xmrig | 1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870

Analysis

max time kernel
150s
max time network
20s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
Size

2.7MB
MD5

559594f46b20bf1bb55094f98431c3d6
SHA1

4a15ba5d09ecf840b95acc8a5a72565a32e34f30
SHA256

1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870
SHA512

01fa0a7be938f776af59fb943a4ad35fd1bb9936cb9bb134127def3b1f7e246dafa3fe0fac5dd86bc0591b63c1c804a05c088d602c404cb47485edc8805ba4fc
SSDEEP

49152:EnCbL83y9FdfE0pZ0zCa4wI156uL3pgrCEdMKPFotsgEBr6T:EniLf9FdfE0pZB156utgpPFotBE4

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2116-0-0x000000013F6A0000-0x000000013F9F4000-memory.dmp	xmrig
behavioral1/files/0x000c000000012266-3.dat	xmrig
behavioral1/memory/2164-9-0x000000013F590000-0x000000013F8E4000-memory.dmp	xmrig
behavioral1/memory/2116-7-0x0000000001FD0000-0x0000000002324000-memory.dmp	xmrig
behavioral1/files/0x0008000000016cf0-10.dat	xmrig
behavioral1/memory/1224-16-0x000000013F380000-0x000000013F6D4000-memory.dmp	xmrig
behavioral1/files/0x0007000000016d0c-12.dat	xmrig
behavioral1/files/0x000b000000016cab-22.dat	xmrig
behavioral1/memory/584-23-0x000000013F5B0000-0x000000013F904000-memory.dmp	xmrig
behavioral1/files/0x000a000000016d2c-39.dat	xmrig
behavioral1/memory/2164-43-0x000000013F590000-0x000000013F8E4000-memory.dmp	xmrig
behavioral1/memory/2844-44-0x000000013FAB0000-0x000000013FE04000-memory.dmp	xmrig
behavioral1/memory/3012-37-0x000000013F340000-0x000000013F694000-memory.dmp	xmrig
behavioral1/files/0x0002000000018334-55.dat	xmrig
behavioral1/files/0x0009000000016d3f-47.dat	xmrig
behavioral1/memory/2252-53-0x000000013F1B0000-0x000000013F504000-memory.dmp	xmrig
behavioral1/memory/1224-52-0x000000013F380000-0x000000013F6D4000-memory.dmp	xmrig
behavioral1/memory/2248-76-0x000000013F580000-0x000000013F8D4000-memory.dmp	xmrig
behavioral1/memory/2252-92-0x000000013F1B0000-0x000000013F504000-memory.dmp	xmrig
behavioral1/memory/1084-93-0x000000013F8B0000-0x000000013FC04000-memory.dmp	xmrig
behavioral1/files/0x00050000000195a7-105.dat	xmrig
behavioral1/memory/2332-102-0x000000013FB80000-0x000000013FED4000-memory.dmp	xmrig
behavioral1/files/0x00050000000195c3-172.dat	xmrig
behavioral1/memory/2996-373-0x000000013FAB0000-0x000000013FE04000-memory.dmp	xmrig
behavioral1/memory/2332-330-0x000000013FB80000-0x000000013FED4000-memory.dmp	xmrig
behavioral1/memory/2116-308-0x000000013FB80000-0x000000013FED4000-memory.dmp	xmrig
behavioral1/memory/1084-286-0x000000013F8B0000-0x000000013FC04000-memory.dmp	xmrig
behavioral1/memory/1944-242-0x000000013FC40000-0x000000013FF94000-memory.dmp	xmrig
behavioral1/files/0x000500000001975a-202.dat	xmrig
behavioral1/files/0x0005000000019643-197.dat	xmrig
behavioral1/files/0x000500000001960c-192.dat	xmrig
behavioral1/files/0x00050000000195c7-187.dat	xmrig
behavioral1/files/0x00050000000195c6-183.dat	xmrig
behavioral1/files/0x00050000000195c5-178.dat	xmrig
behavioral1/files/0x00050000000195c1-168.dat	xmrig
behavioral1/files/0x00050000000195bd-162.dat	xmrig
behavioral1/files/0x00050000000195bb-157.dat	xmrig
behavioral1/memory/2248-154-0x000000013F580000-0x000000013F8D4000-memory.dmp	xmrig
behavioral1/files/0x00050000000195b7-151.dat	xmrig
behavioral1/files/0x00050000000195b5-147.dat	xmrig
behavioral1/files/0x00050000000195b1-137.dat	xmrig
behavioral1/files/0x00050000000195b3-141.dat	xmrig
behavioral1/files/0x00050000000195af-131.dat	xmrig
behavioral1/files/0x00050000000195ad-127.dat	xmrig
behavioral1/files/0x00050000000195a9-112.dat	xmrig
behavioral1/files/0x00050000000195ab-119.dat	xmrig
behavioral1/files/0x000500000001957c-101.dat	xmrig
behavioral1/memory/2920-98-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	xmrig
behavioral1/memory/2872-109-0x000000013F770000-0x000000013FAC4000-memory.dmp	xmrig
behavioral1/files/0x0005000000019547-90.dat	xmrig
behavioral1/memory/1944-84-0x000000013FC40000-0x000000013FF94000-memory.dmp	xmrig
behavioral1/memory/2844-83-0x000000013FAB0000-0x000000013FE04000-memory.dmp	xmrig
behavioral1/files/0x0005000000019515-82.dat	xmrig
behavioral1/memory/3012-75-0x000000013F340000-0x000000013F694000-memory.dmp	xmrig
behavioral1/memory/2872-68-0x000000013F770000-0x000000013FAC4000-memory.dmp	xmrig
behavioral1/files/0x00050000000194ef-67.dat	xmrig
behavioral1/files/0x000500000001950f-73.dat	xmrig
behavioral1/memory/2920-61-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	xmrig
behavioral1/memory/584-56-0x000000013F5B0000-0x000000013F904000-memory.dmp	xmrig
behavioral1/memory/2116-36-0x000000013F6A0000-0x000000013F9F4000-memory.dmp	xmrig
behavioral1/files/0x0007000000016d1c-35.dat	xmrig
behavioral1/memory/2116-32-0x000000013F340000-0x000000013F694000-memory.dmp	xmrig
behavioral1/memory/2160-30-0x000000013FFC0000-0x0000000140314000-memory.dmp	xmrig
behavioral1/memory/2160-2081-0x000000013FFC0000-0x0000000140314000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2164	OcZfMHe.exe
1224	IdSVleB.exe
584	XdkDHUY.exe
2160	vKPaOtz.exe
3012	QgFztvC.exe
2844	AvKVAuM.exe
2252	XxHVtXr.exe
2920	JaEwiGu.exe
2872	mCJiwql.exe
2248	EcIwpCw.exe
1944	QFIhVSz.exe
1084	vbrvDzB.exe
2332	PQTDAKu.exe
2996	TXHnfgy.exe
1952	ZjhXTqx.exe
1436	NDPTgsE.exe
1836	ATdVcyw.exe
452	PDpNsCo.exe
840	yFsmbcG.exe
1632	MfdyBIH.exe
904	qFJwTpp.exe
564	JjFdbdr.exe
2292	jodkhMP.exe
2308	kXwoNVL.exe
1532	sLODpwc.exe
2476	UOMpgkt.exe
2436	rUwKFzU.exe
2284	llRsGuy.exe
2064	enRwKCI.exe
912	xubPJTh.exe
2000	PRRgyTc.exe
768	cMvANkF.exe
1208	OxUXEZP.exe
1572	WdBMpRz.exe
1540	gnnDRfH.exe
2584	kmzxaaH.exe
2300	QYtTrAW.exe
2520	ZJfgpmR.exe
2440	TtwalKh.exe
1088	oYCrSdc.exe
2604	WlZjWZa.exe
2056	wmjAPwi.exe
2376	QWxyFed.exe
1976	NMbSiLX.exe
1748	pHNsnPs.exe
2140	LlMIKna.exe
1528	oTiSsKs.exe
1752	pScrGpz.exe
2320	EEkQwic.exe
2288	exWDLil.exe
1624	kWNWCNV.exe
2364	IdvAqcu.exe
2212	WsbrRTw.exe
3052	yyWqVDx.exe
2896	yurCaPb.exe
2180	IYwmkrg.exe
2016	QniDmCW.exe
2444	sCHoYPI.exe
1692	SENKYcI.exe
2992	cWEiQQQ.exe
2344	godvNgd.exe
1108	rqBtVGo.exe
1408	XlhqKCZ.exe
2028	AuuZgiu.exe

Loads dropped DLL 64 IoCs

pid	Process
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2116-0-0x000000013F6A0000-0x000000013F9F4000-memory.dmp	upx
behavioral1/files/0x000c000000012266-3.dat	upx
behavioral1/memory/2164-9-0x000000013F590000-0x000000013F8E4000-memory.dmp	upx
behavioral1/memory/2116-7-0x0000000001FD0000-0x0000000002324000-memory.dmp	upx
behavioral1/files/0x0008000000016cf0-10.dat	upx
behavioral1/memory/1224-16-0x000000013F380000-0x000000013F6D4000-memory.dmp	upx
behavioral1/files/0x0007000000016d0c-12.dat	upx
behavioral1/files/0x000b000000016cab-22.dat	upx
behavioral1/memory/584-23-0x000000013F5B0000-0x000000013F904000-memory.dmp	upx
behavioral1/files/0x000a000000016d2c-39.dat	upx
behavioral1/memory/2164-43-0x000000013F590000-0x000000013F8E4000-memory.dmp	upx
behavioral1/memory/2844-44-0x000000013FAB0000-0x000000013FE04000-memory.dmp	upx
behavioral1/memory/3012-37-0x000000013F340000-0x000000013F694000-memory.dmp	upx
behavioral1/files/0x0002000000018334-55.dat	upx
behavioral1/files/0x0009000000016d3f-47.dat	upx
behavioral1/memory/2252-53-0x000000013F1B0000-0x000000013F504000-memory.dmp	upx
behavioral1/memory/1224-52-0x000000013F380000-0x000000013F6D4000-memory.dmp	upx
behavioral1/memory/2248-76-0x000000013F580000-0x000000013F8D4000-memory.dmp	upx
behavioral1/memory/2252-92-0x000000013F1B0000-0x000000013F504000-memory.dmp	upx
behavioral1/memory/1084-93-0x000000013F8B0000-0x000000013FC04000-memory.dmp	upx
behavioral1/files/0x00050000000195a7-105.dat	upx
behavioral1/memory/2332-102-0x000000013FB80000-0x000000013FED4000-memory.dmp	upx
behavioral1/files/0x00050000000195c3-172.dat	upx
behavioral1/memory/2996-373-0x000000013FAB0000-0x000000013FE04000-memory.dmp	upx
behavioral1/memory/2332-330-0x000000013FB80000-0x000000013FED4000-memory.dmp	upx
behavioral1/memory/1084-286-0x000000013F8B0000-0x000000013FC04000-memory.dmp	upx
behavioral1/memory/1944-242-0x000000013FC40000-0x000000013FF94000-memory.dmp	upx
behavioral1/files/0x000500000001975a-202.dat	upx
behavioral1/files/0x0005000000019643-197.dat	upx
behavioral1/files/0x000500000001960c-192.dat	upx
behavioral1/files/0x00050000000195c7-187.dat	upx
behavioral1/files/0x00050000000195c6-183.dat	upx
behavioral1/files/0x00050000000195c5-178.dat	upx
behavioral1/files/0x00050000000195c1-168.dat	upx
behavioral1/files/0x00050000000195bd-162.dat	upx
behavioral1/files/0x00050000000195bb-157.dat	upx
behavioral1/memory/2248-154-0x000000013F580000-0x000000013F8D4000-memory.dmp	upx
behavioral1/files/0x00050000000195b7-151.dat	upx
behavioral1/files/0x00050000000195b5-147.dat	upx
behavioral1/files/0x00050000000195b1-137.dat	upx
behavioral1/files/0x00050000000195b3-141.dat	upx
behavioral1/files/0x00050000000195af-131.dat	upx
behavioral1/files/0x00050000000195ad-127.dat	upx
behavioral1/files/0x00050000000195a9-112.dat	upx
behavioral1/files/0x00050000000195ab-119.dat	upx
behavioral1/files/0x000500000001957c-101.dat	upx
behavioral1/memory/2920-98-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	upx
behavioral1/memory/2872-109-0x000000013F770000-0x000000013FAC4000-memory.dmp	upx
behavioral1/files/0x0005000000019547-90.dat	upx
behavioral1/memory/1944-84-0x000000013FC40000-0x000000013FF94000-memory.dmp	upx
behavioral1/memory/2844-83-0x000000013FAB0000-0x000000013FE04000-memory.dmp	upx
behavioral1/files/0x0005000000019515-82.dat	upx
behavioral1/memory/3012-75-0x000000013F340000-0x000000013F694000-memory.dmp	upx
behavioral1/memory/2872-68-0x000000013F770000-0x000000013FAC4000-memory.dmp	upx
behavioral1/files/0x00050000000194ef-67.dat	upx
behavioral1/files/0x000500000001950f-73.dat	upx
behavioral1/memory/2920-61-0x000000013F9A0000-0x000000013FCF4000-memory.dmp	upx
behavioral1/memory/584-56-0x000000013F5B0000-0x000000013F904000-memory.dmp	upx
behavioral1/memory/2116-36-0x000000013F6A0000-0x000000013F9F4000-memory.dmp	upx
behavioral1/files/0x0007000000016d1c-35.dat	upx
behavioral1/memory/2160-30-0x000000013FFC0000-0x0000000140314000-memory.dmp	upx
behavioral1/memory/2160-2081-0x000000013FFC0000-0x0000000140314000-memory.dmp	upx
behavioral1/memory/584-2085-0x000000013F5B0000-0x000000013F904000-memory.dmp	upx
behavioral1/memory/1224-2077-0x000000013F380000-0x000000013F6D4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\iLTcUxr.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\ixFJtgV.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\DhfIieF.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\kPBDQOI.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\Mslhzmo.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\mHqJBVw.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\HIKGZFX.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\KxdhegT.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\tXPmbPw.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\KveHMin.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\bGJZKWP.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\LlMIKna.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\asPqvmv.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\JQUkTmA.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\gYNmvgo.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\uSEeher.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\eSCbpgF.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\dTlXBaM.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\uQoMDEK.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\ReUbFmP.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\vciyLSV.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\yZPiCvb.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\hPeHRbE.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\UCaPIKc.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\vUMDtLr.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\lJxixfA.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\DzDOrbI.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\deKJJIP.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\GcMxYGU.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\pEfdQJm.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\YVbbiDq.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\gaUPyTu.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\hssKpxf.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\cWEiQQQ.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\IRvJDNN.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\rAsgmXY.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\WFalVLi.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\oYCrSdc.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\zCJdyNW.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\UNdmpth.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\XCusGKd.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\yFsmbcG.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\VswqhSI.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\DQVFVFw.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\ECUkTnh.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\FdqAkAz.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\BMRfVaK.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\mkgJwet.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\pIrwojc.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\IeYOjSe.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\aQTQfAT.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\JrESkeF.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\oUqTHXd.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\sBHoKTm.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\QbYwqnL.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\lpwUhwZ.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\IjAkPVu.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\AWjDsfc.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\jMGcfMP.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\zIOWoZk.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\nVKMusG.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\FNQNImq.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\duUBIHp.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
File created	C:\Windows\System\adCSezr.exe	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2164	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	31
PID 2116 wrote to memory of 2164	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	31
PID 2116 wrote to memory of 2164	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	31
PID 2116 wrote to memory of 1224	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	32
PID 2116 wrote to memory of 1224	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	32
PID 2116 wrote to memory of 1224	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	32
PID 2116 wrote to memory of 584	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	33
PID 2116 wrote to memory of 584	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	33
PID 2116 wrote to memory of 584	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	33
PID 2116 wrote to memory of 2160	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	34
PID 2116 wrote to memory of 2160	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	34
PID 2116 wrote to memory of 2160	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	34
PID 2116 wrote to memory of 3012	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	35
PID 2116 wrote to memory of 3012	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	35
PID 2116 wrote to memory of 3012	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	35
PID 2116 wrote to memory of 2844	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	36
PID 2116 wrote to memory of 2844	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	36
PID 2116 wrote to memory of 2844	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	36
PID 2116 wrote to memory of 2252	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	37
PID 2116 wrote to memory of 2252	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	37
PID 2116 wrote to memory of 2252	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	37
PID 2116 wrote to memory of 2920	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	38
PID 2116 wrote to memory of 2920	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	38
PID 2116 wrote to memory of 2920	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	38
PID 2116 wrote to memory of 2872	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	39
PID 2116 wrote to memory of 2872	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	39
PID 2116 wrote to memory of 2872	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	39
PID 2116 wrote to memory of 2248	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	40
PID 2116 wrote to memory of 2248	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	40
PID 2116 wrote to memory of 2248	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	40
PID 2116 wrote to memory of 1944	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	41
PID 2116 wrote to memory of 1944	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	41
PID 2116 wrote to memory of 1944	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	41
PID 2116 wrote to memory of 1084	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	42
PID 2116 wrote to memory of 1084	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	42
PID 2116 wrote to memory of 1084	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	42
PID 2116 wrote to memory of 2332	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	43
PID 2116 wrote to memory of 2332	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	43
PID 2116 wrote to memory of 2332	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	43
PID 2116 wrote to memory of 2996	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	44
PID 2116 wrote to memory of 2996	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	44
PID 2116 wrote to memory of 2996	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	44
PID 2116 wrote to memory of 1436	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	45
PID 2116 wrote to memory of 1436	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	45
PID 2116 wrote to memory of 1436	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	45
PID 2116 wrote to memory of 1952	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	46
PID 2116 wrote to memory of 1952	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	46
PID 2116 wrote to memory of 1952	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	46
PID 2116 wrote to memory of 1836	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	47
PID 2116 wrote to memory of 1836	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	47
PID 2116 wrote to memory of 1836	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	47
PID 2116 wrote to memory of 452	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	48
PID 2116 wrote to memory of 452	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	48
PID 2116 wrote to memory of 452	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	48
PID 2116 wrote to memory of 840	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	49
PID 2116 wrote to memory of 840	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	49
PID 2116 wrote to memory of 840	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	49
PID 2116 wrote to memory of 1632	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	50
PID 2116 wrote to memory of 1632	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	50
PID 2116 wrote to memory of 1632	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	50
PID 2116 wrote to memory of 904	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	51
PID 2116 wrote to memory of 904	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	51
PID 2116 wrote to memory of 904	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	51
PID 2116 wrote to memory of 564	2116	JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe	52

