xmrig | d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
Size

1.2MB
MD5

cfa5e69ceae1b84e410da6c98cc443ae
SHA1

96a928109c3cf5f76c592a9018df58aa624779cd
SHA256

d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c
SHA512

6a16606c3a11784a2318d9061370bc0bf2634293a8c2f2ba23af28d8ebaf547d03cae5ff5149403215828187317ab73034fef5f3c341e33de5061d17f6017734
SSDEEP

24576:EnCbLE/tyK3yt0mFdfE0bLBgDOph4THCGLQTfwlKjoIdBF672l6i2Nck:EnCbL83y9FdfE0pZ0zCa4wI156d

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 62 IoCs

miner

resource	yara_rule
behavioral1/memory/2692-0-0x000000013F3F0000-0x000000013F744000-memory.dmp	xmrig
behavioral1/files/0x0008000000016c4a-6.dat	xmrig
behavioral1/files/0x0007000000016cec-19.dat	xmrig
behavioral1/files/0x000a00000001227e-17.dat	xmrig
behavioral1/files/0x0007000000016d06-27.dat	xmrig
behavioral1/files/0x0008000000016d18-40.dat	xmrig
behavioral1/files/0x0006000000017488-58.dat	xmrig
behavioral1/files/0x00050000000186ea-90.dat	xmrig
behavioral1/files/0x000500000001878f-120.dat	xmrig
behavioral1/files/0x00050000000193b4-160.dat	xmrig
behavioral1/memory/2088-494-0x000000013FAB0000-0x000000013FE04000-memory.dmp	xmrig
behavioral1/files/0x0005000000019350-155.dat	xmrig
behavioral1/files/0x0005000000019334-150.dat	xmrig
behavioral1/files/0x0005000000019282-145.dat	xmrig
behavioral1/files/0x0005000000019261-140.dat	xmrig
behavioral1/files/0x0006000000019023-131.dat	xmrig
behavioral1/files/0x000500000001925e-134.dat	xmrig
behavioral1/files/0x00050000000187a5-125.dat	xmrig
behavioral1/files/0x000500000001873d-110.dat	xmrig
behavioral1/files/0x0005000000018784-115.dat	xmrig
behavioral1/files/0x0005000000018728-105.dat	xmrig
behavioral1/files/0x00050000000186fd-100.dat	xmrig
behavioral1/files/0x00050000000186ee-95.dat	xmrig
behavioral1/files/0x00050000000186e4-85.dat	xmrig
behavioral1/files/0x0005000000018683-80.dat	xmrig
behavioral1/files/0x000d000000018676-75.dat	xmrig
behavioral1/files/0x00060000000174cc-70.dat	xmrig
behavioral1/files/0x0006000000017492-65.dat	xmrig
behavioral1/files/0x00060000000173a9-55.dat	xmrig
behavioral1/files/0x00060000000173a7-50.dat	xmrig
behavioral1/files/0x00060000000171a8-45.dat	xmrig
behavioral1/files/0x0007000000016cc8-26.dat	xmrig
behavioral1/files/0x0008000000016c51-18.dat	xmrig
behavioral1/files/0x0009000000016d0e-33.dat	xmrig
behavioral1/memory/2788-498-0x000000013FB20000-0x000000013FE74000-memory.dmp	xmrig
behavioral1/memory/2392-497-0x000000013FB00000-0x000000013FE54000-memory.dmp	xmrig
behavioral1/memory/2208-506-0x000000013F7E0000-0x000000013FB34000-memory.dmp	xmrig
behavioral1/memory/1520-518-0x000000013FA80000-0x000000013FDD4000-memory.dmp	xmrig
behavioral1/memory/2652-516-0x000000013F490000-0x000000013F7E4000-memory.dmp	xmrig
behavioral1/memory/2608-514-0x000000013F1E0000-0x000000013F534000-memory.dmp	xmrig
behavioral1/memory/2776-512-0x000000013FCA0000-0x000000013FFF4000-memory.dmp	xmrig
behavioral1/memory/2632-510-0x000000013F4C0000-0x000000013F814000-memory.dmp	xmrig
behavioral1/memory/2644-508-0x000000013FF10000-0x0000000140264000-memory.dmp	xmrig
behavioral1/memory/2964-504-0x000000013F3D0000-0x000000013F724000-memory.dmp	xmrig
behavioral1/memory/2760-502-0x000000013F610000-0x000000013F964000-memory.dmp	xmrig
behavioral1/memory/2700-501-0x000000013FA20000-0x000000013FD74000-memory.dmp	xmrig
behavioral1/memory/2720-500-0x000000013F410000-0x000000013F764000-memory.dmp	xmrig
behavioral1/memory/2692-4070-0x000000013F3F0000-0x000000013F744000-memory.dmp	xmrig
behavioral1/memory/2088-4084-0x000000013FAB0000-0x000000013FE04000-memory.dmp	xmrig
behavioral1/memory/2788-4085-0x000000013FB20000-0x000000013FE74000-memory.dmp	xmrig
behavioral1/memory/2776-4095-0x000000013FCA0000-0x000000013FFF4000-memory.dmp	xmrig
behavioral1/memory/2632-4094-0x000000013F4C0000-0x000000013F814000-memory.dmp	xmrig
behavioral1/memory/2392-4093-0x000000013FB00000-0x000000013FE54000-memory.dmp	xmrig
behavioral1/memory/2208-4092-0x000000013F7E0000-0x000000013FB34000-memory.dmp	xmrig
behavioral1/memory/2720-4091-0x000000013F410000-0x000000013F764000-memory.dmp	xmrig
behavioral1/memory/2760-4090-0x000000013F610000-0x000000013F964000-memory.dmp	xmrig
behavioral1/memory/2652-4096-0x000000013F490000-0x000000013F7E4000-memory.dmp	xmrig
behavioral1/memory/2964-4089-0x000000013F3D0000-0x000000013F724000-memory.dmp	xmrig
behavioral1/memory/2608-4097-0x000000013F1E0000-0x000000013F534000-memory.dmp	xmrig
behavioral1/memory/1520-4088-0x000000013FA80000-0x000000013FDD4000-memory.dmp	xmrig
behavioral1/memory/2644-4087-0x000000013FF10000-0x0000000140264000-memory.dmp	xmrig
behavioral1/memory/2700-4086-0x000000013FA20000-0x000000013FD74000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2088	xbabLIV.exe
2392	joiBNBF.exe
2788	vzmAHnV.exe
2720	MkUbgpJ.exe
2700	mIhhGPI.exe
2760	aTKFiMt.exe
2964	ryByamP.exe
2208	ouXioro.exe
2644	XmNJTwj.exe
2632	iUYmWCY.exe
2776	worENdf.exe
2608	rATyTMy.exe
2652	RkNPMoz.exe
1520	xDYlZmT.exe
2280	JMQGyeS.exe
1992	OXBQAVc.exe
1692	CyGdluO.exe
308	WKHQiiI.exe
584	rMxANsH.exe
1584	EehKCZn.exe
992	ynfzlhn.exe
772	TbbCLry.exe
1616	PUQrtDs.exe
1880	XSovxJH.exe
1684	AIllKaT.exe
1404	jjnqafq.exe
2704	OKthCbq.exe
688	WmfoeUG.exe
2452	rxNBcGs.exe
848	fLfwKcc.exe
824	BpfTnSO.exe
2976	kKwWhQP.exe
2040	oiwgIIB.exe
1168	hNxEmWv.exe
3048	YTNZRpt.exe
380	UtFeoLC.exe
976	UtQLTlO.exe
900	GFBGplT.exe
1588	TGwHkGe.exe
1592	sihgBiS.exe
1596	NZzsfFy.exe
752	EkBkbBg.exe
2336	ZFEHqKx.exe
3016	sxKvFoR.exe
1896	JNIXvKq.exe
1988	baFWHxI.exe
2368	EHNYECJ.exe
2536	wFPkJsh.exe
2420	IZSTTfQ.exe
1460	cioMvkI.exe
2132	AbTwZGj.exe
1336	pZnLVzD.exe
804	XeXlPQw.exe
868	LOXLcuV.exe
1180	rmkrqpE.exe
2376	XtYGfvT.exe
1508	rHRFzPo.exe
2416	ErjRoLt.exe
1840	PnAhlCf.exe
2736	mKprcIc.exe
2816	rouvEPK.exe
2796	sPgEttG.exe
2876	NlWgdEb.exe
2868	iZtnJqM.exe

Loads dropped DLL 64 IoCs

pid	Process
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2692-0-0x000000013F3F0000-0x000000013F744000-memory.dmp	upx
behavioral1/files/0x0008000000016c4a-6.dat	upx
behavioral1/files/0x0007000000016cec-19.dat	upx
behavioral1/files/0x000a00000001227e-17.dat	upx
behavioral1/files/0x0007000000016d06-27.dat	upx
behavioral1/files/0x0008000000016d18-40.dat	upx
behavioral1/files/0x0006000000017488-58.dat	upx
behavioral1/files/0x00050000000186ea-90.dat	upx
behavioral1/files/0x000500000001878f-120.dat	upx
behavioral1/files/0x00050000000193b4-160.dat	upx
behavioral1/memory/2088-494-0x000000013FAB0000-0x000000013FE04000-memory.dmp	upx
behavioral1/files/0x0005000000019350-155.dat	upx
behavioral1/files/0x0005000000019334-150.dat	upx
behavioral1/files/0x0005000000019282-145.dat	upx
behavioral1/files/0x0005000000019261-140.dat	upx
behavioral1/files/0x0006000000019023-131.dat	upx
behavioral1/files/0x000500000001925e-134.dat	upx
behavioral1/files/0x00050000000187a5-125.dat	upx
behavioral1/files/0x000500000001873d-110.dat	upx
behavioral1/files/0x0005000000018784-115.dat	upx
behavioral1/files/0x0005000000018728-105.dat	upx
behavioral1/files/0x00050000000186fd-100.dat	upx
behavioral1/files/0x00050000000186ee-95.dat	upx
behavioral1/files/0x00050000000186e4-85.dat	upx
behavioral1/files/0x0005000000018683-80.dat	upx
behavioral1/files/0x000d000000018676-75.dat	upx
behavioral1/files/0x00060000000174cc-70.dat	upx
behavioral1/files/0x0006000000017492-65.dat	upx
behavioral1/files/0x00060000000173a9-55.dat	upx
behavioral1/files/0x00060000000173a7-50.dat	upx
behavioral1/files/0x00060000000171a8-45.dat	upx
behavioral1/files/0x0007000000016cc8-26.dat	upx
behavioral1/files/0x0008000000016c51-18.dat	upx
behavioral1/files/0x0009000000016d0e-33.dat	upx
behavioral1/memory/2788-498-0x000000013FB20000-0x000000013FE74000-memory.dmp	upx
behavioral1/memory/2392-497-0x000000013FB00000-0x000000013FE54000-memory.dmp	upx
behavioral1/memory/2208-506-0x000000013F7E0000-0x000000013FB34000-memory.dmp	upx
behavioral1/memory/1520-518-0x000000013FA80000-0x000000013FDD4000-memory.dmp	upx
behavioral1/memory/2652-516-0x000000013F490000-0x000000013F7E4000-memory.dmp	upx
behavioral1/memory/2608-514-0x000000013F1E0000-0x000000013F534000-memory.dmp	upx
behavioral1/memory/2776-512-0x000000013FCA0000-0x000000013FFF4000-memory.dmp	upx
behavioral1/memory/2632-510-0x000000013F4C0000-0x000000013F814000-memory.dmp	upx
behavioral1/memory/2644-508-0x000000013FF10000-0x0000000140264000-memory.dmp	upx
behavioral1/memory/2964-504-0x000000013F3D0000-0x000000013F724000-memory.dmp	upx
behavioral1/memory/2760-502-0x000000013F610000-0x000000013F964000-memory.dmp	upx
behavioral1/memory/2700-501-0x000000013FA20000-0x000000013FD74000-memory.dmp	upx
behavioral1/memory/2720-500-0x000000013F410000-0x000000013F764000-memory.dmp	upx
behavioral1/memory/2692-4070-0x000000013F3F0000-0x000000013F744000-memory.dmp	upx
behavioral1/memory/2088-4084-0x000000013FAB0000-0x000000013FE04000-memory.dmp	upx
behavioral1/memory/2788-4085-0x000000013FB20000-0x000000013FE74000-memory.dmp	upx
behavioral1/memory/2776-4095-0x000000013FCA0000-0x000000013FFF4000-memory.dmp	upx
behavioral1/memory/2632-4094-0x000000013F4C0000-0x000000013F814000-memory.dmp	upx
behavioral1/memory/2392-4093-0x000000013FB00000-0x000000013FE54000-memory.dmp	upx
behavioral1/memory/2208-4092-0x000000013F7E0000-0x000000013FB34000-memory.dmp	upx
behavioral1/memory/2720-4091-0x000000013F410000-0x000000013F764000-memory.dmp	upx
behavioral1/memory/2760-4090-0x000000013F610000-0x000000013F964000-memory.dmp	upx
behavioral1/memory/2652-4096-0x000000013F490000-0x000000013F7E4000-memory.dmp	upx
behavioral1/memory/2964-4089-0x000000013F3D0000-0x000000013F724000-memory.dmp	upx
behavioral1/memory/2608-4097-0x000000013F1E0000-0x000000013F534000-memory.dmp	upx
behavioral1/memory/1520-4088-0x000000013FA80000-0x000000013FDD4000-memory.dmp	upx
behavioral1/memory/2644-4087-0x000000013FF10000-0x0000000140264000-memory.dmp	upx
behavioral1/memory/2700-4086-0x000000013FA20000-0x000000013FD74000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NRmvDAS.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\AkMWsuw.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\QVhzImd.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\gIsSPdT.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\DdGGQnq.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\KSLehHW.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\dqTGltr.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\NuYONrI.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\HoZJXmz.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\MYNrRQf.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\VOAxMUv.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\OruOFCQ.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\vPipzcU.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\hscuHct.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\oTPmRTA.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\WrwzwAm.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\DnocoqR.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\rSFCJjI.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\jzhXlej.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\zLFvwng.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\qzYmSjp.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\XSovxJH.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\VOndUot.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\mrvaLIz.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\EtJFuSl.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\nqxchKA.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\BCURjtQ.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\NjERyeV.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\KqEpdtY.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\EEoTquK.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\AunwTmk.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\pKWRTHY.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\zbQZRlE.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\VgeCCxb.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\tGxumue.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\EEWskUl.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\fyMHYUd.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\ZRxaIQQ.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\lqVMsXE.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\foDbAET.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\GZFuYKp.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\CNXCRuD.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\pZnLVzD.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\YUpGKsp.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\exefllp.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\JcqQFdk.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\LtEUaSf.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\rDBJytW.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\RUNSBOx.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\dpXjSmf.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\XSLeJlH.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\ydVlnbk.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\zQEfnlL.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\sNrXAWB.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\FapmKhc.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\QBponOG.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\yihhuPP.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\SxYCUSW.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\fbWUfvX.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\piAEEdm.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\FMGWgDU.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\jGMTxGu.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\TvKdPRU.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
File created	C:\Windows\System\GQbIrwN.exe	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2392	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	31
PID 2692 wrote to memory of 2392	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	31
PID 2692 wrote to memory of 2392	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	31
PID 2692 wrote to memory of 2088	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	32
PID 2692 wrote to memory of 2088	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	32
PID 2692 wrote to memory of 2088	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	32
PID 2692 wrote to memory of 2788	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	33
PID 2692 wrote to memory of 2788	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	33
PID 2692 wrote to memory of 2788	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	33
PID 2692 wrote to memory of 2700	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	34
PID 2692 wrote to memory of 2700	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	34
PID 2692 wrote to memory of 2700	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	34
PID 2692 wrote to memory of 2720	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	35
PID 2692 wrote to memory of 2720	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	35
PID 2692 wrote to memory of 2720	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	35
PID 2692 wrote to memory of 2760	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	36
PID 2692 wrote to memory of 2760	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	36
PID 2692 wrote to memory of 2760	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	36
PID 2692 wrote to memory of 2964	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	37
PID 2692 wrote to memory of 2964	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	37
PID 2692 wrote to memory of 2964	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	37
PID 2692 wrote to memory of 2208	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	38
PID 2692 wrote to memory of 2208	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	38
PID 2692 wrote to memory of 2208	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	38
PID 2692 wrote to memory of 2644	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	39
PID 2692 wrote to memory of 2644	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	39
PID 2692 wrote to memory of 2644	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	39
PID 2692 wrote to memory of 2632	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	40
PID 2692 wrote to memory of 2632	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	40
PID 2692 wrote to memory of 2632	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	40
PID 2692 wrote to memory of 2776	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	41
PID 2692 wrote to memory of 2776	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	41
PID 2692 wrote to memory of 2776	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	41
PID 2692 wrote to memory of 2608	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	42
PID 2692 wrote to memory of 2608	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	42
PID 2692 wrote to memory of 2608	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	42
PID 2692 wrote to memory of 2652	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	43
PID 2692 wrote to memory of 2652	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	43
PID 2692 wrote to memory of 2652	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	43
PID 2692 wrote to memory of 1520	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	44
PID 2692 wrote to memory of 1520	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	44
PID 2692 wrote to memory of 1520	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	44
PID 2692 wrote to memory of 2280	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	45
PID 2692 wrote to memory of 2280	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	45
PID 2692 wrote to memory of 2280	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	45
PID 2692 wrote to memory of 1992	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	46
PID 2692 wrote to memory of 1992	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	46
PID 2692 wrote to memory of 1992	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	46
PID 2692 wrote to memory of 1692	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	47
PID 2692 wrote to memory of 1692	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	47
PID 2692 wrote to memory of 1692	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	47
PID 2692 wrote to memory of 308	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	48
PID 2692 wrote to memory of 308	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	48
PID 2692 wrote to memory of 308	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	48
PID 2692 wrote to memory of 584	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	49
PID 2692 wrote to memory of 584	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	49
PID 2692 wrote to memory of 584	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	49
PID 2692 wrote to memory of 1584	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	50
PID 2692 wrote to memory of 1584	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	50
PID 2692 wrote to memory of 1584	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	50
PID 2692 wrote to memory of 992	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	51
PID 2692 wrote to memory of 992	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	51
PID 2692 wrote to memory of 992	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	51
PID 2692 wrote to memory of 772	2692	JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe	52

