xmrig | e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-12-2024 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
Size

3.0MB
MD5

8fe886f0631b0bad576919125d30200c
SHA1

609280a790728b59d37aba39e303c1016abac56a
SHA256

e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e
SHA512

81eab2b40bd6b4b0d02f41224d3d413dadb4dee85c31bb061599bb5d5660d8da4280dea8a0f1b0a6cb1baca3958ad701f40841aebbf131260100b259e71628a8
SSDEEP

49152:EnCbL83y9FdfE0pZ0zCa4wI156uL3pgrCEdMKPFotsgEBr6GZ:EniLf9FdfE0pZB156utgpPFotBE3

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 61 IoCs

miner

resource	yara_rule
behavioral1/memory/1444-0-0x000000013F070000-0x000000013F3C4000-memory.dmp	xmrig
behavioral1/files/0x0003000000012000-3.dat	xmrig
behavioral1/memory/2268-26-0x000000013F2B0000-0x000000013F604000-memory.dmp	xmrig
behavioral1/files/0x00060000000186ea-75.dat	xmrig
behavioral1/files/0x0005000000019609-116.dat	xmrig
behavioral1/files/0x0005000000019582-114.dat	xmrig
behavioral1/files/0x0005000000019461-112.dat	xmrig
behavioral1/files/0x0005000000019441-110.dat	xmrig
behavioral1/memory/2856-109-0x000000013F1A0000-0x000000013F4F4000-memory.dmp	xmrig
behavioral1/files/0x000500000001960d-106.dat	xmrig
behavioral1/files/0x000500000001950c-63.dat	xmrig
behavioral1/files/0x0007000000018683-54.dat	xmrig
behavioral1/memory/2812-44-0x000000013FFF0000-0x0000000140344000-memory.dmp	xmrig
behavioral1/memory/1444-101-0x000000013FFF0000-0x0000000140344000-memory.dmp	xmrig
behavioral1/memory/2552-100-0x000000013F0A0000-0x000000013F3F4000-memory.dmp	xmrig
behavioral1/memory/2696-98-0x000000013FF10000-0x0000000140264000-memory.dmp	xmrig
behavioral1/memory/1444-97-0x000000013F960000-0x000000013FCB4000-memory.dmp	xmrig
behavioral1/memory/3060-96-0x000000013F170000-0x000000013F4C4000-memory.dmp	xmrig
behavioral1/memory/2580-94-0x000000013FC40000-0x000000013FF94000-memory.dmp	xmrig
behavioral1/memory/860-93-0x000000013F2B0000-0x000000013F604000-memory.dmp	xmrig
behavioral1/memory/2836-91-0x000000013F3F0000-0x000000013F744000-memory.dmp	xmrig
behavioral1/memory/2868-88-0x000000013FE70000-0x00000001401C4000-memory.dmp	xmrig
behavioral1/memory/2720-82-0x000000013F8A0000-0x000000013FBF4000-memory.dmp	xmrig
behavioral1/files/0x000500000001960b-84.dat	xmrig
behavioral1/files/0x00050000000195c5-83.dat	xmrig
behavioral1/files/0x00060000000186ee-36.dat	xmrig
behavioral1/files/0x00060000000186fd-80.dat	xmrig
behavioral1/files/0x000500000001944f-60.dat	xmrig
behavioral1/files/0x000700000001873d-59.dat	xmrig
behavioral1/files/0x00060000000186e4-35.dat	xmrig
behavioral1/memory/2692-58-0x000000013F830000-0x000000013FB84000-memory.dmp	xmrig
behavioral1/memory/1444-118-0x000000013F070000-0x000000013F3C4000-memory.dmp	xmrig
behavioral1/files/0x000e000000018676-17.dat	xmrig
behavioral1/files/0x00080000000174cc-30.dat	xmrig
behavioral1/memory/1444-9-0x00000000020F0000-0x0000000002444000-memory.dmp	xmrig
behavioral1/files/0x00390000000173a9-122.dat	xmrig
behavioral1/files/0x000500000001960f-129.dat	xmrig
behavioral1/files/0x0005000000019613-138.dat	xmrig
behavioral1/files/0x0005000000019617-155.dat	xmrig
behavioral1/files/0x000500000001961b-159.dat	xmrig
behavioral1/files/0x000500000001961f-167.dat	xmrig
behavioral1/files/0x0005000000019622-176.dat	xmrig
behavioral1/files/0x0005000000019625-183.dat	xmrig
behavioral1/files/0x0005000000019623-179.dat	xmrig
behavioral1/files/0x0005000000019621-172.dat	xmrig
behavioral1/files/0x000500000001961d-164.dat	xmrig
behavioral1/files/0x0005000000019619-153.dat	xmrig
behavioral1/files/0x0005000000019615-143.dat	xmrig
behavioral1/files/0x0005000000019611-135.dat	xmrig
behavioral1/memory/2812-4101-0x000000013FFF0000-0x0000000140344000-memory.dmp	xmrig
behavioral1/memory/2268-4100-0x000000013F2B0000-0x000000013F604000-memory.dmp	xmrig
behavioral1/memory/3060-4102-0x000000013F170000-0x000000013F4C4000-memory.dmp	xmrig
behavioral1/memory/2720-4104-0x000000013F8A0000-0x000000013FBF4000-memory.dmp	xmrig
behavioral1/memory/2868-4103-0x000000013FE70000-0x00000001401C4000-memory.dmp	xmrig
behavioral1/memory/2580-4105-0x000000013FC40000-0x000000013FF94000-memory.dmp	xmrig
behavioral1/memory/2856-4109-0x000000013F1A0000-0x000000013F4F4000-memory.dmp	xmrig
behavioral1/memory/2836-4110-0x000000013F3F0000-0x000000013F744000-memory.dmp	xmrig
behavioral1/memory/2692-4108-0x000000013F830000-0x000000013FB84000-memory.dmp	xmrig
behavioral1/memory/2696-4107-0x000000013FF10000-0x0000000140264000-memory.dmp	xmrig
behavioral1/memory/860-4106-0x000000013F2B0000-0x000000013F604000-memory.dmp	xmrig
behavioral1/memory/2552-4111-0x000000013F0A0000-0x000000013F3F4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2268	SmAwBUO.exe
2812	UZgDsyO.exe
2692	hhUaWqz.exe
2720	CsDHGbY.exe
2868	FtOzldY.exe
2836	QkGABbw.exe
860	vgSjTFC.exe
2580	MIpkEiz.exe
3060	vygrsaF.exe
2696	FYktpqG.exe
2856	TfzZdkB.exe
2552	PimyZiU.exe
1620	blgjXcI.exe
2612	ihCRAeE.exe
2684	DJtkeXe.exe
2164	SHWRWMT.exe
2412	jXAPjdh.exe
2792	ocQWaPR.exe
376	uRblnfa.exe
1976	paFxDrG.exe
2200	WCnchfN.exe
2192	HemkfoJ.exe
2208	ACWJwnM.exe
1632	YprTinZ.exe
2160	woHaGFW.exe
3040	BauQYEq.exe
1332	rBrDraH.exe
2952	PmDUaEy.exe
2956	VbULbeL.exe
1376	iSuRHus.exe
1044	ntAqmdY.exe
1104	dEDwhNu.exe
816	VJaiFaf.exe
1932	aOFNJgR.exe
1064	DLnrkQH.exe
3032	KUGtktr.exe
2284	lSNUyiG.exe
1560	AmZxzoR.exe
976	igEugGo.exe
2024	eybrtCP.exe
2004	yMJPZyv.exe
2044	kRnyyPN.exe
1808	WBosmWP.exe
284	kyIBFTe.exe
2460	MfVEzAN.exe
2052	LHAmpux.exe
1868	dboJjbR.exe
2468	EzqaTZM.exe
2332	mBxxSfU.exe
3012	FwOhgda.exe
1284	pEoKwzZ.exe
2196	zGlSHND.exe
1448	jctAlXv.exe
1596	XOQhUmQ.exe
2328	wlkngZd.exe
1488	qNCUuJx.exe
2292	HDfhIeb.exe
2404	qFSDzqi.exe
1504	QRowEdg.exe
2252	YCkuKsz.exe
2656	RTEaPMd.exe
1708	JbdMJKR.exe
2860	rlWlXFM.exe
2076	GOWucjb.exe

Loads dropped DLL 64 IoCs

pid	Process
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1444-0-0x000000013F070000-0x000000013F3C4000-memory.dmp	upx
behavioral1/files/0x0003000000012000-3.dat	upx
behavioral1/memory/2268-26-0x000000013F2B0000-0x000000013F604000-memory.dmp	upx
behavioral1/files/0x00060000000186ea-75.dat	upx
behavioral1/files/0x0005000000019609-116.dat	upx
behavioral1/files/0x0005000000019582-114.dat	upx
behavioral1/files/0x0005000000019461-112.dat	upx
behavioral1/files/0x0005000000019441-110.dat	upx
behavioral1/memory/2856-109-0x000000013F1A0000-0x000000013F4F4000-memory.dmp	upx
behavioral1/files/0x000500000001960d-106.dat	upx
behavioral1/files/0x000500000001950c-63.dat	upx
behavioral1/files/0x0007000000018683-54.dat	upx
behavioral1/memory/2812-44-0x000000013FFF0000-0x0000000140344000-memory.dmp	upx
behavioral1/memory/2552-100-0x000000013F0A0000-0x000000013F3F4000-memory.dmp	upx
behavioral1/memory/2696-98-0x000000013FF10000-0x0000000140264000-memory.dmp	upx
behavioral1/memory/3060-96-0x000000013F170000-0x000000013F4C4000-memory.dmp	upx
behavioral1/memory/2580-94-0x000000013FC40000-0x000000013FF94000-memory.dmp	upx
behavioral1/memory/860-93-0x000000013F2B0000-0x000000013F604000-memory.dmp	upx
behavioral1/memory/2836-91-0x000000013F3F0000-0x000000013F744000-memory.dmp	upx
behavioral1/memory/2868-88-0x000000013FE70000-0x00000001401C4000-memory.dmp	upx
behavioral1/memory/2720-82-0x000000013F8A0000-0x000000013FBF4000-memory.dmp	upx
behavioral1/files/0x000500000001960b-84.dat	upx
behavioral1/files/0x00050000000195c5-83.dat	upx
behavioral1/files/0x00060000000186ee-36.dat	upx
behavioral1/files/0x00060000000186fd-80.dat	upx
behavioral1/files/0x000500000001944f-60.dat	upx
behavioral1/files/0x000700000001873d-59.dat	upx
behavioral1/files/0x00060000000186e4-35.dat	upx
behavioral1/memory/2692-58-0x000000013F830000-0x000000013FB84000-memory.dmp	upx
behavioral1/memory/1444-118-0x000000013F070000-0x000000013F3C4000-memory.dmp	upx
behavioral1/files/0x000e000000018676-17.dat	upx
behavioral1/files/0x00080000000174cc-30.dat	upx
behavioral1/memory/1444-9-0x00000000020F0000-0x0000000002444000-memory.dmp	upx
behavioral1/files/0x00390000000173a9-122.dat	upx
behavioral1/files/0x000500000001960f-129.dat	upx
behavioral1/files/0x0005000000019613-138.dat	upx
behavioral1/files/0x0005000000019617-155.dat	upx
behavioral1/files/0x000500000001961b-159.dat	upx
behavioral1/files/0x000500000001961f-167.dat	upx
behavioral1/files/0x0005000000019622-176.dat	upx
behavioral1/files/0x0005000000019625-183.dat	upx
behavioral1/files/0x0005000000019623-179.dat	upx
behavioral1/files/0x0005000000019621-172.dat	upx
behavioral1/files/0x000500000001961d-164.dat	upx
behavioral1/files/0x0005000000019619-153.dat	upx
behavioral1/files/0x0005000000019615-143.dat	upx
behavioral1/files/0x0005000000019611-135.dat	upx
behavioral1/memory/2812-4101-0x000000013FFF0000-0x0000000140344000-memory.dmp	upx
behavioral1/memory/2268-4100-0x000000013F2B0000-0x000000013F604000-memory.dmp	upx
behavioral1/memory/3060-4102-0x000000013F170000-0x000000013F4C4000-memory.dmp	upx
behavioral1/memory/2720-4104-0x000000013F8A0000-0x000000013FBF4000-memory.dmp	upx
behavioral1/memory/2868-4103-0x000000013FE70000-0x00000001401C4000-memory.dmp	upx
behavioral1/memory/2580-4105-0x000000013FC40000-0x000000013FF94000-memory.dmp	upx
behavioral1/memory/2856-4109-0x000000013F1A0000-0x000000013F4F4000-memory.dmp	upx
behavioral1/memory/2836-4110-0x000000013F3F0000-0x000000013F744000-memory.dmp	upx
behavioral1/memory/2692-4108-0x000000013F830000-0x000000013FB84000-memory.dmp	upx
behavioral1/memory/2696-4107-0x000000013FF10000-0x0000000140264000-memory.dmp	upx
behavioral1/memory/860-4106-0x000000013F2B0000-0x000000013F604000-memory.dmp	upx
behavioral1/memory/2552-4111-0x000000013F0A0000-0x000000013F3F4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MMATySu.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\fognryj.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\qINmGUD.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\WvYvoYc.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\UjzIACb.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\mIaZQkW.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\dHXLTnV.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\YVmhXDY.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\ZNXwPud.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\okOSfzd.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\KkmjdBS.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\aDIHmZh.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\dFhxHjB.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\iUZlsgS.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\iOXakWE.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\dhSPSjF.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\HIojsdN.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\vDvCZaN.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\uBBIfsh.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\iZpJKWw.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\VzwmIFM.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\GKJRfkn.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\ntKouQF.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\AVHfEwy.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\LbmmjEY.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\IhlDnXl.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\CuXmrcR.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\JDgmFiX.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\AGEWshX.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\rlVVhhn.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\qaXgbRa.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\WUZnGwB.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\PgZzONN.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\QqUKzzP.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\IpxJUVE.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\lzBLbse.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\cidAwws.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\aUkuPQV.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\UNoUxQA.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\xAoBnWc.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\MDIjZtE.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\mlAbEDP.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\HwnkjlY.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\OsIYcKf.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\rBtwXaJ.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\NzwirAf.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\blgjXcI.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\dboJjbR.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\OezuRzZ.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\NDpGVLd.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\MHsIBQC.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\gbXsLNR.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\jlFCgkm.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\Pikizzq.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\zeJrOqT.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\DcanAKN.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\rMbhReF.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\JzfBSgE.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\MKQKikT.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\wuZUtNw.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\ayWOwlY.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\orARrFE.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\wBLSsDA.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
File created	C:\Windows\System\fLkXchV.exe	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2268	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	31
PID 1444 wrote to memory of 2268	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	31
PID 1444 wrote to memory of 2268	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	31
PID 1444 wrote to memory of 2692	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	32
PID 1444 wrote to memory of 2692	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	32
PID 1444 wrote to memory of 2692	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	32
PID 1444 wrote to memory of 2812	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	33
PID 1444 wrote to memory of 2812	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	33
PID 1444 wrote to memory of 2812	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	33
PID 1444 wrote to memory of 2836	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	34
PID 1444 wrote to memory of 2836	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	34
PID 1444 wrote to memory of 2836	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	34
PID 1444 wrote to memory of 2720	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	35
PID 1444 wrote to memory of 2720	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	35
PID 1444 wrote to memory of 2720	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	35
PID 1444 wrote to memory of 2696	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	36
PID 1444 wrote to memory of 2696	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	36
PID 1444 wrote to memory of 2696	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	36
PID 1444 wrote to memory of 2868	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	37
PID 1444 wrote to memory of 2868	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	37
PID 1444 wrote to memory of 2868	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	37
PID 1444 wrote to memory of 2856	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	38
PID 1444 wrote to memory of 2856	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	38
PID 1444 wrote to memory of 2856	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	38
PID 1444 wrote to memory of 860	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	39
PID 1444 wrote to memory of 860	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	39
PID 1444 wrote to memory of 860	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	39
PID 1444 wrote to memory of 2612	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	40
PID 1444 wrote to memory of 2612	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	40
PID 1444 wrote to memory of 2612	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	40
PID 1444 wrote to memory of 2580	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	41
PID 1444 wrote to memory of 2580	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	41
PID 1444 wrote to memory of 2580	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	41
PID 1444 wrote to memory of 2684	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	42
PID 1444 wrote to memory of 2684	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	42
PID 1444 wrote to memory of 2684	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	42
PID 1444 wrote to memory of 3060	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	43
PID 1444 wrote to memory of 3060	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	43
PID 1444 wrote to memory of 3060	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	43
PID 1444 wrote to memory of 2164	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	44
PID 1444 wrote to memory of 2164	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	44
PID 1444 wrote to memory of 2164	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	44
PID 1444 wrote to memory of 2552	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	45
PID 1444 wrote to memory of 2552	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	45
PID 1444 wrote to memory of 2552	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	45
PID 1444 wrote to memory of 2412	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	46
PID 1444 wrote to memory of 2412	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	46
PID 1444 wrote to memory of 2412	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	46
PID 1444 wrote to memory of 1620	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	47
PID 1444 wrote to memory of 1620	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	47
PID 1444 wrote to memory of 1620	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	47
PID 1444 wrote to memory of 2792	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	48
PID 1444 wrote to memory of 2792	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	48
PID 1444 wrote to memory of 2792	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	48
PID 1444 wrote to memory of 376	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	49
PID 1444 wrote to memory of 376	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	49
PID 1444 wrote to memory of 376	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	49
PID 1444 wrote to memory of 1976	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	50
PID 1444 wrote to memory of 1976	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	50
PID 1444 wrote to memory of 1976	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	50
PID 1444 wrote to memory of 2200	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	51
PID 1444 wrote to memory of 2200	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	51
PID 1444 wrote to memory of 2200	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	51
PID 1444 wrote to memory of 2192	1444	JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe	52

