xmrig | 404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
Size

5.5MB
MD5

0ef8358081a87944772a4835fe53797e
SHA1

ab8cd1ac709b094d11987d70d408c3d6719a736a
SHA256

404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2
SHA512

d400e00fcdf84850c89f6effec6118265826de5918f58b54e7beaae9822fdfcb24d235791ced7e052537530c3439901c6f3c493d15bae54bbc9ece4003f184dd
SSDEEP

98304:EniLf9FdfE0pZB156utgpPFotBER/mQ32W:eOl56utgpPF8u/H

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2112-0-0x000000013FEB0000-0x0000000140204000-memory.dmp	xmrig
behavioral1/files/0x0009000000012117-6.dat	xmrig
behavioral1/memory/2920-9-0x000000013F560000-0x000000013F8B4000-memory.dmp	xmrig
behavioral1/files/0x000700000001878c-10.dat	xmrig
behavioral1/memory/1856-15-0x000000013F360000-0x000000013F6B4000-memory.dmp	xmrig
behavioral1/files/0x000700000001922c-27.dat	xmrig
behavioral1/memory/2112-30-0x000000013F2C0000-0x000000013F614000-memory.dmp	xmrig
behavioral1/memory/1264-28-0x000000013F2C0000-0x000000013F614000-memory.dmp	xmrig
behavioral1/memory/2128-26-0x000000013F260000-0x000000013F5B4000-memory.dmp	xmrig
behavioral1/files/0x0008000000018bf3-19.dat	xmrig
behavioral1/files/0x0006000000019261-34.dat	xmrig
behavioral1/memory/2952-36-0x000000013F1D0000-0x000000013F524000-memory.dmp	xmrig
behavioral1/memory/2112-41-0x000000013FEB0000-0x0000000140204000-memory.dmp	xmrig
behavioral1/files/0x000600000001926a-39.dat	xmrig
behavioral1/files/0x0006000000019279-46.dat	xmrig
behavioral1/files/0x0007000000018731-47.dat	xmrig
behavioral1/files/0x0005000000019506-64.dat	xmrig
behavioral1/files/0x00050000000194fc-59.dat	xmrig
behavioral1/memory/2780-73-0x000000013FE30000-0x0000000140184000-memory.dmp	xmrig
behavioral1/memory/2516-75-0x000000013FE20000-0x0000000140174000-memory.dmp	xmrig
behavioral1/files/0x00050000000195a7-86.dat	xmrig
behavioral1/memory/2112-85-0x000000013F730000-0x000000013FA84000-memory.dmp	xmrig
behavioral1/files/0x00050000000195e6-89.dat	xmrig
behavioral1/memory/2128-104-0x000000013F260000-0x000000013F5B4000-memory.dmp	xmrig
behavioral1/memory/3028-105-0x000000013FDE0000-0x0000000140134000-memory.dmp	xmrig
behavioral1/memory/2932-102-0x000000013FAB0000-0x000000013FE04000-memory.dmp	xmrig
behavioral1/files/0x000500000001957e-98.dat	xmrig
behavioral1/memory/1856-97-0x000000013F360000-0x000000013F6B4000-memory.dmp	xmrig
behavioral1/files/0x000500000001952f-96.dat	xmrig
behavioral1/memory/680-95-0x000000013F150000-0x000000013F4A4000-memory.dmp	xmrig
behavioral1/memory/2648-82-0x000000013FD70000-0x00000001400C4000-memory.dmp	xmrig
behavioral1/memory/2112-76-0x000000013F7D0000-0x000000013FB24000-memory.dmp	xmrig
behavioral1/memory/2668-80-0x000000013F7D0000-0x000000013FB24000-memory.dmp	xmrig
behavioral1/memory/2112-72-0x0000000002300000-0x0000000002654000-memory.dmp	xmrig
behavioral1/memory/2660-71-0x000000013F220000-0x000000013F574000-memory.dmp	xmrig
behavioral1/memory/1264-106-0x000000013F2C0000-0x000000013F614000-memory.dmp	xmrig
behavioral1/memory/2708-69-0x000000013F730000-0x000000013FA84000-memory.dmp	xmrig
behavioral1/files/0x00080000000192a9-54.dat	xmrig
behavioral1/files/0x000500000001961f-111.dat	xmrig
behavioral1/files/0x0005000000019627-138.dat	xmrig
behavioral1/files/0x000500000001962b-146.dat	xmrig
behavioral1/files/0x0005000000019629-141.dat	xmrig
behavioral1/files/0x0005000000019625-135.dat	xmrig
behavioral1/files/0x0005000000019622-124.dat	xmrig
behavioral1/files/0x0005000000019623-129.dat	xmrig
behavioral1/files/0x0005000000019621-119.dat	xmrig
behavioral1/files/0x000500000001961d-110.dat	xmrig
behavioral1/files/0x000500000001967f-154.dat	xmrig
behavioral1/files/0x000500000001963b-160.dat	xmrig
behavioral1/files/0x00050000000196c0-170.dat	xmrig
behavioral1/files/0x000500000001970b-166.dat	xmrig
behavioral1/files/0x00050000000199b9-164.dat	xmrig
behavioral1/files/0x0005000000019c56-178.dat	xmrig
behavioral1/files/0x0005000000019c58-187.dat	xmrig
behavioral1/files/0x0005000000019c54-186.dat	xmrig
behavioral1/files/0x0005000000019c73-184.dat	xmrig
behavioral1/memory/2920-3974-0x000000013F560000-0x000000013F8B4000-memory.dmp	xmrig
behavioral1/memory/1856-3975-0x000000013F360000-0x000000013F6B4000-memory.dmp	xmrig
behavioral1/memory/2128-3976-0x000000013F260000-0x000000013F5B4000-memory.dmp	xmrig
behavioral1/memory/1264-3977-0x000000013F2C0000-0x000000013F614000-memory.dmp	xmrig
behavioral1/memory/2952-3978-0x000000013F1D0000-0x000000013F524000-memory.dmp	xmrig
behavioral1/memory/2648-3979-0x000000013FD70000-0x00000001400C4000-memory.dmp	xmrig
behavioral1/memory/2660-3980-0x000000013F220000-0x000000013F574000-memory.dmp	xmrig
behavioral1/memory/2780-3981-0x000000013FE30000-0x0000000140184000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2920	IYZUrqO.exe
1856	zCAswmF.exe
2128	hposNjF.exe
1264	mSgZrKp.exe
2952	CitnGeK.exe
2648	vqZjyuh.exe
2708	dLeBTnn.exe
2660	RkMZhcd.exe
2780	bKdDUuE.exe
2516	zqDuLLF.exe
2668	AvWWvqu.exe
680	xaxduWq.exe
2932	fRUkCcW.exe
3028	tMTentv.exe
1096	azPXJCD.exe
1928	nESqEbZ.exe
1956	rsNxcYU.exe
1924	WsyRePL.exe
2300	ekWiOwR.exe
1432	AhcQXlz.exe
1708	tOVAKBE.exe
1892	JbvSxvK.exe
1632	mLRiSft.exe
1036	eYySTJo.exe
2816	eHBrnNF.exe
2812	UCIlrXz.exe
2568	ltFXCmu.exe
2928	OVGyplG.exe
2716	iIqVGMg.exe
2044	pPEPOoB.exe
2604	TIUVvjZ.exe
1908	UuSLzFq.exe
1672	sgJIBrr.exe
2232	pPnvJVH.exe
2176	HQTfkhJ.exe
1304	OZmRtvI.exe
2236	IIzAIuf.exe
2216	RkivRiU.exe
660	hPaEgIX.exe
876	hAHReLJ.exe
936	LNAIgaB.exe
2828	WKEUwIp.exe
3052	RWiQqcD.exe
2184	RuCBsnS.exe
2068	JEwOwDp.exe
2308	tUUDVpY.exe
992	gfLOjSw.exe
2384	FGJnCat.exe
756	wkumPes.exe
2980	HSmdtbo.exe
3000	dnRguXj.exe
2744	xGvWNPO.exe
3048	QEpzpRw.exe
684	aoydiar.exe
1136	tyRcxzy.exe
896	BhsgZxU.exe
764	lrDVdsL.exe
1516	TiTpLih.exe
2124	BDDfrTi.exe
1976	oCCNYRz.exe
2808	SbpxkTp.exe
1188	vQiPQEt.exe
1868	zLsmznL.exe
2088	EazTXTe.exe

Loads dropped DLL 64 IoCs

pid	Process
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2112-0-0x000000013FEB0000-0x0000000140204000-memory.dmp	upx
behavioral1/files/0x0009000000012117-6.dat	upx
behavioral1/memory/2920-9-0x000000013F560000-0x000000013F8B4000-memory.dmp	upx
behavioral1/files/0x000700000001878c-10.dat	upx
behavioral1/memory/1856-15-0x000000013F360000-0x000000013F6B4000-memory.dmp	upx
behavioral1/files/0x000700000001922c-27.dat	upx
behavioral1/memory/1264-28-0x000000013F2C0000-0x000000013F614000-memory.dmp	upx
behavioral1/memory/2128-26-0x000000013F260000-0x000000013F5B4000-memory.dmp	upx
behavioral1/files/0x0008000000018bf3-19.dat	upx
behavioral1/files/0x0006000000019261-34.dat	upx
behavioral1/memory/2952-36-0x000000013F1D0000-0x000000013F524000-memory.dmp	upx
behavioral1/memory/2112-41-0x000000013FEB0000-0x0000000140204000-memory.dmp	upx
behavioral1/files/0x000600000001926a-39.dat	upx
behavioral1/files/0x0006000000019279-46.dat	upx
behavioral1/files/0x0007000000018731-47.dat	upx
behavioral1/files/0x0005000000019506-64.dat	upx
behavioral1/files/0x00050000000194fc-59.dat	upx
behavioral1/memory/2780-73-0x000000013FE30000-0x0000000140184000-memory.dmp	upx
behavioral1/memory/2516-75-0x000000013FE20000-0x0000000140174000-memory.dmp	upx
behavioral1/files/0x00050000000195a7-86.dat	upx
behavioral1/files/0x00050000000195e6-89.dat	upx
behavioral1/memory/2128-104-0x000000013F260000-0x000000013F5B4000-memory.dmp	upx
behavioral1/memory/3028-105-0x000000013FDE0000-0x0000000140134000-memory.dmp	upx
behavioral1/memory/2932-102-0x000000013FAB0000-0x000000013FE04000-memory.dmp	upx
behavioral1/files/0x000500000001957e-98.dat	upx
behavioral1/memory/1856-97-0x000000013F360000-0x000000013F6B4000-memory.dmp	upx
behavioral1/files/0x000500000001952f-96.dat	upx
behavioral1/memory/680-95-0x000000013F150000-0x000000013F4A4000-memory.dmp	upx
behavioral1/memory/2648-82-0x000000013FD70000-0x00000001400C4000-memory.dmp	upx
behavioral1/memory/2668-80-0x000000013F7D0000-0x000000013FB24000-memory.dmp	upx
behavioral1/memory/2660-71-0x000000013F220000-0x000000013F574000-memory.dmp	upx
behavioral1/memory/1264-106-0x000000013F2C0000-0x000000013F614000-memory.dmp	upx
behavioral1/memory/2708-69-0x000000013F730000-0x000000013FA84000-memory.dmp	upx
behavioral1/files/0x00080000000192a9-54.dat	upx
behavioral1/files/0x000500000001961f-111.dat	upx
behavioral1/files/0x0005000000019627-138.dat	upx
behavioral1/files/0x000500000001962b-146.dat	upx
behavioral1/files/0x0005000000019629-141.dat	upx
behavioral1/files/0x0005000000019625-135.dat	upx
behavioral1/files/0x0005000000019622-124.dat	upx
behavioral1/files/0x0005000000019623-129.dat	upx
behavioral1/files/0x0005000000019621-119.dat	upx
behavioral1/files/0x000500000001961d-110.dat	upx
behavioral1/files/0x000500000001967f-154.dat	upx
behavioral1/files/0x000500000001963b-160.dat	upx
behavioral1/files/0x00050000000196c0-170.dat	upx
behavioral1/files/0x000500000001970b-166.dat	upx
behavioral1/files/0x00050000000199b9-164.dat	upx
behavioral1/files/0x0005000000019c56-178.dat	upx
behavioral1/files/0x0005000000019c58-187.dat	upx
behavioral1/files/0x0005000000019c54-186.dat	upx
behavioral1/files/0x0005000000019c73-184.dat	upx
behavioral1/memory/2920-3974-0x000000013F560000-0x000000013F8B4000-memory.dmp	upx
behavioral1/memory/1856-3975-0x000000013F360000-0x000000013F6B4000-memory.dmp	upx
behavioral1/memory/2128-3976-0x000000013F260000-0x000000013F5B4000-memory.dmp	upx
behavioral1/memory/1264-3977-0x000000013F2C0000-0x000000013F614000-memory.dmp	upx
behavioral1/memory/2952-3978-0x000000013F1D0000-0x000000013F524000-memory.dmp	upx
behavioral1/memory/2648-3979-0x000000013FD70000-0x00000001400C4000-memory.dmp	upx
behavioral1/memory/2660-3980-0x000000013F220000-0x000000013F574000-memory.dmp	upx
behavioral1/memory/2780-3981-0x000000013FE30000-0x0000000140184000-memory.dmp	upx
behavioral1/memory/2668-3983-0x000000013F7D0000-0x000000013FB24000-memory.dmp	upx
behavioral1/memory/2516-3982-0x000000013FE20000-0x0000000140174000-memory.dmp	upx
behavioral1/memory/2708-3984-0x000000013F730000-0x000000013FA84000-memory.dmp	upx
behavioral1/memory/680-3985-0x000000013F150000-0x000000013F4A4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EoTWAKx.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\DbyBPTG.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\iefSxHj.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\JuzDIHi.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\hAHReLJ.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\GeZhyvg.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\cqKvSbB.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\URXZPnI.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\EzqcmgX.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\UNBRYiX.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\NbqmknX.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\uVcudVl.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\qXYcait.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\nHMrbSy.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\fwUnpNe.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\vMyFVzS.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\SueMKiR.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\ieVxlCQ.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\XrnIhtG.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\WKpKHKp.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\fgxFSnc.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\eThTsqt.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\jxwozcJ.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\QWILVll.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\pMoVKuJ.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\WoRtojd.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\rpUVliD.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\vvtAVTB.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\ttWhlWd.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\VLPXKUT.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\eaMCrDm.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\tUUDVpY.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\kgkvKUR.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\ucjucTF.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\FTraxWG.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\SslzqXx.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\ffGpvxk.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\YKdNlKA.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\EHCBprM.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\EOKDLog.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\mLRiSft.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\fLiTEtP.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\sdlJAgl.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\rAIQAhR.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\ApETBbv.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\NNBvoml.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\hecdmAk.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\ZrvTDjl.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\PXJBIUJ.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\npRmsRM.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\JVnZRhu.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\UNpPTxe.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\JSmUHXK.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\RKfoXqw.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\OWgsIjO.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\TuIztiA.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\KEzuRqg.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\pPEPOoB.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\fxDxUdZ.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\XuefmkY.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\BulXnxr.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\nvjEXzw.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\EApCnfe.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
File created	C:\Windows\System\qflbQfs.exe	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2920	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	31
PID 2112 wrote to memory of 2920	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	31
PID 2112 wrote to memory of 2920	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	31
PID 2112 wrote to memory of 1856	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	32
PID 2112 wrote to memory of 1856	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	32
PID 2112 wrote to memory of 1856	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	32
PID 2112 wrote to memory of 2128	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	33
PID 2112 wrote to memory of 2128	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	33
PID 2112 wrote to memory of 2128	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	33
PID 2112 wrote to memory of 1264	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	34
PID 2112 wrote to memory of 1264	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	34
PID 2112 wrote to memory of 1264	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	34
PID 2112 wrote to memory of 2952	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	35
PID 2112 wrote to memory of 2952	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	35
PID 2112 wrote to memory of 2952	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	35
PID 2112 wrote to memory of 2648	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	36
PID 2112 wrote to memory of 2648	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	36
PID 2112 wrote to memory of 2648	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	36
PID 2112 wrote to memory of 2708	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	37
PID 2112 wrote to memory of 2708	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	37
PID 2112 wrote to memory of 2708	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	37
PID 2112 wrote to memory of 2660	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	38
PID 2112 wrote to memory of 2660	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	38
PID 2112 wrote to memory of 2660	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	38
PID 2112 wrote to memory of 2780	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	39
PID 2112 wrote to memory of 2780	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	39
PID 2112 wrote to memory of 2780	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	39
PID 2112 wrote to memory of 2516	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	40
PID 2112 wrote to memory of 2516	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	40
PID 2112 wrote to memory of 2516	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	40
PID 2112 wrote to memory of 2668	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	41
PID 2112 wrote to memory of 2668	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	41
PID 2112 wrote to memory of 2668	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	41
PID 2112 wrote to memory of 2932	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	42
PID 2112 wrote to memory of 2932	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	42
PID 2112 wrote to memory of 2932	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	42
PID 2112 wrote to memory of 3028	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	43
PID 2112 wrote to memory of 3028	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	43
PID 2112 wrote to memory of 3028	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	43
PID 2112 wrote to memory of 680	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	44
PID 2112 wrote to memory of 680	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	44
PID 2112 wrote to memory of 680	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	44
PID 2112 wrote to memory of 1096	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	45
PID 2112 wrote to memory of 1096	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	45
PID 2112 wrote to memory of 1096	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	45
PID 2112 wrote to memory of 1928	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	46
PID 2112 wrote to memory of 1928	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	46
PID 2112 wrote to memory of 1928	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	46
PID 2112 wrote to memory of 1956	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	47
PID 2112 wrote to memory of 1956	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	47
PID 2112 wrote to memory of 1956	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	47
PID 2112 wrote to memory of 1924	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	48
PID 2112 wrote to memory of 1924	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	48
PID 2112 wrote to memory of 1924	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	48
PID 2112 wrote to memory of 2300	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	49
PID 2112 wrote to memory of 2300	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	49
PID 2112 wrote to memory of 2300	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	49
PID 2112 wrote to memory of 1432	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	50
PID 2112 wrote to memory of 1432	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	50
PID 2112 wrote to memory of 1432	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	50
PID 2112 wrote to memory of 1708	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	51
PID 2112 wrote to memory of 1708	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	51
PID 2112 wrote to memory of 1708	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	51
PID 2112 wrote to memory of 1892	2112	JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe	52

