xmrig | 9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
Size

5.0MB
MD5

ff7caa2e046c0eb6bd3b6e7c50fbbf43
SHA1

467ae090cb3d863a2c5d6382a1fc829183fd1546
SHA256

9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b
SHA512

431bd5b3c3a50f15666d6cd354ba085a52fe47f3d66f43eb29a13299462a0baa6ffa4a559b8d482b67a46ee9528e5600087a854d40e45a3e1e65247e3149bcf2
SSDEEP

98304:EniLf9FdfE0pZB156utgpPFotBER/mQ32d:eOl56utgpPF8u/M

Score

10^/10

xmrig discovery miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 63 IoCs

miner

resource	yara_rule
behavioral1/memory/2392-0-0x000000013F1A0000-0x000000013F4F4000-memory.dmp	xmrig
behavioral1/files/0x00080000000120fc-6.dat	xmrig
behavioral1/files/0x0007000000019551-8.dat	xmrig
behavioral1/files/0x000700000001955c-12.dat	xmrig
behavioral1/memory/2228-30-0x000000013F9C0000-0x000000013FD14000-memory.dmp	xmrig
behavioral1/files/0x000500000001a4b7-43.dat	xmrig
behavioral1/files/0x000500000001a4bb-68.dat	xmrig
behavioral1/memory/2904-82-0x000000013FBC0000-0x000000013FF14000-memory.dmp	xmrig
behavioral1/memory/2816-81-0x000000013F9D0000-0x000000013FD24000-memory.dmp	xmrig
behavioral1/memory/2928-80-0x000000013FF30000-0x0000000140284000-memory.dmp	xmrig
behavioral1/files/0x000500000001a4bd-83.dat	xmrig
behavioral1/memory/2944-79-0x000000013FFC0000-0x0000000140314000-memory.dmp	xmrig
behavioral1/memory/2840-78-0x000000013F230000-0x000000013F584000-memory.dmp	xmrig
behavioral1/memory/2912-70-0x000000013F8A0000-0x000000013FBF4000-memory.dmp	xmrig
behavioral1/memory/2264-69-0x000000013F3C0000-0x000000013F714000-memory.dmp	xmrig
behavioral1/files/0x00080000000195ff-66.dat	xmrig
behavioral1/files/0x000500000001a4b9-65.dat	xmrig
behavioral1/files/0x00060000000195f9-62.dat	xmrig
behavioral1/memory/2260-61-0x000000013FA40000-0x000000013FD94000-memory.dmp	xmrig
behavioral1/files/0x00060000000195fb-57.dat	xmrig
behavioral1/memory/2948-52-0x000000013F600000-0x000000013F954000-memory.dmp	xmrig
behavioral1/memory/2392-46-0x000000013F600000-0x000000013F954000-memory.dmp	xmrig
behavioral1/memory/2392-37-0x000000013FB50000-0x000000013FEA4000-memory.dmp	xmrig
behavioral1/files/0x000500000001a4b5-64.dat	xmrig
behavioral1/memory/1692-42-0x000000013FB50000-0x000000013FEA4000-memory.dmp	xmrig
behavioral1/memory/2584-34-0x000000013F5C0000-0x000000013F914000-memory.dmp	xmrig
behavioral1/files/0x00060000000195fd-31.dat	xmrig
behavioral1/memory/2392-22-0x000000013F9C0000-0x000000013FD14000-memory.dmp	xmrig
behavioral1/files/0x00070000000195c0-20.dat	xmrig
behavioral1/memory/2392-85-0x000000013F1A0000-0x000000013F4F4000-memory.dmp	xmrig
behavioral1/files/0x000500000001a4c5-100.dat	xmrig
behavioral1/files/0x000500000001a4c9-120.dat	xmrig
behavioral1/files/0x000500000001a4cf-131.dat	xmrig
behavioral1/files/0x000500000001a4d8-144.dat	xmrig
behavioral1/files/0x000500000001a4e5-168.dat	xmrig
behavioral1/memory/2840-368-0x000000013F230000-0x000000013F584000-memory.dmp	xmrig
behavioral1/memory/2912-367-0x000000013F8A0000-0x000000013FBF4000-memory.dmp	xmrig
behavioral1/memory/2264-366-0x000000013F3C0000-0x000000013F714000-memory.dmp	xmrig
behavioral1/files/0x000500000001a4e3-163.dat	xmrig
behavioral1/files/0x000500000001a4e1-160.dat	xmrig
behavioral1/files/0x000500000001a4de-155.dat	xmrig
behavioral1/files/0x000500000001a4dc-152.dat	xmrig
behavioral1/files/0x000500000001a4da-147.dat	xmrig
behavioral1/files/0x000500000001a4d6-139.dat	xmrig
behavioral1/files/0x000500000001a4d4-136.dat	xmrig
behavioral1/files/0x000500000001a4cd-128.dat	xmrig
behavioral1/files/0x000500000001a4cb-123.dat	xmrig
behavioral1/files/0x000500000001a4c7-115.dat	xmrig
behavioral1/files/0x000500000001a4c3-111.dat	xmrig
behavioral1/files/0x000500000001a4bf-110.dat	xmrig
behavioral1/files/0x000500000001a4c1-107.dat	xmrig
behavioral1/memory/2392-104-0x000000013F670000-0x000000013F9C4000-memory.dmp	xmrig
behavioral1/files/0x00070000000194da-103.dat	xmrig
behavioral1/memory/2912-3623-0x000000013F8A0000-0x000000013FBF4000-memory.dmp	xmrig
behavioral1/memory/2228-3621-0x000000013F9C0000-0x000000013FD14000-memory.dmp	xmrig
behavioral1/memory/2944-3620-0x000000013FFC0000-0x0000000140314000-memory.dmp	xmrig
behavioral1/memory/2264-3632-0x000000013F3C0000-0x000000013F714000-memory.dmp	xmrig
behavioral1/memory/2816-3640-0x000000013F9D0000-0x000000013FD24000-memory.dmp	xmrig
behavioral1/memory/2904-3639-0x000000013FBC0000-0x000000013FF14000-memory.dmp	xmrig
behavioral1/memory/2260-3668-0x000000013FA40000-0x000000013FD94000-memory.dmp	xmrig
behavioral1/memory/2928-3678-0x000000013FF30000-0x0000000140284000-memory.dmp	xmrig
behavioral1/memory/2584-3677-0x000000013F5C0000-0x000000013F914000-memory.dmp	xmrig
behavioral1/memory/2948-3838-0x000000013F600000-0x000000013F954000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2228	gEFFbwB.exe
2584	EpuOXBj.exe
1692	TETvfSF.exe
2948	yjyRWGC.exe
2260	eUVWwpv.exe
2264	yCDwUca.exe
2912	HnypiMe.exe
2840	WhIjQED.exe
2944	GRKqITp.exe
2928	HEyZiVa.exe
2816	tlbwqCT.exe
2904	dutKdNy.exe
1504	cRRYgEI.exe
3016	AGxtTxU.exe
2760	qtyXzYd.exe
1828	kSpWiaM.exe
2964	OsbwXwW.exe
300	vPEybTG.exe
2568	fMkYNmD.exe
3000	urRbSdz.exe
2036	wTSBBRq.exe
1236	ZEBFjEn.exe
1508	IptEDHx.exe
2488	bEZlQyU.exe
3064	xEdWZur.exe
2504	JfjwNsW.exe
2412	Qtqowil.exe
1152	SPunmMO.exe
2524	plRpyEc.exe
2612	WOwTghg.exe
2444	TrEWDoS.exe
2224	KfbwPxo.exe
1192	KmAYEDA.exe
1016	PBmBOVa.exe
944	FyEyzUV.exe
1864	GfGnWiL.exe
1604	GFTHBbf.exe
1756	XsLMiCu.exe
2780	uwNIPXf.exe
1800	vjLsLNQ.exe
836	SOsQlFf.exe
2660	sYzRCfl.exe
1000	INgAgNb.exe
1492	ZgfzkDR.exe
1344	fLGDGts.exe
2420	HtOlSlz.exe
1648	IGfRigJ.exe
2164	vvZLqLM.exe
2288	TQEVDpv.exe
1988	xaxBeGa.exe
1776	WpHPrvh.exe
2376	BuEbeXG.exe
1632	KePeeBo.exe
2088	cCQVLzn.exe
2064	OOcrYEI.exe
1736	ujRMGbe.exe
1640	efZFgjD.exe
1752	KgkyQBD.exe
1948	HQcrkzb.exe
2576	PMUiPwB.exe
1576	iFHBCLc.exe
1684	YbZAleF.exe
1732	JuqlGDI.exe
2124	YCOVpRW.exe

Loads dropped DLL 64 IoCs

pid	Process
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2392-0-0x000000013F1A0000-0x000000013F4F4000-memory.dmp	upx
behavioral1/files/0x00080000000120fc-6.dat	upx
behavioral1/files/0x0007000000019551-8.dat	upx
behavioral1/files/0x000700000001955c-12.dat	upx
behavioral1/memory/2228-30-0x000000013F9C0000-0x000000013FD14000-memory.dmp	upx
behavioral1/files/0x000500000001a4b7-43.dat	upx
behavioral1/files/0x000500000001a4bb-68.dat	upx
behavioral1/memory/2904-82-0x000000013FBC0000-0x000000013FF14000-memory.dmp	upx
behavioral1/memory/2816-81-0x000000013F9D0000-0x000000013FD24000-memory.dmp	upx
behavioral1/memory/2928-80-0x000000013FF30000-0x0000000140284000-memory.dmp	upx
behavioral1/files/0x000500000001a4bd-83.dat	upx
behavioral1/memory/2944-79-0x000000013FFC0000-0x0000000140314000-memory.dmp	upx
behavioral1/memory/2840-78-0x000000013F230000-0x000000013F584000-memory.dmp	upx
behavioral1/memory/2912-70-0x000000013F8A0000-0x000000013FBF4000-memory.dmp	upx
behavioral1/memory/2264-69-0x000000013F3C0000-0x000000013F714000-memory.dmp	upx
behavioral1/files/0x00080000000195ff-66.dat	upx
behavioral1/files/0x000500000001a4b9-65.dat	upx
behavioral1/files/0x00060000000195f9-62.dat	upx
behavioral1/memory/2260-61-0x000000013FA40000-0x000000013FD94000-memory.dmp	upx
behavioral1/files/0x00060000000195fb-57.dat	upx
behavioral1/memory/2948-52-0x000000013F600000-0x000000013F954000-memory.dmp	upx
behavioral1/files/0x000500000001a4b5-64.dat	upx
behavioral1/memory/1692-42-0x000000013FB50000-0x000000013FEA4000-memory.dmp	upx
behavioral1/memory/2584-34-0x000000013F5C0000-0x000000013F914000-memory.dmp	upx
behavioral1/files/0x00060000000195fd-31.dat	upx
behavioral1/files/0x00070000000195c0-20.dat	upx
behavioral1/memory/2392-85-0x000000013F1A0000-0x000000013F4F4000-memory.dmp	upx
behavioral1/files/0x000500000001a4c5-100.dat	upx
behavioral1/files/0x000500000001a4c9-120.dat	upx
behavioral1/files/0x000500000001a4cf-131.dat	upx
behavioral1/files/0x000500000001a4d8-144.dat	upx
behavioral1/files/0x000500000001a4e5-168.dat	upx
behavioral1/memory/2840-368-0x000000013F230000-0x000000013F584000-memory.dmp	upx
behavioral1/memory/2912-367-0x000000013F8A0000-0x000000013FBF4000-memory.dmp	upx
behavioral1/memory/2264-366-0x000000013F3C0000-0x000000013F714000-memory.dmp	upx
behavioral1/files/0x000500000001a4e3-163.dat	upx
behavioral1/files/0x000500000001a4e1-160.dat	upx
behavioral1/files/0x000500000001a4de-155.dat	upx
behavioral1/files/0x000500000001a4dc-152.dat	upx
behavioral1/files/0x000500000001a4da-147.dat	upx
behavioral1/files/0x000500000001a4d6-139.dat	upx
behavioral1/files/0x000500000001a4d4-136.dat	upx
behavioral1/files/0x000500000001a4cd-128.dat	upx
behavioral1/files/0x000500000001a4cb-123.dat	upx
behavioral1/files/0x000500000001a4c7-115.dat	upx
behavioral1/files/0x000500000001a4c3-111.dat	upx
behavioral1/files/0x000500000001a4bf-110.dat	upx
behavioral1/files/0x000500000001a4c1-107.dat	upx
behavioral1/files/0x00070000000194da-103.dat	upx
behavioral1/memory/2912-3623-0x000000013F8A0000-0x000000013FBF4000-memory.dmp	upx
behavioral1/memory/2228-3621-0x000000013F9C0000-0x000000013FD14000-memory.dmp	upx
behavioral1/memory/2944-3620-0x000000013FFC0000-0x0000000140314000-memory.dmp	upx
behavioral1/memory/2264-3632-0x000000013F3C0000-0x000000013F714000-memory.dmp	upx
behavioral1/memory/2816-3640-0x000000013F9D0000-0x000000013FD24000-memory.dmp	upx
behavioral1/memory/2904-3639-0x000000013FBC0000-0x000000013FF14000-memory.dmp	upx
behavioral1/memory/2260-3668-0x000000013FA40000-0x000000013FD94000-memory.dmp	upx
behavioral1/memory/2928-3678-0x000000013FF30000-0x0000000140284000-memory.dmp	upx
behavioral1/memory/2584-3677-0x000000013F5C0000-0x000000013F914000-memory.dmp	upx
behavioral1/memory/2948-3838-0x000000013F600000-0x000000013F954000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\haWkqyz.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\jaicqRP.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\BdQnfqJ.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\RoacvcF.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\vshigCH.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\JwGXeES.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\RvABTsR.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\gJUOaeD.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\qMqoAHY.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\JPttxjs.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\xEdWZur.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\lWPhptV.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\gdWlnMv.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\BdlZOCH.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\IepGblz.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\IdfkCEa.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\JOchYdr.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\UhAmpjF.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\MVrEUej.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\OTwzeDk.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\QgijQfl.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\WNitbBh.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\EpuOXBj.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\EWEDgMX.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\ueFyLwJ.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\qMFUbFP.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\ODMbWTg.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\lfxjnZQ.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\GngNFOD.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\BKNHSFx.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\KTJnoDS.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\xfjCfMs.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\WBpnZZM.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\PnDBPjz.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\LAqFuOM.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\uPBMFba.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\KmAYEDA.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\FPQgjlY.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\FPkjvJO.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\vnufEmd.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\ITcaBAE.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\mmGBeQe.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\uSGElqx.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\gNzFoFt.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\poommeq.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\lfpizbf.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\CZfApKm.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\SvRzEZZ.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\vbzQAlm.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\phVMtAU.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\GPwfIgO.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\muDMtEV.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\iTTamWs.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\ySfXZRS.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\TBYFbtx.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\PovNdzo.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\dcYYYMg.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\GRhmLrJ.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\QHQjtQA.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\SCyceGX.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\YMdbacU.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\kqqjHfe.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\UiincgO.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
File created	C:\Windows\System\uVEaueb.exe	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
11972	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2228	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	31
PID 2392 wrote to memory of 2228	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	31
PID 2392 wrote to memory of 2228	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	31
PID 2392 wrote to memory of 2584	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	32
PID 2392 wrote to memory of 2584	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	32
PID 2392 wrote to memory of 2584	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	32
PID 2392 wrote to memory of 1692	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	33
PID 2392 wrote to memory of 1692	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	33
PID 2392 wrote to memory of 1692	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	33
PID 2392 wrote to memory of 2948	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	34
PID 2392 wrote to memory of 2948	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	34
PID 2392 wrote to memory of 2948	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	34
PID 2392 wrote to memory of 2264	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	35
PID 2392 wrote to memory of 2264	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	35
PID 2392 wrote to memory of 2264	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	35
PID 2392 wrote to memory of 2260	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	36
PID 2392 wrote to memory of 2260	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	36
PID 2392 wrote to memory of 2260	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	36
PID 2392 wrote to memory of 2912	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	37
PID 2392 wrote to memory of 2912	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	37
PID 2392 wrote to memory of 2912	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	37
PID 2392 wrote to memory of 2928	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	38
PID 2392 wrote to memory of 2928	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	38
PID 2392 wrote to memory of 2928	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	38
PID 2392 wrote to memory of 2840	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	39
PID 2392 wrote to memory of 2840	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	39
PID 2392 wrote to memory of 2840	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	39
PID 2392 wrote to memory of 2816	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	40
PID 2392 wrote to memory of 2816	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	40
PID 2392 wrote to memory of 2816	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	40
PID 2392 wrote to memory of 2944	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	41
PID 2392 wrote to memory of 2944	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	41
PID 2392 wrote to memory of 2944	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	41
PID 2392 wrote to memory of 2904	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	42
PID 2392 wrote to memory of 2904	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	42
PID 2392 wrote to memory of 2904	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	42
PID 2392 wrote to memory of 2760	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	43
PID 2392 wrote to memory of 2760	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	43
PID 2392 wrote to memory of 2760	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	43
PID 2392 wrote to memory of 1504	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	44
PID 2392 wrote to memory of 1504	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	44
PID 2392 wrote to memory of 1504	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	44
PID 2392 wrote to memory of 1828	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	45
PID 2392 wrote to memory of 1828	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	45
PID 2392 wrote to memory of 1828	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	45
PID 2392 wrote to memory of 3016	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	46
PID 2392 wrote to memory of 3016	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	46
PID 2392 wrote to memory of 3016	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	46
PID 2392 wrote to memory of 2964	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	47
PID 2392 wrote to memory of 2964	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	47
PID 2392 wrote to memory of 2964	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	47
PID 2392 wrote to memory of 300	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	48
PID 2392 wrote to memory of 300	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	48
PID 2392 wrote to memory of 300	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	48
PID 2392 wrote to memory of 2568	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	50
PID 2392 wrote to memory of 2568	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	50
PID 2392 wrote to memory of 2568	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	50
PID 2392 wrote to memory of 3000	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	51
PID 2392 wrote to memory of 3000	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	51
PID 2392 wrote to memory of 3000	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	51
PID 2392 wrote to memory of 2036	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	52
PID 2392 wrote to memory of 2036	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	52
PID 2392 wrote to memory of 2036	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	52
PID 2392 wrote to memory of 1236	2392	JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe	53

