xmrig | 1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
Size

2.6MB
MD5

db0c4527bf4fbd5aaf192f05d74f7c6e
SHA1

e60e6c005bde6ee086cde764de54cb491637d415
SHA256

1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065
SHA512

f8ae0054293c5b2b1c34e464b3081c6fe1b00ddd28935aa425b1967bde1cdbc7a67346b01b22add35d0231b2e3cf4890b43171165ed27dd59388ac30aa3316e0
SSDEEP

49152:EnCbL83y9FdfE0pZ0zCa4wI156uL3pgrCEdMKPFotsgEBr1:EniLf9FdfE0pZB156utgpPFotBEb

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/1632-0-0x000000013F810000-0x000000013FB64000-memory.dmp	xmrig
behavioral1/files/0x0007000000012116-6.dat	xmrig
behavioral1/files/0x00070000000186ee-10.dat	xmrig
behavioral1/files/0x00070000000186fd-14.dat	xmrig
behavioral1/files/0x000600000001873d-22.dat	xmrig
behavioral1/files/0x000600000001878f-30.dat	xmrig
behavioral1/files/0x00050000000195c5-41.dat	xmrig
behavioral1/files/0x0005000000019609-46.dat	xmrig
behavioral1/files/0x0005000000019613-65.dat	xmrig
behavioral1/files/0x00050000000196b1-115.dat	xmrig
behavioral1/memory/1348-678-0x000000013F0E0000-0x000000013F434000-memory.dmp	xmrig
behavioral1/memory/2804-676-0x000000013FC00000-0x000000013FF54000-memory.dmp	xmrig
behavioral1/memory/2968-674-0x000000013F030000-0x000000013F384000-memory.dmp	xmrig
behavioral1/memory/2776-672-0x000000013FB30000-0x000000013FE84000-memory.dmp	xmrig
behavioral1/memory/2920-670-0x000000013FCE0000-0x0000000140034000-memory.dmp	xmrig
behavioral1/memory/2780-668-0x000000013FCC0000-0x0000000140014000-memory.dmp	xmrig
behavioral1/memory/2728-666-0x000000013F270000-0x000000013F5C4000-memory.dmp	xmrig
behavioral1/memory/2392-664-0x000000013F760000-0x000000013FAB4000-memory.dmp	xmrig
behavioral1/memory/2100-662-0x000000013F810000-0x000000013FB64000-memory.dmp	xmrig
behavioral1/memory/1700-660-0x000000013FD70000-0x00000001400C4000-memory.dmp	xmrig
behavioral1/memory/2568-658-0x000000013F670000-0x000000013F9C4000-memory.dmp	xmrig
behavioral1/memory/2552-656-0x000000013F440000-0x000000013F794000-memory.dmp	xmrig
behavioral1/memory/2316-583-0x000000013F940000-0x000000013FC94000-memory.dmp	xmrig
behavioral1/memory/2300-561-0x000000013F640000-0x000000013F994000-memory.dmp	xmrig
behavioral1/files/0x0005000000019838-129.dat	xmrig
behavioral1/files/0x000500000001977d-117.dat	xmrig
behavioral1/files/0x0005000000019667-111.dat	xmrig
behavioral1/files/0x00050000000196af-109.dat	xmrig
behavioral1/files/0x0005000000019625-103.dat	xmrig
behavioral1/files/0x00050000000197f8-122.dat	xmrig
behavioral1/files/0x0005000000019622-98.dat	xmrig
behavioral1/files/0x000500000001961f-89.dat	xmrig
behavioral1/files/0x0005000000019623-101.dat	xmrig
behavioral1/files/0x0005000000019621-94.dat	xmrig
behavioral1/files/0x000500000001961d-86.dat	xmrig
behavioral1/files/0x000500000001961b-81.dat	xmrig
behavioral1/files/0x0005000000019619-78.dat	xmrig
behavioral1/files/0x0005000000019617-73.dat	xmrig
behavioral1/files/0x0005000000019615-70.dat	xmrig
behavioral1/files/0x0005000000019611-62.dat	xmrig
behavioral1/files/0x000500000001960f-57.dat	xmrig
behavioral1/files/0x000500000001960d-54.dat	xmrig
behavioral1/files/0x000500000001960b-49.dat	xmrig
behavioral1/files/0x000800000001925e-37.dat	xmrig
behavioral1/files/0x00060000000187a5-34.dat	xmrig
behavioral1/files/0x0006000000018784-25.dat	xmrig
behavioral1/files/0x0007000000018728-18.dat	xmrig
behavioral1/memory/1632-3695-0x000000013F810000-0x000000013FB64000-memory.dmp	xmrig
behavioral1/memory/2316-4127-0x000000013F940000-0x000000013FC94000-memory.dmp	xmrig
behavioral1/memory/2568-4128-0x000000013F670000-0x000000013F9C4000-memory.dmp	xmrig
behavioral1/memory/2100-4129-0x000000013F810000-0x000000013FB64000-memory.dmp	xmrig
behavioral1/memory/2728-4131-0x000000013F270000-0x000000013F5C4000-memory.dmp	xmrig
behavioral1/memory/2780-4132-0x000000013FCC0000-0x0000000140014000-memory.dmp	xmrig
behavioral1/memory/1348-4137-0x000000013F0E0000-0x000000013F434000-memory.dmp	xmrig
behavioral1/memory/2804-4136-0x000000013FC00000-0x000000013FF54000-memory.dmp	xmrig
behavioral1/memory/2968-4135-0x000000013F030000-0x000000013F384000-memory.dmp	xmrig
behavioral1/memory/2776-4134-0x000000013FB30000-0x000000013FE84000-memory.dmp	xmrig
behavioral1/memory/2920-4133-0x000000013FCE0000-0x0000000140034000-memory.dmp	xmrig
behavioral1/memory/2392-4130-0x000000013F760000-0x000000013FAB4000-memory.dmp	xmrig
behavioral1/memory/2300-4138-0x000000013F640000-0x000000013F994000-memory.dmp	xmrig
behavioral1/memory/2552-4139-0x000000013F440000-0x000000013F794000-memory.dmp	xmrig
behavioral1/memory/1700-4140-0x000000013FD70000-0x00000001400C4000-memory.dmp	xmrig
behavioral1/memory/2780-4141-0x000000013FCC0000-0x0000000140014000-memory.dmp	xmrig
behavioral1/memory/2776-4142-0x000000013FB30000-0x000000013FE84000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2300	zHSUGqz.exe
2316	VygxGBy.exe
2552	fwIYVUo.exe
2568	elgLNaQ.exe
1700	stwHdBJ.exe
2100	JIRjIqM.exe
2392	uvyqhVo.exe
2728	NczHlav.exe
2780	JiVYbQN.exe
2920	Gjqxeab.exe
2776	yXfSiHc.exe
2968	qPUfPuH.exe
2804	OkdVmHR.exe
1348	lAsyiih.exe
2644	yqxRVcR.exe
2796	eYAGmgI.exe
2420	WvzXxuv.exe
2652	eFjclBK.exe
2052	ZYSXAUy.exe
2932	GuzPVGX.exe
2332	NbdXrWI.exe
1092	RbbjGrS.exe
2028	PCRHsqj.exe
1684	DEvgXYW.exe
3008	ikdyqub.exe
3016	beEIsoA.exe
2000	LomJJZn.exe
1764	kHhhajs.exe
2312	aowpvpO.exe
768	VpIkhMY.exe
1328	WzGbifj.exe
2188	nbziLgY.exe
1936	BzbGpTS.exe
2380	QKDLPKZ.exe
2344	jkstVYv.exe
2152	hlEQYxo.exe
2140	zmvYUFk.exe
2104	boDnbUY.exe
2496	zLzuicy.exe
448	rBMwOgp.exe
496	YWSlnag.exe
2596	lPtHAqD.exe
2428	kDzBdkx.exe
292	sLRwccY.exe
856	iWMksxh.exe
1604	cNCLtaF.exe
1088	CYmOjxt.exe
2436	wKspnkN.exe
1144	JoFpXxu.exe
1556	PKCdWzI.exe
1660	cPQsgKy.exe
236	ioaaXyY.exe
912	uvJYOUK.exe
1528	zkPnfeL.exe
2136	ixRSjVe.exe
596	AuxvTYv.exe
1468	VVdsGxB.exe
1032	WaaOayg.exe
2964	msQPRAT.exe
1072	TiBKbso.exe
1172	ZnhPCIn.exe
2032	OoGuISU.exe
284	WlaiqdM.exe
1704	SYOhbcd.exe

Loads dropped DLL 64 IoCs

pid	Process
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1632-0-0x000000013F810000-0x000000013FB64000-memory.dmp	upx
behavioral1/files/0x0007000000012116-6.dat	upx
behavioral1/files/0x00070000000186ee-10.dat	upx
behavioral1/files/0x00070000000186fd-14.dat	upx
behavioral1/files/0x000600000001873d-22.dat	upx
behavioral1/files/0x000600000001878f-30.dat	upx
behavioral1/files/0x00050000000195c5-41.dat	upx
behavioral1/files/0x0005000000019609-46.dat	upx
behavioral1/files/0x0005000000019613-65.dat	upx
behavioral1/files/0x00050000000196b1-115.dat	upx
behavioral1/memory/1348-678-0x000000013F0E0000-0x000000013F434000-memory.dmp	upx
behavioral1/memory/2804-676-0x000000013FC00000-0x000000013FF54000-memory.dmp	upx
behavioral1/memory/2968-674-0x000000013F030000-0x000000013F384000-memory.dmp	upx
behavioral1/memory/2776-672-0x000000013FB30000-0x000000013FE84000-memory.dmp	upx
behavioral1/memory/2920-670-0x000000013FCE0000-0x0000000140034000-memory.dmp	upx
behavioral1/memory/2780-668-0x000000013FCC0000-0x0000000140014000-memory.dmp	upx
behavioral1/memory/2728-666-0x000000013F270000-0x000000013F5C4000-memory.dmp	upx
behavioral1/memory/2392-664-0x000000013F760000-0x000000013FAB4000-memory.dmp	upx
behavioral1/memory/2100-662-0x000000013F810000-0x000000013FB64000-memory.dmp	upx
behavioral1/memory/1700-660-0x000000013FD70000-0x00000001400C4000-memory.dmp	upx
behavioral1/memory/2568-658-0x000000013F670000-0x000000013F9C4000-memory.dmp	upx
behavioral1/memory/2552-656-0x000000013F440000-0x000000013F794000-memory.dmp	upx
behavioral1/memory/2316-583-0x000000013F940000-0x000000013FC94000-memory.dmp	upx
behavioral1/memory/2300-561-0x000000013F640000-0x000000013F994000-memory.dmp	upx
behavioral1/files/0x0005000000019838-129.dat	upx
behavioral1/files/0x000500000001977d-117.dat	upx
behavioral1/files/0x0005000000019667-111.dat	upx
behavioral1/files/0x00050000000196af-109.dat	upx
behavioral1/files/0x0005000000019625-103.dat	upx
behavioral1/files/0x00050000000197f8-122.dat	upx
behavioral1/files/0x0005000000019622-98.dat	upx
behavioral1/files/0x000500000001961f-89.dat	upx
behavioral1/files/0x0005000000019623-101.dat	upx
behavioral1/files/0x0005000000019621-94.dat	upx
behavioral1/files/0x000500000001961d-86.dat	upx
behavioral1/files/0x000500000001961b-81.dat	upx
behavioral1/files/0x0005000000019619-78.dat	upx
behavioral1/files/0x0005000000019617-73.dat	upx
behavioral1/files/0x0005000000019615-70.dat	upx
behavioral1/files/0x0005000000019611-62.dat	upx
behavioral1/files/0x000500000001960f-57.dat	upx
behavioral1/files/0x000500000001960d-54.dat	upx
behavioral1/files/0x000500000001960b-49.dat	upx
behavioral1/files/0x000800000001925e-37.dat	upx
behavioral1/files/0x00060000000187a5-34.dat	upx
behavioral1/files/0x0006000000018784-25.dat	upx
behavioral1/files/0x0007000000018728-18.dat	upx
behavioral1/memory/1632-3695-0x000000013F810000-0x000000013FB64000-memory.dmp	upx
behavioral1/memory/2316-4127-0x000000013F940000-0x000000013FC94000-memory.dmp	upx
behavioral1/memory/2568-4128-0x000000013F670000-0x000000013F9C4000-memory.dmp	upx
behavioral1/memory/2100-4129-0x000000013F810000-0x000000013FB64000-memory.dmp	upx
behavioral1/memory/2728-4131-0x000000013F270000-0x000000013F5C4000-memory.dmp	upx
behavioral1/memory/2780-4132-0x000000013FCC0000-0x0000000140014000-memory.dmp	upx
behavioral1/memory/1348-4137-0x000000013F0E0000-0x000000013F434000-memory.dmp	upx
behavioral1/memory/2804-4136-0x000000013FC00000-0x000000013FF54000-memory.dmp	upx
behavioral1/memory/2968-4135-0x000000013F030000-0x000000013F384000-memory.dmp	upx
behavioral1/memory/2776-4134-0x000000013FB30000-0x000000013FE84000-memory.dmp	upx
behavioral1/memory/2920-4133-0x000000013FCE0000-0x0000000140034000-memory.dmp	upx
behavioral1/memory/2392-4130-0x000000013F760000-0x000000013FAB4000-memory.dmp	upx
behavioral1/memory/2300-4138-0x000000013F640000-0x000000013F994000-memory.dmp	upx
behavioral1/memory/2552-4139-0x000000013F440000-0x000000013F794000-memory.dmp	upx
behavioral1/memory/1700-4140-0x000000013FD70000-0x00000001400C4000-memory.dmp	upx
behavioral1/memory/2780-4141-0x000000013FCC0000-0x0000000140014000-memory.dmp	upx
behavioral1/memory/2776-4142-0x000000013FB30000-0x000000013FE84000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\cWfuIqp.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\gajEMlj.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\ZFlDdNC.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\uTvNcSq.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\UncYlvu.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\SehKlIR.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\NkNmrmo.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\iiUhtJO.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\yVRGkRD.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\qbsbbeL.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\xMnZbUl.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\NkmmFXn.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\CsOGbgC.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\tHartqu.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\JqGtGyN.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\vVUSWjl.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\oNXmwnk.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\wnRbyvv.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\uKZRQmJ.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\vJjDDKV.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\MuRhHYn.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\FVZdQAg.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\HQWkOjE.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\YvQzvtw.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\IcZyLkM.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\jsGTDjz.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\ZAgKqQg.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\DXCFaEg.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\vOiiitl.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\eQvpcnf.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\QftrqoS.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\OKMKFLu.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\VVdsGxB.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\oNMZpAL.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\WxYpzZK.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\AaupABx.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\NEXkQdB.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\SagGOIG.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\jbLQMwK.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\wNwxBlX.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\INjQGLz.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\atzxFkv.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\kYIRstd.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\zWaZQmv.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\HWrpEjQ.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\bsRqWWG.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\sGCtVHb.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\eAmpERM.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\UsvcYby.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\xwrqCLx.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\AhtRWrX.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\FlczLIi.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\KGDUqSd.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\FQOZuuW.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\OWpDzwD.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\PIBWKly.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\jaiTODC.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\AFKNoez.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\AJJzYKq.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\ROIpIAc.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\trwAAuE.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\RAiEgKx.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\yDBjmRd.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
File created	C:\Windows\System\xrTTuDr.exe	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2300	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	31
PID 1632 wrote to memory of 2300	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	31
PID 1632 wrote to memory of 2300	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	31
PID 1632 wrote to memory of 2316	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	32
PID 1632 wrote to memory of 2316	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	32
PID 1632 wrote to memory of 2316	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	32
PID 1632 wrote to memory of 2552	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	33
PID 1632 wrote to memory of 2552	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	33
PID 1632 wrote to memory of 2552	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	33
PID 1632 wrote to memory of 2568	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	34
PID 1632 wrote to memory of 2568	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	34
PID 1632 wrote to memory of 2568	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	34
PID 1632 wrote to memory of 1700	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	35
PID 1632 wrote to memory of 1700	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	35
PID 1632 wrote to memory of 1700	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	35
PID 1632 wrote to memory of 2100	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	36
PID 1632 wrote to memory of 2100	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	36
PID 1632 wrote to memory of 2100	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	36
PID 1632 wrote to memory of 2392	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	37
PID 1632 wrote to memory of 2392	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	37
PID 1632 wrote to memory of 2392	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	37
PID 1632 wrote to memory of 2728	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	38
PID 1632 wrote to memory of 2728	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	38
PID 1632 wrote to memory of 2728	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	38
PID 1632 wrote to memory of 2780	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	39
PID 1632 wrote to memory of 2780	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	39
PID 1632 wrote to memory of 2780	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	39
PID 1632 wrote to memory of 2920	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	40
PID 1632 wrote to memory of 2920	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	40
PID 1632 wrote to memory of 2920	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	40
PID 1632 wrote to memory of 2776	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	41
PID 1632 wrote to memory of 2776	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	41
PID 1632 wrote to memory of 2776	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	41
PID 1632 wrote to memory of 2968	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	42
PID 1632 wrote to memory of 2968	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	42
PID 1632 wrote to memory of 2968	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	42
PID 1632 wrote to memory of 2804	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	43
PID 1632 wrote to memory of 2804	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	43
PID 1632 wrote to memory of 2804	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	43
PID 1632 wrote to memory of 1348	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	44
PID 1632 wrote to memory of 1348	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	44
PID 1632 wrote to memory of 1348	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	44
PID 1632 wrote to memory of 2644	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	45
PID 1632 wrote to memory of 2644	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	45
PID 1632 wrote to memory of 2644	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	45
PID 1632 wrote to memory of 2796	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	46
PID 1632 wrote to memory of 2796	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	46
PID 1632 wrote to memory of 2796	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	46
PID 1632 wrote to memory of 2420	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	47
PID 1632 wrote to memory of 2420	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	47
PID 1632 wrote to memory of 2420	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	47
PID 1632 wrote to memory of 2652	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	48
PID 1632 wrote to memory of 2652	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	48
PID 1632 wrote to memory of 2652	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	48
PID 1632 wrote to memory of 2052	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	49
PID 1632 wrote to memory of 2052	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	49
PID 1632 wrote to memory of 2052	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	49
PID 1632 wrote to memory of 2932	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	50
PID 1632 wrote to memory of 2932	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	50
PID 1632 wrote to memory of 2932	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	50
PID 1632 wrote to memory of 2332	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	51
PID 1632 wrote to memory of 2332	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	51
PID 1632 wrote to memory of 2332	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	51
PID 1632 wrote to memory of 1092	1632	JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe	52