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1531f92bbe42151c1511769b39c6403c4732e2e9fc718188e62327c432245870.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\System\OcZfMHe.exe
  C:\Windows\System\OcZfMHe.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\IdSVleB.exe
  C:\Windows\System\IdSVleB.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\XdkDHUY.exe
  C:\Windows\System\XdkDHUY.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\vKPaOtz.exe
  C:\Windows\System\vKPaOtz.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\QgFztvC.exe
  C:\Windows\System\QgFztvC.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\AvKVAuM.exe
  C:\Windows\System\AvKVAuM.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\XxHVtXr.exe
  C:\Windows\System\XxHVtXr.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\JaEwiGu.exe
  C:\Windows\System\JaEwiGu.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\mCJiwql.exe
  C:\Windows\System\mCJiwql.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\EcIwpCw.exe
  C:\Windows\System\EcIwpCw.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\QFIhVSz.exe
  C:\Windows\System\QFIhVSz.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\vbrvDzB.exe
  C:\Windows\System\vbrvDzB.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\PQTDAKu.exe
  C:\Windows\System\PQTDAKu.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\TXHnfgy.exe
  C:\Windows\System\TXHnfgy.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\NDPTgsE.exe
  C:\Windows\System\NDPTgsE.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\ZjhXTqx.exe
  C:\Windows\System\ZjhXTqx.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\ATdVcyw.exe
  C:\Windows\System\ATdVcyw.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\PDpNsCo.exe
  C:\Windows\System\PDpNsCo.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\yFsmbcG.exe
  C:\Windows\System\yFsmbcG.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\MfdyBIH.exe
  C:\Windows\System\MfdyBIH.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\qFJwTpp.exe
  C:\Windows\System\qFJwTpp.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\JjFdbdr.exe
  C:\Windows\System\JjFdbdr.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\jodkhMP.exe
  C:\Windows\System\jodkhMP.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\kXwoNVL.exe
  C:\Windows\System\kXwoNVL.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\sLODpwc.exe
  C:\Windows\System\sLODpwc.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\UOMpgkt.exe
  C:\Windows\System\UOMpgkt.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\rUwKFzU.exe
  C:\Windows\System\rUwKFzU.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\llRsGuy.exe
  C:\Windows\System\llRsGuy.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\enRwKCI.exe
  C:\Windows\System\enRwKCI.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\xubPJTh.exe
  C:\Windows\System\xubPJTh.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\PRRgyTc.exe
  C:\Windows\System\PRRgyTc.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\cMvANkF.exe
  C:\Windows\System\cMvANkF.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\OxUXEZP.exe
  C:\Windows\System\OxUXEZP.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\WdBMpRz.exe
  C:\Windows\System\WdBMpRz.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\gnnDRfH.exe
  C:\Windows\System\gnnDRfH.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\kmzxaaH.exe
  C:\Windows\System\kmzxaaH.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\QYtTrAW.exe
  C:\Windows\System\QYtTrAW.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\ZJfgpmR.exe
  C:\Windows\System\ZJfgpmR.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\TtwalKh.exe
  C:\Windows\System\TtwalKh.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\oYCrSdc.exe
  C:\Windows\System\oYCrSdc.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\WlZjWZa.exe
  C:\Windows\System\WlZjWZa.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\wmjAPwi.exe
  C:\Windows\System\wmjAPwi.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\QWxyFed.exe
  C:\Windows\System\QWxyFed.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\NMbSiLX.exe
  C:\Windows\System\NMbSiLX.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\pHNsnPs.exe
  C:\Windows\System\pHNsnPs.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\LlMIKna.exe
  C:\Windows\System\LlMIKna.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\oTiSsKs.exe
  C:\Windows\System\oTiSsKs.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\pScrGpz.exe
  C:\Windows\System\pScrGpz.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\EEkQwic.exe
  C:\Windows\System\EEkQwic.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\exWDLil.exe
  C:\Windows\System\exWDLil.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\kWNWCNV.exe
  C:\Windows\System\kWNWCNV.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\IdvAqcu.exe
  C:\Windows\System\IdvAqcu.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\WsbrRTw.exe
  C:\Windows\System\WsbrRTw.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\yyWqVDx.exe
  C:\Windows\System\yyWqVDx.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\yurCaPb.exe
  C:\Windows\System\yurCaPb.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\IYwmkrg.exe
  C:\Windows\System\IYwmkrg.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\QniDmCW.exe
  C:\Windows\System\QniDmCW.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\sCHoYPI.exe
  C:\Windows\System\sCHoYPI.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\SENKYcI.exe
  C:\Windows\System\SENKYcI.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\cWEiQQQ.exe
  C:\Windows\System\cWEiQQQ.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\godvNgd.exe
  C:\Windows\System\godvNgd.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\rqBtVGo.exe
  C:\Windows\System\rqBtVGo.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\XlhqKCZ.exe
  C:\Windows\System\XlhqKCZ.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\AuuZgiu.exe
  C:\Windows\System\AuuZgiu.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\lzFNVTi.exe
  C:\Windows\System\lzFNVTi.exe
  2⤵
  PID:1016
- C:\Windows\System\rChSJev.exe
  C:\Windows\System\rChSJev.exe
  2⤵
  PID:2232
- C:\Windows\System\fOhtkMI.exe
  C:\Windows\System\fOhtkMI.exe
  2⤵
  PID:1960
- C:\Windows\System\tEFFVkP.exe
  C:\Windows\System\tEFFVkP.exe
  2⤵
  PID:2472
- C:\Windows\System\FnqbdlV.exe
  C:\Windows\System\FnqbdlV.exe
  2⤵
  PID:680
- C:\Windows\System\cEtRoje.exe
  C:\Windows\System\cEtRoje.exe
  2⤵
  PID:2148
- C:\Windows\System\nVKMusG.exe
  C:\Windows\System\nVKMusG.exe
  2⤵
  PID:1420
- C:\Windows\System\sWIeMvj.exe
  C:\Windows\System\sWIeMvj.exe
  2⤵
  PID:1364
- C:\Windows\System\PuQbyip.exe
  C:\Windows\System\PuQbyip.exe
  2⤵
  PID:2576
- C:\Windows\System\QaXYidM.exe
  C:\Windows\System\QaXYidM.exe
  2⤵
  PID:1764
- C:\Windows\System\VHVoWyd.exe
  C:\Windows\System\VHVoWyd.exe
  2⤵
  PID:1744
- C:\Windows\System\DEEiabJ.exe
  C:\Windows\System\DEEiabJ.exe
  2⤵
  PID:576
- C:\Windows\System\NbTOnGl.exe
  C:\Windows\System\NbTOnGl.exe
  2⤵
  PID:2448
- C:\Windows\System\MNdAYQM.exe
  C:\Windows\System\MNdAYQM.exe
  2⤵
  PID:2752
- C:\Windows\System\NeKSIHK.exe
  C:\Windows\System\NeKSIHK.exe
  2⤵
  PID:1524
- C:\Windows\System\nSrGPAx.exe
  C:\Windows\System\nSrGPAx.exe
  2⤵
  PID:2612
- C:\Windows\System\jPUnocO.exe
  C:\Windows\System\jPUnocO.exe
  2⤵
  PID:1628
- C:\Windows\System\xPyyWVK.exe
  C:\Windows\System\xPyyWVK.exe
  2⤵
  PID:1616
- C:\Windows\System\TaYaMxg.exe
  C:\Windows\System\TaYaMxg.exe
  2⤵
  PID:2948
- C:\Windows\System\JVQqkzH.exe
  C:\Windows\System\JVQqkzH.exe
  2⤵
  PID:2036
- C:\Windows\System\tFjuopP.exe
  C:\Windows\System\tFjuopP.exe
  2⤵
  PID:2884
- C:\Windows\System\uGLsXPy.exe
  C:\Windows\System\uGLsXPy.exe
  2⤵
  PID:2784
- C:\Windows\System\dWsXuYc.exe
  C:\Windows\System\dWsXuYc.exe
  2⤵
  PID:2792
- C:\Windows\System\StpOoYk.exe
  C:\Windows\System\StpOoYk.exe
  2⤵
  PID:2192
- C:\Windows\System\GSyjYvQ.exe
  C:\Windows\System\GSyjYvQ.exe
  2⤵
  PID:1396
- C:\Windows\System\xyKRnjl.exe
  C:\Windows\System\xyKRnjl.exe
  2⤵
  PID:2504
- C:\Windows\System\JGcRBfr.exe
  C:\Windows\System\JGcRBfr.exe
  2⤵
  PID:2464
- C:\Windows\System\HEmDdpc.exe
  C:\Windows\System\HEmDdpc.exe
  2⤵
  PID:624
- C:\Windows\System\asPqvmv.exe
  C:\Windows\System\asPqvmv.exe
  2⤵
  PID:2776
- C:\Windows\System\wKNgudd.exe
  C:\Windows\System\wKNgudd.exe
  2⤵
  PID:1796
- C:\Windows\System\sdopFDf.exe
  C:\Windows\System\sdopFDf.exe
  2⤵
  PID:1564
- C:\Windows\System\pttfaIs.exe
  C:\Windows\System\pttfaIs.exe
  2⤵
  PID:1708
- C:\Windows\System\kRoiFrN.exe
  C:\Windows\System\kRoiFrN.exe
  2⤵
  PID:2628
- C:\Windows\System\yFNmKhP.exe
  C:\Windows\System\yFNmKhP.exe
  2⤵
  PID:2616
- C:\Windows\System\hLharyh.exe
  C:\Windows\System\hLharyh.exe
  2⤵
  PID:888
- C:\Windows\System\OWRYZTw.exe
  C:\Windows\System\OWRYZTw.exe
  2⤵
  PID:2368
- C:\Windows\System\QalxfvB.exe
  C:\Windows\System\QalxfvB.exe
  2⤵
  PID:2044
- C:\Windows\System\QcazeJU.exe
  C:\Windows\System\QcazeJU.exe
  2⤵
  PID:2496
- C:\Windows\System\lApCYGH.exe
  C:\Windows\System\lApCYGH.exe
  2⤵
  PID:1248
- C:\Windows\System\IOjVBFv.exe
  C:\Windows\System\IOjVBFv.exe
  2⤵
  PID:3076
- C:\Windows\System\staaChS.exe
  C:\Windows\System\staaChS.exe
  2⤵
  PID:3096
- C:\Windows\System\HjRXPci.exe
  C:\Windows\System\HjRXPci.exe
  2⤵
  PID:3116
- C:\Windows\System\EtdXubW.exe
  C:\Windows\System\EtdXubW.exe
  2⤵
  PID:3136
- C:\Windows\System\PUurEju.exe
  C:\Windows\System\PUurEju.exe
  2⤵
  PID:3156
- C:\Windows\System\TomwYHR.exe
  C:\Windows\System\TomwYHR.exe
  2⤵
  PID:3176
- C:\Windows\System\uSEeher.exe
  C:\Windows\System\uSEeher.exe
  2⤵
  PID:3196
- C:\Windows\System\kjiVgze.exe
  C:\Windows\System\kjiVgze.exe
  2⤵
  PID:3216
- C:\Windows\System\ZRRCplQ.exe
  C:\Windows\System\ZRRCplQ.exe
  2⤵
  PID:3236
- C:\Windows\System\XObNUSf.exe
  C:\Windows\System\XObNUSf.exe
  2⤵
  PID:3256
- C:\Windows\System\NPkszkx.exe
  C:\Windows\System\NPkszkx.exe
  2⤵
  PID:3276
- C:\Windows\System\PZzDpRV.exe
  C:\Windows\System\PZzDpRV.exe
  2⤵
  PID:3296
- C:\Windows\System\gQmkDNy.exe
  C:\Windows\System\gQmkDNy.exe
  2⤵
  PID:3316
- C:\Windows\System\QIQVVQm.exe
  C:\Windows\System\QIQVVQm.exe
  2⤵
  PID:3340
- C:\Windows\System\HqIVtUi.exe
  C:\Windows\System\HqIVtUi.exe
  2⤵
  PID:3360
- C:\Windows\System\xXYiBLD.exe
  C:\Windows\System\xXYiBLD.exe
  2⤵
  PID:3380
- C:\Windows\System\PofQFCT.exe
  C:\Windows\System\PofQFCT.exe
  2⤵
  PID:3400
- C:\Windows\System\IRvJDNN.exe
  C:\Windows\System\IRvJDNN.exe
  2⤵
  PID:3420
- C:\Windows\System\rXovjTR.exe
  C:\Windows\System\rXovjTR.exe
  2⤵
  PID:3440
- C:\Windows\System\KCscoAe.exe
  C:\Windows\System\KCscoAe.exe
  2⤵
  PID:3460
- C:\Windows\System\fhnLKsW.exe
  C:\Windows\System\fhnLKsW.exe
  2⤵
  PID:3476
- C:\Windows\System\ZMbignX.exe
  C:\Windows\System\ZMbignX.exe
  2⤵
  PID:3500
- C:\Windows\System\wmxEMsL.exe
  C:\Windows\System\wmxEMsL.exe
  2⤵
  PID:3520
- C:\Windows\System\kDQPSVN.exe
  C:\Windows\System\kDQPSVN.exe
  2⤵
  PID:3540
- C:\Windows\System\frbawDZ.exe
  C:\Windows\System\frbawDZ.exe
  2⤵
  PID:3560
- C:\Windows\System\WEZsDQg.exe
  C:\Windows\System\WEZsDQg.exe
  2⤵
  PID:3580
- C:\Windows\System\jMaslGN.exe
  C:\Windows\System\jMaslGN.exe
  2⤵
  PID:3600
- C:\Windows\System\RcZlMio.exe
  C:\Windows\System\RcZlMio.exe
  2⤵
  PID:3620
- C:\Windows\System\LMXQkjZ.exe
  C:\Windows\System\LMXQkjZ.exe
  2⤵
  PID:3640
- C:\Windows\System\IGkpNWz.exe
  C:\Windows\System\IGkpNWz.exe
  2⤵
  PID:3660
- C:\Windows\System\gsxcGUW.exe
  C:\Windows\System\gsxcGUW.exe
  2⤵
  PID:3676
- C:\Windows\System\OTBqLVT.exe
  C:\Windows\System\OTBqLVT.exe
  2⤵
  PID:3700
- C:\Windows\System\syyFZHw.exe
  C:\Windows\System\syyFZHw.exe
  2⤵
  PID:3716
- C:\Windows\System\yVAMiOQ.exe
  C:\Windows\System\yVAMiOQ.exe
  2⤵
  PID:3740
- C:\Windows\System\BUEpKGj.exe
  C:\Windows\System\BUEpKGj.exe
  2⤵
  PID:3760
- C:\Windows\System\wydEeES.exe
  C:\Windows\System\wydEeES.exe
  2⤵
  PID:3780
- C:\Windows\System\WUxAfPT.exe
  C:\Windows\System\WUxAfPT.exe
  2⤵
  PID:3800
- C:\Windows\System\jfVbSNk.exe
  C:\Windows\System\jfVbSNk.exe
  2⤵
  PID:3824
- C:\Windows\System\AuCgCwA.exe
  C:\Windows\System\AuCgCwA.exe
  2⤵
  PID:3844
- C:\Windows\System\ErGMRGx.exe
  C:\Windows\System\ErGMRGx.exe
  2⤵
  PID:3864
- C:\Windows\System\bGbgmFq.exe
  C:\Windows\System\bGbgmFq.exe
  2⤵
  PID:3884
- C:\Windows\System\ZLDclTq.exe
  C:\Windows\System\ZLDclTq.exe
  2⤵
  PID:3904
- C:\Windows\System\YPcIrTE.exe
  C:\Windows\System\YPcIrTE.exe
  2⤵
  PID:3920
- C:\Windows\System\OYHAQMX.exe
  C:\Windows\System\OYHAQMX.exe
  2⤵
  PID:3944
- C:\Windows\System\axcyRiU.exe
  C:\Windows\System\axcyRiU.exe
  2⤵
  PID:3964
- C:\Windows\System\GxWnMzZ.exe
  C:\Windows\System\GxWnMzZ.exe
  2⤵
  PID:3984
- C:\Windows\System\FABmLbE.exe
  C:\Windows\System\FABmLbE.exe
  2⤵
  PID:4004
- C:\Windows\System\RGmhocg.exe
  C:\Windows\System\RGmhocg.exe
  2⤵
  PID:4024
- C:\Windows\System\SAphmeR.exe
  C:\Windows\System\SAphmeR.exe
  2⤵
  PID:4044
- C:\Windows\System\AElwbPl.exe
  C:\Windows\System\AElwbPl.exe
  2⤵
  PID:4064
- C:\Windows\System\uMCyikm.exe
  C:\Windows\System\uMCyikm.exe
  2⤵
  PID:4084
- C:\Windows\System\PweyMha.exe
  C:\Windows\System\PweyMha.exe
  2⤵
  PID:2560
- C:\Windows\System\kCrViUV.exe
  C:\Windows\System\kCrViUV.exe
  2⤵
  PID:2348
- C:\Windows\System\MWaqsvP.exe
  C:\Windows\System\MWaqsvP.exe
  2⤵
  PID:820
- C:\Windows\System\mNqsUQU.exe
  C:\Windows\System\mNqsUQU.exe
  2⤵
  PID:560
- C:\Windows\System\jwnraAo.exe
  C:\Windows\System\jwnraAo.exe
  2⤵
  PID:1080
- C:\Windows\System\KCBjBDQ.exe
  C:\Windows\System\KCBjBDQ.exe
  2⤵
  PID:1232
- C:\Windows\System\JQUkTmA.exe
  C:\Windows\System\JQUkTmA.exe
  2⤵
  PID:2108
- C:\Windows\System\CVPdPEz.exe
  C:\Windows\System\CVPdPEz.exe
  2⤵
  PID:1256
- C:\Windows\System\nzZztcf.exe
  C:\Windows\System\nzZztcf.exe
  2⤵
  PID:1704
- C:\Windows\System\wTTWVsP.exe
  C:\Windows\System\wTTWVsP.exe
  2⤵
  PID:2524
- C:\Windows\System\FqDyaBQ.exe
  C:\Windows\System\FqDyaBQ.exe
  2⤵
  PID:2168
- C:\Windows\System\rlpXIol.exe
  C:\Windows\System\rlpXIol.exe
  2⤵
  PID:3128
- C:\Windows\System\dpCeosz.exe
  C:\Windows\System\dpCeosz.exe
  2⤵
  PID:3152
- C:\Windows\System\lBSeLEv.exe
  C:\Windows\System\lBSeLEv.exe
  2⤵
  PID:3188
- C:\Windows\System\Vnkcwag.exe
  C:\Windows\System\Vnkcwag.exe
  2⤵
  PID:3224
- C:\Windows\System\nuZzPiN.exe
  C:\Windows\System\nuZzPiN.exe
  2⤵
  PID:3288
- C:\Windows\System\VswqhSI.exe
  C:\Windows\System\VswqhSI.exe
  2⤵
  PID:3328
- C:\Windows\System\oPNPfYT.exe
  C:\Windows\System\oPNPfYT.exe
  2⤵
  PID:3312
- C:\Windows\System\JKpxENi.exe
  C:\Windows\System\JKpxENi.exe
  2⤵
  PID:3408
- C:\Windows\System\gaIlNnG.exe
  C:\Windows\System\gaIlNnG.exe
  2⤵
  PID:3396
- C:\Windows\System\SWXDGIj.exe
  C:\Windows\System\SWXDGIj.exe
  2⤵
  PID:3452
- C:\Windows\System\PVkekns.exe
  C:\Windows\System\PVkekns.exe
  2⤵
  PID:3496
- C:\Windows\System\ZGuiSDI.exe
  C:\Windows\System\ZGuiSDI.exe
  2⤵
  PID:3568
- C:\Windows\System\syPDmKZ.exe
  C:\Windows\System\syPDmKZ.exe
  2⤵
  PID:3516
- C:\Windows\System\CSblWYh.exe
  C:\Windows\System\CSblWYh.exe
  2⤵
  PID:3552
- C:\Windows\System\hVZXUnx.exe
  C:\Windows\System\hVZXUnx.exe
  2⤵
  PID:3596
- C:\Windows\System\TducpUs.exe
  C:\Windows\System\TducpUs.exe
  2⤵
  PID:3652
- C:\Windows\System\idfTqlg.exe
  C:\Windows\System\idfTqlg.exe
  2⤵
  PID:3688
- C:\Windows\System\nnUOuvW.exe
  C:\Windows\System\nnUOuvW.exe
  2⤵
  PID:3736
- C:\Windows\System\blrYxIS.exe
  C:\Windows\System\blrYxIS.exe
  2⤵
  PID:3772
- C:\Windows\System\HCUbBdB.exe
  C:\Windows\System\HCUbBdB.exe
  2⤵
  PID:3752
- C:\Windows\System\DQLfBlO.exe
  C:\Windows\System\DQLfBlO.exe
  2⤵
  PID:3860
- C:\Windows\System\EYJbybZ.exe
  C:\Windows\System\EYJbybZ.exe
  2⤵
  PID:3832
- C:\Windows\System\eSCbpgF.exe
  C:\Windows\System\eSCbpgF.exe
  2⤵
  PID:3872
- C:\Windows\System\rQsXiwM.exe
  C:\Windows\System\rQsXiwM.exe
  2⤵
  PID:3940
- C:\Windows\System\DhFGhAE.exe
  C:\Windows\System\DhFGhAE.exe
  2⤵
  PID:3960
- C:\Windows\System\bnXMDcs.exe
  C:\Windows\System\bnXMDcs.exe
  2⤵
  PID:4012
- C:\Windows\System\rMjJfnJ.exe
  C:\Windows\System\rMjJfnJ.exe
  2⤵
  PID:3996
- C:\Windows\System\bMFBylF.exe
  C:\Windows\System\bMFBylF.exe
  2⤵
  PID:4092
- C:\Windows\System\nTZNbzL.exe
  C:\Windows\System\nTZNbzL.exe
  2⤵
  PID:928
- C:\Windows\System\HaWnbMd.exe