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9083faa4b507b6f9a02ec40a28f037870b7fef6028d3c407f22f4e86e1cc082b.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\System\gEFFbwB.exe
  C:\Windows\System\gEFFbwB.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\EpuOXBj.exe
  C:\Windows\System\EpuOXBj.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\TETvfSF.exe
  C:\Windows\System\TETvfSF.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\yjyRWGC.exe
  C:\Windows\System\yjyRWGC.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\yCDwUca.exe
  C:\Windows\System\yCDwUca.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\eUVWwpv.exe
  C:\Windows\System\eUVWwpv.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\HnypiMe.exe
  C:\Windows\System\HnypiMe.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\HEyZiVa.exe
  C:\Windows\System\HEyZiVa.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\WhIjQED.exe
  C:\Windows\System\WhIjQED.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\tlbwqCT.exe
  C:\Windows\System\tlbwqCT.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\GRKqITp.exe
  C:\Windows\System\GRKqITp.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\dutKdNy.exe
  C:\Windows\System\dutKdNy.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\qtyXzYd.exe
  C:\Windows\System\qtyXzYd.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\cRRYgEI.exe
  C:\Windows\System\cRRYgEI.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\kSpWiaM.exe
  C:\Windows\System\kSpWiaM.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\AGxtTxU.exe
  C:\Windows\System\AGxtTxU.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\OsbwXwW.exe
  C:\Windows\System\OsbwXwW.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\vPEybTG.exe
  C:\Windows\System\vPEybTG.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\fMkYNmD.exe
  C:\Windows\System\fMkYNmD.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\urRbSdz.exe
  C:\Windows\System\urRbSdz.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\wTSBBRq.exe
  C:\Windows\System\wTSBBRq.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\ZEBFjEn.exe
  C:\Windows\System\ZEBFjEn.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\IptEDHx.exe
  C:\Windows\System\IptEDHx.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\bEZlQyU.exe
  C:\Windows\System\bEZlQyU.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\xEdWZur.exe
  C:\Windows\System\xEdWZur.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\JfjwNsW.exe
  C:\Windows\System\JfjwNsW.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\Qtqowil.exe
  C:\Windows\System\Qtqowil.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\SPunmMO.exe
  C:\Windows\System\SPunmMO.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\plRpyEc.exe
  C:\Windows\System\plRpyEc.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\WOwTghg.exe
  C:\Windows\System\WOwTghg.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\TrEWDoS.exe
  C:\Windows\System\TrEWDoS.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\KfbwPxo.exe
  C:\Windows\System\KfbwPxo.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\KmAYEDA.exe
  C:\Windows\System\KmAYEDA.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\PBmBOVa.exe
  C:\Windows\System\PBmBOVa.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\FyEyzUV.exe
  C:\Windows\System\FyEyzUV.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\GfGnWiL.exe
  C:\Windows\System\GfGnWiL.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\GFTHBbf.exe
  C:\Windows\System\GFTHBbf.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\XsLMiCu.exe
  C:\Windows\System\XsLMiCu.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\vjLsLNQ.exe
  C:\Windows\System\vjLsLNQ.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\uwNIPXf.exe
  C:\Windows\System\uwNIPXf.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\SOsQlFf.exe
  C:\Windows\System\SOsQlFf.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\sYzRCfl.exe
  C:\Windows\System\sYzRCfl.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\INgAgNb.exe
  C:\Windows\System\INgAgNb.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\ZgfzkDR.exe
  C:\Windows\System\ZgfzkDR.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\fLGDGts.exe
  C:\Windows\System\fLGDGts.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\HtOlSlz.exe
  C:\Windows\System\HtOlSlz.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\vvZLqLM.exe
  C:\Windows\System\vvZLqLM.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\IGfRigJ.exe
  C:\Windows\System\IGfRigJ.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\TQEVDpv.exe
  C:\Windows\System\TQEVDpv.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\xaxBeGa.exe
  C:\Windows\System\xaxBeGa.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\WpHPrvh.exe
  C:\Windows\System\WpHPrvh.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\BuEbeXG.exe
  C:\Windows\System\BuEbeXG.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\KePeeBo.exe
  C:\Windows\System\KePeeBo.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\cCQVLzn.exe
  C:\Windows\System\cCQVLzn.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\OOcrYEI.exe
  C:\Windows\System\OOcrYEI.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\ujRMGbe.exe
  C:\Windows\System\ujRMGbe.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\efZFgjD.exe
  C:\Windows\System\efZFgjD.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\KgkyQBD.exe
  C:\Windows\System\KgkyQBD.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\HQcrkzb.exe
  C:\Windows\System\HQcrkzb.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\PMUiPwB.exe
  C:\Windows\System\PMUiPwB.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\iFHBCLc.exe
  C:\Windows\System\iFHBCLc.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\YbZAleF.exe
  C:\Windows\System\YbZAleF.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\JuqlGDI.exe
  C:\Windows\System\JuqlGDI.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\YCOVpRW.exe
  C:\Windows\System\YCOVpRW.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\aEkzMHv.exe
  C:\Windows\System\aEkzMHv.exe
  2⤵
  PID:1444
- C:\Windows\System\ZzGoLAn.exe
  C:\Windows\System\ZzGoLAn.exe
  2⤵
  PID:2768
- C:\Windows\System\CNlNZwL.exe
  C:\Windows\System\CNlNZwL.exe
  2⤵
  PID:1740
- C:\Windows\System\PovNdzo.exe
  C:\Windows\System\PovNdzo.exe
  2⤵
  PID:2920
- C:\Windows\System\YcmiGvL.exe
  C:\Windows\System\YcmiGvL.exe
  2⤵
  PID:2716
- C:\Windows\System\ippGvsJ.exe
  C:\Windows\System\ippGvsJ.exe
  2⤵
  PID:2240
- C:\Windows\System\WIoRjFo.exe
  C:\Windows\System\WIoRjFo.exe
  2⤵
  PID:1324
- C:\Windows\System\bAutNxF.exe
  C:\Windows\System\bAutNxF.exe
  2⤵
  PID:2696
- C:\Windows\System\dQuZfVT.exe
  C:\Windows\System\dQuZfVT.exe
  2⤵
  PID:1044
- C:\Windows\System\IylgNMZ.exe
  C:\Windows\System\IylgNMZ.exe
  2⤵
  PID:2152
- C:\Windows\System\LSxnaBM.exe
  C:\Windows\System\LSxnaBM.exe
  2⤵
  PID:2784
- C:\Windows\System\JKAnuZu.exe
  C:\Windows\System\JKAnuZu.exe
  2⤵
  PID:2740
- C:\Windows\System\kqqjHfe.exe
  C:\Windows\System\kqqjHfe.exe
  2⤵
  PID:1664
- C:\Windows\System\EDjnHYj.exe
  C:\Windows\System\EDjnHYj.exe
  2⤵
  PID:2348
- C:\Windows\System\SDgrjTa.exe
  C:\Windows\System\SDgrjTa.exe
  2⤵
  PID:1092
- C:\Windows\System\wQmGjmW.exe
  C:\Windows\System\wQmGjmW.exe
  2⤵
  PID:2536
- C:\Windows\System\iqwcgZZ.exe
  C:\Windows\System\iqwcgZZ.exe
  2⤵
  PID:2484
- C:\Windows\System\AUhepFi.exe
  C:\Windows\System\AUhepFi.exe
  2⤵
  PID:1716
- C:\Windows\System\NdAFhNT.exe
  C:\Windows\System\NdAFhNT.exe
  2⤵
  PID:2172
- C:\Windows\System\ComCPFA.exe
  C:\Windows\System\ComCPFA.exe
  2⤵
  PID:1088
- C:\Windows\System\ZvdsdbR.exe
  C:\Windows\System\ZvdsdbR.exe
  2⤵
  PID:1428
- C:\Windows\System\rTDnaSS.exe
  C:\Windows\System\rTDnaSS.exe
  2⤵
  PID:2024
- C:\Windows\System\igiyNEY.exe
  C:\Windows\System\igiyNEY.exe
  2⤵
  PID:2528
- C:\Windows\System\ImmrqNi.exe
  C:\Windows\System\ImmrqNi.exe
  2⤵
  PID:1672
- C:\Windows\System\PKWqibp.exe
  C:\Windows\System\PKWqibp.exe
  2⤵
  PID:756
- C:\Windows\System\ZLrHIKx.exe
  C:\Windows\System\ZLrHIKx.exe
  2⤵
  PID:1808
- C:\Windows\System\nxLISQI.exe
  C:\Windows\System\nxLISQI.exe
  2⤵
  PID:1288
- C:\Windows\System\aiMqcfx.exe
  C:\Windows\System\aiMqcfx.exe
  2⤵
  PID:576
- C:\Windows\System\scKfOaM.exe
  C:\Windows\System\scKfOaM.exe
  2⤵
  PID:2304
- C:\Windows\System\hPSgoEt.exe
  C:\Windows\System\hPSgoEt.exe
  2⤵
  PID:2216
- C:\Windows\System\jRNpond.exe
  C:\Windows\System\jRNpond.exe
  2⤵
  PID:1064
- C:\Windows\System\lWPhptV.exe
  C:\Windows\System\lWPhptV.exe
  2⤵
  PID:2140
- C:\Windows\System\ewZHgBi.exe
  C:\Windows\System\ewZHgBi.exe
  2⤵
  PID:888
- C:\Windows\System\nHmJBxD.exe
  C:\Windows\System\nHmJBxD.exe
  2⤵
  PID:1952
- C:\Windows\System\LeFtyOE.exe
  C:\Windows\System\LeFtyOE.exe
  2⤵
  PID:2384
- C:\Windows\System\QmFLgNd.exe
  C:\Windows\System\QmFLgNd.exe
  2⤵
  PID:2624
- C:\Windows\System\ALvJJVb.exe
  C:\Windows\System\ALvJJVb.exe
  2⤵
  PID:2788
- C:\Windows\System\OLpxnsQ.exe
  C:\Windows\System\OLpxnsQ.exe
  2⤵
  PID:2252
- C:\Windows\System\ecVCRDH.exe
  C:\Windows\System\ecVCRDH.exe
  2⤵
  PID:2836
- C:\Windows\System\efldnDT.exe
  C:\Windows\System\efldnDT.exe
  2⤵
  PID:2676
- C:\Windows\System\xAKEpDt.exe
  C:\Windows\System\xAKEpDt.exe
  2⤵
  PID:1380
- C:\Windows\System\AybRazl.exe
  C:\Windows\System\AybRazl.exe
  2⤵
  PID:1960
- C:\Windows\System\hyZpcVp.exe
  C:\Windows\System\hyZpcVp.exe
  2⤵
  PID:1268
- C:\Windows\System\NcuOiPf.exe
  C:\Windows\System\NcuOiPf.exe
  2⤵
  PID:3032
- C:\Windows\System\sqhtLXW.exe
  C:\Windows\System\sqhtLXW.exe
  2⤵
  PID:2328
- C:\Windows\System\THBGauM.exe
  C:\Windows\System\THBGauM.exe
  2⤵
  PID:2544
- C:\Windows\System\XdPJxvd.exe
  C:\Windows\System\XdPJxvd.exe
  2⤵
  PID:1924
- C:\Windows\System\RsdxoYW.exe
  C:\Windows\System\RsdxoYW.exe
  2⤵
  PID:340
- C:\Windows\System\NELBDBS.exe
  C:\Windows\System\NELBDBS.exe
  2⤵
  PID:692
- C:\Windows\System\tGNKMIX.exe
  C:\Windows\System\tGNKMIX.exe
  2⤵
  PID:872
- C:\Windows\System\CBLirKV.exe
  C:\Windows\System\CBLirKV.exe
  2⤵
  PID:2436
- C:\Windows\System\HlfvLPo.exe
  C:\Windows\System\HlfvLPo.exe
  2⤵
  PID:2112
- C:\Windows\System\YOsIosq.exe
  C:\Windows\System\YOsIosq.exe
  2⤵
  PID:3076
- C:\Windows\System\wLCjFwK.exe
  C:\Windows\System\wLCjFwK.exe
  2⤵
  PID:3092
- C:\Windows\System\wNKrPGh.exe
  C:\Windows\System\wNKrPGh.exe
  2⤵
  PID:3108
- C:\Windows\System\uAeXwpJ.exe
  C:\Windows\System\uAeXwpJ.exe
  2⤵
  PID:3124
- C:\Windows\System\gsnDCIj.exe
  C:\Windows\System\gsnDCIj.exe
  2⤵
  PID:3140
- C:\Windows\System\TBtwBgo.exe
  C:\Windows\System\TBtwBgo.exe
  2⤵
  PID:3156
- C:\Windows\System\zQGmfDR.exe
  C:\Windows\System\zQGmfDR.exe
  2⤵
  PID:3172
- C:\Windows\System\XLmjmcR.exe
  C:\Windows\System\XLmjmcR.exe
  2⤵
  PID:3188
- C:\Windows\System\kfmsJQV.exe
  C:\Windows\System\kfmsJQV.exe
  2⤵
  PID:3204
- C:\Windows\System\jPTLmyH.exe
  C:\Windows\System\jPTLmyH.exe
  2⤵
  PID:3220
- C:\Windows\System\bmuAKhR.exe
  C:\Windows\System\bmuAKhR.exe
  2⤵
  PID:3236
- C:\Windows\System\VNfCeuZ.exe
  C:\Windows\System\VNfCeuZ.exe
  2⤵
  PID:3252
- C:\Windows\System\oBHOrcp.exe
  C:\Windows\System\oBHOrcp.exe
  2⤵
  PID:3268
- C:\Windows\System\kwBqizN.exe
  C:\Windows\System\kwBqizN.exe
  2⤵
  PID:3284
- C:\Windows\System\vshigCH.exe
  C:\Windows\System\vshigCH.exe
  2⤵
  PID:3312
- C:\Windows\System\rlMialm.exe
  C:\Windows\System\rlMialm.exe
  2⤵
  PID:3328
- C:\Windows\System\cHYDRXl.exe
  C:\Windows\System\cHYDRXl.exe
  2⤵
  PID:3344
- C:\Windows\System\yKvXbRf.exe
  C:\Windows\System\yKvXbRf.exe
  2⤵
  PID:3360
- C:\Windows\System\WcniZEI.exe
  C:\Windows\System\WcniZEI.exe
  2⤵
  PID:3376
- C:\Windows\System\aJuowVm.exe
  C:\Windows\System\aJuowVm.exe
  2⤵
  PID:3392
- C:\Windows\System\EWEDgMX.exe
  C:\Windows\System\EWEDgMX.exe
  2⤵
  PID:3408
- C:\Windows\System\hIKbfpx.exe
  C:\Windows\System\hIKbfpx.exe
  2⤵
  PID:3424
- C:\Windows\System\WYnarug.exe
  C:\Windows\System\WYnarug.exe
  2⤵
  PID:3440
- C:\Windows\System\KOYgMCS.exe
  C:\Windows\System\KOYgMCS.exe
  2⤵
  PID:3456
- C:\Windows\System\coYmYxA.exe
  C:\Windows\System\coYmYxA.exe
  2⤵
  PID:3472
- C:\Windows\System\YRGWBKS.exe
  C:\Windows\System\YRGWBKS.exe
  2⤵
  PID:3488
- C:\Windows\System\grENRSj.exe
  C:\Windows\System\grENRSj.exe
  2⤵
  PID:3504
- C:\Windows\System\SOxSLwO.exe
  C:\Windows\System\SOxSLwO.exe
  2⤵
  PID:3520
- C:\Windows\System\XEGAsZk.exe
  C:\Windows\System\XEGAsZk.exe
  2⤵
  PID:3536
- C:\Windows\System\sboxnDQ.exe
  C:\Windows\System\sboxnDQ.exe
  2⤵
  PID:3552
- C:\Windows\System\hIgZhYw.exe
  C:\Windows\System\hIgZhYw.exe
  2⤵
  PID:3568
- C:\Windows\System\rcIyrAF.exe
  C:\Windows\System\rcIyrAF.exe
  2⤵
  PID:3584
- C:\Windows\System\EIjJWci.exe
  C:\Windows\System\EIjJWci.exe
  2⤵
  PID:3600
- C:\Windows\System\JaXZWVI.exe
  C:\Windows\System\JaXZWVI.exe
  2⤵
  PID:3616
- C:\Windows\System\oYVRJma.exe
  C:\Windows\System\oYVRJma.exe
  2⤵
  PID:3632
- C:\Windows\System\UiincgO.exe
  C:\Windows\System\UiincgO.exe
  2⤵
  PID:3648
- C:\Windows\System\tmIrIKz.exe
  C:\Windows\System\tmIrIKz.exe
  2⤵
  PID:3664
- C:\Windows\System\wAmJXbA.exe
  C:\Windows\System\wAmJXbA.exe
  2⤵
  PID:3680
- C:\Windows\System\DyDGEJh.exe
  C:\Windows\System\DyDGEJh.exe
  2⤵
  PID:3696
- C:\Windows\System\dVDKcQm.exe
  C:\Windows\System\dVDKcQm.exe
  2⤵
  PID:3712
- C:\Windows\System\hhlARzW.exe
  C:\Windows\System\hhlARzW.exe
  2⤵
  PID:3728
- C:\Windows\System\kThCThV.exe
  C:\Windows\System\kThCThV.exe
  2⤵
  PID:3744
- C:\Windows\System\YTQcoYm.exe
  C:\Windows\System\YTQcoYm.exe
  2⤵
  PID:3760
- C:\Windows\System\juGynkG.exe
  C:\Windows\System\juGynkG.exe
  2⤵
  PID:3776
- C:\Windows\System\mObmulj.exe
  C:\Windows\System\mObmulj.exe
  2⤵
  PID:3792
- C:\Windows\System\degjtcu.exe
  C:\Windows\System\degjtcu.exe
  2⤵
  PID:3808
- C:\Windows\System\bctzdkY.exe
  C:\Windows\System\bctzdkY.exe
  2⤵
  PID:3824
- C:\Windows\System\TRlkImL.exe
  C:\Windows\System\TRlkImL.exe
  2⤵
  PID:3840
- C:\Windows\System\pMvVdKU.exe
  C:\Windows\System\pMvVdKU.exe
  2⤵
  PID:3856
- C:\Windows\System\MKJyKYB.exe
  C:\Windows\System\MKJyKYB.exe
  2⤵
  PID:3872
- C:\Windows\System\KodJMOJ.exe
  C:\Windows\System\KodJMOJ.exe
  2⤵
  PID:3888
- C:\Windows\System\oTIBmmM.exe
  C:\Windows\System\oTIBmmM.exe
  2⤵
  PID:3904
- C:\Windows\System\UJhkvba.exe
  C:\Windows\System\UJhkvba.exe
  2⤵
  PID:3920
- C:\Windows\System\yFVHPyH.exe
  C:\Windows\System\yFVHPyH.exe
  2⤵
  PID:3936
- C:\Windows\System\JxBsAMM.exe
  C:\Windows\System\JxBsAMM.exe
  2⤵
  PID:3952
- C:\Windows\System\iTTamWs.exe
  C:\Windows\System\iTTamWs.exe
  2⤵
  PID:3968
- C:\Windows\System\UfvprRQ.exe
  C:\Windows\System\UfvprRQ.exe
  2⤵
  PID:3984
- C:\Windows\System\jYZrIQk.exe
  C:\Windows\System\jYZrIQk.exe
  2⤵
  PID:4000
- C:\Windows\System\HrRLvgO.exe
  C:\Windows\System\HrRLvgO.exe
  2⤵
  PID:4016
- C:\Windows\System\wbWFCnY.exe
  C:\Windows\System\wbWFCnY.exe
  2⤵
  PID:4032
- C:\Windows\System\HMIOGwL.exe
  C:\Windows\System\HMIOGwL.exe
  2⤵
  PID:4048
- C:\Windows\System\wrULTCJ.exe
  C:\Windows\System\wrULTCJ.exe
  2⤵
  PID:4064
- C:\Windows\System\tTSDzty.exe
  C:\Windows\System\tTSDzty.exe
  2⤵
  PID:4080
- C:\Windows\System\WTgXZcA.exe
  C:\Windows\System\WTgXZcA.exe
  2⤵
  PID:2236
- C:\Windows\System\hELBSEN.exe
  C:\Windows\System\hELBSEN.exe
  2⤵
  PID:2388
- C:\Windows\System\dXsKFes.exe
  C:\Windows\System\dXsKFes.exe
  2⤵
  PID:1584
- C:\Windows\System\PUxkoIV.exe
  C:\Windows\System\PUxkoIV.exe
  2⤵
  PID:2032
- C:\Windows\System\BuugjYN.exe
  C:\Windows\System\BuugjYN.exe
  2⤵
  PID:2692
- C:\Windows\System\aVdaCTq.exe
  C:\Windows\System\aVdaCTq.exe
  2⤵
  PID:1280
- C:\Windows\System\DwxBxHi.exe
  C:\Windows\System\DwxBxHi.exe
  2⤵
  PID:2084
- C:\Windows\System\kDQcHSo.exe
  C:\Windows\System\kDQcHSo.exe
  2⤵
  PID:2332
- C:\Windows\System\WliuTWM.exe
  C:\Windows\System\WliuTWM.exe
  2⤵
  PID:1860
- C:\Windows\System\DyFqUBL.exe
  C:\Windows\System\DyFqUBL.exe
  2⤵
  PID:380
- C:\Windows\System\SfyPmwR.exe
  C:\Windows\System\SfyPmwR.exe
  2⤵
  PID:2168
- C:\Windows\System\ZOPLtNb.exe
  C:\Windows\System\ZOPLtNb.exe
  2⤵
  PID:3084
- C:\Windows\System\UCQCuDp.exe
  C:\Windows\System\UCQCuDp.exe
  2⤵
  PID:3116
- C:\Windows\System\KcASsjx.exe
  C:\Windows\System\KcASsjx.exe
  2⤵
  PID:3164
- C:\Windows\System\hqbeqSJ.exe
  C:\Windows\System\hqbeqSJ.exe
  2⤵
  PID:3196
- C:\Windows\System\zcVVfDz.exe