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e62d4d45df853dbf694b8f6061c40ad987a16b707dcbbae63613758d5c72992e.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\System\SmAwBUO.exe
  C:\Windows\System\SmAwBUO.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\hhUaWqz.exe
  C:\Windows\System\hhUaWqz.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\UZgDsyO.exe
  C:\Windows\System\UZgDsyO.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\QkGABbw.exe
  C:\Windows\System\QkGABbw.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\CsDHGbY.exe
  C:\Windows\System\CsDHGbY.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\FYktpqG.exe
  C:\Windows\System\FYktpqG.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\FtOzldY.exe
  C:\Windows\System\FtOzldY.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\TfzZdkB.exe
  C:\Windows\System\TfzZdkB.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\vgSjTFC.exe
  C:\Windows\System\vgSjTFC.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\ihCRAeE.exe
  C:\Windows\System\ihCRAeE.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\MIpkEiz.exe
  C:\Windows\System\MIpkEiz.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\DJtkeXe.exe
  C:\Windows\System\DJtkeXe.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\vygrsaF.exe
  C:\Windows\System\vygrsaF.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\SHWRWMT.exe
  C:\Windows\System\SHWRWMT.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\PimyZiU.exe
  C:\Windows\System\PimyZiU.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\jXAPjdh.exe
  C:\Windows\System\jXAPjdh.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\blgjXcI.exe
  C:\Windows\System\blgjXcI.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\ocQWaPR.exe
  C:\Windows\System\ocQWaPR.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\uRblnfa.exe
  C:\Windows\System\uRblnfa.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\paFxDrG.exe
  C:\Windows\System\paFxDrG.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\WCnchfN.exe
  C:\Windows\System\WCnchfN.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\HemkfoJ.exe
  C:\Windows\System\HemkfoJ.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\ACWJwnM.exe
  C:\Windows\System\ACWJwnM.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\woHaGFW.exe
  C:\Windows\System\woHaGFW.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\YprTinZ.exe
  C:\Windows\System\YprTinZ.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\BauQYEq.exe
  C:\Windows\System\BauQYEq.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\rBrDraH.exe
  C:\Windows\System\rBrDraH.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\PmDUaEy.exe
  C:\Windows\System\PmDUaEy.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\VbULbeL.exe
  C:\Windows\System\VbULbeL.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\iSuRHus.exe
  C:\Windows\System\iSuRHus.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\ntAqmdY.exe
  C:\Windows\System\ntAqmdY.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\dEDwhNu.exe
  C:\Windows\System\dEDwhNu.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\VJaiFaf.exe
  C:\Windows\System\VJaiFaf.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\aOFNJgR.exe
  C:\Windows\System\aOFNJgR.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\DLnrkQH.exe
  C:\Windows\System\DLnrkQH.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\KUGtktr.exe
  C:\Windows\System\KUGtktr.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\lSNUyiG.exe
  C:\Windows\System\lSNUyiG.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\AmZxzoR.exe
  C:\Windows\System\AmZxzoR.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\igEugGo.exe
  C:\Windows\System\igEugGo.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\eybrtCP.exe
  C:\Windows\System\eybrtCP.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\yMJPZyv.exe
  C:\Windows\System\yMJPZyv.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\kRnyyPN.exe
  C:\Windows\System\kRnyyPN.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\WBosmWP.exe
  C:\Windows\System\WBosmWP.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\kyIBFTe.exe
  C:\Windows\System\kyIBFTe.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\MfVEzAN.exe
  C:\Windows\System\MfVEzAN.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\LHAmpux.exe
  C:\Windows\System\LHAmpux.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\dboJjbR.exe
  C:\Windows\System\dboJjbR.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\mBxxSfU.exe
  C:\Windows\System\mBxxSfU.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\EzqaTZM.exe
  C:\Windows\System\EzqaTZM.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\wlkngZd.exe
  C:\Windows\System\wlkngZd.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\FwOhgda.exe
  C:\Windows\System\FwOhgda.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\qNCUuJx.exe
  C:\Windows\System\qNCUuJx.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\pEoKwzZ.exe
  C:\Windows\System\pEoKwzZ.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\HDfhIeb.exe
  C:\Windows\System\HDfhIeb.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\zGlSHND.exe
  C:\Windows\System\zGlSHND.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\qFSDzqi.exe
  C:\Windows\System\qFSDzqi.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\jctAlXv.exe
  C:\Windows\System\jctAlXv.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\QRowEdg.exe
  C:\Windows\System\QRowEdg.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\XOQhUmQ.exe
  C:\Windows\System\XOQhUmQ.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\YCkuKsz.exe
  C:\Windows\System\YCkuKsz.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\RTEaPMd.exe
  C:\Windows\System\RTEaPMd.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\JbdMJKR.exe
  C:\Windows\System\JbdMJKR.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\rlWlXFM.exe
  C:\Windows\System\rlWlXFM.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\GOWucjb.exe
  C:\Windows\System\GOWucjb.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\pfxdNYo.exe
  C:\Windows\System\pfxdNYo.exe
  2⤵
  PID:2628
- C:\Windows\System\XbaToSZ.exe
  C:\Windows\System\XbaToSZ.exe
  2⤵
  PID:2100
- C:\Windows\System\hAxxmBB.exe
  C:\Windows\System\hAxxmBB.exe
  2⤵
  PID:2316
- C:\Windows\System\NWGPyxy.exe
  C:\Windows\System\NWGPyxy.exe
  2⤵
  PID:2988
- C:\Windows\System\POmCtUl.exe
  C:\Windows\System\POmCtUl.exe
  2⤵
  PID:2592
- C:\Windows\System\XqePMBT.exe
  C:\Windows\System\XqePMBT.exe
  2⤵
  PID:2564
- C:\Windows\System\lAmFqEm.exe
  C:\Windows\System\lAmFqEm.exe
  2⤵
  PID:3056
- C:\Windows\System\GBklltR.exe
  C:\Windows\System\GBklltR.exe
  2⤵
  PID:2132
- C:\Windows\System\nkHuOjQ.exe
  C:\Windows\System\nkHuOjQ.exe
  2⤵
  PID:2804
- C:\Windows\System\ZxUiFVh.exe
  C:\Windows\System\ZxUiFVh.exe
  2⤵
  PID:2924
- C:\Windows\System\WMKcFCJ.exe
  C:\Windows\System\WMKcFCJ.exe
  2⤵
  PID:2184
- C:\Windows\System\EnWrJmz.exe
  C:\Windows\System\EnWrJmz.exe
  2⤵
  PID:2724
- C:\Windows\System\ErpnsDv.exe
  C:\Windows\System\ErpnsDv.exe
  2⤵
  PID:2596
- C:\Windows\System\SakNbZz.exe
  C:\Windows\System\SakNbZz.exe
  2⤵
  PID:2940
- C:\Windows\System\tNMRRuc.exe
  C:\Windows\System\tNMRRuc.exe
  2⤵
  PID:2020
- C:\Windows\System\dzWuIBt.exe
  C:\Windows\System\dzWuIBt.exe
  2⤵
  PID:2640
- C:\Windows\System\AVHfEwy.exe
  C:\Windows\System\AVHfEwy.exe
  2⤵
  PID:1592
- C:\Windows\System\ZWitiUp.exe
  C:\Windows\System\ZWitiUp.exe
  2⤵
  PID:1260
- C:\Windows\System\xvrxxxZ.exe
  C:\Windows\System\xvrxxxZ.exe
  2⤵
  PID:1980
- C:\Windows\System\etmeSPZ.exe
  C:\Windows\System\etmeSPZ.exe
  2⤵
  PID:588
- C:\Windows\System\vTlqxzs.exe
  C:\Windows\System\vTlqxzs.exe
  2⤵
  PID:1860
- C:\Windows\System\JDOVKUj.exe
  C:\Windows\System\JDOVKUj.exe
  2⤵
  PID:2300
- C:\Windows\System\LuJjuXT.exe
  C:\Windows\System\LuJjuXT.exe
  2⤵
  PID:1208
- C:\Windows\System\reAdFrp.exe
  C:\Windows\System\reAdFrp.exe
  2⤵
  PID:2764
- C:\Windows\System\eZXFtWw.exe
  C:\Windows\System\eZXFtWw.exe
  2⤵
  PID:1396
- C:\Windows\System\tbJdhRH.exe
  C:\Windows\System\tbJdhRH.exe
  2⤵
  PID:2664
- C:\Windows\System\jyBvLDM.exe
  C:\Windows\System\jyBvLDM.exe
  2⤵
  PID:788
- C:\Windows\System\jBizpzA.exe
  C:\Windows\System\jBizpzA.exe
  2⤵
  PID:1036
- C:\Windows\System\TABOmEU.exe
  C:\Windows\System\TABOmEU.exe
  2⤵
  PID:2224
- C:\Windows\System\JmbYQst.exe
  C:\Windows\System\JmbYQst.exe
  2⤵
  PID:1792
- C:\Windows\System\nXAzrVQ.exe
  C:\Windows\System\nXAzrVQ.exe
  2⤵
  PID:2172
- C:\Windows\System\yrsWDIc.exe
  C:\Windows\System\yrsWDIc.exe
  2⤵
  PID:3016
- C:\Windows\System\OYUWVQz.exe
  C:\Windows\System\OYUWVQz.exe
  2⤵
  PID:1360
- C:\Windows\System\KKhyNkL.exe
  C:\Windows\System\KKhyNkL.exe
  2⤵
  PID:3052
- C:\Windows\System\uFjBSem.exe
  C:\Windows\System\uFjBSem.exe
  2⤵
  PID:1204
- C:\Windows\System\YnwQvdz.exe
  C:\Windows\System\YnwQvdz.exe
  2⤵
  PID:1928
- C:\Windows\System\vQIBCFk.exe
  C:\Windows\System\vQIBCFk.exe
  2⤵
  PID:2296
- C:\Windows\System\WgcfUdl.exe
  C:\Windows\System\WgcfUdl.exe
  2⤵
  PID:1556
- C:\Windows\System\hKsqtJH.exe
  C:\Windows\System\hKsqtJH.exe
  2⤵
  PID:2148
- C:\Windows\System\eSuXYCT.exe
  C:\Windows\System\eSuXYCT.exe
  2⤵
  PID:1852
- C:\Windows\System\dvKAHsW.exe
  C:\Windows\System\dvKAHsW.exe
  2⤵
  PID:2516
- C:\Windows\System\HORNXwg.exe
  C:\Windows\System\HORNXwg.exe
  2⤵
  PID:2312
- C:\Windows\System\ctaSMjL.exe
  C:\Windows\System\ctaSMjL.exe
  2⤵
  PID:2320
- C:\Windows\System\svAOjmD.exe
  C:\Windows\System\svAOjmD.exe
  2⤵
  PID:1304
- C:\Windows\System\gqJQvAL.exe
  C:\Windows\System\gqJQvAL.exe
  2⤵
  PID:1532
- C:\Windows\System\HRZTZvC.exe
  C:\Windows\System\HRZTZvC.exe
  2⤵
  PID:2464
- C:\Windows\System\MDIjZtE.exe
  C:\Windows\System\MDIjZtE.exe
  2⤵
  PID:640
- C:\Windows\System\rRHTQoh.exe
  C:\Windows\System\rRHTQoh.exe
  2⤵
  PID:1664
- C:\Windows\System\KQmpyHx.exe
  C:\Windows\System\KQmpyHx.exe
  2⤵
  PID:1512
- C:\Windows\System\YQRcHAR.exe
  C:\Windows\System\YQRcHAR.exe
  2⤵
  PID:1648
- C:\Windows\System\mvVYeap.exe
  C:\Windows\System\mvVYeap.exe
  2⤵
  PID:2708
- C:\Windows\System\kCMDrHf.exe
  C:\Windows\System\kCMDrHf.exe
  2⤵
  PID:2416
- C:\Windows\System\VNWJRoh.exe
  C:\Windows\System\VNWJRoh.exe
  2⤵
  PID:2376
- C:\Windows\System\HxMRZrc.exe
  C:\Windows\System\HxMRZrc.exe
  2⤵
  PID:1788
- C:\Windows\System\cIrOpJz.exe
  C:\Windows\System\cIrOpJz.exe
  2⤵
  PID:3064
- C:\Windows\System\eBiSgHB.exe
  C:\Windows\System\eBiSgHB.exe
  2⤵
  PID:1348
- C:\Windows\System\grkUQKn.exe
  C:\Windows\System\grkUQKn.exe
  2⤵
  PID:2840
- C:\Windows\System\ALQDKvi.exe
  C:\Windows\System\ALQDKvi.exe
  2⤵
  PID:2608
- C:\Windows\System\GqnzeQr.exe
  C:\Windows\System\GqnzeQr.exe
  2⤵
  PID:2688
- C:\Windows\System\XbrehXe.exe
  C:\Windows\System\XbrehXe.exe
  2⤵
  PID:2816
- C:\Windows\System\BWbuBQK.exe
  C:\Windows\System\BWbuBQK.exe
  2⤵
  PID:536
- C:\Windows\System\YZpVicH.exe
  C:\Windows\System\YZpVicH.exe
  2⤵
  PID:2800
- C:\Windows\System\AQwuKzj.exe
  C:\Windows\System\AQwuKzj.exe
  2⤵
  PID:2780
- C:\Windows\System\Pikizzq.exe
  C:\Windows\System\Pikizzq.exe
  2⤵
  PID:2776
- C:\Windows\System\WOMpnfv.exe
  C:\Windows\System\WOMpnfv.exe
  2⤵
  PID:2908
- C:\Windows\System\coEYkcO.exe
  C:\Windows\System\coEYkcO.exe
  2⤵
  PID:2432
- C:\Windows\System\ywAgvqQ.exe
  C:\Windows\System\ywAgvqQ.exe
  2⤵
  PID:264
- C:\Windows\System\UGuJHXo.exe
  C:\Windows\System\UGuJHXo.exe
  2⤵
  PID:1316
- C:\Windows\System\RjhuvTU.exe
  C:\Windows\System\RjhuvTU.exe
  2⤵
  PID:852
- C:\Windows\System\KREdAsu.exe
  C:\Windows\System\KREdAsu.exe
  2⤵
  PID:1516
- C:\Windows\System\fRJrLzm.exe
  C:\Windows\System\fRJrLzm.exe
  2⤵
  PID:820
- C:\Windows\System\kjtmjsY.exe
  C:\Windows\System\kjtmjsY.exe
  2⤵
  PID:1856
- C:\Windows\System\UNXMlFr.exe
  C:\Windows\System\UNXMlFr.exe
  2⤵
  PID:2264
- C:\Windows\System\cCqXUmC.exe
  C:\Windows\System\cCqXUmC.exe
  2⤵
  PID:884
- C:\Windows\System\cHYRsfd.exe
  C:\Windows\System\cHYRsfd.exe
  2⤵
  PID:2384
- C:\Windows\System\fHOBbXl.exe
  C:\Windows\System\fHOBbXl.exe
  2⤵
  PID:708
- C:\Windows\System\yYvHrZs.exe
  C:\Windows\System\yYvHrZs.exe
  2⤵
  PID:2748
- C:\Windows\System\BrZTntU.exe
  C:\Windows\System\BrZTntU.exe
  2⤵
  PID:2824
- C:\Windows\System\uyeeuad.exe
  C:\Windows\System\uyeeuad.exe
  2⤵
  PID:2060
- C:\Windows\System\yXdjPyJ.exe
  C:\Windows\System\yXdjPyJ.exe
  2⤵
  PID:2308
- C:\Windows\System\DIQWazJ.exe
  C:\Windows\System\DIQWazJ.exe
  2⤵
  PID:2832
- C:\Windows\System\vUtCcmd.exe
  C:\Windows\System\vUtCcmd.exe
  2⤵
  PID:1436
- C:\Windows\System\EAYYHwA.exe
  C:\Windows\System\EAYYHwA.exe
  2⤵
  PID:2760
- C:\Windows\System\dbNYOfy.exe
  C:\Windows\System\dbNYOfy.exe
  2⤵
  PID:2068
- C:\Windows\System\wTIcgWx.exe
  C:\Windows\System\wTIcgWx.exe
  2⤵
  PID:2436
- C:\Windows\System\GmpRKXO.exe
  C:\Windows\System\GmpRKXO.exe
  2⤵
  PID:2756
- C:\Windows\System\LSnssLs.exe
  C:\Windows\System\LSnssLs.exe
  2⤵
  PID:2272
- C:\Windows\System\pYqBlOi.exe
  C:\Windows\System\pYqBlOi.exe
  2⤵
  PID:1764
- C:\Windows\System\GHWvpkI.exe
  C:\Windows\System\GHWvpkI.exe
  2⤵
  PID:1548
- C:\Windows\System\RAlrrEL.exe
  C:\Windows\System\RAlrrEL.exe
  2⤵
  PID:2544
- C:\Windows\System\KChnWZN.exe
  C:\Windows\System\KChnWZN.exe
  2⤵
  PID:2968
- C:\Windows\System\VtRclWP.exe
  C:\Windows\System\VtRclWP.exe
  2⤵
  PID:1724
- C:\Windows\System\ZpbOniU.exe
  C:\Windows\System\ZpbOniU.exe
  2⤵
  PID:2120
- C:\Windows\System\KjzmGFs.exe
  C:\Windows\System\KjzmGFs.exe
  2⤵
  PID:2576
- C:\Windows\System\ZkIXEka.exe
  C:\Windows\System\ZkIXEka.exe
  2⤵
  PID:1844
- C:\Windows\System\fujIcJd.exe
  C:\Windows\System\fujIcJd.exe
  2⤵
  PID:2180
- C:\Windows\System\sfFREhZ.exe
  C:\Windows\System\sfFREhZ.exe
  2⤵
  PID:972
- C:\Windows\System\VdDUQIH.exe
  C:\Windows\System\VdDUQIH.exe
  2⤵
  PID:2236
- C:\Windows\System\VWgQVRf.exe
  C:\Windows\System\VWgQVRf.exe
  2⤵
  PID:3020
- C:\Windows\System\JoVhKsU.exe
  C:\Windows\System\JoVhKsU.exe
  2⤵
  PID:1728
- C:\Windows\System\wVMHgEx.exe
  C:\Windows\System\wVMHgEx.exe
  2⤵
  PID:2140
- C:\Windows\System\SwbQaeu.exe
  C:\Windows\System\SwbQaeu.exe
  2⤵
  PID:480
- C:\Windows\System\qNCsmcb.exe
  C:\Windows\System\qNCsmcb.exe
  2⤵
  PID:2064
- C:\Windows\System\HqOUdMl.exe
  C:\Windows\System\HqOUdMl.exe
  2⤵
  PID:2620
- C:\Windows\System\dXKDyih.exe
  C:\Windows\System\dXKDyih.exe
  2⤵
  PID:2632
- C:\Windows\System\uqwhzNS.exe
  C:\Windows\System\uqwhzNS.exe
  2⤵
  PID:2096
- C:\Windows\System\nccRMRV.exe
  C:\Windows\System\nccRMRV.exe
  2⤵
  PID:1972
- C:\Windows\System\uVcVeHx.exe
  C:\Windows\System\uVcVeHx.exe
  2⤵
  PID:2876
- C:\Windows\System\IpxJUVE.exe
  C:\Windows\System\IpxJUVE.exe
  2⤵
  PID:2916
- C:\Windows\System\FBeidsU.exe
  C:\Windows\System\FBeidsU.exe
  2⤵
  PID:956
- C:\Windows\System\WNzUIDD.exe
  C:\Windows\System\WNzUIDD.exe
  2⤵
  PID:3088
- C:\Windows\System\NBHKAiS.exe
  C:\Windows\System\NBHKAiS.exe
  2⤵
  PID:3108
- C:\Windows\System\ykFeGUP.exe
  C:\Windows\System\ykFeGUP.exe
  2⤵
  PID:3124
- C:\Windows\System\zICAlOx.exe
  C:\Windows\System\zICAlOx.exe
  2⤵
  PID:3140
- C:\Windows\System\nmsxukE.exe
  C:\Windows\System\nmsxukE.exe
  2⤵
  PID:3156
- C:\Windows\System\MwNZxwm.exe
  C:\Windows\System\MwNZxwm.exe
  2⤵
  PID:3172
- C:\Windows\System\qpihpnY.exe
  C:\Windows\System\qpihpnY.exe
  2⤵
  PID:3188
- C:\Windows\System\FQVNHzh.exe
  C:\Windows\System\FQVNHzh.exe
  2⤵
  PID:3220
- C:\Windows\System\YMlYLNd.exe
  C:\Windows\System\YMlYLNd.exe
  2⤵
  PID:3236
- C:\Windows\System\DlCKIFm.exe
  C:\Windows\System\DlCKIFm.exe
  2⤵
  PID:3256
- C:\Windows\System\fMnbYFr.exe
  C:\Windows\System\fMnbYFr.exe
  2⤵
  PID:3272
- C:\Windows\System\cggbJqg.exe
  C:\Windows\System\cggbJqg.exe
  2⤵
  PID:3288
- C:\Windows\System\OezuRzZ.exe
  C:\Windows\System\OezuRzZ.exe
  2⤵
  PID:3304
- C:\Windows\System\YyRVRxh.exe
  C:\Windows\System\YyRVRxh.exe
  2⤵
  PID:3320
- C:\Windows\System\xZcalWi.exe
  C:\Windows\System\xZcalWi.exe
  2⤵
  PID:3336
- C:\Windows\System\UZoUfVK.exe
  C:\Windows\System\UZoUfVK.exe
  2⤵
  PID:3352
- C:\Windows\System\rlVVhhn.exe
  C:\Windows\System\rlVVhhn.exe
  2⤵
  PID:3372
- C:\Windows\System\QpLTJRh.exe
  C:\Windows\System\QpLTJRh.exe
  2⤵
  PID:3388
- C:\Windows\System\yPHPMqP.exe
  C:\Windows\System\yPHPMqP.exe
  2⤵
  PID:3404
- C:\Windows\System\RlQmGwT.exe
  C:\Windows\System\RlQmGwT.exe
  2⤵
  PID:3420
- C:\Windows\System\TbwTZcd.exe