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1e1bb963784c229367a290ca41abbe600ce9e47ab6b3f671ad7f9702b58c0065.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\System\zHSUGqz.exe
  C:\Windows\System\zHSUGqz.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\VygxGBy.exe
  C:\Windows\System\VygxGBy.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\fwIYVUo.exe
  C:\Windows\System\fwIYVUo.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\elgLNaQ.exe
  C:\Windows\System\elgLNaQ.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\stwHdBJ.exe
  C:\Windows\System\stwHdBJ.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\JIRjIqM.exe
  C:\Windows\System\JIRjIqM.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\uvyqhVo.exe
  C:\Windows\System\uvyqhVo.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\NczHlav.exe
  C:\Windows\System\NczHlav.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\JiVYbQN.exe
  C:\Windows\System\JiVYbQN.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\Gjqxeab.exe
  C:\Windows\System\Gjqxeab.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\yXfSiHc.exe
  C:\Windows\System\yXfSiHc.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\qPUfPuH.exe
  C:\Windows\System\qPUfPuH.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\OkdVmHR.exe
  C:\Windows\System\OkdVmHR.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\lAsyiih.exe
  C:\Windows\System\lAsyiih.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\yqxRVcR.exe
  C:\Windows\System\yqxRVcR.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\eYAGmgI.exe
  C:\Windows\System\eYAGmgI.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\WvzXxuv.exe
  C:\Windows\System\WvzXxuv.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\eFjclBK.exe
  C:\Windows\System\eFjclBK.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\ZYSXAUy.exe
  C:\Windows\System\ZYSXAUy.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\GuzPVGX.exe
  C:\Windows\System\GuzPVGX.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\NbdXrWI.exe
  C:\Windows\System\NbdXrWI.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\RbbjGrS.exe
  C:\Windows\System\RbbjGrS.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\PCRHsqj.exe
  C:\Windows\System\PCRHsqj.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\DEvgXYW.exe
  C:\Windows\System\DEvgXYW.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\ikdyqub.exe
  C:\Windows\System\ikdyqub.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\aowpvpO.exe
  C:\Windows\System\aowpvpO.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\beEIsoA.exe
  C:\Windows\System\beEIsoA.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\VpIkhMY.exe
  C:\Windows\System\VpIkhMY.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\LomJJZn.exe
  C:\Windows\System\LomJJZn.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\WzGbifj.exe
  C:\Windows\System\WzGbifj.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\kHhhajs.exe
  C:\Windows\System\kHhhajs.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\nbziLgY.exe
  C:\Windows\System\nbziLgY.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\BzbGpTS.exe
  C:\Windows\System\BzbGpTS.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\QKDLPKZ.exe
  C:\Windows\System\QKDLPKZ.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\jkstVYv.exe
  C:\Windows\System\jkstVYv.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\hlEQYxo.exe
  C:\Windows\System\hlEQYxo.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\zmvYUFk.exe
  C:\Windows\System\zmvYUFk.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\boDnbUY.exe
  C:\Windows\System\boDnbUY.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\zLzuicy.exe
  C:\Windows\System\zLzuicy.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\rBMwOgp.exe
  C:\Windows\System\rBMwOgp.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\YWSlnag.exe
  C:\Windows\System\YWSlnag.exe
  2⤵
  - Executes dropped EXE
  PID:496
- C:\Windows\System\lPtHAqD.exe
  C:\Windows\System\lPtHAqD.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\kDzBdkx.exe
  C:\Windows\System\kDzBdkx.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\sLRwccY.exe
  C:\Windows\System\sLRwccY.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\iWMksxh.exe
  C:\Windows\System\iWMksxh.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\cNCLtaF.exe
  C:\Windows\System\cNCLtaF.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\CYmOjxt.exe
  C:\Windows\System\CYmOjxt.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\wKspnkN.exe
  C:\Windows\System\wKspnkN.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\JoFpXxu.exe
  C:\Windows\System\JoFpXxu.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\PKCdWzI.exe
  C:\Windows\System\PKCdWzI.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\cPQsgKy.exe
  C:\Windows\System\cPQsgKy.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\ioaaXyY.exe
  C:\Windows\System\ioaaXyY.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\uvJYOUK.exe
  C:\Windows\System\uvJYOUK.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\zkPnfeL.exe
  C:\Windows\System\zkPnfeL.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\ixRSjVe.exe
  C:\Windows\System\ixRSjVe.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\AuxvTYv.exe
  C:\Windows\System\AuxvTYv.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\VVdsGxB.exe
  C:\Windows\System\VVdsGxB.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\WaaOayg.exe
  C:\Windows\System\WaaOayg.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\msQPRAT.exe
  C:\Windows\System\msQPRAT.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\TiBKbso.exe
  C:\Windows\System\TiBKbso.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\ZnhPCIn.exe
  C:\Windows\System\ZnhPCIn.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\OoGuISU.exe
  C:\Windows\System\OoGuISU.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\WlaiqdM.exe
  C:\Windows\System\WlaiqdM.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\SYOhbcd.exe
  C:\Windows\System\SYOhbcd.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\mWmqjlS.exe
  C:\Windows\System\mWmqjlS.exe
  2⤵
  PID:2528
- C:\Windows\System\lZLMwDI.exe
  C:\Windows\System\lZLMwDI.exe
  2⤵
  PID:564
- C:\Windows\System\oEKVBMS.exe
  C:\Windows\System\oEKVBMS.exe
  2⤵
  PID:1688
- C:\Windows\System\ykTrEbq.exe
  C:\Windows\System\ykTrEbq.exe
  2⤵
  PID:880
- C:\Windows\System\KKQzqiS.exe
  C:\Windows\System\KKQzqiS.exe
  2⤵
  PID:2388
- C:\Windows\System\grhxZpy.exe
  C:\Windows\System\grhxZpy.exe
  2⤵
  PID:2548
- C:\Windows\System\WVTjWJR.exe
  C:\Windows\System\WVTjWJR.exe
  2⤵
  PID:1588
- C:\Windows\System\FzyRYcK.exe
  C:\Windows\System\FzyRYcK.exe
  2⤵
  PID:1548
- C:\Windows\System\oRHRBgK.exe
  C:\Windows\System\oRHRBgK.exe
  2⤵
  PID:2556
- C:\Windows\System\CnLJLWB.exe
  C:\Windows\System\CnLJLWB.exe
  2⤵
  PID:2560
- C:\Windows\System\XyRWPFJ.exe
  C:\Windows\System\XyRWPFJ.exe
  2⤵
  PID:3028
- C:\Windows\System\pscTCxR.exe
  C:\Windows\System\pscTCxR.exe
  2⤵
  PID:2580
- C:\Windows\System\jUMdZua.exe
  C:\Windows\System\jUMdZua.exe
  2⤵
  PID:2908
- C:\Windows\System\yWkaHZH.exe
  C:\Windows\System\yWkaHZH.exe
  2⤵
  PID:2916
- C:\Windows\System\UTvPZLZ.exe
  C:\Windows\System\UTvPZLZ.exe
  2⤵
  PID:3036
- C:\Windows\System\YMKktOE.exe
  C:\Windows\System\YMKktOE.exe
  2⤵
  PID:2760
- C:\Windows\System\IuggBtA.exe
  C:\Windows\System\IuggBtA.exe
  2⤵
  PID:2632
- C:\Windows\System\oYNKEgI.exe
  C:\Windows\System\oYNKEgI.exe
  2⤵
  PID:2324
- C:\Windows\System\mPleebM.exe
  C:\Windows\System\mPleebM.exe
  2⤵
  PID:1464
- C:\Windows\System\cKZRARy.exe
  C:\Windows\System\cKZRARy.exe
  2⤵
  PID:2304
- C:\Windows\System\ZYPdBDi.exe
  C:\Windows\System\ZYPdBDi.exe
  2⤵
  PID:2680
- C:\Windows\System\PiHsNvj.exe
  C:\Windows\System\PiHsNvj.exe
  2⤵
  PID:2036
- C:\Windows\System\gVAYZcH.exe
  C:\Windows\System\gVAYZcH.exe
  2⤵
  PID:2008
- C:\Windows\System\pjslbTx.exe
  C:\Windows\System\pjslbTx.exe
  2⤵
  PID:1148
- C:\Windows\System\hwQTYvP.exe
  C:\Windows\System\hwQTYvP.exe
  2⤵
  PID:2368
- C:\Windows\System\OhwJpuO.exe
  C:\Windows\System\OhwJpuO.exe
  2⤵
  PID:2184
- C:\Windows\System\AXSRnoM.exe
  C:\Windows\System\AXSRnoM.exe
  2⤵
  PID:2144
- C:\Windows\System\dPyQsMb.exe
  C:\Windows\System\dPyQsMb.exe
  2⤵
  PID:2816
- C:\Windows\System\DEQSxch.exe
  C:\Windows\System\DEQSxch.exe
  2⤵
  PID:3064
- C:\Windows\System\wqYvHIp.exe
  C:\Windows\System\wqYvHIp.exe
  2⤵
  PID:1672
- C:\Windows\System\uTvNcSq.exe
  C:\Windows\System\uTvNcSq.exe
  2⤵
  PID:1292
- C:\Windows\System\mqOqqPV.exe
  C:\Windows\System\mqOqqPV.exe
  2⤵
  PID:2128
- C:\Windows\System\KvNluBR.exe
  C:\Windows\System\KvNluBR.exe
  2⤵
  PID:1956
- C:\Windows\System\nfuXSQb.exe
  C:\Windows\System\nfuXSQb.exe
  2⤵
  PID:1552
- C:\Windows\System\iURAwAi.exe
  C:\Windows\System\iURAwAi.exe
  2⤵
  PID:1368
- C:\Windows\System\WtWoOsW.exe
  C:\Windows\System\WtWoOsW.exe
  2⤵
  PID:952
- C:\Windows\System\JBsTEvA.exe
  C:\Windows\System\JBsTEvA.exe
  2⤵
  PID:3048
- C:\Windows\System\vZRpbGu.exe
  C:\Windows\System\vZRpbGu.exe
  2⤵
  PID:1784
- C:\Windows\System\PdGCrZg.exe
  C:\Windows\System\PdGCrZg.exe
  2⤵
  PID:556
- C:\Windows\System\WKfbIBA.exe
  C:\Windows\System\WKfbIBA.exe
  2⤵
  PID:2588
- C:\Windows\System\LZwYGPq.exe
  C:\Windows\System\LZwYGPq.exe
  2⤵
  PID:1616
- C:\Windows\System\WTveTTL.exe
  C:\Windows\System\WTveTTL.exe
  2⤵
  PID:1732
- C:\Windows\System\LkHQYIF.exe
  C:\Windows\System\LkHQYIF.exe
  2⤵
  PID:2440
- C:\Windows\System\nPeWNgQ.exe
  C:\Windows\System\nPeWNgQ.exe
  2⤵
  PID:1576
- C:\Windows\System\qcfiivu.exe
  C:\Windows\System\qcfiivu.exe
  2⤵
  PID:2208
- C:\Windows\System\RnzRTax.exe
  C:\Windows\System\RnzRTax.exe
  2⤵
  PID:2592
- C:\Windows\System\OrGAqjt.exe
  C:\Windows\System\OrGAqjt.exe
  2⤵
  PID:2768
- C:\Windows\System\DWeyfJk.exe
  C:\Windows\System\DWeyfJk.exe
  2⤵
  PID:2800
- C:\Windows\System\BdMfmbr.exe
  C:\Windows\System\BdMfmbr.exe
  2⤵
  PID:2696
- C:\Windows\System\NUAldWj.exe
  C:\Windows\System\NUAldWj.exe
  2⤵
  PID:692
- C:\Windows\System\MRadXRY.exe
  C:\Windows\System\MRadXRY.exe
  2⤵
  PID:1200
- C:\Windows\System\CiBLhwT.exe
  C:\Windows\System\CiBLhwT.exe
  2⤵
  PID:2516
- C:\Windows\System\udoOyva.exe
  C:\Windows\System\udoOyva.exe
  2⤵
  PID:3076
- C:\Windows\System\QIZRiIH.exe
  C:\Windows\System\QIZRiIH.exe
  2⤵
  PID:3092
- C:\Windows\System\zQYSJnc.exe
  C:\Windows\System\zQYSJnc.exe
  2⤵
  PID:3108
- C:\Windows\System\ZUimnmD.exe
  C:\Windows\System\ZUimnmD.exe
  2⤵
  PID:3124
- C:\Windows\System\kyVkJMS.exe
  C:\Windows\System\kyVkJMS.exe
  2⤵
  PID:3140
- C:\Windows\System\LfoyPly.exe
  C:\Windows\System\LfoyPly.exe
  2⤵
  PID:3156
- C:\Windows\System\sCPueaO.exe
  C:\Windows\System\sCPueaO.exe
  2⤵
  PID:3172
- C:\Windows\System\bAfBotQ.exe
  C:\Windows\System\bAfBotQ.exe
  2⤵
  PID:3188
- C:\Windows\System\wWLhpDx.exe
  C:\Windows\System\wWLhpDx.exe
  2⤵
  PID:3204
- C:\Windows\System\AXQgqgk.exe
  C:\Windows\System\AXQgqgk.exe
  2⤵
  PID:3220
- C:\Windows\System\qwXPsTe.exe
  C:\Windows\System\qwXPsTe.exe
  2⤵
  PID:3236
- C:\Windows\System\zrjxHEs.exe
  C:\Windows\System\zrjxHEs.exe
  2⤵
  PID:3252
- C:\Windows\System\EcseiNp.exe
  C:\Windows\System\EcseiNp.exe
  2⤵
  PID:3268
- C:\Windows\System\uxWJHBO.exe
  C:\Windows\System\uxWJHBO.exe
  2⤵
  PID:3284
- C:\Windows\System\zvKOQbB.exe
  C:\Windows\System\zvKOQbB.exe
  2⤵
  PID:3300
- C:\Windows\System\OGAcldT.exe
  C:\Windows\System\OGAcldT.exe
  2⤵
  PID:3316
- C:\Windows\System\tNGFkHx.exe
  C:\Windows\System\tNGFkHx.exe
  2⤵
  PID:3332
- C:\Windows\System\ylecLCv.exe
  C:\Windows\System\ylecLCv.exe
  2⤵
  PID:3348
- C:\Windows\System\mDOtBXM.exe
  C:\Windows\System\mDOtBXM.exe
  2⤵
  PID:3364
- C:\Windows\System\XLbhXRd.exe
  C:\Windows\System\XLbhXRd.exe
  2⤵
  PID:3380
- C:\Windows\System\yBuSdil.exe
  C:\Windows\System\yBuSdil.exe
  2⤵
  PID:3396
- C:\Windows\System\BsfHohT.exe
  C:\Windows\System\BsfHohT.exe
  2⤵
  PID:3412
- C:\Windows\System\mHOAJDg.exe
  C:\Windows\System\mHOAJDg.exe
  2⤵
  PID:3428
- C:\Windows\System\gdmjwGv.exe
  C:\Windows\System\gdmjwGv.exe
  2⤵
  PID:3444
- C:\Windows\System\PkbggEL.exe
  C:\Windows\System\PkbggEL.exe
  2⤵
  PID:3464
- C:\Windows\System\LcaaaqF.exe
  C:\Windows\System\LcaaaqF.exe
  2⤵
  PID:3480
- C:\Windows\System\GTGBrcs.exe
  C:\Windows\System\GTGBrcs.exe
  2⤵
  PID:3496
- C:\Windows\System\gVmEDsx.exe
  C:\Windows\System\gVmEDsx.exe
  2⤵
  PID:3512
- C:\Windows\System\LIpqjWm.exe
  C:\Windows\System\LIpqjWm.exe
  2⤵
  PID:3528
- C:\Windows\System\FZPYobo.exe
  C:\Windows\System\FZPYobo.exe
  2⤵
  PID:3544
- C:\Windows\System\tUiENNq.exe
  C:\Windows\System\tUiENNq.exe
  2⤵
  PID:3560
- C:\Windows\System\ZbrvaxX.exe
  C:\Windows\System\ZbrvaxX.exe
  2⤵
  PID:3576
- C:\Windows\System\iinWXwx.exe
  C:\Windows\System\iinWXwx.exe
  2⤵
  PID:3592
- C:\Windows\System\FwROaQL.exe
  C:\Windows\System\FwROaQL.exe
  2⤵
  PID:3608
- C:\Windows\System\tQJWfXD.exe
  C:\Windows\System\tQJWfXD.exe
  2⤵
  PID:3624
- C:\Windows\System\ichZyJm.exe
  C:\Windows\System\ichZyJm.exe
  2⤵
  PID:3640
- C:\Windows\System\xZkNLXy.exe
  C:\Windows\System\xZkNLXy.exe
  2⤵
  PID:3656
- C:\Windows\System\MgIwoLX.exe
  C:\Windows\System\MgIwoLX.exe
  2⤵
  PID:3672
- C:\Windows\System\mljszMJ.exe
  C:\Windows\System\mljszMJ.exe
  2⤵
  PID:3688
- C:\Windows\System\BYhFxSo.exe
  C:\Windows\System\BYhFxSo.exe
  2⤵
  PID:3704
- C:\Windows\System\ZthtYQr.exe
  C:\Windows\System\ZthtYQr.exe
  2⤵
  PID:3720
- C:\Windows\System\qVTHdij.exe
  C:\Windows\System\qVTHdij.exe
  2⤵
  PID:3736
- C:\Windows\System\AcybhTw.exe
  C:\Windows\System\AcybhTw.exe
  2⤵
  PID:3752
- C:\Windows\System\kTJlkhW.exe
  C:\Windows\System\kTJlkhW.exe
  2⤵
  PID:3768
- C:\Windows\System\CctMAVG.exe
  C:\Windows\System\CctMAVG.exe
  2⤵
  PID:3784
- C:\Windows\System\UGYKACi.exe
  C:\Windows\System\UGYKACi.exe
  2⤵
  PID:3800
- C:\Windows\System\oFtaILx.exe
  C:\Windows\System\oFtaILx.exe
  2⤵
  PID:3816
- C:\Windows\System\MalxqNz.exe
  C:\Windows\System\MalxqNz.exe
  2⤵
  PID:3832
- C:\Windows\System\qVtRsah.exe
  C:\Windows\System\qVtRsah.exe
  2⤵
  PID:3848
- C:\Windows\System\UxtUxaX.exe
  C:\Windows\System\UxtUxaX.exe
  2⤵
  PID:3864
- C:\Windows\System\rzVCjzR.exe
  C:\Windows\System\rzVCjzR.exe
  2⤵
  PID:3880
- C:\Windows\System\rCksDHU.exe
  C:\Windows\System\rCksDHU.exe
  2⤵
  PID:3896
- C:\Windows\System\JoUHLFD.exe
  C:\Windows\System\JoUHLFD.exe
  2⤵
  PID:3912
- C:\Windows\System\uBdrKbV.exe
  C:\Windows\System\uBdrKbV.exe
  2⤵
  PID:3928
- C:\Windows\System\HtqKoUX.exe
  C:\Windows\System\HtqKoUX.exe
  2⤵
  PID:3944
- C:\Windows\System\KAIZzND.exe
  C:\Windows\System\KAIZzND.exe
  2⤵
  PID:3960
- C:\Windows\System\IkRydts.exe
  C:\Windows\System\IkRydts.exe
  2⤵
  PID:3976
- C:\Windows\System\ulaTbDU.exe
  C:\Windows\System\ulaTbDU.exe
  2⤵
  PID:3992
- C:\Windows\System\aJDHzCr.exe
  C:\Windows\System\aJDHzCr.exe
  2⤵
  PID:4008
- C:\Windows\System\UUcCElM.exe
  C:\Windows\System\UUcCElM.exe
  2⤵
  PID:4024
- C:\Windows\System\eNIiXDs.exe
  C:\Windows\System\eNIiXDs.exe
  2⤵
  PID:4040
- C:\Windows\System\UMNndJv.exe
  C:\Windows\System\UMNndJv.exe
  2⤵
  PID:4056
- C:\Windows\System\OBvANTO.exe
  C:\Windows\System\OBvANTO.exe
  2⤵
  PID:4072
- C:\Windows\System\WAHyGnY.exe
  C:\Windows\System\WAHyGnY.exe
  2⤵
  PID:4088
- C:\Windows\System\AcaeSGg.exe
  C:\Windows\System\AcaeSGg.exe
  2⤵
  PID:2508
- C:\Windows\System\ssZnmoz.exe
  C:\Windows\System\ssZnmoz.exe
  2⤵
  PID:1204
- C:\Windows\System\YHxiYPh.exe
  C:\Windows\System\YHxiYPh.exe
  2⤵
  PID:2504
- C:\Windows\System\wMermwl.exe
  C:\Windows\System\wMermwl.exe
  2⤵
  PID:304
- C:\Windows\System\kZWgmQr.exe
  C:\Windows\System\kZWgmQr.exe
  2⤵
  PID:2364
- C:\Windows\System\CDJAcgy.exe
  C:\Windows\System\CDJAcgy.exe
  2⤵
  PID:1564
- C:\Windows\System\rdaNIrl.exe
  C:\Windows\System\rdaNIrl.exe
  2⤵
  PID:2376
- C:\Windows\System\nxbsiEb.exe
  C:\Windows\System\nxbsiEb.exe
  2⤵
  PID:2064
- C:\Windows\System\BRbZZOg.exe
  C:\Windows\System\BRbZZOg.exe
  2⤵
  PID:804
- C:\Windows\System\iRArRim.exe
  C:\Windows\System\iRArRim.exe
  2⤵
  PID:2192
- C:\Windows\System\SOEsvHn.exe
  C:\Windows\System\SOEsvHn.exe
  2⤵
  PID:1628
- C:\Windows\System\GYPTIIo.exe
  C:\Windows\System\GYPTIIo.exe
  2⤵
  PID:1048
- C:\Windows\System\bGiJrMu.exe
  C:\Windows\System\bGiJrMu.exe
  2⤵
  PID:1028
- C:\Windows\System\WjYKmaq.exe
  C:\Windows\System\WjYKmaq.exe
  2⤵
  PID:1436
- C:\Windows\System\jryQkGZ.exe
