xmrig | 539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
Size

3.5MB
MD5

c536015988511217f8d30268eee0fbbe
SHA1

628aa191f1afe38d0289d9f2a7607f7d98581a62
SHA256

539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0
SHA512

9b18d3a00f8e5629657811090e84ecebe718e353068e4e7f695c5e3ae48235490c58046a89ef8beb0aab94587740d728e8319eb9b027542205e0862920365dc1
SSDEEP

49152:EnCbL83y9FdfE0pZ0zCa4wI156uL3pgrCEdMKPFotsgEBr6GjvzW+UB1:EniLf9FdfE0pZB156utgpPFotBER/I

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2364-0-0x000000013F790000-0x000000013FAE4000-memory.dmp	xmrig
behavioral1/files/0x00080000000120f9-6.dat	xmrig
behavioral1/files/0x0008000000016d71-12.dat	xmrig
behavioral1/memory/2768-15-0x000000013F050000-0x000000013F3A4000-memory.dmp	xmrig
behavioral1/memory/2696-8-0x000000013F080000-0x000000013F3D4000-memory.dmp	xmrig
behavioral1/files/0x0008000000016e1d-19.dat	xmrig
behavioral1/memory/2712-54-0x000000013FCC0000-0x0000000140014000-memory.dmp	xmrig
behavioral1/memory/2600-63-0x000000013F880000-0x000000013FBD4000-memory.dmp	xmrig
behavioral1/memory/1212-68-0x000000013F460000-0x000000013F7B4000-memory.dmp	xmrig
behavioral1/memory/2676-80-0x000000013F2E0000-0x000000013F634000-memory.dmp	xmrig
behavioral1/memory/2532-94-0x000000013F7D0000-0x000000013FB24000-memory.dmp	xmrig
behavioral1/memory/3068-99-0x000000013FB80000-0x000000013FED4000-memory.dmp	xmrig
behavioral1/memory/1212-107-0x000000013F460000-0x000000013F7B4000-memory.dmp	xmrig
behavioral1/files/0x0005000000019c0b-139.dat	xmrig
behavioral1/files/0x000500000001a2b9-188.dat	xmrig
behavioral1/memory/3068-1043-0x000000013FB80000-0x000000013FED4000-memory.dmp	xmrig
behavioral1/memory/2364-1042-0x000000013FB80000-0x000000013FED4000-memory.dmp	xmrig
behavioral1/memory/2532-736-0x000000013F7D0000-0x000000013FB24000-memory.dmp	xmrig
behavioral1/memory/1308-431-0x000000013F1C0000-0x000000013F514000-memory.dmp	xmrig
behavioral1/files/0x000500000001a033-178.dat	xmrig
behavioral1/files/0x000500000001a05a-184.dat	xmrig
behavioral1/files/0x000500000001a020-176.dat	xmrig
behavioral1/files/0x0005000000019f71-170.dat	xmrig
behavioral1/files/0x0005000000019d69-161.dat	xmrig
behavioral1/files/0x0005000000019cfc-152.dat	xmrig
behavioral1/files/0x0005000000019f57-165.dat	xmrig
behavioral1/files/0x0005000000019d5c-155.dat	xmrig
behavioral1/files/0x0005000000019bf0-132.dat	xmrig
behavioral1/files/0x0005000000019cd5-144.dat	xmrig
behavioral1/files/0x0005000000019bf2-136.dat	xmrig
behavioral1/files/0x0005000000019bec-126.dat	xmrig
behavioral1/files/0x0005000000019931-121.dat	xmrig
behavioral1/files/0x00050000000196a0-116.dat	xmrig
behavioral1/files/0x0005000000019665-111.dat	xmrig
behavioral1/files/0x0005000000019624-104.dat	xmrig
behavioral1/files/0x00050000000195e0-98.dat	xmrig
behavioral1/files/0x00050000000195d0-91.dat	xmrig
behavioral1/memory/1308-86-0x000000013F1C0000-0x000000013F514000-memory.dmp	xmrig
behavioral1/memory/2560-84-0x000000013F790000-0x000000013FAE4000-memory.dmp	xmrig
behavioral1/files/0x00050000000195ce-83.dat	xmrig
behavioral1/memory/1568-79-0x000000013F380000-0x000000013F6D4000-memory.dmp	xmrig
behavioral1/files/0x00050000000195cc-76.dat	xmrig
behavioral1/memory/2768-70-0x000000013F050000-0x000000013F3A4000-memory.dmp	xmrig
behavioral1/files/0x00050000000195ca-66.dat	xmrig
behavioral1/memory/2580-62-0x000000013F610000-0x000000013F964000-memory.dmp	xmrig
behavioral1/files/0x00070000000191d1-39.dat	xmrig
behavioral1/files/0x0007000000017355-34.dat	xmrig
behavioral1/files/0x000700000001739f-30.dat	xmrig
behavioral1/memory/2364-61-0x000000013F790000-0x000000013FAE4000-memory.dmp	xmrig
behavioral1/memory/2724-56-0x000000013FE00000-0x0000000140154000-memory.dmp	xmrig
behavioral1/files/0x0008000000017342-22.dat	xmrig
behavioral1/memory/2556-52-0x000000013FC10000-0x000000013FF64000-memory.dmp	xmrig
behavioral1/files/0x00050000000195c8-50.dat	xmrig
behavioral1/files/0x00070000000173a3-49.dat	xmrig
behavioral1/memory/2676-21-0x000000013F2E0000-0x000000013F634000-memory.dmp	xmrig
behavioral1/memory/2724-3760-0x000000013FE00000-0x0000000140154000-memory.dmp	xmrig
behavioral1/memory/2532-3759-0x000000013F7D0000-0x000000013FB24000-memory.dmp	xmrig
behavioral1/memory/2712-3762-0x000000013FCC0000-0x0000000140014000-memory.dmp	xmrig
behavioral1/memory/2696-3761-0x000000013F080000-0x000000013F3D4000-memory.dmp	xmrig
behavioral1/memory/1568-3767-0x000000013F380000-0x000000013F6D4000-memory.dmp	xmrig
behavioral1/memory/2556-3765-0x000000013FC10000-0x000000013FF64000-memory.dmp	xmrig
behavioral1/memory/2676-3802-0x000000013F2E0000-0x000000013F634000-memory.dmp	xmrig
behavioral1/memory/2580-3804-0x000000013F610000-0x000000013F964000-memory.dmp	xmrig
behavioral1/memory/2600-3805-0x000000013F880000-0x000000013FBD4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2696	mlxODNS.exe
2768	ZHdurPh.exe
2676	WLojMWJ.exe
2560	tNwOwEp.exe
2712	AOIPFwY.exe
2724	BKEwxUe.exe
2556	LFzApio.exe
2580	RIowDOj.exe
2600	kHFAVGX.exe
1212	bsOdkDv.exe
1568	nJbImfw.exe
1308	yDjQlcI.exe
2532	SbaLjGa.exe
3068	WfvbzPk.exe
2896	IPMXOjz.exe
2156	LpZwWXA.exe
1512	zFWdaCY.exe
2260	pTDEaCw.exe
2376	WTufDfn.exe
2916	REvURuq.exe
2112	RwZISgJ.exe
2356	zELynGE.exe
596	PmTrrdx.exe
2192	HemnYeu.exe
1876	LwJRiJo.exe
2252	lSNzoRE.exe
2396	LAtnPUd.exe
1884	OMlNjrZ.exe
1628	JaRrsXw.exe
1624	uOBAIiy.exe
1108	uHutBdZ.exe
920	WJyqGJO.exe
760	vsEvfnZ.exe
1808	UtVQoQh.exe
884	fbSYwZE.exe
1976	aqXrIRd.exe
1812	sBjNgEQ.exe
1996	KqzgkkH.exe
2028	ACaaZyS.exe
2984	XgQxmAY.exe
2612	oGqIzCt.exe
836	cmeImOo.exe
3000	MwhKKFP.exe
2204	InOTedd.exe
2088	Mnbbxdz.exe
1728	ZSYmgYc.exe
2068	VmJnapE.exe
3064	DQfsvBl.exe
1664	VmCJZet.exe
1516	rhqEYfV.exe
2312	hYCmaGa.exe
1556	WqVniNk.exe
1588	LDnZIMK.exe
2660	AxgqwOn.exe
2764	RaSTdrJ.exe
2988	lKXCzvZ.exe
2568	SYGSQZX.exe
2072	RwnXEKD.exe
2576	JvKKorS.exe
444	yrbdbgk.exe
2416	zcIRYZv.exe
2380	tSswovO.exe
2012	ReEuLiA.exe
2904	elkHHCy.exe

Loads dropped DLL 64 IoCs

pid	Process
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2364-0-0x000000013F790000-0x000000013FAE4000-memory.dmp	upx
behavioral1/files/0x00080000000120f9-6.dat	upx
behavioral1/files/0x0008000000016d71-12.dat	upx
behavioral1/memory/2768-15-0x000000013F050000-0x000000013F3A4000-memory.dmp	upx
behavioral1/memory/2696-8-0x000000013F080000-0x000000013F3D4000-memory.dmp	upx
behavioral1/files/0x0008000000016e1d-19.dat	upx
behavioral1/memory/2712-54-0x000000013FCC0000-0x0000000140014000-memory.dmp	upx
behavioral1/memory/2600-63-0x000000013F880000-0x000000013FBD4000-memory.dmp	upx
behavioral1/memory/1212-68-0x000000013F460000-0x000000013F7B4000-memory.dmp	upx
behavioral1/memory/2676-80-0x000000013F2E0000-0x000000013F634000-memory.dmp	upx
behavioral1/memory/2532-94-0x000000013F7D0000-0x000000013FB24000-memory.dmp	upx
behavioral1/memory/3068-99-0x000000013FB80000-0x000000013FED4000-memory.dmp	upx
behavioral1/memory/1212-107-0x000000013F460000-0x000000013F7B4000-memory.dmp	upx
behavioral1/files/0x0005000000019c0b-139.dat	upx
behavioral1/files/0x000500000001a2b9-188.dat	upx
behavioral1/memory/3068-1043-0x000000013FB80000-0x000000013FED4000-memory.dmp	upx
behavioral1/memory/2532-736-0x000000013F7D0000-0x000000013FB24000-memory.dmp	upx
behavioral1/memory/1308-431-0x000000013F1C0000-0x000000013F514000-memory.dmp	upx
behavioral1/files/0x000500000001a033-178.dat	upx
behavioral1/files/0x000500000001a05a-184.dat	upx
behavioral1/files/0x000500000001a020-176.dat	upx
behavioral1/files/0x0005000000019f71-170.dat	upx
behavioral1/files/0x0005000000019d69-161.dat	upx
behavioral1/files/0x0005000000019cfc-152.dat	upx
behavioral1/files/0x0005000000019f57-165.dat	upx
behavioral1/files/0x0005000000019d5c-155.dat	upx
behavioral1/files/0x0005000000019bf0-132.dat	upx
behavioral1/files/0x0005000000019cd5-144.dat	upx
behavioral1/files/0x0005000000019bf2-136.dat	upx
behavioral1/files/0x0005000000019bec-126.dat	upx
behavioral1/files/0x0005000000019931-121.dat	upx
behavioral1/files/0x00050000000196a0-116.dat	upx
behavioral1/files/0x0005000000019665-111.dat	upx
behavioral1/files/0x0005000000019624-104.dat	upx
behavioral1/files/0x00050000000195e0-98.dat	upx
behavioral1/files/0x00050000000195d0-91.dat	upx
behavioral1/memory/1308-86-0x000000013F1C0000-0x000000013F514000-memory.dmp	upx
behavioral1/memory/2560-84-0x000000013F790000-0x000000013FAE4000-memory.dmp	upx
behavioral1/files/0x00050000000195ce-83.dat	upx
behavioral1/memory/1568-79-0x000000013F380000-0x000000013F6D4000-memory.dmp	upx
behavioral1/files/0x00050000000195cc-76.dat	upx
behavioral1/memory/2768-70-0x000000013F050000-0x000000013F3A4000-memory.dmp	upx
behavioral1/files/0x00050000000195ca-66.dat	upx
behavioral1/memory/2580-62-0x000000013F610000-0x000000013F964000-memory.dmp	upx
behavioral1/files/0x00070000000191d1-39.dat	upx
behavioral1/files/0x0007000000017355-34.dat	upx
behavioral1/files/0x000700000001739f-30.dat	upx
behavioral1/memory/2364-61-0x000000013F790000-0x000000013FAE4000-memory.dmp	upx
behavioral1/memory/2724-56-0x000000013FE00000-0x0000000140154000-memory.dmp	upx
behavioral1/files/0x0008000000017342-22.dat	upx
behavioral1/memory/2556-52-0x000000013FC10000-0x000000013FF64000-memory.dmp	upx
behavioral1/files/0x00050000000195c8-50.dat	upx
behavioral1/files/0x00070000000173a3-49.dat	upx
behavioral1/memory/2676-21-0x000000013F2E0000-0x000000013F634000-memory.dmp	upx
behavioral1/memory/2724-3760-0x000000013FE00000-0x0000000140154000-memory.dmp	upx
behavioral1/memory/2532-3759-0x000000013F7D0000-0x000000013FB24000-memory.dmp	upx
behavioral1/memory/2712-3762-0x000000013FCC0000-0x0000000140014000-memory.dmp	upx
behavioral1/memory/2696-3761-0x000000013F080000-0x000000013F3D4000-memory.dmp	upx
behavioral1/memory/1568-3767-0x000000013F380000-0x000000013F6D4000-memory.dmp	upx
behavioral1/memory/2556-3765-0x000000013FC10000-0x000000013FF64000-memory.dmp	upx
behavioral1/memory/2676-3802-0x000000013F2E0000-0x000000013F634000-memory.dmp	upx
behavioral1/memory/2580-3804-0x000000013F610000-0x000000013F964000-memory.dmp	upx
behavioral1/memory/2600-3805-0x000000013F880000-0x000000013FBD4000-memory.dmp	upx
behavioral1/memory/2768-3803-0x000000013F050000-0x000000013F3A4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lXxDKzd.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\GlwVPlD.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\IWVZglo.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\ScHRYqL.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\YuYfxAd.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\RWSMPst.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\CksBoLo.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\WVMXdel.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\HrzjHBC.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\BbisFNv.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\QLrUaMe.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\PnIEWiJ.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\CJboqjY.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\zTuIoRF.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\eSntNPq.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\vKxeAym.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\sXAUIwT.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\lyHDFzy.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\sxlyLOp.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\FaJrbtf.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\kNeYSMX.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\XAquakj.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\GeoZlOK.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\pjfJoct.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\kpJMnLY.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\WPnMAJx.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\LwHJsNH.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\vJvIPbh.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\QAGZwlD.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\RwZISgJ.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\GfUNBWN.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\VzPLwqG.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\VmJnapE.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\lCBTMml.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\cEKPMoJ.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\IoSvWIv.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\xeDxMhn.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\ftBgFIi.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\gpDuNEM.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\wXXwcMP.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\XSfDPpz.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\fosEhjo.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\xhAIpxQ.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\GjOQqfF.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\WitIDnx.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\BWTEZBM.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\DDRXLNZ.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\PbvLUgB.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\lFoGqmH.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\PrvZehs.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\NJFqxMG.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\HpgjFAH.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\pfHFYRr.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\hqKRRlL.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\FIZWOCH.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\bxdqVpC.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\ZoOEfnJ.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\EDPBuoz.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\DtIiMBm.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\cSIrZlZ.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\LEHOnSH.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\fKjFwZE.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\BKtGPkh.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
File created	C:\Windows\System\hYCmaGa.exe	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2696	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	31
PID 2364 wrote to memory of 2696	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	31
PID 2364 wrote to memory of 2696	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	31
PID 2364 wrote to memory of 2768	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	32
PID 2364 wrote to memory of 2768	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	32
PID 2364 wrote to memory of 2768	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	32
PID 2364 wrote to memory of 2676	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	33
PID 2364 wrote to memory of 2676	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	33
PID 2364 wrote to memory of 2676	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	33
PID 2364 wrote to memory of 2560	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	34
PID 2364 wrote to memory of 2560	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	34
PID 2364 wrote to memory of 2560	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	34
PID 2364 wrote to memory of 2712	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	35
PID 2364 wrote to memory of 2712	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	35
PID 2364 wrote to memory of 2712	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	35
PID 2364 wrote to memory of 2580	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	36
PID 2364 wrote to memory of 2580	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	36
PID 2364 wrote to memory of 2580	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	36
PID 2364 wrote to memory of 2724	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	37
PID 2364 wrote to memory of 2724	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	37
PID 2364 wrote to memory of 2724	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	37
PID 2364 wrote to memory of 2600	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	38
PID 2364 wrote to memory of 2600	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	38
PID 2364 wrote to memory of 2600	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	38
PID 2364 wrote to memory of 2556	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	39
PID 2364 wrote to memory of 2556	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	39
PID 2364 wrote to memory of 2556	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	39
PID 2364 wrote to memory of 1212	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	40
PID 2364 wrote to memory of 1212	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	40
PID 2364 wrote to memory of 1212	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	40
PID 2364 wrote to memory of 1568	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	41
PID 2364 wrote to memory of 1568	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	41
PID 2364 wrote to memory of 1568	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	41
PID 2364 wrote to memory of 1308	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	42
PID 2364 wrote to memory of 1308	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	42
PID 2364 wrote to memory of 1308	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	42
PID 2364 wrote to memory of 2532	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	43
PID 2364 wrote to memory of 2532	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	43
PID 2364 wrote to memory of 2532	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	43
PID 2364 wrote to memory of 3068	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	44
PID 2364 wrote to memory of 3068	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	44
PID 2364 wrote to memory of 3068	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	44
PID 2364 wrote to memory of 2896	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	45
PID 2364 wrote to memory of 2896	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	45
PID 2364 wrote to memory of 2896	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	45
PID 2364 wrote to memory of 2156	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	46
PID 2364 wrote to memory of 2156	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	46
PID 2364 wrote to memory of 2156	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	46
PID 2364 wrote to memory of 1512	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	47
PID 2364 wrote to memory of 1512	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	47
PID 2364 wrote to memory of 1512	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	47
PID 2364 wrote to memory of 2260	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	48
PID 2364 wrote to memory of 2260	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	48
PID 2364 wrote to memory of 2260	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	48
PID 2364 wrote to memory of 2376	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	49
PID 2364 wrote to memory of 2376	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	49
PID 2364 wrote to memory of 2376	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	49
PID 2364 wrote to memory of 2916	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	50
PID 2364 wrote to memory of 2916	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	50
PID 2364 wrote to memory of 2916	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	50
PID 2364 wrote to memory of 2112	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	51
PID 2364 wrote to memory of 2112	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	51
PID 2364 wrote to memory of 2112	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	51
PID 2364 wrote to memory of 596	2364	JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe	52

