⤵
  PID:2748
- C:\Windows\System\bkJCEwz.exe
  C:\Windows\System\bkJCEwz.exe
  2⤵
  PID:5996
- C:\Windows\System\JKJoDXF.exe
  C:\Windows\System\JKJoDXF.exe
  2⤵
  PID:6888
- C:\Windows\System\KpsCijH.exe
  C:\Windows\System\KpsCijH.exe
  2⤵
  PID:3104
- C:\Windows\System\qzNJnHt.exe
  C:\Windows\System\qzNJnHt.exe
  2⤵
  PID:6312
- C:\Windows\System\TnzMthj.exe
  C:\Windows\System\TnzMthj.exe
  2⤵
  PID:2784
- C:\Windows\System\LHqIOYX.exe
  C:\Windows\System\LHqIOYX.exe
  2⤵
  PID:2848
- C:\Windows\System\AKVZMNj.exe
  C:\Windows\System\AKVZMNj.exe
  2⤵
  PID:6136
- C:\Windows\System\TMGhNiL.exe
  C:\Windows\System\TMGhNiL.exe
  2⤵
  PID:6664
- C:\Windows\System\kqhCHvD.exe
  C:\Windows\System\kqhCHvD.exe
  2⤵
  PID:7064
- C:\Windows\System\ZhTygzE.exe
  C:\Windows\System\ZhTygzE.exe
  2⤵
  PID:868
- C:\Windows\System\GLaCKOk.exe
  C:\Windows\System\GLaCKOk.exe
  2⤵
  PID:6944
- C:\Windows\System\YZHgwSt.exe
  C:\Windows\System\YZHgwSt.exe
  2⤵
  PID:5844
- C:\Windows\System\OWMcRCT.exe
  C:\Windows\System\OWMcRCT.exe
  2⤵
  PID:6824
- C:\Windows\System\WwcXPRy.exe
  C:\Windows\System\WwcXPRy.exe
  2⤵
  PID:7132
- C:\Windows\System\IBTdkle.exe
  C:\Windows\System\IBTdkle.exe
  2⤵
  PID:4164
- C:\Windows\System\kGASpYV.exe
  C:\Windows\System\kGASpYV.exe
  2⤵
  PID:740
- C:\Windows\System\GZmacJn.exe
  C:\Windows\System\GZmacJn.exe
  2⤵
  PID:764
- C:\Windows\System\gwGeaND.exe
  C:\Windows\System\gwGeaND.exe
  2⤵
  PID:6892
- C:\Windows\System\pimRrEo.exe
  C:\Windows\System\pimRrEo.exe
  2⤵
  PID:6308
- C:\Windows\System\JuZtwQn.exe
  C:\Windows\System\JuZtwQn.exe
  2⤵
  PID:6128
- C:\Windows\System\TjujgYE.exe
  C:\Windows\System\TjujgYE.exe
  2⤵
  PID:2732
- C:\Windows\System\aQRcAGk.exe
  C:\Windows\System\aQRcAGk.exe
  2⤵
  PID:6904
- C:\Windows\System\tTbJcCz.exe
  C:\Windows\System\tTbJcCz.exe
  2⤵
  PID:7180
- C:\Windows\System\oqvNOgu.exe
  C:\Windows\System\oqvNOgu.exe
  2⤵
  PID:7212
- C:\Windows\System\TlgwJLk.exe
  C:\Windows\System\TlgwJLk.exe
  2⤵
  PID:7228
- C:\Windows\System\KZQJMPY.exe
  C:\Windows\System\KZQJMPY.exe
  2⤵
  PID:7248
- C:\Windows\System\bqNRKGu.exe
  C:\Windows\System\bqNRKGu.exe
  2⤵
  PID:7264
- C:\Windows\System\QKSFhKv.exe
  C:\Windows\System\QKSFhKv.exe
  2⤵
  PID:7280
- C:\Windows\System\SMihqqs.exe
  C:\Windows\System\SMihqqs.exe
  2⤵
  PID:7308
- C:\Windows\System\AHQupqm.exe
  C:\Windows\System\AHQupqm.exe
  2⤵
  PID:7332
- C:\Windows\System\cPwjfIA.exe
  C:\Windows\System\cPwjfIA.exe
  2⤵
  PID:7348
- C:\Windows\System\LRIRVZd.exe
  C:\Windows\System\LRIRVZd.exe
  2⤵
  PID:7364
- C:\Windows\System\FMMsflp.exe
  C:\Windows\System\FMMsflp.exe
  2⤵
  PID:7380
- C:\Windows\System\eKJXBtu.exe
  C:\Windows\System\eKJXBtu.exe
  2⤵
  PID:7396
- C:\Windows\System\bsyirqN.exe
  C:\Windows\System\bsyirqN.exe
  2⤵
  PID:7416
- C:\Windows\System\ioUSAbL.exe
  C:\Windows\System\ioUSAbL.exe
  2⤵
  PID:7440
- C:\Windows\System\GxmghNS.exe
  C:\Windows\System\GxmghNS.exe
  2⤵
  PID:7456
- C:\Windows\System\ZVhfoEh.exe
  C:\Windows\System\ZVhfoEh.exe
  2⤵
  PID:7480
- C:\Windows\System\DIQwLWJ.exe
  C:\Windows\System\DIQwLWJ.exe
  2⤵
  PID:7500
- C:\Windows\System\DeWUIGD.exe
  C:\Windows\System\DeWUIGD.exe
  2⤵
  PID:7516
- C:\Windows\System\DpOsihy.exe
  C:\Windows\System\DpOsihy.exe
  2⤵
  PID:7544
- C:\Windows\System\didnQOE.exe
  C:\Windows\System\didnQOE.exe
  2⤵
  PID:7560
- C:\Windows\System\FDOmDRL.exe
  C:\Windows\System\FDOmDRL.exe
  2⤵
  PID:7576
- C:\Windows\System\PGhdYmQ.exe
  C:\Windows\System\PGhdYmQ.exe
  2⤵
  PID:7592
- C:\Windows\System\uGpJBJK.exe
  C:\Windows\System\uGpJBJK.exe
  2⤵
  PID:7608
- C:\Windows\System\AxkBPDj.exe
  C:\Windows\System\AxkBPDj.exe
  2⤵
  PID:7628
- C:\Windows\System\byWIrDR.exe
  C:\Windows\System\byWIrDR.exe
  2⤵
  PID:7648
- C:\Windows\System\YoqXdfc.exe
  C:\Windows\System\YoqXdfc.exe
  2⤵
  PID:7664
- C:\Windows\System\qgGKUiH.exe
  C:\Windows\System\qgGKUiH.exe
  2⤵
  PID:7684
- C:\Windows\System\gpxqfwC.exe
  C:\Windows\System\gpxqfwC.exe
  2⤵
  PID:7704
- C:\Windows\System\KXypzyy.exe
  C:\Windows\System\KXypzyy.exe
  2⤵
  PID:7720
- C:\Windows\System\OKJdpgI.exe
  C:\Windows\System\OKJdpgI.exe
  2⤵
  PID:7736
- C:\Windows\System\fUhiYyS.exe
  C:\Windows\System\fUhiYyS.exe
  2⤵
  PID:7752
- C:\Windows\System\glHVjPx.exe
  C:\Windows\System\glHVjPx.exe
  2⤵
  PID:7780
- C:\Windows\System\litRETp.exe
  C:\Windows\System\litRETp.exe
  2⤵
  PID:7800
- C:\Windows\System\lLQdoBz.exe
  C:\Windows\System\lLQdoBz.exe
  2⤵
  PID:7816
- C:\Windows\System\CGMTeFz.exe
  C:\Windows\System\CGMTeFz.exe
  2⤵
  PID:7832
- C:\Windows\System\WajvcQW.exe
  C:\Windows\System\WajvcQW.exe
  2⤵
  PID:7848
- C:\Windows\System\HvpoTUR.exe
  C:\Windows\System\HvpoTUR.exe
  2⤵
  PID:7864
- C:\Windows\System\RIfitld.exe
  C:\Windows\System\RIfitld.exe
  2⤵
  PID:7880
- C:\Windows\System\GhAblMt.exe
  C:\Windows\System\GhAblMt.exe
  2⤵
  PID:7900
- C:\Windows\System\NmqDioy.exe
  C:\Windows\System\NmqDioy.exe
  2⤵
  PID:7920
- C:\Windows\System\HZoshIV.exe
  C:\Windows\System\HZoshIV.exe
  2⤵
  PID:7940
- C:\Windows\System\SirjjVH.exe
  C:\Windows\System\SirjjVH.exe
  2⤵
  PID:7964
- C:\Windows\System\poQYTmS.exe
  C:\Windows\System\poQYTmS.exe
  2⤵
  PID:7980
- C:\Windows\System\kGjySSh.exe
  C:\Windows\System\kGjySSh.exe
  2⤵
  PID:7996
- C:\Windows\System\QXKvLKr.exe
  C:\Windows\System\QXKvLKr.exe
  2⤵
  PID:8012
- C:\Windows\System\FTzKqcs.exe
  C:\Windows\System\FTzKqcs.exe
  2⤵
  PID:8036
- C:\Windows\System\aFiSzoW.exe
  C:\Windows\System\aFiSzoW.exe
  2⤵
  PID:8056
- C:\Windows\System\AhcSJSp.exe
  C:\Windows\System\AhcSJSp.exe
  2⤵
  PID:8072
- C:\Windows\System\VMJakaj.exe
  C:\Windows\System\VMJakaj.exe
  2⤵
  PID:8092
- C:\Windows\System\FjXumdi.exe
  C:\Windows\System\FjXumdi.exe
  2⤵
  PID:8112
- C:\Windows\System\dOwTlpA.exe
  C:\Windows\System\dOwTlpA.exe
  2⤵
  PID:8128
- C:\Windows\System\MpZrGoc.exe
  C:\Windows\System\MpZrGoc.exe
  2⤵
  PID:8148
- C:\Windows\System\WeWEUbY.exe
  C:\Windows\System\WeWEUbY.exe