  C:\Windows\System\HaWnbMd.exe
  2⤵
  PID:2032
- C:\Windows\System\sbBOhrd.exe
  C:\Windows\System\sbBOhrd.exe
  2⤵
  PID:1720
- C:\Windows\System\rOeALNG.exe
  C:\Windows\System\rOeALNG.exe
  2⤵
  PID:2556
- C:\Windows\System\CPcLceQ.exe
  C:\Windows\System\CPcLceQ.exe
  2⤵
  PID:1700
- C:\Windows\System\cncwGTn.exe
  C:\Windows\System\cncwGTn.exe
  2⤵
  PID:2156
- C:\Windows\System\SfubVlG.exe
  C:\Windows\System\SfubVlG.exe
  2⤵
  PID:872
- C:\Windows\System\JTDcizl.exe
  C:\Windows\System\JTDcizl.exe
  2⤵
  PID:2480
- C:\Windows\System\rSowSGP.exe
  C:\Windows\System\rSowSGP.exe
  2⤵
  PID:3144
- C:\Windows\System\bumONpo.exe
  C:\Windows\System\bumONpo.exe
  2⤵
  PID:3252
- C:\Windows\System\JeuyoBj.exe
  C:\Windows\System\JeuyoBj.exe
  2⤵
  PID:3304
- C:\Windows\System\ifxRjDX.exe
  C:\Windows\System\ifxRjDX.exe
  2⤵
  PID:3348
- C:\Windows\System\YVsgFgp.exe
  C:\Windows\System\YVsgFgp.exe
  2⤵
  PID:3372
- C:\Windows\System\SrHeXJj.exe
  C:\Windows\System\SrHeXJj.exe
  2⤵
  PID:3356
- C:\Windows\System\DXFTIVn.exe
  C:\Windows\System\DXFTIVn.exe
  2⤵
  PID:3532
- C:\Windows\System\PEOYgHQ.exe
  C:\Windows\System\PEOYgHQ.exe
  2⤵
  PID:3512
- C:\Windows\System\cAVTnAb.exe
  C:\Windows\System\cAVTnAb.exe
  2⤵
  PID:3656
- C:\Windows\System\mmsjnyp.exe
  C:\Windows\System\mmsjnyp.exe
  2⤵
  PID:3724
- C:\Windows\System\pMfpLuI.exe
  C:\Windows\System\pMfpLuI.exe
  2⤵
  PID:3632
- C:\Windows\System\gWoUzEf.exe
  C:\Windows\System\gWoUzEf.exe
  2⤵
  PID:3796
- C:\Windows\System\lwowVXT.exe
  C:\Windows\System\lwowVXT.exe
  2⤵
  PID:3776
- C:\Windows\System\BFVnjVG.exe
  C:\Windows\System\BFVnjVG.exe
  2⤵
  PID:3896
- C:\Windows\System\nXbxgnD.exe
  C:\Windows\System\nXbxgnD.exe
  2⤵
  PID:3972
- C:\Windows\System\BQdEsjh.exe
  C:\Windows\System\BQdEsjh.exe
  2⤵
  PID:3976
- C:\Windows\System\NBEyQTf.exe
  C:\Windows\System\NBEyQTf.exe
  2⤵
  PID:4000
- C:\Windows\System\XPKYWdY.exe
  C:\Windows\System\XPKYWdY.exe
  2⤵
  PID:4108
- C:\Windows\System\sLwHzNY.exe
  C:\Windows\System\sLwHzNY.exe
  2⤵
  PID:4128
- C:\Windows\System\uQoMDEK.exe
  C:\Windows\System\uQoMDEK.exe
  2⤵
  PID:4148
- C:\Windows\System\nPsBHgU.exe
  C:\Windows\System\nPsBHgU.exe
  2⤵
  PID:4168
- C:\Windows\System\OWWcrKs.exe
  C:\Windows\System\OWWcrKs.exe
  2⤵
  PID:4188
- C:\Windows\System\RrscsAw.exe
  C:\Windows\System\RrscsAw.exe
  2⤵
  PID:4208
- C:\Windows\System\dJhtrWe.exe
  C:\Windows\System\dJhtrWe.exe
  2⤵
  PID:4228
- C:\Windows\System\TuHeIdH.exe
  C:\Windows\System\TuHeIdH.exe
  2⤵
  PID:4248
- C:\Windows\System\yDculxu.exe
  C:\Windows\System\yDculxu.exe
  2⤵
  PID:4268
- C:\Windows\System\QAWEuGo.exe
  C:\Windows\System\QAWEuGo.exe
  2⤵
  PID:4284
- C:\Windows\System\byrgUFj.exe
  C:\Windows\System\byrgUFj.exe
  2⤵
  PID:4308
- C:\Windows\System\xxlpvwM.exe
  C:\Windows\System\xxlpvwM.exe
  2⤵
  PID:4328
- C:\Windows\System\hlXymCG.exe
  C:\Windows\System\hlXymCG.exe
  2⤵
  PID:4348
- C:\Windows\System\blccNNy.exe
  C:\Windows\System\blccNNy.exe
  2⤵
  PID:4368
- C:\Windows\System\SAFWjfw.exe
  C:\Windows\System\SAFWjfw.exe
  2⤵
  PID:4388
- C:\Windows\System\vNMwqMp.exe
  C:\Windows\System\vNMwqMp.exe
  2⤵
  PID:4408
- C:\Windows\System\TEMLcJm.exe
  C:\Windows\System\TEMLcJm.exe
  2⤵
  PID:4428
- C:\Windows\System\cMIfvJW.exe
  C:\Windows\System\cMIfvJW.exe
  2⤵
  PID:4448
- C:\Windows\System\dhacLuf.exe
  C:\Windows\System\dhacLuf.exe
  2⤵
  PID:4468
- C:\Windows\System\FZjPLsq.exe
  C:\Windows\System\FZjPLsq.exe
  2⤵
  PID:4488
- C:\Windows\System\gbHRxiO.exe
  C:\Windows\System\gbHRxiO.exe
  2⤵
  PID:4508
- C:\Windows\System\SilUFwh.exe
  C:\Windows\System\SilUFwh.exe
  2⤵
  PID:4528
- C:\Windows\System\OtiztpT.exe
  C:\Windows\System\OtiztpT.exe
  2⤵
  PID:4548
- C:\Windows\System\ldxYIpZ.exe
  C:\Windows\System\ldxYIpZ.exe
  2⤵
  PID:4568
- C:\Windows\System\zCJdyNW.exe
  C:\Windows\System\zCJdyNW.exe
  2⤵
  PID:4588
- C:\Windows\System\sVJeyVm.exe
  C:\Windows\System\sVJeyVm.exe
  2⤵
  PID:4608
- C:\Windows\System\IOngUyO.exe
  C:\Windows\System\IOngUyO.exe
  2⤵
  PID:4628
- C:\Windows\System\BzlUhjF.exe
  C:\Windows\System\BzlUhjF.exe
  2⤵
  PID:4644
- C:\Windows\System\klZWIpf.exe
  C:\Windows\System\klZWIpf.exe
  2⤵
  PID:4668
- C:\Windows\System\QXKZkMS.exe
  C:\Windows\System\QXKZkMS.exe
  2⤵
  PID:4688
- C:\Windows\System\xGaFUiE.exe
  C:\Windows\System\xGaFUiE.exe
  2⤵
  PID:4708
- C:\Windows\System\kPktzOH.exe
  C:\Windows\System\kPktzOH.exe
  2⤵
  PID:4728
- C:\Windows\System\mvYsrVw.exe
  C:\Windows\System\mvYsrVw.exe
  2⤵
  PID:4748
- C:\Windows\System\wKiTpUf.exe
  C:\Windows\System\wKiTpUf.exe
  2⤵
  PID:4768
- C:\Windows\System\KErSvDR.exe
  C:\Windows\System\KErSvDR.exe
  2⤵
  PID:4788
- C:\Windows\System\qGpYvkf.exe
  C:\Windows\System\qGpYvkf.exe
  2⤵
  PID:4808
- C:\Windows\System\xWzlJgU.exe
  C:\Windows\System\xWzlJgU.exe
  2⤵
  PID:4828
- C:\Windows\System\IqpZtKI.exe
  C:\Windows\System\IqpZtKI.exe
  2⤵
  PID:4844
- C:\Windows\System\XjqLCXI.exe
  C:\Windows\System\XjqLCXI.exe
  2⤵
  PID:4868
- C:\Windows\System\FrCfVEW.exe
  C:\Windows\System\FrCfVEW.exe
  2⤵
  PID:4884
- C:\Windows\System\TZCjlol.exe
  C:\Windows\System\TZCjlol.exe
  2⤵
  PID:4908
- C:\Windows\System\EdgsGfo.exe
  C:\Windows\System\EdgsGfo.exe
  2⤵
  PID:4924
- C:\Windows\System\YWRtVqG.exe
  C:\Windows\System\YWRtVqG.exe
  2⤵
  PID:4948
- C:\Windows\System\rkAaosV.exe
  C:\Windows\System\rkAaosV.exe
  2⤵
  PID:4968
- C:\Windows\System\lmbZuJw.exe
  C:\Windows\System\lmbZuJw.exe
  2⤵
  PID:4988
- C:\Windows\System\wlINgJb.exe
  C:\Windows\System\wlINgJb.exe
  2⤵
  PID:5008
- C:\Windows\System\TzHfklp.exe
  C:\Windows\System\TzHfklp.exe
  2⤵
  PID:5028
- C:\Windows\System\nFOIMoj.exe
  C:\Windows\System\nFOIMoj.exe
  2⤵
  PID:5048
- C:\Windows\System\YaWxnVO.exe
  C:\Windows\System\YaWxnVO.exe
  2⤵
  PID:5068
- C:\Windows\System\GycQzSN.exe
  C:\Windows\System\GycQzSN.exe
  2⤵
  PID:5088
- C:\Windows\System\vIAFsTW.exe
  C:\Windows\System\vIAFsTW.exe
  2⤵
  PID:5108
- C:\Windows\System\OTCcdJl.exe
  C:\Windows\System\OTCcdJl.exe
  2⤵
  PID:4080
- C:\Windows\System\AiHcPRv.exe
  C:\Windows\System\AiHcPRv.exe
  2⤵
  PID:2244
- C:\Windows\System\sASAxfb.exe
  C:\Windows\System\sASAxfb.exe
  2⤵
  PID:1656
- C:\Windows\System\wdRJjPA.exe
  C:\Windows\System\wdRJjPA.exe
  2⤵
  PID:2916
- C:\Windows\System\GtEpHvR.exe
  C:\Windows\System\GtEpHvR.exe
  2⤵
  PID:2104
- C:\Windows\System\LyoMNzM.exe
  C:\Windows\System\LyoMNzM.exe
  2⤵
  PID:3212
- C:\Windows\System\sBHoKTm.exe
  C:\Windows\System\sBHoKTm.exe
  2⤵
  PID:3184
- C:\Windows\System\TUrwirJ.exe
  C:\Windows\System\TUrwirJ.exe
  2⤵
  PID:3428
- C:\Windows\System\jvTpEXN.exe
  C:\Windows\System\jvTpEXN.exe
  2⤵
  PID:3332
- C:\Windows\System\UbkcvCy.exe
  C:\Windows\System\UbkcvCy.exe
  2⤵
  PID:3492
- C:\Windows\System\dLygFyo.exe
  C:\Windows\System\dLygFyo.exe
  2⤵
  PID:3732
- C:\Windows\System\VDUbGIz.exe
  C:\Windows\System\VDUbGIz.exe
  2⤵
  PID:3756
- C:\Windows\System\cEouhhI.exe
  C:\Windows\System\cEouhhI.exe
  2⤵
  PID:3852
- C:\Windows\System\oaAAHEf.exe
  C:\Windows\System\oaAAHEf.exe
  2⤵
  PID:3900
- C:\Windows\System\MjWdKiM.exe
  C:\Windows\System\MjWdKiM.exe
  2⤵
  PID:4032
- C:\Windows\System\WPgktnl.exe
  C:\Windows\System\WPgktnl.exe
  2⤵
  PID:3992
- C:\Windows\System\IQSYkwm.exe
  C:\Windows\System\IQSYkwm.exe
  2⤵
  PID:4176
- C:\Windows\System\srhAOQx.exe
  C:\Windows\System\srhAOQx.exe
  2⤵
  PID:4124
- C:\Windows\System\hmFUWAL.exe
  C:\Windows\System\hmFUWAL.exe
  2⤵
  PID:4156
- C:\Windows\System\lVhuMue.exe
  C:\Windows\System\lVhuMue.exe
  2⤵
  PID:4244
- C:\Windows\System\eoWFTAf.exe
  C:\Windows\System\eoWFTAf.exe
  2⤵
  PID:4260
- C:\Windows\System\jhxONgE.exe
  C:\Windows\System\jhxONgE.exe
  2⤵
  PID:4276
- C:\Windows\System\rrkudhj.exe
  C:\Windows\System\rrkudhj.exe
  2⤵
  PID:4320
- C:\Windows\System\SjqwdQS.exe
  C:\Windows\System\SjqwdQS.exe
  2⤵
  PID:4416
- C:\Windows\System\mktMPRO.exe
  C:\Windows\System\mktMPRO.exe
  2⤵
  PID:4404
- C:\Windows\System\LrAlEIq.exe
  C:\Windows\System\LrAlEIq.exe
  2⤵
  PID:4436
- C:\Windows\System\CVTzJde.exe
  C:\Windows\System\CVTzJde.exe
  2⤵
  PID:4476
- C:\Windows\System\eIvrDFG.exe
  C:\Windows\System\eIvrDFG.exe
  2⤵
  PID:2828
- C:\Windows\System\hcVLwXu.exe
  C:\Windows\System\hcVLwXu.exe
  2⤵
  PID:4516
- C:\Windows\System\KETlSGQ.exe
  C:\Windows\System\KETlSGQ.exe
  2⤵
  PID:4564
- C:\Windows\System\fcwKALk.exe
  C:\Windows\System\fcwKALk.exe
  2⤵
  PID:4624
- C:\Windows\System\nMFJmah.exe
  C:\Windows\System\nMFJmah.exe
  2⤵
  PID:4656
- C:\Windows\System\dSHoSVp.exe
  C:\Windows\System\dSHoSVp.exe
  2⤵
  PID:4640
- C:\Windows\System\pTHCtAP.exe
  C:\Windows\System\pTHCtAP.exe
  2⤵
  PID:4680
- C:\Windows\System\CMgLiga.exe
  C:\Windows\System\CMgLiga.exe
  2⤵
  PID:4716
- C:\Windows\System\XbtfJzY.exe
  C:\Windows\System\XbtfJzY.exe
  2⤵
  PID:4756
- C:\Windows\System\rlZCtcK.exe
  C:\Windows\System\rlZCtcK.exe
  2⤵
  PID:4816
- C:\Windows\System\QoFjSBL.exe
  C:\Windows\System\QoFjSBL.exe
  2⤵
  PID:4800
- C:\Windows\System\aAsRikI.exe
  C:\Windows\System\aAsRikI.exe
  2⤵
  PID:4892
- C:\Windows\System\xwCnCTQ.exe
  C:\Windows\System\xwCnCTQ.exe
  2⤵
  PID:4936
- C:\Windows\System\ujEusKc.exe
  C:\Windows\System\ujEusKc.exe
  2⤵
  PID:4840
- C:\Windows\System\BfepDyi.exe
  C:\Windows\System\BfepDyi.exe
  2⤵
  PID:4984
- C:\Windows\System\DhfIieF.exe
  C:\Windows\System\DhfIieF.exe
  2⤵
  PID:4956
- C:\Windows\System\zskqhjp.exe
  C:\Windows\System\zskqhjp.exe
  2⤵
  PID:5060
- C:\Windows\System\aFEZMZw.exe
  C:\Windows\System\aFEZMZw.exe
  2⤵
  PID:3168
- C:\Windows\System\KveHMin.exe
  C:\Windows\System\KveHMin.exe
  2⤵
  PID:1668
- C:\Windows\System\FNRCndL.exe
  C:\Windows\System\FNRCndL.exe
  2⤵
  PID:4996
- C:\Windows\System\LKXizqT.exe
  C:\Windows\System\LKXizqT.exe
  2⤵
  PID:5076
- C:\Windows\System\getdKRV.exe
  C:\Windows\System\getdKRV.exe
  2⤵
  PID:4076
- C:\Windows\System\HIKGZFX.exe
  C:\Windows\System\HIKGZFX.exe
  2⤵
  PID:3272
- C:\Windows\System\CpZLDnM.exe
  C:\Windows\System\CpZLDnM.exe
  2⤵
  PID:3672
- C:\Windows\System\WMucoSM.exe
  C:\Windows\System\WMucoSM.exe
  2⤵
  PID:3892
- C:\Windows\System\djxuaDY.exe
  C:\Windows\System\djxuaDY.exe
  2⤵
  PID:3148
- C:\Windows\System\IRQQKSG.exe
  C:\Windows\System\IRQQKSG.exe
  2⤵
  PID:3768
- C:\Windows\System\TFveJYg.exe
  C:\Windows\System\TFveJYg.exe
  2⤵
  PID:3508
- C:\Windows\System\ODWUpzd.exe
  C:\Windows\System\ODWUpzd.exe
  2⤵
  PID:2484
- C:\Windows\System\IckMxXz.exe
  C:\Windows\System\IckMxXz.exe
  2⤵
  PID:3912
- C:\Windows\System\FgSykYs.exe
  C:\Windows\System\FgSykYs.exe
  2⤵
  PID:4140
- C:\Windows\System\QckGipR.exe
  C:\Windows\System\QckGipR.exe
  2⤵
  PID:4196
- C:\Windows\System\xqeyWzq.exe
  C:\Windows\System\xqeyWzq.exe
  2⤵
  PID:4300
- C:\Windows\System\HRSKlBY.exe
  C:\Windows\System\HRSKlBY.exe
  2⤵
  PID:4280
- C:\Windows\System\SPcSxjs.exe
  C:\Windows\System\SPcSxjs.exe
  2⤵
  PID:4324
- C:\Windows\System\PKtxqFC.exe
  C:\Windows\System\PKtxqFC.exe
  2⤵
  PID:4420
- C:\Windows\System\RVkjQOG.exe
  C:\Windows\System\RVkjQOG.exe
  2⤵
  PID:4444
- C:\Windows\System\QbYwqnL.exe
  C:\Windows\System\QbYwqnL.exe
  2⤵
  PID:4496
- C:\Windows\System\UPHZvau.exe
  C:\Windows\System\UPHZvau.exe
  2⤵
  PID:4544
- C:\Windows\System\ndQCVgM.exe
  C:\Windows\System\ndQCVgM.exe
  2⤵
  PID:4616
- C:\Windows\System\EcRFQzj.exe
  C:\Windows\System\EcRFQzj.exe
  2⤵
  PID:4704
- C:\Windows\System\gkAoWsT.exe
  C:\Windows\System\gkAoWsT.exe
  2⤵
  PID:4636
- C:\Windows\System\elRyWae.exe
  C:\Windows\System\elRyWae.exe
  2⤵
  PID:4820
- C:\Windows\System\qNKCWkK.exe
  C:\Windows\System\qNKCWkK.exe
  2⤵
  PID:4904
- C:\Windows\System\XCxBPlP.exe
  C:\Windows\System\XCxBPlP.exe
  2⤵
  PID:4856
- C:\Windows\System\YNFCEQd.exe
  C:\Windows\System\YNFCEQd.exe
  2⤵
  PID:4876
- C:\Windows\System\aQshhFc.exe
  C:\Windows\System\aQshhFc.exe
  2⤵
  PID:5064
- C:\Windows\System\cUIoZIG.exe
  C:\Windows\System\cUIoZIG.exe
  2⤵
  PID:3040
- C:\Windows\System\cZoClGW.exe
  C:\Windows\System\cZoClGW.exe
  2⤵
  PID:2516
- C:\Windows\System\VDLlOiJ.exe
  C:\Windows\System\VDLlOiJ.exe
  2⤵
  PID:5100
- C:\Windows\System\eKphzim.exe
  C:\Windows\System\eKphzim.exe
  2⤵
  PID:2564
- C:\Windows\System\yZPiCvb.exe
  C:\Windows\System\yZPiCvb.exe
  2⤵
  PID:2304
- C:\Windows\System\rzpEvAp.exe
  C:\Windows\System\rzpEvAp.exe
  2⤵
  PID:3388
- C:\Windows\System\LDAoFxr.exe
  C:\Windows\System\LDAoFxr.exe
  2⤵
  PID:3016
- C:\Windows\System\pqBRmbR.exe
  C:\Windows\System\pqBRmbR.exe
  2⤵
  PID:4104
- C:\Windows\System\ZkEEfWT.exe
  C:\Windows\System\ZkEEfWT.exe
  2⤵
  PID:5124
- C:\Windows\System\PMJrKzk.exe
  C:\Windows\System\PMJrKzk.exe
  2⤵
  PID:5144
- C:\Windows\System\OGCZZnc.exe
  C:\Windows\System\OGCZZnc.exe
  2⤵
  PID:5164
- C:\Windows\System\QaUkkuP.exe
  C:\Windows\System\QaUkkuP.exe
  2⤵
  PID:5184
- C:\Windows\System\mATjcQd.exe
  C:\Windows\System\mATjcQd.exe
  2⤵
  PID:5200
- C:\Windows\System\Psettae.exe
  C:\Windows\System\Psettae.exe
  2⤵
  PID:5224
- C:\Windows\System\mZMWRuR.exe
  C:\Windows\System\mZMWRuR.exe
  2⤵
  PID:5240
- C:\Windows\System\phNMcwp.exe
  C:\Windows\System\phNMcwp.exe
  2⤵
  PID:5264
- C:\Windows\System\StkxJkd.exe
  C:\Windows\System\StkxJkd.exe
  2⤵
  PID:5280
- C:\Windows\System\kmtAdoT.exe
  C:\Windows\System\kmtAdoT.exe
  2⤵
  PID:5300
- C:\Windows\System\sdAspOe.exe
  C:\Windows\System\sdAspOe.exe
  2⤵
  PID:5324
- C:\Windows\System\vyAtzFS.exe
  C:\Windows\System\vyAtzFS.exe
  2⤵
  PID:5344
- C:\Windows\System\SHnVqyD.exe
  C:\Windows\System\SHnVqyD.exe
  2⤵
  PID:5364
- C:\Windows\System\ljbDjwu.exe
  C:\Windows\System\ljbDjwu.exe
  2⤵
  PID:5384
- C:\Windows\System\IWUiVXP.exe
  C:\Windows\System\IWUiVXP.exe
  2⤵
  PID:5404
- C:\Windows\System\RWUYyTq.exe
  C:\Windows\System\RWUYyTq.exe
  2⤵
  PID:5424
- C:\Windows\System\bGJZKWP.exe
  C:\Windows\System\bGJZKWP.exe
  2⤵
  PID:5440
- C:\Windows\System\uvFXaGQ.exe
  C:\Windows\System\uvFXaGQ.exe
  2⤵
  PID:5464
- C:\Windows\System\GCjGBhS.exe
  C:\Windows\System\GCjGBhS.exe
  2⤵
  PID:5484
- C:\Windows\System\LGLeILL.exe
  C:\Windows\System\LGLeILL.exe
  2⤵
  PID:5504
- C:\Windows\System\zJMPWnV.exe
  C:\Windows\System\zJMPWnV.exe
  2⤵
  PID:5524
- C:\Windows\System\IanubmW.exe
  C:\Windows\System\IanubmW.exe
  2⤵
  PID:5544
- C:\Windows\System\rWfLhWF.exe
  C:\Windows\System\rWfLhWF.exe
  2⤵
  PID:5560
- C:\Windows\System\YyIoHtE.exe
  C:\Windows\System\YyIoHtE.exe
  2⤵
  PID:5584
- C:\Windows\System\KUqdQDV.exe
  C:\Windows\System\KUqdQDV.exe
  2⤵
  PID:5604
- C:\Windows\System\XNuXSVI.exe
  C:\Windows\System\XNuXSVI.exe
  2⤵
  PID:5624
- C:\Windows\System\GdhqrrV.exe
  C:\Windows\System\GdhqrrV.exe
  2⤵
  PID:5644
- C:\Windows\System\OjhvkFW.exe
  C:\Windows\System\OjhvkFW.exe
  2⤵
  PID:5664
- C:\Windows\System\FCQFBrt.exe
  C:\Windows\System\FCQFBrt.exe
  2⤵
  PID:5684
- C:\Windows\System\EnmMWbM.exe
  C:\Windows\System\EnmMWbM.exe
  2⤵
  PID:5704
- C:\Windows\System\xQVLGmY.exe
  C:\Windows\System\xQVLGmY.exe
  2⤵
  PID:5724
- C:\Windows\System\AEhSVyU.exe
  C:\Windows\System\AEhSVyU.exe
  2⤵
  PID:5744
- C:\Windows\System\iovfnzA.exe
  C:\Windows\System\iovfnzA.exe
  2⤵
  PID:5764
- C:\Windows\System\oMDBulP.exe
  C:\Windows\System\oMDBulP.exe
  2⤵
  PID:5784
- C:\Windows\System\JrPvKgv.exe
  C:\Windows\System\JrPvKgv.exe
  2⤵
  PID:5804
- C:\Windows\System\uBUmCkn.exe
  C:\Windows\System\uBUmCkn.exe
  2⤵
  PID:5824
- C:\Windows\System\BMRfVaK.exe
  C:\Windows\System\BMRfVaK.exe
  2⤵
  PID:5844
- C:\Windows\System\NtZkhyI.exe
  C:\Windows\System\NtZkhyI.exe
  2⤵
  PID:5864
- C:\Windows\System\DzDOrbI.exe
  C:\Windows\System\DzDOrbI.exe
  2⤵
  PID:5880
- C:\Windows\System\gNdrGUq.exe
  C:\Windows\System\gNdrGUq.exe
  2⤵
  PID:5904
- C:\Windows\System\FDfYHXr.exe
  C:\Windows\System\FDfYHXr.exe
  2⤵
  PID:5924
- C:\Windows\System\JcuNGaN.exe
  C:\Windows\System\JcuNGaN.exe
  2⤵
  PID:5944
- C:\Windows\System\FmMSeFA.exe
  C:\Windows\System\FmMSeFA.exe
  2⤵
  PID:5964
- C:\Windows\System\JVIxBEW.exe
  C:\Windows\System\JVIxBEW.exe
  2⤵
  PID:5984
- C:\Windows\System\vYiWfkc.exe
  C:\Windows\System\vYiWfkc.exe
  2⤵
  PID:6004
- C:\Windows\System\zfmaHkh.exe
  C:\Windows\System\zfmaHkh.exe
  2⤵
  PID:6024
- C:\Windows\System\VOqPkqX.exe
  C:\Windows\System\VOqPkqX.exe
  2⤵
  PID:6044
- C:\Windows\System\TjkGVjm.exe
  C:\Windows\System\TjkGVjm.exe
  2⤵
  PID:6064
- C:\Windows\System\LgwCwDR.exe
  C:\Windows\System\LgwCwDR.exe
  2⤵
  PID:6084
- C:\Windows\System\XVcwVJb.exe
  C:\Windows\System\XVcwVJb.exe
  2⤵
  PID:6104
- C:\Windows\System\EvrQXZy.exe
  C:\Windows\System\EvrQXZy.exe