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_539b469c6d1bf2146a334adbdc23f4ae82fba3364884ef00658416d8f1c3d9e0.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\System\mlxODNS.exe
  C:\Windows\System\mlxODNS.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\ZHdurPh.exe
  C:\Windows\System\ZHdurPh.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\WLojMWJ.exe
  C:\Windows\System\WLojMWJ.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\tNwOwEp.exe
  C:\Windows\System\tNwOwEp.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\AOIPFwY.exe
  C:\Windows\System\AOIPFwY.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\RIowDOj.exe
  C:\Windows\System\RIowDOj.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\BKEwxUe.exe
  C:\Windows\System\BKEwxUe.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\kHFAVGX.exe
  C:\Windows\System\kHFAVGX.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\LFzApio.exe
  C:\Windows\System\LFzApio.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\bsOdkDv.exe
  C:\Windows\System\bsOdkDv.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\nJbImfw.exe
  C:\Windows\System\nJbImfw.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\yDjQlcI.exe
  C:\Windows\System\yDjQlcI.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\SbaLjGa.exe
  C:\Windows\System\SbaLjGa.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\WfvbzPk.exe
  C:\Windows\System\WfvbzPk.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\IPMXOjz.exe
  C:\Windows\System\IPMXOjz.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\LpZwWXA.exe
  C:\Windows\System\LpZwWXA.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\zFWdaCY.exe
  C:\Windows\System\zFWdaCY.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\pTDEaCw.exe
  C:\Windows\System\pTDEaCw.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\WTufDfn.exe
  C:\Windows\System\WTufDfn.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\REvURuq.exe
  C:\Windows\System\REvURuq.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\RwZISgJ.exe
  C:\Windows\System\RwZISgJ.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\PmTrrdx.exe
  C:\Windows\System\PmTrrdx.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\zELynGE.exe
  C:\Windows\System\zELynGE.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\HemnYeu.exe
  C:\Windows\System\HemnYeu.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\LwJRiJo.exe
  C:\Windows\System\LwJRiJo.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\lSNzoRE.exe
  C:\Windows\System\lSNzoRE.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\LAtnPUd.exe
  C:\Windows\System\LAtnPUd.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\OMlNjrZ.exe
  C:\Windows\System\OMlNjrZ.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\JaRrsXw.exe
  C:\Windows\System\JaRrsXw.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\uHutBdZ.exe
  C:\Windows\System\uHutBdZ.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\uOBAIiy.exe
  C:\Windows\System\uOBAIiy.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\WJyqGJO.exe
  C:\Windows\System\WJyqGJO.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\vsEvfnZ.exe
  C:\Windows\System\vsEvfnZ.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\fbSYwZE.exe
  C:\Windows\System\fbSYwZE.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\UtVQoQh.exe
  C:\Windows\System\UtVQoQh.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\sBjNgEQ.exe
  C:\Windows\System\sBjNgEQ.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\aqXrIRd.exe
  C:\Windows\System\aqXrIRd.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\KqzgkkH.exe
  C:\Windows\System\KqzgkkH.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\ACaaZyS.exe
  C:\Windows\System\ACaaZyS.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\XgQxmAY.exe
  C:\Windows\System\XgQxmAY.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\oGqIzCt.exe
  C:\Windows\System\oGqIzCt.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\cmeImOo.exe
  C:\Windows\System\cmeImOo.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\MwhKKFP.exe
  C:\Windows\System\MwhKKFP.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\InOTedd.exe
  C:\Windows\System\InOTedd.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\Mnbbxdz.exe
  C:\Windows\System\Mnbbxdz.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\ZSYmgYc.exe
  C:\Windows\System\ZSYmgYc.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\VmJnapE.exe
  C:\Windows\System\VmJnapE.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\DQfsvBl.exe
  C:\Windows\System\DQfsvBl.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\VmCJZet.exe
  C:\Windows\System\VmCJZet.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\rhqEYfV.exe
  C:\Windows\System\rhqEYfV.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\hYCmaGa.exe
  C:\Windows\System\hYCmaGa.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\WqVniNk.exe
  C:\Windows\System\WqVniNk.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\LDnZIMK.exe
  C:\Windows\System\LDnZIMK.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\AxgqwOn.exe
  C:\Windows\System\AxgqwOn.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\RaSTdrJ.exe
  C:\Windows\System\RaSTdrJ.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\lKXCzvZ.exe
  C:\Windows\System\lKXCzvZ.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\SYGSQZX.exe
  C:\Windows\System\SYGSQZX.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\RwnXEKD.exe
  C:\Windows\System\RwnXEKD.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\JvKKorS.exe
  C:\Windows\System\JvKKorS.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\yrbdbgk.exe
  C:\Windows\System\yrbdbgk.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\zcIRYZv.exe
  C:\Windows\System\zcIRYZv.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\tSswovO.exe
  C:\Windows\System\tSswovO.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\ReEuLiA.exe
  C:\Windows\System\ReEuLiA.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\elkHHCy.exe
  C:\Windows\System\elkHHCy.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\vuGrnOs.exe
  C:\Windows\System\vuGrnOs.exe
  2⤵
  PID:2424
- C:\Windows\System\WEAQhPf.exe
  C:\Windows\System\WEAQhPf.exe
  2⤵
  PID:1044
- C:\Windows\System\eZvBlGC.exe
  C:\Windows\System\eZvBlGC.exe
  2⤵
  PID:796
- C:\Windows\System\ybiegpw.exe
  C:\Windows\System\ybiegpw.exe
  2⤵
  PID:2296
- C:\Windows\System\ezSsCVM.exe
  C:\Windows\System\ezSsCVM.exe
  2⤵
  PID:548
- C:\Windows\System\aCLnlIY.exe
  C:\Windows\System\aCLnlIY.exe
  2⤵
  PID:2180
- C:\Windows\System\lQYCrNb.exe
  C:\Windows\System\lQYCrNb.exe
  2⤵
  PID:1648
- C:\Windows\System\rQHqpkl.exe
  C:\Windows\System\rQHqpkl.exe
  2⤵
  PID:1320
- C:\Windows\System\KvOMWER.exe
  C:\Windows\System\KvOMWER.exe
  2⤵
  PID:996
- C:\Windows\System\tZvNlJA.exe
  C:\Windows\System\tZvNlJA.exe
  2⤵
  PID:1468
- C:\Windows\System\FPgxkJN.exe
  C:\Windows\System\FPgxkJN.exe
  2⤵
  PID:1940
- C:\Windows\System\YdIPNiS.exe
  C:\Windows\System\YdIPNiS.exe
  2⤵
  PID:2024
- C:\Windows\System\egJMAAt.exe
  C:\Windows\System\egJMAAt.exe
  2⤵
  PID:2064
- C:\Windows\System\EsuFSqu.exe
  C:\Windows\System\EsuFSqu.exe
  2⤵
  PID:1196
- C:\Windows\System\gSIrnmj.exe
  C:\Windows\System\gSIrnmj.exe
  2⤵
  PID:2492
- C:\Windows\System\zRgqRPX.exe
  C:\Windows\System\zRgqRPX.exe
  2⤵
  PID:1072
- C:\Windows\System\QHUCWZh.exe
  C:\Windows\System\QHUCWZh.exe
  2⤵
  PID:1496
- C:\Windows\System\DlMbQOF.exe
  C:\Windows\System\DlMbQOF.exe
  2⤵
  PID:1000
- C:\Windows\System\FstNfqF.exe
  C:\Windows\System\FstNfqF.exe
  2⤵
  PID:896
- C:\Windows\System\dQJKlnF.exe
  C:\Windows\System\dQJKlnF.exe
  2⤵
  PID:1912
- C:\Windows\System\SDrVLZO.exe
  C:\Windows\System\SDrVLZO.exe
  2⤵
  PID:1620
- C:\Windows\System\vMMyqiD.exe
  C:\Windows\System\vMMyqiD.exe
  2⤵
  PID:1608
- C:\Windows\System\fuqwOKA.exe
  C:\Windows\System\fuqwOKA.exe
  2⤵
  PID:2704
- C:\Windows\System\nGaiaEe.exe
  C:\Windows\System\nGaiaEe.exe
  2⤵
  PID:2688
- C:\Windows\System\wyLiliH.exe
  C:\Windows\System\wyLiliH.exe
  2⤵
  PID:2172
- C:\Windows\System\NmhHrsn.exe
  C:\Windows\System\NmhHrsn.exe
  2⤵
  PID:2944
- C:\Windows\System\fpxefPd.exe
  C:\Windows\System\fpxefPd.exe
  2⤵
  PID:2536
- C:\Windows\System\hONBELa.exe
  C:\Windows\System\hONBELa.exe
  2⤵
  PID:2472
- C:\Windows\System\yBPzikF.exe
  C:\Windows\System\yBPzikF.exe
  2⤵
  PID:2468
- C:\Windows\System\SIEYiGm.exe
  C:\Windows\System\SIEYiGm.exe
  2⤵
  PID:2148
- C:\Windows\System\DpfzFbg.exe
  C:\Windows\System\DpfzFbg.exe
  2⤵
  PID:2108
- C:\Windows\System\SVaxOSS.exe
  C:\Windows\System\SVaxOSS.exe
  2⤵
  PID:2120
- C:\Windows\System\qzOOmiB.exe
  C:\Windows\System\qzOOmiB.exe
  2⤵
  PID:1348
- C:\Windows\System\IKXsWop.exe
  C:\Windows\System\IKXsWop.exe
  2⤵
  PID:1304
- C:\Windows\System\XJZgekd.exe
  C:\Windows\System\XJZgekd.exe
  2⤵
  PID:1564
- C:\Windows\System\QEGrknx.exe
  C:\Windows\System\QEGrknx.exe
  2⤵
  PID:780
- C:\Windows\System\JQMwYru.exe
  C:\Windows\System\JQMwYru.exe
  2⤵
  PID:1984
- C:\Windows\System\ZNvRiBy.exe
  C:\Windows\System\ZNvRiBy.exe
  2⤵
  PID:2652
- C:\Windows\System\gnGIPfD.exe
  C:\Windows\System\gnGIPfD.exe
  2⤵
  PID:2528
- C:\Windows\System\STstjpV.exe
  C:\Windows\System\STstjpV.exe
  2⤵
  PID:888
- C:\Windows\System\QLrUaMe.exe
  C:\Windows\System\QLrUaMe.exe
  2⤵
  PID:2488
- C:\Windows\System\zvKhtlR.exe
  C:\Windows\System\zvKhtlR.exe
  2⤵
  PID:1352
- C:\Windows\System\UJzHmgU.exe
  C:\Windows\System\UJzHmgU.exe
  2⤵
  PID:3088
- C:\Windows\System\zUmSviO.exe
  C:\Windows\System\zUmSviO.exe
  2⤵
  PID:3104
- C:\Windows\System\zKVXvyc.exe
  C:\Windows\System\zKVXvyc.exe
  2⤵
  PID:3120
- C:\Windows\System\zNmsUHS.exe
  C:\Windows\System\zNmsUHS.exe
  2⤵
  PID:3136
- C:\Windows\System\EnyopGG.exe
  C:\Windows\System\EnyopGG.exe
  2⤵
  PID:3152
- C:\Windows\System\oPyutXg.exe
  C:\Windows\System\oPyutXg.exe
  2⤵
  PID:3168
- C:\Windows\System\EkBztXc.exe
  C:\Windows\System\EkBztXc.exe
  2⤵
  PID:3200
- C:\Windows\System\sxlyLOp.exe
  C:\Windows\System\sxlyLOp.exe
  2⤵
  PID:3220
- C:\Windows\System\abeqjQL.exe
  C:\Windows\System\abeqjQL.exe
  2⤵
  PID:3244
- C:\Windows\System\NXgGdoZ.exe
  C:\Windows\System\NXgGdoZ.exe
  2⤵
  PID:3268
- C:\Windows\System\WJVbUKh.exe
  C:\Windows\System\WJVbUKh.exe
  2⤵
  PID:3316
- C:\Windows\System\DAhjatD.exe
  C:\Windows\System\DAhjatD.exe
  2⤵
  PID:3336
- C:\Windows\System\GfUNBWN.exe
  C:\Windows\System\GfUNBWN.exe
  2⤵
  PID:3356
- C:\Windows\System\sDFgdsY.exe
  C:\Windows\System\sDFgdsY.exe
  2⤵
  PID:3372
- C:\Windows\System\PNqnMWr.exe
  C:\Windows\System\PNqnMWr.exe
  2⤵
  PID:3396
- C:\Windows\System\uQDjhKU.exe
  C:\Windows\System\uQDjhKU.exe
  2⤵
  PID:3412
- C:\Windows\System\icaiDUP.exe
  C:\Windows\System\icaiDUP.exe
  2⤵
  PID:3436
- C:\Windows\System\lgZZCUZ.exe
  C:\Windows\System\lgZZCUZ.exe
  2⤵
  PID:3452
- C:\Windows\System\yhYsvuf.exe
  C:\Windows\System\yhYsvuf.exe
  2⤵
  PID:3476
- C:\Windows\System\JvIyuhi.exe
  C:\Windows\System\JvIyuhi.exe
  2⤵
  PID:3492
- C:\Windows\System\YGebzJJ.exe
  C:\Windows\System\YGebzJJ.exe
  2⤵
  PID:3508
- C:\Windows\System\HpgjFAH.exe
  C:\Windows\System\HpgjFAH.exe
  2⤵
  PID:3524
- C:\Windows\System\MOJzBMr.exe
  C:\Windows\System\MOJzBMr.exe
  2⤵
  PID:3540
- C:\Windows\System\NxfKPRz.exe
  C:\Windows\System\NxfKPRz.exe
  2⤵
  PID:3572
- C:\Windows\System\YGxwDdB.exe
  C:\Windows\System\YGxwDdB.exe
  2⤵
  PID:3600
- C:\Windows\System\psSmsOy.exe
  C:\Windows\System\psSmsOy.exe
  2⤵
  PID:3616
- C:\Windows\System\jdLJQLV.exe
  C:\Windows\System\jdLJQLV.exe
  2⤵
  PID:3636
- C:\Windows\System\TmnWzbA.exe
  C:\Windows\System\TmnWzbA.exe
  2⤵
  PID:3660
- C:\Windows\System\lsLTDlQ.exe
  C:\Windows\System\lsLTDlQ.exe
  2⤵
  PID:3676
- C:\Windows\System\iaowfzY.exe
  C:\Windows\System\iaowfzY.exe
  2⤵
  PID:3696
- C:\Windows\System\jCiYGOl.exe
  C:\Windows\System\jCiYGOl.exe
  2⤵
  PID:3716
- C:\Windows\System\yPkLaBK.exe
  C:\Windows\System\yPkLaBK.exe
  2⤵
  PID:3732
- C:\Windows\System\iYBavRz.exe
  C:\Windows\System\iYBavRz.exe
  2⤵
  PID:3756
- C:\Windows\System\nEbaPDH.exe
  C:\Windows\System\nEbaPDH.exe
  2⤵
  PID:3780
- C:\Windows\System\IJRTerN.exe
  C:\Windows\System\IJRTerN.exe
  2⤵
  PID:3800
- C:\Windows\System\rnfSnZT.exe
  C:\Windows\System\rnfSnZT.exe
  2⤵
  PID:3820
- C:\Windows\System\pUmZuhg.exe
  C:\Windows\System\pUmZuhg.exe
  2⤵
  PID:3836
- C:\Windows\System\aoTRZmE.exe
  C:\Windows\System\aoTRZmE.exe
  2⤵
  PID:3856
- C:\Windows\System\KKgKNoR.exe
  C:\Windows\System\KKgKNoR.exe
  2⤵
  PID:3880
- C:\Windows\System\HQZUXUc.exe
  C:\Windows\System\HQZUXUc.exe
  2⤵
  PID:3896
- C:\Windows\System\WOWABjE.exe
  C:\Windows\System\WOWABjE.exe
  2⤵
  PID:3912
- C:\Windows\System\NeMjLsn.exe
  C:\Windows\System\NeMjLsn.exe
  2⤵
  PID:3932
- C:\Windows\System\HONkNzB.exe
  C:\Windows\System\HONkNzB.exe
  2⤵
  PID:3952
- C:\Windows\System\AoRJETW.exe
  C:\Windows\System\AoRJETW.exe
  2⤵
  PID:3972
- C:\Windows\System\tbXuYpz.exe
  C:\Windows\System\tbXuYpz.exe
  2⤵
  PID:3992
- C:\Windows\System\BxhTAgz.exe
  C:\Windows\System\BxhTAgz.exe
  2⤵
  PID:4008
- C:\Windows\System\dSVyeba.exe
  C:\Windows\System\dSVyeba.exe
  2⤵
  PID:4032
- C:\Windows\System\PnIEWiJ.exe
  C:\Windows\System\PnIEWiJ.exe
  2⤵
  PID:4052
- C:\Windows\System\pylPgxj.exe
  C:\Windows\System\pylPgxj.exe
  2⤵
  PID:4080
- C:\Windows\System\ZenUsTK.exe
  C:\Windows\System\ZenUsTK.exe
  2⤵
  PID:2844
- C:\Windows\System\ZocMhcQ.exe
  C:\Windows\System\ZocMhcQ.exe
  2⤵
  PID:2392
- C:\Windows\System\iPjKFsW.exe
  C:\Windows\System\iPjKFsW.exe
  2⤵
  PID:2868
- C:\Windows\System\QKGZBUT.exe
  C:\Windows\System\QKGZBUT.exe
  2⤵
  PID:2476
- C:\Windows\System\UmGNaIs.exe
  C:\Windows\System\UmGNaIs.exe
  2⤵
  PID:1376
- C:\Windows\System\OEhrAWa.exe
  C:\Windows\System\OEhrAWa.exe
  2⤵
  PID:2400
- C:\Windows\System\jZEBAZw.exe
  C:\Windows\System\jZEBAZw.exe
  2⤵
  PID:1208
- C:\Windows\System\dBFlEGy.exe
  C:\Windows\System\dBFlEGy.exe
  2⤵
  PID:1660
- C:\Windows\System\lmjrvWd.exe
  C:\Windows\System\lmjrvWd.exe
  2⤵
  PID:2636
- C:\Windows\System\HeJacTR.exe
  C:\Windows\System\HeJacTR.exe
  2⤵
  PID:648
- C:\Windows\System\YOEiTHc.exe
  C:\Windows\System\YOEiTHc.exe
  2⤵
  PID:2940
- C:\Windows\System\seDodMY.exe
  C:\Windows\System\seDodMY.exe
  2⤵
  PID:3132
- C:\Windows\System\XXjPFrG.exe
  C:\Windows\System\XXjPFrG.exe
  2⤵
  PID:2080
- C:\Windows\System\xFSruKi.exe
  C:\Windows\System\xFSruKi.exe
  2⤵
  PID:3180
- C:\Windows\System\FVfbgmo.exe
  C:\Windows\System\FVfbgmo.exe
  2⤵
  PID:3232
- C:\Windows\System\WjDlfNT.exe
  C:\Windows\System\WjDlfNT.exe
  2⤵
  PID:2240
- C:\Windows\System\WSEwSYE.exe
  C:\Windows\System\WSEwSYE.exe
  2⤵
  PID:3084
- C:\Windows\System\FlithAr.exe
  C:\Windows\System\FlithAr.exe
  2⤵
  PID:3276
- C:\Windows\System\mTRRjdL.exe
  C:\Windows\System\mTRRjdL.exe
  2⤵
  PID:3292
- C:\Windows\System\fBNYEgU.exe
  C:\Windows\System\fBNYEgU.exe
  2⤵
  PID:3304
- C:\Windows\System\gLtmXra.exe
  C:\Windows\System\gLtmXra.exe
  2⤵
  PID:3348
- C:\Windows\System\UdmhLIK.exe
  C:\Windows\System\UdmhLIK.exe
  2⤵
  PID:3392
- C:\Windows\System\nSDCOwC.exe
  C:\Windows\System\nSDCOwC.exe
  2⤵
  PID:3424
- C:\Windows\System\rHqAQoR.exe
  C:\Windows\System\rHqAQoR.exe
  2⤵
  PID:3484
- C:\Windows\System\rqgtGrF.exe
  C:\Windows\System\rqgtGrF.exe
  2⤵
  PID:3556
- C:\Windows\System\scjLgtR.exe
  C:\Windows\System\scjLgtR.exe
  2⤵
  PID:3564
- C:\Windows\System\jZwTkAb.exe
  C:\Windows\System\jZwTkAb.exe
  2⤵
  PID:3584
- C:\Windows\System\MDoGcGA.exe
  C:\Windows\System\MDoGcGA.exe
  2⤵
  PID:3644
- C:\Windows\System\WkecEzE.exe
  C:\Windows\System\WkecEzE.exe
  2⤵
  PID:3724
- C:\Windows\System\ZMETKoO.exe
  C:\Windows\System\ZMETKoO.exe
  2⤵
  PID:3628
- C:\Windows\System\SBWsTUW.exe
  C:\Windows\System\SBWsTUW.exe
  2⤵
  PID:3708
- C:\Windows\System\iFyjSOu.exe
  C:\Windows\System\iFyjSOu.exe
  2⤵
  PID:3748
- C:\Windows\System\ZkdznYN.exe
  C:\Windows\System\ZkdznYN.exe
  2⤵
  PID:3776
- C:\Windows\System\VOfcetg.exe
  C:\Windows\System\VOfcetg.exe
  2⤵
  PID:3812
- C:\Windows\System\RFiEzrK.exe
  C:\Windows\System\RFiEzrK.exe
  2⤵
  PID:3844
- C:\Windows\System\vgmTmZt.exe
  C:\Windows\System\vgmTmZt.exe
  2⤵
  PID:3892
- C:\Windows\System\TuYQnjF.exe
  C:\Windows\System\TuYQnjF.exe
  2⤵
  PID:3864
- C:\Windows\System\fYWWeFV.exe
  C:\Windows\System\fYWWeFV.exe
  2⤵
  PID:3964
- C:\Windows\System\PCWuNlh.exe
  C:\Windows\System\PCWuNlh.exe
  2⤵
  PID:3904
- C:\Windows\System\BwWEaid.exe
