xmrig | 33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/12/2024, 23:27 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
Size

2.7MB
MD5

d5009aafdf9792869dacfefafaccb266
SHA1

bd1cce8fa201ebc93bd4ac05e8d99ac422c6669b
SHA256

33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47
SHA512

dd9d64a94b28088919ddf660dead67d3c9ee422314af4235e3c51db456cdcd9eb0f66c5b1ef2fa7c6d34d42197185644f78fefaba82c91b0eaefb091222b5f04
SSDEEP

49152:EnCbL83y9FdfE0pZ0zCa4wI156uL3pgrCEdMKPFotsgEBr6r:EniLf9FdfE0pZB156utgpPFotBE0

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/1960-0-0x000000013FF70000-0x00000001402C4000-memory.dmp	xmrig
behavioral1/files/0x00080000000120f9-3.dat	xmrig
behavioral1/files/0x0008000000016d71-11.dat	xmrig
behavioral1/files/0x0007000000017355-23.dat	xmrig
behavioral1/memory/1960-57-0x0000000002160000-0x00000000024B4000-memory.dmp	xmrig
behavioral1/memory/2176-43-0x000000013FA50000-0x000000013FDA4000-memory.dmp	xmrig
behavioral1/files/0x00050000000195ca-67.dat	xmrig
behavioral1/files/0x0005000000019bf2-129.dat	xmrig
behavioral1/files/0x0005000000019c0b-144.dat	xmrig
behavioral1/files/0x0005000000019d69-164.dat	xmrig
behavioral1/memory/3012-1168-0x000000013FEC0000-0x0000000140214000-memory.dmp	xmrig
behavioral1/memory/1308-1036-0x000000013FFB0000-0x0000000140304000-memory.dmp	xmrig
behavioral1/memory/1960-902-0x0000000002160000-0x00000000024B4000-memory.dmp	xmrig
behavioral1/memory/2672-455-0x000000013F5A0000-0x000000013F8F4000-memory.dmp	xmrig
behavioral1/files/0x000500000001a05a-189.dat	xmrig
behavioral1/files/0x000500000001a033-184.dat	xmrig
behavioral1/files/0x000500000001a020-179.dat	xmrig
behavioral1/files/0x0005000000019f71-174.dat	xmrig
behavioral1/files/0x0005000000019f57-169.dat	xmrig
behavioral1/files/0x0005000000019d5c-159.dat	xmrig
behavioral1/files/0x0005000000019cfc-154.dat	xmrig
behavioral1/files/0x0005000000019cd5-149.dat	xmrig
behavioral1/files/0x0032000000016d04-126.dat	xmrig
behavioral1/files/0x0005000000019bf0-122.dat	xmrig
behavioral1/memory/3012-110-0x000000013FEC0000-0x0000000140214000-memory.dmp	xmrig
behavioral1/files/0x0005000000019931-107.dat	xmrig
behavioral1/files/0x0005000000019624-97.dat	xmrig
behavioral1/files/0x0005000000019665-94.dat	xmrig
behavioral1/memory/2956-89-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	xmrig
behavioral1/files/0x00050000000195e0-86.dat	xmrig
behavioral1/files/0x00050000000195ce-78.dat	xmrig
behavioral1/files/0x0005000000019bec-114.dat	xmrig
behavioral1/memory/2604-71-0x000000013FD60000-0x00000001400B4000-memory.dmp	xmrig
behavioral1/memory/2572-70-0x000000013FE20000-0x0000000140174000-memory.dmp	xmrig
behavioral1/files/0x00050000000196a0-103.dat	xmrig
behavioral1/memory/1308-102-0x000000013FFB0000-0x0000000140304000-memory.dmp	xmrig
behavioral1/memory/1960-100-0x0000000002160000-0x00000000024B4000-memory.dmp	xmrig
behavioral1/memory/1960-85-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	xmrig
behavioral1/files/0x00050000000195d0-84.dat	xmrig
behavioral1/files/0x00050000000195cc-75.dat	xmrig
behavioral1/files/0x00070000000191d1-65.dat	xmrig
behavioral1/memory/2672-64-0x000000013F5A0000-0x000000013F8F4000-memory.dmp	xmrig
behavioral1/memory/1960-63-0x000000013FF70000-0x00000001402C4000-memory.dmp	xmrig
behavioral1/files/0x00050000000195c8-61.dat	xmrig
behavioral1/memory/2608-53-0x000000013FC60000-0x000000013FFB4000-memory.dmp	xmrig
behavioral1/memory/2844-42-0x000000013F080000-0x000000013F3D4000-memory.dmp	xmrig
behavioral1/files/0x000700000001739f-39.dat	xmrig
behavioral1/files/0x00070000000173a3-47.dat	xmrig
behavioral1/files/0x0008000000017342-38.dat	xmrig
behavioral1/memory/2432-37-0x000000013F390000-0x000000013F6E4000-memory.dmp	xmrig
behavioral1/memory/1960-32-0x0000000002160000-0x00000000024B4000-memory.dmp	xmrig
behavioral1/memory/2792-30-0x000000013F0E0000-0x000000013F434000-memory.dmp	xmrig
behavioral1/memory/2756-20-0x000000013FC60000-0x000000013FFB4000-memory.dmp	xmrig
behavioral1/files/0x0008000000016e1d-10.dat	xmrig
behavioral1/memory/2128-18-0x000000013F800000-0x000000013FB54000-memory.dmp	xmrig
behavioral1/memory/2128-4016-0x000000013F800000-0x000000013FB54000-memory.dmp	xmrig
behavioral1/memory/2792-4017-0x000000013F0E0000-0x000000013F434000-memory.dmp	xmrig
behavioral1/memory/2756-4018-0x000000013FC60000-0x000000013FFB4000-memory.dmp	xmrig
behavioral1/memory/2432-4021-0x000000013F390000-0x000000013F6E4000-memory.dmp	xmrig
behavioral1/memory/2604-4020-0x000000013FD60000-0x00000001400B4000-memory.dmp	xmrig
behavioral1/memory/2608-4019-0x000000013FC60000-0x000000013FFB4000-memory.dmp	xmrig
behavioral1/memory/2176-4022-0x000000013FA50000-0x000000013FDA4000-memory.dmp	xmrig
behavioral1/memory/2844-4023-0x000000013F080000-0x000000013F3D4000-memory.dmp	xmrig
behavioral1/memory/2956-4025-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2128	tQlmRgc.exe
2756	RlqpqGD.exe
2792	xqPurIK.exe
2432	siUTTCV.exe
2844	VqZpkjv.exe
2176	SyXHQlC.exe
2608	ssDhGSC.exe
2672	ygYaqfm.exe
2572	ZJCetLf.exe
2604	cOomCJf.exe
2956	nhMXvOn.exe
1308	qWbGSFz.exe
3012	oPdTqIX.exe
2136	weznWSE.exe
2740	sfauBLu.exe
432	BlOGxHp.exe
2412	TRYxOIK.exe
1892	oXmlbtc.exe
900	vybPkIe.exe
2368	yphoTaC.exe
2420	XnSCHGb.exe
2904	evFNkvn.exe
2824	igyEzvV.exe
352	PGckjkM.exe
2520	ihcWPkG.exe
1876	pdtqCWZ.exe
2296	KxXVVlk.exe
2396	eRODHBh.exe
1884	jtgexVq.exe
1348	sdemdgp.exe
1108	xxGRpOh.exe
1716	obFgFqD.exe
920	cPDHTIJ.exe
2020	AKJSwoX.exe
2976	pvEWHzC.exe
2104	sxGyQYS.exe
1564	bxEJIiq.exe
2728	KGVImbg.exe
1940	mZgVBRU.exe
1980	mgLZqla.exe
2256	JnuVsaP.exe
288	HCvZqKB.exe
1904	RsIZbnc.exe
308	gUmljKz.exe
2652	JYXwylS.exe
2304	mkPyJUd.exe
3064	xGXFAUe.exe
1072	YVLSxNa.exe
2004	kwdTRyW.exe
1076	ymXSlvI.exe
1780	VRQhpHP.exe
888	skDSIAH.exe
2060	ZNdlwyP.exe
1588	wJvsGJd.exe
1612	zAKqFya.exe
2660	rRZpSec.exe
2704	IOOaWhg.exe
2168	gDVQsWo.exe
2560	ciMrHyH.exe
2688	LosAuqE.exe
2892	aHpaDfq.exe
2912	TrEbLQz.exe
1160	rPBmKeJ.exe
1324	SggDSLL.exe

Loads dropped DLL 64 IoCs

pid	Process
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe

UPX packed file 63 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1960-0-0x000000013FF70000-0x00000001402C4000-memory.dmp	upx
behavioral1/files/0x00080000000120f9-3.dat	upx
behavioral1/files/0x0008000000016d71-11.dat	upx
behavioral1/files/0x0007000000017355-23.dat	upx
behavioral1/memory/2176-43-0x000000013FA50000-0x000000013FDA4000-memory.dmp	upx
behavioral1/files/0x00050000000195ca-67.dat	upx
behavioral1/files/0x0005000000019bf2-129.dat	upx
behavioral1/files/0x0005000000019c0b-144.dat	upx
behavioral1/files/0x0005000000019d69-164.dat	upx
behavioral1/memory/3012-1168-0x000000013FEC0000-0x0000000140214000-memory.dmp	upx
behavioral1/memory/1308-1036-0x000000013FFB0000-0x0000000140304000-memory.dmp	upx
behavioral1/memory/2672-455-0x000000013F5A0000-0x000000013F8F4000-memory.dmp	upx
behavioral1/files/0x000500000001a05a-189.dat	upx
behavioral1/files/0x000500000001a033-184.dat	upx
behavioral1/files/0x000500000001a020-179.dat	upx
behavioral1/files/0x0005000000019f71-174.dat	upx
behavioral1/files/0x0005000000019f57-169.dat	upx
behavioral1/files/0x0005000000019d5c-159.dat	upx
behavioral1/files/0x0005000000019cfc-154.dat	upx
behavioral1/files/0x0005000000019cd5-149.dat	upx
behavioral1/files/0x0032000000016d04-126.dat	upx
behavioral1/files/0x0005000000019bf0-122.dat	upx
behavioral1/memory/3012-110-0x000000013FEC0000-0x0000000140214000-memory.dmp	upx
behavioral1/files/0x0005000000019931-107.dat	upx
behavioral1/files/0x0005000000019624-97.dat	upx
behavioral1/files/0x0005000000019665-94.dat	upx
behavioral1/memory/2956-89-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	upx
behavioral1/files/0x00050000000195e0-86.dat	upx
behavioral1/files/0x00050000000195ce-78.dat	upx
behavioral1/files/0x0005000000019bec-114.dat	upx
behavioral1/memory/2604-71-0x000000013FD60000-0x00000001400B4000-memory.dmp	upx
behavioral1/memory/2572-70-0x000000013FE20000-0x0000000140174000-memory.dmp	upx
behavioral1/files/0x00050000000196a0-103.dat	upx
behavioral1/memory/1308-102-0x000000013FFB0000-0x0000000140304000-memory.dmp	upx
behavioral1/files/0x00050000000195d0-84.dat	upx
behavioral1/files/0x00050000000195cc-75.dat	upx
behavioral1/files/0x00070000000191d1-65.dat	upx
behavioral1/memory/2672-64-0x000000013F5A0000-0x000000013F8F4000-memory.dmp	upx
behavioral1/memory/1960-63-0x000000013FF70000-0x00000001402C4000-memory.dmp	upx
behavioral1/files/0x00050000000195c8-61.dat	upx
behavioral1/memory/2608-53-0x000000013FC60000-0x000000013FFB4000-memory.dmp	upx
behavioral1/memory/2844-42-0x000000013F080000-0x000000013F3D4000-memory.dmp	upx
behavioral1/files/0x000700000001739f-39.dat	upx
behavioral1/files/0x00070000000173a3-47.dat	upx
behavioral1/files/0x0008000000017342-38.dat	upx
behavioral1/memory/2432-37-0x000000013F390000-0x000000013F6E4000-memory.dmp	upx
behavioral1/memory/2792-30-0x000000013F0E0000-0x000000013F434000-memory.dmp	upx
behavioral1/memory/2756-20-0x000000013FC60000-0x000000013FFB4000-memory.dmp	upx
behavioral1/files/0x0008000000016e1d-10.dat	upx
behavioral1/memory/2128-18-0x000000013F800000-0x000000013FB54000-memory.dmp	upx
behavioral1/memory/2128-4016-0x000000013F800000-0x000000013FB54000-memory.dmp	upx
behavioral1/memory/2792-4017-0x000000013F0E0000-0x000000013F434000-memory.dmp	upx
behavioral1/memory/2756-4018-0x000000013FC60000-0x000000013FFB4000-memory.dmp	upx
behavioral1/memory/2432-4021-0x000000013F390000-0x000000013F6E4000-memory.dmp	upx
behavioral1/memory/2604-4020-0x000000013FD60000-0x00000001400B4000-memory.dmp	upx
behavioral1/memory/2608-4019-0x000000013FC60000-0x000000013FFB4000-memory.dmp	upx
behavioral1/memory/2176-4022-0x000000013FA50000-0x000000013FDA4000-memory.dmp	upx
behavioral1/memory/2844-4023-0x000000013F080000-0x000000013F3D4000-memory.dmp	upx
behavioral1/memory/2956-4025-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	upx
behavioral1/memory/2672-4024-0x000000013F5A0000-0x000000013F8F4000-memory.dmp	upx
behavioral1/memory/2572-4026-0x000000013FE20000-0x0000000140174000-memory.dmp	upx
behavioral1/memory/3012-4027-0x000000013FEC0000-0x0000000140214000-memory.dmp	upx
behavioral1/memory/1308-4028-0x000000013FFB0000-0x0000000140304000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UOqJxUv.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\YNpgSJK.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\YrYMXpw.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\atcGcVW.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\KDKuaSL.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\gtGKgxW.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\RbeXlRU.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\OKLqnuf.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\mLjomGg.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\ahhxsjd.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\LqryQQl.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\RPcotjp.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\OOHGouu.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\JbWOmGj.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\KGVImbg.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\UMXuCdu.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\NuJOirv.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\zRBrIjq.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\nqMkWvF.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\JOMVZGa.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\WAcBJnZ.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\aURugQF.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\jwlLLze.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\OJAFOxb.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\FgYnWKQ.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\ypnTtwY.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\yEtSbqt.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\QwDOleO.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\TTktBcO.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\GgZRMRL.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\vrKhaQO.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\scKfqFI.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\PaMPZFy.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\wPAbByF.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\nSBfqOb.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\MPUBFhr.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\TuAVaSb.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\oMSrUuP.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\zxWbEzn.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\GqswwSW.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\lgPZcRf.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\xdCFwoX.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\IimYKYb.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\cYNoLTV.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\hXbzsAI.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\kQMmQEu.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\ZikVOaG.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\CxaGYYx.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\rPBmKeJ.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\BkZbFep.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\vYIQYLK.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\qfyWBfN.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\FpyGqMW.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\eRODHBh.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\IDpacbN.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\KrKEDTK.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\YoKeswM.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\PobplFS.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\CtqGbEr.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\yfhgmlC.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\nDUNEVN.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\cYBXXuV.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\eNllBYN.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
File created	C:\Windows\System\KIKWuWl.exe	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2128	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	31
PID 1960 wrote to memory of 2128	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	31
PID 1960 wrote to memory of 2128	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	31
PID 1960 wrote to memory of 2756	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	32
PID 1960 wrote to memory of 2756	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	32
PID 1960 wrote to memory of 2756	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	32
PID 1960 wrote to memory of 2792	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	33
PID 1960 wrote to memory of 2792	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	33
PID 1960 wrote to memory of 2792	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	33
PID 1960 wrote to memory of 2844	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	34
PID 1960 wrote to memory of 2844	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	34
PID 1960 wrote to memory of 2844	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	34
PID 1960 wrote to memory of 2432	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	35
PID 1960 wrote to memory of 2432	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	35
PID 1960 wrote to memory of 2432	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	35
PID 1960 wrote to memory of 2176	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	36
PID 1960 wrote to memory of 2176	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	36
PID 1960 wrote to memory of 2176	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	36
PID 1960 wrote to memory of 2608	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	37
PID 1960 wrote to memory of 2608	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	37
PID 1960 wrote to memory of 2608	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	37
PID 1960 wrote to memory of 2572	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	38
PID 1960 wrote to memory of 2572	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	38
PID 1960 wrote to memory of 2572	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	38
PID 1960 wrote to memory of 2672	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	39
PID 1960 wrote to memory of 2672	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	39
PID 1960 wrote to memory of 2672	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	39
PID 1960 wrote to memory of 2604	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	40
PID 1960 wrote to memory of 2604	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	40
PID 1960 wrote to memory of 2604	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	40
PID 1960 wrote to memory of 2956	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	41
PID 1960 wrote to memory of 2956	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	41
PID 1960 wrote to memory of 2956	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	41
PID 1960 wrote to memory of 432	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	42
PID 1960 wrote to memory of 432	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	42
PID 1960 wrote to memory of 432	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	42
PID 1960 wrote to memory of 1308	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	43
PID 1960 wrote to memory of 1308	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	43
PID 1960 wrote to memory of 1308	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	43
PID 1960 wrote to memory of 2412	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	44
PID 1960 wrote to memory of 2412	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	44
PID 1960 wrote to memory of 2412	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	44
PID 1960 wrote to memory of 3012	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	45
PID 1960 wrote to memory of 3012	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	45
PID 1960 wrote to memory of 3012	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	45
PID 1960 wrote to memory of 1892	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	46
PID 1960 wrote to memory of 1892	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	46
PID 1960 wrote to memory of 1892	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	46
PID 1960 wrote to memory of 2136	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	47
PID 1960 wrote to memory of 2136	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	47
PID 1960 wrote to memory of 2136	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	47
PID 1960 wrote to memory of 900	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	48
PID 1960 wrote to memory of 900	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	48
PID 1960 wrote to memory of 900	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	48
PID 1960 wrote to memory of 2740	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	49
PID 1960 wrote to memory of 2740	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	49
PID 1960 wrote to memory of 2740	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	49
PID 1960 wrote to memory of 2368	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	50
PID 1960 wrote to memory of 2368	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	50
PID 1960 wrote to memory of 2368	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	50
PID 1960 wrote to memory of 2420	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	51
PID 1960 wrote to memory of 2420	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	51
PID 1960 wrote to memory of 2420	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	51
PID 1960 wrote to memory of 2904	1960	JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe	52