  C:\Windows\System\TbwTZcd.exe
  2⤵
  PID:3436
- C:\Windows\System\yUduVYX.exe
  C:\Windows\System\yUduVYX.exe
  2⤵
  PID:3452
- C:\Windows\System\qpSmOov.exe
  C:\Windows\System\qpSmOov.exe
  2⤵
  PID:3468
- C:\Windows\System\jWsFbbV.exe
  C:\Windows\System\jWsFbbV.exe
  2⤵
  PID:3484
- C:\Windows\System\rXjCIaO.exe
  C:\Windows\System\rXjCIaO.exe
  2⤵
  PID:3520
- C:\Windows\System\TxgbTNW.exe
  C:\Windows\System\TxgbTNW.exe
  2⤵
  PID:3612
- C:\Windows\System\cYChorv.exe
  C:\Windows\System\cYChorv.exe
  2⤵
  PID:3628
- C:\Windows\System\waCxRBt.exe
  C:\Windows\System\waCxRBt.exe
  2⤵
  PID:3644
- C:\Windows\System\TvXSFSZ.exe
  C:\Windows\System\TvXSFSZ.exe
  2⤵
  PID:3660
- C:\Windows\System\hJpJadb.exe
  C:\Windows\System\hJpJadb.exe
  2⤵
  PID:3676
- C:\Windows\System\EFeIIJZ.exe
  C:\Windows\System\EFeIIJZ.exe
  2⤵
  PID:3692
- C:\Windows\System\OytcfWH.exe
  C:\Windows\System\OytcfWH.exe
  2⤵
  PID:3708
- C:\Windows\System\UEzWfZP.exe
  C:\Windows\System\UEzWfZP.exe
  2⤵
  PID:3724
- C:\Windows\System\EbBYctz.exe
  C:\Windows\System\EbBYctz.exe
  2⤵
  PID:3740
- C:\Windows\System\kcMXPBS.exe
  C:\Windows\System\kcMXPBS.exe
  2⤵
  PID:3756
- C:\Windows\System\IxVHtCc.exe
  C:\Windows\System\IxVHtCc.exe
  2⤵
  PID:3772
- C:\Windows\System\gZCJWlz.exe
  C:\Windows\System\gZCJWlz.exe
  2⤵
  PID:3788
- C:\Windows\System\SJwGFmT.exe
  C:\Windows\System\SJwGFmT.exe
  2⤵
  PID:3804
- C:\Windows\System\ELUqtaW.exe
  C:\Windows\System\ELUqtaW.exe
  2⤵
  PID:3820
- C:\Windows\System\lDvABpJ.exe
  C:\Windows\System\lDvABpJ.exe
  2⤵
  PID:3836
- C:\Windows\System\mJorKjm.exe
  C:\Windows\System\mJorKjm.exe
  2⤵
  PID:3852
- C:\Windows\System\AdxlwLD.exe
  C:\Windows\System\AdxlwLD.exe
  2⤵
  PID:3868
- C:\Windows\System\sicLtbd.exe
  C:\Windows\System\sicLtbd.exe
  2⤵
  PID:3884
- C:\Windows\System\txapgki.exe
  C:\Windows\System\txapgki.exe
  2⤵
  PID:3900
- C:\Windows\System\liNBzOB.exe
  C:\Windows\System\liNBzOB.exe
  2⤵
  PID:3916
- C:\Windows\System\QnbUBEb.exe
  C:\Windows\System\QnbUBEb.exe
  2⤵
  PID:3932
- C:\Windows\System\DdqePvP.exe
  C:\Windows\System\DdqePvP.exe
  2⤵
  PID:3948
- C:\Windows\System\WOeLPTL.exe
  C:\Windows\System\WOeLPTL.exe
  2⤵
  PID:3964
- C:\Windows\System\ainhpEE.exe
  C:\Windows\System\ainhpEE.exe
  2⤵
  PID:3980
- C:\Windows\System\UtKjibm.exe
  C:\Windows\System\UtKjibm.exe
  2⤵
  PID:3996
- C:\Windows\System\EdqPTpM.exe
  C:\Windows\System\EdqPTpM.exe
  2⤵
  PID:4012
- C:\Windows\System\pQNedPb.exe
  C:\Windows\System\pQNedPb.exe
  2⤵
  PID:4028
- C:\Windows\System\saSADLo.exe
  C:\Windows\System\saSADLo.exe
  2⤵
  PID:4044
- C:\Windows\System\nOSZmkW.exe
  C:\Windows\System\nOSZmkW.exe
  2⤵
  PID:4060
- C:\Windows\System\WGyOAOy.exe
  C:\Windows\System\WGyOAOy.exe
  2⤵
  PID:4076
- C:\Windows\System\xOpzUnQ.exe
  C:\Windows\System\xOpzUnQ.exe
  2⤵
  PID:4092
- C:\Windows\System\BOwZcSc.exe
  C:\Windows\System\BOwZcSc.exe
  2⤵
  PID:1016
- C:\Windows\System\YlfpZfy.exe
  C:\Windows\System\YlfpZfy.exe
  2⤵
  PID:3100
- C:\Windows\System\sxxldLG.exe
  C:\Windows\System\sxxldLG.exe
  2⤵
  PID:2280
- C:\Windows\System\BNoxVFH.exe
  C:\Windows\System\BNoxVFH.exe
  2⤵
  PID:1948
- C:\Windows\System\FvYsOBj.exe
  C:\Windows\System\FvYsOBj.exe
  2⤵
  PID:3116
- C:\Windows\System\PqaSsVE.exe
  C:\Windows\System\PqaSsVE.exe
  2⤵
  PID:3148
- C:\Windows\System\wDnagkM.exe
  C:\Windows\System\wDnagkM.exe
  2⤵
  PID:592
- C:\Windows\System\hmCBaof.exe
  C:\Windows\System\hmCBaof.exe
  2⤵
  PID:3204
- C:\Windows\System\JICXnwY.exe
  C:\Windows\System\JICXnwY.exe
  2⤵
  PID:3232
- C:\Windows\System\DBItCCL.exe
  C:\Windows\System\DBItCCL.exe
  2⤵
  PID:3332
- C:\Windows\System\ocTbdgG.exe
  C:\Windows\System\ocTbdgG.exe
  2⤵
  PID:3396
- C:\Windows\System\vDZCAYQ.exe
  C:\Windows\System\vDZCAYQ.exe
  2⤵
  PID:3248
- C:\Windows\System\dlJBtHx.exe
  C:\Windows\System\dlJBtHx.exe
  2⤵
  PID:3312
- C:\Windows\System\OsySOJu.exe
  C:\Windows\System\OsySOJu.exe
  2⤵
  PID:3380
- C:\Windows\System\LlKGTAu.exe
  C:\Windows\System\LlKGTAu.exe
  2⤵
  PID:3444
- C:\Windows\System\BdNLBYb.exe
  C:\Windows\System\BdNLBYb.exe
  2⤵
  PID:3264
- C:\Windows\System\qBxhSkv.exe
  C:\Windows\System\qBxhSkv.exe
  2⤵
  PID:3432
- C:\Windows\System\EQgjetG.exe
  C:\Windows\System\EQgjetG.exe
  2⤵
  PID:3552
- C:\Windows\System\RuhIIXh.exe
  C:\Windows\System\RuhIIXh.exe
  2⤵
  PID:3568
- C:\Windows\System\cwWEzzB.exe
  C:\Windows\System\cwWEzzB.exe
  2⤵
  PID:3584
- C:\Windows\System\BaAiPkD.exe
  C:\Windows\System\BaAiPkD.exe
  2⤵
  PID:3600
- C:\Windows\System\znjyVXq.exe
  C:\Windows\System\znjyVXq.exe
  2⤵
  PID:3656
- C:\Windows\System\NjOechJ.exe
  C:\Windows\System\NjOechJ.exe
  2⤵
  PID:3720
- C:\Windows\System\PnXihqL.exe
  C:\Windows\System\PnXihqL.exe
  2⤵
  PID:3752
- C:\Windows\System\dMdTsad.exe
  C:\Windows\System\dMdTsad.exe
  2⤵
  PID:3812
- C:\Windows\System\ZjzQQMr.exe
  C:\Windows\System\ZjzQQMr.exe
  2⤵
  PID:3908
- C:\Windows\System\bdJMxIE.exe
  C:\Windows\System\bdJMxIE.exe
  2⤵
  PID:3976
- C:\Windows\System\DCBMGpq.exe
  C:\Windows\System\DCBMGpq.exe
  2⤵
  PID:3988
- C:\Windows\System\AVgrWMR.exe
  C:\Windows\System\AVgrWMR.exe
  2⤵
  PID:3640
- C:\Windows\System\xbzNSdM.exe
  C:\Windows\System\xbzNSdM.exe
  2⤵
  PID:3704
- C:\Windows\System\IOYTHCd.exe
  C:\Windows\System\IOYTHCd.exe
  2⤵
  PID:3768
- C:\Windows\System\XJEfLpu.exe
  C:\Windows\System\XJEfLpu.exe
  2⤵
  PID:3832
- C:\Windows\System\CbhppAk.exe
  C:\Windows\System\CbhppAk.exe
  2⤵
  PID:3924
- C:\Windows\System\SyEwCrf.exe
  C:\Windows\System\SyEwCrf.exe
  2⤵
  PID:4020
- C:\Windows\System\uBBIfsh.exe
  C:\Windows\System\uBBIfsh.exe
  2⤵
  PID:4072
- C:\Windows\System\zBzMAZQ.exe
  C:\Windows\System\zBzMAZQ.exe
  2⤵
  PID:3132
- C:\Windows\System\pVTEwCQ.exe
  C:\Windows\System\pVTEwCQ.exe
  2⤵
  PID:3180
- C:\Windows\System\wgvMNaL.exe
  C:\Windows\System\wgvMNaL.exe
  2⤵
  PID:4068
- C:\Windows\System\yxTSDHg.exe
  C:\Windows\System\yxTSDHg.exe
  2⤵
  PID:4088
- C:\Windows\System\VWgMEWv.exe
  C:\Windows\System\VWgMEWv.exe
  2⤵
  PID:696
- C:\Windows\System\JpHghcL.exe
  C:\Windows\System\JpHghcL.exe
  2⤵
  PID:3200
- C:\Windows\System\eDSJKad.exe
  C:\Windows\System\eDSJKad.exe
  2⤵
  PID:3280
- C:\Windows\System\TBgiccX.exe
  C:\Windows\System\TBgiccX.exe
  2⤵
  PID:3460
- C:\Windows\System\uFisXoT.exe
  C:\Windows\System\uFisXoT.exe
  2⤵
  PID:3596
- C:\Windows\System\rpNCzrU.exe
  C:\Windows\System\rpNCzrU.exe
  2⤵
  PID:3344
- C:\Windows\System\BSiOVVG.exe
  C:\Windows\System\BSiOVVG.exe
  2⤵
  PID:4008
- C:\Windows\System\lPppgXl.exe
  C:\Windows\System\lPppgXl.exe
  2⤵
  PID:2116
- C:\Windows\System\rtJNxjy.exe
  C:\Windows\System\rtJNxjy.exe
  2⤵
  PID:3604
- C:\Windows\System\fBQdVqU.exe
  C:\Windows\System\fBQdVqU.exe
  2⤵
  PID:3892
- C:\Windows\System\ziuexWf.exe
  C:\Windows\System\ziuexWf.exe
  2⤵
  PID:3476
- C:\Windows\System\pzxOalk.exe
  C:\Windows\System\pzxOalk.exe
  2⤵
  PID:3624
- C:\Windows\System\dGowGJg.exe
  C:\Windows\System\dGowGJg.exe
  2⤵
  PID:3780
- C:\Windows\System\tiPCaLD.exe
  C:\Windows\System\tiPCaLD.exe
  2⤵
  PID:4040
- C:\Windows\System\uSkecOd.exe
  C:\Windows\System\uSkecOd.exe
  2⤵
  PID:4084
- C:\Windows\System\xRfPcFq.exe
  C:\Windows\System\xRfPcFq.exe
  2⤵
  PID:3416
- C:\Windows\System\feEuBLo.exe
  C:\Windows\System\feEuBLo.exe
  2⤵
  PID:3944
- C:\Windows\System\kdkyyrk.exe
  C:\Windows\System\kdkyyrk.exe
  2⤵
  PID:3580
- C:\Windows\System\dHXLTnV.exe
  C:\Windows\System\dHXLTnV.exe
  2⤵
  PID:4108
- C:\Windows\System\jwxjGqU.exe
  C:\Windows\System\jwxjGqU.exe
  2⤵
  PID:4124
- C:\Windows\System\oXlREPy.exe
  C:\Windows\System\oXlREPy.exe
  2⤵
  PID:4140
- C:\Windows\System\oDWcblo.exe
  C:\Windows\System\oDWcblo.exe
  2⤵
  PID:4156
- C:\Windows\System\wOFotSt.exe
  C:\Windows\System\wOFotSt.exe
  2⤵
  PID:4172
- C:\Windows\System\kjwxjFV.exe
  C:\Windows\System\kjwxjFV.exe
  2⤵
  PID:4188
- C:\Windows\System\eiXZRPb.exe
  C:\Windows\System\eiXZRPb.exe
  2⤵
  PID:4204
- C:\Windows\System\aEBNVwC.exe
  C:\Windows\System\aEBNVwC.exe
  2⤵
  PID:4220
- C:\Windows\System\xcOvuIb.exe
  C:\Windows\System\xcOvuIb.exe
  2⤵
  PID:4236
- C:\Windows\System\tsbRZMk.exe
  C:\Windows\System\tsbRZMk.exe
  2⤵
  PID:4252
- C:\Windows\System\NtiKtGf.exe
  C:\Windows\System\NtiKtGf.exe
  2⤵
  PID:4268
- C:\Windows\System\syRYzqH.exe
  C:\Windows\System\syRYzqH.exe
  2⤵
  PID:4284
- C:\Windows\System\VgIjTSJ.exe
  C:\Windows\System\VgIjTSJ.exe
  2⤵
  PID:4300
- C:\Windows\System\oBKcuMP.exe
  C:\Windows\System\oBKcuMP.exe
  2⤵
  PID:4316
- C:\Windows\System\LBMOiwf.exe
  C:\Windows\System\LBMOiwf.exe
  2⤵
  PID:4332
- C:\Windows\System\rtLxTRC.exe
  C:\Windows\System\rtLxTRC.exe
  2⤵
  PID:4348
- C:\Windows\System\JkSVmjO.exe
  C:\Windows\System\JkSVmjO.exe
  2⤵
  PID:4364
- C:\Windows\System\YvkOAwG.exe
  C:\Windows\System\YvkOAwG.exe
  2⤵
  PID:4380
- C:\Windows\System\ChFcCRV.exe
  C:\Windows\System\ChFcCRV.exe
  2⤵
  PID:4396
- C:\Windows\System\afivxgy.exe
  C:\Windows\System\afivxgy.exe
  2⤵
  PID:4412
- C:\Windows\System\WZhZcKw.exe
  C:\Windows\System\WZhZcKw.exe
  2⤵
  PID:4428
- C:\Windows\System\stgUjnL.exe
  C:\Windows\System\stgUjnL.exe
  2⤵
  PID:4444
- C:\Windows\System\nwErWof.exe
  C:\Windows\System\nwErWof.exe
  2⤵
  PID:4460
- C:\Windows\System\VEpUQni.exe
  C:\Windows\System\VEpUQni.exe
  2⤵
  PID:4476
- C:\Windows\System\RnLkCWV.exe
  C:\Windows\System\RnLkCWV.exe
  2⤵
  PID:4492
- C:\Windows\System\wuZUtNw.exe
  C:\Windows\System\wuZUtNw.exe
  2⤵
  PID:4508
- C:\Windows\System\dphhqeJ.exe
  C:\Windows\System\dphhqeJ.exe
  2⤵
  PID:4524
- C:\Windows\System\ZGCeznb.exe
  C:\Windows\System\ZGCeznb.exe
  2⤵
  PID:4548
- C:\Windows\System\EZHKMVs.exe
  C:\Windows\System\EZHKMVs.exe
  2⤵
  PID:4628
- C:\Windows\System\yBFoECC.exe
  C:\Windows\System\yBFoECC.exe
  2⤵
  PID:4644
- C:\Windows\System\kKMfunI.exe
  C:\Windows\System\kKMfunI.exe
  2⤵
  PID:4660
- C:\Windows\System\otdXXuH.exe
  C:\Windows\System\otdXXuH.exe
  2⤵
  PID:4676
- C:\Windows\System\apYKmVY.exe
  C:\Windows\System\apYKmVY.exe
  2⤵
  PID:4692
- C:\Windows\System\bVGMjef.exe
  C:\Windows\System\bVGMjef.exe
  2⤵
  PID:4708
- C:\Windows\System\AvzfUEN.exe
  C:\Windows\System\AvzfUEN.exe
  2⤵
  PID:4724
- C:\Windows\System\yfmPRql.exe
  C:\Windows\System\yfmPRql.exe
  2⤵
  PID:4740
- C:\Windows\System\HYYXAiB.exe
  C:\Windows\System\HYYXAiB.exe
  2⤵
  PID:4756
- C:\Windows\System\eODZzGe.exe
  C:\Windows\System\eODZzGe.exe
  2⤵
  PID:4772
- C:\Windows\System\dxSMHvs.exe
  C:\Windows\System\dxSMHvs.exe
  2⤵
  PID:4788
- C:\Windows\System\SclqbWW.exe
  C:\Windows\System\SclqbWW.exe
  2⤵
  PID:4804
- C:\Windows\System\JvJDWPb.exe
  C:\Windows\System\JvJDWPb.exe
  2⤵
  PID:4820
- C:\Windows\System\aPGpyNz.exe
  C:\Windows\System\aPGpyNz.exe
  2⤵
  PID:4836
- C:\Windows\System\eEFMhPJ.exe
  C:\Windows\System\eEFMhPJ.exe
  2⤵
  PID:4852
- C:\Windows\System\UktamUH.exe
  C:\Windows\System\UktamUH.exe
  2⤵
  PID:4868
- C:\Windows\System\qxNuYHU.exe
  C:\Windows\System\qxNuYHU.exe
  2⤵
  PID:4884
- C:\Windows\System\tIUhwqT.exe
  C:\Windows\System\tIUhwqT.exe
  2⤵
  PID:4900
- C:\Windows\System\bnOGklb.exe
  C:\Windows\System\bnOGklb.exe
  2⤵
  PID:4916
- C:\Windows\System\MuSlSbT.exe
  C:\Windows\System\MuSlSbT.exe
  2⤵
  PID:4932
- C:\Windows\System\ZyRvgUC.exe
  C:\Windows\System\ZyRvgUC.exe
  2⤵
  PID:4948
- C:\Windows\System\gJLlmmC.exe
  C:\Windows\System\gJLlmmC.exe
  2⤵
  PID:4964
- C:\Windows\System\IylXQHs.exe
  C:\Windows\System\IylXQHs.exe
  2⤵
  PID:4980
- C:\Windows\System\ahxoPPg.exe
  C:\Windows\System\ahxoPPg.exe
  2⤵
  PID:4996
- C:\Windows\System\mcTQoUu.exe
  C:\Windows\System\mcTQoUu.exe
  2⤵
  PID:5012
- C:\Windows\System\GbTZZqU.exe
  C:\Windows\System\GbTZZqU.exe
  2⤵
  PID:5028
- C:\Windows\System\ioFJtRp.exe
  C:\Windows\System\ioFJtRp.exe
  2⤵
  PID:5044
- C:\Windows\System\OfXSXpk.exe
  C:\Windows\System\OfXSXpk.exe
  2⤵
  PID:5060
- C:\Windows\System\ebbwMmq.exe
  C:\Windows\System\ebbwMmq.exe
  2⤵
  PID:5076
- C:\Windows\System\biyzaGL.exe
  C:\Windows\System\biyzaGL.exe
  2⤵
  PID:5092
- C:\Windows\System\qaXgbRa.exe
  C:\Windows\System\qaXgbRa.exe
  2⤵
  PID:5108
- C:\Windows\System\dFhxHjB.exe
  C:\Windows\System\dFhxHjB.exe
  2⤵
  PID:3184
- C:\Windows\System\HLQooYv.exe
  C:\Windows\System\HLQooYv.exe
  2⤵
  PID:4116
- C:\Windows\System\zlYdgVb.exe
  C:\Windows\System\zlYdgVb.exe
  2⤵
  PID:3700
- C:\Windows\System\LkVcGoW.exe
  C:\Windows\System\LkVcGoW.exe
  2⤵
  PID:4180
- C:\Windows\System\kCVekFt.exe
  C:\Windows\System\kCVekFt.exe
  2⤵
  PID:3960
- C:\Windows\System\eFoDddE.exe
  C:\Windows\System\eFoDddE.exe
  2⤵
  PID:4276
- C:\Windows\System\TATKOJN.exe
  C:\Windows\System\TATKOJN.exe
  2⤵
  PID:4312
- C:\Windows\System\olNMBFE.exe
  C:\Windows\System\olNMBFE.exe
  2⤵
  PID:4372
- C:\Windows\System\HvKNlSD.exe
  C:\Windows\System\HvKNlSD.exe
  2⤵
  PID:4408
- C:\Windows\System\qsYlhlx.exe
  C:\Windows\System\qsYlhlx.exe
  2⤵
  PID:4472
- C:\Windows\System\mHHZwxw.exe
  C:\Windows\System\mHHZwxw.exe
  2⤵
  PID:3876
- C:\Windows\System\cLXlLiw.exe
  C:\Windows\System\cLXlLiw.exe
  2⤵
  PID:3368
- C:\Windows\System\CBRHnGt.exe
  C:\Windows\System\CBRHnGt.exe
  2⤵
  PID:268
- C:\Windows\System\inmSijr.exe
  C:\Windows\System\inmSijr.exe
  2⤵
  PID:3736
- C:\Windows\System\AlUEAZe.exe
  C:\Windows\System\AlUEAZe.exe
  2⤵
  PID:4420
- C:\Windows\System\kQkMspK.exe
  C:\Windows\System\kQkMspK.exe
  2⤵
  PID:4052
- C:\Windows\System\SMPFpBb.exe
  C:\Windows\System\SMPFpBb.exe
  2⤵
  PID:4132
- C:\Windows\System\mLptKqm.exe
  C:\Windows\System\mLptKqm.exe
  2⤵
  PID:4228
- C:\Windows\System\wrVvTfp.exe
  C:\Windows\System\wrVvTfp.exe
  2⤵
  PID:4292
- C:\Windows\System\YVmhXDY.exe
  C:\Windows\System\YVmhXDY.exe
  2⤵
  PID:4356
- C:\Windows\System\vIotqxm.exe
  C:\Windows\System\vIotqxm.exe
  2⤵
  PID:4424
- C:\Windows\System\MnZtEWo.exe
  C:\Windows\System\MnZtEWo.exe
  2⤵
  PID:4520
- C:\Windows\System\yrEbMAr.exe
  C:\Windows\System\yrEbMAr.exe
  2⤵
  PID:4564
- C:\Windows\System\WzOCFny.exe
  C:\Windows\System\WzOCFny.exe
  2⤵
  PID:4576
- C:\Windows\System\wlppgjS.exe
  C:\Windows\System\wlppgjS.exe
  2⤵
  PID:4596
- C:\Windows\System\MMATySu.exe
  C:\Windows\System\MMATySu.exe
  2⤵
  PID:4612
- C:\Windows\System\FsjShrw.exe
  C:\Windows\System\FsjShrw.exe
  2⤵
  PID:4640
- C:\Windows\System\DZyaoHY.exe
  C:\Windows\System\DZyaoHY.exe
  2⤵
  PID:4704
- C:\Windows\System\zFgyzSf.exe
  C:\Windows\System\zFgyzSf.exe
  2⤵
  PID:4796
- C:\Windows\System\ayWOwlY.exe
  C:\Windows\System\ayWOwlY.exe
  2⤵
  PID:4748
- C:\Windows\System\aAZvVet.exe
  C:\Windows\System\aAZvVet.exe
  2⤵
  PID:4864
- C:\Windows\System\pFkPUOk.exe
  C:\Windows\System\pFkPUOk.exe
  2⤵
  PID:4716
- C:\Windows\System\dtljFfP.exe
  C:\Windows\System\dtljFfP.exe
  2⤵
  PID:4780
- C:\Windows\System\nlDIkbD.exe
  C:\Windows\System\nlDIkbD.exe
  2⤵
  PID:4844
- C:\Windows\System\eOluTQU.exe
  C:\Windows\System\eOluTQU.exe
  2⤵
  PID:4960
- C:\Windows\System\qnlSYDT.exe
  C:\Windows\System\qnlSYDT.exe
  2⤵
  PID:5024
- C:\Windows\System\hPjOXrK.exe
  C:\Windows\System\hPjOXrK.exe
  2⤵
  PID:4912
- C:\Windows\System\DvTNZjE.exe
  C:\Windows\System\DvTNZjE.exe
  2⤵
  PID:5088
- C:\Windows\System\waSCgoa.exe
  C:\Windows\System\waSCgoa.exe
  2⤵
  PID:4976
- C:\Windows\System\CjznEFa.exe
  C:\Windows\System\CjznEFa.exe
  2⤵
  PID:5008
- C:\Windows\System\ztGwuVQ.exe
  C:\Windows\System\ztGwuVQ.exe
  2⤵
  PID:4216
- C:\Windows\System\KOdwZKg.exe
  C:\Windows\System\KOdwZKg.exe
  2⤵
  PID:5100
- C:\Windows\System\IenPxTG.exe
  C:\Windows\System\IenPxTG.exe
  2⤵
  PID:3512
- C:\Windows\System\JjoMvJz.exe
  C:\Windows\System\JjoMvJz.exe
  2⤵
  PID:4436
- C:\Windows\System\tbxhlsu.exe
  C:\Windows\System\tbxhlsu.exe
  2⤵
  PID:4504
- C:\Windows\System\ojvKJIG.exe
  C:\Windows\System\ojvKJIG.exe
  2⤵
  PID:672
- C:\Windows\System\UXrWuhm.exe
  C:\Windows\System\UXrWuhm.exe
  2⤵
  PID:4100
- C:\Windows\System\CTEkpbG.exe
  C:\Windows\System\CTEkpbG.exe
  2⤵
  PID:4388
- C:\Windows\System\rSDxZsw.exe
  C:\Windows\System\rSDxZsw.exe
  2⤵
  PID:3576
- C:\Windows\System\lztyXjb.exe
  C:\Windows\System\lztyXjb.exe
  2⤵
  PID:3168
- C:\Windows\System\HwKQzzV.exe
  C:\Windows\System\HwKQzzV.exe
  2⤵
  PID:4484
- C:\Windows\System\qTsjxBp.exe
  C:\Windows\System\qTsjxBp.exe
  2⤵
  PID:4560
- C:\Windows\System\xWEBjxl.exe
  C:\Windows\System\xWEBjxl.exe
  2⤵
  PID:4636
- C:\Windows\System\fssKnES.exe
  C:\Windows\System\fssKnES.exe
  2⤵
  PID:4764
- C:\Windows\System\fCNafba.exe
  C:\Windows\System\fCNafba.exe
  2⤵
  PID:4752
- C:\Windows\System\JScqLoU.exe
  C:\Windows\System\JScqLoU.exe