  C:\Windows\System\zcVVfDz.exe
  2⤵
  PID:308
- C:\Windows\System\HFPDKMf.exe
  C:\Windows\System\HFPDKMf.exe
  2⤵
  PID:3228
- C:\Windows\System\dIRujWQ.exe
  C:\Windows\System\dIRujWQ.exe
  2⤵
  PID:3260
- C:\Windows\System\nqthFjX.exe
  C:\Windows\System\nqthFjX.exe
  2⤵
  PID:3276
- C:\Windows\System\hEzfykc.exe
  C:\Windows\System\hEzfykc.exe
  2⤵
  PID:2720
- C:\Windows\System\PAJdUIz.exe
  C:\Windows\System\PAJdUIz.exe
  2⤵
  PID:3336
- C:\Windows\System\fnkzLBO.exe
  C:\Windows\System\fnkzLBO.exe
  2⤵
  PID:3340
- C:\Windows\System\skulimF.exe
  C:\Windows\System\skulimF.exe
  2⤵
  PID:3368
- C:\Windows\System\PvhFBjl.exe
  C:\Windows\System\PvhFBjl.exe
  2⤵
  PID:3400
- C:\Windows\System\aFtjFNV.exe
  C:\Windows\System\aFtjFNV.exe
  2⤵
  PID:3416
- C:\Windows\System\XbGoczb.exe
  C:\Windows\System\XbGoczb.exe
  2⤵
  PID:1700
- C:\Windows\System\kSjawxX.exe
  C:\Windows\System\kSjawxX.exe
  2⤵
  PID:2712
- C:\Windows\System\KiqgimO.exe
  C:\Windows\System\KiqgimO.exe
  2⤵
  PID:3500
- C:\Windows\System\XjLdERy.exe
  C:\Windows\System\XjLdERy.exe
  2⤵
  PID:3532
- C:\Windows\System\DOJFuex.exe
  C:\Windows\System\DOJFuex.exe
  2⤵
  PID:3560
- C:\Windows\System\ODjHmZi.exe
  C:\Windows\System\ODjHmZi.exe
  2⤵
  PID:3580
- C:\Windows\System\fhusFCt.exe
  C:\Windows\System\fhusFCt.exe
  2⤵
  PID:1976
- C:\Windows\System\rhvutMx.exe
  C:\Windows\System\rhvutMx.exe
  2⤵
  PID:3640
- C:\Windows\System\WCEJOBw.exe
  C:\Windows\System\WCEJOBw.exe
  2⤵
  PID:3672
- C:\Windows\System\IAgUZmx.exe
  C:\Windows\System\IAgUZmx.exe
  2⤵
  PID:3720
- C:\Windows\System\LLcVvNg.exe
  C:\Windows\System\LLcVvNg.exe
  2⤵
  PID:3736
- C:\Windows\System\lDaSnab.exe
  C:\Windows\System\lDaSnab.exe
  2⤵
  PID:3756
- C:\Windows\System\THXohar.exe
  C:\Windows\System\THXohar.exe
  2⤵
  PID:3788
- C:\Windows\System\FrHVRYV.exe
  C:\Windows\System\FrHVRYV.exe
  2⤵
  PID:3820
- C:\Windows\System\txuzlGX.exe
  C:\Windows\System\txuzlGX.exe
  2⤵
  PID:3852
- C:\Windows\System\FQvyzSK.exe
  C:\Windows\System\FQvyzSK.exe
  2⤵
  PID:3884
- C:\Windows\System\MDHLArg.exe
  C:\Windows\System\MDHLArg.exe
  2⤵
  PID:3916
- C:\Windows\System\ErsUgAJ.exe
  C:\Windows\System\ErsUgAJ.exe
  2⤵
  PID:3948
- C:\Windows\System\cNHfVDX.exe
  C:\Windows\System\cNHfVDX.exe
  2⤵
  PID:3980
- C:\Windows\System\bDwxhHV.exe
  C:\Windows\System\bDwxhHV.exe
  2⤵
  PID:4012
- C:\Windows\System\nojyynz.exe
  C:\Windows\System\nojyynz.exe
  2⤵
  PID:4044
- C:\Windows\System\hzltsCO.exe
  C:\Windows\System\hzltsCO.exe
  2⤵
  PID:4076
- C:\Windows\System\SvRzEZZ.exe
  C:\Windows\System\SvRzEZZ.exe
  2⤵
  PID:1916
- C:\Windows\System\VfqCjcw.exe
  C:\Windows\System\VfqCjcw.exe
  2⤵
  PID:2220
- C:\Windows\System\cOazinq.exe
  C:\Windows\System\cOazinq.exe
  2⤵
  PID:1320
- C:\Windows\System\CArEINJ.exe
  C:\Windows\System\CArEINJ.exe
  2⤵
  PID:2364
- C:\Windows\System\pYGIifC.exe
  C:\Windows\System\pYGIifC.exe
  2⤵
  PID:2868
- C:\Windows\System\oAfkpdL.exe
  C:\Windows\System\oAfkpdL.exe
  2⤵
  PID:1856
- C:\Windows\System\TfRiUBK.exe
  C:\Windows\System\TfRiUBK.exe
  2⤵
  PID:3088
- C:\Windows\System\SFDsIxb.exe
  C:\Windows\System\SFDsIxb.exe
  2⤵
  PID:3148
- C:\Windows\System\buQBAHg.exe
  C:\Windows\System\buQBAHg.exe
  2⤵
  PID:3212
- C:\Windows\System\THAezRA.exe
  C:\Windows\System\THAezRA.exe
  2⤵
  PID:3280
- C:\Windows\System\JNMLHfw.exe
  C:\Windows\System\JNMLHfw.exe
  2⤵
  PID:2924
- C:\Windows\System\ntmahMj.exe
  C:\Windows\System\ntmahMj.exe
  2⤵
  PID:2820
- C:\Windows\System\wVdaLXF.exe
  C:\Windows\System\wVdaLXF.exe
  2⤵
  PID:3436
- C:\Windows\System\yoaOsWk.exe
  C:\Windows\System\yoaOsWk.exe
  2⤵
  PID:3496
- C:\Windows\System\FzqTLUM.exe
  C:\Windows\System\FzqTLUM.exe
  2⤵
  PID:3544
- C:\Windows\System\pmLiZIE.exe
  C:\Windows\System\pmLiZIE.exe
  2⤵
  PID:3596
- C:\Windows\System\mGoArTF.exe
  C:\Windows\System\mGoArTF.exe
  2⤵
  PID:3656
- C:\Windows\System\wFBYKnX.exe
  C:\Windows\System\wFBYKnX.exe
  2⤵
  PID:2848
- C:\Windows\System\LDBkFSV.exe
  C:\Windows\System\LDBkFSV.exe
  2⤵
  PID:3784
- C:\Windows\System\hPjBnRd.exe
  C:\Windows\System\hPjBnRd.exe
  2⤵
  PID:3816
- C:\Windows\System\NruynFA.exe
  C:\Windows\System\NruynFA.exe
  2⤵
  PID:3868
- C:\Windows\System\dOFtNOj.exe
  C:\Windows\System\dOFtNOj.exe
  2⤵
  PID:3944
- C:\Windows\System\ABlyTUo.exe
  C:\Windows\System\ABlyTUo.exe
  2⤵
  PID:3996
- C:\Windows\System\NYYYqWC.exe
  C:\Windows\System\NYYYqWC.exe
  2⤵
  PID:4060
- C:\Windows\System\QGdUnNs.exe
  C:\Windows\System\QGdUnNs.exe
  2⤵
  PID:2116
- C:\Windows\System\SwfMvRq.exe
  C:\Windows\System\SwfMvRq.exe
  2⤵
  PID:2512
- C:\Windows\System\FTDCkxW.exe
  C:\Windows\System\FTDCkxW.exe
  2⤵
  PID:2608
- C:\Windows\System\FbfossW.exe
  C:\Windows\System\FbfossW.exe
  2⤵
  PID:3168
- C:\Windows\System\sxFsByn.exe
  C:\Windows\System\sxFsByn.exe
  2⤵
  PID:3264
- C:\Windows\System\lxcAegX.exe
  C:\Windows\System\lxcAegX.exe
  2⤵
  PID:3324
- C:\Windows\System\gQaCoPx.exe
  C:\Windows\System\gQaCoPx.exe
  2⤵
  PID:3448
- C:\Windows\System\dREQVUV.exe
  C:\Windows\System\dREQVUV.exe
  2⤵
  PID:3548
- C:\Windows\System\AyQjzAh.exe
  C:\Windows\System\AyQjzAh.exe
  2⤵
  PID:4104
- C:\Windows\System\ApvRXlw.exe
  C:\Windows\System\ApvRXlw.exe
  2⤵
  PID:4120
- C:\Windows\System\hLRICpN.exe
  C:\Windows\System\hLRICpN.exe
  2⤵
  PID:4136
- C:\Windows\System\zmZriLH.exe
  C:\Windows\System\zmZriLH.exe
  2⤵
  PID:4152
- C:\Windows\System\VwZdlqz.exe
  C:\Windows\System\VwZdlqz.exe
  2⤵
  PID:4168
- C:\Windows\System\OYKJHPm.exe
  C:\Windows\System\OYKJHPm.exe
  2⤵
  PID:4184
- C:\Windows\System\CwRuBvk.exe
  C:\Windows\System\CwRuBvk.exe
  2⤵
  PID:4200
- C:\Windows\System\FNVNZHL.exe
  C:\Windows\System\FNVNZHL.exe
  2⤵
  PID:4216
- C:\Windows\System\iJxJrQc.exe
  C:\Windows\System\iJxJrQc.exe
  2⤵
  PID:4232
- C:\Windows\System\LArBAir.exe
  C:\Windows\System\LArBAir.exe
  2⤵
  PID:4248
- C:\Windows\System\XITokwv.exe
  C:\Windows\System\XITokwv.exe
  2⤵
  PID:4264
- C:\Windows\System\gaYLiaI.exe
  C:\Windows\System\gaYLiaI.exe
  2⤵
  PID:4280
- C:\Windows\System\xOcXBcZ.exe
  C:\Windows\System\xOcXBcZ.exe
  2⤵
  PID:4296
- C:\Windows\System\dxVqkxU.exe
  C:\Windows\System\dxVqkxU.exe
  2⤵
  PID:4312
- C:\Windows\System\DwtbWBB.exe
  C:\Windows\System\DwtbWBB.exe
  2⤵
  PID:4328
- C:\Windows\System\xtsLRKC.exe
  C:\Windows\System\xtsLRKC.exe
  2⤵
  PID:4344
- C:\Windows\System\zroWhEo.exe
  C:\Windows\System\zroWhEo.exe
  2⤵
  PID:4360
- C:\Windows\System\IkfItJo.exe
  C:\Windows\System\IkfItJo.exe
  2⤵
  PID:4376
- C:\Windows\System\JiwEruK.exe
  C:\Windows\System\JiwEruK.exe
  2⤵
  PID:4392
- C:\Windows\System\ueGEuga.exe
  C:\Windows\System\ueGEuga.exe
  2⤵
  PID:4408
- C:\Windows\System\CNldEzR.exe
  C:\Windows\System\CNldEzR.exe
  2⤵
  PID:4424
- C:\Windows\System\UOUgRIR.exe
  C:\Windows\System\UOUgRIR.exe
  2⤵
  PID:4440
- C:\Windows\System\NzHmQHr.exe
  C:\Windows\System\NzHmQHr.exe
  2⤵
  PID:4456
- C:\Windows\System\MAMMMxn.exe
  C:\Windows\System\MAMMMxn.exe
  2⤵
  PID:4472
- C:\Windows\System\WiMLLmp.exe
  C:\Windows\System\WiMLLmp.exe
  2⤵
  PID:4488
- C:\Windows\System\laRTzWe.exe
  C:\Windows\System\laRTzWe.exe
  2⤵
  PID:4504
- C:\Windows\System\VmFQHsc.exe
  C:\Windows\System\VmFQHsc.exe
  2⤵
  PID:4520
- C:\Windows\System\nrdjfsn.exe
  C:\Windows\System\nrdjfsn.exe
  2⤵
  PID:4536
- C:\Windows\System\QeIsgTz.exe
  C:\Windows\System\QeIsgTz.exe
  2⤵
  PID:4552
- C:\Windows\System\NbmLcSF.exe
  C:\Windows\System\NbmLcSF.exe
  2⤵
  PID:4568
- C:\Windows\System\vFHrlCS.exe
  C:\Windows\System\vFHrlCS.exe
  2⤵
  PID:4584
- C:\Windows\System\kdKdAMS.exe
  C:\Windows\System\kdKdAMS.exe
  2⤵
  PID:4600
- C:\Windows\System\WjnqrGf.exe
  C:\Windows\System\WjnqrGf.exe
  2⤵
  PID:4616
- C:\Windows\System\sQdkLkz.exe
  C:\Windows\System\sQdkLkz.exe
  2⤵
  PID:4632
- C:\Windows\System\ZVTxLDh.exe
  C:\Windows\System\ZVTxLDh.exe
  2⤵
  PID:4648
- C:\Windows\System\ZeZrXgo.exe
  C:\Windows\System\ZeZrXgo.exe
  2⤵
  PID:4664
- C:\Windows\System\drAVWeG.exe
  C:\Windows\System\drAVWeG.exe
  2⤵
  PID:4680
- C:\Windows\System\uowxRMi.exe
  C:\Windows\System\uowxRMi.exe
  2⤵
  PID:4696
- C:\Windows\System\iMbsOsG.exe
  C:\Windows\System\iMbsOsG.exe
  2⤵
  PID:4712
- C:\Windows\System\lgbLZbn.exe
  C:\Windows\System\lgbLZbn.exe
  2⤵
  PID:4728
- C:\Windows\System\fUCJYyp.exe
  C:\Windows\System\fUCJYyp.exe
  2⤵
  PID:4744
- C:\Windows\System\XSLEQTI.exe
  C:\Windows\System\XSLEQTI.exe
  2⤵
  PID:4760
- C:\Windows\System\EVtZnQV.exe
  C:\Windows\System\EVtZnQV.exe
  2⤵
  PID:4776
- C:\Windows\System\zhYZXmi.exe
  C:\Windows\System\zhYZXmi.exe
  2⤵
  PID:4792
- C:\Windows\System\oGmGFQY.exe
  C:\Windows\System\oGmGFQY.exe
  2⤵
  PID:4808
- C:\Windows\System\xbdPDsE.exe
  C:\Windows\System\xbdPDsE.exe
  2⤵
  PID:4824
- C:\Windows\System\AjxJmZc.exe
  C:\Windows\System\AjxJmZc.exe
  2⤵
  PID:4840
- C:\Windows\System\gDwDYxE.exe
  C:\Windows\System\gDwDYxE.exe
  2⤵
  PID:4856
- C:\Windows\System\pcGOgEo.exe
  C:\Windows\System\pcGOgEo.exe
  2⤵
  PID:4872
- C:\Windows\System\bLABtXW.exe
  C:\Windows\System\bLABtXW.exe
  2⤵
  PID:4888
- C:\Windows\System\EYrWotH.exe
  C:\Windows\System\EYrWotH.exe
  2⤵
  PID:4904
- C:\Windows\System\OfwdPep.exe
  C:\Windows\System\OfwdPep.exe
  2⤵
  PID:4920
- C:\Windows\System\wlPghLG.exe
  C:\Windows\System\wlPghLG.exe
  2⤵
  PID:4936
- C:\Windows\System\AMjgoPm.exe
  C:\Windows\System\AMjgoPm.exe
  2⤵
  PID:4952
- C:\Windows\System\GRhmLrJ.exe
  C:\Windows\System\GRhmLrJ.exe
  2⤵
  PID:4968
- C:\Windows\System\NdTqHwS.exe
  C:\Windows\System\NdTqHwS.exe
  2⤵
  PID:4984
- C:\Windows\System\potnHva.exe
  C:\Windows\System\potnHva.exe
  2⤵
  PID:5000
- C:\Windows\System\apJUwef.exe
  C:\Windows\System\apJUwef.exe
  2⤵
  PID:5016
- C:\Windows\System\ZFdpnuW.exe
  C:\Windows\System\ZFdpnuW.exe
  2⤵
  PID:5032
- C:\Windows\System\JOchYdr.exe
  C:\Windows\System\JOchYdr.exe
  2⤵
  PID:5048
- C:\Windows\System\WwAEPdy.exe
  C:\Windows\System\WwAEPdy.exe
  2⤵
  PID:5064
- C:\Windows\System\sJrFuwN.exe
  C:\Windows\System\sJrFuwN.exe
  2⤵
  PID:5080
- C:\Windows\System\bnCbpNY.exe
  C:\Windows\System\bnCbpNY.exe
  2⤵
  PID:5096
- C:\Windows\System\WWEqNSC.exe
  C:\Windows\System\WWEqNSC.exe
  2⤵
  PID:5112
- C:\Windows\System\gKifOpr.exe
  C:\Windows\System\gKifOpr.exe
  2⤵
  PID:3692
- C:\Windows\System\ERwETcL.exe
  C:\Windows\System\ERwETcL.exe
  2⤵
  PID:2764
- C:\Windows\System\jcUNovy.exe
  C:\Windows\System\jcUNovy.exe
  2⤵
  PID:3880
- C:\Windows\System\cCqqUFd.exe
  C:\Windows\System\cCqqUFd.exe
  2⤵
  PID:4008
- C:\Windows\System\tDoTmyB.exe
  C:\Windows\System\tDoTmyB.exe
  2⤵
  PID:1964
- C:\Windows\System\rvToXhm.exe
  C:\Windows\System\rvToXhm.exe
  2⤵
  PID:1616
- C:\Windows\System\dhvHcHk.exe
  C:\Windows\System\dhvHcHk.exe
  2⤵
  PID:3296
- C:\Windows\System\dgPEQze.exe
  C:\Windows\System\dgPEQze.exe
  2⤵
  PID:3452
- C:\Windows\System\rAZhtsv.exe
  C:\Windows\System\rAZhtsv.exe
  2⤵
  PID:4112
- C:\Windows\System\onrJFYc.exe
  C:\Windows\System\onrJFYc.exe
  2⤵
  PID:4144
- C:\Windows\System\JDfGxJB.exe
  C:\Windows\System\JDfGxJB.exe
  2⤵
  PID:4176
- C:\Windows\System\JmXUhVc.exe
  C:\Windows\System\JmXUhVc.exe
  2⤵
  PID:4208
- C:\Windows\System\PRMvKfY.exe
  C:\Windows\System\PRMvKfY.exe
  2⤵
  PID:4240
- C:\Windows\System\mQpVkGH.exe
  C:\Windows\System\mQpVkGH.exe
  2⤵
  PID:4272
- C:\Windows\System\gNzFoFt.exe
  C:\Windows\System\gNzFoFt.exe
  2⤵
  PID:4304
- C:\Windows\System\LJdWgHy.exe
  C:\Windows\System\LJdWgHy.exe
  2⤵
  PID:4336
- C:\Windows\System\dLlOCNc.exe
  C:\Windows\System\dLlOCNc.exe
  2⤵
  PID:4368
- C:\Windows\System\VQkpnwG.exe
  C:\Windows\System\VQkpnwG.exe
  2⤵
  PID:4416
- C:\Windows\System\fkPxoaa.exe
  C:\Windows\System\fkPxoaa.exe
  2⤵
  PID:4432
- C:\Windows\System\FXRYOEh.exe
  C:\Windows\System\FXRYOEh.exe
  2⤵
  PID:4464
- C:\Windows\System\MLHtymo.exe
  C:\Windows\System\MLHtymo.exe
  2⤵
  PID:4496
- C:\Windows\System\qfOYEhc.exe
  C:\Windows\System\qfOYEhc.exe
  2⤵
  PID:4544
- C:\Windows\System\XXwhZaV.exe
  C:\Windows\System\XXwhZaV.exe
  2⤵
  PID:4560
- C:\Windows\System\lTkJYFe.exe
  C:\Windows\System\lTkJYFe.exe
  2⤵
  PID:4592
- C:\Windows\System\xwWpyDh.exe
  C:\Windows\System\xwWpyDh.exe
  2⤵
  PID:4624
- C:\Windows\System\NbsxiQN.exe
  C:\Windows\System\NbsxiQN.exe
  2⤵
  PID:4656
- C:\Windows\System\EUqJPwE.exe
  C:\Windows\System\EUqJPwE.exe
  2⤵
  PID:4676
- C:\Windows\System\ySXKIet.exe
  C:\Windows\System\ySXKIet.exe
  2⤵
  PID:4708
- C:\Windows\System\NvKlGNh.exe
  C:\Windows\System\NvKlGNh.exe
  2⤵
  PID:4752
- C:\Windows\System\JwGXeES.exe
  C:\Windows\System\JwGXeES.exe
  2⤵
  PID:4772
- C:\Windows\System\HKJotyV.exe
  C:\Windows\System\HKJotyV.exe
  2⤵
  PID:4788
- C:\Windows\System\cpNvQac.exe
  C:\Windows\System\cpNvQac.exe
  2⤵
  PID:4820
- C:\Windows\System\lqdkvyS.exe
  C:\Windows\System\lqdkvyS.exe
  2⤵
  PID:2900
- C:\Windows\System\SagzWFu.exe
  C:\Windows\System\SagzWFu.exe
  2⤵
  PID:4880
- C:\Windows\System\MukQjfh.exe
  C:\Windows\System\MukQjfh.exe
  2⤵
  PID:4912
- C:\Windows\System\AHUSloX.exe
  C:\Windows\System\AHUSloX.exe
  2⤵
  PID:4944
- C:\Windows\System\RaXJAuG.exe
  C:\Windows\System\RaXJAuG.exe
  2⤵
  PID:4976
- C:\Windows\System\Wlltleu.exe
  C:\Windows\System\Wlltleu.exe
  2⤵
  PID:5008
- C:\Windows\System\agKqXYw.exe
  C:\Windows\System\agKqXYw.exe
  2⤵
  PID:5024
- C:\Windows\System\VbPRixk.exe
  C:\Windows\System\VbPRixk.exe
  2⤵
  PID:5056
- C:\Windows\System\OADIQor.exe
  C:\Windows\System\OADIQor.exe
  2⤵
  PID:5072
- C:\Windows\System\YETZOSu.exe
  C:\Windows\System\YETZOSu.exe
  2⤵
  PID:5092
- C:\Windows\System\OTgtcJr.exe
  C:\Windows\System\OTgtcJr.exe
  2⤵
  PID:5108
- C:\Windows\System\AxcEkur.exe
  C:\Windows\System\AxcEkur.exe
  2⤵
  PID:3848
- C:\Windows\System\VbMmtOd.exe
  C:\Windows\System\VbMmtOd.exe
  2⤵
  PID:4040
- C:\Windows\System\fQvWBWJ.exe
  C:\Windows\System\fQvWBWJ.exe
  2⤵
  PID:3120
- C:\Windows\System\WxZjbMT.exe
  C:\Windows\System\WxZjbMT.exe
  2⤵
  PID:3608
- C:\Windows\System\BdQnfqJ.exe
  C:\Windows\System\BdQnfqJ.exe
  2⤵
  PID:4116
- C:\Windows\System\reKEYCl.exe
  C:\Windows\System\reKEYCl.exe
  2⤵
  PID:4180
- C:\Windows\System\psADPxM.exe
  C:\Windows\System\psADPxM.exe
  2⤵
  PID:4244
- C:\Windows\System\GPTiaLV.exe
  C:\Windows\System\GPTiaLV.exe
  2⤵
  PID:4308
- C:\Windows\System\fWWdlNI.exe
  C:\Windows\System\fWWdlNI.exe
  2⤵
  PID:4372
- C:\Windows\System\zvSDATD.exe
  C:\Windows\System\zvSDATD.exe
  2⤵
  PID:4436
- C:\Windows\System\QHJVqFi.exe
  C:\Windows\System\QHJVqFi.exe
  2⤵
  PID:4500
- C:\Windows\System\ZJHHubJ.exe
  C:\Windows\System\ZJHHubJ.exe
  2⤵
  PID:4564
- C:\Windows\System\zVoXVKs.exe
  C:\Windows\System\zVoXVKs.exe
  2⤵
  PID:4628
- C:\Windows\System\FPQgjlY.exe
  C:\Windows\System\FPQgjlY.exe
  2⤵
  PID:4704
- C:\Windows\System\aXsnscr.exe
  C:\Windows\System\aXsnscr.exe
  2⤵
  PID:4768
- C:\Windows\System\vxNrPJr.exe
  C:\Windows\System\vxNrPJr.exe
  2⤵
  PID:4816
- C:\Windows\System\wpDzLYu.exe
  C:\Windows\System\wpDzLYu.exe
  2⤵
  PID:4868
- C:\Windows\System\hDByMGB.exe
  C:\Windows\System\hDByMGB.exe
  2⤵
  PID:4916
- C:\Windows\System\RvABTsR.exe
  C:\Windows\System\RvABTsR.exe
  2⤵
  PID:4980
- C:\Windows\System\NOiVNNS.exe
  C:\Windows\System\NOiVNNS.exe
  2⤵
  PID:5028
- C:\Windows\System\GhnFBwh.exe
  C:\Windows\System\GhnFBwh.exe
  2⤵
  PID:5076
- C:\Windows\System\CjjKZVD.exe
  C:\Windows\System\CjjKZVD.exe
  2⤵
  PID:3724
- C:\Windows\System\lQKvZgd.exe
  C:\Windows\System\lQKvZgd.exe
  2⤵
  PID:2748
- C:\Windows\System\fSDMPRN.exe
  C:\Windows\System\fSDMPRN.exe
  2⤵
  PID:4100
- C:\Windows\System\RhMWxYv.exe
  C:\Windows\System\RhMWxYv.exe
  2⤵
  PID:4228
- C:\Windows\System\VanrtbK.exe
  C:\Windows\System\VanrtbK.exe
  2⤵
  PID:4356
- C:\Windows\System\Kmjtzbb.exe
  C:\Windows\System\Kmjtzbb.exe
  2⤵
  PID:4484
- C:\Windows\System\EGmHWoB.exe
  C:\Windows\System\EGmHWoB.exe
  2⤵
  PID:4580
- C:\Windows\System\GZgxHnK.exe
  C:\Windows\System\GZgxHnK.exe
  2⤵
  PID:4756
- C:\Windows\System\WkMHbEg.exe
  C:\Windows\System\WkMHbEg.exe
  2⤵
  PID:4884
- C:\Windows\System\NxPJhQA.exe
  C:\Windows\System\NxPJhQA.exe
  2⤵
  PID:2852
- C:\Windows\System\mEWYVeH.exe
  C:\Windows\System\mEWYVeH.exe
  2⤵
  PID:3624
- C:\Windows\System\ZOTiXNb.exe
  C:\Windows\System\ZOTiXNb.exe
  2⤵
  PID:1048
- C:\Windows\System\eDsjJgF.exe
  C:\Windows\System\eDsjJgF.exe
  2⤵
  PID:5136
- C:\Windows\System\BixcNtf.exe
  C:\Windows\System\BixcNtf.exe
  2⤵
  PID:5152
- C:\Windows\System\EdFsQbw.exe
  C:\Windows\System\EdFsQbw.exe
  2⤵
  PID:5168
- C:\Windows\System\zixUzsw.exe
  C:\Windows\System\zixUzsw.exe