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_33c1bca3b3e663e080f58725a6132ffa1aca316ab2b029ecc4e39b2fa9f07c47.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\System\tQlmRgc.exe
  C:\Windows\System\tQlmRgc.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\RlqpqGD.exe
  C:\Windows\System\RlqpqGD.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\xqPurIK.exe
  C:\Windows\System\xqPurIK.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\VqZpkjv.exe
  C:\Windows\System\VqZpkjv.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\siUTTCV.exe
  C:\Windows\System\siUTTCV.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\SyXHQlC.exe
  C:\Windows\System\SyXHQlC.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\ssDhGSC.exe
  C:\Windows\System\ssDhGSC.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\ZJCetLf.exe
  C:\Windows\System\ZJCetLf.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\ygYaqfm.exe
  C:\Windows\System\ygYaqfm.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\cOomCJf.exe
  C:\Windows\System\cOomCJf.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\nhMXvOn.exe
  C:\Windows\System\nhMXvOn.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\BlOGxHp.exe
  C:\Windows\System\BlOGxHp.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\qWbGSFz.exe
  C:\Windows\System\qWbGSFz.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\TRYxOIK.exe
  C:\Windows\System\TRYxOIK.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\oPdTqIX.exe
  C:\Windows\System\oPdTqIX.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\oXmlbtc.exe
  C:\Windows\System\oXmlbtc.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\weznWSE.exe
  C:\Windows\System\weznWSE.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\vybPkIe.exe
  C:\Windows\System\vybPkIe.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\sfauBLu.exe
  C:\Windows\System\sfauBLu.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\yphoTaC.exe
  C:\Windows\System\yphoTaC.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\XnSCHGb.exe
  C:\Windows\System\XnSCHGb.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\evFNkvn.exe
  C:\Windows\System\evFNkvn.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\igyEzvV.exe
  C:\Windows\System\igyEzvV.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\PGckjkM.exe
  C:\Windows\System\PGckjkM.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\ihcWPkG.exe
  C:\Windows\System\ihcWPkG.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\pdtqCWZ.exe
  C:\Windows\System\pdtqCWZ.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\KxXVVlk.exe
  C:\Windows\System\KxXVVlk.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\eRODHBh.exe
  C:\Windows\System\eRODHBh.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\jtgexVq.exe
  C:\Windows\System\jtgexVq.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\sdemdgp.exe
  C:\Windows\System\sdemdgp.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\xxGRpOh.exe
  C:\Windows\System\xxGRpOh.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\obFgFqD.exe
  C:\Windows\System\obFgFqD.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\cPDHTIJ.exe
  C:\Windows\System\cPDHTIJ.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\AKJSwoX.exe
  C:\Windows\System\AKJSwoX.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\pvEWHzC.exe
  C:\Windows\System\pvEWHzC.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\sxGyQYS.exe
  C:\Windows\System\sxGyQYS.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\bxEJIiq.exe
  C:\Windows\System\bxEJIiq.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\KGVImbg.exe
  C:\Windows\System\KGVImbg.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\mZgVBRU.exe
  C:\Windows\System\mZgVBRU.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\mgLZqla.exe
  C:\Windows\System\mgLZqla.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\JnuVsaP.exe
  C:\Windows\System\JnuVsaP.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\HCvZqKB.exe
  C:\Windows\System\HCvZqKB.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\RsIZbnc.exe
  C:\Windows\System\RsIZbnc.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\gUmljKz.exe
  C:\Windows\System\gUmljKz.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\JYXwylS.exe
  C:\Windows\System\JYXwylS.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\mkPyJUd.exe
  C:\Windows\System\mkPyJUd.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\xGXFAUe.exe
  C:\Windows\System\xGXFAUe.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\YVLSxNa.exe
  C:\Windows\System\YVLSxNa.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\kwdTRyW.exe
  C:\Windows\System\kwdTRyW.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\ymXSlvI.exe
  C:\Windows\System\ymXSlvI.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\VRQhpHP.exe
  C:\Windows\System\VRQhpHP.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\skDSIAH.exe
  C:\Windows\System\skDSIAH.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\ZNdlwyP.exe
  C:\Windows\System\ZNdlwyP.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\wJvsGJd.exe
  C:\Windows\System\wJvsGJd.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\zAKqFya.exe
  C:\Windows\System\zAKqFya.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\rRZpSec.exe
  C:\Windows\System\rRZpSec.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\IOOaWhg.exe
  C:\Windows\System\IOOaWhg.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\gDVQsWo.exe
  C:\Windows\System\gDVQsWo.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\ciMrHyH.exe
  C:\Windows\System\ciMrHyH.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\LosAuqE.exe
  C:\Windows\System\LosAuqE.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\aHpaDfq.exe
  C:\Windows\System\aHpaDfq.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\TrEbLQz.exe
  C:\Windows\System\TrEbLQz.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\rPBmKeJ.exe
  C:\Windows\System\rPBmKeJ.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\SggDSLL.exe
  C:\Windows\System\SggDSLL.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\SNLnCJc.exe
  C:\Windows\System\SNLnCJc.exe
  2⤵
  PID:1276
- C:\Windows\System\TfOkQIe.exe
  C:\Windows\System\TfOkQIe.exe
  2⤵
  PID:2888
- C:\Windows\System\SdjjuMQ.exe
  C:\Windows\System\SdjjuMQ.exe
  2⤵
  PID:2264
- C:\Windows\System\krNalSv.exe
  C:\Windows\System\krNalSv.exe
  2⤵
  PID:2476
- C:\Windows\System\XsDXhAx.exe
  C:\Windows\System\XsDXhAx.exe
  2⤵
  PID:2308
- C:\Windows\System\jsEmFaU.exe
  C:\Windows\System\jsEmFaU.exe
  2⤵
  PID:796
- C:\Windows\System\yTiJsIe.exe
  C:\Windows\System\yTiJsIe.exe
  2⤵
  PID:2120
- C:\Windows\System\SqEWPTN.exe
  C:\Windows\System\SqEWPTN.exe
  2⤵
  PID:2440
- C:\Windows\System\HqbXhrD.exe
  C:\Windows\System\HqbXhrD.exe
  2⤵
  PID:1320
- C:\Windows\System\cTlVAzf.exe
  C:\Windows\System\cTlVAzf.exe
  2⤵
  PID:2508
- C:\Windows\System\PqiijCj.exe
  C:\Windows\System\PqiijCj.exe
  2⤵
  PID:924
- C:\Windows\System\CPDqWIW.exe
  C:\Windows\System\CPDqWIW.exe
  2⤵
  PID:1048
- C:\Windows\System\QISfEZs.exe
  C:\Windows\System\QISfEZs.exe
  2⤵
  PID:2292
- C:\Windows\System\WPRWbOU.exe
  C:\Windows\System\WPRWbOU.exe
  2⤵
  PID:780
- C:\Windows\System\oZGgUDW.exe
  C:\Windows\System\oZGgUDW.exe
  2⤵
  PID:1976
- C:\Windows\System\CpPkFCH.exe
  C:\Windows\System\CpPkFCH.exe
  2⤵
  PID:1968
- C:\Windows\System\qiIsqIQ.exe
  C:\Windows\System\qiIsqIQ.exe
  2⤵
  PID:1888
- C:\Windows\System\vdndZKK.exe
  C:\Windows\System\vdndZKK.exe
  2⤵
  PID:3000
- C:\Windows\System\tJrbQFG.exe
  C:\Windows\System\tJrbQFG.exe
  2⤵
  PID:2080
- C:\Windows\System\heJHRRj.exe
  C:\Windows\System\heJHRRj.exe
  2⤵
  PID:1728
- C:\Windows\System\cwnGHHO.exe
  C:\Windows\System\cwnGHHO.exe
  2⤵
  PID:3024
- C:\Windows\System\cYBXXuV.exe
  C:\Windows\System\cYBXXuV.exe
  2⤵
  PID:1372
- C:\Windows\System\KfdQRDu.exe
  C:\Windows\System\KfdQRDu.exe
  2⤵
  PID:1608
- C:\Windows\System\NFhucgu.exe
  C:\Windows\System\NFhucgu.exe
  2⤵
  PID:2940
- C:\Windows\System\JAiANaj.exe
  C:\Windows\System\JAiANaj.exe
  2⤵
  PID:2748
- C:\Windows\System\YoWnDoO.exe
  C:\Windows\System\YoWnDoO.exe
  2⤵
  PID:2988
- C:\Windows\System\BkZbFep.exe
  C:\Windows\System\BkZbFep.exe
  2⤵
  PID:2684
- C:\Windows\System\hffTvxH.exe
  C:\Windows\System\hffTvxH.exe
  2⤵
  PID:2648
- C:\Windows\System\EgrpSmf.exe
  C:\Windows\System\EgrpSmf.exe
  2⤵
  PID:2968
- C:\Windows\System\OSqkyRP.exe
  C:\Windows\System\OSqkyRP.exe
  2⤵
  PID:2880
- C:\Windows\System\GSyuRXn.exe
  C:\Windows\System\GSyuRXn.exe
  2⤵
  PID:616
- C:\Windows\System\zRQBsel.exe
  C:\Windows\System\zRQBsel.exe
  2⤵
  PID:2424
- C:\Windows\System\qFhSWKO.exe
  C:\Windows\System\qFhSWKO.exe
  2⤵
  PID:2816
- C:\Windows\System\MJugtUs.exe
  C:\Windows\System\MJugtUs.exe
  2⤵
  PID:2116
- C:\Windows\System\gPxdhRR.exe
  C:\Windows\System\gPxdhRR.exe
  2⤵
  PID:1660
- C:\Windows\System\NmVgQZe.exe
  C:\Windows\System\NmVgQZe.exe
  2⤵
  PID:1624
- C:\Windows\System\sGytTMm.exe
  C:\Windows\System\sGytTMm.exe
  2⤵
  PID:1364
- C:\Windows\System\cXWnZun.exe
  C:\Windows\System\cXWnZun.exe
  2⤵
  PID:1468
- C:\Windows\System\LlonjWL.exe
  C:\Windows\System\LlonjWL.exe
  2⤵
  PID:2512
- C:\Windows\System\lfdOwWi.exe
  C:\Windows\System\lfdOwWi.exe
  2⤵
  PID:2612
- C:\Windows\System\tEiwkNK.exe
  C:\Windows\System\tEiwkNK.exe
  2⤵
  PID:1464
- C:\Windows\System\bFybpIp.exe
  C:\Windows\System\bFybpIp.exe
  2⤵
  PID:2068
- C:\Windows\System\mXZYFKM.exe
  C:\Windows\System\mXZYFKM.exe
  2⤵
  PID:1520
- C:\Windows\System\ATxwEGX.exe
  C:\Windows\System\ATxwEGX.exe
  2⤵
  PID:3060
- C:\Windows\System\pgQHkAh.exe
  C:\Windows\System\pgQHkAh.exe
  2⤵
  PID:2992
- C:\Windows\System\IolqvqC.exe
  C:\Windows\System\IolqvqC.exe
  2⤵
  PID:2924
- C:\Windows\System\aUEwoIO.exe
  C:\Windows\System\aUEwoIO.exe
  2⤵
  PID:2972
- C:\Windows\System\uGrxQag.exe
  C:\Windows\System\uGrxQag.exe
  2⤵
  PID:2804
- C:\Windows\System\IxWROVK.exe
  C:\Windows\System\IxWROVK.exe
  2⤵
  PID:1688
- C:\Windows\System\QTvqIbR.exe
  C:\Windows\System\QTvqIbR.exe
  2⤵
  PID:1744
- C:\Windows\System\EQGIbXZ.exe
  C:\Windows\System\EQGIbXZ.exe
  2⤵
  PID:2132
- C:\Windows\System\lBPlUko.exe
  C:\Windows\System\lBPlUko.exe
  2⤵
  PID:2000
- C:\Windows\System\KuFWVQm.exe
  C:\Windows\System\KuFWVQm.exe
  2⤵
  PID:2024
- C:\Windows\System\TePOXBI.exe
  C:\Windows\System\TePOXBI.exe
  2⤵
  PID:1676
- C:\Windows\System\rpXdPWV.exe
  C:\Windows\System\rpXdPWV.exe
  2⤵
  PID:1700
- C:\Windows\System\VpTMHEA.exe
  C:\Windows\System\VpTMHEA.exe
  2⤵
  PID:3056
- C:\Windows\System\yjqWAGM.exe
  C:\Windows\System\yjqWAGM.exe
  2⤵
  PID:2556
- C:\Windows\System\jRQhbhd.exe
  C:\Windows\System\jRQhbhd.exe
  2⤵
  PID:2324
- C:\Windows\System\ojRNFqc.exe
  C:\Windows\System\ojRNFqc.exe
  2⤵
  PID:3080
- C:\Windows\System\ycunuBZ.exe
  C:\Windows\System\ycunuBZ.exe
  2⤵
  PID:3100
- C:\Windows\System\pElXIOx.exe
  C:\Windows\System\pElXIOx.exe
  2⤵
  PID:3120
- C:\Windows\System\djKncBA.exe
  C:\Windows\System\djKncBA.exe
  2⤵
  PID:3136
- C:\Windows\System\iopDVDQ.exe
  C:\Windows\System\iopDVDQ.exe
  2⤵
  PID:3156
- C:\Windows\System\ZtOjfzo.exe
  C:\Windows\System\ZtOjfzo.exe
  2⤵
  PID:3180
- C:\Windows\System\CetGsMi.exe
  C:\Windows\System\CetGsMi.exe
  2⤵
  PID:3200
- C:\Windows\System\CDEfYHZ.exe
  C:\Windows\System\CDEfYHZ.exe
  2⤵
  PID:3220
- C:\Windows\System\flNDTMK.exe
  C:\Windows\System\flNDTMK.exe
  2⤵
  PID:3236
- C:\Windows\System\KcMgzwk.exe
  C:\Windows\System\KcMgzwk.exe
  2⤵
  PID:3256
- C:\Windows\System\EzXzSjV.exe
  C:\Windows\System\EzXzSjV.exe
  2⤵
  PID:3280
- C:\Windows\System\KJOOeJw.exe
  C:\Windows\System\KJOOeJw.exe
  2⤵
  PID:3300
- C:\Windows\System\bJYPbkc.exe
  C:\Windows\System\bJYPbkc.exe
  2⤵
  PID:3320
- C:\Windows\System\rurBQnP.exe
  C:\Windows\System\rurBQnP.exe
  2⤵
  PID:3340
- C:\Windows\System\eNllBYN.exe
  C:\Windows\System\eNllBYN.exe
  2⤵
  PID:3356
- C:\Windows\System\YlnrthH.exe
  C:\Windows\System\YlnrthH.exe
  2⤵
  PID:3376
- C:\Windows\System\ModpihD.exe
  C:\Windows\System\ModpihD.exe
  2⤵
  PID:3396
- C:\Windows\System\NwIfrMB.exe
  C:\Windows\System\NwIfrMB.exe
  2⤵
  PID:3420
- C:\Windows\System\vAUHiGJ.exe
  C:\Windows\System\vAUHiGJ.exe
  2⤵
  PID:3440
- C:\Windows\System\EERBFrP.exe
  C:\Windows\System\EERBFrP.exe
  2⤵
  PID:3460
- C:\Windows\System\CzyzHHW.exe
  C:\Windows\System\CzyzHHW.exe
  2⤵
  PID:3480
- C:\Windows\System\MgOXqrl.exe
  C:\Windows\System\MgOXqrl.exe
  2⤵
  PID:3500
- C:\Windows\System\UPZCSxV.exe
  C:\Windows\System\UPZCSxV.exe
  2⤵
  PID:3516
- C:\Windows\System\svDBYwZ.exe
  C:\Windows\System\svDBYwZ.exe
  2⤵
  PID:3536
- C:\Windows\System\nVyHGPl.exe
  C:\Windows\System\nVyHGPl.exe
  2⤵
  PID:3560
- C:\Windows\System\nkpLvSy.exe
  C:\Windows\System\nkpLvSy.exe
  2⤵
  PID:3576
- C:\Windows\System\qcKWZgt.exe
  C:\Windows\System\qcKWZgt.exe
  2⤵
  PID:3600
- C:\Windows\System\FAhKCSE.exe
  C:\Windows\System\FAhKCSE.exe
  2⤵
  PID:3620
- C:\Windows\System\udQODug.exe
  C:\Windows\System\udQODug.exe
  2⤵
  PID:3640
- C:\Windows\System\pSzGMAI.exe
  C:\Windows\System\pSzGMAI.exe
  2⤵
  PID:3656
- C:\Windows\System\TTMyUWu.exe
  C:\Windows\System\TTMyUWu.exe
  2⤵
  PID:3676
- C:\Windows\System\blUfgbb.exe
  C:\Windows\System\blUfgbb.exe
  2⤵
  PID:3700
- C:\Windows\System\tRtQreW.exe
  C:\Windows\System\tRtQreW.exe
  2⤵
  PID:3720
- C:\Windows\System\roUhMjC.exe
  C:\Windows\System\roUhMjC.exe
  2⤵
  PID:3740
- C:\Windows\System\ZOwHGaz.exe
  C:\Windows\System\ZOwHGaz.exe
  2⤵
  PID:3760
- C:\Windows\System\bQDrTwH.exe
  C:\Windows\System\bQDrTwH.exe
  2⤵
  PID:3780
- C:\Windows\System\WTZAyxP.exe
  C:\Windows\System\WTZAyxP.exe
  2⤵
  PID:3800
- C:\Windows\System\nNiEzju.exe
  C:\Windows\System\nNiEzju.exe
  2⤵
  PID:3820
- C:\Windows\System\nynpHml.exe
  C:\Windows\System\nynpHml.exe
  2⤵
  PID:3840
- C:\Windows\System\tKQopYB.exe
  C:\Windows\System\tKQopYB.exe
  2⤵
  PID:3860
- C:\Windows\System\cwDTSXR.exe
  C:\Windows\System\cwDTSXR.exe
  2⤵
  PID:3880
- C:\Windows\System\RPAfIrA.exe
  C:\Windows\System\RPAfIrA.exe
  2⤵
  PID:3896
- C:\Windows\System\YchoJju.exe
  C:\Windows\System\YchoJju.exe
  2⤵
  PID:3916
- C:\Windows\System\RxbIROE.exe
  C:\Windows\System\RxbIROE.exe
  2⤵
  PID:3940
- C:\Windows\System\bGNbaJD.exe
  C:\Windows\System\bGNbaJD.exe
  2⤵
  PID:3960
- C:\Windows\System\VzZyMEK.exe
  C:\Windows\System\VzZyMEK.exe
  2⤵
  PID:3976
- C:\Windows\System\UFixolg.exe
  C:\Windows\System\UFixolg.exe
  2⤵
  PID:3992
- C:\Windows\System\nfrsXWQ.exe
  C:\Windows\System\nfrsXWQ.exe
  2⤵
  PID:4012
- C:\Windows\System\jdPGhyY.exe
  C:\Windows\System\jdPGhyY.exe
  2⤵
  PID:4040
- C:\Windows\System\qjQgupF.exe
  C:\Windows\System\qjQgupF.exe
  2⤵
  PID:4056
- C:\Windows\System\ytOdVOE.exe
  C:\Windows\System\ytOdVOE.exe
  2⤵
  PID:4080
- C:\Windows\System\FgYnWKQ.exe
  C:\Windows\System\FgYnWKQ.exe
  2⤵
  PID:2008
- C:\Windows\System\BSxzdxf.exe
  C:\Windows\System\BSxzdxf.exe
  2⤵
  PID:2144
- C:\Windows\System\FBZTKMe.exe
  C:\Windows\System\FBZTKMe.exe
  2⤵
  PID:1060
- C:\Windows\System\qVTIlLI.exe
  C:\Windows\System\qVTIlLI.exe
  2⤵
  PID:1812
- C:\Windows\System\jdtwDva.exe
  C:\Windows\System\jdtwDva.exe
  2⤵
  PID:1352
- C:\Windows\System\IxuRNYK.exe
  C:\Windows\System\IxuRNYK.exe
  2⤵
  PID:2732
- C:\Windows\System\EbvxJHv.exe
  C:\Windows\System\EbvxJHv.exe
  2⤵
  PID:3096
- C:\Windows\System\IRuRJNg.exe
  C:\Windows\System\IRuRJNg.exe
  2⤵
  PID:3116
- C:\Windows\System\uqbCRSs.exe
  C:\Windows\System\uqbCRSs.exe
  2⤵
  PID:3168
- C:\Windows\System\WhbZdUO.exe
  C:\Windows\System\WhbZdUO.exe
  2⤵
  PID:3212
- C:\Windows\System\KDKuaSL.exe
  C:\Windows\System\KDKuaSL.exe
  2⤵
  PID:3252
- C:\Windows\System\nkyLvJt.exe
  C:\Windows\System\nkyLvJt.exe
  2⤵
  PID:3292
- C:\Windows\System\bFpRlIG.exe
  C:\Windows\System\bFpRlIG.exe
  2⤵
  PID:3232
- C:\Windows\System\gfMBNvw.exe
  C:\Windows\System\gfMBNvw.exe
  2⤵
  PID:3364
- C:\Windows\System\rkZXTCn.exe
  C:\Windows\System\rkZXTCn.exe
  2⤵
  PID:3316
- C:\Windows\System\AnPjDgn.exe
  C:\Windows\System\AnPjDgn.exe
  2⤵
  PID:3404
- C:\Windows\System\kyUwqfj.exe
  C:\Windows\System\kyUwqfj.exe
  2⤵
  PID:3452
- C:\Windows\System\jVYiMfd.exe
  C:\Windows\System\jVYiMfd.exe
  2⤵
  PID:3436
- C:\Windows\System\xsymvwt.exe
  C:\Windows\System\xsymvwt.exe
  2⤵
  PID:3468
- C:\Windows\System\UMXuCdu.exe
  C:\Windows\System\UMXuCdu.exe
  2⤵
  PID:3528
- C:\Windows\System\FxfCbJM.exe
  C:\Windows\System\FxfCbJM.exe
  2⤵
  PID:3612
- C:\Windows\System\xbELfxz.exe