  2⤵
  PID:6124
- C:\Windows\System\BCQOmot.exe
  C:\Windows\System\BCQOmot.exe
  2⤵
  PID:4144
- C:\Windows\System\rrOIXSc.exe
  C:\Windows\System\rrOIXSc.exe
  2⤵
  PID:4256
- C:\Windows\System\MBFbEGK.exe
  C:\Windows\System\MBFbEGK.exe
  2⤵
  PID:2852
- C:\Windows\System\IhUfuOQ.exe
  C:\Windows\System\IhUfuOQ.exe
  2⤵
  PID:4336
- C:\Windows\System\fHPSvDV.exe
  C:\Windows\System\fHPSvDV.exe
  2⤵
  PID:4360
- C:\Windows\System\stEVkxk.exe
  C:\Windows\System\stEVkxk.exe
  2⤵
  PID:4536
- C:\Windows\System\itYxJcQ.exe
  C:\Windows\System\itYxJcQ.exe
  2⤵
  PID:4460
- C:\Windows\System\rrflBBz.exe
  C:\Windows\System\rrflBBz.exe
  2⤵
  PID:4696
- C:\Windows\System\ybDcqrJ.exe
  C:\Windows\System\ybDcqrJ.exe
  2⤵
  PID:4776
- C:\Windows\System\whRbbxk.exe
  C:\Windows\System\whRbbxk.exe
  2⤵
  PID:4604
- C:\Windows\System\tfVrYRB.exe
  C:\Windows\System\tfVrYRB.exe
  2⤵
  PID:4916
- C:\Windows\System\mNeXUHG.exe
  C:\Windows\System\mNeXUHG.exe
  2⤵
  PID:2208
- C:\Windows\System\qrAcrvf.exe
  C:\Windows\System\qrAcrvf.exe
  2⤵
  PID:5004
- C:\Windows\System\LsxDTDn.exe
  C:\Windows\System\LsxDTDn.exe
  2⤵
  PID:1192
- C:\Windows\System\ltGIRYj.exe
  C:\Windows\System\ltGIRYj.exe
  2⤵
  PID:3436
- C:\Windows\System\GlwLnkN.exe
  C:\Windows\System\GlwLnkN.exe
  2⤵
  PID:2324
- C:\Windows\System\vlhfqDm.exe
  C:\Windows\System\vlhfqDm.exe
  2⤵
  PID:944
- C:\Windows\System\UsKkQcU.exe
  C:\Windows\System\UsKkQcU.exe
  2⤵
  PID:5140
- C:\Windows\System\gWYEROd.exe
  C:\Windows\System\gWYEROd.exe
  2⤵
  PID:5172
- C:\Windows\System\pRcTDIj.exe
  C:\Windows\System\pRcTDIj.exe
  2⤵
  PID:5156
- C:\Windows\System\mAODFYy.exe
  C:\Windows\System\mAODFYy.exe
  2⤵
  PID:5248
- C:\Windows\System\QHUkIBN.exe
  C:\Windows\System\QHUkIBN.exe
  2⤵
  PID:5196
- C:\Windows\System\aDHVfTt.exe
  C:\Windows\System\aDHVfTt.exe
  2⤵
  PID:5296
- C:\Windows\System\JdRXFnG.exe
  C:\Windows\System\JdRXFnG.exe
  2⤵
  PID:5340
- C:\Windows\System\IEvmzHw.exe
  C:\Windows\System\IEvmzHw.exe
  2⤵
  PID:5312
- C:\Windows\System\XcHgKWB.exe
  C:\Windows\System\XcHgKWB.exe
  2⤵
  PID:5372
- C:\Windows\System\kEifIVc.exe
  C:\Windows\System\kEifIVc.exe
  2⤵
  PID:5392
- C:\Windows\System\SQYbSKe.exe
  C:\Windows\System\SQYbSKe.exe
  2⤵
  PID:5448
- C:\Windows\System\AnsUEPs.exe
  C:\Windows\System\AnsUEPs.exe
  2⤵
  PID:5496
- C:\Windows\System\dMJQZjk.exe
  C:\Windows\System\dMJQZjk.exe
  2⤵
  PID:5476
- C:\Windows\System\pioGxeZ.exe
  C:\Windows\System\pioGxeZ.exe
  2⤵
  PID:5576
- C:\Windows\System\SzPbIwr.exe
  C:\Windows\System\SzPbIwr.exe
  2⤵
  PID:2924
- C:\Windows\System\zUYTeBk.exe
  C:\Windows\System\zUYTeBk.exe
  2⤵
  PID:2968
- C:\Windows\System\cVwpArI.exe
  C:\Windows\System\cVwpArI.exe
  2⤵
  PID:5612
- C:\Windows\System\EOuMLIh.exe
  C:\Windows\System\EOuMLIh.exe
  2⤵
  PID:5660
- C:\Windows\System\jLefHGA.exe
  C:\Windows\System\jLefHGA.exe
  2⤵
  PID:5692
- C:\Windows\System\vphucYj.exe
  C:\Windows\System\vphucYj.exe
  2⤵
  PID:5740
- C:\Windows\System\rrDDQnd.exe
  C:\Windows\System\rrDDQnd.exe
  2⤵
  PID:5712
- C:\Windows\System\PwDklnV.exe
  C:\Windows\System\PwDklnV.exe
  2⤵
  PID:5752
- C:\Windows\System\KxdhegT.exe
  C:\Windows\System\KxdhegT.exe
  2⤵
  PID:5776
- C:\Windows\System\oQPpjnN.exe
  C:\Windows\System\oQPpjnN.exe
  2⤵
  PID:5800
- C:\Windows\System\weEIJKV.exe
  C:\Windows\System\weEIJKV.exe
  2⤵
  PID:5856
- C:\Windows\System\zKTrMem.exe
  C:\Windows\System\zKTrMem.exe
  2⤵
  PID:3056
- C:\Windows\System\lVJbfkS.exe
  C:\Windows\System\lVJbfkS.exe
  2⤵
  PID:5876
- C:\Windows\System\IXVZTcS.exe
  C:\Windows\System\IXVZTcS.exe
  2⤵
  PID:5912
- C:\Windows\System\eYTkPtM.exe
  C:\Windows\System\eYTkPtM.exe
  2⤵
  PID:6012
- C:\Windows\System\yHYduJg.exe
  C:\Windows\System\yHYduJg.exe
  2⤵
  PID:5916
- C:\Windows\System\GNGSNJV.exe
  C:\Windows\System\GNGSNJV.exe
  2⤵
  PID:6016
- C:\Windows\System\SOKzWcE.exe
  C:\Windows\System\SOKzWcE.exe
  2⤵
  PID:5996
- C:\Windows\System\KiQEyUv.exe
  C:\Windows\System\KiQEyUv.exe
  2⤵
  PID:6036
- C:\Windows\System\JLzuYkU.exe
  C:\Windows\System\JLzuYkU.exe
  2⤵
  PID:6096
- C:\Windows\System\SQXPSXr.exe
  C:\Windows\System\SQXPSXr.exe
  2⤵
  PID:6140
- C:\Windows\System\TwhMVca.exe
  C:\Windows\System\TwhMVca.exe
  2⤵
  PID:3008
- C:\Windows\System\rGXkHHt.exe
  C:\Windows\System\rGXkHHt.exe
  2⤵
  PID:4344
- C:\Windows\System\kgOwHOP.exe
  C:\Windows\System\kgOwHOP.exe
  2⤵
  PID:4456
- C:\Windows\System\YrgjWXs.exe
  C:\Windows\System\YrgjWXs.exe
  2⤵
  PID:4240
- C:\Windows\System\tHGhhfM.exe
  C:\Windows\System\tHGhhfM.exe
  2⤵
  PID:2088
- C:\Windows\System\iIYzZLd.exe
  C:\Windows\System\iIYzZLd.exe
  2⤵
  PID:4700
- C:\Windows\System\raPDZQR.exe
  C:\Windows\System\raPDZQR.exe
  2⤵
  PID:4796
- C:\Windows\System\ZEAlUBS.exe
  C:\Windows\System\ZEAlUBS.exe
  2⤵
  PID:5080
- C:\Windows\System\ySsrghY.exe
  C:\Windows\System\ySsrghY.exe
  2⤵
  PID:5024
- C:\Windows\System\gHbsThf.exe
  C:\Windows\System\gHbsThf.exe
  2⤵
  PID:1988
- C:\Windows\System\VewfwTm.exe
  C:\Windows\System\VewfwTm.exe
  2⤵
  PID:5056
- C:\Windows\System\kqgLgwB.exe
  C:\Windows\System\kqgLgwB.exe
  2⤵
  PID:2864
- C:\Windows\System\KbWAltk.exe
  C:\Windows\System\KbWAltk.exe
  2⤵
  PID:2004
- C:\Windows\System\ThGeGMc.exe
  C:\Windows\System\ThGeGMc.exe
  2⤵
  PID:3232
- C:\Windows\System\qYHwEFg.exe
  C:\Windows\System\qYHwEFg.exe
  2⤵
  PID:5136
- C:\Windows\System\kMHroxU.exe
  C:\Windows\System\kMHroxU.exe
  2⤵
  PID:5220
- C:\Windows\System\jwuqjfr.exe
  C:\Windows\System\jwuqjfr.exe
  2⤵
  PID:864
- C:\Windows\System\pjWYuAq.exe
  C:\Windows\System\pjWYuAq.exe
  2⤵
  PID:5260
- C:\Windows\System\rAsgmXY.exe
  C:\Windows\System\rAsgmXY.exe
  2⤵
  PID:1460
- C:\Windows\System\iXiTzDM.exe
  C:\Windows\System\iXiTzDM.exe
  2⤵
  PID:1992
- C:\Windows\System\SYcZRel.exe
  C:\Windows\System\SYcZRel.exe
  2⤵
  PID:5460
- C:\Windows\System\VtanOAL.exe
  C:\Windows\System\VtanOAL.exe
  2⤵
  PID:5356
- C:\Windows\System\NkwfscA.exe
  C:\Windows\System\NkwfscA.exe
  2⤵
  PID:5416
- C:\Windows\System\wZNdrlu.exe
  C:\Windows\System\wZNdrlu.exe
  2⤵
  PID:2136
- C:\Windows\System\JYYYFPD.exe
  C:\Windows\System\JYYYFPD.exe
  2⤵
  PID:984
- C:\Windows\System\vosbODE.exe
  C:\Windows\System\vosbODE.exe
  2⤵
  PID:5572
- C:\Windows\System\iBTAxyi.exe
  C:\Windows\System\iBTAxyi.exe
  2⤵
  PID:432
- C:\Windows\System\wRFLfrh.exe
  C:\Windows\System\wRFLfrh.exe
  2⤵
  PID:5732
- C:\Windows\System\PogMPGx.exe
  C:\Windows\System\PogMPGx.exe
  2⤵
  PID:5736
- C:\Windows\System\lzBlulW.exe
  C:\Windows\System\lzBlulW.exe
  2⤵
  PID:5816
- C:\Windows\System\DpxhPVE.exe
  C:\Windows\System\DpxhPVE.exe
  2⤵
  PID:5796
- C:\Windows\System\bQMhXvP.exe
  C:\Windows\System\bQMhXvP.exe
  2⤵
  PID:5676
- C:\Windows\System\yrEVvAp.exe
  C:\Windows\System\yrEVvAp.exe
  2⤵
  PID:5900
- C:\Windows\System\qlVIhZR.exe
  C:\Windows\System\qlVIhZR.exe
  2⤵
  PID:1820
- C:\Windows\System\PGBBLHG.exe
  C:\Windows\System\PGBBLHG.exe
  2⤵
  PID:5872
- C:\Windows\System\WDQrEaL.exe
  C:\Windows\System\WDQrEaL.exe
  2⤵
  PID:6020
- C:\Windows\System\vaclmcW.exe
  C:\Windows\System\vaclmcW.exe
  2⤵
  PID:5976
- C:\Windows\System\gIjCCtg.exe
  C:\Windows\System\gIjCCtg.exe
  2⤵
  PID:6092
- C:\Windows\System\VlIpDlm.exe
  C:\Windows\System\VlIpDlm.exe
  2⤵
  PID:6120
- C:\Windows\System\gBALUhz.exe
  C:\Windows\System\gBALUhz.exe
  2⤵
  PID:6032
- C:\Windows\System\KjNxovn.exe
  C:\Windows\System\KjNxovn.exe
  2⤵
  PID:2276
- C:\Windows\System\JDDcnmF.exe
  C:\Windows\System\JDDcnmF.exe
  2⤵
  PID:960
- C:\Windows\System\mkgJwet.exe
  C:\Windows\System\mkgJwet.exe
  2⤵
  PID:2812
- C:\Windows\System\LcNODaY.exe
  C:\Windows\System\LcNODaY.exe
  2⤵
  PID:4660
- C:\Windows\System\koTFjUZ.exe
  C:\Windows\System\koTFjUZ.exe
  2⤵
  PID:4652
- C:\Windows\System\EfYDvsl.exe
  C:\Windows\System\EfYDvsl.exe
  2⤵
  PID:4964
- C:\Windows\System\oFXDmdf.exe
  C:\Windows\System\oFXDmdf.exe
  2⤵
  PID:4060
- C:\Windows\System\CrlHWGC.exe
  C:\Windows\System\CrlHWGC.exe
  2⤵
  PID:2988
- C:\Windows\System\RafMWcl.exe
  C:\Windows\System\RafMWcl.exe
  2⤵
  PID:1956
- C:\Windows\System\NzqbQWJ.exe
  C:\Windows\System\NzqbQWJ.exe
  2⤵
  PID:2856
- C:\Windows\System\mGawtGE.exe
  C:\Windows\System\mGawtGE.exe
  2⤵
  PID:5208
- C:\Windows\System\ItCKQHQ.exe
  C:\Windows\System\ItCKQHQ.exe
  2⤵
  PID:1456
- C:\Windows\System\zmOshHI.exe
  C:\Windows\System\zmOshHI.exe
  2⤵
  PID:5316
- C:\Windows\System\mBAqOFn.exe
  C:\Windows\System\mBAqOFn.exe
  2⤵
  PID:2732
- C:\Windows\System\zNKMyRI.exe
  C:\Windows\System\zNKMyRI.exe
  2⤵
  PID:5332
- C:\Windows\System\ZtBcRCq.exe
  C:\Windows\System\ZtBcRCq.exe
  2⤵
  PID:5568
- C:\Windows\System\GpxQlTT.exe
  C:\Windows\System\GpxQlTT.exe
  2⤵
  PID:5556
- C:\Windows\System\UcBTyeN.exe
  C:\Windows\System\UcBTyeN.exe
  2⤵
  PID:2800
- C:\Windows\System\WAAFuhr.exe
  C:\Windows\System\WAAFuhr.exe
  2⤵
  PID:5772
- C:\Windows\System\NjorHwk.exe
  C:\Windows\System\NjorHwk.exe
  2⤵
  PID:2548
- C:\Windows\System\SnqpBGB.exe
  C:\Windows\System\SnqpBGB.exe
  2⤵
  PID:5820
- C:\Windows\System\nCrMsra.exe
  C:\Windows\System\nCrMsra.exe
  2⤵
  PID:5896
- C:\Windows\System\KWLmusn.exe
  C:\Windows\System\KWLmusn.exe
  2⤵
  PID:5992
- C:\Windows\System\sMMsuwr.exe
  C:\Windows\System\sMMsuwr.exe
  2⤵
  PID:2900
- C:\Windows\System\sJUYGhI.exe
  C:\Windows\System\sJUYGhI.exe
  2⤵
  PID:2508
- C:\Windows\System\aGKhHyP.exe
  C:\Windows\System\aGKhHyP.exe
  2⤵
  PID:6080
- C:\Windows\System\HaCadmL.exe
  C:\Windows\System\HaCadmL.exe
  2⤵
  PID:2500
- C:\Windows\System\ElSSxAl.exe
  C:\Windows\System\ElSSxAl.exe
  2⤵
  PID:1400
- C:\Windows\System\aJOfgli.exe
  C:\Windows\System\aJOfgli.exe
  2⤵
  PID:4664
- C:\Windows\System\EAebwcX.exe
  C:\Windows\System\EAebwcX.exe
  2⤵
  PID:2352
- C:\Windows\System\oNmdqTt.exe
  C:\Windows\System\oNmdqTt.exe
  2⤵
  PID:5132
- C:\Windows\System\IITgIsi.exe
  C:\Windows\System\IITgIsi.exe
  2⤵
  PID:5192
- C:\Windows\System\gDZzswB.exe
  C:\Windows\System\gDZzswB.exe
  2⤵
  PID:5276
- C:\Windows\System\VCAnoeY.exe
  C:\Windows\System\VCAnoeY.exe
  2⤵
  PID:2428
- C:\Windows\System\KQQWgxa.exe
  C:\Windows\System\KQQWgxa.exe
  2⤵
  PID:5436
- C:\Windows\System\GWgWMpY.exe
  C:\Windows\System\GWgWMpY.exe
  2⤵
  PID:5596
- C:\Windows\System\vIuLQsH.exe
  C:\Windows\System\vIuLQsH.exe
  2⤵
  PID:1660
- C:\Windows\System\GoCnpDC.exe
  C:\Windows\System\GoCnpDC.exe
  2⤵
  PID:5680
- C:\Windows\System\WpoqOHr.exe
  C:\Windows\System\WpoqOHr.exe
  2⤵
  PID:5936
- C:\Windows\System\ndzjkEO.exe
  C:\Windows\System\ndzjkEO.exe
  2⤵
  PID:1056
- C:\Windows\System\fFCSgvA.exe
  C:\Windows\System\fFCSgvA.exe
  2⤵
  PID:924
- C:\Windows\System\vJvtzmw.exe
  C:\Windows\System\vJvtzmw.exe
  2⤵
  PID:6056
- C:\Windows\System\rNUOZev.exe
  C:\Windows\System\rNUOZev.exe
  2⤵
  PID:4740
- C:\Windows\System\iYbyxwC.exe
  C:\Windows\System\iYbyxwC.exe
  2⤵
  PID:5104
- C:\Windows\System\ECCzPPc.exe
  C:\Windows\System\ECCzPPc.exe
  2⤵
  PID:3936
- C:\Windows\System\EuQLFYB.exe
  C:\Windows\System\EuQLFYB.exe
  2⤵
  PID:5396
- C:\Windows\System\NdElvlM.exe
  C:\Windows\System\NdElvlM.exe
  2⤵
  PID:5696
- C:\Windows\System\IQrTEsl.exe
  C:\Windows\System\IQrTEsl.exe
  2⤵
  PID:5720
- C:\Windows\System\cyQzMoF.exe
  C:\Windows\System\cyQzMoF.exe
  2⤵
  PID:5640
- C:\Windows\System\jhxpZyk.exe
  C:\Windows\System\jhxpZyk.exe
  2⤵
  PID:6000
- C:\Windows\System\CIQQSlK.exe
  C:\Windows\System\CIQQSlK.exe
  2⤵
  PID:6052
- C:\Windows\System\XtUoDhq.exe
  C:\Windows\System\XtUoDhq.exe
  2⤵
  PID:2280
- C:\Windows\System\oUVnbME.exe
  C:\Windows\System\oUVnbME.exe
  2⤵
  PID:3572
- C:\Windows\System\phQdNGa.exe
  C:\Windows\System\phQdNGa.exe
  2⤵
  PID:2360
- C:\Windows\System\fgIfxPw.exe
  C:\Windows\System\fgIfxPw.exe
  2⤵
  PID:5552
- C:\Windows\System\VVheIKR.exe
  C:\Windows\System\VVheIKR.exe
  2⤵
  PID:4896
- C:\Windows\System\ZsRTWdG.exe
  C:\Windows\System\ZsRTWdG.exe
  2⤵
  PID:2636
- C:\Windows\System\mLRGWnp.exe
  C:\Windows\System\mLRGWnp.exe
  2⤵
  PID:5272
- C:\Windows\System\jITFjot.exe
  C:\Windows\System\jITFjot.exe
  2⤵
  PID:5480
- C:\Windows\System\tZBILJP.exe
  C:\Windows\System\tZBILJP.exe
  2⤵
  PID:3132
- C:\Windows\System\fBXOtXd.exe
  C:\Windows\System\fBXOtXd.exe
  2⤵
  PID:6156
- C:\Windows\System\nPakgGm.exe
  C:\Windows\System\nPakgGm.exe
  2⤵
  PID:6176
- C:\Windows\System\WegoSjY.exe
  C:\Windows\System\WegoSjY.exe
  2⤵
  PID:6204
- C:\Windows\System\RJJDUlf.exe
  C:\Windows\System\RJJDUlf.exe
  2⤵
  PID:6220
- C:\Windows\System\nOShoIZ.exe
  C:\Windows\System\nOShoIZ.exe
  2⤵
  PID:6248
- C:\Windows\System\FfWiYUC.exe
  C:\Windows\System\FfWiYUC.exe
  2⤵
  PID:6268
- C:\Windows\System\vEgclzm.exe
  C:\Windows\System\vEgclzm.exe
  2⤵
  PID:6284
- C:\Windows\System\NDdnInV.exe
  C:\Windows\System\NDdnInV.exe
  2⤵
  PID:6300
- C:\Windows\System\GUnmDbe.exe
  C:\Windows\System\GUnmDbe.exe
  2⤵
  PID:6316
- C:\Windows\System\iAIIbiB.exe
  C:\Windows\System\iAIIbiB.exe
  2⤵
  PID:6340
- C:\Windows\System\PuyYRwK.exe
  C:\Windows\System\PuyYRwK.exe
  2⤵
  PID:6368
- C:\Windows\System\dyovOwR.exe
  C:\Windows\System\dyovOwR.exe
  2⤵
  PID:6388
- C:\Windows\System\uBwmdEw.exe
  C:\Windows\System\uBwmdEw.exe
  2⤵
  PID:6404
- C:\Windows\System\EwjNTnN.exe
  C:\Windows\System\EwjNTnN.exe
  2⤵
  PID:6420
- C:\Windows\System\ULkgGSN.exe
  C:\Windows\System\ULkgGSN.exe
  2⤵
  PID:6440
- C:\Windows\System\WaKgWdq.exe
  C:\Windows\System\WaKgWdq.exe
  2⤵
  PID:6460
- C:\Windows\System\nIsViyc.exe
  C:\Windows\System\nIsViyc.exe
  2⤵
  PID:6480
- C:\Windows\System\wGEYMJP.exe
  C:\Windows\System\wGEYMJP.exe
  2⤵
  PID:6500
- C:\Windows\System\LFgrOtG.exe
  C:\Windows\System\LFgrOtG.exe
  2⤵
  PID:6516
- C:\Windows\System\fnKkBes.exe
  C:\Windows\System\fnKkBes.exe
  2⤵
  PID:6540
- C:\Windows\System\pBxXZeb.exe
  C:\Windows\System\pBxXZeb.exe
  2⤵
  PID:6556
- C:\Windows\System\bRlwfSZ.exe
  C:\Windows\System\bRlwfSZ.exe
  2⤵
  PID:6576
- C:\Windows\System\SEJIUqp.exe
  C:\Windows\System\SEJIUqp.exe
  2⤵
  PID:6608
- C:\Windows\System\odwlUFb.exe
  C:\Windows\System\odwlUFb.exe
  2⤵
  PID:6624
- C:\Windows\System\nBYsvTi.exe
  C:\Windows\System\nBYsvTi.exe
  2⤵
  PID:6640
- C:\Windows\System\qAOswzC.exe
  C:\Windows\System\qAOswzC.exe
  2⤵
  PID:6664
- C:\Windows\System\oiQvfzH.exe
  C:\Windows\System\oiQvfzH.exe
  2⤵
  PID:6688
- C:\Windows\System\FCYRAtu.exe
  C:\Windows\System\FCYRAtu.exe
  2⤵
  PID:6708
- C:\Windows\System\FSMjoOE.exe
  C:\Windows\System\FSMjoOE.exe
  2⤵
  PID:6724
- C:\Windows\System\aDPoBsx.exe
  C:\Windows\System\aDPoBsx.exe
  2⤵
  PID:6744
- C:\Windows\System\pIrwojc.exe
  C:\Windows\System\pIrwojc.exe
  2⤵
  PID:6772
- C:\Windows\System\lnmOSEK.exe
  C:\Windows\System\lnmOSEK.exe
  2⤵
  PID:6788
- C:\Windows\System\pdEnKOl.exe
  C:\Windows\System\pdEnKOl.exe
  2⤵
  PID:6804
- C:\Windows\System\NdcfgRc.exe
  C:\Windows\System\NdcfgRc.exe
  2⤵
  PID:6820
- C:\Windows\System\HNeNWxV.exe
  C:\Windows\System\HNeNWxV.exe
  2⤵
  PID:6840
- C:\Windows\System\qbNmydd.exe
  C:\Windows\System\qbNmydd.exe
  2⤵
  PID:6856
- C:\Windows\System\FLWbVzz.exe
  C:\Windows\System\FLWbVzz.exe
  2⤵
  PID:6872
- C:\Windows\System\dHjsBRF.exe
  C:\Windows\System\dHjsBRF.exe
  2⤵
  PID:6892
- C:\Windows\System\CyYVFEl.exe
  C:\Windows\System\CyYVFEl.exe
  2⤵
  PID:6932
- C:\Windows\System\BLpgPxr.exe
  C:\Windows\System\BLpgPxr.exe
  2⤵
  PID:6952
- C:\Windows\System\eqIExqX.exe
  C:\Windows\System\eqIExqX.exe
  2⤵
  PID:6968
- C:\Windows\System\wXiEuba.exe
  C:\Windows\System\wXiEuba.exe
  2⤵
  PID:6988
- C:\Windows\System\ilqNIwG.exe
  C:\Windows\System\ilqNIwG.exe
  2⤵
  PID:7004
- C:\Windows\System\RZWDIHj.exe
  C:\Windows\System\RZWDIHj.exe
  2⤵
  PID:7024
- C:\Windows\System\FEZFeXy.exe
  C:\Windows\System\FEZFeXy.exe
  2⤵
  PID:7040
- C:\Windows\System\rQJrrmS.exe
  C:\Windows\System\rQJrrmS.exe
  2⤵
  PID:7056
- C:\Windows\System\nJIvYer.exe
  C:\Windows\System\nJIvYer.exe
  2⤵
  PID:7076
- C:\Windows\System\ApZrufc.exe
  C:\Windows\System\ApZrufc.exe
  2⤵
  PID:7112
- C:\Windows\System\aFbzbkL.exe
  C:\Windows\System\aFbzbkL.exe
  2⤵
  PID:7132
- C:\Windows\System\jTefSgU.exe
  C:\Windows\System\jTefSgU.exe
  2⤵
  PID:7152
- C:\Windows\System\WvSZFZI.exe
  C:\Windows\System\WvSZFZI.exe
  2⤵
  PID:1352
- C:\Windows\System\guGxufK.exe
  C:\Windows\System\guGxufK.exe
  2⤵
  PID:6188
- C:\Windows\System\pgAmUlZ.exe
  C:\Windows\System\pgAmUlZ.exe
  2⤵
  PID:6168
- C:\Windows\System\IqxsCrA.exe
  C:\Windows\System\IqxsCrA.exe
  2⤵
  PID:6232
- C:\Windows\System\NVVrcVU.exe
  C:\Windows\System\NVVrcVU.exe
  2⤵
  PID:6212