  C:\Windows\System\jryQkGZ.exe
  2⤵
  PID:3088
- C:\Windows\System\yMRBdZE.exe
  C:\Windows\System\yMRBdZE.exe
  2⤵
  PID:3120
- C:\Windows\System\PecCCnY.exe
  C:\Windows\System\PecCCnY.exe
  2⤵
  PID:3152
- C:\Windows\System\hfUnAVg.exe
  C:\Windows\System\hfUnAVg.exe
  2⤵
  PID:3184
- C:\Windows\System\qMukeGX.exe
  C:\Windows\System\qMukeGX.exe
  2⤵
  PID:3216
- C:\Windows\System\eCUEOSp.exe
  C:\Windows\System\eCUEOSp.exe
  2⤵
  PID:3248
- C:\Windows\System\dfeIgRA.exe
  C:\Windows\System\dfeIgRA.exe
  2⤵
  PID:3280
- C:\Windows\System\KLdIZXz.exe
  C:\Windows\System\KLdIZXz.exe
  2⤵
  PID:3312
- C:\Windows\System\guvBasw.exe
  C:\Windows\System\guvBasw.exe
  2⤵
  PID:3344
- C:\Windows\System\PtIJosE.exe
  C:\Windows\System\PtIJosE.exe
  2⤵
  PID:3376
- C:\Windows\System\UDEebGa.exe
  C:\Windows\System\UDEebGa.exe
  2⤵
  PID:3408
- C:\Windows\System\dSNjTwp.exe
  C:\Windows\System\dSNjTwp.exe
  2⤵
  PID:3440
- C:\Windows\System\sAykzym.exe
  C:\Windows\System\sAykzym.exe
  2⤵
  PID:3476
- C:\Windows\System\mfRTyaf.exe
  C:\Windows\System\mfRTyaf.exe
  2⤵
  PID:3508
- C:\Windows\System\eWMFKJW.exe
  C:\Windows\System\eWMFKJW.exe
  2⤵
  PID:3540
- C:\Windows\System\fwzsgtV.exe
  C:\Windows\System\fwzsgtV.exe
  2⤵
  PID:3572
- C:\Windows\System\DHXJIiN.exe
  C:\Windows\System\DHXJIiN.exe
  2⤵
  PID:3604
- C:\Windows\System\fDTReDt.exe
  C:\Windows\System\fDTReDt.exe
  2⤵
  PID:3636
- C:\Windows\System\pfXhFYE.exe
  C:\Windows\System\pfXhFYE.exe
  2⤵
  PID:3668
- C:\Windows\System\AlDxeDr.exe
  C:\Windows\System\AlDxeDr.exe
  2⤵
  PID:3700
- C:\Windows\System\bSGFEDy.exe
  C:\Windows\System\bSGFEDy.exe
  2⤵
  PID:3732
- C:\Windows\System\wnRbyvv.exe
  C:\Windows\System\wnRbyvv.exe
  2⤵
  PID:3764
- C:\Windows\System\ckOHRnt.exe
  C:\Windows\System\ckOHRnt.exe
  2⤵
  PID:3796
- C:\Windows\System\xMnZbUl.exe
  C:\Windows\System\xMnZbUl.exe
  2⤵
  PID:3828
- C:\Windows\System\nVwpqQP.exe
  C:\Windows\System\nVwpqQP.exe
  2⤵
  PID:3860
- C:\Windows\System\lxhelCF.exe
  C:\Windows\System\lxhelCF.exe
  2⤵
  PID:3892
- C:\Windows\System\ZcWqsKX.exe
  C:\Windows\System\ZcWqsKX.exe
  2⤵
  PID:3924
- C:\Windows\System\obDsWeL.exe
  C:\Windows\System\obDsWeL.exe
  2⤵
  PID:3940
- C:\Windows\System\uMylrao.exe
  C:\Windows\System\uMylrao.exe
  2⤵
  PID:3988
- C:\Windows\System\oNSrbyF.exe
  C:\Windows\System\oNSrbyF.exe
  2⤵
  PID:4020
- C:\Windows\System\bwKkoiH.exe
  C:\Windows\System\bwKkoiH.exe
  2⤵
  PID:4052
- C:\Windows\System\zfJwLXy.exe
  C:\Windows\System\zfJwLXy.exe
  2⤵
  PID:4084
- C:\Windows\System\wkZWMlW.exe
  C:\Windows\System\wkZWMlW.exe
  2⤵
  PID:2356
- C:\Windows\System\itAjlkO.exe
  C:\Windows\System\itAjlkO.exe
  2⤵
  PID:3056
- C:\Windows\System\degdwEP.exe
  C:\Windows\System\degdwEP.exe
  2⤵
  PID:1376
- C:\Windows\System\YwSwxPD.exe
  C:\Windows\System\YwSwxPD.exe
  2⤵
  PID:780
- C:\Windows\System\XMSyOHS.exe
  C:\Windows\System\XMSyOHS.exe
  2⤵
  PID:2252
- C:\Windows\System\ODcsmDF.exe
  C:\Windows\System\ODcsmDF.exe
  2⤵
  PID:2732
- C:\Windows\System\cvFIrZL.exe
  C:\Windows\System\cvFIrZL.exe
  2⤵
  PID:2260
- C:\Windows\System\opBUBAr.exe
  C:\Windows\System\opBUBAr.exe
  2⤵
  PID:3136
- C:\Windows\System\ZJgOAPB.exe
  C:\Windows\System\ZJgOAPB.exe
  2⤵
  PID:3232
- C:\Windows\System\dALpEcN.exe
  C:\Windows\System\dALpEcN.exe
  2⤵
  PID:3264
- C:\Windows\System\xhmNEjv.exe
  C:\Windows\System\xhmNEjv.exe
  2⤵
  PID:3340
- C:\Windows\System\zLpqVKm.exe
  C:\Windows\System\zLpqVKm.exe
  2⤵
  PID:3392
- C:\Windows\System\TzySmXp.exe
  C:\Windows\System\TzySmXp.exe
  2⤵
  PID:3456
- C:\Windows\System\fzxotkR.exe
  C:\Windows\System\fzxotkR.exe
  2⤵
  PID:3524
- C:\Windows\System\XBdJOBb.exe
  C:\Windows\System\XBdJOBb.exe
  2⤵
  PID:3588
- C:\Windows\System\FdNQZrl.exe
  C:\Windows\System\FdNQZrl.exe
  2⤵
  PID:3684
- C:\Windows\System\zOPKYkm.exe
  C:\Windows\System\zOPKYkm.exe
  2⤵
  PID:4112
- C:\Windows\System\aihJFMh.exe
  C:\Windows\System\aihJFMh.exe
  2⤵
  PID:4128
- C:\Windows\System\hpLBuUK.exe
  C:\Windows\System\hpLBuUK.exe
  2⤵
  PID:4148
- C:\Windows\System\JAeeVSq.exe
  C:\Windows\System\JAeeVSq.exe
  2⤵
  PID:4808
- C:\Windows\System\VFHbSUV.exe
  C:\Windows\System\VFHbSUV.exe
  2⤵
  PID:4824
- C:\Windows\System\llNnCCT.exe
  C:\Windows\System\llNnCCT.exe
  2⤵
  PID:4840
- C:\Windows\System\TVEMZdX.exe
  C:\Windows\System\TVEMZdX.exe
  2⤵
  PID:4856
- C:\Windows\System\kAhdNiD.exe
  C:\Windows\System\kAhdNiD.exe
  2⤵
  PID:4872
- C:\Windows\System\FuICaFm.exe
  C:\Windows\System\FuICaFm.exe
  2⤵
  PID:4892
- C:\Windows\System\LqbnWNN.exe
  C:\Windows\System\LqbnWNN.exe
  2⤵
  PID:4912
- C:\Windows\System\QXDsBBd.exe
  C:\Windows\System\QXDsBBd.exe
  2⤵
  PID:4932
- C:\Windows\System\ZgRWHrY.exe
  C:\Windows\System\ZgRWHrY.exe
  2⤵
  PID:4948
- C:\Windows\System\acfTNMY.exe
  C:\Windows\System\acfTNMY.exe
  2⤵
  PID:4968
- C:\Windows\System\mnCEFzZ.exe
  C:\Windows\System\mnCEFzZ.exe
  2⤵
  PID:5024
- C:\Windows\System\GQJqbQO.exe
  C:\Windows\System\GQJqbQO.exe
  2⤵
  PID:5044
- C:\Windows\System\UncYlvu.exe
  C:\Windows\System\UncYlvu.exe
  2⤵
  PID:5060
- C:\Windows\System\ixJmkEi.exe
  C:\Windows\System\ixJmkEi.exe
  2⤵
  PID:5076
- C:\Windows\System\pOXruSj.exe
  C:\Windows\System\pOXruSj.exe
  2⤵
  PID:5092
- C:\Windows\System\jhZVtzl.exe
  C:\Windows\System\jhZVtzl.exe
  2⤵
  PID:5108
- C:\Windows\System\nUDvsBL.exe
  C:\Windows\System\nUDvsBL.exe
  2⤵
  PID:3748
- C:\Windows\System\DhXzyfd.exe
  C:\Windows\System\DhXzyfd.exe
  2⤵
  PID:3888
- C:\Windows\System\cxkmUTX.exe
  C:\Windows\System\cxkmUTX.exe
  2⤵
  PID:4004
- C:\Windows\System\LCLjcqN.exe
  C:\Windows\System\LCLjcqN.exe
  2⤵
  PID:4080
- C:\Windows\System\ZsHTKpY.exe
  C:\Windows\System\ZsHTKpY.exe
  2⤵
  PID:352
- C:\Windows\System\PiCNYxl.exe
  C:\Windows\System\PiCNYxl.exe
  2⤵
  PID:3116
- C:\Windows\System\eJYmqUM.exe
  C:\Windows\System\eJYmqUM.exe
  2⤵
  PID:3372
- C:\Windows\System\HPtzmkN.exe
  C:\Windows\System\HPtzmkN.exe
  2⤵
  PID:3632
- C:\Windows\System\ujVYuMl.exe
  C:\Windows\System\ujVYuMl.exe
  2⤵
  PID:1124
- C:\Windows\System\ybzLRyT.exe
  C:\Windows\System\ybzLRyT.exe
  2⤵
  PID:316
- C:\Windows\System\jEQtIbj.exe
  C:\Windows\System\jEQtIbj.exe
  2⤵
  PID:3844
- C:\Windows\System\ZYPZtex.exe
  C:\Windows\System\ZYPZtex.exe
  2⤵
  PID:3972
- C:\Windows\System\AjbOovb.exe
  C:\Windows\System\AjbOovb.exe
  2⤵
  PID:2148
- C:\Windows\System\uPLwTYK.exe
  C:\Windows\System\uPLwTYK.exe
  2⤵
  PID:4312
- C:\Windows\System\teowkrF.exe
  C:\Windows\System\teowkrF.exe
  2⤵
  PID:4296
- C:\Windows\System\PJeTbQO.exe
  C:\Windows\System\PJeTbQO.exe
  2⤵
  PID:4280
- C:\Windows\System\zzioszp.exe
  C:\Windows\System\zzioszp.exe
  2⤵
  PID:4264
- C:\Windows\System\cAQoWOD.exe
  C:\Windows\System\cAQoWOD.exe
  2⤵
  PID:4244
- C:\Windows\System\obvJSlO.exe
  C:\Windows\System\obvJSlO.exe
  2⤵
  PID:4228
- C:\Windows\System\ckMChuG.exe
  C:\Windows\System\ckMChuG.exe
  2⤵
  PID:4212
- C:\Windows\System\vWchigo.exe
  C:\Windows\System\vWchigo.exe
  2⤵
  PID:4196
- C:\Windows\System\SPDmefe.exe
  C:\Windows\System\SPDmefe.exe
  2⤵
  PID:4180
- C:\Windows\System\pmawabR.exe
  C:\Windows\System\pmawabR.exe
  2⤵
  PID:4160
- C:\Windows\System\TwFispo.exe
  C:\Windows\System\TwFispo.exe
  2⤵
  PID:4536
- C:\Windows\System\nGxGcLi.exe
  C:\Windows\System\nGxGcLi.exe
  2⤵
  PID:4520
- C:\Windows\System\ZwvDwmY.exe
  C:\Windows\System\ZwvDwmY.exe
  2⤵
  PID:4504
- C:\Windows\System\qQmPmgs.exe
  C:\Windows\System\qQmPmgs.exe
  2⤵
  PID:4488
- C:\Windows\System\QrMNXJf.exe
  C:\Windows\System\QrMNXJf.exe
  2⤵
  PID:4472
- C:\Windows\System\YSSwSDL.exe
  C:\Windows\System\YSSwSDL.exe
  2⤵
  PID:4456
- C:\Windows\System\upzBUwn.exe
  C:\Windows\System\upzBUwn.exe
  2⤵
  PID:4440
- C:\Windows\System\MVCFFoJ.exe
  C:\Windows\System\MVCFFoJ.exe
  2⤵
  PID:4424
- C:\Windows\System\KafUwSu.exe
  C:\Windows\System\KafUwSu.exe
  2⤵
  PID:4408
- C:\Windows\System\VwXMMWG.exe
  C:\Windows\System\VwXMMWG.exe
  2⤵
  PID:4392
- C:\Windows\System\MRTkulN.exe
  C:\Windows\System\MRTkulN.exe
  2⤵
  PID:4376
- C:\Windows\System\PJwDRMT.exe
  C:\Windows\System\PJwDRMT.exe
  2⤵
  PID:4360
- C:\Windows\System\jJHpoLq.exe
  C:\Windows\System\jJHpoLq.exe
  2⤵
  PID:4344
- C:\Windows\System\wONCkEj.exe
  C:\Windows\System\wONCkEj.exe
  2⤵
  PID:4328
- C:\Windows\System\uKZRQmJ.exe
  C:\Windows\System\uKZRQmJ.exe
  2⤵
  PID:2120
- C:\Windows\System\tkgpvZz.exe
  C:\Windows\System\tkgpvZz.exe
  2⤵
  PID:3276
- C:\Windows\System\oAKjftU.exe
  C:\Windows\System\oAKjftU.exe
  2⤵
  PID:1716
- C:\Windows\System\NkmmFXn.exe
  C:\Windows\System\NkmmFXn.exe
  2⤵
  PID:2400
- C:\Windows\System\rFhxAOd.exe
  C:\Windows\System\rFhxAOd.exe
  2⤵
  PID:4144
- C:\Windows\System\NhqRJru.exe
  C:\Windows\System\NhqRJru.exe
  2⤵
  PID:580
- C:\Windows\System\IUrtzUS.exe
  C:\Windows\System\IUrtzUS.exe
  2⤵
  PID:1396
- C:\Windows\System\xIBUtwf.exe
  C:\Windows\System\xIBUtwf.exe
  2⤵
  PID:560
- C:\Windows\System\NVaWMhD.exe
  C:\Windows\System\NVaWMhD.exe
  2⤵
  PID:2488
- C:\Windows\System\OPUgWbk.exe
  C:\Windows\System\OPUgWbk.exe
  2⤵
  PID:2520
- C:\Windows\System\nMjGadm.exe
  C:\Windows\System\nMjGadm.exe
  2⤵
  PID:2464
- C:\Windows\System\SzcGmxA.exe
  C:\Windows\System\SzcGmxA.exe
  2⤵
  PID:2684
- C:\Windows\System\TfuBqfM.exe
  C:\Windows\System\TfuBqfM.exe
  2⤵
  PID:4172
- C:\Windows\System\xQHFikS.exe
  C:\Windows\System\xQHFikS.exe
  2⤵
  PID:4568
- C:\Windows\System\vQjpuoS.exe
  C:\Windows\System\vQjpuoS.exe
  2⤵
  PID:4564
- C:\Windows\System\vjxcCYp.exe
  C:\Windows\System\vjxcCYp.exe
  2⤵
  PID:4596
- C:\Windows\System\JNNBMeI.exe
  C:\Windows\System\JNNBMeI.exe
  2⤵
  PID:4612
- C:\Windows\System\oGBIpbL.exe
  C:\Windows\System\oGBIpbL.exe
  2⤵
  PID:4624
- C:\Windows\System\VSepJjG.exe
  C:\Windows\System\VSepJjG.exe
  2⤵
  PID:4648
- C:\Windows\System\LxDOjNF.exe
  C:\Windows\System\LxDOjNF.exe
  2⤵
  PID:1880
- C:\Windows\System\GCPylDj.exe
  C:\Windows\System\GCPylDj.exe
  2⤵
  PID:2624
- C:\Windows\System\BAcgRXf.exe
  C:\Windows\System\BAcgRXf.exe
  2⤵
  PID:2656
- C:\Windows\System\ZJWfhlG.exe
  C:\Windows\System\ZJWfhlG.exe
  2⤵
  PID:4688
- C:\Windows\System\IssWkUY.exe
  C:\Windows\System\IssWkUY.exe
  2⤵
  PID:4700
- C:\Windows\System\PdbaQXB.exe
  C:\Windows\System\PdbaQXB.exe
  2⤵
  PID:4720
- C:\Windows\System\yTnmyRF.exe
  C:\Windows\System\yTnmyRF.exe
  2⤵
  PID:4736
- C:\Windows\System\FJFTbfn.exe
  C:\Windows\System\FJFTbfn.exe
  2⤵
  PID:848
- C:\Windows\System\SmfcNmS.exe
  C:\Windows\System\SmfcNmS.exe
  2⤵
  PID:1864
- C:\Windows\System\TayeDZG.exe
  C:\Windows\System\TayeDZG.exe
  2⤵
  PID:2676
- C:\Windows\System\oLjKIfN.exe
  C:\Windows\System\oLjKIfN.exe
  2⤵
  PID:3040
- C:\Windows\System\CsOGbgC.exe
  C:\Windows\System\CsOGbgC.exe
  2⤵
  PID:1740
- C:\Windows\System\iidpfrz.exe
  C:\Windows\System\iidpfrz.exe
  2⤵
  PID:4764
- C:\Windows\System\pEhzumk.exe
  C:\Windows\System\pEhzumk.exe
  2⤵
  PID:4780
- C:\Windows\System\tcBxOxX.exe
  C:\Windows\System\tcBxOxX.exe
  2⤵
  PID:4796
- C:\Windows\System\NUlmZpK.exe
  C:\Windows\System\NUlmZpK.exe
  2⤵
  PID:4816
- C:\Windows\System\MMufPeo.exe
  C:\Windows\System\MMufPeo.exe
  2⤵
  PID:4848
- C:\Windows\System\NrZXSrb.exe
  C:\Windows\System\NrZXSrb.exe
  2⤵
  PID:4904
- C:\Windows\System\haSlrsb.exe
  C:\Windows\System\haSlrsb.exe
  2⤵
  PID:4920
- C:\Windows\System\oNMZpAL.exe
  C:\Windows\System\oNMZpAL.exe
  2⤵
  PID:4852
- C:\Windows\System\GxeHIYe.exe
  C:\Windows\System\GxeHIYe.exe
  2⤵
  PID:4964
- C:\Windows\System\ANiNyxv.exe
  C:\Windows\System\ANiNyxv.exe
  2⤵
  PID:5004
- C:\Windows\System\nFeYMEg.exe
  C:\Windows\System\nFeYMEg.exe
  2⤵
  PID:5020
- C:\Windows\System\zgYsmLk.exe
  C:\Windows\System\zgYsmLk.exe
  2⤵
  PID:5088
- C:\Windows\System\lwnYDFm.exe
  C:\Windows\System\lwnYDFm.exe
  2⤵
  PID:5068
- C:\Windows\System\uWAcnyU.exe
  C:\Windows\System\uWAcnyU.exe
  2⤵
  PID:3824
- C:\Windows\System\TdRYqiq.exe
  C:\Windows\System\TdRYqiq.exe
  2⤵
  PID:4016
- C:\Windows\System\oeAVDSP.exe
  C:\Windows\System\oeAVDSP.exe
  2⤵
  PID:3504
- C:\Windows\System\YuxkSLR.exe
  C:\Windows\System\YuxkSLR.exe
  2⤵
  PID:2276
- C:\Windows\System\XKmUKpH.exe
  C:\Windows\System\XKmUKpH.exe
  2⤵
  PID:3936
- C:\Windows\System\CTMvymz.exe
  C:\Windows\System\CTMvymz.exe
  2⤵
  PID:3792
- C:\Windows\System\rKMxcfe.exe
  C:\Windows\System\rKMxcfe.exe
  2⤵
  PID:4304
- C:\Windows\System\ZnzMRmV.exe
  C:\Windows\System\ZnzMRmV.exe
  2⤵
  PID:4236
- C:\Windows\System\bDWmXkD.exe
  C:\Windows\System\bDWmXkD.exe
  2⤵
  PID:4168
- C:\Windows\System\Gumuggh.exe
  C:\Windows\System\Gumuggh.exe
  2⤵
  PID:4496
- C:\Windows\System\JOrSgBD.exe
  C:\Windows\System\JOrSgBD.exe
  2⤵
  PID:4432
- C:\Windows\System\jmVLNsN.exe
  C:\Windows\System\jmVLNsN.exe
  2⤵
  PID:4364
- C:\Windows\System\SDZCUNm.exe
  C:\Windows\System\SDZCUNm.exe
  2⤵
  PID:4288
- C:\Windows\System\OAkkIib.exe
  C:\Windows\System\OAkkIib.exe
  2⤵
  PID:4428
- C:\Windows\System\xnJhhXX.exe
  C:\Windows\System\xnJhhXX.exe
  2⤵
  PID:4480
- C:\Windows\System\iiimAqI.exe
  C:\Windows\System\iiimAqI.exe
  2⤵
  PID:4216
- C:\Windows\System\xBmyMow.exe
  C:\Windows\System\xBmyMow.exe
  2⤵
  PID:4320
- C:\Windows\System\auLBAcu.exe
  C:\Windows\System\auLBAcu.exe
  2⤵
  PID:2744
- C:\Windows\System\eHuSkWF.exe
  C:\Windows\System\eHuSkWF.exe
  2⤵
  PID:4476
- C:\Windows\System\SlvkLPo.exe
  C:\Windows\System\SlvkLPo.exe
  2⤵
  PID:4412
- C:\Windows\System\MRqrAZO.exe
  C:\Windows\System\MRqrAZO.exe
  2⤵
  PID:4316
- C:\Windows\System\QrByYvI.exe
  C:\Windows\System\QrByYvI.exe
  2⤵
  PID:2784
- C:\Windows\System\AIlwKmh.exe
  C:\Windows\System\AIlwKmh.exe
  2⤵
  PID:4676
- C:\Windows\System\TwPGYhb.exe
  C:\Windows\System\TwPGYhb.exe
  2⤵
  PID:3044
- C:\Windows\System\HSOKDmZ.exe
  C:\Windows\System\HSOKDmZ.exe
  2⤵
  PID:4588
- C:\Windows\System\kzlVeyG.exe
  C:\Windows\System\kzlVeyG.exe
  2⤵
  PID:4656
- C:\Windows\System\tPKBONQ.exe
  C:\Windows\System\tPKBONQ.exe
  2⤵
  PID:4692
- C:\Windows\System\LMnzdyT.exe
  C:\Windows\System\LMnzdyT.exe
  2⤵
  PID:884
- C:\Windows\System\uCFNjGR.exe
  C:\Windows\System\uCFNjGR.exe
  2⤵
  PID:4756
- C:\Windows\System\yUFEBzT.exe
  C:\Windows\System\yUFEBzT.exe
  2⤵
  PID:4836
- C:\Windows\System\gNXGyqn.exe
  C:\Windows\System\gNXGyqn.exe
  2⤵
  PID:4884
- C:\Windows\System\iezeJCF.exe
  C:\Windows\System\iezeJCF.exe
  2⤵
  PID:5100
- C:\Windows\System\NsSLkAX.exe
  C:\Windows\System\NsSLkAX.exe
  2⤵
  PID:3328
- C:\Windows\System\iFhuGpm.exe
  C:\Windows\System\iFhuGpm.exe
  2⤵
  PID:4272
- C:\Windows\System\rvLzJpM.exe
  C:\Windows\System\rvLzJpM.exe
  2⤵
  PID:3308
- C:\Windows\System\NDnOUuU.exe
  C:\Windows\System\NDnOUuU.exe
  2⤵
  PID:4368
- C:\Windows\System\nZZPGKn.exe
  C:\Windows\System\nZZPGKn.exe
  2⤵
  PID:5124
- C:\Windows\System\cPQdhOn.exe
  C:\Windows\System\cPQdhOn.exe
  2⤵
  PID:5140
- C:\Windows\System\UvxalFF.exe
  C:\Windows\System\UvxalFF.exe
  2⤵
  PID:5156
- C:\Windows\System\uvWzEFi.exe
  C:\Windows\System\uvWzEFi.exe
  2⤵
  PID:5172
- C:\Windows\System\PLMZzkC.exe
  C:\Windows\System\PLMZzkC.exe
  2⤵
  PID:5188
- C:\Windows\System\zSVuOhy.exe
  C:\Windows\System\zSVuOhy.exe
  2⤵
  PID:5204
- C:\Windows\System\UiDYsNl.exe
  C:\Windows\System\UiDYsNl.exe
  2⤵
  PID:5220
- C:\Windows\System\XnEqnAX.exe
  C:\Windows\System\XnEqnAX.exe
  2⤵
  PID:5236
- C:\Windows\System\OCZRBoE.exe
  C:\Windows\System\OCZRBoE.exe
  2⤵
  PID:5252
- C:\Windows\System\CEYtvez.exe
  C:\Windows\System\CEYtvez.exe
  2⤵
  PID:5268
- C:\Windows\System\iPJYtGm.exe
  C:\Windows\System\iPJYtGm.exe
  2⤵
  PID:5284
- C:\Windows\System\ZmYNsNg.exe
  C:\Windows\System\ZmYNsNg.exe
  2⤵
  PID:5300
- C:\Windows\System\EDtLKli.exe
  C:\Windows\System\EDtLKli.exe
  2⤵
  PID:5316
- C:\Windows\System\OyKYjXh.exe
  C:\Windows\System\OyKYjXh.exe
  2⤵
  PID:5332
- C:\Windows\System\FdtKQVu.exe
  C:\Windows\System\FdtKQVu.exe
  2⤵
  PID:5348
- C:\Windows\System\VRlGIIm.exe
  C:\Windows\System\VRlGIIm.exe
  2⤵
  PID:5364
- C:\Windows\System\wIPAkKT.exe
  C:\Windows\System\wIPAkKT.exe
  2⤵
  PID:5380
- C:\Windows\System\Fnzgwkp.exe
  C:\Windows\System\Fnzgwkp.exe
  2⤵
  PID:5396
- C:\Windows\System\trwAAuE.exe
  C:\Windows\System\trwAAuE.exe
  2⤵
  PID:5412
- C:\Windows\System\FkhZrhS.exe
  C:\Windows\System\FkhZrhS.exe
  2⤵
  PID:5428
- C:\Windows\System\juwAAWL.exe
  C:\Windows\System\juwAAWL.exe
  2⤵
  PID:5444
- C:\Windows\System\CdPAWdx.exe
  C:\Windows\System\CdPAWdx.exe
  2⤵
  PID:5460
- C:\Windows\System\TiWmvTh.exe
  C:\Windows\System\TiWmvTh.exe
  2⤵
  PID:5476
- C:\Windows\System\XowLcZq.exe
  C:\Windows\System\XowLcZq.exe