  2⤵
  PID:8168
- C:\Windows\System\deGVxNv.exe
  C:\Windows\System\deGVxNv.exe
  2⤵
  PID:8188
- C:\Windows\System\drPkjeP.exe
  C:\Windows\System\drPkjeP.exe
  2⤵
  PID:6764
- C:\Windows\System\ugPcADZ.exe
  C:\Windows\System\ugPcADZ.exe
  2⤵
  PID:6192
- C:\Windows\System\veUQRHl.exe
  C:\Windows\System\veUQRHl.exe
  2⤵
  PID:7192
- C:\Windows\System\naodHaz.exe
  C:\Windows\System\naodHaz.exe
  2⤵
  PID:7204
- C:\Windows\System\qopYTOt.exe
  C:\Windows\System\qopYTOt.exe
  2⤵
  PID:7272
- C:\Windows\System\zHZEEyL.exe
  C:\Windows\System\zHZEEyL.exe
  2⤵
  PID:6588
- C:\Windows\System\lqTRoIW.exe
  C:\Windows\System\lqTRoIW.exe
  2⤵
  PID:6960
- C:\Windows\System\blzWoHm.exe
  C:\Windows\System\blzWoHm.exe
  2⤵
  PID:7320
- C:\Windows\System\sKtzHZm.exe
  C:\Windows\System\sKtzHZm.exe
  2⤵
  PID:7360
- C:\Windows\System\sWycwZW.exe
  C:\Windows\System\sWycwZW.exe
  2⤵
  PID:7424
- C:\Windows\System\HZKXvrN.exe
  C:\Windows\System\HZKXvrN.exe
  2⤵
  PID:7552
- C:\Windows\System\JtCekXA.exe
  C:\Windows\System\JtCekXA.exe
  2⤵
  PID:7468
- C:\Windows\System\dmGcZkT.exe
  C:\Windows\System\dmGcZkT.exe
  2⤵
  PID:7512
- C:\Windows\System\bDitsdz.exe
  C:\Windows\System\bDitsdz.exe
  2⤵
  PID:7692
- C:\Windows\System\NUpXYTI.exe
  C:\Windows\System\NUpXYTI.exe
  2⤵
  PID:7808
- C:\Windows\System\SiwyUhO.exe
  C:\Windows\System\SiwyUhO.exe
  2⤵
  PID:7876
- C:\Windows\System\uRQGEnq.exe
  C:\Windows\System\uRQGEnq.exe
  2⤵
  PID:7908
- C:\Windows\System\UjEsDlR.exe
  C:\Windows\System\UjEsDlR.exe
  2⤵
  PID:7916
- C:\Windows\System\osxPoGx.exe
  C:\Windows\System\osxPoGx.exe
  2⤵
  PID:7960
- C:\Windows\System\KxxpVow.exe
  C:\Windows\System\KxxpVow.exe
  2⤵
  PID:8024
- C:\Windows\System\IAxsUDX.exe
  C:\Windows\System\IAxsUDX.exe
  2⤵
  PID:8064
- C:\Windows\System\BZUiKaQ.exe
  C:\Windows\System\BZUiKaQ.exe
  2⤵
  PID:6068
- C:\Windows\System\RnMvFTi.exe
  C:\Windows\System\RnMvFTi.exe
  2⤵
  PID:8144
- C:\Windows\System\KrKxxeY.exe
  C:\Windows\System\KrKxxeY.exe
  2⤵
  PID:7276
- C:\Windows\System\YLodTJx.exe
  C:\Windows\System\YLodTJx.exe
  2⤵
  PID:7472
- C:\Windows\System\MiKjJCa.exe
  C:\Windows\System\MiKjJCa.exe
  2⤵
  PID:7844
- C:\Windows\System\ePvkzJO.exe
  C:\Windows\System\ePvkzJO.exe
  2⤵
  PID:7224
- C:\Windows\System\JfMENbz.exe
  C:\Windows\System\JfMENbz.exe
  2⤵
  PID:7992
- C:\Windows\System\MNZNglI.exe
  C:\Windows\System\MNZNglI.exe
  2⤵
  PID:8176
- C:\Windows\System\ePujTBk.exe
  C:\Windows\System\ePujTBk.exe
  2⤵
  PID:7404
- C:\Windows\System\fKNGbTe.exe
  C:\Windows\System\fKNGbTe.exe
  2⤵
  PID:6492
- C:\Windows\System\mAfhsvV.exe
  C:\Windows\System\mAfhsvV.exe
  2⤵
  PID:992
- C:\Windows\System\uxFNZBz.exe
  C:\Windows\System\uxFNZBz.exe
  2⤵
  PID:7260
- C:\Windows\System\wzziMwA.exe
  C:\Windows\System\wzziMwA.exe
  2⤵
  PID:7712
- C:\Windows\System\TVtjeMa.exe
  C:\Windows\System\TVtjeMa.exe
  2⤵
  PID:8004
- C:\Windows\System\hLITVRS.exe
  C:\Windows\System\hLITVRS.exe
  2⤵
  PID:7296
- C:\Windows\System\raztmrE.exe
  C:\Windows\System\raztmrE.exe
  2⤵
  PID:7376
- C:\Windows\System\TieVqJU.exe
  C:\Windows\System\TieVqJU.exe
  2⤵
  PID:7952
- C:\Windows\System\lozNRed.exe
  C:\Windows\System\lozNRed.exe
  2⤵
  PID:7452
- C:\Windows\System\wHRfLmF.exe
  C:\Windows\System\wHRfLmF.exe
  2⤵
  PID:7568
- C:\Windows\System\jzYezEo.exe
  C:\Windows\System\jzYezEo.exe
  2⤵
  PID:7676
- C:\Windows\System\uXabbHH.exe
  C:\Windows\System\uXabbHH.exe
  2⤵
  PID:7792
- C:\Windows\System\BsvqLRL.exe
  C:\Windows\System\BsvqLRL.exe
  2⤵
  PID:7892
- C:\Windows\System\xEuieLK.exe
  C:\Windows\System\xEuieLK.exe
  2⤵
  PID:7976
- C:\Windows\System\UYevPsP.exe
  C:\Windows\System\UYevPsP.exe
  2⤵
  PID:8124
- C:\Windows\System\FsopTkq.exe
  C:\Windows\System\FsopTkq.exe
  2⤵
  PID:6564
- C:\Windows\System\uMPIvpL.exe
  C:\Windows\System\uMPIvpL.exe
  2⤵
  PID:7188
- C:\Windows\System\dVMPEGc.exe
  C:\Windows\System\dVMPEGc.exe
  2⤵
  PID:7356
- C:\Windows\System\jUXBFJV.exe
  C:\Windows\System\jUXBFJV.exe
  2⤵
  PID:7288
- C:\Windows\System\YnuRVNu.exe
  C:\Windows\System\YnuRVNu.exe
  2⤵
  PID:7292
- C:\Windows\System\gEKQsCw.exe
  C:\Windows\System\gEKQsCw.exe
  2⤵
  PID:7392
- C:\Windows\System\zKnJFMJ.exe
  C:\Windows\System\zKnJFMJ.exe
  2⤵
  PID:7776
- C:\Windows\System\uQbZLYM.exe
  C:\Windows\System\uQbZLYM.exe
  2⤵
  PID:7640
- C:\Windows\System\YLnihbV.exe
  C:\Windows\System\YLnihbV.exe
  2⤵
  PID:7328
- C:\Windows\System\mEMspRa.exe
  C:\Windows\System\mEMspRa.exe
  2⤵
  PID:7532
- C:\Windows\System\ZNuVZOD.exe
  C:\Windows\System\ZNuVZOD.exe
  2⤵
  PID:7972
- C:\Windows\System\OrrCRql.exe
  C:\Windows\System\OrrCRql.exe
  2⤵
  PID:7244
- C:\Windows\System\INDzsNx.exe
  C:\Windows\System\INDzsNx.exe
  2⤵
  PID:7488
- C:\Windows\System\LcExTqw.exe
  C:\Windows\System\LcExTqw.exe
  2⤵
  PID:8052
- C:\Windows\System\ntFeANv.exe
  C:\Windows\System\ntFeANv.exe
  2⤵
  PID:8208
- C:\Windows\System\RnzUfxz.exe
  C:\Windows\System\RnzUfxz.exe
  2⤵
  PID:8228
- C:\Windows\System\QbwSMsY.exe
  C:\Windows\System\QbwSMsY.exe
  2⤵
  PID:8248
- C:\Windows\System\NzOiaFS.exe
  C:\Windows\System\NzOiaFS.exe
  2⤵
  PID:8268
- C:\Windows\System\zEnYlXY.exe
  C:\Windows\System\zEnYlXY.exe
  2⤵
  PID:8288
- C:\Windows\System\KMzBcVL.exe
  C:\Windows\System\KMzBcVL.exe
  2⤵
  PID:8304
- C:\Windows\System\OfuZSjn.exe
  C:\Windows\System\OfuZSjn.exe
  2⤵
  PID:8320
- C:\Windows\System\vEIkWkE.exe
  C:\Windows\System\vEIkWkE.exe
  2⤵
  PID:8340
- C:\Windows\System\dRsCZoo.exe
  C:\Windows\System\dRsCZoo.exe
  2⤵
  PID:8360
- C:\Windows\System\FaoNjfF.exe
  C:\Windows\System\FaoNjfF.exe
  2⤵
  PID:8380
- C:\Windows\System\eGfkoSv.exe
  C:\Windows\System\eGfkoSv.exe
  2⤵
  PID:8396
- C:\Windows\System\LcIsJCK.exe
  C:\Windows\System\LcIsJCK.exe
  2⤵
  PID:8412
- C:\Windows\System\SoQsssJ.exe
  C:\Windows\System\SoQsssJ.exe
  2⤵
  PID:8428
- C:\Windows\System\epaFqkw.exe
  C:\Windows\System\epaFqkw.exe
  2⤵
  PID:8452
- C:\Windows\System\QzPbiBP.exe