  2⤵
  PID:5184
- C:\Windows\System\GJNQKCJ.exe
  C:\Windows\System\GJNQKCJ.exe
  2⤵
  PID:5200
- C:\Windows\System\RfKMbhT.exe
  C:\Windows\System\RfKMbhT.exe
  2⤵
  PID:5216
- C:\Windows\System\CIBpQeX.exe
  C:\Windows\System\CIBpQeX.exe
  2⤵
  PID:5232
- C:\Windows\System\cQVlXeE.exe
  C:\Windows\System\cQVlXeE.exe
  2⤵
  PID:5248
- C:\Windows\System\jRKfjaH.exe
  C:\Windows\System\jRKfjaH.exe
  2⤵
  PID:5264
- C:\Windows\System\uhHLDGF.exe
  C:\Windows\System\uhHLDGF.exe
  2⤵
  PID:5280
- C:\Windows\System\eKDYUvf.exe
  C:\Windows\System\eKDYUvf.exe
  2⤵
  PID:5296
- C:\Windows\System\UDPZzBG.exe
  C:\Windows\System\UDPZzBG.exe
  2⤵
  PID:5312
- C:\Windows\System\OkmCwaW.exe
  C:\Windows\System\OkmCwaW.exe
  2⤵
  PID:5328
- C:\Windows\System\dQrrrXX.exe
  C:\Windows\System\dQrrrXX.exe
  2⤵
  PID:5344
- C:\Windows\System\ByWYHXO.exe
  C:\Windows\System\ByWYHXO.exe
  2⤵
  PID:5360
- C:\Windows\System\SdiqImK.exe
  C:\Windows\System\SdiqImK.exe
  2⤵
  PID:5376
- C:\Windows\System\hcVCecU.exe
  C:\Windows\System\hcVCecU.exe
  2⤵
  PID:5392
- C:\Windows\System\HPquFxV.exe
  C:\Windows\System\HPquFxV.exe
  2⤵
  PID:5408
- C:\Windows\System\YSseAxm.exe
  C:\Windows\System\YSseAxm.exe
  2⤵
  PID:5424
- C:\Windows\System\bWsoUQY.exe
  C:\Windows\System\bWsoUQY.exe
  2⤵
  PID:5440
- C:\Windows\System\ehGUSSr.exe
  C:\Windows\System\ehGUSSr.exe
  2⤵
  PID:5456
- C:\Windows\System\BblzTlo.exe
  C:\Windows\System\BblzTlo.exe
  2⤵
  PID:5472
- C:\Windows\System\lFkncPC.exe
  C:\Windows\System\lFkncPC.exe
  2⤵
  PID:5488
- C:\Windows\System\WIVuNiE.exe
  C:\Windows\System\WIVuNiE.exe
  2⤵
  PID:5504
- C:\Windows\System\JlkvAgt.exe
  C:\Windows\System\JlkvAgt.exe
  2⤵
  PID:5520
- C:\Windows\System\UrcfJMk.exe
  C:\Windows\System\UrcfJMk.exe
  2⤵
  PID:5536
- C:\Windows\System\ZddOqPK.exe
  C:\Windows\System\ZddOqPK.exe
  2⤵
  PID:5552
- C:\Windows\System\YJCqjLv.exe
  C:\Windows\System\YJCqjLv.exe
  2⤵
  PID:5568
- C:\Windows\System\CBrKoNS.exe
  C:\Windows\System\CBrKoNS.exe
  2⤵
  PID:5584
- C:\Windows\System\CKsImac.exe
  C:\Windows\System\CKsImac.exe
  2⤵
  PID:5600
- C:\Windows\System\ySfXZRS.exe
  C:\Windows\System\ySfXZRS.exe
  2⤵
  PID:5616
- C:\Windows\System\xZEcjWQ.exe
  C:\Windows\System\xZEcjWQ.exe
  2⤵
  PID:5632
- C:\Windows\System\erEHDie.exe
  C:\Windows\System\erEHDie.exe
  2⤵
  PID:5648
- C:\Windows\System\PqIvIQc.exe
  C:\Windows\System\PqIvIQc.exe
  2⤵
  PID:5664
- C:\Windows\System\NEeKSBO.exe
  C:\Windows\System\NEeKSBO.exe
  2⤵
  PID:5680
- C:\Windows\System\gJUOaeD.exe
  C:\Windows\System\gJUOaeD.exe
  2⤵
  PID:5696
- C:\Windows\System\uDdUdPi.exe
  C:\Windows\System\uDdUdPi.exe
  2⤵
  PID:5712
- C:\Windows\System\YNsGSUQ.exe
  C:\Windows\System\YNsGSUQ.exe
  2⤵
  PID:5728
- C:\Windows\System\DrvOxQo.exe
  C:\Windows\System\DrvOxQo.exe
  2⤵
  PID:5744
- C:\Windows\System\IJZWmeW.exe
  C:\Windows\System\IJZWmeW.exe
  2⤵
  PID:5760
- C:\Windows\System\yFhzCUQ.exe
  C:\Windows\System\yFhzCUQ.exe
  2⤵
  PID:5776
- C:\Windows\System\jIlaRpm.exe
  C:\Windows\System\jIlaRpm.exe
  2⤵
  PID:5792
- C:\Windows\System\noaEKco.exe
  C:\Windows\System\noaEKco.exe
  2⤵
  PID:5808
- C:\Windows\System\DeVXmsO.exe
  C:\Windows\System\DeVXmsO.exe
  2⤵
  PID:5824
- C:\Windows\System\roqsTTg.exe
  C:\Windows\System\roqsTTg.exe
  2⤵
  PID:5840
- C:\Windows\System\SYhEGQP.exe
  C:\Windows\System\SYhEGQP.exe
  2⤵
  PID:5856
- C:\Windows\System\MzwfaNe.exe
  C:\Windows\System\MzwfaNe.exe
  2⤵
  PID:5872
- C:\Windows\System\UIaxjwg.exe
  C:\Windows\System\UIaxjwg.exe
  2⤵
  PID:5888
- C:\Windows\System\LRWTDwu.exe
  C:\Windows\System\LRWTDwu.exe
  2⤵
  PID:5904
- C:\Windows\System\YPSbTUK.exe
  C:\Windows\System\YPSbTUK.exe
  2⤵
  PID:5920
- C:\Windows\System\YEXnDCz.exe
  C:\Windows\System\YEXnDCz.exe
  2⤵
  PID:5936
- C:\Windows\System\LdVIxJA.exe
  C:\Windows\System\LdVIxJA.exe
  2⤵
  PID:5952
- C:\Windows\System\OSIYNhI.exe
  C:\Windows\System\OSIYNhI.exe
  2⤵
  PID:5968
- C:\Windows\System\GuNDMWL.exe
  C:\Windows\System\GuNDMWL.exe
  2⤵
  PID:5984
- C:\Windows\System\KZEOGKN.exe
  C:\Windows\System\KZEOGKN.exe
  2⤵
  PID:6000
- C:\Windows\System\pIPOYJA.exe
  C:\Windows\System\pIPOYJA.exe
  2⤵
  PID:6016
- C:\Windows\System\poommeq.exe
  C:\Windows\System\poommeq.exe
  2⤵
  PID:6032
- C:\Windows\System\IwLVbNd.exe
  C:\Windows\System\IwLVbNd.exe
  2⤵
  PID:6048
- C:\Windows\System\gqHlejA.exe
  C:\Windows\System\gqHlejA.exe
  2⤵
  PID:6064
- C:\Windows\System\CPtRrGH.exe
  C:\Windows\System\CPtRrGH.exe
  2⤵
  PID:6080
- C:\Windows\System\kmuwSoq.exe
  C:\Windows\System\kmuwSoq.exe
  2⤵
  PID:6096
- C:\Windows\System\inNWmdz.exe
  C:\Windows\System\inNWmdz.exe
  2⤵
  PID:6112
- C:\Windows\System\NiMoGOz.exe
  C:\Windows\System\NiMoGOz.exe
  2⤵
  PID:6128
- C:\Windows\System\eewkHzh.exe
  C:\Windows\System\eewkHzh.exe
  2⤵
  PID:3232
- C:\Windows\System\QCygSPR.exe
  C:\Windows\System\QCygSPR.exe
  2⤵
  PID:4260
- C:\Windows\System\FYAFqJM.exe
  C:\Windows\System\FYAFqJM.exe
  2⤵
  PID:4516
- C:\Windows\System\Ztlbiqa.exe
  C:\Windows\System\Ztlbiqa.exe
  2⤵
  PID:4692
- C:\Windows\System\SNAkWMb.exe
  C:\Windows\System\SNAkWMb.exe
  2⤵
  PID:2248
- C:\Windows\System\sQYajzM.exe
  C:\Windows\System\sQYajzM.exe
  2⤵
  PID:5128
- C:\Windows\System\OtWPqrX.exe
  C:\Windows\System\OtWPqrX.exe
  2⤵
  PID:5160
- C:\Windows\System\oZKQtWt.exe
  C:\Windows\System\oZKQtWt.exe
  2⤵
  PID:1592
- C:\Windows\System\jFrWyhy.exe
  C:\Windows\System\jFrWyhy.exe
  2⤵
  PID:5224
- C:\Windows\System\mvnIGsR.exe
  C:\Windows\System\mvnIGsR.exe
  2⤵
  PID:5240
- C:\Windows\System\kZftWPa.exe
  C:\Windows\System\kZftWPa.exe
  2⤵
  PID:5272
- C:\Windows\System\UtuvuqU.exe
  C:\Windows\System\UtuvuqU.exe
  2⤵
  PID:5304
- C:\Windows\System\lZaEmUA.exe
  C:\Windows\System\lZaEmUA.exe
  2⤵
  PID:5336
- C:\Windows\System\lKOpOac.exe
  C:\Windows\System\lKOpOac.exe
  2⤵
  PID:5368
- C:\Windows\System\RBUaOMo.exe
  C:\Windows\System\RBUaOMo.exe
  2⤵
  PID:5400
- C:\Windows\System\krJpuOV.exe
  C:\Windows\System\krJpuOV.exe
  2⤵
  PID:5432
- C:\Windows\System\KzrbJbm.exe
  C:\Windows\System\KzrbJbm.exe
  2⤵
  PID:5464
- C:\Windows\System\mIVtfxN.exe
  C:\Windows\System\mIVtfxN.exe
  2⤵
  PID:5496
- C:\Windows\System\ILEQbbU.exe
  C:\Windows\System\ILEQbbU.exe
  2⤵
  PID:5528
- C:\Windows\System\ZHEhdVj.exe
  C:\Windows\System\ZHEhdVj.exe
  2⤵
  PID:5560
- C:\Windows\System\TiqkIJE.exe
  C:\Windows\System\TiqkIJE.exe
  2⤵
  PID:5592
- C:\Windows\System\JrdjmaY.exe
  C:\Windows\System\JrdjmaY.exe
  2⤵
  PID:5624
- C:\Windows\System\cPTvmRp.exe
  C:\Windows\System\cPTvmRp.exe
  2⤵
  PID:5656
- C:\Windows\System\tSTExDY.exe
  C:\Windows\System\tSTExDY.exe
  2⤵
  PID:5660
- C:\Windows\System\ldDmDCF.exe
  C:\Windows\System\ldDmDCF.exe
  2⤵
  PID:5704
- C:\Windows\System\VnJljIi.exe
  C:\Windows\System\VnJljIi.exe
  2⤵
  PID:5736
- C:\Windows\System\pQHtpiv.exe
  C:\Windows\System\pQHtpiv.exe
  2⤵
  PID:5768
- C:\Windows\System\lRmKKun.exe
  C:\Windows\System\lRmKKun.exe
  2⤵
  PID:5800
- C:\Windows\System\JQAGBkO.exe
  C:\Windows\System\JQAGBkO.exe
  2⤵
  PID:5832
- C:\Windows\System\UsrqADb.exe
  C:\Windows\System\UsrqADb.exe
  2⤵
  PID:5864
- C:\Windows\System\rcmbAJt.exe
  C:\Windows\System\rcmbAJt.exe
  2⤵
  PID:5896
- C:\Windows\System\snZBexe.exe
  C:\Windows\System\snZBexe.exe
  2⤵
  PID:5928
- C:\Windows\System\BEuJERw.exe
  C:\Windows\System\BEuJERw.exe
  2⤵
  PID:5948
- C:\Windows\System\WXwILLi.exe
  C:\Windows\System\WXwILLi.exe
  2⤵
  PID:5980
- C:\Windows\System\VtAIapD.exe
  C:\Windows\System\VtAIapD.exe
  2⤵
  PID:6012
- C:\Windows\System\oiAaEvv.exe
  C:\Windows\System\oiAaEvv.exe
  2⤵
  PID:6044
- C:\Windows\System\FTrgNab.exe
  C:\Windows\System\FTrgNab.exe
  2⤵
  PID:6076
- C:\Windows\System\UhAmpjF.exe
  C:\Windows\System\UhAmpjF.exe
  2⤵
  PID:6108
- C:\Windows\System\jBvSjCU.exe
  C:\Windows\System\jBvSjCU.exe
  2⤵
  PID:6140
- C:\Windows\System\idmXEex.exe
  C:\Windows\System\idmXEex.exe
  2⤵
  PID:4724
- C:\Windows\System\lwcQcIP.exe
  C:\Windows\System\lwcQcIP.exe
  2⤵
  PID:5040
- C:\Windows\System\pGWXGrv.exe
  C:\Windows\System\pGWXGrv.exe
  2⤵
  PID:5148
- C:\Windows\System\wXdIoWM.exe
  C:\Windows\System\wXdIoWM.exe
  2⤵
  PID:5208
- C:\Windows\System\OevaYAH.exe
  C:\Windows\System\OevaYAH.exe
  2⤵
  PID:5260
- C:\Windows\System\SoRlTxO.exe
  C:\Windows\System\SoRlTxO.exe
  2⤵
  PID:5340
- C:\Windows\System\bKLnkEQ.exe
  C:\Windows\System\bKLnkEQ.exe
  2⤵
  PID:5404
- C:\Windows\System\qtydySB.exe
  C:\Windows\System\qtydySB.exe
  2⤵
  PID:5468
- C:\Windows\System\iurSyMx.exe
  C:\Windows\System\iurSyMx.exe
  2⤵
  PID:5516
- C:\Windows\System\byXIOKS.exe
  C:\Windows\System\byXIOKS.exe
  2⤵
  PID:5580
- C:\Windows\System\CftSMov.exe
  C:\Windows\System\CftSMov.exe
  2⤵
  PID:5644
- C:\Windows\System\qMqoAHY.exe
  C:\Windows\System\qMqoAHY.exe
  2⤵
  PID:5692
- C:\Windows\System\DSCyDxf.exe
  C:\Windows\System\DSCyDxf.exe
  2⤵
  PID:5756
- C:\Windows\System\jfvNZqZ.exe
  C:\Windows\System\jfvNZqZ.exe
  2⤵
  PID:5820
- C:\Windows\System\sKvwJJC.exe
  C:\Windows\System\sKvwJJC.exe
  2⤵
  PID:3308
- C:\Windows\System\XhhESSM.exe
  C:\Windows\System\XhhESSM.exe
  2⤵
  PID:5900
- C:\Windows\System\CHtuZse.exe
  C:\Windows\System\CHtuZse.exe
  2⤵
  PID:5964
- C:\Windows\System\qSXvJLh.exe
  C:\Windows\System\qSXvJLh.exe
  2⤵
  PID:6028
- C:\Windows\System\BeSXqaS.exe
  C:\Windows\System\BeSXqaS.exe
  2⤵
  PID:6092
- C:\Windows\System\fHxjHvx.exe
  C:\Windows\System\fHxjHvx.exe
  2⤵
  PID:4340
- C:\Windows\System\XtULYUS.exe
  C:\Windows\System\XtULYUS.exe
  2⤵
  PID:1812
- C:\Windows\System\cXAAGlt.exe
  C:\Windows\System\cXAAGlt.exe
  2⤵
  PID:5228
- C:\Windows\System\zGLTIbR.exe
  C:\Windows\System\zGLTIbR.exe
  2⤵
  PID:5308
- C:\Windows\System\vNIXJoZ.exe
  C:\Windows\System\vNIXJoZ.exe
  2⤵
  PID:5436
- C:\Windows\System\aGBWnmc.exe
  C:\Windows\System\aGBWnmc.exe
  2⤵
  PID:5576
- C:\Windows\System\LlqHRSD.exe
  C:\Windows\System\LlqHRSD.exe
  2⤵
  PID:5688
- C:\Windows\System\XXJyiHl.exe
  C:\Windows\System\XXJyiHl.exe
  2⤵
  PID:5816
- C:\Windows\System\ENCAase.exe
  C:\Windows\System\ENCAase.exe
  2⤵
  PID:5880
- C:\Windows\System\mNGvfIC.exe
  C:\Windows\System\mNGvfIC.exe
  2⤵
  PID:6008
- C:\Windows\System\aZbOxcP.exe
  C:\Windows\System\aZbOxcP.exe
  2⤵
  PID:6156
- C:\Windows\System\RVqOgTv.exe
  C:\Windows\System\RVqOgTv.exe
  2⤵
  PID:6172
- C:\Windows\System\HUCyefP.exe
  C:\Windows\System\HUCyefP.exe
  2⤵
  PID:6188
- C:\Windows\System\sfLNbJE.exe
  C:\Windows\System\sfLNbJE.exe
  2⤵
  PID:6204
- C:\Windows\System\mBBgYGD.exe
  C:\Windows\System\mBBgYGD.exe
  2⤵
  PID:6220
- C:\Windows\System\dsMHXgO.exe
  C:\Windows\System\dsMHXgO.exe
  2⤵
  PID:6240
- C:\Windows\System\AbKZFvF.exe
  C:\Windows\System\AbKZFvF.exe
  2⤵
  PID:6256
- C:\Windows\System\nEjgBGw.exe
  C:\Windows\System\nEjgBGw.exe
  2⤵
  PID:6272
- C:\Windows\System\IYrBqrC.exe
  C:\Windows\System\IYrBqrC.exe
  2⤵
  PID:6288
- C:\Windows\System\WBpnZZM.exe
  C:\Windows\System\WBpnZZM.exe
  2⤵
  PID:6304
- C:\Windows\System\eKmmjCQ.exe
  C:\Windows\System\eKmmjCQ.exe
  2⤵
  PID:6320
- C:\Windows\System\WVnZGdR.exe
  C:\Windows\System\WVnZGdR.exe
  2⤵
  PID:6336
- C:\Windows\System\lZsklKF.exe
  C:\Windows\System\lZsklKF.exe
  2⤵
  PID:6352
- C:\Windows\System\HXyjbkp.exe
  C:\Windows\System\HXyjbkp.exe
  2⤵
  PID:6368
- C:\Windows\System\ehaUuQU.exe
  C:\Windows\System\ehaUuQU.exe
  2⤵
  PID:6384
- C:\Windows\System\umpIEKb.exe
  C:\Windows\System\umpIEKb.exe
  2⤵
  PID:6400
- C:\Windows\System\uSrTtGx.exe
  C:\Windows\System\uSrTtGx.exe
  2⤵
  PID:6904
- C:\Windows\System\SuwZJdH.exe
  C:\Windows\System\SuwZJdH.exe
  2⤵
  PID:6920
- C:\Windows\System\LzFgnMq.exe
  C:\Windows\System\LzFgnMq.exe
  2⤵
  PID:6944
- C:\Windows\System\qwacKuA.exe
  C:\Windows\System\qwacKuA.exe
  2⤵
  PID:6976
- C:\Windows\System\ZpFbDrA.exe
  C:\Windows\System\ZpFbDrA.exe
  2⤵
  PID:7012
- C:\Windows\System\tVocLVX.exe
  C:\Windows\System\tVocLVX.exe
  2⤵
  PID:7044
- C:\Windows\System\PmZchvP.exe
  C:\Windows\System\PmZchvP.exe
  2⤵
  PID:7084
- C:\Windows\System\YgMCxoi.exe
  C:\Windows\System\YgMCxoi.exe
  2⤵
  PID:7112
- C:\Windows\System\QphkGxH.exe
  C:\Windows\System\QphkGxH.exe
  2⤵
  PID:7148
- C:\Windows\System\phVMtAU.exe
  C:\Windows\System\phVMtAU.exe
  2⤵
  PID:5196
- C:\Windows\System\sJFaZQB.exe
  C:\Windows\System\sJFaZQB.exe
  2⤵
  PID:6248
- C:\Windows\System\QVucapc.exe
  C:\Windows\System\QVucapc.exe
  2⤵
  PID:6168
- C:\Windows\System\KfsfHBq.exe
  C:\Windows\System\KfsfHBq.exe
  2⤵
  PID:6652
- C:\Windows\System\jnlGaWd.exe
  C:\Windows\System\jnlGaWd.exe
  2⤵
  PID:6668
- C:\Windows\System\tPEyRio.exe
  C:\Windows\System\tPEyRio.exe
  2⤵
  PID:6684
- C:\Windows\System\TUniPDM.exe
  C:\Windows\System\TUniPDM.exe
  2⤵
  PID:6700
- C:\Windows\System\lCEsxWA.exe
  C:\Windows\System\lCEsxWA.exe
  2⤵
  PID:6716
- C:\Windows\System\zEaAGHV.exe
  C:\Windows\System\zEaAGHV.exe
  2⤵
  PID:6732
- C:\Windows\System\GJymDYf.exe
  C:\Windows\System\GJymDYf.exe
  2⤵
  PID:6748
- C:\Windows\System\PUwAUbP.exe
  C:\Windows\System\PUwAUbP.exe
  2⤵
  PID:6760
- C:\Windows\System\uuemZnY.exe
  C:\Windows\System\uuemZnY.exe
  2⤵
  PID:6776
- C:\Windows\System\QToAIUG.exe
  C:\Windows\System\QToAIUG.exe
  2⤵
  PID:6792
- C:\Windows\System\vfreXus.exe
  C:\Windows\System\vfreXus.exe
  2⤵
  PID:6808
- C:\Windows\System\chgNFlF.exe
  C:\Windows\System\chgNFlF.exe
  2⤵
  PID:6824
- C:\Windows\System\aokRdiv.exe
  C:\Windows\System\aokRdiv.exe
  2⤵
  PID:6844
- C:\Windows\System\tSMkMVK.exe
  C:\Windows\System\tSMkMVK.exe
  2⤵
  PID:6860
- C:\Windows\System\PBlTMRr.exe
  C:\Windows\System\PBlTMRr.exe
  2⤵
  PID:6876
- C:\Windows\System\nTcQmOm.exe
  C:\Windows\System\nTcQmOm.exe
  2⤵
  PID:6896
- C:\Windows\System\XkJICSq.exe
  C:\Windows\System\XkJICSq.exe
  2⤵
  PID:6984
- C:\Windows\System\xNdRfGr.exe
  C:\Windows\System\xNdRfGr.exe
  2⤵
  PID:7000
- C:\Windows\System\BitnRub.exe
  C:\Windows\System\BitnRub.exe
  2⤵
  PID:7056
- C:\Windows\System\SEheRRe.exe
  C:\Windows\System\SEheRRe.exe
  2⤵
  PID:7072
- C:\Windows\System\lvXByXb.exe
  C:\Windows\System\lvXByXb.exe
  2⤵
  PID:7124
- C:\Windows\System\cQiPYQS.exe
  C:\Windows\System\cQiPYQS.exe
  2⤵
  PID:7140
- C:\Windows\System\oXnpynb.exe
  C:\Windows\System\oXnpynb.exe
  2⤵
  PID:5420
- C:\Windows\System\htlJRsE.exe
  C:\Windows\System\htlJRsE.exe
  2⤵
  PID:1552
- C:\Windows\System\YcJwsIM.exe
  C:\Windows\System\YcJwsIM.exe
  2⤵
  PID:1852
- C:\Windows\System\pYmYfMs.exe
  C:\Windows\System\pYmYfMs.exe
  2⤵
  PID:6232
- C:\Windows\System\RoacvcF.exe
  C:\Windows\System\RoacvcF.exe
  2⤵
  PID:6148
- C:\Windows\System\fNbSsqY.exe
  C:\Windows\System\fNbSsqY.exe
  2⤵
  PID:2800
- C:\Windows\System\wNzxioU.exe
  C:\Windows\System\wNzxioU.exe
  2⤵
  PID:6332
- C:\Windows\System\BIjtXyF.exe
  C:\Windows\System\BIjtXyF.exe
  2⤵
  PID:1760
- C:\Windows\System\tKbNzdH.exe
  C:\Windows\System\tKbNzdH.exe
  2⤵
  PID:6212
- C:\Windows\System\pjCDACK.exe
  C:\Windows\System\pjCDACK.exe
  2⤵
  PID:268
- C:\Windows\System\IIRTdrv.exe
  C:\Windows\System\IIRTdrv.exe
  2⤵
  PID:848
- C:\Windows\System\OVxcTdD.exe
  C:\Windows\System\OVxcTdD.exe
  2⤵
  PID:1996
- C:\Windows\System\KfLGTfZ.exe
  C:\Windows\System\KfLGTfZ.exe
  2⤵
  PID:3056
- C:\Windows\System\bZgcVin.exe
  C:\Windows\System\bZgcVin.exe
  2⤵
  PID:6316
- C:\Windows\System\RrUgIDA.exe
  C:\Windows\System\RrUgIDA.exe
  2⤵
  PID:6440
- C:\Windows\System\bvzcAXc.exe
  C:\Windows\System\bvzcAXc.exe
  2⤵
  PID:4740
- C:\Windows\System\RuEfBVF.exe
  C:\Windows\System\RuEfBVF.exe
  2⤵
  PID:584
- C:\Windows\System\SQiFYDh.exe
  C:\Windows\System\SQiFYDh.exe
  2⤵
  PID:7156
- C:\Windows\System\FtVuvsH.exe
  C:\Windows\System\FtVuvsH.exe
  2⤵
  PID:6960
- C:\Windows\System\BYySuCr.exe
  C:\Windows\System\BYySuCr.exe
  2⤵
  PID:7028
- C:\Windows\System\muccUnl.exe
  C:\Windows\System\muccUnl.exe
  2⤵
  PID:7104
- C:\Windows\System\mKhJTow.exe
  C:\Windows\System\mKhJTow.exe
  2⤵
  PID:6136
- C:\Windows\System\qNTNlKa.exe
  C:\Windows\System\qNTNlKa.exe
  2⤵
  PID:5292
- C:\Windows\System\hWXoXcg.exe
  C:\Windows\System\hWXoXcg.exe
  2⤵
  PID:5788
- C:\Windows\System\CKhWaKr.exe
  C:\Windows\System\CKhWaKr.exe
  2⤵
  PID:6912
- C:\Windows\System\pFwUevL.exe
  C:\Windows\System\pFwUevL.exe
  2⤵
  PID:6968
- C:\Windows\System\tfHaWqL.exe
  C:\Windows\System\tfHaWqL.exe
  2⤵
  PID:1256
- C:\Windows\System\QHQjtQA.exe
  C:\Windows\System\QHQjtQA.exe
  2⤵
  PID:6528
- C:\Windows\System\HoDbJYO.exe
  C:\Windows\System\HoDbJYO.exe
  2⤵
  PID:6616
- C:\Windows\System\XaXIlld.exe
  C:\Windows\System\XaXIlld.exe
  2⤵
  PID:6508
- C:\Windows\System\vFrIBCk.exe