  2⤵
  PID:5492
- C:\Windows\System\nQsyRxG.exe
  C:\Windows\System\nQsyRxG.exe
  2⤵
  PID:5508
- C:\Windows\System\pQhZiLa.exe
  C:\Windows\System\pQhZiLa.exe
  2⤵
  PID:5524
- C:\Windows\System\EZBIEmL.exe
  C:\Windows\System\EZBIEmL.exe
  2⤵
  PID:5540
- C:\Windows\System\QgkoVpf.exe
  C:\Windows\System\QgkoVpf.exe
  2⤵
  PID:5556
- C:\Windows\System\YvNNCjM.exe
  C:\Windows\System\YvNNCjM.exe
  2⤵
  PID:5572
- C:\Windows\System\jsGTDjz.exe
  C:\Windows\System\jsGTDjz.exe
  2⤵
  PID:5588
- C:\Windows\System\IxhuYni.exe
  C:\Windows\System\IxhuYni.exe
  2⤵
  PID:5604
- C:\Windows\System\DnNOxHq.exe
  C:\Windows\System\DnNOxHq.exe
  2⤵
  PID:5620
- C:\Windows\System\GXbmeEl.exe
  C:\Windows\System\GXbmeEl.exe
  2⤵
  PID:5636
- C:\Windows\System\OPcGHjh.exe
  C:\Windows\System\OPcGHjh.exe
  2⤵
  PID:5652
- C:\Windows\System\lxxnUpB.exe
  C:\Windows\System\lxxnUpB.exe
  2⤵
  PID:5668
- C:\Windows\System\cFjfUyX.exe
  C:\Windows\System\cFjfUyX.exe
  2⤵
  PID:5684
- C:\Windows\System\uGtSEEd.exe
  C:\Windows\System\uGtSEEd.exe
  2⤵
  PID:5700
- C:\Windows\System\UVobbNn.exe
  C:\Windows\System\UVobbNn.exe
  2⤵
  PID:5716
- C:\Windows\System\bhjESLl.exe
  C:\Windows\System\bhjESLl.exe
  2⤵
  PID:5732
- C:\Windows\System\QvQoEQR.exe
  C:\Windows\System\QvQoEQR.exe
  2⤵
  PID:5748
- C:\Windows\System\AHGONrG.exe
  C:\Windows\System\AHGONrG.exe
  2⤵
  PID:5764
- C:\Windows\System\APLEslk.exe
  C:\Windows\System\APLEslk.exe
  2⤵
  PID:5784
- C:\Windows\System\ndpdRsU.exe
  C:\Windows\System\ndpdRsU.exe
  2⤵
  PID:5800
- C:\Windows\System\DhunmER.exe
  C:\Windows\System\DhunmER.exe
  2⤵
  PID:5816
- C:\Windows\System\VKyZVFC.exe
  C:\Windows\System\VKyZVFC.exe
  2⤵
  PID:5832
- C:\Windows\System\PcAJvAm.exe
  C:\Windows\System\PcAJvAm.exe
  2⤵
  PID:5848
- C:\Windows\System\RAWoqjO.exe
  C:\Windows\System\RAWoqjO.exe
  2⤵
  PID:5864
- C:\Windows\System\zGlYTGK.exe
  C:\Windows\System\zGlYTGK.exe
  2⤵
  PID:5880
- C:\Windows\System\hlFLkTT.exe
  C:\Windows\System\hlFLkTT.exe
  2⤵
  PID:5896
- C:\Windows\System\oeITsnz.exe
  C:\Windows\System\oeITsnz.exe
  2⤵
  PID:5912
- C:\Windows\System\HqUvGCr.exe
  C:\Windows\System\HqUvGCr.exe
  2⤵
  PID:5928
- C:\Windows\System\UcifIJX.exe
  C:\Windows\System\UcifIJX.exe
  2⤵
  PID:5944
- C:\Windows\System\MfoLZwY.exe
  C:\Windows\System\MfoLZwY.exe
  2⤵
  PID:5960
- C:\Windows\System\KEbvHdm.exe
  C:\Windows\System\KEbvHdm.exe
  2⤵
  PID:5976
- C:\Windows\System\OKvGPbd.exe
  C:\Windows\System\OKvGPbd.exe
  2⤵
  PID:5992
- C:\Windows\System\beEElHI.exe
  C:\Windows\System\beEElHI.exe
  2⤵
  PID:6008
- C:\Windows\System\UIrjeyt.exe
  C:\Windows\System\UIrjeyt.exe
  2⤵
  PID:6024
- C:\Windows\System\OVOFmVJ.exe
  C:\Windows\System\OVOFmVJ.exe
  2⤵
  PID:6040
- C:\Windows\System\fyxZXnd.exe
  C:\Windows\System\fyxZXnd.exe
  2⤵
  PID:6056
- C:\Windows\System\rkXrecl.exe
  C:\Windows\System\rkXrecl.exe
  2⤵
  PID:6072
- C:\Windows\System\LyHmgGQ.exe
  C:\Windows\System\LyHmgGQ.exe
  2⤵
  PID:6088
- C:\Windows\System\qztiHts.exe
  C:\Windows\System\qztiHts.exe
  2⤵
  PID:6104
- C:\Windows\System\XllZbQF.exe
  C:\Windows\System\XllZbQF.exe
  2⤵
  PID:6120
- C:\Windows\System\FFZvhDQ.exe
  C:\Windows\System\FFZvhDQ.exe
  2⤵
  PID:6136
- C:\Windows\System\gqwosqz.exe
  C:\Windows\System\gqwosqz.exe
  2⤵
  PID:3168
- C:\Windows\System\hWIOsYX.exe
  C:\Windows\System\hWIOsYX.exe
  2⤵
  PID:4628
- C:\Windows\System\BZCwOXc.exe
  C:\Windows\System\BZCwOXc.exe
  2⤵
  PID:4732
- C:\Windows\System\RAiEgKx.exe
  C:\Windows\System\RAiEgKx.exe
  2⤵
  PID:5016
- C:\Windows\System\fUixPSP.exe
  C:\Windows\System\fUixPSP.exe
  2⤵
  PID:4284
- C:\Windows\System\OWpDzwD.exe
  C:\Windows\System\OWpDzwD.exe
  2⤵
  PID:4576
- C:\Windows\System\ADqaydL.exe
  C:\Windows\System\ADqaydL.exe
  2⤵
  PID:2748
- C:\Windows\System\TXGdOEb.exe
  C:\Windows\System\TXGdOEb.exe
  2⤵
  PID:904
- C:\Windows\System\YwJClqN.exe
  C:\Windows\System\YwJClqN.exe
  2⤵
  PID:4608
- C:\Windows\System\eZKhbAg.exe
  C:\Windows\System\eZKhbAg.exe
  2⤵
  PID:2972
- C:\Windows\System\MKLXQxm.exe
  C:\Windows\System\MKLXQxm.exe
  2⤵
  PID:4744
- C:\Windows\System\oTvHqGd.exe
  C:\Windows\System\oTvHqGd.exe
  2⤵
  PID:1944
- C:\Windows\System\ljicUnK.exe
  C:\Windows\System\ljicUnK.exe
  2⤵
  PID:4752
- C:\Windows\System\fjPqqnm.exe
  C:\Windows\System\fjPqqnm.exe
  2⤵
  PID:4956
- C:\Windows\System\QruCLml.exe
  C:\Windows\System\QruCLml.exe
  2⤵
  PID:5084
- C:\Windows\System\PjYRqpi.exe
  C:\Windows\System\PjYRqpi.exe
  2⤵
  PID:3728
- C:\Windows\System\SZAfivT.exe
  C:\Windows\System\SZAfivT.exe
  2⤵
  PID:4464
- C:\Windows\System\YKXwIZD.exe
  C:\Windows\System\YKXwIZD.exe
  2⤵
  PID:3920
- C:\Windows\System\bcKYbvP.exe
  C:\Windows\System\bcKYbvP.exe
  2⤵
  PID:1484
- C:\Windows\System\PYgNIqz.exe
  C:\Windows\System\PYgNIqz.exe
  2⤵
  PID:4104
- C:\Windows\System\iNpVtDN.exe
  C:\Windows\System\iNpVtDN.exe
  2⤵
  PID:2788
- C:\Windows\System\NmjSFZA.exe
  C:\Windows\System\NmjSFZA.exe
  2⤵
  PID:4944
- C:\Windows\System\jWFjTJO.exe
  C:\Windows\System\jWFjTJO.exe
  2⤵
  PID:4540
- C:\Windows\System\eJJdYiQ.exe
  C:\Windows\System\eJJdYiQ.exe
  2⤵
  PID:5196
- C:\Windows\System\llNpRie.exe
  C:\Windows\System\llNpRie.exe
  2⤵
  PID:5324
- C:\Windows\System\YjRSuUo.exe
  C:\Windows\System\YjRSuUo.exe
  2⤵
  PID:5152
- C:\Windows\System\IENNHdf.exe
  C:\Windows\System\IENNHdf.exe
  2⤵
  PID:5420
- C:\Windows\System\EtvFOuf.exe
  C:\Windows\System\EtvFOuf.exe
  2⤵
  PID:5248
- C:\Windows\System\xguiHiL.exe
  C:\Windows\System\xguiHiL.exe
  2⤵
  PID:5436
- C:\Windows\System\eBKIfPR.exe
  C:\Windows\System\eBKIfPR.exe
  2⤵
  PID:5340
- C:\Windows\System\UzvqWGZ.exe
  C:\Windows\System\UzvqWGZ.exe
  2⤵
  PID:5376
- C:\Windows\System\gmhSdal.exe
  C:\Windows\System\gmhSdal.exe
  2⤵
  PID:5468
- C:\Windows\System\weIqfGH.exe
  C:\Windows\System\weIqfGH.exe
  2⤵
  PID:5500
- C:\Windows\System\zywGLtj.exe
  C:\Windows\System\zywGLtj.exe
  2⤵
  PID:5232
- C:\Windows\System\tHartqu.exe
  C:\Windows\System\tHartqu.exe
  2⤵
  PID:5516
- C:\Windows\System\HeXulFw.exe
  C:\Windows\System\HeXulFw.exe
  2⤵
  PID:5532
- C:\Windows\System\gFSvPJr.exe
  C:\Windows\System\gFSvPJr.exe
  2⤵
  PID:5596
- C:\Windows\System\IhWLXRW.exe
  C:\Windows\System\IhWLXRW.exe
  2⤵
  PID:5584
- C:\Windows\System\ozYbrnS.exe
  C:\Windows\System\ozYbrnS.exe
  2⤵
  PID:5660
- C:\Windows\System\jOqIQnK.exe
  C:\Windows\System\jOqIQnK.exe
  2⤵
  PID:5676
- C:\Windows\System\JVChpgX.exe
  C:\Windows\System\JVChpgX.exe
  2⤵
  PID:5740
- C:\Windows\System\fhTgLmN.exe
  C:\Windows\System\fhTgLmN.exe
  2⤵
  PID:5696
- C:\Windows\System\SpVXaRP.exe
  C:\Windows\System\SpVXaRP.exe
  2⤵
  PID:5792
- C:\Windows\System\szvWHkO.exe
  C:\Windows\System\szvWHkO.exe
  2⤵
  PID:5856
- C:\Windows\System\uxncAAu.exe
  C:\Windows\System\uxncAAu.exe
  2⤵
  PID:5812
- C:\Windows\System\GjdkDfg.exe
  C:\Windows\System\GjdkDfg.exe
  2⤵
  PID:5876
- C:\Windows\System\wxbPmKn.exe
  C:\Windows\System\wxbPmKn.exe
  2⤵
  PID:5936
- C:\Windows\System\VsGmuZV.exe
  C:\Windows\System\VsGmuZV.exe
  2⤵
  PID:6000
- C:\Windows\System\ofkqwtz.exe
  C:\Windows\System\ofkqwtz.exe
  2⤵
  PID:6064
- C:\Windows\System\PQkVtZG.exe
  C:\Windows\System\PQkVtZG.exe
  2⤵
  PID:6128
- C:\Windows\System\wGBEVnf.exe
  C:\Windows\System\wGBEVnf.exe
  2⤵
  PID:5892
- C:\Windows\System\yAmBzfi.exe
  C:\Windows\System\yAmBzfi.exe
  2⤵
  PID:5984
- C:\Windows\System\EjnwYnm.exe
  C:\Windows\System\EjnwYnm.exe
  2⤵
  PID:6048
- C:\Windows\System\GilAwLX.exe
  C:\Windows\System\GilAwLX.exe
  2⤵
  PID:6112
- C:\Windows\System\EQtEfvW.exe
  C:\Windows\System\EQtEfvW.exe
  2⤵
  PID:1808
- C:\Windows\System\hORcFfa.exe
  C:\Windows\System\hORcFfa.exe
  2⤵
  PID:4792
- C:\Windows\System\ZEbTCzJ.exe
  C:\Windows\System\ZEbTCzJ.exe
  2⤵
  PID:4528
- C:\Windows\System\OlBauFa.exe
  C:\Windows\System\OlBauFa.exe
  2⤵
  PID:4804
- C:\Windows\System\MOnCUIc.exe
  C:\Windows\System\MOnCUIc.exe
  2⤵
  PID:4396
- C:\Windows\System\xOhwtxA.exe
  C:\Windows\System\xOhwtxA.exe
  2⤵
  PID:4900
- C:\Windows\System\wGCpKmp.exe
  C:\Windows\System\wGCpKmp.exe
  2⤵
  PID:4332
- C:\Windows\System\ArxYLRX.exe
  C:\Windows\System\ArxYLRX.exe
  2⤵
  PID:1332
- C:\Windows\System\bTHoGwK.exe
  C:\Windows\System\bTHoGwK.exe
  2⤵
  PID:5356
- C:\Windows\System\npVeTrN.exe
  C:\Windows\System\npVeTrN.exe
  2⤵
  PID:5244
- C:\Windows\System\KGDUqSd.exe
  C:\Windows\System\KGDUqSd.exe
  2⤵
  PID:5200
- C:\Windows\System\JeJgBSh.exe
  C:\Windows\System\JeJgBSh.exe
  2⤵
  PID:5580
- C:\Windows\System\xNWKGQh.exe
  C:\Windows\System\xNWKGQh.exe
  2⤵
  PID:5692
- C:\Windows\System\HZvCvVf.exe
  C:\Windows\System\HZvCvVf.exe
  2⤵
  PID:5844
- C:\Windows\System\Mkxuhis.exe
  C:\Windows\System\Mkxuhis.exe
  2⤵
  PID:2200
- C:\Windows\System\PXYydSM.exe
  C:\Windows\System\PXYydSM.exe
  2⤵
  PID:3536
- C:\Windows\System\DXCFaEg.exe
  C:\Windows\System\DXCFaEg.exe
  2⤵
  PID:5552
- C:\Windows\System\NFXWpDU.exe
  C:\Windows\System\NFXWpDU.exe
  2⤵
  PID:5276
- C:\Windows\System\XRBKSyq.exe
  C:\Windows\System\XRBKSyq.exe
  2⤵
  PID:4772
- C:\Windows\System\atRGhEo.exe
  C:\Windows\System\atRGhEo.exe
  2⤵
  PID:4204
- C:\Windows\System\RnJZLDn.exe
  C:\Windows\System\RnJZLDn.exe
  2⤵
  PID:2612
- C:\Windows\System\vOiiitl.exe
  C:\Windows\System\vOiiitl.exe
  2⤵
  PID:5292
- C:\Windows\System\ayLhcSI.exe
  C:\Windows\System\ayLhcSI.exe
  2⤵
  PID:5308
- C:\Windows\System\txjylyo.exe
  C:\Windows\System\txjylyo.exe
  2⤵
  PID:5168
- C:\Windows\System\ngIAkKn.exe
  C:\Windows\System\ngIAkKn.exe
  2⤵
  PID:5632
- C:\Windows\System\eCTrXKw.exe
  C:\Windows\System\eCTrXKw.exe
  2⤵
  PID:5756
- C:\Windows\System\agsxBSl.exe
  C:\Windows\System\agsxBSl.exe
  2⤵
  PID:5904
- C:\Windows\System\INjQGLz.exe
  C:\Windows\System\INjQGLz.exe
  2⤵
  PID:5888
- C:\Windows\System\vnrTjvf.exe
  C:\Windows\System\vnrTjvf.exe
  2⤵
  PID:4444
- C:\Windows\System\xwVIQQz.exe
  C:\Windows\System\xwVIQQz.exe
  2⤵
  PID:5136
- C:\Windows\System\EXeHLdr.exe
  C:\Windows\System\EXeHLdr.exe
  2⤵
  PID:5164
- C:\Windows\System\KZSulJk.exe
  C:\Windows\System\KZSulJk.exe
  2⤵
  PID:5968
- C:\Windows\System\WDtdyvt.exe
  C:\Windows\System\WDtdyvt.exe
  2⤵
  PID:3000
- C:\Windows\System\ngBiwWC.exe
  C:\Windows\System\ngBiwWC.exe
  2⤵
  PID:4184
- C:\Windows\System\tYdLUNn.exe
  C:\Windows\System\tYdLUNn.exe
  2⤵
  PID:5148
- C:\Windows\System\ypCDEeI.exe
  C:\Windows\System\ypCDEeI.exe
  2⤵
  PID:5564
- C:\Windows\System\WcwuyjV.exe
  C:\Windows\System\WcwuyjV.exe
  2⤵
  PID:5056
- C:\Windows\System\jNLncpm.exe
  C:\Windows\System\jNLncpm.exe
  2⤵
  PID:5456
- C:\Windows\System\vcFYrbV.exe
  C:\Windows\System\vcFYrbV.exe
  2⤵
  PID:6036
- C:\Windows\System\fsqMjTR.exe
  C:\Windows\System\fsqMjTR.exe
  2⤵
  PID:6152
- C:\Windows\System\oBmQbHf.exe
  C:\Windows\System\oBmQbHf.exe
  2⤵
  PID:6168
- C:\Windows\System\LyHEAwV.exe
  C:\Windows\System\LyHEAwV.exe
  2⤵
  PID:6184
- C:\Windows\System\jucNDnH.exe
  C:\Windows\System\jucNDnH.exe
  2⤵
  PID:6200
- C:\Windows\System\siyONdz.exe
  C:\Windows\System\siyONdz.exe
  2⤵
  PID:6216
- C:\Windows\System\sGCtVHb.exe
  C:\Windows\System\sGCtVHb.exe
  2⤵
  PID:6232
- C:\Windows\System\uSVCtwY.exe
  C:\Windows\System\uSVCtwY.exe
  2⤵
  PID:6248
- C:\Windows\System\bPksEjP.exe
  C:\Windows\System\bPksEjP.exe
  2⤵
  PID:6264
- C:\Windows\System\PzruidK.exe
  C:\Windows\System\PzruidK.exe
  2⤵
  PID:6280
- C:\Windows\System\JJXSGUv.exe
  C:\Windows\System\JJXSGUv.exe
  2⤵
  PID:6296
- C:\Windows\System\lTLbrnr.exe
  C:\Windows\System\lTLbrnr.exe
  2⤵
  PID:6312
- C:\Windows\System\PIBWKly.exe
  C:\Windows\System\PIBWKly.exe
  2⤵
  PID:6328
- C:\Windows\System\xPFtgJk.exe
  C:\Windows\System\xPFtgJk.exe
  2⤵
  PID:6344
- C:\Windows\System\cHQRXFX.exe
  C:\Windows\System\cHQRXFX.exe
  2⤵
  PID:6360
- C:\Windows\System\htNEWxV.exe
  C:\Windows\System\htNEWxV.exe
  2⤵
  PID:6376
- C:\Windows\System\HRVskEH.exe
  C:\Windows\System\HRVskEH.exe
  2⤵
  PID:6392
- C:\Windows\System\oIBpWyG.exe
  C:\Windows\System\oIBpWyG.exe
  2⤵
  PID:6408
- C:\Windows\System\ziNXcyW.exe
  C:\Windows\System\ziNXcyW.exe
  2⤵
  PID:6424
- C:\Windows\System\SgeMScN.exe
  C:\Windows\System\SgeMScN.exe
  2⤵
  PID:6440
- C:\Windows\System\hzlfwaf.exe
  C:\Windows\System\hzlfwaf.exe
  2⤵
  PID:6456
- C:\Windows\System\PztoIoQ.exe
  C:\Windows\System\PztoIoQ.exe
  2⤵
  PID:6472
- C:\Windows\System\rTetsLM.exe
  C:\Windows\System\rTetsLM.exe
  2⤵
  PID:6488
- C:\Windows\System\EYfrLqH.exe
  C:\Windows\System\EYfrLqH.exe
  2⤵
  PID:6504
- C:\Windows\System\NrvLKIj.exe
  C:\Windows\System\NrvLKIj.exe
  2⤵
  PID:6520
- C:\Windows\System\MRiTKQt.exe
  C:\Windows\System\MRiTKQt.exe
  2⤵
  PID:6536
- C:\Windows\System\RCzGQxV.exe
  C:\Windows\System\RCzGQxV.exe
  2⤵
  PID:6552
- C:\Windows\System\pnluqPJ.exe
  C:\Windows\System\pnluqPJ.exe
  2⤵
  PID:6568
- C:\Windows\System\YivedyT.exe
  C:\Windows\System\YivedyT.exe
  2⤵
  PID:6584
- C:\Windows\System\bFBYHWe.exe
  C:\Windows\System\bFBYHWe.exe
  2⤵
  PID:6600
- C:\Windows\System\fvAKEck.exe
  C:\Windows\System\fvAKEck.exe
  2⤵
  PID:6616
- C:\Windows\System\OwTuySv.exe
  C:\Windows\System\OwTuySv.exe
  2⤵
  PID:6632
- C:\Windows\System\bzdNGwF.exe
  C:\Windows\System\bzdNGwF.exe
  2⤵
  PID:6648
- C:\Windows\System\IpcRYRT.exe
  C:\Windows\System\IpcRYRT.exe
  2⤵
  PID:6664
- C:\Windows\System\UtTYApR.exe
  C:\Windows\System\UtTYApR.exe
  2⤵
  PID:6680
- C:\Windows\System\jWtgNEY.exe
  C:\Windows\System\jWtgNEY.exe
  2⤵
  PID:6696
- C:\Windows\System\ezcWZRL.exe
  C:\Windows\System\ezcWZRL.exe
  2⤵
  PID:6712
- C:\Windows\System\GxrbUbX.exe
  C:\Windows\System\GxrbUbX.exe
  2⤵
  PID:6728
- C:\Windows\System\XzeCnpn.exe
  C:\Windows\System\XzeCnpn.exe
  2⤵
  PID:6744
- C:\Windows\System\bBRMLmN.exe
  C:\Windows\System\bBRMLmN.exe
  2⤵
  PID:6760
- C:\Windows\System\NANHBcU.exe
  C:\Windows\System\NANHBcU.exe
  2⤵
  PID:6776
- C:\Windows\System\viHcurz.exe
  C:\Windows\System\viHcurz.exe
  2⤵
  PID:6792
- C:\Windows\System\PDPFokY.exe
  C:\Windows\System\PDPFokY.exe
  2⤵
  PID:6808
- C:\Windows\System\SNEKZGb.exe
  C:\Windows\System\SNEKZGb.exe
  2⤵
  PID:6824
- C:\Windows\System\kDDZejp.exe
  C:\Windows\System\kDDZejp.exe
  2⤵
  PID:6840
- C:\Windows\System\DFJPJyX.exe
  C:\Windows\System\DFJPJyX.exe
  2⤵
  PID:6856
- C:\Windows\System\rOVWaFe.exe
  C:\Windows\System\rOVWaFe.exe
  2⤵
  PID:6872
- C:\Windows\System\XyvVHdw.exe
  C:\Windows\System\XyvVHdw.exe
  2⤵
  PID:6888
- C:\Windows\System\fBOLVra.exe
  C:\Windows\System\fBOLVra.exe
  2⤵
  PID:6904
- C:\Windows\System\atzxFkv.exe
  C:\Windows\System\atzxFkv.exe
  2⤵
  PID:6920
- C:\Windows\System\fYbhnbw.exe
  C:\Windows\System\fYbhnbw.exe
  2⤵
  PID:6936
- C:\Windows\System\omQQpuD.exe
  C:\Windows\System\omQQpuD.exe
  2⤵
  PID:6952
- C:\Windows\System\wQfKnpo.exe
  C:\Windows\System\wQfKnpo.exe
  2⤵
  PID:6968
- C:\Windows\System\cTBtTbT.exe
  C:\Windows\System\cTBtTbT.exe
  2⤵
  PID:6984
- C:\Windows\System\NrvlSex.exe
  C:\Windows\System\NrvlSex.exe
  2⤵
  PID:7000
- C:\Windows\System\vHeRuUa.exe
  C:\Windows\System\vHeRuUa.exe
  2⤵
  PID:7016
- C:\Windows\System\zRlWchr.exe
  C:\Windows\System\zRlWchr.exe
  2⤵
  PID:7032
- C:\Windows\System\FKEkMNV.exe
  C:\Windows\System\FKEkMNV.exe
  2⤵
  PID:7048
- C:\Windows\System\CSrwDkc.exe
  C:\Windows\System\CSrwDkc.exe
  2⤵
  PID:7064
- C:\Windows\System\KwcWpae.exe
  C:\Windows\System\KwcWpae.exe
  2⤵
  PID:7080
- C:\Windows\System\bgBzAxR.exe
  C:\Windows\System\bgBzAxR.exe
  2⤵
  PID:7096
- C:\Windows\System\RDsGJCk.exe
  C:\Windows\System\RDsGJCk.exe
  2⤵
  PID:7112
- C:\Windows\System\irnxotM.exe
  C:\Windows\System\irnxotM.exe
  2⤵
  PID:7128
- C:\Windows\System\aUoOcdk.exe
  C:\Windows\System\aUoOcdk.exe
  2⤵
  PID:7144
- C:\Windows\System\yVRGkRD.exe
  C:\Windows\System\yVRGkRD.exe
  2⤵
  PID:7160
- C:\Windows\System\elUacLB.exe
  C:\Windows\System\elUacLB.exe
  2⤵
  PID:6016
- C:\Windows\System\tmuhteM.exe
  C:\Windows\System\tmuhteM.exe
  2⤵
  PID:5956
- C:\Windows\System\kUcZQGi.exe
  C:\Windows\System\kUcZQGi.exe
  2⤵
  PID:4508
- C:\Windows\System\tYPSHUI.exe
  C:\Windows\System\tYPSHUI.exe
  2⤵
  PID:5712
- C:\Windows\System\IctvNeG.exe
  C:\Windows\System\IctvNeG.exe
  2⤵
  PID:6192
- C:\Windows\System\tWRHSQe.exe
  C:\Windows\System\tWRHSQe.exe
  2⤵
  PID:6260
- C:\Windows\System\puEvWuP.exe
  C:\Windows\System\puEvWuP.exe
  2⤵
  PID:6292
- C:\Windows\System\mdLtIYv.exe
  C:\Windows\System\mdLtIYv.exe
  2⤵
  PID:6356
- C:\Windows\System\zzvgdcr.exe
  C:\Windows\System\zzvgdcr.exe
  2⤵
  PID:5372
- C:\Windows\System\DvymEfX.exe
  C:\Windows\System\DvymEfX.exe
  2⤵
  PID:6448