- C:\Windows\System\MixbaOf.exe
  C:\Windows\System\MixbaOf.exe
  2⤵
  PID:6280
- C:\Windows\System\ywkcPMX.exe
  C:\Windows\System\ywkcPMX.exe
  2⤵
  PID:6260
- C:\Windows\System\cJvhNEc.exe
  C:\Windows\System\cJvhNEc.exe
  2⤵
  PID:6328
- C:\Windows\System\PMVrCPA.exe
  C:\Windows\System\PMVrCPA.exe
  2⤵
  PID:6352
- C:\Windows\System\RcNeCat.exe
  C:\Windows\System\RcNeCat.exe
  2⤵
  PID:6432
- C:\Windows\System\QvHACLt.exe
  C:\Windows\System\QvHACLt.exe
  2⤵
  PID:6476
- C:\Windows\System\jzbOLcB.exe
  C:\Windows\System\jzbOLcB.exe
  2⤵
  PID:6448
- C:\Windows\System\zNZNtNG.exe
  C:\Windows\System\zNZNtNG.exe
  2⤵
  PID:6492
- C:\Windows\System\wkBQISc.exe
  C:\Windows\System\wkBQISc.exe
  2⤵
  PID:6548
- C:\Windows\System\odJgatX.exe
  C:\Windows\System\odJgatX.exe
  2⤵
  PID:6592
- C:\Windows\System\WEOeqDG.exe
  C:\Windows\System\WEOeqDG.exe
  2⤵
  PID:6564
- C:\Windows\System\hpiBYsW.exe
  C:\Windows\System\hpiBYsW.exe
  2⤵
  PID:6616
- C:\Windows\System\kPBDQOI.exe
  C:\Windows\System\kPBDQOI.exe
  2⤵
  PID:6648
- C:\Windows\System\ULfMWKB.exe
  C:\Windows\System\ULfMWKB.exe
  2⤵
  PID:6672
- C:\Windows\System\noguAFo.exe
  C:\Windows\System\noguAFo.exe
  2⤵
  PID:6752
- C:\Windows\System\XbAGWFi.exe
  C:\Windows\System\XbAGWFi.exe
  2⤵
  PID:6736
- C:\Windows\System\pivNtne.exe
  C:\Windows\System\pivNtne.exe
  2⤵
  PID:6764
- C:\Windows\System\GwyHCEg.exe
  C:\Windows\System\GwyHCEg.exe
  2⤵
  PID:6816
- C:\Windows\System\EAMNMES.exe
  C:\Windows\System\EAMNMES.exe
  2⤵
  PID:6836
- C:\Windows\System\SPziGiN.exe
  C:\Windows\System\SPziGiN.exe
  2⤵
  PID:6912
- C:\Windows\System\WLUTTKP.exe
  C:\Windows\System\WLUTTKP.exe
  2⤵
  PID:6888
- C:\Windows\System\KMyfKdK.exe
  C:\Windows\System\KMyfKdK.exe
  2⤵
  PID:6964
- C:\Windows\System\YGPsxHx.exe
  C:\Windows\System\YGPsxHx.exe
  2⤵
  PID:7000
- C:\Windows\System\JnWDYWQ.exe
  C:\Windows\System\JnWDYWQ.exe
  2⤵
  PID:7068
- C:\Windows\System\KsczSeI.exe
  C:\Windows\System\KsczSeI.exe
  2⤵
  PID:6984
- C:\Windows\System\JDscygD.exe
  C:\Windows\System\JDscygD.exe
  2⤵
  PID:7052
- C:\Windows\System\giMJPhy.exe
  C:\Windows\System\giMJPhy.exe
  2⤵
  PID:7104
- C:\Windows\System\KNHPWJg.exe
  C:\Windows\System\KNHPWJg.exe
  2⤵
  PID:7140
- C:\Windows\System\UgejpZA.exe
  C:\Windows\System\UgejpZA.exe
  2⤵
  PID:6196
- C:\Windows\System\OkhiqNM.exe
  C:\Windows\System\OkhiqNM.exe
  2⤵
  PID:5160
- C:\Windows\System\LHQalYO.exe
  C:\Windows\System\LHQalYO.exe
  2⤵
  PID:5756
- C:\Windows\System\sCWQDUw.exe
  C:\Windows\System\sCWQDUw.exe
  2⤵
  PID:6240
- C:\Windows\System\Bkagpxa.exe
  C:\Windows\System\Bkagpxa.exe
  2⤵
  PID:6348
- C:\Windows\System\KYRhTLr.exe
  C:\Windows\System\KYRhTLr.exe
  2⤵
  PID:6376
- C:\Windows\System\FuawAfJ.exe
  C:\Windows\System\FuawAfJ.exe
  2⤵
  PID:6472
- C:\Windows\System\gyYVwAT.exe
  C:\Windows\System\gyYVwAT.exe
  2⤵
  PID:6528
- C:\Windows\System\dzAxqIg.exe
  C:\Windows\System\dzAxqIg.exe
  2⤵
  PID:6532
- C:\Windows\System\VIneqcO.exe
  C:\Windows\System\VIneqcO.exe
  2⤵
  PID:6660
- C:\Windows\System\sNKtjwL.exe
  C:\Windows\System\sNKtjwL.exe
  2⤵
  PID:6704
- C:\Windows\System\xEvhNZg.exe
  C:\Windows\System\xEvhNZg.exe
  2⤵
  PID:6800
- C:\Windows\System\jKdIAWv.exe
  C:\Windows\System\jKdIAWv.exe
  2⤵
  PID:6632
- C:\Windows\System\UFJoPNb.exe
  C:\Windows\System\UFJoPNb.exe
  2⤵
  PID:6908
- C:\Windows\System\NCSummT.exe
  C:\Windows\System\NCSummT.exe
  2⤵
  PID:6916
- C:\Windows\System\yVVHatZ.exe
  C:\Windows\System\yVVHatZ.exe
  2⤵
  PID:7064
- C:\Windows\System\PNEPROF.exe
  C:\Windows\System\PNEPROF.exe
  2⤵
  PID:7124
- C:\Windows\System\pynqLTU.exe
  C:\Windows\System\pynqLTU.exe
  2⤵
  PID:7144
- C:\Windows\System\JvsvdDr.exe
  C:\Windows\System\JvsvdDr.exe
  2⤵
  PID:4540
- C:\Windows\System\CWEfHwO.exe
  C:\Windows\System\CWEfHwO.exe
  2⤵
  PID:7100
- C:\Windows\System\FkIPRkG.exe
  C:\Windows\System\FkIPRkG.exe
  2⤵
  PID:5980
- C:\Windows\System\yZMDSKO.exe
  C:\Windows\System\yZMDSKO.exe
  2⤵
  PID:6400
- C:\Windows\System\qcjZnnh.exe
  C:\Windows\System\qcjZnnh.exe
  2⤵
  PID:6512
- C:\Windows\System\oXaqVbU.exe
  C:\Windows\System\oXaqVbU.exe
  2⤵
  PID:6568
- C:\Windows\System\lwVmeEp.exe
  C:\Windows\System\lwVmeEp.exe
  2⤵
  PID:6780
- C:\Windows\System\zVxgtAb.exe
  C:\Windows\System\zVxgtAb.exe
  2⤵
  PID:6756
- C:\Windows\System\XMRTLtw.exe
  C:\Windows\System\XMRTLtw.exe
  2⤵
  PID:6696
- C:\Windows\System\BoRdhzV.exe
  C:\Windows\System\BoRdhzV.exe
  2⤵
  PID:6960
- C:\Windows\System\asahKxB.exe
  C:\Windows\System\asahKxB.exe
  2⤵
  PID:7128
- C:\Windows\System\GYOtvHX.exe
  C:\Windows\System\GYOtvHX.exe
  2⤵
  PID:6384
- C:\Windows\System\CiYKbgN.exe
  C:\Windows\System\CiYKbgN.exe
  2⤵
  PID:6880
- C:\Windows\System\xGLyqko.exe
  C:\Windows\System\xGLyqko.exe
  2⤵
  PID:6980
- C:\Windows\System\HWkDxzi.exe
  C:\Windows\System\HWkDxzi.exe
  2⤵
  PID:6296
- C:\Windows\System\KMcIuDj.exe
  C:\Windows\System\KMcIuDj.exe
  2⤵
  PID:6684
- C:\Windows\System\TwqhjiF.exe
  C:\Windows\System\TwqhjiF.exe
  2⤵
  PID:7088
- C:\Windows\System\TtKekJV.exe
  C:\Windows\System\TtKekJV.exe
  2⤵
  PID:6200
- C:\Windows\System\pQsgUmk.exe
  C:\Windows\System\pQsgUmk.exe
  2⤵
  PID:6256
- C:\Windows\System\FpiWljH.exe
  C:\Windows\System\FpiWljH.exe
  2⤵
  PID:7036
- C:\Windows\System\WYGteLM.exe
  C:\Windows\System\WYGteLM.exe
  2⤵
  PID:6732
- C:\Windows\System\ZpcJmew.exe
  C:\Windows\System\ZpcJmew.exe
  2⤵
  PID:6468
- C:\Windows\System\JPBCVCL.exe
  C:\Windows\System\JPBCVCL.exe
  2⤵
  PID:6604
- C:\Windows\System\tRpxAhy.exe
  C:\Windows\System\tRpxAhy.exe
  2⤵
  PID:6884
- C:\Windows\System\tabgygu.exe
  C:\Windows\System\tabgygu.exe
  2⤵
  PID:7096
- C:\Windows\System\BoogoDp.exe
  C:\Windows\System\BoogoDp.exe
  2⤵
  PID:6900
- C:\Windows\System\xHOFRJJ.exe
  C:\Windows\System\xHOFRJJ.exe
  2⤵
  PID:6336
- C:\Windows\System\ilUMniO.exe
  C:\Windows\System\ilUMniO.exe
  2⤵
  PID:6584
- C:\Windows\System\UYqPeVY.exe
  C:\Windows\System\UYqPeVY.exe
  2⤵
  PID:7184
- C:\Windows\System\RvOfRzQ.exe
  C:\Windows\System\RvOfRzQ.exe
  2⤵
  PID:7204
- C:\Windows\System\vsauhvk.exe
  C:\Windows\System\vsauhvk.exe
  2⤵
  PID:7224
- C:\Windows\System\jXkAxgK.exe
  C:\Windows\System\jXkAxgK.exe
  2⤵
  PID:7240
- C:\Windows\System\mRwXUMS.exe
  C:\Windows\System\mRwXUMS.exe
  2⤵
  PID:7256
- C:\Windows\System\SAEQtTw.exe
  C:\Windows\System\SAEQtTw.exe
  2⤵
  PID:7284
- C:\Windows\System\OCodVVn.exe
  C:\Windows\System\OCodVVn.exe
  2⤵
  PID:7308
- C:\Windows\System\KVXjAoZ.exe
  C:\Windows\System\KVXjAoZ.exe
  2⤵
  PID:7324
- C:\Windows\System\FeBtPei.exe
  C:\Windows\System\FeBtPei.exe
  2⤵
  PID:7344
- C:\Windows\System\iwDKTiA.exe
  C:\Windows\System\iwDKTiA.exe
  2⤵
  PID:7360
- C:\Windows\System\LjTeVMz.exe
  C:\Windows\System\LjTeVMz.exe
  2⤵
  PID:7376
- C:\Windows\System\htcgkau.exe
  C:\Windows\System\htcgkau.exe
  2⤵
  PID:7400
- C:\Windows\System\tUoFGJe.exe
  C:\Windows\System\tUoFGJe.exe
  2⤵
  PID:7432
- C:\Windows\System\tJFbXrC.exe
  C:\Windows\System\tJFbXrC.exe
  2⤵
  PID:7452
- C:\Windows\System\TDMhVRh.exe
  C:\Windows\System\TDMhVRh.exe
  2⤵
  PID:7472
- C:\Windows\System\TTOFeQn.exe
  C:\Windows\System\TTOFeQn.exe
  2⤵
  PID:7496
- C:\Windows\System\EIYWvCq.exe
  C:\Windows\System\EIYWvCq.exe
  2⤵
  PID:7512
- C:\Windows\System\taJpxzG.exe
  C:\Windows\System\taJpxzG.exe
  2⤵
  PID:7532
- C:\Windows\System\JMvTHGS.exe
  C:\Windows\System\JMvTHGS.exe
  2⤵
  PID:7552
- C:\Windows\System\uVZEYmb.exe
  C:\Windows\System\uVZEYmb.exe
  2⤵
  PID:7572
- C:\Windows\System\gRgSRFm.exe
  C:\Windows\System\gRgSRFm.exe
  2⤵
  PID:7596
- C:\Windows\System\yDoOLay.exe
  C:\Windows\System\yDoOLay.exe
  2⤵
  PID:7612
- C:\Windows\System\zEOiwMd.exe
  C:\Windows\System\zEOiwMd.exe
  2⤵
  PID:7632
- C:\Windows\System\GPLcPFV.exe
  C:\Windows\System\GPLcPFV.exe
  2⤵
  PID:7652
- C:\Windows\System\HCNzyYi.exe
  C:\Windows\System\HCNzyYi.exe
  2⤵
  PID:7672
- C:\Windows\System\AXSGLxj.exe
  C:\Windows\System\AXSGLxj.exe
  2⤵
  PID:7696
- C:\Windows\System\lTtFyKP.exe
  C:\Windows\System\lTtFyKP.exe
  2⤵
  PID:7712
- C:\Windows\System\UqHJmDq.exe
  C:\Windows\System\UqHJmDq.exe
  2⤵
  PID:7728
- C:\Windows\System\WfLjQvh.exe
  C:\Windows\System\WfLjQvh.exe
  2⤵
  PID:7748
- C:\Windows\System\RzgSKrq.exe
  C:\Windows\System\RzgSKrq.exe
  2⤵
  PID:7764
- C:\Windows\System\iiBwALn.exe
  C:\Windows\System\iiBwALn.exe
  2⤵
  PID:7784
- C:\Windows\System\xZnPnTu.exe
  C:\Windows\System\xZnPnTu.exe
  2⤵
  PID:7808
- C:\Windows\System\RpUJEUo.exe
  C:\Windows\System\RpUJEUo.exe
  2⤵
  PID:7836
- C:\Windows\System\GDWKtcy.exe
  C:\Windows\System\GDWKtcy.exe
  2⤵
  PID:7852
- C:\Windows\System\YJzohTM.exe
  C:\Windows\System\YJzohTM.exe
  2⤵
  PID:7868
- C:\Windows\System\ErYZaEP.exe
  C:\Windows\System\ErYZaEP.exe
  2⤵
  PID:7888
- C:\Windows\System\CxbXMsg.exe
  C:\Windows\System\CxbXMsg.exe
  2⤵
  PID:7904
- C:\Windows\System\EpZZndl.exe
  C:\Windows\System\EpZZndl.exe
  2⤵
  PID:7924
- C:\Windows\System\yCSwjlZ.exe
  C:\Windows\System\yCSwjlZ.exe
  2⤵
  PID:7940
- C:\Windows\System\LtKrmph.exe
  C:\Windows\System\LtKrmph.exe
  2⤵
  PID:7964
- C:\Windows\System\PAjNaUd.exe
  C:\Windows\System\PAjNaUd.exe
  2⤵
  PID:7980
- C:\Windows\System\nhVJilz.exe
  C:\Windows\System\nhVJilz.exe
  2⤵
  PID:7996
- C:\Windows\System\eBdZNUG.exe
  C:\Windows\System\eBdZNUG.exe
  2⤵
  PID:8020
- C:\Windows\System\gFNvNuy.exe
  C:\Windows\System\gFNvNuy.exe
  2⤵
  PID:8048
- C:\Windows\System\NgEhRja.exe
  C:\Windows\System\NgEhRja.exe
  2⤵
  PID:8064
- C:\Windows\System\HRxFmYm.exe
  C:\Windows\System\HRxFmYm.exe
  2⤵
  PID:8088
- C:\Windows\System\GSquZiH.exe
  C:\Windows\System\GSquZiH.exe
  2⤵
  PID:8116
- C:\Windows\System\LbzwSkT.exe
  C:\Windows\System\LbzwSkT.exe
  2⤵
  PID:8136
- C:\Windows\System\LAaJiOZ.exe
  C:\Windows\System\LAaJiOZ.exe
  2⤵
  PID:8152
- C:\Windows\System\JpxUClN.exe
  C:\Windows\System\JpxUClN.exe
  2⤵
  PID:8168
- C:\Windows\System\iNzYiof.exe
  C:\Windows\System\iNzYiof.exe
  2⤵
  PID:8188
- C:\Windows\System\WDsehCM.exe
  C:\Windows\System\WDsehCM.exe
  2⤵
  PID:6324
- C:\Windows\System\mzGEOJC.exe
  C:\Windows\System\mzGEOJC.exe
  2⤵
  PID:6784
- C:\Windows\System\JnbxZBr.exe
  C:\Windows\System\JnbxZBr.exe
  2⤵
  PID:7180
- C:\Windows\System\PqBStse.exe
  C:\Windows\System\PqBStse.exe
  2⤵
  PID:7268
- C:\Windows\System\NDWJLVu.exe
  C:\Windows\System\NDWJLVu.exe
  2⤵
  PID:7300
- C:\Windows\System\MxSMEuC.exe
  C:\Windows\System\MxSMEuC.exe
  2⤵
  PID:7336
- C:\Windows\System\hqdMRQs.exe
  C:\Windows\System\hqdMRQs.exe
  2⤵
  PID:7384
- C:\Windows\System\QEWulrT.exe
  C:\Windows\System\QEWulrT.exe
  2⤵
  PID:7396
- C:\Windows\System\OizOqgy.exe
  C:\Windows\System\OizOqgy.exe
  2⤵
  PID:7424
- C:\Windows\System\EnVHUOe.exe
  C:\Windows\System\EnVHUOe.exe
  2⤵
  PID:7464
- C:\Windows\System\GuSnExO.exe
  C:\Windows\System\GuSnExO.exe
  2⤵
  PID:7520
- C:\Windows\System\rLGvJzG.exe
  C:\Windows\System\rLGvJzG.exe
  2⤵
  PID:6828
- C:\Windows\System\lOWujRM.exe
  C:\Windows\System\lOWujRM.exe
  2⤵
  PID:7560
- C:\Windows\System\tSXgjbU.exe
  C:\Windows\System\tSXgjbU.exe
  2⤵
  PID:7592
- C:\Windows\System\ujEExNq.exe
  C:\Windows\System\ujEExNq.exe
  2⤵
  PID:7628
- C:\Windows\System\pEfdQJm.exe
  C:\Windows\System\pEfdQJm.exe
  2⤵
  PID:7664
- C:\Windows\System\OhdasPq.exe
  C:\Windows\System\OhdasPq.exe
  2⤵
  PID:7704
- C:\Windows\System\OPTuaCr.exe
  C:\Windows\System\OPTuaCr.exe
  2⤵
  PID:7796
- C:\Windows\System\gkZZJuZ.exe
  C:\Windows\System\gkZZJuZ.exe
  2⤵
  PID:7780
- C:\Windows\System\nufbEig.exe
  C:\Windows\System\nufbEig.exe
  2⤵
  PID:7804
- C:\Windows\System\ATXceOX.exe
  C:\Windows\System\ATXceOX.exe
  2⤵
  PID:7820
- C:\Windows\System\BLVxmqX.exe
  C:\Windows\System\BLVxmqX.exe
  2⤵
  PID:7876
- C:\Windows\System\rPUTnGP.exe
  C:\Windows\System\rPUTnGP.exe
  2⤵
  PID:7952
- C:\Windows\System\uGbABQU.exe
  C:\Windows\System\uGbABQU.exe
  2⤵
  PID:7936
- C:\Windows\System\fgmdCcw.exe
  C:\Windows\System\fgmdCcw.exe
  2⤵
  PID:7976
- C:\Windows\System\zGYbmui.exe
  C:\Windows\System\zGYbmui.exe
  2⤵
  PID:8004
- C:\Windows\System\gpPdvZa.exe
  C:\Windows\System\gpPdvZa.exe
  2⤵
  PID:8040
- C:\Windows\System\BqeAsTL.exe
  C:\Windows\System\BqeAsTL.exe
  2⤵
  PID:8076
- C:\Windows\System\abOjAPD.exe
  C:\Windows\System\abOjAPD.exe
  2⤵
  PID:8100
- C:\Windows\System\jJUvITR.exe
  C:\Windows\System\jJUvITR.exe
  2⤵
  PID:8164
- C:\Windows\System\lIoofIY.exe
  C:\Windows\System\lIoofIY.exe
  2⤵
  PID:8184
- C:\Windows\System\BGAWyzD.exe
  C:\Windows\System\BGAWyzD.exe
  2⤵
  PID:8180
- C:\Windows\System\eVRSbfh.exe
  C:\Windows\System\eVRSbfh.exe
  2⤵
  PID:7264
- C:\Windows\System\GcDjEhf.exe
  C:\Windows\System\GcDjEhf.exe
  2⤵
  PID:7304
- C:\Windows\System\TfpxchJ.exe
  C:\Windows\System\TfpxchJ.exe
  2⤵
  PID:7280
- C:\Windows\System\CJYoTll.exe
  C:\Windows\System\CJYoTll.exe
  2⤵
  PID:7416
- C:\Windows\System\vnotvij.exe
  C:\Windows\System\vnotvij.exe
  2⤵
  PID:7448
- C:\Windows\System\YlViAxq.exe
  C:\Windows\System\YlViAxq.exe
  2⤵
  PID:7504
- C:\Windows\System\KozwaPf.exe
  C:\Windows\System\KozwaPf.exe
  2⤵
  PID:7580
- C:\Windows\System\nxplKeg.exe
  C:\Windows\System\nxplKeg.exe
  2⤵
  PID:7648
- C:\Windows\System\GKnAXmZ.exe
  C:\Windows\System\GKnAXmZ.exe
  2⤵
  PID:7604
- C:\Windows\System\GuavINg.exe
  C:\Windows\System\GuavINg.exe
  2⤵
  PID:7760
- C:\Windows\System\UAEHFWH.exe
  C:\Windows\System\UAEHFWH.exe
  2⤵
  PID:7824
- C:\Windows\System\fKcGXeZ.exe
  C:\Windows\System\fKcGXeZ.exe
  2⤵
  PID:7920
- C:\Windows\System\nzUzOQt.exe
  C:\Windows\System\nzUzOQt.exe
  2⤵
  PID:7900
- C:\Windows\System\MnSQMbs.exe
  C:\Windows\System\MnSQMbs.exe
  2⤵
  PID:8096
- C:\Windows\System\UseDqBC.exe
  C:\Windows\System\UseDqBC.exe
  2⤵
  PID:7880
- C:\Windows\System\nEyFCdx.exe
  C:\Windows\System\nEyFCdx.exe
  2⤵
  PID:7988
- C:\Windows\System\GqmYHRY.exe
  C:\Windows\System\GqmYHRY.exe
  2⤵
  PID:8016
- C:\Windows\System\JrARKPi.exe
  C:\Windows\System\JrARKPi.exe
  2⤵
  PID:8128
- C:\Windows\System\GWJCbCq.exe
  C:\Windows\System\GWJCbCq.exe
  2⤵
  PID:7232
- C:\Windows\System\hpGmfCc.exe
  C:\Windows\System\hpGmfCc.exe
  2⤵
  PID:7216
- C:\Windows\System\dhGtVLJ.exe
  C:\Windows\System\dhGtVLJ.exe
  2⤵
  PID:7356
- C:\Windows\System\miEFKSk.exe
  C:\Windows\System\miEFKSk.exe
  2⤵
  PID:7480
- C:\Windows\System\rvmpFBT.exe
  C:\Windows\System\rvmpFBT.exe
  2⤵
  PID:7528
- C:\Windows\System\NFlYZuh.exe
  C:\Windows\System\NFlYZuh.exe
  2⤵
  PID:7544
- C:\Windows\System\UMlirlT.exe
  C:\Windows\System\UMlirlT.exe
  2⤵
  PID:7660
- C:\Windows\System\IFJwzfN.exe
  C:\Windows\System\IFJwzfN.exe
  2⤵
  PID:7736
- C:\Windows\System\shmCVCR.exe
  C:\Windows\System\shmCVCR.exe
  2⤵
  PID:7860
- C:\Windows\System\GOnnDdq.exe
  C:\Windows\System\GOnnDdq.exe
  2⤵
  PID:7192
- C:\Windows\System\ZAvdAov.exe
  C:\Windows\System\ZAvdAov.exe
  2⤵
  PID:8112
- C:\Windows\System\vklMWnr.exe
  C:\Windows\System\vklMWnr.exe
  2⤵
  PID:8104
- C:\Windows\System\qpWJKSl.exe
  C:\Windows\System\qpWJKSl.exe
  2⤵
  PID:7236
- C:\Windows\System\LzaoPaG.exe
  C:\Windows\System\LzaoPaG.exe
  2⤵
  PID:7508
- C:\Windows\System\hgkYAFC.exe
  C:\Windows\System\hgkYAFC.exe
  2⤵
  PID:7484
- C:\Windows\System\rqLsdde.exe
  C:\Windows\System\rqLsdde.exe
  2⤵
  PID:7912
- C:\Windows\System\Vopbmuk.exe
  C:\Windows\System\Vopbmuk.exe
  2⤵
  PID:8036
- C:\Windows\System\DhAOJZz.exe
  C:\Windows\System\DhAOJZz.exe
  2⤵
  PID:7624
- C:\Windows\System\uFvibhe.exe
  C:\Windows\System\uFvibhe.exe
  2⤵
  PID:8204
- C:\Windows\System\UFVHHSS.exe
  C:\Windows\System\UFVHHSS.exe
  2⤵
  PID:8224
- C:\Windows\System\tnspjUM.exe
  C:\Windows\System\tnspjUM.exe
  2⤵
  PID:8272
- C:\Windows\System\SnrJShe.exe
  C:\Windows\System\SnrJShe.exe
  2⤵
  PID:8288
- C:\Windows\System\VSFWGsT.exe
  C:\Windows\System\VSFWGsT.exe
  2⤵
  PID:8304
- C:\Windows\System\EsOfSvT.exe
  C:\Windows\System\EsOfSvT.exe
  2⤵
  PID:8320
- C:\Windows\System\HnRFRAR.exe
  C:\Windows\System\HnRFRAR.exe
  2⤵
  PID:8336
- C:\Windows\System\qLAnjEL.exe
  C:\Windows\System\qLAnjEL.exe
  2⤵
  PID:8360
- C:\Windows\System\pUKlOnP.exe
  C:\Windows\System\pUKlOnP.exe
  2⤵
  PID:8388
- C:\Windows\System\hnrMVDO.exe
  C:\Windows\System\hnrMVDO.exe
  2⤵
  PID:8404
- C:\Windows\System\gnopMKJ.exe
  C:\Windows\System\gnopMKJ.exe
  2⤵
  PID:8440
- C:\Windows\System\WOsYLUu.exe
  C:\Windows\System\WOsYLUu.exe
  2⤵
  PID:8456
- C:\Windows\System\cOatlaQ.exe
  C:\Windows\System\cOatlaQ.exe
  2⤵
  PID:8472
- C:\Windows\System\rtDLcjB.exe
  C:\Windows\System\rtDLcjB.exe
  2⤵
  PID:8488
- C:\Windows\System\pjJWitf.exe