  C:\Windows\System\BwWEaid.exe
  2⤵
  PID:3988
- C:\Windows\System\knskWHo.exe
  C:\Windows\System\knskWHo.exe
  2⤵
  PID:3984
- C:\Windows\System\mTTorkx.exe
  C:\Windows\System\mTTorkx.exe
  2⤵
  PID:4092
- C:\Windows\System\kpJMnLY.exe
  C:\Windows\System\kpJMnLY.exe
  2⤵
  PID:1592
- C:\Windows\System\yeHPZyI.exe
  C:\Windows\System\yeHPZyI.exe
  2⤵
  PID:2128
- C:\Windows\System\eXVwdZB.exe
  C:\Windows\System\eXVwdZB.exe
  2⤵
  PID:2188
- C:\Windows\System\owIjUoN.exe
  C:\Windows\System\owIjUoN.exe
  2⤵
  PID:2316
- C:\Windows\System\VZEBEvR.exe
  C:\Windows\System\VZEBEvR.exe
  2⤵
  PID:2104
- C:\Windows\System\hCaYukH.exe
  C:\Windows\System\hCaYukH.exe
  2⤵
  PID:1604
- C:\Windows\System\iqMvsQo.exe
  C:\Windows\System\iqMvsQo.exe
  2⤵
  PID:3208
- C:\Windows\System\VirXopL.exe
  C:\Windows\System\VirXopL.exe
  2⤵
  PID:3192
- C:\Windows\System\qsBngkQ.exe
  C:\Windows\System\qsBngkQ.exe
  2⤵
  PID:3096
- C:\Windows\System\zMuDTRc.exe
  C:\Windows\System\zMuDTRc.exe
  2⤵
  PID:3080
- C:\Windows\System\roRpecG.exe
  C:\Windows\System\roRpecG.exe
  2⤵
  PID:3404
- C:\Windows\System\oUidjQp.exe
  C:\Windows\System\oUidjQp.exe
  2⤵
  PID:3432
- C:\Windows\System\mThiHRc.exe
  C:\Windows\System\mThiHRc.exe
  2⤵
  PID:3548
- C:\Windows\System\ZbsQmqt.exe
  C:\Windows\System\ZbsQmqt.exe
  2⤵
  PID:3300
- C:\Windows\System\byuEgBJ.exe
  C:\Windows\System\byuEgBJ.exe
  2⤵
  PID:3536
- C:\Windows\System\eBXMMYG.exe
  C:\Windows\System\eBXMMYG.exe
  2⤵
  PID:4116
- C:\Windows\System\mKFyJko.exe
  C:\Windows\System\mKFyJko.exe
  2⤵
  PID:4144
- C:\Windows\System\biqfklL.exe
  C:\Windows\System\biqfklL.exe
  2⤵
  PID:4160
- C:\Windows\System\zwImnqf.exe
  C:\Windows\System\zwImnqf.exe
  2⤵
  PID:4184
- C:\Windows\System\XIlGhUt.exe
  C:\Windows\System\XIlGhUt.exe
  2⤵
  PID:4204
- C:\Windows\System\QYUtaNE.exe
  C:\Windows\System\QYUtaNE.exe
  2⤵
  PID:4220
- C:\Windows\System\fjlFOIG.exe
  C:\Windows\System\fjlFOIG.exe
  2⤵
  PID:4236
- C:\Windows\System\ysWDqEG.exe
  C:\Windows\System\ysWDqEG.exe
  2⤵
  PID:4256
- C:\Windows\System\TLYmlqU.exe
  C:\Windows\System\TLYmlqU.exe
  2⤵
  PID:4272
- C:\Windows\System\yBMEbyh.exe
  C:\Windows\System\yBMEbyh.exe
  2⤵
  PID:4288
- C:\Windows\System\uRXrvSM.exe
  C:\Windows\System\uRXrvSM.exe
  2⤵
  PID:4304
- C:\Windows\System\FaJrbtf.exe
  C:\Windows\System\FaJrbtf.exe
  2⤵
  PID:4324
- C:\Windows\System\WPnMAJx.exe
  C:\Windows\System\WPnMAJx.exe
  2⤵
  PID:4352
- C:\Windows\System\UMwMPYA.exe
  C:\Windows\System\UMwMPYA.exe
  2⤵
  PID:4368
- C:\Windows\System\VUMwnFm.exe
  C:\Windows\System\VUMwnFm.exe
  2⤵
  PID:4384
- C:\Windows\System\OCmbBRp.exe
  C:\Windows\System\OCmbBRp.exe
  2⤵
  PID:4400
- C:\Windows\System\UgFKFxd.exe
  C:\Windows\System\UgFKFxd.exe
  2⤵
  PID:4420
- C:\Windows\System\QWvVDYS.exe
  C:\Windows\System\QWvVDYS.exe
  2⤵
  PID:4436
- C:\Windows\System\VnSohIs.exe
  C:\Windows\System\VnSohIs.exe
  2⤵
  PID:4456
- C:\Windows\System\jmaFfci.exe
  C:\Windows\System\jmaFfci.exe
  2⤵
  PID:4472
- C:\Windows\System\airKmkF.exe
  C:\Windows\System\airKmkF.exe
  2⤵
  PID:4500
- C:\Windows\System\ZXveoJd.exe
  C:\Windows\System\ZXveoJd.exe
  2⤵
  PID:4520
- C:\Windows\System\PtoMdss.exe
  C:\Windows\System\PtoMdss.exe
  2⤵
  PID:4540
- C:\Windows\System\JPDNEtR.exe
  C:\Windows\System\JPDNEtR.exe
  2⤵
  PID:4564
- C:\Windows\System\poifbxY.exe
  C:\Windows\System\poifbxY.exe
  2⤵
  PID:4600
- C:\Windows\System\qsqhhsb.exe
  C:\Windows\System\qsqhhsb.exe
  2⤵
  PID:4628
- C:\Windows\System\jOlzJpa.exe
  C:\Windows\System\jOlzJpa.exe
  2⤵
  PID:4648
- C:\Windows\System\jfPrqxl.exe
  C:\Windows\System\jfPrqxl.exe
  2⤵
  PID:4668
- C:\Windows\System\pHVVQus.exe
  C:\Windows\System\pHVVQus.exe
  2⤵
  PID:4684
- C:\Windows\System\BPuSCHJ.exe
  C:\Windows\System\BPuSCHJ.exe
  2⤵
  PID:4708
- C:\Windows\System\WnNjuWF.exe
  C:\Windows\System\WnNjuWF.exe
  2⤵
  PID:4724
- C:\Windows\System\fbWPSWs.exe
  C:\Windows\System\fbWPSWs.exe
  2⤵
  PID:4748
- C:\Windows\System\xnYnVDe.exe
  C:\Windows\System\xnYnVDe.exe
  2⤵
  PID:4764
- C:\Windows\System\LUwyAHf.exe
  C:\Windows\System\LUwyAHf.exe
  2⤵
  PID:4788
- C:\Windows\System\CQRvlur.exe
  C:\Windows\System\CQRvlur.exe
  2⤵
  PID:4808
- C:\Windows\System\bSDJbcC.exe
  C:\Windows\System\bSDJbcC.exe
  2⤵
  PID:4828
- C:\Windows\System\YFHvfRw.exe
  C:\Windows\System\YFHvfRw.exe
  2⤵
  PID:4848
- C:\Windows\System\sqpnFty.exe
  C:\Windows\System\sqpnFty.exe
  2⤵
  PID:4864
- C:\Windows\System\wCRtSXa.exe
  C:\Windows\System\wCRtSXa.exe
  2⤵
  PID:4884
- C:\Windows\System\ylzRqBV.exe
  C:\Windows\System\ylzRqBV.exe
  2⤵
  PID:4904
- C:\Windows\System\SMldhqf.exe
  C:\Windows\System\SMldhqf.exe
  2⤵
  PID:4920
- C:\Windows\System\aClNudR.exe
  C:\Windows\System\aClNudR.exe
  2⤵
  PID:4940
- C:\Windows\System\XYghwMh.exe
  C:\Windows\System\XYghwMh.exe
  2⤵
  PID:4956
- C:\Windows\System\BfHOXZC.exe
  C:\Windows\System\BfHOXZC.exe
  2⤵
  PID:4976
- C:\Windows\System\NkEdGLf.exe
  C:\Windows\System\NkEdGLf.exe
  2⤵
  PID:5004
- C:\Windows\System\IHoDQfQ.exe
  C:\Windows\System\IHoDQfQ.exe
  2⤵
  PID:5024
- C:\Windows\System\JOrdhMD.exe
  C:\Windows\System\JOrdhMD.exe
  2⤵
  PID:5044
- C:\Windows\System\LXTiTMG.exe
  C:\Windows\System\LXTiTMG.exe
  2⤵
  PID:5064
- C:\Windows\System\JBnkaki.exe
  C:\Windows\System\JBnkaki.exe
  2⤵
  PID:5084
- C:\Windows\System\LehxOeI.exe
  C:\Windows\System\LehxOeI.exe
  2⤵
  PID:5100
- C:\Windows\System\nKVaCjQ.exe
  C:\Windows\System\nKVaCjQ.exe
  2⤵
  PID:5116
- C:\Windows\System\CECdXZX.exe
  C:\Windows\System\CECdXZX.exe
  2⤵
  PID:3648
- C:\Windows\System\NjrtMvI.exe
  C:\Windows\System\NjrtMvI.exe
  2⤵
  PID:3672
- C:\Windows\System\PmQByLS.exe
  C:\Windows\System\PmQByLS.exe
  2⤵
  PID:3608
- C:\Windows\System\zEGsbQx.exe
  C:\Windows\System\zEGsbQx.exe
  2⤵
  PID:3624
- C:\Windows\System\iaSMbmB.exe
  C:\Windows\System\iaSMbmB.exe
  2⤵
  PID:3924
- C:\Windows\System\ZDelDkC.exe
  C:\Windows\System\ZDelDkC.exe
  2⤵
  PID:3740
- C:\Windows\System\yntKOvs.exe
  C:\Windows\System\yntKOvs.exe
  2⤵
  PID:4028
- C:\Windows\System\xhbwkNT.exe
  C:\Windows\System\xhbwkNT.exe
  2⤵
  PID:480
- C:\Windows\System\XgfzAXm.exe
  C:\Windows\System\XgfzAXm.exe
  2⤵
  PID:1076
- C:\Windows\System\zDerTbp.exe
  C:\Windows\System\zDerTbp.exe
  2⤵
  PID:3876
- C:\Windows\System\DmRRPrB.exe
  C:\Windows\System\DmRRPrB.exe
  2⤵
  PID:3116
- C:\Windows\System\EBNJFQE.exe
  C:\Windows\System\EBNJFQE.exe
  2⤵
  PID:3944
- C:\Windows\System\UZYPHWP.exe
  C:\Windows\System\UZYPHWP.exe
  2⤵
  PID:3176
- C:\Windows\System\cAclvil.exe
  C:\Windows\System\cAclvil.exe
  2⤵
  PID:3328
- C:\Windows\System\lCBTMml.exe
  C:\Windows\System\lCBTMml.exe
  2⤵
  PID:3384
- C:\Windows\System\NCefrph.exe
  C:\Windows\System\NCefrph.exe
  2⤵
  PID:4168
- C:\Windows\System\XsbRPyP.exe
  C:\Windows\System\XsbRPyP.exe
  2⤵
  PID:1004
- C:\Windows\System\ScHRYqL.exe
  C:\Windows\System\ScHRYqL.exe
  2⤵
  PID:3196
- C:\Windows\System\fouAbzI.exe
  C:\Windows\System\fouAbzI.exe
  2⤵
  PID:4244
- C:\Windows\System\WcMHQqn.exe
  C:\Windows\System\WcMHQqn.exe
  2⤵
  PID:4252
- C:\Windows\System\TlGEHAa.exe
  C:\Windows\System\TlGEHAa.exe
  2⤵
  PID:3388
- C:\Windows\System\PPlKdji.exe
  C:\Windows\System\PPlKdji.exe
  2⤵
  PID:4104
- C:\Windows\System\oBqEzkF.exe
  C:\Windows\System\oBqEzkF.exe
  2⤵
  PID:4320
- C:\Windows\System\MWmrIUi.exe
  C:\Windows\System\MWmrIUi.exe
  2⤵
  PID:4200
- C:\Windows\System\UPICxkE.exe
  C:\Windows\System\UPICxkE.exe
  2⤵
  PID:4464
- C:\Windows\System\YcxgrBB.exe
  C:\Windows\System\YcxgrBB.exe
  2⤵
  PID:4512
- C:\Windows\System\kHgDCJK.exe
  C:\Windows\System\kHgDCJK.exe
  2⤵
  PID:4552
- C:\Windows\System\QorDrTv.exe
  C:\Windows\System\QorDrTv.exe
  2⤵
  PID:4332
- C:\Windows\System\InSjdYQ.exe
  C:\Windows\System\InSjdYQ.exe
  2⤵
  PID:4480
- C:\Windows\System\IWBailf.exe
  C:\Windows\System\IWBailf.exe
  2⤵
  PID:4612
- C:\Windows\System\FgnPtJL.exe
  C:\Windows\System\FgnPtJL.exe
  2⤵
  PID:4536
- C:\Windows\System\nDHGjZM.exe
  C:\Windows\System\nDHGjZM.exe
  2⤵
  PID:4444
- C:\Windows\System\iuRBaPj.exe
  C:\Windows\System\iuRBaPj.exe
  2⤵
  PID:4376
- C:\Windows\System\MYVXQPB.exe
  C:\Windows\System\MYVXQPB.exe
  2⤵
  PID:4592
- C:\Windows\System\NAnahSD.exe
  C:\Windows\System\NAnahSD.exe
  2⤵
  PID:4656
- C:\Windows\System\DHAcDWS.exe
  C:\Windows\System\DHAcDWS.exe
  2⤵
  PID:4636
- C:\Windows\System\RWttlna.exe
  C:\Windows\System\RWttlna.exe
  2⤵
  PID:4696
- C:\Windows\System\sUWHfby.exe
  C:\Windows\System\sUWHfby.exe
  2⤵
  PID:4740
- C:\Windows\System\XCJAZPL.exe
  C:\Windows\System\XCJAZPL.exe
  2⤵
  PID:4720
- C:\Windows\System\wxcpQLM.exe
  C:\Windows\System\wxcpQLM.exe
  2⤵
  PID:4756
- C:\Windows\System\MrVVqdV.exe
  C:\Windows\System\MrVVqdV.exe
  2⤵
  PID:4800
- C:\Windows\System\SsRxEMB.exe
  C:\Windows\System\SsRxEMB.exe
  2⤵
  PID:4896
- C:\Windows\System\GBkMHBZ.exe
  C:\Windows\System\GBkMHBZ.exe
  2⤵
  PID:4872
- C:\Windows\System\PbcXlrq.exe
  C:\Windows\System\PbcXlrq.exe
  2⤵
  PID:4972
- C:\Windows\System\vzVEtKA.exe
  C:\Windows\System\vzVEtKA.exe
  2⤵
  PID:4988
- C:\Windows\System\cLBhHCl.exe
  C:\Windows\System\cLBhHCl.exe
  2⤵
  PID:4996
- C:\Windows\System\HxyMTzC.exe
  C:\Windows\System\HxyMTzC.exe
  2⤵
  PID:5032
- C:\Windows\System\lgQOymi.exe
  C:\Windows\System\lgQOymi.exe
  2⤵
  PID:5096
- C:\Windows\System\ODISfEi.exe
  C:\Windows\System\ODISfEi.exe
  2⤵
  PID:3772
- C:\Windows\System\LRvtHSC.exe
  C:\Windows\System\LRvtHSC.exe
  2⤵
  PID:3668
- C:\Windows\System\tvQSMkX.exe
  C:\Windows\System\tvQSMkX.exe
  2⤵
  PID:5072
- C:\Windows\System\FjgcnyX.exe
  C:\Windows\System\FjgcnyX.exe
  2⤵
  PID:3588
- C:\Windows\System\cEreNxt.exe
  C:\Windows\System\cEreNxt.exe
  2⤵
  PID:1560
- C:\Windows\System\WpPjqJU.exe
  C:\Windows\System\WpPjqJU.exe
  2⤵
  PID:4044
- C:\Windows\System\MtXNoXM.exe
  C:\Windows\System\MtXNoXM.exe
  2⤵
  PID:3816
- C:\Windows\System\wvAwcMM.exe
  C:\Windows\System\wvAwcMM.exe
  2⤵
  PID:768
- C:\Windows\System\KwBliZc.exe
  C:\Windows\System\KwBliZc.exe
  2⤵
  PID:3284
- C:\Windows\System\lfLeocg.exe
  C:\Windows\System\lfLeocg.exe
  2⤵
  PID:3324
- C:\Windows\System\QAWEwvJ.exe
  C:\Windows\System\QAWEwvJ.exe
  2⤵
  PID:2460
- C:\Windows\System\jcErNtz.exe
  C:\Windows\System\jcErNtz.exe
  2⤵
  PID:3552
- C:\Windows\System\jiAGGuf.exe
  C:\Windows\System\jiAGGuf.exe
  2⤵
  PID:4060
- C:\Windows\System\RfnxRZd.exe
  C:\Windows\System\RfnxRZd.exe
  2⤵
  PID:2060
- C:\Windows\System\KcWxHND.exe
  C:\Windows\System\KcWxHND.exe
  2⤵
  PID:4112
- C:\Windows\System\lNIQOgj.exe
  C:\Windows\System\lNIQOgj.exe
  2⤵
  PID:4396
- C:\Windows\System\cmrDGOz.exe
  C:\Windows\System\cmrDGOz.exe
  2⤵
  PID:4516
- C:\Windows\System\wNpKsVT.exe
  C:\Windows\System\wNpKsVT.exe
  2⤵
  PID:4448
- C:\Windows\System\LwUWtJx.exe
  C:\Windows\System\LwUWtJx.exe
  2⤵
  PID:4608
- C:\Windows\System\YiCIPOk.exe
  C:\Windows\System\YiCIPOk.exe
  2⤵
  PID:4408
- C:\Windows\System\bzyQNcK.exe
  C:\Windows\System\bzyQNcK.exe
  2⤵
  PID:4644
- C:\Windows\System\nVcHnWL.exe
  C:\Windows\System\nVcHnWL.exe
  2⤵
  PID:4584
- C:\Windows\System\XgrZkOQ.exe
  C:\Windows\System\XgrZkOQ.exe
  2⤵
  PID:4576
- C:\Windows\System\kNeYSMX.exe
  C:\Windows\System\kNeYSMX.exe
  2⤵
  PID:4744
- C:\Windows\System\agNtmwn.exe
  C:\Windows\System\agNtmwn.exe
  2⤵
  PID:4780
- C:\Windows\System\CJboqjY.exe
  C:\Windows\System\CJboqjY.exe
  2⤵
  PID:2756
- C:\Windows\System\beVSsQJ.exe
  C:\Windows\System\beVSsQJ.exe
  2⤵
  PID:4876
- C:\Windows\System\ofVAEbE.exe
  C:\Windows\System\ofVAEbE.exe
  2⤵
  PID:4892
- C:\Windows\System\nRFyZYM.exe
  C:\Windows\System\nRFyZYM.exe
  2⤵
  PID:4964
- C:\Windows\System\cLkvzvl.exe
  C:\Windows\System\cLkvzvl.exe
  2⤵
  PID:5016
- C:\Windows\System\gUULbve.exe
  C:\Windows\System\gUULbve.exe
  2⤵
  PID:5056
- C:\Windows\System\stAexNQ.exe
  C:\Windows\System\stAexNQ.exe
  2⤵
  PID:3500
- C:\Windows\System\JwZlzNi.exe
  C:\Windows\System\JwZlzNi.exe
  2⤵
  PID:4048
- C:\Windows\System\BHLztDh.exe
  C:\Windows\System\BHLztDh.exe
  2⤵
  PID:5112
- C:\Windows\System\aVxYwPv.exe
  C:\Windows\System\aVxYwPv.exe
  2⤵
  PID:5040
- C:\Windows\System\ZJzXLSS.exe
  C:\Windows\System\ZJzXLSS.exe
  2⤵
  PID:3960
- C:\Windows\System\ojllHZy.exe
  C:\Windows\System\ojllHZy.exe
  2⤵
  PID:2552
- C:\Windows\System\iOdelpd.exe
  C:\Windows\System\iOdelpd.exe
  2⤵
  PID:3128
- C:\Windows\System\CuaPaCU.exe
  C:\Windows\System\CuaPaCU.exe
  2⤵
  PID:4136
- C:\Windows\System\HeiPvRb.exe
  C:\Windows\System\HeiPvRb.exe
  2⤵
  PID:4316
- C:\Windows\System\XALhTtL.exe
  C:\Windows\System\XALhTtL.exe
  2⤵
  PID:4264
- C:\Windows\System\NkuPdFc.exe
  C:\Windows\System\NkuPdFc.exe
  2⤵
  PID:5128
- C:\Windows\System\PKUDOAu.exe
  C:\Windows\System\PKUDOAu.exe
  2⤵
  PID:5144
- C:\Windows\System\ZoOEfnJ.exe
  C:\Windows\System\ZoOEfnJ.exe
  2⤵
  PID:5160
- C:\Windows\System\ajzJDwv.exe
  C:\Windows\System\ajzJDwv.exe
  2⤵
  PID:5176
- C:\Windows\System\StlEsjO.exe
  C:\Windows\System\StlEsjO.exe
  2⤵
  PID:5192
- C:\Windows\System\yQtxVbI.exe
  C:\Windows\System\yQtxVbI.exe
  2⤵
  PID:5208
- C:\Windows\System\GQFIwyf.exe
  C:\Windows\System\GQFIwyf.exe
  2⤵
  PID:5224
- C:\Windows\System\vaXNZAq.exe
  C:\Windows\System\vaXNZAq.exe
  2⤵
  PID:5240
- C:\Windows\System\nNRgwdj.exe
  C:\Windows\System\nNRgwdj.exe
  2⤵
  PID:5260
- C:\Windows\System\qGibHlO.exe
  C:\Windows\System\qGibHlO.exe
  2⤵
  PID:5276
- C:\Windows\System\ZuItmdi.exe
  C:\Windows\System\ZuItmdi.exe
  2⤵
  PID:5324
- C:\Windows\System\SvrgYtW.exe
  C:\Windows\System\SvrgYtW.exe
  2⤵
  PID:5340
- C:\Windows\System\GTyArkm.exe
  C:\Windows\System\GTyArkm.exe
  2⤵
  PID:5356
- C:\Windows\System\MmqacXb.exe
  C:\Windows\System\MmqacXb.exe
  2⤵
  PID:5372
- C:\Windows\System\NKTTKBJ.exe
  C:\Windows\System\NKTTKBJ.exe
  2⤵
  PID:5388
- C:\Windows\System\srjwiAn.exe
  C:\Windows\System\srjwiAn.exe
  2⤵
  PID:5404
- C:\Windows\System\QrjECCS.exe
  C:\Windows\System\QrjECCS.exe
  2⤵
  PID:5420
- C:\Windows\System\CWZbgFb.exe
  C:\Windows\System\CWZbgFb.exe
  2⤵
  PID:5436
- C:\Windows\System\zTuIoRF.exe
  C:\Windows\System\zTuIoRF.exe
  2⤵
  PID:5452
- C:\Windows\System\goKEONn.exe
  C:\Windows\System\goKEONn.exe
  2⤵
  PID:5468
- C:\Windows\System\WSCoFYa.exe
  C:\Windows\System\WSCoFYa.exe
  2⤵
  PID:5484
- C:\Windows\System\dYJuQmR.exe
  C:\Windows\System\dYJuQmR.exe
  2⤵
  PID:5500
- C:\Windows\System\QuNFceU.exe
  C:\Windows\System\QuNFceU.exe
  2⤵
  PID:5516
- C:\Windows\System\UxwRUZL.exe
  C:\Windows\System\UxwRUZL.exe
  2⤵
  PID:5532
- C:\Windows\System\mymSpMk.exe
  C:\Windows\System\mymSpMk.exe
  2⤵
  PID:5548
- C:\Windows\System\NImbPka.exe
  C:\Windows\System\NImbPka.exe
  2⤵
  PID:5564
- C:\Windows\System\JcvFwjP.exe
  C:\Windows\System\JcvFwjP.exe
  2⤵
  PID:5580
- C:\Windows\System\KaMHyWw.exe
  C:\Windows\System\KaMHyWw.exe
  2⤵
  PID:5596
- C:\Windows\System\QXFWPCS.exe
  C:\Windows\System\QXFWPCS.exe
  2⤵
  PID:5612
- C:\Windows\System\aOlkIZv.exe
  C:\Windows\System\aOlkIZv.exe
  2⤵
  PID:5628
- C:\Windows\System\hbZlvEn.exe
  C:\Windows\System\hbZlvEn.exe
  2⤵
  PID:5644
- C:\Windows\System\eJkmTnj.exe
  C:\Windows\System\eJkmTnj.exe
  2⤵
  PID:5660
- C:\Windows\System\tTJftWN.exe
  C:\Windows\System\tTJftWN.exe
  2⤵
  PID:5676
- C:\Windows\System\mJDQEdc.exe
  C:\Windows\System\mJDQEdc.exe
  2⤵
  PID:5692
- C:\Windows\System\YuYfxAd.exe
  C:\Windows\System\YuYfxAd.exe
  2⤵
  PID:5708
- C:\Windows\System\crXygno.exe
  C:\Windows\System\crXygno.exe
  2⤵
  PID:5724
- C:\Windows\System\NuDPeoF.exe
  C:\Windows\System\NuDPeoF.exe
  2⤵
  PID:5740
- C:\Windows\System\BtsgfNu.exe
  C:\Windows\System\BtsgfNu.exe
  2⤵
  PID:5756
- C:\Windows\System\kRNCpVC.exe
  C:\Windows\System\kRNCpVC.exe
  2⤵
  PID:5772
- C:\Windows\System\UATXqCI.exe
  C:\Windows\System\UATXqCI.exe
  2⤵
  PID:5788
- C:\Windows\System\GxjCyYu.exe
  C:\Windows\System\GxjCyYu.exe
  2⤵
  PID:5804
- C:\Windows\System\qTbQBZC.exe
  C:\Windows\System\qTbQBZC.exe
  2⤵
  PID:5820
- C:\Windows\System\IpSKhXJ.exe
  C:\Windows\System\IpSKhXJ.exe
  2⤵
  PID:5836
- C:\Windows\System\QnojNBq.exe
  C:\Windows\System\QnojNBq.exe
  2⤵
  PID:5852
- C:\Windows\System\kjCavqi.exe
  C:\Windows\System\kjCavqi.exe
  2⤵
  PID:5868
- C:\Windows\System\AsOPUtU.exe
  C:\Windows\System\AsOPUtU.exe
  2⤵
  PID:5884
- C:\Windows\System\znrbUca.exe
  C:\Windows\System\znrbUca.exe
  2⤵
  PID:5900
- C:\Windows\System\LoWFEoy.exe
  C:\Windows\System\LoWFEoy.exe
  2⤵
  PID:5916
- C:\Windows\System\LpuwQDL.exe
  C:\Windows\System\LpuwQDL.exe
  2⤵
  PID:5932
- C:\Windows\System\SRYzmPt.exe
  C:\Windows\System\SRYzmPt.exe