- C:\Windows\System\RWvEDGq.exe
  C:\Windows\System\RWvEDGq.exe
  2⤵
  PID:6180
- C:\Windows\System\QhjGbxV.exe
  C:\Windows\System\QhjGbxV.exe
  2⤵
  PID:6516
- C:\Windows\System\odIrLdz.exe
  C:\Windows\System\odIrLdz.exe
  2⤵
  PID:6548
- C:\Windows\System\nLHlQtM.exe
  C:\Windows\System\nLHlQtM.exe
  2⤵
  PID:6640
- C:\Windows\System\PexUDQI.exe
  C:\Windows\System\PexUDQI.exe
  2⤵
  PID:6740
- C:\Windows\System\IAVUvhi.exe
  C:\Windows\System\IAVUvhi.exe
  2⤵
  PID:6804
- C:\Windows\System\zPpVWdq.exe
  C:\Windows\System\zPpVWdq.exe
  2⤵
  PID:6868
- C:\Windows\System\KaxLcsF.exe
  C:\Windows\System\KaxLcsF.exe
  2⤵
  PID:6932
- C:\Windows\System\QZRQOKG.exe
  C:\Windows\System\QZRQOKG.exe
  2⤵
  PID:6996
- C:\Windows\System\koWvlPY.exe
  C:\Windows\System\koWvlPY.exe
  2⤵
  PID:6212
- C:\Windows\System\jsLfWlK.exe
  C:\Windows\System\jsLfWlK.exe
  2⤵
  PID:6272
- C:\Windows\System\YKWgMOK.exe
  C:\Windows\System\YKWgMOK.exe
  2⤵
  PID:6308
- C:\Windows\System\qLxmeLc.exe
  C:\Windows\System\qLxmeLc.exe
  2⤵
  PID:6372
- C:\Windows\System\inoxafP.exe
  C:\Windows\System\inoxafP.exe
  2⤵
  PID:6436
- C:\Windows\System\oSpNTWV.exe
  C:\Windows\System\oSpNTWV.exe
  2⤵
  PID:7060
- C:\Windows\System\DjLpcUc.exe
  C:\Windows\System\DjLpcUc.exe
  2⤵
  PID:6500
- C:\Windows\System\rqPjuTp.exe
  C:\Windows\System\rqPjuTp.exe
  2⤵
  PID:4960
- C:\Windows\System\xBuAlNl.exe
  C:\Windows\System\xBuAlNl.exe
  2⤵
  PID:7124
- C:\Windows\System\gJKXrYq.exe
  C:\Windows\System\gJKXrYq.exe
  2⤵
  PID:7156
- C:\Windows\System\YiwclQp.exe
  C:\Windows\System\YiwclQp.exe
  2⤵
  PID:5616
- C:\Windows\System\rxPBWGw.exe
  C:\Windows\System\rxPBWGw.exe
  2⤵
  PID:6624
- C:\Windows\System\NXGSIPw.exe
  C:\Windows\System\NXGSIPw.exe
  2⤵
  PID:6480
- C:\Windows\System\eAmpERM.exe
  C:\Windows\System\eAmpERM.exe
  2⤵
  PID:6788
- C:\Windows\System\guvggho.exe
  C:\Windows\System\guvggho.exe
  2⤵
  PID:6852
- C:\Windows\System\ZtMduQj.exe
  C:\Windows\System\ZtMduQj.exe
  2⤵
  PID:6916
- C:\Windows\System\JFpiHMv.exe
  C:\Windows\System\JFpiHMv.exe
  2⤵
  PID:6980
- C:\Windows\System\PAGDVto.exe
  C:\Windows\System\PAGDVto.exe
  2⤵
  PID:7044
- C:\Windows\System\GOkIPNf.exe
  C:\Windows\System\GOkIPNf.exe
  2⤵
  PID:7108
- C:\Windows\System\ONVjpcF.exe
  C:\Windows\System\ONVjpcF.exe
  2⤵
  PID:5808
- C:\Windows\System\eQvpcnf.exe
  C:\Windows\System\eQvpcnf.exe
  2⤵
  PID:6772
- C:\Windows\System\YDENnUb.exe
  C:\Windows\System\YDENnUb.exe
  2⤵
  PID:6928
- C:\Windows\System\OCppJWv.exe
  C:\Windows\System\OCppJWv.exe
  2⤵
  PID:6688
- C:\Windows\System\dKnRodS.exe
  C:\Windows\System\dKnRodS.exe
  2⤵
  PID:6484
- C:\Windows\System\gWJyXLV.exe
  C:\Windows\System\gWJyXLV.exe
  2⤵
  PID:6208
- C:\Windows\System\UEaRTlx.exe
  C:\Windows\System\UEaRTlx.exe
  2⤵
  PID:6864
- C:\Windows\System\EKFtdrt.exe
  C:\Windows\System\EKFtdrt.exe
  2⤵
  PID:5212
- C:\Windows\System\yNRlnnq.exe
  C:\Windows\System\yNRlnnq.exe
  2⤵
  PID:7056
- C:\Windows\System\kgKSlaO.exe
  C:\Windows\System\kgKSlaO.exe
  2⤵
  PID:6404
- C:\Windows\System\AHmOZDv.exe
  C:\Windows\System\AHmOZDv.exe
  2⤵
  PID:6432
- C:\Windows\System\uAbUcaB.exe
  C:\Windows\System\uAbUcaB.exe
  2⤵
  PID:6592
- C:\Windows\System\nRZzbSy.exe
  C:\Windows\System\nRZzbSy.exe
  2⤵
  PID:6884
- C:\Windows\System\AaGKuoP.exe
  C:\Windows\System\AaGKuoP.exe
  2⤵
  PID:6224
- C:\Windows\System\YknrlNZ.exe
  C:\Windows\System\YknrlNZ.exe
  2⤵
  PID:6656
- C:\Windows\System\NEXhSqf.exe
  C:\Windows\System\NEXhSqf.exe
  2⤵
  PID:7076
- C:\Windows\System\papWSOR.exe
  C:\Windows\System\papWSOR.exe
  2⤵
  PID:6160
- C:\Windows\System\CqJlDrT.exe
  C:\Windows\System\CqJlDrT.exe
  2⤵
  PID:6576
- C:\Windows\System\ewmubQr.exe
  C:\Windows\System\ewmubQr.exe
  2⤵
  PID:6580
- C:\Windows\System\pGlPNym.exe
  C:\Windows\System\pGlPNym.exe
  2⤵
  PID:6596
- C:\Windows\System\vVLAqCG.exe
  C:\Windows\System\vVLAqCG.exe
  2⤵
  PID:6720
- C:\Windows\System\fuLGMgU.exe
  C:\Windows\System\fuLGMgU.exe
  2⤵
  PID:6532
- C:\Windows\System\oUsFAcj.exe
  C:\Windows\System\oUsFAcj.exe
  2⤵
  PID:6736
- C:\Windows\System\FyQnrnY.exe
  C:\Windows\System\FyQnrnY.exe
  2⤵
  PID:7152
- C:\Windows\System\CnaZrfN.exe
  C:\Windows\System\CnaZrfN.exe
  2⤵
  PID:7140
- C:\Windows\System\MAaRYtz.exe
  C:\Windows\System\MAaRYtz.exe
  2⤵
  PID:6948
- C:\Windows\System\vrSPdOu.exe
  C:\Windows\System\vrSPdOu.exe
  2⤵
  PID:5780
- C:\Windows\System\xUrsCmw.exe
  C:\Windows\System\xUrsCmw.exe
  2⤵
  PID:6244
- C:\Windows\System\DIBNEsw.exe
  C:\Windows\System\DIBNEsw.exe
  2⤵
  PID:6420
- C:\Windows\System\wfNuotS.exe
  C:\Windows\System\wfNuotS.exe
  2⤵
  PID:7180
- C:\Windows\System\BjtRrFl.exe
  C:\Windows\System\BjtRrFl.exe
  2⤵
  PID:7196
- C:\Windows\System\XULLzke.exe
  C:\Windows\System\XULLzke.exe
  2⤵
  PID:7212
- C:\Windows\System\wCAEdZh.exe
  C:\Windows\System\wCAEdZh.exe
  2⤵
  PID:7228
- C:\Windows\System\ReTYxul.exe
  C:\Windows\System\ReTYxul.exe
  2⤵
  PID:7244
- C:\Windows\System\qhycRLS.exe
  C:\Windows\System\qhycRLS.exe
  2⤵
  PID:7260
- C:\Windows\System\RMPGPMW.exe
  C:\Windows\System\RMPGPMW.exe
  2⤵
  PID:7276
- C:\Windows\System\vqiUaMu.exe
  C:\Windows\System\vqiUaMu.exe
  2⤵
  PID:7292
- C:\Windows\System\ejABjxa.exe
  C:\Windows\System\ejABjxa.exe
  2⤵
  PID:7308
- C:\Windows\System\HWrpEjQ.exe
  C:\Windows\System\HWrpEjQ.exe
  2⤵
  PID:7324
- C:\Windows\System\RYsvFYa.exe
  C:\Windows\System\RYsvFYa.exe
  2⤵
  PID:7344
- C:\Windows\System\YrFcSxu.exe
  C:\Windows\System\YrFcSxu.exe
  2⤵
  PID:7360
- C:\Windows\System\arhdEBs.exe
  C:\Windows\System\arhdEBs.exe
  2⤵
  PID:7376
- C:\Windows\System\xrTTuDr.exe
  C:\Windows\System\xrTTuDr.exe
  2⤵
  PID:7392
- C:\Windows\System\CiRESwj.exe
  C:\Windows\System\CiRESwj.exe
  2⤵
  PID:7408
- C:\Windows\System\ZAgKqQg.exe
  C:\Windows\System\ZAgKqQg.exe
  2⤵
  PID:7424
- C:\Windows\System\VrWWVoK.exe
  C:\Windows\System\VrWWVoK.exe
  2⤵
  PID:7440
- C:\Windows\System\jaiTODC.exe
  C:\Windows\System\jaiTODC.exe
  2⤵
  PID:7456
- C:\Windows\System\syRpQxJ.exe
  C:\Windows\System\syRpQxJ.exe
  2⤵
  PID:7472
- C:\Windows\System\xFZCruE.exe
  C:\Windows\System\xFZCruE.exe
  2⤵
  PID:7488
- C:\Windows\System\Pjidgjv.exe
  C:\Windows\System\Pjidgjv.exe
  2⤵
  PID:7504
- C:\Windows\System\KVUyNDa.exe
  C:\Windows\System\KVUyNDa.exe
  2⤵
  PID:7520
- C:\Windows\System\BFANWNR.exe
  C:\Windows\System\BFANWNR.exe
  2⤵
  PID:7536
- C:\Windows\System\XWxXLem.exe
  C:\Windows\System\XWxXLem.exe
  2⤵
  PID:7552
- C:\Windows\System\degkFUN.exe
  C:\Windows\System\degkFUN.exe
  2⤵
  PID:7568
- C:\Windows\System\EQgaIdM.exe
  C:\Windows\System\EQgaIdM.exe
  2⤵
  PID:7584
- C:\Windows\System\wLTyGvz.exe
  C:\Windows\System\wLTyGvz.exe
  2⤵
  PID:7600
- C:\Windows\System\tGHQnTh.exe
  C:\Windows\System\tGHQnTh.exe
  2⤵
  PID:7616
- C:\Windows\System\HOrvxwq.exe
  C:\Windows\System\HOrvxwq.exe
  2⤵
  PID:7632
- C:\Windows\System\uVvvREu.exe
  C:\Windows\System\uVvvREu.exe
  2⤵
  PID:7648
- C:\Windows\System\EDRpxKe.exe
  C:\Windows\System\EDRpxKe.exe
  2⤵
  PID:7664
- C:\Windows\System\eVyUgLo.exe
  C:\Windows\System\eVyUgLo.exe
  2⤵
  PID:7680
- C:\Windows\System\GGEOefz.exe
  C:\Windows\System\GGEOefz.exe
  2⤵
  PID:7696
- C:\Windows\System\QuLDItk.exe
  C:\Windows\System\QuLDItk.exe
  2⤵
  PID:7712
- C:\Windows\System\IjOpENv.exe
  C:\Windows\System\IjOpENv.exe
  2⤵
  PID:7732
- C:\Windows\System\ZdKfmMB.exe
  C:\Windows\System\ZdKfmMB.exe
  2⤵
  PID:7748
- C:\Windows\System\DXakggF.exe
  C:\Windows\System\DXakggF.exe
  2⤵
  PID:7764
- C:\Windows\System\wxBoxdk.exe
  C:\Windows\System\wxBoxdk.exe
  2⤵
  PID:7780
- C:\Windows\System\WxYpzZK.exe
  C:\Windows\System\WxYpzZK.exe
  2⤵
  PID:7796
- C:\Windows\System\eBWyYvH.exe
  C:\Windows\System\eBWyYvH.exe
  2⤵
  PID:7812
- C:\Windows\System\WzSKErG.exe
  C:\Windows\System\WzSKErG.exe
  2⤵
  PID:7828
- C:\Windows\System\tfwjzFG.exe
  C:\Windows\System\tfwjzFG.exe
  2⤵
  PID:7844
- C:\Windows\System\TYgfQIO.exe
  C:\Windows\System\TYgfQIO.exe
  2⤵
  PID:7860
- C:\Windows\System\aIcBJSs.exe
  C:\Windows\System\aIcBJSs.exe
  2⤵
  PID:7876
- C:\Windows\System\JLXOsSC.exe
  C:\Windows\System\JLXOsSC.exe
  2⤵
  PID:7892
- C:\Windows\System\pWMudFh.exe
  C:\Windows\System\pWMudFh.exe
  2⤵
  PID:7908
- C:\Windows\System\qcknniw.exe
  C:\Windows\System\qcknniw.exe
  2⤵
  PID:7924
- C:\Windows\System\xgdNFaH.exe
  C:\Windows\System\xgdNFaH.exe
  2⤵
  PID:7944
- C:\Windows\System\eivnkvg.exe
  C:\Windows\System\eivnkvg.exe
  2⤵
  PID:7960
- C:\Windows\System\sJvByQz.exe
  C:\Windows\System\sJvByQz.exe
  2⤵
  PID:7976
- C:\Windows\System\skhEGtj.exe
  C:\Windows\System\skhEGtj.exe
  2⤵
  PID:7992
- C:\Windows\System\MpxMMdq.exe
  C:\Windows\System\MpxMMdq.exe
  2⤵
  PID:8008
- C:\Windows\System\BYOpcqq.exe
  C:\Windows\System\BYOpcqq.exe
  2⤵
  PID:8024
- C:\Windows\System\dbuWHem.exe
  C:\Windows\System\dbuWHem.exe
  2⤵
  PID:8040
- C:\Windows\System\xFBHyeM.exe
  C:\Windows\System\xFBHyeM.exe
  2⤵
  PID:8056
- C:\Windows\System\DpIBuNA.exe
  C:\Windows\System\DpIBuNA.exe
  2⤵
  PID:8072
- C:\Windows\System\uuJvYHM.exe
  C:\Windows\System\uuJvYHM.exe
  2⤵
  PID:8088
- C:\Windows\System\GVNMIvx.exe
  C:\Windows\System\GVNMIvx.exe
  2⤵
  PID:8104
- C:\Windows\System\ZbBAukc.exe
  C:\Windows\System\ZbBAukc.exe
  2⤵
  PID:8120
- C:\Windows\System\xqCYHrJ.exe
  C:\Windows\System\xqCYHrJ.exe
  2⤵
  PID:8136
- C:\Windows\System\GolFBnT.exe
  C:\Windows\System\GolFBnT.exe
  2⤵
  PID:8156
- C:\Windows\System\raSGapl.exe
  C:\Windows\System\raSGapl.exe
  2⤵
  PID:8172
- C:\Windows\System\OUKbtIg.exe
  C:\Windows\System\OUKbtIg.exe
  2⤵
  PID:6320
- C:\Windows\System\ZBwUwZn.exe
  C:\Windows\System\ZBwUwZn.exe
  2⤵
  PID:7192
- C:\Windows\System\qwiBlyV.exe
  C:\Windows\System\qwiBlyV.exe
  2⤵
  PID:6612
- C:\Windows\System\vluIsmq.exe
  C:\Windows\System\vluIsmq.exe
  2⤵
  PID:7284
- C:\Windows\System\kIRFAIi.exe
  C:\Windows\System\kIRFAIi.exe
  2⤵
  PID:7352
- C:\Windows\System\MyhyzWK.exe
  C:\Windows\System\MyhyzWK.exe
  2⤵
  PID:7416
- C:\Windows\System\UTwbxhX.exe
  C:\Windows\System\UTwbxhX.exe
  2⤵
  PID:6468
- C:\Windows\System\jUZmQal.exe
  C:\Windows\System\jUZmQal.exe
  2⤵
  PID:7484
- C:\Windows\System\jRZPgaQ.exe
  C:\Windows\System\jRZPgaQ.exe
  2⤵
  PID:7176
- C:\Windows\System\GYwrCqT.exe
  C:\Windows\System\GYwrCqT.exe
  2⤵
  PID:7268
- C:\Windows\System\zLVWEFf.exe
  C:\Windows\System\zLVWEFf.exe
  2⤵
  PID:7548
- C:\Windows\System\WrgTwzh.exe
  C:\Windows\System\WrgTwzh.exe
  2⤵
  PID:7612
- C:\Windows\System\lOwEiLh.exe
  C:\Windows\System\lOwEiLh.exe
  2⤵
  PID:7368
- C:\Windows\System\aYLtLbv.exe
  C:\Windows\System\aYLtLbv.exe
  2⤵
  PID:7432
- C:\Windows\System\vJjDDKV.exe
  C:\Windows\System\vJjDDKV.exe
  2⤵
  PID:7672
- C:\Windows\System\FlsdKll.exe
  C:\Windows\System\FlsdKll.exe
  2⤵
  PID:7500
- C:\Windows\System\tGvZHhg.exe
  C:\Windows\System\tGvZHhg.exe
  2⤵
  PID:7740
- C:\Windows\System\QpNPOZY.exe
  C:\Windows\System\QpNPOZY.exe
  2⤵
  PID:7592
- C:\Windows\System\QftrqoS.exe
  C:\Windows\System\QftrqoS.exe
  2⤵
  PID:7692
- C:\Windows\System\nzOAnbR.exe
  C:\Windows\System\nzOAnbR.exe
  2⤵
  PID:7756
- C:\Windows\System\NMbxMsh.exe
  C:\Windows\System\NMbxMsh.exe
  2⤵
  PID:7820
- C:\Windows\System\PQZieWj.exe
  C:\Windows\System\PQZieWj.exe
  2⤵
  PID:7804
- C:\Windows\System\AaupABx.exe
  C:\Windows\System\AaupABx.exe
  2⤵
  PID:7872
- C:\Windows\System\XaORerU.exe
  C:\Windows\System\XaORerU.exe
  2⤵
  PID:7856
- C:\Windows\System\fRGpeMS.exe
  C:\Windows\System\fRGpeMS.exe
  2⤵
  PID:7916
- C:\Windows\System\WcbdERF.exe
  C:\Windows\System\WcbdERF.exe
  2⤵
  PID:7956
- C:\Windows\System\iQpvtju.exe
  C:\Windows\System\iQpvtju.exe
  2⤵
  PID:8004
- C:\Windows\System\FnLuITi.exe
  C:\Windows\System\FnLuITi.exe
  2⤵
  PID:8036
- C:\Windows\System\dxFxQSv.exe
  C:\Windows\System\dxFxQSv.exe
  2⤵
  PID:8052
- C:\Windows\System\qPJwnFt.exe
  C:\Windows\System\qPJwnFt.exe
  2⤵
  PID:8128
- C:\Windows\System\FpKVQyb.exe
  C:\Windows\System\FpKVQyb.exe
  2⤵
  PID:8084
- C:\Windows\System\FLzIGrh.exe
  C:\Windows\System\FLzIGrh.exe
  2⤵
  PID:8112
- C:\Windows\System\VbsbZoH.exe
  C:\Windows\System\VbsbZoH.exe
  2⤵
  PID:8144
- C:\Windows\System\QXUqqny.exe
  C:\Windows\System\QXUqqny.exe
  2⤵
  PID:7452
- C:\Windows\System\NEXkQdB.exe
  C:\Windows\System\NEXkQdB.exe
  2⤵
  PID:6256
- C:\Windows\System\tkMcFKz.exe
  C:\Windows\System\tkMcFKz.exe
  2⤵
  PID:8184
- C:\Windows\System\cWLBpxk.exe
  C:\Windows\System\cWLBpxk.exe
  2⤵
  PID:1508
- C:\Windows\System\IcvrBak.exe
  C:\Windows\System\IcvrBak.exe
  2⤵
  PID:7208
- C:\Windows\System\UqNXzuj.exe
  C:\Windows\System\UqNXzuj.exe
  2⤵
  PID:5440
- C:\Windows\System\qhxSvGW.exe
  C:\Windows\System\qhxSvGW.exe
  2⤵
  PID:7580
- C:\Windows\System\CsdDHGH.exe
  C:\Windows\System\CsdDHGH.exe
  2⤵
  PID:7468
- C:\Windows\System\duomwho.exe
  C:\Windows\System\duomwho.exe
  2⤵
  PID:7724
- C:\Windows\System\WSKwFKE.exe
  C:\Windows\System\WSKwFKE.exe
  2⤵
  PID:7904
- C:\Windows\System\SagGOIG.exe
  C:\Windows\System\SagGOIG.exe
  2⤵
  PID:8032
- C:\Windows\System\AXyzTpI.exe
  C:\Windows\System\AXyzTpI.exe
  2⤵
  PID:7300
- C:\Windows\System\dLITKXU.exe
  C:\Windows\System\dLITKXU.exe
  2⤵
  PID:7372
- C:\Windows\System\TVZWccp.exe
  C:\Windows\System\TVZWccp.exe
  2⤵
  PID:7332
- C:\Windows\System\MDtgczr.exe
  C:\Windows\System\MDtgczr.exe
  2⤵
  PID:8000
- C:\Windows\System\xYWWdEz.exe
  C:\Windows\System\xYWWdEz.exe
  2⤵
  PID:7688
- C:\Windows\System\tuQJzpx.exe
  C:\Windows\System\tuQJzpx.exe
  2⤵
  PID:8100
- C:\Windows\System\PjooPlP.exe
  C:\Windows\System\PjooPlP.exe
  2⤵
  PID:8148
- C:\Windows\System\cmYQNhA.exe
  C:\Windows\System\cmYQNhA.exe
  2⤵
  PID:7288
- C:\Windows\System\MNLhGbH.exe
  C:\Windows\System\MNLhGbH.exe
  2⤵
  PID:7320
- C:\Windows\System\uvmewSb.exe
  C:\Windows\System\uvmewSb.exe
  2⤵
  PID:7400
- C:\Windows\System\VJgZYrI.exe
  C:\Windows\System\VJgZYrI.exe
  2⤵
  PID:7464
- C:\Windows\System\aRGkfJq.exe
  C:\Windows\System\aRGkfJq.exe
  2⤵
  PID:6900
- C:\Windows\System\ZrRvhnQ.exe
  C:\Windows\System\ZrRvhnQ.exe
  2⤵
  PID:7888
- C:\Windows\System\MuRhHYn.exe
  C:\Windows\System\MuRhHYn.exe
  2⤵
  PID:7404
- C:\Windows\System\KPybUFC.exe
  C:\Windows\System\KPybUFC.exe
  2⤵
  PID:7772
- C:\Windows\System\BZawLcS.exe
  C:\Windows\System\BZawLcS.exe
  2⤵
  PID:7544
- C:\Windows\System\YKRnmFP.exe
  C:\Windows\System\YKRnmFP.exe
  2⤵
  PID:6756
- C:\Windows\System\hkCEOQk.exe
  C:\Windows\System\hkCEOQk.exe
  2⤵
  PID:7480
- C:\Windows\System\lTohJWq.exe
  C:\Windows\System\lTohJWq.exe
  2⤵
  PID:7240
- C:\Windows\System\kvqUWAZ.exe
  C:\Windows\System\kvqUWAZ.exe
  2⤵
  PID:7528
- C:\Windows\System\jhNvmfa.exe
  C:\Windows\System\jhNvmfa.exe
  2⤵
  PID:8068
- C:\Windows\System\ssvFULU.exe
  C:\Windows\System\ssvFULU.exe
  2⤵
  PID:7884
- C:\Windows\System\KXzupSO.exe
  C:\Windows\System\KXzupSO.exe
  2⤵
  PID:8188
- C:\Windows\System\UnIneML.exe
  C:\Windows\System\UnIneML.exe
  2⤵
  PID:7596
- C:\Windows\System\jpRCdAw.exe
  C:\Windows\System\jpRCdAw.exe
  2⤵
  PID:8048
- C:\Windows\System\jJYBXwH.exe
  C:\Windows\System\jJYBXwH.exe
  2⤵
  PID:7516
- C:\Windows\System\vIWiTGo.exe
  C:\Windows\System\vIWiTGo.exe
  2⤵
  PID:7340
- C:\Windows\System\yAWXEEi.exe
  C:\Windows\System\yAWXEEi.exe
  2⤵
  PID:8152
- C:\Windows\System\JuYRMml.exe
  C:\Windows\System\JuYRMml.exe
  2⤵
  PID:8208
- C:\Windows\System\YXygWoi.exe
  C:\Windows\System\YXygWoi.exe
  2⤵
  PID:8224
- C:\Windows\System\KNIKtIa.exe
  C:\Windows\System\KNIKtIa.exe
  2⤵
  PID:8240
- C:\Windows\System\FbyrpQt.exe
  C:\Windows\System\FbyrpQt.exe
  2⤵
  PID:8256
- C:\Windows\System\vDEoruK.exe
  C:\Windows\System\vDEoruK.exe
  2⤵
  PID:8272
- C:\Windows\System\sIRWeSD.exe
  C:\Windows\System\sIRWeSD.exe
  2⤵
  PID:8288
- C:\Windows\System\dfJGdJa.exe
  C:\Windows\System\dfJGdJa.exe
  2⤵
  PID:8304
- C:\Windows\System\nZxkeaQ.exe
  C:\Windows\System\nZxkeaQ.exe
  2⤵
  PID:8320
- C:\Windows\System\tFqrasl.exe
  C:\Windows\System\tFqrasl.exe
  2⤵
  PID:8336
- C:\Windows\System\dLObWOQ.exe
  C:\Windows\System\dLObWOQ.exe
  2⤵
  PID:8352
- C:\Windows\System\ahQHzMP.exe
  C:\Windows\System\ahQHzMP.exe
  2⤵
  PID:8368
- C:\Windows\System\zYAtbRM.exe
  C:\Windows\System\zYAtbRM.exe
  2⤵
  PID:8384
- C:\Windows\System\lsIgomy.exe
  C:\Windows\System\lsIgomy.exe
  2⤵
  PID:8400
- C:\Windows\System\eSnCUna.exe
  C:\Windows\System\eSnCUna.exe
  2⤵
  PID:8416
- C:\Windows\System\egamaxj.exe
  C:\Windows\System\egamaxj.exe
  2⤵
  PID:8432
- C:\Windows\System\FwkXsDC.exe
  C:\Windows\System\FwkXsDC.exe
  2⤵
  PID:8448
- C:\Windows\System\VutSkwq.exe
  C:\Windows\System\VutSkwq.exe