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d3d3450af4adb6c9eef0e47e758aae86efe0486066b88a2006623df61f91420c.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\System\joiBNBF.exe
  C:\Windows\System\joiBNBF.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\xbabLIV.exe
  C:\Windows\System\xbabLIV.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\vzmAHnV.exe
  C:\Windows\System\vzmAHnV.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\mIhhGPI.exe
  C:\Windows\System\mIhhGPI.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\MkUbgpJ.exe
  C:\Windows\System\MkUbgpJ.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\aTKFiMt.exe
  C:\Windows\System\aTKFiMt.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\ryByamP.exe
  C:\Windows\System\ryByamP.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\ouXioro.exe
  C:\Windows\System\ouXioro.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\XmNJTwj.exe
  C:\Windows\System\XmNJTwj.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\iUYmWCY.exe
  C:\Windows\System\iUYmWCY.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\worENdf.exe
  C:\Windows\System\worENdf.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\rATyTMy.exe
  C:\Windows\System\rATyTMy.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\RkNPMoz.exe
  C:\Windows\System\RkNPMoz.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\xDYlZmT.exe
  C:\Windows\System\xDYlZmT.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\JMQGyeS.exe
  C:\Windows\System\JMQGyeS.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\OXBQAVc.exe
  C:\Windows\System\OXBQAVc.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\CyGdluO.exe
  C:\Windows\System\CyGdluO.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\WKHQiiI.exe
  C:\Windows\System\WKHQiiI.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\rMxANsH.exe
  C:\Windows\System\rMxANsH.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\EehKCZn.exe
  C:\Windows\System\EehKCZn.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\ynfzlhn.exe
  C:\Windows\System\ynfzlhn.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\TbbCLry.exe
  C:\Windows\System\TbbCLry.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\PUQrtDs.exe
  C:\Windows\System\PUQrtDs.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\XSovxJH.exe
  C:\Windows\System\XSovxJH.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\AIllKaT.exe
  C:\Windows\System\AIllKaT.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\jjnqafq.exe
  C:\Windows\System\jjnqafq.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\OKthCbq.exe
  C:\Windows\System\OKthCbq.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\WmfoeUG.exe
  C:\Windows\System\WmfoeUG.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\rxNBcGs.exe
  C:\Windows\System\rxNBcGs.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\fLfwKcc.exe
  C:\Windows\System\fLfwKcc.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\BpfTnSO.exe
  C:\Windows\System\BpfTnSO.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\kKwWhQP.exe
  C:\Windows\System\kKwWhQP.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\oiwgIIB.exe
  C:\Windows\System\oiwgIIB.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\hNxEmWv.exe
  C:\Windows\System\hNxEmWv.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\YTNZRpt.exe
  C:\Windows\System\YTNZRpt.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\UtFeoLC.exe
  C:\Windows\System\UtFeoLC.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\UtQLTlO.exe
  C:\Windows\System\UtQLTlO.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\GFBGplT.exe
  C:\Windows\System\GFBGplT.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\TGwHkGe.exe
  C:\Windows\System\TGwHkGe.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\sihgBiS.exe
  C:\Windows\System\sihgBiS.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\NZzsfFy.exe
  C:\Windows\System\NZzsfFy.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\EkBkbBg.exe
  C:\Windows\System\EkBkbBg.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\ZFEHqKx.exe
  C:\Windows\System\ZFEHqKx.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\sxKvFoR.exe
  C:\Windows\System\sxKvFoR.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\JNIXvKq.exe
  C:\Windows\System\JNIXvKq.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\baFWHxI.exe
  C:\Windows\System\baFWHxI.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\EHNYECJ.exe
  C:\Windows\System\EHNYECJ.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\wFPkJsh.exe
  C:\Windows\System\wFPkJsh.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\IZSTTfQ.exe
  C:\Windows\System\IZSTTfQ.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\cioMvkI.exe
  C:\Windows\System\cioMvkI.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\AbTwZGj.exe
  C:\Windows\System\AbTwZGj.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\pZnLVzD.exe
  C:\Windows\System\pZnLVzD.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\XeXlPQw.exe
  C:\Windows\System\XeXlPQw.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\LOXLcuV.exe
  C:\Windows\System\LOXLcuV.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\rmkrqpE.exe
  C:\Windows\System\rmkrqpE.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\XtYGfvT.exe
  C:\Windows\System\XtYGfvT.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\rHRFzPo.exe
  C:\Windows\System\rHRFzPo.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\ErjRoLt.exe
  C:\Windows\System\ErjRoLt.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\PnAhlCf.exe
  C:\Windows\System\PnAhlCf.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\mKprcIc.exe
  C:\Windows\System\mKprcIc.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\rouvEPK.exe
  C:\Windows\System\rouvEPK.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\sPgEttG.exe
  C:\Windows\System\sPgEttG.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\NlWgdEb.exe
  C:\Windows\System\NlWgdEb.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\iZtnJqM.exe
  C:\Windows\System\iZtnJqM.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\JrKpqEi.exe
  C:\Windows\System\JrKpqEi.exe
  2⤵
  PID:2680
- C:\Windows\System\MYNrRQf.exe
  C:\Windows\System\MYNrRQf.exe
  2⤵
  PID:2564
- C:\Windows\System\ltdszfz.exe
  C:\Windows\System\ltdszfz.exe
  2⤵
  PID:2032
- C:\Windows\System\PVptaXU.exe
  C:\Windows\System\PVptaXU.exe
  2⤵
  PID:1380
- C:\Windows\System\jTsXGML.exe
  C:\Windows\System\jTsXGML.exe
  2⤵
  PID:444
- C:\Windows\System\MxYGuXt.exe
  C:\Windows\System\MxYGuXt.exe
  2⤵
  PID:2008
- C:\Windows\System\qoTuqCR.exe
  C:\Windows\System\qoTuqCR.exe
  2⤵
  PID:1432
- C:\Windows\System\jJeMwmP.exe
  C:\Windows\System\jJeMwmP.exe
  2⤵
  PID:1216
- C:\Windows\System\oJSuwUe.exe
  C:\Windows\System\oJSuwUe.exe
  2⤵
  PID:492
- C:\Windows\System\VOAxMUv.exe
  C:\Windows\System\VOAxMUv.exe
  2⤵
  PID:2248
- C:\Windows\System\BNyaKKI.exe
  C:\Windows\System\BNyaKKI.exe
  2⤵
  PID:3012
- C:\Windows\System\YUpGKsp.exe
  C:\Windows\System\YUpGKsp.exe
  2⤵
  PID:2380
- C:\Windows\System\FGjMers.exe
  C:\Windows\System\FGjMers.exe
  2⤵
  PID:936
- C:\Windows\System\AgWaWNf.exe
  C:\Windows\System\AgWaWNf.exe
  2⤵
  PID:1524
- C:\Windows\System\NLZrBpU.exe
  C:\Windows\System\NLZrBpU.exe
  2⤵
  PID:1120
- C:\Windows\System\dNaCXQo.exe
  C:\Windows\System\dNaCXQo.exe
  2⤵
  PID:1448
- C:\Windows\System\kFsVanB.exe
  C:\Windows\System\kFsVanB.exe
  2⤵
  PID:2284
- C:\Windows\System\ZNoyaDE.exe
  C:\Windows\System\ZNoyaDE.exe
  2⤵
  PID:1612
- C:\Windows\System\gBQQwOC.exe
  C:\Windows\System\gBQQwOC.exe
  2⤵
  PID:572
- C:\Windows\System\bEAsFAS.exe
  C:\Windows\System\bEAsFAS.exe
  2⤵
  PID:556
- C:\Windows\System\cTUpnzc.exe
  C:\Windows\System\cTUpnzc.exe
  2⤵
  PID:3044
- C:\Windows\System\lJCwwcY.exe
  C:\Windows\System\lJCwwcY.exe
  2⤵
  PID:2164
- C:\Windows\System\XGoXbGd.exe
  C:\Windows\System\XGoXbGd.exe
  2⤵
  PID:2552
- C:\Windows\System\HktXGJk.exe
  C:\Windows\System\HktXGJk.exe
  2⤵
  PID:2928
- C:\Windows\System\VDgKmkx.exe
  C:\Windows\System\VDgKmkx.exe
  2⤵
  PID:2364
- C:\Windows\System\LEqMGmZ.exe
  C:\Windows\System\LEqMGmZ.exe
  2⤵
  PID:2264
- C:\Windows\System\UmuWlib.exe
  C:\Windows\System\UmuWlib.exe
  2⤵
  PID:2092
- C:\Windows\System\VaQFuno.exe
  C:\Windows\System\VaQFuno.exe
  2⤵
  PID:2400
- C:\Windows\System\peVhLpM.exe
  C:\Windows\System\peVhLpM.exe
  2⤵
  PID:2896
- C:\Windows\System\AkMWsuw.exe
  C:\Windows\System\AkMWsuw.exe
  2⤵
  PID:2480
- C:\Windows\System\czqYTjy.exe
  C:\Windows\System\czqYTjy.exe
  2⤵
  PID:2852
- C:\Windows\System\Wdhhcnx.exe
  C:\Windows\System\Wdhhcnx.exe
  2⤵
  PID:2884
- C:\Windows\System\obxqHtQ.exe
  C:\Windows\System\obxqHtQ.exe
  2⤵
  PID:1624
- C:\Windows\System\GgGLtNQ.exe
  C:\Windows\System\GgGLtNQ.exe
  2⤵
  PID:2780
- C:\Windows\System\GTGbFgG.exe
  C:\Windows\System\GTGbFgG.exe
  2⤵
  PID:1928
- C:\Windows\System\EzlwbYo.exe
  C:\Windows\System\EzlwbYo.exe
  2⤵
  PID:800
- C:\Windows\System\YVgQclm.exe
  C:\Windows\System\YVgQclm.exe
  2⤵
  PID:2428
- C:\Windows\System\OcDVkux.exe
  C:\Windows\System\OcDVkux.exe
  2⤵
  PID:764
- C:\Windows\System\KvZWuOs.exe
  C:\Windows\System\KvZWuOs.exe
  2⤵
  PID:2260
- C:\Windows\System\ezOIJxT.exe
  C:\Windows\System\ezOIJxT.exe
  2⤵
  PID:2592
- C:\Windows\System\qjjbuFJ.exe
  C:\Windows\System\qjjbuFJ.exe
  2⤵
  PID:2984
- C:\Windows\System\omtnvgZ.exe
  C:\Windows\System\omtnvgZ.exe
  2⤵
  PID:560
- C:\Windows\System\rSWBNBw.exe
  C:\Windows\System\rSWBNBw.exe
  2⤵
  PID:2832
- C:\Windows\System\GEIPJIc.exe
  C:\Windows\System\GEIPJIc.exe
  2⤵
  PID:1604
- C:\Windows\System\ZBgHNAf.exe
  C:\Windows\System\ZBgHNAf.exe
  2⤵
  PID:892
- C:\Windows\System\GaauhEJ.exe
  C:\Windows\System\GaauhEJ.exe
  2⤵
  PID:2412
- C:\Windows\System\qTbrjfJ.exe
  C:\Windows\System\qTbrjfJ.exe
  2⤵
  PID:1648
- C:\Windows\System\kHHyyMW.exe
  C:\Windows\System\kHHyyMW.exe
  2⤵
  PID:2548
- C:\Windows\System\cdMdLix.exe
  C:\Windows\System\cdMdLix.exe
  2⤵
  PID:1632
- C:\Windows\System\fbWUfvX.exe
  C:\Windows\System\fbWUfvX.exe
  2⤵
  PID:268
- C:\Windows\System\RqkjZkI.exe
  C:\Windows\System\RqkjZkI.exe
  2⤵
  PID:1540
- C:\Windows\System\GQPTLIZ.exe
  C:\Windows\System\GQPTLIZ.exe
  2⤵
  PID:2768
- C:\Windows\System\zvvfwft.exe
  C:\Windows\System\zvvfwft.exe
  2⤵
  PID:2332
- C:\Windows\System\TdYCYNh.exe
  C:\Windows\System\TdYCYNh.exe
  2⤵
  PID:2636
- C:\Windows\System\vXjfRxA.exe
  C:\Windows\System\vXjfRxA.exe
  2⤵
  PID:2956
- C:\Windows\System\ewLdxqr.exe
  C:\Windows\System\ewLdxqr.exe
  2⤵
  PID:2488
- C:\Windows\System\lZbqvqG.exe
  C:\Windows\System\lZbqvqG.exe
  2⤵
  PID:2824
- C:\Windows\System\KEeLmAl.exe
  C:\Windows\System\KEeLmAl.exe
  2⤵
  PID:2036
- C:\Windows\System\HcZavqV.exe
  C:\Windows\System\HcZavqV.exe
  2⤵
  PID:376
- C:\Windows\System\kdJbBfC.exe
  C:\Windows\System\kdJbBfC.exe
  2⤵
  PID:2624
- C:\Windows\System\IjQiDuJ.exe
  C:\Windows\System\IjQiDuJ.exe
  2⤵
  PID:2672
- C:\Windows\System\FgYhlbu.exe
  C:\Windows\System\FgYhlbu.exe
  2⤵
  PID:1272
- C:\Windows\System\OYijQbB.exe
  C:\Windows\System\OYijQbB.exe
  2⤵
  PID:2744
- C:\Windows\System\qkGvyau.exe
  C:\Windows\System\qkGvyau.exe
  2⤵
  PID:300
- C:\Windows\System\fFgtBvH.exe
  C:\Windows\System\fFgtBvH.exe
  2⤵
  PID:3036
- C:\Windows\System\AJngIWK.exe
  C:\Windows\System\AJngIWK.exe
  2⤵
  PID:2844
- C:\Windows\System\mqMUkhi.exe
  C:\Windows\System\mqMUkhi.exe
  2⤵
  PID:1444
- C:\Windows\System\IbmhQKQ.exe
  C:\Windows\System\IbmhQKQ.exe
  2⤵
  PID:2860
- C:\Windows\System\IHggUJk.exe
  C:\Windows\System\IHggUJk.exe
  2⤵
  PID:1852
- C:\Windows\System\mafHxXB.exe
  C:\Windows\System\mafHxXB.exe
  2⤵
  PID:1664
- C:\Windows\System\gUmQACq.exe
  C:\Windows\System\gUmQACq.exe
  2⤵
  PID:2188
- C:\Windows\System\MQJPEIj.exe
  C:\Windows\System\MQJPEIj.exe
  2⤵
  PID:2740
- C:\Windows\System\RahtQIJ.exe
  C:\Windows\System\RahtQIJ.exe
  2⤵
  PID:1396
- C:\Windows\System\jscAzZk.exe
  C:\Windows\System\jscAzZk.exe
  2⤵
  PID:1912
- C:\Windows\System\AvzBzWz.exe
  C:\Windows\System\AvzBzWz.exe
  2⤵
  PID:972
- C:\Windows\System\eJOhvzk.exe
  C:\Windows\System\eJOhvzk.exe
  2⤵
  PID:1772
- C:\Windows\System\NVdbVsP.exe
  C:\Windows\System\NVdbVsP.exe
  2⤵
  PID:1200
- C:\Windows\System\AfeZkUo.exe
  C:\Windows\System\AfeZkUo.exe
  2⤵
  PID:2152
- C:\Windows\System\wcgvzhd.exe
  C:\Windows\System\wcgvzhd.exe
  2⤵
  PID:2100
- C:\Windows\System\rOmhXNu.exe
  C:\Windows\System\rOmhXNu.exe
  2⤵
  PID:3028
- C:\Windows\System\mWTFSIR.exe
  C:\Windows\System\mWTFSIR.exe
  2⤵
  PID:2288
- C:\Windows\System\SUYRuNq.exe
  C:\Windows\System\SUYRuNq.exe
  2⤵
  PID:2784
- C:\Windows\System\QWrdwbi.exe
  C:\Windows\System\QWrdwbi.exe
  2⤵
  PID:532
- C:\Windows\System\zQUuigm.exe
  C:\Windows\System\zQUuigm.exe
  2⤵
  PID:1724
- C:\Windows\System\ucJXewy.exe
  C:\Windows\System\ucJXewy.exe
  2⤵
  PID:2908
- C:\Windows\System\DNncXdd.exe
  C:\Windows\System\DNncXdd.exe
  2⤵
  PID:296
- C:\Windows\System\PzGzTlh.exe
  C:\Windows\System\PzGzTlh.exe
  2⤵
  PID:3076
- C:\Windows\System\Jeukknv.exe
  C:\Windows\System\Jeukknv.exe
  2⤵
  PID:3100
- C:\Windows\System\fJCXcHP.exe
  C:\Windows\System\fJCXcHP.exe
  2⤵
  PID:3116
- C:\Windows\System\XxFTagR.exe
  C:\Windows\System\XxFTagR.exe
  2⤵
  PID:3136
- C:\Windows\System\ifrVpLV.exe
  C:\Windows\System\ifrVpLV.exe
  2⤵
  PID:3156
- C:\Windows\System\IgvAJpK.exe
  C:\Windows\System\IgvAJpK.exe
  2⤵
  PID:3180
- C:\Windows\System\xDBGmHp.exe
  C:\Windows\System\xDBGmHp.exe
  2⤵
  PID:3196
- C:\Windows\System\VQviQoj.exe
  C:\Windows\System\VQviQoj.exe
  2⤵
  PID:3220
- C:\Windows\System\wwywVsR.exe
  C:\Windows\System\wwywVsR.exe
  2⤵
  PID:3240
- C:\Windows\System\cnOKjUc.exe
  C:\Windows\System\cnOKjUc.exe
  2⤵
  PID:3260
- C:\Windows\System\dpXjSmf.exe
  C:\Windows\System\dpXjSmf.exe
  2⤵
  PID:3280
- C:\Windows\System\qDuecem.exe
  C:\Windows\System\qDuecem.exe
  2⤵
  PID:3300
- C:\Windows\System\qGqvqic.exe
  C:\Windows\System\qGqvqic.exe
  2⤵
  PID:3320
- C:\Windows\System\sDjFlxp.exe
  C:\Windows\System\sDjFlxp.exe
  2⤵
  PID:3340
- C:\Windows\System\zNzqUDD.exe
  C:\Windows\System\zNzqUDD.exe
  2⤵
  PID:3360
- C:\Windows\System\qqQMKgG.exe
  C:\Windows\System\qqQMKgG.exe
  2⤵
  PID:3380
- C:\Windows\System\lenMeLp.exe
  C:\Windows\System\lenMeLp.exe
  2⤵
  PID:3400
- C:\Windows\System\DRnuWhO.exe
  C:\Windows\System\DRnuWhO.exe
  2⤵
  PID:3420
- C:\Windows\System\AAdKPdL.exe
  C:\Windows\System\AAdKPdL.exe
  2⤵
  PID:3440
- C:\Windows\System\TEpgcVL.exe
  C:\Windows\System\TEpgcVL.exe
  2⤵
  PID:3460
- C:\Windows\System\IYUVJSI.exe
  C:\Windows\System\IYUVJSI.exe
  2⤵
  PID:3480
- C:\Windows\System\UhjFQrz.exe
  C:\Windows\System\UhjFQrz.exe
  2⤵
  PID:3500
- C:\Windows\System\omMgUMM.exe
  C:\Windows\System\omMgUMM.exe
  2⤵
  PID:3520
- C:\Windows\System\folVpDh.exe
  C:\Windows\System\folVpDh.exe
  2⤵
  PID:3540
- C:\Windows\System\IqHgkhs.exe
  C:\Windows\System\IqHgkhs.exe
  2⤵
  PID:3560
- C:\Windows\System\jYbaMnM.exe
  C:\Windows\System\jYbaMnM.exe
  2⤵
  PID:3580
- C:\Windows\System\tzkKbBC.exe
  C:\Windows\System\tzkKbBC.exe
  2⤵
  PID:3600
- C:\Windows\System\HwAaQRg.exe
  C:\Windows\System\HwAaQRg.exe
  2⤵
  PID:3620
- C:\Windows\System\stgCFUb.exe
  C:\Windows\System\stgCFUb.exe
  2⤵
  PID:3636
- C:\Windows\System\QFExnqi.exe
  C:\Windows\System\QFExnqi.exe
  2⤵
  PID:3652
- C:\Windows\System\JLUOxZs.exe
  C:\Windows\System\JLUOxZs.exe
  2⤵
  PID:3676
- C:\Windows\System\MexkzQs.exe
  C:\Windows\System\MexkzQs.exe
  2⤵
  PID:3692
- C:\Windows\System\DKLajko.exe
  C:\Windows\System\DKLajko.exe
  2⤵
  PID:3712
- C:\Windows\System\bothTsk.exe
  C:\Windows\System\bothTsk.exe
  2⤵
  PID:3736
- C:\Windows\System\YiExilE.exe
  C:\Windows\System\YiExilE.exe
  2⤵
  PID:3752
- C:\Windows\System\jpxXluS.exe
  C:\Windows\System\jpxXluS.exe
  2⤵
  PID:3768
- C:\Windows\System\ZsmZBBI.exe
  C:\Windows\System\ZsmZBBI.exe
  2⤵
  PID:3788
- C:\Windows\System\kabCWZQ.exe
  C:\Windows\System\kabCWZQ.exe
  2⤵
  PID:3804
- C:\Windows\System\zKhxPCp.exe
  C:\Windows\System\zKhxPCp.exe
  2⤵
  PID:3824
- C:\Windows\System\jClZOhZ.exe
  C:\Windows\System\jClZOhZ.exe
  2⤵
  PID:3856
- C:\Windows\System\oWKYKHR.exe
  C:\Windows\System\oWKYKHR.exe
  2⤵
  PID:3876
- C:\Windows\System\xLjsQsO.exe
  C:\Windows\System\xLjsQsO.exe
  2⤵
  PID:3900
- C:\Windows\System\mFPADOE.exe
  C:\Windows\System\mFPADOE.exe
  2⤵
  PID:3916
- C:\Windows\System\svRGMOX.exe
  C:\Windows\System\svRGMOX.exe
  2⤵
  PID:3932
- C:\Windows\System\OruOFCQ.exe