  C:\Windows\System\QzPbiBP.exe
  2⤵
  PID:8468
- C:\Windows\System\tYvmuLK.exe
  C:\Windows\System\tYvmuLK.exe
  2⤵
  PID:8484
- C:\Windows\System\hvZYnnV.exe
  C:\Windows\System\hvZYnnV.exe
  2⤵
  PID:8504
- C:\Windows\System\eOccfpj.exe
  C:\Windows\System\eOccfpj.exe
  2⤵
  PID:8632
- C:\Windows\System\FJWHmzK.exe
  C:\Windows\System\FJWHmzK.exe
  2⤵
  PID:8648
- C:\Windows\System\GUJFvQR.exe
  C:\Windows\System\GUJFvQR.exe
  2⤵
  PID:8664
- C:\Windows\System\VkbpTLF.exe
  C:\Windows\System\VkbpTLF.exe
  2⤵
  PID:8684
- C:\Windows\System\oGclVSw.exe
  C:\Windows\System\oGclVSw.exe
  2⤵
  PID:8700
- C:\Windows\System\eRYNmty.exe
  C:\Windows\System\eRYNmty.exe
  2⤵
  PID:8716
- C:\Windows\System\OCEEsnu.exe
  C:\Windows\System\OCEEsnu.exe
  2⤵
  PID:8732
- C:\Windows\System\spLtlzZ.exe
  C:\Windows\System\spLtlzZ.exe
  2⤵
  PID:8748
- C:\Windows\System\zbWDPiA.exe
  C:\Windows\System\zbWDPiA.exe
  2⤵
  PID:8764
- C:\Windows\System\SIuTPfK.exe
  C:\Windows\System\SIuTPfK.exe
  2⤵
  PID:8780
- C:\Windows\System\rFSXEFa.exe
  C:\Windows\System\rFSXEFa.exe
  2⤵
  PID:8796
- C:\Windows\System\mjbddct.exe
  C:\Windows\System\mjbddct.exe
  2⤵
  PID:8812
- C:\Windows\System\iWoPUIA.exe
  C:\Windows\System\iWoPUIA.exe
  2⤵
  PID:8828
- C:\Windows\System\uRLKHhl.exe
  C:\Windows\System\uRLKHhl.exe
  2⤵
  PID:8896
- C:\Windows\System\nfBySuy.exe
  C:\Windows\System\nfBySuy.exe
  2⤵
  PID:8912
- C:\Windows\System\CWudgVl.exe
  C:\Windows\System\CWudgVl.exe
  2⤵
  PID:8928
- C:\Windows\System\YINyLDE.exe
  C:\Windows\System\YINyLDE.exe
  2⤵
  PID:8944
- C:\Windows\System\FhItEuY.exe
  C:\Windows\System\FhItEuY.exe
  2⤵
  PID:8960
- C:\Windows\System\LunBxCn.exe
  C:\Windows\System\LunBxCn.exe
  2⤵
  PID:8976
- C:\Windows\System\jvXKEOn.exe
  C:\Windows\System\jvXKEOn.exe
  2⤵
  PID:8992
- C:\Windows\System\XdSLYnd.exe
  C:\Windows\System\XdSLYnd.exe
  2⤵
  PID:9008
- C:\Windows\System\XvyeHyu.exe
  C:\Windows\System\XvyeHyu.exe
  2⤵
  PID:9024
- C:\Windows\System\YBdoMwj.exe
  C:\Windows\System\YBdoMwj.exe
  2⤵
  PID:9040
- C:\Windows\System\dtiGeQV.exe
  C:\Windows\System\dtiGeQV.exe
  2⤵
  PID:9056
- C:\Windows\System\fHEcBJH.exe
  C:\Windows\System\fHEcBJH.exe
  2⤵
  PID:9072
- C:\Windows\System\nfNhwkS.exe
  C:\Windows\System\nfNhwkS.exe
  2⤵
  PID:9088
- C:\Windows\System\joUYDNu.exe
  C:\Windows\System\joUYDNu.exe
  2⤵
  PID:9104
- C:\Windows\System\EdHCBbi.exe
  C:\Windows\System\EdHCBbi.exe
  2⤵
  PID:9120
- C:\Windows\System\DzsuFpj.exe
  C:\Windows\System\DzsuFpj.exe
  2⤵
  PID:9136
- C:\Windows\System\UXtMbbS.exe
  C:\Windows\System\UXtMbbS.exe
  2⤵
  PID:9152
- C:\Windows\System\mDnopyI.exe
  C:\Windows\System\mDnopyI.exe
  2⤵
  PID:9168
- C:\Windows\System\lyhXGJM.exe
  C:\Windows\System\lyhXGJM.exe
  2⤵
  PID:9184
- C:\Windows\System\VUQPGUB.exe
  C:\Windows\System\VUQPGUB.exe
  2⤵
  PID:9200
- C:\Windows\System\SHLmRzR.exe
  C:\Windows\System\SHLmRzR.exe
  2⤵
  PID:6132
- C:\Windows\System\YHVDpzm.exe
  C:\Windows\System\YHVDpzm.exe
  2⤵
  PID:7732
- C:\Windows\System\OuuECdP.exe
  C:\Windows\System\OuuECdP.exe
  2⤵
  PID:8236
- C:\Windows\System\dwAcznQ.exe
  C:\Windows\System\dwAcznQ.exe
  2⤵
  PID:8280
- C:\Windows\System\yDqGVjI.exe
  C:\Windows\System\yDqGVjI.exe
  2⤵
  PID:8348
- C:\Windows\System\ylfiqHX.exe
  C:\Windows\System\ylfiqHX.exe
  2⤵
  PID:8392
- C:\Windows\System\PZTrBwd.exe
  C:\Windows\System\PZTrBwd.exe
  2⤵
  PID:8464
- C:\Windows\System\qNyqkTj.exe
  C:\Windows\System\qNyqkTj.exe
  2⤵
  PID:7856
- C:\Windows\System\JFyMnHd.exe
  C:\Windows\System\JFyMnHd.exe
  2⤵
  PID:7840
- C:\Windows\System\jsOQxhu.exe
  C:\Windows\System\jsOQxhu.exe
  2⤵
  PID:8476
- C:\Windows\System\WDIaKIG.exe
  C:\Windows\System\WDIaKIG.exe
  2⤵
  PID:7176
- C:\Windows\System\DSGDhCw.exe
  C:\Windows\System\DSGDhCw.exe
  2⤵
  PID:580
- C:\Windows\System\gcGwNkD.exe
  C:\Windows\System\gcGwNkD.exe
  2⤵
  PID:8328
- C:\Windows\System\rQIyyJB.exe
  C:\Windows\System\rQIyyJB.exe
  2⤵
  PID:7200
- C:\Windows\System\zevLTpy.exe
  C:\Windows\System\zevLTpy.exe
  2⤵
  PID:7932
- C:\Windows\System\sMGwrAM.exe
  C:\Windows\System\sMGwrAM.exe
  2⤵
  PID:7448
- C:\Windows\System\FJufdiM.exe
  C:\Windows\System\FJufdiM.exe
  2⤵
  PID:8088
- C:\Windows\System\LzzoOMq.exe
  C:\Windows\System\LzzoOMq.exe
  2⤵
  PID:7256
- C:\Windows\System\zzisYnS.exe
  C:\Windows\System\zzisYnS.exe
  2⤵
  PID:8184
- C:\Windows\System\LaSoEfn.exe
  C:\Windows\System\LaSoEfn.exe
  2⤵
  PID:7240
- C:\Windows\System\EQdJRjy.exe
  C:\Windows\System\EQdJRjy.exe
  2⤵
  PID:8260
- C:\Windows\System\hethmzD.exe
  C:\Windows\System\hethmzD.exe
  2⤵
  PID:8332
- C:\Windows\System\fascBfS.exe
  C:\Windows\System\fascBfS.exe
  2⤵
  PID:8408
- C:\Windows\System\jWPuRBj.exe
  C:\Windows\System\jWPuRBj.exe
  2⤵
  PID:8520
- C:\Windows\System\vKQpMIn.exe
  C:\Windows\System\vKQpMIn.exe
  2⤵
  PID:8536
- C:\Windows\System\NapoUIY.exe
  C:\Windows\System\NapoUIY.exe
  2⤵
  PID:8552
- C:\Windows\System\TpYJUFk.exe
  C:\Windows\System\TpYJUFk.exe
  2⤵
  PID:8568
- C:\Windows\System\CqOxLGz.exe
  C:\Windows\System\CqOxLGz.exe
  2⤵
  PID:8640
- C:\Windows\System\rLMSxlx.exe
  C:\Windows\System\rLMSxlx.exe
  2⤵
  PID:8848
- C:\Windows\System\hfuvzJo.exe
  C:\Windows\System\hfuvzJo.exe
  2⤵
  PID:8884
- C:\Windows\System\AXPVXLj.exe
  C:\Windows\System\AXPVXLj.exe
  2⤵
  PID:8940
- C:\Windows\System\DsLDGfG.exe
  C:\Windows\System\DsLDGfG.exe
  2⤵
  PID:9112
- C:\Windows\System\lYIiQfm.exe
  C:\Windows\System\lYIiQfm.exe
  2⤵
  PID:9176
- C:\Windows\System\GimTIKo.exe
  C:\Windows\System\GimTIKo.exe
  2⤵
  PID:8200
- C:\Windows\System\VaxVlHQ.exe
  C:\Windows\System\VaxVlHQ.exe
  2⤵
  PID:8972
- C:\Windows\System\jQeJZEq.exe
  C:\Windows\System\jQeJZEq.exe
  2⤵
  PID:9032
- C:\Windows\System\ffAaXRl.exe
  C:\Windows\System\ffAaXRl.exe
  2⤵
  PID:9164
- C:\Windows\System\YgFvQLn.exe
  C:\Windows\System\YgFvQLn.exe
  2⤵
  PID:8424
- C:\Windows\System\OmmgXbE.exe
  C:\Windows\System\OmmgXbE.exe
  2⤵
  PID:8164
- C:\Windows\System\BwjevNe.exe