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_404f56c0db08065bb48ac36346f5b29310327406f85e882221d467328d8ca3e2.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\System\IYZUrqO.exe
  C:\Windows\System\IYZUrqO.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\zCAswmF.exe
  C:\Windows\System\zCAswmF.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\hposNjF.exe
  C:\Windows\System\hposNjF.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\mSgZrKp.exe
  C:\Windows\System\mSgZrKp.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\CitnGeK.exe
  C:\Windows\System\CitnGeK.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\vqZjyuh.exe
  C:\Windows\System\vqZjyuh.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\dLeBTnn.exe
  C:\Windows\System\dLeBTnn.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\RkMZhcd.exe
  C:\Windows\System\RkMZhcd.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\bKdDUuE.exe
  C:\Windows\System\bKdDUuE.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\zqDuLLF.exe
  C:\Windows\System\zqDuLLF.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\AvWWvqu.exe
  C:\Windows\System\AvWWvqu.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\fRUkCcW.exe
  C:\Windows\System\fRUkCcW.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\tMTentv.exe
  C:\Windows\System\tMTentv.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\xaxduWq.exe
  C:\Windows\System\xaxduWq.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\azPXJCD.exe
  C:\Windows\System\azPXJCD.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\nESqEbZ.exe
  C:\Windows\System\nESqEbZ.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\rsNxcYU.exe
  C:\Windows\System\rsNxcYU.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\WsyRePL.exe
  C:\Windows\System\WsyRePL.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\ekWiOwR.exe
  C:\Windows\System\ekWiOwR.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\AhcQXlz.exe
  C:\Windows\System\AhcQXlz.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\tOVAKBE.exe
  C:\Windows\System\tOVAKBE.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\JbvSxvK.exe
  C:\Windows\System\JbvSxvK.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\eYySTJo.exe
  C:\Windows\System\eYySTJo.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\mLRiSft.exe
  C:\Windows\System\mLRiSft.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\eHBrnNF.exe
  C:\Windows\System\eHBrnNF.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\UCIlrXz.exe
  C:\Windows\System\UCIlrXz.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\OVGyplG.exe
  C:\Windows\System\OVGyplG.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\ltFXCmu.exe
  C:\Windows\System\ltFXCmu.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\TIUVvjZ.exe
  C:\Windows\System\TIUVvjZ.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\iIqVGMg.exe
  C:\Windows\System\iIqVGMg.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\pPnvJVH.exe
  C:\Windows\System\pPnvJVH.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\pPEPOoB.exe
  C:\Windows\System\pPEPOoB.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\HQTfkhJ.exe
  C:\Windows\System\HQTfkhJ.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\UuSLzFq.exe
  C:\Windows\System\UuSLzFq.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\OZmRtvI.exe
  C:\Windows\System\OZmRtvI.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\sgJIBrr.exe
  C:\Windows\System\sgJIBrr.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\IIzAIuf.exe
  C:\Windows\System\IIzAIuf.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\RkivRiU.exe
  C:\Windows\System\RkivRiU.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\hPaEgIX.exe
  C:\Windows\System\hPaEgIX.exe
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\System\hAHReLJ.exe
  C:\Windows\System\hAHReLJ.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\LNAIgaB.exe
  C:\Windows\System\LNAIgaB.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\WKEUwIp.exe
  C:\Windows\System\WKEUwIp.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\RWiQqcD.exe
  C:\Windows\System\RWiQqcD.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\RuCBsnS.exe
  C:\Windows\System\RuCBsnS.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\QEpzpRw.exe
  C:\Windows\System\QEpzpRw.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\JEwOwDp.exe
  C:\Windows\System\JEwOwDp.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\aoydiar.exe
  C:\Windows\System\aoydiar.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\tUUDVpY.exe
  C:\Windows\System\tUUDVpY.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\tyRcxzy.exe
  C:\Windows\System\tyRcxzy.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\gfLOjSw.exe
  C:\Windows\System\gfLOjSw.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\BhsgZxU.exe
  C:\Windows\System\BhsgZxU.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\FGJnCat.exe
  C:\Windows\System\FGJnCat.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\lrDVdsL.exe
  C:\Windows\System\lrDVdsL.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\wkumPes.exe
  C:\Windows\System\wkumPes.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\TiTpLih.exe
  C:\Windows\System\TiTpLih.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\HSmdtbo.exe
  C:\Windows\System\HSmdtbo.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\BDDfrTi.exe
  C:\Windows\System\BDDfrTi.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\dnRguXj.exe
  C:\Windows\System\dnRguXj.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\oCCNYRz.exe
  C:\Windows\System\oCCNYRz.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\xGvWNPO.exe
  C:\Windows\System\xGvWNPO.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\SbpxkTp.exe
  C:\Windows\System\SbpxkTp.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\vQiPQEt.exe
  C:\Windows\System\vQiPQEt.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\zLsmznL.exe
  C:\Windows\System\zLsmznL.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\EazTXTe.exe
  C:\Windows\System\EazTXTe.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\gxbACcK.exe
  C:\Windows\System\gxbACcK.exe
  2⤵
  PID:1652
- C:\Windows\System\jMMcBlj.exe
  C:\Windows\System\jMMcBlj.exe
  2⤵
  PID:1840
- C:\Windows\System\tNyevxy.exe
  C:\Windows\System\tNyevxy.exe
  2⤵
  PID:1732
- C:\Windows\System\QeOHMeL.exe
  C:\Windows\System\QeOHMeL.exe
  2⤵
  PID:1680
- C:\Windows\System\wVbwUKD.exe
  C:\Windows\System\wVbwUKD.exe
  2⤵
  PID:1244
- C:\Windows\System\YoMoNyi.exe
  C:\Windows\System\YoMoNyi.exe
  2⤵
  PID:1828
- C:\Windows\System\tKrvRAM.exe
  C:\Windows\System\tKrvRAM.exe
  2⤵
  PID:2548
- C:\Windows\System\ZdGaivm.exe
  C:\Windows\System\ZdGaivm.exe
  2⤵
  PID:2596
- C:\Windows\System\mvRsaCe.exe
  C:\Windows\System\mvRsaCe.exe
  2⤵
  PID:1436
- C:\Windows\System\latKAgO.exe
  C:\Windows\System\latKAgO.exe
  2⤵
  PID:2972
- C:\Windows\System\jkMMDys.exe
  C:\Windows\System\jkMMDys.exe
  2⤵
  PID:2628
- C:\Windows\System\blKyzdo.exe
  C:\Windows\System\blKyzdo.exe
  2⤵
  PID:2560
- C:\Windows\System\JTVShDU.exe
  C:\Windows\System\JTVShDU.exe
  2⤵
  PID:920
- C:\Windows\System\ILWBRnt.exe
  C:\Windows\System\ILWBRnt.exe
  2⤵
  PID:2164
- C:\Windows\System\EodPkCV.exe
  C:\Windows\System\EodPkCV.exe
  2⤵
  PID:1852
- C:\Windows\System\OcaENGk.exe
  C:\Windows\System\OcaENGk.exe
  2⤵
  PID:408
- C:\Windows\System\qyKyyek.exe
  C:\Windows\System\qyKyyek.exe
  2⤵
  PID:1176
- C:\Windows\System\VaaxFgK.exe
  C:\Windows\System\VaaxFgK.exe
  2⤵
  PID:1444
- C:\Windows\System\LyWPtmt.exe
  C:\Windows\System\LyWPtmt.exe
  2⤵
  PID:1644
- C:\Windows\System\qtXdFvr.exe
  C:\Windows\System\qtXdFvr.exe
  2⤵
  PID:1460
- C:\Windows\System\QkqRKPZ.exe
  C:\Windows\System\QkqRKPZ.exe
  2⤵
  PID:832
- C:\Windows\System\zjapKzH.exe
  C:\Windows\System\zjapKzH.exe
  2⤵
  PID:236
- C:\Windows\System\eCjeybP.exe
  C:\Windows\System\eCjeybP.exe
  2⤵
  PID:1600
- C:\Windows\System\NkjjWca.exe
  C:\Windows\System\NkjjWca.exe
  2⤵
  PID:2600
- C:\Windows\System\hWKaojB.exe
  C:\Windows\System\hWKaojB.exe
  2⤵
  PID:2208
- C:\Windows\System\Kvfyngl.exe
  C:\Windows\System\Kvfyngl.exe
  2⤵
  PID:2268
- C:\Windows\System\djRRWxt.exe
  C:\Windows\System\djRRWxt.exe
  2⤵
  PID:2988
- C:\Windows\System\kgkvKUR.exe
  C:\Windows\System\kgkvKUR.exe
  2⤵
  PID:2196
- C:\Windows\System\aHOCNXr.exe
  C:\Windows\System\aHOCNXr.exe
  2⤵
  PID:2624
- C:\Windows\System\EYLAFSM.exe
  C:\Windows\System\EYLAFSM.exe
  2⤵
  PID:3032
- C:\Windows\System\GPgRLpW.exe
  C:\Windows\System\GPgRLpW.exe
  2⤵
  PID:1440
- C:\Windows\System\FCEJetY.exe
  C:\Windows\System\FCEJetY.exe
  2⤵
  PID:2620
- C:\Windows\System\FSpRfGm.exe
  C:\Windows\System\FSpRfGm.exe
  2⤵
  PID:1640
- C:\Windows\System\ImYFwqv.exe
  C:\Windows\System\ImYFwqv.exe
  2⤵
  PID:2168
- C:\Windows\System\xItHgoI.exe
  C:\Windows\System\xItHgoI.exe
  2⤵
  PID:2632
- C:\Windows\System\BtUfltC.exe
  C:\Windows\System\BtUfltC.exe
  2⤵
  PID:2260
- C:\Windows\System\IHdDAfS.exe
  C:\Windows\System\IHdDAfS.exe
  2⤵
  PID:2400
- C:\Windows\System\EDChWkr.exe
  C:\Windows\System\EDChWkr.exe
  2⤵
  PID:864
- C:\Windows\System\GxOJIhM.exe
  C:\Windows\System\GxOJIhM.exe
  2⤵
  PID:1548
- C:\Windows\System\pbHRMhY.exe
  C:\Windows\System\pbHRMhY.exe
  2⤵
  PID:1888
- C:\Windows\System\MRHQmSf.exe
  C:\Windows\System\MRHQmSf.exe
  2⤵
  PID:2704
- C:\Windows\System\WmyVzTf.exe
  C:\Windows\System\WmyVzTf.exe
  2⤵
  PID:2416
- C:\Windows\System\SkgXhJa.exe
  C:\Windows\System\SkgXhJa.exe
  2⤵
  PID:380
- C:\Windows\System\hJnOeYA.exe
  C:\Windows\System\hJnOeYA.exe
  2⤵
  PID:2332
- C:\Windows\System\opkljKs.exe
  C:\Windows\System\opkljKs.exe
  2⤵
  PID:2528
- C:\Windows\System\JYAOhEw.exe
  C:\Windows\System\JYAOhEw.exe
  2⤵
  PID:2572
- C:\Windows\System\GvwfUMc.exe
  C:\Windows\System\GvwfUMc.exe
  2⤵
  PID:2872
- C:\Windows\System\FJgelGV.exe
  C:\Windows\System\FJgelGV.exe
  2⤵
  PID:448
- C:\Windows\System\RJjbOLv.exe
  C:\Windows\System\RJjbOLv.exe
  2⤵
  PID:1204
- C:\Windows\System\KPVSTad.exe
  C:\Windows\System\KPVSTad.exe
  2⤵
  PID:2244
- C:\Windows\System\VhpIZnb.exe
  C:\Windows\System\VhpIZnb.exe
  2⤵
  PID:320
- C:\Windows\System\SqKKDWq.exe
  C:\Windows\System\SqKKDWq.exe
  2⤵
  PID:2212
- C:\Windows\System\OlkGbjg.exe
  C:\Windows\System\OlkGbjg.exe
  2⤵
  PID:2472
- C:\Windows\System\dwOrcEv.exe
  C:\Windows\System\dwOrcEv.exe
  2⤵
  PID:2996
- C:\Windows\System\bHrpjrE.exe
  C:\Windows\System\bHrpjrE.exe
  2⤵
  PID:2796
- C:\Windows\System\lJqRGro.exe
  C:\Windows\System\lJqRGro.exe
  2⤵
  PID:2792
- C:\Windows\System\xtOGygx.exe
  C:\Windows\System\xtOGygx.exe
  2⤵
  PID:2248
- C:\Windows\System\QEwCqJK.exe
  C:\Windows\System\QEwCqJK.exe
  2⤵
  PID:2012
- C:\Windows\System\pZFdyqb.exe
  C:\Windows\System\pZFdyqb.exe
  2⤵
  PID:1276
- C:\Windows\System\AzEaPVp.exe
  C:\Windows\System\AzEaPVp.exe
  2⤵
  PID:3024
- C:\Windows\System\BcIoaCx.exe
  C:\Windows\System\BcIoaCx.exe
  2⤵
  PID:2856
- C:\Windows\System\afaaQaB.exe
  C:\Windows\System\afaaQaB.exe
  2⤵
  PID:1636
- C:\Windows\System\KnuBktn.exe
  C:\Windows\System\KnuBktn.exe
  2⤵
  PID:1424
- C:\Windows\System\SFeVxtp.exe
  C:\Windows\System\SFeVxtp.exe
  2⤵
  PID:1712
- C:\Windows\System\UbuvYqd.exe
  C:\Windows\System\UbuvYqd.exe
  2⤵
  PID:2844
- C:\Windows\System\nKLmCBv.exe
  C:\Windows\System\nKLmCBv.exe
  2⤵
  PID:2616
- C:\Windows\System\cxvKuNV.exe
  C:\Windows\System\cxvKuNV.exe
  2⤵
  PID:3060
- C:\Windows\System\HgtfsKN.exe
  C:\Windows\System\HgtfsKN.exe
  2⤵
  PID:2520
- C:\Windows\System\kUVfuJm.exe
  C:\Windows\System\kUVfuJm.exe
  2⤵
  PID:996
- C:\Windows\System\BgWMSKD.exe
  C:\Windows\System\BgWMSKD.exe
  2⤵
  PID:1208
- C:\Windows\System\WEqDzIu.exe
  C:\Windows\System\WEqDzIu.exe
  2⤵
  PID:576
- C:\Windows\System\NuQhlPc.exe
  C:\Windows\System\NuQhlPc.exe
  2⤵
  PID:1912
- C:\Windows\System\jWjDqiA.exe
  C:\Windows\System\jWjDqiA.exe
  2⤵
  PID:3076
- C:\Windows\System\aiDgVoZ.exe
  C:\Windows\System\aiDgVoZ.exe
  2⤵
  PID:3156
- C:\Windows\System\CuqIgoj.exe
  C:\Windows\System\CuqIgoj.exe
  2⤵
  PID:3172
- C:\Windows\System\XTJqSqR.exe
  C:\Windows\System\XTJqSqR.exe
  2⤵
  PID:3188
- C:\Windows\System\siCcIPL.exe
  C:\Windows\System\siCcIPL.exe
  2⤵
  PID:3204
- C:\Windows\System\UjBBrMf.exe
  C:\Windows\System\UjBBrMf.exe
  2⤵
  PID:3220
- C:\Windows\System\PgUuhez.exe
  C:\Windows\System\PgUuhez.exe
  2⤵
  PID:3236
- C:\Windows\System\jBmYPYR.exe
  C:\Windows\System\jBmYPYR.exe
  2⤵
  PID:3260
- C:\Windows\System\wSNbvVX.exe
  C:\Windows\System\wSNbvVX.exe
  2⤵
  PID:3276
- C:\Windows\System\zwRTlTW.exe
  C:\Windows\System\zwRTlTW.exe
  2⤵
  PID:3292
- C:\Windows\System\eBZapbK.exe
  C:\Windows\System\eBZapbK.exe
  2⤵
  PID:3308
- C:\Windows\System\eOYChFv.exe
  C:\Windows\System\eOYChFv.exe
  2⤵
  PID:3324
- C:\Windows\System\GyfMmbE.exe
  C:\Windows\System\GyfMmbE.exe
  2⤵
  PID:3340
- C:\Windows\System\TsGjdzM.exe
  C:\Windows\System\TsGjdzM.exe
  2⤵
  PID:3356
- C:\Windows\System\SZSNjYR.exe
  C:\Windows\System\SZSNjYR.exe
  2⤵
  PID:3372
- C:\Windows\System\baUeskh.exe
  C:\Windows\System\baUeskh.exe
  2⤵
  PID:3388
- C:\Windows\System\BXwVYgA.exe
  C:\Windows\System\BXwVYgA.exe
  2⤵
  PID:3404
- C:\Windows\System\vMyFVzS.exe
  C:\Windows\System\vMyFVzS.exe
  2⤵
  PID:3420
- C:\Windows\System\PSomiqK.exe
  C:\Windows\System\PSomiqK.exe
  2⤵
  PID:3436
- C:\Windows\System\PkMzuCU.exe
  C:\Windows\System\PkMzuCU.exe
  2⤵
  PID:3544
- C:\Windows\System\IuDzfxS.exe
  C:\Windows\System\IuDzfxS.exe
  2⤵
  PID:3560
- C:\Windows\System\HeyPzov.exe
  C:\Windows\System\HeyPzov.exe
  2⤵
  PID:3576
- C:\Windows\System\XoqGHZb.exe
  C:\Windows\System\XoqGHZb.exe
  2⤵
  PID:3596
- C:\Windows\System\jiewCwJ.exe
  C:\Windows\System\jiewCwJ.exe
  2⤵
  PID:3640
- C:\Windows\System\UNBRYiX.exe
  C:\Windows\System\UNBRYiX.exe
  2⤵
  PID:3656
- C:\Windows\System\LyhOpqG.exe
  C:\Windows\System\LyhOpqG.exe
  2⤵
  PID:3672
- C:\Windows\System\rGBlfzy.exe
  C:\Windows\System\rGBlfzy.exe
  2⤵
  PID:3688
- C:\Windows\System\ngNFUfu.exe
  C:\Windows\System\ngNFUfu.exe
  2⤵
  PID:3712
- C:\Windows\System\RGfKIru.exe
  C:\Windows\System\RGfKIru.exe
  2⤵
  PID:3728
- C:\Windows\System\DxgfPjy.exe
  C:\Windows\System\DxgfPjy.exe
  2⤵
  PID:3760
- C:\Windows\System\PBUhihl.exe
  C:\Windows\System\PBUhihl.exe
  2⤵
  PID:3776
- C:\Windows\System\wqWeCVO.exe
  C:\Windows\System\wqWeCVO.exe
  2⤵
  PID:3796
- C:\Windows\System\sDnvkGF.exe
  C:\Windows\System\sDnvkGF.exe
  2⤵
  PID:3820
- C:\Windows\System\hCgzjjD.exe
  C:\Windows\System\hCgzjjD.exe
  2⤵
  PID:3836
- C:\Windows\System\WxpfsUi.exe
  C:\Windows\System\WxpfsUi.exe
  2⤵
  PID:3852
- C:\Windows\System\CmtqnGN.exe
  C:\Windows\System\CmtqnGN.exe
  2⤵
  PID:3880
- C:\Windows\System\SqvZvFB.exe
  C:\Windows\System\SqvZvFB.exe
  2⤵
  PID:3904
- C:\Windows\System\VvxGcJK.exe
  C:\Windows\System\VvxGcJK.exe
  2⤵
  PID:3920
- C:\Windows\System\EgQfJGj.exe
  C:\Windows\System\EgQfJGj.exe
  2⤵
  PID:3936
- C:\Windows\System\XRACVAP.exe
  C:\Windows\System\XRACVAP.exe
  2⤵
  PID:3956
- C:\Windows\System\nGrZqPM.exe
  C:\Windows\System\nGrZqPM.exe
  2⤵
  PID:3984
- C:\Windows\System\MXOisgI.exe
  C:\Windows\System\MXOisgI.exe
  2⤵
  PID:4012
- C:\Windows\System\kJnllaj.exe
  C:\Windows\System\kJnllaj.exe
  2⤵
  PID:4028
- C:\Windows\System\IpoMDSg.exe
  C:\Windows\System\IpoMDSg.exe
  2⤵
  PID:4044
- C:\Windows\System\ynxlVcE.exe
  C:\Windows\System\ynxlVcE.exe
  2⤵
  PID:4060
- C:\Windows\System\fjrGXHy.exe
  C:\Windows\System\fjrGXHy.exe
  2⤵
  PID:4088
- C:\Windows\System\chVXZlO.exe
  C:\Windows\System\chVXZlO.exe
  2⤵
  PID:1572
- C:\Windows\System\DdOuHKy.exe
  C:\Windows\System\DdOuHKy.exe
  2⤵
  PID:1408
- C:\Windows\System\luvMzxM.exe
  C:\Windows\System\luvMzxM.exe
  2⤵
  PID:2432
- C:\Windows\System\SRDeNhD.exe
  C:\Windows\System\SRDeNhD.exe
  2⤵
  PID:108
- C:\Windows\System\ATLmyJZ.exe
  C:\Windows\System\ATLmyJZ.exe
  2⤵
  PID:1784
- C:\Windows\System\MbbFPgv.exe
  C:\Windows\System\MbbFPgv.exe
  2⤵
  PID:900
- C:\Windows\System\exbAIQv.exe
  C:\Windows\System\exbAIQv.exe
  2⤵
  PID:908
- C:\Windows\System\NckAXgU.exe
  C:\Windows\System\NckAXgU.exe
  2⤵
  PID:3088
- C:\Windows\System\VJBHzIn.exe
  C:\Windows\System\VJBHzIn.exe
  2⤵
  PID:3112
- C:\Windows\System\mNpBgxr.exe
  C:\Windows\System\mNpBgxr.exe
  2⤵
  PID:3124
- C:\Windows\System\ucLctBQ.exe
  C:\Windows\System\ucLctBQ.exe
  2⤵
  PID:3140
- C:\Windows\System\IoKpHUE.exe
  C:\Windows\System\IoKpHUE.exe
  2⤵
  PID:3180
- C:\Windows\System\RGdfCju.exe