  C:\Windows\System\vFrIBCk.exe
  2⤵
  PID:6468
- C:\Windows\System\tzHFBYn.exe
  C:\Windows\System\tzHFBYn.exe
  2⤵
  PID:6236
- C:\Windows\System\CPBFGQp.exe
  C:\Windows\System\CPBFGQp.exe
  2⤵
  PID:6496
- C:\Windows\System\KYDmAYx.exe
  C:\Windows\System\KYDmAYx.exe
  2⤵
  PID:6532
- C:\Windows\System\cRtdlaH.exe
  C:\Windows\System\cRtdlaH.exe
  2⤵
  PID:6520
- C:\Windows\System\hHcLqgP.exe
  C:\Windows\System\hHcLqgP.exe
  2⤵
  PID:6540
- C:\Windows\System\oByzRkc.exe
  C:\Windows\System\oByzRkc.exe
  2⤵
  PID:6568
- C:\Windows\System\kLzfvHJ.exe
  C:\Windows\System\kLzfvHJ.exe
  2⤵
  PID:6584
- C:\Windows\System\FTyAMCB.exe
  C:\Windows\System\FTyAMCB.exe
  2⤵
  PID:6608
- C:\Windows\System\IHjmyMv.exe
  C:\Windows\System\IHjmyMv.exe
  2⤵
  PID:6628
- C:\Windows\System\aOCLYSQ.exe
  C:\Windows\System\aOCLYSQ.exe
  2⤵
  PID:6648
- C:\Windows\System\eSKnrMi.exe
  C:\Windows\System\eSKnrMi.exe
  2⤵
  PID:6692
- C:\Windows\System\fOUpQzg.exe
  C:\Windows\System\fOUpQzg.exe
  2⤵
  PID:6784
- C:\Windows\System\MSEVCfD.exe
  C:\Windows\System\MSEVCfD.exe
  2⤵
  PID:6804
- C:\Windows\System\vivUUGy.exe
  C:\Windows\System\vivUUGy.exe
  2⤵
  PID:6872
- C:\Windows\System\KhITFJf.exe
  C:\Windows\System\KhITFJf.exe
  2⤵
  PID:7052
- C:\Windows\System\mDhqcNt.exe
  C:\Windows\System\mDhqcNt.exe
  2⤵
  PID:5372
- C:\Windows\System\BxfbDLq.exe
  C:\Windows\System\BxfbDLq.exe
  2⤵
  PID:6740
- C:\Windows\System\iFmKolh.exe
  C:\Windows\System\iFmKolh.exe
  2⤵
  PID:5752
- C:\Windows\System\elZvTPS.exe
  C:\Windows\System\elZvTPS.exe
  2⤵
  PID:6364
- C:\Windows\System\LswVMRD.exe
  C:\Windows\System\LswVMRD.exe
  2⤵
  PID:6856
- C:\Windows\System\TErVIeo.exe
  C:\Windows\System\TErVIeo.exe
  2⤵
  PID:7132
- C:\Windows\System\ItRizOY.exe
  C:\Windows\System\ItRizOY.exe
  2⤵
  PID:6228
- C:\Windows\System\nPiIDDJ.exe
  C:\Windows\System\nPiIDDJ.exe
  2⤵
  PID:1540
- C:\Windows\System\liKxrud.exe
  C:\Windows\System\liKxrud.exe
  2⤵
  PID:6888
- C:\Windows\System\tMPUNxV.exe
  C:\Windows\System\tMPUNxV.exe
  2⤵
  PID:6392
- C:\Windows\System\DdkpISQ.exe
  C:\Windows\System\DdkpISQ.exe
  2⤵
  PID:3300
- C:\Windows\System\dmBgCJo.exe
  C:\Windows\System\dmBgCJo.exe
  2⤵
  PID:828
- C:\Windows\System\fNAsJPG.exe
  C:\Windows\System\fNAsJPG.exe
  2⤵
  PID:3012
- C:\Windows\System\UyuJMFm.exe
  C:\Windows\System\UyuJMFm.exe
  2⤵
  PID:7160
- C:\Windows\System\jzcOWkj.exe
  C:\Windows\System\jzcOWkj.exe
  2⤵
  PID:6072
- C:\Windows\System\FRWuNPt.exe
  C:\Windows\System\FRWuNPt.exe
  2⤵
  PID:7020
- C:\Windows\System\lsTvGfa.exe
  C:\Windows\System\lsTvGfa.exe
  2⤵
  PID:2864
- C:\Windows\System\yEHEkeC.exe
  C:\Windows\System\yEHEkeC.exe
  2⤵
  PID:7100
- C:\Windows\System\GZhaRim.exe
  C:\Windows\System\GZhaRim.exe
  2⤵
  PID:6436
- C:\Windows\System\FiAPcpT.exe
  C:\Windows\System\FiAPcpT.exe
  2⤵
  PID:6916
- C:\Windows\System\RKTOhha.exe
  C:\Windows\System\RKTOhha.exe
  2⤵
  PID:1908
- C:\Windows\System\tqmVTkm.exe
  C:\Windows\System\tqmVTkm.exe
  2⤵
  PID:6516
- C:\Windows\System\FOfwfAr.exe
  C:\Windows\System\FOfwfAr.exe
  2⤵
  PID:6552
- C:\Windows\System\LAqFuOM.exe
  C:\Windows\System\LAqFuOM.exe
  2⤵
  PID:6744
- C:\Windows\System\KodhpWF.exe
  C:\Windows\System\KodhpWF.exe
  2⤵
  PID:6480
- C:\Windows\System\FbiSpEm.exe
  C:\Windows\System\FbiSpEm.exe
  2⤵
  PID:6900
- C:\Windows\System\yfcYnfn.exe
  C:\Windows\System\yfcYnfn.exe
  2⤵
  PID:5548
- C:\Windows\System\OWFHddx.exe
  C:\Windows\System\OWFHddx.exe
  2⤵
  PID:6296
- C:\Windows\System\FKGcTmr.exe
  C:\Windows\System\FKGcTmr.exe
  2⤵
  PID:7172
- C:\Windows\System\ZyaPvpd.exe
  C:\Windows\System\ZyaPvpd.exe
  2⤵
  PID:7188
- C:\Windows\System\JfPrMtC.exe
  C:\Windows\System\JfPrMtC.exe
  2⤵
  PID:7204
- C:\Windows\System\gULxunm.exe
  C:\Windows\System\gULxunm.exe
  2⤵
  PID:7220
- C:\Windows\System\NrRksKP.exe
  C:\Windows\System\NrRksKP.exe
  2⤵
  PID:7236
- C:\Windows\System\oXcZhTh.exe
  C:\Windows\System\oXcZhTh.exe
  2⤵
  PID:7252
- C:\Windows\System\uTTUqwL.exe
  C:\Windows\System\uTTUqwL.exe
  2⤵
  PID:7268
- C:\Windows\System\uWNbZKq.exe
  C:\Windows\System\uWNbZKq.exe
  2⤵
  PID:7284
- C:\Windows\System\wlSiJUe.exe
  C:\Windows\System\wlSiJUe.exe
  2⤵
  PID:7300
- C:\Windows\System\YFCCjpq.exe
  C:\Windows\System\YFCCjpq.exe
  2⤵
  PID:7316
- C:\Windows\System\KWCBPDK.exe
  C:\Windows\System\KWCBPDK.exe
  2⤵
  PID:7332
- C:\Windows\System\lQcijnu.exe
  C:\Windows\System\lQcijnu.exe
  2⤵
  PID:7348
- C:\Windows\System\ucfMJoy.exe
  C:\Windows\System\ucfMJoy.exe
  2⤵
  PID:7364
- C:\Windows\System\WcoTeqm.exe
  C:\Windows\System\WcoTeqm.exe
  2⤵
  PID:7380
- C:\Windows\System\vCuWHcp.exe
  C:\Windows\System\vCuWHcp.exe
  2⤵
  PID:7396
- C:\Windows\System\rGcOiGV.exe
  C:\Windows\System\rGcOiGV.exe
  2⤵
  PID:7412
- C:\Windows\System\pkCBOIQ.exe
  C:\Windows\System\pkCBOIQ.exe
  2⤵
  PID:7428
- C:\Windows\System\ZeQnWuT.exe
  C:\Windows\System\ZeQnWuT.exe
  2⤵
  PID:7444
- C:\Windows\System\SKzgUJp.exe
  C:\Windows\System\SKzgUJp.exe
  2⤵
  PID:7460
- C:\Windows\System\MVrEUej.exe
  C:\Windows\System\MVrEUej.exe
  2⤵
  PID:7476
- C:\Windows\System\zZjXpOv.exe
  C:\Windows\System\zZjXpOv.exe
  2⤵
  PID:7492
- C:\Windows\System\jRoAtvM.exe
  C:\Windows\System\jRoAtvM.exe
  2⤵
  PID:7508
- C:\Windows\System\urjAPVP.exe
  C:\Windows\System\urjAPVP.exe
  2⤵
  PID:7524
- C:\Windows\System\PBjzhGC.exe
  C:\Windows\System\PBjzhGC.exe
  2⤵
  PID:7540
- C:\Windows\System\zYuQtyh.exe
  C:\Windows\System\zYuQtyh.exe
  2⤵
  PID:7556
- C:\Windows\System\iEUjWMf.exe
  C:\Windows\System\iEUjWMf.exe
  2⤵
  PID:7572
- C:\Windows\System\fWeIpkG.exe
  C:\Windows\System\fWeIpkG.exe
  2⤵
  PID:7588
- C:\Windows\System\UewVCUs.exe
  C:\Windows\System\UewVCUs.exe
  2⤵
  PID:7604
- C:\Windows\System\onBDmas.exe
  C:\Windows\System\onBDmas.exe
  2⤵
  PID:7620
- C:\Windows\System\JjoRKJL.exe
  C:\Windows\System\JjoRKJL.exe
  2⤵
  PID:7636
- C:\Windows\System\vbzQAlm.exe
  C:\Windows\System\vbzQAlm.exe
  2⤵
  PID:7652
- C:\Windows\System\uPBMFba.exe
  C:\Windows\System\uPBMFba.exe
  2⤵
  PID:7668
- C:\Windows\System\goJcXrp.exe
  C:\Windows\System\goJcXrp.exe
  2⤵
  PID:7684
- C:\Windows\System\ehUQFuB.exe
  C:\Windows\System\ehUQFuB.exe
  2⤵
  PID:7700
- C:\Windows\System\XSYQnnR.exe
  C:\Windows\System\XSYQnnR.exe
  2⤵
  PID:7716
- C:\Windows\System\hKJRNIq.exe
  C:\Windows\System\hKJRNIq.exe
  2⤵
  PID:7732
- C:\Windows\System\aatgEcc.exe
  C:\Windows\System\aatgEcc.exe
  2⤵
  PID:7748
- C:\Windows\System\xULmQbg.exe
  C:\Windows\System\xULmQbg.exe
  2⤵
  PID:7764
- C:\Windows\System\hkvjQXT.exe
  C:\Windows\System\hkvjQXT.exe
  2⤵
  PID:7780
- C:\Windows\System\PUJVSTC.exe
  C:\Windows\System\PUJVSTC.exe
  2⤵
  PID:7796
- C:\Windows\System\wdHdIrm.exe
  C:\Windows\System\wdHdIrm.exe
  2⤵
  PID:7812
- C:\Windows\System\fwfEqSl.exe
  C:\Windows\System\fwfEqSl.exe
  2⤵
  PID:7828
- C:\Windows\System\MRCJKpx.exe
  C:\Windows\System\MRCJKpx.exe
  2⤵
  PID:7844
- C:\Windows\System\yJuUozN.exe
  C:\Windows\System\yJuUozN.exe
  2⤵
  PID:7860
- C:\Windows\System\VmLOQqN.exe
  C:\Windows\System\VmLOQqN.exe
  2⤵
  PID:7876
- C:\Windows\System\IHmTGWZ.exe
  C:\Windows\System\IHmTGWZ.exe
  2⤵
  PID:7892
- C:\Windows\System\sgpgWsE.exe
  C:\Windows\System\sgpgWsE.exe
  2⤵
  PID:7908
- C:\Windows\System\amlqqOr.exe
  C:\Windows\System\amlqqOr.exe
  2⤵
  PID:7924
- C:\Windows\System\rjtRaGh.exe
  C:\Windows\System\rjtRaGh.exe
  2⤵
  PID:7940
- C:\Windows\System\rzkJDuQ.exe
  C:\Windows\System\rzkJDuQ.exe
  2⤵
  PID:7956
- C:\Windows\System\HRFenWI.exe
  C:\Windows\System\HRFenWI.exe
  2⤵
  PID:7972
- C:\Windows\System\IWIKfPa.exe
  C:\Windows\System\IWIKfPa.exe
  2⤵
  PID:7988
- C:\Windows\System\zXqMTfS.exe
  C:\Windows\System\zXqMTfS.exe
  2⤵
  PID:8004
- C:\Windows\System\LFkcsBD.exe
  C:\Windows\System\LFkcsBD.exe
  2⤵
  PID:8020
- C:\Windows\System\LWlldKg.exe
  C:\Windows\System\LWlldKg.exe
  2⤵
  PID:8036
- C:\Windows\System\EseLLlj.exe
  C:\Windows\System\EseLLlj.exe
  2⤵
  PID:8052
- C:\Windows\System\WfHVFNk.exe
  C:\Windows\System\WfHVFNk.exe
  2⤵
  PID:8068
- C:\Windows\System\WjzEMhK.exe
  C:\Windows\System\WjzEMhK.exe
  2⤵
  PID:8084
- C:\Windows\System\KqrWjQN.exe
  C:\Windows\System\KqrWjQN.exe
  2⤵
  PID:8100
- C:\Windows\System\jqrySYw.exe
  C:\Windows\System\jqrySYw.exe
  2⤵
  PID:8116
- C:\Windows\System\GJeLNEW.exe
  C:\Windows\System\GJeLNEW.exe
  2⤵
  PID:8132
- C:\Windows\System\jbFBYip.exe
  C:\Windows\System\jbFBYip.exe
  2⤵
  PID:8148
- C:\Windows\System\Erurtfb.exe
  C:\Windows\System\Erurtfb.exe
  2⤵
  PID:8164
- C:\Windows\System\xSQCqsd.exe
  C:\Windows\System\xSQCqsd.exe
  2⤵
  PID:8180
- C:\Windows\System\OgvtwiB.exe
  C:\Windows\System\OgvtwiB.exe
  2⤵
  PID:4932
- C:\Windows\System\BnNnJCq.exe
  C:\Windows\System\BnNnJCq.exe
  2⤵
  PID:6492
- C:\Windows\System\GoGvyXU.exe
  C:\Windows\System\GoGvyXU.exe
  2⤵
  PID:6312
- C:\Windows\System\dLvPlBk.exe
  C:\Windows\System\dLvPlBk.exe
  2⤵
  PID:2136
- C:\Windows\System\oYUGbxa.exe
  C:\Windows\System\oYUGbxa.exe
  2⤵
  PID:7200
- C:\Windows\System\rBfdOKQ.exe
  C:\Windows\System\rBfdOKQ.exe
  2⤵
  PID:7264
- C:\Windows\System\vUHNFNc.exe
  C:\Windows\System\vUHNFNc.exe
  2⤵
  PID:7008
- C:\Windows\System\NpzgTEd.exe
  C:\Windows\System\NpzgTEd.exe
  2⤵
  PID:2984
- C:\Windows\System\MIsSlyM.exe
  C:\Windows\System\MIsSlyM.exe
  2⤵
  PID:6264
- C:\Windows\System\UBzuqxN.exe
  C:\Windows\System\UBzuqxN.exe
  2⤵
  PID:6664
- C:\Windows\System\BxiRHaw.exe
  C:\Windows\System\BxiRHaw.exe
  2⤵
  PID:6680
- C:\Windows\System\YlIhYoj.exe
  C:\Windows\System\YlIhYoj.exe
  2⤵
  PID:7068
- C:\Windows\System\TMSlZqg.exe
  C:\Windows\System\TMSlZqg.exe
  2⤵
  PID:2072
- C:\Windows\System\aZUxdMg.exe
  C:\Windows\System\aZUxdMg.exe
  2⤵
  PID:6956
- C:\Windows\System\nlTgCzj.exe
  C:\Windows\System\nlTgCzj.exe
  2⤵
  PID:6500
- C:\Windows\System\bZMWHbE.exe
  C:\Windows\System\bZMWHbE.exe
  2⤵
  PID:6840
- C:\Windows\System\uRvwcIx.exe
  C:\Windows\System\uRvwcIx.exe
  2⤵
  PID:7180
- C:\Windows\System\nspogiR.exe
  C:\Windows\System\nspogiR.exe
  2⤵
  PID:7244
- C:\Windows\System\fsOcvhZ.exe
  C:\Windows\System\fsOcvhZ.exe
  2⤵
  PID:7308
- C:\Windows\System\dcTVWpt.exe
  C:\Windows\System\dcTVWpt.exe
  2⤵
  PID:7356
- C:\Windows\System\MDJZiOk.exe
  C:\Windows\System\MDJZiOk.exe
  2⤵
  PID:7372
- C:\Windows\System\yxkixhW.exe
  C:\Windows\System\yxkixhW.exe
  2⤵
  PID:7424
- C:\Windows\System\NKhmyNt.exe
  C:\Windows\System\NKhmyNt.exe
  2⤵
  PID:7484
- C:\Windows\System\PQnbjoR.exe
  C:\Windows\System\PQnbjoR.exe
  2⤵
  PID:7584
- C:\Windows\System\fTMPgMW.exe
  C:\Windows\System\fTMPgMW.exe
  2⤵
  PID:7676
- C:\Windows\System\edmXtSR.exe
  C:\Windows\System\edmXtSR.exe
  2⤵
  PID:7712
- C:\Windows\System\QpNIaEV.exe
  C:\Windows\System\QpNIaEV.exe
  2⤵
  PID:7680
- C:\Windows\System\AcpjnaN.exe
  C:\Windows\System\AcpjnaN.exe
  2⤵
  PID:7808
- C:\Windows\System\RFotQyE.exe
  C:\Windows\System\RFotQyE.exe
  2⤵
  PID:7872
- C:\Windows\System\Ukksrxc.exe
  C:\Windows\System\Ukksrxc.exe
  2⤵
  PID:7936
- C:\Windows\System\tPmxHWH.exe
  C:\Windows\System\tPmxHWH.exe
  2⤵
  PID:8000
- C:\Windows\System\QvfYqiT.exe
  C:\Windows\System\QvfYqiT.exe
  2⤵
  PID:8064
- C:\Windows\System\RKbTpku.exe
  C:\Windows\System\RKbTpku.exe
  2⤵
  PID:8128
- C:\Windows\System\LvRoGWp.exe
  C:\Windows\System\LvRoGWp.exe
  2⤵
  PID:8188
- C:\Windows\System\OFRTvKB.exe
  C:\Windows\System\OFRTvKB.exe
  2⤵
  PID:6476
- C:\Windows\System\cvsrqRw.exe
  C:\Windows\System\cvsrqRw.exe
  2⤵
  PID:6620
- C:\Windows\System\oCtYHmA.exe
  C:\Windows\System\oCtYHmA.exe
  2⤵
  PID:6676
- C:\Windows\System\rxazJWk.exe
  C:\Windows\System\rxazJWk.exe
  2⤵
  PID:6164
- C:\Windows\System\pHClqPH.exe
  C:\Windows\System\pHClqPH.exe
  2⤵
  PID:7440
- C:\Windows\System\LNBVmTv.exe
  C:\Windows\System\LNBVmTv.exe
  2⤵
  PID:7916
- C:\Windows\System\KabtnEE.exe
  C:\Windows\System\KabtnEE.exe
  2⤵
  PID:7260
- C:\Windows\System\ejkODLd.exe
  C:\Windows\System\ejkODLd.exe
  2⤵
  PID:6720
- C:\Windows\System\hyWyWQo.exe
  C:\Windows\System\hyWyWQo.exe
  2⤵
  PID:7568
- C:\Windows\System\JWGsDZk.exe
  C:\Windows\System\JWGsDZk.exe
  2⤵
  PID:7632
- C:\Windows\System\sbLrSup.exe
  C:\Windows\System\sbLrSup.exe
  2⤵
  PID:7696
- C:\Windows\System\YoEIrFD.exe
  C:\Windows\System\YoEIrFD.exe
  2⤵
  PID:7760
- C:\Windows\System\ZYbozkf.exe
  C:\Windows\System\ZYbozkf.exe
  2⤵
  PID:7852
- C:\Windows\System\RIMIrkf.exe
  C:\Windows\System\RIMIrkf.exe
  2⤵
  PID:7948
- C:\Windows\System\cTyCxGL.exe
  C:\Windows\System\cTyCxGL.exe
  2⤵
  PID:8012
- C:\Windows\System\jrPmwgN.exe
  C:\Windows\System\jrPmwgN.exe
  2⤵
  PID:8080
- C:\Windows\System\hUymNwz.exe
  C:\Windows\System\hUymNwz.exe
  2⤵
  PID:8144
- C:\Windows\System\XSHgosX.exe
  C:\Windows\System\XSHgosX.exe
  2⤵
  PID:3772
- C:\Windows\System\kQAALqU.exe
  C:\Windows\System\kQAALqU.exe
  2⤵
  PID:6820
- C:\Windows\System\pEkDxHK.exe
  C:\Windows\System\pEkDxHK.exe
  2⤵
  PID:6596
- C:\Windows\System\hLuofQi.exe
  C:\Windows\System\hLuofQi.exe
  2⤵
  PID:7216
- C:\Windows\System\VsbmjxR.exe
  C:\Windows\System\VsbmjxR.exe
  2⤵
  PID:7392
- C:\Windows\System\sgPMyCE.exe
  C:\Windows\System\sgPMyCE.exe
  2⤵
  PID:7340
- C:\Windows\System\GXqmEkm.exe
  C:\Windows\System\GXqmEkm.exe
  2⤵
  PID:7580
- C:\Windows\System\GXWfwoJ.exe
  C:\Windows\System\GXWfwoJ.exe
  2⤵
  PID:7868
- C:\Windows\System\PMVapPf.exe
  C:\Windows\System\PMVapPf.exe
  2⤵
  PID:8124
- C:\Windows\System\hLelBWl.exe
  C:\Windows\System\hLelBWl.exe
  2⤵
  PID:7788
- C:\Windows\System\jOmTjMY.exe
  C:\Windows\System\jOmTjMY.exe
  2⤵
  PID:7436
- C:\Windows\System\KrOfxtW.exe
  C:\Windows\System\KrOfxtW.exe
  2⤵
  PID:7536
- C:\Windows\System\zZCbAKL.exe
  C:\Windows\System\zZCbAKL.exe
  2⤵
  PID:7824
- C:\Windows\System\POGaaon.exe
  C:\Windows\System\POGaaon.exe
  2⤵
  PID:7984
- C:\Windows\System\YjsjpFu.exe
  C:\Windows\System\YjsjpFu.exe
  2⤵
  PID:6536
- C:\Windows\System\ijJZDNy.exe
  C:\Windows\System\ijJZDNy.exe
  2⤵
  PID:7404
- C:\Windows\System\rtlBqRq.exe
  C:\Windows\System\rtlBqRq.exe
  2⤵
  PID:7504
- C:\Windows\System\pzbwvLD.exe
  C:\Windows\System\pzbwvLD.exe
  2⤵
  PID:8208
- C:\Windows\System\wMKEgZI.exe
  C:\Windows\System\wMKEgZI.exe
  2⤵
  PID:8224
- C:\Windows\System\JlEDGsU.exe
  C:\Windows\System\JlEDGsU.exe
  2⤵
  PID:8240
- C:\Windows\System\BeEkAlI.exe
  C:\Windows\System\BeEkAlI.exe
  2⤵
  PID:8256
- C:\Windows\System\vrvKrFG.exe
  C:\Windows\System\vrvKrFG.exe
  2⤵
  PID:8272
- C:\Windows\System\vMIHAgC.exe
  C:\Windows\System\vMIHAgC.exe
  2⤵
  PID:8288
- C:\Windows\System\hZywCEv.exe
  C:\Windows\System\hZywCEv.exe
  2⤵
  PID:8304
- C:\Windows\System\LWdDwXc.exe
  C:\Windows\System\LWdDwXc.exe
  2⤵
  PID:8320
- C:\Windows\System\HmkJNfj.exe
  C:\Windows\System\HmkJNfj.exe
  2⤵
  PID:8336
- C:\Windows\System\zKwtUio.exe
  C:\Windows\System\zKwtUio.exe
  2⤵
  PID:8352
- C:\Windows\System\IQdGIQE.exe
  C:\Windows\System\IQdGIQE.exe
  2⤵
  PID:8368
- C:\Windows\System\BKCtnkB.exe
  C:\Windows\System\BKCtnkB.exe
  2⤵
  PID:8388
- C:\Windows\System\SWBAMVM.exe
  C:\Windows\System\SWBAMVM.exe
  2⤵
  PID:8404
- C:\Windows\System\MbSpIbx.exe
  C:\Windows\System\MbSpIbx.exe
  2⤵
  PID:8420
- C:\Windows\System\yVkznYy.exe
  C:\Windows\System\yVkznYy.exe
  2⤵
  PID:8436
- C:\Windows\System\rSNTdlx.exe
  C:\Windows\System\rSNTdlx.exe
  2⤵
  PID:8452
- C:\Windows\System\PGWKLtO.exe
  C:\Windows\System\PGWKLtO.exe
  2⤵
  PID:8468
- C:\Windows\System\gfQCiLV.exe
  C:\Windows\System\gfQCiLV.exe
  2⤵
  PID:8484
- C:\Windows\System\JoQuYmK.exe
  C:\Windows\System\JoQuYmK.exe
  2⤵
  PID:8500
- C:\Windows\System\JAuFgSd.exe
  C:\Windows\System\JAuFgSd.exe
  2⤵
  PID:8516
- C:\Windows\System\SCwGkom.exe
  C:\Windows\System\SCwGkom.exe
  2⤵
  PID:8532
- C:\Windows\System\jeeBmWa.exe
  C:\Windows\System\jeeBmWa.exe
  2⤵
  PID:8548
- C:\Windows\System\PpAOCYe.exe
  C:\Windows\System\PpAOCYe.exe
  2⤵
  PID:8564
- C:\Windows\System\cCTeLSZ.exe
  C:\Windows\System\cCTeLSZ.exe
  2⤵
  PID:8580
- C:\Windows\System\FwteWpV.exe
  C:\Windows\System\FwteWpV.exe
  2⤵
  PID:8596
- C:\Windows\System\pvLBcoG.exe
  C:\Windows\System\pvLBcoG.exe
  2⤵
  PID:8612
- C:\Windows\System\TvCXoAb.exe
  C:\Windows\System\TvCXoAb.exe
  2⤵
  PID:8628
- C:\Windows\System\hkwiDoZ.exe
  C:\Windows\System\hkwiDoZ.exe
  2⤵
  PID:8644
- C:\Windows\System\vnufEmd.exe
  C:\Windows\System\vnufEmd.exe
  2⤵
  PID:8660
- C:\Windows\System\cOfENLl.exe
  C:\Windows\System\cOfENLl.exe
  2⤵
  PID:8676
- C:\Windows\System\ycRweyP.exe
  C:\Windows\System\ycRweyP.exe
  2⤵
  PID:8692
- C:\Windows\System\kPsiqbd.exe
  C:\Windows\System\kPsiqbd.exe