  C:\Windows\System\BwjevNe.exe
  2⤵
  PID:9132
- C:\Windows\System\QEheGyx.exe
  C:\Windows\System\QEheGyx.exe
  2⤵
  PID:7588
- C:\Windows\System\raQXADn.exe
  C:\Windows\System\raQXADn.exe
  2⤵
  PID:7788
- C:\Windows\System\ALNuwNC.exe
  C:\Windows\System\ALNuwNC.exe
  2⤵
  PID:8080
- C:\Windows\System\WRSrcqc.exe
  C:\Windows\System\WRSrcqc.exe
  2⤵
  PID:8220
- C:\Windows\System\nsEFCtW.exe
  C:\Windows\System\nsEFCtW.exe
  2⤵
  PID:8528
- C:\Windows\System\yDxtwuT.exe
  C:\Windows\System\yDxtwuT.exe
  2⤵
  PID:8356
- C:\Windows\System\KwYczsV.exe
  C:\Windows\System\KwYczsV.exe
  2⤵
  PID:8500
- C:\Windows\System\jawmLBa.exe
  C:\Windows\System\jawmLBa.exe
  2⤵
  PID:7508
- C:\Windows\System\pDVFtOM.exe
  C:\Windows\System\pDVFtOM.exe
  2⤵
  PID:8512
- C:\Windows\System\zGNBnRi.exe
  C:\Windows\System\zGNBnRi.exe
  2⤵
  PID:2600
- C:\Windows\System\aKSFuYB.exe
  C:\Windows\System\aKSFuYB.exe
  2⤵
  PID:8448
- C:\Windows\System\JViPWIL.exe
  C:\Windows\System\JViPWIL.exe
  2⤵
  PID:8548
- C:\Windows\System\NaWeSUj.exe
  C:\Windows\System\NaWeSUj.exe
  2⤵
  PID:1492
- C:\Windows\System\KyozmCw.exe
  C:\Windows\System\KyozmCw.exe
  2⤵
  PID:8616
- C:\Windows\System\YGMywnf.exe
  C:\Windows\System\YGMywnf.exe
  2⤵
  PID:8680
- C:\Windows\System\nHBnNgZ.exe
  C:\Windows\System\nHBnNgZ.exe
  2⤵
  PID:8708
- C:\Windows\System\gumUdeg.exe
  C:\Windows\System\gumUdeg.exe
  2⤵
  PID:8760
- C:\Windows\System\ZyenKmd.exe
  C:\Windows\System\ZyenKmd.exe
  2⤵
  PID:8724
- C:\Windows\System\ZPLDdOz.exe
  C:\Windows\System\ZPLDdOz.exe
  2⤵
  PID:8820
- C:\Windows\System\NojhyMF.exe
  C:\Windows\System\NojhyMF.exe
  2⤵
  PID:8772
- C:\Windows\System\lSgQhTA.exe
  C:\Windows\System\lSgQhTA.exe
  2⤵
  PID:8888
- C:\Windows\System\VWZYWZu.exe
  C:\Windows\System\VWZYWZu.exe
  2⤵
  PID:8876
- C:\Windows\System\AUcgrnA.exe
  C:\Windows\System\AUcgrnA.exe
  2⤵
  PID:8904
- C:\Windows\System\kMraVYo.exe
  C:\Windows\System\kMraVYo.exe
  2⤵
  PID:8984
- C:\Windows\System\UGEoLgE.exe
  C:\Windows\System\UGEoLgE.exe
  2⤵
  PID:9048
- C:\Windows\System\WJbPwRI.exe
  C:\Windows\System\WJbPwRI.exe
  2⤵
  PID:9144
- C:\Windows\System\kFnsreS.exe
  C:\Windows\System\kFnsreS.exe
  2⤵
  PID:9064
- C:\Windows\System\UkblVtV.exe
  C:\Windows\System\UkblVtV.exe
  2⤵
  PID:9080
- C:\Windows\System\DNGrqZx.exe
  C:\Windows\System\DNGrqZx.exe
  2⤵
  PID:9128
- C:\Windows\System\VxtirCH.exe
  C:\Windows\System\VxtirCH.exe
  2⤵
  PID:7524
- C:\Windows\System\pqPMlxM.exe
  C:\Windows\System\pqPMlxM.exe
  2⤵
  PID:7340
- C:\Windows\System\ySFTiPN.exe
  C:\Windows\System\ySFTiPN.exe
  2⤵
  PID:8376
- C:\Windows\System\jPfQcRt.exe
  C:\Windows\System\jPfQcRt.exe
  2⤵
  PID:8580
- C:\Windows\System\PGsghKh.exe
  C:\Windows\System\PGsghKh.exe
  2⤵
  PID:8444
- C:\Windows\System\lZHRCEZ.exe
  C:\Windows\System\lZHRCEZ.exe
  2⤵
  PID:8600
- C:\Windows\System\tWHqBlb.exe
  C:\Windows\System\tWHqBlb.exe
  2⤵
  PID:8676
- C:\Windows\System\vtJAvQH.exe
  C:\Windows\System\vtJAvQH.exe
  2⤵
  PID:9212
- C:\Windows\System\fkfEcOG.exe
  C:\Windows\System\fkfEcOG.exe
  2⤵
  PID:8544
- C:\Windows\System\uVBOLlH.exe
  C:\Windows\System\uVBOLlH.exe
  2⤵
  PID:8696
- C:\Windows\System\vTaovlb.exe
  C:\Windows\System\vTaovlb.exe
  2⤵
  PID:8836
- C:\Windows\System\zHdSeTZ.exe
  C:\Windows\System\zHdSeTZ.exe
  2⤵
  PID:8956
- C:\Windows\System\QSvlHDE.exe
  C:\Windows\System\QSvlHDE.exe
  2⤵
  PID:9208
- C:\Windows\System\UDLKevs.exe
  C:\Windows\System\UDLKevs.exe
  2⤵
  PID:8276
- C:\Windows\System\adLAoPf.exe
  C:\Windows\System\adLAoPf.exe
  2⤵
  PID:8860
- C:\Windows\System\SQUdKHc.exe
  C:\Windows\System\SQUdKHc.exe
  2⤵
  PID:9068
- C:\Windows\System\TZNgRVO.exe
  C:\Windows\System\TZNgRVO.exe
  2⤵
  PID:8316
- C:\Windows\System\bNsxBPr.exe
  C:\Windows\System\bNsxBPr.exe
  2⤵
  PID:8300
- C:\Windows\System\EuWXroP.exe
  C:\Windows\System\EuWXroP.exe
  2⤵
  PID:8744
- C:\Windows\System\sKGknBk.exe
  C:\Windows\System\sKGknBk.exe
  2⤵
  PID:8032
- C:\Windows\System\qFSDMnN.exe
  C:\Windows\System\qFSDMnN.exe
  2⤵
  PID:8788
- C:\Windows\System\MdhiuLb.exe
  C:\Windows\System\MdhiuLb.exe
  2⤵
  PID:8672
- C:\Windows\System\SjsWgLd.exe
  C:\Windows\System\SjsWgLd.exe
  2⤵
  PID:8100
- C:\Windows\System\OdFAKWq.exe
  C:\Windows\System\OdFAKWq.exe
  2⤵
  PID:8968
- C:\Windows\System\eSneYma.exe
  C:\Windows\System\eSneYma.exe
  2⤵
  PID:8612
- C:\Windows\System\zKeNZcg.exe
  C:\Windows\System\zKeNZcg.exe
  2⤵
  PID:9232
- C:\Windows\System\OcVOiKf.exe
  C:\Windows\System\OcVOiKf.exe
  2⤵
  PID:9248
- C:\Windows\System\dIIDNOR.exe
  C:\Windows\System\dIIDNOR.exe
  2⤵
  PID:9264
- C:\Windows\System\JoWwNIk.exe
  C:\Windows\System\JoWwNIk.exe
  2⤵
  PID:9280
- C:\Windows\System\uoAsKGD.exe
  C:\Windows\System\uoAsKGD.exe
  2⤵
  PID:9296
- C:\Windows\System\HTCyoRY.exe
  C:\Windows\System\HTCyoRY.exe
  2⤵
  PID:9312
- C:\Windows\System\cqVzUNq.exe
  C:\Windows\System\cqVzUNq.exe
  2⤵
  PID:9328
- C:\Windows\System\cPdQnex.exe
  C:\Windows\System\cPdQnex.exe
  2⤵
  PID:9348
- C:\Windows\System\CzgvmoB.exe
  C:\Windows\System\CzgvmoB.exe
  2⤵
  PID:9364
- C:\Windows\System\mEgdDBr.exe
  C:\Windows\System\mEgdDBr.exe
  2⤵
  PID:9380
- C:\Windows\System\bdXqdcH.exe
  C:\Windows\System\bdXqdcH.exe
  2⤵
  PID:9396
- C:\Windows\System\HyizNKr.exe
  C:\Windows\System\HyizNKr.exe
  2⤵
  PID:9412
- C:\Windows\System\rYWhqQk.exe
  C:\Windows\System\rYWhqQk.exe
  2⤵
  PID:9428
- C:\Windows\System\fNaJAjD.exe
  C:\Windows\System\fNaJAjD.exe
  2⤵
  PID:9444
- C:\Windows\System\nEhvDxi.exe
  C:\Windows\System\nEhvDxi.exe
  2⤵
  PID:9460
- C:\Windows\System\dkbSBsw.exe
  C:\Windows\System\dkbSBsw.exe
  2⤵
  PID:9476
- C:\Windows\System\NZaEsDj.exe
  C:\Windows\System\NZaEsDj.exe
  2⤵
  PID:9492
- C:\Windows\System\xmwaoYz.exe
  C:\Windows\System\xmwaoYz.exe
  2⤵
  PID:9508
- C:\Windows\System\lenqUsx.exe
  C:\Windows\System\lenqUsx.exe
  2⤵
  PID:9524
- C:\Windows\System\GoggnIw.exe
  C:\Windows\System\GoggnIw.exe
  2⤵
  PID:9544
- C:\Windows\System\JKiSoIA.exe