  C:\Windows\System\RGdfCju.exe
  2⤵
  PID:2764
- C:\Windows\System\vwjzyGy.exe
  C:\Windows\System\vwjzyGy.exe
  2⤵
  PID:2636
- C:\Windows\System\fLiTEtP.exe
  C:\Windows\System\fLiTEtP.exe
  2⤵
  PID:3248
- C:\Windows\System\zWAbyqA.exe
  C:\Windows\System\zWAbyqA.exe
  2⤵
  PID:3284
- C:\Windows\System\YXeaPFP.exe
  C:\Windows\System\YXeaPFP.exe
  2⤵
  PID:3348
- C:\Windows\System\vXNQXDV.exe
  C:\Windows\System\vXNQXDV.exe
  2⤵
  PID:3200
- C:\Windows\System\gnqmsCO.exe
  C:\Windows\System\gnqmsCO.exe
  2⤵
  PID:3516
- C:\Windows\System\eGRenRp.exe
  C:\Windows\System\eGRenRp.exe
  2⤵
  PID:3536
- C:\Windows\System\jzLwpxI.exe
  C:\Windows\System\jzLwpxI.exe
  2⤵
  PID:3336
- C:\Windows\System\NbqmknX.exe
  C:\Windows\System\NbqmknX.exe
  2⤵
  PID:3432
- C:\Windows\System\uBXybBz.exe
  C:\Windows\System\uBXybBz.exe
  2⤵
  PID:3604
- C:\Windows\System\YMRcQVF.exe
  C:\Windows\System\YMRcQVF.exe
  2⤵
  PID:3624
- C:\Windows\System\baJUZTJ.exe
  C:\Windows\System\baJUZTJ.exe
  2⤵
  PID:3636
- C:\Windows\System\GeZhyvg.exe
  C:\Windows\System\GeZhyvg.exe
  2⤵
  PID:3700
- C:\Windows\System\wodvGXa.exe
  C:\Windows\System\wodvGXa.exe
  2⤵
  PID:3736
- C:\Windows\System\ELoqCtM.exe
  C:\Windows\System\ELoqCtM.exe
  2⤵
  PID:3552
- C:\Windows\System\knMpyJl.exe
  C:\Windows\System\knMpyJl.exe
  2⤵
  PID:3680
- C:\Windows\System\iePBwje.exe
  C:\Windows\System\iePBwje.exe
  2⤵
  PID:3756
- C:\Windows\System\jQzvzts.exe
  C:\Windows\System\jQzvzts.exe
  2⤵
  PID:2252
- C:\Windows\System\CgIkUIw.exe
  C:\Windows\System\CgIkUIw.exe
  2⤵
  PID:3792
- C:\Windows\System\zvDDeKz.exe
  C:\Windows\System\zvDDeKz.exe
  2⤵
  PID:3864
- C:\Windows\System\AjuGKJO.exe
  C:\Windows\System\AjuGKJO.exe
  2⤵
  PID:3808
- C:\Windows\System\RLUKbZm.exe
  C:\Windows\System\RLUKbZm.exe
  2⤵
  PID:2264
- C:\Windows\System\PVJRzQs.exe
  C:\Windows\System\PVJRzQs.exe
  2⤵
  PID:3892
- C:\Windows\System\gZmbIOF.exe
  C:\Windows\System\gZmbIOF.exe
  2⤵
  PID:3928
- C:\Windows\System\ELNBXBi.exe
  C:\Windows\System\ELNBXBi.exe
  2⤵
  PID:4068
- C:\Windows\System\oZLyVqy.exe
  C:\Windows\System\oZLyVqy.exe
  2⤵
  PID:4084
- C:\Windows\System\jOvhwSi.exe
  C:\Windows\System\jOvhwSi.exe
  2⤵
  PID:1492
- C:\Windows\System\FTTSStJ.exe
  C:\Windows\System\FTTSStJ.exe
  2⤵
  PID:4056
- C:\Windows\System\JeZkPNP.exe
  C:\Windows\System\JeZkPNP.exe
  2⤵
  PID:3084
- C:\Windows\System\kLTJoXs.exe
  C:\Windows\System\kLTJoXs.exe
  2⤵
  PID:1740
- C:\Windows\System\QySrnvG.exe
  C:\Windows\System\QySrnvG.exe
  2⤵
  PID:3148
- C:\Windows\System\MlARTMV.exe
  C:\Windows\System\MlARTMV.exe
  2⤵
  PID:2392
- C:\Windows\System\JtzymVt.exe
  C:\Windows\System\JtzymVt.exe
  2⤵
  PID:3104
- C:\Windows\System\SJgaVVf.exe
  C:\Windows\System\SJgaVVf.exe
  2⤵
  PID:2788
- C:\Windows\System\TEfoelg.exe
  C:\Windows\System\TEfoelg.exe
  2⤵
  PID:3168
- C:\Windows\System\toDYUeG.exe
  C:\Windows\System\toDYUeG.exe
  2⤵
  PID:3212
- C:\Windows\System\VSxEVvZ.exe
  C:\Windows\System\VSxEVvZ.exe
  2⤵
  PID:1896
- C:\Windows\System\iDlqoKn.exe
  C:\Windows\System\iDlqoKn.exe
  2⤵
  PID:3448
- C:\Windows\System\OeOWvus.exe
  C:\Windows\System\OeOWvus.exe
  2⤵
  PID:3384
- C:\Windows\System\ALGUgOo.exe
  C:\Windows\System\ALGUgOo.exe
  2⤵
  PID:3500
- C:\Windows\System\XFZiiHi.exe
  C:\Windows\System\XFZiiHi.exe
  2⤵
  PID:3664
- C:\Windows\System\QYNSSWJ.exe
  C:\Windows\System\QYNSSWJ.exe
  2⤵
  PID:3720
- C:\Windows\System\aIcEreo.exe
  C:\Windows\System\aIcEreo.exe
  2⤵
  PID:3784
- C:\Windows\System\NvOzNoD.exe
  C:\Windows\System\NvOzNoD.exe
  2⤵
  PID:3848
- C:\Windows\System\ouTQKdq.exe
  C:\Windows\System\ouTQKdq.exe
  2⤵
  PID:3968
- C:\Windows\System\MFQjVMF.exe
  C:\Windows\System\MFQjVMF.exe
  2⤵
  PID:3708
- C:\Windows\System\TTmLlRt.exe
  C:\Windows\System\TTmLlRt.exe
  2⤵
  PID:4020
- C:\Windows\System\hOnuOQp.exe
  C:\Windows\System\hOnuOQp.exe
  2⤵
  PID:3704
- C:\Windows\System\ShfxpeE.exe
  C:\Windows\System\ShfxpeE.exe
  2⤵
  PID:3592
- C:\Windows\System\sdlJAgl.exe
  C:\Windows\System\sdlJAgl.exe
  2⤵
  PID:3768
- C:\Windows\System\BAeJgVQ.exe
  C:\Windows\System\BAeJgVQ.exe
  2⤵
  PID:4076
- C:\Windows\System\ZKdROXc.exe
  C:\Windows\System\ZKdROXc.exe
  2⤵
  PID:2760
- C:\Windows\System\TEhNGiN.exe
  C:\Windows\System\TEhNGiN.exe
  2⤵
  PID:2072
- C:\Windows\System\JcuInrC.exe
  C:\Windows\System\JcuInrC.exe
  2⤵
  PID:2968
- C:\Windows\System\XiBiWsm.exe
  C:\Windows\System\XiBiWsm.exe
  2⤵
  PID:2188
- C:\Windows\System\OGFcFWA.exe
  C:\Windows\System\OGFcFWA.exe
  2⤵
  PID:1872
- C:\Windows\System\VELXyWh.exe
  C:\Windows\System\VELXyWh.exe
  2⤵
  PID:3256
- C:\Windows\System\GrFlrEj.exe
  C:\Windows\System\GrFlrEj.exe
  2⤵
  PID:3108
- C:\Windows\System\pMTJFPT.exe
  C:\Windows\System\pMTJFPT.exe
  2⤵
  PID:3136
- C:\Windows\System\RqSdeCu.exe
  C:\Windows\System\RqSdeCu.exe
  2⤵
  PID:3524
- C:\Windows\System\kcjqzfy.exe
  C:\Windows\System\kcjqzfy.exe
  2⤵
  PID:1520
- C:\Windows\System\giaWIwf.exe
  C:\Windows\System\giaWIwf.exe
  2⤵
  PID:2864
- C:\Windows\System\hnoIJFv.exe
  C:\Windows\System\hnoIJFv.exe
  2⤵
  PID:4000
- C:\Windows\System\xiBxevQ.exe
  C:\Windows\System\xiBxevQ.exe
  2⤵
  PID:2592
- C:\Windows\System\MWlaLCy.exe
  C:\Windows\System\MWlaLCy.exe
  2⤵
  PID:3912
- C:\Windows\System\FKTYMIW.exe
  C:\Windows\System\FKTYMIW.exe
  2⤵
  PID:3648
- C:\Windows\System\xqhtUPY.exe
  C:\Windows\System\xqhtUPY.exe
  2⤵
  PID:3888
- C:\Windows\System\GkcdRBX.exe
  C:\Windows\System\GkcdRBX.exe
  2⤵
  PID:2284
- C:\Windows\System\gVCZLIX.exe
  C:\Windows\System\gVCZLIX.exe
  2⤵
  PID:4024
- C:\Windows\System\aGLjOPf.exe
  C:\Windows\System\aGLjOPf.exe
  2⤵
  PID:2960
- C:\Windows\System\RaOWCtz.exe
  C:\Windows\System\RaOWCtz.exe
  2⤵
  PID:2056
- C:\Windows\System\SJYBrXP.exe
  C:\Windows\System\SJYBrXP.exe
  2⤵
  PID:1248
- C:\Windows\System\uCNVZNI.exe
  C:\Windows\System\uCNVZNI.exe
  2⤵
  PID:1720
- C:\Windows\System\fxDxUdZ.exe
  C:\Windows\System\fxDxUdZ.exe
  2⤵
  PID:1180
- C:\Windows\System\iIHeYbn.exe
  C:\Windows\System\iIHeYbn.exe
  2⤵
  PID:1568
- C:\Windows\System\nGjdwXW.exe
  C:\Windows\System\nGjdwXW.exe
  2⤵
  PID:1256
- C:\Windows\System\QWILVll.exe
  C:\Windows\System\QWILVll.exe
  2⤵
  PID:4008
- C:\Windows\System\EoTWAKx.exe
  C:\Windows\System\EoTWAKx.exe
  2⤵
  PID:1196
- C:\Windows\System\XtuuMAI.exe
  C:\Windows\System\XtuuMAI.exe
  2⤵
  PID:3652
- C:\Windows\System\pejVHGe.exe
  C:\Windows\System\pejVHGe.exe
  2⤵
  PID:3456
- C:\Windows\System\KnfciWQ.exe
  C:\Windows\System\KnfciWQ.exe
  2⤵
  PID:3916
- C:\Windows\System\DOzbIJi.exe
  C:\Windows\System\DOzbIJi.exe
  2⤵
  PID:4104
- C:\Windows\System\DuAIlws.exe
  C:\Windows\System\DuAIlws.exe
  2⤵
  PID:4120
- C:\Windows\System\JXOdtTg.exe
  C:\Windows\System\JXOdtTg.exe
  2⤵
  PID:4136
- C:\Windows\System\TBSLgBc.exe
  C:\Windows\System\TBSLgBc.exe
  2⤵
  PID:4164
- C:\Windows\System\ihNzomg.exe
  C:\Windows\System\ihNzomg.exe
  2⤵
  PID:4180
- C:\Windows\System\xeDiOkP.exe
  C:\Windows\System\xeDiOkP.exe
  2⤵
  PID:4200
- C:\Windows\System\jwYCult.exe
  C:\Windows\System\jwYCult.exe
  2⤵
  PID:4224
- C:\Windows\System\RklnYfA.exe
  C:\Windows\System\RklnYfA.exe
  2⤵
  PID:4244
- C:\Windows\System\fBIuVRp.exe
  C:\Windows\System\fBIuVRp.exe
  2⤵
  PID:4260
- C:\Windows\System\HVZWjhh.exe
  C:\Windows\System\HVZWjhh.exe
  2⤵
  PID:4312
- C:\Windows\System\fFURXuO.exe
  C:\Windows\System\fFURXuO.exe
  2⤵
  PID:4328
- C:\Windows\System\kZDKQdX.exe
  C:\Windows\System\kZDKQdX.exe
  2⤵
  PID:4352
- C:\Windows\System\cqKvSbB.exe
  C:\Windows\System\cqKvSbB.exe
  2⤵
  PID:4368
- C:\Windows\System\DWCRafs.exe
  C:\Windows\System\DWCRafs.exe
  2⤵
  PID:4388
- C:\Windows\System\DbyBPTG.exe
  C:\Windows\System\DbyBPTG.exe
  2⤵
  PID:4408
- C:\Windows\System\noKCeXj.exe
  C:\Windows\System\noKCeXj.exe
  2⤵
  PID:4424
- C:\Windows\System\hspsvUS.exe
  C:\Windows\System\hspsvUS.exe
  2⤵
  PID:4440
- C:\Windows\System\sxdgUEi.exe
  C:\Windows\System\sxdgUEi.exe
  2⤵
  PID:4456
- C:\Windows\System\YITOETq.exe
  C:\Windows\System\YITOETq.exe
  2⤵
  PID:4472
- C:\Windows\System\tdwPZoK.exe
  C:\Windows\System\tdwPZoK.exe
  2⤵
  PID:4496
- C:\Windows\System\wCVzXLA.exe
  C:\Windows\System\wCVzXLA.exe
  2⤵
  PID:4512
- C:\Windows\System\eqLGoLn.exe
  C:\Windows\System\eqLGoLn.exe
  2⤵
  PID:4552
- C:\Windows\System\BpjqMlQ.exe
  C:\Windows\System\BpjqMlQ.exe
  2⤵
  PID:4568
- C:\Windows\System\FeToYRP.exe
  C:\Windows\System\FeToYRP.exe
  2⤵
  PID:4584
- C:\Windows\System\LJAITdl.exe
  C:\Windows\System\LJAITdl.exe
  2⤵
  PID:4600
- C:\Windows\System\rnNCbDa.exe
  C:\Windows\System\rnNCbDa.exe
  2⤵
  PID:4616
- C:\Windows\System\EApCnfe.exe
  C:\Windows\System\EApCnfe.exe
  2⤵
  PID:4636
- C:\Windows\System\YzCnzQP.exe
  C:\Windows\System\YzCnzQP.exe
  2⤵
  PID:4680
- C:\Windows\System\zCKPapZ.exe
  C:\Windows\System\zCKPapZ.exe
  2⤵
  PID:4696
- C:\Windows\System\aATyOrX.exe
  C:\Windows\System\aATyOrX.exe
  2⤵
  PID:4712
- C:\Windows\System\VjsNobc.exe
  C:\Windows\System\VjsNobc.exe
  2⤵
  PID:4728
- C:\Windows\System\pMoVKuJ.exe
  C:\Windows\System\pMoVKuJ.exe
  2⤵
  PID:4744
- C:\Windows\System\kPxGIVr.exe
  C:\Windows\System\kPxGIVr.exe
  2⤵
  PID:4784
- C:\Windows\System\wjjDpAe.exe
  C:\Windows\System\wjjDpAe.exe
  2⤵
  PID:4804
- C:\Windows\System\rmKueMB.exe
  C:\Windows\System\rmKueMB.exe
  2⤵
  PID:4820
- C:\Windows\System\xcfAtBC.exe
  C:\Windows\System\xcfAtBC.exe
  2⤵
  PID:4836
- C:\Windows\System\bpiZVUI.exe
  C:\Windows\System\bpiZVUI.exe
  2⤵
  PID:4852
- C:\Windows\System\DLTPzwe.exe
  C:\Windows\System\DLTPzwe.exe
  2⤵
  PID:4876
- C:\Windows\System\uVTISBJ.exe
  C:\Windows\System\uVTISBJ.exe
  2⤵
  PID:4900
- C:\Windows\System\CslxIJb.exe
  C:\Windows\System\CslxIJb.exe
  2⤵
  PID:4916
- C:\Windows\System\EozLCBU.exe
  C:\Windows\System\EozLCBU.exe
  2⤵
  PID:4932
- C:\Windows\System\uVcudVl.exe
  C:\Windows\System\uVcudVl.exe
  2⤵
  PID:4952
- C:\Windows\System\mQpSaEN.exe
  C:\Windows\System\mQpSaEN.exe
  2⤵
  PID:4972
- C:\Windows\System\pMpoqbq.exe
  C:\Windows\System\pMpoqbq.exe
  2⤵
  PID:4988
- C:\Windows\System\OvGiKux.exe
  C:\Windows\System\OvGiKux.exe
  2⤵
  PID:5004
- C:\Windows\System\IBTBsoE.exe
  C:\Windows\System\IBTBsoE.exe
  2⤵
  PID:5036
- C:\Windows\System\ffGpvxk.exe
  C:\Windows\System\ffGpvxk.exe
  2⤵
  PID:5052
- C:\Windows\System\lrSwznX.exe
  C:\Windows\System\lrSwznX.exe
  2⤵
  PID:5068
- C:\Windows\System\KZYaMFy.exe
  C:\Windows\System\KZYaMFy.exe
  2⤵
  PID:5084
- C:\Windows\System\IpPHJvX.exe
  C:\Windows\System\IpPHJvX.exe
  2⤵
  PID:5100
- C:\Windows\System\Jwozzeb.exe
  C:\Windows\System\Jwozzeb.exe
  2⤵
  PID:5116
- C:\Windows\System\fLnPHXy.exe
  C:\Windows\System\fLnPHXy.exe
  2⤵
  PID:3976
- C:\Windows\System\sbKgiTs.exe
  C:\Windows\System\sbKgiTs.exe
  2⤵
  PID:3588
- C:\Windows\System\iefSxHj.exe
  C:\Windows\System\iefSxHj.exe
  2⤵
  PID:4116
- C:\Windows\System\cnJkOor.exe
  C:\Windows\System\cnJkOor.exe
  2⤵
  PID:4152
- C:\Windows\System\dqujsPc.exe
  C:\Windows\System\dqujsPc.exe
  2⤵
  PID:4192
- C:\Windows\System\ucjucTF.exe
  C:\Windows\System\ucjucTF.exe
  2⤵
  PID:2312
- C:\Windows\System\XuefmkY.exe
  C:\Windows\System\XuefmkY.exe
  2⤵
  PID:3460
- C:\Windows\System\EkzhlIj.exe
  C:\Windows\System\EkzhlIj.exe
  2⤵
  PID:4208
- C:\Windows\System\ZLPeJVv.exe
  C:\Windows\System\ZLPeJVv.exe
  2⤵
  PID:4284
- C:\Windows\System\BqGEwlL.exe
  C:\Windows\System\BqGEwlL.exe
  2⤵
  PID:3332
- C:\Windows\System\svsPuth.exe
  C:\Windows\System\svsPuth.exe
  2⤵
  PID:4336
- C:\Windows\System\MYGbVkI.exe
  C:\Windows\System\MYGbVkI.exe
  2⤵
  PID:4344
- C:\Windows\System\LDtWycq.exe
  C:\Windows\System\LDtWycq.exe
  2⤵
  PID:4220
- C:\Windows\System\NEDRCPN.exe
  C:\Windows\System\NEDRCPN.exe
  2⤵
  PID:4416
- C:\Windows\System\kyVkkRQ.exe
  C:\Windows\System\kyVkkRQ.exe
  2⤵
  PID:4480
- C:\Windows\System\jNeZWFR.exe
  C:\Windows\System\jNeZWFR.exe
  2⤵
  PID:4324
- C:\Windows\System\lOzRLDg.exe
  C:\Windows\System\lOzRLDg.exe
  2⤵
  PID:4400
- C:\Windows\System\kNYOjYq.exe
  C:\Windows\System\kNYOjYq.exe
  2⤵
  PID:4524
- C:\Windows\System\ZLdwRJc.exe
  C:\Windows\System\ZLdwRJc.exe
  2⤵
  PID:4544
- C:\Windows\System\hjyeJRv.exe
  C:\Windows\System\hjyeJRv.exe
  2⤵
  PID:4608
- C:\Windows\System\SueMKiR.exe
  C:\Windows\System\SueMKiR.exe
  2⤵
  PID:4508
- C:\Windows\System\JEEyNaA.exe
  C:\Windows\System\JEEyNaA.exe
  2⤵
  PID:4596
- C:\Windows\System\MZdpxDr.exe
  C:\Windows\System\MZdpxDr.exe
  2⤵
  PID:4660
- C:\Windows\System\GRoDTqT.exe
  C:\Windows\System\GRoDTqT.exe
  2⤵
  PID:4668
- C:\Windows\System\jNxUaSM.exe
  C:\Windows\System\jNxUaSM.exe
  2⤵
  PID:4720
- C:\Windows\System\xgnhQoN.exe
  C:\Windows\System\xgnhQoN.exe
  2⤵
  PID:4760
- C:\Windows\System\OTeNtpk.exe
  C:\Windows\System\OTeNtpk.exe
  2⤵
  PID:4772
- C:\Windows\System\RaQzgNJ.exe
  C:\Windows\System\RaQzgNJ.exe
  2⤵
  PID:4800
- C:\Windows\System\XmESNyx.exe
  C:\Windows\System\XmESNyx.exe
  2⤵
  PID:4860
- C:\Windows\System\fMdHJSH.exe
  C:\Windows\System\fMdHJSH.exe
  2⤵
  PID:4868
- C:\Windows\System\dFLnUaD.exe
  C:\Windows\System\dFLnUaD.exe
  2⤵
  PID:4892
- C:\Windows\System\XveraPe.exe
  C:\Windows\System\XveraPe.exe
  2⤵
  PID:4948
- C:\Windows\System\IZnYxCw.exe
  C:\Windows\System\IZnYxCw.exe
  2⤵
  PID:5028
- C:\Windows\System\HOmzYjd.exe
  C:\Windows\System\HOmzYjd.exe
  2⤵
  PID:5096
- C:\Windows\System\YiLfJKI.exe
  C:\Windows\System\YiLfJKI.exe
  2⤵
  PID:2288
- C:\Windows\System\pzwxtnR.exe
  C:\Windows\System\pzwxtnR.exe
  2⤵
  PID:4148
- C:\Windows\System\MliuxSn.exe
  C:\Windows\System\MliuxSn.exe
  2⤵
  PID:4960
- C:\Windows\System\qflbQfs.exe
  C:\Windows\System\qflbQfs.exe
  2⤵
  PID:3572
- C:\Windows\System\ewbDrhT.exe
  C:\Windows\System\ewbDrhT.exe
  2⤵
  PID:5080
- C:\Windows\System\HjuwPyt.exe
  C:\Windows\System\HjuwPyt.exe
  2⤵
  PID:4996
- C:\Windows\System\OAoCqRC.exe
  C:\Windows\System\OAoCqRC.exe
  2⤵
  PID:4232
- C:\Windows\System\uxjPKSR.exe
  C:\Windows\System\uxjPKSR.exe
  2⤵
  PID:1252
- C:\Windows\System\zUXqlTv.exe
  C:\Windows\System\zUXqlTv.exe
  2⤵
  PID:4280
- C:\Windows\System\gPMtGtl.exe
  C:\Windows\System\gPMtGtl.exe
  2⤵
  PID:4376
- C:\Windows\System\VtPVqHh.exe
  C:\Windows\System\VtPVqHh.exe
  2⤵
  PID:4448
- C:\Windows\System\UFJwcEw.exe
  C:\Windows\System\UFJwcEw.exe
  2⤵
  PID:4432
- C:\Windows\System\PcVncbv.exe
  C:\Windows\System\PcVncbv.exe
  2⤵
  PID:4436
- C:\Windows\System\hjZekmm.exe
  C:\Windows\System\hjZekmm.exe
  2⤵
  PID:2344
- C:\Windows\System\bkKBYSt.exe
  C:\Windows\System\bkKBYSt.exe
  2⤵
  PID:4576
- C:\Windows\System\hEXMWym.exe
  C:\Windows\System\hEXMWym.exe
  2⤵
  PID:4632
- C:\Windows\System\xZNKwLE.exe
  C:\Windows\System\xZNKwLE.exe
  2⤵
  PID:4740
- C:\Windows\System\mkcUDXc.exe
  C:\Windows\System\mkcUDXc.exe
  2⤵
  PID:4828
- C:\Windows\System\cCpxQXQ.exe
  C:\Windows\System\cCpxQXQ.exe
  2⤵
  PID:2608
- C:\Windows\System\BulXnxr.exe
  C:\Windows\System\BulXnxr.exe
  2⤵
  PID:4984
- C:\Windows\System\rFLVEXT.exe
  C:\Windows\System\rFLVEXT.exe
  2⤵
  PID:5024
- C:\Windows\System\PhNtRDE.exe
  C:\Windows\System\PhNtRDE.exe
  2⤵
  PID:4756
- C:\Windows\System\VoyTzWg.exe
  C:\Windows\System\VoyTzWg.exe
  2⤵
  PID:3164
- C:\Windows\System\ZSTFbVn.exe
  C:\Windows\System\ZSTFbVn.exe
  2⤵
  PID:4592
- C:\Windows\System\xkxvAZy.exe
  C:\Windows\System\xkxvAZy.exe
  2⤵
  PID:4848
- C:\Windows\System\lEaBMNy.exe
  C:\Windows\System\lEaBMNy.exe
  2⤵
  PID:4924
- C:\Windows\System\OJURZnf.exe
  C:\Windows\System\OJURZnf.exe
  2⤵
  PID:5112
- C:\Windows\System\FcpmUEL.exe
  C:\Windows\System\FcpmUEL.exe
  2⤵
  PID:4216
- C:\Windows\System\oeysYEb.exe
  C:\Windows\System\oeysYEb.exe
  2⤵
  PID:4132
- C:\Windows\System\xORAjnb.exe
  C:\Windows\System\xORAjnb.exe
  2⤵
  PID:4300
- C:\Windows\System\RcTSoZn.exe
  C:\Windows\System\RcTSoZn.exe
  2⤵
  PID:5000
- C:\Windows\System\TnGUwwl.exe
  C:\Windows\System\TnGUwwl.exe
  2⤵
  PID:4652
- C:\Windows\System\hWgAhXI.exe
  C:\Windows\System\hWgAhXI.exe
  2⤵
  PID:4320
- C:\Windows\System\lhRQtrB.exe
  C:\Windows\System\lhRQtrB.exe
  2⤵
  PID:4708
- C:\Windows\System\IcYMuUo.exe
  C:\Windows\System\IcYMuUo.exe
  2⤵
  PID:4884
- C:\Windows\System\TQjEWIq.exe
  C:\Windows\System\TQjEWIq.exe
  2⤵
  PID:3896
- C:\Windows\System\qXYcait.exe
  C:\Windows\System\qXYcait.exe
  2⤵
  PID:5060
- C:\Windows\System\RNBRxYT.exe
  C:\Windows\System\RNBRxYT.exe
  2⤵
  PID:4776
- C:\Windows\System\pseTRvq.exe
  C:\Windows\System\pseTRvq.exe
  2⤵
  PID:5092
- C:\Windows\System\KPABMAJ.exe
  C:\Windows\System\KPABMAJ.exe
  2⤵
  PID:3900
- C:\Windows\System\hyWlsJv.exe
  C:\Windows\System\hyWlsJv.exe