  C:\Windows\System\xbELfxz.exe
  2⤵
  PID:3648
- C:\Windows\System\jZKgGLu.exe
  C:\Windows\System\jZKgGLu.exe
  2⤵
  PID:3592
- C:\Windows\System\VVVZBtE.exe
  C:\Windows\System\VVVZBtE.exe
  2⤵
  PID:3668
- C:\Windows\System\QrOkQLO.exe
  C:\Windows\System\QrOkQLO.exe
  2⤵
  PID:3728
- C:\Windows\System\msONCKs.exe
  C:\Windows\System\msONCKs.exe
  2⤵
  PID:3768
- C:\Windows\System\pTPzUfl.exe
  C:\Windows\System\pTPzUfl.exe
  2⤵
  PID:3812
- C:\Windows\System\QgKppHF.exe
  C:\Windows\System\QgKppHF.exe
  2⤵
  PID:3748
- C:\Windows\System\liiDMfe.exe
  C:\Windows\System\liiDMfe.exe
  2⤵
  PID:3856
- C:\Windows\System\qdOeMZe.exe
  C:\Windows\System\qdOeMZe.exe
  2⤵
  PID:3888
- C:\Windows\System\HqAyZOi.exe
  C:\Windows\System\HqAyZOi.exe
  2⤵
  PID:3876
- C:\Windows\System\yjPPiym.exe
  C:\Windows\System\yjPPiym.exe
  2⤵
  PID:3932
- C:\Windows\System\cSRUAKA.exe
  C:\Windows\System\cSRUAKA.exe
  2⤵
  PID:3972
- C:\Windows\System\HxrDGSU.exe
  C:\Windows\System\HxrDGSU.exe
  2⤵
  PID:3956
- C:\Windows\System\UOqJxUv.exe
  C:\Windows\System\UOqJxUv.exe
  2⤵
  PID:4048
- C:\Windows\System\sQBlrPY.exe
  C:\Windows\System\sQBlrPY.exe
  2⤵
  PID:2152
- C:\Windows\System\tqGdpuI.exe
  C:\Windows\System\tqGdpuI.exe
  2⤵
  PID:4036
- C:\Windows\System\lrmufWN.exe
  C:\Windows\System\lrmufWN.exe
  2⤵
  PID:1384
- C:\Windows\System\EaQANhJ.exe
  C:\Windows\System\EaQANhJ.exe
  2⤵
  PID:1984
- C:\Windows\System\IWumuSz.exe
  C:\Windows\System\IWumuSz.exe
  2⤵
  PID:1592
- C:\Windows\System\JZFifpJ.exe
  C:\Windows\System\JZFifpJ.exe
  2⤵
  PID:2380
- C:\Windows\System\owpMFTM.exe
  C:\Windows\System\owpMFTM.exe
  2⤵
  PID:4100
- C:\Windows\System\BhTymMO.exe
  C:\Windows\System\BhTymMO.exe
  2⤵
  PID:4116
- C:\Windows\System\rSZabgq.exe
  C:\Windows\System\rSZabgq.exe
  2⤵
  PID:4136
- C:\Windows\System\DdUTqaj.exe
  C:\Windows\System\DdUTqaj.exe
  2⤵
  PID:4156
- C:\Windows\System\pkeQljj.exe
  C:\Windows\System\pkeQljj.exe
  2⤵
  PID:4180
- C:\Windows\System\MeQQVjb.exe
  C:\Windows\System\MeQQVjb.exe
  2⤵
  PID:4196
- C:\Windows\System\mOCNlTg.exe
  C:\Windows\System\mOCNlTg.exe
  2⤵
  PID:4220
- C:\Windows\System\imfHpNE.exe
  C:\Windows\System\imfHpNE.exe
  2⤵
  PID:4240
- C:\Windows\System\dEgHjJN.exe
  C:\Windows\System\dEgHjJN.exe
  2⤵
  PID:4260
- C:\Windows\System\zbofoHP.exe
  C:\Windows\System\zbofoHP.exe
  2⤵
  PID:4280
- C:\Windows\System\vYomLEl.exe
  C:\Windows\System\vYomLEl.exe
  2⤵
  PID:4300
- C:\Windows\System\adUwzAu.exe
  C:\Windows\System\adUwzAu.exe
  2⤵
  PID:4320
- C:\Windows\System\QMTIqaI.exe
  C:\Windows\System\QMTIqaI.exe
  2⤵
  PID:4340
- C:\Windows\System\DouDFEf.exe
  C:\Windows\System\DouDFEf.exe
  2⤵
  PID:4356
- C:\Windows\System\mNaGylF.exe
  C:\Windows\System\mNaGylF.exe
  2⤵
  PID:4376
- C:\Windows\System\ELQWZAO.exe
  C:\Windows\System\ELQWZAO.exe
  2⤵
  PID:4396
- C:\Windows\System\hTlMCPu.exe
  C:\Windows\System\hTlMCPu.exe
  2⤵
  PID:4416
- C:\Windows\System\JeuikmV.exe
  C:\Windows\System\JeuikmV.exe
  2⤵
  PID:4436
- C:\Windows\System\daeLIku.exe
  C:\Windows\System\daeLIku.exe
  2⤵
  PID:4460
- C:\Windows\System\BKBIToM.exe
  C:\Windows\System\BKBIToM.exe
  2⤵
  PID:4476
- C:\Windows\System\oMSrUuP.exe
  C:\Windows\System\oMSrUuP.exe
  2⤵
  PID:4496
- C:\Windows\System\rbyRQmM.exe
  C:\Windows\System\rbyRQmM.exe
  2⤵
  PID:4516
- C:\Windows\System\gtGKgxW.exe
  C:\Windows\System\gtGKgxW.exe
  2⤵
  PID:4532
- C:\Windows\System\tcVBZMY.exe
  C:\Windows\System\tcVBZMY.exe
  2⤵
  PID:4548
- C:\Windows\System\rwdralW.exe
  C:\Windows\System\rwdralW.exe
  2⤵
  PID:4576
- C:\Windows\System\kxQdHJU.exe
  C:\Windows\System\kxQdHJU.exe
  2⤵
  PID:4592
- C:\Windows\System\AavbAyo.exe
  C:\Windows\System\AavbAyo.exe
  2⤵
  PID:4608
- C:\Windows\System\LSgdgjS.exe
  C:\Windows\System\LSgdgjS.exe
  2⤵
  PID:4624
- C:\Windows\System\IgTmtQQ.exe
  C:\Windows\System\IgTmtQQ.exe
  2⤵
  PID:4640
- C:\Windows\System\ydifGDs.exe
  C:\Windows\System\ydifGDs.exe
  2⤵
  PID:4660
- C:\Windows\System\KGJgniu.exe
  C:\Windows\System\KGJgniu.exe
  2⤵
  PID:4684
- C:\Windows\System\qHPvDaO.exe
  C:\Windows\System\qHPvDaO.exe
  2⤵
  PID:4708
- C:\Windows\System\LqryQQl.exe
  C:\Windows\System\LqryQQl.exe
  2⤵
  PID:4756
- C:\Windows\System\FYrfUoP.exe
  C:\Windows\System\FYrfUoP.exe
  2⤵
  PID:4780
- C:\Windows\System\XlqqLek.exe
  C:\Windows\System\XlqqLek.exe
  2⤵
  PID:4796
- C:\Windows\System\PDwAdzW.exe
  C:\Windows\System\PDwAdzW.exe
  2⤵
  PID:4820
- C:\Windows\System\dacZTPR.exe
  C:\Windows\System\dacZTPR.exe
  2⤵
  PID:4840
- C:\Windows\System\bnzYtFq.exe
  C:\Windows\System\bnzYtFq.exe
  2⤵
  PID:4864
- C:\Windows\System\ssKNBzp.exe
  C:\Windows\System\ssKNBzp.exe
  2⤵
  PID:4880
- C:\Windows\System\fWWWQzn.exe
  C:\Windows\System\fWWWQzn.exe
  2⤵
  PID:4900
- C:\Windows\System\LerWbUr.exe
  C:\Windows\System\LerWbUr.exe
  2⤵
  PID:4920
- C:\Windows\System\OycoOkO.exe
  C:\Windows\System\OycoOkO.exe
  2⤵
  PID:4944
- C:\Windows\System\BCUzOsP.exe
  C:\Windows\System\BCUzOsP.exe
  2⤵
  PID:4960
- C:\Windows\System\lKQvVLz.exe
  C:\Windows\System\lKQvVLz.exe
  2⤵
  PID:4980
- C:\Windows\System\IwIFuNI.exe
  C:\Windows\System\IwIFuNI.exe
  2⤵
  PID:5000
- C:\Windows\System\LyFxJJC.exe
  C:\Windows\System\LyFxJJC.exe
  2⤵
  PID:5020
- C:\Windows\System\yEZOPID.exe
  C:\Windows\System\yEZOPID.exe
  2⤵
  PID:5036
- C:\Windows\System\JAXmLOt.exe
  C:\Windows\System\JAXmLOt.exe
  2⤵
  PID:5056
- C:\Windows\System\svUBerV.exe
  C:\Windows\System\svUBerV.exe
  2⤵
  PID:5080
- C:\Windows\System\gXhcvPO.exe
  C:\Windows\System\gXhcvPO.exe
  2⤵
  PID:5096
- C:\Windows\System\YHMROFP.exe
  C:\Windows\System\YHMROFP.exe
  2⤵
  PID:5112
- C:\Windows\System\KgPvWRh.exe
  C:\Windows\System\KgPvWRh.exe
  2⤵
  PID:3228
- C:\Windows\System\LPALoMC.exe
  C:\Windows\System\LPALoMC.exe
  2⤵
  PID:3208
- C:\Windows\System\ncYJIpU.exe
  C:\Windows\System\ncYJIpU.exe
  2⤵
  PID:3296
- C:\Windows\System\eLniUvq.exe
  C:\Windows\System\eLniUvq.exe
  2⤵
  PID:3268
- C:\Windows\System\kERBoTP.exe
  C:\Windows\System\kERBoTP.exe
  2⤵
  PID:3472
- C:\Windows\System\OnTcKzw.exe
  C:\Windows\System\OnTcKzw.exe
  2⤵
  PID:3572
- C:\Windows\System\jOVunGY.exe
  C:\Windows\System\jOVunGY.exe
  2⤵
  PID:3556
- C:\Windows\System\SYpmwME.exe
  C:\Windows\System\SYpmwME.exe
  2⤵
  PID:3696
- C:\Windows\System\HQWkixS.exe
  C:\Windows\System\HQWkixS.exe
  2⤵
  PID:3596
- C:\Windows\System\PfIBKsz.exe
  C:\Windows\System\PfIBKsz.exe
  2⤵
  PID:3732
- C:\Windows\System\zQYSRTr.exe
  C:\Windows\System\zQYSRTr.exe
  2⤵
  PID:3892
- C:\Windows\System\nqMkWvF.exe
  C:\Windows\System\nqMkWvF.exe
  2⤵
  PID:3752
- C:\Windows\System\nlEYvqb.exe
  C:\Windows\System\nlEYvqb.exe
  2⤵
  PID:3988
- C:\Windows\System\cHbAset.exe
  C:\Windows\System\cHbAset.exe
  2⤵
  PID:4032
- C:\Windows\System\iCRVnAX.exe
  C:\Windows\System\iCRVnAX.exe
  2⤵
  PID:3076
- C:\Windows\System\btLXPQU.exe
  C:\Windows\System\btLXPQU.exe
  2⤵
  PID:3928
- C:\Windows\System\IKymUJr.exe
  C:\Windows\System\IKymUJr.exe
  2⤵
  PID:4144
- C:\Windows\System\CxtoZcT.exe
  C:\Windows\System\CxtoZcT.exe
  2⤵
  PID:4020
- C:\Windows\System\jMosbRV.exe
  C:\Windows\System\jMosbRV.exe
  2⤵
  PID:4068
- C:\Windows\System\ExWZyIA.exe
  C:\Windows\System\ExWZyIA.exe
  2⤵
  PID:480
- C:\Windows\System\AkyLINX.exe
  C:\Windows\System\AkyLINX.exe
  2⤵
  PID:4232
- C:\Windows\System\ypnTtwY.exe
  C:\Windows\System\ypnTtwY.exe
  2⤵
  PID:4124
- C:\Windows\System\tMJxoXn.exe
  C:\Windows\System\tMJxoXn.exe
  2⤵
  PID:4176
- C:\Windows\System\FupDZAT.exe
  C:\Windows\System\FupDZAT.exe
  2⤵
  PID:4308
- C:\Windows\System\gDqrIle.exe
  C:\Windows\System\gDqrIle.exe
  2⤵
  PID:4212
- C:\Windows\System\tdwQEoL.exe
  C:\Windows\System\tdwQEoL.exe
  2⤵
  PID:4388
- C:\Windows\System\vxZRCTo.exe
  C:\Windows\System\vxZRCTo.exe
  2⤵
  PID:4256
- C:\Windows\System\vDlXBAj.exe
  C:\Windows\System\vDlXBAj.exe
  2⤵
  PID:4372
- C:\Windows\System\mEwYGhe.exe
  C:\Windows\System\mEwYGhe.exe
  2⤵
  PID:4472
- C:\Windows\System\bEUumiW.exe
  C:\Windows\System\bEUumiW.exe
  2⤵
  PID:4408
- C:\Windows\System\WHBIVgU.exe
  C:\Windows\System\WHBIVgU.exe
  2⤵
  PID:4540
- C:\Windows\System\RPhqyAj.exe
  C:\Windows\System\RPhqyAj.exe
  2⤵
  PID:4616
- C:\Windows\System\Owdcmyv.exe
  C:\Windows\System\Owdcmyv.exe
  2⤵
  PID:4456
- C:\Windows\System\Lucbtpu.exe
  C:\Windows\System\Lucbtpu.exe
  2⤵
  PID:4656
- C:\Windows\System\PKQXjwV.exe
  C:\Windows\System\PKQXjwV.exe
  2⤵
  PID:4492
- C:\Windows\System\amvWyAY.exe
  C:\Windows\System\amvWyAY.exe
  2⤵
  PID:4560
- C:\Windows\System\AUjshkx.exe
  C:\Windows\System\AUjshkx.exe
  2⤵
  PID:4604
- C:\Windows\System\QGYlJfe.exe
  C:\Windows\System\QGYlJfe.exe
  2⤵
  PID:4668
- C:\Windows\System\lgNCSyt.exe
  C:\Windows\System\lgNCSyt.exe
  2⤵
  PID:4556
- C:\Windows\System\vPjkbgZ.exe
  C:\Windows\System\vPjkbgZ.exe
  2⤵
  PID:4744
- C:\Windows\System\nBxinEy.exe
  C:\Windows\System\nBxinEy.exe
  2⤵
  PID:4816
- C:\Windows\System\aZOODZA.exe
  C:\Windows\System\aZOODZA.exe
  2⤵
  PID:4852
- C:\Windows\System\yEdpHBP.exe
  C:\Windows\System\yEdpHBP.exe
  2⤵
  PID:4896
- C:\Windows\System\xhSiooD.exe
  C:\Windows\System\xhSiooD.exe
  2⤵
  PID:4976
- C:\Windows\System\agehTQd.exe
  C:\Windows\System\agehTQd.exe
  2⤵
  PID:4872
- C:\Windows\System\fPeBbCB.exe
  C:\Windows\System\fPeBbCB.exe
  2⤵
  PID:4952
- C:\Windows\System\YaBrEue.exe
  C:\Windows\System\YaBrEue.exe
  2⤵
  PID:5044
- C:\Windows\System\qShxgux.exe
  C:\Windows\System\qShxgux.exe
  2⤵
  PID:5032
- C:\Windows\System\Awkjguq.exe
  C:\Windows\System\Awkjguq.exe
  2⤵
  PID:3092
- C:\Windows\System\mCaQVkN.exe
  C:\Windows\System\mCaQVkN.exe
  2⤵
  PID:3312
- C:\Windows\System\dvILbnA.exe
  C:\Windows\System\dvILbnA.exe
  2⤵
  PID:5072
- C:\Windows\System\MXfniiP.exe
  C:\Windows\System\MXfniiP.exe
  2⤵
  PID:3176
- C:\Windows\System\wyDafmF.exe
  C:\Windows\System\wyDafmF.exe
  2⤵
  PID:3272
- C:\Windows\System\JbyOowD.exe
  C:\Windows\System\JbyOowD.exe
  2⤵
  PID:3524
- C:\Windows\System\TFXCDsK.exe
  C:\Windows\System\TFXCDsK.exe
  2⤵
  PID:3772
- C:\Windows\System\BgUaBNS.exe
  C:\Windows\System\BgUaBNS.exe
  2⤵
  PID:3632
- C:\Windows\System\hUObRSt.exe
  C:\Windows\System\hUObRSt.exe
  2⤵
  PID:3664
- C:\Windows\System\zveHLmN.exe
  C:\Windows\System\zveHLmN.exe
  2⤵
  PID:2248
- C:\Windows\System\RbeXlRU.exe
  C:\Windows\System\RbeXlRU.exe
  2⤵
  PID:3968
- C:\Windows\System\NmGnQCJ.exe
  C:\Windows\System\NmGnQCJ.exe
  2⤵
  PID:1296
- C:\Windows\System\IKLFioK.exe
  C:\Windows\System\IKLFioK.exe
  2⤵
  PID:3924
- C:\Windows\System\RqNZfVQ.exe
  C:\Windows\System\RqNZfVQ.exe
  2⤵
  PID:4188
- C:\Windows\System\vpRYEXL.exe
  C:\Windows\System\vpRYEXL.exe
  2⤵
  PID:4164
- C:\Windows\System\HSdTohS.exe
  C:\Windows\System\HSdTohS.exe
  2⤵
  PID:4272
- C:\Windows\System\BJWuuDM.exe
  C:\Windows\System\BJWuuDM.exe
  2⤵
  PID:4276
- C:\Windows\System\mYFTjEw.exe
  C:\Windows\System\mYFTjEw.exe
  2⤵
  PID:4336
- C:\Windows\System\rioevnU.exe
  C:\Windows\System\rioevnU.exe
  2⤵
  PID:4512
- C:\Windows\System\vKqnFQp.exe
  C:\Windows\System\vKqnFQp.exe
  2⤵
  PID:4248
- C:\Windows\System\dqIbUKD.exe
  C:\Windows\System\dqIbUKD.exe
  2⤵
  PID:4584
- C:\Windows\System\tRqGOup.exe
  C:\Windows\System\tRqGOup.exe
  2⤵
  PID:4696
- C:\Windows\System\wQMzIrq.exe
  C:\Windows\System\wQMzIrq.exe
  2⤵
  PID:4484
- C:\Windows\System\nBZHCbz.exe
  C:\Windows\System\nBZHCbz.exe
  2⤵
  PID:4572
- C:\Windows\System\SAYDlTg.exe
  C:\Windows\System\SAYDlTg.exe
  2⤵
  PID:4632
- C:\Windows\System\nmYywHa.exe
  C:\Windows\System\nmYywHa.exe
  2⤵
  PID:4788
- C:\Windows\System\BDqxtOG.exe
  C:\Windows\System\BDqxtOG.exe
  2⤵
  PID:4888
- C:\Windows\System\GFEpsha.exe
  C:\Windows\System\GFEpsha.exe
  2⤵
  PID:4932
- C:\Windows\System\oeHjxhM.exe
  C:\Windows\System\oeHjxhM.exe
  2⤵
  PID:4968
- C:\Windows\System\HughwzJ.exe
  C:\Windows\System\HughwzJ.exe
  2⤵
  PID:4912
- C:\Windows\System\naMjDkU.exe
  C:\Windows\System\naMjDkU.exe
  2⤵
  PID:4992
- C:\Windows\System\owUgATw.exe
  C:\Windows\System\owUgATw.exe
  2⤵
  PID:5028
- C:\Windows\System\BtdHQJz.exe
  C:\Windows\System\BtdHQJz.exe
  2⤵
  PID:5064
- C:\Windows\System\sAOHDlW.exe
  C:\Windows\System\sAOHDlW.exe
  2⤵
  PID:3412
- C:\Windows\System\JOMVZGa.exe
  C:\Windows\System\JOMVZGa.exe
  2⤵
  PID:3132
- C:\Windows\System\HdItOJr.exe
  C:\Windows\System\HdItOJr.exe
  2⤵
  PID:3848
- C:\Windows\System\gGRePqM.exe
  C:\Windows\System\gGRePqM.exe
  2⤵
  PID:5128
- C:\Windows\System\JLaEMQY.exe
  C:\Windows\System\JLaEMQY.exe
  2⤵
  PID:5148
- C:\Windows\System\CuHGSEn.exe
  C:\Windows\System\CuHGSEn.exe
  2⤵
  PID:5164
- C:\Windows\System\aYOmPij.exe
  C:\Windows\System\aYOmPij.exe
  2⤵
  PID:5184
- C:\Windows\System\bmJZgtS.exe
  C:\Windows\System\bmJZgtS.exe
  2⤵
  PID:5200
- C:\Windows\System\qxTDUvR.exe
  C:\Windows\System\qxTDUvR.exe
  2⤵
  PID:5220
- C:\Windows\System\jrKblof.exe
  C:\Windows\System\jrKblof.exe
  2⤵
  PID:5236
- C:\Windows\System\OAljLrV.exe
  C:\Windows\System\OAljLrV.exe
  2⤵
  PID:5252
- C:\Windows\System\iGUQYvc.exe
  C:\Windows\System\iGUQYvc.exe
  2⤵
  PID:5276
- C:\Windows\System\WljprwX.exe
  C:\Windows\System\WljprwX.exe
  2⤵
  PID:5324
- C:\Windows\System\HmuWObT.exe
  C:\Windows\System\HmuWObT.exe
  2⤵
  PID:5352
- C:\Windows\System\PsATQPx.exe
  C:\Windows\System\PsATQPx.exe
  2⤵
  PID:5372
- C:\Windows\System\dormAUZ.exe
  C:\Windows\System\dormAUZ.exe
  2⤵
  PID:5392
- C:\Windows\System\qKXbKBZ.exe
  C:\Windows\System\qKXbKBZ.exe
  2⤵
  PID:5408
- C:\Windows\System\CiVCHhM.exe
  C:\Windows\System\CiVCHhM.exe
  2⤵
  PID:5432
- C:\Windows\System\Rqmpfzd.exe
  C:\Windows\System\Rqmpfzd.exe
  2⤵
  PID:5448
- C:\Windows\System\hwsVhSs.exe
  C:\Windows\System\hwsVhSs.exe
  2⤵
  PID:5464
- C:\Windows\System\gZwfjko.exe
  C:\Windows\System\gZwfjko.exe
  2⤵
  PID:5480
- C:\Windows\System\hlbOQMi.exe
  C:\Windows\System\hlbOQMi.exe
  2⤵
  PID:5500
- C:\Windows\System\qgyDHgk.exe
  C:\Windows\System\qgyDHgk.exe
  2⤵
  PID:5516
- C:\Windows\System\IKjaWIC.exe
  C:\Windows\System\IKjaWIC.exe
  2⤵
  PID:5540
- C:\Windows\System\DJCVhel.exe
  C:\Windows\System\DJCVhel.exe
  2⤵
  PID:5560
- C:\Windows\System\tWIpSCP.exe
  C:\Windows\System\tWIpSCP.exe
  2⤵
  PID:5576
- C:\Windows\System\lOdzjGs.exe
  C:\Windows\System\lOdzjGs.exe
  2⤵
  PID:5600
- C:\Windows\System\YNpgSJK.exe
  C:\Windows\System\YNpgSJK.exe
  2⤵
  PID:5616
- C:\Windows\System\dgJEHyb.exe
  C:\Windows\System\dgJEHyb.exe
  2⤵
  PID:5644
- C:\Windows\System\MCdHrNM.exe
  C:\Windows\System\MCdHrNM.exe
  2⤵
  PID:5668
- C:\Windows\System\jHPVpLs.exe
  C:\Windows\System\jHPVpLs.exe
  2⤵
  PID:5688
- C:\Windows\System\SWCAtZh.exe
  C:\Windows\System\SWCAtZh.exe
  2⤵
  PID:5708
- C:\Windows\System\IEVnwxA.exe
  C:\Windows\System\IEVnwxA.exe
  2⤵
  PID:5728
- C:\Windows\System\WriuhCr.exe
  C:\Windows\System\WriuhCr.exe
  2⤵
  PID:5748
- C:\Windows\System\JppEFZM.exe
  C:\Windows\System\JppEFZM.exe
  2⤵
  PID:5768
- C:\Windows\System\IDEGzTI.exe
  C:\Windows\System\IDEGzTI.exe
  2⤵
  PID:5784
- C:\Windows\System\WVowRtc.exe
  C:\Windows\System\WVowRtc.exe
  2⤵
  PID:5808
- C:\Windows\System\djguSxK.exe
  C:\Windows\System\djguSxK.exe
  2⤵
  PID:5828
- C:\Windows\System\nydJmYC.exe
  C:\Windows\System\nydJmYC.exe
  2⤵
  PID:5848
- C:\Windows\System\mEqvwMe.exe
  C:\Windows\System\mEqvwMe.exe
  2⤵
  PID:5872
- C:\Windows\System\DYKovTl.exe
  C:\Windows\System\DYKovTl.exe
  2⤵
  PID:5888
- C:\Windows\System\KYMeVHM.exe
  C:\Windows\System\KYMeVHM.exe
  2⤵
  PID:5904
- C:\Windows\System\caxvfFz.exe
  C:\Windows\System\caxvfFz.exe
  2⤵
  PID:5924
- C:\Windows\System\ykPiWHU.exe
  C:\Windows\System\ykPiWHU.exe
  2⤵
  PID:5940
- C:\Windows\System\sVuDwCI.exe
  C:\Windows\System\sVuDwCI.exe
  2⤵
  PID:5960
- C:\Windows\System\zxWbEzn.exe
  C:\Windows\System\zxWbEzn.exe
  2⤵
  PID:5988
- C:\Windows\System\NuJOirv.exe
  C:\Windows\System\NuJOirv.exe
  2⤵
  PID:6008
- C:\Windows\System\DUXchJu.exe
  C:\Windows\System\DUXchJu.exe
  2⤵
  PID:6028
- C:\Windows\System\NPOqBgn.exe
  C:\Windows\System\NPOqBgn.exe
  2⤵
  PID:6048
- C:\Windows\System\sgbYPTt.exe
  C:\Windows\System\sgbYPTt.exe
  2⤵
  PID:6072
- C:\Windows\System\gjJwllN.exe
  C:\Windows\System\gjJwllN.exe
  2⤵
  PID:6088
- C:\Windows\System\mJbipnp.exe
  C:\Windows\System\mJbipnp.exe
  2⤵
  PID:6108
- C:\Windows\System\pAVpnPo.exe
  C:\Windows\System\pAVpnPo.exe
  2⤵
  PID:6132
- C:\Windows\System\dEeGPpW.exe
  C:\Windows\System\dEeGPpW.exe
  2⤵
  PID:2696
- C:\Windows\System\jekigka.exe
  C:\Windows\System\jekigka.exe
  2⤵
  PID:3708
- C:\Windows\System\BiXgqyx.exe
  C:\Windows\System\BiXgqyx.exe