  C:\Windows\System\JKiSoIA.exe
  2⤵
  PID:9564
- C:\Windows\System\AmAMznS.exe
  C:\Windows\System\AmAMznS.exe
  2⤵
  PID:9580
- C:\Windows\System\zTVlTHS.exe
  C:\Windows\System\zTVlTHS.exe
  2⤵
  PID:9596
- C:\Windows\System\ZzNbyrG.exe
  C:\Windows\System\ZzNbyrG.exe
  2⤵
  PID:9612
- C:\Windows\System\SlyAXDK.exe
  C:\Windows\System\SlyAXDK.exe
  2⤵
  PID:9628
- C:\Windows\System\GiTqSPA.exe
  C:\Windows\System\GiTqSPA.exe
  2⤵
  PID:9644
- C:\Windows\System\Tkerlei.exe
  C:\Windows\System\Tkerlei.exe
  2⤵
  PID:9660
- C:\Windows\System\lXvGbTv.exe
  C:\Windows\System\lXvGbTv.exe
  2⤵
  PID:9676
- C:\Windows\System\TqVqNoZ.exe
  C:\Windows\System\TqVqNoZ.exe
  2⤵
  PID:9692
- C:\Windows\System\kZYxerD.exe
  C:\Windows\System\kZYxerD.exe
  2⤵
  PID:9708
- C:\Windows\System\pPXZsko.exe
  C:\Windows\System\pPXZsko.exe
  2⤵
  PID:9724
- C:\Windows\System\IDhZGzU.exe
  C:\Windows\System\IDhZGzU.exe
  2⤵
  PID:9744
- C:\Windows\System\dwDpBbl.exe
  C:\Windows\System\dwDpBbl.exe
  2⤵
  PID:9760
- C:\Windows\System\HqZwNha.exe
  C:\Windows\System\HqZwNha.exe
  2⤵
  PID:9776
- C:\Windows\System\zKvUHUY.exe
  C:\Windows\System\zKvUHUY.exe
  2⤵
  PID:9792
- C:\Windows\System\uOmerEc.exe
  C:\Windows\System\uOmerEc.exe
  2⤵
  PID:9808
- C:\Windows\System\UciRgaR.exe
  C:\Windows\System\UciRgaR.exe
  2⤵
  PID:9824
- C:\Windows\System\VRwIaFB.exe
  C:\Windows\System\VRwIaFB.exe
  2⤵
  PID:9840
- C:\Windows\System\PqbPwlT.exe
  C:\Windows\System\PqbPwlT.exe
  2⤵
  PID:9856
- C:\Windows\System\uPRITrK.exe
  C:\Windows\System\uPRITrK.exe
  2⤵
  PID:9872
- C:\Windows\System\DqXoaWk.exe
  C:\Windows\System\DqXoaWk.exe
  2⤵
  PID:9888
- C:\Windows\System\EVlTqXp.exe
  C:\Windows\System\EVlTqXp.exe
  2⤵
  PID:9904
- C:\Windows\System\LCKBsCS.exe
  C:\Windows\System\LCKBsCS.exe
  2⤵
  PID:9920
- C:\Windows\System\riikPnK.exe
  C:\Windows\System\riikPnK.exe
  2⤵
  PID:9936
- C:\Windows\System\UsZEOTl.exe
  C:\Windows\System\UsZEOTl.exe
  2⤵
  PID:9952
- C:\Windows\System\keXvcjj.exe
  C:\Windows\System\keXvcjj.exe
  2⤵
  PID:9968
- C:\Windows\System\YdssmoJ.exe
  C:\Windows\System\YdssmoJ.exe
  2⤵
  PID:9984
- C:\Windows\System\xtYURer.exe
  C:\Windows\System\xtYURer.exe
  2⤵
  PID:10000
- C:\Windows\System\xrvGhra.exe
  C:\Windows\System\xrvGhra.exe
  2⤵
  PID:10016
- C:\Windows\System\woCvZWl.exe
  C:\Windows\System\woCvZWl.exe
  2⤵
  PID:10032
- C:\Windows\System\jnzGlDV.exe
  C:\Windows\System\jnzGlDV.exe
  2⤵
  PID:10048
- C:\Windows\System\trAmaoQ.exe
  C:\Windows\System\trAmaoQ.exe
  2⤵
  PID:10064
- C:\Windows\System\JriNTkr.exe
  C:\Windows\System\JriNTkr.exe
  2⤵
  PID:10080
- C:\Windows\System\RoRiyWz.exe
  C:\Windows\System\RoRiyWz.exe
  2⤵
  PID:10096
- C:\Windows\System\zjAkXNM.exe
  C:\Windows\System\zjAkXNM.exe
  2⤵
  PID:10112
- C:\Windows\System\rZDZzZq.exe
  C:\Windows\System\rZDZzZq.exe
  2⤵
  PID:10128
- C:\Windows\System\PEdpXHu.exe
  C:\Windows\System\PEdpXHu.exe
  2⤵
  PID:10144
- C:\Windows\System\grmXXLq.exe
  C:\Windows\System\grmXXLq.exe
  2⤵
  PID:10160
- C:\Windows\System\fLmdhZA.exe
  C:\Windows\System\fLmdhZA.exe
  2⤵
  PID:10176
- C:\Windows\System\qowZtmn.exe
  C:\Windows\System\qowZtmn.exe
  2⤵
  PID:10192
- C:\Windows\System\fbYKTlv.exe
  C:\Windows\System\fbYKTlv.exe
  2⤵
  PID:10208
- C:\Windows\System\QMIhUzQ.exe
  C:\Windows\System\QMIhUzQ.exe
  2⤵
  PID:10224
- C:\Windows\System\TuaGjfN.exe
  C:\Windows\System\TuaGjfN.exe
  2⤵
  PID:8880
- C:\Windows\System\MjnKTZk.exe
  C:\Windows\System\MjnKTZk.exe
  2⤵
  PID:7616
- C:\Windows\System\IbJWgOn.exe
  C:\Windows\System\IbJWgOn.exe
  2⤵
  PID:9320
- C:\Windows\System\EYMsnhK.exe
  C:\Windows\System\EYMsnhK.exe
  2⤵
  PID:9360
- C:\Windows\System\HwqihjR.exe
  C:\Windows\System\HwqihjR.exe
  2⤵
  PID:9424
- C:\Windows\System\HQXoToL.exe
  C:\Windows\System\HQXoToL.exe
  2⤵
  PID:9408
- C:\Windows\System\UfOXuLm.exe
  C:\Windows\System\UfOXuLm.exe
  2⤵
  PID:9456
- C:\Windows\System\gqZeuNe.exe
  C:\Windows\System\gqZeuNe.exe
  2⤵
  PID:9516
- C:\Windows\System\opljXbK.exe
  C:\Windows\System\opljXbK.exe
  2⤵
  PID:9504
- C:\Windows\System\RnCWRvC.exe
  C:\Windows\System\RnCWRvC.exe
  2⤵
  PID:9592
- C:\Windows\System\JyWZGqg.exe
  C:\Windows\System\JyWZGqg.exe
  2⤵
  PID:9624
- C:\Windows\System\KKCvlVy.exe
  C:\Windows\System\KKCvlVy.exe
  2⤵
  PID:9720
- C:\Windows\System\HSHcOol.exe
  C:\Windows\System\HSHcOol.exe
  2⤵
  PID:9704
- C:\Windows\System\GQNqfhV.exe
  C:\Windows\System\GQNqfhV.exe
  2⤵
  PID:9668
- C:\Windows\System\bCVKDOZ.exe
  C:\Windows\System\bCVKDOZ.exe
  2⤵
  PID:9700
- C:\Windows\System\hqhASKL.exe
  C:\Windows\System\hqhASKL.exe
  2⤵
  PID:9832
- C:\Windows\System\CUOtMiL.exe
  C:\Windows\System\CUOtMiL.exe
  2⤵
  PID:9784
- C:\Windows\System\hFCRqJB.exe
  C:\Windows\System\hFCRqJB.exe
  2⤵
  PID:9868
- C:\Windows\System\bYUvmGg.exe
  C:\Windows\System\bYUvmGg.exe
  2⤵
  PID:9932
- C:\Windows\System\qdTdXfB.exe
  C:\Windows\System\qdTdXfB.exe
  2⤵
  PID:9912
- C:\Windows\System\fBEVvpW.exe
  C:\Windows\System\fBEVvpW.exe
  2⤵
  PID:9948
- C:\Windows\System\gcyGwBH.exe
  C:\Windows\System\gcyGwBH.exe
  2⤵
  PID:9900
- C:\Windows\System\JiIIFzO.exe
  C:\Windows\System\JiIIFzO.exe
  2⤵
  PID:9992
- C:\Windows\System\BbUPjls.exe
  C:\Windows\System\BbUPjls.exe
  2⤵
  PID:10056
- C:\Windows\System\rDslVvC.exe
  C:\Windows\System\rDslVvC.exe
  2⤵
  PID:9976
- C:\Windows\System\dBokeXr.exe
  C:\Windows\System\dBokeXr.exe
  2⤵
  PID:10140
- C:\Windows\System\LPkTwHk.exe
  C:\Windows\System\LPkTwHk.exe
  2⤵
  PID:10204
- C:\Windows\System\Mrggwix.exe
  C:\Windows\System\Mrggwix.exe
  2⤵
  PID:10120
- C:\Windows\System\aMDhtdB.exe
  C:\Windows\System\aMDhtdB.exe
  2⤵
  PID:10188
- C:\Windows\System\hTQYIZi.exe
  C:\Windows\System\hTQYIZi.exe
  2⤵
  PID:8872
- C:\Windows\System\HyGykle.exe
  C:\Windows\System\HyGykle.exe
  2⤵
  PID:9276
- C:\Windows\System\RLjTlbe.exe
  C:\Windows\System\RLjTlbe.exe
  2⤵
  PID:9308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ChSEQbx.exe