  2⤵
  PID:4564
- C:\Windows\System\WfvFUFg.exe
  C:\Windows\System\WfvFUFg.exe
  2⤵
  PID:4272
- C:\Windows\System\ZRFaZTQ.exe
  C:\Windows\System\ZRFaZTQ.exe
  2⤵
  PID:4384
- C:\Windows\System\yjiHpEe.exe
  C:\Windows\System\yjiHpEe.exe
  2⤵
  PID:1392
- C:\Windows\System\akhSzVP.exe
  C:\Windows\System\akhSzVP.exe
  2⤵
  PID:4692
- C:\Windows\System\KOPRNju.exe
  C:\Windows\System\KOPRNju.exe
  2⤵
  PID:4628
- C:\Windows\System\iovkDHW.exe
  C:\Windows\System\iovkDHW.exe
  2⤵
  PID:4664
- C:\Windows\System\qbABmaY.exe
  C:\Windows\System\qbABmaY.exe
  2⤵
  PID:4540
- C:\Windows\System\VEKLpxL.exe
  C:\Windows\System\VEKLpxL.exe
  2⤵
  PID:1620
- C:\Windows\System\JuzDIHi.exe
  C:\Windows\System\JuzDIHi.exe
  2⤵
  PID:3568
- C:\Windows\System\EDscQhO.exe
  C:\Windows\System\EDscQhO.exe
  2⤵
  PID:3788
- C:\Windows\System\hYHANpa.exe
  C:\Windows\System\hYHANpa.exe
  2⤵
  PID:5132
- C:\Windows\System\WAqVhix.exe
  C:\Windows\System\WAqVhix.exe
  2⤵
  PID:5152
- C:\Windows\System\liRIWLT.exe
  C:\Windows\System\liRIWLT.exe
  2⤵
  PID:5172
- C:\Windows\System\kdCcpaD.exe
  C:\Windows\System\kdCcpaD.exe
  2⤵
  PID:5204
- C:\Windows\System\jcKWcFM.exe
  C:\Windows\System\jcKWcFM.exe
  2⤵
  PID:5220
- C:\Windows\System\TbmBddN.exe
  C:\Windows\System\TbmBddN.exe
  2⤵
  PID:5256
- C:\Windows\System\SlCuWoK.exe
  C:\Windows\System\SlCuWoK.exe
  2⤵
  PID:5272
- C:\Windows\System\fBrdTob.exe
  C:\Windows\System\fBrdTob.exe
  2⤵
  PID:5288
- C:\Windows\System\PbmDQSO.exe
  C:\Windows\System\PbmDQSO.exe
  2⤵
  PID:5304
- C:\Windows\System\vXkdTJd.exe
  C:\Windows\System\vXkdTJd.exe
  2⤵
  PID:5344
- C:\Windows\System\PEOszMa.exe
  C:\Windows\System\PEOszMa.exe
  2⤵
  PID:5360
- C:\Windows\System\hNNJuLk.exe
  C:\Windows\System\hNNJuLk.exe
  2⤵
  PID:5376
- C:\Windows\System\KBtbEgp.exe
  C:\Windows\System\KBtbEgp.exe
  2⤵
  PID:5396
- C:\Windows\System\trQunTq.exe
  C:\Windows\System\trQunTq.exe
  2⤵
  PID:5412
- C:\Windows\System\ntglaLs.exe
  C:\Windows\System\ntglaLs.exe
  2⤵
  PID:5428
- C:\Windows\System\PbnbQQv.exe
  C:\Windows\System\PbnbQQv.exe
  2⤵
  PID:5444
- C:\Windows\System\WUHYVeo.exe
  C:\Windows\System\WUHYVeo.exe
  2⤵
  PID:5472
- C:\Windows\System\EPjuZaU.exe
  C:\Windows\System\EPjuZaU.exe
  2⤵
  PID:5488
- C:\Windows\System\bwMVDQb.exe
  C:\Windows\System\bwMVDQb.exe
  2⤵
  PID:5508
- C:\Windows\System\TpbHgkz.exe
  C:\Windows\System\TpbHgkz.exe
  2⤵
  PID:5524
- C:\Windows\System\lPVtNjV.exe
  C:\Windows\System\lPVtNjV.exe
  2⤵
  PID:5540
- C:\Windows\System\aNifAit.exe
  C:\Windows\System\aNifAit.exe
  2⤵
  PID:5568
- C:\Windows\System\VsYTxhk.exe
  C:\Windows\System\VsYTxhk.exe
  2⤵
  PID:5584
- C:\Windows\System\hUPrIvJ.exe
  C:\Windows\System\hUPrIvJ.exe
  2⤵
  PID:5600
- C:\Windows\System\GIULpCS.exe
  C:\Windows\System\GIULpCS.exe
  2⤵
  PID:5628
- C:\Windows\System\UrhXxFg.exe
  C:\Windows\System\UrhXxFg.exe
  2⤵
  PID:5644
- C:\Windows\System\MKJKJwi.exe
  C:\Windows\System\MKJKJwi.exe
  2⤵
  PID:5660
- C:\Windows\System\OAznMFu.exe
  C:\Windows\System\OAznMFu.exe
  2⤵
  PID:5676
- C:\Windows\System\PJbSeLf.exe
  C:\Windows\System\PJbSeLf.exe
  2⤵
  PID:5716
- C:\Windows\System\GaeqrvI.exe
  C:\Windows\System\GaeqrvI.exe
  2⤵
  PID:5732
- C:\Windows\System\nPpSBuI.exe
  C:\Windows\System\nPpSBuI.exe
  2⤵
  PID:5748
- C:\Windows\System\DKCULeJ.exe
  C:\Windows\System\DKCULeJ.exe
  2⤵
  PID:5768
- C:\Windows\System\IfeTMDv.exe
  C:\Windows\System\IfeTMDv.exe
  2⤵
  PID:5796
- C:\Windows\System\VqvcqyF.exe
  C:\Windows\System\VqvcqyF.exe
  2⤵
  PID:5812
- C:\Windows\System\hMTIbeO.exe
  C:\Windows\System\hMTIbeO.exe
  2⤵
  PID:5828
- C:\Windows\System\swDHQqo.exe
  C:\Windows\System\swDHQqo.exe
  2⤵
  PID:5848
- C:\Windows\System\dHfnecB.exe
  C:\Windows\System\dHfnecB.exe
  2⤵
  PID:5872
- C:\Windows\System\memWIYO.exe
  C:\Windows\System\memWIYO.exe
  2⤵
  PID:5888
- C:\Windows\System\hViHiYp.exe
  C:\Windows\System\hViHiYp.exe
  2⤵
  PID:5908
- C:\Windows\System\huwJmUS.exe
  C:\Windows\System\huwJmUS.exe
  2⤵
  PID:5924
- C:\Windows\System\WEJGNJr.exe
  C:\Windows\System\WEJGNJr.exe
  2⤵
  PID:5948
- C:\Windows\System\IwcfLVR.exe
  C:\Windows\System\IwcfLVR.exe
  2⤵
  PID:5972
- C:\Windows\System\lmkAFwP.exe
  C:\Windows\System\lmkAFwP.exe
  2⤵
  PID:5992
- C:\Windows\System\xmnilMm.exe
  C:\Windows\System\xmnilMm.exe
  2⤵
  PID:6024
- C:\Windows\System\DYwTioN.exe
  C:\Windows\System\DYwTioN.exe
  2⤵
  PID:6040
- C:\Windows\System\wncbZtT.exe
  C:\Windows\System\wncbZtT.exe
  2⤵
  PID:6056
- C:\Windows\System\JnFBtch.exe
  C:\Windows\System\JnFBtch.exe
  2⤵
  PID:6080
- C:\Windows\System\ntIhymU.exe
  C:\Windows\System\ntIhymU.exe
  2⤵
  PID:6100
- C:\Windows\System\DMmXgKZ.exe
  C:\Windows\System\DMmXgKZ.exe
  2⤵
  PID:6124
- C:\Windows\System\NBmXGfC.exe
  C:\Windows\System\NBmXGfC.exe
  2⤵
  PID:6140
- C:\Windows\System\HvMIMZI.exe
  C:\Windows\System\HvMIMZI.exe
  2⤵
  PID:288
- C:\Windows\System\TiYQTHT.exe
  C:\Windows\System\TiYQTHT.exe
  2⤵
  PID:4796
- C:\Windows\System\QZKFuzC.exe
  C:\Windows\System\QZKFuzC.exe
  2⤵
  PID:5140
- C:\Windows\System\URXZPnI.exe
  C:\Windows\System\URXZPnI.exe
  2⤵
  PID:5184
- C:\Windows\System\XedFTgd.exe
  C:\Windows\System\XedFTgd.exe
  2⤵
  PID:5192
- C:\Windows\System\MhqiHxe.exe
  C:\Windows\System\MhqiHxe.exe
  2⤵
  PID:4752
- C:\Windows\System\NNBvoml.exe
  C:\Windows\System\NNBvoml.exe
  2⤵
  PID:5128
- C:\Windows\System\otVcryO.exe
  C:\Windows\System\otVcryO.exe
  2⤵
  PID:4240
- C:\Windows\System\JMCIHhS.exe
  C:\Windows\System\JMCIHhS.exe
  2⤵
  PID:5240
- C:\Windows\System\lGDsAZR.exe
  C:\Windows\System\lGDsAZR.exe
  2⤵
  PID:5280
- C:\Windows\System\YPvHyDp.exe
  C:\Windows\System\YPvHyDp.exe
  2⤵
  PID:5336
- C:\Windows\System\rWXzWiz.exe
  C:\Windows\System\rWXzWiz.exe
  2⤵
  PID:5408
- C:\Windows\System\IRcdcQL.exe
  C:\Windows\System\IRcdcQL.exe
  2⤵
  PID:5484
- C:\Windows\System\njQDUwj.exe
  C:\Windows\System\njQDUwj.exe
  2⤵
  PID:5548
- C:\Windows\System\AwKMWmd.exe
  C:\Windows\System\AwKMWmd.exe
  2⤵
  PID:5564
- C:\Windows\System\wFNzAEr.exe
  C:\Windows\System\wFNzAEr.exe
  2⤵
  PID:2352
- C:\Windows\System\OWgtbQL.exe
  C:\Windows\System\OWgtbQL.exe
  2⤵
  PID:5464
- C:\Windows\System\MyfQYLg.exe
  C:\Windows\System\MyfQYLg.exe
  2⤵
  PID:5504
- C:\Windows\System\RiSKWuE.exe
  C:\Windows\System\RiSKWuE.exe
  2⤵
  PID:5672
- C:\Windows\System\qUtvpYw.exe
  C:\Windows\System\qUtvpYw.exe
  2⤵
  PID:5388
- C:\Windows\System\VAUiwtL.exe
  C:\Windows\System\VAUiwtL.exe
  2⤵
  PID:5456
- C:\Windows\System\nXTazrF.exe
  C:\Windows\System\nXTazrF.exe
  2⤵
  PID:5532
- C:\Windows\System\CbJEfYy.exe
  C:\Windows\System\CbJEfYy.exe
  2⤵
  PID:5840
- C:\Windows\System\aemOcgZ.exe
  C:\Windows\System\aemOcgZ.exe
  2⤵
  PID:5920
- C:\Windows\System\vPUbfFZ.exe
  C:\Windows\System\vPUbfFZ.exe
  2⤵
  PID:5684
- C:\Windows\System\xduUEBq.exe
  C:\Windows\System\xduUEBq.exe
  2⤵
  PID:5700
- C:\Windows\System\SdCxGNJ.exe
  C:\Windows\System\SdCxGNJ.exe
  2⤵
  PID:6004
- C:\Windows\System\VjEpGKp.exe
  C:\Windows\System\VjEpGKp.exe
  2⤵
  PID:5712
- C:\Windows\System\vsDzAVg.exe
  C:\Windows\System\vsDzAVg.exe
  2⤵
  PID:6052
- C:\Windows\System\HLeTqWz.exe
  C:\Windows\System\HLeTqWz.exe
  2⤵
  PID:5776
- C:\Windows\System\mKwNAYd.exe
  C:\Windows\System\mKwNAYd.exe
  2⤵
  PID:6088
- C:\Windows\System\UstFRow.exe
  C:\Windows\System\UstFRow.exe
  2⤵
  PID:5896
- C:\Windows\System\bYUdoTt.exe
  C:\Windows\System\bYUdoTt.exe
  2⤵
  PID:5936
- C:\Windows\System\OuodUZR.exe
  C:\Windows\System\OuodUZR.exe
  2⤵
  PID:5984
- C:\Windows\System\KCgjaIU.exe
  C:\Windows\System\KCgjaIU.exe
  2⤵
  PID:6136
- C:\Windows\System\QWtkPrs.exe
  C:\Windows\System\QWtkPrs.exe
  2⤵
  PID:5180
- C:\Windows\System\plXVlPw.exe
  C:\Windows\System\plXVlPw.exe
  2⤵
  PID:6076
- C:\Windows\System\mhtIlEQ.exe
  C:\Windows\System\mhtIlEQ.exe
  2⤵
  PID:4196
- C:\Windows\System\qGeLvpZ.exe
  C:\Windows\System\qGeLvpZ.exe
  2⤵
  PID:5188
- C:\Windows\System\UgCuRAV.exe
  C:\Windows\System\UgCuRAV.exe
  2⤵
  PID:5228
- C:\Windows\System\MMPwIKa.exe
  C:\Windows\System\MMPwIKa.exe
  2⤵
  PID:5312
- C:\Windows\System\twxeBmM.exe
  C:\Windows\System\twxeBmM.exe
  2⤵
  PID:2020
- C:\Windows\System\mMQDERU.exe
  C:\Windows\System\mMQDERU.exe
  2⤵
  PID:5264
- C:\Windows\System\BjTXSOF.exe
  C:\Windows\System\BjTXSOF.exe
  2⤵
  PID:5368
- C:\Windows\System\UPSJzwW.exe
  C:\Windows\System\UPSJzwW.exe
  2⤵
  PID:840
- C:\Windows\System\CMBLgRp.exe
  C:\Windows\System\CMBLgRp.exe
  2⤵
  PID:5576
- C:\Windows\System\HdvhRIB.exe
  C:\Windows\System\HdvhRIB.exe
  2⤵
  PID:5352
- C:\Windows\System\IChJiJi.exe
  C:\Windows\System\IChJiJi.exe
  2⤵
  PID:5636
- C:\Windows\System\zFDKoBo.exe
  C:\Windows\System\zFDKoBo.exe
  2⤵
  PID:5560
- C:\Windows\System\xJsUNFy.exe
  C:\Windows\System\xJsUNFy.exe
  2⤵
  PID:5616
- C:\Windows\System\uKIZIXe.exe
  C:\Windows\System\uKIZIXe.exe
  2⤵
  PID:5696
- C:\Windows\System\ldfDddw.exe
  C:\Windows\System\ldfDddw.exe
  2⤵
  PID:5652
- C:\Windows\System\HaFZFxi.exe
  C:\Windows\System\HaFZFxi.exe
  2⤵
  PID:6096
- C:\Windows\System\YUNMuJm.exe
  C:\Windows\System\YUNMuJm.exe
  2⤵
  PID:6000
- C:\Windows\System\TDwoDQA.exe
  C:\Windows\System\TDwoDQA.exe
  2⤵
  PID:5792
- C:\Windows\System\BByCTKY.exe
  C:\Windows\System\BByCTKY.exe
  2⤵
  PID:5944
- C:\Windows\System\aMwreti.exe
  C:\Windows\System\aMwreti.exe
  2⤵
  PID:3368
- C:\Windows\System\kYajHqm.exe
  C:\Windows\System\kYajHqm.exe
  2⤵
  PID:5020
- C:\Windows\System\bQnxiVZ.exe
  C:\Windows\System\bQnxiVZ.exe
  2⤵
  PID:1716
- C:\Windows\System\NbsgKyA.exe
  C:\Windows\System\NbsgKyA.exe
  2⤵
  PID:5212
- C:\Windows\System\vqITlfu.exe
  C:\Windows\System\vqITlfu.exe
  2⤵
  PID:5164
- C:\Windows\System\wYRciMI.exe
  C:\Windows\System\wYRciMI.exe
  2⤵
  PID:6036
- C:\Windows\System\SQdPGLd.exe
  C:\Windows\System\SQdPGLd.exe
  2⤵
  PID:5580
- C:\Windows\System\NFnJvtO.exe
  C:\Windows\System\NFnJvtO.exe
  2⤵
  PID:5452
- C:\Windows\System\SfdlRiP.exe
  C:\Windows\System\SfdlRiP.exe
  2⤵
  PID:5216
- C:\Windows\System\ADdDgJG.exe
  C:\Windows\System\ADdDgJG.exe
  2⤵
  PID:4528
- C:\Windows\System\vKjIqaP.exe
  C:\Windows\System\vKjIqaP.exe
  2⤵
  PID:5608
- C:\Windows\System\VcclLDO.exe
  C:\Windows\System\VcclLDO.exe
  2⤵
  PID:5844
- C:\Windows\System\SJGOGBB.exe
  C:\Windows\System\SJGOGBB.exe
  2⤵
  PID:5956
- C:\Windows\System\jcxFPQX.exe
  C:\Windows\System\jcxFPQX.exe
  2⤵
  PID:5968
- C:\Windows\System\XYcQoHS.exe
  C:\Windows\System\XYcQoHS.exe
  2⤵
  PID:6120
- C:\Windows\System\nvjEXzw.exe
  C:\Windows\System\nvjEXzw.exe
  2⤵
  PID:5932
- C:\Windows\System\tBraoLK.exe
  C:\Windows\System\tBraoLK.exe
  2⤵
  PID:5980
- C:\Windows\System\XoSulpm.exe
  C:\Windows\System\XoSulpm.exe
  2⤵
  PID:5236
- C:\Windows\System\IVDkytW.exe
  C:\Windows\System\IVDkytW.exe
  2⤵
  PID:4780
- C:\Windows\System\vfswbOZ.exe
  C:\Windows\System\vfswbOZ.exe
  2⤵
  PID:5864
- C:\Windows\System\GUwwRme.exe
  C:\Windows\System\GUwwRme.exe
  2⤵
  PID:5756
- C:\Windows\System\uEOVrjv.exe
  C:\Windows\System\uEOVrjv.exe
  2⤵
  PID:5440
- C:\Windows\System\JgJoYRq.exe
  C:\Windows\System\JgJoYRq.exe
  2⤵
  PID:5744
- C:\Windows\System\DXOoZHs.exe
  C:\Windows\System\DXOoZHs.exe
  2⤵
  PID:5740
- C:\Windows\System\qsQMbVr.exe
  C:\Windows\System\qsQMbVr.exe
  2⤵
  PID:5668
- C:\Windows\System\ayfiovu.exe
  C:\Windows\System\ayfiovu.exe
  2⤵
  PID:5836
- C:\Windows\System\QfIdzvv.exe
  C:\Windows\System\QfIdzvv.exe
  2⤵
  PID:5856
- C:\Windows\System\pRYqyYk.exe
  C:\Windows\System\pRYqyYk.exe
  2⤵
  PID:6152
- C:\Windows\System\TbtnnhH.exe
  C:\Windows\System\TbtnnhH.exe
  2⤵
  PID:6168
- C:\Windows\System\FPmfiyW.exe
  C:\Windows\System\FPmfiyW.exe
  2⤵
  PID:6188
- C:\Windows\System\kOheghQ.exe
  C:\Windows\System\kOheghQ.exe
  2⤵
  PID:6208
- C:\Windows\System\lMGvcXW.exe
  C:\Windows\System\lMGvcXW.exe
  2⤵
  PID:6228
- C:\Windows\System\gwjKCTA.exe
  C:\Windows\System\gwjKCTA.exe
  2⤵
  PID:6280
- C:\Windows\System\LVHUCil.exe
  C:\Windows\System\LVHUCil.exe
  2⤵
  PID:6296
- C:\Windows\System\XAYrQet.exe
  C:\Windows\System\XAYrQet.exe
  2⤵
  PID:6312
- C:\Windows\System\rcTumQP.exe
  C:\Windows\System\rcTumQP.exe
  2⤵
  PID:6332
- C:\Windows\System\fmDFLFi.exe
  C:\Windows\System\fmDFLFi.exe
  2⤵
  PID:6356
- C:\Windows\System\kYGqWYW.exe
  C:\Windows\System\kYGqWYW.exe
  2⤵
  PID:6380
- C:\Windows\System\sUUXnsw.exe
  C:\Windows\System\sUUXnsw.exe
  2⤵
  PID:6396
- C:\Windows\System\EsUbkWk.exe
  C:\Windows\System\EsUbkWk.exe
  2⤵
  PID:6420
- C:\Windows\System\MuCotaL.exe
  C:\Windows\System\MuCotaL.exe
  2⤵
  PID:6436
- C:\Windows\System\okewMIg.exe
  C:\Windows\System\okewMIg.exe
  2⤵
  PID:6452
- C:\Windows\System\zcZYihj.exe
  C:\Windows\System\zcZYihj.exe
  2⤵
  PID:6472
- C:\Windows\System\hKQgQiR.exe
  C:\Windows\System\hKQgQiR.exe
  2⤵
  PID:6488
- C:\Windows\System\fKmMlni.exe
  C:\Windows\System\fKmMlni.exe
  2⤵
  PID:6504
- C:\Windows\System\jBJBppb.exe
  C:\Windows\System\jBJBppb.exe
  2⤵
  PID:6524
- C:\Windows\System\SBdxlnC.exe
  C:\Windows\System\SBdxlnC.exe
  2⤵
  PID:6544
- C:\Windows\System\WoRtojd.exe
  C:\Windows\System\WoRtojd.exe
  2⤵
  PID:6560
- C:\Windows\System\YjzhmYy.exe
  C:\Windows\System\YjzhmYy.exe
  2⤵
  PID:6596
- C:\Windows\System\GYGiLuz.exe
  C:\Windows\System\GYGiLuz.exe
  2⤵
  PID:6612
- C:\Windows\System\GlLsZbd.exe
  C:\Windows\System\GlLsZbd.exe
  2⤵
  PID:6632
- C:\Windows\System\jdbZBzk.exe
  C:\Windows\System\jdbZBzk.exe
  2⤵
  PID:6648
- C:\Windows\System\PuScCDx.exe
  C:\Windows\System\PuScCDx.exe
  2⤵
  PID:6668
- C:\Windows\System\NBqhMMy.exe
  C:\Windows\System\NBqhMMy.exe
  2⤵
  PID:6684
- C:\Windows\System\gDgEHys.exe
  C:\Windows\System\gDgEHys.exe
  2⤵
  PID:6704
- C:\Windows\System\zMgeZkT.exe
  C:\Windows\System\zMgeZkT.exe
  2⤵
  PID:6724
- C:\Windows\System\qIYfLoR.exe
  C:\Windows\System\qIYfLoR.exe
  2⤵
  PID:6740
- C:\Windows\System\wxMbYah.exe
  C:\Windows\System\wxMbYah.exe
  2⤵
  PID:6756
- C:\Windows\System\jwiqsDb.exe
  C:\Windows\System\jwiqsDb.exe
  2⤵
  PID:6776
- C:\Windows\System\yMQQmoX.exe
  C:\Windows\System\yMQQmoX.exe
  2⤵
  PID:6796
- C:\Windows\System\IfIZQvE.exe
  C:\Windows\System\IfIZQvE.exe
  2⤵
  PID:6816
- C:\Windows\System\vVUrcyE.exe
  C:\Windows\System\vVUrcyE.exe
  2⤵
  PID:6844
- C:\Windows\System\FTraxWG.exe
  C:\Windows\System\FTraxWG.exe
  2⤵
  PID:6876
- C:\Windows\System\WMrMnHO.exe
  C:\Windows\System\WMrMnHO.exe
  2⤵
  PID:6892
- C:\Windows\System\nMbhSeQ.exe
  C:\Windows\System\nMbhSeQ.exe
  2⤵
  PID:6908
- C:\Windows\System\ieVxlCQ.exe
  C:\Windows\System\ieVxlCQ.exe
  2⤵
  PID:6924
- C:\Windows\System\UyAbESE.exe
  C:\Windows\System\UyAbESE.exe
  2⤵
  PID:6952
- C:\Windows\System\MwPtAca.exe
  C:\Windows\System\MwPtAca.exe
  2⤵
  PID:6968
- C:\Windows\System\LgjuSAF.exe
  C:\Windows\System\LgjuSAF.exe
  2⤵
  PID:6988
- C:\Windows\System\QZEDDmb.exe
  C:\Windows\System\QZEDDmb.exe
  2⤵
  PID:7004
- C:\Windows\System\scvMhuz.exe
  C:\Windows\System\scvMhuz.exe
  2⤵
  PID:7024
- C:\Windows\System\BsQXoXC.exe
  C:\Windows\System\BsQXoXC.exe
  2⤵
  PID:7044
- C:\Windows\System\NyIalzH.exe
  C:\Windows\System\NyIalzH.exe
  2⤵
  PID:7064
- C:\Windows\System\fkiKTZn.exe
  C:\Windows\System\fkiKTZn.exe
  2⤵
  PID:7092
- C:\Windows\System\qdNfFJw.exe
  C:\Windows\System\qdNfFJw.exe
  2⤵
  PID:7108
- C:\Windows\System\lqFrAtN.exe
  C:\Windows\System\lqFrAtN.exe
  2⤵
  PID:7124
- C:\Windows\System\wxfQrNl.exe
  C:\Windows\System\wxfQrNl.exe
  2⤵
  PID:7144
- C:\Windows\System\igRciTQ.exe
  C:\Windows\System\igRciTQ.exe
  2⤵
  PID:7160
- C:\Windows\System\TLCyNSf.exe
  C:\Windows\System\TLCyNSf.exe
  2⤵
  PID:5692
- C:\Windows\System\XrnIhtG.exe
  C:\Windows\System\XrnIhtG.exe
  2⤵
  PID:5640
- C:\Windows\System\lriLYuS.exe
  C:\Windows\System\lriLYuS.exe
  2⤵
  PID:6236
- C:\Windows\System\PeBhGYo.exe
  C:\Windows\System\PeBhGYo.exe
  2⤵
  PID:5960
- C:\Windows\System\oVwQMTS.exe
  C:\Windows\System\oVwQMTS.exe
  2⤵
  PID:1172
- C:\Windows\System\rhcflUp.exe
  C:\Windows\System\rhcflUp.exe
  2⤵
  PID:5384
- C:\Windows\System\mIAluLq.exe
  C:\Windows\System\mIAluLq.exe
  2⤵
  PID:6320
- C:\Windows\System\jzdbQGf.exe
  C:\Windows\System\jzdbQGf.exe
  2⤵
  PID:6272
- C:\Windows\System\xQrlyGI.exe
  C:\Windows\System\xQrlyGI.exe
  2⤵
  PID:6240
- C:\Windows\System\ndcIaid.exe
  C:\Windows\System\ndcIaid.exe
  2⤵
  PID:6364
- C:\Windows\System\wtqHRKq.exe
  C:\Windows\System\wtqHRKq.exe
  2⤵
  PID:6388
- C:\Windows\System\XivNwxK.exe
  C:\Windows\System\XivNwxK.exe
  2⤵
  PID:6448
- C:\Windows\System\HNTHLVt.exe
  C:\Windows\System\HNTHLVt.exe
  2⤵
  PID:6520