  2⤵
  PID:8708
- C:\Windows\System\fzvObUV.exe
  C:\Windows\System\fzvObUV.exe
  2⤵
  PID:8724
- C:\Windows\System\nfITGME.exe
  C:\Windows\System\nfITGME.exe
  2⤵
  PID:8744
- C:\Windows\System\IqaAeUb.exe
  C:\Windows\System\IqaAeUb.exe
  2⤵
  PID:8760
- C:\Windows\System\ovPwKiN.exe
  C:\Windows\System\ovPwKiN.exe
  2⤵
  PID:8776
- C:\Windows\System\HfNGlKh.exe
  C:\Windows\System\HfNGlKh.exe
  2⤵
  PID:8792
- C:\Windows\System\efDWROM.exe
  C:\Windows\System\efDWROM.exe
  2⤵
  PID:8808
- C:\Windows\System\hpBeZHQ.exe
  C:\Windows\System\hpBeZHQ.exe
  2⤵
  PID:8824
- C:\Windows\System\QXwacND.exe
  C:\Windows\System\QXwacND.exe
  2⤵
  PID:8840
- C:\Windows\System\FlvCsxX.exe
  C:\Windows\System\FlvCsxX.exe
  2⤵
  PID:8856
- C:\Windows\System\vXMskNV.exe
  C:\Windows\System\vXMskNV.exe
  2⤵
  PID:8872
- C:\Windows\System\KGWwBOB.exe
  C:\Windows\System\KGWwBOB.exe
  2⤵
  PID:8888
- C:\Windows\System\GbuEzVM.exe
  C:\Windows\System\GbuEzVM.exe
  2⤵
  PID:8904
- C:\Windows\System\IcAEOUI.exe
  C:\Windows\System\IcAEOUI.exe
  2⤵
  PID:8920
- C:\Windows\System\yPPIEIl.exe
  C:\Windows\System\yPPIEIl.exe
  2⤵
  PID:8936
- C:\Windows\System\VOeoaZC.exe
  C:\Windows\System\VOeoaZC.exe
  2⤵
  PID:8952
- C:\Windows\System\TSjKuDP.exe
  C:\Windows\System\TSjKuDP.exe
  2⤵
  PID:8968
- C:\Windows\System\medKcNy.exe
  C:\Windows\System\medKcNy.exe
  2⤵
  PID:8984
- C:\Windows\System\eQLdBge.exe
  C:\Windows\System\eQLdBge.exe
  2⤵
  PID:9000
- C:\Windows\System\GPwfIgO.exe
  C:\Windows\System\GPwfIgO.exe
  2⤵
  PID:9016
- C:\Windows\System\EFjgrYj.exe
  C:\Windows\System\EFjgrYj.exe
  2⤵
  PID:9032
- C:\Windows\System\ZdtgucA.exe
  C:\Windows\System\ZdtgucA.exe
  2⤵
  PID:9048
- C:\Windows\System\DwVSOYh.exe
  C:\Windows\System\DwVSOYh.exe
  2⤵
  PID:9064
- C:\Windows\System\BXkzZIG.exe
  C:\Windows\System\BXkzZIG.exe
  2⤵
  PID:9080
- C:\Windows\System\zKMAhMt.exe
  C:\Windows\System\zKMAhMt.exe
  2⤵
  PID:9096
- C:\Windows\System\VnBwVbJ.exe
  C:\Windows\System\VnBwVbJ.exe
  2⤵
  PID:9112
- C:\Windows\System\ZuHXeNV.exe
  C:\Windows\System\ZuHXeNV.exe
  2⤵
  PID:9128
- C:\Windows\System\AnuHTkA.exe
  C:\Windows\System\AnuHTkA.exe
  2⤵
  PID:9144
- C:\Windows\System\KFvCRoJ.exe
  C:\Windows\System\KFvCRoJ.exe
  2⤵
  PID:9160
- C:\Windows\System\APdFLvs.exe
  C:\Windows\System\APdFLvs.exe
  2⤵
  PID:9180
- C:\Windows\System\cLpQHBJ.exe
  C:\Windows\System\cLpQHBJ.exe
  2⤵
  PID:9196
- C:\Windows\System\TgHxEiq.exe
  C:\Windows\System\TgHxEiq.exe
  2⤵
  PID:9212
- C:\Windows\System\gTHxNaW.exe
  C:\Windows\System\gTHxNaW.exe
  2⤵
  PID:7932
- C:\Windows\System\kTdwrBU.exe
  C:\Windows\System\kTdwrBU.exe
  2⤵
  PID:8200
- C:\Windows\System\XhstRIB.exe
  C:\Windows\System\XhstRIB.exe
  2⤵
  PID:8264
- C:\Windows\System\nieilkL.exe
  C:\Windows\System\nieilkL.exe
  2⤵
  PID:8328
- C:\Windows\System\kdsmefd.exe
  C:\Windows\System\kdsmefd.exe
  2⤵
  PID:7600
- C:\Windows\System\fBPTTui.exe
  C:\Windows\System\fBPTTui.exe
  2⤵
  PID:8400
- C:\Windows\System\PnDBPjz.exe
  C:\Windows\System\PnDBPjz.exe
  2⤵
  PID:8044
- C:\Windows\System\EGYxezv.exe
  C:\Windows\System\EGYxezv.exe
  2⤵
  PID:8160
- C:\Windows\System\OTwzeDk.exe
  C:\Windows\System\OTwzeDk.exe
  2⤵
  PID:8248
- C:\Windows\System\FhNvVVD.exe
  C:\Windows\System\FhNvVVD.exe
  2⤵
  PID:7884
- C:\Windows\System\DSeMbrB.exe
  C:\Windows\System\DSeMbrB.exe
  2⤵
  PID:7728
- C:\Windows\System\tXxcgbr.exe
  C:\Windows\System\tXxcgbr.exe
  2⤵
  PID:8048
- C:\Windows\System\BsgaIpb.exe
  C:\Windows\System\BsgaIpb.exe
  2⤵
  PID:7036
- C:\Windows\System\aKIwWUj.exe
  C:\Windows\System\aKIwWUj.exe
  2⤵
  PID:8096
- C:\Windows\System\ihhDzWx.exe
  C:\Windows\System\ihhDzWx.exe
  2⤵
  PID:7820
- C:\Windows\System\bXGcGjY.exe
  C:\Windows\System\bXGcGjY.exe
  2⤵
  PID:8216
- C:\Windows\System\ssnJTHY.exe
  C:\Windows\System\ssnJTHY.exe
  2⤵
  PID:8284
- C:\Windows\System\Fvfickx.exe
  C:\Windows\System\Fvfickx.exe
  2⤵
  PID:8348
- C:\Windows\System\fWCQywF.exe
  C:\Windows\System\fWCQywF.exe
  2⤵
  PID:8416
- C:\Windows\System\lzJxIka.exe
  C:\Windows\System\lzJxIka.exe
  2⤵
  PID:8444
- C:\Windows\System\pXIuSLO.exe
  C:\Windows\System\pXIuSLO.exe
  2⤵
  PID:8464
- C:\Windows\System\aQEDreG.exe
  C:\Windows\System\aQEDreG.exe
  2⤵
  PID:8496
- C:\Windows\System\syCuBnD.exe
  C:\Windows\System\syCuBnD.exe
  2⤵
  PID:8588
- C:\Windows\System\gLVbfvj.exe
  C:\Windows\System\gLVbfvj.exe
  2⤵
  PID:8684
- C:\Windows\System\JkzWQAR.exe
  C:\Windows\System\JkzWQAR.exe
  2⤵
  PID:8716
- C:\Windows\System\aVCtcID.exe
  C:\Windows\System\aVCtcID.exe
  2⤵
  PID:8784
- C:\Windows\System\IoxpRLp.exe
  C:\Windows\System\IoxpRLp.exe
  2⤵
  PID:8572
- C:\Windows\System\JLDWgMf.exe
  C:\Windows\System\JLDWgMf.exe
  2⤵
  PID:8732
- C:\Windows\System\nLFDFqs.exe
  C:\Windows\System\nLFDFqs.exe
  2⤵
  PID:8540
- C:\Windows\System\AcLoKrc.exe
  C:\Windows\System\AcLoKrc.exe
  2⤵
  PID:8672
- C:\Windows\System\uzquurT.exe
  C:\Windows\System\uzquurT.exe
  2⤵
  PID:8800
- C:\Windows\System\JSdkFZN.exe
  C:\Windows\System\JSdkFZN.exe
  2⤵
  PID:8884
- C:\Windows\System\vHllRAZ.exe
  C:\Windows\System\vHllRAZ.exe
  2⤵
  PID:8948
- C:\Windows\System\encHPis.exe
  C:\Windows\System\encHPis.exe
  2⤵
  PID:9076
- C:\Windows\System\VOFxMvO.exe
  C:\Windows\System\VOFxMvO.exe
  2⤵
  PID:9012
- C:\Windows\System\QgijQfl.exe
  C:\Windows\System\QgijQfl.exe
  2⤵
  PID:9104
- C:\Windows\System\YGtZWhh.exe
  C:\Windows\System\YGtZWhh.exe
  2⤵
  PID:9172
- C:\Windows\System\trUjkKF.exe
  C:\Windows\System\trUjkKF.exe
  2⤵
  PID:8296
- C:\Windows\System\GWuaCHj.exe
  C:\Windows\System\GWuaCHj.exe
  2⤵
  PID:8364
- C:\Windows\System\OVXgNlA.exe
  C:\Windows\System\OVXgNlA.exe
  2⤵
  PID:7420
- C:\Windows\System\wHrrDCM.exe
  C:\Windows\System\wHrrDCM.exe
  2⤵
  PID:7920
- C:\Windows\System\AWZEnYR.exe
  C:\Windows\System\AWZEnYR.exe
  2⤵
  PID:6940
- C:\Windows\System\ITcaBAE.exe
  C:\Windows\System\ITcaBAE.exe
  2⤵
  PID:8460
- C:\Windows\System\rpCpSKi.exe
  C:\Windows\System\rpCpSKi.exe
  2⤵
  PID:8624
- C:\Windows\System\RkAOgmO.exe
  C:\Windows\System\RkAOgmO.exe
  2⤵
  PID:8636
- C:\Windows\System\lAsnJEo.exe
  C:\Windows\System\lAsnJEo.exe
  2⤵
  PID:8608
- C:\Windows\System\CnYSVSh.exe
  C:\Windows\System\CnYSVSh.exe
  2⤵
  PID:9008
- C:\Windows\System\TcJQkCT.exe
  C:\Windows\System\TcJQkCT.exe
  2⤵
  PID:9136
- C:\Windows\System\SCxgTbi.exe
  C:\Windows\System\SCxgTbi.exe
  2⤵
  PID:9024
- C:\Windows\System\DmZrhAR.exe
  C:\Windows\System\DmZrhAR.exe
  2⤵
  PID:9124
- C:\Windows\System\BudNlVP.exe
  C:\Windows\System\BudNlVP.exe
  2⤵
  PID:8804
- C:\Windows\System\obfUzGp.exe
  C:\Windows\System\obfUzGp.exe
  2⤵
  PID:8900
- C:\Windows\System\xgrczDn.exe
  C:\Windows\System\xgrczDn.exe
  2⤵
  PID:9088
- C:\Windows\System\DFIZEcD.exe
  C:\Windows\System\DFIZEcD.exe
  2⤵
  PID:8620
- C:\Windows\System\kACmGOj.exe
  C:\Windows\System\kACmGOj.exe
  2⤵
  PID:9224
- C:\Windows\System\JPttxjs.exe
  C:\Windows\System\JPttxjs.exe
  2⤵
  PID:9240
- C:\Windows\System\oskGgqi.exe
  C:\Windows\System\oskGgqi.exe
  2⤵
  PID:9256
- C:\Windows\System\ANMXKwt.exe
  C:\Windows\System\ANMXKwt.exe
  2⤵
  PID:9272
- C:\Windows\System\pPTeJGf.exe
  C:\Windows\System\pPTeJGf.exe
  2⤵
  PID:9288
- C:\Windows\System\SyIgHZF.exe
  C:\Windows\System\SyIgHZF.exe
  2⤵
  PID:9304
- C:\Windows\System\IOfBDaB.exe
  C:\Windows\System\IOfBDaB.exe
  2⤵
  PID:9320
- C:\Windows\System\ysOgqNY.exe
  C:\Windows\System\ysOgqNY.exe
  2⤵
  PID:9336
- C:\Windows\System\XzSxXfD.exe
  C:\Windows\System\XzSxXfD.exe
  2⤵
  PID:9352
- C:\Windows\System\vKPFerD.exe
  C:\Windows\System\vKPFerD.exe
  2⤵
  PID:9368
- C:\Windows\System\GNnMyBW.exe
  C:\Windows\System\GNnMyBW.exe
  2⤵
  PID:9384
- C:\Windows\System\JeCGnzL.exe
  C:\Windows\System\JeCGnzL.exe
  2⤵
  PID:9400
- C:\Windows\System\FrBEWuz.exe
  C:\Windows\System\FrBEWuz.exe
  2⤵
  PID:9416
- C:\Windows\System\ouuSGCR.exe
  C:\Windows\System\ouuSGCR.exe
  2⤵
  PID:9432
- C:\Windows\System\cavrsXP.exe
  C:\Windows\System\cavrsXP.exe
  2⤵
  PID:9448
- C:\Windows\System\HLEpGVi.exe
  C:\Windows\System\HLEpGVi.exe
  2⤵
  PID:9464
- C:\Windows\System\HWHHtVf.exe
  C:\Windows\System\HWHHtVf.exe
  2⤵
  PID:9484
- C:\Windows\System\ZlOpmNo.exe
  C:\Windows\System\ZlOpmNo.exe
  2⤵
  PID:9500
- C:\Windows\System\tzzPXZb.exe
  C:\Windows\System\tzzPXZb.exe
  2⤵
  PID:9516
- C:\Windows\System\lStMRlx.exe
  C:\Windows\System\lStMRlx.exe
  2⤵
  PID:9532
- C:\Windows\System\pngOeQf.exe
  C:\Windows\System\pngOeQf.exe
  2⤵
  PID:9548
- C:\Windows\System\ypiIJjW.exe
  C:\Windows\System\ypiIJjW.exe
  2⤵
  PID:9564
- C:\Windows\System\DcBqoOu.exe
  C:\Windows\System\DcBqoOu.exe
  2⤵
  PID:9580
- C:\Windows\System\ndcJXdl.exe
  C:\Windows\System\ndcJXdl.exe
  2⤵
  PID:9596
- C:\Windows\System\vqtSbzs.exe
  C:\Windows\System\vqtSbzs.exe
  2⤵
  PID:9612
- C:\Windows\System\SCyceGX.exe
  C:\Windows\System\SCyceGX.exe
  2⤵
  PID:9628
- C:\Windows\System\WdvseSz.exe
  C:\Windows\System\WdvseSz.exe
  2⤵
  PID:9648
- C:\Windows\System\AWToZyV.exe
  C:\Windows\System\AWToZyV.exe
  2⤵
  PID:9664
- C:\Windows\System\NnMKvZS.exe
  C:\Windows\System\NnMKvZS.exe
  2⤵
  PID:9680
- C:\Windows\System\cFyitAB.exe
  C:\Windows\System\cFyitAB.exe
  2⤵
  PID:9696
- C:\Windows\System\IKleoUF.exe
  C:\Windows\System\IKleoUF.exe
  2⤵
  PID:9712
- C:\Windows\System\qSabcpU.exe
  C:\Windows\System\qSabcpU.exe
  2⤵
  PID:9728
- C:\Windows\System\wdfFiqn.exe
  C:\Windows\System\wdfFiqn.exe
  2⤵
  PID:9744
- C:\Windows\System\TrCOgiu.exe
  C:\Windows\System\TrCOgiu.exe
  2⤵
  PID:9760
- C:\Windows\System\dRUqwnT.exe
  C:\Windows\System\dRUqwnT.exe
  2⤵
  PID:9776
- C:\Windows\System\aomXeXT.exe
  C:\Windows\System\aomXeXT.exe
  2⤵
  PID:9792
- C:\Windows\System\NzfPbSN.exe
  C:\Windows\System\NzfPbSN.exe
  2⤵
  PID:9808
- C:\Windows\System\jWNFNGm.exe
  C:\Windows\System\jWNFNGm.exe
  2⤵
  PID:9824
- C:\Windows\System\QfFrrTk.exe
  C:\Windows\System\QfFrrTk.exe
  2⤵
  PID:9840
- C:\Windows\System\mZcBaxN.exe
  C:\Windows\System\mZcBaxN.exe
  2⤵
  PID:9856
- C:\Windows\System\MlmzpLd.exe
  C:\Windows\System\MlmzpLd.exe
  2⤵
  PID:9872
- C:\Windows\System\SFjrxrA.exe
  C:\Windows\System\SFjrxrA.exe
  2⤵
  PID:9888
- C:\Windows\System\rWPVBtA.exe
  C:\Windows\System\rWPVBtA.exe
  2⤵
  PID:9924
- C:\Windows\System\iEJzXon.exe
  C:\Windows\System\iEJzXon.exe
  2⤵
  PID:9940
- C:\Windows\System\ysqaltU.exe
  C:\Windows\System\ysqaltU.exe
  2⤵
  PID:9960
- C:\Windows\System\kCYTJbr.exe
  C:\Windows\System\kCYTJbr.exe
  2⤵
  PID:9984
- C:\Windows\System\NzmCZQJ.exe
  C:\Windows\System\NzmCZQJ.exe
  2⤵
  PID:10000
- C:\Windows\System\rrsJBDQ.exe
  C:\Windows\System\rrsJBDQ.exe
  2⤵
  PID:10020
- C:\Windows\System\KEvWUtk.exe
  C:\Windows\System\KEvWUtk.exe
  2⤵
  PID:10036
- C:\Windows\System\qnxOVzy.exe
  C:\Windows\System\qnxOVzy.exe
  2⤵
  PID:10056
- C:\Windows\System\njLWNQg.exe
  C:\Windows\System\njLWNQg.exe
  2⤵
  PID:10072
- C:\Windows\System\VQnUtrh.exe
  C:\Windows\System\VQnUtrh.exe
  2⤵
  PID:10088
- C:\Windows\System\TlkLCWB.exe
  C:\Windows\System\TlkLCWB.exe
  2⤵
  PID:10104
- C:\Windows\System\IHQjBHT.exe
  C:\Windows\System\IHQjBHT.exe
  2⤵
  PID:10120
- C:\Windows\System\ubMAROl.exe
  C:\Windows\System\ubMAROl.exe
  2⤵
  PID:10136
- C:\Windows\System\lfxjnZQ.exe
  C:\Windows\System\lfxjnZQ.exe
  2⤵
  PID:10152
- C:\Windows\System\eqTRxlv.exe
  C:\Windows\System\eqTRxlv.exe
  2⤵
  PID:10168
- C:\Windows\System\XhXENbV.exe
  C:\Windows\System\XhXENbV.exe
  2⤵
  PID:10184
- C:\Windows\System\yVnoCGA.exe
  C:\Windows\System\yVnoCGA.exe
  2⤵
  PID:10200
- C:\Windows\System\JPQmWmq.exe
  C:\Windows\System\JPQmWmq.exe
  2⤵
  PID:10216
- C:\Windows\System\dGenuKV.exe
  C:\Windows\System\dGenuKV.exe
  2⤵
  PID:10232
- C:\Windows\System\KrbFotU.exe
  C:\Windows\System\KrbFotU.exe
  2⤵
  PID:9092
- C:\Windows\System\shZvfhQ.exe
  C:\Windows\System\shZvfhQ.exe
  2⤵
  PID:6936
- C:\Windows\System\VFEaoGZ.exe
  C:\Windows\System\VFEaoGZ.exe
  2⤵
  PID:9236
- C:\Windows\System\dXcbZWF.exe
  C:\Windows\System\dXcbZWF.exe
  2⤵
  PID:9296
- C:\Windows\System\fCpOKuX.exe
  C:\Windows\System\fCpOKuX.exe
  2⤵
  PID:6728
- C:\Windows\System\UdKctXW.exe
  C:\Windows\System\UdKctXW.exe
  2⤵
  PID:9188
- C:\Windows\System\cVVMWUk.exe
  C:\Windows\System\cVVMWUk.exe
  2⤵
  PID:876
- C:\Windows\System\gSCcFPF.exe
  C:\Windows\System\gSCcFPF.exe
  2⤵
  PID:8236
- C:\Windows\System\QlWSRHx.exe
  C:\Windows\System\QlWSRHx.exe
  2⤵
  PID:7804
- C:\Windows\System\cFOppfZ.exe
  C:\Windows\System\cFOppfZ.exe
  2⤵
  PID:8820
- C:\Windows\System\ogcbPXL.exe
  C:\Windows\System\ogcbPXL.exe
  2⤵
  PID:8280
- C:\Windows\System\jOZrJXB.exe
  C:\Windows\System\jOZrJXB.exe
  2⤵
  PID:8560
- C:\Windows\System\dKnbXfV.exe
  C:\Windows\System\dKnbXfV.exe
  2⤵
  PID:8508
- C:\Windows\System\bOLZlJB.exe
  C:\Windows\System\bOLZlJB.exe
  2⤵
  PID:8916
- C:\Windows\System\MVWLfgv.exe
  C:\Windows\System\MVWLfgv.exe
  2⤵
  PID:9140
- C:\Windows\System\Qwtfcri.exe
  C:\Windows\System\Qwtfcri.exe
  2⤵
  PID:9168
- C:\Windows\System\SBmCBZn.exe
  C:\Windows\System\SBmCBZn.exe
  2⤵
  PID:8300
- C:\Windows\System\vENeqUG.exe
  C:\Windows\System\vENeqUG.exe
  2⤵
  PID:8344
- C:\Windows\System\udaXaVZ.exe
  C:\Windows\System\udaXaVZ.exe
  2⤵
  PID:8960
- C:\Windows\System\fxBKtEm.exe
  C:\Windows\System\fxBKtEm.exe
  2⤵
  PID:8992
- C:\Windows\System\zWLTCrH.exe
  C:\Windows\System\zWLTCrH.exe
  2⤵
  PID:9252
- C:\Windows\System\BXwodQx.exe
  C:\Windows\System\BXwodQx.exe
  2⤵
  PID:9348
- C:\Windows\System\UBEIuqb.exe
  C:\Windows\System\UBEIuqb.exe
  2⤵
  PID:9424
- C:\Windows\System\FtQnFUO.exe
  C:\Windows\System\FtQnFUO.exe
  2⤵
  PID:9460
- C:\Windows\System\nvIHtlk.exe
  C:\Windows\System\nvIHtlk.exe
  2⤵
  PID:992
- C:\Windows\System\rZFoVmG.exe
  C:\Windows\System\rZFoVmG.exe
  2⤵
  PID:9508
- C:\Windows\System\QRlHdLm.exe
  C:\Windows\System\QRlHdLm.exe
  2⤵
  PID:9540
- C:\Windows\System\hHeBixq.exe
  C:\Windows\System\hHeBixq.exe
  2⤵
  PID:9636
- C:\Windows\System\LoijKos.exe
  C:\Windows\System\LoijKos.exe
  2⤵
  PID:9704
- C:\Windows\System\cqcTwnA.exe
  C:\Windows\System\cqcTwnA.exe
  2⤵
  PID:9656
- C:\Windows\System\mmGBeQe.exe
  C:\Windows\System\mmGBeQe.exe
  2⤵
  PID:9660
- C:\Windows\System\hGFqLmt.exe
  C:\Windows\System\hGFqLmt.exe
  2⤵
  PID:9720
- C:\Windows\System\YyZftmr.exe
  C:\Windows\System\YyZftmr.exe
  2⤵
  PID:9848
- C:\Windows\System\oUpweAM.exe
  C:\Windows\System\oUpweAM.exe
  2⤵
  PID:9772
- C:\Windows\System\WUwRfNC.exe
  C:\Windows\System\WUwRfNC.exe
  2⤵
  PID:9896
- C:\Windows\System\aNSAWvx.exe
  C:\Windows\System\aNSAWvx.exe
  2⤵
  PID:9880
- C:\Windows\System\ZkSBxVy.exe
  C:\Windows\System\ZkSBxVy.exe
  2⤵
  PID:9936
- C:\Windows\System\lCeHqgF.exe
  C:\Windows\System\lCeHqgF.exe
  2⤵
  PID:9980
- C:\Windows\System\fcVzphP.exe
  C:\Windows\System\fcVzphP.exe
  2⤵
  PID:10016
- C:\Windows\System\JTbQIsn.exe
  C:\Windows\System\JTbQIsn.exe
  2⤵
  PID:9992
- C:\Windows\System\RRoBMRf.exe
  C:\Windows\System\RRoBMRf.exe
  2⤵
  PID:10028
- C:\Windows\System\fBbpAAl.exe
  C:\Windows\System\fBbpAAl.exe
  2⤵
  PID:10084
- C:\Windows\System\URnXowa.exe
  C:\Windows\System\URnXowa.exe
  2⤵
  PID:10116
- C:\Windows\System\hWXCGqa.exe
  C:\Windows\System\hWXCGqa.exe
  2⤵
  PID:8640
- C:\Windows\System\huYYNWN.exe
  C:\Windows\System\huYYNWN.exe
  2⤵
  PID:10160
- C:\Windows\System\rtjWrZn.exe
  C:\Windows\System\rtjWrZn.exe
  2⤵
  PID:10196
- C:\Windows\System\IepGblz.exe
  C:\Windows\System\IepGblz.exe
  2⤵
  PID:9056
- C:\Windows\System\kLyyXec.exe
  C:\Windows\System\kLyyXec.exe
  2⤵
  PID:9268
- C:\Windows\System\AgzzTiM.exe
  C:\Windows\System\AgzzTiM.exe
  2⤵
  PID:8252
- C:\Windows\System\haWkqyz.exe
  C:\Windows\System\haWkqyz.exe
  2⤵
  PID:7996
- C:\Windows\System\JWZABqv.exe
  C:\Windows\System\JWZABqv.exe
  2⤵
  PID:8556
- C:\Windows\System\qLNLlxJ.exe
  C:\Windows\System\qLNLlxJ.exe
  2⤵
  PID:7628
- C:\Windows\System\sLhCZYR.exe
  C:\Windows\System\sLhCZYR.exe
  2⤵
  PID:8480
- C:\Windows\System\LfYtYhA.exe
  C:\Windows\System\LfYtYhA.exe
  2⤵
  PID:8752
- C:\Windows\System\FPkjvJO.exe
  C:\Windows\System\FPkjvJO.exe
  2⤵
  PID:9376
- C:\Windows\System\cMevIVj.exe
  C:\Windows\System\cMevIVj.exe
  2⤵
  PID:9512
- C:\Windows\System\BpmJapO.exe
  C:\Windows\System\BpmJapO.exe
  2⤵
  PID:9672
- C:\Windows\System\GfMsVqy.exe
  C:\Windows\System\GfMsVqy.exe
  2⤵
  PID:7888
- C:\Windows\System\qSCruEG.exe
  C:\Windows\System\qSCruEG.exe
  2⤵
  PID:9556
- C:\Windows\System\hVjBDyp.exe
  C:\Windows\System\hVjBDyp.exe
  2⤵
  PID:9412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AGxtTxU.exe