  2⤵
  PID:4672
- C:\Windows\System\uRfKcJg.exe
  C:\Windows\System\uRfKcJg.exe
  2⤵
  PID:4956
- C:\Windows\System\dAzhQqn.exe
  C:\Windows\System\dAzhQqn.exe
  2⤵
  PID:4972
- C:\Windows\System\HeCicXe.exe
  C:\Windows\System\HeCicXe.exe
  2⤵
  PID:4280
- C:\Windows\System\zZtvFPw.exe
  C:\Windows\System\zZtvFPw.exe
  2⤵
  PID:4684
- C:\Windows\System\DGKpeXZ.exe
  C:\Windows\System\DGKpeXZ.exe
  2⤵
  PID:4452
- C:\Windows\System\RTReCsI.exe
  C:\Windows\System\RTReCsI.exe
  2⤵
  PID:4328
- C:\Windows\System\oKdLOUc.exe
  C:\Windows\System\oKdLOUc.exe
  2⤵
  PID:4620
- C:\Windows\System\XdMAmqC.exe
  C:\Windows\System\XdMAmqC.exe
  2⤵
  PID:4624
- C:\Windows\System\JIhwysD.exe
  C:\Windows\System\JIhwysD.exe
  2⤵
  PID:4924
- C:\Windows\System\JiLvUKq.exe
  C:\Windows\System\JiLvUKq.exe
  2⤵
  PID:5020
- C:\Windows\System\CYrDluI.exe
  C:\Windows\System\CYrDluI.exe
  2⤵
  PID:4880
- C:\Windows\System\xUFdswJ.exe
  C:\Windows\System\xUFdswJ.exe
  2⤵
  PID:3828
- C:\Windows\System\DBVstvX.exe
  C:\Windows\System\DBVstvX.exe
  2⤵
  PID:4532
- C:\Windows\System\TvTEeMi.exe
  C:\Windows\System\TvTEeMi.exe
  2⤵
  PID:4260
- C:\Windows\System\enVsqVb.exe
  C:\Windows\System\enVsqVb.exe
  2⤵
  PID:4768
- C:\Windows\System\AjrMNMG.exe
  C:\Windows\System\AjrMNMG.exe
  2⤵
  PID:4324
- C:\Windows\System\zeYGRIG.exe
  C:\Windows\System\zeYGRIG.exe
  2⤵
  PID:4608
- C:\Windows\System\jHCBFjP.exe
  C:\Windows\System\jHCBFjP.exe
  2⤵
  PID:3348
- C:\Windows\System\sjMuCMC.exe
  C:\Windows\System\sjMuCMC.exe
  2⤵
  PID:5068
- C:\Windows\System\BxqNFqh.exe
  C:\Windows\System\BxqNFqh.exe
  2⤵
  PID:4556
- C:\Windows\System\fmAUAMu.exe
  C:\Windows\System\fmAUAMu.exe
  2⤵
  PID:5072
- C:\Windows\System\bxKVYvy.exe
  C:\Windows\System\bxKVYvy.exe
  2⤵
  PID:3816
- C:\Windows\System\WwQyjFD.exe
  C:\Windows\System\WwQyjFD.exe
  2⤵
  PID:4200
- C:\Windows\System\caIuEpZ.exe
  C:\Windows\System\caIuEpZ.exe
  2⤵
  PID:4580
- C:\Windows\System\pmKqide.exe
  C:\Windows\System\pmKqide.exe
  2⤵
  PID:4892
- C:\Windows\System\RoZPlPJ.exe
  C:\Windows\System\RoZPlPJ.exe
  2⤵
  PID:4860
- C:\Windows\System\ZwCXJev.exe
  C:\Windows\System\ZwCXJev.exe
  2⤵
  PID:5136
- C:\Windows\System\ePjsAyu.exe
  C:\Windows\System\ePjsAyu.exe
  2⤵
  PID:5152
- C:\Windows\System\hokIhRu.exe
  C:\Windows\System\hokIhRu.exe
  2⤵
  PID:5168
- C:\Windows\System\qJNCMrK.exe
  C:\Windows\System\qJNCMrK.exe
  2⤵
  PID:5184
- C:\Windows\System\GVkggri.exe
  C:\Windows\System\GVkggri.exe
  2⤵
  PID:5200
- C:\Windows\System\qtERHXu.exe
  C:\Windows\System\qtERHXu.exe
  2⤵
  PID:5216
- C:\Windows\System\FiprUod.exe
  C:\Windows\System\FiprUod.exe
  2⤵
  PID:5232
- C:\Windows\System\IJlwvmS.exe
  C:\Windows\System\IJlwvmS.exe
  2⤵
  PID:5248
- C:\Windows\System\uXmVCMH.exe
  C:\Windows\System\uXmVCMH.exe
  2⤵
  PID:5264
- C:\Windows\System\eHrcGjV.exe
  C:\Windows\System\eHrcGjV.exe
  2⤵
  PID:5280
- C:\Windows\System\QPWyFcE.exe
  C:\Windows\System\QPWyFcE.exe
  2⤵
  PID:5296
- C:\Windows\System\zojgEaS.exe
  C:\Windows\System\zojgEaS.exe
  2⤵
  PID:5312
- C:\Windows\System\KvgMGLu.exe
  C:\Windows\System\KvgMGLu.exe
  2⤵
  PID:5328
- C:\Windows\System\eAZiUEi.exe
  C:\Windows\System\eAZiUEi.exe
  2⤵
  PID:5344
- C:\Windows\System\xztohVF.exe
  C:\Windows\System\xztohVF.exe
  2⤵
  PID:5360
- C:\Windows\System\oHWBsAv.exe
  C:\Windows\System\oHWBsAv.exe
  2⤵
  PID:5376
- C:\Windows\System\yjDQMhI.exe
  C:\Windows\System\yjDQMhI.exe
  2⤵
  PID:5392
- C:\Windows\System\rSVIWXe.exe
  C:\Windows\System\rSVIWXe.exe
  2⤵
  PID:5408
- C:\Windows\System\dSlcuXf.exe
  C:\Windows\System\dSlcuXf.exe
  2⤵
  PID:5424
- C:\Windows\System\tMWonrY.exe
  C:\Windows\System\tMWonrY.exe
  2⤵
  PID:5440
- C:\Windows\System\AypDyNr.exe
  C:\Windows\System\AypDyNr.exe
  2⤵
  PID:5456
- C:\Windows\System\EKbrTXz.exe
  C:\Windows\System\EKbrTXz.exe
  2⤵
  PID:5472
- C:\Windows\System\heOuqap.exe
  C:\Windows\System\heOuqap.exe
  2⤵
  PID:5488
- C:\Windows\System\wqEXbuE.exe
  C:\Windows\System\wqEXbuE.exe
  2⤵
  PID:5504
- C:\Windows\System\zyYWQSO.exe
  C:\Windows\System\zyYWQSO.exe
  2⤵
  PID:5520
- C:\Windows\System\HOVfLaX.exe
  C:\Windows\System\HOVfLaX.exe
  2⤵
  PID:5536
- C:\Windows\System\ZPwEaJz.exe
  C:\Windows\System\ZPwEaJz.exe
  2⤵
  PID:5552
- C:\Windows\System\DLDJKnx.exe
  C:\Windows\System\DLDJKnx.exe
  2⤵
  PID:5568
- C:\Windows\System\BRnZxlD.exe
  C:\Windows\System\BRnZxlD.exe
  2⤵
  PID:5584
- C:\Windows\System\qtAEmAm.exe
  C:\Windows\System\qtAEmAm.exe
  2⤵
  PID:5600
- C:\Windows\System\GnDELFc.exe
  C:\Windows\System\GnDELFc.exe
  2⤵
  PID:5616
- C:\Windows\System\LzxpGgu.exe
  C:\Windows\System\LzxpGgu.exe
  2⤵
  PID:5632
- C:\Windows\System\triEsla.exe
  C:\Windows\System\triEsla.exe
  2⤵
  PID:5648
- C:\Windows\System\YYhHyPQ.exe
  C:\Windows\System\YYhHyPQ.exe
  2⤵
  PID:5664
- C:\Windows\System\EnOvpTw.exe
  C:\Windows\System\EnOvpTw.exe
  2⤵
  PID:5680
- C:\Windows\System\JHVdgmZ.exe
  C:\Windows\System\JHVdgmZ.exe
  2⤵
  PID:5696
- C:\Windows\System\kwadRML.exe
  C:\Windows\System\kwadRML.exe
  2⤵
  PID:5712
- C:\Windows\System\rJBBwXg.exe
  C:\Windows\System\rJBBwXg.exe
  2⤵
  PID:5728
- C:\Windows\System\iUZlsgS.exe
  C:\Windows\System\iUZlsgS.exe
  2⤵
  PID:5744
- C:\Windows\System\KBGNIUF.exe
  C:\Windows\System\KBGNIUF.exe
  2⤵
  PID:5760
- C:\Windows\System\FojDxab.exe
  C:\Windows\System\FojDxab.exe
  2⤵
  PID:5776
- C:\Windows\System\jAoFRYI.exe
  C:\Windows\System\jAoFRYI.exe
  2⤵
  PID:5792
- C:\Windows\System\aHTvlxU.exe
  C:\Windows\System\aHTvlxU.exe
  2⤵
  PID:5808
- C:\Windows\System\oDxoZvJ.exe
  C:\Windows\System\oDxoZvJ.exe
  2⤵
  PID:5824
- C:\Windows\System\jEEGbxe.exe
  C:\Windows\System\jEEGbxe.exe
  2⤵
  PID:5840
- C:\Windows\System\flxhrMe.exe
  C:\Windows\System\flxhrMe.exe
  2⤵
  PID:5856
- C:\Windows\System\dPGgLDj.exe
  C:\Windows\System\dPGgLDj.exe
  2⤵
  PID:5872
- C:\Windows\System\dzmelDr.exe
  C:\Windows\System\dzmelDr.exe
  2⤵
  PID:5888
- C:\Windows\System\YzHuhhA.exe
  C:\Windows\System\YzHuhhA.exe
  2⤵
  PID:5904
- C:\Windows\System\BVBkKYe.exe
  C:\Windows\System\BVBkKYe.exe
  2⤵
  PID:5920
- C:\Windows\System\AOlZLVe.exe
  C:\Windows\System\AOlZLVe.exe
  2⤵
  PID:5936
- C:\Windows\System\VsrSJde.exe
  C:\Windows\System\VsrSJde.exe
  2⤵
  PID:5952
- C:\Windows\System\vDeMCgK.exe
  C:\Windows\System\vDeMCgK.exe
  2⤵
  PID:5968
- C:\Windows\System\QpChalO.exe
  C:\Windows\System\QpChalO.exe
  2⤵
  PID:5984
- C:\Windows\System\TqvQLgP.exe
  C:\Windows\System\TqvQLgP.exe
  2⤵
  PID:6000
- C:\Windows\System\aAfrFkZ.exe
  C:\Windows\System\aAfrFkZ.exe
  2⤵
  PID:6016
- C:\Windows\System\vHmbvnL.exe
  C:\Windows\System\vHmbvnL.exe
  2⤵
  PID:6032
- C:\Windows\System\UmBaYJs.exe
  C:\Windows\System\UmBaYJs.exe
  2⤵
  PID:6048
- C:\Windows\System\fOrAapz.exe
  C:\Windows\System\fOrAapz.exe
  2⤵
  PID:6064
- C:\Windows\System\orARrFE.exe
  C:\Windows\System\orARrFE.exe
  2⤵
  PID:6080
- C:\Windows\System\ZhneTpQ.exe
  C:\Windows\System\ZhneTpQ.exe
  2⤵
  PID:6096
- C:\Windows\System\jRxdqHi.exe
  C:\Windows\System\jRxdqHi.exe
  2⤵
  PID:6112
- C:\Windows\System\YbqcFXo.exe
  C:\Windows\System\YbqcFXo.exe
  2⤵
  PID:6128
- C:\Windows\System\RXcDsSt.exe
  C:\Windows\System\RXcDsSt.exe
  2⤵
  PID:5128
- C:\Windows\System\RFRrJcj.exe
  C:\Windows\System\RFRrJcj.exe
  2⤵
  PID:4212
- C:\Windows\System\rncoJNC.exe
  C:\Windows\System\rncoJNC.exe
  2⤵
  PID:4572
- C:\Windows\System\ZarSxBT.exe
  C:\Windows\System\ZarSxBT.exe
  2⤵
  PID:5260
- C:\Windows\System\kYeEDRu.exe
  C:\Windows\System\kYeEDRu.exe
  2⤵
  PID:5320
- C:\Windows\System\VQCrgCp.exe
  C:\Windows\System\VQCrgCp.exe
  2⤵
  PID:5356
- C:\Windows\System\yTrZTta.exe
  C:\Windows\System\yTrZTta.exe
  2⤵
  PID:5244
- C:\Windows\System\jPmGbWX.exe
  C:\Windows\System\jPmGbWX.exe
  2⤵
  PID:5420
- C:\Windows\System\PzaLJaL.exe
  C:\Windows\System\PzaLJaL.exe
  2⤵
  PID:5340
- C:\Windows\System\zCroIYK.exe
  C:\Windows\System\zCroIYK.exe
  2⤵
  PID:5480
- C:\Windows\System\qabZpVU.exe
  C:\Windows\System\qabZpVU.exe
  2⤵
  PID:5308
- C:\Windows\System\aDTaQqr.exe
  C:\Windows\System\aDTaQqr.exe
  2⤵
  PID:5512
- C:\Windows\System\QeezLIu.exe
  C:\Windows\System\QeezLIu.exe
  2⤵
  PID:5276
- C:\Windows\System\gHDkSsA.exe
  C:\Windows\System\gHDkSsA.exe
  2⤵
  PID:5464
- C:\Windows\System\DXEBOvH.exe
  C:\Windows\System\DXEBOvH.exe
  2⤵
  PID:5580
- C:\Windows\System\hqDuLZP.exe
  C:\Windows\System\hqDuLZP.exe
  2⤵
  PID:5500
- C:\Windows\System\ISMZVhc.exe
  C:\Windows\System\ISMZVhc.exe
  2⤵
  PID:5612
- C:\Windows\System\jQFjjGH.exe
  C:\Windows\System\jQFjjGH.exe
  2⤵
  PID:5676
- C:\Windows\System\feQsgnD.exe
  C:\Windows\System\feQsgnD.exe
  2⤵
  PID:5740
- C:\Windows\System\PfBkuWp.exe
  C:\Windows\System\PfBkuWp.exe
  2⤵
  PID:5800
- C:\Windows\System\WRnwHRO.exe
  C:\Windows\System\WRnwHRO.exe
  2⤵
  PID:5624
- C:\Windows\System\OCvjoqV.exe
  C:\Windows\System\OCvjoqV.exe
  2⤵
  PID:5656
- C:\Windows\System\CeBozHH.exe
  C:\Windows\System\CeBozHH.exe
  2⤵
  PID:5688
- C:\Windows\System\vMjJDhe.exe
  C:\Windows\System\vMjJDhe.exe
  2⤵
  PID:5864
- C:\Windows\System\sgfVVyl.exe
  C:\Windows\System\sgfVVyl.exe
  2⤵
  PID:5788
- C:\Windows\System\xpKuyLk.exe
  C:\Windows\System\xpKuyLk.exe
  2⤵
  PID:5820
- C:\Windows\System\bTGUPKs.exe
  C:\Windows\System\bTGUPKs.exe
  2⤵
  PID:5964
- C:\Windows\System\UmdQgCt.exe
  C:\Windows\System\UmdQgCt.exe
  2⤵
  PID:5912
- C:\Windows\System\GDzNpUm.exe
  C:\Windows\System\GDzNpUm.exe
  2⤵
  PID:6024
- C:\Windows\System\LQSmlBx.exe
  C:\Windows\System\LQSmlBx.exe
  2⤵
  PID:6088
- C:\Windows\System\pzaKibl.exe
  C:\Windows\System\pzaKibl.exe
  2⤵
  PID:5916
- C:\Windows\System\BVopTYE.exe
  C:\Windows\System\BVopTYE.exe
  2⤵
  PID:6040
- C:\Windows\System\DNLGhvq.exe
  C:\Windows\System\DNLGhvq.exe
  2⤵
  PID:6120
- C:\Windows\System\IxrsgVS.exe
  C:\Windows\System\IxrsgVS.exe
  2⤵
  PID:6104
- C:\Windows\System\zGwhPGY.exe
  C:\Windows\System\zGwhPGY.exe
  2⤵
  PID:6140
- C:\Windows\System\pmOcCIA.exe
  C:\Windows\System\pmOcCIA.exe
  2⤵
  PID:5176
- C:\Windows\System\EQLhMZL.exe
  C:\Windows\System\EQLhMZL.exe
  2⤵
  PID:5452
- C:\Windows\System\wkeYbNV.exe
  C:\Windows\System\wkeYbNV.exe
  2⤵
  PID:5148
- C:\Windows\System\FBLJzPT.exe
  C:\Windows\System\FBLJzPT.exe
  2⤵
  PID:5292
- C:\Windows\System\ibBAKNU.exe
  C:\Windows\System\ibBAKNU.exe
  2⤵
  PID:5432
- C:\Windows\System\WYMgUtB.exe
  C:\Windows\System\WYMgUtB.exe
  2⤵
  PID:5528
- C:\Windows\System\aXAUhmU.exe
  C:\Windows\System\aXAUhmU.exe
  2⤵
  PID:5672
- C:\Windows\System\UteMZoe.exe
  C:\Windows\System\UteMZoe.exe
  2⤵
  PID:5628
- C:\Windows\System\jeYHkjP.exe
  C:\Windows\System\jeYHkjP.exe
  2⤵
  PID:5836
- C:\Windows\System\HXaAKkJ.exe
  C:\Windows\System\HXaAKkJ.exe
  2⤵
  PID:5880
- C:\Windows\System\wgJjIRd.exe
  C:\Windows\System\wgJjIRd.exe
  2⤵
  PID:5752
- C:\Windows\System\wkMmaIZ.exe
  C:\Windows\System\wkMmaIZ.exe
  2⤵
  PID:6060
- C:\Windows\System\lRIwWLa.exe
  C:\Windows\System\lRIwWLa.exe
  2⤵
  PID:6012
- C:\Windows\System\QNjLxjJ.exe
  C:\Windows\System\QNjLxjJ.exe
  2⤵
  PID:5996
- C:\Windows\System\rhQRPRW.exe
  C:\Windows\System\rhQRPRW.exe
  2⤵
  PID:5196
- C:\Windows\System\fMPSYjv.exe
  C:\Windows\System\fMPSYjv.exe
  2⤵
  PID:5240
- C:\Windows\System\qMndUOm.exe
  C:\Windows\System\qMndUOm.exe
  2⤵
  PID:5720
- C:\Windows\System\GlQgSXa.exe
  C:\Windows\System\GlQgSXa.exe
  2⤵
  PID:5736
- C:\Windows\System\mEmzpLr.exe
  C:\Windows\System\mEmzpLr.exe
  2⤵
  PID:5596
- C:\Windows\System\AWmmewm.exe
  C:\Windows\System\AWmmewm.exe
  2⤵
  PID:6076
- C:\Windows\System\uYDrkZT.exe
  C:\Windows\System\uYDrkZT.exe
  2⤵
  PID:6008
- C:\Windows\System\LinYNiZ.exe
  C:\Windows\System\LinYNiZ.exe
  2⤵
  PID:5644
- C:\Windows\System\tGFJalr.exe
  C:\Windows\System\tGFJalr.exe
  2⤵
  PID:6148
- C:\Windows\System\eMzvyDQ.exe
  C:\Windows\System\eMzvyDQ.exe
  2⤵
  PID:6164
- C:\Windows\System\pHsmYZy.exe
  C:\Windows\System\pHsmYZy.exe
  2⤵
  PID:6180
- C:\Windows\System\toDSZEx.exe
  C:\Windows\System\toDSZEx.exe
  2⤵
  PID:6196
- C:\Windows\System\KHuJHYW.exe
  C:\Windows\System\KHuJHYW.exe
  2⤵
  PID:6212
- C:\Windows\System\LSLxvTv.exe
  C:\Windows\System\LSLxvTv.exe
  2⤵
  PID:6228
- C:\Windows\System\IQnCiHp.exe
  C:\Windows\System\IQnCiHp.exe
  2⤵
  PID:6244
- C:\Windows\System\czOOsWm.exe
  C:\Windows\System\czOOsWm.exe
  2⤵
  PID:6260
- C:\Windows\System\mlAbEDP.exe
  C:\Windows\System\mlAbEDP.exe
  2⤵
  PID:6276
- C:\Windows\System\JlvAKjL.exe
  C:\Windows\System\JlvAKjL.exe
  2⤵
  PID:6292
- C:\Windows\System\IppKlwK.exe
  C:\Windows\System\IppKlwK.exe
  2⤵
  PID:6308
- C:\Windows\System\DRsCbdC.exe
  C:\Windows\System\DRsCbdC.exe
  2⤵
  PID:6324
- C:\Windows\System\ZNAMQxa.exe
  C:\Windows\System\ZNAMQxa.exe
  2⤵
  PID:6340
- C:\Windows\System\OYMWCcY.exe
  C:\Windows\System\OYMWCcY.exe
  2⤵
  PID:6356
- C:\Windows\System\tMZKIqU.exe
  C:\Windows\System\tMZKIqU.exe
  2⤵
  PID:6372
- C:\Windows\System\LbChARc.exe
  C:\Windows\System\LbChARc.exe
  2⤵
  PID:6388
- C:\Windows\System\ZIaEQMo.exe
  C:\Windows\System\ZIaEQMo.exe
  2⤵
  PID:6404
- C:\Windows\System\tkDAPIo.exe
  C:\Windows\System\tkDAPIo.exe
  2⤵
  PID:6420
- C:\Windows\System\WQLkXEz.exe
  C:\Windows\System\WQLkXEz.exe
  2⤵
  PID:6436
- C:\Windows\System\lzBLbse.exe
  C:\Windows\System\lzBLbse.exe
  2⤵
  PID:6452
- C:\Windows\System\oaYDXAU.exe
  C:\Windows\System\oaYDXAU.exe
  2⤵
  PID:6468
- C:\Windows\System\IOvJioY.exe
  C:\Windows\System\IOvJioY.exe
  2⤵
  PID:6484
- C:\Windows\System\pUJtgSM.exe
  C:\Windows\System\pUJtgSM.exe
  2⤵
  PID:6500
- C:\Windows\System\ZLZAxNW.exe
  C:\Windows\System\ZLZAxNW.exe
  2⤵
  PID:6516
- C:\Windows\System\wIRPceS.exe
  C:\Windows\System\wIRPceS.exe
  2⤵
  PID:6532
- C:\Windows\System\QECMmSB.exe
  C:\Windows\System\QECMmSB.exe
  2⤵
  PID:6548
- C:\Windows\System\zeJrOqT.exe
  C:\Windows\System\zeJrOqT.exe
  2⤵
  PID:6564
- C:\Windows\System\Auggxck.exe
  C:\Windows\System\Auggxck.exe
  2⤵
  PID:6580
- C:\Windows\System\iZpJKWw.exe
  C:\Windows\System\iZpJKWw.exe
  2⤵
  PID:6596
- C:\Windows\System\QZDWKpG.exe
  C:\Windows\System\QZDWKpG.exe
  2⤵
  PID:6612
- C:\Windows\System\xIaYOVG.exe
  C:\Windows\System\xIaYOVG.exe
  2⤵
  PID:6628
- C:\Windows\System\OfgKDtH.exe
  C:\Windows\System\OfgKDtH.exe
  2⤵
  PID:6644
- C:\Windows\System\rwuKmVC.exe
  C:\Windows\System\rwuKmVC.exe
  2⤵
  PID:6660
- C:\Windows\System\hmtPgnG.exe
  C:\Windows\System\hmtPgnG.exe
  2⤵
  PID:6676
- C:\Windows\System\pBysOKd.exe
  C:\Windows\System\pBysOKd.exe
  2⤵
  PID:6692
- C:\Windows\System\NuRuWyf.exe
  C:\Windows\System\NuRuWyf.exe
  2⤵
  PID:6708
- C:\Windows\System\YtofpIU.exe
  C:\Windows\System\YtofpIU.exe
  2⤵
  PID:6724
- C:\Windows\System\ddMQXnz.exe
  C:\Windows\System\ddMQXnz.exe
  2⤵
  PID:6740
- C:\Windows\System\QpCtJBj.exe
  C:\Windows\System\QpCtJBj.exe
  2⤵
  PID:6756
- C:\Windows\System\ZglmwrQ.exe
  C:\Windows\System\ZglmwrQ.exe
  2⤵
  PID:6772
- C:\Windows\System\fjcNtvN.exe
  C:\Windows\System\fjcNtvN.exe
  2⤵
  PID:6788
- C:\Windows\System\RezOssZ.exe
  C:\Windows\System\RezOssZ.exe
  2⤵
  PID:7068
- C:\Windows\System\ZeikUdx.exe
  C:\Windows\System\ZeikUdx.exe
  2⤵
  PID:7088
- C:\Windows\System\SWymFVw.exe
  C:\Windows\System\SWymFVw.exe
  2⤵
  PID:7112
- C:\Windows\System\JOdYBiI.exe
  C:\Windows\System\JOdYBiI.exe
  2⤵
  PID:7140
- C:\Windows\System\gXWuENJ.exe
  C:\Windows\System\gXWuENJ.exe
  2⤵
  PID:7164
- C:\Windows\System\KOOAWwx.exe
  C:\Windows\System\KOOAWwx.exe
  2⤵
  PID:6176
- C:\Windows\System\ndyRsuV.exe
  C:\Windows\System\ndyRsuV.exe
  2⤵
  PID:5372
- C:\Windows\System\cRfvXMD.exe
  C:\Windows\System\cRfvXMD.exe
  2⤵
  PID:5932
- C:\Windows\System\ovTHCJk.exe
  C:\Windows\System\ovTHCJk.exe
  2⤵
  PID:6268
- C:\Windows\System\vicCLQQ.exe
  C:\Windows\System\vicCLQQ.exe
  2⤵
  PID:6220
- C:\Windows\System\bOPwarx.exe
  C:\Windows\System\bOPwarx.exe
  2⤵
  PID:6336
- C:\Windows\System\TBWHkhV.exe
  C:\Windows\System\TBWHkhV.exe
  2⤵
  PID:6428
- C:\Windows\System\JWMAPCj.exe
  C:\Windows\System\JWMAPCj.exe
  2⤵
  PID:5164
- C:\Windows\System\NfvZwRB.exe
  C:\Windows\System\NfvZwRB.exe
  2⤵
  PID:6252
- C:\Windows\System\gMwPFPo.exe
  C:\Windows\System\gMwPFPo.exe
  2⤵
  PID:6384
- C:\Windows\System\aYiFXrg.exe
  C:\Windows\System\aYiFXrg.exe
  2⤵
  PID:6524
- C:\Windows\System\sZlqWCG.exe
  C:\Windows\System\sZlqWCG.exe
  2⤵
  PID:6508
- C:\Windows\System\bTInCLs.exe
  C:\Windows\System\bTInCLs.exe
  2⤵
  PID:6540
- C:\Windows\System\kdPmVQd.exe
  C:\Windows\System\kdPmVQd.exe
  2⤵
  PID:6656
- C:\Windows\System\vDVZOFE.exe
  C:\Windows\System\vDVZOFE.exe
  2⤵
  PID:6720