- C:\Windows\System\dCeCgmq.exe
  C:\Windows\System\dCeCgmq.exe
  2⤵
  PID:6460
- C:\Windows\System\DWWurDA.exe
  C:\Windows\System\DWWurDA.exe
  2⤵
  PID:6568
- C:\Windows\System\nIdLwZa.exe
  C:\Windows\System\nIdLwZa.exe
  2⤵
  PID:6588
- C:\Windows\System\IOEBcfr.exe
  C:\Windows\System\IOEBcfr.exe
  2⤵
  PID:6644
- C:\Windows\System\tYXmfGe.exe
  C:\Windows\System\tYXmfGe.exe
  2⤵
  PID:6680
- C:\Windows\System\SbYQLsj.exe
  C:\Windows\System\SbYQLsj.exe
  2⤵
  PID:6748
- C:\Windows\System\BRMpJlq.exe
  C:\Windows\System\BRMpJlq.exe
  2⤵
  PID:6792
- C:\Windows\System\IBIELbE.exe
  C:\Windows\System\IBIELbE.exe
  2⤵
  PID:6620
- C:\Windows\System\gATQufa.exe
  C:\Windows\System\gATQufa.exe
  2⤵
  PID:6628
- C:\Windows\System\hMOBjcW.exe
  C:\Windows\System\hMOBjcW.exe
  2⤵
  PID:6832
- C:\Windows\System\BMMwRjV.exe
  C:\Windows\System\BMMwRjV.exe
  2⤵
  PID:6700
- C:\Windows\System\BOBTmaB.exe
  C:\Windows\System\BOBTmaB.exe
  2⤵
  PID:6808
- C:\Windows\System\ItpJWsE.exe
  C:\Windows\System\ItpJWsE.exe
  2⤵
  PID:6864
- C:\Windows\System\aRWLoJk.exe
  C:\Windows\System\aRWLoJk.exe
  2⤵
  PID:6888
- C:\Windows\System\JVnZRhu.exe
  C:\Windows\System\JVnZRhu.exe
  2⤵
  PID:6900
- C:\Windows\System\UQAsQit.exe
  C:\Windows\System\UQAsQit.exe
  2⤵
  PID:7036
- C:\Windows\System\lLHwkvb.exe
  C:\Windows\System\lLHwkvb.exe
  2⤵
  PID:4844
- C:\Windows\System\AophNWC.exe
  C:\Windows\System\AophNWC.exe
  2⤵
  PID:6936
- C:\Windows\System\JaadPWx.exe
  C:\Windows\System\JaadPWx.exe
  2⤵
  PID:6976
- C:\Windows\System\McLfAPR.exe
  C:\Windows\System\McLfAPR.exe
  2⤵
  PID:7136
- C:\Windows\System\kyKmWfZ.exe
  C:\Windows\System\kyKmWfZ.exe
  2⤵
  PID:6148
- C:\Windows\System\lVMKnne.exe
  C:\Windows\System\lVMKnne.exe
  2⤵
  PID:6216
- C:\Windows\System\WwLLFjE.exe
  C:\Windows\System\WwLLFjE.exe
  2⤵
  PID:6220
- C:\Windows\System\ORfgwFh.exe
  C:\Windows\System\ORfgwFh.exe
  2⤵
  PID:6176
- C:\Windows\System\vfoAxKg.exe
  C:\Windows\System\vfoAxKg.exe
  2⤵
  PID:6268
- C:\Windows\System\AqmBRxH.exe
  C:\Windows\System\AqmBRxH.exe
  2⤵
  PID:6308
- C:\Windows\System\qrcynwN.exe
  C:\Windows\System\qrcynwN.exe
  2⤵
  PID:6392
- C:\Windows\System\rdYsyGe.exe
  C:\Windows\System\rdYsyGe.exe
  2⤵
  PID:6352
- C:\Windows\System\PoeuDLk.exe
  C:\Windows\System\PoeuDLk.exe
  2⤵
  PID:6444
- C:\Windows\System\CBuXxHe.exe
  C:\Windows\System\CBuXxHe.exe
  2⤵
  PID:6752
- C:\Windows\System\POYaWFF.exe
  C:\Windows\System\POYaWFF.exe
  2⤵
  PID:6540
- C:\Windows\System\oLfWbKX.exe
  C:\Windows\System\oLfWbKX.exe
  2⤵
  PID:6856
- C:\Windows\System\uDkqoeY.exe
  C:\Windows\System\uDkqoeY.exe
  2⤵
  PID:6712
- C:\Windows\System\gMCOEUk.exe
  C:\Windows\System\gMCOEUk.exe
  2⤵
  PID:6692
- C:\Windows\System\nwVcpzj.exe
  C:\Windows\System\nwVcpzj.exe
  2⤵
  PID:7084
- C:\Windows\System\nbyGoFu.exe
  C:\Windows\System\nbyGoFu.exe
  2⤵
  PID:7080
- C:\Windows\System\wRZdJks.exe
  C:\Windows\System\wRZdJks.exe
  2⤵
  PID:6884
- C:\Windows\System\deCSswb.exe
  C:\Windows\System\deCSswb.exe
  2⤵
  PID:6716
- C:\Windows\System\bZkhNsw.exe
  C:\Windows\System\bZkhNsw.exe
  2⤵
  PID:6828
- C:\Windows\System\CWvzVvQ.exe
  C:\Windows\System\CWvzVvQ.exe
  2⤵
  PID:6872
- C:\Windows\System\LtunWZm.exe
  C:\Windows\System\LtunWZm.exe
  2⤵
  PID:6944
- C:\Windows\System\jbumMwB.exe
  C:\Windows\System\jbumMwB.exe
  2⤵
  PID:2152
- C:\Windows\System\eIdUUJJ.exe
  C:\Windows\System\eIdUUJJ.exe
  2⤵
  PID:6252
- C:\Windows\System\kgVyhvH.exe
  C:\Windows\System\kgVyhvH.exe
  2⤵
  PID:6484
- C:\Windows\System\uYYsfVx.exe
  C:\Windows\System\uYYsfVx.exe
  2⤵
  PID:6948
- C:\Windows\System\NrYersi.exe
  C:\Windows\System\NrYersi.exe
  2⤵
  PID:5728
- C:\Windows\System\BWXfKAd.exe
  C:\Windows\System\BWXfKAd.exe
  2⤵
  PID:6500
- C:\Windows\System\iaoEPkY.exe
  C:\Windows\System\iaoEPkY.exe
  2⤵
  PID:6812
- C:\Windows\System\YKtehxn.exe
  C:\Windows\System\YKtehxn.exe
  2⤵
  PID:6608
- C:\Windows\System\EUwfYqM.exe
  C:\Windows\System\EUwfYqM.exe
  2⤵
  PID:6960
- C:\Windows\System\TWzJTyo.exe
  C:\Windows\System\TWzJTyo.exe
  2⤵
  PID:7016
- C:\Windows\System\HFcNmnr.exe
  C:\Windows\System\HFcNmnr.exe
  2⤵
  PID:6468
- C:\Windows\System\neVDeSc.exe
  C:\Windows\System\neVDeSc.exe
  2⤵
  PID:7032
- C:\Windows\System\bYaXmYx.exe
  C:\Windows\System\bYaXmYx.exe
  2⤵
  PID:6016
- C:\Windows\System\WtMMVkg.exe
  C:\Windows\System\WtMMVkg.exe
  2⤵
  PID:6196
- C:\Windows\System\lILnFWy.exe
  C:\Windows\System\lILnFWy.exe
  2⤵
  PID:6412
- C:\Windows\System\NrgPzUa.exe
  C:\Windows\System\NrgPzUa.exe
  2⤵
  PID:6624
- C:\Windows\System\FvwawOg.exe
  C:\Windows\System\FvwawOg.exe
  2⤵
  PID:6664
- C:\Windows\System\LhOHlFf.exe
  C:\Windows\System\LhOHlFf.exe
  2⤵
  PID:6532
- C:\Windows\System\IslMxyk.exe
  C:\Windows\System\IslMxyk.exe
  2⤵
  PID:7156
- C:\Windows\System\rAIQAhR.exe
  C:\Windows\System\rAIQAhR.exe
  2⤵
  PID:7072
- C:\Windows\System\KvJtSnp.exe
  C:\Windows\System\KvJtSnp.exe
  2⤵
  PID:6736
- C:\Windows\System\bPHlGNP.exe
  C:\Windows\System\bPHlGNP.exe
  2⤵
  PID:6772
- C:\Windows\System\rpUVliD.exe
  C:\Windows\System\rpUVliD.exe
  2⤵
  PID:5332
- C:\Windows\System\BLdPaLO.exe
  C:\Windows\System\BLdPaLO.exe
  2⤵
  PID:6372
- C:\Windows\System\KamFnzj.exe
  C:\Windows\System\KamFnzj.exe
  2⤵
  PID:892
- C:\Windows\System\hwreMMD.exe
  C:\Windows\System\hwreMMD.exe
  2⤵
  PID:5320
- C:\Windows\System\DGbamzc.exe
  C:\Windows\System\DGbamzc.exe
  2⤵
  PID:6200
- C:\Windows\System\JnCNtKJ.exe
  C:\Windows\System\JnCNtKJ.exe
  2⤵
  PID:6676
- C:\Windows\System\pNSZapx.exe
  C:\Windows\System\pNSZapx.exe
  2⤵
  PID:7184
- C:\Windows\System\wtVXwSY.exe
  C:\Windows\System\wtVXwSY.exe
  2⤵
  PID:7200
- C:\Windows\System\Ocxwiof.exe
  C:\Windows\System\Ocxwiof.exe
  2⤵
  PID:7232
- C:\Windows\System\MldLuRW.exe
  C:\Windows\System\MldLuRW.exe
  2⤵
  PID:7252
- C:\Windows\System\tPQCvEX.exe
  C:\Windows\System\tPQCvEX.exe
  2⤵
  PID:7268
- C:\Windows\System\bKrFHBI.exe
  C:\Windows\System\bKrFHBI.exe
  2⤵
  PID:7284
- C:\Windows\System\IEtweCI.exe
  C:\Windows\System\IEtweCI.exe
  2⤵
  PID:7300
- C:\Windows\System\OFTpjOP.exe
  C:\Windows\System\OFTpjOP.exe
  2⤵
  PID:7316
- C:\Windows\System\EbvkucZ.exe
  C:\Windows\System\EbvkucZ.exe
  2⤵
  PID:7332
- C:\Windows\System\IHEqeVc.exe
  C:\Windows\System\IHEqeVc.exe
  2⤵
  PID:7356
- C:\Windows\System\CaVzpEI.exe
  C:\Windows\System\CaVzpEI.exe
  2⤵
  PID:7376
- C:\Windows\System\XlxdKiv.exe
  C:\Windows\System\XlxdKiv.exe
  2⤵
  PID:7392
- C:\Windows\System\URzPbqr.exe
  C:\Windows\System\URzPbqr.exe
  2⤵
  PID:7408
- C:\Windows\System\cCxMYPs.exe
  C:\Windows\System\cCxMYPs.exe
  2⤵
  PID:7424
- C:\Windows\System\MDwvDRx.exe
  C:\Windows\System\MDwvDRx.exe
  2⤵
  PID:7472
- C:\Windows\System\qpsLCyI.exe
  C:\Windows\System\qpsLCyI.exe
  2⤵
  PID:7492
- C:\Windows\System\bpvCzdd.exe
  C:\Windows\System\bpvCzdd.exe
  2⤵
  PID:7508
- C:\Windows\System\MQLNrPL.exe
  C:\Windows\System\MQLNrPL.exe
  2⤵
  PID:7528
- C:\Windows\System\jqpyesB.exe
  C:\Windows\System\jqpyesB.exe
  2⤵
  PID:7548
- C:\Windows\System\vpbISLq.exe
  C:\Windows\System\vpbISLq.exe
  2⤵
  PID:7564
- C:\Windows\System\pJRoqtx.exe
  C:\Windows\System\pJRoqtx.exe
  2⤵
  PID:7580
- C:\Windows\System\LEcyRnN.exe
  C:\Windows\System\LEcyRnN.exe
  2⤵
  PID:7608
- C:\Windows\System\dEYppFh.exe
  C:\Windows\System\dEYppFh.exe
  2⤵
  PID:7624
- C:\Windows\System\LfcpnGw.exe
  C:\Windows\System\LfcpnGw.exe
  2⤵
  PID:7640
- C:\Windows\System\zlzrNqH.exe
  C:\Windows\System\zlzrNqH.exe
  2⤵
  PID:7656
- C:\Windows\System\IOMfGyY.exe
  C:\Windows\System\IOMfGyY.exe
  2⤵
  PID:7676
- C:\Windows\System\ThAldhL.exe
  C:\Windows\System\ThAldhL.exe
  2⤵
  PID:7696
- C:\Windows\System\NeMKfCT.exe
  C:\Windows\System\NeMKfCT.exe
  2⤵
  PID:7728
- C:\Windows\System\OWgsIjO.exe
  C:\Windows\System\OWgsIjO.exe
  2⤵
  PID:7748
- C:\Windows\System\oJDNAER.exe
  C:\Windows\System\oJDNAER.exe
  2⤵
  PID:7768
- C:\Windows\System\HDtPgPg.exe
  C:\Windows\System\HDtPgPg.exe
  2⤵
  PID:7788
- C:\Windows\System\PhZmGid.exe
  C:\Windows\System\PhZmGid.exe
  2⤵
  PID:7808
- C:\Windows\System\cbcftRh.exe
  C:\Windows\System\cbcftRh.exe
  2⤵
  PID:7824
- C:\Windows\System\OruVIQJ.exe
  C:\Windows\System\OruVIQJ.exe
  2⤵
  PID:7844
- C:\Windows\System\AEfnlRe.exe
  C:\Windows\System\AEfnlRe.exe
  2⤵
  PID:7864
- C:\Windows\System\fGdjNjj.exe
  C:\Windows\System\fGdjNjj.exe
  2⤵
  PID:7880
- C:\Windows\System\VxwoqNz.exe
  C:\Windows\System\VxwoqNz.exe
  2⤵
  PID:7896
- C:\Windows\System\ApPhjLE.exe
  C:\Windows\System\ApPhjLE.exe
  2⤵
  PID:7912
- C:\Windows\System\PEHNeqM.exe
  C:\Windows\System\PEHNeqM.exe
  2⤵
  PID:7928
- C:\Windows\System\vvtAVTB.exe
  C:\Windows\System\vvtAVTB.exe
  2⤵
  PID:7956
- C:\Windows\System\iWiZsus.exe
  C:\Windows\System\iWiZsus.exe
  2⤵
  PID:7976
- C:\Windows\System\ajYJpAB.exe
  C:\Windows\System\ajYJpAB.exe
  2⤵
  PID:8012
- C:\Windows\System\uduBLUc.exe
  C:\Windows\System\uduBLUc.exe
  2⤵
  PID:8028
- C:\Windows\System\ipxObHO.exe
  C:\Windows\System\ipxObHO.exe
  2⤵
  PID:8044
- C:\Windows\System\XbowSls.exe
  C:\Windows\System\XbowSls.exe
  2⤵
  PID:8060
- C:\Windows\System\UXbFolI.exe
  C:\Windows\System\UXbFolI.exe
  2⤵
  PID:8076
- C:\Windows\System\IYhhAGo.exe
  C:\Windows\System\IYhhAGo.exe
  2⤵
  PID:8092
- C:\Windows\System\cnoBxXt.exe
  C:\Windows\System\cnoBxXt.exe
  2⤵
  PID:8116
- C:\Windows\System\dDMqmLY.exe
  C:\Windows\System\dDMqmLY.exe
  2⤵
  PID:8136
- C:\Windows\System\wXylMfK.exe
  C:\Windows\System\wXylMfK.exe
  2⤵
  PID:8156
- C:\Windows\System\ikIKAIu.exe
  C:\Windows\System\ikIKAIu.exe
  2⤵
  PID:8172
- C:\Windows\System\JpMIiqN.exe
  C:\Windows\System\JpMIiqN.exe
  2⤵
  PID:8188
- C:\Windows\System\njDpyfn.exe
  C:\Windows\System\njDpyfn.exe
  2⤵
  PID:6840
- C:\Windows\System\IstfXle.exe
  C:\Windows\System\IstfXle.exe
  2⤵
  PID:7220
- C:\Windows\System\CcTnFDW.exe
  C:\Windows\System\CcTnFDW.exe
  2⤵
  PID:7248
- C:\Windows\System\LJabOsN.exe
  C:\Windows\System\LJabOsN.exe
  2⤵
  PID:7308
- C:\Windows\System\BTzmSkE.exe
  C:\Windows\System\BTzmSkE.exe
  2⤵
  PID:7348
- C:\Windows\System\NELfznW.exe
  C:\Windows\System\NELfznW.exe
  2⤵
  PID:7416
- C:\Windows\System\kIvhewx.exe
  C:\Windows\System\kIvhewx.exe
  2⤵
  PID:7324
- C:\Windows\System\HYOhlir.exe
  C:\Windows\System\HYOhlir.exe
  2⤵
  PID:7292
- C:\Windows\System\gNOCIBg.exe
  C:\Windows\System\gNOCIBg.exe
  2⤵
  PID:7372
- C:\Windows\System\svixvLG.exe
  C:\Windows\System\svixvLG.exe
  2⤵
  PID:7464
- C:\Windows\System\MWtHIeD.exe
  C:\Windows\System\MWtHIeD.exe
  2⤵
  PID:7488
- C:\Windows\System\aDabNlI.exe
  C:\Windows\System\aDabNlI.exe
  2⤵
  PID:7504
- C:\Windows\System\kUSxVjG.exe
  C:\Windows\System\kUSxVjG.exe
  2⤵
  PID:7560
- C:\Windows\System\HeZOZVM.exe
  C:\Windows\System\HeZOZVM.exe
  2⤵
  PID:7604
- C:\Windows\System\UNpPTxe.exe
  C:\Windows\System\UNpPTxe.exe
  2⤵
  PID:7716
- C:\Windows\System\qKIjnRl.exe
  C:\Windows\System\qKIjnRl.exe
  2⤵
  PID:7616
- C:\Windows\System\JSmUHXK.exe
  C:\Windows\System\JSmUHXK.exe
  2⤵
  PID:7708
- C:\Windows\System\tywxnvW.exe
  C:\Windows\System\tywxnvW.exe
  2⤵
  PID:7744
- C:\Windows\System\PrAWHgE.exe
  C:\Windows\System\PrAWHgE.exe
  2⤵
  PID:7776
- C:\Windows\System\wDTAqke.exe
  C:\Windows\System\wDTAqke.exe
  2⤵
  PID:7804
- C:\Windows\System\rbdBasV.exe
  C:\Windows\System\rbdBasV.exe
  2⤵
  PID:7872
- C:\Windows\System\awgtgvN.exe
  C:\Windows\System\awgtgvN.exe
  2⤵
  PID:7952
- C:\Windows\System\lSHiRhl.exe
  C:\Windows\System\lSHiRhl.exe
  2⤵
  PID:7924
- C:\Windows\System\ouWoInN.exe
  C:\Windows\System\ouWoInN.exe
  2⤵
  PID:7852
- C:\Windows\System\WHhmJES.exe
  C:\Windows\System\WHhmJES.exe
  2⤵
  PID:8000
- C:\Windows\System\jXxCzYG.exe
  C:\Windows\System\jXxCzYG.exe
  2⤵
  PID:8008
- C:\Windows\System\bGWoYNj.exe
  C:\Windows\System\bGWoYNj.exe
  2⤵
  PID:8072
- C:\Windows\System\lfseIdr.exe
  C:\Windows\System\lfseIdr.exe
  2⤵
  PID:8112
- C:\Windows\System\JfsoUAX.exe
  C:\Windows\System\JfsoUAX.exe
  2⤵
  PID:8124
- C:\Windows\System\lRXkisM.exe
  C:\Windows\System\lRXkisM.exe
  2⤵
  PID:7208
- C:\Windows\System\NOoETmA.exe
  C:\Windows\System\NOoETmA.exe
  2⤵
  PID:8164
- C:\Windows\System\ATbhXqi.exe
  C:\Windows\System\ATbhXqi.exe
  2⤵
  PID:6184
- C:\Windows\System\sJonWvy.exe
  C:\Windows\System\sJonWvy.exe
  2⤵
  PID:6996
- C:\Windows\System\YKdNlKA.exe
  C:\Windows\System\YKdNlKA.exe
  2⤵
  PID:7440
- C:\Windows\System\ieHntSF.exe
  C:\Windows\System\ieHntSF.exe
  2⤵
  PID:7444
- C:\Windows\System\QHpEKtE.exe
  C:\Windows\System\QHpEKtE.exe
  2⤵
  PID:7516
- C:\Windows\System\MWVloRH.exe
  C:\Windows\System\MWVloRH.exe
  2⤵
  PID:7228
- C:\Windows\System\nHbRqBw.exe
  C:\Windows\System\nHbRqBw.exe
  2⤵
  PID:7260
- C:\Windows\System\CIQnNxD.exe
  C:\Windows\System\CIQnNxD.exe
  2⤵
  PID:7436
- C:\Windows\System\quQHOLP.exe
  C:\Windows\System\quQHOLP.exe
  2⤵
  PID:7520
- C:\Windows\System\XnGHmMN.exe
  C:\Windows\System\XnGHmMN.exe
  2⤵
  PID:7712
- C:\Windows\System\aILNnJD.exe
  C:\Windows\System\aILNnJD.exe
  2⤵
  PID:7720
- C:\Windows\System\GTDZEyf.exe
  C:\Windows\System\GTDZEyf.exe
  2⤵
  PID:7836
- C:\Windows\System\miCJFbC.exe
  C:\Windows\System\miCJFbC.exe
  2⤵
  PID:7936
- C:\Windows\System\fpXvVPK.exe
  C:\Windows\System\fpXvVPK.exe
  2⤵
  PID:7968
- C:\Windows\System\TuIztiA.exe
  C:\Windows\System\TuIztiA.exe
  2⤵
  PID:7920
- C:\Windows\System\PEpNLeZ.exe
  C:\Windows\System\PEpNLeZ.exe
  2⤵
  PID:8108
- C:\Windows\System\XTjrtoC.exe
  C:\Windows\System\XTjrtoC.exe
  2⤵
  PID:7132
- C:\Windows\System\pQeSVpf.exe
  C:\Windows\System\pQeSVpf.exe
  2⤵
  PID:7996
- C:\Windows\System\jIjtAKi.exe
  C:\Windows\System\jIjtAKi.exe
  2⤵
  PID:8152
- C:\Windows\System\cYgajjf.exe
  C:\Windows\System\cYgajjf.exe
  2⤵
  PID:6292
- C:\Windows\System\yIMHhRb.exe
  C:\Windows\System\yIMHhRb.exe
  2⤵
  PID:8052
- C:\Windows\System\jblwEvf.exe
  C:\Windows\System\jblwEvf.exe
  2⤵
  PID:7344
- C:\Windows\System\hJsYWru.exe
  C:\Windows\System\hJsYWru.exe
  2⤵
  PID:7600
- C:\Windows\System\vSsZCgI.exe
  C:\Windows\System\vSsZCgI.exe
  2⤵
  PID:7060
- C:\Windows\System\yMRPBze.exe
  C:\Windows\System\yMRPBze.exe
  2⤵
  PID:7756
- C:\Windows\System\ZHvxQHy.exe
  C:\Windows\System\ZHvxQHy.exe
  2⤵
  PID:7636
- C:\Windows\System\hecdmAk.exe
  C:\Windows\System\hecdmAk.exe
  2⤵
  PID:7832
- C:\Windows\System\ZoWKajj.exe
  C:\Windows\System\ZoWKajj.exe
  2⤵
  PID:7892
- C:\Windows\System\eSJGXta.exe
  C:\Windows\System\eSJGXta.exe
  2⤵
  PID:8068
- C:\Windows\System\XsbNldK.exe
  C:\Windows\System\XsbNldK.exe
  2⤵
  PID:7176
- C:\Windows\System\cSkvbvV.exe
  C:\Windows\System\cSkvbvV.exe
  2⤵
  PID:7404
- C:\Windows\System\gvKLuyd.exe
  C:\Windows\System\gvKLuyd.exe
  2⤵
  PID:7796
- C:\Windows\System\IXPNerZ.exe
  C:\Windows\System\IXPNerZ.exe
  2⤵
  PID:6064
- C:\Windows\System\nDeFGSg.exe
  C:\Windows\System\nDeFGSg.exe
  2⤵
  PID:8040
- C:\Windows\System\uOJRJYB.exe
  C:\Windows\System\uOJRJYB.exe
  2⤵
  PID:7340
- C:\Windows\System\aNEQRjJ.exe
  C:\Windows\System\aNEQRjJ.exe
  2⤵
  PID:8056
- C:\Windows\System\hAhUyYd.exe
  C:\Windows\System\hAhUyYd.exe
  2⤵
  PID:7592
- C:\Windows\System\ASxqUCO.exe
  C:\Windows\System\ASxqUCO.exe
  2⤵
  PID:7840
- C:\Windows\System\moKtqTH.exe
  C:\Windows\System\moKtqTH.exe
  2⤵
  PID:7368
- C:\Windows\System\ZJLJKBj.exe
  C:\Windows\System\ZJLJKBj.exe
  2⤵
  PID:8208
- C:\Windows\System\gOgMRnS.exe
  C:\Windows\System\gOgMRnS.exe
  2⤵
  PID:8224
- C:\Windows\System\UxWTRpa.exe
  C:\Windows\System\UxWTRpa.exe
  2⤵
  PID:8272
- C:\Windows\System\EnnSIyu.exe
  C:\Windows\System\EnnSIyu.exe
  2⤵
  PID:8288
- C:\Windows\System\oSvuubr.exe
  C:\Windows\System\oSvuubr.exe
  2⤵
  PID:8304
- C:\Windows\System\Ehkoftn.exe
  C:\Windows\System\Ehkoftn.exe
  2⤵
  PID:8320
- C:\Windows\System\fuoMWZc.exe
  C:\Windows\System\fuoMWZc.exe
  2⤵
  PID:8336
- C:\Windows\System\YipiJCe.exe
  C:\Windows\System\YipiJCe.exe
  2⤵
  PID:8352
- C:\Windows\System\fgxFSnc.exe
  C:\Windows\System\fgxFSnc.exe
  2⤵
  PID:8368
- C:\Windows\System\TsSgZeR.exe
  C:\Windows\System\TsSgZeR.exe
  2⤵
  PID:8404
- C:\Windows\System\uxsHxLv.exe
  C:\Windows\System\uxsHxLv.exe
  2⤵
  PID:8420
- C:\Windows\System\cpjtmKb.exe
  C:\Windows\System\cpjtmKb.exe
  2⤵
  PID:8436
- C:\Windows\System\vdXpZsJ.exe
  C:\Windows\System\vdXpZsJ.exe
  2⤵
  PID:8464
- C:\Windows\System\eThTsqt.exe
  C:\Windows\System\eThTsqt.exe
  2⤵
  PID:8480
- C:\Windows\System\KRZNlrJ.exe
  C:\Windows\System\KRZNlrJ.exe
  2⤵
  PID:8516
- C:\Windows\System\imYgGWL.exe
  C:\Windows\System\imYgGWL.exe
  2⤵
  PID:8532
- C:\Windows\System\ptLjPTT.exe
  C:\Windows\System\ptLjPTT.exe