  C:\Windows\System\OruOFCQ.exe
  2⤵
  PID:3956
- C:\Windows\System\iYlzCNb.exe
  C:\Windows\System\iYlzCNb.exe
  2⤵
  PID:3972
- C:\Windows\System\FHLfwbm.exe
  C:\Windows\System\FHLfwbm.exe
  2⤵
  PID:3992
- C:\Windows\System\BFBbjyM.exe
  C:\Windows\System\BFBbjyM.exe
  2⤵
  PID:4008
- C:\Windows\System\QRbeKzv.exe
  C:\Windows\System\QRbeKzv.exe
  2⤵
  PID:4040
- C:\Windows\System\kYsnugZ.exe
  C:\Windows\System\kYsnugZ.exe
  2⤵
  PID:4056
- C:\Windows\System\TJSMHcc.exe
  C:\Windows\System\TJSMHcc.exe
  2⤵
  PID:4076
- C:\Windows\System\QGXpWzn.exe
  C:\Windows\System\QGXpWzn.exe
  2⤵
  PID:4092
- C:\Windows\System\vNZZOoY.exe
  C:\Windows\System\vNZZOoY.exe
  2⤵
  PID:2356
- C:\Windows\System\oZsfDzy.exe
  C:\Windows\System\oZsfDzy.exe
  2⤵
  PID:668
- C:\Windows\System\foDbAET.exe
  C:\Windows\System\foDbAET.exe
  2⤵
  PID:1600
- C:\Windows\System\BJUwuPM.exe
  C:\Windows\System\BJUwuPM.exe
  2⤵
  PID:3092
- C:\Windows\System\hscuHct.exe
  C:\Windows\System\hscuHct.exe
  2⤵
  PID:3128
- C:\Windows\System\MgWSDVZ.exe
  C:\Windows\System\MgWSDVZ.exe
  2⤵
  PID:3112
- C:\Windows\System\dxzDttP.exe
  C:\Windows\System\dxzDttP.exe
  2⤵
  PID:3172
- C:\Windows\System\iLriryV.exe
  C:\Windows\System\iLriryV.exe
  2⤵
  PID:3208
- C:\Windows\System\KIhPwWD.exe
  C:\Windows\System\KIhPwWD.exe
  2⤵
  PID:3248
- C:\Windows\System\PXvGefR.exe
  C:\Windows\System\PXvGefR.exe
  2⤵
  PID:3288
- C:\Windows\System\ahdzhGF.exe
  C:\Windows\System\ahdzhGF.exe
  2⤵
  PID:3328
- C:\Windows\System\KIyEFjy.exe
  C:\Windows\System\KIyEFjy.exe
  2⤵
  PID:3348
- C:\Windows\System\ANpNWdJ.exe
  C:\Windows\System\ANpNWdJ.exe
  2⤵
  PID:3352
- C:\Windows\System\hzufKgn.exe
  C:\Windows\System\hzufKgn.exe
  2⤵
  PID:3408
- C:\Windows\System\GZFuYKp.exe
  C:\Windows\System\GZFuYKp.exe
  2⤵
  PID:3436
- C:\Windows\System\tywLTrU.exe
  C:\Windows\System\tywLTrU.exe
  2⤵
  PID:3468
- C:\Windows\System\msPcxzZ.exe
  C:\Windows\System\msPcxzZ.exe
  2⤵
  PID:3508
- C:\Windows\System\oADzDMI.exe
  C:\Windows\System\oADzDMI.exe
  2⤵
  PID:3532
- C:\Windows\System\zoBkqTI.exe
  C:\Windows\System\zoBkqTI.exe
  2⤵
  PID:3616
- C:\Windows\System\nOvdrzG.exe
  C:\Windows\System\nOvdrzG.exe
  2⤵
  PID:3684
- C:\Windows\System\YbIrWub.exe
  C:\Windows\System\YbIrWub.exe
  2⤵
  PID:3732
- C:\Windows\System\QGngcSB.exe
  C:\Windows\System\QGngcSB.exe
  2⤵
  PID:3548
- C:\Windows\System\KmbYnrC.exe
  C:\Windows\System\KmbYnrC.exe
  2⤵
  PID:3592
- C:\Windows\System\BLBiIKp.exe
  C:\Windows\System\BLBiIKp.exe
  2⤵
  PID:3672
- C:\Windows\System\peGHIRE.exe
  C:\Windows\System\peGHIRE.exe
  2⤵
  PID:3700
- C:\Windows\System\IUvNCza.exe
  C:\Windows\System\IUvNCza.exe
  2⤵
  PID:3708
- C:\Windows\System\tYSVCHe.exe
  C:\Windows\System\tYSVCHe.exe
  2⤵
  PID:3848
- C:\Windows\System\HKaKXVz.exe
  C:\Windows\System\HKaKXVz.exe
  2⤵
  PID:3888
- C:\Windows\System\dXyKMrq.exe
  C:\Windows\System\dXyKMrq.exe
  2⤵
  PID:3928
- C:\Windows\System\GTboPMr.exe
  C:\Windows\System\GTboPMr.exe
  2⤵
  PID:3872
- C:\Windows\System\GCIpghm.exe
  C:\Windows\System\GCIpghm.exe
  2⤵
  PID:3984
- C:\Windows\System\lukhpZC.exe
  C:\Windows\System\lukhpZC.exe
  2⤵
  PID:3980
- C:\Windows\System\YFJpWFh.exe
  C:\Windows\System\YFJpWFh.exe
  2⤵
  PID:1712
- C:\Windows\System\rrQytrp.exe
  C:\Windows\System\rrQytrp.exe
  2⤵
  PID:4028
- C:\Windows\System\ZnHbPvg.exe
  C:\Windows\System\ZnHbPvg.exe
  2⤵
  PID:1004
- C:\Windows\System\QVhzImd.exe
  C:\Windows\System\QVhzImd.exe
  2⤵
  PID:2444
- C:\Windows\System\PespESm.exe
  C:\Windows\System\PespESm.exe
  2⤵
  PID:3144
- C:\Windows\System\luuzSLA.exe
  C:\Windows\System\luuzSLA.exe
  2⤵
  PID:2424
- C:\Windows\System\rItSwob.exe
  C:\Windows\System\rItSwob.exe
  2⤵
  PID:3232
- C:\Windows\System\fdWlJhW.exe
  C:\Windows\System\fdWlJhW.exe
  2⤵
  PID:3332
- C:\Windows\System\qhoDuKv.exe
  C:\Windows\System\qhoDuKv.exe
  2⤵
  PID:3096
- C:\Windows\System\bVnMHHr.exe
  C:\Windows\System\bVnMHHr.exe
  2⤵
  PID:3276
- C:\Windows\System\WckCzQN.exe
  C:\Windows\System\WckCzQN.exe
  2⤵
  PID:3456
- C:\Windows\System\GGhJcQn.exe
  C:\Windows\System\GGhJcQn.exe
  2⤵
  PID:3428
- C:\Windows\System\oMxAbAM.exe
  C:\Windows\System\oMxAbAM.exe
  2⤵
  PID:3392
- C:\Windows\System\HIryNfg.exe
  C:\Windows\System\HIryNfg.exe
  2⤵
  PID:3492
- C:\Windows\System\bxWAMUl.exe
  C:\Windows\System\bxWAMUl.exe
  2⤵
  PID:3728
- C:\Windows\System\CiDjJvp.exe
  C:\Windows\System\CiDjJvp.exe
  2⤵
  PID:3776
- C:\Windows\System\CpuNrpR.exe
  C:\Windows\System\CpuNrpR.exe
  2⤵
  PID:3552
- C:\Windows\System\AOekFUh.exe
  C:\Windows\System\AOekFUh.exe
  2⤵
  PID:3596
- C:\Windows\System\JBruApD.exe
  C:\Windows\System\JBruApD.exe
  2⤵
  PID:3812
- C:\Windows\System\xXMcLUI.exe
  C:\Windows\System\xXMcLUI.exe
  2⤵
  PID:3988
- C:\Windows\System\faxBCaq.exe
  C:\Windows\System\faxBCaq.exe
  2⤵
  PID:3084
- C:\Windows\System\aOrXOQw.exe
  C:\Windows\System\aOrXOQw.exe
  2⤵
  PID:3864
- C:\Windows\System\pGcarBN.exe
  C:\Windows\System\pGcarBN.exe
  2⤵
  PID:4004
- C:\Windows\System\OQvNEVt.exe
  C:\Windows\System\OQvNEVt.exe
  2⤵
  PID:832
- C:\Windows\System\IxEZDUC.exe
  C:\Windows\System\IxEZDUC.exe
  2⤵
  PID:3192
- C:\Windows\System\lvuBuNK.exe
  C:\Windows\System\lvuBuNK.exe
  2⤵
  PID:3236
- C:\Windows\System\LSaSDky.exe
  C:\Windows\System\LSaSDky.exe
  2⤵
  PID:3396
- C:\Windows\System\VtLOTZn.exe
  C:\Windows\System\VtLOTZn.exe
  2⤵
  PID:3536
- C:\Windows\System\wlhHuPo.exe
  C:\Windows\System\wlhHuPo.exe
  2⤵
  PID:3452
- C:\Windows\System\yISBTSc.exe
  C:\Windows\System\yISBTSc.exe
  2⤵
  PID:3644
- C:\Windows\System\VHYBZwG.exe
  C:\Windows\System\VHYBZwG.exe
  2⤵
  PID:3576
- C:\Windows\System\HAnLJvM.exe
  C:\Windows\System\HAnLJvM.exe
  2⤵
  PID:3844
- C:\Windows\System\rymioUe.exe
  C:\Windows\System\rymioUe.exe
  2⤵
  PID:3940
- C:\Windows\System\gzzgmbY.exe
  C:\Windows\System\gzzgmbY.exe
  2⤵
  PID:4032
- C:\Windows\System\nPwULVu.exe
  C:\Windows\System\nPwULVu.exe
  2⤵
  PID:4016
- C:\Windows\System\DIDiCqD.exe
  C:\Windows\System\DIDiCqD.exe
  2⤵
  PID:1184
- C:\Windows\System\CFWFCfm.exe
  C:\Windows\System\CFWFCfm.exe
  2⤵
  PID:904
- C:\Windows\System\XjdzHWK.exe
  C:\Windows\System\XjdzHWK.exe
  2⤵
  PID:3124
- C:\Windows\System\tXmpaWi.exe
  C:\Windows\System\tXmpaWi.exe
  2⤵
  PID:3212
- C:\Windows\System\lTnTRJC.exe
  C:\Windows\System\lTnTRJC.exe
  2⤵
  PID:3472
- C:\Windows\System\HhjOtzj.exe
  C:\Windows\System\HhjOtzj.exe
  2⤵
  PID:3648
- C:\Windows\System\oTPmRTA.exe
  C:\Windows\System\oTPmRTA.exe
  2⤵
  PID:1864
- C:\Windows\System\oWZIJWS.exe
  C:\Windows\System\oWZIJWS.exe
  2⤵
  PID:3668
- C:\Windows\System\GIGfWAb.exe
  C:\Windows\System\GIGfWAb.exe
  2⤵
  PID:3744
- C:\Windows\System\JqefwUV.exe
  C:\Windows\System\JqefwUV.exe
  2⤵
  PID:3488
- C:\Windows\System\QVWqNyp.exe
  C:\Windows\System\QVWqNyp.exe
  2⤵
  PID:3292
- C:\Windows\System\iLmAHaS.exe
  C:\Windows\System\iLmAHaS.exe
  2⤵
  PID:4088
- C:\Windows\System\eXGgVZM.exe
  C:\Windows\System\eXGgVZM.exe
  2⤵
  PID:3032
- C:\Windows\System\QJbUmAT.exe
  C:\Windows\System\QJbUmAT.exe
  2⤵
  PID:3800
- C:\Windows\System\ovJRXjp.exe
  C:\Windows\System\ovJRXjp.exe
  2⤵
  PID:2296
- C:\Windows\System\clYHLVd.exe
  C:\Windows\System\clYHLVd.exe
  2⤵
  PID:2764
- C:\Windows\System\tSUUlJd.exe
  C:\Windows\System\tSUUlJd.exe
  2⤵
  PID:2096
- C:\Windows\System\FMPOWru.exe
  C:\Windows\System\FMPOWru.exe
  2⤵
  PID:4104
- C:\Windows\System\nGrqUAn.exe
  C:\Windows\System\nGrqUAn.exe
  2⤵
  PID:4120
- C:\Windows\System\oJRbDYI.exe
  C:\Windows\System\oJRbDYI.exe
  2⤵
  PID:4136
- C:\Windows\System\KiNsVvv.exe
  C:\Windows\System\KiNsVvv.exe
  2⤵
  PID:4152
- C:\Windows\System\rVCcyXm.exe
  C:\Windows\System\rVCcyXm.exe
  2⤵
  PID:4168
- C:\Windows\System\xUMExYb.exe
  C:\Windows\System\xUMExYb.exe
  2⤵
  PID:4184
- C:\Windows\System\VQplola.exe
  C:\Windows\System\VQplola.exe
  2⤵
  PID:4200
- C:\Windows\System\xchCSTg.exe
  C:\Windows\System\xchCSTg.exe
  2⤵
  PID:4216
- C:\Windows\System\GCwKGoi.exe
  C:\Windows\System\GCwKGoi.exe
  2⤵
  PID:4232
- C:\Windows\System\QorgCRp.exe
  C:\Windows\System\QorgCRp.exe
  2⤵
  PID:4248
- C:\Windows\System\wTdSuhA.exe
  C:\Windows\System\wTdSuhA.exe
  2⤵
  PID:4264
- C:\Windows\System\iMfnTuQ.exe
  C:\Windows\System\iMfnTuQ.exe
  2⤵
  PID:4280
- C:\Windows\System\mXSrTKk.exe
  C:\Windows\System\mXSrTKk.exe
  2⤵
  PID:4296
- C:\Windows\System\uJyzdDb.exe
  C:\Windows\System\uJyzdDb.exe
  2⤵
  PID:4312
- C:\Windows\System\JAWKTzt.exe
  C:\Windows\System\JAWKTzt.exe
  2⤵
  PID:4332
- C:\Windows\System\BrLJlZU.exe
  C:\Windows\System\BrLJlZU.exe
  2⤵
  PID:4348
- C:\Windows\System\ulfdyXk.exe
  C:\Windows\System\ulfdyXk.exe
  2⤵
  PID:4364
- C:\Windows\System\KVpuFSS.exe
  C:\Windows\System\KVpuFSS.exe
  2⤵
  PID:4380
- C:\Windows\System\VCIlhor.exe
  C:\Windows\System\VCIlhor.exe
  2⤵
  PID:4396
- C:\Windows\System\JPPUDzW.exe
  C:\Windows\System\JPPUDzW.exe
  2⤵
  PID:4412
- C:\Windows\System\yocUvWl.exe
  C:\Windows\System\yocUvWl.exe
  2⤵
  PID:4428
- C:\Windows\System\KqEpdtY.exe
  C:\Windows\System\KqEpdtY.exe
  2⤵
  PID:4444
- C:\Windows\System\alsQRxX.exe
  C:\Windows\System\alsQRxX.exe
  2⤵
  PID:4460
- C:\Windows\System\DXmSQAm.exe
  C:\Windows\System\DXmSQAm.exe
  2⤵
  PID:4476
- C:\Windows\System\yzZNSnc.exe
  C:\Windows\System\yzZNSnc.exe
  2⤵
  PID:4492
- C:\Windows\System\pohgxFo.exe
  C:\Windows\System\pohgxFo.exe
  2⤵
  PID:4508
- C:\Windows\System\jmdmlTa.exe
  C:\Windows\System\jmdmlTa.exe
  2⤵
  PID:4524
- C:\Windows\System\MzdRtSG.exe
  C:\Windows\System\MzdRtSG.exe
  2⤵
  PID:4540
- C:\Windows\System\CKmSzIQ.exe
  C:\Windows\System\CKmSzIQ.exe
  2⤵
  PID:4556
- C:\Windows\System\MsKxyHK.exe
  C:\Windows\System\MsKxyHK.exe
  2⤵
  PID:4572
- C:\Windows\System\dcUIxGO.exe
  C:\Windows\System\dcUIxGO.exe
  2⤵
  PID:4588
- C:\Windows\System\MKQSueG.exe
  C:\Windows\System\MKQSueG.exe
  2⤵
  PID:4604
- C:\Windows\System\bcthRZO.exe
  C:\Windows\System\bcthRZO.exe
  2⤵
  PID:4620
- C:\Windows\System\CNXCRuD.exe
  C:\Windows\System\CNXCRuD.exe
  2⤵
  PID:4636
- C:\Windows\System\SmSjWZx.exe
  C:\Windows\System\SmSjWZx.exe
  2⤵
  PID:4652
- C:\Windows\System\jVQRNRl.exe
  C:\Windows\System\jVQRNRl.exe
  2⤵
  PID:4668
- C:\Windows\System\NCxdOZX.exe
  C:\Windows\System\NCxdOZX.exe
  2⤵
  PID:4684
- C:\Windows\System\NoEaUcU.exe
  C:\Windows\System\NoEaUcU.exe
  2⤵
  PID:4700
- C:\Windows\System\dapjEPf.exe
  C:\Windows\System\dapjEPf.exe
  2⤵
  PID:4716
- C:\Windows\System\lUQdldi.exe
  C:\Windows\System\lUQdldi.exe
  2⤵
  PID:4732
- C:\Windows\System\RrCbAQM.exe
  C:\Windows\System\RrCbAQM.exe
  2⤵
  PID:4748
- C:\Windows\System\EEoTquK.exe
  C:\Windows\System\EEoTquK.exe
  2⤵
  PID:4764
- C:\Windows\System\gqsCVQo.exe
  C:\Windows\System\gqsCVQo.exe
  2⤵
  PID:4780
- C:\Windows\System\tGxumue.exe
  C:\Windows\System\tGxumue.exe
  2⤵
  PID:4796
- C:\Windows\System\bkrZQWm.exe
  C:\Windows\System\bkrZQWm.exe
  2⤵
  PID:4812
- C:\Windows\System\vfMYLfW.exe
  C:\Windows\System\vfMYLfW.exe
  2⤵
  PID:4828
- C:\Windows\System\aLNuApS.exe
  C:\Windows\System\aLNuApS.exe
  2⤵
  PID:4844
- C:\Windows\System\Bqojlmb.exe
  C:\Windows\System\Bqojlmb.exe
  2⤵
  PID:4860
- C:\Windows\System\DdGGQnq.exe
  C:\Windows\System\DdGGQnq.exe
  2⤵
  PID:4876
- C:\Windows\System\VpoaNuV.exe
  C:\Windows\System\VpoaNuV.exe
  2⤵
  PID:4892
- C:\Windows\System\xWpWxAg.exe
  C:\Windows\System\xWpWxAg.exe
  2⤵
  PID:4908
- C:\Windows\System\qCypLKp.exe
  C:\Windows\System\qCypLKp.exe
  2⤵
  PID:4924
- C:\Windows\System\rbwyPqM.exe
  C:\Windows\System\rbwyPqM.exe
  2⤵
  PID:4940
- C:\Windows\System\COkUKSq.exe
  C:\Windows\System\COkUKSq.exe
  2⤵
  PID:4956
- C:\Windows\System\lrYiyxF.exe
  C:\Windows\System\lrYiyxF.exe
  2⤵
  PID:4972
- C:\Windows\System\eXcZVyQ.exe
  C:\Windows\System\eXcZVyQ.exe
  2⤵
  PID:4988
- C:\Windows\System\TApwkkw.exe
  C:\Windows\System\TApwkkw.exe
  2⤵
  PID:5004
- C:\Windows\System\KjKzRDh.exe
  C:\Windows\System\KjKzRDh.exe
  2⤵
  PID:5020
- C:\Windows\System\KDUWhNz.exe
  C:\Windows\System\KDUWhNz.exe
  2⤵
  PID:5036
- C:\Windows\System\xssvIFN.exe
  C:\Windows\System\xssvIFN.exe
  2⤵
  PID:5052
- C:\Windows\System\ZOPWAcK.exe
  C:\Windows\System\ZOPWAcK.exe
  2⤵
  PID:5068
- C:\Windows\System\twtCCqh.exe
  C:\Windows\System\twtCCqh.exe
  2⤵
  PID:5084
- C:\Windows\System\EyKLdBj.exe
  C:\Windows\System\EyKLdBj.exe
  2⤵
  PID:5100
- C:\Windows\System\UMcyVnz.exe
  C:\Windows\System\UMcyVnz.exe
  2⤵
  PID:5116
- C:\Windows\System\HnAvgRL.exe
  C:\Windows\System\HnAvgRL.exe
  2⤵
  PID:3832
- C:\Windows\System\ElDaKXf.exe
  C:\Windows\System\ElDaKXf.exe
  2⤵
  PID:3496
- C:\Windows\System\WuMGdeC.exe
  C:\Windows\System\WuMGdeC.exe
  2⤵
  PID:4072
- C:\Windows\System\iqcvaXC.exe
  C:\Windows\System\iqcvaXC.exe
  2⤵
  PID:4100
- C:\Windows\System\jBtnxmF.exe
  C:\Windows\System\jBtnxmF.exe
  2⤵
  PID:4148
- C:\Windows\System\XTTXLez.exe
  C:\Windows\System\XTTXLez.exe
  2⤵
  PID:4180
- C:\Windows\System\YMAGPBx.exe
  C:\Windows\System\YMAGPBx.exe
  2⤵
  PID:4212
- C:\Windows\System\QELSwpE.exe
  C:\Windows\System\QELSwpE.exe
  2⤵
  PID:4244
- C:\Windows\System\rnraJVe.exe
  C:\Windows\System\rnraJVe.exe
  2⤵
  PID:4276
- C:\Windows\System\VOndUot.exe
  C:\Windows\System\VOndUot.exe
  2⤵
  PID:4308
- C:\Windows\System\slEakNd.exe
  C:\Windows\System\slEakNd.exe
  2⤵
  PID:4344
- C:\Windows\System\luqHqKS.exe
  C:\Windows\System\luqHqKS.exe
  2⤵
  PID:4376
- C:\Windows\System\rpbqcZJ.exe
  C:\Windows\System\rpbqcZJ.exe
  2⤵
  PID:4408
- C:\Windows\System\bsWeUDx.exe
  C:\Windows\System\bsWeUDx.exe
  2⤵
  PID:4452
- C:\Windows\System\vWJHMCo.exe
  C:\Windows\System\vWJHMCo.exe
  2⤵
  PID:4504
- C:\Windows\System\IEfdtpz.exe
  C:\Windows\System\IEfdtpz.exe
  2⤵
  PID:4564
- C:\Windows\System\OFPgHZG.exe
  C:\Windows\System\OFPgHZG.exe
  2⤵
  PID:4596
- C:\Windows\System\VHgNZiq.exe
  C:\Windows\System\VHgNZiq.exe
  2⤵
  PID:4616
- C:\Windows\System\nnpUonj.exe
  C:\Windows\System\nnpUonj.exe
  2⤵
  PID:4648
- C:\Windows\System\NUUBpzD.exe
  C:\Windows\System\NUUBpzD.exe
  2⤵
  PID:4680
- C:\Windows\System\pALHNkh.exe
  C:\Windows\System\pALHNkh.exe
  2⤵
  PID:4728
- C:\Windows\System\GmfdtnU.exe
  C:\Windows\System\GmfdtnU.exe
  2⤵
  PID:4760
- C:\Windows\System\FmnCcZG.exe
  C:\Windows\System\FmnCcZG.exe
  2⤵
  PID:4792
- C:\Windows\System\WPQqXrY.exe
  C:\Windows\System\WPQqXrY.exe
  2⤵
  PID:4824
- C:\Windows\System\wRGSTrT.exe
  C:\Windows\System\wRGSTrT.exe
  2⤵
  PID:4856
- C:\Windows\System\zwHfdof.exe
  C:\Windows\System\zwHfdof.exe
  2⤵
  PID:4888
- C:\Windows\System\XZmHseH.exe
  C:\Windows\System\XZmHseH.exe
  2⤵
  PID:4948
- C:\Windows\System\hlesGzI.exe
  C:\Windows\System\hlesGzI.exe
  2⤵
  PID:4952
- C:\Windows\System\BnNwntM.exe
  C:\Windows\System\BnNwntM.exe
  2⤵
  PID:4984
- C:\Windows\System\azpiCqC.exe
  C:\Windows\System\azpiCqC.exe
  2⤵
  PID:5016
- C:\Windows\System\gIsSPdT.exe
  C:\Windows\System\gIsSPdT.exe
  2⤵
  PID:5048
- C:\Windows\System\fvGDYJQ.exe
  C:\Windows\System\fvGDYJQ.exe
  2⤵
  PID:5064
- C:\Windows\System\nEbEnZu.exe
  C:\Windows\System\nEbEnZu.exe
  2⤵
  PID:3056
- C:\Windows\System\RUfbpmA.exe
  C:\Windows\System\RUfbpmA.exe
  2⤵
  PID:5096
- C:\Windows\System\KNysUQl.exe
  C:\Windows\System\KNysUQl.exe
  2⤵
  PID:2952
- C:\Windows\System\ybgmzUL.exe
  C:\Windows\System\ybgmzUL.exe
  2⤵
  PID:2432
- C:\Windows\System\FoWOdkh.exe
  C:\Windows\System\FoWOdkh.exe
  2⤵
  PID:1384
- C:\Windows\System\hoUCOwD.exe
  C:\Windows\System\hoUCOwD.exe
  2⤵
  PID:4000
- C:\Windows\System\RezlFdu.exe
  C:\Windows\System\RezlFdu.exe
  2⤵
  PID:4292
- C:\Windows\System\yeaiuVc.exe
  C:\Windows\System\yeaiuVc.exe
  2⤵
  PID:4304
- C:\Windows\System\WUfqFFQ.exe
  C:\Windows\System\WUfqFFQ.exe
  2⤵
  PID:4440
- C:\Windows\System\jgxKZAA.exe
  C:\Windows\System\jgxKZAA.exe
  2⤵
  PID:4520
- C:\Windows\System\IAdSnZd.exe
  C:\Windows\System\IAdSnZd.exe
  2⤵
  PID:4808
- C:\Windows\System\BAwajaa.exe
  C:\Windows\System\BAwajaa.exe
  2⤵
  PID:4936
- C:\Windows\System\FmnQAbo.exe
  C:\Windows\System\FmnQAbo.exe
  2⤵
  PID:2580
- C:\Windows\System\kCzfbXP.exe
  C:\Windows\System\kCzfbXP.exe
  2⤵
  PID:4872
- C:\Windows\System\EGFtpyf.exe
  C:\Windows\System\EGFtpyf.exe
  2⤵
  PID:4132
- C:\Windows\System\DdPnaRa.exe
  C:\Windows\System\DdPnaRa.exe
  2⤵
  PID:5080
- C:\Windows\System\mGHnAOh.exe
  C:\Windows\System\mGHnAOh.exe
  2⤵
  PID:1704
- C:\Windows\System\NDaeGPR.exe
  C:\Windows\System\NDaeGPR.exe
  2⤵
  PID:4196
- C:\Windows\System\GMryYiZ.exe
  C:\Windows\System\GMryYiZ.exe
  2⤵
  PID:4324
- C:\Windows\System\OisJahZ.exe
  C:\Windows\System\OisJahZ.exe
  2⤵