- C:\Windows\System\cDPsAAY.exe
  C:\Windows\System\cDPsAAY.exe
  2⤵
  PID:6672
- C:\Windows\System\OXkKioz.exe
  C:\Windows\System\OXkKioz.exe
  2⤵
  PID:6636
- C:\Windows\System\ymikVnN.exe
  C:\Windows\System\ymikVnN.exe
  2⤵
  PID:6700
- C:\Windows\System\IdlkjAm.exe
  C:\Windows\System\IdlkjAm.exe
  2⤵
  PID:6780
- C:\Windows\System\VzwmIFM.exe
  C:\Windows\System\VzwmIFM.exe
  2⤵
  PID:6768
- C:\Windows\System\ZlRXitK.exe
  C:\Windows\System\ZlRXitK.exe
  2⤵
  PID:6808
- C:\Windows\System\fxTPStl.exe
  C:\Windows\System\fxTPStl.exe
  2⤵
  PID:6828
- C:\Windows\System\aaArrfZ.exe
  C:\Windows\System\aaArrfZ.exe
  2⤵
  PID:6844
- C:\Windows\System\bAaNCYD.exe
  C:\Windows\System\bAaNCYD.exe
  2⤵
  PID:6860
- C:\Windows\System\ntmyhhl.exe
  C:\Windows\System\ntmyhhl.exe
  2⤵
  PID:6876
- C:\Windows\System\ySAHzdI.exe
  C:\Windows\System\ySAHzdI.exe
  2⤵
  PID:6904
- C:\Windows\System\XBQtcTa.exe
  C:\Windows\System\XBQtcTa.exe
  2⤵
  PID:6916
- C:\Windows\System\aUJqbVI.exe
  C:\Windows\System\aUJqbVI.exe
  2⤵
  PID:6936
- C:\Windows\System\szSFhfx.exe
  C:\Windows\System\szSFhfx.exe
  2⤵
  PID:6952
- C:\Windows\System\KDcJCOt.exe
  C:\Windows\System\KDcJCOt.exe
  2⤵
  PID:6968
- C:\Windows\System\krFMsLA.exe
  C:\Windows\System\krFMsLA.exe
  2⤵
  PID:7080
- C:\Windows\System\WUZnGwB.exe
  C:\Windows\System\WUZnGwB.exe
  2⤵
  PID:7008
- C:\Windows\System\LtAPXzl.exe
  C:\Windows\System\LtAPXzl.exe
  2⤵
  PID:6988
- C:\Windows\System\ecNByIX.exe
  C:\Windows\System\ecNByIX.exe
  2⤵
  PID:7020
- C:\Windows\System\ypVJHzJ.exe
  C:\Windows\System\ypVJHzJ.exe
  2⤵
  PID:7036
- C:\Windows\System\SrWRByN.exe
  C:\Windows\System\SrWRByN.exe
  2⤵
  PID:7052
- C:\Windows\System\tHuQWpk.exe
  C:\Windows\System\tHuQWpk.exe
  2⤵
  PID:7096
- C:\Windows\System\PgZzONN.exe
  C:\Windows\System\PgZzONN.exe
  2⤵
  PID:7148
- C:\Windows\System\GyUEYIl.exe
  C:\Windows\System\GyUEYIl.exe
  2⤵
  PID:6208
- C:\Windows\System\hMrFgXz.exe
  C:\Windows\System\hMrFgXz.exe
  2⤵
  PID:6240
- C:\Windows\System\JlFEuZs.exe
  C:\Windows\System\JlFEuZs.exe
  2⤵
  PID:5544
- C:\Windows\System\JNlhSNN.exe
  C:\Windows\System\JNlhSNN.exe
  2⤵
  PID:5852
- C:\Windows\System\FUNcLLv.exe
  C:\Windows\System\FUNcLLv.exe
  2⤵
  PID:6192
- C:\Windows\System\fzvFcZY.exe
  C:\Windows\System\fzvFcZY.exe
  2⤵
  PID:6464
- C:\Windows\System\JjsVeEf.exe
  C:\Windows\System\JjsVeEf.exe
  2⤵
  PID:6480
- C:\Windows\System\yaPiJJM.exe
  C:\Windows\System\yaPiJJM.exe
  2⤵
  PID:5980
- C:\Windows\System\kZdmsqg.exe
  C:\Windows\System\kZdmsqg.exe
  2⤵
  PID:6316
- C:\Windows\System\njbMTwY.exe
  C:\Windows\System\njbMTwY.exe
  2⤵
  PID:5900
- C:\Windows\System\TcNXMKO.exe
  C:\Windows\System\TcNXMKO.exe
  2⤵
  PID:6156
- C:\Windows\System\ewVxqXj.exe
  C:\Windows\System\ewVxqXj.exe
  2⤵
  PID:6352
- C:\Windows\System\OLKGZdH.exe
  C:\Windows\System\OLKGZdH.exe
  2⤵
  PID:6588
- C:\Windows\System\RzHGAXS.exe
  C:\Windows\System\RzHGAXS.exe
  2⤵
  PID:6572
- C:\Windows\System\gDzeEGZ.exe
  C:\Windows\System\gDzeEGZ.exe
  2⤵
  PID:876
- C:\Windows\System\dJXwNmz.exe
  C:\Windows\System\dJXwNmz.exe
  2⤵
  PID:6868
- C:\Windows\System\yzRWMzT.exe
  C:\Windows\System\yzRWMzT.exe
  2⤵
  PID:6824
- C:\Windows\System\ZaYmLBJ.exe
  C:\Windows\System\ZaYmLBJ.exe
  2⤵
  PID:6624
- C:\Windows\System\TqlvlnJ.exe
  C:\Windows\System\TqlvlnJ.exe
  2⤵
  PID:6668
- C:\Windows\System\hhCRkxT.exe
  C:\Windows\System\hhCRkxT.exe
  2⤵
  PID:6912
- C:\Windows\System\OdfzNSY.exe
  C:\Windows\System\OdfzNSY.exe
  2⤵
  PID:6764
- C:\Windows\System\FYBBhCs.exe
  C:\Windows\System\FYBBhCs.exe
  2⤵
  PID:6976
- C:\Windows\System\KsViWar.exe
  C:\Windows\System\KsViWar.exe
  2⤵
  PID:7060
- C:\Windows\System\NDevFgV.exe
  C:\Windows\System\NDevFgV.exe
  2⤵
  PID:6332
- C:\Windows\System\ZNXwPud.exe
  C:\Windows\System\ZNXwPud.exe
  2⤵
  PID:6964
- C:\Windows\System\GuinDti.exe
  C:\Windows\System\GuinDti.exe
  2⤵
  PID:6188
- C:\Windows\System\CIUFIwB.exe
  C:\Windows\System\CIUFIwB.exe
  2⤵
  PID:6284
- C:\Windows\System\rvXZIHL.exe
  C:\Windows\System\rvXZIHL.exe
  2⤵
  PID:6576
- C:\Windows\System\NavSqLN.exe
  C:\Windows\System\NavSqLN.exe
  2⤵
  PID:7016
- C:\Windows\System\ybrIiEU.exe
  C:\Windows\System\ybrIiEU.exe
  2⤵
  PID:6160
- C:\Windows\System\cIbEKNF.exe
  C:\Windows\System\cIbEKNF.exe
  2⤵
  PID:5288
- C:\Windows\System\GBSwszn.exe
  C:\Windows\System\GBSwszn.exe
  2⤵
  PID:6556
- C:\Windows\System\MMqOxBC.exe
  C:\Windows\System\MMqOxBC.exe
  2⤵
  PID:6920
- C:\Windows\System\mMpjiqg.exe
  C:\Windows\System\mMpjiqg.exe
  2⤵
  PID:7132
- C:\Windows\System\FobvkBm.exe
  C:\Windows\System\FobvkBm.exe
  2⤵
  PID:7160
- C:\Windows\System\bNrtWPc.exe
  C:\Windows\System\bNrtWPc.exe
  2⤵
  PID:6056
- C:\Windows\System\ltFeWPa.exe
  C:\Windows\System\ltFeWPa.exe
  2⤵
  PID:6348
- C:\Windows\System\qXuBtJF.exe
  C:\Windows\System\qXuBtJF.exe
  2⤵
  PID:6932
- C:\Windows\System\SBBcYoO.exe
  C:\Windows\System\SBBcYoO.exe
  2⤵
  PID:6412
- C:\Windows\System\WpOGapU.exe
  C:\Windows\System\WpOGapU.exe
  2⤵
  PID:6796
- C:\Windows\System\iEPNqPb.exe
  C:\Windows\System\iEPNqPb.exe
  2⤵
  PID:6996
- C:\Windows\System\AXKzQCO.exe
  C:\Windows\System\AXKzQCO.exe
  2⤵
  PID:7000
- C:\Windows\System\LRyGvUa.exe
  C:\Windows\System\LRyGvUa.exe
  2⤵
  PID:6836
- C:\Windows\System\DwxvlXP.exe
  C:\Windows\System\DwxvlXP.exe
  2⤵
  PID:6652
- C:\Windows\System\WjmfzNI.exe
  C:\Windows\System\WjmfzNI.exe
  2⤵
  PID:7172
- C:\Windows\System\ecULbHu.exe
  C:\Windows\System\ecULbHu.exe
  2⤵
  PID:7328
- C:\Windows\System\veMedZS.exe
  C:\Windows\System\veMedZS.exe
  2⤵
  PID:7356
- C:\Windows\System\cidAwws.exe
  C:\Windows\System\cidAwws.exe
  2⤵
  PID:7372
- C:\Windows\System\ETEbSuG.exe
  C:\Windows\System\ETEbSuG.exe
  2⤵
  PID:7388
- C:\Windows\System\olmejLS.exe
  C:\Windows\System\olmejLS.exe
  2⤵
  PID:7408
- C:\Windows\System\qtpdSUt.exe
  C:\Windows\System\qtpdSUt.exe
  2⤵
  PID:7424
- C:\Windows\System\BRsDrEn.exe
  C:\Windows\System\BRsDrEn.exe
  2⤵
  PID:7440
- C:\Windows\System\ERWDPdH.exe
  C:\Windows\System\ERWDPdH.exe
  2⤵
  PID:7456
- C:\Windows\System\tcnvAuz.exe
  C:\Windows\System\tcnvAuz.exe
  2⤵
  PID:7472
- C:\Windows\System\TRmapyW.exe
  C:\Windows\System\TRmapyW.exe
  2⤵
  PID:7488
- C:\Windows\System\VQsJXCD.exe
  C:\Windows\System\VQsJXCD.exe
  2⤵
  PID:7504
- C:\Windows\System\VclLYxn.exe
  C:\Windows\System\VclLYxn.exe
  2⤵
  PID:7520
- C:\Windows\System\XdwEErS.exe
  C:\Windows\System\XdwEErS.exe
  2⤵
  PID:7536
- C:\Windows\System\dZwYIGk.exe
  C:\Windows\System\dZwYIGk.exe
  2⤵
  PID:7552
- C:\Windows\System\TTrAAec.exe
  C:\Windows\System\TTrAAec.exe
  2⤵
  PID:7568
- C:\Windows\System\wPpWYDh.exe
  C:\Windows\System\wPpWYDh.exe
  2⤵
  PID:7588
- C:\Windows\System\xTjKIQA.exe
  C:\Windows\System\xTjKIQA.exe
  2⤵
  PID:7604
- C:\Windows\System\VYxLCOu.exe
  C:\Windows\System\VYxLCOu.exe
  2⤵
  PID:7620
- C:\Windows\System\wNvMrQD.exe
  C:\Windows\System\wNvMrQD.exe
  2⤵
  PID:7640
- C:\Windows\System\KEkANgy.exe
  C:\Windows\System\KEkANgy.exe
  2⤵
  PID:7656
- C:\Windows\System\SuVOtny.exe
  C:\Windows\System\SuVOtny.exe
  2⤵
  PID:7672
- C:\Windows\System\uXSEnFf.exe
  C:\Windows\System\uXSEnFf.exe
  2⤵
  PID:7688
- C:\Windows\System\jNgQmFC.exe
  C:\Windows\System\jNgQmFC.exe
  2⤵
  PID:7704
- C:\Windows\System\OYTJUds.exe
  C:\Windows\System\OYTJUds.exe
  2⤵
  PID:7720
- C:\Windows\System\JoYyLjc.exe
  C:\Windows\System\JoYyLjc.exe
  2⤵
  PID:7736
- C:\Windows\System\xxiJejs.exe
  C:\Windows\System\xxiJejs.exe
  2⤵
  PID:7752
- C:\Windows\System\MinHswo.exe
  C:\Windows\System\MinHswo.exe
  2⤵
  PID:7768
- C:\Windows\System\BqtVeeJ.exe
  C:\Windows\System\BqtVeeJ.exe
  2⤵
  PID:7784
- C:\Windows\System\RlgDasp.exe
  C:\Windows\System\RlgDasp.exe
  2⤵
  PID:7800
- C:\Windows\System\FgeAYKk.exe
  C:\Windows\System\FgeAYKk.exe
  2⤵
  PID:7816
- C:\Windows\System\hHRGUyf.exe
  C:\Windows\System\hHRGUyf.exe
  2⤵
  PID:7832
- C:\Windows\System\dVocdDO.exe
  C:\Windows\System\dVocdDO.exe
  2⤵
  PID:7848
- C:\Windows\System\AUlTtHK.exe
  C:\Windows\System\AUlTtHK.exe
  2⤵
  PID:7864
- C:\Windows\System\JuGjnGm.exe
  C:\Windows\System\JuGjnGm.exe
  2⤵
  PID:7880
- C:\Windows\System\BUjmWUG.exe
  C:\Windows\System\BUjmWUG.exe
  2⤵
  PID:7896
- C:\Windows\System\vntLUJZ.exe
  C:\Windows\System\vntLUJZ.exe
  2⤵
  PID:7912
- C:\Windows\System\mrxhhBx.exe
  C:\Windows\System\mrxhhBx.exe
  2⤵
  PID:7928
- C:\Windows\System\niVNjvp.exe
  C:\Windows\System\niVNjvp.exe
  2⤵
  PID:7944
- C:\Windows\System\onuekYy.exe
  C:\Windows\System\onuekYy.exe
  2⤵
  PID:7960
- C:\Windows\System\hDkNLjV.exe
  C:\Windows\System\hDkNLjV.exe
  2⤵
  PID:7976
- C:\Windows\System\zkujTfT.exe
  C:\Windows\System\zkujTfT.exe
  2⤵
  PID:7992
- C:\Windows\System\GXzvUDe.exe
  C:\Windows\System\GXzvUDe.exe
  2⤵
  PID:8008
- C:\Windows\System\sknVXgs.exe
  C:\Windows\System\sknVXgs.exe
  2⤵
  PID:8024
- C:\Windows\System\PaBumZS.exe
  C:\Windows\System\PaBumZS.exe
  2⤵
  PID:8040
- C:\Windows\System\sYjNlCG.exe
  C:\Windows\System\sYjNlCG.exe
  2⤵
  PID:8056
- C:\Windows\System\GGLTQyQ.exe
  C:\Windows\System\GGLTQyQ.exe
  2⤵
  PID:8072
- C:\Windows\System\tLyfJbC.exe
  C:\Windows\System\tLyfJbC.exe
  2⤵
  PID:8088
- C:\Windows\System\jrQVwcn.exe
  C:\Windows\System\jrQVwcn.exe
  2⤵
  PID:8104
- C:\Windows\System\iEqXfYp.exe
  C:\Windows\System\iEqXfYp.exe
  2⤵
  PID:8120
- C:\Windows\System\IHNRZCs.exe
  C:\Windows\System\IHNRZCs.exe
  2⤵
  PID:8136
- C:\Windows\System\uDrpwtN.exe
  C:\Windows\System\uDrpwtN.exe
  2⤵
  PID:8152
- C:\Windows\System\bMVvygF.exe
  C:\Windows\System\bMVvygF.exe
  2⤵
  PID:8168
- C:\Windows\System\HCjiMvs.exe
  C:\Windows\System\HCjiMvs.exe
  2⤵
  PID:8184
- C:\Windows\System\KtFZxOf.exe
  C:\Windows\System\KtFZxOf.exe
  2⤵
  PID:7044
- C:\Windows\System\okOSfzd.exe
  C:\Windows\System\okOSfzd.exe
  2⤵
  PID:6856
- C:\Windows\System\cjSDqpC.exe
  C:\Windows\System\cjSDqpC.exe
  2⤵
  PID:6752
- C:\Windows\System\zXSHfvO.exe
  C:\Windows\System\zXSHfvO.exe
  2⤵
  PID:6928
- C:\Windows\System\oIBfuYe.exe
  C:\Windows\System\oIBfuYe.exe
  2⤵
  PID:7184
- C:\Windows\System\QNCKaNR.exe
  C:\Windows\System\QNCKaNR.exe
  2⤵
  PID:7200
- C:\Windows\System\IHYHeYK.exe
  C:\Windows\System\IHYHeYK.exe
  2⤵
  PID:7236
- C:\Windows\System\hvVOaev.exe
  C:\Windows\System\hvVOaev.exe
  2⤵
  PID:7216
- C:\Windows\System\rjNHGnA.exe
  C:\Windows\System\rjNHGnA.exe
  2⤵
  PID:7296
- C:\Windows\System\LnWYenu.exe
  C:\Windows\System\LnWYenu.exe
  2⤵
  PID:7244
- C:\Windows\System\NJEiEzF.exe
  C:\Windows\System\NJEiEzF.exe
  2⤵
  PID:7260
- C:\Windows\System\CHbMtZO.exe
  C:\Windows\System\CHbMtZO.exe
  2⤵
  PID:7284
- C:\Windows\System\HwnkjlY.exe
  C:\Windows\System\HwnkjlY.exe
  2⤵
  PID:7336
- C:\Windows\System\KrfXAsD.exe
  C:\Windows\System\KrfXAsD.exe
  2⤵
  PID:7352
- C:\Windows\System\cmQOPUw.exe
  C:\Windows\System\cmQOPUw.exe
  2⤵
  PID:7420
- C:\Windows\System\EeLQWfM.exe
  C:\Windows\System\EeLQWfM.exe
  2⤵
  PID:7364
- C:\Windows\System\KxuitgL.exe
  C:\Windows\System\KxuitgL.exe
  2⤵
  PID:7544
- C:\Windows\System\WSAKCiY.exe
  C:\Windows\System\WSAKCiY.exe
  2⤵
  PID:7612
- C:\Windows\System\FoNJUps.exe
  C:\Windows\System\FoNJUps.exe
  2⤵
  PID:7652
- C:\Windows\System\mrgOuIL.exe
  C:\Windows\System\mrgOuIL.exe
  2⤵
  PID:7716
- C:\Windows\System\UuaTRos.exe
  C:\Windows\System\UuaTRos.exe
  2⤵
  PID:7780
- C:\Windows\System\cwytxSk.exe
  C:\Windows\System\cwytxSk.exe
  2⤵
  PID:7844
- C:\Windows\System\fdUYkWz.exe
  C:\Windows\System\fdUYkWz.exe
  2⤵
  PID:7908
- C:\Windows\System\fIbvNjV.exe
  C:\Windows\System\fIbvNjV.exe
  2⤵
  PID:7972
- C:\Windows\System\EYuqMrX.exe
  C:\Windows\System\EYuqMrX.exe
  2⤵
  PID:8032
- C:\Windows\System\aUkuPQV.exe
  C:\Windows\System\aUkuPQV.exe
  2⤵
  PID:8096
- C:\Windows\System\icDgXZQ.exe
  C:\Windows\System\icDgXZQ.exe
  2⤵
  PID:8164
- C:\Windows\System\KyoZjhH.exe
  C:\Windows\System\KyoZjhH.exe
  2⤵
  PID:7500
- C:\Windows\System\ouuJxyy.exe
  C:\Windows\System\ouuJxyy.exe
  2⤵
  PID:7532
- C:\Windows\System\eNyVyhd.exe
  C:\Windows\System\eNyVyhd.exe
  2⤵
  PID:7436
- C:\Windows\System\YnXyunl.exe
  C:\Windows\System\YnXyunl.exe
  2⤵
  PID:7700
- C:\Windows\System\rkvcnBc.exe
  C:\Windows\System\rkvcnBc.exe
  2⤵
  PID:7496
- C:\Windows\System\GbAFKTC.exe
  C:\Windows\System\GbAFKTC.exe
  2⤵
  PID:7180
- C:\Windows\System\LbmmjEY.exe
  C:\Windows\System\LbmmjEY.exe
  2⤵
  PID:7632
- C:\Windows\System\jXuSPZA.exe
  C:\Windows\System\jXuSPZA.exe
  2⤵
  PID:7668
- C:\Windows\System\UfDRdtC.exe
  C:\Windows\System\UfDRdtC.exe
  2⤵
  PID:7984
- C:\Windows\System\XpMQWFH.exe
  C:\Windows\System\XpMQWFH.exe
  2⤵
  PID:8084
- C:\Windows\System\CVoKwUj.exe
  C:\Windows\System\CVoKwUj.exe
  2⤵
  PID:8180
- C:\Windows\System\rBAzBCb.exe
  C:\Windows\System\rBAzBCb.exe
  2⤵
  PID:7956
- C:\Windows\System\kDGvnrO.exe
  C:\Windows\System\kDGvnrO.exe
  2⤵
  PID:7892
- C:\Windows\System\kEoIRXl.exe
  C:\Windows\System\kEoIRXl.exe
  2⤵
  PID:7824
- C:\Windows\System\pPQLbIF.exe
  C:\Windows\System\pPQLbIF.exe
  2⤵
  PID:7108
- C:\Windows\System\YzHGjWt.exe
  C:\Windows\System\YzHGjWt.exe
  2⤵
  PID:7272
- C:\Windows\System\FQpaxGs.exe
  C:\Windows\System\FQpaxGs.exe
  2⤵
  PID:7256
- C:\Windows\System\AvQKhZV.exe
  C:\Windows\System\AvQKhZV.exe
  2⤵
  PID:7224
- C:\Windows\System\UWwwyvk.exe
  C:\Windows\System\UWwwyvk.exe
  2⤵
  PID:7240
- C:\Windows\System\iNVHRTb.exe
  C:\Windows\System\iNVHRTb.exe
  2⤵
  PID:6812
- C:\Windows\System\mIjBVmd.exe
  C:\Windows\System\mIjBVmd.exe
  2⤵
  PID:7512
- C:\Windows\System\XSOIMIu.exe
  C:\Windows\System\XSOIMIu.exe
  2⤵
  PID:7748
- C:\Windows\System\szVaPmj.exe
  C:\Windows\System\szVaPmj.exe
  2⤵
  PID:8004
- C:\Windows\System\QQxkDau.exe
  C:\Windows\System\QQxkDau.exe
  2⤵
  PID:8160
- C:\Windows\System\vtfoEwA.exe
  C:\Windows\System\vtfoEwA.exe
  2⤵
  PID:7400
- C:\Windows\System\woQGiHX.exe
  C:\Windows\System\woQGiHX.exe
  2⤵
  PID:7580
- C:\Windows\System\LkOMjNf.exe
  C:\Windows\System\LkOMjNf.exe
  2⤵
  PID:6980
- C:\Windows\System\XNNPodR.exe
  C:\Windows\System\XNNPodR.exe
  2⤵
  PID:6944
- C:\Windows\System\bWVAgBp.exe
  C:\Windows\System\bWVAgBp.exe
  2⤵
  PID:8052
- C:\Windows\System\GrTlzJC.exe
  C:\Windows\System\GrTlzJC.exe
  2⤵
  PID:6560
- C:\Windows\System\RBdURjZ.exe
  C:\Windows\System\RBdURjZ.exe
  2⤵
  PID:7856
- C:\Windows\System\lAyhYaM.exe
  C:\Windows\System\lAyhYaM.exe
  2⤵
  PID:7712
- C:\Windows\System\orhOQfr.exe
  C:\Windows\System\orhOQfr.exe
  2⤵
  PID:7968
- C:\Windows\System\mEWMFuk.exe
  C:\Windows\System\mEWMFuk.exe
  2⤵
  PID:7728
- C:\Windows\System\exETCJO.exe
  C:\Windows\System\exETCJO.exe
  2⤵
  PID:7764
- C:\Windows\System\tnwnLLI.exe
  C:\Windows\System\tnwnLLI.exe
  2⤵
  PID:7320
- C:\Windows\System\dsKCvGY.exe
  C:\Windows\System\dsKCvGY.exe
  2⤵
  PID:7792
- C:\Windows\System\aOLkZVD.exe
  C:\Windows\System\aOLkZVD.exe
  2⤵
  PID:7276
- C:\Windows\System\DRgVTCH.exe
  C:\Windows\System\DRgVTCH.exe
  2⤵
  PID:8128
- C:\Windows\System\voPlwwB.exe
  C:\Windows\System\voPlwwB.exe
  2⤵
  PID:7464
- C:\Windows\System\hQpDBdY.exe
  C:\Windows\System\hQpDBdY.exe
  2⤵
  PID:7348
- C:\Windows\System\DwzNUkv.exe
  C:\Windows\System\DwzNUkv.exe
  2⤵
  PID:8016
- C:\Windows\System\SUcHTyK.exe
  C:\Windows\System\SUcHTyK.exe
  2⤵
  PID:7924
- C:\Windows\System\rDIhaeT.exe
  C:\Windows\System\rDIhaeT.exe
  2⤵
  PID:7316
- C:\Windows\System\OLaWCTv.exe
  C:\Windows\System\OLaWCTv.exe
  2⤵
  PID:7280
- C:\Windows\System\ngSgzfx.exe
  C:\Windows\System\ngSgzfx.exe
  2⤵
  PID:7628
- C:\Windows\System\skXLevu.exe
  C:\Windows\System\skXLevu.exe
  2⤵
  PID:8200
- C:\Windows\System\svoLLDK.exe
  C:\Windows\System\svoLLDK.exe
  2⤵
  PID:8216
- C:\Windows\System\wApbwqi.exe
  C:\Windows\System\wApbwqi.exe
  2⤵
  PID:8232
- C:\Windows\System\hzRNhYQ.exe
  C:\Windows\System\hzRNhYQ.exe
  2⤵
  PID:8248
- C:\Windows\System\cTqmrKh.exe
  C:\Windows\System\cTqmrKh.exe
  2⤵
  PID:8264
- C:\Windows\System\ezTbDmi.exe
  C:\Windows\System\ezTbDmi.exe
  2⤵
  PID:8280
- C:\Windows\System\wuiCbNd.exe
  C:\Windows\System\wuiCbNd.exe
  2⤵
  PID:8296
- C:\Windows\System\BBUDWjt.exe
  C:\Windows\System\BBUDWjt.exe
  2⤵
  PID:8312
- C:\Windows\System\aBHzuct.exe
  C:\Windows\System\aBHzuct.exe
  2⤵
  PID:8328
- C:\Windows\System\yzocTvB.exe
  C:\Windows\System\yzocTvB.exe
  2⤵
  PID:8344
- C:\Windows\System\piEIDQs.exe
  C:\Windows\System\piEIDQs.exe
  2⤵
  PID:8360
- C:\Windows\System\WwgxFyD.exe
  C:\Windows\System\WwgxFyD.exe
  2⤵
  PID:8376
- C:\Windows\System\fUxuydI.exe
  C:\Windows\System\fUxuydI.exe
  2⤵
  PID:8392
- C:\Windows\System\cBCQZcI.exe
  C:\Windows\System\cBCQZcI.exe