  2⤵
  PID:8464
- C:\Windows\System\KsvypMQ.exe
  C:\Windows\System\KsvypMQ.exe
  2⤵
  PID:8480
- C:\Windows\System\FQSkNJU.exe
  C:\Windows\System\FQSkNJU.exe
  2⤵
  PID:8496
- C:\Windows\System\ChnHCqq.exe
  C:\Windows\System\ChnHCqq.exe
  2⤵
  PID:8512
- C:\Windows\System\RIPQplv.exe
  C:\Windows\System\RIPQplv.exe
  2⤵
  PID:8528
- C:\Windows\System\kvoFERM.exe
  C:\Windows\System\kvoFERM.exe
  2⤵
  PID:8544
- C:\Windows\System\wYGsZDb.exe
  C:\Windows\System\wYGsZDb.exe
  2⤵
  PID:8560
- C:\Windows\System\hjDMDFl.exe
  C:\Windows\System\hjDMDFl.exe
  2⤵
  PID:8576
- C:\Windows\System\yIIVfET.exe
  C:\Windows\System\yIIVfET.exe
  2⤵
  PID:8592
- C:\Windows\System\tzsKltB.exe
  C:\Windows\System\tzsKltB.exe
  2⤵
  PID:8608
- C:\Windows\System\aXFonTQ.exe
  C:\Windows\System\aXFonTQ.exe
  2⤵
  PID:8624
- C:\Windows\System\GKLZtxO.exe
  C:\Windows\System\GKLZtxO.exe
  2⤵
  PID:8640
- C:\Windows\System\eqbcOwP.exe
  C:\Windows\System\eqbcOwP.exe
  2⤵
  PID:8656
- C:\Windows\System\QPeIZFW.exe
  C:\Windows\System\QPeIZFW.exe
  2⤵
  PID:8672
- C:\Windows\System\RFenIWT.exe
  C:\Windows\System\RFenIWT.exe
  2⤵
  PID:8688
- C:\Windows\System\CKMXEat.exe
  C:\Windows\System\CKMXEat.exe
  2⤵
  PID:8704
- C:\Windows\System\aKyxaRk.exe
  C:\Windows\System\aKyxaRk.exe
  2⤵
  PID:8720
- C:\Windows\System\ikJhczn.exe
  C:\Windows\System\ikJhczn.exe
  2⤵
  PID:8740
- C:\Windows\System\YXRdmWc.exe
  C:\Windows\System\YXRdmWc.exe
  2⤵
  PID:8756
- C:\Windows\System\vssCKMa.exe
  C:\Windows\System\vssCKMa.exe
  2⤵
  PID:8772
- C:\Windows\System\HkLOier.exe
  C:\Windows\System\HkLOier.exe
  2⤵
  PID:8788
- C:\Windows\System\pFWAMhs.exe
  C:\Windows\System\pFWAMhs.exe
  2⤵
  PID:8804
- C:\Windows\System\EjELiwj.exe
  C:\Windows\System\EjELiwj.exe
  2⤵
  PID:8820
- C:\Windows\System\NhpRBkv.exe
  C:\Windows\System\NhpRBkv.exe
  2⤵
  PID:8836
- C:\Windows\System\BrynBbx.exe
  C:\Windows\System\BrynBbx.exe
  2⤵
  PID:8852
- C:\Windows\System\jxCsFsp.exe
  C:\Windows\System\jxCsFsp.exe
  2⤵
  PID:8868
- C:\Windows\System\VekvmbC.exe
  C:\Windows\System\VekvmbC.exe
  2⤵
  PID:8884
- C:\Windows\System\JTWPCDc.exe
  C:\Windows\System\JTWPCDc.exe
  2⤵
  PID:8900
- C:\Windows\System\bHoKqmh.exe
  C:\Windows\System\bHoKqmh.exe
  2⤵
  PID:8916
- C:\Windows\System\lhsqWNH.exe
  C:\Windows\System\lhsqWNH.exe
  2⤵
  PID:8932
- C:\Windows\System\kBXCJNV.exe
  C:\Windows\System\kBXCJNV.exe
  2⤵
  PID:8948
- C:\Windows\System\CnkiOLc.exe
  C:\Windows\System\CnkiOLc.exe
  2⤵
  PID:8964
- C:\Windows\System\JtrcKqP.exe
  C:\Windows\System\JtrcKqP.exe
  2⤵
  PID:8980
- C:\Windows\System\MEZzcWf.exe
  C:\Windows\System\MEZzcWf.exe
  2⤵
  PID:8996
- C:\Windows\System\FeaqITt.exe
  C:\Windows\System\FeaqITt.exe
  2⤵
  PID:9012
- C:\Windows\System\IClJYSm.exe
  C:\Windows\System\IClJYSm.exe
  2⤵
  PID:9028
- C:\Windows\System\ofIYFNG.exe
  C:\Windows\System\ofIYFNG.exe
  2⤵
  PID:9044
- C:\Windows\System\lOMVfsT.exe
  C:\Windows\System\lOMVfsT.exe
  2⤵
  PID:9060
- C:\Windows\System\rJdGnLE.exe
  C:\Windows\System\rJdGnLE.exe
  2⤵
  PID:9076
- C:\Windows\System\gqdFseq.exe
  C:\Windows\System\gqdFseq.exe
  2⤵
  PID:9092
- C:\Windows\System\LYCDJsc.exe
  C:\Windows\System\LYCDJsc.exe
  2⤵
  PID:9108
- C:\Windows\System\WMVNsbp.exe
  C:\Windows\System\WMVNsbp.exe
  2⤵
  PID:9124
- C:\Windows\System\ofaiWpv.exe
  C:\Windows\System\ofaiWpv.exe
  2⤵
  PID:9140
- C:\Windows\System\hEPieIL.exe
  C:\Windows\System\hEPieIL.exe
  2⤵
  PID:9156
- C:\Windows\System\RUdGazT.exe
  C:\Windows\System\RUdGazT.exe
  2⤵
  PID:9176
- C:\Windows\System\jbLQMwK.exe
  C:\Windows\System\jbLQMwK.exe
  2⤵
  PID:9192
- C:\Windows\System\XgWaXNQ.exe
  C:\Windows\System\XgWaXNQ.exe
  2⤵
  PID:9208
- C:\Windows\System\XfPbAqY.exe
  C:\Windows\System\XfPbAqY.exe
  2⤵
  PID:8200
- C:\Windows\System\TyAnqvh.exe
  C:\Windows\System\TyAnqvh.exe
  2⤵
  PID:8232
- C:\Windows\System\NcysGpp.exe
  C:\Windows\System\NcysGpp.exe
  2⤵
  PID:8280
- C:\Windows\System\zMfYvTC.exe
  C:\Windows\System\zMfYvTC.exe
  2⤵
  PID:8296
- C:\Windows\System\kbCTxfg.exe
  C:\Windows\System\kbCTxfg.exe
  2⤵
  PID:8332
- C:\Windows\System\LofeIcD.exe
  C:\Windows\System\LofeIcD.exe
  2⤵
  PID:8380
- C:\Windows\System\mYtEfAW.exe
  C:\Windows\System\mYtEfAW.exe
  2⤵
  PID:8424
- C:\Windows\System\GQBFApd.exe
  C:\Windows\System\GQBFApd.exe
  2⤵
  PID:8504
- C:\Windows\System\fyMHevs.exe
  C:\Windows\System\fyMHevs.exe
  2⤵
  PID:8460
- C:\Windows\System\VMSSGgM.exe
  C:\Windows\System\VMSSGgM.exe
  2⤵
  PID:8572
- C:\Windows\System\gndxqyq.exe
  C:\Windows\System\gndxqyq.exe
  2⤵
  PID:8600
- C:\Windows\System\FVZdQAg.exe
  C:\Windows\System\FVZdQAg.exe
  2⤵
  PID:8604
- C:\Windows\System\comTZUu.exe
  C:\Windows\System\comTZUu.exe
  2⤵
  PID:8664
- C:\Windows\System\CypGoBQ.exe
  C:\Windows\System\CypGoBQ.exe
  2⤵
  PID:6976
- C:\Windows\System\cDBsXjT.exe
  C:\Windows\System\cDBsXjT.exe
  2⤵
  PID:8736
- C:\Windows\System\fjgrbWY.exe
  C:\Windows\System\fjgrbWY.exe
  2⤵
  PID:8716
- C:\Windows\System\SQIEKHf.exe
  C:\Windows\System\SQIEKHf.exe
  2⤵
  PID:8768
- C:\Windows\System\reejUqN.exe
  C:\Windows\System\reejUqN.exe
  2⤵
  PID:8832
- C:\Windows\System\JqGtGyN.exe
  C:\Windows\System\JqGtGyN.exe
  2⤵
  PID:8896
- C:\Windows\System\vWdtZDX.exe
  C:\Windows\System\vWdtZDX.exe
  2⤵
  PID:8960
- C:\Windows\System\oztcaca.exe
  C:\Windows\System\oztcaca.exe
  2⤵
  PID:8812
- C:\Windows\System\SKLBODp.exe
  C:\Windows\System\SKLBODp.exe
  2⤵
  PID:8844
- C:\Windows\System\mzEWYXS.exe
  C:\Windows\System\mzEWYXS.exe
  2⤵
  PID:9084
- C:\Windows\System\PnbTvQD.exe
  C:\Windows\System\PnbTvQD.exe
  2⤵
  PID:9036
- C:\Windows\System\UxdCwnf.exe
  C:\Windows\System\UxdCwnf.exe
  2⤵
  PID:8912
- C:\Windows\System\LjufoSC.exe
  C:\Windows\System\LjufoSC.exe
  2⤵
  PID:9072
- C:\Windows\System\TMPFzwN.exe
  C:\Windows\System\TMPFzwN.exe
  2⤵
  PID:9100
- C:\Windows\System\hIyzuAs.exe
  C:\Windows\System\hIyzuAs.exe
  2⤵
  PID:9068
- C:\Windows\System\gbbrPez.exe
  C:\Windows\System\gbbrPez.exe
  2⤵
  PID:9184
- C:\Windows\System\rIGtbrK.exe
  C:\Windows\System\rIGtbrK.exe
  2⤵
  PID:9172
- C:\Windows\System\AFKNoez.exe
  C:\Windows\System\AFKNoez.exe
  2⤵
  PID:9204
- C:\Windows\System\vjQEXsf.exe
  C:\Windows\System\vjQEXsf.exe
  2⤵
  PID:7936
- C:\Windows\System\Mtuuqpa.exe
  C:\Windows\System\Mtuuqpa.exe
  2⤵
  PID:8220
- C:\Windows\System\qUJHzhc.exe
  C:\Windows\System\qUJHzhc.exe
  2⤵
  PID:8316
- C:\Windows\System\hzFaYMX.exe
  C:\Windows\System\hzFaYMX.exe
  2⤵
  PID:8396
- C:\Windows\System\YVHdLIU.exe
  C:\Windows\System\YVHdLIU.exe
  2⤵
  PID:8364
- C:\Windows\System\MWyyBFE.exe
  C:\Windows\System\MWyyBFE.exe
  2⤵
  PID:8476
- C:\Windows\System\obDwiib.exe
  C:\Windows\System\obDwiib.exe
  2⤵
  PID:8444
- C:\Windows\System\RasTIuD.exe
  C:\Windows\System\RasTIuD.exe
  2⤵
  PID:8588
- C:\Windows\System\uAhwfRY.exe
  C:\Windows\System\uAhwfRY.exe
  2⤵
  PID:8684
- C:\Windows\System\wNwxBlX.exe
  C:\Windows\System\wNwxBlX.exe
  2⤵
  PID:8752
- C:\Windows\System\hxKgWlq.exe
  C:\Windows\System\hxKgWlq.exe
  2⤵
  PID:8800
- C:\Windows\System\cWfuIqp.exe
  C:\Windows\System\cWfuIqp.exe
  2⤵
  PID:1728
- C:\Windows\System\KWTVVcK.exe
  C:\Windows\System\KWTVVcK.exe
  2⤵
  PID:9024
- C:\Windows\System\NfRgtro.exe
  C:\Windows\System\NfRgtro.exe
  2⤵
  PID:8908
- C:\Windows\System\QfrEKzA.exe
  C:\Windows\System\QfrEKzA.exe
  2⤵
  PID:8940
- C:\Windows\System\YWXdvtG.exe
  C:\Windows\System\YWXdvtG.exe
  2⤵
  PID:9004
- C:\Windows\System\HxHkoRS.exe
  C:\Windows\System\HxHkoRS.exe
  2⤵
  PID:9008
- C:\Windows\System\YoCdWse.exe
  C:\Windows\System\YoCdWse.exe
  2⤵
  PID:8080
- C:\Windows\System\KbyWqDa.exe
  C:\Windows\System\KbyWqDa.exe
  2⤵
  PID:8376
- C:\Windows\System\mUnwFAA.exe
  C:\Windows\System\mUnwFAA.exe
  2⤵
  PID:8524
- C:\Windows\System\BzhocNQ.exe
  C:\Windows\System\BzhocNQ.exe
  2⤵
  PID:8440
- C:\Windows\System\AJJzYKq.exe
  C:\Windows\System\AJJzYKq.exe
  2⤵
  PID:8616
- C:\Windows\System\fRitZZi.exe
  C:\Windows\System\fRitZZi.exe
  2⤵
  PID:8828
- C:\Windows\System\JsWjSsI.exe
  C:\Windows\System\JsWjSsI.exe
  2⤵
  PID:8712
- C:\Windows\System\aISXrWV.exe
  C:\Windows\System\aISXrWV.exe
  2⤵
  PID:9152
- C:\Windows\System\ZPDVhkc.exe
  C:\Windows\System\ZPDVhkc.exe
  2⤵
  PID:9168
- C:\Windows\System\gcAtHWQ.exe
  C:\Windows\System\gcAtHWQ.exe
  2⤵
  PID:8268
- C:\Windows\System\WXqvZII.exe
  C:\Windows\System\WXqvZII.exe
  2⤵
  PID:8732
- C:\Windows\System\cNRQvdC.exe
  C:\Windows\System\cNRQvdC.exe
  2⤵
  PID:8584
- C:\Windows\System\PdDfBte.exe
  C:\Windows\System\PdDfBte.exe
  2⤵
  PID:8956
- C:\Windows\System\UZTILCE.exe
  C:\Windows\System\UZTILCE.exe
  2⤵
  PID:8456
- C:\Windows\System\ymYIEiB.exe
  C:\Windows\System\ymYIEiB.exe
  2⤵
  PID:8880
- C:\Windows\System\msmLReb.exe
  C:\Windows\System\msmLReb.exe
  2⤵
  PID:9120
- C:\Windows\System\CbeyQAD.exe
  C:\Windows\System\CbeyQAD.exe
  2⤵
  PID:8520
- C:\Windows\System\lCteZWc.exe
  C:\Windows\System\lCteZWc.exe
  2⤵
  PID:9220
- C:\Windows\System\biOOaaF.exe
  C:\Windows\System\biOOaaF.exe
  2⤵
  PID:9248
- C:\Windows\System\GlFpwlv.exe
  C:\Windows\System\GlFpwlv.exe
  2⤵
  PID:9264
- C:\Windows\System\LvyHOXa.exe
  C:\Windows\System\LvyHOXa.exe
  2⤵
  PID:9284
- C:\Windows\System\SQljKeq.exe
  C:\Windows\System\SQljKeq.exe
  2⤵
  PID:9300
- C:\Windows\System\MoavbHx.exe
  C:\Windows\System\MoavbHx.exe
  2⤵
  PID:9316
- C:\Windows\System\Ueqwefk.exe
  C:\Windows\System\Ueqwefk.exe
  2⤵
  PID:9340
- C:\Windows\System\FJzMycB.exe
  C:\Windows\System\FJzMycB.exe
  2⤵
  PID:9356
- C:\Windows\System\RSjtRmS.exe
  C:\Windows\System\RSjtRmS.exe
  2⤵
  PID:9380
- C:\Windows\System\CZYKiHF.exe
  C:\Windows\System\CZYKiHF.exe
  2⤵
  PID:9396
- C:\Windows\System\POdiRjL.exe
  C:\Windows\System\POdiRjL.exe
  2⤵
  PID:9420
- C:\Windows\System\YIyhiVG.exe
  C:\Windows\System\YIyhiVG.exe
  2⤵
  PID:9440
- C:\Windows\System\GZwekCw.exe
  C:\Windows\System\GZwekCw.exe
  2⤵
  PID:9464
- C:\Windows\System\DttKVQo.exe
  C:\Windows\System\DttKVQo.exe
  2⤵
  PID:9484
- C:\Windows\System\pkvBZpA.exe
  C:\Windows\System\pkvBZpA.exe
  2⤵
  PID:9504
- C:\Windows\System\gBXvoHs.exe
  C:\Windows\System\gBXvoHs.exe
  2⤵
  PID:9532
- C:\Windows\System\JyTpLNX.exe
  C:\Windows\System\JyTpLNX.exe
  2⤵
  PID:9548
- C:\Windows\System\mpRDXUq.exe
  C:\Windows\System\mpRDXUq.exe
  2⤵
  PID:9564
- C:\Windows\System\TVQHOEQ.exe
  C:\Windows\System\TVQHOEQ.exe
  2⤵
  PID:9580
- C:\Windows\System\ZtHWISR.exe
  C:\Windows\System\ZtHWISR.exe
  2⤵
  PID:9604
- C:\Windows\System\WxXgQxo.exe
  C:\Windows\System\WxXgQxo.exe
  2⤵
  PID:9620
- C:\Windows\System\sKWcaXf.exe
  C:\Windows\System\sKWcaXf.exe
  2⤵
  PID:9636
- C:\Windows\System\dhGbZMZ.exe
  C:\Windows\System\dhGbZMZ.exe
  2⤵
  PID:9656
- C:\Windows\System\IQnKRNB.exe
  C:\Windows\System\IQnKRNB.exe
  2⤵
  PID:9676
- C:\Windows\System\MXcTKlw.exe
  C:\Windows\System\MXcTKlw.exe
  2⤵
  PID:9692
- C:\Windows\System\gvCfFmm.exe
  C:\Windows\System\gvCfFmm.exe
  2⤵
  PID:9708
- C:\Windows\System\CTnlJOJ.exe
  C:\Windows\System\CTnlJOJ.exe
  2⤵
  PID:9724
- C:\Windows\System\ZMIpOEo.exe
  C:\Windows\System\ZMIpOEo.exe
  2⤵
  PID:9744
- C:\Windows\System\NLspxKv.exe
  C:\Windows\System\NLspxKv.exe
  2⤵
  PID:9768
- C:\Windows\System\rgDohcg.exe
  C:\Windows\System\rgDohcg.exe
  2⤵
  PID:9784
- C:\Windows\System\wpnhIrR.exe
  C:\Windows\System\wpnhIrR.exe
  2⤵
  PID:9800
- C:\Windows\System\gajEMlj.exe
  C:\Windows\System\gajEMlj.exe
  2⤵
  PID:9816
- C:\Windows\System\vyFyOHO.exe
  C:\Windows\System\vyFyOHO.exe
  2⤵
  PID:9832
- C:\Windows\System\mlsZsBw.exe
  C:\Windows\System\mlsZsBw.exe
  2⤵
  PID:9852
- C:\Windows\System\KQJsVLi.exe
  C:\Windows\System\KQJsVLi.exe
  2⤵
  PID:9868
- C:\Windows\System\xDpLlFG.exe
  C:\Windows\System\xDpLlFG.exe
  2⤵
  PID:9892
- C:\Windows\System\gDXoxyM.exe
  C:\Windows\System\gDXoxyM.exe
  2⤵
  PID:9908
- C:\Windows\System\BcXmDgZ.exe
  C:\Windows\System\BcXmDgZ.exe
  2⤵
  PID:9924
- C:\Windows\System\EliiVPN.exe
  C:\Windows\System\EliiVPN.exe
  2⤵
  PID:9944
- C:\Windows\System\JHOnZFl.exe
  C:\Windows\System\JHOnZFl.exe
  2⤵
  PID:9960
- C:\Windows\System\RTcpesC.exe
  C:\Windows\System\RTcpesC.exe
  2⤵
  PID:9980
- C:\Windows\System\iIEKiYq.exe
  C:\Windows\System\iIEKiYq.exe
  2⤵
  PID:10000
- C:\Windows\System\JZdhgFY.exe
  C:\Windows\System\JZdhgFY.exe
  2⤵
  PID:10016
- C:\Windows\System\GDtgTli.exe
  C:\Windows\System\GDtgTli.exe
  2⤵
  PID:10040
- C:\Windows\System\ShKqWJc.exe
  C:\Windows\System\ShKqWJc.exe
  2⤵
  PID:10060
- C:\Windows\System\avQmVbE.exe
  C:\Windows\System\avQmVbE.exe
  2⤵
  PID:10080
- C:\Windows\System\vVUSWjl.exe
  C:\Windows\System\vVUSWjl.exe
  2⤵
  PID:10100
- C:\Windows\System\veHAXWq.exe
  C:\Windows\System\veHAXWq.exe
  2⤵
  PID:10116
- C:\Windows\System\qxeMLdw.exe
  C:\Windows\System\qxeMLdw.exe
  2⤵
  PID:10136
- C:\Windows\System\FeNPzyz.exe
  C:\Windows\System\FeNPzyz.exe
  2⤵
  PID:10152
- C:\Windows\System\QhDwBGF.exe
  C:\Windows\System\QhDwBGF.exe
  2⤵
  PID:10172
- C:\Windows\System\DFSNJoo.exe
  C:\Windows\System\DFSNJoo.exe
  2⤵
  PID:10188
- C:\Windows\System\cJvIQNn.exe
  C:\Windows\System\cJvIQNn.exe
  2⤵
  PID:10212
- C:\Windows\System\dxeZzOV.exe
  C:\Windows\System\dxeZzOV.exe
  2⤵
  PID:10232
- C:\Windows\System\RaxJBKZ.exe
  C:\Windows\System\RaxJBKZ.exe
  2⤵
  PID:9236
- C:\Windows\System\FtALGpH.exe
  C:\Windows\System\FtALGpH.exe
  2⤵
  PID:9276
- C:\Windows\System\hjjeGPo.exe
  C:\Windows\System\hjjeGPo.exe
  2⤵
  PID:9292
- C:\Windows\System\zCCQNPT.exe
  C:\Windows\System\zCCQNPT.exe
  2⤵
  PID:9328
- C:\Windows\System\HdLVBDu.exe
  C:\Windows\System\HdLVBDu.exe
  2⤵
  PID:9388
- C:\Windows\System\sOFzOsg.exe
  C:\Windows\System\sOFzOsg.exe
  2⤵
  PID:9376
- C:\Windows\System\hvpuMkl.exe
  C:\Windows\System\hvpuMkl.exe
  2⤵
  PID:9416
- C:\Windows\System\uAdYvtz.exe
  C:\Windows\System\uAdYvtz.exe
  2⤵
  PID:9452
- C:\Windows\System\WUAVlch.exe
  C:\Windows\System\WUAVlch.exe
  2⤵
  PID:9512
- C:\Windows\System\TwhTENX.exe
  C:\Windows\System\TwhTENX.exe
  2⤵
  PID:9516
- C:\Windows\System\nxkFLnX.exe
  C:\Windows\System\nxkFLnX.exe
  2⤵
  PID:9540
- C:\Windows\System\jzdrqHH.exe
  C:\Windows\System\jzdrqHH.exe
  2⤵
  PID:9572
- C:\Windows\System\kHOBJQl.exe
  C:\Windows\System\kHOBJQl.exe
  2⤵
  PID:9632
- C:\Windows\System\uXPBudI.exe
  C:\Windows\System\uXPBudI.exe
  2⤵
  PID:9652
- C:\Windows\System\GlmnPAt.exe
  C:\Windows\System\GlmnPAt.exe
  2⤵
  PID:9684
- C:\Windows\System\afMeMQy.exe
  C:\Windows\System\afMeMQy.exe
  2⤵
  PID:9716
- C:\Windows\System\qWQBhWq.exe
  C:\Windows\System\qWQBhWq.exe
  2⤵
  PID:9740
- C:\Windows\System\hupMyhg.exe
  C:\Windows\System\hupMyhg.exe
  2⤵
  PID:9780
- C:\Windows\System\dIRtauU.exe
  C:\Windows\System\dIRtauU.exe
  2⤵
  PID:9824
- C:\Windows\System\hUyuHmd.exe
  C:\Windows\System\hUyuHmd.exe
  2⤵
  PID:9876
- C:\Windows\System\jNFiaqf.exe
  C:\Windows\System\jNFiaqf.exe
  2⤵
  PID:9916
- C:\Windows\System\ZvXAwwi.exe
  C:\Windows\System\ZvXAwwi.exe
  2⤵
  PID:9920
- C:\Windows\System\gRrUdHg.exe
  C:\Windows\System\gRrUdHg.exe
  2⤵
  PID:9992
- C:\Windows\System\yNGUwOn.exe
  C:\Windows\System\yNGUwOn.exe
  2⤵
  PID:9972
- C:\Windows\System\CKbgeuX.exe
  C:\Windows\System\CKbgeuX.exe
  2⤵
  PID:10032
- C:\Windows\System\FQOZuuW.exe
  C:\Windows\System\FQOZuuW.exe
  2⤵
  PID:10072
- C:\Windows\System\UhGEfbo.exe
  C:\Windows\System\UhGEfbo.exe
  2⤵
  PID:10092
- C:\Windows\System\tNOQYux.exe
  C:\Windows\System\tNOQYux.exe
  2⤵
  PID:10128
- C:\Windows\System\NqiJmFt.exe
  C:\Windows\System\NqiJmFt.exe
  2⤵
  PID:10180
- C:\Windows\System\muvUtLn.exe
  C:\Windows\System\muvUtLn.exe
  2⤵
  PID:10196
- C:\Windows\System\UZODOKs.exe
  C:\Windows\System\UZODOKs.exe
  2⤵
  PID:9240
- C:\Windows\System\udMmacT.exe
  C:\Windows\System\udMmacT.exe
  2⤵
  PID:9228
- C:\Windows\System\UylXkgj.exe
  C:\Windows\System\UylXkgj.exe
  2⤵
  PID:9308
- C:\Windows\System\zNfenCJ.exe
  C:\Windows\System\zNfenCJ.exe
  2⤵
  PID:9368
- C:\Windows\System\RGgnnCp.exe
  C:\Windows\System\RGgnnCp.exe
  2⤵
  PID:9496
- C:\Windows\System\jwgvMYc.exe
  C:\Windows\System\jwgvMYc.exe
  2⤵
  PID:9448
- C:\Windows\System\NzyxVGo.exe
  C:\Windows\System\NzyxVGo.exe
  2⤵
  PID:9476
- C:\Windows\System\rwShUko.exe
  C:\Windows\System\rwShUko.exe
  2⤵
  PID:9616
- C:\Windows\System\NEKXuUR.exe
  C:\Windows\System\NEKXuUR.exe
  2⤵
  PID:9524
- C:\Windows\System\bNNCYEb.exe
  C:\Windows\System\bNNCYEb.exe
  2⤵
  PID:9764
- C:\Windows\System\KiUfTcn.exe
  C:\Windows\System\KiUfTcn.exe
  2⤵
  PID:9704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DEvgXYW.exe