  2⤵
  PID:8548
- C:\Windows\System\HfUjrLc.exe
  C:\Windows\System\HfUjrLc.exe
  2⤵
  PID:8572
- C:\Windows\System\jsaebdv.exe
  C:\Windows\System\jsaebdv.exe
  2⤵
  PID:8592
- C:\Windows\System\jLsHtiv.exe
  C:\Windows\System\jLsHtiv.exe
  2⤵
  PID:8620
- C:\Windows\System\pxyuUcL.exe
  C:\Windows\System\pxyuUcL.exe
  2⤵
  PID:8640
- C:\Windows\System\tDGJmlC.exe
  C:\Windows\System\tDGJmlC.exe
  2⤵
  PID:8664
- C:\Windows\System\EzeyJTK.exe
  C:\Windows\System\EzeyJTK.exe
  2⤵
  PID:8680
- C:\Windows\System\VxrNSEO.exe
  C:\Windows\System\VxrNSEO.exe
  2⤵
  PID:8696
- C:\Windows\System\TApVCUX.exe
  C:\Windows\System\TApVCUX.exe
  2⤵
  PID:8712
- C:\Windows\System\xdmcCUf.exe
  C:\Windows\System\xdmcCUf.exe
  2⤵
  PID:8728
- C:\Windows\System\FtnLcXj.exe
  C:\Windows\System\FtnLcXj.exe
  2⤵
  PID:8744
- C:\Windows\System\nHMrbSy.exe
  C:\Windows\System\nHMrbSy.exe
  2⤵
  PID:8760
- C:\Windows\System\ZMyGaAL.exe
  C:\Windows\System\ZMyGaAL.exe
  2⤵
  PID:8808
- C:\Windows\System\WhTZfgP.exe
  C:\Windows\System\WhTZfgP.exe
  2⤵
  PID:8824
- C:\Windows\System\pyQriBD.exe
  C:\Windows\System\pyQriBD.exe
  2⤵
  PID:8840
- C:\Windows\System\ukqoTCR.exe
  C:\Windows\System\ukqoTCR.exe
  2⤵
  PID:8864
- C:\Windows\System\daREMde.exe
  C:\Windows\System\daREMde.exe
  2⤵
  PID:8880
- C:\Windows\System\SNTderg.exe
  C:\Windows\System\SNTderg.exe
  2⤵
  PID:8896
- C:\Windows\System\fdMDLPW.exe
  C:\Windows\System\fdMDLPW.exe
  2⤵
  PID:8912
- C:\Windows\System\QiVcPiY.exe
  C:\Windows\System\QiVcPiY.exe
  2⤵
  PID:8932
- C:\Windows\System\PjJwtwF.exe
  C:\Windows\System\PjJwtwF.exe
  2⤵
  PID:8956
- C:\Windows\System\uJVMPFb.exe
  C:\Windows\System\uJVMPFb.exe
  2⤵
  PID:8980
- C:\Windows\System\vGnxLZH.exe
  C:\Windows\System\vGnxLZH.exe
  2⤵
  PID:8996
- C:\Windows\System\QsiWmqh.exe
  C:\Windows\System\QsiWmqh.exe
  2⤵
  PID:9012
- C:\Windows\System\KadfggL.exe
  C:\Windows\System\KadfggL.exe
  2⤵
  PID:9032
- C:\Windows\System\BIJVtPj.exe
  C:\Windows\System\BIJVtPj.exe
  2⤵
  PID:9072
- C:\Windows\System\cjkGRCk.exe
  C:\Windows\System\cjkGRCk.exe
  2⤵
  PID:9088
- C:\Windows\System\GVkkpgn.exe
  C:\Windows\System\GVkkpgn.exe
  2⤵
  PID:9104
- C:\Windows\System\gJdHJvT.exe
  C:\Windows\System\gJdHJvT.exe
  2⤵
  PID:9124
- C:\Windows\System\FvxZskK.exe
  C:\Windows\System\FvxZskK.exe
  2⤵
  PID:9148
- C:\Windows\System\ByqtSpc.exe
  C:\Windows\System\ByqtSpc.exe
  2⤵
  PID:9164
- C:\Windows\System\fnMoiot.exe
  C:\Windows\System\fnMoiot.exe
  2⤵
  PID:9180
- C:\Windows\System\NWVsUbr.exe
  C:\Windows\System\NWVsUbr.exe
  2⤵
  PID:9196
- C:\Windows\System\wgMlcqo.exe
  C:\Windows\System\wgMlcqo.exe
  2⤵
  PID:9212
- C:\Windows\System\ZrvTDjl.exe
  C:\Windows\System\ZrvTDjl.exe
  2⤵
  PID:7544
- C:\Windows\System\UPPYUQP.exe
  C:\Windows\System\UPPYUQP.exe
  2⤵
  PID:7704
- C:\Windows\System\IHzFFLw.exe
  C:\Windows\System\IHzFFLw.exe
  2⤵
  PID:8168
- C:\Windows\System\MnvCYar.exe
  C:\Windows\System\MnvCYar.exe
  2⤵
  PID:7216
- C:\Windows\System\CvoGjkB.exe
  C:\Windows\System\CvoGjkB.exe
  2⤵
  PID:8184
- C:\Windows\System\fwhSomq.exe
  C:\Windows\System\fwhSomq.exe
  2⤵
  PID:8236
- C:\Windows\System\CUaIHJM.exe
  C:\Windows\System\CUaIHJM.exe
  2⤵
  PID:8256
- C:\Windows\System\uZSkedj.exe
  C:\Windows\System\uZSkedj.exe
  2⤵
  PID:8344
- C:\Windows\System\uHUKVPr.exe
  C:\Windows\System\uHUKVPr.exe
  2⤵
  PID:8392
- C:\Windows\System\peXrMIM.exe
  C:\Windows\System\peXrMIM.exe
  2⤵
  PID:8432
- C:\Windows\System\MxBSqJe.exe
  C:\Windows\System\MxBSqJe.exe
  2⤵
  PID:8448
- C:\Windows\System\jyiBBXs.exe
  C:\Windows\System\jyiBBXs.exe
  2⤵
  PID:8456
- C:\Windows\System\EHCBprM.exe
  C:\Windows\System\EHCBprM.exe
  2⤵
  PID:8300
- C:\Windows\System\OJgwlmG.exe
  C:\Windows\System\OJgwlmG.exe
  2⤵
  PID:8416
- C:\Windows\System\XYRIwDQ.exe
  C:\Windows\System\XYRIwDQ.exe
  2⤵
  PID:8588
- C:\Windows\System\HrRxhKG.exe
  C:\Windows\System\HrRxhKG.exe
  2⤵
  PID:8628
- C:\Windows\System\TdRSXjh.exe
  C:\Windows\System\TdRSXjh.exe
  2⤵
  PID:8652
- C:\Windows\System\ApRmwSB.exe
  C:\Windows\System\ApRmwSB.exe
  2⤵
  PID:8688
- C:\Windows\System\XKRVVGx.exe
  C:\Windows\System\XKRVVGx.exe
  2⤵
  PID:8752
- C:\Windows\System\OOEIlYe.exe
  C:\Windows\System\OOEIlYe.exe
  2⤵
  PID:8784
- C:\Windows\System\IhoalXB.exe
  C:\Windows\System\IhoalXB.exe
  2⤵
  PID:8796
- C:\Windows\System\jDYDbyp.exe
  C:\Windows\System\jDYDbyp.exe
  2⤵
  PID:8848
- C:\Windows\System\fCQzBQF.exe
  C:\Windows\System\fCQzBQF.exe
  2⤵
  PID:8924
- C:\Windows\System\CpACwuW.exe
  C:\Windows\System\CpACwuW.exe
  2⤵
  PID:8876
- C:\Windows\System\nYuXLul.exe
  C:\Windows\System\nYuXLul.exe
  2⤵
  PID:8908
- C:\Windows\System\sNrHghl.exe
  C:\Windows\System\sNrHghl.exe
  2⤵
  PID:8968
- C:\Windows\System\HsClTfl.exe
  C:\Windows\System\HsClTfl.exe
  2⤵
  PID:9004
- C:\Windows\System\RRUdstL.exe
  C:\Windows\System\RRUdstL.exe
  2⤵
  PID:9044
- C:\Windows\System\mFPYTjZ.exe
  C:\Windows\System\mFPYTjZ.exe
  2⤵
  PID:8988
- C:\Windows\System\aQYJiAj.exe
  C:\Windows\System\aQYJiAj.exe
  2⤵
  PID:9056
- C:\Windows\System\xpkLcdU.exe
  C:\Windows\System\xpkLcdU.exe
  2⤵
  PID:9096
- C:\Windows\System\ZJBsWQd.exe
  C:\Windows\System\ZJBsWQd.exe
  2⤵
  PID:9144
- C:\Windows\System\TSwzzAR.exe
  C:\Windows\System\TSwzzAR.exe
  2⤵
  PID:7540
- C:\Windows\System\vJrLeDo.exe
  C:\Windows\System\vJrLeDo.exe
  2⤵
  PID:7988
- C:\Windows\System\xpvlKEw.exe
  C:\Windows\System\xpvlKEw.exe
  2⤵
  PID:8100
- C:\Windows\System\KFtnyFA.exe
  C:\Windows\System\KFtnyFA.exe
  2⤵
  PID:1488
- C:\Windows\System\TRakICz.exe
  C:\Windows\System\TRakICz.exe
  2⤵
  PID:8280
- C:\Windows\System\vmOjnyG.exe
  C:\Windows\System\vmOjnyG.exe
  2⤵
  PID:8316
- C:\Windows\System\eMQyQTW.exe
  C:\Windows\System\eMQyQTW.exe
  2⤵
  PID:9064
- C:\Windows\System\UfcHsPu.exe
  C:\Windows\System\UfcHsPu.exe
  2⤵
  PID:8388
- C:\Windows\System\pZmpOCL.exe
  C:\Windows\System\pZmpOCL.exe
  2⤵
  PID:8504
- C:\Windows\System\pCdRYKB.exe
  C:\Windows\System\pCdRYKB.exe
  2⤵
  PID:8556
- C:\Windows\System\rXlvzNT.exe
  C:\Windows\System\rXlvzNT.exe
  2⤵
  PID:8564
- C:\Windows\System\oiLePgO.exe
  C:\Windows\System\oiLePgO.exe
  2⤵
  PID:8264
- C:\Windows\System\HQewKBD.exe
  C:\Windows\System\HQewKBD.exe
  2⤵
  PID:8676
- C:\Windows\System\aZtQsik.exe
  C:\Windows\System\aZtQsik.exe
  2⤵
  PID:8720
- C:\Windows\System\RaEQGlp.exe
  C:\Windows\System\RaEQGlp.exe
  2⤵
  PID:8804
- C:\Windows\System\ZlSEytM.exe
  C:\Windows\System\ZlSEytM.exe
  2⤵
  PID:8860
- C:\Windows\System\JLdQqFg.exe
  C:\Windows\System\JLdQqFg.exe
  2⤵
  PID:8836
- C:\Windows\System\ahEqHYR.exe
  C:\Windows\System\ahEqHYR.exe
  2⤵
  PID:8948
- C:\Windows\System\HMSFTIH.exe
  C:\Windows\System\HMSFTIH.exe
  2⤵
  PID:9132
- C:\Windows\System\rrSxEHX.exe
  C:\Windows\System\rrSxEHX.exe
  2⤵
  PID:9116
- C:\Windows\System\MAZDArU.exe
  C:\Windows\System\MAZDArU.exe
  2⤵
  PID:8992
- C:\Windows\System\ezHmEND.exe
  C:\Windows\System\ezHmEND.exe
  2⤵
  PID:9068
- C:\Windows\System\SvaUENc.exe
  C:\Windows\System\SvaUENc.exe
  2⤵
  PID:7632
- C:\Windows\System\CFGMSgh.exe
  C:\Windows\System\CFGMSgh.exe
  2⤵
  PID:9204
- C:\Windows\System\CuBmVCv.exe
  C:\Windows\System\CuBmVCv.exe
  2⤵
  PID:8476
- C:\Windows\System\uBTuArY.exe
  C:\Windows\System\uBTuArY.exe
  2⤵
  PID:8492
- C:\Windows\System\DWeOLcZ.exe
  C:\Windows\System\DWeOLcZ.exe
  2⤵
  PID:8512
- C:\Windows\System\sobCiKI.exe
  C:\Windows\System\sobCiKI.exe
  2⤵
  PID:8608
- C:\Windows\System\vPZGrqe.exe
  C:\Windows\System\vPZGrqe.exe
  2⤵
  PID:8772
- C:\Windows\System\nNbiUzJ.exe
  C:\Windows\System\nNbiUzJ.exe
  2⤵
  PID:8704
- C:\Windows\System\nDfCILS.exe
  C:\Windows\System\nDfCILS.exe
  2⤵
  PID:8820
- C:\Windows\System\WHicsKY.exe
  C:\Windows\System\WHicsKY.exe
  2⤵
  PID:8872
- C:\Windows\System\wjKrWNK.exe
  C:\Windows\System\wjKrWNK.exe
  2⤵
  PID:2360
- C:\Windows\System\WKQWcrO.exe
  C:\Windows\System\WKQWcrO.exe
  2⤵
  PID:9080
- C:\Windows\System\yuHVtYa.exe
  C:\Windows\System\yuHVtYa.exe
  2⤵
  PID:9188
- C:\Windows\System\HOjqjcD.exe
  C:\Windows\System\HOjqjcD.exe
  2⤵
  PID:9208
- C:\Windows\System\yFjzczK.exe
  C:\Windows\System\yFjzczK.exe
  2⤵
  PID:8248
- C:\Windows\System\RDmugrF.exe
  C:\Windows\System\RDmugrF.exe
  2⤵
  PID:8500
- C:\Windows\System\mjIrOby.exe
  C:\Windows\System\mjIrOby.exe
  2⤵
  PID:8724
- C:\Windows\System\WgQJjyz.exe
  C:\Windows\System\WgQJjyz.exe
  2⤵
  PID:8708
- C:\Windows\System\TPbkOvX.exe
  C:\Windows\System\TPbkOvX.exe
  2⤵
  PID:8832
- C:\Windows\System\cMXEDIe.exe
  C:\Windows\System\cMXEDIe.exe
  2⤵
  PID:9020
- C:\Windows\System\yCWNMZV.exe
  C:\Windows\System\yCWNMZV.exe
  2⤵
  PID:9172
- C:\Windows\System\deIxyfT.exe
  C:\Windows\System\deIxyfT.exe
  2⤵
  PID:8412
- C:\Windows\System\UdILptN.exe
  C:\Windows\System\UdILptN.exe
  2⤵
  PID:8600
- C:\Windows\System\cCrpdWi.exe
  C:\Windows\System\cCrpdWi.exe
  2⤵
  PID:8648
- C:\Windows\System\pdhNFlh.exe
  C:\Windows\System\pdhNFlh.exe
  2⤵
  PID:9156
- C:\Windows\System\NdxqmHt.exe
  C:\Windows\System\NdxqmHt.exe
  2⤵
  PID:8360
- C:\Windows\System\ZMMuqMX.exe
  C:\Windows\System\ZMMuqMX.exe
  2⤵
  PID:8544
- C:\Windows\System\xyVeDVg.exe
  C:\Windows\System\xyVeDVg.exe
  2⤵
  PID:7800
- C:\Windows\System\EzaitjE.exe
  C:\Windows\System\EzaitjE.exe
  2⤵
  PID:8528
- C:\Windows\System\JhSTMgM.exe
  C:\Windows\System\JhSTMgM.exe
  2⤵
  PID:8920
- C:\Windows\System\cjBoTZd.exe
  C:\Windows\System\cjBoTZd.exe
  2⤵
  PID:9220
- C:\Windows\System\NIfmprG.exe
  C:\Windows\System\NIfmprG.exe
  2⤵
  PID:9240
- C:\Windows\System\DxEbyCn.exe
  C:\Windows\System\DxEbyCn.exe
  2⤵
  PID:9256
- C:\Windows\System\kSBSnlt.exe
  C:\Windows\System\kSBSnlt.exe
  2⤵
  PID:9272
- C:\Windows\System\ynzItTl.exe
  C:\Windows\System\ynzItTl.exe
  2⤵
  PID:9288
- C:\Windows\System\sQBlcDu.exe
  C:\Windows\System\sQBlcDu.exe
  2⤵
  PID:9304
- C:\Windows\System\wmMqpHq.exe
  C:\Windows\System\wmMqpHq.exe
  2⤵
  PID:9340
- C:\Windows\System\RRJWbzU.exe
  C:\Windows\System\RRJWbzU.exe
  2⤵
  PID:9356
- C:\Windows\System\XYDiLvA.exe
  C:\Windows\System\XYDiLvA.exe
  2⤵
  PID:9388
- C:\Windows\System\DOXLpwo.exe
  C:\Windows\System\DOXLpwo.exe
  2⤵
  PID:9404
- C:\Windows\System\RHjXDnQ.exe
  C:\Windows\System\RHjXDnQ.exe
  2⤵
  PID:9420
- C:\Windows\System\GuxKKAI.exe
  C:\Windows\System\GuxKKAI.exe
  2⤵
  PID:9440
- C:\Windows\System\tMgRShM.exe
  C:\Windows\System\tMgRShM.exe
  2⤵
  PID:9460
- C:\Windows\System\NZlzlFh.exe
  C:\Windows\System\NZlzlFh.exe
  2⤵
  PID:9480
- C:\Windows\System\QcHhcjz.exe
  C:\Windows\System\QcHhcjz.exe
  2⤵
  PID:9508
- C:\Windows\System\TJCcIZy.exe
  C:\Windows\System\TJCcIZy.exe
  2⤵
  PID:9524
- C:\Windows\System\zmHEaFh.exe
  C:\Windows\System\zmHEaFh.exe
  2⤵
  PID:9540
- C:\Windows\System\cLRRkCr.exe
  C:\Windows\System\cLRRkCr.exe
  2⤵
  PID:9556
- C:\Windows\System\tyZJBOk.exe
  C:\Windows\System\tyZJBOk.exe
  2⤵
  PID:9572
- C:\Windows\System\OqHIjlq.exe
  C:\Windows\System\OqHIjlq.exe
  2⤵
  PID:9588
- C:\Windows\System\UNvfZyM.exe
  C:\Windows\System\UNvfZyM.exe
  2⤵
  PID:9604
- C:\Windows\System\drndwiT.exe
  C:\Windows\System\drndwiT.exe
  2⤵
  PID:9636
- C:\Windows\System\sKHsVEk.exe
  C:\Windows\System\sKHsVEk.exe
  2⤵
  PID:9656
- C:\Windows\System\LJwdSnB.exe
  C:\Windows\System\LJwdSnB.exe
  2⤵
  PID:9696
- C:\Windows\System\ysBgVUy.exe
  C:\Windows\System\ysBgVUy.exe
  2⤵
  PID:9716
- C:\Windows\System\KSndmXZ.exe
  C:\Windows\System\KSndmXZ.exe
  2⤵
  PID:9732
- C:\Windows\System\CEYkWlD.exe
  C:\Windows\System\CEYkWlD.exe
  2⤵
  PID:9752
- C:\Windows\System\aAcUTaB.exe
  C:\Windows\System\aAcUTaB.exe
  2⤵
  PID:9776
- C:\Windows\System\SFhPhgo.exe
  C:\Windows\System\SFhPhgo.exe
  2⤵
  PID:9792
- C:\Windows\System\efVvBhC.exe
  C:\Windows\System\efVvBhC.exe
  2⤵
  PID:9812
- C:\Windows\System\KEzuRqg.exe
  C:\Windows\System\KEzuRqg.exe
  2⤵
  PID:9832
- C:\Windows\System\kHEePQn.exe
  C:\Windows\System\kHEePQn.exe
  2⤵
  PID:9852
- C:\Windows\System\NFZUTht.exe
  C:\Windows\System\NFZUTht.exe
  2⤵
  PID:9872
- C:\Windows\System\YukbWlP.exe
  C:\Windows\System\YukbWlP.exe
  2⤵
  PID:9888
- C:\Windows\System\zJREuPJ.exe
  C:\Windows\System\zJREuPJ.exe
  2⤵
  PID:9912
- C:\Windows\System\ZTsUnDp.exe
  C:\Windows\System\ZTsUnDp.exe
  2⤵
  PID:9944
- C:\Windows\System\bOywqgY.exe
  C:\Windows\System\bOywqgY.exe
  2⤵
  PID:9964
- C:\Windows\System\HigMxud.exe
  C:\Windows\System\HigMxud.exe
  2⤵
  PID:9980
- C:\Windows\System\wWGCict.exe
  C:\Windows\System\wWGCict.exe
  2⤵
  PID:9996
- C:\Windows\System\kDCHOlp.exe
  C:\Windows\System\kDCHOlp.exe
  2⤵
  PID:10012
- C:\Windows\System\mHlVvgn.exe
  C:\Windows\System\mHlVvgn.exe
  2⤵
  PID:10040
- C:\Windows\System\CDqMyQI.exe
  C:\Windows\System\CDqMyQI.exe
  2⤵
  PID:10060
- C:\Windows\System\WbXrvTA.exe
  C:\Windows\System\WbXrvTA.exe
  2⤵
  PID:10080
- C:\Windows\System\hjFhYNV.exe
  C:\Windows\System\hjFhYNV.exe
  2⤵
  PID:10100
- C:\Windows\System\pTsYrNc.exe
  C:\Windows\System\pTsYrNc.exe
  2⤵
  PID:10124
- C:\Windows\System\aXmLunQ.exe
  C:\Windows\System\aXmLunQ.exe
  2⤵
  PID:10144
- C:\Windows\System\CuDpFod.exe
  C:\Windows\System\CuDpFod.exe
  2⤵
  PID:10164
- C:\Windows\System\iThsBaP.exe
  C:\Windows\System\iThsBaP.exe
  2⤵
  PID:10188
- C:\Windows\System\mUPHruQ.exe
  C:\Windows\System\mUPHruQ.exe
  2⤵
  PID:10204
- C:\Windows\System\pyzgSal.exe
  C:\Windows\System\pyzgSal.exe
  2⤵
  PID:10220
- C:\Windows\System\tMneQCw.exe
  C:\Windows\System\tMneQCw.exe
  2⤵
  PID:10236
- C:\Windows\System\RqXSVFc.exe
  C:\Windows\System\RqXSVFc.exe
  2⤵
  PID:9264
- C:\Windows\System\jDkzPsp.exe
  C:\Windows\System\jDkzPsp.exe
  2⤵
  PID:9296
- C:\Windows\System\gQAEYwP.exe
  C:\Windows\System\gQAEYwP.exe
  2⤵
  PID:9300
- C:\Windows\System\VbKZijl.exe
  C:\Windows\System\VbKZijl.exe
  2⤵
  PID:9348
- C:\Windows\System\pLFtOSd.exe
  C:\Windows\System\pLFtOSd.exe
  2⤵
  PID:9328
- C:\Windows\System\CewVTHS.exe
  C:\Windows\System\CewVTHS.exe
  2⤵
  PID:9400
- C:\Windows\System\FApblxb.exe
  C:\Windows\System\FApblxb.exe
  2⤵
  PID:9452
- C:\Windows\System\cEmqInp.exe
  C:\Windows\System\cEmqInp.exe
  2⤵
  PID:9432
- C:\Windows\System\JXGZnCA.exe
  C:\Windows\System\JXGZnCA.exe
  2⤵
  PID:9520
- C:\Windows\System\pwyjNOC.exe
  C:\Windows\System\pwyjNOC.exe
  2⤵
  PID:9584
- C:\Windows\System\bkHxkBG.exe
  C:\Windows\System\bkHxkBG.exe
  2⤵
  PID:9536
- C:\Windows\System\MjvsaSF.exe
  C:\Windows\System\MjvsaSF.exe
  2⤵
  PID:9624
- C:\Windows\System\BVRCjoR.exe
  C:\Windows\System\BVRCjoR.exe
  2⤵
  PID:9596
- C:\Windows\System\qLTocXC.exe
  C:\Windows\System\qLTocXC.exe
  2⤵
  PID:9676
- C:\Windows\System\mdepbTh.exe
  C:\Windows\System\mdepbTh.exe
  2⤵
  PID:9704
- C:\Windows\System\YPdLhwA.exe
  C:\Windows\System\YPdLhwA.exe
  2⤵
  PID:9728
- C:\Windows\System\BYOObVq.exe
  C:\Windows\System\BYOObVq.exe
  2⤵
  PID:9760
- C:\Windows\System\oWDTICm.exe
  C:\Windows\System\oWDTICm.exe
  2⤵
  PID:9800
- C:\Windows\System\pwwCzyS.exe
  C:\Windows\System\pwwCzyS.exe
  2⤵
  PID:9824
- C:\Windows\System\JRzpJKY.exe
  C:\Windows\System\JRzpJKY.exe
  2⤵
  PID:9848
- C:\Windows\System\pfLeoCu.exe
  C:\Windows\System\pfLeoCu.exe
  2⤵
  PID:9884
- C:\Windows\System\sIUjOOH.exe
  C:\Windows\System\sIUjOOH.exe
  2⤵
  PID:9900
- C:\Windows\System\sMKSWCT.exe
  C:\Windows\System\sMKSWCT.exe
  2⤵
  PID:9924
- C:\Windows\System\XUruidx.exe
  C:\Windows\System\XUruidx.exe
  2⤵
  PID:9960
- C:\Windows\System\ZANBuSo.exe
  C:\Windows\System\ZANBuSo.exe
  2⤵
  PID:9992
- C:\Windows\System\yGJcvIu.exe
  C:\Windows\System\yGJcvIu.exe
  2⤵
  PID:9648
- C:\Windows\System\ybYNjSh.exe
  C:\Windows\System\ybYNjSh.exe
  2⤵
  PID:10048
- C:\Windows\System\WYvqqnA.exe
  C:\Windows\System\WYvqqnA.exe
  2⤵
  PID:10096
- C:\Windows\System\RsMMtJs.exe
  C:\Windows\System\RsMMtJs.exe
  2⤵
  PID:10116
- C:\Windows\System\EImPPQu.exe
  C:\Windows\System\EImPPQu.exe
  2⤵
  PID:10160
- C:\Windows\System\kgAtisi.exe
  C:\Windows\System\kgAtisi.exe
  2⤵
  PID:10180
- C:\Windows\System\eybfQZG.exe
  C:\Windows\System\eybfQZG.exe
  2⤵
  PID:9228
- C:\Windows\System\GYMqPpR.exe
  C:\Windows\System\GYMqPpR.exe
  2⤵
  PID:10196
- C:\Windows\System\pahvQdb.exe
  C:\Windows\System\pahvQdb.exe
  2⤵
  PID:10228
- C:\Windows\System\lKnlDmY.exe
  C:\Windows\System\lKnlDmY.exe
  2⤵
  PID:9368
- C:\Windows\System\DBxzjaj.exe
  C:\Windows\System\DBxzjaj.exe
  2⤵
  PID:9316
- C:\Windows\System\LCXofDD.exe
  C:\Windows\System\LCXofDD.exe
  2⤵
  PID:9428
- C:\Windows\System\eSBHPEh.exe
  C:\Windows\System\eSBHPEh.exe
  2⤵
  PID:9416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AhcQXlz.exe