  2⤵
  PID:3832
- C:\Windows\System\HyZvpGo.exe
  C:\Windows\System\HyZvpGo.exe
  2⤵
  PID:3952
- C:\Windows\System\RtlBWEr.exe
  C:\Windows\System\RtlBWEr.exe
  2⤵
  PID:4352
- C:\Windows\System\ChdOtPP.exe
  C:\Windows\System\ChdOtPP.exe
  2⤵
  PID:4152
- C:\Windows\System\nbGrTSh.exe
  C:\Windows\System\nbGrTSh.exe
  2⤵
  PID:4468
- C:\Windows\System\xuFzlmN.exe
  C:\Windows\System\xuFzlmN.exe
  2⤵
  PID:4252
- C:\Windows\System\xPNYxcw.exe
  C:\Windows\System\xPNYxcw.exe
  2⤵
  PID:4716
- C:\Windows\System\RPcotjp.exe
  C:\Windows\System\RPcotjp.exe
  2⤵
  PID:4804
- C:\Windows\System\HzWozUC.exe
  C:\Windows\System\HzWozUC.exe
  2⤵
  PID:5008
- C:\Windows\System\GqswwSW.exe
  C:\Windows\System\GqswwSW.exe
  2⤵
  PID:4828
- C:\Windows\System\RYrHQEL.exe
  C:\Windows\System\RYrHQEL.exe
  2⤵
  PID:3476
- C:\Windows\System\mPvnUWG.exe
  C:\Windows\System\mPvnUWG.exe
  2⤵
  PID:4568
- C:\Windows\System\bAEVrym.exe
  C:\Windows\System\bAEVrym.exe
  2⤵
  PID:4956
- C:\Windows\System\cUgrrnq.exe
  C:\Windows\System\cUgrrnq.exe
  2⤵
  PID:3416
- C:\Windows\System\hPviHoD.exe
  C:\Windows\System\hPviHoD.exe
  2⤵
  PID:5156
- C:\Windows\System\tSuaSjI.exe
  C:\Windows\System\tSuaSjI.exe
  2⤵
  PID:5260
- C:\Windows\System\KIKWuWl.exe
  C:\Windows\System\KIKWuWl.exe
  2⤵
  PID:5272
- C:\Windows\System\xbwejqX.exe
  C:\Windows\System\xbwejqX.exe
  2⤵
  PID:2872
- C:\Windows\System\VsEjLHv.exe
  C:\Windows\System\VsEjLHv.exe
  2⤵
  PID:5288
- C:\Windows\System\dfOSnaD.exe
  C:\Windows\System\dfOSnaD.exe
  2⤵
  PID:5180
- C:\Windows\System\agrpKIT.exe
  C:\Windows\System\agrpKIT.exe
  2⤵
  PID:3492
- C:\Windows\System\traWJov.exe
  C:\Windows\System\traWJov.exe
  2⤵
  PID:5348
- C:\Windows\System\arQjJRt.exe
  C:\Windows\System\arQjJRt.exe
  2⤵
  PID:5316
- C:\Windows\System\AKiQCEF.exe
  C:\Windows\System\AKiQCEF.exe
  2⤵
  PID:5388
- C:\Windows\System\kiioJXL.exe
  C:\Windows\System\kiioJXL.exe
  2⤵
  PID:5364
- C:\Windows\System\lgPZcRf.exe
  C:\Windows\System\lgPZcRf.exe
  2⤵
  PID:5460
- C:\Windows\System\vneTPls.exe
  C:\Windows\System\vneTPls.exe
  2⤵
  PID:5528
- C:\Windows\System\oEXcCGP.exe
  C:\Windows\System\oEXcCGP.exe
  2⤵
  PID:5440
- C:\Windows\System\RwcaeuR.exe
  C:\Windows\System\RwcaeuR.exe
  2⤵
  PID:5608
- C:\Windows\System\iDXzHKU.exe
  C:\Windows\System\iDXzHKU.exe
  2⤵
  PID:5588
- C:\Windows\System\PobplFS.exe
  C:\Windows\System\PobplFS.exe
  2⤵
  PID:2856
- C:\Windows\System\TNZGYmR.exe
  C:\Windows\System\TNZGYmR.exe
  2⤵
  PID:5628
- C:\Windows\System\xxwxTxJ.exe
  C:\Windows\System\xxwxTxJ.exe
  2⤵
  PID:5696
- C:\Windows\System\OeUjYqA.exe
  C:\Windows\System\OeUjYqA.exe
  2⤵
  PID:5736
- C:\Windows\System\vESGVYY.exe
  C:\Windows\System\vESGVYY.exe
  2⤵
  PID:5720
- C:\Windows\System\JWNbuEN.exe
  C:\Windows\System\JWNbuEN.exe
  2⤵
  PID:5764
- C:\Windows\System\lWXNHbZ.exe
  C:\Windows\System\lWXNHbZ.exe
  2⤵
  PID:5796
- C:\Windows\System\CukpscT.exe
  C:\Windows\System\CukpscT.exe
  2⤵
  PID:5860
- C:\Windows\System\UhTxtvO.exe
  C:\Windows\System\UhTxtvO.exe
  2⤵
  PID:5836
- C:\Windows\System\uVujCyM.exe
  C:\Windows\System\uVujCyM.exe
  2⤵
  PID:5936
- C:\Windows\System\IDqgtBd.exe
  C:\Windows\System\IDqgtBd.exe
  2⤵
  PID:5916
- C:\Windows\System\jxaEfSb.exe
  C:\Windows\System\jxaEfSb.exe
  2⤵
  PID:5884
- C:\Windows\System\mMrfJkb.exe
  C:\Windows\System\mMrfJkb.exe
  2⤵
  PID:5996
- C:\Windows\System\bElpXQp.exe
  C:\Windows\System\bElpXQp.exe
  2⤵
  PID:6004
- C:\Windows\System\ibNgTRy.exe
  C:\Windows\System\ibNgTRy.exe
  2⤵
  PID:6068
- C:\Windows\System\uKmLSRv.exe
  C:\Windows\System\uKmLSRv.exe
  2⤵
  PID:6036
- C:\Windows\System\kOzOISF.exe
  C:\Windows\System\kOzOISF.exe
  2⤵
  PID:6140
- C:\Windows\System\MUJpDig.exe
  C:\Windows\System\MUJpDig.exe
  2⤵
  PID:3948
- C:\Windows\System\QzkpyXQ.exe
  C:\Windows\System\QzkpyXQ.exe
  2⤵
  PID:4316
- C:\Windows\System\zvQQpQF.exe
  C:\Windows\System\zvQQpQF.exe
  2⤵
  PID:4508
- C:\Windows\System\peZufzd.exe
  C:\Windows\System\peZufzd.exe
  2⤵
  PID:4076
- C:\Windows\System\LwlqNUh.exe
  C:\Windows\System\LwlqNUh.exe
  2⤵
  PID:4680
- C:\Windows\System\qeqbnVg.exe
  C:\Windows\System\qeqbnVg.exe
  2⤵
  PID:4892
- C:\Windows\System\VFXmuJW.exe
  C:\Windows\System\VFXmuJW.exe
  2⤵
  PID:4808
- C:\Windows\System\DnJBusE.exe
  C:\Windows\System\DnJBusE.exe
  2⤵
  PID:4996
- C:\Windows\System\JVqttjx.exe
  C:\Windows\System\JVqttjx.exe
  2⤵
  PID:3248
- C:\Windows\System\rVxazUU.exe
  C:\Windows\System\rVxazUU.exe
  2⤵
  PID:4524
- C:\Windows\System\dImABpd.exe
  C:\Windows\System\dImABpd.exe
  2⤵
  PID:5232
- C:\Windows\System\ZqmjPNw.exe
  C:\Windows\System\ZqmjPNw.exe
  2⤵
  PID:3108
- C:\Windows\System\aejkcir.exe
  C:\Windows\System\aejkcir.exe
  2⤵
  PID:5248
- C:\Windows\System\xXxOqrF.exe
  C:\Windows\System\xXxOqrF.exe
  2⤵
  PID:5308
- C:\Windows\System\QWcJNbA.exe
  C:\Windows\System\QWcJNbA.exe
  2⤵
  PID:5384
- C:\Windows\System\jyFNlaL.exe
  C:\Windows\System\jyFNlaL.exe
  2⤵
  PID:5416
- C:\Windows\System\KMDCHLQ.exe
  C:\Windows\System\KMDCHLQ.exe
  2⤵
  PID:5456
- C:\Windows\System\BqswrRW.exe
  C:\Windows\System\BqswrRW.exe
  2⤵
  PID:5380
- C:\Windows\System\UVIDoMu.exe
  C:\Windows\System\UVIDoMu.exe
  2⤵
  PID:5612
- C:\Windows\System\EUbPjTO.exe
  C:\Windows\System\EUbPjTO.exe
  2⤵
  PID:5568
- C:\Windows\System\rkQmllk.exe
  C:\Windows\System\rkQmllk.exe
  2⤵
  PID:5508
- C:\Windows\System\hsEfiOt.exe
  C:\Windows\System\hsEfiOt.exe
  2⤵
  PID:5776
- C:\Windows\System\VVWmKDA.exe
  C:\Windows\System\VVWmKDA.exe
  2⤵
  PID:5704
- C:\Windows\System\oTjcrFs.exe
  C:\Windows\System\oTjcrFs.exe
  2⤵
  PID:5820
- C:\Windows\System\YrYMXpw.exe
  C:\Windows\System\YrYMXpw.exe
  2⤵
  PID:5896
- C:\Windows\System\OikIMUt.exe
  C:\Windows\System\OikIMUt.exe
  2⤵
  PID:5976
- C:\Windows\System\hBsdsDp.exe
  C:\Windows\System\hBsdsDp.exe
  2⤵
  PID:5800
- C:\Windows\System\oahKbdP.exe
  C:\Windows\System\oahKbdP.exe
  2⤵
  PID:5956
- C:\Windows\System\WAcBJnZ.exe
  C:\Windows\System\WAcBJnZ.exe
  2⤵
  PID:6000
- C:\Windows\System\ZDmFQgy.exe
  C:\Windows\System\ZDmFQgy.exe
  2⤵
  PID:6024
- C:\Windows\System\FqtuDQC.exe
  C:\Windows\System\FqtuDQC.exe
  2⤵
  PID:3688
- C:\Windows\System\nRcWjde.exe
  C:\Windows\System\nRcWjde.exe
  2⤵
  PID:4092
- C:\Windows\System\HQmrxBD.exe
  C:\Windows\System\HQmrxBD.exe
  2⤵
  PID:6152
- C:\Windows\System\yHIObPp.exe
  C:\Windows\System\yHIObPp.exe
  2⤵
  PID:6172
- C:\Windows\System\bvWbtBF.exe
  C:\Windows\System\bvWbtBF.exe
  2⤵
  PID:6192
- C:\Windows\System\adYfvUN.exe
  C:\Windows\System\adYfvUN.exe
  2⤵
  PID:6216
- C:\Windows\System\xkaxPRJ.exe
  C:\Windows\System\xkaxPRJ.exe
  2⤵
  PID:6232
- C:\Windows\System\PmGUNDA.exe
  C:\Windows\System\PmGUNDA.exe
  2⤵
  PID:6252
- C:\Windows\System\aYErzOD.exe
  C:\Windows\System\aYErzOD.exe
  2⤵
  PID:6276
- C:\Windows\System\UuErncD.exe
  C:\Windows\System\UuErncD.exe
  2⤵
  PID:6296
- C:\Windows\System\ILkWFrm.exe
  C:\Windows\System\ILkWFrm.exe
  2⤵
  PID:6316
- C:\Windows\System\EaztLNx.exe
  C:\Windows\System\EaztLNx.exe
  2⤵
  PID:6336
- C:\Windows\System\hYeLuqB.exe
  C:\Windows\System\hYeLuqB.exe
  2⤵
  PID:6356
- C:\Windows\System\TTTJLuG.exe
  C:\Windows\System\TTTJLuG.exe
  2⤵
  PID:6372
- C:\Windows\System\AkJBLqD.exe
  C:\Windows\System\AkJBLqD.exe
  2⤵
  PID:6392
- C:\Windows\System\nNFxEcP.exe
  C:\Windows\System\nNFxEcP.exe
  2⤵
  PID:6416
- C:\Windows\System\WCpQTyp.exe
  C:\Windows\System\WCpQTyp.exe
  2⤵
  PID:6432
- C:\Windows\System\xBNfEDL.exe
  C:\Windows\System\xBNfEDL.exe
  2⤵
  PID:6456
- C:\Windows\System\nCIaGGz.exe
  C:\Windows\System\nCIaGGz.exe
  2⤵
  PID:6472
- C:\Windows\System\jytDueo.exe
  C:\Windows\System\jytDueo.exe
  2⤵
  PID:6488
- C:\Windows\System\liQJjng.exe
  C:\Windows\System\liQJjng.exe
  2⤵
  PID:6508
- C:\Windows\System\XPQQQRs.exe
  C:\Windows\System\XPQQQRs.exe
  2⤵
  PID:6528
- C:\Windows\System\GrLGXum.exe
  C:\Windows\System\GrLGXum.exe
  2⤵
  PID:6552
- C:\Windows\System\IDpacbN.exe
  C:\Windows\System\IDpacbN.exe
  2⤵
  PID:6572
- C:\Windows\System\KbuTNwU.exe
  C:\Windows\System\KbuTNwU.exe
  2⤵
  PID:6592
- C:\Windows\System\hqWLJGY.exe
  C:\Windows\System\hqWLJGY.exe
  2⤵
  PID:6612
- C:\Windows\System\hKAaBYy.exe
  C:\Windows\System\hKAaBYy.exe
  2⤵
  PID:6632
- C:\Windows\System\zKPkABf.exe
  C:\Windows\System\zKPkABf.exe
  2⤵
  PID:6656
- C:\Windows\System\ODxYsky.exe
  C:\Windows\System\ODxYsky.exe
  2⤵
  PID:6672
- C:\Windows\System\VInNJse.exe
  C:\Windows\System\VInNJse.exe
  2⤵
  PID:6696
- C:\Windows\System\RGXAnHu.exe
  C:\Windows\System\RGXAnHu.exe
  2⤵
  PID:6712
- C:\Windows\System\nfdnoqQ.exe
  C:\Windows\System\nfdnoqQ.exe
  2⤵
  PID:6736
- C:\Windows\System\wInPMDg.exe
  C:\Windows\System\wInPMDg.exe
  2⤵
  PID:6752
- C:\Windows\System\jIDVJOU.exe
  C:\Windows\System\jIDVJOU.exe
  2⤵
  PID:6772
- C:\Windows\System\fGEzotk.exe
  C:\Windows\System\fGEzotk.exe
  2⤵
  PID:6796
- C:\Windows\System\SwnrCWM.exe
  C:\Windows\System\SwnrCWM.exe
  2⤵
  PID:6812
- C:\Windows\System\NQnzfBM.exe
  C:\Windows\System\NQnzfBM.exe
  2⤵
  PID:6836
- C:\Windows\System\DPibkRf.exe
  C:\Windows\System\DPibkRf.exe
  2⤵
  PID:6856
- C:\Windows\System\DUIgVHv.exe
  C:\Windows\System\DUIgVHv.exe
  2⤵
  PID:6872
- C:\Windows\System\FhZKgxC.exe
  C:\Windows\System\FhZKgxC.exe
  2⤵
  PID:6892
- C:\Windows\System\GYvaAim.exe
  C:\Windows\System\GYvaAim.exe
  2⤵
  PID:6912
- C:\Windows\System\MYOvXQz.exe
  C:\Windows\System\MYOvXQz.exe
  2⤵
  PID:6932
- C:\Windows\System\EMBWUxK.exe
  C:\Windows\System\EMBWUxK.exe
  2⤵
  PID:6952
- C:\Windows\System\DNQefGy.exe
  C:\Windows\System\DNQefGy.exe
  2⤵
  PID:6972
- C:\Windows\System\mfvhIhq.exe
  C:\Windows\System\mfvhIhq.exe
  2⤵
  PID:6988
- C:\Windows\System\sdoLEal.exe
  C:\Windows\System\sdoLEal.exe
  2⤵
  PID:7012
- C:\Windows\System\IzavxMu.exe
  C:\Windows\System\IzavxMu.exe
  2⤵
  PID:7032
- C:\Windows\System\fJjfEwW.exe
  C:\Windows\System\fJjfEwW.exe
  2⤵
  PID:7052
- C:\Windows\System\mNOCIkG.exe
  C:\Windows\System\mNOCIkG.exe
  2⤵
  PID:7072
- C:\Windows\System\ZKxuaEv.exe
  C:\Windows\System\ZKxuaEv.exe
  2⤵
  PID:7088
- C:\Windows\System\TFxjTQL.exe
  C:\Windows\System\TFxjTQL.exe
  2⤵
  PID:7108
- C:\Windows\System\dlXoyIv.exe
  C:\Windows\System\dlXoyIv.exe
  2⤵
  PID:7128
- C:\Windows\System\VVQKeHr.exe
  C:\Windows\System\VVQKeHr.exe
  2⤵
  PID:7148
- C:\Windows\System\SeQxFly.exe
  C:\Windows\System\SeQxFly.exe
  2⤵
  PID:7164
- C:\Windows\System\QIVwHDU.exe
  C:\Windows\System\QIVwHDU.exe
  2⤵
  PID:4332
- C:\Windows\System\iOORRvy.exe
  C:\Windows\System\iOORRvy.exe
  2⤵
  PID:4412
- C:\Windows\System\EgGKnfU.exe
  C:\Windows\System\EgGKnfU.exe
  2⤵
  PID:4600
- C:\Windows\System\nlXvuxo.exe
  C:\Windows\System\nlXvuxo.exe
  2⤵
  PID:4768
- C:\Windows\System\RHYdOSp.exe
  C:\Windows\System\RHYdOSp.exe
  2⤵
  PID:3912
- C:\Windows\System\BMYEQrv.exe
  C:\Windows\System\BMYEQrv.exe
  2⤵
  PID:5332
- C:\Windows\System\JLJhqYv.exe
  C:\Windows\System\JLJhqYv.exe
  2⤵
  PID:5244
- C:\Windows\System\mlYPoQw.exe
  C:\Windows\System\mlYPoQw.exe
  2⤵
  PID:5420
- C:\Windows\System\jijWJls.exe
  C:\Windows\System\jijWJls.exe
  2⤵
  PID:5524
- C:\Windows\System\JBkiJAo.exe
  C:\Windows\System\JBkiJAo.exe
  2⤵
  PID:5596
- C:\Windows\System\AYvfrzU.exe
  C:\Windows\System\AYvfrzU.exe
  2⤵
  PID:5684
- C:\Windows\System\XinQhet.exe
  C:\Windows\System\XinQhet.exe
  2⤵
  PID:5584
- C:\Windows\System\sTVZVuj.exe
  C:\Windows\System\sTVZVuj.exe
  2⤵
  PID:5760
- C:\Windows\System\bBQJTsv.exe
  C:\Windows\System\bBQJTsv.exe
  2⤵
  PID:5980
- C:\Windows\System\DJGIeUS.exe
  C:\Windows\System\DJGIeUS.exe
  2⤵
  PID:2416
- C:\Windows\System\xXJBjLk.exe
  C:\Windows\System\xXJBjLk.exe
  2⤵
  PID:6084
- C:\Windows\System\yjDioYe.exe
  C:\Windows\System\yjDioYe.exe
  2⤵
  PID:6020
- C:\Windows\System\cJxrIca.exe
  C:\Windows\System\cJxrIca.exe
  2⤵
  PID:6160
- C:\Windows\System\xxCWqKO.exe
  C:\Windows\System\xxCWqKO.exe
  2⤵
  PID:6212
- C:\Windows\System\YLpGrmN.exe
  C:\Windows\System\YLpGrmN.exe
  2⤵
  PID:2640
- C:\Windows\System\mpeCxoR.exe
  C:\Windows\System\mpeCxoR.exe
  2⤵
  PID:6188
- C:\Windows\System\UlZhJQe.exe
  C:\Windows\System\UlZhJQe.exe
  2⤵
  PID:6284
- C:\Windows\System\OqaIGye.exe
  C:\Windows\System\OqaIGye.exe
  2⤵
  PID:6268
- C:\Windows\System\RDzjhtp.exe
  C:\Windows\System\RDzjhtp.exe
  2⤵
  PID:6308
- C:\Windows\System\hSVCYVE.exe
  C:\Windows\System\hSVCYVE.exe
  2⤵
  PID:1896
- C:\Windows\System\spFoupn.exe
  C:\Windows\System\spFoupn.exe
  2⤵
  PID:6344
- C:\Windows\System\dNLqPBM.exe
  C:\Windows\System\dNLqPBM.exe
  2⤵
  PID:6404
- C:\Windows\System\IlBEuNu.exe
  C:\Windows\System\IlBEuNu.exe
  2⤵
  PID:2208
- C:\Windows\System\VYWgAUv.exe
  C:\Windows\System\VYWgAUv.exe
  2⤵
  PID:6452
- C:\Windows\System\mqJYwrH.exe
  C:\Windows\System\mqJYwrH.exe
  2⤵
  PID:552
- C:\Windows\System\QLJRsFj.exe
  C:\Windows\System\QLJRsFj.exe
  2⤵
  PID:6524
- C:\Windows\System\qKdPUUQ.exe
  C:\Windows\System\qKdPUUQ.exe
  2⤵
  PID:6560
- C:\Windows\System\AfaMaQS.exe
  C:\Windows\System\AfaMaQS.exe
  2⤵
  PID:6548
- C:\Windows\System\zgDBpWb.exe
  C:\Windows\System\zgDBpWb.exe
  2⤵
  PID:6604
- C:\Windows\System\YxkRLbX.exe
  C:\Windows\System\YxkRLbX.exe
  2⤵
  PID:6644
- C:\Windows\System\epXUoom.exe
  C:\Windows\System\epXUoom.exe
  2⤵
  PID:6628
- C:\Windows\System\aURugQF.exe
  C:\Windows\System\aURugQF.exe
  2⤵
  PID:6720
- C:\Windows\System\jCKvhoq.exe
  C:\Windows\System\jCKvhoq.exe
  2⤵
  PID:6760
- C:\Windows\System\KkZkAtp.exe
  C:\Windows\System\KkZkAtp.exe
  2⤵
  PID:6708
- C:\Windows\System\qgvgJRa.exe
  C:\Windows\System\qgvgJRa.exe
  2⤵
  PID:6804
- C:\Windows\System\oiqXubW.exe
  C:\Windows\System\oiqXubW.exe
  2⤵
  PID:6792
- C:\Windows\System\johXGJF.exe
  C:\Windows\System\johXGJF.exe
  2⤵
  PID:6828
- C:\Windows\System\JWsEzvi.exe
  C:\Windows\System\JWsEzvi.exe
  2⤵
  PID:6920
- C:\Windows\System\zglfRzb.exe
  C:\Windows\System\zglfRzb.exe
  2⤵
  PID:2472
- C:\Windows\System\RpcuDHV.exe
  C:\Windows\System\RpcuDHV.exe
  2⤵
  PID:6868
- C:\Windows\System\lbosZxV.exe
  C:\Windows\System\lbosZxV.exe
  2⤵
  PID:6908
- C:\Windows\System\qnAVGmT.exe
  C:\Windows\System\qnAVGmT.exe
  2⤵
  PID:7008
- C:\Windows\System\vFqtzGs.exe
  C:\Windows\System\vFqtzGs.exe
  2⤵
  PID:2536
- C:\Windows\System\MWfpoOb.exe
  C:\Windows\System\MWfpoOb.exe
  2⤵
  PID:1956
- C:\Windows\System\nHHueTZ.exe
  C:\Windows\System\nHHueTZ.exe
  2⤵
  PID:7156
- C:\Windows\System\xkzHXdT.exe
  C:\Windows\System\xkzHXdT.exe
  2⤵
  PID:4428
- C:\Windows\System\aWsAaJX.exe
  C:\Windows\System\aWsAaJX.exe
  2⤵
  PID:7068
- C:\Windows\System\GgZRMRL.exe
  C:\Windows\System\GgZRMRL.exe
  2⤵
  PID:2760
- C:\Windows\System\EamSStv.exe
  C:\Windows\System\EamSStv.exe
  2⤵
  PID:2196
- C:\Windows\System\DoqqhJY.exe
  C:\Windows\System\DoqqhJY.exe
  2⤵
  PID:3336
- C:\Windows\System\SfOxGED.exe
  C:\Windows\System\SfOxGED.exe
  2⤵
  PID:2996
- C:\Windows\System\HabqIhI.exe
  C:\Windows\System\HabqIhI.exe
  2⤵
  PID:2384
- C:\Windows\System\HIFNXYo.exe
  C:\Windows\System\HIFNXYo.exe
  2⤵
  PID:5140
- C:\Windows\System\XMMpmwG.exe
  C:\Windows\System\XMMpmwG.exe
  2⤵
  PID:5340
- C:\Windows\System\Itgrhey.exe
  C:\Windows\System\Itgrhey.exe
  2⤵
  PID:5492
- C:\Windows\System\CGfRcPo.exe
  C:\Windows\System\CGfRcPo.exe
  2⤵
  PID:5652
- C:\Windows\System\KpLODHQ.exe
  C:\Windows\System\KpLODHQ.exe
  2⤵
  PID:5532
- C:\Windows\System\zkfYmvE.exe
  C:\Windows\System\zkfYmvE.exe
  2⤵
  PID:2580
- C:\Windows\System\ChGxrNs.exe
  C:\Windows\System\ChGxrNs.exe
  2⤵
  PID:2812
- C:\Windows\System\WrDCIZU.exe
  C:\Windows\System\WrDCIZU.exe
  2⤵
  PID:1704
- C:\Windows\System\OjLZlTd.exe
  C:\Windows\System\OjLZlTd.exe
  2⤵
  PID:5948
- C:\Windows\System\qwBQOZW.exe
  C:\Windows\System\qwBQOZW.exe
  2⤵
  PID:3936
- C:\Windows\System\DxhuYSv.exe
  C:\Windows\System\DxhuYSv.exe
  2⤵
  PID:1816
- C:\Windows\System\uWvrptv.exe
  C:\Windows\System\uWvrptv.exe
  2⤵
  PID:3148
- C:\Windows\System\BQmyfDm.exe
  C:\Windows\System\BQmyfDm.exe
  2⤵
  PID:6244
- C:\Windows\System\RrplPGO.exe
  C:\Windows\System\RrplPGO.exe
  2⤵
  PID:6200
- C:\Windows\System\nXeUpJX.exe
  C:\Windows\System\nXeUpJX.exe
  2⤵
  PID:2900
- C:\Windows\System\gHvqzGO.exe
  C:\Windows\System\gHvqzGO.exe
  2⤵
  PID:6184
- C:\Windows\System\UMSFjqj.exe
  C:\Windows\System\UMSFjqj.exe
  2⤵
  PID:2268
- C:\Windows\System\LOktUQv.exe
  C:\Windows\System\LOktUQv.exe
  2⤵
  PID:2600
- C:\Windows\System\XRsCSHn.exe
  C:\Windows\System\XRsCSHn.exe
  2⤵
  PID:6388
- C:\Windows\System\jFghhxd.exe
  C:\Windows\System\jFghhxd.exe
  2⤵
  PID:2092