Filesize
3.3MB

MD5
060737347b67bd510ec67a4e5c423563

SHA1
0ae18d4049ff2ac07582ed67723423a2a1d29962

SHA256
dfe3fe718d54183685f7ea1d91d41c7f954677dc52aa099e56a173338f66141c

SHA512
041e6def319f642b26663397767473965ae56a3dd8353a0d8ad3011035f676f6a84ff37a84eedab12f511a150475774cf547220d9f53dffbaf9bb51421e294f9

Download Submit
C:\Windows\system\DBUnoNX.exe

Filesize
3.3MB

MD5
044e721f961acf9018816b4bb4e9de00

SHA1
e1e8c87d3b7ef3f3a3728cb387fb9a1f9e527648

SHA256
c8e258e1503963c3bf131d54f8ed313a822190ff9654c7a2a09e2f1fa5e29455

SHA512
341fc0f79cea813b66754292e214464019270f6e48e4b9ed0e691d8b38af85309afc56a5391eb943ec24584299c8dfb882632fc7b3204e4b9962840e9cb8b915

Download Submit
C:\Windows\system\EYnbOid.exe

Filesize
3.3MB

MD5
95c2941948af8b6f200baf1ba812ef88

SHA1
1fc656e648cc6b370c2808f3c892aa87f2683fd3

SHA256
a19da265fac9e38a2e8b56a689949e7d6acb0b0324895bb922cc635d555ffe2b

SHA512
6546f079847257322d53052c93763a05d9bf4118664b80f98656cbc8a2c907d23fbe3cda38b411c54381849d693d69f0f42955875f3ca0383a9cf548966768d3

Download Submit
C:\Windows\system\ExkUKTB.exe

Filesize
3.3MB

MD5
1286071af3d43a76ee6e96a90e4fbae6

SHA1
c419d88b71c514fd4a9c88e74211807173e9ecea

SHA256
ee28975cc4a80c119b98ebf0e25b93a99c61c246d5092aa380c249b178f23e6a

SHA512
985a8661f6b0171342438a1d44cc1e274651ec28af1624378c0a0195721b2d476182306d90b15c219a79dd9f24b71c9cb0b4e817a6ad07de67089c87898a9653

Download Submit
C:\Windows\system\EzsoGvj.exe

Filesize
3.3MB

MD5
493e4f7816276526ab1f67da2943907b

SHA1
5ec294fc5fca243dd5c3f72bfd47c14c446a0e7e

SHA256
ce8e35ad3b022f37426e9d72958c09b11655814eaf9f0f70190b90b09a9bd07b

SHA512
85144d57973f50e23af4dd97ee48adb333b68cf063e88757dbc68a1f085ff006df17deee7297c57c44ad90f4888aaa63fb1d2b4da11e2510ba4527b62c8f56cf

Download Submit
C:\Windows\system\HfTLgae.exe

Filesize
3.3MB

MD5
1f1e3ba03c9e30202527ede949a2afe7

SHA1
d60de10f91c7eddf1ee196dd54374217d2096494

SHA256
25d9819f670140ac315946c1c495ef9ddc3f3daba7d9f8a43045973381c9a050

SHA512
e7a114ccd4d31436d039b8f1f1291ce4e8eec28fd44a3f966e4506e4f9fb114673984dddf62a9c71414475707fc2b531670c1df2ee1be1cfe6556e9913095e91

Download Submit
C:\Windows\system\HfcnfZW.exe

Filesize
3.3MB

MD5
c24043f1b08b02e94f39a407054367c9

SHA1
41e4932f19008bfcf5881001fc676f60c14dec3b

SHA256
942795945be9f21c04f00e7e7c034a92b4e194540e7904cb3103d129a5c20589

SHA512
9194776f0b17fa237bf40d6bc273ea3b69801ebff9f69c8ad15b2b2520fe5397f0c3f4b3418d210425248dbaf4c440b7d4cce1aa791f308257cbf0a44dac649e

Download Submit
C:\Windows\system\HxcjmXD.exe

Filesize
3.3MB

MD5
fe47fa1098b420362eb3937f8376f3f1

SHA1
9c0c2b89949ee1c5afe70b9a746144abb6808852

SHA256
a879a0f845f75da4afc2c52d0568c348a50ec37ec879b10930d3c3ffa6dbd57d

SHA512
d232cb339c6b3b5007435d632e406c53406b21b3498858cc54d17b6c427adcc3faeb932eccdf2a2928f2ee06bb1d36405995890a85a61fd07c501263f3e9d96d

Download Submit
C:\Windows\system\JhGpXAw.exe

Filesize
3.3MB

MD5
359398af008c65533c560e1371fbf182

SHA1
151d579662994370d20e7e15f1765a8174c8b1a7

SHA256
0d7eda2ce2ffb2130abfaceb4a74bd79f1cab03775d680c656ab4f41a19c9ad4

SHA512
03d41358258f9d81a7462fbe89ce9c316886806f70ad5fd14be7414b881a433563f602289c73f4ccef3bc3c8167b95680cc6e66c1cb0913e86f8f8ef5f4d5c9a

Download Submit
C:\Windows\system\PuxUICO.exe

Filesize
3.3MB

MD5
e5b53178bc3a27fd05de1493702fe336

SHA1
55e7945694f2138c7395820c40e167c8d126b594

SHA256
1a96db521ce4d362cdc23a3cf15144d273779d37802a3eea0211ee2be40882d1

SHA512
21934aa0aca042ba780ced8d9f6cc80b058aacb9aa4c4246481b2e8ff438d2bb928b5402b757d321abf435c4d85c4baa3d573d18f2b67f6926e5793d6f105bb9

Download Submit
C:\Windows\system\RmyakoC.exe

Filesize
3.3MB

MD5
c42230e934117a44a4904a89f20da059

SHA1
0db2abb629ed2c4d4df0cc9c2072fc965c78ae4a

SHA256
7486628c35a4f430bc42de5d4d193cf6f1ab4ce8da842709d0d8f02ca26401fe

SHA512
7c3b1419a2234b116465b276593b1aad1678d0c91311711193c795fcc6fb3a78a920c06ecd52eafe14cb0308608ba684af621063ab3327da6a17982ec8fe08cb