  2⤵
  PID:8408
- C:\Windows\System\AYcSzMQ.exe
  C:\Windows\System\AYcSzMQ.exe
  2⤵
  PID:8424
- C:\Windows\System\ijNwJFB.exe
  C:\Windows\System\ijNwJFB.exe
  2⤵
  PID:8440
- C:\Windows\System\jyputWr.exe
  C:\Windows\System\jyputWr.exe
  2⤵
  PID:8456
- C:\Windows\System\gYOWwkO.exe
  C:\Windows\System\gYOWwkO.exe
  2⤵
  PID:8472
- C:\Windows\System\VVMeqWo.exe
  C:\Windows\System\VVMeqWo.exe
  2⤵
  PID:8488
- C:\Windows\System\tKDtcmG.exe
  C:\Windows\System\tKDtcmG.exe
  2⤵
  PID:8504
- C:\Windows\System\IhlDnXl.exe
  C:\Windows\System\IhlDnXl.exe
  2⤵
  PID:8520
- C:\Windows\System\JAIbvSZ.exe
  C:\Windows\System\JAIbvSZ.exe
  2⤵
  PID:8536
- C:\Windows\System\dtjCwxc.exe
  C:\Windows\System\dtjCwxc.exe
  2⤵
  PID:8552
- C:\Windows\System\DQLabDD.exe
  C:\Windows\System\DQLabDD.exe
  2⤵
  PID:8568
- C:\Windows\System\FWQnInS.exe
  C:\Windows\System\FWQnInS.exe
  2⤵
  PID:8584
- C:\Windows\System\wOqpRPD.exe
  C:\Windows\System\wOqpRPD.exe
  2⤵
  PID:8600
- C:\Windows\System\ufeacPk.exe
  C:\Windows\System\ufeacPk.exe
  2⤵
  PID:8616
- C:\Windows\System\TqYdyXO.exe
  C:\Windows\System\TqYdyXO.exe
  2⤵
  PID:8632
- C:\Windows\System\AJCdHuh.exe
  C:\Windows\System\AJCdHuh.exe
  2⤵
  PID:8648
- C:\Windows\System\gayITBL.exe
  C:\Windows\System\gayITBL.exe
  2⤵
  PID:8664
- C:\Windows\System\mxJnePd.exe
  C:\Windows\System\mxJnePd.exe
  2⤵
  PID:8680
- C:\Windows\System\ajLiByq.exe
  C:\Windows\System\ajLiByq.exe
  2⤵
  PID:8696
- C:\Windows\System\gkWeFtz.exe
  C:\Windows\System\gkWeFtz.exe
  2⤵
  PID:8712
- C:\Windows\System\zZnpETD.exe
  C:\Windows\System\zZnpETD.exe
  2⤵
  PID:8728
- C:\Windows\System\XlxpOFn.exe
  C:\Windows\System\XlxpOFn.exe
  2⤵
  PID:8744
- C:\Windows\System\KBukMMJ.exe
  C:\Windows\System\KBukMMJ.exe
  2⤵
  PID:8760
- C:\Windows\System\kkSkrfx.exe
  C:\Windows\System\kkSkrfx.exe
  2⤵
  PID:8776
- C:\Windows\System\vQnGBtm.exe
  C:\Windows\System\vQnGBtm.exe
  2⤵
  PID:8792
- C:\Windows\System\WAuuzdn.exe
  C:\Windows\System\WAuuzdn.exe
  2⤵
  PID:8808
- C:\Windows\System\uRIrqHd.exe
  C:\Windows\System\uRIrqHd.exe
  2⤵
  PID:8824
- C:\Windows\System\jtQszkJ.exe
  C:\Windows\System\jtQszkJ.exe
  2⤵
  PID:8840
- C:\Windows\System\XdLzNSJ.exe
  C:\Windows\System\XdLzNSJ.exe
  2⤵
  PID:8856
- C:\Windows\System\hXeDypp.exe
  C:\Windows\System\hXeDypp.exe
  2⤵
  PID:8872
- C:\Windows\System\knQwlad.exe
  C:\Windows\System\knQwlad.exe
  2⤵
  PID:8888
- C:\Windows\System\GQZDBtt.exe
  C:\Windows\System\GQZDBtt.exe
  2⤵
  PID:8904
- C:\Windows\System\NNRySjE.exe
  C:\Windows\System\NNRySjE.exe
  2⤵
  PID:8928
- C:\Windows\System\GvdHKVv.exe
  C:\Windows\System\GvdHKVv.exe
  2⤵
  PID:8944
- C:\Windows\System\fognryj.exe
  C:\Windows\System\fognryj.exe
  2⤵
  PID:8960
- C:\Windows\System\zELACOC.exe
  C:\Windows\System\zELACOC.exe
  2⤵
  PID:8976
- C:\Windows\System\vRFiWXs.exe
  C:\Windows\System\vRFiWXs.exe
  2⤵
  PID:8992
- C:\Windows\System\RsuehyG.exe
  C:\Windows\System\RsuehyG.exe
  2⤵
  PID:9008
- C:\Windows\System\OfadgeV.exe
  C:\Windows\System\OfadgeV.exe
  2⤵
  PID:9024
- C:\Windows\System\qbWKCqe.exe
  C:\Windows\System\qbWKCqe.exe
  2⤵
  PID:9040
- C:\Windows\System\FidFxel.exe
  C:\Windows\System\FidFxel.exe
  2⤵
  PID:9056
- C:\Windows\System\WVKfNOu.exe
  C:\Windows\System\WVKfNOu.exe
  2⤵
  PID:9072
- C:\Windows\System\nifbzxi.exe
  C:\Windows\System\nifbzxi.exe
  2⤵
  PID:9088
- C:\Windows\System\AXFMYcK.exe
  C:\Windows\System\AXFMYcK.exe
  2⤵
  PID:9104
- C:\Windows\System\ekSYpcQ.exe
  C:\Windows\System\ekSYpcQ.exe
  2⤵
  PID:9120
- C:\Windows\System\uULaozr.exe
  C:\Windows\System\uULaozr.exe
  2⤵
  PID:9136
- C:\Windows\System\IKNmPcc.exe
  C:\Windows\System\IKNmPcc.exe
  2⤵
  PID:9152
- C:\Windows\System\MjLQjsJ.exe
  C:\Windows\System\MjLQjsJ.exe
  2⤵
  PID:9168
- C:\Windows\System\VgoJnvN.exe
  C:\Windows\System\VgoJnvN.exe
  2⤵
  PID:9184
- C:\Windows\System\uCDWkOq.exe
  C:\Windows\System\uCDWkOq.exe
  2⤵
  PID:9200
- C:\Windows\System\wljyiIJ.exe
  C:\Windows\System\wljyiIJ.exe
  2⤵
  PID:8068
- C:\Windows\System\UnbiTrY.exe
  C:\Windows\System\UnbiTrY.exe
  2⤵
  PID:8240
- C:\Windows\System\fgkwxZG.exe
  C:\Windows\System\fgkwxZG.exe
  2⤵
  PID:8304
- C:\Windows\System\wSiMzHb.exe
  C:\Windows\System\wSiMzHb.exe
  2⤵
  PID:8368
- C:\Windows\System\qkCIEzQ.exe
  C:\Windows\System\qkCIEzQ.exe
  2⤵
  PID:8432
- C:\Windows\System\uynBzKF.exe
  C:\Windows\System\uynBzKF.exe
  2⤵
  PID:8500
- C:\Windows\System\iBxLDYi.exe
  C:\Windows\System\iBxLDYi.exe
  2⤵
  PID:8020
- C:\Windows\System\VWGBatl.exe
  C:\Windows\System\VWGBatl.exe
  2⤵
  PID:6892
- C:\Windows\System\FszFWnW.exe
  C:\Windows\System\FszFWnW.exe
  2⤵
  PID:7760
- C:\Windows\System\naFnKKg.exe
  C:\Windows\System\naFnKKg.exe
  2⤵
  PID:8148
- C:\Windows\System\HJpcQiM.exe
  C:\Windows\System\HJpcQiM.exe
  2⤵
  PID:7920
- C:\Windows\System\PkfVVVv.exe
  C:\Windows\System\PkfVVVv.exe
  2⤵
  PID:7876
- C:\Windows\System\HHmDRPn.exe
  C:\Windows\System\HHmDRPn.exe
  2⤵
  PID:8608
- C:\Windows\System\OIprmFM.exe
  C:\Windows\System\OIprmFM.exe
  2⤵
  PID:8228
- C:\Windows\System\wKvbRYm.exe
  C:\Windows\System\wKvbRYm.exe
  2⤵
  PID:8292
- C:\Windows\System\lvWtcTq.exe
  C:\Windows\System\lvWtcTq.exe
  2⤵
  PID:8576
- C:\Windows\System\FSdvldO.exe
  C:\Windows\System\FSdvldO.exe
  2⤵
  PID:8416
- C:\Windows\System\KGANYkr.exe
  C:\Windows\System\KGANYkr.exe
  2⤵
  PID:8352
- C:\Windows\System\GhZVfRM.exe
  C:\Windows\System\GhZVfRM.exe
  2⤵
  PID:8624
- C:\Windows\System\fDnGBrx.exe
  C:\Windows\System\fDnGBrx.exe
  2⤵
  PID:8688
- C:\Windows\System\YsDgYuU.exe
  C:\Windows\System\YsDgYuU.exe
  2⤵
  PID:8724
- C:\Windows\System\GMmOqnh.exe
  C:\Windows\System\GMmOqnh.exe
  2⤵
  PID:8784
- C:\Windows\System\YqFfEcj.exe
  C:\Windows\System\YqFfEcj.exe
  2⤵
  PID:8820
- C:\Windows\System\qmwRjaF.exe
  C:\Windows\System\qmwRjaF.exe
  2⤵
  PID:8880
- C:\Windows\System\cYbcaIP.exe
  C:\Windows\System\cYbcaIP.exe
  2⤵
  PID:8864
- C:\Windows\System\NvdrNmy.exe
  C:\Windows\System\NvdrNmy.exe
  2⤵
  PID:8916
- C:\Windows\System\FETUVXt.exe
  C:\Windows\System\FETUVXt.exe
  2⤵
  PID:8952
- C:\Windows\System\iRQnXcE.exe
  C:\Windows\System\iRQnXcE.exe
  2⤵
  PID:8804
- C:\Windows\System\yFvhqEK.exe
  C:\Windows\System\yFvhqEK.exe
  2⤵
  PID:9048
- C:\Windows\System\CvakPpW.exe
  C:\Windows\System\CvakPpW.exe
  2⤵
  PID:9112
- C:\Windows\System\GBDvGPr.exe
  C:\Windows\System\GBDvGPr.exe
  2⤵
  PID:8940
- C:\Windows\System\liBrLAY.exe
  C:\Windows\System\liBrLAY.exe
  2⤵
  PID:9004
- C:\Windows\System\BWzUjaC.exe
  C:\Windows\System\BWzUjaC.exe
  2⤵
  PID:9096
- C:\Windows\System\JMQfcbP.exe
  C:\Windows\System\JMQfcbP.exe
  2⤵
  PID:9144
- C:\Windows\System\OOksHZx.exe
  C:\Windows\System\OOksHZx.exe
  2⤵
  PID:9160
- C:\Windows\System\YoIhDvb.exe
  C:\Windows\System\YoIhDvb.exe
  2⤵
  PID:9164
- C:\Windows\System\tRCxiTB.exe
  C:\Windows\System\tRCxiTB.exe
  2⤵
  PID:8272
- C:\Windows\System\wtdUnOV.exe
  C:\Windows\System\wtdUnOV.exe
  2⤵
  PID:8336
- C:\Windows\System\eZRDFCr.exe
  C:\Windows\System\eZRDFCr.exe
  2⤵
  PID:8532
- C:\Windows\System\DcanAKN.exe
  C:\Windows\System\DcanAKN.exe
  2⤵
  PID:7940
- C:\Windows\System\uosbDcn.exe
  C:\Windows\System\uosbDcn.exe
  2⤵
  PID:8480
- C:\Windows\System\EIVOHJB.exe
  C:\Windows\System\EIVOHJB.exe
  2⤵
  PID:8356
- C:\Windows\System\TtLjZww.exe
  C:\Windows\System\TtLjZww.exe
  2⤵
  PID:8816
- C:\Windows\System\uopxsFI.exe
  C:\Windows\System\uopxsFI.exe
  2⤵
  PID:8924
- C:\Windows\System\esjtvhv.exe
  C:\Windows\System\esjtvhv.exe
  2⤵
  PID:8644
- C:\Windows\System\KkmjdBS.exe
  C:\Windows\System\KkmjdBS.exe
  2⤵
  PID:9080
- C:\Windows\System\FTUopmx.exe
  C:\Windows\System\FTUopmx.exe
  2⤵
  PID:9036
- C:\Windows\System\xkZjqHZ.exe
  C:\Windows\System\xkZjqHZ.exe
  2⤵
  PID:9132
- C:\Windows\System\zRiXuBo.exe
  C:\Windows\System\zRiXuBo.exe
  2⤵
  PID:9196
- C:\Windows\System\HFgSXeA.exe
  C:\Windows\System\HFgSXeA.exe
  2⤵
  PID:8592
- C:\Windows\System\JdeoaMz.exe
  C:\Windows\System\JdeoaMz.exe
  2⤵
  PID:8496
- C:\Windows\System\PKjayUS.exe
  C:\Windows\System\PKjayUS.exe
  2⤵
  PID:8288
- C:\Windows\System\AIGKkRL.exe
  C:\Windows\System\AIGKkRL.exe
  2⤵
  PID:7136
- C:\Windows\System\KFylQVV.exe
  C:\Windows\System\KFylQVV.exe
  2⤵
  PID:8320
- C:\Windows\System\qINmGUD.exe
  C:\Windows\System\qINmGUD.exe
  2⤵
  PID:8484
- C:\Windows\System\UNoUxQA.exe
  C:\Windows\System\UNoUxQA.exe
  2⤵
  PID:8756
- C:\Windows\System\UOwAXEo.exe
  C:\Windows\System\UOwAXEo.exe
  2⤵
  PID:8852
- C:\Windows\System\HnqVRPD.exe
  C:\Windows\System\HnqVRPD.exe
  2⤵
  PID:8224
- C:\Windows\System\aRGLkLJ.exe
  C:\Windows\System\aRGLkLJ.exe
  2⤵
  PID:8984
- C:\Windows\System\RQEMzAz.exe
  C:\Windows\System\RQEMzAz.exe
  2⤵
  PID:9180
- C:\Windows\System\QyGKFvP.exe
  C:\Windows\System\QyGKFvP.exe
  2⤵
  PID:1576
- C:\Windows\System\iBzqEZY.exe
  C:\Windows\System\iBzqEZY.exe
  2⤵
  PID:8544
- C:\Windows\System\gQDHozp.exe
  C:\Windows\System\gQDHozp.exe
  2⤵
  PID:8936
- C:\Windows\System\zBObseE.exe
  C:\Windows\System\zBObseE.exe
  2⤵
  PID:9032
- C:\Windows\System\cyqMvvg.exe
  C:\Windows\System\cyqMvvg.exe
  2⤵
  PID:8972
- C:\Windows\System\yfpSMKO.exe
  C:\Windows\System\yfpSMKO.exe
  2⤵
  PID:8260
- C:\Windows\System\OpeVRcQ.exe
  C:\Windows\System\OpeVRcQ.exe
  2⤵
  PID:8920
- C:\Windows\System\FxTcazq.exe
  C:\Windows\System\FxTcazq.exe
  2⤵
  PID:8560
- C:\Windows\System\kHyujJt.exe
  C:\Windows\System\kHyujJt.exe
  2⤵
  PID:9148
- C:\Windows\System\UZlyGrZ.exe
  C:\Windows\System\UZlyGrZ.exe
  2⤵
  PID:8868
- C:\Windows\System\ktneYFL.exe
  C:\Windows\System\ktneYFL.exe
  2⤵
  PID:9228
- C:\Windows\System\BKCkDnQ.exe
  C:\Windows\System\BKCkDnQ.exe
  2⤵
  PID:9244
- C:\Windows\System\JLPnAst.exe
  C:\Windows\System\JLPnAst.exe
  2⤵
  PID:9260
- C:\Windows\System\LQWBWXA.exe
  C:\Windows\System\LQWBWXA.exe
  2⤵
  PID:9280
- C:\Windows\System\pnzMPqm.exe
  C:\Windows\System\pnzMPqm.exe
  2⤵
  PID:9296
- C:\Windows\System\qLdEPxO.exe
  C:\Windows\System\qLdEPxO.exe
  2⤵
  PID:9312
- C:\Windows\System\iMHrSEd.exe
  C:\Windows\System\iMHrSEd.exe
  2⤵
  PID:9328
- C:\Windows\System\FQyFzmO.exe
  C:\Windows\System\FQyFzmO.exe
  2⤵
  PID:9344
- C:\Windows\System\ZpvQmdS.exe
  C:\Windows\System\ZpvQmdS.exe
  2⤵
  PID:9360
- C:\Windows\System\GKJRfkn.exe
  C:\Windows\System\GKJRfkn.exe
  2⤵
  PID:9376
- C:\Windows\System\nRpDGWu.exe
  C:\Windows\System\nRpDGWu.exe
  2⤵
  PID:9392
- C:\Windows\System\nsHirgz.exe
  C:\Windows\System\nsHirgz.exe
  2⤵
  PID:9408
- C:\Windows\System\ssiZIYE.exe
  C:\Windows\System\ssiZIYE.exe
  2⤵
  PID:9424
- C:\Windows\System\OmpZQPM.exe
  C:\Windows\System\OmpZQPM.exe
  2⤵
  PID:9440
- C:\Windows\System\NHaisNK.exe
  C:\Windows\System\NHaisNK.exe
  2⤵
  PID:9456
- C:\Windows\System\wsYaDNH.exe
  C:\Windows\System\wsYaDNH.exe
  2⤵
  PID:9476
- C:\Windows\System\MqBqiKh.exe
  C:\Windows\System\MqBqiKh.exe
  2⤵
  PID:9492
- C:\Windows\System\ATeNwwo.exe
  C:\Windows\System\ATeNwwo.exe
  2⤵
  PID:9508
- C:\Windows\System\ZIJqLXf.exe
  C:\Windows\System\ZIJqLXf.exe
  2⤵
  PID:9524
- C:\Windows\System\bWkdqIr.exe
  C:\Windows\System\bWkdqIr.exe
  2⤵
  PID:9540
- C:\Windows\System\jWOXmAS.exe
  C:\Windows\System\jWOXmAS.exe
  2⤵
  PID:9560
- C:\Windows\System\MFtCFVs.exe
  C:\Windows\System\MFtCFVs.exe
  2⤵
  PID:9576
- C:\Windows\System\LWWAfxs.exe
  C:\Windows\System\LWWAfxs.exe
  2⤵
  PID:9592
- C:\Windows\System\gaSkiam.exe
  C:\Windows\System\gaSkiam.exe
  2⤵
  PID:9608
- C:\Windows\System\jdzNhSZ.exe
  C:\Windows\System\jdzNhSZ.exe
  2⤵
  PID:9624
- C:\Windows\System\QHnJvsO.exe
  C:\Windows\System\QHnJvsO.exe
  2⤵
  PID:9640
- C:\Windows\System\TgcfUwg.exe
  C:\Windows\System\TgcfUwg.exe
  2⤵
  PID:9660
- C:\Windows\System\rhAzPAk.exe
  C:\Windows\System\rhAzPAk.exe
  2⤵
  PID:9680
- C:\Windows\System\ZTGknNh.exe
  C:\Windows\System\ZTGknNh.exe
  2⤵
  PID:9700
- C:\Windows\System\DZetUFU.exe
  C:\Windows\System\DZetUFU.exe
  2⤵
  PID:9716
- C:\Windows\System\vfagJBP.exe
  C:\Windows\System\vfagJBP.exe
  2⤵
  PID:9740
- C:\Windows\System\UyegNqt.exe
  C:\Windows\System\UyegNqt.exe
  2⤵
  PID:9760
- C:\Windows\System\ccybezk.exe
  C:\Windows\System\ccybezk.exe
  2⤵
  PID:9776
- C:\Windows\System\sXTgSse.exe
  C:\Windows\System\sXTgSse.exe
  2⤵
  PID:9792
- C:\Windows\System\irwARrV.exe
  C:\Windows\System\irwARrV.exe
  2⤵
  PID:9808
- C:\Windows\System\ilOVnLV.exe
  C:\Windows\System\ilOVnLV.exe
  2⤵
  PID:9824
- C:\Windows\System\SpXUDUq.exe
  C:\Windows\System\SpXUDUq.exe
  2⤵
  PID:9840
- C:\Windows\System\AGWdihE.exe
  C:\Windows\System\AGWdihE.exe
  2⤵
  PID:9856
- C:\Windows\System\mGNwqAz.exe
  C:\Windows\System\mGNwqAz.exe
  2⤵
  PID:9876
- C:\Windows\System\JzLjLAO.exe
  C:\Windows\System\JzLjLAO.exe
  2⤵
  PID:9892
- C:\Windows\System\HHOIAob.exe
  C:\Windows\System\HHOIAob.exe
  2⤵
  PID:9908
- C:\Windows\System\ohjogjR.exe
  C:\Windows\System\ohjogjR.exe
  2⤵
  PID:9924
- C:\Windows\System\oxeDWlj.exe
  C:\Windows\System\oxeDWlj.exe
  2⤵
  PID:9944
- C:\Windows\System\WvYvoYc.exe
  C:\Windows\System\WvYvoYc.exe
  2⤵
  PID:9960
- C:\Windows\System\ngPKVQF.exe
  C:\Windows\System\ngPKVQF.exe
  2⤵
  PID:9976
- C:\Windows\System\gqLcnSD.exe
  C:\Windows\System\gqLcnSD.exe
  2⤵
  PID:9992
- C:\Windows\System\UCYAAxS.exe
  C:\Windows\System\UCYAAxS.exe
  2⤵
  PID:10008
- C:\Windows\System\SWaVsRL.exe
  C:\Windows\System\SWaVsRL.exe
  2⤵
  PID:10024
- C:\Windows\System\WDFecKa.exe
  C:\Windows\System\WDFecKa.exe
  2⤵
  PID:10040
- C:\Windows\System\iuKmzfs.exe
  C:\Windows\System\iuKmzfs.exe
  2⤵
  PID:10056
- C:\Windows\System\RhiEuzd.exe
  C:\Windows\System\RhiEuzd.exe
  2⤵
  PID:10236
- C:\Windows\System\hApkTpA.exe
  C:\Windows\System\hApkTpA.exe
  2⤵
  PID:8212
- C:\Windows\System\FwjrZTC.exe
  C:\Windows\System\FwjrZTC.exe
  2⤵
  PID:8836
- C:\Windows\System\WrRgCQc.exe
  C:\Windows\System\WrRgCQc.exe
  2⤵
  PID:9256
- C:\Windows\System\KgykwCU.exe
  C:\Windows\System\KgykwCU.exe
  2⤵
  PID:9272
- C:\Windows\System\RskYADO.exe
  C:\Windows\System\RskYADO.exe
  2⤵
  PID:9352
- C:\Windows\System\upoxMLd.exe
  C:\Windows\System\upoxMLd.exe
  2⤵
  PID:9416
- C:\Windows\System\QriVncm.exe
  C:\Windows\System\QriVncm.exe
  2⤵
  PID:9308
- C:\Windows\System\RWqTawu.exe
  C:\Windows\System\RWqTawu.exe
  2⤵
  PID:9372
- C:\Windows\System\iljWxst.exe
  C:\Windows\System\iljWxst.exe
  2⤵
  PID:9436
- C:\Windows\System\GikHPZS.exe
  C:\Windows\System\GikHPZS.exe
  2⤵
  PID:9516
- C:\Windows\System\inWPtDt.exe
  C:\Windows\System\inWPtDt.exe
  2⤵
  PID:9532
- C:\Windows\System\pvyLJrc.exe
  C:\Windows\System\pvyLJrc.exe
  2⤵
  PID:9556
- C:\Windows\System\uMoXzeA.exe
  C:\Windows\System\uMoXzeA.exe
  2⤵
  PID:9616
- C:\Windows\System\QuHPgGZ.exe
  C:\Windows\System\QuHPgGZ.exe
  2⤵
  PID:9648
- C:\Windows\System\axAkTGL.exe
  C:\Windows\System\axAkTGL.exe
  2⤵
  PID:9692
- C:\Windows\System\hFIufvY.exe
  C:\Windows\System\hFIufvY.exe
  2⤵
  PID:9732
- C:\Windows\System\FwqCPUZ.exe
  C:\Windows\System\FwqCPUZ.exe
  2⤵
  PID:9772
- C:\Windows\System\uVyGNpU.exe
  C:\Windows\System\uVyGNpU.exe
  2⤵
  PID:9864
- C:\Windows\System\MUKmhpv.exe
  C:\Windows\System\MUKmhpv.exe
  2⤵
  PID:9904
- C:\Windows\System\UvDlyxL.exe
  C:\Windows\System\UvDlyxL.exe
  2⤵
  PID:9604
- C:\Windows\System\xbZwyeg.exe
  C:\Windows\System\xbZwyeg.exe
  2⤵
  PID:9672
- C:\Windows\System\wBrMLxy.exe
  C:\Windows\System\wBrMLxy.exe
  2⤵
  PID:9848
- C:\Windows\System\TISmQvT.exe
  C:\Windows\System\TISmQvT.exe
  2⤵
  PID:9940
- C:\Windows\System\aDIHmZh.exe
  C:\Windows\System\aDIHmZh.exe
  2⤵
  PID:9888
- C:\Windows\System\bDpfSxR.exe
  C:\Windows\System\bDpfSxR.exe
  2⤵
  PID:9784
- C:\Windows\System\zYcpQgM.exe
  C:\Windows\System\zYcpQgM.exe
  2⤵
  PID:10000
- C:\Windows\System\Ezjjvbg.exe
  C:\Windows\System\Ezjjvbg.exe
  2⤵
  PID:9984
- C:\Windows\System\gUoWEcC.exe
  C:\Windows\System\gUoWEcC.exe
  2⤵
  PID:10048
- C:\Windows\System\CuXmrcR.exe
  C:\Windows\System\CuXmrcR.exe
  2⤵
  PID:10072
- C:\Windows\System\bYJaDwQ.exe
  C:\Windows\System\bYJaDwQ.exe
  2⤵
  PID:10088
- C:\Windows\System\CnZZLVO.exe
  C:\Windows\System\CnZZLVO.exe
  2⤵
  PID:10104
- C:\Windows\System\SfPVuYu.exe
  C:\Windows\System\SfPVuYu.exe
  2⤵
  PID:10120
- C:\Windows\System\sajuvuR.exe
  C:\Windows\System\sajuvuR.exe
  2⤵
  PID:10144
- C:\Windows\System\EEVrOTi.exe
  C:\Windows\System\EEVrOTi.exe
  2⤵
  PID:10168
- C:\Windows\System\UGRXgiC.exe
  C:\Windows\System\UGRXgiC.exe
  2⤵
  PID:10224
- C:\Windows\System\VMAJrqf.exe
  C:\Windows\System\VMAJrqf.exe
  2⤵
  PID:10212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ACWJwnM.exe