- C:\Windows\System\kNysZNm.exe
  C:\Windows\System\kNysZNm.exe
  2⤵
  PID:6408
- C:\Windows\System\buswVvP.exe
  C:\Windows\System\buswVvP.exe
  2⤵
  PID:1648
- C:\Windows\System\ntZYYFe.exe
  C:\Windows\System\ntZYYFe.exe
  2⤵
  PID:684
- C:\Windows\System\bwxzZfP.exe
  C:\Windows\System\bwxzZfP.exe
  2⤵
  PID:276
- C:\Windows\System\HLrTcDa.exe
  C:\Windows\System\HLrTcDa.exe
  2⤵
  PID:3016
- C:\Windows\System\ozYBVEG.exe
  C:\Windows\System\ozYBVEG.exe
  2⤵
  PID:6504
- C:\Windows\System\kPssaVK.exe
  C:\Windows\System\kPssaVK.exe
  2⤵
  PID:2372
- C:\Windows\System\DjXPFMF.exe
  C:\Windows\System\DjXPFMF.exe
  2⤵
  PID:6484
- C:\Windows\System\JFFUdLA.exe
  C:\Windows\System\JFFUdLA.exe
  2⤵
  PID:6544
- C:\Windows\System\HuLQlaf.exe
  C:\Windows\System\HuLQlaf.exe
  2⤵
  PID:6620
- C:\Windows\System\mQnLDPS.exe
  C:\Windows\System\mQnLDPS.exe
  2⤵
  PID:6732
- C:\Windows\System\fnDyPkE.exe
  C:\Windows\System\fnDyPkE.exe
  2⤵
  PID:6748
- C:\Windows\System\oacFZgt.exe
  C:\Windows\System\oacFZgt.exe
  2⤵
  PID:1140
- C:\Windows\System\vfRtZpx.exe
  C:\Windows\System\vfRtZpx.exe
  2⤵
  PID:6968
- C:\Windows\System\zCeEGjW.exe
  C:\Windows\System\zCeEGjW.exe
  2⤵
  PID:6844
- C:\Windows\System\OBkKjFh.exe
  C:\Windows\System\OBkKjFh.exe
  2⤵
  PID:6888
- C:\Windows\System\RvSsZIh.exe
  C:\Windows\System\RvSsZIh.exe
  2⤵
  PID:6864
- C:\Windows\System\kPAtQOW.exe
  C:\Windows\System\kPAtQOW.exe
  2⤵
  PID:7004
- C:\Windows\System\AcKXdhr.exe
  C:\Windows\System\AcKXdhr.exe
  2⤵
  PID:2832
- C:\Windows\System\ihjWwWJ.exe
  C:\Windows\System\ihjWwWJ.exe
  2⤵
  PID:7064
- C:\Windows\System\vaYVYqz.exe
  C:\Windows\System\vaYVYqz.exe
  2⤵
  PID:960
- C:\Windows\System\tiBVuoU.exe
  C:\Windows\System\tiBVuoU.exe
  2⤵
  PID:2752
- C:\Windows\System\kytMWrX.exe
  C:\Windows\System\kytMWrX.exe
  2⤵
  PID:5228
- C:\Windows\System\lKWHTii.exe
  C:\Windows\System\lKWHTii.exe
  2⤵
  PID:3384
- C:\Windows\System\HhjBtQD.exe
  C:\Windows\System\HhjBtQD.exe
  2⤵
  PID:7096
- C:\Windows\System\XLHrKXz.exe
  C:\Windows\System\XLHrKXz.exe
  2⤵
  PID:2848
- C:\Windows\System\pNzQCJr.exe
  C:\Windows\System\pNzQCJr.exe
  2⤵
  PID:5052
- C:\Windows\System\rXToUyq.exe
  C:\Windows\System\rXToUyq.exe
  2⤵
  PID:5756
- C:\Windows\System\NBoMMLr.exe
  C:\Windows\System\NBoMMLr.exe
  2⤵
  PID:5900
- C:\Windows\System\BHpbTxK.exe
  C:\Windows\System\BHpbTxK.exe
  2⤵
  PID:3004
- C:\Windows\System\QeUUvEd.exe
  C:\Windows\System\QeUUvEd.exe
  2⤵
  PID:6164
- C:\Windows\System\aXHGOTA.exe
  C:\Windows\System\aXHGOTA.exe
  2⤵
  PID:6288
- C:\Windows\System\wUWEuwB.exe
  C:\Windows\System\wUWEuwB.exe
  2⤵
  PID:5912
- C:\Windows\System\BgyDpja.exe
  C:\Windows\System\BgyDpja.exe
  2⤵
  PID:2200
- C:\Windows\System\vrKhaQO.exe
  C:\Windows\System\vrKhaQO.exe
  2⤵
  PID:6500
- C:\Windows\System\NWdBWmE.exe
  C:\Windows\System\NWdBWmE.exe
  2⤵
  PID:2276
- C:\Windows\System\zRBrIjq.exe
  C:\Windows\System\zRBrIjq.exe
  2⤵
  PID:6820
- C:\Windows\System\yHadXia.exe
  C:\Windows\System\yHadXia.exe
  2⤵
  PID:2336
- C:\Windows\System\kuEvhWC.exe
  C:\Windows\System\kuEvhWC.exe
  2⤵
  PID:6428
- C:\Windows\System\mcMgtnL.exe
  C:\Windows\System\mcMgtnL.exe
  2⤵
  PID:5624
- C:\Windows\System\ZOFcDcY.exe
  C:\Windows\System\ZOFcDcY.exe
  2⤵
  PID:6368
- C:\Windows\System\QYmpxGZ.exe
  C:\Windows\System\QYmpxGZ.exe
  2⤵
  PID:6768
- C:\Windows\System\uOcTgNv.exe
  C:\Windows\System\uOcTgNv.exe
  2⤵
  PID:6960
- C:\Windows\System\jwlLLze.exe
  C:\Windows\System\jwlLLze.exe
  2⤵
  PID:6564
- C:\Windows\System\ijWVCJZ.exe
  C:\Windows\System\ijWVCJZ.exe
  2⤵
  PID:3008
- C:\Windows\System\Onaxyqz.exe
  C:\Windows\System\Onaxyqz.exe
  2⤵
  PID:6400
- C:\Windows\System\URrXzEZ.exe
  C:\Windows\System\URrXzEZ.exe
  2⤵
  PID:6292
- C:\Windows\System\NQJgZNm.exe
  C:\Windows\System\NQJgZNm.exe
  2⤵
  PID:6248
- C:\Windows\System\sMxIDGA.exe
  C:\Windows\System\sMxIDGA.exe
  2⤵
  PID:5856
- C:\Windows\System\llaVFuh.exe
  C:\Windows\System\llaVFuh.exe
  2⤵
  PID:6948
- C:\Windows\System\tMnaObL.exe
  C:\Windows\System\tMnaObL.exe
  2⤵
  PID:2108
- C:\Windows\System\hgzrzrP.exe
  C:\Windows\System\hgzrzrP.exe
  2⤵
  PID:3352
- C:\Windows\System\cMcFCFl.exe
  C:\Windows\System\cMcFCFl.exe
  2⤵
  PID:7124
- C:\Windows\System\yMBihEZ.exe
  C:\Windows\System\yMBihEZ.exe
  2⤵
  PID:4740
- C:\Windows\System\zDozFDq.exe
  C:\Windows\System\zDozFDq.exe
  2⤵
  PID:5216
- C:\Windows\System\RSuPZaS.exe
  C:\Windows\System\RSuPZaS.exe
  2⤵
  PID:2772
- C:\Windows\System\NqNLATn.exe
  C:\Windows\System\NqNLATn.exe
  2⤵
  PID:1368
- C:\Windows\System\mRFXXTn.exe
  C:\Windows\System\mRFXXTn.exe
  2⤵
  PID:2496
- C:\Windows\System\xmLvawj.exe
  C:\Windows\System\xmLvawj.exe
  2⤵
  PID:5512
- C:\Windows\System\qqQpMMP.exe
  C:\Windows\System\qqQpMMP.exe
  2⤵
  PID:1752
- C:\Windows\System\SDfRFmU.exe
  C:\Windows\System\SDfRFmU.exe
  2⤵
  PID:5716
- C:\Windows\System\TzsvKjs.exe
  C:\Windows\System\TzsvKjs.exe
  2⤵
  PID:6684
- C:\Windows\System\kSGSxEd.exe
  C:\Windows\System\kSGSxEd.exe
  2⤵
  PID:6208
- C:\Windows\System\pMnlDax.exe
  C:\Windows\System\pMnlDax.exe
  2⤵
  PID:6692
- C:\Windows\System\KvBBOSg.exe
  C:\Windows\System\KvBBOSg.exe
  2⤵
  PID:6328
- C:\Windows\System\MUDazSU.exe
  C:\Windows\System\MUDazSU.exe
  2⤵
  PID:768
- C:\Windows\System\rrhgpkM.exe
  C:\Windows\System\rrhgpkM.exe
  2⤵
  PID:5864
- C:\Windows\System\gkKjQun.exe
  C:\Windows\System\gkKjQun.exe
  2⤵
  PID:7024
- C:\Windows\System\FaZVxQE.exe
  C:\Windows\System\FaZVxQE.exe
  2⤵
  PID:2948
- C:\Windows\System\xpZqZgY.exe
  C:\Windows\System\xpZqZgY.exe
  2⤵
  PID:6944
- C:\Windows\System\QFxFTsP.exe
  C:\Windows\System\QFxFTsP.exe
  2⤵
  PID:6996
- C:\Windows\System\DMUQGxI.exe
  C:\Windows\System\DMUQGxI.exe
  2⤵
  PID:2076
- C:\Windows\System\TsDSMCY.exe
  C:\Windows\System\TsDSMCY.exe
  2⤵
  PID:5744
- C:\Windows\System\xVSXefQ.exe
  C:\Windows\System\xVSXefQ.exe
  2⤵
  PID:6440
- C:\Windows\System\OpakiaR.exe
  C:\Windows\System\OpakiaR.exe
  2⤵
  PID:2096
- C:\Windows\System\xdCFwoX.exe
  C:\Windows\System\xdCFwoX.exe
  2⤵
  PID:7020
- C:\Windows\System\qDnfRMw.exe
  C:\Windows\System\qDnfRMw.exe
  2⤵
  PID:5952
- C:\Windows\System\wXDRbEz.exe
  C:\Windows\System\wXDRbEz.exe
  2⤵
  PID:7184
- C:\Windows\System\fykcKJp.exe
  C:\Windows\System\fykcKJp.exe
  2⤵
  PID:7200
- C:\Windows\System\enSmyzI.exe
  C:\Windows\System\enSmyzI.exe
  2⤵
  PID:7216
- C:\Windows\System\lfdfBNH.exe
  C:\Windows\System\lfdfBNH.exe
  2⤵
  PID:7232
- C:\Windows\System\ZBlHyvJ.exe
  C:\Windows\System\ZBlHyvJ.exe
  2⤵
  PID:7248
- C:\Windows\System\wjbcfcL.exe
  C:\Windows\System\wjbcfcL.exe
  2⤵
  PID:7264
- C:\Windows\System\BdeihBx.exe
  C:\Windows\System\BdeihBx.exe
  2⤵
  PID:7280
- C:\Windows\System\TvpmHJg.exe
  C:\Windows\System\TvpmHJg.exe
  2⤵
  PID:7296
- C:\Windows\System\dsLmZGu.exe
  C:\Windows\System\dsLmZGu.exe
  2⤵
  PID:7312
- C:\Windows\System\bVSneCI.exe
  C:\Windows\System\bVSneCI.exe
  2⤵
  PID:7328
- C:\Windows\System\jQnVzOg.exe
  C:\Windows\System\jQnVzOg.exe
  2⤵
  PID:7344
- C:\Windows\System\wXNaDcV.exe
  C:\Windows\System\wXNaDcV.exe
  2⤵
  PID:7360
- C:\Windows\System\EITdfEI.exe
  C:\Windows\System\EITdfEI.exe
  2⤵
  PID:7376
- C:\Windows\System\TuDNMXm.exe
  C:\Windows\System\TuDNMXm.exe
  2⤵
  PID:7392
- C:\Windows\System\oHudQuu.exe
  C:\Windows\System\oHudQuu.exe
  2⤵
  PID:7408
- C:\Windows\System\WdjreuK.exe
  C:\Windows\System\WdjreuK.exe
  2⤵
  PID:7424
- C:\Windows\System\feVyLOU.exe
  C:\Windows\System\feVyLOU.exe
  2⤵
  PID:7440
- C:\Windows\System\BKmYoqD.exe
  C:\Windows\System\BKmYoqD.exe
  2⤵
  PID:7456
- C:\Windows\System\RqlrpFV.exe
  C:\Windows\System\RqlrpFV.exe
  2⤵
  PID:7472
- C:\Windows\System\svCHHfZ.exe
  C:\Windows\System\svCHHfZ.exe
  2⤵
  PID:7488
- C:\Windows\System\sEGPGUU.exe
  C:\Windows\System\sEGPGUU.exe
  2⤵
  PID:7504
- C:\Windows\System\dFiSxtV.exe
  C:\Windows\System\dFiSxtV.exe
  2⤵
  PID:7520
- C:\Windows\System\LZIEiVM.exe
  C:\Windows\System\LZIEiVM.exe
  2⤵
  PID:7536
- C:\Windows\System\eQrlXWV.exe
  C:\Windows\System\eQrlXWV.exe
  2⤵
  PID:7552
- C:\Windows\System\fflAApP.exe
  C:\Windows\System\fflAApP.exe
  2⤵
  PID:7568
- C:\Windows\System\fpCKSjY.exe
  C:\Windows\System\fpCKSjY.exe
  2⤵
  PID:7584
- C:\Windows\System\JMrcKQA.exe
  C:\Windows\System\JMrcKQA.exe
  2⤵
  PID:7600
- C:\Windows\System\PvVSQTg.exe
  C:\Windows\System\PvVSQTg.exe
  2⤵
  PID:7616
- C:\Windows\System\jFEgkuZ.exe
  C:\Windows\System\jFEgkuZ.exe
  2⤵
  PID:7632
- C:\Windows\System\hIqKrrc.exe
  C:\Windows\System\hIqKrrc.exe
  2⤵
  PID:7648
- C:\Windows\System\LrVoEsb.exe
  C:\Windows\System\LrVoEsb.exe
  2⤵
  PID:7664
- C:\Windows\System\XWfFWpb.exe
  C:\Windows\System\XWfFWpb.exe
  2⤵
  PID:7680
- C:\Windows\System\YKbZqhu.exe
  C:\Windows\System\YKbZqhu.exe
  2⤵
  PID:7696
- C:\Windows\System\EMJunLQ.exe
  C:\Windows\System\EMJunLQ.exe
  2⤵
  PID:7712
- C:\Windows\System\OOjYCIG.exe
  C:\Windows\System\OOjYCIG.exe
  2⤵
  PID:7728
- C:\Windows\System\uoZJKBv.exe
  C:\Windows\System\uoZJKBv.exe
  2⤵
  PID:7744
- C:\Windows\System\EoUxnFx.exe
  C:\Windows\System\EoUxnFx.exe
  2⤵
  PID:7760
- C:\Windows\System\SjPbSTo.exe
  C:\Windows\System\SjPbSTo.exe
  2⤵
  PID:7776
- C:\Windows\System\YzQHVqe.exe
  C:\Windows\System\YzQHVqe.exe
  2⤵
  PID:7792
- C:\Windows\System\gqROPwn.exe
  C:\Windows\System\gqROPwn.exe
  2⤵
  PID:7808
- C:\Windows\System\VcQGcKW.exe
  C:\Windows\System\VcQGcKW.exe
  2⤵
  PID:7824
- C:\Windows\System\oLlUBkY.exe
  C:\Windows\System\oLlUBkY.exe
  2⤵
  PID:7840
- C:\Windows\System\SylIOhY.exe
  C:\Windows\System\SylIOhY.exe
  2⤵
  PID:7856
- C:\Windows\System\uWewozN.exe
  C:\Windows\System\uWewozN.exe
  2⤵
  PID:7872
- C:\Windows\System\UpUQNNd.exe
  C:\Windows\System\UpUQNNd.exe
  2⤵
  PID:7888
- C:\Windows\System\ToJTYNJ.exe
  C:\Windows\System\ToJTYNJ.exe
  2⤵
  PID:7904
- C:\Windows\System\ITYvAdF.exe
  C:\Windows\System\ITYvAdF.exe
  2⤵
  PID:7920
- C:\Windows\System\atcGcVW.exe
  C:\Windows\System\atcGcVW.exe
  2⤵
  PID:7936
- C:\Windows\System\PaMPZFy.exe
  C:\Windows\System\PaMPZFy.exe
  2⤵
  PID:7952
- C:\Windows\System\lZKqzxv.exe
  C:\Windows\System\lZKqzxv.exe
  2⤵
  PID:7968
- C:\Windows\System\aCVnsZG.exe
  C:\Windows\System\aCVnsZG.exe
  2⤵
  PID:7984
- C:\Windows\System\kTSKpvl.exe
  C:\Windows\System\kTSKpvl.exe
  2⤵
  PID:8000
- C:\Windows\System\BJgRfSI.exe
  C:\Windows\System\BJgRfSI.exe
  2⤵
  PID:8016
- C:\Windows\System\GVktjCF.exe
  C:\Windows\System\GVktjCF.exe
  2⤵
  PID:8032
- C:\Windows\System\PBjCNmL.exe
  C:\Windows\System\PBjCNmL.exe
  2⤵
  PID:8048
- C:\Windows\System\JUHoScc.exe
  C:\Windows\System\JUHoScc.exe
  2⤵
  PID:8064
- C:\Windows\System\ArCMaGP.exe
  C:\Windows\System\ArCMaGP.exe
  2⤵
  PID:8080
- C:\Windows\System\yonCPDn.exe
  C:\Windows\System\yonCPDn.exe
  2⤵
  PID:8096
- C:\Windows\System\xOIHIFX.exe
  C:\Windows\System\xOIHIFX.exe
  2⤵
  PID:8112
- C:\Windows\System\ZUrYWZk.exe
  C:\Windows\System\ZUrYWZk.exe
  2⤵
  PID:8128
- C:\Windows\System\oZLZCIQ.exe
  C:\Windows\System\oZLZCIQ.exe
  2⤵
  PID:8144
- C:\Windows\System\wZSeJkp.exe
  C:\Windows\System\wZSeJkp.exe
  2⤵
  PID:8160
- C:\Windows\System\zSTrdce.exe
  C:\Windows\System\zSTrdce.exe
  2⤵
  PID:8176
- C:\Windows\System\jAeeVfp.exe
  C:\Windows\System\jAeeVfp.exe
  2⤵
  PID:6600
- C:\Windows\System\zusSpVy.exe
  C:\Windows\System\zusSpVy.exe
  2⤵
  PID:7212
- C:\Windows\System\sMFOrYD.exe
  C:\Windows\System\sMFOrYD.exe
  2⤵
  PID:7272
- C:\Windows\System\AJrHKQZ.exe
  C:\Windows\System\AJrHKQZ.exe
  2⤵
  PID:7304
- C:\Windows\System\yEtSbqt.exe
  C:\Windows\System\yEtSbqt.exe
  2⤵
  PID:7000
- C:\Windows\System\HRHhrxb.exe
  C:\Windows\System\HRHhrxb.exe
  2⤵
  PID:5472
- C:\Windows\System\jCLTRpB.exe
  C:\Windows\System\jCLTRpB.exe
  2⤵
  PID:2388
- C:\Windows\System\dziaErY.exe
  C:\Windows\System\dziaErY.exe
  2⤵
  PID:7256
- C:\Windows\System\NJxcSeb.exe
  C:\Windows\System\NJxcSeb.exe
  2⤵
  PID:7368
- C:\Windows\System\vSrNZzR.exe
  C:\Windows\System\vSrNZzR.exe
  2⤵
  PID:7432
- C:\Windows\System\HuDlFBQ.exe
  C:\Windows\System\HuDlFBQ.exe
  2⤵
  PID:7496
- C:\Windows\System\ESQcYkF.exe
  C:\Windows\System\ESQcYkF.exe
  2⤵
  PID:7292
- C:\Windows\System\xmpuAUW.exe
  C:\Windows\System\xmpuAUW.exe
  2⤵
  PID:7560
- C:\Windows\System\izkOuGd.exe
  C:\Windows\System\izkOuGd.exe
  2⤵
  PID:7624
- C:\Windows\System\IimYKYb.exe
  C:\Windows\System\IimYKYb.exe
  2⤵
  PID:7688
- C:\Windows\System\kKiRjap.exe
  C:\Windows\System\kKiRjap.exe
  2⤵
  PID:7752
- C:\Windows\System\CSiamDY.exe
  C:\Windows\System\CSiamDY.exe
  2⤵
  PID:7816
- C:\Windows\System\AQtHHcv.exe
  C:\Windows\System\AQtHHcv.exe
  2⤵
  PID:7772
- C:\Windows\System\WEYErnl.exe
  C:\Windows\System\WEYErnl.exe
  2⤵
  PID:7736
- C:\Windows\System\bNjtRNn.exe
  C:\Windows\System\bNjtRNn.exe
  2⤵
  PID:7800
- C:\Windows\System\BgItZHk.exe
  C:\Windows\System\BgItZHk.exe
  2⤵
  PID:7420
- C:\Windows\System\PeUvKSe.exe
  C:\Windows\System\PeUvKSe.exe
  2⤵
  PID:7484
- C:\Windows\System\RPBLiom.exe
  C:\Windows\System\RPBLiom.exe
  2⤵
  PID:7544
- C:\Windows\System\WagDRhs.exe
  C:\Windows\System\WagDRhs.exe
  2⤵
  PID:7608
- C:\Windows\System\YDxcHaF.exe
  C:\Windows\System\YDxcHaF.exe
  2⤵
  PID:7672
- C:\Windows\System\dTQRBbd.exe
  C:\Windows\System\dTQRBbd.exe
  2⤵
  PID:7836
- C:\Windows\System\rKpgNoP.exe
  C:\Windows\System\rKpgNoP.exe
  2⤵
  PID:7916
- C:\Windows\System\icFuQXK.exe
  C:\Windows\System\icFuQXK.exe
  2⤵
  PID:7960
- C:\Windows\System\hzfPOKQ.exe
  C:\Windows\System\hzfPOKQ.exe
  2⤵
  PID:8012
- C:\Windows\System\WNISJXR.exe
  C:\Windows\System\WNISJXR.exe
  2⤵
  PID:8044
- C:\Windows\System\OHGrfYA.exe
  C:\Windows\System\OHGrfYA.exe
  2⤵
  PID:8104
- C:\Windows\System\gVTHjKk.exe
  C:\Windows\System\gVTHjKk.exe
  2⤵
  PID:7928
- C:\Windows\System\YYknfru.exe
  C:\Windows\System\YYknfru.exe
  2⤵
  PID:7180
- C:\Windows\System\kBEvTTj.exe
  C:\Windows\System\kBEvTTj.exe
  2⤵
  PID:1964
- C:\Windows\System\tRskGtH.exe
  C:\Windows\System\tRskGtH.exe
  2⤵
  PID:8024
- C:\Windows\System\BjIKlig.exe
  C:\Windows\System\BjIKlig.exe
  2⤵
  PID:7240
- C:\Windows\System\FjOpjRH.exe
  C:\Windows\System\FjOpjRH.exe
  2⤵
  PID:8088
- C:\Windows\System\UpPEDdN.exe
  C:\Windows\System\UpPEDdN.exe
  2⤵
  PID:8156
- C:\Windows\System\OKLqnuf.exe
  C:\Windows\System\OKLqnuf.exe
  2⤵
  PID:1732
- C:\Windows\System\Xkbfmop.exe
  C:\Windows\System\Xkbfmop.exe
  2⤵
  PID:7404
- C:\Windows\System\fQRtVyX.exe
  C:\Windows\System\fQRtVyX.exe
  2⤵
  PID:7592
- C:\Windows\System\nUWLYGY.exe
  C:\Windows\System\nUWLYGY.exe
  2⤵
  PID:7724
- C:\Windows\System\CFgQjtC.exe
  C:\Windows\System\CFgQjtC.exe
  2⤵
  PID:7356
- C:\Windows\System\yeLBTGD.exe
  C:\Windows\System\yeLBTGD.exe
  2⤵
  PID:7576
- C:\Windows\System\UBZcqrS.exe
  C:\Windows\System\UBZcqrS.exe
  2⤵
  PID:7932
- C:\Windows\System\mPQReLe.exe
  C:\Windows\System\mPQReLe.exe
  2⤵
  PID:7900
- C:\Windows\System\vfmQbYM.exe
  C:\Windows\System\vfmQbYM.exe
  2⤵
  PID:8152
- C:\Windows\System\cCZRaDq.exe
  C:\Windows\System\cCZRaDq.exe
  2⤵
  PID:8120
- C:\Windows\System\FkFssNK.exe
  C:\Windows\System\FkFssNK.exe
  2⤵
  PID:7596
- C:\Windows\System\hIIJMUK.exe
  C:\Windows\System\hIIJMUK.exe
  2⤵
  PID:8008
- C:\Windows\System\vvgtEnk.exe
  C:\Windows\System\vvgtEnk.exe
  2⤵
  PID:7580
- C:\Windows\System\BFflTKF.exe
  C:\Windows\System\BFflTKF.exe
  2⤵
  PID:8204
- C:\Windows\System\XStmHBO.exe
  C:\Windows\System\XStmHBO.exe
  2⤵
  PID:8220
- C:\Windows\System\nbqiWVQ.exe
  C:\Windows\System\nbqiWVQ.exe
  2⤵
  PID:8236
- C:\Windows\System\snsQViP.exe
  C:\Windows\System\snsQViP.exe
  2⤵
  PID:8252
- C:\Windows\System\Otbcmxf.exe
  C:\Windows\System\Otbcmxf.exe
  2⤵
  PID:8268
- C:\Windows\System\MrAwQJZ.exe
  C:\Windows\System\MrAwQJZ.exe
  2⤵
  PID:8288
- C:\Windows\System\ixWDjvo.exe
  C:\Windows\System\ixWDjvo.exe
  2⤵
  PID:8304
- C:\Windows\System\oCDVqKf.exe
  C:\Windows\System\oCDVqKf.exe
  2⤵
  PID:8320
- C:\Windows\System\GlofiWB.exe
  C:\Windows\System\GlofiWB.exe
  2⤵
  PID:8336
- C:\Windows\System\QroAqUI.exe
  C:\Windows\System\QroAqUI.exe
  2⤵
  PID:8352
- C:\Windows\System\jQFyUpU.exe
  C:\Windows\System\jQFyUpU.exe
  2⤵
  PID:8368
- C:\Windows\System\liABdUT.exe
  C:\Windows\System\liABdUT.exe
  2⤵
  PID:8384
- C:\Windows\System\zIlsAYh.exe
  C:\Windows\System\zIlsAYh.exe
  2⤵
  PID:8400
- C:\Windows\System\yxtTSUH.exe
  C:\Windows\System\yxtTSUH.exe
  2⤵
  PID:8416
- C:\Windows\System\VlQdokA.exe
  C:\Windows\System\VlQdokA.exe
  2⤵
  PID:8432
- C:\Windows\System\pnXgMSK.exe
  C:\Windows\System\pnXgMSK.exe
  2⤵
  PID:8448
- C:\Windows\System\NykljSr.exe