  PID:4472
- C:\Windows\System\xBJDGcG.exe
  C:\Windows\System\xBJDGcG.exe
  2⤵
  PID:4568
- C:\Windows\System\IvTiWiU.exe
  C:\Windows\System\IvTiWiU.exe
  2⤵
  PID:4708
- C:\Windows\System\RYLNPKa.exe
  C:\Windows\System\RYLNPKa.exe
  2⤵
  PID:4776
- C:\Windows\System\rDTHHgs.exe
  C:\Windows\System\rDTHHgs.exe
  2⤵
  PID:4920
- C:\Windows\System\JJlALAz.exe
  C:\Windows\System\JJlALAz.exe
  2⤵
  PID:5032
- C:\Windows\System\bpRhFGu.exe
  C:\Windows\System\bpRhFGu.exe
  2⤵
  PID:2808
- C:\Windows\System\LpMHJYL.exe
  C:\Windows\System\LpMHJYL.exe
  2⤵
  PID:4164
- C:\Windows\System\nxZirjo.exe
  C:\Windows\System\nxZirjo.exe
  2⤵
  PID:5136
- C:\Windows\System\pXaNqmX.exe
  C:\Windows\System\pXaNqmX.exe
  2⤵
  PID:5152
- C:\Windows\System\TeGWrph.exe
  C:\Windows\System\TeGWrph.exe
  2⤵
  PID:5168
- C:\Windows\System\qExNTzL.exe
  C:\Windows\System\qExNTzL.exe
  2⤵
  PID:5184
- C:\Windows\System\sYIPEiV.exe
  C:\Windows\System\sYIPEiV.exe
  2⤵
  PID:5200
- C:\Windows\System\iILoJit.exe
  C:\Windows\System\iILoJit.exe
  2⤵
  PID:5216
- C:\Windows\System\EEWskUl.exe
  C:\Windows\System\EEWskUl.exe
  2⤵
  PID:5232
- C:\Windows\System\CdZYCAs.exe
  C:\Windows\System\CdZYCAs.exe
  2⤵
  PID:5248
- C:\Windows\System\VBWHsMW.exe
  C:\Windows\System\VBWHsMW.exe
  2⤵
  PID:5264
- C:\Windows\System\qBIqZwK.exe
  C:\Windows\System\qBIqZwK.exe
  2⤵
  PID:5280
- C:\Windows\System\KLoBoEH.exe
  C:\Windows\System\KLoBoEH.exe
  2⤵
  PID:5296
- C:\Windows\System\xBioibM.exe
  C:\Windows\System\xBioibM.exe
  2⤵
  PID:5312
- C:\Windows\System\DmJxpKA.exe
  C:\Windows\System\DmJxpKA.exe
  2⤵
  PID:5328
- C:\Windows\System\weHgcqK.exe
  C:\Windows\System\weHgcqK.exe
  2⤵
  PID:5344
- C:\Windows\System\sxOvUmv.exe
  C:\Windows\System\sxOvUmv.exe
  2⤵
  PID:5360
- C:\Windows\System\EScCsiv.exe
  C:\Windows\System\EScCsiv.exe
  2⤵
  PID:5376
- C:\Windows\System\ecAQRjL.exe
  C:\Windows\System\ecAQRjL.exe
  2⤵
  PID:5392
- C:\Windows\System\WLTObbL.exe
  C:\Windows\System\WLTObbL.exe
  2⤵
  PID:5408
- C:\Windows\System\LlTVFXa.exe
  C:\Windows\System\LlTVFXa.exe
  2⤵
  PID:5424
- C:\Windows\System\AvDtBDU.exe
  C:\Windows\System\AvDtBDU.exe
  2⤵
  PID:5440
- C:\Windows\System\rDkhQwS.exe
  C:\Windows\System\rDkhQwS.exe
  2⤵
  PID:5456
- C:\Windows\System\SMVPPbc.exe
  C:\Windows\System\SMVPPbc.exe
  2⤵
  PID:5472
- C:\Windows\System\iNSVJlD.exe
  C:\Windows\System\iNSVJlD.exe
  2⤵
  PID:5488
- C:\Windows\System\jOvVVXX.exe
  C:\Windows\System\jOvVVXX.exe
  2⤵
  PID:5504
- C:\Windows\System\piAEEdm.exe
  C:\Windows\System\piAEEdm.exe
  2⤵
  PID:5520
- C:\Windows\System\KwKXAFm.exe
  C:\Windows\System\KwKXAFm.exe
  2⤵
  PID:5536
- C:\Windows\System\jYbIUJA.exe
  C:\Windows\System\jYbIUJA.exe
  2⤵
  PID:5552
- C:\Windows\System\CzSaTXf.exe
  C:\Windows\System\CzSaTXf.exe
  2⤵
  PID:5568
- C:\Windows\System\FUZYoDu.exe
  C:\Windows\System\FUZYoDu.exe
  2⤵
  PID:5584
- C:\Windows\System\fhJhoft.exe
  C:\Windows\System\fhJhoft.exe
  2⤵
  PID:5600
- C:\Windows\System\qQwjRiL.exe
  C:\Windows\System\qQwjRiL.exe
  2⤵
  PID:5616
- C:\Windows\System\EGNcJWr.exe
  C:\Windows\System\EGNcJWr.exe
  2⤵
  PID:5632
- C:\Windows\System\AunwTmk.exe
  C:\Windows\System\AunwTmk.exe
  2⤵
  PID:5648
- C:\Windows\System\KUEAfkR.exe
  C:\Windows\System\KUEAfkR.exe
  2⤵
  PID:5664
- C:\Windows\System\QlppJFi.exe
  C:\Windows\System\QlppJFi.exe
  2⤵
  PID:5680
- C:\Windows\System\yTkCVrO.exe
  C:\Windows\System\yTkCVrO.exe
  2⤵
  PID:5696
- C:\Windows\System\DfacYXh.exe
  C:\Windows\System\DfacYXh.exe
  2⤵
  PID:5712
- C:\Windows\System\EvfmnFh.exe
  C:\Windows\System\EvfmnFh.exe
  2⤵
  PID:5728
- C:\Windows\System\qQCpmcm.exe
  C:\Windows\System\qQCpmcm.exe
  2⤵
  PID:5744
- C:\Windows\System\slIjcsg.exe
  C:\Windows\System\slIjcsg.exe
  2⤵
  PID:5760
- C:\Windows\System\UlVcZAP.exe
  C:\Windows\System\UlVcZAP.exe
  2⤵
  PID:5776
- C:\Windows\System\TqbwBdl.exe
  C:\Windows\System\TqbwBdl.exe
  2⤵
  PID:5792
- C:\Windows\System\BRNOyQQ.exe
  C:\Windows\System\BRNOyQQ.exe
  2⤵
  PID:5808
- C:\Windows\System\YHBMHwj.exe
  C:\Windows\System\YHBMHwj.exe
  2⤵
  PID:5824
- C:\Windows\System\bttrOJa.exe
  C:\Windows\System\bttrOJa.exe
  2⤵
  PID:5840
- C:\Windows\System\gWHIRes.exe
  C:\Windows\System\gWHIRes.exe
  2⤵
  PID:5856
- C:\Windows\System\WIeTpFx.exe
  C:\Windows\System\WIeTpFx.exe
  2⤵
  PID:5872
- C:\Windows\System\obMNdVy.exe
  C:\Windows\System\obMNdVy.exe
  2⤵
  PID:5888
- C:\Windows\System\ILegABf.exe
  C:\Windows\System\ILegABf.exe
  2⤵
  PID:5904
- C:\Windows\System\yZftJlX.exe
  C:\Windows\System\yZftJlX.exe
  2⤵
  PID:5920
- C:\Windows\System\VWjpVDE.exe
  C:\Windows\System\VWjpVDE.exe
  2⤵
  PID:5936
- C:\Windows\System\AFhVWOG.exe
  C:\Windows\System\AFhVWOG.exe
  2⤵
  PID:5952
- C:\Windows\System\aHDSqRw.exe
  C:\Windows\System\aHDSqRw.exe
  2⤵
  PID:5968
- C:\Windows\System\QGKLXep.exe
  C:\Windows\System\QGKLXep.exe
  2⤵
  PID:5984
- C:\Windows\System\sNBrxvH.exe
  C:\Windows\System\sNBrxvH.exe
  2⤵
  PID:6000
- C:\Windows\System\QUilJbP.exe
  C:\Windows\System\QUilJbP.exe
  2⤵
  PID:6016
- C:\Windows\System\FBvWdmu.exe
  C:\Windows\System\FBvWdmu.exe
  2⤵
  PID:6032
- C:\Windows\System\CbGSNja.exe
  C:\Windows\System\CbGSNja.exe
  2⤵
  PID:6048
- C:\Windows\System\jGMTxGu.exe
  C:\Windows\System\jGMTxGu.exe
  2⤵
  PID:6068
- C:\Windows\System\bFCJBMA.exe
  C:\Windows\System\bFCJBMA.exe
  2⤵
  PID:6084
- C:\Windows\System\hyYjXOM.exe
  C:\Windows\System\hyYjXOM.exe
  2⤵
  PID:6100
- C:\Windows\System\tYbbZsB.exe
  C:\Windows\System\tYbbZsB.exe
  2⤵
  PID:6120
- C:\Windows\System\CfgvSvh.exe
  C:\Windows\System\CfgvSvh.exe
  2⤵
  PID:6136
- C:\Windows\System\YhRWQUz.exe
  C:\Windows\System\YhRWQUz.exe
  2⤵
  PID:4548
- C:\Windows\System\MHKPjUB.exe
  C:\Windows\System\MHKPjUB.exe
  2⤵
  PID:1548
- C:\Windows\System\HQhNdOi.exe
  C:\Windows\System\HQhNdOi.exe
  2⤵
  PID:3924
- C:\Windows\System\tnRJrsF.exe
  C:\Windows\System\tnRJrsF.exe
  2⤵
  PID:4372
- C:\Windows\System\jNHzJop.exe
  C:\Windows\System\jNHzJop.exe
  2⤵
  PID:4628
- C:\Windows\System\ljXzCdi.exe
  C:\Windows\System\ljXzCdi.exe
  2⤵
  PID:1628
- C:\Windows\System\JMTPlwS.exe
  C:\Windows\System\JMTPlwS.exe
  2⤵
  PID:4208
- C:\Windows\System\nMOKLrc.exe
  C:\Windows\System\nMOKLrc.exe
  2⤵
  PID:4660
- C:\Windows\System\BrUReZN.exe
  C:\Windows\System\BrUReZN.exe
  2⤵
  PID:4968
- C:\Windows\System\eZwUTEE.exe
  C:\Windows\System\eZwUTEE.exe
  2⤵
  PID:5108
- C:\Windows\System\slbrxkJ.exe
  C:\Windows\System\slbrxkJ.exe
  2⤵
  PID:5160
- C:\Windows\System\RxeRzqD.exe
  C:\Windows\System\RxeRzqD.exe
  2⤵
  PID:4176
- C:\Windows\System\hVLESHu.exe
  C:\Windows\System\hVLESHu.exe
  2⤵
  PID:5180
- C:\Windows\System\rSWjoII.exe
  C:\Windows\System\rSWjoII.exe
  2⤵
  PID:5244
- C:\Windows\System\PkiutfF.exe
  C:\Windows\System\PkiutfF.exe
  2⤵
  PID:5308
- C:\Windows\System\uXVaMJu.exe
  C:\Windows\System\uXVaMJu.exe
  2⤵
  PID:5372
- C:\Windows\System\glukiag.exe
  C:\Windows\System\glukiag.exe
  2⤵
  PID:5464
- C:\Windows\System\bDSKJTp.exe
  C:\Windows\System\bDSKJTp.exe
  2⤵
  PID:5436
- C:\Windows\System\EqvHSeD.exe
  C:\Windows\System\EqvHSeD.exe
  2⤵
  PID:5532
- C:\Windows\System\VsDfJvf.exe
  C:\Windows\System\VsDfJvf.exe
  2⤵
  PID:5596
- C:\Windows\System\YFpLXFG.exe
  C:\Windows\System\YFpLXFG.exe
  2⤵
  PID:5256
- C:\Windows\System\WTTXNAQ.exe
  C:\Windows\System\WTTXNAQ.exe
  2⤵
  PID:5320
- C:\Windows\System\gxVstcR.exe
  C:\Windows\System\gxVstcR.exe
  2⤵
  PID:5384
- C:\Windows\System\DYQXyeN.exe
  C:\Windows\System\DYQXyeN.exe
  2⤵
  PID:5448
- C:\Windows\System\KSLehHW.exe
  C:\Windows\System\KSLehHW.exe
  2⤵
  PID:5512
- C:\Windows\System\HAgvYpe.exe
  C:\Windows\System\HAgvYpe.exe
  2⤵
  PID:5580
- C:\Windows\System\akYIvzl.exe
  C:\Windows\System\akYIvzl.exe
  2⤵
  PID:5656
- C:\Windows\System\UEIDOfv.exe
  C:\Windows\System\UEIDOfv.exe
  2⤵
  PID:5644
- C:\Windows\System\GRtTIna.exe
  C:\Windows\System\GRtTIna.exe
  2⤵
  PID:5756
- C:\Windows\System\FMGWgDU.exe
  C:\Windows\System\FMGWgDU.exe
  2⤵
  PID:5820
- C:\Windows\System\aTicmzX.exe
  C:\Windows\System\aTicmzX.exe
  2⤵
  PID:5884
- C:\Windows\System\loglCWo.exe
  C:\Windows\System\loglCWo.exe
  2⤵
  PID:5948
- C:\Windows\System\CqVvuZT.exe
  C:\Windows\System\CqVvuZT.exe
  2⤵
  PID:6012
- C:\Windows\System\OwYFhQe.exe
  C:\Windows\System\OwYFhQe.exe
  2⤵
  PID:6044
- C:\Windows\System\SevosBh.exe
  C:\Windows\System\SevosBh.exe
  2⤵
  PID:6116
- C:\Windows\System\ChSUypC.exe
  C:\Windows\System\ChSUypC.exe
  2⤵
  PID:4424
- C:\Windows\System\yzMkEei.exe
  C:\Windows\System\yzMkEei.exe
  2⤵
  PID:5736
- C:\Windows\System\UgPjnOv.exe
  C:\Windows\System\UgPjnOv.exe
  2⤵
  PID:5800
- C:\Windows\System\VHgzeZE.exe
  C:\Windows\System\VHgzeZE.exe
  2⤵
  PID:4884
- C:\Windows\System\KLZbLRC.exe
  C:\Windows\System\KLZbLRC.exe
  2⤵
  PID:4712
- C:\Windows\System\mrvaLIz.exe
  C:\Windows\System\mrvaLIz.exe
  2⤵
  PID:5896
- C:\Windows\System\AmFEczA.exe
  C:\Windows\System\AmFEczA.exe
  2⤵
  PID:5960
- C:\Windows\System\YcIoJEq.exe
  C:\Windows\System\YcIoJEq.exe
  2⤵
  PID:4456
- C:\Windows\System\PkUowIe.exe
  C:\Windows\System\PkUowIe.exe
  2⤵
  PID:6128
- C:\Windows\System\NrWgNRN.exe
  C:\Windows\System\NrWgNRN.exe
  2⤵
  PID:4228
- C:\Windows\System\dqTGltr.exe
  C:\Windows\System\dqTGltr.exe
  2⤵
  PID:4916
- C:\Windows\System\bXEmMvT.exe
  C:\Windows\System\bXEmMvT.exe
  2⤵
  PID:5240
- C:\Windows\System\nwOFFnT.exe
  C:\Windows\System\nwOFFnT.exe
  2⤵
  PID:5176
- C:\Windows\System\dJVTNmH.exe
  C:\Windows\System\dJVTNmH.exe
  2⤵
  PID:5404
- C:\Windows\System\StoivqW.exe
  C:\Windows\System\StoivqW.exe
  2⤵
  PID:5528
- C:\Windows\System\hzDOOmY.exe
  C:\Windows\System\hzDOOmY.exe
  2⤵
  PID:5356
- C:\Windows\System\zYJDqbB.exe
  C:\Windows\System\zYJDqbB.exe
  2⤵
  PID:5688
- C:\Windows\System\XZdnsQL.exe
  C:\Windows\System\XZdnsQL.exe
  2⤵
  PID:5592
- C:\Windows\System\KDEAwFe.exe
  C:\Windows\System\KDEAwFe.exe
  2⤵
  PID:5576
- C:\Windows\System\UoaSUeI.exe
  C:\Windows\System\UoaSUeI.exe
  2⤵
  PID:5612
- C:\Windows\System\GQqpcNG.exe
  C:\Windows\System\GQqpcNG.exe
  2⤵
  PID:5484
- C:\Windows\System\uuzUclD.exe
  C:\Windows\System\uuzUclD.exe
  2⤵
  PID:4436
- C:\Windows\System\OZZjxme.exe
  C:\Windows\System\OZZjxme.exe
  2⤵
  PID:1544
- C:\Windows\System\ZtKVYhw.exe
  C:\Windows\System\ZtKVYhw.exe
  2⤵
  PID:4328
- C:\Windows\System\OTfnmib.exe
  C:\Windows\System\OTfnmib.exe
  2⤵
  PID:5724
- C:\Windows\System\FKduoRT.exe
  C:\Windows\System\FKduoRT.exe
  2⤵
  PID:5836
- C:\Windows\System\LzjeGQr.exe
  C:\Windows\System\LzjeGQr.exe
  2⤵
  PID:5992
- C:\Windows\System\cxSBpMr.exe
  C:\Windows\System\cxSBpMr.exe
  2⤵
  PID:4340
- C:\Windows\System\vqiLjSN.exe
  C:\Windows\System\vqiLjSN.exe
  2⤵
  PID:5304
- C:\Windows\System\KchJCrW.exe
  C:\Windows\System\KchJCrW.exe
  2⤵
  PID:5228
- C:\Windows\System\rMusDyP.exe
  C:\Windows\System\rMusDyP.exe
  2⤵
  PID:4644
- C:\Windows\System\hpXKREW.exe
  C:\Windows\System\hpXKREW.exe
  2⤵
  PID:6092
- C:\Windows\System\YqxPiHd.exe
  C:\Windows\System\YqxPiHd.exe
  2⤵
  PID:5148
- C:\Windows\System\PXcXJys.exe
  C:\Windows\System\PXcXJys.exe
  2⤵
  PID:5980
- C:\Windows\System\SrniGHP.exe
  C:\Windows\System\SrniGHP.exe
  2⤵
  PID:5640
- C:\Windows\System\gRpGDCb.exe
  C:\Windows\System\gRpGDCb.exe
  2⤵
  PID:6108
- C:\Windows\System\YjstqhB.exe
  C:\Windows\System\YjstqhB.exe
  2⤵
  PID:6028
- C:\Windows\System\SCYhkvS.exe
  C:\Windows\System\SCYhkvS.exe
  2⤵
  PID:5928
- C:\Windows\System\CZGOOmo.exe
  C:\Windows\System\CZGOOmo.exe
  2⤵
  PID:5212
- C:\Windows\System\EtJFuSl.exe
  C:\Windows\System\EtJFuSl.exe
  2⤵
  PID:4500
- C:\Windows\System\IaixlMm.exe
  C:\Windows\System\IaixlMm.exe
  2⤵
  PID:5772
- C:\Windows\System\EtJALal.exe
  C:\Windows\System\EtJALal.exe
  2⤵
  PID:6148
- C:\Windows\System\HJwQKiH.exe
  C:\Windows\System\HJwQKiH.exe
  2⤵
  PID:6164
- C:\Windows\System\yrxfFgE.exe
  C:\Windows\System\yrxfFgE.exe
  2⤵
  PID:6180
- C:\Windows\System\edvikzP.exe
  C:\Windows\System\edvikzP.exe
  2⤵
  PID:6200
- C:\Windows\System\puuqgbM.exe
  C:\Windows\System\puuqgbM.exe
  2⤵
  PID:6216
- C:\Windows\System\mmLFdBx.exe
  C:\Windows\System\mmLFdBx.exe
  2⤵
  PID:6232
- C:\Windows\System\ZwieVYJ.exe
  C:\Windows\System\ZwieVYJ.exe
  2⤵
  PID:6248
- C:\Windows\System\bGvoHYP.exe
  C:\Windows\System\bGvoHYP.exe
  2⤵
  PID:6264
- C:\Windows\System\KeyXGCh.exe
  C:\Windows\System\KeyXGCh.exe
  2⤵
  PID:6280
- C:\Windows\System\iCDVFEW.exe
  C:\Windows\System\iCDVFEW.exe
  2⤵
  PID:6296
- C:\Windows\System\hYuNeWV.exe
  C:\Windows\System\hYuNeWV.exe
  2⤵
  PID:6312
- C:\Windows\System\amGBPhu.exe
  C:\Windows\System\amGBPhu.exe
  2⤵
  PID:6328
- C:\Windows\System\vVpyATY.exe
  C:\Windows\System\vVpyATY.exe
  2⤵
  PID:6344
- C:\Windows\System\fyMHYUd.exe
  C:\Windows\System\fyMHYUd.exe
  2⤵
  PID:6360
- C:\Windows\System\JkzSnMK.exe
  C:\Windows\System\JkzSnMK.exe
  2⤵
  PID:6376
- C:\Windows\System\GekdndO.exe
  C:\Windows\System\GekdndO.exe
  2⤵
  PID:6392
- C:\Windows\System\QyHclhn.exe
  C:\Windows\System\QyHclhn.exe
  2⤵
  PID:6408
- C:\Windows\System\CaKLDrt.exe
  C:\Windows\System\CaKLDrt.exe
  2⤵
  PID:6424
- C:\Windows\System\fjcJAHh.exe
  C:\Windows\System\fjcJAHh.exe
  2⤵
  PID:6440
- C:\Windows\System\esRPkwo.exe
  C:\Windows\System\esRPkwo.exe
  2⤵
  PID:6456
- C:\Windows\System\QPXOpJe.exe
  C:\Windows\System\QPXOpJe.exe
  2⤵
  PID:6472
- C:\Windows\System\LhRsELN.exe
  C:\Windows\System\LhRsELN.exe
  2⤵
  PID:6488
- C:\Windows\System\cbBCScu.exe
  C:\Windows\System\cbBCScu.exe
  2⤵
  PID:6504
- C:\Windows\System\RzCyCUV.exe
  C:\Windows\System\RzCyCUV.exe
  2⤵
  PID:6520
- C:\Windows\System\lScagwU.exe
  C:\Windows\System\lScagwU.exe
  2⤵
  PID:6536
- C:\Windows\System\VouWUlj.exe
  C:\Windows\System\VouWUlj.exe
  2⤵
  PID:6552
- C:\Windows\System\DaqAcJD.exe
  C:\Windows\System\DaqAcJD.exe
  2⤵
  PID:6568
- C:\Windows\System\dfPbEfI.exe
  C:\Windows\System\dfPbEfI.exe
  2⤵
  PID:6584
- C:\Windows\System\EAYrsci.exe
  C:\Windows\System\EAYrsci.exe
  2⤵
  PID:6600
- C:\Windows\System\YYUtccq.exe
  C:\Windows\System\YYUtccq.exe
  2⤵
  PID:6616
- C:\Windows\System\fWsAOld.exe
  C:\Windows\System\fWsAOld.exe
  2⤵
  PID:6632
- C:\Windows\System\JSJlNMn.exe
  C:\Windows\System\JSJlNMn.exe
  2⤵
  PID:6648
- C:\Windows\System\xnvhopx.exe
  C:\Windows\System\xnvhopx.exe
  2⤵
  PID:6664
- C:\Windows\System\AieVOlI.exe
  C:\Windows\System\AieVOlI.exe
  2⤵
  PID:6680
- C:\Windows\System\iNCyxYO.exe
  C:\Windows\System\iNCyxYO.exe
  2⤵
  PID:6696
- C:\Windows\System\LBbMeoz.exe
  C:\Windows\System\LBbMeoz.exe
  2⤵
  PID:6712
- C:\Windows\System\CZQJfyH.exe
  C:\Windows\System\CZQJfyH.exe
  2⤵
  PID:6728
- C:\Windows\System\GQFihBq.exe
  C:\Windows\System\GQFihBq.exe
  2⤵
  PID:6744
- C:\Windows\System\jFmtIwe.exe
  C:\Windows\System\jFmtIwe.exe
  2⤵
  PID:6760
- C:\Windows\System\pRljWUl.exe
  C:\Windows\System\pRljWUl.exe
  2⤵
  PID:6776
- C:\Windows\System\NloZzcx.exe
  C:\Windows\System\NloZzcx.exe
  2⤵
  PID:6792
- C:\Windows\System\XhkGypo.exe
  C:\Windows\System\XhkGypo.exe
  2⤵
  PID:6808
- C:\Windows\System\cApAJmy.exe
  C:\Windows\System\cApAJmy.exe
  2⤵
  PID:6824
- C:\Windows\System\arogkFo.exe
  C:\Windows\System\arogkFo.exe
  2⤵
  PID:6840
- C:\Windows\System\VGFpCng.exe
  C:\Windows\System\VGFpCng.exe
  2⤵
  PID:6856
- C:\Windows\System\SZeSCnH.exe
  C:\Windows\System\SZeSCnH.exe
  2⤵
  PID:6872
- C:\Windows\System\bDqyVVL.exe
  C:\Windows\System\bDqyVVL.exe
  2⤵
  PID:6888
- C:\Windows\System\GSrLxOE.exe
  C:\Windows\System\GSrLxOE.exe
  2⤵
  PID:6904
- C:\Windows\System\cEThzUd.exe
  C:\Windows\System\cEThzUd.exe
  2⤵
  PID:6920
- C:\Windows\System\mirhAqO.exe
  C:\Windows\System\mirhAqO.exe
  2⤵
  PID:6936
- C:\Windows\System\ZcEGjJd.exe
  C:\Windows\System\ZcEGjJd.exe
  2⤵
  PID:6952
- C:\Windows\System\UEIVpLn.exe
  C:\Windows\System\UEIVpLn.exe
  2⤵
  PID:6968
- C:\Windows\System\xUxTyXO.exe
  C:\Windows\System\xUxTyXO.exe
  2⤵
  PID:6984
- C:\Windows\System\RGfboLT.exe
  C:\Windows\System\RGfboLT.exe
  2⤵
  PID:7000
- C:\Windows\System\APxsRos.exe
  C:\Windows\System\APxsRos.exe
  2⤵
  PID:7016
- C:\Windows\System\LfXIbvE.exe
  C:\Windows\System\LfXIbvE.exe
  2⤵
  PID:7032
- C:\Windows\System\BtOURfY.exe
  C:\Windows\System\BtOURfY.exe
  2⤵
  PID:7048
- C:\Windows\System\nqxchKA.exe
  C:\Windows\System\nqxchKA.exe
  2⤵
  PID:7064
- C:\Windows\System\dJoYAIn.exe
  C:\Windows\System\dJoYAIn.exe
  2⤵
  PID:7080
- C:\Windows\System\AXPqWBU.exe
  C:\Windows\System\AXPqWBU.exe
  2⤵
  PID:7096
- C:\Windows\System\LcxIFde.exe
  C:\Windows\System\LcxIFde.exe
  2⤵
  PID:7112
- C:\Windows\System\ZZkdCuK.exe