  2⤵
  PID:5948
- C:\Windows\System\cxKLzhi.exe
  C:\Windows\System\cxKLzhi.exe
  2⤵
  PID:5964
- C:\Windows\System\eETraNd.exe
  C:\Windows\System\eETraNd.exe
  2⤵
  PID:5980
- C:\Windows\System\LTJTkiC.exe
  C:\Windows\System\LTJTkiC.exe
  2⤵
  PID:5996
- C:\Windows\System\DdMmzNr.exe
  C:\Windows\System\DdMmzNr.exe
  2⤵
  PID:6012
- C:\Windows\System\caXcdJK.exe
  C:\Windows\System\caXcdJK.exe
  2⤵
  PID:6028
- C:\Windows\System\qEPbYpC.exe
  C:\Windows\System\qEPbYpC.exe
  2⤵
  PID:6044
- C:\Windows\System\RfsYIFn.exe
  C:\Windows\System\RfsYIFn.exe
  2⤵
  PID:6060
- C:\Windows\System\iLrKKxb.exe
  C:\Windows\System\iLrKKxb.exe
  2⤵
  PID:6076
- C:\Windows\System\SGxMOke.exe
  C:\Windows\System\SGxMOke.exe
  2⤵
  PID:6092
- C:\Windows\System\PEMItuB.exe
  C:\Windows\System\PEMItuB.exe
  2⤵
  PID:6108
- C:\Windows\System\gaMArlC.exe
  C:\Windows\System\gaMArlC.exe
  2⤵
  PID:6124
- C:\Windows\System\MWUicte.exe
  C:\Windows\System\MWUicte.exe
  2⤵
  PID:6140
- C:\Windows\System\nfoOOHw.exe
  C:\Windows\System\nfoOOHw.exe
  2⤵
  PID:4296
- C:\Windows\System\DtVKSIw.exe
  C:\Windows\System\DtVKSIw.exe
  2⤵
  PID:4588
- C:\Windows\System\wRcVBRv.exe
  C:\Windows\System\wRcVBRv.exe
  2⤵
  PID:3940
- C:\Windows\System\oSbxPmL.exe
  C:\Windows\System\oSbxPmL.exe
  2⤵
  PID:4216
- C:\Windows\System\yoIectJ.exe
  C:\Windows\System\yoIectJ.exe
  2⤵
  PID:4928
- C:\Windows\System\FNbilTK.exe
  C:\Windows\System\FNbilTK.exe
  2⤵
  PID:5000
- C:\Windows\System\qfoyjck.exe
  C:\Windows\System\qfoyjck.exe
  2⤵
  PID:5092
- C:\Windows\System\MmQGlMB.exe
  C:\Windows\System\MmQGlMB.exe
  2⤵
  PID:2100
- C:\Windows\System\pwNZUga.exe
  C:\Windows\System\pwNZUga.exe
  2⤵
  PID:5136
- C:\Windows\System\ztpDZDq.exe
  C:\Windows\System\ztpDZDq.exe
  2⤵
  PID:4248
- C:\Windows\System\aITUkoO.exe
  C:\Windows\System\aITUkoO.exe
  2⤵
  PID:4348
- C:\Windows\System\jVNyNSg.exe
  C:\Windows\System\jVNyNSg.exe
  2⤵
  PID:4532
- C:\Windows\System\RwrjuDA.exe
  C:\Windows\System\RwrjuDA.exe
  2⤵
  PID:5204
- C:\Windows\System\EywnuuS.exe
  C:\Windows\System\EywnuuS.exe
  2⤵
  PID:5272
- C:\Windows\System\GfuKPDE.exe
  C:\Windows\System\GfuKPDE.exe
  2⤵
  PID:5156
- C:\Windows\System\FFEslaL.exe
  C:\Windows\System\FFEslaL.exe
  2⤵
  PID:5220
- C:\Windows\System\HVpvXDh.exe
  C:\Windows\System\HVpvXDh.exe
  2⤵
  PID:5284
- C:\Windows\System\frAYzAj.exe
  C:\Windows\System\frAYzAj.exe
  2⤵
  PID:4064
- C:\Windows\System\akjFnvz.exe
  C:\Windows\System\akjFnvz.exe
  2⤵
  PID:2740
- C:\Windows\System\MTLOGbf.exe
  C:\Windows\System\MTLOGbf.exe
  2⤵
  PID:3768
- C:\Windows\System\KrYKMGO.exe
  C:\Windows\System\KrYKMGO.exe
  2⤵
  PID:4984
- C:\Windows\System\tAFripN.exe
  C:\Windows\System\tAFripN.exe
  2⤵
  PID:4784
- C:\Windows\System\CFSYYYR.exe
  C:\Windows\System\CFSYYYR.exe
  2⤵
  PID:5336
- C:\Windows\System\POeWQCQ.exe
  C:\Windows\System\POeWQCQ.exe
  2⤵
  PID:5400
- C:\Windows\System\ceTaeey.exe
  C:\Windows\System\ceTaeey.exe
  2⤵
  PID:5348
- C:\Windows\System\Fvwxttq.exe
  C:\Windows\System\Fvwxttq.exe
  2⤵
  PID:5412
- C:\Windows\System\jJGnCmu.exe
  C:\Windows\System\jJGnCmu.exe
  2⤵
  PID:5492
- C:\Windows\System\zlgtkvz.exe
  C:\Windows\System\zlgtkvz.exe
  2⤵
  PID:5496
- C:\Windows\System\XetWOGs.exe
  C:\Windows\System\XetWOGs.exe
  2⤵
  PID:5560
- C:\Windows\System\clCmtLr.exe
  C:\Windows\System\clCmtLr.exe
  2⤵
  PID:5512
- C:\Windows\System\NgLOduy.exe
  C:\Windows\System\NgLOduy.exe
  2⤵
  PID:5620
- C:\Windows\System\NRiyLMJ.exe
  C:\Windows\System\NRiyLMJ.exe
  2⤵
  PID:5688
- C:\Windows\System\zmsZkIW.exe
  C:\Windows\System\zmsZkIW.exe
  2⤵
  PID:5752
- C:\Windows\System\UKWzIDc.exe
  C:\Windows\System\UKWzIDc.exe
  2⤵
  PID:5640
- C:\Windows\System\yCgyZES.exe
  C:\Windows\System\yCgyZES.exe
  2⤵
  PID:5608
- C:\Windows\System\WbgAVOE.exe
  C:\Windows\System\WbgAVOE.exe
  2⤵
  PID:5700
- C:\Windows\System\jYwDKGw.exe
  C:\Windows\System\jYwDKGw.exe
  2⤵
  PID:5768
- C:\Windows\System\WabtFBt.exe
  C:\Windows\System\WabtFBt.exe
  2⤵
  PID:5816
- C:\Windows\System\DgimHOL.exe
  C:\Windows\System\DgimHOL.exe
  2⤵
  PID:5876
- C:\Windows\System\JopGGwZ.exe
  C:\Windows\System\JopGGwZ.exe
  2⤵
  PID:5908
- C:\Windows\System\XgEeyeR.exe
  C:\Windows\System\XgEeyeR.exe
  2⤵
  PID:5972
- C:\Windows\System\XSfDPpz.exe
  C:\Windows\System\XSfDPpz.exe
  2⤵
  PID:5892
- C:\Windows\System\eTMNiqU.exe
  C:\Windows\System\eTMNiqU.exe
  2⤵
  PID:6008
- C:\Windows\System\Upmrpgs.exe
  C:\Windows\System\Upmrpgs.exe
  2⤵
  PID:5956
- C:\Windows\System\iztVuqL.exe
  C:\Windows\System\iztVuqL.exe
  2⤵
  PID:6036
- C:\Windows\System\eSntNPq.exe
  C:\Windows\System\eSntNPq.exe
  2⤵
  PID:6024
- C:\Windows\System\gczrocO.exe
  C:\Windows\System\gczrocO.exe
  2⤵
  PID:6056
- C:\Windows\System\ShfYjZL.exe
  C:\Windows\System\ShfYjZL.exe
  2⤵
  PID:4692
- C:\Windows\System\bLdlIgk.exe
  C:\Windows\System\bLdlIgk.exe
  2⤵
  PID:5020
- C:\Windows\System\LwHJsNH.exe
  C:\Windows\System\LwHJsNH.exe
  2⤵
  PID:5076
- C:\Windows\System\XbuEEfy.exe
  C:\Windows\System\XbuEEfy.exe
  2⤵
  PID:6084
- C:\Windows\System\XxgxMMs.exe
  C:\Windows\System\XxgxMMs.exe
  2⤵
  PID:4488
- C:\Windows\System\qzKAkYl.exe
  C:\Windows\System\qzKAkYl.exe
  2⤵
  PID:4284
- C:\Windows\System\RoychfR.exe
  C:\Windows\System\RoychfR.exe
  2⤵
  PID:5236
- C:\Windows\System\lyljpLG.exe
  C:\Windows\System\lyljpLG.exe
  2⤵
  PID:5200
- C:\Windows\System\gEiUmqY.exe
  C:\Windows\System\gEiUmqY.exe
  2⤵
  PID:5268
- C:\Windows\System\xJIxYNk.exe
  C:\Windows\System\xJIxYNk.exe
  2⤵
  PID:5188
- C:\Windows\System\mMZxmgn.exe
  C:\Windows\System\mMZxmgn.exe
  2⤵
  PID:5256
- C:\Windows\System\iebszLM.exe
  C:\Windows\System\iebszLM.exe
  2⤵
  PID:3788
- C:\Windows\System\OYhwgJQ.exe
  C:\Windows\System\OYhwgJQ.exe
  2⤵
  PID:4860
- C:\Windows\System\uobyypE.exe
  C:\Windows\System\uobyypE.exe
  2⤵
  PID:5396
- C:\Windows\System\WymDebT.exe
  C:\Windows\System\WymDebT.exe
  2⤵
  PID:6156
- C:\Windows\System\gOAXRQR.exe
  C:\Windows\System\gOAXRQR.exe
  2⤵
  PID:6172
- C:\Windows\System\vtTkETY.exe
  C:\Windows\System\vtTkETY.exe
  2⤵
  PID:6188
- C:\Windows\System\rLoHnFY.exe
  C:\Windows\System\rLoHnFY.exe
  2⤵
  PID:6204
- C:\Windows\System\LrrsxZm.exe
  C:\Windows\System\LrrsxZm.exe
  2⤵
  PID:6220
- C:\Windows\System\rBIqUVt.exe
  C:\Windows\System\rBIqUVt.exe
  2⤵
  PID:6236
- C:\Windows\System\cJGsUZy.exe
  C:\Windows\System\cJGsUZy.exe
  2⤵
  PID:6252
- C:\Windows\System\EAmdVhn.exe
  C:\Windows\System\EAmdVhn.exe
  2⤵
  PID:6268
- C:\Windows\System\tGAfovA.exe
  C:\Windows\System\tGAfovA.exe
  2⤵
  PID:6284
- C:\Windows\System\OBniayW.exe
  C:\Windows\System\OBniayW.exe
  2⤵
  PID:6300
- C:\Windows\System\COCeLaZ.exe
  C:\Windows\System\COCeLaZ.exe
  2⤵
  PID:6316
- C:\Windows\System\kxHJixw.exe
  C:\Windows\System\kxHJixw.exe
  2⤵
  PID:6332
- C:\Windows\System\JRXKqEw.exe
  C:\Windows\System\JRXKqEw.exe
  2⤵
  PID:6348
- C:\Windows\System\GlqPaTk.exe
  C:\Windows\System\GlqPaTk.exe
  2⤵
  PID:6364
- C:\Windows\System\OfwGHim.exe
  C:\Windows\System\OfwGHim.exe
  2⤵
  PID:6380
- C:\Windows\System\FWWzqHr.exe
  C:\Windows\System\FWWzqHr.exe
  2⤵
  PID:6396
- C:\Windows\System\WXFpiAl.exe
  C:\Windows\System\WXFpiAl.exe
  2⤵
  PID:6412
- C:\Windows\System\hfFNQEP.exe
  C:\Windows\System\hfFNQEP.exe
  2⤵
  PID:6428
- C:\Windows\System\kxbAliS.exe
  C:\Windows\System\kxbAliS.exe
  2⤵
  PID:6444
- C:\Windows\System\ZaXrvly.exe
  C:\Windows\System\ZaXrvly.exe
  2⤵
  PID:6460
- C:\Windows\System\gXoJRfF.exe
  C:\Windows\System\gXoJRfF.exe
  2⤵
  PID:6476
- C:\Windows\System\qPECjWf.exe
  C:\Windows\System\qPECjWf.exe
  2⤵
  PID:6492
- C:\Windows\System\UBjrEHo.exe
  C:\Windows\System\UBjrEHo.exe
  2⤵
  PID:6508
- C:\Windows\System\QHaJxgo.exe
  C:\Windows\System\QHaJxgo.exe
  2⤵
  PID:6524
- C:\Windows\System\XFatlQE.exe
  C:\Windows\System\XFatlQE.exe
  2⤵
  PID:6540
- C:\Windows\System\dpWRPKl.exe
  C:\Windows\System\dpWRPKl.exe
  2⤵
  PID:6556
- C:\Windows\System\VeRavue.exe
  C:\Windows\System\VeRavue.exe
  2⤵
  PID:6572
- C:\Windows\System\ZEfPSvj.exe
  C:\Windows\System\ZEfPSvj.exe
  2⤵
  PID:6588
- C:\Windows\System\cdbzDOi.exe
  C:\Windows\System\cdbzDOi.exe
  2⤵
  PID:6604
- C:\Windows\System\UDHGqUP.exe
  C:\Windows\System\UDHGqUP.exe
  2⤵
  PID:6620
- C:\Windows\System\DDlkQwp.exe
  C:\Windows\System\DDlkQwp.exe
  2⤵
  PID:6636
- C:\Windows\System\wDrtAvL.exe
  C:\Windows\System\wDrtAvL.exe
  2⤵
  PID:6652
- C:\Windows\System\LXDYbsx.exe
  C:\Windows\System\LXDYbsx.exe
  2⤵
  PID:6668
- C:\Windows\System\IKQnPIU.exe
  C:\Windows\System\IKQnPIU.exe
  2⤵
  PID:6684
- C:\Windows\System\YaAntGv.exe
  C:\Windows\System\YaAntGv.exe
  2⤵
  PID:6700
- C:\Windows\System\WvcdEsc.exe
  C:\Windows\System\WvcdEsc.exe
  2⤵
  PID:6716
- C:\Windows\System\dzMWeRz.exe
  C:\Windows\System\dzMWeRz.exe
  2⤵
  PID:6732
- C:\Windows\System\riQJzyO.exe
  C:\Windows\System\riQJzyO.exe
  2⤵
  PID:6748
- C:\Windows\System\eIhNXkO.exe
  C:\Windows\System\eIhNXkO.exe
  2⤵
  PID:6764
- C:\Windows\System\FSIBQVs.exe
  C:\Windows\System\FSIBQVs.exe
  2⤵
  PID:6780
- C:\Windows\System\cPtLMnZ.exe
  C:\Windows\System\cPtLMnZ.exe
  2⤵
  PID:6796
- C:\Windows\System\jHBesqq.exe
  C:\Windows\System\jHBesqq.exe
  2⤵
  PID:6812
- C:\Windows\System\WmLYPUb.exe
  C:\Windows\System\WmLYPUb.exe
  2⤵
  PID:6828
- C:\Windows\System\TYgKGUA.exe
  C:\Windows\System\TYgKGUA.exe
  2⤵
  PID:6844
- C:\Windows\System\FomwkJw.exe
  C:\Windows\System\FomwkJw.exe
  2⤵
  PID:6860
- C:\Windows\System\eLKUaJi.exe
  C:\Windows\System\eLKUaJi.exe
  2⤵
  PID:6876
- C:\Windows\System\MPgbWss.exe
  C:\Windows\System\MPgbWss.exe
  2⤵
  PID:6892
- C:\Windows\System\OKkRRqf.exe
  C:\Windows\System\OKkRRqf.exe
  2⤵
  PID:6908
- C:\Windows\System\AKcyKBZ.exe
  C:\Windows\System\AKcyKBZ.exe
  2⤵
  PID:6924
- C:\Windows\System\ueQVJsw.exe
  C:\Windows\System\ueQVJsw.exe
  2⤵
  PID:6940
- C:\Windows\System\xtJIwUS.exe
  C:\Windows\System\xtJIwUS.exe
  2⤵
  PID:6956
- C:\Windows\System\gOdSbQS.exe
  C:\Windows\System\gOdSbQS.exe
  2⤵
  PID:6972
- C:\Windows\System\hEsvEVZ.exe
  C:\Windows\System\hEsvEVZ.exe
  2⤵
  PID:6988
- C:\Windows\System\NfAObPs.exe
  C:\Windows\System\NfAObPs.exe
  2⤵
  PID:7004
- C:\Windows\System\vYOpHPc.exe
  C:\Windows\System\vYOpHPc.exe
  2⤵
  PID:7020
- C:\Windows\System\vKxeAym.exe
  C:\Windows\System\vKxeAym.exe
  2⤵
  PID:7036
- C:\Windows\System\ijHcTpt.exe
  C:\Windows\System\ijHcTpt.exe
  2⤵
  PID:7052
- C:\Windows\System\deJxzWf.exe
  C:\Windows\System\deJxzWf.exe
  2⤵
  PID:7068
- C:\Windows\System\dANBQUw.exe
  C:\Windows\System\dANBQUw.exe
  2⤵
  PID:7084
- C:\Windows\System\GDDlBKp.exe
  C:\Windows\System\GDDlBKp.exe
  2⤵
  PID:7100
- C:\Windows\System\RAuJQVO.exe
  C:\Windows\System\RAuJQVO.exe
  2⤵
  PID:7116
- C:\Windows\System\fefvTAh.exe
  C:\Windows\System\fefvTAh.exe
  2⤵
  PID:7132
- C:\Windows\System\AhibMrb.exe
  C:\Windows\System\AhibMrb.exe
  2⤵
  PID:7148
- C:\Windows\System\ENdiHPE.exe
  C:\Windows\System\ENdiHPE.exe
  2⤵
  PID:7164
- C:\Windows\System\JbRJxgZ.exe
  C:\Windows\System\JbRJxgZ.exe
  2⤵
  PID:5380
- C:\Windows\System\XearXpW.exe
  C:\Windows\System\XearXpW.exe
  2⤵
  PID:2996
- C:\Windows\System\DlExPmy.exe
  C:\Windows\System\DlExPmy.exe
  2⤵
  PID:5508
- C:\Windows\System\EBBgWME.exe
  C:\Windows\System\EBBgWME.exe
  2⤵
  PID:5656
- C:\Windows\System\RgIjhYh.exe
  C:\Windows\System\RgIjhYh.exe
  2⤵
  PID:5636
- C:\Windows\System\qKZbxxP.exe
  C:\Windows\System\qKZbxxP.exe
  2⤵
  PID:5672
- C:\Windows\System\LNRMWzz.exe
  C:\Windows\System\LNRMWzz.exe
  2⤵
  PID:5812
- C:\Windows\System\GpXFLIv.exe
  C:\Windows\System\GpXFLIv.exe
  2⤵
  PID:5880
- C:\Windows\System\KMuODne.exe
  C:\Windows\System\KMuODne.exe
  2⤵
  PID:5988
- C:\Windows\System\YsCvWbD.exe
  C:\Windows\System\YsCvWbD.exe
  2⤵
  PID:6020
- C:\Windows\System\dMpRXsF.exe
  C:\Windows\System\dMpRXsF.exe
  2⤵
  PID:5924
- C:\Windows\System\sNGonmP.exe
  C:\Windows\System\sNGonmP.exe
  2⤵
  PID:4624
- C:\Windows\System\iCwKIHc.exe
  C:\Windows\System\iCwKIHc.exe
  2⤵
  PID:4796
- C:\Windows\System\GxLtSOm.exe
  C:\Windows\System\GxLtSOm.exe
  2⤵
  PID:6088
- C:\Windows\System\oxiCPQn.exe
  C:\Windows\System\oxiCPQn.exe
  2⤵
  PID:2924
- C:\Windows\System\bBFrjZw.exe
  C:\Windows\System\bBFrjZw.exe
  2⤵
  PID:5172
- C:\Windows\System\ZGNFNmk.exe
  C:\Windows\System\ZGNFNmk.exe
  2⤵
  PID:5288
- C:\Windows\System\jLIBmMI.exe
  C:\Windows\System\jLIBmMI.exe
  2⤵
  PID:4968
- C:\Windows\System\fwNgYlM.exe
  C:\Windows\System\fwNgYlM.exe
  2⤵
  PID:5364
- C:\Windows\System\YhYGtfO.exe
  C:\Windows\System\YhYGtfO.exe
  2⤵
  PID:6164
- C:\Windows\System\vntsTMc.exe
  C:\Windows\System\vntsTMc.exe
  2⤵
  PID:6200
- C:\Windows\System\xUvXFkz.exe
  C:\Windows\System\xUvXFkz.exe
  2⤵
  PID:6244
- C:\Windows\System\UjkKPBL.exe
  C:\Windows\System\UjkKPBL.exe
  2⤵
  PID:6260
- C:\Windows\System\cnrWWZQ.exe
  C:\Windows\System\cnrWWZQ.exe
  2⤵
  PID:6296
- C:\Windows\System\FtQXOQW.exe
  C:\Windows\System\FtQXOQW.exe
  2⤵
  PID:6344
- C:\Windows\System\nBtTTjj.exe
  C:\Windows\System\nBtTTjj.exe
  2⤵
  PID:6360
- C:\Windows\System\hHxVEis.exe
  C:\Windows\System\hHxVEis.exe
  2⤵
  PID:6392
- C:\Windows\System\jZIbhfY.exe
  C:\Windows\System\jZIbhfY.exe
  2⤵
  PID:6420
- C:\Windows\System\ejCFuKQ.exe
  C:\Windows\System\ejCFuKQ.exe
  2⤵
  PID:6472
- C:\Windows\System\pfHFYRr.exe
  C:\Windows\System\pfHFYRr.exe
  2⤵
  PID:6504
- C:\Windows\System\LwXkeUJ.exe
  C:\Windows\System\LwXkeUJ.exe
  2⤵
  PID:2596
- C:\Windows\System\gtZxLrT.exe
  C:\Windows\System\gtZxLrT.exe
  2⤵
  PID:6564
- C:\Windows\System\XXBigFP.exe
  C:\Windows\System\XXBigFP.exe
  2⤵
  PID:6596
- C:\Windows\System\fYECuXr.exe
  C:\Windows\System\fYECuXr.exe
  2⤵
  PID:6612
- C:\Windows\System\gRUEVhZ.exe
  C:\Windows\System\gRUEVhZ.exe
  2⤵
  PID:6644
- C:\Windows\System\BhCHPYC.exe
  C:\Windows\System\BhCHPYC.exe
  2⤵
  PID:6676
- C:\Windows\System\MFRdkCI.exe
  C:\Windows\System\MFRdkCI.exe
  2⤵
  PID:6680
- C:\Windows\System\RxuXfsq.exe
  C:\Windows\System\RxuXfsq.exe
  2⤵
  PID:6708
- C:\Windows\System\sWWjZJJ.exe
  C:\Windows\System\sWWjZJJ.exe
  2⤵
  PID:6788
- C:\Windows\System\uRnzfOS.exe
  C:\Windows\System\uRnzfOS.exe
  2⤵
  PID:2860
- C:\Windows\System\ePgMuER.exe
  C:\Windows\System\ePgMuER.exe
  2⤵
  PID:6808
- C:\Windows\System\nuDcfXn.exe
  C:\Windows\System\nuDcfXn.exe
  2⤵
  PID:6840
- C:\Windows\System\oJrcXYN.exe
  C:\Windows\System\oJrcXYN.exe
  2⤵
  PID:6888
- C:\Windows\System\ozyUYVi.exe
  C:\Windows\System\ozyUYVi.exe
  2⤵
  PID:6948
- C:\Windows\System\yeprGLn.exe
  C:\Windows\System\yeprGLn.exe
  2⤵
  PID:6936
- C:\Windows\System\POtpzAQ.exe
  C:\Windows\System\POtpzAQ.exe
  2⤵
  PID:2624
- C:\Windows\System\jGugkHN.exe
  C:\Windows\System\jGugkHN.exe
  2⤵
  PID:7016
- C:\Windows\System\ikKmsNt.exe
  C:\Windows\System\ikKmsNt.exe
  2⤵
  PID:7028
- C:\Windows\System\LUWSfAc.exe
  C:\Windows\System\LUWSfAc.exe
  2⤵
  PID:7064
- C:\Windows\System\XQcvzHY.exe
  C:\Windows\System\XQcvzHY.exe
  2⤵
  PID:7112
- C:\Windows\System\YTFzQsZ.exe
  C:\Windows\System\YTFzQsZ.exe
  2⤵
  PID:7128
- C:\Windows\System\imyakJg.exe
  C:\Windows\System\imyakJg.exe
  2⤵
  PID:5432
- C:\Windows\System\mxYSQbt.exe
  C:\Windows\System\mxYSQbt.exe
  2⤵
  PID:5528
- C:\Windows\System\DuoIAve.exe
  C:\Windows\System\DuoIAve.exe
  2⤵
  PID:5720
- C:\Windows\System\SgkimMi.exe
  C:\Windows\System\SgkimMi.exe
  2⤵
  PID:2076
- C:\Windows\System\yowBSuh.exe
  C:\Windows\System\yowBSuh.exe
  2⤵
  PID:5668
- C:\Windows\System\ucSzvHt.exe
  C:\Windows\System\ucSzvHt.exe
  2⤵
  PID:5844
- C:\Windows\System\klMfhQh.exe
  C:\Windows\System\klMfhQh.exe
  2⤵
  PID:5944
- C:\Windows\System\qzGRZGw.exe
  C:\Windows\System\qzGRZGw.exe
  2⤵
  PID:6136
- C:\Windows\System\LyLxlue.exe
  C:\Windows\System\LyLxlue.exe
  2⤵
  PID:6052
- C:\Windows\System\CszWrHT.exe
  C:\Windows\System\CszWrHT.exe
  2⤵
  PID:5124
- C:\Windows\System\RpZtniN.exe
  C:\Windows\System\RpZtniN.exe
  2⤵
  PID:2628
- C:\Windows\System\cHTczfA.exe
  C:\Windows\System\cHTczfA.exe
  2⤵
  PID:3288
- C:\Windows\System\FnHiMDJ.exe
  C:\Windows\System\FnHiMDJ.exe
  2⤵
  PID:6212
- C:\Windows\System\CiyejBL.exe
  C:\Windows\System\CiyejBL.exe
  2⤵
  PID:6280
- C:\Windows\System\IexkOcI.exe
  C:\Windows\System\IexkOcI.exe
  2⤵
  PID:6292
- C:\Windows\System\DPzBBoc.exe
  C:\Windows\System\DPzBBoc.exe
  2⤵
  PID:6356
- C:\Windows\System\FRotsWU.exe
  C:\Windows\System\FRotsWU.exe
  2⤵
  PID:6452
- C:\Windows\System\ylNAOtj.exe
  C:\Windows\System\ylNAOtj.exe
  2⤵
  PID:6440
- C:\Windows\System\KGcChZl.exe
  C:\Windows\System\KGcChZl.exe
  2⤵
  PID:5556