  C:\Windows\System\NykljSr.exe
  2⤵
  PID:8464
- C:\Windows\System\jYPvzca.exe
  C:\Windows\System\jYPvzca.exe
  2⤵
  PID:8480
- C:\Windows\System\xHDKDug.exe
  C:\Windows\System\xHDKDug.exe
  2⤵
  PID:8496
- C:\Windows\System\YRTqYtk.exe
  C:\Windows\System\YRTqYtk.exe
  2⤵
  PID:8512
- C:\Windows\System\NLUpOSS.exe
  C:\Windows\System\NLUpOSS.exe
  2⤵
  PID:8528
- C:\Windows\System\hzljeFb.exe
  C:\Windows\System\hzljeFb.exe
  2⤵
  PID:8544
- C:\Windows\System\ccEkiGH.exe
  C:\Windows\System\ccEkiGH.exe
  2⤵
  PID:8560
- C:\Windows\System\zZPbKMU.exe
  C:\Windows\System\zZPbKMU.exe
  2⤵
  PID:8576
- C:\Windows\System\EsYceUi.exe
  C:\Windows\System\EsYceUi.exe
  2⤵
  PID:8592
- C:\Windows\System\XfaNYUj.exe
  C:\Windows\System\XfaNYUj.exe
  2⤵
  PID:8608
- C:\Windows\System\EInmNIi.exe
  C:\Windows\System\EInmNIi.exe
  2⤵
  PID:8624
- C:\Windows\System\wPAbByF.exe
  C:\Windows\System\wPAbByF.exe
  2⤵
  PID:8640
- C:\Windows\System\qmwAJCs.exe
  C:\Windows\System\qmwAJCs.exe
  2⤵
  PID:8656
- C:\Windows\System\sDMeyTG.exe
  C:\Windows\System\sDMeyTG.exe
  2⤵
  PID:8672
- C:\Windows\System\TSRRlRg.exe
  C:\Windows\System\TSRRlRg.exe
  2⤵
  PID:8688
- C:\Windows\System\lNJClUq.exe
  C:\Windows\System\lNJClUq.exe
  2⤵
  PID:8704
- C:\Windows\System\UIhcCDX.exe
  C:\Windows\System\UIhcCDX.exe
  2⤵
  PID:8720
- C:\Windows\System\bLorrKT.exe
  C:\Windows\System\bLorrKT.exe
  2⤵
  PID:8736
- C:\Windows\System\wVfRcjs.exe
  C:\Windows\System\wVfRcjs.exe
  2⤵
  PID:8752
- C:\Windows\System\kBEKmJV.exe
  C:\Windows\System\kBEKmJV.exe
  2⤵
  PID:8768
- C:\Windows\System\dkvVjQk.exe
  C:\Windows\System\dkvVjQk.exe
  2⤵
  PID:8788
- C:\Windows\System\oVOxrxH.exe
  C:\Windows\System\oVOxrxH.exe
  2⤵
  PID:8804
- C:\Windows\System\XzibCWQ.exe
  C:\Windows\System\XzibCWQ.exe
  2⤵
  PID:8820
- C:\Windows\System\ntCFLlg.exe
  C:\Windows\System\ntCFLlg.exe
  2⤵
  PID:8836
- C:\Windows\System\DELcvbX.exe
  C:\Windows\System\DELcvbX.exe
  2⤵
  PID:8852
- C:\Windows\System\VpbHcuU.exe
  C:\Windows\System\VpbHcuU.exe
  2⤵
  PID:8868
- C:\Windows\System\lXBflsZ.exe
  C:\Windows\System\lXBflsZ.exe
  2⤵
  PID:8884
- C:\Windows\System\fqjRDzA.exe
  C:\Windows\System\fqjRDzA.exe
  2⤵
  PID:8900
- C:\Windows\System\GFyyhgN.exe
  C:\Windows\System\GFyyhgN.exe
  2⤵
  PID:8916
- C:\Windows\System\SIYewLA.exe
  C:\Windows\System\SIYewLA.exe
  2⤵
  PID:8932
- C:\Windows\System\nxRqRLt.exe
  C:\Windows\System\nxRqRLt.exe
  2⤵
  PID:8948
- C:\Windows\System\PktdwbF.exe
  C:\Windows\System\PktdwbF.exe
  2⤵
  PID:8964
- C:\Windows\System\nBMUElr.exe
  C:\Windows\System\nBMUElr.exe
  2⤵
  PID:8980
- C:\Windows\System\UYtkXUG.exe
  C:\Windows\System\UYtkXUG.exe
  2⤵
  PID:8996
- C:\Windows\System\xAkjOBB.exe
  C:\Windows\System\xAkjOBB.exe
  2⤵
  PID:9012
- C:\Windows\System\xhDrouz.exe
  C:\Windows\System\xhDrouz.exe
  2⤵
  PID:9028
- C:\Windows\System\wvMlRfP.exe
  C:\Windows\System\wvMlRfP.exe
  2⤵
  PID:9044
- C:\Windows\System\RSJtLyw.exe
  C:\Windows\System\RSJtLyw.exe
  2⤵
  PID:9060
- C:\Windows\System\zkoFFcB.exe
  C:\Windows\System\zkoFFcB.exe
  2⤵
  PID:9076
- C:\Windows\System\wmUvECQ.exe
  C:\Windows\System\wmUvECQ.exe
  2⤵
  PID:9092
- C:\Windows\System\RqJkgJc.exe
  C:\Windows\System\RqJkgJc.exe
  2⤵
  PID:9108
- C:\Windows\System\PVBenoG.exe
  C:\Windows\System\PVBenoG.exe
  2⤵
  PID:9124
- C:\Windows\System\orxAGBT.exe
  C:\Windows\System\orxAGBT.exe
  2⤵
  PID:9140
- C:\Windows\System\iqeqqqu.exe
  C:\Windows\System\iqeqqqu.exe
  2⤵
  PID:9156
- C:\Windows\System\vMMdDNS.exe
  C:\Windows\System\vMMdDNS.exe
  2⤵
  PID:9172
- C:\Windows\System\GcBTgso.exe
  C:\Windows\System\GcBTgso.exe
  2⤵
  PID:9188
- C:\Windows\System\emPbbqA.exe
  C:\Windows\System\emPbbqA.exe
  2⤵
  PID:9204
- C:\Windows\System\uevfTsR.exe
  C:\Windows\System\uevfTsR.exe
  2⤵
  PID:8200
- C:\Windows\System\XUdhmdG.exe
  C:\Windows\System\XUdhmdG.exe
  2⤵
  PID:8264
- C:\Windows\System\ryFBEmP.exe
  C:\Windows\System\ryFBEmP.exe
  2⤵
  PID:7464
- C:\Windows\System\xcCqfNL.exe
  C:\Windows\System\xcCqfNL.exe
  2⤵
  PID:7628
- C:\Windows\System\lReHZMi.exe
  C:\Windows\System\lReHZMi.exe
  2⤵
  PID:7804
- C:\Windows\System\tHwRppm.exe
  C:\Windows\System\tHwRppm.exe
  2⤵
  PID:7880
- C:\Windows\System\dyRYbFD.exe
  C:\Windows\System\dyRYbFD.exe
  2⤵
  PID:7980
- C:\Windows\System\zbirJJe.exe
  C:\Windows\System\zbirJJe.exe
  2⤵
  PID:7208
- C:\Windows\System\yeRwUFH.exe
  C:\Windows\System\yeRwUFH.exe
  2⤵
  PID:8060
- C:\Windows\System\tzoVFag.exe
  C:\Windows\System\tzoVFag.exe
  2⤵
  PID:7288
- C:\Windows\System\wUmcYvo.exe
  C:\Windows\System\wUmcYvo.exe
  2⤵
  PID:7944
- C:\Windows\System\DFlPquk.exe
  C:\Windows\System\DFlPquk.exe
  2⤵
  PID:7136
- C:\Windows\System\UPLSBWv.exe
  C:\Windows\System\UPLSBWv.exe
  2⤵
  PID:8244
- C:\Windows\System\yVddZIo.exe
  C:\Windows\System\yVddZIo.exe
  2⤵
  PID:8332
- C:\Windows\System\gCPkjPr.exe
  C:\Windows\System\gCPkjPr.exe
  2⤵
  PID:7976
- C:\Windows\System\Nkpsclb.exe
  C:\Windows\System\Nkpsclb.exe
  2⤵
  PID:8376
- C:\Windows\System\nJmdfFc.exe
  C:\Windows\System\nJmdfFc.exe
  2⤵
  PID:8428
- C:\Windows\System\wUZwgTr.exe
  C:\Windows\System\wUZwgTr.exe
  2⤵
  PID:8488
- C:\Windows\System\pmnAPJq.exe
  C:\Windows\System\pmnAPJq.exe
  2⤵
  PID:8552
- C:\Windows\System\wIsKFQG.exe
  C:\Windows\System\wIsKFQG.exe
  2⤵
  PID:8408
- C:\Windows\System\YJXbHqe.exe
  C:\Windows\System\YJXbHqe.exe
  2⤵
  PID:8440
- C:\Windows\System\RlrXPtM.exe
  C:\Windows\System\RlrXPtM.exe
  2⤵
  PID:8572
- C:\Windows\System\AddXvCt.exe
  C:\Windows\System\AddXvCt.exe
  2⤵
  PID:8508
- C:\Windows\System\TuUgHAa.exe
  C:\Windows\System\TuUgHAa.exe
  2⤵
  PID:8620
- C:\Windows\System\frAnTIz.exe
  C:\Windows\System\frAnTIz.exe
  2⤵
  PID:8716
- C:\Windows\System\OOHGouu.exe
  C:\Windows\System\OOHGouu.exe
  2⤵
  PID:8748
- C:\Windows\System\CfxDTdf.exe
  C:\Windows\System\CfxDTdf.exe
  2⤵
  PID:8816
- C:\Windows\System\fYnFKqj.exe
  C:\Windows\System\fYnFKqj.exe
  2⤵
  PID:8880
- C:\Windows\System\CozgNjd.exe
  C:\Windows\System\CozgNjd.exe
  2⤵
  PID:8940
- C:\Windows\System\QwDOleO.exe
  C:\Windows\System\QwDOleO.exe
  2⤵
  PID:9004
- C:\Windows\System\FVWIiEH.exe
  C:\Windows\System\FVWIiEH.exe
  2⤵
  PID:9040
- C:\Windows\System\hEQzLbC.exe
  C:\Windows\System\hEQzLbC.exe
  2⤵
  PID:9100
- C:\Windows\System\ErbAGaj.exe
  C:\Windows\System\ErbAGaj.exe
  2⤵
  PID:9164
- C:\Windows\System\DPmMbIc.exe
  C:\Windows\System\DPmMbIc.exe
  2⤵
  PID:8860
- C:\Windows\System\lRxnzmi.exe
  C:\Windows\System\lRxnzmi.exe
  2⤵
  PID:8700
- C:\Windows\System\czkPxZd.exe
  C:\Windows\System\czkPxZd.exe
  2⤵
  PID:8764
- C:\Windows\System\eLGqQEy.exe
  C:\Windows\System\eLGqQEy.exe
  2⤵
  PID:8832
- C:\Windows\System\ddjRHYT.exe
  C:\Windows\System\ddjRHYT.exe
  2⤵
  PID:8928
- C:\Windows\System\nIuiEVm.exe
  C:\Windows\System\nIuiEVm.exe
  2⤵
  PID:8992
- C:\Windows\System\TTktBcO.exe
  C:\Windows\System\TTktBcO.exe
  2⤵
  PID:9180
- C:\Windows\System\oeYGoTq.exe
  C:\Windows\System\oeYGoTq.exe
  2⤵
  PID:9056
- C:\Windows\System\JcwIqWM.exe
  C:\Windows\System\JcwIqWM.exe
  2⤵
  PID:9148
- C:\Windows\System\lhRKAJY.exe
  C:\Windows\System\lhRKAJY.exe
  2⤵
  PID:7532
- C:\Windows\System\djsTXZR.exe
  C:\Windows\System\djsTXZR.exe
  2⤵
  PID:7788
- C:\Windows\System\RVHMkcT.exe
  C:\Windows\System\RVHMkcT.exe
  2⤵
  PID:5984
- C:\Windows\System\YCXYaep.exe
  C:\Windows\System\YCXYaep.exe
  2⤵
  PID:7340
- C:\Windows\System\MPUBFhr.exe
  C:\Windows\System\MPUBFhr.exe
  2⤵
  PID:7768
- C:\Windows\System\RQlWHCB.exe
  C:\Windows\System\RQlWHCB.exe
  2⤵
  PID:8328
- C:\Windows\System\dRzeciy.exe
  C:\Windows\System\dRzeciy.exe
  2⤵
  PID:8392
- C:\Windows\System\kshMbrE.exe
  C:\Windows\System\kshMbrE.exe
  2⤵
  PID:8348
- C:\Windows\System\VrVzyEo.exe
  C:\Windows\System\VrVzyEo.exe
  2⤵
  PID:8460
- C:\Windows\System\mOShIMQ.exe
  C:\Windows\System\mOShIMQ.exe
  2⤵
  PID:8540
- C:\Windows\System\OMDQdJx.exe
  C:\Windows\System\OMDQdJx.exe
  2⤵
  PID:8412
- C:\Windows\System\tFyrzSx.exe
  C:\Windows\System\tFyrzSx.exe
  2⤵
  PID:8876
- C:\Windows\System\WoZtaZb.exe
  C:\Windows\System\WoZtaZb.exe
  2⤵
  PID:8744
- C:\Windows\System\ewOcmEO.exe
  C:\Windows\System\ewOcmEO.exe
  2⤵
  PID:9072
- C:\Windows\System\zgyxHUS.exe
  C:\Windows\System\zgyxHUS.exe
  2⤵
  PID:8760
- C:\Windows\System\KrKEDTK.exe
  C:\Windows\System\KrKEDTK.exe
  2⤵
  PID:9084
- C:\Windows\System\ecrQbwP.exe
  C:\Windows\System\ecrQbwP.exe
  2⤵
  PID:7388
- C:\Windows\System\kVAHUnr.exe
  C:\Windows\System\kVAHUnr.exe
  2⤵
  PID:8648
- C:\Windows\System\sGiNylg.exe
  C:\Windows\System\sGiNylg.exe
  2⤵
  PID:8960
- C:\Windows\System\EzYRCfq.exe
  C:\Windows\System\EzYRCfq.exe
  2⤵
  PID:9184
- C:\Windows\System\aPpjtFL.exe
  C:\Windows\System\aPpjtFL.exe
  2⤵
  PID:8696
- C:\Windows\System\hFSWvaz.exe
  C:\Windows\System\hFSWvaz.exe
  2⤵
  PID:9008
- C:\Windows\System\hsoQVia.exe
  C:\Windows\System\hsoQVia.exe
  2⤵
  PID:8212
- C:\Windows\System\PHKCuPg.exe
  C:\Windows\System\PHKCuPg.exe
  2⤵
  PID:8520
- C:\Windows\System\vtjLjoU.exe
  C:\Windows\System\vtjLjoU.exe
  2⤵
  PID:8616
- C:\Windows\System\ZPgBQde.exe
  C:\Windows\System\ZPgBQde.exe
  2⤵
  PID:9052
- C:\Windows\System\AAJQEIQ.exe
  C:\Windows\System\AAJQEIQ.exe
  2⤵
  PID:8056
- C:\Windows\System\FfvlWpZ.exe
  C:\Windows\System\FfvlWpZ.exe
  2⤵
  PID:8712
- C:\Windows\System\lpubujn.exe
  C:\Windows\System\lpubujn.exe
  2⤵
  PID:8228
- C:\Windows\System\jBCxEmP.exe
  C:\Windows\System\jBCxEmP.exe
  2⤵
  PID:7196
- C:\Windows\System\hMoaQpy.exe
  C:\Windows\System\hMoaQpy.exe
  2⤵
  PID:7384
- C:\Windows\System\DBoLtwc.exe
  C:\Windows\System\DBoLtwc.exe
  2⤵
  PID:9068
- C:\Windows\System\wfHyarr.exe
  C:\Windows\System\wfHyarr.exe
  2⤵
  PID:9136
- C:\Windows\System\kgjClXz.exe
  C:\Windows\System\kgjClXz.exe
  2⤵
  PID:8828
- C:\Windows\System\KQRjGmY.exe
  C:\Windows\System\KQRjGmY.exe
  2⤵
  PID:9224
- C:\Windows\System\HQbQZMe.exe
  C:\Windows\System\HQbQZMe.exe
  2⤵
  PID:9240
- C:\Windows\System\FjcqmFV.exe
  C:\Windows\System\FjcqmFV.exe
  2⤵
  PID:9256
- C:\Windows\System\ksVZEBA.exe
  C:\Windows\System\ksVZEBA.exe
  2⤵
  PID:9272
- C:\Windows\System\linxITx.exe
  C:\Windows\System\linxITx.exe
  2⤵
  PID:9288
- C:\Windows\System\bHpoGKJ.exe
  C:\Windows\System\bHpoGKJ.exe
  2⤵
  PID:9304
- C:\Windows\System\DmwMFbT.exe
  C:\Windows\System\DmwMFbT.exe
  2⤵
  PID:9320
- C:\Windows\System\TuAVaSb.exe
  C:\Windows\System\TuAVaSb.exe
  2⤵
  PID:9336
- C:\Windows\System\boWhHyI.exe
  C:\Windows\System\boWhHyI.exe
  2⤵
  PID:9352
- C:\Windows\System\HqVYeAC.exe
  C:\Windows\System\HqVYeAC.exe
  2⤵
  PID:9368
- C:\Windows\System\eTFYhqZ.exe
  C:\Windows\System\eTFYhqZ.exe
  2⤵
  PID:9388
- C:\Windows\System\NVneUHa.exe
  C:\Windows\System\NVneUHa.exe
  2⤵
  PID:9404
- C:\Windows\System\NaarVvb.exe
  C:\Windows\System\NaarVvb.exe
  2⤵
  PID:9420
- C:\Windows\System\WkTgeLH.exe
  C:\Windows\System\WkTgeLH.exe
  2⤵
  PID:9436
- C:\Windows\System\hMCJIBY.exe
  C:\Windows\System\hMCJIBY.exe
  2⤵
  PID:9452
- C:\Windows\System\zFlnFgf.exe
  C:\Windows\System\zFlnFgf.exe
  2⤵
  PID:9468
- C:\Windows\System\DSNldRf.exe
  C:\Windows\System\DSNldRf.exe
  2⤵
  PID:9484
- C:\Windows\System\rFFnnCQ.exe
  C:\Windows\System\rFFnnCQ.exe
  2⤵
  PID:9504
- C:\Windows\System\UGYfsEl.exe
  C:\Windows\System\UGYfsEl.exe
  2⤵
  PID:9520
- C:\Windows\System\SPrDJQe.exe
  C:\Windows\System\SPrDJQe.exe
  2⤵
  PID:9536
- C:\Windows\System\PsqZNMT.exe
  C:\Windows\System\PsqZNMT.exe
  2⤵
  PID:9552
- C:\Windows\System\ZKTGlWL.exe
  C:\Windows\System\ZKTGlWL.exe
  2⤵
  PID:9568
- C:\Windows\System\jNrbhRw.exe
  C:\Windows\System\jNrbhRw.exe
  2⤵
  PID:9584
- C:\Windows\System\ejScYzC.exe
  C:\Windows\System\ejScYzC.exe
  2⤵
  PID:9600
- C:\Windows\System\CKtbWZQ.exe
  C:\Windows\System\CKtbWZQ.exe
  2⤵
  PID:9616
- C:\Windows\System\CAElekF.exe
  C:\Windows\System\CAElekF.exe
  2⤵
  PID:9632
- C:\Windows\System\EnvxCsH.exe
  C:\Windows\System\EnvxCsH.exe
  2⤵
  PID:9648
- C:\Windows\System\ukZZHUx.exe
  C:\Windows\System\ukZZHUx.exe
  2⤵
  PID:9664
- C:\Windows\System\JpclbUn.exe
  C:\Windows\System\JpclbUn.exe
  2⤵
  PID:9680
- C:\Windows\System\zVCRiTk.exe
  C:\Windows\System\zVCRiTk.exe
  2⤵
  PID:9696
- C:\Windows\System\xfsICkC.exe
  C:\Windows\System\xfsICkC.exe
  2⤵
  PID:9712
- C:\Windows\System\qNUCcaQ.exe
  C:\Windows\System\qNUCcaQ.exe
  2⤵
  PID:9728
- C:\Windows\System\ndXQNjD.exe
  C:\Windows\System\ndXQNjD.exe
  2⤵
  PID:9744
- C:\Windows\System\TOxFqcF.exe
  C:\Windows\System\TOxFqcF.exe
  2⤵
  PID:9760
- C:\Windows\System\QyEHEGn.exe
  C:\Windows\System\QyEHEGn.exe
  2⤵
  PID:9776
- C:\Windows\System\dgUQZaj.exe
  C:\Windows\System\dgUQZaj.exe
  2⤵
  PID:9792
- C:\Windows\System\QITdPls.exe
  C:\Windows\System\QITdPls.exe
  2⤵
  PID:9808
- C:\Windows\System\IytAXbK.exe
  C:\Windows\System\IytAXbK.exe
  2⤵
  PID:9824
- C:\Windows\System\lUHoPwW.exe
  C:\Windows\System\lUHoPwW.exe
  2⤵
  PID:9840
- C:\Windows\System\vdONogG.exe
  C:\Windows\System\vdONogG.exe
  2⤵
  PID:9856
- C:\Windows\System\ysyeMNk.exe
  C:\Windows\System\ysyeMNk.exe
  2⤵
  PID:9872
- C:\Windows\System\bEGHHVL.exe
  C:\Windows\System\bEGHHVL.exe
  2⤵
  PID:9888
- C:\Windows\System\dqcTiBL.exe
  C:\Windows\System\dqcTiBL.exe
  2⤵
  PID:9904
- C:\Windows\System\vYIQYLK.exe
  C:\Windows\System\vYIQYLK.exe
  2⤵
  PID:9920
- C:\Windows\System\jZlOpRb.exe
  C:\Windows\System\jZlOpRb.exe
  2⤵
  PID:9936
- C:\Windows\System\iLIaGeu.exe
  C:\Windows\System\iLIaGeu.exe
  2⤵
  PID:9952
- C:\Windows\System\xIyJNhm.exe
  C:\Windows\System\xIyJNhm.exe
  2⤵
  PID:9968
- C:\Windows\System\AaFtNxL.exe
  C:\Windows\System\AaFtNxL.exe
  2⤵
  PID:9984
- C:\Windows\System\YFGVDPF.exe
  C:\Windows\System\YFGVDPF.exe
  2⤵
  PID:10000
- C:\Windows\System\RNWAsSW.exe
  C:\Windows\System\RNWAsSW.exe
  2⤵
  PID:10016
- C:\Windows\System\NmIMDPo.exe
  C:\Windows\System\NmIMDPo.exe
  2⤵
  PID:10032
- C:\Windows\System\zvJrYno.exe
  C:\Windows\System\zvJrYno.exe
  2⤵
  PID:10048
- C:\Windows\System\VTiFGcS.exe
  C:\Windows\System\VTiFGcS.exe
  2⤵
  PID:10064
- C:\Windows\System\mLjomGg.exe
  C:\Windows\System\mLjomGg.exe
  2⤵
  PID:10080
- C:\Windows\System\ohqINWk.exe
  C:\Windows\System\ohqINWk.exe
  2⤵
  PID:10096
- C:\Windows\System\kYfoDFJ.exe
  C:\Windows\System\kYfoDFJ.exe
  2⤵
  PID:10112
- C:\Windows\System\BKmlRqz.exe
  C:\Windows\System\BKmlRqz.exe
  2⤵
  PID:10128
- C:\Windows\System\utfFStY.exe
  C:\Windows\System\utfFStY.exe
  2⤵
  PID:10144
- C:\Windows\System\IwmOWaV.exe
  C:\Windows\System\IwmOWaV.exe
  2⤵
  PID:10160
- C:\Windows\System\hfWjTtV.exe
  C:\Windows\System\hfWjTtV.exe
  2⤵
  PID:10176
- C:\Windows\System\hUpTqYJ.exe
  C:\Windows\System\hUpTqYJ.exe
  2⤵
  PID:10196
- C:\Windows\System\osDWZEr.exe
  C:\Windows\System\osDWZEr.exe
  2⤵
  PID:10212
- C:\Windows\System\EgggyCW.exe
  C:\Windows\System\EgggyCW.exe
  2⤵
  PID:10228
- C:\Windows\System\RlKNkQG.exe
  C:\Windows\System\RlKNkQG.exe
  2⤵
  PID:8812
- C:\Windows\System\TWyuQIj.exe
  C:\Windows\System\TWyuQIj.exe
  2⤵
  PID:7244
- C:\Windows\System\YhqLssY.exe
  C:\Windows\System\YhqLssY.exe
  2⤵
  PID:8364
- C:\Windows\System\YoKeswM.exe
  C:\Windows\System\YoKeswM.exe
  2⤵
  PID:9264
- C:\Windows\System\aMQPayu.exe
  C:\Windows\System\aMQPayu.exe
  2⤵
  PID:9300
- C:\Windows\System\wwOYFOm.exe
  C:\Windows\System\wwOYFOm.exe
  2⤵
  PID:9252
- C:\Windows\System\bxQdAvU.exe
  C:\Windows\System\bxQdAvU.exe
  2⤵
  PID:9280
- C:\Windows\System\qEXfFZf.exe
  C:\Windows\System\qEXfFZf.exe
  2⤵
  PID:9328
- C:\Windows\System\zzAkOoP.exe
  C:\Windows\System\zzAkOoP.exe
  2⤵
  PID:9348
- C:\Windows\System\cYNoLTV.exe
  C:\Windows\System\cYNoLTV.exe
  2⤵
  PID:9384
- C:\Windows\System\xQnQQfg.exe
  C:\Windows\System\xQnQQfg.exe
  2⤵
  PID:9432
- C:\Windows\System\LNYjrfm.exe
  C:\Windows\System\LNYjrfm.exe
  2⤵
  PID:9500
- C:\Windows\System\OXDlXYV.exe
  C:\Windows\System\OXDlXYV.exe
  2⤵
  PID:9564
- C:\Windows\System\TAPCnja.exe
  C:\Windows\System\TAPCnja.exe
  2⤵
  PID:9448
- C:\Windows\System\yfhgmlC.exe
  C:\Windows\System\yfhgmlC.exe
  2⤵
  PID:9656
- C:\Windows\System\tAYiXOj.exe
  C:\Windows\System\tAYiXOj.exe
  2⤵
  PID:9692
- C:\Windows\System\HxBhrWb.exe
  C:\Windows\System\HxBhrWb.exe
  2⤵
  PID:9544
- C:\Windows\System\yzyAyam.exe
  C:\Windows\System\yzyAyam.exe
  2⤵
  PID:9612
- C:\Windows\System\avzsJCa.exe
  C:\Windows\System\avzsJCa.exe
  2⤵
  PID:9704
- C:\Windows\System\qTtPeOh.exe
  C:\Windows\System\qTtPeOh.exe
  2⤵
  PID:9736
- C:\Windows\System\FOFpYDo.exe
  C:\Windows\System\FOFpYDo.exe
  2⤵
  PID:9784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\KxXVVlk.exe