  C:\Windows\System\ZZkdCuK.exe
  2⤵
  PID:7128
- C:\Windows\System\iJzIDTr.exe
  C:\Windows\System\iJzIDTr.exe
  2⤵
  PID:7144
- C:\Windows\System\YVgoFul.exe
  C:\Windows\System\YVgoFul.exe
  2⤵
  PID:7160
- C:\Windows\System\hWeaQmq.exe
  C:\Windows\System\hWeaQmq.exe
  2⤵
  PID:6196
- C:\Windows\System\QNUhetO.exe
  C:\Windows\System\QNUhetO.exe
  2⤵
  PID:6160
- C:\Windows\System\pxLbfpf.exe
  C:\Windows\System\pxLbfpf.exe
  2⤵
  PID:5944
- C:\Windows\System\Ncdgyqa.exe
  C:\Windows\System\Ncdgyqa.exe
  2⤵
  PID:6176
- C:\Windows\System\LtTjwwk.exe
  C:\Windows\System\LtTjwwk.exe
  2⤵
  PID:6240
- C:\Windows\System\XAolXBO.exe
  C:\Windows\System\XAolXBO.exe
  2⤵
  PID:6304
- C:\Windows\System\kvZNSDQ.exe
  C:\Windows\System\kvZNSDQ.exe
  2⤵
  PID:6224
- C:\Windows\System\dGGocgv.exe
  C:\Windows\System\dGGocgv.exe
  2⤵
  PID:6320
- C:\Windows\System\jkDNJxG.exe
  C:\Windows\System\jkDNJxG.exe
  2⤵
  PID:6480
- C:\Windows\System\fXqanIM.exe
  C:\Windows\System\fXqanIM.exe
  2⤵
  PID:6340
- C:\Windows\System\QVtclwu.exe
  C:\Windows\System\QVtclwu.exe
  2⤵
  PID:6420
- C:\Windows\System\HhzFmqk.exe
  C:\Windows\System\HhzFmqk.exe
  2⤵
  PID:6512
- C:\Windows\System\YTEBSPH.exe
  C:\Windows\System\YTEBSPH.exe
  2⤵
  PID:6432
- C:\Windows\System\WMPNRgh.exe
  C:\Windows\System\WMPNRgh.exe
  2⤵
  PID:6500
- C:\Windows\System\DIcRIzk.exe
  C:\Windows\System\DIcRIzk.exe
  2⤵
  PID:6564
- C:\Windows\System\YKJxuDJ.exe
  C:\Windows\System\YKJxuDJ.exe
  2⤵
  PID:6468
- C:\Windows\System\RQJfqld.exe
  C:\Windows\System\RQJfqld.exe
  2⤵
  PID:6692
- C:\Windows\System\fWHzMEO.exe
  C:\Windows\System\fWHzMEO.exe
  2⤵
  PID:6756
- C:\Windows\System\Lpsuggz.exe
  C:\Windows\System\Lpsuggz.exe
  2⤵
  PID:6544
- C:\Windows\System\VNdHrtd.exe
  C:\Windows\System\VNdHrtd.exe
  2⤵
  PID:6848
- C:\Windows\System\jXHPahl.exe
  C:\Windows\System\jXHPahl.exe
  2⤵
  PID:6676
- C:\Windows\System\OTlPbxy.exe
  C:\Windows\System\OTlPbxy.exe
  2⤵
  PID:6916
- C:\Windows\System\lozgMVx.exe
  C:\Windows\System\lozgMVx.exe
  2⤵
  PID:7008
- C:\Windows\System\ZbWTpLk.exe
  C:\Windows\System\ZbWTpLk.exe
  2⤵
  PID:6928
- C:\Windows\System\bOrhULo.exe
  C:\Windows\System\bOrhULo.exe
  2⤵
  PID:7044
- C:\Windows\System\nJHIMEY.exe
  C:\Windows\System\nJHIMEY.exe
  2⤵
  PID:6672
- C:\Windows\System\FffvUpx.exe
  C:\Windows\System\FffvUpx.exe
  2⤵
  PID:6740
- C:\Windows\System\SLyQvwX.exe
  C:\Windows\System\SLyQvwX.exe
  2⤵
  PID:6800
- C:\Windows\System\IWnckgk.exe
  C:\Windows\System\IWnckgk.exe
  2⤵
  PID:6900
- C:\Windows\System\hXQGoTq.exe
  C:\Windows\System\hXQGoTq.exe
  2⤵
  PID:7104
- C:\Windows\System\JhTqMMq.exe
  C:\Windows\System\JhTqMMq.exe
  2⤵
  PID:5548
- C:\Windows\System\XSLeJlH.exe
  C:\Windows\System\XSLeJlH.exe
  2⤵
  PID:6996
- C:\Windows\System\oQoTsCz.exe
  C:\Windows\System\oQoTsCz.exe
  2⤵
  PID:7092
- C:\Windows\System\bkGriBx.exe
  C:\Windows\System\bkGriBx.exe
  2⤵
  PID:7156
- C:\Windows\System\KGLGUKw.exe
  C:\Windows\System\KGLGUKw.exe
  2⤵
  PID:5420
- C:\Windows\System\tRbTEvw.exe
  C:\Windows\System\tRbTEvw.exe
  2⤵
  PID:6212
- C:\Windows\System\EEkxtnn.exe
  C:\Windows\System\EEkxtnn.exe
  2⤵
  PID:6260
- C:\Windows\System\NfOyFqR.exe
  C:\Windows\System\NfOyFqR.exe
  2⤵
  PID:6324
- C:\Windows\System\QIRtqpC.exe
  C:\Windows\System\QIRtqpC.exe
  2⤵
  PID:6532
- C:\Windows\System\MMCrocZ.exe
  C:\Windows\System\MMCrocZ.exe
  2⤵
  PID:6624
- C:\Windows\System\pdvBbGl.exe
  C:\Windows\System\pdvBbGl.exe
  2⤵
  PID:6628
- C:\Windows\System\oJtqJVN.exe
  C:\Windows\System\oJtqJVN.exe
  2⤵
  PID:6868
- C:\Windows\System\tHwhDeI.exe
  C:\Windows\System\tHwhDeI.exe
  2⤵
  PID:6580
- C:\Windows\System\BeJlscW.exe
  C:\Windows\System\BeJlscW.exe
  2⤵
  PID:7012
- C:\Windows\System\sohaDdg.exe
  C:\Windows\System\sohaDdg.exe
  2⤵
  PID:6644
- C:\Windows\System\INHSTrq.exe
  C:\Windows\System\INHSTrq.exe
  2⤵
  PID:7136
- C:\Windows\System\MBOMhWQ.exe
  C:\Windows\System\MBOMhWQ.exe
  2⤵
  PID:5832
- C:\Windows\System\rLtpoPd.exe
  C:\Windows\System\rLtpoPd.exe
  2⤵
  PID:6336
- C:\Windows\System\etAcaKM.exe
  C:\Windows\System\etAcaKM.exe
  2⤵
  PID:6992
- C:\Windows\System\NfZvVUY.exe
  C:\Windows\System\NfZvVUY.exe
  2⤵
  PID:6292
- C:\Windows\System\iFaGRBy.exe
  C:\Windows\System\iFaGRBy.exe
  2⤵
  PID:6452
- C:\Windows\System\jjajoyX.exe
  C:\Windows\System\jjajoyX.exe
  2⤵
  PID:6752
- C:\Windows\System\kjkdlLd.exe
  C:\Windows\System\kjkdlLd.exe
  2⤵
  PID:6496
- C:\Windows\System\SEvPmZN.exe
  C:\Windows\System\SEvPmZN.exe
  2⤵
  PID:6736
- C:\Windows\System\TovXZfM.exe
  C:\Windows\System\TovXZfM.exe
  2⤵
  PID:6884
- C:\Windows\System\zDLZjiz.exe
  C:\Windows\System\zDLZjiz.exe
  2⤵
  PID:6948
- C:\Windows\System\GPqKtFT.exe
  C:\Windows\System\GPqKtFT.exe
  2⤵
  PID:4820
- C:\Windows\System\BCURjtQ.exe
  C:\Windows\System\BCURjtQ.exe
  2⤵
  PID:6372
- C:\Windows\System\VDitnin.exe
  C:\Windows\System\VDitnin.exe
  2⤵
  PID:6576
- C:\Windows\System\TvFHSqQ.exe
  C:\Windows\System\TvFHSqQ.exe
  2⤵
  PID:7040
- C:\Windows\System\QcRbEzq.exe
  C:\Windows\System\QcRbEzq.exe
  2⤵
  PID:7152
- C:\Windows\System\mtdhmMx.exe
  C:\Windows\System\mtdhmMx.exe
  2⤵
  PID:6384
- C:\Windows\System\EtIwtpC.exe
  C:\Windows\System\EtIwtpC.exe
  2⤵
  PID:7180
- C:\Windows\System\ZNvKoEL.exe
  C:\Windows\System\ZNvKoEL.exe
  2⤵
  PID:7196
- C:\Windows\System\piqVORM.exe
  C:\Windows\System\piqVORM.exe
  2⤵
  PID:7216
- C:\Windows\System\mYJsFzB.exe
  C:\Windows\System\mYJsFzB.exe
  2⤵
  PID:7232
- C:\Windows\System\WdCmIvh.exe
  C:\Windows\System\WdCmIvh.exe
  2⤵
  PID:7248
- C:\Windows\System\nOXaUEO.exe
  C:\Windows\System\nOXaUEO.exe
  2⤵
  PID:7264
- C:\Windows\System\GeWfqVQ.exe
  C:\Windows\System\GeWfqVQ.exe
  2⤵
  PID:7280
- C:\Windows\System\XHpGcXZ.exe
  C:\Windows\System\XHpGcXZ.exe
  2⤵
  PID:7300
- C:\Windows\System\OtoWThR.exe
  C:\Windows\System\OtoWThR.exe
  2⤵
  PID:7316
- C:\Windows\System\oUuoENH.exe
  C:\Windows\System\oUuoENH.exe
  2⤵
  PID:7332
- C:\Windows\System\CmQrhvR.exe
  C:\Windows\System\CmQrhvR.exe
  2⤵
  PID:7348
- C:\Windows\System\xDdeYwF.exe
  C:\Windows\System\xDdeYwF.exe
  2⤵
  PID:7364
- C:\Windows\System\ThifLbq.exe
  C:\Windows\System\ThifLbq.exe
  2⤵
  PID:7380
- C:\Windows\System\bkYSICD.exe
  C:\Windows\System\bkYSICD.exe
  2⤵
  PID:7396
- C:\Windows\System\KOpbyzl.exe
  C:\Windows\System\KOpbyzl.exe
  2⤵
  PID:7412
- C:\Windows\System\wGSfXbu.exe
  C:\Windows\System\wGSfXbu.exe
  2⤵
  PID:7428
- C:\Windows\System\fxyGlkc.exe
  C:\Windows\System\fxyGlkc.exe
  2⤵
  PID:7444
- C:\Windows\System\DQLNcRs.exe
  C:\Windows\System\DQLNcRs.exe
  2⤵
  PID:7460
- C:\Windows\System\xdeQEDx.exe
  C:\Windows\System\xdeQEDx.exe
  2⤵
  PID:7476
- C:\Windows\System\NRmvDAS.exe
  C:\Windows\System\NRmvDAS.exe
  2⤵
  PID:7492
- C:\Windows\System\tZGeOIk.exe
  C:\Windows\System\tZGeOIk.exe
  2⤵
  PID:7508
- C:\Windows\System\oCQUCvT.exe
  C:\Windows\System\oCQUCvT.exe
  2⤵
  PID:7524
- C:\Windows\System\btgkOxc.exe
  C:\Windows\System\btgkOxc.exe
  2⤵
  PID:7540
- C:\Windows\System\ElgjzoQ.exe
  C:\Windows\System\ElgjzoQ.exe
  2⤵
  PID:7556
- C:\Windows\System\ZapwbFN.exe
  C:\Windows\System\ZapwbFN.exe
  2⤵
  PID:7572
- C:\Windows\System\NatrerD.exe
  C:\Windows\System\NatrerD.exe
  2⤵
  PID:7588
- C:\Windows\System\LapCplN.exe
  C:\Windows\System\LapCplN.exe
  2⤵
  PID:7604
- C:\Windows\System\ydVlnbk.exe
  C:\Windows\System\ydVlnbk.exe
  2⤵
  PID:7624
- C:\Windows\System\VttSXpH.exe
  C:\Windows\System\VttSXpH.exe
  2⤵
  PID:7640
- C:\Windows\System\ebDDdjg.exe
  C:\Windows\System\ebDDdjg.exe
  2⤵
  PID:7656
- C:\Windows\System\wDvsHkm.exe
  C:\Windows\System\wDvsHkm.exe
  2⤵
  PID:7672
- C:\Windows\System\CNTRRYA.exe
  C:\Windows\System\CNTRRYA.exe
  2⤵
  PID:7688
- C:\Windows\System\yLzsHdI.exe
  C:\Windows\System\yLzsHdI.exe
  2⤵
  PID:7704
- C:\Windows\System\jkTKbRY.exe
  C:\Windows\System\jkTKbRY.exe
  2⤵
  PID:7720
- C:\Windows\System\llgPcOW.exe
  C:\Windows\System\llgPcOW.exe
  2⤵
  PID:7736
- C:\Windows\System\DnocoqR.exe
  C:\Windows\System\DnocoqR.exe
  2⤵
  PID:7752
- C:\Windows\System\DptMfTm.exe
  C:\Windows\System\DptMfTm.exe
  2⤵
  PID:7768
- C:\Windows\System\CqiFqXr.exe
  C:\Windows\System\CqiFqXr.exe
  2⤵
  PID:7784
- C:\Windows\System\rIdtcIz.exe
  C:\Windows\System\rIdtcIz.exe
  2⤵
  PID:7800
- C:\Windows\System\iqWMppg.exe
  C:\Windows\System\iqWMppg.exe
  2⤵
  PID:7816
- C:\Windows\System\nfPuGwI.exe
  C:\Windows\System\nfPuGwI.exe
  2⤵
  PID:7852
- C:\Windows\System\XtJSBNV.exe
  C:\Windows\System\XtJSBNV.exe
  2⤵
  PID:7884
- C:\Windows\System\ctKajDL.exe
  C:\Windows\System\ctKajDL.exe
  2⤵
  PID:7908
- C:\Windows\System\KoPWUBK.exe
  C:\Windows\System\KoPWUBK.exe
  2⤵
  PID:7928
- C:\Windows\System\SzCKFKi.exe
  C:\Windows\System\SzCKFKi.exe
  2⤵
  PID:7944
- C:\Windows\System\fAhCdYD.exe
  C:\Windows\System\fAhCdYD.exe
  2⤵
  PID:8000
- C:\Windows\System\kojJqco.exe
  C:\Windows\System\kojJqco.exe
  2⤵
  PID:8016
- C:\Windows\System\NCQIldC.exe
  C:\Windows\System\NCQIldC.exe
  2⤵
  PID:8032
- C:\Windows\System\jUpbjSv.exe
  C:\Windows\System\jUpbjSv.exe
  2⤵
  PID:8048
- C:\Windows\System\RKInNTZ.exe
  C:\Windows\System\RKInNTZ.exe
  2⤵
  PID:8064
- C:\Windows\System\TvKdPRU.exe
  C:\Windows\System\TvKdPRU.exe
  2⤵
  PID:8080
- C:\Windows\System\hHRvAfL.exe
  C:\Windows\System\hHRvAfL.exe
  2⤵
  PID:8096
- C:\Windows\System\sRTypFv.exe
  C:\Windows\System\sRTypFv.exe
  2⤵
  PID:8112
- C:\Windows\System\opjeLLY.exe
  C:\Windows\System\opjeLLY.exe
  2⤵
  PID:8128
- C:\Windows\System\gQwVaPn.exe
  C:\Windows\System\gQwVaPn.exe
  2⤵
  PID:8144
- C:\Windows\System\JKawsqc.exe
  C:\Windows\System\JKawsqc.exe
  2⤵
  PID:8160
- C:\Windows\System\ryAUXbh.exe
  C:\Windows\System\ryAUXbh.exe
  2⤵
  PID:8176
- C:\Windows\System\EkApyKF.exe
  C:\Windows\System\EkApyKF.exe
  2⤵
  PID:7056
- C:\Windows\System\tJvRfaD.exe
  C:\Windows\System\tJvRfaD.exe
  2⤵
  PID:7172
- C:\Windows\System\QtRublQ.exe
  C:\Windows\System\QtRublQ.exe
  2⤵
  PID:7212
- C:\Windows\System\fzUBphn.exe
  C:\Windows\System\fzUBphn.exe
  2⤵
  PID:7272
- C:\Windows\System\MPqaIGh.exe
  C:\Windows\System\MPqaIGh.exe
  2⤵
  PID:7188
- C:\Windows\System\aBWIGaG.exe
  C:\Windows\System\aBWIGaG.exe
  2⤵
  PID:7228
- C:\Windows\System\CBVDzwd.exe
  C:\Windows\System\CBVDzwd.exe
  2⤵
  PID:7312
- C:\Windows\System\sOeuotD.exe
  C:\Windows\System\sOeuotD.exe
  2⤵
  PID:7340
- C:\Windows\System\fYDIiLN.exe
  C:\Windows\System\fYDIiLN.exe
  2⤵
  PID:6060
- C:\Windows\System\kPmRFOc.exe
  C:\Windows\System\kPmRFOc.exe
  2⤵
  PID:7328
- C:\Windows\System\cZAbrhL.exe
  C:\Windows\System\cZAbrhL.exe
  2⤵
  PID:7392
- C:\Windows\System\SSXEAoj.exe
  C:\Windows\System\SSXEAoj.exe
  2⤵
  PID:7456
- C:\Windows\System\rVcemQf.exe
  C:\Windows\System\rVcemQf.exe
  2⤵
  PID:7488
- C:\Windows\System\dtyezCn.exe
  C:\Windows\System\dtyezCn.exe
  2⤵
  PID:7584
- C:\Windows\System\qaWgbXC.exe
  C:\Windows\System\qaWgbXC.exe
  2⤵
  PID:7472
- C:\Windows\System\zguTEBQ.exe
  C:\Windows\System\zguTEBQ.exe
  2⤵
  PID:7536
- C:\Windows\System\wbsWaVS.exe
  C:\Windows\System\wbsWaVS.exe
  2⤵
  PID:7600
- C:\Windows\System\dIxWNGu.exe
  C:\Windows\System\dIxWNGu.exe
  2⤵
  PID:7664
- C:\Windows\System\XIDekAe.exe
  C:\Windows\System\XIDekAe.exe
  2⤵
  PID:7648
- C:\Windows\System\baMFcBx.exe
  C:\Windows\System\baMFcBx.exe
  2⤵
  PID:7712
- C:\Windows\System\OHFMMLU.exe
  C:\Windows\System\OHFMMLU.exe
  2⤵
  PID:7744
- C:\Windows\System\kXPohfi.exe
  C:\Windows\System\kXPohfi.exe
  2⤵
  PID:7732
- C:\Windows\System\kwdXlAd.exe
  C:\Windows\System\kwdXlAd.exe
  2⤵
  PID:7760
- C:\Windows\System\hBnnfXG.exe
  C:\Windows\System\hBnnfXG.exe
  2⤵
  PID:7832
- C:\Windows\System\ztzgUMy.exe
  C:\Windows\System\ztzgUMy.exe
  2⤵
  PID:7840
- C:\Windows\System\nbPlTze.exe
  C:\Windows\System\nbPlTze.exe
  2⤵
  PID:6256
- C:\Windows\System\TJOteEm.exe
  C:\Windows\System\TJOteEm.exe
  2⤵
  PID:7936
- C:\Windows\System\vEJRYFl.exe
  C:\Windows\System\vEJRYFl.exe
  2⤵
  PID:7924
- C:\Windows\System\lmfepPn.exe
  C:\Windows\System\lmfepPn.exe
  2⤵
  PID:7956
- C:\Windows\System\DxPIJFC.exe
  C:\Windows\System\DxPIJFC.exe
  2⤵
  PID:7976
- C:\Windows\System\xfQxAqM.exe
  C:\Windows\System\xfQxAqM.exe
  2⤵
  PID:7992
- C:\Windows\System\PsalfST.exe
  C:\Windows\System\PsalfST.exe
  2⤵
  PID:8040
- C:\Windows\System\KmtuWLd.exe
  C:\Windows\System\KmtuWLd.exe
  2⤵
  PID:8104
- C:\Windows\System\uiYciJw.exe
  C:\Windows\System\uiYciJw.exe
  2⤵
  PID:8168
- C:\Windows\System\JjpFxOc.exe
  C:\Windows\System\JjpFxOc.exe
  2⤵
  PID:7244
- C:\Windows\System\kKkbIVs.exe
  C:\Windows\System\kKkbIVs.exe
  2⤵
  PID:6356
- C:\Windows\System\JrNGNEz.exe
  C:\Windows\System\JrNGNEz.exe
  2⤵
  PID:8028
- C:\Windows\System\UWZXtEP.exe
  C:\Windows\System\UWZXtEP.exe
  2⤵
  PID:8120
- C:\Windows\System\xbNJaIQ.exe
  C:\Windows\System\xbNJaIQ.exe
  2⤵
  PID:8188
- C:\Windows\System\BOFUlds.exe
  C:\Windows\System\BOFUlds.exe
  2⤵
  PID:7408
- C:\Windows\System\aQIcYiY.exe
  C:\Windows\System\aQIcYiY.exe
  2⤵
  PID:7424
- C:\Windows\System\hCUXZYH.exe
  C:\Windows\System\hCUXZYH.exe
  2⤵
  PID:7504
- C:\Windows\System\IFsYBOR.exe
  C:\Windows\System\IFsYBOR.exe
  2⤵
  PID:7388
- C:\Windows\System\cyASIlo.exe
  C:\Windows\System\cyASIlo.exe
  2⤵
  PID:7292
- C:\Windows\System\dLpHVCX.exe
  C:\Windows\System\dLpHVCX.exe
  2⤵
  PID:7516
- C:\Windows\System\mCtnbZS.exe
  C:\Windows\System\mCtnbZS.exe
  2⤵
  PID:7520
- C:\Windows\System\XRPneCy.exe
  C:\Windows\System\XRPneCy.exe
  2⤵
  PID:7776
- C:\Windows\System\pJlVdFQ.exe
  C:\Windows\System\pJlVdFQ.exe
  2⤵
  PID:7824
- C:\Windows\System\vQSEpyc.exe
  C:\Windows\System\vQSEpyc.exe
  2⤵
  PID:7864
- C:\Windows\System\ZxYITZe.exe
  C:\Windows\System\ZxYITZe.exe
  2⤵
  PID:7848
- C:\Windows\System\wQAdNVD.exe
  C:\Windows\System\wQAdNVD.exe
  2⤵
  PID:7920
- C:\Windows\System\MRRdlvL.exe
  C:\Windows\System\MRRdlvL.exe
  2⤵
  PID:7984
- C:\Windows\System\zQOdDjx.exe
  C:\Windows\System\zQOdDjx.exe
  2⤵
  PID:8072
- C:\Windows\System\lrWwQGb.exe
  C:\Windows\System\lrWwQGb.exe
  2⤵
  PID:8024
- C:\Windows\System\BisWQAo.exe
  C:\Windows\System\BisWQAo.exe
  2⤵
  PID:7256
- C:\Windows\System\piTHpUD.exe
  C:\Windows\System\piTHpUD.exe
  2⤵
  PID:7060
- C:\Windows\System\rYVrgAh.exe
  C:\Windows\System\rYVrgAh.exe
  2⤵
  PID:7296
- C:\Windows\System\LBuTweC.exe
  C:\Windows\System\LBuTweC.exe
  2⤵
  PID:7616
- C:\Windows\System\qoWjphE.exe
  C:\Windows\System\qoWjphE.exe
  2⤵
  PID:7680
- C:\Windows\System\uqJJDmk.exe
  C:\Windows\System\uqJJDmk.exe
  2⤵
  PID:7808
- C:\Windows\System\VAYDzPL.exe
  C:\Windows\System\VAYDzPL.exe
  2⤵
  PID:7828
- C:\Windows\System\hHaYnbV.exe
  C:\Windows\System\hHaYnbV.exe
  2⤵
  PID:7952
- C:\Windows\System\PUBCXJx.exe
  C:\Windows\System\PUBCXJx.exe
  2⤵
  PID:8076
- C:\Windows\System\TolFpWv.exe
  C:\Windows\System\TolFpWv.exe
  2⤵
  PID:8060
- C:\Windows\System\hIzHTSb.exe
  C:\Windows\System\hIzHTSb.exe
  2⤵
  PID:7204
- C:\Windows\System\QXrJYhs.exe
  C:\Windows\System\QXrJYhs.exe
  2⤵
  PID:7360
- C:\Windows\System\MyQZFgM.exe
  C:\Windows\System\MyQZFgM.exe
  2⤵
  PID:7636
- C:\Windows\System\FZtUaLy.exe
  C:\Windows\System\FZtUaLy.exe
  2⤵
  PID:8012
- C:\Windows\System\cPfedIt.exe
  C:\Windows\System\cPfedIt.exe
  2⤵
  PID:7596
- C:\Windows\System\FxYVHAF.exe
  C:\Windows\System\FxYVHAF.exe
  2⤵
  PID:8156
- C:\Windows\System\wiexxfU.exe
  C:\Windows\System\wiexxfU.exe
  2⤵
  PID:8184
- C:\Windows\System\GqqkzQy.exe
  C:\Windows\System\GqqkzQy.exe
  2⤵
  PID:8200
- C:\Windows\System\pZSkyFj.exe
  C:\Windows\System\pZSkyFj.exe
  2⤵
  PID:8216
- C:\Windows\System\dYSyAtO.exe
  C:\Windows\System\dYSyAtO.exe
  2⤵
  PID:8232
- C:\Windows\System\rEFpvcQ.exe
  C:\Windows\System\rEFpvcQ.exe
  2⤵
  PID:8248
- C:\Windows\System\UjNOGqk.exe
  C:\Windows\System\UjNOGqk.exe
  2⤵
  PID:8264
- C:\Windows\System\OsljZuj.exe
  C:\Windows\System\OsljZuj.exe
  2⤵
  PID:8280
- C:\Windows\System\cTkgnLO.exe
  C:\Windows\System\cTkgnLO.exe
  2⤵
  PID:8296
- C:\Windows\System\QiGMOKI.exe
  C:\Windows\System\QiGMOKI.exe
  2⤵
  PID:8312
- C:\Windows\System\uLwqGbY.exe
  C:\Windows\System\uLwqGbY.exe
  2⤵
  PID:8328
- C:\Windows\System\BaHoHql.exe
  C:\Windows\System\BaHoHql.exe
  2⤵
  PID:8344
- C:\Windows\System\ZixrSMQ.exe
  C:\Windows\System\ZixrSMQ.exe
  2⤵
  PID:8360
- C:\Windows\System\ZAGEqtW.exe
  C:\Windows\System\ZAGEqtW.exe
  2⤵
  PID:8376
- C:\Windows\System\viYafTo.exe
  C:\Windows\System\viYafTo.exe
  2⤵
  PID:8392
- C:\Windows\System\saJPYzz.exe
  C:\Windows\System\saJPYzz.exe
  2⤵
  PID:8408
- C:\Windows\System\nPvFOoD.exe
  C:\Windows\System\nPvFOoD.exe