Filesize
2.6MB

MD5
da15490a76eece205c2152990d4a19fd

SHA1
bbaf46ba2c8632585b7192e037076213205ffc36

SHA256
8ed1128c65f465df8573f38072e611fcc56e16422ec9c29916770cbac53de748

SHA512
8e05a8562da29eaf5c560296480fbda5bb3b0a9d6cd81d99cdd0856946a41ebfc3ece0afdbe089bb6f0d731a4b65e73b102792cbd814dd11b171ef0360dce6ad

Download Submit
C:\Windows\system\Gjqxeab.exe

Filesize
2.6MB

MD5
67eeab97c26c48328f872d66a7692528

SHA1
8043f03d8f18b84fc0722e40456a82aa37b43623

SHA256
5050b4139b35e97772b15824c2bd8fb081c0c537720bb5d068565c0ca5f879be

SHA512
d7f930aae024cec7bf7835347f080381e529d92dfe4ee29e8d6ed36d2eb0fdd46c18a435ce12729264af2e92e635484aba630fb416df61e599b41928df1dae7e

Download Submit
C:\Windows\system\GuzPVGX.exe

Filesize
2.6MB

MD5
c92a2994e03da1e6823ab2d40dfc3144

SHA1
75f69c62bf48ba9c15cf03a9ddce38e918a34b1a

SHA256
d7c37fedad788e0493279b3673805ceed29497f5871321c62b35475494610b94

SHA512
ed6df62dd9295d315c8834335f408ec82e0a7cfef788b05895bb11d26fa6fe4505cac71a21d19281ab1fd3e39427de248ca98546964e0ca147016f0f9efd7133

Download Submit
C:\Windows\system\JIRjIqM.exe

Filesize
2.6MB

MD5
efdffa57bbe42134fef1771384d0d532

SHA1
155fbd4adf2cd5f0ae2eb62242cbaddbbd616c55

SHA256
e47fa2f6e8da0839a085c5d0b72f12695ceae3b61cfcafd6224a1c674921a955

SHA512
4f1e60e27155e72ef495aa20f1776d5221cb0ec1aee23b602d78f755b368141cab07a5c4b14e9886ba41f5713934636f812e4e3581e4831136876722d251d791

Download Submit
C:\Windows\system\JiVYbQN.exe

Filesize
2.6MB

MD5
65e3b071156b1cb99c91b3cd291e5dad

SHA1
c0b452ab03203c3f8ca41f76cb82b42ae5501eb9

SHA256
1d31ce54ac5e31b1f8bc1e34563b7832f62dbe2b0ffc89a899f2ee4631490a22

SHA512
0fb96c66d8d4141227b7139086a166602f330079e01989cc2f1095b1b42ed3746427cab5822053609c2a42b4cc3adfae144be30e1965a4759eb08a2b058e2ad5