Filesize
3.0MB

MD5
d2c968b36f3f5c19c3d1430104bd4c91

SHA1
539d3e42ddf82d2c8b03ac2712e3dff1c0213cb3

SHA256
5e181d4d9b94bdbb848ca7906909adce5339d59c5a584fcf3bd43c0dcead6363

SHA512
b8bbbd3606f0d52c0b30ee34598aef16d63d8c83b50ff2140b66c6afbd4cc924ed9fe173c510024d6bc314dee8bb9f71298ced9d49258304bcdc528e5f9176e3

Download Submit
C:\Windows\system\BauQYEq.exe

Filesize
3.0MB

MD5
b12c23d2fcab981fb230e1d3e91f40d0

SHA1
e34b09d68829b19012bc441b03fba1b8f087594c

SHA256
97285e9a82902e120dc1527949614f87d5f4478ea75b9884596a385f648c7b66

SHA512
938df899ce1685740d60c62c4ca937d55a30d9ed2bd94f27d048e6731179236fbe7c6c7b47c86547b4d4db843cdaf4e18a206101c00efe45ee9228e4f95300b0

Download Submit
C:\Windows\system\CsDHGbY.exe

Filesize
3.0MB

MD5
cf5812648eaebef1aa131e6819a6acc0

SHA1
7e708d6dc459491b20d48384273c7f46bff8c6d8

SHA256
af5fc4ea520d0dc621554f1c0d685dfa0909948f8c7776d13f13bd9ec6305dec

SHA512
e30793ff9f6db702e5f3376049cc635517c6ba52faf9d39d667cbc80cd2ffd274de33cbc2107753fc9372c81b817c70f7683cc3747e97c683e86130671b1d94e