Filesize
5.0MB

MD5
788c7eaee71195462eaf797e67f83d0d

SHA1
e3ea89f6898dbdf42dcc4c499af990df2f4a167a

SHA256
70b1a7190a4cb7061394f0d45d10d157c725b304158290d25215617e3ce7c5e4

SHA512
8693eb078ae7341f893f60d49404ce626d3c1c34f1d76735e040a13d6360f6942b1a751424fe63d91a58272c9dd642c29b2abd527f4baf6438da60f0deed7008

Download Submit
C:\Windows\system\GRKqITp.exe

Filesize
5.0MB

MD5
62f3c4c2c78096a0df9ec760bb1843fd

SHA1
6bfbf5c384f53e9102f969e03ce32401c1abbbf9

SHA256
75d16471939559d388c842419406e88e2f8482c62c3fb96c3a72b9167289d3cc

SHA512
f011242fac04379dcc1aa5681c7fafb6a864cb94c650cdd1bdf21d10ac8fabbc1b470bc3637d3bbd62986cb3427584b656980c49f24841072b7c777247b18b13

Download Submit
C:\Windows\system\HEyZiVa.exe

Filesize
5.0MB

MD5
28095ec755d0e0231377ab4265c962fe

SHA1
830fc16e35b0fcce97f9dbc2ee8b22673afee450

SHA256
23e2681c3212ef518b515ddd055c28ec57ea511d14d6fae12142096151bb1b16

SHA512
5e41f72242b633da76ba4781ed31c102bb0e71939660629bfb52fdb7a959260f819a1d47888d758c72f9dffb8765bbea04b279c5e3b5d31aaeae03755774c7e2