  2⤵
  PID:8424
- C:\Windows\System\EvXwEPe.exe
  C:\Windows\System\EvXwEPe.exe
  2⤵
  PID:8440
- C:\Windows\System\vCbCFQV.exe
  C:\Windows\System\vCbCFQV.exe
  2⤵
  PID:8456
- C:\Windows\System\nTlvLab.exe
  C:\Windows\System\nTlvLab.exe
  2⤵
  PID:8472
- C:\Windows\System\QVUPeON.exe
  C:\Windows\System\QVUPeON.exe
  2⤵
  PID:8488
- C:\Windows\System\OEwjLBu.exe
  C:\Windows\System\OEwjLBu.exe
  2⤵
  PID:8504
- C:\Windows\System\RoWjcNV.exe
  C:\Windows\System\RoWjcNV.exe
  2⤵
  PID:8520
- C:\Windows\System\cXKdaWR.exe
  C:\Windows\System\cXKdaWR.exe
  2⤵
  PID:8536
- C:\Windows\System\QHvDDBw.exe
  C:\Windows\System\QHvDDBw.exe
  2⤵
  PID:8552
- C:\Windows\System\sNnMFWC.exe
  C:\Windows\System\sNnMFWC.exe
  2⤵
  PID:8568
- C:\Windows\System\oWHPHem.exe
  C:\Windows\System\oWHPHem.exe
  2⤵
  PID:8584
- C:\Windows\System\shLgpXP.exe
  C:\Windows\System\shLgpXP.exe
  2⤵
  PID:8600
- C:\Windows\System\rSFCJjI.exe
  C:\Windows\System\rSFCJjI.exe
  2⤵
  PID:8616
- C:\Windows\System\pjiwpqH.exe
  C:\Windows\System\pjiwpqH.exe
  2⤵
  PID:8632
- C:\Windows\System\dSusUCZ.exe
  C:\Windows\System\dSusUCZ.exe
  2⤵
  PID:8648
- C:\Windows\System\uXuihTH.exe
  C:\Windows\System\uXuihTH.exe
  2⤵
  PID:8664
- C:\Windows\System\RbUdBZw.exe
  C:\Windows\System\RbUdBZw.exe
  2⤵
  PID:8680
- C:\Windows\System\rCLuoRd.exe
  C:\Windows\System\rCLuoRd.exe
  2⤵
  PID:8696
- C:\Windows\System\Hgsdpnh.exe
  C:\Windows\System\Hgsdpnh.exe
  2⤵
  PID:8712
- C:\Windows\System\zuEaQOn.exe
  C:\Windows\System\zuEaQOn.exe
  2⤵
  PID:8728
- C:\Windows\System\YvYtqgx.exe
  C:\Windows\System\YvYtqgx.exe
  2⤵
  PID:8744
- C:\Windows\System\NRZstTF.exe
  C:\Windows\System\NRZstTF.exe
  2⤵
  PID:8760
- C:\Windows\System\WJpXDzx.exe
  C:\Windows\System\WJpXDzx.exe
  2⤵
  PID:8776
- C:\Windows\System\cAMmcjC.exe
  C:\Windows\System\cAMmcjC.exe
  2⤵
  PID:8792
- C:\Windows\System\CrhhUrZ.exe
  C:\Windows\System\CrhhUrZ.exe
  2⤵
  PID:8808
- C:\Windows\System\BQanzGl.exe
  C:\Windows\System\BQanzGl.exe
  2⤵
  PID:8824
- C:\Windows\System\iQDYCcY.exe
  C:\Windows\System\iQDYCcY.exe
  2⤵
  PID:8840
- C:\Windows\System\MNQlzDu.exe
  C:\Windows\System\MNQlzDu.exe
  2⤵
  PID:8856
- C:\Windows\System\thezhyH.exe
  C:\Windows\System\thezhyH.exe
  2⤵
  PID:8872
- C:\Windows\System\jzhXlej.exe
  C:\Windows\System\jzhXlej.exe
  2⤵
  PID:8888
- C:\Windows\System\LiNgQjY.exe
  C:\Windows\System\LiNgQjY.exe
  2⤵
  PID:8904
- C:\Windows\System\tfOMpnw.exe
  C:\Windows\System\tfOMpnw.exe
  2⤵
  PID:8924
- C:\Windows\System\qbvOtcC.exe
  C:\Windows\System\qbvOtcC.exe
  2⤵
  PID:8940
- C:\Windows\System\jHQxvOz.exe
  C:\Windows\System\jHQxvOz.exe
  2⤵
  PID:8956
- C:\Windows\System\aVysIxB.exe
  C:\Windows\System\aVysIxB.exe
  2⤵
  PID:8972
- C:\Windows\System\BwbrHMQ.exe
  C:\Windows\System\BwbrHMQ.exe
  2⤵
  PID:8988
- C:\Windows\System\ZDfmFOG.exe
  C:\Windows\System\ZDfmFOG.exe
  2⤵
  PID:9008
- C:\Windows\System\fgJSKAe.exe
  C:\Windows\System\fgJSKAe.exe
  2⤵
  PID:9028
- C:\Windows\System\NuYONrI.exe
  C:\Windows\System\NuYONrI.exe
  2⤵
  PID:9044
- C:\Windows\System\XDZgIQo.exe
  C:\Windows\System\XDZgIQo.exe
  2⤵
  PID:9060
- C:\Windows\System\aMFPdnn.exe
  C:\Windows\System\aMFPdnn.exe
  2⤵
  PID:9076
- C:\Windows\System\bKkaGKw.exe
  C:\Windows\System\bKkaGKw.exe
  2⤵
  PID:9092
- C:\Windows\System\FiWIPWs.exe
  C:\Windows\System\FiWIPWs.exe
  2⤵
  PID:9112
- C:\Windows\System\fFIpTet.exe
  C:\Windows\System\fFIpTet.exe
  2⤵
  PID:9132
- C:\Windows\System\IVLDvSM.exe
  C:\Windows\System\IVLDvSM.exe
  2⤵
  PID:9148
- C:\Windows\System\QNEwfDP.exe
  C:\Windows\System\QNEwfDP.exe
  2⤵
  PID:9168
- C:\Windows\System\QJvXlxR.exe
  C:\Windows\System\QJvXlxR.exe
  2⤵
  PID:9188
- C:\Windows\System\WrwzwAm.exe
  C:\Windows\System\WrwzwAm.exe
  2⤵
  PID:8196
- C:\Windows\System\JzxUijw.exe
  C:\Windows\System\JzxUijw.exe
  2⤵
  PID:8228
- C:\Windows\System\pKWRTHY.exe
  C:\Windows\System\pKWRTHY.exe
  2⤵
  PID:8260
- C:\Windows\System\YHnYrFW.exe
  C:\Windows\System\YHnYrFW.exe
  2⤵
  PID:856
- C:\Windows\System\UduQVAU.exe
  C:\Windows\System\UduQVAU.exe
  2⤵
  PID:8308
- C:\Windows\System\RBWgoqB.exe
  C:\Windows\System\RBWgoqB.exe
  2⤵
  PID:8276
- C:\Windows\System\WdjxGbC.exe
  C:\Windows\System\WdjxGbC.exe
  2⤵
  PID:8388
- C:\Windows\System\WhhmDoe.exe
  C:\Windows\System\WhhmDoe.exe
  2⤵
  PID:8400
- C:\Windows\System\fvOVJCY.exe
  C:\Windows\System\fvOVJCY.exe
  2⤵
  PID:8436
- C:\Windows\System\NeQedUZ.exe
  C:\Windows\System\NeQedUZ.exe
  2⤵
  PID:8512
- C:\Windows\System\UtdsxOI.exe
  C:\Windows\System\UtdsxOI.exe
  2⤵
  PID:8496
- C:\Windows\System\EKWyxQe.exe
  C:\Windows\System\EKWyxQe.exe
  2⤵
  PID:8468
- C:\Windows\System\euIYSTM.exe
  C:\Windows\System\euIYSTM.exe
  2⤵
  PID:8500
- C:\Windows\System\RVgUgPH.exe
  C:\Windows\System\RVgUgPH.exe
  2⤵
  PID:8608
- C:\Windows\System\dZHZjJC.exe
  C:\Windows\System\dZHZjJC.exe
  2⤵
  PID:8672
- C:\Windows\System\wLBmxCD.exe
  C:\Windows\System\wLBmxCD.exe
  2⤵
  PID:8660
- C:\Windows\System\olRkMos.exe
  C:\Windows\System\olRkMos.exe
  2⤵
  PID:8688
- C:\Windows\System\nYpoWYs.exe
  C:\Windows\System\nYpoWYs.exe
  2⤵
  PID:8724
- C:\Windows\System\JNtuYwI.exe
  C:\Windows\System\JNtuYwI.exe
  2⤵
  PID:8756
- C:\Windows\System\LvbqcHR.exe
  C:\Windows\System\LvbqcHR.exe
  2⤵
  PID:8832
- C:\Windows\System\MIIoYBI.exe
  C:\Windows\System\MIIoYBI.exe
  2⤵
  PID:8784
- C:\Windows\System\jrcPaLm.exe
  C:\Windows\System\jrcPaLm.exe
  2⤵
  PID:8896
- C:\Windows\System\KwQHyCV.exe
  C:\Windows\System\KwQHyCV.exe
  2⤵
  PID:8880
- C:\Windows\System\NjERyeV.exe
  C:\Windows\System\NjERyeV.exe
  2⤵
  PID:8936
- C:\Windows\System\iEBdLLM.exe
  C:\Windows\System\iEBdLLM.exe
  2⤵
  PID:9000
- C:\Windows\System\dryhDOq.exe
  C:\Windows\System\dryhDOq.exe
  2⤵
  PID:8948
- C:\Windows\System\NkdwrIR.exe
  C:\Windows\System\NkdwrIR.exe
  2⤵
  PID:9100
- C:\Windows\System\DQfCsIX.exe
  C:\Windows\System\DQfCsIX.exe
  2⤵
  PID:8984
- C:\Windows\System\StaOGbU.exe
  C:\Windows\System\StaOGbU.exe
  2⤵
  PID:9052
- C:\Windows\System\LvjGvrq.exe
  C:\Windows\System\LvjGvrq.exe
  2⤵
  PID:9140
- C:\Windows\System\xVxyHFi.exe
  C:\Windows\System\xVxyHFi.exe
  2⤵
  PID:9184
- C:\Windows\System\mvQInii.exe
  C:\Windows\System\mvQInii.exe
  2⤵
  PID:9156
- C:\Windows\System\mTqgqQt.exe
  C:\Windows\System\mTqgqQt.exe
  2⤵
  PID:9204
- C:\Windows\System\TCpWvRN.exe
  C:\Windows\System\TCpWvRN.exe
  2⤵
  PID:8212
- C:\Windows\System\zQxFXpU.exe
  C:\Windows\System\zQxFXpU.exe
  2⤵
  PID:8336
- C:\Windows\System\wzSTxeQ.exe
  C:\Windows\System\wzSTxeQ.exe
  2⤵
  PID:8404
- C:\Windows\System\cCUwyfu.exe
  C:\Windows\System\cCUwyfu.exe
  2⤵
  PID:8372
- C:\Windows\System\hMTQpeZ.exe
  C:\Windows\System\hMTQpeZ.exe
  2⤵
  PID:8224
- C:\Windows\System\mPASjwY.exe
  C:\Windows\System\mPASjwY.exe
  2⤵
  PID:8528
- C:\Windows\System\cCEHihK.exe
  C:\Windows\System\cCEHihK.exe
  2⤵
  PID:8564
- C:\Windows\System\UpWvgjN.exe
  C:\Windows\System\UpWvgjN.exe
  2⤵
  PID:8768
- C:\Windows\System\zRwKYIj.exe
  C:\Windows\System\zRwKYIj.exe
  2⤵
  PID:8532
- C:\Windows\System\DEaYNjq.exe
  C:\Windows\System\DEaYNjq.exe
  2⤵
  PID:8852
- C:\Windows\System\xjEIfGn.exe
  C:\Windows\System\xjEIfGn.exe
  2⤵
  PID:8996
- C:\Windows\System\aQcpskJ.exe
  C:\Windows\System\aQcpskJ.exe
  2⤵
  PID:8916
- C:\Windows\System\gFznjYx.exe
  C:\Windows\System\gFznjYx.exe
  2⤵
  PID:9036
- C:\Windows\System\jHRgHeL.exe
  C:\Windows\System\jHRgHeL.exe
  2⤵
  PID:9176
- C:\Windows\System\KhguBgl.exe
  C:\Windows\System\KhguBgl.exe
  2⤵
  PID:9200
- C:\Windows\System\rKZtYKi.exe
  C:\Windows\System\rKZtYKi.exe
  2⤵
  PID:8952
- C:\Windows\System\sOpHwPt.exe
  C:\Windows\System\sOpHwPt.exe
  2⤵
  PID:7568
- C:\Windows\System\gvISXTp.exe
  C:\Windows\System\gvISXTp.exe
  2⤵
  PID:8644
- C:\Windows\System\FoMnnrV.exe
  C:\Windows\System\FoMnnrV.exe
  2⤵
  PID:8704
- C:\Windows\System\EdIiMNL.exe
  C:\Windows\System\EdIiMNL.exe
  2⤵
  PID:9108
- C:\Windows\System\ylvaMkc.exe
  C:\Windows\System\ylvaMkc.exe
  2⤵
  PID:8548
- C:\Windows\System\RZhlAjz.exe
  C:\Windows\System\RZhlAjz.exe
  2⤵
  PID:8804
- C:\Windows\System\gwRXBgI.exe
  C:\Windows\System\gwRXBgI.exe
  2⤵
  PID:8816
- C:\Windows\System\NKpnhgG.exe
  C:\Windows\System\NKpnhgG.exe
  2⤵
  PID:8868
- C:\Windows\System\vPipzcU.exe
  C:\Windows\System\vPipzcU.exe
  2⤵
  PID:9040
- C:\Windows\System\CpyaSZs.exe
  C:\Windows\System\CpyaSZs.exe
  2⤵
  PID:8656
- C:\Windows\System\SIOvGpG.exe
  C:\Windows\System\SIOvGpG.exe
  2⤵
  PID:8920
- C:\Windows\System\SdGyCyy.exe
  C:\Windows\System\SdGyCyy.exe
  2⤵
  PID:9084
- C:\Windows\System\cTGtiRN.exe
  C:\Windows\System\cTGtiRN.exe
  2⤵
  PID:8420
- C:\Windows\System\ZumOXXV.exe
  C:\Windows\System\ZumOXXV.exe
  2⤵
  PID:9220
- C:\Windows\System\DLCMrMw.exe
  C:\Windows\System\DLCMrMw.exe
  2⤵
  PID:9236
- C:\Windows\System\nzlNLnZ.exe
  C:\Windows\System\nzlNLnZ.exe
  2⤵
  PID:9252
- C:\Windows\System\REzPMVb.exe
  C:\Windows\System\REzPMVb.exe
  2⤵
  PID:9268
- C:\Windows\System\czNeGqF.exe
  C:\Windows\System\czNeGqF.exe
  2⤵
  PID:9284
- C:\Windows\System\kYrwEAM.exe
  C:\Windows\System\kYrwEAM.exe
  2⤵
  PID:9300
- C:\Windows\System\rabCzfJ.exe
  C:\Windows\System\rabCzfJ.exe
  2⤵
  PID:9316
- C:\Windows\System\jilkUFO.exe
  C:\Windows\System\jilkUFO.exe
  2⤵
  PID:9336
- C:\Windows\System\GorpPuL.exe
  C:\Windows\System\GorpPuL.exe
  2⤵
  PID:9352
- C:\Windows\System\phPyTZG.exe
  C:\Windows\System\phPyTZG.exe
  2⤵
  PID:9368
- C:\Windows\System\TCGollK.exe
  C:\Windows\System\TCGollK.exe
  2⤵
  PID:9384
- C:\Windows\System\xANGCOv.exe
  C:\Windows\System\xANGCOv.exe
  2⤵
  PID:9400
- C:\Windows\System\iYMOCZy.exe
  C:\Windows\System\iYMOCZy.exe
  2⤵
  PID:9416
- C:\Windows\System\sNrXAWB.exe
  C:\Windows\System\sNrXAWB.exe
  2⤵
  PID:9432
- C:\Windows\System\MQyocgO.exe
  C:\Windows\System\MQyocgO.exe
  2⤵
  PID:9448
- C:\Windows\System\PLHXWxV.exe
  C:\Windows\System\PLHXWxV.exe
  2⤵
  PID:9464
- C:\Windows\System\BppabuK.exe
  C:\Windows\System\BppabuK.exe
  2⤵
  PID:9480
- C:\Windows\System\lngeaBF.exe
  C:\Windows\System\lngeaBF.exe
  2⤵
  PID:9496
- C:\Windows\System\HtYZBEm.exe
  C:\Windows\System\HtYZBEm.exe
  2⤵
  PID:9516
- C:\Windows\System\TEIzxBB.exe
  C:\Windows\System\TEIzxBB.exe
  2⤵
  PID:9532
- C:\Windows\System\RcuVYng.exe
  C:\Windows\System\RcuVYng.exe
  2⤵
  PID:9548
- C:\Windows\System\FkDXgwE.exe
  C:\Windows\System\FkDXgwE.exe
  2⤵
  PID:9564
- C:\Windows\System\efZwVMJ.exe
  C:\Windows\System\efZwVMJ.exe
  2⤵
  PID:9580
- C:\Windows\System\RdobrFE.exe
  C:\Windows\System\RdobrFE.exe
  2⤵
  PID:9596
- C:\Windows\System\yPxzAnY.exe
  C:\Windows\System\yPxzAnY.exe
  2⤵
  PID:9612
- C:\Windows\System\hEklrTh.exe
  C:\Windows\System\hEklrTh.exe
  2⤵
  PID:9632
- C:\Windows\System\PVfOMBd.exe
  C:\Windows\System\PVfOMBd.exe
  2⤵
  PID:9648
- C:\Windows\System\QBpGZer.exe
  C:\Windows\System\QBpGZer.exe
  2⤵
  PID:9664
- C:\Windows\System\mmnxVIy.exe
  C:\Windows\System\mmnxVIy.exe
  2⤵
  PID:9680
- C:\Windows\System\ZCfnqDi.exe
  C:\Windows\System\ZCfnqDi.exe
  2⤵
  PID:9696
- C:\Windows\System\tMzmiLd.exe
  C:\Windows\System\tMzmiLd.exe
  2⤵
  PID:9712
- C:\Windows\System\GfUTrVu.exe
  C:\Windows\System\GfUTrVu.exe
  2⤵
  PID:9728
- C:\Windows\System\exefllp.exe
  C:\Windows\System\exefllp.exe
  2⤵
  PID:9744
- C:\Windows\System\YeZfgHe.exe
  C:\Windows\System\YeZfgHe.exe
  2⤵
  PID:9760
- C:\Windows\System\woDrDIl.exe
  C:\Windows\System\woDrDIl.exe
  2⤵
  PID:9776
- C:\Windows\System\urUrpCF.exe
  C:\Windows\System\urUrpCF.exe
  2⤵
  PID:9792
- C:\Windows\System\WLCgiKQ.exe
  C:\Windows\System\WLCgiKQ.exe
  2⤵
  PID:9808
- C:\Windows\System\HqUuasR.exe
  C:\Windows\System\HqUuasR.exe
  2⤵
  PID:9824
- C:\Windows\System\GQbIrwN.exe
  C:\Windows\System\GQbIrwN.exe
  2⤵
  PID:9840
- C:\Windows\System\ApWgPLT.exe
  C:\Windows\System\ApWgPLT.exe
  2⤵
  PID:9856
- C:\Windows\System\xcNkYZH.exe
  C:\Windows\System\xcNkYZH.exe
  2⤵
  PID:9872
- C:\Windows\System\TlNCOaP.exe
  C:\Windows\System\TlNCOaP.exe
  2⤵
  PID:9888
- C:\Windows\System\ImYIVAH.exe
  C:\Windows\System\ImYIVAH.exe
  2⤵
  PID:9904
- C:\Windows\System\EiEOGFZ.exe
  C:\Windows\System\EiEOGFZ.exe
  2⤵
  PID:9920
- C:\Windows\System\zLFvwng.exe
  C:\Windows\System\zLFvwng.exe
  2⤵
  PID:9936
- C:\Windows\System\POpixxj.exe
  C:\Windows\System\POpixxj.exe
  2⤵
  PID:9952
- C:\Windows\System\MBFtDxP.exe
  C:\Windows\System\MBFtDxP.exe
  2⤵
  PID:9968
- C:\Windows\System\duQAdVF.exe
  C:\Windows\System\duQAdVF.exe
  2⤵
  PID:9984
- C:\Windows\System\PmuoATT.exe
  C:\Windows\System\PmuoATT.exe
  2⤵
  PID:10000
- C:\Windows\System\eiIyFRV.exe
  C:\Windows\System\eiIyFRV.exe
  2⤵
  PID:10016
- C:\Windows\System\PyErYPA.exe
  C:\Windows\System\PyErYPA.exe
  2⤵
  PID:10032
- C:\Windows\System\bbBfWGf.exe
  C:\Windows\System\bbBfWGf.exe
  2⤵
  PID:10048
- C:\Windows\System\gwvQTFj.exe
  C:\Windows\System\gwvQTFj.exe
  2⤵
  PID:10064
- C:\Windows\System\TLyaXLO.exe
  C:\Windows\System\TLyaXLO.exe
  2⤵
  PID:10084
- C:\Windows\System\QBponOG.exe
  C:\Windows\System\QBponOG.exe
  2⤵
  PID:10100
- C:\Windows\System\ZrLrvPb.exe
  C:\Windows\System\ZrLrvPb.exe
  2⤵
  PID:10116
- C:\Windows\System\cdvqKmY.exe
  C:\Windows\System\cdvqKmY.exe
  2⤵
  PID:10132
- C:\Windows\System\BHIzrpb.exe
  C:\Windows\System\BHIzrpb.exe
  2⤵
  PID:10148
- C:\Windows\System\htFjPuy.exe
  C:\Windows\System\htFjPuy.exe
  2⤵
  PID:10164
- C:\Windows\System\egYKvcJ.exe
  C:\Windows\System\egYKvcJ.exe
  2⤵
  PID:10180
- C:\Windows\System\sPocXet.exe
  C:\Windows\System\sPocXet.exe
  2⤵
  PID:10196
- C:\Windows\System\NqiAmOR.exe
  C:\Windows\System\NqiAmOR.exe
  2⤵
  PID:10212
- C:\Windows\System\NDSOfGD.exe
  C:\Windows\System\NDSOfGD.exe
  2⤵
  PID:10228
- C:\Windows\System\yihhuPP.exe
  C:\Windows\System\yihhuPP.exe
  2⤵
  PID:9128
- C:\Windows\System\quJvRHM.exe
  C:\Windows\System\quJvRHM.exe
  2⤵
  PID:9248
- C:\Windows\System\HIAJMDa.exe
  C:\Windows\System\HIAJMDa.exe
  2⤵
  PID:9232
- C:\Windows\System\PkBcDHZ.exe
  C:\Windows\System\PkBcDHZ.exe
  2⤵
  PID:8432
- C:\Windows\System\WeqNBwp.exe
  C:\Windows\System\WeqNBwp.exe
  2⤵
  PID:9312
- C:\Windows\System\PMQIiPM.exe
  C:\Windows\System\PMQIiPM.exe
  2⤵
  PID:9344
- C:\Windows\System\CJOatZw.exe
  C:\Windows\System\CJOatZw.exe
  2⤵
  PID:9376
- C:\Windows\System\TdbEHiW.exe
  C:\Windows\System\TdbEHiW.exe
  2⤵
  PID:9412
- C:\Windows\System\YwPQVOE.exe
  C:\Windows\System\YwPQVOE.exe
  2⤵
  PID:9456
- C:\Windows\System\fSYVwpb.exe
  C:\Windows\System\fSYVwpb.exe
  2⤵
  PID:9444
- C:\Windows\System\kfuJFcD.exe
  C:\Windows\System\kfuJFcD.exe
  2⤵
  PID:9512
- C:\Windows\System\mlZEepz.exe
  C:\Windows\System\mlZEepz.exe
  2⤵
  PID:9488
- C:\Windows\System\vkAqmjx.exe
  C:\Windows\System\vkAqmjx.exe
  2⤵
  PID:9556
- C:\Windows\System\gkbRjSl.exe
  C:\Windows\System\gkbRjSl.exe
  2⤵
  PID:9588
- C:\Windows\System\HcUFgGG.exe
  C:\Windows\System\HcUFgGG.exe
  2⤵
  PID:9624
- C:\Windows\System\WEfDdCI.exe
  C:\Windows\System\WEfDdCI.exe
  2⤵
  PID:9656
- C:\Windows\System\ziuDFZc.exe
  C:\Windows\System\ziuDFZc.exe
  2⤵
  PID:9688
- C:\Windows\System\tXJGBWh.exe
  C:\Windows\System\tXJGBWh.exe
  2⤵
  PID:9692
- C:\Windows\System\cBxkpcL.exe
  C:\Windows\System\cBxkpcL.exe
  2⤵
  PID:9724
- C:\Windows\System\EsrAbKB.exe
  C:\Windows\System\EsrAbKB.exe
  2⤵
  PID:9800
- C:\Windows\System\wypVqON.exe
  C:\Windows\System\wypVqON.exe
  2⤵
  PID:9788
- C:\Windows\System\UvLxkwS.exe
  C:\Windows\System\UvLxkwS.exe
  2⤵
  PID:9848
- C:\Windows\System\yNDlIAM.exe
  C:\Windows\System\yNDlIAM.exe
  2⤵
  PID:9884
- C:\Windows\System\csMojbO.exe
  C:\Windows\System\csMojbO.exe
  2⤵
  PID:9932
- C:\Windows\System\GEUFwyA.exe
  C:\Windows\System\GEUFwyA.exe
  2⤵
  PID:9964
- C:\Windows\System\TsIKlIC.exe
  C:\Windows\System\TsIKlIC.exe
  2⤵
  PID:9980
- C:\Windows\System\NTKhPYk.exe
  C:\Windows\System\NTKhPYk.exe
  2⤵
  PID:10008
- C:\Windows\System\vTYhGac.exe
  C:\Windows\System\vTYhGac.exe
  2⤵
  PID:10040
- C:\Windows\System\ehjXPbr.exe
  C:\Windows\System\ehjXPbr.exe
  2⤵
  PID:10124
- C:\Windows\System\dthnEvt.exe
  C:\Windows\System\dthnEvt.exe
  2⤵
  PID:10160
- C:\Windows\System\KQfsMpX.exe
  C:\Windows\System\KQfsMpX.exe
  2⤵
  PID:10172
- C:\Windows\System\ZdCygLe.exe
  C:\Windows\System\ZdCygLe.exe
  2⤵
  PID:10220
- C:\Windows\System\HoZJXmz.exe
  C:\Windows\System\HoZJXmz.exe
  2⤵
  PID:8932
- C:\Windows\System\kYQctVT.exe
  C:\Windows\System\kYQctVT.exe
  2⤵
  PID:10208
- C:\Windows\System\CgrhQcm.exe
  C:\Windows\System\CgrhQcm.exe
  2⤵
  PID:9228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AIllKaT.exe