Download Submit
C:\Windows\system\DJtkeXe.exe

Filesize
3.0MB

MD5
8cc71f877fd95a00468f9d45d123bcda

SHA1
cdcf074c76f7c1ae900a26028b301cae93919755

SHA256
689c6f339f65cca76b214e27616a4396e361048d5751835d988cdb1f1812eca7

SHA512
b49a21f1ca1a8c3dd1fc44b7a5237930ffb24c686a93a88c76d741f846aa39e745d60fff1696e9957f54540d3ee5968e839a3f068de72bd676eb22d96117d8ee

Download Submit
C:\Windows\system\FYktpqG.exe

Filesize
3.0MB

MD5
b0e9fd17e48722e90a021e31268ebaae

SHA1
c34aa0d7510b8b9da38d6cc2565acf5ba4ea59a9

SHA256
a8d1aa5df02843bbcad3ae879fb8676e484e225c954e3e03f335f3993cbfbcc0

SHA512
7d708133f03e71183d57461f642b82bff1fb0d0405d852c8cca0b5614b46124716ac5220b7172ce2fbda1a2e1084360a6e1a73f95d768df057101c5bffedbbde

Download Submit
C:\Windows\system\FtOzldY.exe

Filesize
3.0MB

MD5
1b41c448635507a30ea37712edc3aa37

SHA1
51209812d9184a9c07579b34c866c44efeafde3a

SHA256
63f57a4cb9466da7b38d9093949fd33a29b29641850380516f07cb450c280a8d

SHA512
986bbc49ec6f669906b11610cdb462536c78ff98f374606e816d7583b5ae214c36094dfdf76b276a682b17dd5db1e09921762dfa31a208c9c08d6384648166e3

Download Submit
C:\Windows\system\HemkfoJ.exe

Filesize
3.0MB

MD5
0eeb9af7d4043155ee38152326f82f60

SHA1
afd920501e15886dfe6e5c2eadc734623e0f20e9

SHA256
ac5222d30dc1b901f4b4b2d42a6115cfd7926b2d9e53037b44e06dfde875bf3f

SHA512
8c0c44322801ac0f9e7c43047249f1cdd9550afea508a54c01b74d66d3dd106ec6d9a1a78cc1aa2ff7ddf1f99eeb47f6882805a1bbe00b32dddab341e9b69c70

Download Submit
C:\Windows\system\MIpkEiz.exe

Filesize
3.0MB

MD5
2549f7d27131833286073ef6ebe5161c

SHA1
f4a16c85ed89460f0211d9c8f65c238688129ff5

SHA256
cb106d0b67c449924aed330198d4ead09dce205535cb7e67b3de3948dee446a6

SHA512
ed147de06e716ebdf01a9d2c39f01ff3768cb7467818630942aba0f63d3b40857aa8c1356d2aab22bf3048862ef6b37ea2a732b072eecfadebe2c4b9b0868220

Download Submit
C:\Windows\system\PimyZiU.exe

Filesize
3.0MB

MD5
3135559fcfb09cdfccf38517b87a8584

SHA1
6556b751c571a939fd201abfece5fbd924df7c2e

SHA256
2974ae8dc9653047442d24b92ba4340871abb28252b93ef1cb57918a67d9ef71

SHA512
5b54cc2286cedbc1dc578e8d29f08af522dd792de7d93cc24530cb3cb52c33d4f15e42f6f62f38e0459e2bea3d06d0af7d752c936b3f755bd28c9beb29424e76

Download Submit
C:\Windows\system\PmDUaEy.exe

Filesize
3.0MB

MD5
55e3ced6b718fbd80dd1df5ca2913200

SHA1
b8068c6c7df546bc37a37996aa5206ac9708c559

SHA256
a5156b92d8d6dfceb03ee671b9c1d88a5015c941259d50021bf133e70e3e2be6

SHA512
2bb046ae759e2cd32a7877a2e9958153283f96b7cac669a77e163fc08d1ec19e79f168f8a0244633eb60168d5bf7c27d88e313bfeca45a38166307a1d4dd17c0

Download Submit
C:\Windows\system\QkGABbw.exe

Filesize
3.0MB

MD5
34ef51d0015957222de1f9c16dc4bc7d

SHA1
05f60220667934e56c0804d06107ead6ba0aa65d

SHA256
02511306bfad605ee68c0fa0ba99c8f29419c074fa96b9262b796750be9d66cc

SHA512
46953b12857e8d656a154345eb373daccaac20fb33183ed14e8539531a2095872f2f45935937c56918c87faa8c8b66b3879094840ae3f218d8194fa4ca8d8939

Download Submit
C:\Windows\system\SHWRWMT.exe

Filesize
3.0MB

MD5
3bb54c04ea0a346809af89c72cfa06dc

SHA1
ae203557809f8573d21dd3d8baa6a9751c6513f8

SHA256
1b9071529b4eb7345ad289cf43560d199193c0362d637bd5302e5ae9bd3e4d5d

SHA512
8fd32c6f1b8a3122c898a15e3ff0ff367bb55fafdf129ca9887c39c909b06a9722a6ef61815ca4a90c00046923ed26f656015d03bf7e66613f32a081e175479d

Download Submit
C:\Windows\system\TfzZdkB.exe

Filesize
3.0MB

MD5
cd600aef128075449ad6f647af6768c9

SHA1
7563729d24e2d824460e9e5f60936aa059aa37d2

SHA256
865465224815ca498ed85ff0a9bccce69aa3db9310ec4167f817762cccb60b03

SHA512
6883523525ad1dc51ebcdffbed108cec5c2a93eb9576de25c842da21e73cc6736aa7be8bca933c814991d5e19c04912ae8227036f9b7969a9f46ab798e5e8d93

Download Submit
C:\Windows\system\UZgDsyO.exe

Filesize
3.0MB

MD5
7196bdc03a344bef7ade57291c64fc21

SHA1
ddb55cd0387635d35bcdf0fcf057ceefb12e377f

SHA256
dcfa0b987cd9f8353a5ccdc7b69c8f21ab9dd4af0aa7fb53b9839d31fc72f072

SHA512
dc5c9c5bc81daed5167fa73be2849b539cf81293ad4a4e07d729b2c8e5702bf86e47a95630dd610b09e99bced156989cfff44bd7c9aefc0be66b2e8341508b97

Download Submit
C:\Windows\system\VbULbeL.exe

Filesize
3.0MB

MD5
1f0520de84d917c6db131c6068b9bc0f

SHA1
d35582ef2998c0330d718dfd1fc27ed521948067

SHA256
adf9f222bc482c7a6ef55c11b15706e3b3695c1aa6041d591b6d38ea3f1af8e7

SHA512
f25c51541a3f9cd715a993ae6914af97786096b573851f75c88d6ad029a37e2ac1ff0b61b42c1d3d69c4ae9f48b3156397f32a3fb0a302471b35c9b96cb0b00b

Download Submit
C:\Windows\system\WCnchfN.exe

Filesize
3.0MB

MD5
7d62e1cd23d0d9f183359ecdf0cb66ab

SHA1
9a2c0e1e6567282020921d5a6350a1d4a331d45c

SHA256
5b81a5cb352df2e7a315486fc7b9e1ba19d4ed92e45a5d0300b01a419c86ef17

SHA512
993cf12ebf3c099fe568a846a7f8de522b9a9fd4dfae9c2dbc39549f07d6dfb79f8566ab92e2af756ec437dff96105fbd8d306b9a9d78749c06bcd3bcf76712c

Download Submit
C:\Windows\system\YprTinZ.exe

Filesize
3.0MB

MD5
ba64536703868d3da41d4f63770108d7

SHA1
d9ebfc487647a3931af52274526db86830731cea

SHA256
5c9d0f7b1c52ee56ffc4fa6b16c96b6c56409b1c37efc617b4b472a1562d41b8

SHA512
9ca55b56377ecc5e3208c8204019d37ef9b677b2b5f2ec29f2ac0c4390c1a9b4795b8cd41da031ba27a07f8a49d2b9a329ac1038d14aeefcf8ff6b29eadcfe49

Download Submit
C:\Windows\system\blgjXcI.exe

Filesize
3.0MB

MD5
20ad4afe1661e7a56bafcececdd87097

SHA1
89eafd9fca4911a95320245782b39c66bd4c7b9b

SHA256
e9c922aa9ce2ea5803becb84e080773271e03f747a7f6be63f43cf221c032045

SHA512
7d9dd27c886d194317d069d5ad8b757f2d84705fd63c0a5b69140bbbc046b6113e839c949847a6a1614cd7d23e2c742bccc370a54d066b45165fb2aae260507d

Download Submit
C:\Windows\system\dEDwhNu.exe

Filesize
3.0MB

MD5
86a8016ffd6ff8a0006989cb3fc20706

SHA1
5b3579f5738d81d16d336b68f43b1941d2cc30a2

SHA256
e8c3a578d2a23632cf33fd0428f1e8217d982293ceb0a84739480e3783784c09

SHA512
2002c94920c3326cfdece523c928807a1488275a692d93e557a03cac04523ceac7cb1ab7939205142f256eddae215413fed2df8f732e64a6de8a3811a48abb81

Download Submit
C:\Windows\system\hhUaWqz.exe

Filesize
3.0MB

MD5
887c074190c0187727df424389bc55bb

SHA1
45f005db0cf79e289abce3f7f4f5949bfc001492

SHA256
8921b1698325885c8afe047aabd2bc00a78526dddedc00087e12282d4f15f12d

SHA512
50b193b8d8f677ea5c2324f74f2406809224632b356b710772b8c52819eeb2a7ccd599aa1379338e7d4192f92ca6556cca265facd77ec9716abe06f0794d1001

Download Submit
C:\Windows\system\iSuRHus.exe

Filesize
3.0MB

MD5
02146ff6715b9a434bfb9ad4ec49305a

SHA1
6fdf4c411f45d07082690b89960f2af8bc4bf395

SHA256
06149c81e3bb704180ebf2434fe38cc48bbb86c4e78888dce609754637eaf510

SHA512
153792b6826a96ac55a7c7c04e4ad96ed6347920d35a39d5853b7565e00f19c14cfd803e991de70cd4b6b8513f28a09c369ed69485592ac98ed9f339d7fde8bc

Download Submit
C:\Windows\system\ihCRAeE.exe

Filesize
3.0MB

MD5
9e6ee14c7188729b530c55f094d9a45e

SHA1
206750feae74e593ad7952f9890adfb02fd5a5c5

SHA256
4649e54cfa396e734144c5d1252d1f3afd77e5b5e72ef885151463d48ce99893

SHA512
23dc6cef7798ad45c2d9d67ce3246344929962709c076e823aace34c20138e8dd8bacb066c7d7c1096923b7e934f68ae7c9764d00ca873c4e174f9edf9ebfa13

Download Submit
C:\Windows\system\jXAPjdh.exe

Filesize
3.0MB

MD5
be38d4454c20cc95c501388c29c8e73f

SHA1
156898eae45da28694d94c4fbe75fbdfb2419b7d

SHA256
537db0784ce33148ad9996aa5d10e92a15f6f06bda2977302c4ee55b3ed32e75

SHA512
f5946d7c8ce0961f377bdf85ee153354c812b8ffae97dc4726b0f0626d3b041ce7baa040655101cce59b56555c54359e21921d50c2dc2a151f737d8fabd212d7

Download Submit
C:\Windows\system\ntAqmdY.exe

Filesize
3.0MB

MD5
ba7950c2c81ab04c8bc359fddd08424b

SHA1
d2b14f222fb5af073c94ce5e5a488667aee6a886

SHA256
51b44d396ffd788f6adaa12a0d97be194e1acbe0cfeb12a215ffe756cce37cde

SHA512
87e5df6f6af5ba3716c5589cb32e435556fa09c9b7c2d6172d0a9f6624d8285d4280c0f9a85b1fad57702597b5e230f31b4ef1cb616d7d30b8ab8eaaa6a89113

Download Submit
C:\Windows\system\paFxDrG.exe

Filesize
3.0MB

MD5
ef3a0b66a22c85a6e4414e169d9f02e6

SHA1
7bf881ce3717edc08894dbcbd4fdb6341d1e93b9

SHA256
636c179d083bcedde0ee2b0b19147bc54a1152d9b21751c0f63fbc8e57c0e05f

SHA512
7299b94d58164ca3c3ad552a2244e4f405df6684922ab6ddc5a8a746c462290354ceb26db8829ae303dc91d585c216ace429347ec259fa06a49055ba6a05009a

Download Submit
C:\Windows\system\rBrDraH.exe

Filesize
3.0MB

MD5
32429c375afd6cc9bc3a4203021d8d4a

SHA1
87c9c8d989a1d4f8ac80769b94e2fe5f7a2038d1

SHA256
d68d82976525c96c8c972439c3ef69524b6cc5c5fb4ab04bba32a07486c746b6

SHA512
6b3dda4549a2530e379cdb6000abe6ed71246535aa6fe7caf29cf79d258c8a60fab627c4de91bc8628ff61e6ba83746cbf098342b297dcb407818569590016de

Download Submit
C:\Windows\system\vgSjTFC.exe

Filesize
3.0MB

MD5
44fe31ff5cf329142050531298a7b759

SHA1
5d6f797ab40809e20d4a6765857dcdb245f3fe3b

SHA256
19f4aeb160538f9404dc5fb0a21452fa6ded2b909cfb4659c56171932e323930

SHA512
3d366ce25d07150b582aeff24d1ae3656eee87986c52e30efa7eb06616820cb3afe95a0ec90c6e12121e9e10e72d2ccee325a8f04db593159f6aed8b1cfe8e5f

Download Submit
C:\Windows\system\vygrsaF.exe

Filesize
3.0MB

MD5
34aa8d41f6552791075d8a51f26989b2

SHA1
ff9698482da9a593673553beee67668b2728ca00

SHA256
134a7e59490bb364a5bfd6d13328706886a10fc55e3cd62949332cb6b06d3a28

SHA512
35ce304c81e33ab4c73238eb01d467ec7f30d6cd3513686bdcdc5cc36849cd81f2a44efee9b856d1d11638a402965e92928f951431672c049e2132716bdb6508

Download Submit
C:\Windows\system\woHaGFW.exe

Filesize
3.0MB

MD5
e9dd90f62836ae550fe2fe6fa26dca8c

SHA1
f5b42e5a921c5b2375c732b676bb23733aa521ef

SHA256
3af557967de11b32b2198d623b5e10799708384ef657553ea75e578ab2310436

SHA512
133d6016f9428f034c2a0b9b652ee191c2b9a12baafc4affef9dbcf31129204aec2e66aa1db2b982b9dde5b400edd57ed5d684a85d7828fe6188496526ac1647

Download Submit
\Windows\system\SmAwBUO.exe

Filesize
3.0MB

MD5
9318e0ef9ce524db7c034b971a7ba9e2

SHA1
dc4102f4c78ae6966c3f9536bf6f958bb5f94ec6

SHA256
77084aff6d70b9aa62de3a484b83a7b857d9199a6831f4dfe25472f71a6cac40

SHA512
fb1f98af2b98bc90f2780955b0218a194e6e2dd71a362c0d87bd19d02bff2746d30770ec9dd9b26496148a506736ccc7a0cf055e710c461e72d0ca216a0f9502

Download Submit
\Windows\system\ocQWaPR.exe

Filesize
3.0MB

MD5
7fb5022ba878813191822220d80c81df

SHA1
dd9c33b928b6fa4cae376f85a1d3c3f7bc6de99f

SHA256
70be640fc6856a4f5e35c9ed6b6b07f0184b7d84df2874308a92bc16cc53b789

SHA512
bc57ea40092bdef326cdb36a36e7d721d6ad66699278f5b616315b89905dab7f92bdf7cac9b990e2d908f7b3b78e0521aa0868b664ebe2ce81a7e0ac6f8e2379

Download Submit
\Windows\system\uRblnfa.exe

Filesize
3.0MB

MD5
c76af47da7c4a9e949e211c1d4d6eb27

SHA1
70db6b337f09a517f2f2d9f7777b547015ace92e

SHA256
914f11609bf9161ad4b75608a7e86c5261510238bfe50497f2b1fc7dd0aa5d8c

SHA512
f3b0e80ff26972ec21fe0b8e561291a1eae50c68aeac996d24a72e926f11f532ff38d9aa1c7bcd59e393aa50ccfd17dce3c20f95ebaff837ac75adf01f1f5c9a

Download Submit
memory/860-4106-0x000000013F2B0000-0x000000013F604000-memory.dmp

Filesize
3.3MB

Download
memory/860-93-0x000000013F2B0000-0x000000013F604000-memory.dmp

Filesize
3.3MB

Download
memory/1444-21-0x000000013F830000-0x000000013FB84000-memory.dmp

Filesize
3.3MB

Download
memory/1444-95-0x00000000020F0000-0x0000000002444000-memory.dmp

Filesize
3.3MB

Download
memory/1444-102-0x000000013F3F0000-0x000000013F744000-memory.dmp

Filesize
3.3MB

Download
memory/1444-103-0x000000013FF10000-0x0000000140264000-memory.dmp

Filesize
3.3MB

Download
memory/1444-104-0x000000013FE70000-0x00000001401C4000-memory.dmp

Filesize
3.3MB

Download
memory/1444-79-0x00000000020F0000-0x0000000002444000-memory.dmp

Filesize
3.3MB

Download
memory/1444-99-0x000000013F730000-0x000000013FA84000-memory.dmp

Filesize
3.3MB

Download
memory/1444-4099-0x00000000020F0000-0x0000000002444000-memory.dmp

Filesize
3.3MB

Download
memory/1444-4098-0x000000013FC40000-0x000000013FF94000-memory.dmp

Filesize
3.3MB

Download
memory/1444-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/1444-118-0x000000013F070000-0x000000013F3C4000-memory.dmp

Filesize
3.3MB

Download
memory/1444-50-0x000000013F8A0000-0x000000013FBF4000-memory.dmp

Filesize
3.3MB

Download
memory/1444-89-0x00000000020F0000-0x0000000002444000-memory.dmp

Filesize
3.3MB

Download
memory/1444-107-0x000000013FDB0000-0x0000000140104000-memory.dmp

Filesize
3.3MB

Download
memory/1444-97-0x000000013F960000-0x000000013FCB4000-memory.dmp

Filesize
3.3MB

Download
memory/1444-9-0x00000000020F0000-0x0000000002444000-memory.dmp

Filesize
3.3MB

Download
memory/1444-90-0x00000000020F0000-0x0000000002444000-memory.dmp

Filesize
3.3MB

Download
memory/1444-105-0x000000013FC40000-0x000000013FF94000-memory.dmp

Filesize
3.3MB

Download
memory/1444-108-0x00000000020F0000-0x0000000002444000-memory.dmp

Filesize
3.3MB

Download
memory/1444-92-0x00000000020F0000-0x0000000002444000-memory.dmp

Filesize
3.3MB

Download
memory/1444-349-0x000000013F730000-0x000000013FA84000-memory.dmp

Filesize
3.3MB

Download
memory/1444-101-0x000000013FFF0000-0x0000000140344000-memory.dmp

Filesize
3.3MB

Download
memory/1444-0-0x000000013F070000-0x000000013F3C4000-memory.dmp

Filesize
3.3MB

Download
memory/2268-4100-0x000000013F2B0000-0x000000013F604000-memory.dmp

Filesize
3.3MB

Download
memory/2268-26-0x000000013F2B0000-0x000000013F604000-memory.dmp

Filesize
3.3MB

Download
memory/2552-100-0x000000013F0A0000-0x000000013F3F4000-memory.dmp

Filesize
3.3MB

Download
memory/2552-4111-0x000000013F0A0000-0x000000013F3F4000-memory.dmp

Filesize
3.3MB

Download
memory/2580-4105-0x000000013FC40000-0x000000013FF94000-memory.dmp

Filesize
3.3MB

Download
memory/2580-94-0x000000013FC40000-0x000000013FF94000-memory.dmp

Filesize
3.3MB

Download
memory/2692-58-0x000000013F830000-0x000000013FB84000-memory.dmp

Filesize
3.3MB

Download
memory/2692-4108-0x000000013F830000-0x000000013FB84000-memory.dmp

Filesize
3.3MB

Download
memory/2696-98-0x000000013FF10000-0x0000000140264000-memory.dmp

Filesize
3.3MB

Download
memory/2696-4107-0x000000013FF10000-0x0000000140264000-memory.dmp

Filesize
3.3MB

Download
memory/2720-4104-0x000000013F8A0000-0x000000013FBF4000-memory.dmp

Filesize
3.3MB

Download
memory/2720-82-0x000000013F8A0000-0x000000013FBF4000-memory.dmp

Filesize
3.3MB

Download
memory/2812-4101-0x000000013FFF0000-0x0000000140344000-memory.dmp

Filesize
3.3MB

Download
memory/2812-44-0x000000013FFF0000-0x0000000140344000-memory.dmp

Filesize
3.3MB

Download
memory/2836-91-0x000000013F3F0000-0x000000013F744000-memory.dmp

Filesize
3.3MB

Download
memory/2836-4110-0x000000013F3F0000-0x000000013F744000-memory.dmp

Filesize
3.3MB

Download
memory/2856-4109-0x000000013F1A0000-0x000000013F4F4000-memory.dmp

Filesize
3.3MB

Download
memory/2856-109-0x000000013F1A0000-0x000000013F4F4000-memory.dmp

Filesize
3.3MB

Download
memory/2868-4103-0x000000013FE70000-0x00000001401C4000-memory.dmp

Filesize
3.3MB

Download
memory/2868-88-0x000000013FE70000-0x00000001401C4000-memory.dmp

Filesize
3.3MB

Download
memory/3060-96-0x000000013F170000-0x000000013F4C4000-memory.dmp

Filesize
3.3MB

Download
memory/3060-4102-0x000000013F170000-0x000000013F4C4000-memory.dmp

Filesize
3.3MB

Download