Download Submit
C:\Windows\system\IptEDHx.exe

Filesize
5.0MB

MD5
0ca7e6c988d9224bccc85f9de3e0e067

SHA1
b0823590c338e0ab4b3c00514145ba7c9d21c692

SHA256
d8d0fdd372f18a56e1a5b6517ac5820fd9d8422241d12486cfd007a483a04106

SHA512
9146ba407247bafe20ea31e7356a51a84ec396be01da9e00fcc1d2668354ba569283a07a08808a6a45c39b52812c4682951530d3e361980f4f119d9ab3af5d04

Download Submit
C:\Windows\system\JfjwNsW.exe

Filesize
5.0MB

MD5
9c1e3d5e5c167321280cefe620d3d24f

SHA1
30abba4477f5dbf97ddb48084ef6f2a55a231b7e

SHA256
ab79b73f641497b027bbb421313573ec8d0c51c3d09ff3bec3b853762251d872

SHA512
ee6161182ba2d86ba48f7e0882f7e6d4a767c1d14b51d7d9459fda0441e17e36845365519b3c97f9475616de97d4162d623f742a3e5d2e7f12b2e1abcd42febc

Download Submit
C:\Windows\system\KfbwPxo.exe

Filesize
5.0MB

MD5
628c1809e22ef546d203140a7176a138

SHA1
1d9c5fdbc7f7c39b4c6b28174955924d51286401

SHA256
60b15ed0717fd9eb7293ec81327d49d72cad16e92044c1e5840c52b814d90f52

SHA512
2d0828172e4b93324fd6c5ce678bb644659c04079c0d665efbdd33f2063e9d8a30480f7bdf5f9e9fe4e3adc787baa14a6d9c4a85df6f86a4d45e5a1a6088e92c

Download Submit
C:\Windows\system\OsbwXwW.exe

Filesize
5.0MB

MD5
826e5315762b9bfba234b1a12886fffa

SHA1
4e068dfb134d004fdeea47e09e265bedbaea91a9

SHA256
5feab091dad99e01e0699636061753f72ef5fae5150b0b2f5ecceab5546ff0d2

SHA512
eaeda0bb5dcee3f8df2fa5593b1a084998fef54994d8a2e5ec78e544b2ff39f15913fbea4275c9fb9e9e4ad85b89747d4aaf2a4cd0ae43d7706c1896d9378d6d

Download Submit
C:\Windows\system\Qtqowil.exe

Filesize
5.0MB

MD5
74de07b6d1c6f1a5c40be1a0c71f2fef

SHA1
736aa439fa8d31fbfefe27dad671cbd54bb8e421

SHA256
07eb56ddc7b8701b0dd8077bffdf956f797f546634d33063261bbcd061fe6bd2

SHA512
ecb6a131c619dae5b87b2c5b707440bc4f93baa71f04dd95d8936cbbf35dc31662dc12bc5d86a8f88db5cfb2d6f77a9d45dd8cb2f7636880491df853ee991358

Download Submit
C:\Windows\system\SPunmMO.exe

Filesize
5.0MB

MD5
1ed73347a625abc2ee4926af008b883d

SHA1
77d6158ddddffd81bb34d0c444bb1f3818b83891

SHA256
af7df1a0108cd40c296cc1a83038f81b9ad9795652ca726cde8b7de5c03fbf4f

SHA512
532a0d9b88caf95b31491b2f5689fe610c34fdaec969093bb45a69ff08af5254f24e4f078797d2a32241a791352780e50ecebcac9e8d17b7ad6c4b87b261f286

Download Submit
C:\Windows\system\TrEWDoS.exe

Filesize
5.0MB

MD5
0a1d8346497293a70bd4c8115a5f1933

SHA1
d7db18bd3bc709895c81c95af5404a3220679a3a

SHA256
855dd3e1695084f40a999be3d5ddce3cf0997af9ff4fd8392937dc2d4b7a9c5e

SHA512
88a46c7a4cfe6d12d3919ae58fccecfb24600f140033b2efe54c6323b1fa1c305df366d4b5134bba34195d88caca6a286efafb02520e40d12ad6887d8b14e3d0

Download Submit
C:\Windows\system\WOwTghg.exe

Filesize
5.0MB

MD5
35cb69fdf53623b387fc9f052a2370b9

SHA1
0f12409567eaada2f1b43b7584bb876f60eb8530

SHA256
c91f4d08059127554407178e69c8cbdfc67e3420488399030027fc6d71139e68

SHA512
cc91d911a6a453980ef9c5ac50cb4110583c5bf2e2c14fe6d650708ae5cd478d0e5ca729ff36bd5fdb01a4048594b35303cee1ad6f9af860e50cc0e7b0376cc0

Download Submit
C:\Windows\system\WhIjQED.exe

Filesize
5.0MB

MD5
893b8f62cdd1904f2653019aec1ea48c

SHA1
0b29186400451aec81571795b14ecc262e2581e8

SHA256
f7bfd1ca71decc6ec6f686316eb07c9295fe471be08651af62145bd3648ebca1

SHA512
c6dec37c7a5543da2a994fb86533cb9019e4f932bbd213a3ac6950585b7231962e38973fbfda23c540c7e5c5f476e03a6615d1310e2cf248e4a9c1d349eef2b8

Download Submit
C:\Windows\system\ZEBFjEn.exe

Filesize
5.0MB

MD5
ddf37244c0a6bc68992fcf6aaa628058

SHA1
bc14195bca35bdae21ef33b67c615af18da2865a

SHA256
f7535b893a1912fe8f1d6d05e80a1a3569426541141f39746fa275a11360aeb3

SHA512
69163183c0d9d0a43bc31a226861b38ce080a5446c9dd92bc64e3fd2777bfcb0fda832a5c9504c3f22f5a39d8032a00ea9f3333e79ff0c6e8a0192f24304df4f

Download Submit
C:\Windows\system\bEZlQyU.exe

Filesize
5.0MB

MD5
1d16513b1314bffb67d9014d82f24bee

SHA1
da82ef6e34ce54bcc40f30ce2ee6bd35158d44cb

SHA256
ef5d8e48919d29e0bafc95156788c9695ca9a3324c7682074f5ef30703fa6c1d

SHA512
a75d3266fd71bd3d613b3baffb9304ebd86771211b36e1a8b2316ac1c33f31049a867d143a3d051bf2388ba1e30ca18773cda5c94919e42f83181f03d93703be

Download Submit
C:\Windows\system\cRRYgEI.exe

Filesize
5.0MB

MD5
b6d25d6a2672c9ea8716b007c4190f2c

SHA1
b5b066104c6141556f660de8915b0efc2f5e7f83

SHA256
6bed736781dd9e8281b5804db997ab2e348c30a4cc445a77eb7bfb1d5d3a38be

SHA512
ef9c8d44a82629a5509ec8317a34cc3b25128ac83cfa17ec1a938a1c9f078f6b24e9693005d28a7b0e0b5fddc5dd95c0a884db3562e3d7f4f2b3e3e6d4801e7c

Download Submit
C:\Windows\system\dutKdNy.exe

Filesize
5.0MB

MD5
b0fc51d88d2ba6e80aea7a1afa5324cb

SHA1
380f3824fd0578eff9ae8faba27f6358c95eafbb

SHA256
eb2394251cc3820e2bb090c4a18c479d7be8b92f5ab6764c613a4a31e9e281f7

SHA512
d94c3e8fd245767f69420ee9730eeb85a0fd914d3be48f08ca3331d7f917fb1f575e80109a56768fdf2192ac1a6bac0cd82fca66a3abb71def14ed6368c3b717

Download Submit
C:\Windows\system\eUVWwpv.exe

Filesize
5.0MB

MD5
f9394c58b435b52272213b9971cefa1c

SHA1
bea49b6013ba48b910a832089a36723dcebcc23c

SHA256
1ac1fc22917db76277a867ef3e901da60ae41a45ee466d48aa00e9b65ec808c0

SHA512
0f3309a0819f51fb47d989b09bcb62e852c550c0469587a13d70a450d51f681dd5e35dca58a3225b2cff01c01cca5cee49e1b84630da7ab38f5b2f2190f2096b

Download Submit
C:\Windows\system\fMkYNmD.exe

Filesize
5.0MB

MD5
7e83c861c80c8e611d7d5366dc675831

SHA1
7270026f277ccb945da742a8a3155a4cbb30d3b7

SHA256
6dd270885623b5f064e942a775c760b7e202bf0658e700975f16606ddb21d1cf

SHA512
2aa847b1751a9cd1361e06985948de8d88ab156b50a90e6635df4f53276ec45bb7e10d037f280f5edd43623764e540879f61b369124810030b5ab5c408a73ab9

Download Submit
C:\Windows\system\gEFFbwB.exe

Filesize
5.0MB

MD5
e6d8d363e357f243f93bfa7e1c14b7f3

SHA1
04bbdcd31f90f506b406b763fe447fabca67d3c8

SHA256
a21abb68770d46b55916bdbd00d16793a913c20da4ed132300cd174baeb0f7ed

SHA512
0dc08e55be87b9753284349fa20584beebe680bdc236348685d1e4bbec885c026104250c18ecb00371275887a1e4c83c941fd460c0144709074801f9f3b98b98

Download Submit
C:\Windows\system\kSpWiaM.exe

Filesize
5.0MB

MD5
0b6463138a8f6a8900697e651f55f962

SHA1
48107540c9a77424ce5fe9a48490a554c6a06825

SHA256
efb59040e66abeb7e7510e46993cf5413e5a08b41a877558698b6004def1b004

SHA512
5ec409d371e28db1b8bfbef5b215bbcc086b70b6d32ea4a6f809d1b2f2d3b32caff2a2d14ac307c48bfd30c9442fb71c128c812006fb1292339f97e818486c2f

Download Submit
C:\Windows\system\plRpyEc.exe

Filesize
5.0MB

MD5
6f6612df335f5575cfe86848991d887f

SHA1
d20d8848c8c55f554569582132b6deba465900bf

SHA256
93650f294ab8acdfaa2cd99427217ea62519f982efa7845c87b7241b687eaf35

SHA512
288ee8aa72f95f4b76a54f997f8418c18553d398ef054f943c47302d1ccc72fde246bf12e5688eb3602bcb04cadefe33bed2aaa194822486b01962246d274024

Download Submit
C:\Windows\system\urRbSdz.exe

Filesize
5.0MB

MD5
4b3f0912cac87a8df8e76f09e6734a9a

SHA1
7561d93ad910015c98a3089b1cac5d29bf10d0cd

SHA256
a910cab2f716de8dcccfc1386c95e619342f6e67c3180512b2fc25dbea654a6b

SHA512
6a67b5fb58ab3c2c8fdee984f93e944b1b360e2f32fc929e1f739e966605f48788374ff5ee0c01dbc544a31e979adf40b427f73c3d2e995b31bbedaa334b8da7

Download Submit
C:\Windows\system\wTSBBRq.exe

Filesize
5.0MB

MD5
4ae85f039b35b2d6ae62bbd75ba09a30

SHA1
28de40f2f5db1872be38c9cb6d1ea5cbd83cdfaa

SHA256
83f90fd39fc7bfae19d3f1afc2292cdb788ba09469bf4a1feef49a4eb9082429

SHA512
88f38c7d6a95d0755511a35471e9c00f3fed357e118e6c5b3f6c6ddbd7f6d684040fc668d32c87436f577099f61b26099e7159c7d11f1907dc476ae3ccf7c852

Download Submit
C:\Windows\system\xEdWZur.exe

Filesize
5.0MB

MD5
56fecbf47f508a123af28114bec87262

SHA1
ddd29c02101eab8673e7616763ee2e9c16e64064

SHA256
69a7c71670c259d9be5bb1d0aac301a2472112c49c9f5448905a77b569f96d55

SHA512
02b351d0dda6e936a8447573c77e8eeb2920a4fb81d08da2c37535e31fe8d805c4a09b29f717ae45056cd43444eed7ece7891710a017deaf6ab8d1f3ee14ad2c

Download Submit
C:\Windows\system\yCDwUca.exe

Filesize
5.0MB

MD5
1fc6938b863d4ffc59ca1b813c481f04

SHA1
f551bc08aea32feecab949fb74529de0112fead5

SHA256
5ad2b74d5ea2c74e3783c309096496a62d3a1cf26100d172b051ce8cca8a97f5

SHA512
73a6543c6a7453a51ccfbcd24af354803a1abbd16e27755f2635ea72897b2c1aefb733311a92187fcc0ff2423d2b8084e44bb5a4c587ba67b89527de1195523e

Download Submit
C:\Windows\system\yjyRWGC.exe

Filesize
5.0MB

MD5
1f7ccdc5d7be2becc36a4d33ae022f2a

SHA1
a48da6e427acb02b4e578236e9ac02a86c2aa42a

SHA256
5744baf2959c22f24b09c2796e9f478bb71bd2e1e686c801038a560278734e5e

SHA512
9ce50f14247447f8c2702494fc7c7d462107bc5d4d74dbeb1e50a4e51dcdceca93dc921bfbe8da8fc8f9d7c98ab0e7a9bc1c098601c9b602335d1631ef7825c7

Download Submit
\Windows\system\EpuOXBj.exe

Filesize
5.0MB

MD5
bdf45d6866b49fae3fae9d7f823a2ffe

SHA1
3967816effeece949cd835b81d66fbc06c7a1ac3

SHA256
2f65432ca9a4c5ccb5504acf10d60bf168fceaa1db9c385db3e96a35e2f41f1c

SHA512
094bfffc1c5470de572a712e6c343a60e6f855b3e687d99df553fd46631087075a4564039b598b926f44280ffed39a28ef5c8521cd75ba5aa2366885b051f082

Download Submit
\Windows\system\HnypiMe.exe

Filesize
5.0MB

MD5
1da84fc5179228edee1197e9844b2dab

SHA1
485197cb09a562f3f0ba798df302b7755072a0ac

SHA256
2a200a02e9f7e30cb1e7cc6b41ea931f72b818fc3dbcb1db91d337c545c40861

SHA512
c188119c69f4e462401241d7418b0dd96470367e0ecf93f702d568cae8c67212ff1cd8aaadd5dbde50fe5494b9a30a0b04a9233546a98e077a3de72e5a884ab2

Download Submit
\Windows\system\TETvfSF.exe

Filesize
5.0MB

MD5
3c60ed47c3585512d8ed6273bcec494a

SHA1
6fcc5aa2c5173261123f2f7a5819c95891e59511

SHA256
4e9fbd6b95cd768d5567586d7976dd773c45ca4c214ac2d276825083cb439621

SHA512
386c04c3a2da309f2e7f645e79a6a682dc3694702d53426edfec1b2e6d9b08cd9603076dc516149b31a6899a0c741b096248dbe19ab28565d6b294aeaf16a595

Download Submit
\Windows\system\qtyXzYd.exe

Filesize
5.0MB

MD5
459a169143215b9741c7698c3d789319

SHA1
c1a7688e8d92673c1ad01d8077dd5415727637ca

SHA256
a0a87785dec1548ada956e010c57a9d16b348056788c3912c2771004e2dadf4e

SHA512
8b48b88f508f298f8afdf2edf90a13400e07bd2beb6293502d5be71c26cf0bb5afc03cd268978587c5cf6a6ad4534f63b44bc0206c41eea84639ebfd8dfa2e66

Download Submit
\Windows\system\tlbwqCT.exe

Filesize
5.0MB

MD5
8cf168200b63cda7661dac18d2e4de9d

SHA1
39daa5018ced7883756ceb62127fc7fc50f04aab

SHA256
3f471726a502dab11ff68ed0f1209dbc414dea1637180e9c70b71bf6f03c65a8

SHA512
a2a07cf275efb8396f23876769ac52e50a577c18868bb2e24f400a51130eccae020c4e8fa059e257a7dc460afc1e24befa1a59f6af2ec706fc94e7b2cdf48aee

Download Submit
\Windows\system\vPEybTG.exe

Filesize
5.0MB

MD5
ed38e3ca52b99d5dd4bbfbd0d41f67ca

SHA1
10a6d23f0cb5b90d69c702a274b393364353510c

SHA256
d06d1d270c4a2dae48f3b2a39dfe91131dac266177c4f59b11b911071c1e0ec8

SHA512
5b44ce24a3343bed9bdceaa7e0e1616f8e7c6674e42719471899f0145d539005a0dc6f73f1d807d04a713b41949974470916c31164519133c5de770aa5de011e

Download Submit
memory/1692-42-0x000000013FB50000-0x000000013FEA4000-memory.dmp

Filesize
3.3MB

Download
memory/2228-3621-0x000000013F9C0000-0x000000013FD14000-memory.dmp

Filesize
3.3MB

Download
memory/2228-30-0x000000013F9C0000-0x000000013FD14000-memory.dmp

Filesize
3.3MB

Download
memory/2260-61-0x000000013FA40000-0x000000013FD94000-memory.dmp

Filesize
3.3MB

Download
memory/2260-3668-0x000000013FA40000-0x000000013FD94000-memory.dmp

Filesize
3.3MB

Download
memory/2264-69-0x000000013F3C0000-0x000000013F714000-memory.dmp

Filesize
3.3MB

Download
memory/2264-3632-0x000000013F3C0000-0x000000013F714000-memory.dmp

Filesize
3.3MB

Download
memory/2264-366-0x000000013F3C0000-0x000000013F714000-memory.dmp

Filesize
3.3MB

Download
memory/2392-22-0x000000013F9C0000-0x000000013FD14000-memory.dmp

Filesize
3.3MB

Download
memory/2392-55-0x000000013F5C0000-0x000000013F914000-memory.dmp

Filesize
3.3MB

Download
memory/2392-885-0x00000000022A0000-0x00000000025F4000-memory.dmp

Filesize
3.3MB

Download
memory/2392-884-0x000000013F7C0000-0x000000013FB14000-memory.dmp

Filesize
3.3MB

Download
memory/2392-883-0x00000000022A0000-0x00000000025F4000-memory.dmp

Filesize
3.3MB

Download
memory/2392-810-0x000000013F670000-0x000000013F9C4000-memory.dmp

Filesize
3.3MB

Download
memory/2392-489-0x00000000022A0000-0x00000000025F4000-memory.dmp

Filesize
3.3MB

Download
memory/2392-59-0x00000000022A0000-0x00000000025F4000-memory.dmp

Filesize
3.3MB

Download
memory/2392-56-0x000000013F8A0000-0x000000013FBF4000-memory.dmp

Filesize
3.3MB

Download
memory/2392-0-0x000000013F1A0000-0x000000013F4F4000-memory.dmp

Filesize
3.3MB

Download
memory/2392-221-0x00000000022A0000-0x00000000025F4000-memory.dmp

Filesize
3.3MB

Download
memory/2392-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2392-104-0x000000013F670000-0x000000013F9C4000-memory.dmp

Filesize
3.3MB

Download
memory/2392-85-0x000000013F1A0000-0x000000013F4F4000-memory.dmp

Filesize
3.3MB

Download
memory/2392-106-0x00000000022A0000-0x00000000025F4000-memory.dmp

Filesize
3.3MB

Download
memory/2392-54-0x000000013FA40000-0x000000013FD94000-memory.dmp

Filesize
3.3MB

Download
memory/2392-58-0x000000013FF30000-0x0000000140284000-memory.dmp

Filesize
3.3MB

Download
memory/2392-46-0x000000013F600000-0x000000013F954000-memory.dmp

Filesize
3.3MB

Download
memory/2392-84-0x00000000022A0000-0x00000000025F4000-memory.dmp

Filesize
3.3MB

Download
memory/2392-37-0x000000013FB50000-0x000000013FEA4000-memory.dmp

Filesize
3.3MB

Download
memory/2584-34-0x000000013F5C0000-0x000000013F914000-memory.dmp

Filesize
3.3MB

Download
memory/2584-3677-0x000000013F5C0000-0x000000013F914000-memory.dmp

Filesize
3.3MB

Download
memory/2816-81-0x000000013F9D0000-0x000000013FD24000-memory.dmp

Filesize
3.3MB

Download
memory/2816-3640-0x000000013F9D0000-0x000000013FD24000-memory.dmp

Filesize
3.3MB

Download
memory/2840-368-0x000000013F230000-0x000000013F584000-memory.dmp

Filesize
3.3MB

Download
memory/2840-78-0x000000013F230000-0x000000013F584000-memory.dmp

Filesize
3.3MB

Download
memory/2904-82-0x000000013FBC0000-0x000000013FF14000-memory.dmp

Filesize
3.3MB

Download
memory/2904-3639-0x000000013FBC0000-0x000000013FF14000-memory.dmp

Filesize
3.3MB

Download
memory/2912-70-0x000000013F8A0000-0x000000013FBF4000-memory.dmp

Filesize
3.3MB

Download
memory/2912-367-0x000000013F8A0000-0x000000013FBF4000-memory.dmp

Filesize
3.3MB

Download
memory/2912-3623-0x000000013F8A0000-0x000000013FBF4000-memory.dmp

Filesize
3.3MB

Download
memory/2928-80-0x000000013FF30000-0x0000000140284000-memory.dmp

Filesize
3.3MB

Download
memory/2928-3678-0x000000013FF30000-0x0000000140284000-memory.dmp

Filesize
3.3MB

Download
memory/2944-3620-0x000000013FFC0000-0x0000000140314000-memory.dmp

Filesize
3.3MB

Download
memory/2944-79-0x000000013FFC0000-0x0000000140314000-memory.dmp

Filesize
3.3MB

Download
memory/2948-52-0x000000013F600000-0x000000013F954000-memory.dmp

Filesize
3.3MB

Download
memory/2948-3838-0x000000013F600000-0x000000013F954000-memory.dmp

Filesize
3.3MB

Download