  C:\Windows\System\pjJWitf.exe
  2⤵
  PID:8512
- C:\Windows\System\KDvKWNt.exe
  C:\Windows\System\KDvKWNt.exe
  2⤵
  PID:8536
- C:\Windows\System\ySAeCzI.exe
  C:\Windows\System\ySAeCzI.exe
  2⤵
  PID:8552
- C:\Windows\System\ZbOxjxb.exe
  C:\Windows\System\ZbOxjxb.exe
  2⤵
  PID:8568
- C:\Windows\System\WuMLJTC.exe
  C:\Windows\System\WuMLJTC.exe
  2⤵
  PID:8588
- C:\Windows\System\hPeHRbE.exe
  C:\Windows\System\hPeHRbE.exe
  2⤵
  PID:8612
- C:\Windows\System\hyAlOvQ.exe
  C:\Windows\System\hyAlOvQ.exe
  2⤵
  PID:8628
- C:\Windows\System\PxartyD.exe
  C:\Windows\System\PxartyD.exe
  2⤵
  PID:8660
- C:\Windows\System\ukGcdnH.exe
  C:\Windows\System\ukGcdnH.exe
  2⤵
  PID:8676
- C:\Windows\System\JGbEWTG.exe
  C:\Windows\System\JGbEWTG.exe
  2⤵
  PID:8696
- C:\Windows\System\jrxOapn.exe
  C:\Windows\System\jrxOapn.exe
  2⤵
  PID:8712
- C:\Windows\System\xJtrbye.exe
  C:\Windows\System\xJtrbye.exe
  2⤵
  PID:8728
- C:\Windows\System\OuutwLj.exe
  C:\Windows\System\OuutwLj.exe
  2⤵
  PID:8744
- C:\Windows\System\sfRUqEp.exe
  C:\Windows\System\sfRUqEp.exe
  2⤵
  PID:8764
- C:\Windows\System\cAVXMsY.exe
  C:\Windows\System\cAVXMsY.exe
  2⤵
  PID:8780
- C:\Windows\System\NMAumjA.exe
  C:\Windows\System\NMAumjA.exe
  2⤵
  PID:8796
- C:\Windows\System\DVDrftr.exe
  C:\Windows\System\DVDrftr.exe
  2⤵
  PID:8812
- C:\Windows\System\aywxRZQ.exe
  C:\Windows\System\aywxRZQ.exe
  2⤵
  PID:8840
- C:\Windows\System\poLjZSU.exe
  C:\Windows\System\poLjZSU.exe
  2⤵
  PID:8856
- C:\Windows\System\omcVAnT.exe
  C:\Windows\System\omcVAnT.exe
  2⤵
  PID:8876
- C:\Windows\System\hjtnsJT.exe
  C:\Windows\System\hjtnsJT.exe
  2⤵
  PID:8892
- C:\Windows\System\xmGkoeM.exe
  C:\Windows\System\xmGkoeM.exe
  2⤵
  PID:8912
- C:\Windows\System\zBbmRmG.exe
  C:\Windows\System\zBbmRmG.exe
  2⤵
  PID:8928
- C:\Windows\System\SxLMHdT.exe
  C:\Windows\System\SxLMHdT.exe
  2⤵
  PID:8944
- C:\Windows\System\bgRfUdZ.exe
  C:\Windows\System\bgRfUdZ.exe
  2⤵
  PID:8960
- C:\Windows\System\MfpJGdm.exe
  C:\Windows\System\MfpJGdm.exe
  2⤵
  PID:8976
- C:\Windows\System\RFnBZnk.exe
  C:\Windows\System\RFnBZnk.exe
  2⤵
  PID:8992
- C:\Windows\System\dDRykSV.exe
  C:\Windows\System\dDRykSV.exe
  2⤵
  PID:9008
- C:\Windows\System\ffLafRO.exe
  C:\Windows\System\ffLafRO.exe
  2⤵
  PID:9028
- C:\Windows\System\yaxesow.exe
  C:\Windows\System\yaxesow.exe
  2⤵
  PID:9044
- C:\Windows\System\LlPSoPv.exe
  C:\Windows\System\LlPSoPv.exe
  2⤵
  PID:9060
- C:\Windows\System\AezAHtg.exe
  C:\Windows\System\AezAHtg.exe
  2⤵
  PID:9076
- C:\Windows\System\fiJThoq.exe
  C:\Windows\System\fiJThoq.exe
  2⤵
  PID:9096
- C:\Windows\System\gYsKjQM.exe
  C:\Windows\System\gYsKjQM.exe
  2⤵
  PID:9112
- C:\Windows\System\ECUkTnh.exe
  C:\Windows\System\ECUkTnh.exe
  2⤵
  PID:9128
- C:\Windows\System\dLIwnkB.exe
  C:\Windows\System\dLIwnkB.exe
  2⤵
  PID:9144
- C:\Windows\System\kmkzEsq.exe
  C:\Windows\System\kmkzEsq.exe
  2⤵
  PID:9164
- C:\Windows\System\zIwWKUm.exe
  C:\Windows\System\zIwWKUm.exe
  2⤵
  PID:9180
- C:\Windows\System\fqxMpQq.exe
  C:\Windows\System\fqxMpQq.exe
  2⤵
  PID:9196
- C:\Windows\System\APsRMyc.exe
  C:\Windows\System\APsRMyc.exe
  2⤵
  PID:9212
- C:\Windows\System\IgfSFBy.exe
  C:\Windows\System\IgfSFBy.exe
  2⤵
  PID:7688
- C:\Windows\System\UCaPIKc.exe
  C:\Windows\System\UCaPIKc.exe
  2⤵
  PID:7368
- C:\Windows\System\cxIfdzz.exe
  C:\Windows\System\cxIfdzz.exe
  2⤵
  PID:8072
- C:\Windows\System\LvHqDKj.exe
  C:\Windows\System\LvHqDKj.exe
  2⤵
  PID:7932
- C:\Windows\System\wSpfFUm.exe
  C:\Windows\System\wSpfFUm.exe
  2⤵
  PID:8212
- C:\Windows\System\DndhSwc.exe
  C:\Windows\System\DndhSwc.exe
  2⤵
  PID:8268
- C:\Windows\System\PkFhVRX.exe
  C:\Windows\System\PkFhVRX.exe
  2⤵
  PID:8328
- C:\Windows\System\FujSzBr.exe
  C:\Windows\System\FujSzBr.exe
  2⤵
  PID:8368
- C:\Windows\System\toyhJAn.exe
  C:\Windows\System\toyhJAn.exe
  2⤵
  PID:8412
- C:\Windows\System\IgpzdAs.exe
  C:\Windows\System\IgpzdAs.exe
  2⤵
  PID:8424
- C:\Windows\System\VcLRHEu.exe
  C:\Windows\System\VcLRHEu.exe
  2⤵
  PID:8400
- C:\Windows\System\Mslhzmo.exe
  C:\Windows\System\Mslhzmo.exe
  2⤵
  PID:8468
- C:\Windows\System\aqVvMmU.exe
  C:\Windows\System\aqVvMmU.exe
  2⤵
  PID:8452
- C:\Windows\System\XKQlVPe.exe
  C:\Windows\System\XKQlVPe.exe
  2⤵
  PID:8544
- C:\Windows\System\IIPuvYj.exe
  C:\Windows\System\IIPuvYj.exe
  2⤵
  PID:8532
- C:\Windows\System\RaYGuXg.exe
  C:\Windows\System\RaYGuXg.exe
  2⤵
  PID:8564
- C:\Windows\System\nGkILwK.exe
  C:\Windows\System\nGkILwK.exe
  2⤵
  PID:8652
- C:\Windows\System\mVzdFQQ.exe
  C:\Windows\System\mVzdFQQ.exe
  2⤵
  PID:8656
- C:\Windows\System\PifiwHG.exe
  C:\Windows\System\PifiwHG.exe
  2⤵
  PID:8692
- C:\Windows\System\IDAUlWf.exe
  C:\Windows\System\IDAUlWf.exe
  2⤵
  PID:8776
- C:\Windows\System\fYiFndv.exe
  C:\Windows\System\fYiFndv.exe
  2⤵
  PID:8832
- C:\Windows\System\OTByMnY.exe
  C:\Windows\System\OTByMnY.exe
  2⤵
  PID:8884
- C:\Windows\System\tukLAyN.exe
  C:\Windows\System\tukLAyN.exe
  2⤵
  PID:8788
- C:\Windows\System\Rsltwyr.exe
  C:\Windows\System\Rsltwyr.exe
  2⤵
  PID:8864
- C:\Windows\System\esirYBD.exe
  C:\Windows\System\esirYBD.exe
  2⤵
  PID:8920
- C:\Windows\System\mwirzjj.exe
  C:\Windows\System\mwirzjj.exe
  2⤵
  PID:8908
- C:\Windows\System\SBzXGPa.exe
  C:\Windows\System\SBzXGPa.exe
  2⤵
  PID:8988
- C:\Windows\System\nlTUkWV.exe
  C:\Windows\System\nlTUkWV.exe
  2⤵
  PID:9004
- C:\Windows\System\mhqnLkq.exe
  C:\Windows\System\mhqnLkq.exe
  2⤵
  PID:9024
- C:\Windows\System\DTWNnAX.exe
  C:\Windows\System\DTWNnAX.exe
  2⤵
  PID:9056
- C:\Windows\System\RHKtHfe.exe
  C:\Windows\System\RHKtHfe.exe
  2⤵
  PID:9092
- C:\Windows\System\HlutEsY.exe
  C:\Windows\System\HlutEsY.exe
  2⤵
  PID:9104
- C:\Windows\System\AyBynKD.exe
  C:\Windows\System\AyBynKD.exe
  2⤵
  PID:9160
- C:\Windows\System\JSxTemA.exe
  C:\Windows\System\JSxTemA.exe
  2⤵
  PID:9176
- C:\Windows\System\ZhJTLVL.exe
  C:\Windows\System\ZhJTLVL.exe
  2⤵
  PID:9204
- C:\Windows\System\qXJbONd.exe
  C:\Windows\System\qXJbONd.exe
  2⤵
  PID:8232
- C:\Windows\System\lpmQUxO.exe
  C:\Windows\System\lpmQUxO.exe
  2⤵
  PID:8252
- C:\Windows\System\SCKqDTa.exe
  C:\Windows\System\SCKqDTa.exe
  2⤵
  PID:8260
- C:\Windows\System\iNakdzm.exe
  C:\Windows\System\iNakdzm.exe
  2⤵
  PID:8300
- C:\Windows\System\yoHHYUZ.exe
  C:\Windows\System\yoHHYUZ.exe
  2⤵
  PID:8084
- C:\Windows\System\OestCVv.exe
  C:\Windows\System\OestCVv.exe
  2⤵
  PID:8384
- C:\Windows\System\kXjHGkI.exe
  C:\Windows\System\kXjHGkI.exe
  2⤵
  PID:8416
- C:\Windows\System\EFgOCYi.exe
  C:\Windows\System\EFgOCYi.exe
  2⤵
  PID:8496
- C:\Windows\System\zOMXtuC.exe
  C:\Windows\System\zOMXtuC.exe
  2⤵
  PID:8580
- C:\Windows\System\NldBElE.exe
  C:\Windows\System\NldBElE.exe
  2⤵
  PID:8484
- C:\Windows\System\FarrDWl.exe
  C:\Windows\System\FarrDWl.exe
  2⤵
  PID:8620
- C:\Windows\System\kugoNrw.exe
  C:\Windows\System\kugoNrw.exe
  2⤵
  PID:8672
- C:\Windows\System\ARLjhUp.exe
  C:\Windows\System\ARLjhUp.exe
  2⤵
  PID:8772
- C:\Windows\System\kmCPlRt.exe
  C:\Windows\System\kmCPlRt.exe
  2⤵
  PID:8648
- C:\Windows\System\zQMJrNj.exe
  C:\Windows\System\zQMJrNj.exe
  2⤵
  PID:8852
- C:\Windows\System\RDQxqpT.exe
  C:\Windows\System\RDQxqpT.exe
  2⤵
  PID:8952
- C:\Windows\System\OWrwueM.exe
  C:\Windows\System\OWrwueM.exe
  2⤵
  PID:9000
- C:\Windows\System\LeGuTzv.exe
  C:\Windows\System\LeGuTzv.exe
  2⤵
  PID:8972
- C:\Windows\System\QCcqskp.exe
  C:\Windows\System\QCcqskp.exe
  2⤵
  PID:9036
- C:\Windows\System\IawovdB.exe
  C:\Windows\System\IawovdB.exe
  2⤵
  PID:9192
- C:\Windows\System\NdZpoiK.exe
  C:\Windows\System\NdZpoiK.exe
  2⤵
  PID:8432
- C:\Windows\System\XRucweP.exe
  C:\Windows\System\XRucweP.exe
  2⤵
  PID:8132
- C:\Windows\System\tgEEayD.exe
  C:\Windows\System\tgEEayD.exe
  2⤵
  PID:8256
- C:\Windows\System\pnRasmN.exe
  C:\Windows\System\pnRasmN.exe
  2⤵
  PID:8380
- C:\Windows\System\zyRLpXY.exe
  C:\Windows\System\zyRLpXY.exe
  2⤵
  PID:8560
- C:\Windows\System\OiNrpyJ.exe
  C:\Windows\System\OiNrpyJ.exe
  2⤵
  PID:8264
- C:\Windows\System\gZAcQDB.exe
  C:\Windows\System\gZAcQDB.exe
  2⤵
  PID:8508
- C:\Windows\System\deKJJIP.exe
  C:\Windows\System\deKJJIP.exe
  2⤵
  PID:8724
- C:\Windows\System\dtBEUQC.exe
  C:\Windows\System\dtBEUQC.exe
  2⤵
  PID:8904
- C:\Windows\System\TxwqOYZ.exe
  C:\Windows\System\TxwqOYZ.exe
  2⤵
  PID:8848
- C:\Windows\System\HOMsszK.exe
  C:\Windows\System\HOMsszK.exe
  2⤵
  PID:8792
- C:\Windows\System\kvDPGdr.exe
  C:\Windows\System\kvDPGdr.exe
  2⤵
  PID:9136
- C:\Windows\System\JNqcNlp.exe
  C:\Windows\System\JNqcNlp.exe
  2⤵
  PID:9072
- C:\Windows\System\TTCyqVO.exe
  C:\Windows\System\TTCyqVO.exe
  2⤵
  PID:9172
- C:\Windows\System\vJAJlOb.exe
  C:\Windows\System\vJAJlOb.exe
  2⤵
  PID:8584
- C:\Windows\System\AzFWrCO.exe
  C:\Windows\System\AzFWrCO.exe
  2⤵
  PID:8688
- C:\Windows\System\gqtJwbU.exe
  C:\Windows\System\gqtJwbU.exe
  2⤵
  PID:8480
- C:\Windows\System\ISciRfc.exe
  C:\Windows\System\ISciRfc.exe
  2⤵
  PID:8428
- C:\Windows\System\awVmjOm.exe
  C:\Windows\System\awVmjOm.exe
  2⤵
  PID:9228
- C:\Windows\System\tXtmOiN.exe
  C:\Windows\System\tXtmOiN.exe
  2⤵
  PID:9244
- C:\Windows\System\udFvBLN.exe
  C:\Windows\System\udFvBLN.exe
  2⤵
  PID:9260
- C:\Windows\System\NpZPUER.exe
  C:\Windows\System\NpZPUER.exe
  2⤵
  PID:9276
- C:\Windows\System\juYbsmV.exe
  C:\Windows\System\juYbsmV.exe
  2⤵
  PID:9292
- C:\Windows\System\SdlycJJ.exe
  C:\Windows\System\SdlycJJ.exe
  2⤵
  PID:9308
- C:\Windows\System\owYlCRE.exe
  C:\Windows\System\owYlCRE.exe
  2⤵
  PID:9324
- C:\Windows\System\iwDNrUS.exe
  C:\Windows\System\iwDNrUS.exe
  2⤵
  PID:9340
- C:\Windows\System\zWptTiu.exe
  C:\Windows\System\zWptTiu.exe
  2⤵
  PID:9356
- C:\Windows\System\ZxEMtDm.exe
  C:\Windows\System\ZxEMtDm.exe
  2⤵
  PID:9372
- C:\Windows\System\LBIcdXN.exe
  C:\Windows\System\LBIcdXN.exe
  2⤵
  PID:9388
- C:\Windows\System\sFXWMjy.exe
  C:\Windows\System\sFXWMjy.exe
  2⤵
  PID:9424
- C:\Windows\System\KSOoKfI.exe
  C:\Windows\System\KSOoKfI.exe
  2⤵
  PID:9444
- C:\Windows\System\NYBZHrr.exe
  C:\Windows\System\NYBZHrr.exe
  2⤵
  PID:9508
- C:\Windows\System\gMCpcIt.exe
  C:\Windows\System\gMCpcIt.exe
  2⤵
  PID:9528
- C:\Windows\System\hgmMXSm.exe
  C:\Windows\System\hgmMXSm.exe
  2⤵
  PID:9544
- C:\Windows\System\vCHJvch.exe
  C:\Windows\System\vCHJvch.exe
  2⤵
  PID:9560
- C:\Windows\System\DQVFVFw.exe
  C:\Windows\System\DQVFVFw.exe
  2⤵
  PID:9576
- C:\Windows\System\BuLjnDl.exe
  C:\Windows\System\BuLjnDl.exe
  2⤵
  PID:9596
- C:\Windows\System\qBuGpLJ.exe
  C:\Windows\System\qBuGpLJ.exe
  2⤵
  PID:9616
- C:\Windows\System\MWWiaVX.exe
  C:\Windows\System\MWWiaVX.exe
  2⤵
  PID:9632
- C:\Windows\System\BecIlra.exe
  C:\Windows\System\BecIlra.exe
  2⤵
  PID:9648
- C:\Windows\System\lGQUFtM.exe
  C:\Windows\System\lGQUFtM.exe
  2⤵
  PID:9664
- C:\Windows\System\FXgfniN.exe
  C:\Windows\System\FXgfniN.exe
  2⤵
  PID:9680
- C:\Windows\System\zDWSese.exe
  C:\Windows\System\zDWSese.exe
  2⤵
  PID:9696
- C:\Windows\System\oDjSzUj.exe
  C:\Windows\System\oDjSzUj.exe
  2⤵
  PID:9712
- C:\Windows\System\awmPnQK.exe
  C:\Windows\System\awmPnQK.exe
  2⤵
  PID:9728
- C:\Windows\System\VIExLSM.exe
  C:\Windows\System\VIExLSM.exe
  2⤵
  PID:9744
- C:\Windows\System\TYPwBqp.exe
  C:\Windows\System\TYPwBqp.exe
  2⤵
  PID:9764
- C:\Windows\System\fRepUiG.exe
  C:\Windows\System\fRepUiG.exe
  2⤵
  PID:9788
- C:\Windows\System\DFMtBHm.exe
  C:\Windows\System\DFMtBHm.exe
  2⤵
  PID:9804
- C:\Windows\System\tqeuXqZ.exe
  C:\Windows\System\tqeuXqZ.exe
  2⤵
  PID:9820
- C:\Windows\System\qazHmxT.exe
  C:\Windows\System\qazHmxT.exe
  2⤵
  PID:9836
- C:\Windows\System\QrjQrJI.exe
  C:\Windows\System\QrjQrJI.exe
  2⤵
  PID:9852
- C:\Windows\System\RwgBHFg.exe
  C:\Windows\System\RwgBHFg.exe
  2⤵
  PID:9868
- C:\Windows\System\uNgLQfw.exe
  C:\Windows\System\uNgLQfw.exe
  2⤵
  PID:9884
- C:\Windows\System\FoktTQp.exe
  C:\Windows\System\FoktTQp.exe
  2⤵
  PID:9900
- C:\Windows\System\jKURBkt.exe
  C:\Windows\System\jKURBkt.exe
  2⤵
  PID:9916
- C:\Windows\System\TiRIqiQ.exe
  C:\Windows\System\TiRIqiQ.exe
  2⤵
  PID:9932
- C:\Windows\System\YgbmTao.exe
  C:\Windows\System\YgbmTao.exe
  2⤵
  PID:9948
- C:\Windows\System\TrZnINo.exe
  C:\Windows\System\TrZnINo.exe
  2⤵
  PID:9972
- C:\Windows\System\bGbebFm.exe
  C:\Windows\System\bGbebFm.exe
  2⤵
  PID:9992
- C:\Windows\System\igaRJbC.exe
  C:\Windows\System\igaRJbC.exe
  2⤵
  PID:10008
- C:\Windows\System\XxwECNA.exe
  C:\Windows\System\XxwECNA.exe
  2⤵
  PID:10024
- C:\Windows\System\RwfFEwI.exe
  C:\Windows\System\RwfFEwI.exe
  2⤵
  PID:10040
- C:\Windows\System\sxSCXAU.exe
  C:\Windows\System\sxSCXAU.exe
  2⤵
  PID:9236
- C:\Windows\System\LdAofVE.exe
  C:\Windows\System\LdAofVE.exe
  2⤵
  PID:7960
- C:\Windows\System\qaHETxT.exe
  C:\Windows\System\qaHETxT.exe
  2⤵
  PID:9272
- C:\Windows\System\agyTMRf.exe
  C:\Windows\System\agyTMRf.exe
  2⤵
  PID:9284
- C:\Windows\System\atnQQHV.exe
  C:\Windows\System\atnQQHV.exe
  2⤵
  PID:9316
- C:\Windows\System\MdeqFWB.exe
  C:\Windows\System\MdeqFWB.exe
  2⤵
  PID:9336
- C:\Windows\System\ODQsOCh.exe
  C:\Windows\System\ODQsOCh.exe
  2⤵
  PID:9368
- C:\Windows\System\ZRoxjOb.exe
  C:\Windows\System\ZRoxjOb.exe
  2⤵
  PID:9408
- C:\Windows\System\CMSnpwb.exe
  C:\Windows\System\CMSnpwb.exe
  2⤵
  PID:9380
- C:\Windows\System\boQsTMR.exe
  C:\Windows\System\boQsTMR.exe
  2⤵
  PID:9436
- C:\Windows\System\ZRJZFXu.exe
  C:\Windows\System\ZRJZFXu.exe
  2⤵
  PID:9464
- C:\Windows\System\rgrGQyh.exe
  C:\Windows\System\rgrGQyh.exe
  2⤵
  PID:9480
- C:\Windows\System\ihVRFNP.exe
  C:\Windows\System\ihVRFNP.exe
  2⤵
  PID:9500
- C:\Windows\System\vpZhEhF.exe
  C:\Windows\System\vpZhEhF.exe
  2⤵
  PID:9520
- C:\Windows\System\ftlvnJv.exe
  C:\Windows\System\ftlvnJv.exe
  2⤵
  PID:9552
- C:\Windows\System\CjEAaBR.exe
  C:\Windows\System\CjEAaBR.exe
  2⤵
  PID:9592
- C:\Windows\System\Jgqamzf.exe
  C:\Windows\System\Jgqamzf.exe
  2⤵
  PID:9644
- C:\Windows\System\kAmqlAe.exe
  C:\Windows\System\kAmqlAe.exe
  2⤵
  PID:9708
- C:\Windows\System\dHijeiL.exe
  C:\Windows\System\dHijeiL.exe
  2⤵
  PID:9964
- C:\Windows\System\xFXbNag.exe
  C:\Windows\System\xFXbNag.exe
  2⤵
  PID:10048
- C:\Windows\System\tQlIImR.exe
  C:\Windows\System\tQlIImR.exe
  2⤵
  PID:10052
- C:\Windows\System\cFJhQVw.exe
  C:\Windows\System\cFJhQVw.exe
  2⤵
  PID:10072
- C:\Windows\System\MIWpIwB.exe
  C:\Windows\System\MIWpIwB.exe
  2⤵
  PID:10000
- C:\Windows\System\XmCplCG.exe
  C:\Windows\System\XmCplCG.exe
  2⤵
  PID:10112
- C:\Windows\System\XIYFrrx.exe
  C:\Windows\System\XIYFrrx.exe
  2⤵
  PID:10124
- C:\Windows\System\DPTXVOl.exe
  C:\Windows\System\DPTXVOl.exe
  2⤵
  PID:10144
- C:\Windows\System\UtWTjtr.exe
  C:\Windows\System\UtWTjtr.exe
  2⤵
  PID:1840
- C:\Windows\System\plqWPij.exe
  C:\Windows\System\plqWPij.exe
  2⤵
  PID:10176
- C:\Windows\System\dkWxxcV.exe
  C:\Windows\System\dkWxxcV.exe
  2⤵
  PID:2528
- C:\Windows\System\MyZcPYW.exe
  C:\Windows\System\MyZcPYW.exe
  2⤵
  PID:1044
- C:\Windows\System\FDxcxUl.exe
  C:\Windows\System\FDxcxUl.exe
  2⤵
  PID:10200
- C:\Windows\System\cIPpdre.exe
  C:\Windows\System\cIPpdre.exe
  2⤵
  PID:10216
- C:\Windows\System\ANziDRc.exe
  C:\Windows\System\ANziDRc.exe
  2⤵
  PID:10232
- C:\Windows\System\pktDjcf.exe
  C:\Windows\System\pktDjcf.exe
  2⤵
  PID:8900
- C:\Windows\System\EznMgfC.exe
  C:\Windows\System\EznMgfC.exe
  2⤵
  PID:9152
- C:\Windows\System\hZTZLHa.exe
  C:\Windows\System\hZTZLHa.exe
  2⤵
  PID:9240
- C:\Windows\System\dhsATyK.exe
  C:\Windows\System\dhsATyK.exe
  2⤵
  PID:9304
- C:\Windows\System\NSgFPJb.exe
  C:\Windows\System\NSgFPJb.exe
  2⤵
  PID:9364
- C:\Windows\System\AeUqxoV.exe
  C:\Windows\System\AeUqxoV.exe
  2⤵
  PID:9420
- C:\Windows\System\kzCTOjx.exe
  C:\Windows\System\kzCTOjx.exe
  2⤵
  PID:9404
- C:\Windows\System\gcbwFXV.exe
  C:\Windows\System\gcbwFXV.exe
  2⤵
  PID:9568
- C:\Windows\System\wfYJScx.exe
  C:\Windows\System\wfYJScx.exe
  2⤵
  PID:9628
- C:\Windows\System\AGLwwei.exe
  C:\Windows\System\AGLwwei.exe
  2⤵
  PID:9740
- C:\Windows\System\lpwUhwZ.exe
  C:\Windows\System\lpwUhwZ.exe
  2⤵
  PID:9760
- C:\Windows\System\vFITmBP.exe
  C:\Windows\System\vFITmBP.exe
  2⤵
  PID:9720
- C:\Windows\System\psquVkJ.exe
  C:\Windows\System\psquVkJ.exe
  2⤵
  PID:9776
- C:\Windows\System\RsUPmpz.exe
  C:\Windows\System\RsUPmpz.exe
  2⤵
  PID:9812
- C:\Windows\System\TxNxsBR.exe
  C:\Windows\System\TxNxsBR.exe
  2⤵
  PID:9864
- C:\Windows\System\zsvdfJM.exe
  C:\Windows\System\zsvdfJM.exe
  2⤵
  PID:9880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ATdVcyw.exe