Filesize
5.5MB

MD5
6f8e47e637e6066107476d6fab48fdf9

SHA1
94b1a857e9dac0d2a99b2f54df1156620c937110

SHA256
3e8d04028f5b76d634f73e4d27a2c80b60f9d9126e22e9603e255f7d77774e68

SHA512
cee19accb9dd07b83c9c5b057fddb348af9b51e5fdc2daa0a50d84cf3fe99663a71e8d8bde6a8b064ef07fd8b305383ba15fe390a60a688fcd24664dcaee457e

Download Submit
C:\Windows\system\AvWWvqu.exe

Filesize
5.5MB

MD5
06f977e8819d78eeea6f252988e783df

SHA1
b5489fabbfd759f73df6e664519cad146556b2da

SHA256
bf307d8e253640d35d1293201d65963d8d6da6c05bbb4fab83ba10a7114a4e0c

SHA512
eb672ecd42323e1d3e25c6b085b1514be802067a85a68904b155a19280cd609566f1fa897690d513b8f0d498fff67f9f7eb8224e57fecd6247ea169a60e54475

Download Submit
C:\Windows\system\CitnGeK.exe

Filesize
5.5MB

MD5
481de2096122a10fbc10c892198fe30b

SHA1
9965c93de5822d902f47a4d073ace8422371cb35

SHA256
31c90be2ccc29dc8194ac34f3f6653546f599c2f8993e2a62cf4b137872a287a

SHA512
78e2cde9dc7cff4c892f3e7b3bbd93bf0e2d571fef5b286f56678988b5cfcf5d8751e766d1f20d600db5a2a95eb9f50d3cf24479fe335954c8ec6a6aadfbdbdf

Download Submit
C:\Windows\system\IYZUrqO.exe

Filesize
5.5MB

MD5
eb108217d6ef3f6ea78efde020f015fc

SHA1
a195b58516f7ec84e1e0541a213793150e864d22

SHA256
c5ac54a3c0e204016de3395ee896749cd9499c34a48c46a71e3ff16b38363aac

SHA512
538b8a7823578567e09cebd13b28d868eb2581a725bda542274deff6226f5b1716d5db677c97f2957c5ba3f5091d8ddc8deaa2d4f9c7c728fdc376d5406cfcb8