Filesize
1.2MB

MD5
6d9917b4a2559ddaa921e08df2275dd6

SHA1
62995e756ca82c403552fd2a75a0161bd87cbbad

SHA256
b910ab16ab312b403761dbb017f2059315a8544f82c2a1fc8ca0759f9cac7101

SHA512
3059984ceae1d7b23b979cf3df02238e57d5b08d840e5bc7ce3c5e55c6022e8253c616b28ac62f382e0cd101567dbda8a7407c96a72ce63bd5071646390d43a6

Download Submit
C:\Windows\system\BpfTnSO.exe

Filesize
1.2MB

MD5
cc81beca9a0455678dc42e001d62f707

SHA1
099adf87e0a8f3d2e3724e763f13896e77867de9

SHA256
15c77845abb7514250dc91cf849ec36598a76df28cf3f7afc9daf4d105cb057c

SHA512
c6ccc30a362c9968ecea7c9484aadce7e6957d9fbbb3ff2ff132de3f717b06c60a6454aae04106d392ee7b8ea4f6c1d503b2a46226ba22ee0c0c6a1a3f17eaf3

Download Submit
C:\Windows\system\CyGdluO.exe

Filesize
1.2MB

MD5
5ffa706badce0341ae5c9ab9ad15723a

SHA1
19deb2ed338683c4a05ad6fc198a4247da7aec34

SHA256
90dcb05d85f6b2e3bac59d037aa552474c51bc508c7bcae6a9a1e89ced7d4d04

SHA512
00a2e06c5daa2127483523049c38de7ee34ee8bc47e80fa598b88206dbc17bba040fd716e40f1bc8b50df9504629f62cc8bba24fd303c0e1c64c792fb69e2359

Download Submit
C:\Windows\system\EehKCZn.exe

Filesize
1.2MB

MD5
67e570f245843a5832d71f156107440d

SHA1
0bd6b829c08e95f3c169947745baf6cd0f521b13

SHA256
7554ecf38e435ae1bcd0b786c8a51c8ff86fc43ddf763566bf4be46a87f69739

SHA512
2083143c7c4a427a59bad8b058f463ab07bc25aa48028e06fbaf78f2f7d74ab438e2e6eabd6516876bcede4fb196f6b0f1c7ac316721bd32b3c18c3ecdc41d7d

Download Submit
C:\Windows\system\JMQGyeS.exe

Filesize
1.2MB

MD5
8729c0ecb56dc89ea8cdf061d4e853f0

SHA1
0954febef61ee5e96fda3618d8ec7dbeecbd548e

SHA256
ce8087090061070e7ff862cb4d59f8e454a2083d7c98510d07fa6e8fdf798340

SHA512
4bbfe118db7d6ebb5141988fbbce5832f81861508c0a0635df3533457e85ca2b3c0cda3e93f0a59067d7b4810b629e1605d255e16e1277648f1c78f2e89783f5