Filesize
2.7MB

MD5
b28f022c55272af42ec89bd19939eb34

SHA1
a23e5d937a6ce429dbafb8ee983f62f1c0be8f7d

SHA256
52deda641104604de3e9c872f35dad67fff9e5b954811f7cdf1c9cbef8baad24

SHA512
d7ea8fea3c5c6b7c31d004a1b8b71724440bb2928b21fdc6c69e84c32f758f032be9a1f4d5acdbf35de16580eaa87f632d4faa0bb31576504625a1894a184ce4

Download Submit
C:\Windows\system\EcIwpCw.exe

Filesize
2.7MB

MD5
3e2d51c3122b8e50bbdb2b953ede2f54

SHA1
66773d8fdc99463bca6ff720e6d0665fa5450e88

SHA256
a37fe4203953675b3619b2f6af5f927c2e623b9257e6104a39128c891450c52d

SHA512
ad562c0345d4e731e1716cbb60a0df81ac1f1353eff2be83708c4779243f2030a1a3abc0a90dedefe494a02938501e1b002a011394e23a585932909e1b0861bd

Download Submit
C:\Windows\system\JjFdbdr.exe

Filesize
2.7MB

MD5
5c2bbbb5bd031d1cb4b7b14f5dc213b1

SHA1
1648518455aeb9c1dd3addd6424fda7f8db35835

SHA256
3617aff3428e72e8a4b3ddb26e4f732ea01eb98705a20e66ab6297d95663dfad

SHA512
10f485d97640c406ef704083eab1ed676b6d4bb1948d2d5d61502d473b95a0bb84e7aec960e3302b8cdcce1236d24be07d58acc0f1c5401f3ba392e81cd8b185

Download Submit
C:\Windows\system\MfdyBIH.exe

Filesize
2.7MB

MD5
f1538f647c47c3c881840ba03b3c9be1

SHA1
6fa74fbddfedce7ef425be0de504385d58c1e61c

SHA256
78d87d0e6c840e8af116133e4dd0876fe38a402f42287e07d006aa9639c85e7b

SHA512
50e9d77f7443d2c15eec675e49be13b4279edc203395d139e2e89338277f137bf4afafc30630f2cc84e015df89a6ea471da4536dfd9d81cc81daa0b8b1285cfa

Download Submit
C:\Windows\system\PDpNsCo.exe

Filesize
2.7MB

MD5
820e907f6ae239018fbe860a1011df72

SHA1
88a1494719f278ac04549b7506d98e08675aeb87

SHA256
7c3f9915e36110cef7b9eb4232153677c0681e83b0af51f40dc102aa19868373

SHA512
bbe0d0caf90b7969300060cef8362809b24f7eed81e5bf474a7e855431fc41baa6954230b70094a4b27ba7a1f918cf8dc9cdfaa2029bb5fb28b10f9d86909c12