Download Submit
C:\Windows\system\SfVcAZK.exe

Filesize
3.3MB

MD5
55704408620cb500590e58a4c2db242c

SHA1
c75bf168b908ff0cd45b66a3b95da4374731f472

SHA256
150685b06c7f83001ad2968ffb1361602a348862a294f7d56f2e7254669e77f3

SHA512
60f07dffc18ba2f3130ce12611704488828ba50e0c3e1198d860ae1e2b01f083d9dbc10814ce1f8b84945796ac9c281d0760ded650e8920000b116288d039a8d

Download Submit
C:\Windows\system\aDBnoEb.exe

Filesize
3.3MB

MD5
ec0d1ad442af5be0c318cdd0bf988b0b

SHA1
c67fa7e3f9dd778f7b72703d6772db183423779f

SHA256
c66f59ac59e5dcd5f336494c8a7f0fc82dacd4ebe6c5a08c2c036badb754735a

SHA512
b497cd7892624c12b22450f4e6807f7372a49e2495db2abe2625df74b3a9789ee11fd3e4d6210c9bda7797c442f8fed68009df2c26f72c8572193e7a9ccdc26f

Download Submit
C:\Windows\system\dmnhyQQ.exe

Filesize
3.3MB

MD5
74c72f7eef0256fcae55a34d4453c6c6

SHA1
f1ae1387d3f4010838e66f5d1d71eeaa58aaa7fb

SHA256
a1885888bdeb8cd7fa488c3c4141e85e1d407bc0d13eb7c2ddd2eb8ff7dcd44f

SHA512
10a33a37588a6fb2dcd7000492c47aa5ce4e792578a4bc98fd89e0060d71a01b7c4c0b7c86560ad5c62a23444fe7c62d0feac419677413affe65c6f3dc648d0b

Download Submit
C:\Windows\system\eLWXXUC.exe

Filesize
3.3MB

MD5
5a99f2b605e8ca5c3b01f512036e113c

SHA1
a66321e488b6b7fdcd3fc162f12f9222c23a478f

SHA256
f66059c397d0916d0a3bbe2039e8b8cc5bad3473c245c689c009a88da672dc19

SHA512
b16e8a7ede576fd8c923af8469f300cda86818db4fc21c6c8455b5dabf0670417719b28cbd98c12486e7758e888515e38ae808e9965b52b722bdf84a847d9e18

Download Submit
C:\Windows\system\guweAlw.exe

Filesize
3.3MB

MD5
b91ebfc8a96b1d06cb72582729fa29d5

SHA1
459f97ffb58e4998a67e7fbbd7a0c969ee1ce3be

SHA256
c8c665907dbf395616dd8d0a2db2a9609c41f33cee2bfe6bf6752756e71be2a7

SHA512
a0b4569f5822aa4e2cc24a490cda5ca11b8c1a6646e049c31b63ef3af9e47d13a9dec058b40df03bcaaebcb27b709766e41aa3b51eff663f784ae8353dba2699

Download Submit
C:\Windows\system\gzBhvVn.exe

Filesize
3.3MB

MD5
67c41075701ba1e8c91776bd8fa414ba

SHA1
681b32cc5a60d4e007c81a0fa58703bd712c529f

SHA256
56e7db6c33c161b68efce6ce4b4ac8df930e144ce682d832c9871bc54e812d13

SHA512
5304ca812c0581a444b35a0690ab983ed51ddb57eb1392dd917e696fe2462812f306b54aa1c2252a45b410b1167c32f225b5f5c264e8ef70c15eb55f6b5e3758

Download Submit
C:\Windows\system\hgHtXVR.exe

Filesize
3.3MB

MD5
92b74dec233080d7cb4a85d3cd497f22

SHA1
7e27c104a94d41fc1746116aab1af352cebd98d9

SHA256
20018022d4242dac3d4ff40408b9db277d9d33fe67ae20b4a1f9f2bb5e12df24

SHA512
99f4def830b5c97a30efdee45659c2df399692ef67f19a4a6a605afb496a1a7e63bc63bb4f7b3472ef7c1c0821a1fd48efe4604ac3550a13bb0f1005914ebbdd

Download Submit
C:\Windows\system\hqNAAsH.exe

Filesize
3.3MB

MD5
5d72227ca91d2c32fe3290259d670b44

SHA1
257f475ace41f5ef2dfb8842a5ae49702efb5702

SHA256
360548e942e29d7bf69d052d1044d8f66ee5bf57b657d730bc25b97d099a6d4c

SHA512
22d11f43b95f1b2ae07109e936255e5e2e7f770422c240c8be423c52c30e8871625ca8461b837b50331acecdd7d10050b2eca042d421cd80dc0336ac51431f2b

Download Submit
C:\Windows\system\kAErgcn.exe

Filesize
3.3MB

MD5
3939f29f2873c643368b36a67974f282

SHA1
f9a67d1be96deaa6b4d84bef55d34e85af4e28b8

SHA256
202fbea5055591108cf5d57c26d145de04430d6d8fd874d829f7e002f8effbad

SHA512
bb036ad1c64118599c1e9957a95ddd2a369041fae04efc5cc5523416c420e09e7e4b00281ace5f89475a8488cce37283702a14e09ca662e597436e040f850d5d

Download Submit
C:\Windows\system\nZGjgsF.exe

Filesize
3.3MB

MD5
372fc0410e0bcc22a80bf8cb6631d4a9

SHA1
314c1363702ff86446542b0d821cda224eccbb57

SHA256
518f45d40e7de26b936d2552280e7f075d459ff2f679f5b11fb4d8cd0bccaed7

SHA512
f2764f0f2090355487a248c962419f7f012ee3f378ae5875cf1fe4f0d347c03559487cd394f1db1131b22d88fa47797f3290b5d1ad3d4c28559c24ad8da83537

Download Submit
C:\Windows\system\nzJMfLg.exe

Filesize
3.3MB

MD5
2479839cc9b9206758adb10141af846d

SHA1
519400d51cef5bf3f6b8eb5fcf6d9e6476c8cfb3

SHA256
f89505ead805a0178635914e84d73fe6288a6c11cd4dd75bab36a3025b1b0bd3

SHA512
1ddd267d83cb6ff9a3c2271ac603e3eb3506b0488599fa6e9928419047fea5f96f62472160ec1a0882b76ccd5fc71217c37d71e4ddd00c6a6a61d4524a74a9bd

Download Submit
C:\Windows\system\qITNIZR.exe

Filesize
3.3MB

MD5
fd97ddc365c38fef98d27b4579caa1fe

SHA1
cfdb6ed5832709fe354f7b7f665f2753454443a7

SHA256
a68d2c7a501b0698a10c424919ddc6363b4b1a1102e6d8bea00dd12b0792eb72

SHA512
48f86c07870d17f996bb2826e246f66cad72dbdaaae4828df67a0e8cedb037100727ce78638a33a1da990080fdcfef129c4f45fe1b1d802a4bebd7144eff4438

Download Submit
C:\Windows\system\qTHewPH.exe

Filesize
3.3MB

MD5
d31bf125fa39dd51ff1d2a0e28410c8e

SHA1
78057d380407c80ddabbc183b8488fd319248d89

SHA256
a7e3de4bde55d81233907a09f332f101f7a7dd8e832f33fec3ec8e4ee8a9ded2

SHA512
d9f76bf883e996de395b4b98c442a28caaa971220bca9d4b3aef853614efb4e2c80ff8b631179201fb063746378e99e1073d9db3a23cb781aac8d82debdf1ed6

Download Submit
C:\Windows\system\sgPNFiy.exe

Filesize
3.3MB

MD5
a9fce9b8036209470719d31f8a472957

SHA1
484ee6c1b988d5d0a401fc8a71f31f4bb41306ec

SHA256
e12cc03db58bc47cda8e0ef341f70945f65596086431888be8327340a93d5b70

SHA512
a67c2542cfcdf82726f503c21b50cf4e6919f50e6366dfa49e524fab1d0922130f942b14888642ea6962fbb20fdef6a58307df6426109379dedd6bd225ee5cf6

Download Submit
C:\Windows\system\ubdzLyc.exe

Filesize
3.3MB

MD5
6cd4466a9019deb4c562073f07df83a0

SHA1
0b54acbb8b6a05baf2a89f51851adf6be0b058e6

SHA256
c0f635b9c3ffcc3fa488513341c2917b9e145c67f4b899b2b77716349c315880

SHA512
b9d34cf492fb197c9c844f01dc673006656746b7d19ec4075352eb8a5bb101d65f9ec5e91f38756dcf9805614b694122a556fb5394037d2da00204c83add0c51

Download Submit
C:\Windows\system\xgBjMKd.exe

Filesize
3.3MB

MD5
dc911f70aa42c2143c3b7e7b630cce72

SHA1
440d574b3715bde411eea1a4ac03a1be74171e6f

SHA256
11ae39762d82e7ca458a1ad84b69f035c2347c5bd19b2dac082764cfacac8d32

SHA512
734b325252d5e36a74634fbabd19b2cd01843b1d5bc8bdb71ff8bd32a164173cd2f286625821f9e3a34533402141e409aba69d997a17d6b6014db9179443e427

Download Submit
\Windows\system\IVKwxOV.exe

Filesize
3.3MB

MD5
b3e65d6e8eada5ebf9769bee917971ea

SHA1
2b280f5a25307b560737a87c600feb605d45d8af

SHA256
f8fbdac38f9a128137f8b680f8fb3ec99b6cbb4b394d95f52f55ad194dd9f9c1

SHA512
c44ef2997e47f4dec35f3bfc030945ef6b98534b06a4a513deaaacdc93cce5d1f2333944bb358eecc7f6b790f8496c7330be474a22a3ae74b9f2b2aee0857786