Download Submit
C:\Windows\system\OKthCbq.exe

Filesize
1.2MB

MD5
541e358c809d2c0f3550b530ad65b59e

SHA1
2a093c20c8de488314e828d5ef1081bee5f8c945

SHA256
0f3df16cd0bf547c1beac326ee9598daf3dc6c61097792454dae418c68efd0b1

SHA512
62fdb7198cd4d5024d9df6ee18ddbe26b5ecd35a3f13c17399e97aecc56f29a1fe5dd7976c1df202cde79051e933a66252cad59c90129d735b0998e70c3354e6

Download Submit
C:\Windows\system\OXBQAVc.exe

Filesize
1.2MB

MD5
137d6f7c375c278847cecd206541ee4c

SHA1
25f78956c899704b11272e888a733cc80d9ebcc9

SHA256
42dd44fbe74789fd5dd16e890e59a13102b2129894818fd50955e562f5c38931

SHA512
516a5a386b35fa8e801af80bdedb5e6c038384775003edc864f5fa0702cb5109397f6230fca9aa9c4ad56c2cf6ebceb94c034b392829350954f69537b8d8a46d

Download Submit
C:\Windows\system\PUQrtDs.exe

Filesize
1.2MB

MD5
a907f97403af9f09660823a629018b83

SHA1
e16dfed84ca345f47bb87b764e4aff4defa93dc4

SHA256
bbfc1c7eef0c99a946e6f983a669362a5741c66c794bf595f1893007f95810cd

SHA512
0b5cc83ce791aa731b27ab3dbb0d88c8b6a3175f7e49315ab3eb813fa3fc719e4d7eb0876ca84cca968b7bc28d82810a220f88f7912ba5e861837c2ac853367c

Download Submit
C:\Windows\system\RkNPMoz.exe

Filesize
1.2MB

MD5
dbd88185a688b2db8ddfd4308c1c6981

SHA1
c8e48a15fedc64d27004bd60d428e6d4bb9b4c0b

SHA256
071c0c11fad151500924cd494bea338827d912ce96ff843aab139a98343485cf

SHA512
7b6108bafa82cbe8135fdcbdadba2e643a89f0df9af07d3eed45d2bf919fa9412c8a05412fba1de110e7e6a221866baf2e4126273c6b56e90e8aa9ab9fbcc5f8

Download Submit
C:\Windows\system\TbbCLry.exe

Filesize
1.2MB

MD5
7f42ed02cd208c026d872df202654f0e

SHA1
e4c42029e31ac154d4de9fee33c7c5ccc161c33d

SHA256
f608f889b7d081517e228bf5fdb146dd4002cb880d60dcd6e254c6b0bf3d022c

SHA512
9fc99462e76ef4cd108628c78f9a55c505daba873716605c047d8c36d4b8cd27491720c7219ea5b9e68451c5a95b054ec28a985d9c738c2c18bad981282e0ea7

Download Submit
C:\Windows\system\WKHQiiI.exe

Filesize
1.2MB

MD5
7d2152ff54f6d919a668d88e0d7b5a27

SHA1
68e5a8e6894efdec6cd101f72eb9c422e8cd56e8

SHA256
a1f87cfc1e7833a1a79152edde9f2038ad6b4ad0bd952375ee6fe9152b0d4d3c

SHA512
d43fbdd0c92a24c2e8c5529e8e3ab16c9cfbfed8e4b9e67a09ef6b369b3fbbd9b72a6b7f02c9694c724646568828992bc03f6454f958a02a407f431e005bf119

Download Submit
C:\Windows\system\WmfoeUG.exe

Filesize
1.2MB

MD5
579234bf27f031ee64a18bdcd6c1c2b3

SHA1
ab0ca7fb0c09843eac509983518bdf1cb77d74e4

SHA256
ec8d572c5e6cb81d4e9c19de6b416de853f5a22b86a468550f317ec23f0c4879

SHA512
1373dd74c52b079cd852b943c921765eec82b6cacc5497629adb6d710cd6530fa755a94acc025edf51d1bff29fbf9325d558b7a15ba37c6dfd6ecfb316d0d7d8

Download Submit
C:\Windows\system\XSovxJH.exe

Filesize
1.2MB

MD5
9acf04d00665bb6d17125a1fd32a07e1

SHA1
7cbc0890228bee9bedce69f06e25c02a5743258b

SHA256
431792844ed1fd1d71552eeaeea6e434072b467c41ba3bc57718b8cf6239cf26

SHA512
6b6b3d1f0970808113b38d884b469959f71738a64bb3815fa0657a0660b785f0e63a4f668618e273e4199fdc3318259daeb71086be43fc08a211c85ec67cd237

Download Submit
C:\Windows\system\XmNJTwj.exe

Filesize
1.2MB

MD5
59521ce02999e6a272170c9895df4900

SHA1
9bf072d054a27c8eb56068c40dac0819cd460950

SHA256
53739b2f3308c659b591a4cd0559b5a21382ebc0b778edf5a50170053f661f6e

SHA512
755991ae9489a8f2ca6c36df4e20759f9dfd5c37eff3bd8ab47d381b48d5806838be84c7c0af1335b7e48140e2aece7d6e2fdb49fc9d771c1b99238347257f1e

Download Submit
C:\Windows\system\aTKFiMt.exe

Filesize
1.2MB

MD5
99e10b736b45059d5b8a100a45b1568e

SHA1
62ee8812d888351dd88fcd462c45d0d51d8864ed

SHA256
f491006fbe41cb957f940e8b8e7e0ab6a566e46f8763a264278e10f9f76eeff1

SHA512
15b0fbadac3185ebb346072d6b0ccfed9f20dc7e2f10c4fac0148c83b3513954c044223b773a8eff580c473d40f601275568994e3a1beb9d9533423fd742505b

Download Submit
C:\Windows\system\fLfwKcc.exe

Filesize
1.2MB

MD5
28893536499ea4b89f97c33648ab8bab

SHA1
523350b21303d20254d597a96a7ab924165951b6

SHA256
98a12a2b358547356dedb3c03233e9f3446c985488aa371e304ef3f8e85cdf61

SHA512
b910a9395cafdc3b018b19d190737c1aafffc535d21ee4a22a7c40e0f2a69994dcb8431e8946bf6dc9cfd1235c887bad36888a7d77c5f23be41d50c43add93e0

Download Submit
C:\Windows\system\iUYmWCY.exe

Filesize
1.2MB

MD5
2a9ac0e79b0ae83cb8a655fd1a457e27

SHA1
235e7ca8b8c84cbb87cb2f6a47e7a66d78bf903e

SHA256
0d71df78d52a7d7f1a8711e7e825e59de1414e2f97235ceb3c6bb569c62b386f

SHA512
023ce206434fac4fafb2f06c2ac2795d73faa5bfff2b88b69722222d3141c984f45c0d73e638d9581db93348ce98618c19fac069cee55503e010ab6b37ec0fe5

Download Submit
C:\Windows\system\jjnqafq.exe

Filesize
1.2MB

MD5
4574e25c572aa012596665dbb248f806

SHA1
d5f2a9fd3c61f243b041b6a5b3a929687473bf1b

SHA256
56d4703418c0f9a7f2b8275701c4c224017c619a52afedf8469972b26069acbd

SHA512
28f790f508d45402a7e57ef80aeac055ff35d7d6d81fe9230ea885020a61a14163e4e9e8d7500c4c202783fd69c8029a79fd108d2bb53e482047e6da2ea72db6

Download Submit
C:\Windows\system\joiBNBF.exe

Filesize
1.2MB

MD5
43b341f163cb61473f91a42e249f3756

SHA1
ad6fd1295f42413ca43969728f9cbf296d44b0c5

SHA256
53f7dc26b48801ac2e009bddd817295a7dfa65c98b76a4d79ea89eac5ec533de

SHA512
f3cd1d52fe26df71d8ec48ed0819647b4489272dd9277f08c0851601627f0ac3f6d69683444902d67d6e30607cc61b939359d8e2ad0ad3b0a26faa8b4603bb3d

Download Submit
C:\Windows\system\kKwWhQP.exe

Filesize
1.2MB

MD5
109bd5a9660cfdf4253ebe5957226f24

SHA1
4b830802c2306431d489c02f1bfc89251f51dab3

SHA256
b4c4aeb821e802f6427ba85be9e3b3d816fdae38dc94eda35f170f0b9d29b093

SHA512
8f2f58d8050eef6db79d066330e7106d93889dc5908ffa912cef861adcaf3fe47c56865283d81559aa0d48dcc1558fca50a264fd90047055b4cadca50b9c7d13

Download Submit
C:\Windows\system\mIhhGPI.exe

Filesize
1.2MB

MD5
7fbf2c4e0a71e21a00b118d491a5cfde

SHA1
8dd00223913c7b7106c77707741acae118045903

SHA256
0f1763e0c21c6939126352497ad3b7e65847303b7ae6b2a98e7e7f8ac13f1975

SHA512
290ba18274059c65c82679c40a83abe0620f8f5b02c4e3c882aefaebb6d8f666643294634c10aeec372673ac530691b1022969d8c8fda25739969b9da4bab476

Download Submit
C:\Windows\system\ouXioro.exe

Filesize
1.2MB

MD5
105203315d42fbdf7b0fd2d8756908af

SHA1
fb846915c63fff73d8ff44d850b69046bcc7de5f

SHA256
eb11e4a10f468bc791bf86e4d715a3a19a92808f156ace8c9e05cd19bed5713e

SHA512
1e4a9512d5336ff684ab0ff407c94d4ee4d2ec6b47fa85bd47932e23f7ce2f27b4f1b92a8c531000a06ae25953213f54f0b898d99263990181f027d68b6e201b

Download Submit
C:\Windows\system\rMxANsH.exe

Filesize
1.2MB

MD5
51541f010dad9b65483da9141a2c153c

SHA1
26a33399dae88580d9c134d75a240e69d4a63847

SHA256
4ec3e7fa1013b6f73fb107cebd1240da79a891bfe0bfe592dcf7e132e3a870d7

SHA512
03a8558fe6dd2fbd56da0970fb76aa4514124fb39b3ec25c3ee5714009584b728204ffa22406b4479226b3a619302a05d922c0d49591d876651e86f53a2e9dbc

Download Submit
C:\Windows\system\rxNBcGs.exe

Filesize
1.2MB

MD5
53198f0a6671517a90e6914c3e7ad25b

SHA1
cb4c684041e891f4006c8a4303a2286bf512d0a0

SHA256
4f641200514204b50e8d0b985376fc8b1b09127d7d67b80b3b1c85f5ab9494b1

SHA512
51d2bc49f044df43f10d62df3980294fd818d948c21d611e7d4abb2ac900d9289bdf1c2d3b629dd87791e3a9c90beecb811ed53ee1c2d2943c1cf639a266deb5

Download Submit
C:\Windows\system\ryByamP.exe

Filesize
1.2MB

MD5
95cf0e1a35139c26086015d9774a9fe9

SHA1
b0d84078535f69989cab40a8a400c3376ebecaef

SHA256
04929a7b5d5a6673a3de1cac1599251f3af1592befd273774e779a90e2c1be7a

SHA512
a7770d1b58d16280a9055128007aee12eb8f195512859b54ae87781efed248f99bb500ddde38436c7403470bef04e98367f91470a4db40d2ed81cd4af4bedffe

Download Submit
C:\Windows\system\vzmAHnV.exe

Filesize
1.2MB

MD5
b37c5b823353f9dc5a7da7d3d9ea0e2e

SHA1
4d731d82438b1d8bfa0c8a66e50c8a6581cc971c

SHA256
67ff3ced1e1bf4ea93404102a273ac58029899c5740db5b94d854df1da9dc1f9

SHA512
12364064d1aa6483d16f67a39a99005f8ca85579d74a8927aa646adf68d7d267b8a738cfab57ae13463d9ef830c22661f1fe39fdfc4975da40f92d3cb27eb942

Download Submit
C:\Windows\system\worENdf.exe

Filesize
1.2MB

MD5
30cd4c1bf4dcea69224ab74922a15271

SHA1
09f87559ae0752e868255b08af64d8c2da4b1202

SHA256
721f3bb988e13b21c643e48d00f533ea99f83ff46da9faa8e90958ecf08b320f

SHA512
d468d99507377c0a60850ac99655a859ba651ce37cf8d43bc96808f3f1b6dfe6e08e926c150c4b9411bf53a66b931e23fe15bcc642920859b31d6499a7a83344

Download Submit
C:\Windows\system\xDYlZmT.exe

Filesize
1.2MB

MD5
4c711a7f09291b6b0bf75b623596fa21

SHA1
e5806866c2c06145618a611864537d688d77bd7b

SHA256
886860eecd37209ff69e0118f87fc601f3281fe0fde08962b35a41431308c2de

SHA512
f1038994649458ee51389e8db0756b2a6766c746a8793f8158adb0c060099b14692eba7ecfeb915f8e69d438972e58d84acb0f2b7198846a8803df682934d290

Download Submit
C:\Windows\system\ynfzlhn.exe

Filesize
1.2MB

MD5
c0b22f722121b484ded11e60b9dbc552

SHA1
0cfed3c2c45b5e7b7791e4727c6a568ae19d15cd

SHA256
1e4b3aadabd771e56007fc950b1b3593b125100c4ea7067ad4714c15bf1ddb19

SHA512
02a6a7d0e15250ede1717dd807917906fbc7dc596b8dcd3513883259403c4c25abe7d8ee89d308b1de4766aa929a41e6d48d2404d67672c89f97479a13987913

Download Submit
\Windows\system\MkUbgpJ.exe

Filesize
1.2MB

MD5
634179b1e29ebceb56fbf09e1afe49f9

SHA1
acade75acc4468b9ac6573225b7fb7b298be24b4

SHA256
3076f90248ab6cbc41925c8a1238e391c0d6666bb09ec4bb33c1cd469dfe78e7

SHA512
a3b994b260b74152e5adfe9e91c7289a25223d4395f771da7f833891e2f42592ad9f00eb5d64c951e55f722b45b794586030c0ccbc08c3b564230086ef3920cf

Download Submit
\Windows\system\rATyTMy.exe

Filesize
1.2MB

MD5
a0bb28f91e058b0fe1fc1b57e6d4b0ee

SHA1
2e6c071b3303eefa834630f49a562a169fe50461

SHA256
8e27b3e44b505b70942d9144e88827f6439600a3a13d47b05633d72c7a7b3b92

SHA512
e007a1302823b991efee6e3b1b95c60ca98a911463eb5fa9028d7bdc3b992a5b69b3dbc3e78529fe29943a24233de7d999350d1b1e52b6a1d10f218faa7a7422

Download Submit
\Windows\system\xbabLIV.exe

Filesize
1.2MB

MD5
a728fe132a7bc95c892c42866ae6c121

SHA1
27b532f4c26cf312a1cfca6dfeb5408508f9d04d

SHA256
f6e1b25bc5e6402c63c49c0629f839981583d4bda5c7451b6acd14eebc681747

SHA512
7e102b924331d225129a84c2eb5332bc9a4710f6583888c69f7f972e93e4af1ee5e7879ba6c2c1e3f161f09680b734ad8941a7ef4653f4b5040c665075603ea6

Download Submit
memory/1520-518-0x000000013FA80000-0x000000013FDD4000-memory.dmp

Filesize
3.3MB

Download
memory/1520-4088-0x000000013FA80000-0x000000013FDD4000-memory.dmp

Filesize
3.3MB

Download
memory/2088-4084-0x000000013FAB0000-0x000000013FE04000-memory.dmp

Filesize
3.3MB

Download
memory/2088-494-0x000000013FAB0000-0x000000013FE04000-memory.dmp

Filesize
3.3MB

Download
memory/2208-506-0x000000013F7E0000-0x000000013FB34000-memory.dmp

Filesize
3.3MB

Download
memory/2208-4092-0x000000013F7E0000-0x000000013FB34000-memory.dmp

Filesize
3.3MB

Download
memory/2392-497-0x000000013FB00000-0x000000013FE54000-memory.dmp

Filesize
3.3MB

Download
memory/2392-4093-0x000000013FB00000-0x000000013FE54000-memory.dmp

Filesize
3.3MB

Download
memory/2608-4097-0x000000013F1E0000-0x000000013F534000-memory.dmp

Filesize
3.3MB

Download
memory/2608-514-0x000000013F1E0000-0x000000013F534000-memory.dmp

Filesize
3.3MB

Download
memory/2632-4094-0x000000013F4C0000-0x000000013F814000-memory.dmp

Filesize
3.3MB

Download
memory/2632-510-0x000000013F4C0000-0x000000013F814000-memory.dmp

Filesize
3.3MB

Download
memory/2644-4087-0x000000013FF10000-0x0000000140264000-memory.dmp

Filesize
3.3MB

Download
memory/2644-508-0x000000013FF10000-0x0000000140264000-memory.dmp

Filesize
3.3MB

Download
memory/2652-4096-0x000000013F490000-0x000000013F7E4000-memory.dmp

Filesize
3.3MB

Download
memory/2652-516-0x000000013F490000-0x000000013F7E4000-memory.dmp

Filesize
3.3MB

Download
memory/2692-519-0x0000000001DC0000-0x0000000002114000-memory.dmp

Filesize
3.3MB

Download
memory/2692-520-0x000000013FAB0000-0x000000013FE04000-memory.dmp

Filesize
3.3MB

Download
memory/2692-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2692-511-0x000000013FCA0000-0x000000013FFF4000-memory.dmp

Filesize
3.3MB

Download
memory/2692-515-0x0000000001DC0000-0x0000000002114000-memory.dmp

Filesize
3.3MB

Download
memory/2692-509-0x0000000001DC0000-0x0000000002114000-memory.dmp

Filesize
3.3MB

Download
memory/2692-517-0x000000013FA80000-0x000000013FDD4000-memory.dmp

Filesize
3.3MB

Download
memory/2692-507-0x000000013FF10000-0x0000000140264000-memory.dmp

Filesize
3.3MB

Download
memory/2692-496-0x000000013FA20000-0x000000013FD74000-memory.dmp

Filesize
3.3MB

Download
memory/2692-503-0x0000000001DC0000-0x0000000002114000-memory.dmp

Filesize
3.3MB

Download
memory/2692-505-0x000000013F7E0000-0x000000013FB34000-memory.dmp

Filesize
3.3MB

Download
memory/2692-522-0x0000000001DC0000-0x0000000002114000-memory.dmp

Filesize
3.3MB

Download
memory/2692-521-0x000000013FB20000-0x000000013FE74000-memory.dmp

Filesize
3.3MB

Download
memory/2692-499-0x0000000001DC0000-0x0000000002114000-memory.dmp

Filesize
3.3MB

Download
memory/2692-4070-0x000000013F3F0000-0x000000013F744000-memory.dmp

Filesize
3.3MB

Download
memory/2692-4071-0x000000013FB00000-0x000000013FE54000-memory.dmp

Filesize
3.3MB

Download
memory/2692-4072-0x0000000001DC0000-0x0000000002114000-memory.dmp

Filesize
3.3MB

Download
memory/2692-4073-0x000000013F7E0000-0x000000013FB34000-memory.dmp

Filesize
3.3MB

Download
memory/2692-4074-0x000000013FF10000-0x0000000140264000-memory.dmp

Filesize
3.3MB

Download
memory/2692-4075-0x0000000001DC0000-0x0000000002114000-memory.dmp

Filesize
3.3MB

Download
memory/2692-4076-0x000000013FCA0000-0x000000013FFF4000-memory.dmp

Filesize
3.3MB

Download
memory/2692-4079-0x000000013FA80000-0x000000013FDD4000-memory.dmp

Filesize
3.3MB

Download
memory/2692-4080-0x0000000001DC0000-0x0000000002114000-memory.dmp

Filesize
3.3MB

Download
memory/2692-4078-0x0000000001DC0000-0x0000000002114000-memory.dmp

Filesize
3.3MB

Download
memory/2692-4077-0x0000000001DC0000-0x0000000002114000-memory.dmp

Filesize
3.3MB

Download
memory/2692-4083-0x0000000001DC0000-0x0000000002114000-memory.dmp

Filesize
3.3MB

Download
memory/2692-4082-0x000000013FB20000-0x000000013FE74000-memory.dmp

Filesize
3.3MB

Download
memory/2692-4081-0x000000013FAB0000-0x000000013FE04000-memory.dmp

Filesize
3.3MB

Download
memory/2692-0-0x000000013F3F0000-0x000000013F744000-memory.dmp

Filesize
3.3MB

Download
memory/2692-513-0x0000000001DC0000-0x0000000002114000-memory.dmp

Filesize
3.3MB

Download
memory/2700-501-0x000000013FA20000-0x000000013FD74000-memory.dmp

Filesize
3.3MB

Download
memory/2700-4086-0x000000013FA20000-0x000000013FD74000-memory.dmp

Filesize
3.3MB

Download
memory/2720-500-0x000000013F410000-0x000000013F764000-memory.dmp

Filesize
3.3MB

Download
memory/2720-4091-0x000000013F410000-0x000000013F764000-memory.dmp

Filesize
3.3MB

Download
memory/2760-4090-0x000000013F610000-0x000000013F964000-memory.dmp

Filesize
3.3MB

Download
memory/2760-502-0x000000013F610000-0x000000013F964000-memory.dmp

Filesize
3.3MB

Download
memory/2776-4095-0x000000013FCA0000-0x000000013FFF4000-memory.dmp

Filesize
3.3MB

Download
memory/2776-512-0x000000013FCA0000-0x000000013FFF4000-memory.dmp

Filesize
3.3MB

Download
memory/2788-4085-0x000000013FB20000-0x000000013FE74000-memory.dmp

Filesize
3.3MB

Download
memory/2788-498-0x000000013FB20000-0x000000013FE74000-memory.dmp

Filesize
3.3MB

Download
memory/2964-4089-0x000000013F3D0000-0x000000013F724000-memory.dmp

Filesize
3.3MB

Download
memory/2964-504-0x000000013F3D0000-0x000000013F724000-memory.dmp

Filesize
3.3MB

Download