- C:\Windows\System\sMnJFrJ.exe
  C:\Windows\System\sMnJFrJ.exe
  2⤵
  PID:6616
- C:\Windows\System\WFMrGwI.exe
  C:\Windows\System\WFMrGwI.exe
  2⤵
  PID:6724
- C:\Windows\System\nULRobU.exe
  C:\Windows\System\nULRobU.exe
  2⤵
  PID:6760
- C:\Windows\System\kPwtXeV.exe
  C:\Windows\System\kPwtXeV.exe
  2⤵
  PID:6740
- C:\Windows\System\RQZvuuN.exe
  C:\Windows\System\RQZvuuN.exe
  2⤵
  PID:6820
- C:\Windows\System\JbuyzIx.exe
  C:\Windows\System\JbuyzIx.exe
  2⤵
  PID:6852
- C:\Windows\System\iGFDmtp.exe
  C:\Windows\System\iGFDmtp.exe
  2⤵
  PID:6920
- C:\Windows\System\DuJKxpT.exe
  C:\Windows\System\DuJKxpT.exe
  2⤵
  PID:7012
- C:\Windows\System\QIsUSPB.exe
  C:\Windows\System\QIsUSPB.exe
  2⤵
  PID:7048
- C:\Windows\System\ngvJRFn.exe
  C:\Windows\System\ngvJRFn.exe
  2⤵
  PID:7096
- C:\Windows\System\gkGhzNj.exe
  C:\Windows\System\gkGhzNj.exe
  2⤵
  PID:7160
- C:\Windows\System\vjWXEhu.exe
  C:\Windows\System\vjWXEhu.exe
  2⤵
  PID:5748
- C:\Windows\System\yRQOhxj.exe
  C:\Windows\System\yRQOhxj.exe
  2⤵
  PID:6004
- C:\Windows\System\cbSwmld.exe
  C:\Windows\System\cbSwmld.exe
  2⤵
  PID:5860
- C:\Windows\System\WMFXWfA.exe
  C:\Windows\System\WMFXWfA.exe
  2⤵
  PID:4912
- C:\Windows\System\WcjGFOX.exe
  C:\Windows\System\WcjGFOX.exe
  2⤵
  PID:6148
- C:\Windows\System\JEoVnps.exe
  C:\Windows\System\JEoVnps.exe
  2⤵
  PID:7172
- C:\Windows\System\WkUHUER.exe
  C:\Windows\System\WkUHUER.exe
  2⤵
  PID:7188
- C:\Windows\System\dXjDasf.exe
  C:\Windows\System\dXjDasf.exe
  2⤵
  PID:7204
- C:\Windows\System\bwwKslS.exe
  C:\Windows\System\bwwKslS.exe
  2⤵
  PID:7220
- C:\Windows\System\VzPLwqG.exe
  C:\Windows\System\VzPLwqG.exe
  2⤵
  PID:7236
- C:\Windows\System\lLAWWAZ.exe
  C:\Windows\System\lLAWWAZ.exe
  2⤵
  PID:7252
- C:\Windows\System\WlFgxcw.exe
  C:\Windows\System\WlFgxcw.exe
  2⤵
  PID:7268
- C:\Windows\System\vNgvNsA.exe
  C:\Windows\System\vNgvNsA.exe
  2⤵
  PID:7284
- C:\Windows\System\xeDxMhn.exe
  C:\Windows\System\xeDxMhn.exe
  2⤵
  PID:7300
- C:\Windows\System\afymrop.exe
  C:\Windows\System\afymrop.exe
  2⤵
  PID:7316
- C:\Windows\System\ohgTXLl.exe
  C:\Windows\System\ohgTXLl.exe
  2⤵
  PID:7332
- C:\Windows\System\LOBSphM.exe
  C:\Windows\System\LOBSphM.exe
  2⤵
  PID:7348
- C:\Windows\System\lKNLYAm.exe
  C:\Windows\System\lKNLYAm.exe
  2⤵
  PID:7364
- C:\Windows\System\hqKRRlL.exe
  C:\Windows\System\hqKRRlL.exe
  2⤵
  PID:7380
- C:\Windows\System\iKaCHwK.exe
  C:\Windows\System\iKaCHwK.exe
  2⤵
  PID:7396
- C:\Windows\System\DqKErvF.exe
  C:\Windows\System\DqKErvF.exe
  2⤵
  PID:7412
- C:\Windows\System\EcKfMQG.exe
  C:\Windows\System\EcKfMQG.exe
  2⤵
  PID:7428
- C:\Windows\System\JvejuOC.exe
  C:\Windows\System\JvejuOC.exe
  2⤵
  PID:7444
- C:\Windows\System\eghRSzo.exe
  C:\Windows\System\eghRSzo.exe
  2⤵
  PID:7460
- C:\Windows\System\EABuGve.exe
  C:\Windows\System\EABuGve.exe
  2⤵
  PID:7476
- C:\Windows\System\OSQYRsS.exe
  C:\Windows\System\OSQYRsS.exe
  2⤵
  PID:7492
- C:\Windows\System\BAiStTX.exe
  C:\Windows\System\BAiStTX.exe
  2⤵
  PID:7508
- C:\Windows\System\BYfPgYT.exe
  C:\Windows\System\BYfPgYT.exe
  2⤵
  PID:7524
- C:\Windows\System\oujmgrd.exe
  C:\Windows\System\oujmgrd.exe
  2⤵
  PID:7540
- C:\Windows\System\lUIHqkU.exe
  C:\Windows\System\lUIHqkU.exe
  2⤵
  PID:7556
- C:\Windows\System\vvIEcSZ.exe
  C:\Windows\System\vvIEcSZ.exe
  2⤵
  PID:7572
- C:\Windows\System\bFyGKCu.exe
  C:\Windows\System\bFyGKCu.exe
  2⤵
  PID:7592
- C:\Windows\System\OGlbqfZ.exe
  C:\Windows\System\OGlbqfZ.exe
  2⤵
  PID:7608
- C:\Windows\System\EDPBuoz.exe
  C:\Windows\System\EDPBuoz.exe
  2⤵
  PID:7624
- C:\Windows\System\EsxmEhR.exe
  C:\Windows\System\EsxmEhR.exe
  2⤵
  PID:7640
- C:\Windows\System\eBMqxfG.exe
  C:\Windows\System\eBMqxfG.exe
  2⤵
  PID:7656
- C:\Windows\System\qeNRIQv.exe
  C:\Windows\System\qeNRIQv.exe
  2⤵
  PID:7672
- C:\Windows\System\bUujSgh.exe
  C:\Windows\System\bUujSgh.exe
  2⤵
  PID:7688
- C:\Windows\System\YXTJkod.exe
  C:\Windows\System\YXTJkod.exe
  2⤵
  PID:7704
- C:\Windows\System\YfnBqhU.exe
  C:\Windows\System\YfnBqhU.exe
  2⤵
  PID:7720
- C:\Windows\System\ORTnsjt.exe
  C:\Windows\System\ORTnsjt.exe
  2⤵
  PID:7736
- C:\Windows\System\sUdJwEH.exe
  C:\Windows\System\sUdJwEH.exe
  2⤵
  PID:7752
- C:\Windows\System\KkVPvTe.exe
  C:\Windows\System\KkVPvTe.exe
  2⤵
  PID:7768
- C:\Windows\System\eMMcXEO.exe
  C:\Windows\System\eMMcXEO.exe
  2⤵
  PID:7784
- C:\Windows\System\EeRTpZO.exe
  C:\Windows\System\EeRTpZO.exe
  2⤵
  PID:7800
- C:\Windows\System\YIwWwNi.exe
  C:\Windows\System\YIwWwNi.exe
  2⤵
  PID:7816
- C:\Windows\System\YRogyOH.exe
  C:\Windows\System\YRogyOH.exe
  2⤵
  PID:7832
- C:\Windows\System\ebwXciN.exe
  C:\Windows\System\ebwXciN.exe
  2⤵
  PID:7848
- C:\Windows\System\gyniGhz.exe
  C:\Windows\System\gyniGhz.exe
  2⤵
  PID:7864
- C:\Windows\System\wPrMFvR.exe
  C:\Windows\System\wPrMFvR.exe
  2⤵
  PID:7880
- C:\Windows\System\XzMIZYb.exe
  C:\Windows\System\XzMIZYb.exe
  2⤵
  PID:7896
- C:\Windows\System\ZDmlwBu.exe
  C:\Windows\System\ZDmlwBu.exe
  2⤵
  PID:7912
- C:\Windows\System\fEBNkZu.exe
  C:\Windows\System\fEBNkZu.exe
  2⤵
  PID:7928
- C:\Windows\System\oQVfUpx.exe
  C:\Windows\System\oQVfUpx.exe
  2⤵
  PID:7944
- C:\Windows\System\wmVlFra.exe
  C:\Windows\System\wmVlFra.exe
  2⤵
  PID:7960
- C:\Windows\System\szQXgnN.exe
  C:\Windows\System\szQXgnN.exe
  2⤵
  PID:7976
- C:\Windows\System\beeQETQ.exe
  C:\Windows\System\beeQETQ.exe
  2⤵
  PID:7992
- C:\Windows\System\hfXgoEI.exe
  C:\Windows\System\hfXgoEI.exe
  2⤵
  PID:8008
- C:\Windows\System\LjlwJuW.exe
  C:\Windows\System\LjlwJuW.exe
  2⤵
  PID:8024
- C:\Windows\System\pONJAkA.exe
  C:\Windows\System\pONJAkA.exe
  2⤵
  PID:8040
- C:\Windows\System\FVJivUA.exe
  C:\Windows\System\FVJivUA.exe
  2⤵
  PID:8056
- C:\Windows\System\DDRXLNZ.exe
  C:\Windows\System\DDRXLNZ.exe
  2⤵
  PID:8072
- C:\Windows\System\yntsvPn.exe
  C:\Windows\System\yntsvPn.exe
  2⤵
  PID:8088
- C:\Windows\System\knBgvnO.exe
  C:\Windows\System\knBgvnO.exe
  2⤵
  PID:8104
- C:\Windows\System\GTMZrou.exe
  C:\Windows\System\GTMZrou.exe
  2⤵
  PID:8120
- C:\Windows\System\WIgMVxx.exe
  C:\Windows\System\WIgMVxx.exe
  2⤵
  PID:8136
- C:\Windows\System\cuKthQA.exe
  C:\Windows\System\cuKthQA.exe
  2⤵
  PID:8152
- C:\Windows\System\nZwQqAb.exe
  C:\Windows\System\nZwQqAb.exe
  2⤵
  PID:8168
- C:\Windows\System\ftBgFIi.exe
  C:\Windows\System\ftBgFIi.exe
  2⤵
  PID:8184
- C:\Windows\System\KiUNoQa.exe
  C:\Windows\System\KiUNoQa.exe
  2⤵
  PID:1964
- C:\Windows\System\osBWaqU.exe
  C:\Windows\System\osBWaqU.exe
  2⤵
  PID:6340
- C:\Windows\System\IXYbIEY.exe
  C:\Windows\System\IXYbIEY.exe
  2⤵
  PID:2788
- C:\Windows\System\esHKxKj.exe
  C:\Windows\System\esHKxKj.exe
  2⤵
  PID:6456
- C:\Windows\System\VhmIeiL.exe
  C:\Windows\System\VhmIeiL.exe
  2⤵
  PID:6664
- C:\Windows\System\rAcsKMK.exe
  C:\Windows\System\rAcsKMK.exe
  2⤵
  PID:6776
- C:\Windows\System\lAPNpwp.exe
  C:\Windows\System\lAPNpwp.exe
  2⤵
  PID:6868
- C:\Windows\System\mlysYKH.exe
  C:\Windows\System\mlysYKH.exe
  2⤵
  PID:6996
- C:\Windows\System\hjsvDEe.exe
  C:\Windows\System\hjsvDEe.exe
  2⤵
  PID:7108
- C:\Windows\System\zRjknQI.exe
  C:\Windows\System\zRjknQI.exe
  2⤵
  PID:1324
- C:\Windows\System\JpynhgG.exe
  C:\Windows\System\JpynhgG.exe
  2⤵
  PID:5480
- C:\Windows\System\jQkiBJW.exe
  C:\Windows\System\jQkiBJW.exe
  2⤵
  PID:5864
- C:\Windows\System\ueMylPn.exe
  C:\Windows\System\ueMylPn.exe
  2⤵
  PID:4528
- C:\Windows\System\ZpXyFFk.exe
  C:\Windows\System\ZpXyFFk.exe
  2⤵
  PID:7184
- C:\Windows\System\mseEvJS.exe
  C:\Windows\System\mseEvJS.exe
  2⤵
  PID:7216
- C:\Windows\System\ixQkptc.exe
  C:\Windows\System\ixQkptc.exe
  2⤵
  PID:2908
- C:\Windows\System\rWVMMJJ.exe
  C:\Windows\System\rWVMMJJ.exe
  2⤵
  PID:7260
- C:\Windows\System\HGpcRco.exe
  C:\Windows\System\HGpcRco.exe
  2⤵
  PID:7248
- C:\Windows\System\iUkclNP.exe
  C:\Windows\System\iUkclNP.exe
  2⤵
  PID:7280
- C:\Windows\System\NrPCVND.exe
  C:\Windows\System\NrPCVND.exe
  2⤵
  PID:7312
- C:\Windows\System\gKLXSYn.exe
  C:\Windows\System\gKLXSYn.exe
  2⤵
  PID:7340
- C:\Windows\System\PbvLUgB.exe
  C:\Windows\System\PbvLUgB.exe
  2⤵
  PID:7372
- C:\Windows\System\afiUTOQ.exe
  C:\Windows\System\afiUTOQ.exe
  2⤵
  PID:7404
- C:\Windows\System\GUaWrHq.exe
  C:\Windows\System\GUaWrHq.exe
  2⤵
  PID:7436
- C:\Windows\System\JHpKNTI.exe
  C:\Windows\System\JHpKNTI.exe
  2⤵
  PID:7456
- C:\Windows\System\USqLAip.exe
  C:\Windows\System\USqLAip.exe
  2⤵
  PID:7488
- C:\Windows\System\zbUJEgB.exe
  C:\Windows\System\zbUJEgB.exe
  2⤵
  PID:7520
- C:\Windows\System\MMwgFSQ.exe
  C:\Windows\System\MMwgFSQ.exe
  2⤵
  PID:2664
- C:\Windows\System\BVjbkQU.exe
  C:\Windows\System\BVjbkQU.exe
  2⤵
  PID:7568
- C:\Windows\System\iVasfma.exe
  C:\Windows\System\iVasfma.exe
  2⤵
  PID:7616
- C:\Windows\System\AmjUDZu.exe
  C:\Windows\System\AmjUDZu.exe
  2⤵
  PID:3012
- C:\Windows\System\BNMNzgQ.exe
  C:\Windows\System\BNMNzgQ.exe
  2⤵
  PID:7636
- C:\Windows\System\DMgGHpW.exe
  C:\Windows\System\DMgGHpW.exe
  2⤵
  PID:2368
- C:\Windows\System\FJWeHIz.exe
  C:\Windows\System\FJWeHIz.exe
  2⤵
  PID:7668
- C:\Windows\System\SIVyofD.exe
  C:\Windows\System\SIVyofD.exe
  2⤵
  PID:7716
- C:\Windows\System\yhREQVL.exe
  C:\Windows\System\yhREQVL.exe
  2⤵
  PID:7748
- C:\Windows\System\PnJXqSm.exe
  C:\Windows\System\PnJXqSm.exe
  2⤵
  PID:7780
- C:\Windows\System\tzNhhQD.exe
  C:\Windows\System\tzNhhQD.exe
  2⤵
  PID:7792
- C:\Windows\System\IhAPjwi.exe
  C:\Windows\System\IhAPjwi.exe
  2⤵
  PID:1908
- C:\Windows\System\vpGrqHJ.exe
  C:\Windows\System\vpGrqHJ.exe
  2⤵
  PID:7856
- C:\Windows\System\GeoZlOK.exe
  C:\Windows\System\GeoZlOK.exe
  2⤵
  PID:7904
- C:\Windows\System\nnMiBrQ.exe
  C:\Windows\System\nnMiBrQ.exe
  2⤵
  PID:2936
- C:\Windows\System\wWUKzMK.exe
  C:\Windows\System\wWUKzMK.exe
  2⤵
  PID:8000
- C:\Windows\System\TOlGTQs.exe
  C:\Windows\System\TOlGTQs.exe
  2⤵
  PID:7920
- C:\Windows\System\eGgiweF.exe
  C:\Windows\System\eGgiweF.exe
  2⤵
  PID:7984
- C:\Windows\System\WfamkDG.exe
  C:\Windows\System\WfamkDG.exe
  2⤵
  PID:8036
- C:\Windows\System\bhCUJLu.exe
  C:\Windows\System\bhCUJLu.exe
  2⤵
  PID:8096
- C:\Windows\System\xIbSZKH.exe
  C:\Windows\System\xIbSZKH.exe
  2⤵
  PID:8100
- C:\Windows\System\nomasxu.exe
  C:\Windows\System\nomasxu.exe
  2⤵
  PID:2276
- C:\Windows\System\unVQJYL.exe
  C:\Windows\System\unVQJYL.exe
  2⤵
  PID:2336
- C:\Windows\System\yXkEOPm.exe
  C:\Windows\System\yXkEOPm.exe
  2⤵
  PID:6196
- C:\Windows\System\lpnoVOd.exe
  C:\Windows\System\lpnoVOd.exe
  2⤵
  PID:8148
- C:\Windows\System\mjPENyL.exe
  C:\Windows\System\mjPENyL.exe
  2⤵
  PID:2752
- C:\Windows\System\dtZUSbr.exe
  C:\Windows\System\dtZUSbr.exe
  2⤵
  PID:2692
- C:\Windows\System\STJdkGg.exe
  C:\Windows\System\STJdkGg.exe
  2⤵
  PID:6388
- C:\Windows\System\bXvZrLF.exe
  C:\Windows\System\bXvZrLF.exe
  2⤵
  PID:1156
- C:\Windows\System\cVvXkxK.exe
  C:\Windows\System\cVvXkxK.exe
  2⤵
  PID:6856
- C:\Windows\System\QqDUxrF.exe
  C:\Windows\System\QqDUxrF.exe
  2⤵
  PID:2228
- C:\Windows\System\llqjWyo.exe
  C:\Windows\System\llqjWyo.exe
  2⤵
  PID:2836
- C:\Windows\System\nbmZrSI.exe
  C:\Windows\System\nbmZrSI.exe
  2⤵
  PID:7276
- C:\Windows\System\jJyBXVS.exe
  C:\Windows\System\jJyBXVS.exe
  2⤵
  PID:2852
- C:\Windows\System\FMvtjOH.exe
  C:\Windows\System\FMvtjOH.exe
  2⤵
  PID:7356
- C:\Windows\System\epYOmzz.exe
  C:\Windows\System\epYOmzz.exe
  2⤵
  PID:2964
- C:\Windows\System\IxNaXPd.exe
  C:\Windows\System\IxNaXPd.exe
  2⤵
  PID:2016
- C:\Windows\System\xgvnYwq.exe
  C:\Windows\System\xgvnYwq.exe
  2⤵
  PID:2196
- C:\Windows\System\XRBOuph.exe
  C:\Windows\System\XRBOuph.exe
  2⤵
  PID:1816
- C:\Windows\System\NdXKKpF.exe
  C:\Windows\System\NdXKKpF.exe
  2⤵
  PID:7552
- C:\Windows\System\PgJAXge.exe
  C:\Windows\System\PgJAXge.exe
  2⤵
  PID:7652
- C:\Windows\System\GBrMrWs.exe
  C:\Windows\System\GBrMrWs.exe
  2⤵
  PID:7680
- C:\Windows\System\iufyodW.exe
  C:\Windows\System\iufyodW.exe
  2⤵
  PID:7844
- C:\Windows\System\HqBzpSs.exe
  C:\Windows\System\HqBzpSs.exe
  2⤵
  PID:4856
- C:\Windows\System\unikGIb.exe
  C:\Windows\System\unikGIb.exe
  2⤵
  PID:7956
- C:\Windows\System\lFoGqmH.exe
  C:\Windows\System\lFoGqmH.exe
  2⤵
  PID:6180
- C:\Windows\System\nHXTgOF.exe
  C:\Windows\System\nHXTgOF.exe
  2⤵
  PID:2124
- C:\Windows\System\jjgVyNP.exe
  C:\Windows\System\jjgVyNP.exe
  2⤵
  PID:7936
- C:\Windows\System\FPEoyDW.exe
  C:\Windows\System\FPEoyDW.exe
  2⤵
  PID:1096
- C:\Windows\System\sQYcqav.exe
  C:\Windows\System\sQYcqav.exe
  2⤵
  PID:8004
- C:\Windows\System\GLiuXyh.exe
  C:\Windows\System\GLiuXyh.exe
  2⤵
  PID:8128
- C:\Windows\System\iWOzvDT.exe
  C:\Windows\System\iWOzvDT.exe
  2⤵
  PID:6324
- C:\Windows\System\SibvOgD.exe
  C:\Windows\System\SibvOgD.exe
  2⤵
  PID:6600
- C:\Windows\System\RwAhQsB.exe
  C:\Windows\System\RwAhQsB.exe
  2⤵
  PID:7000
- C:\Windows\System\Yxvmprj.exe
  C:\Windows\System\Yxvmprj.exe
  2⤵
  PID:2084
- C:\Windows\System\mOEjnTC.exe
  C:\Windows\System\mOEjnTC.exe
  2⤵
  PID:2144
- C:\Windows\System\cSIrZlZ.exe
  C:\Windows\System\cSIrZlZ.exe
  2⤵
  PID:2780
- C:\Windows\System\PrvZehs.exe
  C:\Windows\System\PrvZehs.exe
  2⤵
  PID:2880
- C:\Windows\System\ZJqvvqJ.exe
  C:\Windows\System\ZJqvvqJ.exe
  2⤵
  PID:432
- C:\Windows\System\bZsKmLg.exe
  C:\Windows\System\bZsKmLg.exe
  2⤵
  PID:2732
- C:\Windows\System\BJyhdqS.exe
  C:\Windows\System\BJyhdqS.exe
  2⤵
  PID:7324
- C:\Windows\System\EqyfoIX.exe
  C:\Windows\System\EqyfoIX.exe
  2⤵
  PID:568
- C:\Windows\System\DtXMKzA.exe
  C:\Windows\System\DtXMKzA.exe
  2⤵
  PID:7516
- C:\Windows\System\IUzGwHn.exe
  C:\Windows\System\IUzGwHn.exe
  2⤵
  PID:7744
- C:\Windows\System\FvsLdeR.exe
  C:\Windows\System\FvsLdeR.exe
  2⤵
  PID:7840
- C:\Windows\System\exzPPQi.exe
  C:\Windows\System\exzPPQi.exe
  2⤵
  PID:2056
- C:\Windows\System\lMomYGr.exe
  C:\Windows\System\lMomYGr.exe
  2⤵
  PID:7664
- C:\Windows\System\BXGuRlm.exe
  C:\Windows\System\BXGuRlm.exe
  2⤵
  PID:7968
- C:\Windows\System\dpUcclh.exe
  C:\Windows\System\dpUcclh.exe
  2⤵
  PID:1752
- C:\Windows\System\FolewhZ.exe
  C:\Windows\System\FolewhZ.exe
  2⤵
  PID:2096
- C:\Windows\System\AIIZCLu.exe
  C:\Windows\System\AIIZCLu.exe
  2⤵
  PID:2232
- C:\Windows\System\BPEixVe.exe
  C:\Windows\System\BPEixVe.exe
  2⤵
  PID:2268
- C:\Windows\System\llvqksv.exe
  C:\Windows\System\llvqksv.exe
  2⤵
  PID:7732
- C:\Windows\System\HcXxapw.exe
  C:\Windows\System\HcXxapw.exe
  2⤵
  PID:556
- C:\Windows\System\IVSOppC.exe
  C:\Windows\System\IVSOppC.exe
  2⤵
  PID:7424
- C:\Windows\System\dJUbXBT.exe
  C:\Windows\System\dJUbXBT.exe
  2⤵
  PID:8196
- C:\Windows\System\ripnNFZ.exe
  C:\Windows\System\ripnNFZ.exe
  2⤵
  PID:8212
- C:\Windows\System\mUQxmsM.exe
  C:\Windows\System\mUQxmsM.exe
  2⤵
  PID:8228
- C:\Windows\System\flwCEae.exe
  C:\Windows\System\flwCEae.exe
  2⤵
  PID:8244
- C:\Windows\System\eDeRNZL.exe
  C:\Windows\System\eDeRNZL.exe
  2⤵
  PID:8260
- C:\Windows\System\IaKiMZj.exe
  C:\Windows\System\IaKiMZj.exe
  2⤵
  PID:8276
- C:\Windows\System\sTAbShm.exe
  C:\Windows\System\sTAbShm.exe
  2⤵
  PID:8292
- C:\Windows\System\GxaciVJ.exe
  C:\Windows\System\GxaciVJ.exe
  2⤵
  PID:8308
- C:\Windows\System\fLWDwmM.exe
  C:\Windows\System\fLWDwmM.exe
  2⤵
  PID:8324
- C:\Windows\System\fCTnJns.exe
  C:\Windows\System\fCTnJns.exe
  2⤵
  PID:8340
- C:\Windows\System\EdPeszN.exe
  C:\Windows\System\EdPeszN.exe
  2⤵
  PID:8356
- C:\Windows\System\BbVFCXx.exe
  C:\Windows\System\BbVFCXx.exe
  2⤵
  PID:8372
- C:\Windows\System\tSZwTkW.exe
  C:\Windows\System\tSZwTkW.exe
  2⤵
  PID:8388
- C:\Windows\System\CksBoLo.exe
  C:\Windows\System\CksBoLo.exe
  2⤵
  PID:8404
- C:\Windows\System\gWYUEYS.exe
  C:\Windows\System\gWYUEYS.exe
  2⤵
  PID:8420
- C:\Windows\System\oxWsCtE.exe
  C:\Windows\System\oxWsCtE.exe
  2⤵
  PID:8436
- C:\Windows\System\VLpNHev.exe
  C:\Windows\System\VLpNHev.exe
  2⤵
  PID:8452
- C:\Windows\System\GjOQqfF.exe
  C:\Windows\System\GjOQqfF.exe
  2⤵
  PID:8468
- C:\Windows\System\xcTISfp.exe
  C:\Windows\System\xcTISfp.exe
  2⤵
  PID:8484
- C:\Windows\System\xFsdJxE.exe
  C:\Windows\System\xFsdJxE.exe
  2⤵
  PID:8500
- C:\Windows\System\etUkMwV.exe
  C:\Windows\System\etUkMwV.exe
  2⤵
  PID:8516
- C:\Windows\System\LEHOnSH.exe
  C:\Windows\System\LEHOnSH.exe
  2⤵
  PID:8532
- C:\Windows\System\QAGZwlD.exe
  C:\Windows\System\QAGZwlD.exe
  2⤵
  PID:8548
- C:\Windows\System\fMXIAZh.exe
  C:\Windows\System\fMXIAZh.exe
  2⤵
  PID:8564
- C:\Windows\System\YaeZyMA.exe
  C:\Windows\System\YaeZyMA.exe
  2⤵
  PID:8580
- C:\Windows\System\reuyPaf.exe
  C:\Windows\System\reuyPaf.exe