Download Submit
C:\Windows\system\PQTDAKu.exe

Filesize
2.7MB

MD5
6bd4ab09673dc38a51ae3fe7f3b30ddb

SHA1
c4f9c71413233064081c774d218993b9ddccb400

SHA256
054ee180b11feb3315aa84347b7d4259f9b47d995a9a5bbed9eca7f43e1c8752

SHA512
677b4b771c59ccf740fd2e0fa2cdeac1023b712590f5d2f6a1e62342bbd402114f4b132f91a80025b446a87bc3e6f200e74f7b491bc3a579b65c5f1aad00eba2

Download Submit
C:\Windows\system\PRRgyTc.exe

Filesize
2.7MB

MD5
c174b34a82837971f27775316d16d06c

SHA1
34c9949d5ced32d832b1f8688fc144a96d3a913c

SHA256
806234f5cab6bb3742ca3db2ab31ea1538a55768a60e439d062309ca66745159

SHA512
1d09f6f9c5bd1e8545236cc6d1b1160fb064928ccfa39688eced4a3b023ba47324216796cab8691acc681c2a0ab3c09cb7d0fdf96a75e02d79249ad9aa289b77

Download Submit
C:\Windows\system\QFIhVSz.exe

Filesize
2.7MB

MD5
6438f4ba31299ac96accacfc2c636c02

SHA1
c9ded1d61d18aa14d8c95b750eb25b9ce85966b8

SHA256
0c47d2d98bc7e91b63b91d6d3766c87cdaa10001aa70c884b59a8ef7fae62a61

SHA512
16990f47f040f360160d78792c1f8f1678575dfaae5db03d3e9b430808792f8e0c2545776e4033b3e83b006c786c854f9e9223cbb1672c958e77b3b3b8f270a0

Download Submit
C:\Windows\system\QgFztvC.exe

Filesize
2.7MB

MD5
8f5ba5436fe30e178ed99d7334d3904f

SHA1
b485c3642e3d97623c218ba79ca7b5875ee4f609

SHA256
0b46a3f7a05a36eae8211ac19da3b3ed9ac94a960d709d2a392013353ade4330

SHA512
45f39f880d268e9cb58eef1e300b52224d727997cedb049f177c7b9d72fa8da86c5b6fecf2846ad86fe7face0c0d3a8049f59af1850f32993117322db2845966

Download Submit
C:\Windows\system\UOMpgkt.exe

Filesize
2.7MB

MD5
9c2c9a57cbe67b9186f26877b86554fd

SHA1
455fa9d74239d844706181530f3deb259edc8273

SHA256
57611cef7a179ea088e74e0720ab01cb6ca77fddce5aeea52bd359ac044baaf5

SHA512
21d1e5a92fdf05b8aebc1b268f5f9821651ce114ee227e848031addd9941f8f6aa65c65cc181587c695524a19bf49c6ea3a55d058ccbeeb865cd9da4de3eb695

Download Submit
C:\Windows\system\XdkDHUY.exe

Filesize
2.7MB

MD5
86afe5082508eac0c2128311ceee0cec

SHA1
51569b0233c7ff91e4529da18f59d1a5434ee57e

SHA256
bf46cc988dc73c435d4975b8ca9ddd41785b97a99c82986dd17eb03e20eda298

SHA512
c21bafaac65c58fa7a8a10f7ebb5ac9542d60f2914fc837db917963b0a67bf35410650408305f9cf8699c5536be6404cd411b4065d51f2d8819c68ead49cd9ce

Download Submit
C:\Windows\system\ZjhXTqx.exe

Filesize
2.7MB

MD5
034a8e37fa46875e2fafae1fb8c9001a

SHA1
0179e92b0a5b656ec6a77c5ffccb85792f1ef5cb

SHA256
4da75eb63fa92b6007fa5423e69136a1c9976bc87c04dc813f5b8e7783e9c69c

SHA512
a85ffc41d694e1974598f4204af7a0e8ffa652fb789076d3d676f2f18b8fb973809e5578c084b7ef01531ae6635e78dc04762b06db3f8685b76ecf86c4ccc24f

Download Submit
C:\Windows\system\cMvANkF.exe

Filesize
2.7MB

MD5
feae969c25c510572358772aec4001d7

SHA1
d2e38947548eb771b1b44b2b2c0420f5b7c5e1a6

SHA256
58f99ac8954a7769aec55597dc0e40a195aa56e863555d2cdf87edabd8504099

SHA512
0c387aa3bb344daf95f1076132a665d0e7518758689ccf4e1963b266bc7627dfd580ca475af66673461ddd71cd6570bc31a41a3d48a67339bed76d2b6e17d473

Download Submit
C:\Windows\system\enRwKCI.exe

Filesize
2.7MB

MD5
e4f72a2cbfc08f4ce2e5cbd4ee13b4f2

SHA1
02317ec3550b9a9b5aa53467fe0200c9452f6631

SHA256
53663dad361e447213f59913e02e4d4b3c2483314d8a0d8f22f2c5a5ceb560a7

SHA512
eaf943ef22490dbbf0132c7395e5b2b82a8e32dcd14f04f191805ba55fa66bfe4d01074536dc09549a6b2d2b8293d21976b368ed4e1eb7cc6c30dc421c209a56

Download Submit
C:\Windows\system\jodkhMP.exe

Filesize
2.7MB

MD5
429a32238368cdf410b2a62e0926bff2

SHA1
5b1687cc18a6a51b32531d171c798f66100372e4

SHA256
824faba30f90443edff3b38d1a0b61300a30cba45f7233160580f60adf68fb46

SHA512
a68b2dc0d5de811c9b88bfde17e9fa96b1d33e2a51f622da6f29f12bac9bf2dab3ed2a6c79c9bf502fce184b27571e20ad879cb218f198eb282448116a6d2df6

Download Submit
C:\Windows\system\kXwoNVL.exe

Filesize
2.7MB

MD5
b9fc5c9503bef25a36c885aeb3976e89

SHA1
e998afcaa8a55cb0706545cb5720abe81107a933

SHA256
499b817ce18b68057c660fec8f6b0f5f7fada11a44e8ede2d819b180815f0b31

SHA512
bf33dc263a4752ec964c1de513e4f2e96739c3e3ca182d6184385f10df340f978155394d9d7694cc0f12dfc471535f16cf542eff74dd482852dc2011fb64424c

Download Submit
C:\Windows\system\llRsGuy.exe

Filesize
2.7MB

MD5
8c23c087e6ab48b05ee8964ad6b89f2e

SHA1
c4a2f9fdedcc272d7219513ab2f031e82fe1c09f

SHA256
dbdff1f7d7e2021e85c9c7351f3ce2e845045332e2edf61399a1f86603c4796d

SHA512
622a85d25c1a7e3fb600f40b8e3fc72a01454979d72b61eb80d7b9d61525f45d50ec63c7df8b3d5a57ebdf1cb4bcbd3950631bd232afa844900cc3d87d8a5e07

Download Submit
C:\Windows\system\mCJiwql.exe

Filesize
2.7MB

MD5
1fb84f457494be0fc4cb0d1d4344f052

SHA1
fb3f63289c0eaac1c7312e8ca8b1bf0ee3d3c59f

SHA256
2a5fbfe1365690cd07ec2def64e55dc3ff50d6f5359038a67c76b3ec9cf8e50f

SHA512
5fa6cc707d32a19d2cc9076568c93936e44190e9314ceb466afbce3a037cc0e18bac4f1ceabaa2b0641cd838df4f646ccb54aa34d2dffd7d2d45cc78456ffba2

Download Submit
C:\Windows\system\qFJwTpp.exe

Filesize
2.7MB

MD5
c105db2e109db7bbaabcf227f86fa66e

SHA1
ec5bcdcdb6a5d566678766079e489d52ba01fd5d

SHA256
d4e5763598d8246db83b16db0e9d0bfc6e6a35683c8058ba5c0b2d35ebf84836

SHA512
5fdc04508c8b268f9604e4706432d1ad36ae78fe0fe9ef89e946b1c9724b6d8ab493904831cecae50de35ac189db481088fcf2d0026c7294295920941b1b2722

Download Submit
C:\Windows\system\rUwKFzU.exe

Filesize
2.7MB

MD5
f5c202c31ed047742dbb91a07c1f94d8

SHA1
8858e82e36a5961998ba09ef2f110a9b15ef2639

SHA256
c8677ea9976eebb8f8b7136f6e3071c9208f13e3f06d9e304836ddca93034781

SHA512
175a19becedab9f370365d7279beff90455fcb1d37d83dcc8752975efdf69ee9975517b802cebc90937e4bc29a159ae282a29f331161599f373850ee3c103eb3

Download Submit
C:\Windows\system\sLODpwc.exe

Filesize
2.7MB

MD5
0643f148f478bbfdddad731fd7caea7e

SHA1
59c0536211086b3a6cc43e0710e5cfb9683859df

SHA256
fa623cb6d8f01830c43d8fe368a5afddac6ed7c3c21e308f210a0c69bc2a8b2d

SHA512
41e5c30395b508550f0a2d98c8c1b9f3df6b183d0e0b891d12b5d24b0481445d8d07998e71c68609f09fe0d843d7fb0c9dbcf0bd924ea6f0972266033ef346a7

Download Submit
C:\Windows\system\vbrvDzB.exe

Filesize
2.7MB

MD5
943b54c5931457e80ed51e277847161d

SHA1
cef0245098fd7a2c0d5696eae07d16e7a2a620e8

SHA256
37527fa34769d93958496828f3d255b0054b39cff7e7489ca1b14dab633ccf31

SHA512
ec6698d42236f62b0ce2302ff62adeaa4fd40d4f0153e9ef793f3ed9a52c756bb09ee2248e37e686e40b260a3c42b83c5d956e0bf876e6426d502a2c9844473b

Download Submit
C:\Windows\system\xubPJTh.exe

Filesize
2.7MB

MD5
8fdc45835d7d1e2aa210abfa475e1b8f

SHA1
9489b97147e0e938cd75ac07090b21129787da86

SHA256
7dd3de3559cd092e7d788a8fee9700d0b3126cba2a9271998179da6baaef1faa

SHA512
524e6d6f73b965968254834f7afc554219d931b66c6616df74d5e95111e2c11a748cad9c3703b769317d486b8e0e42b3273d351ab0f155e3c08612ad724b2043

Download Submit
C:\Windows\system\yFsmbcG.exe

Filesize
2.7MB

MD5
cb11f8ee467c55ae9b7c1875c07efb91

SHA1
9d389d44f6ce10617bd69c3d732b03333bbabcae

SHA256
5eaad1784d6164c221fc77723315c4ada95533b97773de475502e249417433f0

SHA512
640245c803727a32fe268d24a4e32b1061e06a9b592e5ca4349efa3bce1cfa8ce3a1642f740c4adf243b1491c9f3a43f05669bcbb5151f45dae2772e7ec678e1

Download Submit
\Windows\system\AvKVAuM.exe

Filesize
2.7MB

MD5
91a5e4beab3ad98d97dee98c13009163

SHA1
9d2f5572f5388be31391c1f707d2c8d1f5284703

SHA256
abe1e51bedac53918d92a5c0b4e39bb81376a33a7991e7d3f30634dcba556176

SHA512
5e2820e2736f69c92c325a6978c8b2ce616f987a0d07996b3f593a8cab73216b373c5fe96830bed5c5e13188e5713deaf0f643121a4771d4872e77df4becb97f

Download Submit
\Windows\system\IdSVleB.exe

Filesize
2.7MB

MD5
4566da59059acac498c6526aee5f1362

SHA1
d9df080f55e2468aa515e69118f200849b43b13f

SHA256
9c9e9ce10455837d94c86df4701420fc33f952c8f20f0195b4d60bcdeed67353

SHA512
7700c269095bf1776ad3003dbc744fc0021f17d67f619d3c9330edd94ac9f5ef7007985036f0fda7da2648373fefb60c33d9e990ca6b5b003db4bec2002935b7

Download Submit
\Windows\system\JaEwiGu.exe

Filesize
2.7MB

MD5
7591e9f4ad6d13bffca63cb87c5de688

SHA1
41eccaea3284eb4a364453e60b09aabbd667dd5d

SHA256
fbd85d98d35f8ed3236567c37e726f70364fb800ed2e4ef4c468838c1b45fd1c

SHA512
fdabe1f97aabc53fe73dbb9d56884d45d0e96bc0ee4f88a15cd4882a372c28de33500c4c811afec14d96d320b52ddedf53a99e91c50106d10c44eb94ef6b3a25

Download Submit
\Windows\system\NDPTgsE.exe

Filesize
2.7MB

MD5
41ab876010eb88627e1b9a84f31c2ec4

SHA1
d031db5981c1ec6f1f24f088ae95299ddaf04d5e

SHA256
afea5e8130a2df560fad319500e75c50026a6565aa683b337384cb7e3319cdae

SHA512
84bcfd67096aaa654e31d60f95bca7670ce21b8c08f3ad27753dfb9da88c8ad3da979382fa714e462ea9feab745720d0fbad0f6bfc88b99f04a492f8006c4a71

Download Submit
\Windows\system\OcZfMHe.exe

Filesize
2.7MB

MD5
7415da93a0b45a8e0ddef26a4f257a30

SHA1
7179b7ed6847f661844dcbdec8d2c2c646efacae

SHA256
d0af488055aa9f0db6a6d5191ffdf372807fe85e9b64537c7cda5de85c904c58

SHA512
e74e38d62cb0ec191b6ed67f1a5789d944329b3b8763abf0f211b14a435d3a87d45f95c7a446bd88bc8993059010ddc133e52dd9e0dfe1f14fcc293b9f317fb4

Download Submit
\Windows\system\TXHnfgy.exe

Filesize
2.7MB

MD5
502aa9ccfcc9ef1080034aaa41baaa14

SHA1
3966dba24250fd5deb07f8b07e714f7b5c08d6f1

SHA256
5ba574e066e4aa54260970df9ebe938432ec1e2d23fc3d5af716c6fa0b087021

SHA512
e5349bd15864a013a33af3a965a650e33b4acd53e0b4b46c0299df3cccf4070aafa5483bee45b0ddc36b8d8f565189a340bd3f9a5ffc3a6978c7e6edfdd4498d

Download Submit
\Windows\system\XxHVtXr.exe

Filesize
2.7MB

MD5
06613f0c205d062419eb0a545ccbca4e

SHA1
6c0e1e51184001ad519194fadd0493869135ebfb

SHA256
dc14ccbde9fbef9058962c90ed643f35101e29ac39bf71b39d7bf9c4fe801c7b

SHA512
1a72153217a36ed75f1ba60655dfa4c1a199cc4072578ef5900f487d1d54cad11cdfed973e684a61f430774d1a6b689bafb2f56300d7aa801fdad5799029c1c0

Download Submit
\Windows\system\vKPaOtz.exe

Filesize
2.7MB

MD5
498b1d6d6b646f7a4d934560c5441438

SHA1
90c66cbbb7a93caf14bd761dd8759d8d2b5f8e2d

SHA256
6db42985213853afbd2d785ad1a18de2370a298ff2b9e1aa5ffcbd1dd9a1c02b

SHA512
60d1b2223a34fde795b75cf9e98939289616f4b93b1ad63f47a2260242b9df470585fd6a3f65bae0172fdc353c4fe61c92c26c8c163063a3628b74543dd9a54a

Download Submit
memory/584-56-0x000000013F5B0000-0x000000013F904000-memory.dmp

Filesize
3.3MB

Download
memory/584-2085-0x000000013F5B0000-0x000000013F904000-memory.dmp

Filesize
3.3MB

Download
memory/584-23-0x000000013F5B0000-0x000000013F904000-memory.dmp

Filesize
3.3MB

Download
memory/1084-286-0x000000013F8B0000-0x000000013FC04000-memory.dmp

Filesize
3.3MB

Download
memory/1084-93-0x000000013F8B0000-0x000000013FC04000-memory.dmp

Filesize
3.3MB

Download
memory/1084-2150-0x000000013F8B0000-0x000000013FC04000-memory.dmp

Filesize
3.3MB

Download
memory/1224-16-0x000000013F380000-0x000000013F6D4000-memory.dmp

Filesize
3.3MB

Download
memory/1224-2077-0x000000013F380000-0x000000013F6D4000-memory.dmp

Filesize
3.3MB

Download
memory/1224-52-0x000000013F380000-0x000000013F6D4000-memory.dmp

Filesize
3.3MB

Download
memory/1944-242-0x000000013FC40000-0x000000013FF94000-memory.dmp

Filesize
3.3MB

Download
memory/1944-84-0x000000013FC40000-0x000000013FF94000-memory.dmp

Filesize
3.3MB

Download
memory/1944-2141-0x000000013FC40000-0x000000013FF94000-memory.dmp

Filesize
3.3MB

Download
memory/2116-60-0x000000013FFC0000-0x0000000140314000-memory.dmp

Filesize
3.3MB

Download
memory/2116-65-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2116-29-0x000000013FFC0000-0x0000000140314000-memory.dmp

Filesize
3.3MB

Download
memory/2116-0-0x000000013F6A0000-0x000000013F9F4000-memory.dmp

Filesize
3.3MB

Download
memory/2116-20-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2116-74-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2116-40-0x000000013FAB0000-0x000000013FE04000-memory.dmp

Filesize
3.3MB

Download
memory/2116-32-0x000000013F340000-0x000000013F694000-memory.dmp

Filesize
3.3MB

Download
memory/2116-114-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2116-113-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2116-206-0x000000013FC40000-0x000000013FF94000-memory.dmp

Filesize
3.3MB

Download
memory/2116-13-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2116-266-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2116-99-0x000000013FB80000-0x000000013FED4000-memory.dmp

Filesize
3.3MB

Download
memory/2116-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2116-97-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2116-36-0x000000013F6A0000-0x000000013F9F4000-memory.dmp

Filesize
3.3MB

Download
memory/2116-108-0x000000013FAB0000-0x000000013FE04000-memory.dmp

Filesize
3.3MB

Download
memory/2116-91-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2116-308-0x000000013FB80000-0x000000013FED4000-memory.dmp

Filesize
3.3MB

Download
memory/2116-89-0x000000013F1B0000-0x000000013F504000-memory.dmp

Filesize
3.3MB

Download
memory/2116-57-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2116-48-0x000000013F1B0000-0x000000013F504000-memory.dmp

Filesize
3.3MB

Download
memory/2116-7-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2116-80-0x000000013FC40000-0x000000013FF94000-memory.dmp

Filesize
3.3MB

Download
memory/2116-374-0x0000000001FD0000-0x0000000002324000-memory.dmp

Filesize
3.3MB

Download
memory/2160-2081-0x000000013FFC0000-0x0000000140314000-memory.dmp

Filesize
3.3MB

Download
memory/2160-30-0x000000013FFC0000-0x0000000140314000-memory.dmp

Filesize
3.3MB

Download
memory/2164-43-0x000000013F590000-0x000000013F8E4000-memory.dmp

Filesize
3.3MB

Download
memory/2164-9-0x000000013F590000-0x000000013F8E4000-memory.dmp

Filesize
3.3MB

Download
memory/2164-2089-0x000000013F590000-0x000000013F8E4000-memory.dmp

Filesize
3.3MB

Download
memory/2248-76-0x000000013F580000-0x000000013F8D4000-memory.dmp

Filesize
3.3MB

Download
memory/2248-2134-0x000000013F580000-0x000000013F8D4000-memory.dmp

Filesize
3.3MB

Download
memory/2248-154-0x000000013F580000-0x000000013F8D4000-memory.dmp

Filesize
3.3MB

Download
memory/2252-2117-0x000000013F1B0000-0x000000013F504000-memory.dmp

Filesize
3.3MB

Download
memory/2252-53-0x000000013F1B0000-0x000000013F504000-memory.dmp

Filesize
3.3MB

Download
memory/2252-92-0x000000013F1B0000-0x000000013F504000-memory.dmp

Filesize
3.3MB

Download
memory/2332-330-0x000000013FB80000-0x000000013FED4000-memory.dmp

Filesize
3.3MB

Download
memory/2332-2151-0x000000013FB80000-0x000000013FED4000-memory.dmp

Filesize
3.3MB

Download
memory/2332-102-0x000000013FB80000-0x000000013FED4000-memory.dmp

Filesize
3.3MB

Download
memory/2844-44-0x000000013FAB0000-0x000000013FE04000-memory.dmp

Filesize
3.3MB

Download
memory/2844-2108-0x000000013FAB0000-0x000000013FE04000-memory.dmp

Filesize
3.3MB

Download
memory/2844-83-0x000000013FAB0000-0x000000013FE04000-memory.dmp

Filesize
3.3MB

Download
memory/2872-68-0x000000013F770000-0x000000013FAC4000-memory.dmp

Filesize
3.3MB

Download
memory/2872-109-0x000000013F770000-0x000000013FAC4000-memory.dmp

Filesize
3.3MB

Download
memory/2872-2126-0x000000013F770000-0x000000013FAC4000-memory.dmp

Filesize
3.3MB

Download
memory/2920-2118-0x000000013F9A0000-0x000000013FCF4000-memory.dmp

Filesize
3.3MB

Download
memory/2920-61-0x000000013F9A0000-0x000000013FCF4000-memory.dmp

Filesize
3.3MB

Download
memory/2920-98-0x000000013F9A0000-0x000000013FCF4000-memory.dmp

Filesize
3.3MB

Download
memory/2996-373-0x000000013FAB0000-0x000000013FE04000-memory.dmp

Filesize
3.3MB

Download
memory/2996-2152-0x000000013FAB0000-0x000000013FE04000-memory.dmp

Filesize
3.3MB

Download
memory/3012-2107-0x000000013F340000-0x000000013F694000-memory.dmp

Filesize
3.3MB

Download
memory/3012-75-0x000000013F340000-0x000000013F694000-memory.dmp

Filesize
3.3MB

Download
memory/3012-37-0x000000013F340000-0x000000013F694000-memory.dmp

Filesize
3.3MB

Download