Download Submit
C:\Windows\system\LomJJZn.exe

Filesize
2.6MB

MD5
58202b5b9a15991d8b8b2c92a3b49457

SHA1
1dcf175b2017504433f762c71e84fd7511f11984

SHA256
3f2399892b9cd2e4e4d7064d0e48d63aa5c5aa4e41308a21e5b25b5a492fcc3c

SHA512
6e4131024388b6c2735c630d76b632cbcb74c7cb8dc4a47ee5cc77bdb62395b134b847203c3be11943a7415a8b5ac8cf1bc4fee9731d13066ff7e18d5f2e818a

Download Submit
C:\Windows\system\NbdXrWI.exe

Filesize
2.6MB

MD5
9165be6c8869cb351bb74b314c8dac1f

SHA1
5e650cee73b096fcf9b03af196b221ed801e5b96

SHA256
24be9a6096497197e13e2269f8d676fdd67c2d35858df4b57da3e6a46f32cda6

SHA512
a103f123d68e7171bf0e9f9c9d89f2fbff0bd0a4b55dd4c38b00141286a96621b37010efedb4ec510271c37ed233f79f8fa3ec8f339d4ae7e52efa1a6606a2ea

Download Submit
C:\Windows\system\NczHlav.exe

Filesize
2.6MB

MD5
1384854cbafa3e7bb2fcbc55da01d4a7

SHA1
55ed5f6661d42fdc5444332c734da97d8d50fa8c

SHA256
bf9a14d3f8b8bd71b19065bbd5c07c99d26e3809adf5e0dceb71b71483bfa2f6

SHA512
7ecc0afb98c30e8e9fdf7ef737ff3d3f91997d8e5597062d6cfa93392c524b73d43bb4c22e1193cf84d76f72866742e8513ad723350431306e59170bacb90975

Download Submit
C:\Windows\system\OkdVmHR.exe

Filesize
2.6MB

MD5
ff4727c482b2635142b5dbef543f10b8

SHA1
7d9397cc50660f5b4c71c532b3d05902553f146e

SHA256
6efd05f4e5272aef3c792d1ad3586ef47818f6f18728c6d0c617f4c302f09a9f

SHA512
3895afe99c8b209cbb97ba3164c9ff5e636bc88fddf0f94a7f153aadae4a701f405d48ce036018241a611dbccce63dc8312d9b53c8eff5d8fc06b1e712422145

Download Submit
C:\Windows\system\PCRHsqj.exe

Filesize
2.6MB

MD5
c2c08d7d6bd20e2c9cb9f9e17f90d390

SHA1
c7a2a9d62d7f1ee997f20684e42fdf17f329630f

SHA256
caf3f4e75a061e2935d9a0aecb729715ae26423329a4aadaeaf5d86e896aced7

SHA512
3239092ba1e543fdd7ec2f5f9c7f756a6662d7efaba5bde4518288e2e6caaccb4aff9ecb3a7aaab8416ed95425febdc5b5b6d9974b7dd64425a9c4a76734a656

Download Submit
C:\Windows\system\RbbjGrS.exe

Filesize
2.6MB

MD5
27768b98cceae8778b7f24460b9f5ff6

SHA1
d1c6837b6986bda39b72aeaab23ff3186ecf4fce

SHA256
b1cf518569ca021c86d2cc3f88174616a0d7b613704a47f411d3bfabe3bdb7b1

SHA512
dab6e6cba03cb60a40cebd5f7000f97c2d1a3c4753bd10b859ed69360a73ef8665a903b52400c7897598f74ce0611c20bb597f84a12ed0d4166d016941bb7faf

Download Submit
C:\Windows\system\VygxGBy.exe

Filesize
2.6MB

MD5
3689e3285c60a5be4cd8492c5098ab53

SHA1
0899460135070f550a529a0ce3e5af39ba761277

SHA256
17c6667e944583117ec93dc692e2b97e008765f8eb76c6da1b025efe14e4553f

SHA512
6e11fc1569ae54dd91989f1b880309e41f8e2e716d66808753829ecc01d5bbe4dd66723fb41d36b4bfdebfa559550f125dccd45c1edb750b839da15faab6cc12

Download Submit
C:\Windows\system\WvzXxuv.exe

Filesize
2.6MB

MD5
2ea4c65ad5e58d9c03a04f0952117dcc

SHA1
66df79f012479419646eefbc812923f7548833a3

SHA256
9daa53ccb27216e8915301ea553d011dedcb16351b0c6f7cb66c7465a4a49aa2

SHA512
b37c1905c9dd794a368ada48be67339d81a9782d4d08c43bd4d52602ad05f97683f1bc934e84bcf8d63df9dcf759cba1bf715bfc640eb78043ba03f216526078

Download Submit
C:\Windows\system\ZYSXAUy.exe

Filesize
2.6MB

MD5
1d9911f26131fefd7b6b97f44f42ae59

SHA1
a61f6ffae98ba494ceee6377e9ea3527a84c153f

SHA256
460397a435dff7465d4828dd38fde32cd7b71374db49df74d6fbeb0241242957

SHA512
d204926fc10c91e5ca378fdbfec11ccaa888008a805456498fc90bf27a2454ccb82663efea52fd9129bebe47d2ae4e40af7602f0b4ec3f64b77e4828fd79e158

Download Submit
C:\Windows\system\beEIsoA.exe

Filesize
2.6MB

MD5
896b744558999226c25fd5d99807f0a5

SHA1
021c2b14b6e0ee0ff4332a776d365eeaa7c7b918

SHA256
1156aecf69b6713108a93fa3a60488f8ad7ee41af063d39bf8a1e05b1ad853f3

SHA512
0270dbdc3c797951f41d7ccc613484b44b41a7405accef751625fec983284a85211704d45dce62d2d66797a88565fca20afd50025c72c89b7b557c911a93eba8

Download Submit
C:\Windows\system\eFjclBK.exe

Filesize
2.6MB

MD5
d12b0044676bc47215fef90017923501

SHA1
549fcfd30e44b5ecf1ce00c08422dc484536e649

SHA256
57775d669490a01da9c888ce99398232fa883dca847630f3cc6d4a6f58515e9f

SHA512
75878ecbfc0ab8fdb85a1e6a53b575005f9e24bc073f591c93cf94f8c505ebf69f92e16440891c04fe1ea6b33814feb480f6cef82e27fca1f12317a8fa5005ee

Download Submit
C:\Windows\system\eYAGmgI.exe

Filesize
2.6MB

MD5
eca04cafdfff321e04a97e49db991256

SHA1
6a3ef20b0063d4355a74186e7969ff97a0877427

SHA256
b7374b48e7dcbda330f3cc270ee3c6062ad8e0f5288b248eaa7b1b05f926ccf1

SHA512
cb771d82717d658f1ec8936f0a1b2d80bde9918533b7cf69897fd6cc4f74809b1c38f508034c72625c497f60640b7ad645e1607f3adb199b5d2790b4f95d8255

Download Submit
C:\Windows\system\elgLNaQ.exe

Filesize
2.6MB

MD5
a90c6056cb4928f5be32cceb07ffda76

SHA1
162bcc1df1ad4430be5a5c581af41deca6bb041d

SHA256
f505bc4b8f4abab99687f98608d07511829cb65a3999884e42bcc87dedfdfa46

SHA512
bde5e194733df808541bdf3328b1958b36b48037d94ca9a789f760575e9a29b930cb9dfe800ef89ab21c70694f7d65f8d194c3ebf46a2251faaefb426062a8d1

Download Submit
C:\Windows\system\fwIYVUo.exe

Filesize
2.6MB

MD5
cf842b16711da5c5bc678c9cf2e6ebfb

SHA1
1bc4f400b0661421d6a36c14b212decbf55c4100

SHA256
b200f115d440a5a0ef4458c36d5ce059769817bf98da358cae8367b4e69e2cb2

SHA512
dce5e5aa3f128bdddb56a6dad60918b6116ee4c4cc238caa3a5c883bdc6307be5729ffbc2cf9a1b2b177222109197d0b090318ec12e077882aceab66d83a3c13

Download Submit
C:\Windows\system\ikdyqub.exe

Filesize
2.6MB

MD5
6812b10f2c48b4378c1e5b85313646e8

SHA1
430b2d0a9e5157e1736d8d9208d9a46d3aba6a8e

SHA256
bd13c3248acd636e0766f26c1a002231d956e3e54e5f07a90fd7bac10ad9419d

SHA512
a818c500dae0c538203470984cbb2b229a7ae5fb988e8d7161eb49171a4a4af555d639ab81fd40040a2f41f66de1e7068660cd5cdc5ff1609ec42edc2c3c5cb8

Download Submit
C:\Windows\system\kHhhajs.exe

Filesize
2.6MB

MD5
820e2a371a563d011448db3607f58927

SHA1
48ca97e6827a58d4daf56aa566b0300c4067ff91

SHA256
26734b4f8b2329e8ba39ee114258747393738a897d8c587c6689a1431f256985

SHA512
dab446a9bf29a7f7e06bc9062ba8471ad66af1f534821848d00bbfa599285e2b32b21c741c523a6a69399989c371b9eb58c35ad3acd49658c1def37eafae9ffa

Download Submit
C:\Windows\system\lAsyiih.exe

Filesize
2.6MB

MD5
5c7fa1d4725818088b0525b9824fe573

SHA1
94005f56bdd3c8852885ab9a59254122c6fead4d

SHA256
f6fa25de546f1b0239a19e57e8938d9cff3a93df37db584bf8449693fa66df79

SHA512
0771ef081908d9f22a8e918fdc8e1ae13cf7a5d1c379a14ea11fcb8c6e3a4650e477a0457444277da67d5be709f0b9296f8985d1a5b2fcc9e6cecebef33aef15

Download Submit
C:\Windows\system\nbziLgY.exe

Filesize
2.6MB

MD5
465e8c3f5f7ce8e478c632f6bc242234

SHA1
88170a655099cdfeeb7e5413422a95e4465f0d19

SHA256
0a90b30a44054141cc2496ec26c47ae29176c716030c2d5b6e0dc4b573fa5bdc

SHA512
8b7331062c6c7392986237cff42ff1b6515609930dd45250b0af7ab717f4ff7c19a00559e48c30cacdfc0f9c0f2be9b24f2f53e96d4824f83ce202548505a969

Download Submit
C:\Windows\system\qPUfPuH.exe

Filesize
2.6MB

MD5
fc723e82f09f0190192d45e1727ff1f6

SHA1
a28e2bca55882b5d910aec221aef41563aabd8ab

SHA256
22603f96f8b15d17c5aed235268bfaf2c5f2c15b713a51dccf027f417593ba4c

SHA512
268eaeb22b934abf2d7f9a828ff3215f279eabe54f15e8f9e386c5ab52fdf664ae362197d5e8c832213eaabecb85cfd8d4d579801ea4e101c1ac0864b415ea7f

Download Submit
C:\Windows\system\stwHdBJ.exe

Filesize
2.6MB

MD5
25c6b0f43e121b335e769edbfb7c789e

SHA1
b9748c0f31a289d6269a3bb244dd8771a8e90654

SHA256
73067a91cddfad06784b552b7257f93cc23c59e995dc07e22d10dc0987ecc0f2

SHA512
9b227bd01bc88a5567afb7c0f0aca85c940dd4d8f7a335e9e882b0cc9af058246cbd7366522e73830a1531539a62165e9404acb20918e042b4ca3876cb936729

Download Submit
C:\Windows\system\uvyqhVo.exe

Filesize
2.6MB

MD5
f05e74687985c49e36fe47fb977d1310

SHA1
e85ab1ec4364e706200e7fed76cccc3a40c0e057

SHA256
d9636846567d39ee8080d12b311bbfa7c02fcb2616e49828c3c7e207d1ccc65a

SHA512
aff3e672c9ff6da020840596f32ff575510b5123276863d9f3f0e7f26c67ff67e5867231a9664ae765ffbea6d38872e6a96e1e21dbeb5adb5c801296e0029d83

Download Submit
C:\Windows\system\yXfSiHc.exe

Filesize
2.6MB

MD5
a6ebc2ca605eb5e40acd606e90129613

SHA1
c47b822b95a91ba752194b93b5833cbf5031d08f

SHA256
20ed9491b29eb3a0512c5eac8afeaea8973254ff034e3226e700b37aaa37ab16

SHA512
b9ace4b8896657e847be303a6c3e73175764b8e4fc679c34c0b47bafa300f9a0ebc8dd8145226f77b40fba08309450b63375b513d5d6376e455758fc1c0d3b94

Download Submit
C:\Windows\system\yqxRVcR.exe

Filesize
2.6MB

MD5
012e6f3c7a5564ce3d88f32da436f8a2

SHA1
12efaa9e22da658d8441e8f98b741c2c88322536

SHA256
d07d65f1ffb6908840d27d023ca6ae05a937d373a33d7f98deb3ddc0d1445427

SHA512
aa1e582bdf8f77b7af97869805a31a2e646908ba690843211b0038415e8307e89096a57e6f37808afb0119fdb0cb87a0884b8b5fb3f58aab6942dd539c87999b

Download Submit
C:\Windows\system\zHSUGqz.exe

Filesize
2.6MB

MD5
f4b41b52aceaee54ca47f1cc96ca3bb9

SHA1
6133a7acffa31e5d35d11d7001ff68b5362c7b3d

SHA256
af241c19997b7ce8a17bd60390a3aa172c628191c050020ed498d93605725d23

SHA512
e7b5598e62c72d0d8a174fcd5817049416eae7e17c5a9a7daa4821beba3e05d11e28829a5a61fc68d306f7f4af724d8d660171b7ee42965514d1a20c85bc0399

Download Submit
\Windows\system\VpIkhMY.exe

Filesize
2.6MB

MD5
9b99a92ac95139f54599abe9014d4d31

SHA1
423487d5f346052c9b60cb1434fca312bbe22d96

SHA256
db83ea09446469a3357b906d39deb3615e3cf33981be4208fb3385211f7ea7da

SHA512
f1849238ebba8c8c7076a1b61e8344f8442fae79314df6f3a387da1296a5afe2057c6b2c209dd18de28141d1d536740e1feed91e8818d4f3ccc770d9e3f44a97

Download Submit
\Windows\system\WzGbifj.exe

Filesize
2.6MB

MD5
7fb417a55544a2a55a48cb4bc4102f94

SHA1
c2d8ed4e7ba54b02d272b9738df75ed31dba3ea7

SHA256
6f507d2199974bde5c311be5f2c4d2b96ad5f228dde2c48625e76cf46984a864

SHA512
d86dbdfb0a1996d5806dcf62a4e8337de5b113e60880594ef61d649d12b0b0150e488fc5ad75a3a105095049d9a0fd9787915fa86763a9098f31564abf7bfe0f

Download Submit
\Windows\system\aowpvpO.exe

Filesize
2.6MB

MD5
18d37fddd58d4a83b1ca5b41e052687d

SHA1
dcdf81e51876528c82931d3c8da6fa24b6482853

SHA256
9413951a453784284029ac416c81fbbc3f38ef210fa72f140a45933a54ca1349

SHA512
06a9b70c371932de6ce834dd0d1d368e99ba0e811b84c24eadda83dc9d8a323c861f665d6ad162f1cc7e7d4fcc892017ee19d6b39ab6223b7a6d3f2638de92aa

Download Submit
memory/1348-4149-0x000000013F0E0000-0x000000013F434000-memory.dmp

Filesize
3.3MB

Download
memory/1348-678-0x000000013F0E0000-0x000000013F434000-memory.dmp

Filesize
3.3MB

Download
memory/1348-4137-0x000000013F0E0000-0x000000013F434000-memory.dmp

Filesize
3.3MB

Download
memory/1632-675-0x000000013FC00000-0x000000013FF54000-memory.dmp

Filesize
3.3MB

Download
memory/1632-669-0x000000013FCE0000-0x0000000140034000-memory.dmp

Filesize
3.3MB

Download
memory/1632-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/1632-0-0x000000013F810000-0x000000013FB64000-memory.dmp

Filesize
3.3MB

Download
memory/1632-3695-0x000000013F810000-0x000000013FB64000-memory.dmp

Filesize
3.3MB

Download
memory/1632-657-0x0000000002000000-0x0000000002354000-memory.dmp

Filesize
3.3MB

Download
memory/1632-677-0x000000013F0E0000-0x000000013F434000-memory.dmp

Filesize
3.3MB

Download
memory/1632-659-0x000000013FD70000-0x00000001400C4000-memory.dmp

Filesize
3.3MB

Download
memory/1632-680-0x0000000002000000-0x0000000002354000-memory.dmp

Filesize
3.3MB

Download
memory/1632-661-0x0000000002000000-0x0000000002354000-memory.dmp

Filesize
3.3MB

Download
memory/1632-679-0x0000000002000000-0x0000000002354000-memory.dmp

Filesize
3.3MB

Download
memory/1632-663-0x0000000002000000-0x0000000002354000-memory.dmp

Filesize
3.3MB

Download
memory/1632-673-0x000000013F030000-0x000000013F384000-memory.dmp

Filesize
3.3MB

Download
memory/1632-665-0x000000013F270000-0x000000013F5C4000-memory.dmp

Filesize
3.3MB

Download
memory/1632-671-0x0000000002000000-0x0000000002354000-memory.dmp

Filesize
3.3MB

Download
memory/1632-667-0x000000013FCC0000-0x0000000140014000-memory.dmp

Filesize
3.3MB

Download
memory/1632-655-0x000000013F440000-0x000000013F794000-memory.dmp

Filesize
3.3MB

Download
memory/1700-4140-0x000000013FD70000-0x00000001400C4000-memory.dmp

Filesize
3.3MB

Download
memory/1700-660-0x000000013FD70000-0x00000001400C4000-memory.dmp

Filesize
3.3MB

Download
memory/2100-4145-0x000000013F810000-0x000000013FB64000-memory.dmp

Filesize
3.3MB

Download
memory/2100-662-0x000000013F810000-0x000000013FB64000-memory.dmp

Filesize
3.3MB

Download
memory/2100-4129-0x000000013F810000-0x000000013FB64000-memory.dmp

Filesize
3.3MB

Download
memory/2300-4138-0x000000013F640000-0x000000013F994000-memory.dmp

Filesize
3.3MB

Download
memory/2300-561-0x000000013F640000-0x000000013F994000-memory.dmp

Filesize
3.3MB

Download
memory/2316-4127-0x000000013F940000-0x000000013FC94000-memory.dmp

Filesize
3.3MB

Download
memory/2316-4151-0x000000013F940000-0x000000013FC94000-memory.dmp

Filesize
3.3MB

Download
memory/2316-583-0x000000013F940000-0x000000013FC94000-memory.dmp

Filesize
3.3MB

Download
memory/2392-664-0x000000013F760000-0x000000013FAB4000-memory.dmp

Filesize
3.3MB

Download
memory/2392-4130-0x000000013F760000-0x000000013FAB4000-memory.dmp

Filesize
3.3MB

Download
memory/2392-4143-0x000000013F760000-0x000000013FAB4000-memory.dmp

Filesize
3.3MB

Download
memory/2552-656-0x000000013F440000-0x000000013F794000-memory.dmp

Filesize
3.3MB

Download
memory/2552-4139-0x000000013F440000-0x000000013F794000-memory.dmp

Filesize
3.3MB

Download
memory/2568-4128-0x000000013F670000-0x000000013F9C4000-memory.dmp

Filesize
3.3MB

Download
memory/2568-658-0x000000013F670000-0x000000013F9C4000-memory.dmp

Filesize
3.3MB

Download
memory/2568-4148-0x000000013F670000-0x000000013F9C4000-memory.dmp

Filesize
3.3MB

Download
memory/2728-4131-0x000000013F270000-0x000000013F5C4000-memory.dmp

Filesize
3.3MB

Download
memory/2728-666-0x000000013F270000-0x000000013F5C4000-memory.dmp

Filesize
3.3MB

Download
memory/2728-4146-0x000000013F270000-0x000000013F5C4000-memory.dmp

Filesize
3.3MB

Download
memory/2776-672-0x000000013FB30000-0x000000013FE84000-memory.dmp

Filesize
3.3MB

Download
memory/2776-4142-0x000000013FB30000-0x000000013FE84000-memory.dmp

Filesize
3.3MB

Download
memory/2776-4134-0x000000013FB30000-0x000000013FE84000-memory.dmp

Filesize
3.3MB

Download
memory/2780-4132-0x000000013FCC0000-0x0000000140014000-memory.dmp

Filesize
3.3MB

Download
memory/2780-4141-0x000000013FCC0000-0x0000000140014000-memory.dmp

Filesize
3.3MB

Download
memory/2780-668-0x000000013FCC0000-0x0000000140014000-memory.dmp

Filesize
3.3MB

Download
memory/2804-4136-0x000000013FC00000-0x000000013FF54000-memory.dmp

Filesize
3.3MB

Download
memory/2804-4144-0x000000013FC00000-0x000000013FF54000-memory.dmp

Filesize
3.3MB

Download
memory/2804-676-0x000000013FC00000-0x000000013FF54000-memory.dmp

Filesize
3.3MB

Download
memory/2920-670-0x000000013FCE0000-0x0000000140034000-memory.dmp

Filesize
3.3MB

Download
memory/2920-4133-0x000000013FCE0000-0x0000000140034000-memory.dmp

Filesize
3.3MB

Download
memory/2920-4150-0x000000013FCE0000-0x0000000140034000-memory.dmp

Filesize
3.3MB

Download
memory/2968-4135-0x000000013F030000-0x000000013F384000-memory.dmp

Filesize
3.3MB

Download
memory/2968-674-0x000000013F030000-0x000000013F384000-memory.dmp

Filesize
3.3MB

Download
memory/2968-4147-0x000000013F030000-0x000000013F384000-memory.dmp

Filesize
3.3MB

Download