Filesize
2.7MB

MD5
fdc4090a641a429e487c8fd526029207

SHA1
f29138d819df0b1597e78e9b2d4595203d089baa

SHA256
f394e7646cef5c36cecc07cc3011ed4a89c587b2387a4dde6942c51d7b56da92

SHA512
63ab55815c1b6ecb3fae4d4370124066410435905aa80086dc2a839231d29df840deb61143ebba09d7b9eea7cdf3af1bf6e09764b78025945e78c4d7ab83246b

Download Submit
C:\Windows\system\PGckjkM.exe

Filesize
2.7MB

MD5
f3df4e7afd01948f6ac45e9dfd66c1ff

SHA1
65cd0b4326f5338bb5c2a30e17db45651bca8394

SHA256
6791ef4b9215d7d2cbff319624d0d34eeef58b1db17dfd545872e5654eda7129

SHA512
84bbd5ae5c37343a69585a3dfc6d45d3e64f278723411f64e810b302dd830a372e51f59f9cce0bde2e4bbb59d1dccbfd411703bc048d538e6996bffa2110c387

Download Submit
C:\Windows\system\RlqpqGD.exe

Filesize
2.7MB

MD5
7f9455eac0a20a3bb07b2c544e2784de

SHA1
52bf0e83a08a282b807ba78ca32b8b556694da48

SHA256
a5326c08477518a74602622fc2f9a85aa6e98d9efc386795c9b224b2ab6de525

SHA512
4ea23fcc65fb0dbfdc36433e843ad86c1063ae5798ec87cfc16a9dab99ebcf50cdba33b751275c057225eceba497ac3ba172364ae83692513cbf8cbb47011d5f

Download Submit
C:\Windows\system\SyXHQlC.exe

Filesize
2.7MB

MD5
e25b81a78c644068b516167f70adf2d1

SHA1
f047144049008fa115ad4fc9a79d5bb968c33396

SHA256
8bca8eb3a9a2b1e5225e64edc501b0d34a73f87d3a15fa63a7645bd18ea581e6

SHA512
1002ed94960dbd8d3aa960f7e86d66aca73b3c0d1904089dd093d27cf01cf6702eeec50146c42c377a26e802ca937a2beecf50fe1c61066f4642df7f2bdf64be