Download Submit
\Windows\system\THfEghi.exe

Filesize
3.3MB

MD5
03e59be48e5c897741cf3fd9d1edeaf8

SHA1
78bddee42d91083261c9335bf45cba6040b92da0

SHA256
a4cb81ae04f259ecf615da77ac695f19b7cd23c562549bbc00d4ee32e2d005af

SHA512
bdbbc05f6d38fcea20b489529f3ed66a1996980123cd4c636edd2375374757bca61ac7fdb8cec546be4c23c8dcfb05cafdfd82f838fc1e7e9bf0a5926c30c8a7

Download Submit
\Windows\system\kstyPwk.exe

Filesize
3.3MB

MD5
1bda28b550aaecec1c344da148b25f58

SHA1
b48aee62bc10c8d892811c4a717104b2985cdda2

SHA256
13f1abd5213d615ac3e20434f907039cfe188588ad3535996d0a406d95397e8a

SHA512
f24cb5e8e0689874959e55d1160d5708f60a6dcbdfbbe5b04207dc2b503c79269bdfbd0283b53bd9b9edb215eebed9627de070a4ab3cce69826aa4eba6b44191

Download Submit
\Windows\system\mEHrwQB.exe

Filesize
3.3MB

MD5
6ee90e8bfb8d2f90fdd0fe750dba11e8

SHA1
87a165064040f6d23205d9d0b18beddadcb743da

SHA256
ed4ab00d6315afc52e2dc8728209de8969021af9746462eb0cac7dcb02b73d96

SHA512
591cfbd52ae1c28e4cae1c018712709cebb37e202a9283f5d78ed069e9091c7db96439e701ab0370b74b716475f3d98468cd5bf5fa661833af411bc27bd88ab7

Download Submit
\Windows\system\nNPKULG.exe

Filesize
3.3MB

MD5
fe4dcb651d9455023433c5d82db4e444

SHA1
05a82527239022c4b0e71f735456a9b2bd013053

SHA256
c4657be72e3282d1412c8329f34c182855a3bfe571134c448dda30b3ef0a22ef

SHA512
1101c9198c5bdeedf58e6a9eec61205b13e2a76c24c7788d154f374ccea38c8e89e4e227fc2ebd7755fa9b4344b5126780be2ad51a33a1eed925b8d8d5c44092

Download Submit
\Windows\system\xGawJQf.exe

Filesize
3.3MB

MD5
82262673f9a9673602b4d2caf7089a4e

SHA1
937605aaf1244db4a2613f154fa437db25061cd9

SHA256
146962522f8a7ecd0235faf160167764ec6b6b1048b6bc7f152bb32041cfdabc

SHA512
10205589049a285a0a1cf8e4113aca7fe716e55ff95ff258415a72e26a7886f154991c9b7b37b9483b377733356e3c5b9c7ed34aa6fb9a4afd15c7bb99f59198

Download Submit
memory/1956-1299-0x000000013F9E0000-0x000000013FD34000-memory.dmp

Filesize
3.3MB

Download
memory/1956-95-0x000000013F9E0000-0x000000013FD34000-memory.dmp

Filesize
3.3MB

Download
memory/1956-4020-0x000000013F9E0000-0x000000013FD34000-memory.dmp

Filesize
3.3MB

Download
memory/1992-45-0x000000013F8C0000-0x000000013FC14000-memory.dmp

Filesize
3.3MB

Download
memory/1992-4012-0x000000013F8C0000-0x000000013FC14000-memory.dmp

Filesize
3.3MB

Download
memory/2172-4017-0x000000013F530000-0x000000013F884000-memory.dmp

Filesize
3.3MB

Download
memory/2172-54-0x000000013F530000-0x000000013F884000-memory.dmp

Filesize
3.3MB

Download
memory/2172-672-0x000000013F530000-0x000000013F884000-memory.dmp

Filesize
3.3MB

Download
memory/2296-549-0x000000013F9B0000-0x000000013FD04000-memory.dmp

Filesize
3.3MB

Download
memory/2296-49-0x000000013F9B0000-0x000000013FD04000-memory.dmp

Filesize
3.3MB

Download
memory/2296-4018-0x000000013F9B0000-0x000000013FD04000-memory.dmp

Filesize
3.3MB

Download
memory/2332-105-0x0000000002130000-0x0000000002484000-memory.dmp

Filesize
3.3MB

Download
memory/2332-63-0x000000013F310000-0x000000013F664000-memory.dmp

Filesize
3.3MB

Download
memory/2332-91-0x000000013F320000-0x000000013F674000-memory.dmp

Filesize
3.3MB

Download
memory/2332-104-0x0000000002130000-0x0000000002484000-memory.dmp

Filesize
3.3MB

Download
memory/2332-0-0x000000013FC10000-0x000000013FF64000-memory.dmp

Filesize
3.3MB

Download
memory/2332-1-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/2332-68-0x000000013FC10000-0x000000013FF64000-memory.dmp

Filesize
3.3MB

Download
memory/2332-106-0x0000000002130000-0x0000000002484000-memory.dmp

Filesize
3.3MB

Download
memory/2332-8-0x0000000002130000-0x0000000002484000-memory.dmp

Filesize
3.3MB

Download
memory/2332-108-0x000000013F630000-0x000000013F984000-memory.dmp

Filesize
3.3MB

Download
memory/2332-1296-0x0000000002130000-0x0000000002484000-memory.dmp

Filesize
3.3MB

Download
memory/2332-41-0x0000000002130000-0x0000000002484000-memory.dmp

Filesize
3.3MB

Download
memory/2332-44-0x0000000002130000-0x0000000002484000-memory.dmp

Filesize
3.3MB

Download
memory/2332-39-0x000000013F170000-0x000000013F4C4000-memory.dmp

Filesize
3.3MB

Download
memory/2332-53-0x000000013F530000-0x000000013F884000-memory.dmp

Filesize
3.3MB

Download
memory/2332-1298-0x000000013F320000-0x000000013F674000-memory.dmp

Filesize
3.3MB

Download
memory/2332-1531-0x0000000002130000-0x0000000002484000-memory.dmp

Filesize
3.3MB

Download
memory/2332-1528-0x000000013F2A0000-0x000000013F5F4000-memory.dmp

Filesize
3.3MB

Download
memory/2332-28-0x0000000002130000-0x0000000002484000-memory.dmp

Filesize
3.3MB

Download
memory/2332-34-0x0000000002130000-0x0000000002484000-memory.dmp

Filesize
3.3MB

Download
memory/2332-1532-0x0000000002130000-0x0000000002484000-memory.dmp

Filesize
3.3MB

Download
memory/2332-99-0x000000013F2A0000-0x000000013F5F4000-memory.dmp

Filesize
3.3MB

Download
memory/2456-37-0x000000013FD60000-0x00000001400B4000-memory.dmp

Filesize
3.3MB

Download
memory/2456-4014-0x000000013FD60000-0x00000001400B4000-memory.dmp

Filesize
3.3MB

Download
memory/2456-103-0x000000013FD60000-0x00000001400B4000-memory.dmp

Filesize
3.3MB

Download
memory/2480-74-0x000000013FCB0000-0x0000000140004000-memory.dmp

Filesize
3.3MB

Download
memory/2480-27-0x000000013FCB0000-0x0000000140004000-memory.dmp

Filesize
3.3MB

Download
memory/2480-4013-0x000000013FCB0000-0x0000000140004000-memory.dmp

Filesize
3.3MB

Download
memory/2496-46-0x000000013FCA0000-0x000000013FFF4000-memory.dmp

Filesize
3.3MB

Download
memory/2496-4021-0x000000013FCA0000-0x000000013FFF4000-memory.dmp

Filesize
3.3MB

Download
memory/2624-4019-0x000000013F2A0000-0x000000013F5F4000-memory.dmp

Filesize
3.3MB

Download
memory/2624-1533-0x000000013F2A0000-0x000000013F5F4000-memory.dmp

Filesize
3.3MB

Download
memory/2624-107-0x000000013F2A0000-0x000000013F5F4000-memory.dmp

Filesize
3.3MB

Download
memory/2760-4022-0x000000013FA90000-0x000000013FDE4000-memory.dmp

Filesize
3.3MB

Download
memory/2760-1297-0x000000013FA90000-0x000000013FDE4000-memory.dmp

Filesize
3.3MB

Download
memory/2760-69-0x000000013FA90000-0x000000013FDE4000-memory.dmp

Filesize
3.3MB

Download
memory/2820-64-0x000000013F310000-0x000000013F664000-memory.dmp

Filesize
3.3MB

Download
memory/2820-4016-0x000000013F310000-0x000000013F664000-memory.dmp

Filesize
3.3MB

Download
memory/2872-4015-0x000000013F170000-0x000000013F4C4000-memory.dmp

Filesize
3.3MB

Download
memory/2872-47-0x000000013F170000-0x000000013F4C4000-memory.dmp

Filesize
3.3MB

Download
memory/3060-9-0x000000013F910000-0x000000013FC64000-memory.dmp

Filesize
3.3MB

Download
memory/3060-4011-0x000000013F910000-0x000000013FC64000-memory.dmp

Filesize
3.3MB

Download