  2⤵
  PID:8596
- C:\Windows\System\rOaxmzY.exe
  C:\Windows\System\rOaxmzY.exe
  2⤵
  PID:8612
- C:\Windows\System\eiFLtuH.exe
  C:\Windows\System\eiFLtuH.exe
  2⤵
  PID:8632
- C:\Windows\System\OOMcFFF.exe
  C:\Windows\System\OOMcFFF.exe
  2⤵
  PID:8648
- C:\Windows\System\XVbjile.exe
  C:\Windows\System\XVbjile.exe
  2⤵
  PID:8664
- C:\Windows\System\gYyHTKM.exe
  C:\Windows\System\gYyHTKM.exe
  2⤵
  PID:8680
- C:\Windows\System\yTfSSWZ.exe
  C:\Windows\System\yTfSSWZ.exe
  2⤵
  PID:8696
- C:\Windows\System\LJrBefA.exe
  C:\Windows\System\LJrBefA.exe
  2⤵
  PID:8712
- C:\Windows\System\GXUnPnm.exe
  C:\Windows\System\GXUnPnm.exe
  2⤵
  PID:8728
- C:\Windows\System\aPwryuR.exe
  C:\Windows\System\aPwryuR.exe
  2⤵
  PID:8744
- C:\Windows\System\RBbzJqA.exe
  C:\Windows\System\RBbzJqA.exe
  2⤵
  PID:8760
- C:\Windows\System\JXZUpfw.exe
  C:\Windows\System\JXZUpfw.exe
  2⤵
  PID:8776
- C:\Windows\System\utjjMsU.exe
  C:\Windows\System\utjjMsU.exe
  2⤵
  PID:8796
- C:\Windows\System\XnHRMZQ.exe
  C:\Windows\System\XnHRMZQ.exe
  2⤵
  PID:8812
- C:\Windows\System\IuqtAOJ.exe
  C:\Windows\System\IuqtAOJ.exe
  2⤵
  PID:8832
- C:\Windows\System\EHCzwwG.exe
  C:\Windows\System\EHCzwwG.exe
  2⤵
  PID:8848
- C:\Windows\System\jRImZeG.exe
  C:\Windows\System\jRImZeG.exe
  2⤵
  PID:8864
- C:\Windows\System\GurkdZn.exe
  C:\Windows\System\GurkdZn.exe
  2⤵
  PID:8888
- C:\Windows\System\PPFZqpI.exe
  C:\Windows\System\PPFZqpI.exe
  2⤵
  PID:8908
- C:\Windows\System\oJqpzBU.exe
  C:\Windows\System\oJqpzBU.exe
  2⤵
  PID:8924
- C:\Windows\System\OWZYOME.exe
  C:\Windows\System\OWZYOME.exe
  2⤵
  PID:8956
- C:\Windows\System\rjhmFtU.exe
  C:\Windows\System\rjhmFtU.exe
  2⤵
  PID:8976
- C:\Windows\System\YcOazwy.exe
  C:\Windows\System\YcOazwy.exe
  2⤵
  PID:9000
- C:\Windows\System\usVJjaV.exe
  C:\Windows\System\usVJjaV.exe
  2⤵
  PID:9020
- C:\Windows\System\QEYfBJu.exe
  C:\Windows\System\QEYfBJu.exe
  2⤵
  PID:9040
- C:\Windows\System\yhLxJTq.exe
  C:\Windows\System\yhLxJTq.exe
  2⤵
  PID:9056
- C:\Windows\System\hoYWbqA.exe
  C:\Windows\System\hoYWbqA.exe
  2⤵
  PID:9072
- C:\Windows\System\ePgDXmQ.exe
  C:\Windows\System\ePgDXmQ.exe
  2⤵
  PID:9088
- C:\Windows\System\JtbSGpD.exe
  C:\Windows\System\JtbSGpD.exe
  2⤵
  PID:9132
- C:\Windows\System\TDubeUH.exe
  C:\Windows\System\TDubeUH.exe
  2⤵
  PID:9160
- C:\Windows\System\BtgPYXr.exe
  C:\Windows\System\BtgPYXr.exe
  2⤵
  PID:9176
- C:\Windows\System\MUlVRIF.exe
  C:\Windows\System\MUlVRIF.exe
  2⤵
  PID:9196
- C:\Windows\System\NoySMeh.exe
  C:\Windows\System\NoySMeh.exe
  2⤵
  PID:9212
- C:\Windows\System\OEyMumd.exe
  C:\Windows\System\OEyMumd.exe
  2⤵
  PID:8240
- C:\Windows\System\mHVkibn.exe
  C:\Windows\System\mHVkibn.exe
  2⤵
  PID:8252
- C:\Windows\System\wtyqEUI.exe
  C:\Windows\System\wtyqEUI.exe
  2⤵
  PID:8364
- C:\Windows\System\yShRpeY.exe
  C:\Windows\System\yShRpeY.exe
  2⤵
  PID:8428
- C:\Windows\System\zgbmRDP.exe
  C:\Windows\System\zgbmRDP.exe
  2⤵
  PID:7468
- C:\Windows\System\ZRJGTGS.exe
  C:\Windows\System\ZRJGTGS.exe
  2⤵
  PID:7712
- C:\Windows\System\huTtpYn.exe
  C:\Windows\System\huTtpYn.exe
  2⤵
  PID:7764
- C:\Windows\System\beGuDog.exe
  C:\Windows\System\beGuDog.exe
  2⤵
  PID:7876
- C:\Windows\System\dSHutdP.exe
  C:\Windows\System\dSHutdP.exe
  2⤵
  PID:6804
- C:\Windows\System\PDYrsrp.exe
  C:\Windows\System\PDYrsrp.exe
  2⤵
  PID:7124
- C:\Windows\System\dDpyurr.exe
  C:\Windows\System\dDpyurr.exe
  2⤵
  PID:8144
- C:\Windows\System\AvnMKoQ.exe
  C:\Windows\System\AvnMKoQ.exe
  2⤵
  PID:8288
- C:\Windows\System\bupceYZ.exe
  C:\Windows\System\bupceYZ.exe
  2⤵
  PID:8528
- C:\Windows\System\qVrUfQr.exe
  C:\Windows\System\qVrUfQr.exe
  2⤵
  PID:8592
- C:\Windows\System\XgWAbgg.exe
  C:\Windows\System\XgWAbgg.exe
  2⤵
  PID:8620
- C:\Windows\System\OrErEDE.exe
  C:\Windows\System\OrErEDE.exe
  2⤵
  PID:8688
- C:\Windows\System\vtUYxvS.exe
  C:\Windows\System\vtUYxvS.exe
  2⤵
  PID:8572
- C:\Windows\System\AolTTbg.exe
  C:\Windows\System\AolTTbg.exe
  2⤵
  PID:8844
- C:\Windows\System\FbEkLgK.exe
  C:\Windows\System\FbEkLgK.exe
  2⤵
  PID:9032
- C:\Windows\System\tbFQjHR.exe
  C:\Windows\System\tbFQjHR.exe
  2⤵
  PID:8840
- C:\Windows\System\KDruVDY.exe
  C:\Windows\System\KDruVDY.exe
  2⤵
  PID:8876
- C:\Windows\System\HsSzEPE.exe
  C:\Windows\System\HsSzEPE.exe
  2⤵
  PID:9008
- C:\Windows\System\LMYjAMK.exe
  C:\Windows\System\LMYjAMK.exe
  2⤵
  PID:9012
- C:\Windows\System\ydfRcSV.exe
  C:\Windows\System\ydfRcSV.exe
  2⤵
  PID:9080
- C:\Windows\System\YzcvcoS.exe
  C:\Windows\System\YzcvcoS.exe
  2⤵
  PID:9108
- C:\Windows\System\UwJbxud.exe
  C:\Windows\System\UwJbxud.exe
  2⤵
  PID:9128
- C:\Windows\System\wPTIYTH.exe
  C:\Windows\System\wPTIYTH.exe
  2⤵
  PID:9148
- C:\Windows\System\eEMzEoI.exe
  C:\Windows\System\eEMzEoI.exe
  2⤵
  PID:9208
- C:\Windows\System\fKjFwZE.exe
  C:\Windows\System\fKjFwZE.exe
  2⤵
  PID:8400
- C:\Windows\System\RyjnLgL.exe
  C:\Windows\System\RyjnLgL.exe
  2⤵
  PID:8236
- C:\Windows\System\tntZkYI.exe
  C:\Windows\System\tntZkYI.exe
  2⤵
  PID:9188
- C:\Windows\System\BKtGPkh.exe
  C:\Windows\System\BKtGPkh.exe
  2⤵
  PID:8460
- C:\Windows\System\DZUxUwn.exe
  C:\Windows\System\DZUxUwn.exe
  2⤵
  PID:8052
- C:\Windows\System\nrcZeKv.exe
  C:\Windows\System\nrcZeKv.exe
  2⤵
  PID:7872
- C:\Windows\System\AMShYSJ.exe
  C:\Windows\System\AMShYSJ.exe
  2⤵
  PID:1244
- C:\Windows\System\KlZaxkc.exe
  C:\Windows\System\KlZaxkc.exe
  2⤵
  PID:1584
- C:\Windows\System\CQKhpzE.exe
  C:\Windows\System\CQKhpzE.exe
  2⤵
  PID:7604
- C:\Windows\System\DWAiVHM.exe
  C:\Windows\System\DWAiVHM.exe
  2⤵
  PID:532
- C:\Windows\System\WUsdsRz.exe
  C:\Windows\System\WUsdsRz.exe
  2⤵
  PID:2736
- C:\Windows\System\rObamVR.exe
  C:\Windows\System\rObamVR.exe
  2⤵
  PID:7620
- C:\Windows\System\rtzhGPB.exe
  C:\Windows\System\rtzhGPB.exe
  2⤵
  PID:8256
- C:\Windows\System\pjfJoct.exe
  C:\Windows\System\pjfJoct.exe
  2⤵
  PID:8524
- C:\Windows\System\gCvpzNE.exe
  C:\Windows\System\gCvpzNE.exe
  2⤵
  PID:8352
- C:\Windows\System\FISjqiT.exe
  C:\Windows\System\FISjqiT.exe
  2⤵
  PID:8384
- C:\Windows\System\CVSZKAH.exe
  C:\Windows\System\CVSZKAH.exe
  2⤵
  PID:8720
- C:\Windows\System\OjYTYXJ.exe
  C:\Windows\System\OjYTYXJ.exe
  2⤵
  PID:8176
- C:\Windows\System\EyRpGff.exe
  C:\Windows\System\EyRpGff.exe
  2⤵
  PID:8544
- C:\Windows\System\gHGfrJv.exe
  C:\Windows\System\gHGfrJv.exe
  2⤵
  PID:8756
- C:\Windows\System\VxqMSxm.exe
  C:\Windows\System\VxqMSxm.exe
  2⤵
  PID:8828
- C:\Windows\System\BqOuExi.exe
  C:\Windows\System\BqOuExi.exe
  2⤵
  PID:8896
- C:\Windows\System\FriZWky.exe
  C:\Windows\System\FriZWky.exe
  2⤵
  PID:8900
- C:\Windows\System\qlZsvcG.exe
  C:\Windows\System\qlZsvcG.exe
  2⤵
  PID:8940
- C:\Windows\System\cFhaKWY.exe
  C:\Windows\System\cFhaKWY.exe
  2⤵
  PID:8984
- C:\Windows\System\IJMVDKS.exe
  C:\Windows\System\IJMVDKS.exe
  2⤵
  PID:8676
- C:\Windows\System\HDulfLX.exe
  C:\Windows\System\HDulfLX.exe
  2⤵
  PID:8736
- C:\Windows\System\YRUwEBq.exe
  C:\Windows\System\YRUwEBq.exe
  2⤵
  PID:9036
- C:\Windows\System\akLLVpQ.exe
  C:\Windows\System\akLLVpQ.exe
  2⤵
  PID:9048
- C:\Windows\System\NkdoagG.exe
  C:\Windows\System\NkdoagG.exe
  2⤵
  PID:9120
- C:\Windows\System\cEKPMoJ.exe
  C:\Windows\System\cEKPMoJ.exe
  2⤵
  PID:9100
- C:\Windows\System\OMSuTmC.exe
  C:\Windows\System\OMSuTmC.exe
  2⤵
  PID:8208
- C:\Windows\System\WDySzIf.exe
  C:\Windows\System\WDySzIf.exe
  2⤵
  PID:8492
- C:\Windows\System\OEdHjsv.exe
  C:\Windows\System\OEdHjsv.exe
  2⤵
  PID:8968
- C:\Windows\System\zhLiwIJ.exe
  C:\Windows\System\zhLiwIJ.exe
  2⤵
  PID:8284
- C:\Windows\System\vhebXeF.exe
  C:\Windows\System\vhebXeF.exe
  2⤵
  PID:8380
- C:\Windows\System\eteOdeb.exe
  C:\Windows\System\eteOdeb.exe
  2⤵
  PID:2448
- C:\Windows\System\GKzNvuG.exe
  C:\Windows\System\GKzNvuG.exe
  2⤵
  PID:8628
- C:\Windows\System\IwVFFmW.exe
  C:\Windows\System\IwVFFmW.exe
  2⤵
  PID:8320
- C:\Windows\System\eGbWmqC.exe
  C:\Windows\System\eGbWmqC.exe
  2⤵
  PID:1688
- C:\Windows\System\bRUqDyI.exe
  C:\Windows\System\bRUqDyI.exe
  2⤵
  PID:7684
- C:\Windows\System\NLtFIrJ.exe
  C:\Windows\System\NLtFIrJ.exe
  2⤵
  PID:8608
- C:\Windows\System\vfGbjac.exe
  C:\Windows\System\vfGbjac.exe
  2⤵
  PID:8932
- C:\Windows\System\onwwQyq.exe
  C:\Windows\System\onwwQyq.exe
  2⤵
  PID:9096
- C:\Windows\System\jMaQXMk.exe
  C:\Windows\System\jMaQXMk.exe
  2⤵
  PID:8672
- C:\Windows\System\RxEBkaW.exe
  C:\Windows\System\RxEBkaW.exe
  2⤵
  PID:9116
- C:\Windows\System\kYSzlVz.exe
  C:\Windows\System\kYSzlVz.exe
  2⤵
  PID:7212
- C:\Windows\System\njMyoGm.exe
  C:\Windows\System\njMyoGm.exe
  2⤵
  PID:8348
- C:\Windows\System\rDArAkN.exe
  C:\Windows\System\rDArAkN.exe
  2⤵
  PID:9156
- C:\Windows\System\OMWQSnw.exe
  C:\Windows\System\OMWQSnw.exe
  2⤵
  PID:8808
- C:\Windows\System\QvtqnsJ.exe
  C:\Windows\System\QvtqnsJ.exe
  2⤵
  PID:9220
- C:\Windows\System\NtoihQI.exe
  C:\Windows\System\NtoihQI.exe
  2⤵
  PID:9236
- C:\Windows\System\eFUeLlE.exe
  C:\Windows\System\eFUeLlE.exe
  2⤵
  PID:9252
- C:\Windows\System\dqAidfx.exe
  C:\Windows\System\dqAidfx.exe
  2⤵
  PID:9268
- C:\Windows\System\BSMCttu.exe
  C:\Windows\System\BSMCttu.exe
  2⤵
  PID:9284
- C:\Windows\System\WfhDTon.exe
  C:\Windows\System\WfhDTon.exe
  2⤵
  PID:9300
- C:\Windows\System\JSsICNR.exe
  C:\Windows\System\JSsICNR.exe
  2⤵
  PID:9316
- C:\Windows\System\nsHZduw.exe
  C:\Windows\System\nsHZduw.exe
  2⤵
  PID:9332
- C:\Windows\System\gpDuNEM.exe
  C:\Windows\System\gpDuNEM.exe
  2⤵
  PID:9348
- C:\Windows\System\uRmukao.exe
  C:\Windows\System\uRmukao.exe
  2⤵
  PID:9368
- C:\Windows\System\xyYKreA.exe
  C:\Windows\System\xyYKreA.exe
  2⤵
  PID:9384
- C:\Windows\System\aTNqpgk.exe
  C:\Windows\System\aTNqpgk.exe
  2⤵
  PID:9400
- C:\Windows\System\OHZAXmT.exe
  C:\Windows\System\OHZAXmT.exe
  2⤵
  PID:9416
- C:\Windows\System\XRsKyAe.exe
  C:\Windows\System\XRsKyAe.exe
  2⤵
  PID:9432
- C:\Windows\System\xNHXXtd.exe
  C:\Windows\System\xNHXXtd.exe
  2⤵
  PID:9448
- C:\Windows\System\cmyYJXF.exe
  C:\Windows\System\cmyYJXF.exe
  2⤵
  PID:9464
- C:\Windows\System\pUfOetE.exe
  C:\Windows\System\pUfOetE.exe
  2⤵
  PID:9480
- C:\Windows\System\dYZRAPn.exe
  C:\Windows\System\dYZRAPn.exe
  2⤵
  PID:9496
- C:\Windows\System\mPXeHjD.exe
  C:\Windows\System\mPXeHjD.exe
  2⤵
  PID:9512
- C:\Windows\System\XAgMvfB.exe
  C:\Windows\System\XAgMvfB.exe
  2⤵
  PID:9528
- C:\Windows\System\qZuplaB.exe
  C:\Windows\System\qZuplaB.exe
  2⤵
  PID:9544
- C:\Windows\System\fdWfVpf.exe
  C:\Windows\System\fdWfVpf.exe
  2⤵
  PID:9560
- C:\Windows\System\RigTiXg.exe
  C:\Windows\System\RigTiXg.exe
  2⤵
  PID:9576
- C:\Windows\System\sXAUIwT.exe
  C:\Windows\System\sXAUIwT.exe
  2⤵
  PID:9596
- C:\Windows\System\DzNSOCe.exe
  C:\Windows\System\DzNSOCe.exe
  2⤵
  PID:9612
- C:\Windows\System\cGcvIIj.exe
  C:\Windows\System\cGcvIIj.exe
  2⤵
  PID:9628
- C:\Windows\System\uDuTYvH.exe
  C:\Windows\System\uDuTYvH.exe
  2⤵
  PID:9644
- C:\Windows\System\lmWfqcv.exe
  C:\Windows\System\lmWfqcv.exe
  2⤵
  PID:9660
- C:\Windows\System\cOjhUDU.exe
  C:\Windows\System\cOjhUDU.exe
  2⤵
  PID:9676
- C:\Windows\System\vaMZUvQ.exe
  C:\Windows\System\vaMZUvQ.exe
  2⤵
  PID:9692
- C:\Windows\System\idssCrD.exe
  C:\Windows\System\idssCrD.exe
  2⤵
  PID:9708
- C:\Windows\System\xDIwPMp.exe
  C:\Windows\System\xDIwPMp.exe
  2⤵
  PID:9724
- C:\Windows\System\jEcfcEp.exe
  C:\Windows\System\jEcfcEp.exe
  2⤵
  PID:9740
- C:\Windows\System\RWSMPst.exe
  C:\Windows\System\RWSMPst.exe
  2⤵
  PID:9756
- C:\Windows\System\GrgJwif.exe
  C:\Windows\System\GrgJwif.exe
  2⤵
  PID:9772
- C:\Windows\System\JKXvyjG.exe
  C:\Windows\System\JKXvyjG.exe
  2⤵
  PID:9788
- C:\Windows\System\okTNMXv.exe
  C:\Windows\System\okTNMXv.exe
  2⤵
  PID:9804
- C:\Windows\System\pwxcVXk.exe
  C:\Windows\System\pwxcVXk.exe
  2⤵
  PID:9820
- C:\Windows\System\hxrJNek.exe
  C:\Windows\System\hxrJNek.exe
  2⤵
  PID:9836
- C:\Windows\System\wRIeldC.exe
  C:\Windows\System\wRIeldC.exe
  2⤵
  PID:9852
- C:\Windows\System\TaPiFWb.exe
  C:\Windows\System\TaPiFWb.exe
  2⤵
  PID:9868
- C:\Windows\System\MgtUmJV.exe
  C:\Windows\System\MgtUmJV.exe
  2⤵
  PID:9884
- C:\Windows\System\xjDUHoL.exe
  C:\Windows\System\xjDUHoL.exe
  2⤵
  PID:9900
- C:\Windows\System\IjFcUop.exe
  C:\Windows\System\IjFcUop.exe
  2⤵
  PID:9916
- C:\Windows\System\TDSOhHS.exe
  C:\Windows\System\TDSOhHS.exe
  2⤵
  PID:9932
- C:\Windows\System\bnAgBRw.exe
  C:\Windows\System\bnAgBRw.exe
  2⤵
  PID:9948
- C:\Windows\System\ZyUADJA.exe
  C:\Windows\System\ZyUADJA.exe
  2⤵
  PID:9964
- C:\Windows\System\DtIiMBm.exe
  C:\Windows\System\DtIiMBm.exe
  2⤵
  PID:9980
- C:\Windows\System\vGlEYPO.exe
  C:\Windows\System\vGlEYPO.exe
  2⤵
  PID:9996
- C:\Windows\System\UoTcIns.exe
  C:\Windows\System\UoTcIns.exe
  2⤵
  PID:10012
- C:\Windows\System\ApShgUP.exe
  C:\Windows\System\ApShgUP.exe
  2⤵
  PID:10028
- C:\Windows\System\dljDsSz.exe
  C:\Windows\System\dljDsSz.exe
  2⤵
  PID:10044
- C:\Windows\System\FCJKORb.exe
  C:\Windows\System\FCJKORb.exe
  2⤵
  PID:10060
- C:\Windows\System\hzcfUoz.exe
  C:\Windows\System\hzcfUoz.exe
  2⤵
  PID:10076
- C:\Windows\System\xJTBrwi.exe
  C:\Windows\System\xJTBrwi.exe
  2⤵
  PID:10092
- C:\Windows\System\DvvgsIs.exe
  C:\Windows\System\DvvgsIs.exe
  2⤵
  PID:10108
- C:\Windows\System\sQNzttq.exe
  C:\Windows\System\sQNzttq.exe
  2⤵
  PID:10124
- C:\Windows\System\KPYZzxQ.exe
  C:\Windows\System\KPYZzxQ.exe
  2⤵
  PID:10140
- C:\Windows\System\sOVvXBb.exe
  C:\Windows\System\sOVvXBb.exe
  2⤵
  PID:10156
- C:\Windows\System\aInYlrJ.exe
  C:\Windows\System\aInYlrJ.exe
  2⤵
  PID:10176
- C:\Windows\System\ooZTDvr.exe
  C:\Windows\System\ooZTDvr.exe
  2⤵
  PID:10192
- C:\Windows\System\IMMqLxy.exe
  C:\Windows\System\IMMqLxy.exe
  2⤵
  PID:10208
- C:\Windows\System\bigmWfk.exe
  C:\Windows\System\bigmWfk.exe
  2⤵
  PID:10224
- C:\Windows\System\UtefAya.exe
  C:\Windows\System\UtefAya.exe
  2⤵
  PID:8768
- C:\Windows\System\VJolYHd.exe
  C:\Windows\System\VJolYHd.exe
  2⤵
  PID:9264
- C:\Windows\System\lGkBNxn.exe
  C:\Windows\System\lGkBNxn.exe
  2⤵
  PID:9328
- C:\Windows\System\DWQalSg.exe
  C:\Windows\System\DWQalSg.exe
  2⤵
  PID:8480
- C:\Windows\System\JDfmPQM.exe
  C:\Windows\System\JDfmPQM.exe
  2⤵
  PID:9424
- C:\Windows\System\ijGkCVx.exe
  C:\Windows\System\ijGkCVx.exe
  2⤵
  PID:9460
- C:\Windows\System\DihUPwC.exe
  C:\Windows\System\DihUPwC.exe
  2⤵
  PID:9524
- C:\Windows\System\IHKhQYn.exe
  C:\Windows\System\IHKhQYn.exe
  2⤵
  PID:8740
- C:\Windows\System\ozVCYME.exe
  C:\Windows\System\ozVCYME.exe
  2⤵
  PID:9624
- C:\Windows\System\YGeWzyX.exe
  C:\Windows\System\YGeWzyX.exe
  2⤵
  PID:9656
- C:\Windows\System\XfmufeU.exe
  C:\Windows\System\XfmufeU.exe
  2⤵
  PID:8708
- C:\Windows\System\hSvrHLk.exe
  C:\Windows\System\hSvrHLk.exe
  2⤵
  PID:9752
- C:\Windows\System\yblSzZk.exe
  C:\Windows\System\yblSzZk.exe
  2⤵
  PID:8336
- C:\Windows\System\JZECNdc.exe
  C:\Windows\System\JZECNdc.exe
  2⤵
  PID:9276
- C:\Windows\System\TWsDweb.exe
  C:\Windows\System\TWsDweb.exe
  2⤵
  PID:9408
- C:\Windows\System\QbfYMGt.exe
  C:\Windows\System\QbfYMGt.exe
  2⤵
  PID:8936
- C:\Windows\System\LcCxROi.exe
  C:\Windows\System\LcCxROi.exe
  2⤵
  PID:9700
- C:\Windows\System\XepwUBr.exe
  C:\Windows\System\XepwUBr.exe
  2⤵
  PID:2388
- C:\Windows\System\RIYLduU.exe
  C:\Windows\System\RIYLduU.exe
  2⤵
  PID:9308
- C:\Windows\System\oidUjgW.exe
  C:\Windows\System\oidUjgW.exe
  2⤵
  PID:9440
- C:\Windows\System\NhOQwbs.exe
  C:\Windows\System\NhOQwbs.exe
  2⤵
  PID:9508
- C:\Windows\System\NMfoAfo.exe
  C:\Windows\System\NMfoAfo.exe
  2⤵
  PID:9608
- C:\Windows\System\vKPhJMM.exe
  C:\Windows\System\vKPhJMM.exe
  2⤵
  PID:9764
- C:\Windows\System\hrIsGUn.exe
  C:\Windows\System\hrIsGUn.exe
  2⤵
  PID:9816
- C:\Windows\System\CmdyZme.exe
  C:\Windows\System\CmdyZme.exe
  2⤵
  PID:9876
- C:\Windows\System\MyxFJMI.exe
  C:\Windows\System\MyxFJMI.exe
  2⤵
  PID:9860
- C:\Windows\System\GRXINHV.exe
  C:\Windows\System\GRXINHV.exe
  2⤵
  PID:9924
- C:\Windows\System\gOsPFVK.exe
  C:\Windows\System\gOsPFVK.exe
  2⤵
  PID:9972
- C:\Windows\System\jEVraCO.exe
  C:\Windows\System\jEVraCO.exe
  2⤵
  PID:10004
- C:\Windows\System\YpgoXpz.exe
  C:\Windows\System\YpgoXpz.exe
  2⤵
  PID:10068
- C:\Windows\System\jRiboFv.exe
  C:\Windows\System\jRiboFv.exe
  2⤵
  PID:10052
- C:\Windows\System\CXfSoLq.exe
  C:\Windows\System\CXfSoLq.exe
  2⤵
  PID:10088
- C:\Windows\System\FJdpcZc.exe
  C:\Windows\System\FJdpcZc.exe
  2⤵
  PID:10132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AOIPFwY.exe