Download Submit
C:\Windows\system\VqZpkjv.exe

Filesize
2.7MB

MD5
f1a71f686c4b51c547b67bb0857932b1

SHA1
7dbcbeea049bec4f7993f077b5db88617ad1c6d8

SHA256
5db9e00c6f337c2889dfe56a83c535684bbc77bed4ed672ae9699b8d202b6b8c

SHA512
5294ddd0cc6e87f076bbbe0a96b8508cb61a55e7c8e2385c151d1d77f473367984f1d15715e304092e5471f8930e683f9a8a53990963143df2b8fa7dbf6b7a9d

Download Submit
C:\Windows\system\XnSCHGb.exe

Filesize
2.7MB

MD5
c3381548076c38ad937a9eace514e53f

SHA1
c4f153a7d97ea3fe87527f7b06a5d88b82d6a858

SHA256
929bef9a660a457fa7061e9dafc7aae0cd2d45f3644a2382d772b1582df87d2b

SHA512
353a9a209164ce08a000b16bfa2317471227d813817d547a02a060294b9deb77c391dad3949db2c208bb0bfb44209b8905071491d674ca101596d6c7e296093d

Download Submit
C:\Windows\system\ZJCetLf.exe

Filesize
2.7MB

MD5
1f924d7666bcbe67a221f64b9f555012

SHA1
7cc2b9f170d30fd69eadfbedb4f301c49bdc905c

SHA256
c353af8be66a205b7d92ea5ae3c0ec928c5fc48f4d8e38b6c4b4e19340f62fcd

SHA512
f54aa91a2c882645b12f90e9439f76786e655a1111dd979b416131a8ee7c6578fba0dc2f02a3bf4eba71e709b4d130cbac36eb1de36219d386a4625d6bf27a57

Download Submit
C:\Windows\system\cOomCJf.exe

Filesize
2.7MB

MD5
4326dd6bad4ba351dfc4cda54b6ae248

SHA1
6f699b386e5f939c4ca46a7840ecee16ea013dc4

SHA256
42c6bfdb06c9713b0f976bea3b63c53cfc89cf1606774f962587e91056923d52

SHA512
1975a9af7a3dfc5003eb90d687de2532208a1b6d5ff8042037bc9bbf945fc531ba188344b58a9ed0590be2a0ceb0a1ae860daecc270377ea09951913d653f07f

Download Submit
C:\Windows\system\eRODHBh.exe

Filesize
2.7MB

MD5
31fe6164952740aa0d1a5ed79abe20cd

SHA1
f961e9298031536b97e2dd808800bd294ec9b702

SHA256
2f58d79d076f264059952be33b5c8bab09fc32dd9ae12a415eb5b18a4fb47300

SHA512
7a6c66b59eb21c263aaf531b6a5f327689064ab49692b0f3aaa890ac9c41a1ca5c4eadee586e27d0281f8d21a301ef73904c551937693bccad1b834143e6015a

Download Submit
C:\Windows\system\evFNkvn.exe

Filesize
2.7MB

MD5
e2dc3542e3cf2369721b1e1af86349ed

SHA1
6c683a9bd63a7e84ccd0c6970875bcdc8873be9d

SHA256
6c1e8e3af8c127049c6584f7d55b44b03cd306e3ebdfd428abf71440941e19f4

SHA512
2ba5fe3e549253023768fee1c689addba320f28719697dffe7d53286d995ea35b950e2eb8652d884569f5c8b1c68c9781629284f0db9e8f32390bd16c364589c

Download Submit
C:\Windows\system\igyEzvV.exe

Filesize
2.7MB

MD5
e73ba8271a1da23c49ae266bad016f9d

SHA1
51fe7eb1c3ef00fc471852b64dfa3ca527598f9b

SHA256
c60fd007c060b86866592a3d098ab0dcb15d6ae8617723dbfd394023da59de49

SHA512
a0910c2bce9aceaa8ed351c727c8143aa6f903f0046c667bada6f6aa30a456b054f51b404ff8102582ad24906c25ad788f64214bd7ea4b6af9989d7b5120fc60

Download Submit
C:\Windows\system\ihcWPkG.exe

Filesize
2.7MB

MD5
65d3bd971e5bbd1a22e8701c3d067196

SHA1
a01304044aa5e4fa5dd4607445b28599094f97f1

SHA256
7b081a925002f93037c5f4bb5031d3aeab88bb13bdc59f3ffecff30e6ce2a04a

SHA512
26598acc64e94b0c1febf58690785de0f1722b8d5e7f68d22b48ea083dfbcab6bb23326d156b45b07e4547fa9d20cf2c1ada235335a250ddeeb230f70c9cb82f

Download Submit
C:\Windows\system\jtgexVq.exe

Filesize
2.7MB

MD5
01f4c4bb884d4412871fee48292fa85a

SHA1
221600ac1e2ac8f169b0d71ed7d554bb076889bb

SHA256
239479720609707f388a65eba9d0501defc93f789ef5d04e129a20a6d698ad38

SHA512
61c575d03ec1565007c3fc043f752d16d22a2e11bdda468c5477d120c77f4e0d9ae21654399dee5388fc16845fa102500c43c604063d98dc44b2cb45017e75a5

Download Submit
C:\Windows\system\nhMXvOn.exe

Filesize
2.7MB

MD5
78fde2e51d41594f484588a29d2308c2

SHA1
ed0cbe9501a3d788fdce04dd3cb7a43012b2c790

SHA256
61690691e2a755584e0a2e8a807cfa8e44f5870d12f823989e9c55a5a4b9b302

SHA512
4dbfe862012e9547083d324808672d4e9a7b64eae1cac9e3970cafc83b7dae3f2f0c9ce2ae5012fab76eb5a171d831aeba3d81d21a282eefef78d04be8bfee4d

Download Submit
C:\Windows\system\oPdTqIX.exe

Filesize
2.7MB

MD5
808647374ec668b12624c6701f41fb28

SHA1
0b104ba8b22367c50208f4d3e17687744890ff4f

SHA256
cdda0a23b809dc10782a36d0503efd1666c0b7554dbd31ca49ac89e0171be447

SHA512
f8247aa08339cc1fedb6a9a6ec68a18d38b94892b3951d9e17998c4df475a8d8c6f6d72c94e922e812f2f80bd8ce5315aa9432d2954e12e79a975417ec93c02b

Download Submit
C:\Windows\system\obFgFqD.exe

Filesize
2.7MB

MD5
6d445f8a581d7ee14f5615df34adc117

SHA1
10dd0b73db1ce1b8745d1300a2bd985ec17ca01b

SHA256
99d7ed5fe862e5809e9b15042ee58b310c5d5d31ee36b14ef11b54021744520e

SHA512
0c6ef7efb2e86e30ff53aad85cb7254a413f42ce5f838be17d7d78fc48a1a5e78adb975dc2aa297937d267560894b1c519281d741240dbd7425112750ffe4a87

Download Submit
C:\Windows\system\pdtqCWZ.exe

Filesize
2.7MB

MD5
01cf199cbc6517bdc514263171966367

SHA1
1f83d0742187534a9de1b1918e0161f042112f20

SHA256
2fcdab70b64677b896d6cdecfa12cdf2950ddb229d2b1a8d2a7d3ee20c443fcf

SHA512
c230d2505eb10844c87735a737565b6841e1ab4d1d5659ed9b5276eecbf497f2fa034a27799219170d271ecc463ca20b644f61ed356ac54898eb0f0e567e2882

Download Submit
C:\Windows\system\qWbGSFz.exe

Filesize
2.7MB

MD5
ca1c33e09bd5b9476d77ed23daf2135d

SHA1
f1bf98da5b2597c4f12ac858ae88db6142431c68

SHA256
275d16b6d6dad8b171373dfbe900d8113089dd7d30a8e9808c093afedf36a698

SHA512
61a38f09cce354a9c713e371a704fe56755951ea50965d08c4462303f6246b2becf378e68edceed5b6c10b56b55c30631314fcd7651f987c6e989c49d13a34b6

Download Submit
C:\Windows\system\sdemdgp.exe

Filesize
2.7MB

MD5
292835a51f4447c352e407e7aaab7b3f

SHA1
b13c74c3b6b6e10336aac97ecff7baae6a7d8055

SHA256
8e065bcf28da84e1389e3bbcc7cb31980359ba805edfa8000c755eb516464818

SHA512
a357c06239968d448316ecd02fc38ee262e3d3a0acc1a5dcfa474e33a445d08973b8c2389bc425b89042d4d64bf19c8a453494f0c0b5ab4b71c2529c581e8d00

Download Submit
C:\Windows\system\sfauBLu.exe

Filesize
2.7MB

MD5
764ef1b32e90d9f3d6c01949cf5be3ca

SHA1
8ff0460f4870abf132d22be7018c642fbab02bb1

SHA256
0471c0a844898c608854b170ac2cd95f3c547b54670a3624a45a21085ba91b0c

SHA512
94206862215fd6b4bd0b82783f71dc57b61997ee6e2d5c8e47240d6916320901847e689dad826a1d31c8696b10a8d4a6103eb3208adba36c5086cb066eced5af

Download Submit
C:\Windows\system\ssDhGSC.exe

Filesize
2.7MB

MD5
f3edc90dcef298545e9a0dbd084f20a0

SHA1
d3631591621d47505c862efdeb61c53fd6c3cb01

SHA256
cd7df660d35cf95cced65943784aed67124150a09e71bd7b3b8fac12b7fa3239

SHA512
1c3214d760ce764bd4aec3332dc579d643fa269bb83ec4e299832233049b1f628ba89651e75bef2e62d5f40153a5928ad432b62a2e4ed723868de1e3965e432a

Download Submit
C:\Windows\system\weznWSE.exe

Filesize
2.7MB

MD5
0eecfb90587b270f5389b9668b7868e4

SHA1
d1aad6e9b4941dc409584f75ff3bdf085386ffdf

SHA256
1589216eab9178d2bd8a4a8e6557669c64707d6d0a38e66797b776aa816a140f

SHA512
99d393be9ed4a4b64894c7ea0335337d5ab30063f08525d9378125660c921c5882422dbe7184735cedc4203ac7b608ee7ed7b86904e6ce3d538fb94be8171bd1

Download Submit
C:\Windows\system\xqPurIK.exe

Filesize
2.7MB

MD5
46a5b4576cb73c6c0286d5516313c3cb

SHA1
5d8a78190ec4cabf3b5386c1b81650ffe72369e3

SHA256
89158006770966dfd72739d11d1b49213b297a785b721e2d9e4a6d9c0abc09ac

SHA512
2d5594034103edd462fb4e7b1814dd9276e4fbc8cd57353d4f69aaeb870cde47349bef537a3462a34d5e5ab6e7cfb419754d202012bf5b8c9acf9e590b6e98e5

Download Submit
C:\Windows\system\xxGRpOh.exe

Filesize
2.7MB

MD5
64bae601331a248827977ae7c07a0ff3

SHA1
c3a9ef0d0b13fde42ed6ae559000b84a9ee46de5

SHA256
b12c6545c15f8393c6a1b8d4f676498f8ab706d1fcc6c5b03e0bd66326330378

SHA512
e88f660a0f6bcaf63bd83f497535202d48f7dc5d37d2495b0703486f2d21073e0e18ec95e60e5332d6d112cf824eeb729eb155d5fc4487c6fcc2ed2893faebf5

Download Submit
C:\Windows\system\ygYaqfm.exe

Filesize
2.7MB

MD5
a28660b6b56b4714008884c00b0b3446

SHA1
598f20fc1a1f4ecf8955f54556d203064080750b

SHA256
5198648a7efe426b4fb30cacf0d24d041c977fd0cb2379049da1f361e03fc2fa

SHA512
977d6af97839c425c657bee851550a45bab6c4bfa70671509324f83eb0a84318cf2b523d63499f52c3680f695fd5138fef912390b4770f9776e1c1ce0046b08e

Download Submit
C:\Windows\system\yphoTaC.exe

Filesize
2.7MB

MD5
9ddf7820f353c05a22b7faa29c66865a

SHA1
1f290fa0e62bc792473b5110743be266be07074a

SHA256
bd0dd2425c29711305f3c63dd0098f47ee9ba3cacfc1004cad3a9dbc040dc7ed

SHA512
5515fdd902d73a1d8a9ce1faee307dde3678bf75a35e5cd49891451c6f62f90bcf5bc6902ab9c07a849831df732c2674ba4fa5b2339404cbe5f3737aa2bca70f

Download Submit
\Windows\system\BlOGxHp.exe

Filesize
2.7MB

MD5
2ff8efe855beb6518c0f106a607440e3

SHA1
1c1b7934d9c5916a7ce845780f29dced6b2fbccd

SHA256
bbf4f85e90eae9d7f2a80318914e729c10fa33c671883a5f7047f91997e35a01

SHA512
c8fdf32bdc9ea09ffdce0bcaebc40b3720549089e869061a4ebf24dcdf11030b4b54832066501dcf9988d1c3235f19832a740689ce92e00712b95dce41229a9e

Download Submit
\Windows\system\TRYxOIK.exe

Filesize
2.7MB

MD5
99b88dd3acbe468640f7a265219df130

SHA1
c4c7c9bd90ee40971bb6aeba0a1cbc2bdc0f361c

SHA256
4a772fe160829710f1cfa7bb5618fe096a76856db7d98d790246c21ec7bd1a5a

SHA512
6e934b2075bf992c01176c29a852c77e7b2f1e55ea761a00e5e50c7ccb5aecddc47d2e454b054d95018f8d9d3ebdcbfcab497db8c605016942d5c8cbaac6001b

Download Submit
\Windows\system\oXmlbtc.exe

Filesize
2.7MB

MD5
59afcd39d1108fa6415a71411408dd95

SHA1
67e55ba794d9e35f89c55377ae5e42a879aac569

SHA256
22bffbcef7bdf9a4e6c538f2db781928f49b207e62edc00882e23f5067cc9d96

SHA512
779afd8b1a161ce5a8b61240b49e733d6c7c1dfcc502c03855dd326884705ed88c9ec88d1b9ede39a1674bf7b3c8e128a94a587ca5a63e500bd05f28dabfc7b0

Download Submit
\Windows\system\siUTTCV.exe

Filesize
2.7MB

MD5
863ef0aea5d86b309bf5588e4b6d7285

SHA1
62a41a1a83d46d8207f4dd089c031c32f94c3109

SHA256
fb16bc94bca6e53284a91c73da8759e9bed5fa4b7d5b223751f65b34071513c3

SHA512
e77a02b157070a0735ce00748da38ce529c3167d9e041b909de43b195c95322027d9bd825e2e3f122f8f9464e57fadb182877cd03084f68c7d74fa6d2ba77bbe

Download Submit
\Windows\system\tQlmRgc.exe

Filesize
2.7MB

MD5
80e07f8d1bad8fce9bf4d0918dfe2c50

SHA1
9c65bf2277e3033677ba55716dbfdbaa7ba4fd87

SHA256
7996f6203505f75e07ad3bd1c3580dbf5798c4b562888f202466828d4ce1298d

SHA512
6354a898c32d633f01f1d8571d3a0f0cf11c85f58e4fe866d3f0de7e771533056f408671ad4627a822ccb973eb5b259a75a4a46a1976b444c95deba1959d5f50

Download Submit
\Windows\system\vybPkIe.exe

Filesize
2.7MB

MD5
22f0bf435b9c1370064ee064027ed99e

SHA1
1765cf4d3d8c7c948d4dd1df9a30b9c7be30abbb

SHA256
b5eb8c1a96b192a9573c8689cf8f48b48bbf6fb1dee8ba447580aabc593c7be7

SHA512
0bcfc508863faa4ef7dbb16813ddc0bccadd066ac0308a382ceb5d0993870726b53e1ee7f1ee58f3ac1b68653261b5a4ba84935d065768ce88b5b737e479b1df

Download Submit
memory/1308-102-0x000000013FFB0000-0x0000000140304000-memory.dmp

Filesize
3.3MB

Download
memory/1308-1036-0x000000013FFB0000-0x0000000140304000-memory.dmp

Filesize
3.3MB

Download
memory/1308-4028-0x000000013FFB0000-0x0000000140304000-memory.dmp

Filesize
3.3MB

Download
memory/1960-106-0x0000000002160000-0x00000000024B4000-memory.dmp

Filesize
3.3MB

Download
memory/1960-85-0x000000013F9A0000-0x000000013FCF4000-memory.dmp

Filesize
3.3MB

Download
memory/1960-90-0x0000000002160000-0x00000000024B4000-memory.dmp

Filesize
3.3MB

Download
memory/1960-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/1960-49-0x0000000002160000-0x00000000024B4000-memory.dmp

Filesize
3.3MB

Download
memory/1960-36-0x000000013FA50000-0x000000013FDA4000-memory.dmp

Filesize
3.3MB

Download
memory/1960-69-0x000000013F800000-0x000000013FB54000-memory.dmp

Filesize
3.3MB

Download
memory/1960-0-0x000000013FF70000-0x00000001402C4000-memory.dmp

Filesize
3.3MB

Download
memory/1960-105-0x000000013F110000-0x000000013F464000-memory.dmp

Filesize
3.3MB

Download
memory/1960-104-0x000000013F9E0000-0x000000013FD34000-memory.dmp

Filesize
3.3MB

Download
memory/1960-454-0x0000000002160000-0x00000000024B4000-memory.dmp

Filesize
3.3MB

Download
memory/1960-26-0x000000013F0E0000-0x000000013F434000-memory.dmp

Filesize
3.3MB

Download
memory/1960-100-0x0000000002160000-0x00000000024B4000-memory.dmp

Filesize
3.3MB

Download
memory/1960-57-0x0000000002160000-0x00000000024B4000-memory.dmp

Filesize
3.3MB

Download
memory/1960-901-0x000000013F9A0000-0x000000013FCF4000-memory.dmp

Filesize
3.3MB

Download
memory/1960-902-0x0000000002160000-0x00000000024B4000-memory.dmp

Filesize
3.3MB

Download
memory/1960-903-0x0000000002160000-0x00000000024B4000-memory.dmp

Filesize
3.3MB

Download
memory/1960-32-0x0000000002160000-0x00000000024B4000-memory.dmp

Filesize
3.3MB

Download
memory/1960-63-0x000000013FF70000-0x00000001402C4000-memory.dmp

Filesize
3.3MB

Download
memory/1960-62-0x0000000002160000-0x00000000024B4000-memory.dmp

Filesize
3.3MB

Download
memory/1960-1167-0x0000000002160000-0x00000000024B4000-memory.dmp

Filesize
3.3MB

Download
memory/1960-33-0x000000013F080000-0x000000013F3D4000-memory.dmp

Filesize
3.3MB

Download
memory/1960-35-0x000000013F390000-0x000000013F6E4000-memory.dmp

Filesize
3.3MB

Download
memory/2128-18-0x000000013F800000-0x000000013FB54000-memory.dmp

Filesize
3.3MB

Download
memory/2128-4016-0x000000013F800000-0x000000013FB54000-memory.dmp

Filesize
3.3MB

Download
memory/2176-43-0x000000013FA50000-0x000000013FDA4000-memory.dmp

Filesize
3.3MB

Download
memory/2176-4022-0x000000013FA50000-0x000000013FDA4000-memory.dmp

Filesize
3.3MB

Download
memory/2432-37-0x000000013F390000-0x000000013F6E4000-memory.dmp

Filesize
3.3MB

Download
memory/2432-4021-0x000000013F390000-0x000000013F6E4000-memory.dmp

Filesize
3.3MB

Download
memory/2572-70-0x000000013FE20000-0x0000000140174000-memory.dmp

Filesize
3.3MB

Download
memory/2572-4026-0x000000013FE20000-0x0000000140174000-memory.dmp

Filesize
3.3MB

Download
memory/2604-4020-0x000000013FD60000-0x00000001400B4000-memory.dmp

Filesize
3.3MB

Download
memory/2604-71-0x000000013FD60000-0x00000001400B4000-memory.dmp

Filesize
3.3MB

Download
memory/2608-4019-0x000000013FC60000-0x000000013FFB4000-memory.dmp

Filesize
3.3MB

Download
memory/2608-53-0x000000013FC60000-0x000000013FFB4000-memory.dmp

Filesize
3.3MB

Download
memory/2672-4024-0x000000013F5A0000-0x000000013F8F4000-memory.dmp

Filesize
3.3MB

Download
memory/2672-455-0x000000013F5A0000-0x000000013F8F4000-memory.dmp

Filesize
3.3MB

Download
memory/2672-64-0x000000013F5A0000-0x000000013F8F4000-memory.dmp

Filesize
3.3MB

Download
memory/2756-20-0x000000013FC60000-0x000000013FFB4000-memory.dmp

Filesize
3.3MB

Download
memory/2756-4018-0x000000013FC60000-0x000000013FFB4000-memory.dmp

Filesize
3.3MB

Download
memory/2792-4017-0x000000013F0E0000-0x000000013F434000-memory.dmp

Filesize
3.3MB

Download
memory/2792-30-0x000000013F0E0000-0x000000013F434000-memory.dmp

Filesize
3.3MB

Download
memory/2844-42-0x000000013F080000-0x000000013F3D4000-memory.dmp

Filesize
3.3MB

Download
memory/2844-4023-0x000000013F080000-0x000000013F3D4000-memory.dmp

Filesize
3.3MB

Download
memory/2956-89-0x000000013F9A0000-0x000000013FCF4000-memory.dmp

Filesize
3.3MB

Download
memory/2956-4025-0x000000013F9A0000-0x000000013FCF4000-memory.dmp

Filesize
3.3MB

Download
memory/3012-1168-0x000000013FEC0000-0x0000000140214000-memory.dmp

Filesize
3.3MB

Download
memory/3012-4027-0x000000013FEC0000-0x0000000140214000-memory.dmp

Filesize
3.3MB

Download
memory/3012-110-0x000000013FEC0000-0x0000000140214000-memory.dmp

Filesize
3.3MB

Download