Download Submit
C:\Windows\system\JbvSxvK.exe

Filesize
5.5MB

MD5
8f7f9eeb95dcbee1cc544bae91da8bd4

SHA1
b8f809ec24fd3f4ac54d84477fbf66a15fa5c760

SHA256
4b5469029ad841e114d1aa6e3641503aed25a1e6adbe21e231ebe52dc8247936

SHA512
7b3c3ebc36103289515211f2feec31abce48256e2d05b6cc868a639c496bccfc3c2ade738aeb79d19b3ce60b71a3ee3fce3be6b9651d7ae0fd2fd4ee2b8867fa

Download Submit
C:\Windows\system\OVGyplG.exe

Filesize
5.5MB

MD5
ad47b414a35354ee82a7f9c422b0dac5

SHA1
ea0d08abccab270e4e8801eee6685a53bd227cce

SHA256
66894833083a17344e06267129d2b4d0547271ed137a442b25c14405525cbb35

SHA512
e92c7fcdbbf7913e5b4c06216ec394f13530442b858fe85349e0aa743f1669b90885dc1359b13232fa6e67bea30daaa08793405c040495c2077c0c644ef93269

Download Submit
C:\Windows\system\WsyRePL.exe

Filesize
5.5MB

MD5
be65eca6405d18aba61bc1324d15ca2f

SHA1
f3594c4d9441be15a9f81d447be982bffc6a2dda

SHA256
b7820f067a51c0d4370d13506ee494ff65ca31dd9f73056898d95072ef7e2443

SHA512
43a79609e83311f0d2030b54e86aa238c2a7a864b99ae7f368407ef8efc143044bb43e178d49d5d453d50f03876a6892a564f110ce21c8fc3fe6d159f042984a

Download Submit
C:\Windows\system\bKdDUuE.exe

Filesize
5.5MB

MD5
4263256e853c55934e06902cef46708e

SHA1
dddf0ad5dfef69756a06c9a6e7325b8f1be00dd3

SHA256
90aa8662c376ee855de785692deb0ed7b4eaf44495ef84f6c609b86bfd30f226

SHA512
50659dcf943ec23b284abdbba2a3c9fd213251d2d1e336f5760515b68d1e60dd2221e7b39b60d609a07e05d29c885eba40bcddf3b1540a60d91946b50439117e

Download Submit
C:\Windows\system\dLeBTnn.exe

Filesize
5.5MB

MD5
84629505ad2a2cfbda6258db1c18384e

SHA1
f1973ff5b8e6a16f3483f4020e8e32b60ce74052

SHA256
ac4a35924513ff7769f409cb6b3e3aed6fd30883eb780613a16ee318e784806b

SHA512
1fd04190dab3fcbdda9b4dc1b7a8bcb26f8e0275b207317871c1fe28a3568073b121170ed67b1adc0ef22736494332055d79982a8f148ea3bb55816f85b82693

Download Submit
C:\Windows\system\eHBrnNF.exe

Filesize
5.5MB

MD5
9be62a11d773bd7c4ae2fa9c2e96db0b

SHA1
96e0ae6fa44a0e8f2d5fe9a0460f3b99d8b6e43f

SHA256
6cf84a63172e23a6caaf5b9f2e737b268308a3dac08294569005c7b5ee9466e4

SHA512
9ab23f96dd9ee4dea263dfcfa17f1dab96b953ccb10f1fa3546fc51ba2faae1f28b8c933d4fa40bbaf6f5ad7eb6ab40969f875d506d5bb79e69f0e1aba3286dd

Download Submit
C:\Windows\system\ekWiOwR.exe

Filesize
5.5MB

MD5
fbabb952b845bfc8f151fcdc1fd72043

SHA1
6c4e80f9d546d3a269e1d93921b4d7de62a0fcfe

SHA256
0d7242033a239f36480b7cb33712f9081880ddbc87f9a0f611a0a1011a1ab085

SHA512
94866e62b34563ec7a98bbc79609f3327524ea931b4317fab7768152e12fdba4dade5476576ca9a8322841a0cf426c5fd60bdf65d7b242ddb750092e2f7bbf6f

Download Submit
C:\Windows\system\fRUkCcW.exe

Filesize
5.5MB

MD5
d2db67d8f8b66b9480429e0f8f197b32

SHA1
65ca9eedbbdf856106757ab50e5ea9c965e8f95a

SHA256
ceb9fb2f932cccd8f3e8c4f503fd74a34f9e06df096c9eb2496c2fb05ff387e2

SHA512
0a71522a1d69e92979ba34bcc6ac5691eda9b631ff13ec3c58b853b8533f27cbb1268d2947ef6f9d69a2058cca5efed9ce77009dd0495037469b199800958204

Download Submit
C:\Windows\system\hposNjF.exe

Filesize
5.5MB

MD5
193a14dd9fed628b81ed1a08962a42c7

SHA1
f7c2838f15bb4233747d370c7c71aa82e4478d6e

SHA256
a322a50e477d36514cfca06ba176020cbedc21b78fd0eeaaf2f2443644070f23

SHA512
06d7e092fb5653a069db374a890ea70a9d3dc428da87186b0fec087559670f7d88bd349e31a104c50f0d653daf4b3f77a2d9df79b5e6f95b937bc9c712fa15c5

Download Submit
C:\Windows\system\iIqVGMg.exe

Filesize
5.5MB

MD5
29913236b37bafb38d4b6a3506ea6cc6

SHA1
34f8564308f980c9a9c0667e9ecf7b69838ce5dc

SHA256
1ad9b7f7589bb3f43e201faf76a1ea2f9056175fc1938ec49af155d5d4ce1c21

SHA512
50b1a031cdc7d509f6b051dd9b28a7e4c3737aa679208f41c3d74c355ff6ec944efcb2c6ffc8fcb2c5ab2298368d32aadce6120c24c0efc4fae39b437a591120

Download Submit
C:\Windows\system\ltFXCmu.exe

Filesize
5.5MB

MD5
29c77c5a419a3e44a78865c5ca09a048

SHA1
703d60a3c80499b5bcf462c8211f1ae45e532430

SHA256
1221ec3cf56eba6b3163fcb90711d3241b5263f4a67364ec912869d4f0031b7b

SHA512
538846ec64a47d2ab8096c3ef74256b0868bdff5c6b06bd23f328dd1a5e1d575f3685862c66e2d029333a053c18a8758fb5ca93f89645e20e2727466e673d520

Download Submit
C:\Windows\system\mLRiSft.exe

Filesize
5.5MB

MD5
7051874083e0eb8b1ab238a9d608490c

SHA1
f60a415efca6688caa266d992b71149d5ce12033

SHA256
9e395bf3df7ad704f1126dc725675892f50fcdaa2833ab89971378384c35766f

SHA512
72f900caad974a1ca36429544f62f5fa81fc4d6abe9673956bdc1308de185db842366e73750d1aa5e7c82787edabea83a0442d9f3a7d7520d3707a40f94ef151

Download Submit
C:\Windows\system\mSgZrKp.exe

Filesize
5.5MB

MD5
00cec95ce3ab560149a73a4c87bf90b6

SHA1
ad09659a8bcb763a0f0d1a94278428e4e8037151

SHA256
68fc655bd46a7294d6fed6d2b055fddde0dee2d8f9d461499c790d52b42adc39

SHA512
9345565517b44fd8375d933019b34d666e43d1d48da0e19244b47838204df618a4784a98f36de65608c0912230b96fb6e7c3e13675eae0764f754d8840670086

Download Submit
C:\Windows\system\nESqEbZ.exe

Filesize
5.5MB

MD5
2b0387930e32d49223f3d825c35ac75f

SHA1
29a282dfd122eb9eeaf57450bf73867a4e50b750

SHA256
97bbd16aa4f4690d0949a3ceac72732a4b5af72e1734acd935b371889582c185

SHA512
2d901428b257e6b44e8cc643ba92fc810c9ce74e6d21ee5fa93045580951b0d1c5e27de2f46e90d178ea12ec0c2bfabaeaa0e748da39790a68a06b987dbba921

Download Submit
C:\Windows\system\pPEPOoB.exe

Filesize
5.5MB

MD5
fe1e766d3b0861528a9e83f6d8dc911f

SHA1
97bb8be0726e42805f68eec1e19ad92b00659d8c

SHA256
942f118de738ad3d994dfca2fbb361f51e2cd73b43eb4c3b7573768948c061c1

SHA512
f32575d6ad96701524dafa3320f686f5f6b95b2e1477096e6034d12e4fa5a54d48b44a2be14f9c86c529ae00b5be70875813339b71831cebb27e064bb3e27781

Download Submit
C:\Windows\system\tMTentv.exe

Filesize
5.5MB

MD5
27d6a5dcf896212b757e961bfbb03f46

SHA1
223270e9ebf49303be6f708710f62fb488be1cf0

SHA256
2c223acece56233bd9c66ef84950e7741d780f5ccc4ce06d94cc9cd594c91bf7

SHA512
eeba9d794246d19f1172421dd69bc74f0bdec19645b9bbbd0ab842ef920ba4dfb549c6345f169a2388381084e85cdb7c9161c440d2653730a49a66d234043f3c

Download Submit
C:\Windows\system\tOVAKBE.exe

Filesize
5.5MB

MD5
82fb5a129de0537756d0c78c857ba44b

SHA1
67abc58fbfbbf2bba90c8330072d4e8d658ab673

SHA256
4c8cc2fc970bca58f0321c2421cede95be089a41e6ecc92f084b687dd189410f

SHA512
aa6f9743030c614e84282baafb7fb344ff6f5e477ce31a9c5f453555dd2863b8ba810280d2219c0c702daddba630fabadc49bc33c13091b4e59f68705106ba94

Download Submit
C:\Windows\system\vqZjyuh.exe

Filesize
5.5MB

MD5
61e81805cf4e380d6cc2a30442f1ab60

SHA1
cfb4ec95da82d72ec7197cbee72961bd0b5794aa

SHA256
660c32e7bdf61055ced6aa753225eb2e78b5fe08c1902d7701e7a8776c257eea

SHA512
efceaf6a13de2552889761ba15f60e6f97bcaf2f118ed32fc695c45be0e5c50245d9a57da5b50e439f9d8f8b31689ac3b34aa4458bbed771e0c7480c780825f6

Download Submit
C:\Windows\system\zqDuLLF.exe

Filesize
5.5MB

MD5
1d4dde62ca1f6ba63c18c6fd2d00ab18

SHA1
25458f32f5f19bc6921c0f103492386893f816fa

SHA256
1b8855ccc5d0f0bf0f78cc3bb9ea865dd07dbd548fcef3dd043b005e08a4bf93

SHA512
3c4a4cb0cfd0f4bb6faf8eed783254b595346ba88e387f04dcdca2858b4e9f304e42f5c8abd09d18bbc14f0785b72a5ca9eeffc38d99701beeb108e327b4839e

Download Submit
\Windows\system\HQTfkhJ.exe

Filesize
5.5MB

MD5
5fa91c761b371f0bb1a8f4ff176600ad

SHA1
997b141a9699cea9251507e2dbc3cfa510a32292

SHA256
2c3ae775168de435069e3d42304f247b8b63721814f6ce81abeb47feb8161224

SHA512
a6ca6eff550ce9d03e0e6a43fb125a30a96d91a947c26e296004b65f9e229aaf28ea87657001fbc5c44009a3b680820519550e0b61e8619742166a50a03beeca

Download Submit
\Windows\system\RkMZhcd.exe

Filesize
5.5MB

MD5
0e45faa8a394b55a69b7338c3180dfae

SHA1
c11ef90f0a6638c879b6dd847ca94833a63c38a0

SHA256
550a70efa4071eec96d2b66dd4c0db52c5f2e8678207514f2b5d3e2388c7bc7d

SHA512
0e9bfbe58b2dd292398db88eaa3914de13cde48c8b9af09852a3c72401828f1d207ec580a5fe4ccf7bd1659f8b07dcf3712d5693a723d9e5de1edde8d045e666

Download Submit
\Windows\system\TIUVvjZ.exe

Filesize
5.5MB

MD5
edae597df507a9768dc8331f3c472e27

SHA1
c480eb07bb97c20f389bb99599389ecaf77721f0

SHA256
fb6ab901f3d556832397a4fd7e8c6f8bcff557226cf16232503c1889cbf994a4

SHA512
ac207c7771ba43988ce6a859743ccf09b8668147ac44e16b122a3fa298776cf5bf7be694a57d85e2f96b54a091e0488e2200c54b1d3afa0e20d13f5a57a33b4d

Download Submit
\Windows\system\UCIlrXz.exe

Filesize
5.5MB

MD5
994794ac8de6226b16c5eb19eac61c33

SHA1
80133c114c6fdab3793cfda87a9e6f725a4e239d

SHA256
ae1a127d91a7a82ae6b45874329769ab20c574f4be508f9127b43d98018bda1f

SHA512
124fb184846dd172e5145e3f57451026622ec33337d7fd340e2a07d223fd987e77221cc52c161965928d75f0a7ab4fb19e0c6135d558c05da5d7394f3d9b7def

Download Submit
\Windows\system\azPXJCD.exe

Filesize
5.5MB

MD5
45ae4fdf540141adff30345c6d7278ad

SHA1
70960f9000075171610359d4b629391ba34decdd

SHA256
f570ba6378500be998442685f19e514f5a9a5eca1e0e466382ff439071f43ed3

SHA512
f47d7014d92302f993963a5faf108af5cfa781d4751668ada127842f3560a63f240e041e4b989130250128b5877cbdaa0b710d864667de7075076388f30ed256

Download Submit
\Windows\system\eYySTJo.exe

Filesize
5.5MB

MD5
5f345ffed487908d17e6e24cd4be784f

SHA1
8cebb502ae6478f18ef08a27cf791b10d7b15b28

SHA256
d4fbdbf25591e49c4dabe3b46a2f8dfeecc05c628e2fa21d34ed665243494564

SHA512
f9be9b1601983fb84438d100ad4bb42a3254883f3f809244de06a3e4069b2adcfd531ab818047ff8609e437fa91e599b7707528c81514261bb27c5f7e9fb307d

Download Submit
\Windows\system\pPnvJVH.exe

Filesize
5.5MB

MD5
be455c948d6373b2467b79f368f847fc

SHA1
7df6b87d930bd1b8ec365c1231eaca06e53891c8

SHA256
c57ff9868d3c0e5056803f85a933865142233e4b2f7b6156b18e844859cb3999

SHA512
f590eb3e2c559709a2aedb71ac53a0f51b07a042dd188d55ae69121f2eaa886af1e8bbddfaa15621602e93b22b100b0effd8b22cda822344c338797bd774a8a9

Download Submit
\Windows\system\rsNxcYU.exe

Filesize
5.5MB

MD5
776411f4c9008340f5949bf73c744cff

SHA1
80397f7782dfd93d63575c8b935c93a5319c2af3

SHA256
f593e895c4b4d16edf570ee7ca35d66c2258fdcb610001ad8d831c9fcecea1c4

SHA512
fd3505dc34599c114c06f5cc8f485cf216ef1f6786ad43958f01c9ab9247e41322c8fb3f4203a00e0e3b4ff6c3ef4ed965fd9b709d39d9c9accae0b29b5efde9

Download Submit
\Windows\system\xaxduWq.exe

Filesize
5.5MB

MD5
3c605bd56611e1b52cdde5a2145e786e

SHA1
12cb9b81862653304d8ca19e01757d7da3da2f9a

SHA256
2c5aba701778fba661ced880fdffbe1251324acab90a458ab2ac0b67e36fc197

SHA512
4c53b9c5f17d7c9e4d14680e08b81cdad97cbcc8ed8f383d6967375857f5554087e0c6bc6d6cc9cdec1582c8893e270456a8b7507f4b17d5075d50465615bf72

Download Submit
\Windows\system\zCAswmF.exe

Filesize
5.5MB

MD5
1c5b087debb366e885dbb83836693d39

SHA1
79bd23561d87e7648e52a5f8e0915fb13f6ea3ce

SHA256
6927477fee36d0b99c310ac8d54106fbe322fea0fc230fac53e8cb3e0e039b81

SHA512
ba0b19c8ad012e369e4b3f6aed5a178d3363ae0960c2d8c61509b96dadafdd905931b9113e93a2045a5c1761d0d3e45a18d4f2f6a367df2219a2d6496066c673

Download Submit
memory/680-95-0x000000013F150000-0x000000013F4A4000-memory.dmp

Filesize
3.3MB

Download
memory/680-3985-0x000000013F150000-0x000000013F4A4000-memory.dmp

Filesize
3.3MB

Download
memory/1264-106-0x000000013F2C0000-0x000000013F614000-memory.dmp

Filesize
3.3MB

Download
memory/1264-28-0x000000013F2C0000-0x000000013F614000-memory.dmp

Filesize
3.3MB

Download
memory/1264-3977-0x000000013F2C0000-0x000000013F614000-memory.dmp

Filesize
3.3MB

Download
memory/1856-97-0x000000013F360000-0x000000013F6B4000-memory.dmp

Filesize
3.3MB

Download
memory/1856-15-0x000000013F360000-0x000000013F6B4000-memory.dmp

Filesize
3.3MB

Download
memory/1856-3975-0x000000013F360000-0x000000013F6B4000-memory.dmp

Filesize
3.3MB

Download
memory/2112-265-0x000000013FAB0000-0x000000013FE04000-memory.dmp

Filesize
3.3MB

Download
memory/2112-0-0x000000013FEB0000-0x0000000140204000-memory.dmp

Filesize
3.3MB

Download
memory/2112-681-0x0000000002300000-0x0000000002654000-memory.dmp

Filesize
3.3MB

Download
memory/2112-68-0x0000000002300000-0x0000000002654000-memory.dmp

Filesize
3.3MB

Download
memory/2112-85-0x000000013F730000-0x000000013FA84000-memory.dmp

Filesize
3.3MB

Download
memory/2112-224-0x0000000002300000-0x0000000002654000-memory.dmp

Filesize
3.3MB

Download
memory/2112-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2112-41-0x000000013FEB0000-0x0000000140204000-memory.dmp

Filesize
3.3MB

Download
memory/2112-72-0x0000000002300000-0x0000000002654000-memory.dmp

Filesize
3.3MB

Download
memory/2112-8-0x000000013F560000-0x000000013F8B4000-memory.dmp

Filesize
3.3MB

Download
memory/2112-70-0x000000013F220000-0x000000013F574000-memory.dmp

Filesize
3.3MB

Download
memory/2112-93-0x000000013F3D0000-0x000000013F724000-memory.dmp

Filesize
3.3MB

Download
memory/2112-30-0x000000013F2C0000-0x000000013F614000-memory.dmp

Filesize
3.3MB

Download
memory/2112-21-0x000000013F260000-0x000000013F5B4000-memory.dmp

Filesize
3.3MB

Download
memory/2112-74-0x0000000002300000-0x0000000002654000-memory.dmp

Filesize
3.3MB

Download
memory/2112-13-0x000000013F360000-0x000000013F6B4000-memory.dmp

Filesize
3.3MB

Download
memory/2112-76-0x000000013F7D0000-0x000000013FB24000-memory.dmp

Filesize
3.3MB

Download
memory/2128-26-0x000000013F260000-0x000000013F5B4000-memory.dmp

Filesize
3.3MB

Download
memory/2128-104-0x000000013F260000-0x000000013F5B4000-memory.dmp

Filesize
3.3MB

Download
memory/2128-3976-0x000000013F260000-0x000000013F5B4000-memory.dmp

Filesize
3.3MB

Download
memory/2516-75-0x000000013FE20000-0x0000000140174000-memory.dmp

Filesize
3.3MB

Download
memory/2516-3982-0x000000013FE20000-0x0000000140174000-memory.dmp

Filesize
3.3MB

Download
memory/2648-3979-0x000000013FD70000-0x00000001400C4000-memory.dmp

Filesize
3.3MB

Download
memory/2648-82-0x000000013FD70000-0x00000001400C4000-memory.dmp

Filesize
3.3MB

Download
memory/2660-71-0x000000013F220000-0x000000013F574000-memory.dmp

Filesize
3.3MB

Download
memory/2660-3980-0x000000013F220000-0x000000013F574000-memory.dmp

Filesize
3.3MB

Download
memory/2668-80-0x000000013F7D0000-0x000000013FB24000-memory.dmp

Filesize
3.3MB

Download
memory/2668-3983-0x000000013F7D0000-0x000000013FB24000-memory.dmp

Filesize
3.3MB

Download
memory/2708-3984-0x000000013F730000-0x000000013FA84000-memory.dmp

Filesize
3.3MB

Download
memory/2708-69-0x000000013F730000-0x000000013FA84000-memory.dmp

Filesize
3.3MB

Download
memory/2780-73-0x000000013FE30000-0x0000000140184000-memory.dmp

Filesize
3.3MB

Download
memory/2780-3981-0x000000013FE30000-0x0000000140184000-memory.dmp

Filesize
3.3MB

Download
memory/2920-9-0x000000013F560000-0x000000013F8B4000-memory.dmp

Filesize
3.3MB

Download
memory/2920-3974-0x000000013F560000-0x000000013F8B4000-memory.dmp

Filesize
3.3MB

Download
memory/2932-102-0x000000013FAB0000-0x000000013FE04000-memory.dmp

Filesize
3.3MB

Download
memory/2932-3986-0x000000013FAB0000-0x000000013FE04000-memory.dmp

Filesize
3.3MB

Download
memory/2952-3978-0x000000013F1D0000-0x000000013F524000-memory.dmp

Filesize
3.3MB

Download
memory/2952-36-0x000000013F1D0000-0x000000013F524000-memory.dmp

Filesize
3.3MB

Download
memory/3028-105-0x000000013FDE0000-0x0000000140134000-memory.dmp

Filesize
3.3MB

Download
memory/3028-3987-0x000000013FDE0000-0x0000000140134000-memory.dmp

Filesize
3.3MB

Download