Filesize
3.5MB

MD5
039f3ff1b6c2b467c803aa156b1ec41d

SHA1
cc0cd1c4811fb18df44d62b9006664414cc0182c

SHA256
04e59da549aa2ba032a7ff9c0f3b71f3d02062f236c3cc9fdcbc5fb3f9114cf5

SHA512
2a048b643664dcc9b4743c73da1bea4fd649ec16b4cccde79f9c02425743eac083389ce6be463b8b0aabf5bb6fc3f9f1a904f4ce9063926a7ff360ceb4f85d3d

Download Submit
C:\Windows\system\BKEwxUe.exe

Filesize
3.5MB

MD5
6dd9dc2c034f75f66d0a51d9d5800892

SHA1
87a069568cbc410b147f5769c93d6f18f42efce7

SHA256
1e60883f928cdc865a1e08ea8bac67c2662f976b28e2e2fecbc506f6106fb724

SHA512
aab9ecab072f5d067ab6188dfc197d9471076dc83a098f887e769e0dfac7d373ea5b993cf84f60920059a06e9a83f5241b9769d449f5280742ff56dc83915bf6

Download Submit
C:\Windows\system\HemnYeu.exe

Filesize
3.5MB

MD5
68d95847c9dc0e4ecfd4cc9482fb5a07

SHA1
d1ed66b657cc6ea54dd65d40144fd987864212a2

SHA256
8d825b4c0fc225e631da91a09d6a6d1f8f5f1d0333d8324df7d0f5f20c4ec1f6

SHA512
131ca7166e58cf93327692ad465a19ed706a44e1699e60fdff31e7c049d5ef8b43dd225968ce6b104ace7a5835939781f73b79df26e0192aa7f7309ab0c8624a

Download Submit
C:\Windows\system\IPMXOjz.exe

Filesize
3.5MB

MD5
424a4b947b508922ca3b4e71d771f4ba

SHA1
064dc4b3b3a48288e806a9bd67623dabbb453d79

SHA256
5c021047e2fcdaf4fb8058f050f1bd0326e981c6bb4322dc49301a0e0692f7bf

SHA512
8230726eff962048b07c0286acf3f4b9e8d747703e939e54861c2cb03360df32a19393adadfcfef88a962bbae0b960d6245838abeaa3a18c820b8e95c161bffd

Download Submit
C:\Windows\system\JaRrsXw.exe

Filesize
3.5MB

MD5
e8614e271b7dfdda2835517af97e0c17

SHA1
1122c58d81cdd0ce8c3bf9f5188cc393f0f70327

SHA256
5a93e9a3b6c2f0e5629d32ef66ef5f9dc415f9dfa0bf76450b57a6cb5e5de78e

SHA512
0d671b1e9a0232b0994ea171e5b6a8506af4be78f35a9136c0acacc305cfcf149fa7cf905094b37cd7bfabb2cde92525460d25d8e15771015325d71a2336aeda

Download Submit
C:\Windows\system\LAtnPUd.exe

Filesize
3.5MB

MD5
0f50ceebf94c4c932c941ea2c9f2377e

SHA1
da3c544c503bc82c0b97961e356cdb6cc6bed4b3

SHA256
f173943393fdbca1fa84a294c1c883a68e866e09b4483232f9170c0d3e9c7597

SHA512
fd4fad2554a14accf51ed33dbc59422f54976e668ed965db0626fb6589e3378b36bd3d277ff1065b26bd45f053a10dc8801d79c9d3c7b96a378b0be13a043206

Download Submit
C:\Windows\system\LFzApio.exe

Filesize
3.5MB

MD5
7e91716707d7da7bd1aa485c73c428ca

SHA1
0a2ba24f76c0c0ec462bc4b353a1fef56998545a

SHA256
5c055ea42d1f474a84f07927a1fc1d8252a882eb09b47a3da63271c99c5a56ae

SHA512
eebb8c5983432f3fc8c22f9bade66ba2ddd7b8a103024fce9b9c0528ba1af6e6edfead9ef8c2b1c978950df0a5eb794c53a64d3792dc8649c133dcd65df231f0

Download Submit
C:\Windows\system\LpZwWXA.exe

Filesize
3.5MB

MD5
b61ad2e806fced6cf7850229d0dfe530

SHA1
8a3a073bebdc3d0d9cc92c52fb1edebab14be445

SHA256
b127550f584a4249ef4f28efcc0220bb03e644774dd466f9f60915273d33ff7a

SHA512
da3e2d8a79d674a4abafb26821a78844cc52d604cd16175d040a07cad92a020241faa7242b2aa7ba899c7fd1a0354fe7ad0760a059194a81786e49441c87fb49

Download Submit
C:\Windows\system\LwJRiJo.exe

Filesize
3.5MB

MD5
e0ac727fed5a213c729a96c127f56888

SHA1
5201b91d1c58cfa9bf60bb3aad96eb9654ea12be

SHA256
771a3f5062f1ac86453018487dd5e0ec6290d7bf905ca2c9004dabbebf62d3cd

SHA512
b6b05b550ffb4f230a601aeae45eccd940b355877060536140bc64220eaf0dbd98878aa43612645730e65efa89a6a8fb30c895ba8c1b446e74092745755456f9

Download Submit
C:\Windows\system\OMlNjrZ.exe

Filesize
3.5MB

MD5
9c6ad522272c3b84250364eea01d2a63

SHA1
30108742373cd1676d19aece3011e4c0a7aea2b0

SHA256
c08ec61783ededab05adee8731df1eb3a68bbe1df113d7310be9baebb0f6d2f0

SHA512
3b1ac5a849d40be827ce2fce7bbfa54fcbbd7014d347f2d262ac61647f64ab6b3fc5d7e1db09329f454c8f68e62eb4fcfd581423eeb1c543eb2ca2ad3a58ac5a

Download Submit
C:\Windows\system\REvURuq.exe

Filesize
3.5MB

MD5
7860f474aeb59e0a4b4c96c6dbbff9de

SHA1
6efff4f36c61988983c408074c788056fcb139d5

SHA256
c56796f00dbe1e6f777f8cc2f506927fecb8d8faf201905bfd454052fe7f294f

SHA512
b42983fad491ef80b4679f131d76803d04197efde14e2dbbc40f2bc81eed2132575a6399c96853c5939dbdfb3deb472dff7ecb852cc21481a72b99b0602ec76c

Download Submit
C:\Windows\system\RwZISgJ.exe

Filesize
3.5MB

MD5
1077ed7db8e56f0ce0f54124c939480c

SHA1
7fe6b5ad0887b8b489aa97d486f6e9c341c7000a

SHA256
48a587b45a356af24ca84f9cc6db3fa92a400268912df557e2f5f65603003177

SHA512
73c0f0829a3d466a2f333649e361e49ca3f778580980d7c9cc2fd5fb258684cadeeb281e14a2cd2ec939a84c116608ba228e4c950f4c98d91cf2c095b09cb502

Download Submit
C:\Windows\system\SbaLjGa.exe

Filesize
3.5MB

MD5
53d9cfda7245fbb45ad9b2fb23c79372

SHA1
ef41ffad5f8dbb69082065e6799242c51ec14890

SHA256
1ad94403f8b825b514dbdfd6295bdf639eba43f6b762bf526e3b5b45f9497182

SHA512
735721f2e62b78e649350485570c8c1e211abc376ff6dfed57db9d756a32c156ad12ccb5c5eed4f844aab93dd71c969dccbaa3f52fc9d6d4ec77e5cf11c796e4

Download Submit
C:\Windows\system\WLojMWJ.exe

Filesize
3.5MB

MD5
786d2febf13a8191704340f6f2ffb280

SHA1
304e22abe65d91799001bb6ccfe140c1a57bf72f

SHA256
7020f353e4ee7eff7fc9d310f2d36e9233af1ab763bda426b248545aa9a54558

SHA512
93421635ac881fa040b54492b928a2302628a8f479dc2131587b1ea2a02d408b40c7c93cd5080c992699242a52f3993e622ecf80d28001354edd649ab6214f39

Download Submit
C:\Windows\system\WTufDfn.exe

Filesize
3.5MB

MD5
d947481a1230463750c9b578e5d17279

SHA1
43e0dc247f539644f570ab381e95076761382fc0

SHA256
a19c8dfa55095704a6cd28f6472be9837e9c34bbc449e719ef67ec8c71aa4582

SHA512
4ec61d2a596e645bc38ea911e595804e04e30b78464119e50967f92e0185ac246da97f2cef8f2062f7fc8235b12ecd3432bc51aaf5af7a8f5aa2e34a1e2bff29

Download Submit
C:\Windows\system\WfvbzPk.exe

Filesize
3.5MB

MD5
c15a4de49b5bee000e8acfed9c79c6db

SHA1
89d592c90d255a15d8c4d415eec8abc53e4bad7d

SHA256
6c8d7275b039dc2d4012eff4e6bb891f81ecf7992004f7f1d577ee248fea840b

SHA512
ca8990f242d87f89a27646c1951d97a92ed0f669962583ba4bfa127da677387c9c37973746f709d243c8192398a4cd0cb5bf7eb0a7b28133097a50492031a853

Download Submit
C:\Windows\system\ZHdurPh.exe

Filesize
3.5MB

MD5
6bbcd5573161f09e51563f9d6ea24c7c

SHA1
fbc5db9ebc18d7e92ec527a30e7216f3c31debff

SHA256
eebd3012b784e2919d13074d764f8dbaebf6ad8dda53821665e4b9f1761962f8

SHA512
41a87e469439decfdb43e41deac28c4b830bee15b6cc181d4bb78fc5c3ea6c69db1390be5c6e27781a73dfa4abc2bbfebf6e94996ea5b6eead0664af8b39acea

Download Submit
C:\Windows\system\bsOdkDv.exe

Filesize
3.5MB

MD5
cc2f699572baff7c4c9210deed9ac970

SHA1
9baa602491039b8100c25394a14d8ad93b6c2031

SHA256
f8dfd35161756888addb2322fe3a5dd358d29f9f933aaf2783da4f874ac248c4

SHA512
49fadadfc730322dc3d27b0ac18515edff54e7ff892304cca18e7b3dd18a63b7fb285658f8cc70fcbd1e74b13f58597917650de8752fb812c02349a4c32d5683

Download Submit
C:\Windows\system\lSNzoRE.exe

Filesize
3.5MB

MD5
e039c5cebcfdc40b0571b8290aed3c64

SHA1
7f75ffabec2335680126e9b901ddf6ac79f3fd2e

SHA256
e69fc9dc61d301fb8664ea3b5a381da35d18b84049c65fa05c7f743cb91cff13

SHA512
77219b07f42e8660484cc12cf9d6d571c003c57d37393c83546cd8494286831228d3db5b88b24f3e8bafb7198580ac51cf85731c236a968ecdb02116d9e9f07c

Download Submit
C:\Windows\system\mlxODNS.exe

Filesize
3.5MB

MD5
5456567db8a17054c0e4dfd55e2fe0e7

SHA1
521d0da435a5aaec1621ab1c31b8b9916c67941b

SHA256
d3e05700b7072fac942e2ba8a77ac9804dbd0e9365231f1834b26e19f099a4c1

SHA512
694008544b8a50ea0c3fd9603406f71b8f651faa42d306c518f906cd35a12d2eafb1cd35aae8dd9c34f9f70644bf64865fdc5f448ddc962aaa116a116a75ad69

Download Submit
C:\Windows\system\nJbImfw.exe

Filesize
3.5MB

MD5
6712c487aeaef457f6c91cae8731757f

SHA1
b91c0bbfadd147c306f665e3bcf82133768be96e

SHA256
e67a3913547317b0cd2400d543eb0a98d6619dc0a0c6afd0edd881457ebea026

SHA512
be9f0f47f68209e9e1bc6eb6041cdf4c1c422999c2ff3812698893a4868756c3e43360fd1d17b6bea078b88061043b31bbf8c58a0c110d0de613a8bdeb897e6f

Download Submit
C:\Windows\system\pTDEaCw.exe

Filesize
3.5MB

MD5
ea5603ab930e0aa0804a885f074e5490

SHA1
a32eebe7d97fffdbcccc0ee3dffa841931f272c0

SHA256
81343ae52186dfb19a73a37ed2a6371e42c8fc163db9ae35807a23aa7e36d9c3

SHA512
f711342c8032fe9c285ae2b02c25da541b5f73f012024737080ecf74c4227c50f66fca3e8295545de1b727f0a7fc6d34cad415e37a920752cd76718a2fd1b216

Download Submit
C:\Windows\system\uOBAIiy.exe

Filesize
3.5MB

MD5
90beb02768cc8ac185b8ad3da283214a

SHA1
c771386bc5e2b21632562c6dd64cd0c65b6f1ec3

SHA256
c58f56c6a6064d3b7dbd9497345fc159a7f6b1adde862d5af30ce46300ed2dbf

SHA512
610921462286078127408750d79d22b4bc96dd0c8dfcc537c401048155076bd1bafc4e13b97c61ce597687e3839945a0efe87b0e28c7f9578cd4ce396c165e33

Download Submit
C:\Windows\system\yDjQlcI.exe

Filesize
3.5MB

MD5
4cef94d2c2259f9ef427e16f13eb3f91

SHA1
214d9cc45116d83a4f1b9bd8e1fbdcdabcb028f5

SHA256
c479bd303507136b1cf718dc5d0daa9285da5970bd79c6d15038cf85f37b1e76

SHA512
b669692cc9637fe8ced844d11b51dcb12e5692305fcbfc54c965c0a220045a7bbb5fadcf928a6c5b918210300660bc8eafa1a445215fcbe7a7f95db3a7c18576

Download Submit
C:\Windows\system\zELynGE.exe

Filesize
3.5MB

MD5
d927995ebd5a4583e2202e923619cb26

SHA1
30062337e8b7d16567e38bc994c8bdd2e8c17dcd

SHA256
ae5d7fb27d372906d5f414616ccbbd00d745dd3eab68dd0e6c08a868e25deac2

SHA512
09fb80e88041e52923387196e588f3895122ade67313a62143e4c561e89ccf3ed68e1ff7e45232fae04ad9be22d596264ee53b46522c4b9464ea09e6c1784655

Download Submit
C:\Windows\system\zFWdaCY.exe

Filesize
3.5MB

MD5
ec2cbd1bc1441e97a5f8de59158935c8

SHA1
afadf19fa7fd9141de1c9eff58d11c78ddce9b6b

SHA256
6a2f5f5bfb7cd70fd5f9e3e00e9dff558994f8c943068a55b8338533c97cca2b

SHA512
7a81fd812ff8a5a575b11b22777a6df746835304cf68587381332db0f9f0bf71f3826c40cd9287752cd392f7d428bec3a3daacdde21b3e4fd3754e7deaf5dabf

Download Submit
\Windows\system\PmTrrdx.exe

Filesize
3.5MB

MD5
96f0aca517584455286ba74d9c4d07c5

SHA1
e5f757f46652c92a72fa83c320763e961a594350

SHA256
dfd1459a313835c1d506c99f1f7c2c38bb8bf25ac7aaf37f3744f9339732436c

SHA512
530645dadbcac9d15d6022bc8b891664393a7eb7465e6409845e948a04dbb94cb42af74a8ee7832039c82e3f8ceeb7c8b412d09afd2759bb61f606ae8f343046

Download Submit
\Windows\system\RIowDOj.exe

Filesize
3.5MB

MD5
4337302310b312465a70d0e96578c371

SHA1
2da4407155ba8a6582994c2f99bd0396eaeeedd9

SHA256
8ea4960796f8ad48342552e4ecd03c2a45b143a245440e69647a5fc625f5dd9d

SHA512
f7618d7c4c5bf8fc25521c655b002e4f6ccac9aa9b27fb8aa4411f7887e4061872deefc1fbaf72b8150755a9862502f91914b43f4d57a48a2915c28b78481cb9

Download Submit
\Windows\system\WJyqGJO.exe

Filesize
3.5MB

MD5
7cd6d2227853cfc27979182a3fbdffe2

SHA1
7a95289ee24d620b69c5aa76d840bec6e6cf6ff3

SHA256
399c17c396cb8a598ee8d9099c9767ea4af2d330fc9969887b929750cd1ecb98

SHA512
53d7a8f6363c49be60eb12d95066f7a12b894a7df4cfc8b8e7ea6920de17b5a5c53a5cfba07b5bcd612bf7b11a5c2f5c0cc5fa9b4d8e28296926eb95ab423f87

Download Submit
\Windows\system\kHFAVGX.exe

Filesize
3.5MB

MD5
a211d0a780ba0b4d52f274ceb03971b6

SHA1
809ff853939949b6fc7a6d9e028dd7850799657e

SHA256
71b18deae95cd1d011641cb475b25169e4ddf1488ab20ee8756a7380ad0b37b0

SHA512
20b9a322a927a23152da945216bd04cf2fa9181562ca98e9f230a933c7c363110488821aa83ef9b2fda8880187b73ed91571b6798140fe1ab5f7ee4666c70dba

Download Submit
\Windows\system\tNwOwEp.exe

Filesize
3.5MB

MD5
850a90306a56dc4fc05f0382446becba

SHA1
51269dd7375d8f6b7b45c97ff74ff33d10986f0a

SHA256
78113359951f6139337d52c3a9760e02a78a33e5ecb0658c777c8ea61aaa58ef

SHA512
84ed77372c6cc6ada0e97c5457fac50d62242a27e125cf9db0b9014f119a37c830a356d234c8363c6337c397d236e410d4578e8a0980cd909d8bfab9a5840938

Download Submit
\Windows\system\uHutBdZ.exe

Filesize
3.5MB

MD5
926b7c756c7c4e5b6009fcbf4972a1d8

SHA1
951b8d374b44c84a83eb6bfa2d026ef14af425a8

SHA256
f5f99da010a7edea2231b340261628458a224c1d22c24ad1c7faf67f122c4702

SHA512
6a48f72115cab57d43064090a58ad426425092149134fd7618d7784bb36f3107fd1853ae2790f5ad8f741a92faf83fdd1af9af2436b977274d4744729817acc2

Download Submit
memory/1212-3866-0x000000013F460000-0x000000013F7B4000-memory.dmp

Filesize
3.3MB

Download
memory/1212-107-0x000000013F460000-0x000000013F7B4000-memory.dmp

Filesize
3.3MB

Download
memory/1212-68-0x000000013F460000-0x000000013F7B4000-memory.dmp

Filesize
3.3MB

Download
memory/1308-431-0x000000013F1C0000-0x000000013F514000-memory.dmp

Filesize
3.3MB

Download
memory/1308-3867-0x000000013F1C0000-0x000000013F514000-memory.dmp

Filesize
3.3MB

Download
memory/1308-86-0x000000013F1C0000-0x000000013F514000-memory.dmp

Filesize
3.3MB

Download
memory/1568-3767-0x000000013F380000-0x000000013F6D4000-memory.dmp

Filesize
3.3MB

Download
memory/1568-79-0x000000013F380000-0x000000013F6D4000-memory.dmp

Filesize
3.3MB

Download
memory/2364-69-0x000000013F050000-0x000000013F3A4000-memory.dmp

Filesize
3.3MB

Download
memory/2364-735-0x0000000002130000-0x0000000002484000-memory.dmp

Filesize
3.3MB

Download
memory/2364-93-0x0000000002130000-0x0000000002484000-memory.dmp

Filesize
3.3MB

Download
memory/2364-1042-0x000000013FB80000-0x000000013FED4000-memory.dmp

Filesize
3.3MB

Download
memory/2364-13-0x000000013F050000-0x000000013F3A4000-memory.dmp

Filesize
3.3MB

Download
memory/2364-20-0x000000013F2E0000-0x000000013F634000-memory.dmp

Filesize
3.3MB

Download
memory/2364-106-0x0000000002130000-0x0000000002484000-memory.dmp

Filesize
3.3MB

Download
memory/2364-29-0x0000000002130000-0x0000000002484000-memory.dmp

Filesize
3.3MB

Download
memory/2364-78-0x000000013F380000-0x000000013F6D4000-memory.dmp

Filesize
3.3MB

Download
memory/2364-38-0x000000013FCC0000-0x0000000140014000-memory.dmp

Filesize
3.3MB

Download
memory/2364-46-0x0000000002130000-0x0000000002484000-memory.dmp

Filesize
3.3MB

Download
memory/2364-48-0x000000013FE00000-0x0000000140154000-memory.dmp

Filesize
3.3MB

Download
memory/2364-67-0x0000000002130000-0x0000000002484000-memory.dmp

Filesize
3.3MB

Download
memory/2364-1-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/2364-0-0x000000013F790000-0x000000013FAE4000-memory.dmp

Filesize
3.3MB

Download
memory/2364-85-0x000000013F1C0000-0x000000013F514000-memory.dmp

Filesize
3.3MB

Download
memory/2364-430-0x000000013F1C0000-0x000000013F514000-memory.dmp

Filesize
3.3MB

Download
memory/2364-55-0x0000000002130000-0x0000000002484000-memory.dmp

Filesize
3.3MB

Download
memory/2364-61-0x000000013F790000-0x000000013FAE4000-memory.dmp

Filesize
3.3MB

Download
memory/2532-94-0x000000013F7D0000-0x000000013FB24000-memory.dmp

Filesize
3.3MB

Download
memory/2532-736-0x000000013F7D0000-0x000000013FB24000-memory.dmp

Filesize
3.3MB

Download
memory/2532-3759-0x000000013F7D0000-0x000000013FB24000-memory.dmp

Filesize
3.3MB

Download
memory/2556-52-0x000000013FC10000-0x000000013FF64000-memory.dmp

Filesize
3.3MB

Download
memory/2556-3765-0x000000013FC10000-0x000000013FF64000-memory.dmp

Filesize
3.3MB

Download
memory/2560-84-0x000000013F790000-0x000000013FAE4000-memory.dmp

Filesize
3.3MB

Download
memory/2560-3869-0x000000013F790000-0x000000013FAE4000-memory.dmp

Filesize
3.3MB

Download
memory/2580-62-0x000000013F610000-0x000000013F964000-memory.dmp

Filesize
3.3MB

Download
memory/2580-3804-0x000000013F610000-0x000000013F964000-memory.dmp

Filesize
3.3MB

Download
memory/2600-3805-0x000000013F880000-0x000000013FBD4000-memory.dmp

Filesize
3.3MB

Download
memory/2600-63-0x000000013F880000-0x000000013FBD4000-memory.dmp

Filesize
3.3MB

Download
memory/2676-3802-0x000000013F2E0000-0x000000013F634000-memory.dmp

Filesize
3.3MB

Download
memory/2676-80-0x000000013F2E0000-0x000000013F634000-memory.dmp

Filesize
3.3MB

Download
memory/2676-21-0x000000013F2E0000-0x000000013F634000-memory.dmp

Filesize
3.3MB

Download
memory/2696-3761-0x000000013F080000-0x000000013F3D4000-memory.dmp

Filesize
3.3MB

Download
memory/2696-8-0x000000013F080000-0x000000013F3D4000-memory.dmp

Filesize
3.3MB

Download
memory/2712-3762-0x000000013FCC0000-0x0000000140014000-memory.dmp

Filesize
3.3MB

Download
memory/2712-54-0x000000013FCC0000-0x0000000140014000-memory.dmp

Filesize
3.3MB

Download
memory/2724-56-0x000000013FE00000-0x0000000140154000-memory.dmp

Filesize
3.3MB

Download
memory/2724-3760-0x000000013FE00000-0x0000000140154000-memory.dmp

Filesize
3.3MB

Download
memory/2768-70-0x000000013F050000-0x000000013F3A4000-memory.dmp

Filesize
3.3MB

Download
memory/2768-3803-0x000000013F050000-0x000000013F3A4000-memory.dmp

Filesize
3.3MB

Download
memory/2768-15-0x000000013F050000-0x000000013F3A4000-memory.dmp

Filesize
3.3MB

Download
memory/3068-3865-0x000000013FB80000-0x000000013FED4000-memory.dmp

Filesize
3.3MB

Download
memory/3068-99-0x000000013FB80000-0x000000013FED4000-memory.dmp

Filesize
3.3MB

Download
memory/3068-1043-0x000000013FB80000-0x000000013FED4000-memory.dmp

Filesize
3.3MB

Download