xmrig | dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/12/2024, 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
Size

2.6MB
MD5

8d3b304696c863d6501b7eb1e7a1af00
SHA1

a02c13c43b523f7a6b843b413bfe6934b77ee7e1
SHA256

dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c
SHA512

c71dd32fdccc31f2fb8b3c1e8ff3e1f9527a69665feebd77c7a1402b236634a0bfa3e03f26624db21cfc015c13b6d89445d8de45974def0073104d7835f18f83
SSDEEP

49152:EnCbL83y9FdfE0pZ0zCa4wI156uL3pgrCEdMKPFotsgEBrE:EniLf9FdfE0pZB156utgpPFotBEC

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2512-0-0x000000013FDC0000-0x0000000140114000-memory.dmp	xmrig
behavioral1/files/0x000c000000012263-3.dat	xmrig
behavioral1/memory/2288-8-0x000000013FFA0000-0x00000001402F4000-memory.dmp	xmrig
behavioral1/files/0x0008000000016cfe-9.dat	xmrig
behavioral1/memory/3000-14-0x000000013F0D0000-0x000000013F424000-memory.dmp	xmrig
behavioral1/files/0x0008000000016d13-27.dat	xmrig
behavioral1/files/0x0008000000016d3f-39.dat	xmrig
behavioral1/files/0x00060000000174ac-54.dat	xmrig
behavioral1/files/0x001500000001866d-65.dat	xmrig
behavioral1/files/0x0007000000016d24-68.dat	xmrig
behavioral1/memory/3000-72-0x000000013F0D0000-0x000000013F424000-memory.dmp	xmrig
behavioral1/files/0x000600000001752f-76.dat	xmrig
behavioral1/memory/2512-62-0x000000013FDC0000-0x0000000140114000-memory.dmp	xmrig
behavioral1/memory/2752-59-0x000000013F020000-0x000000013F374000-memory.dmp	xmrig
behavioral1/memory/276-77-0x000000013F270000-0x000000013F5C4000-memory.dmp	xmrig
behavioral1/memory/2880-53-0x000000013FA00000-0x000000013FD54000-memory.dmp	xmrig
behavioral1/files/0x0008000000016d47-50.dat	xmrig
behavioral1/memory/2860-75-0x000000013FDD0000-0x0000000140124000-memory.dmp	xmrig
behavioral1/files/0x0007000000016d36-31.dat	xmrig
behavioral1/memory/2816-73-0x000000013FBE0000-0x000000013FF34000-memory.dmp	xmrig
behavioral1/memory/2772-85-0x000000013F910000-0x000000013FC64000-memory.dmp	xmrig
behavioral1/memory/2868-84-0x000000013F860000-0x000000013FBB4000-memory.dmp	xmrig
behavioral1/memory/3028-69-0x000000013FED0000-0x0000000140224000-memory.dmp	xmrig
behavioral1/memory/2288-67-0x000000013FFA0000-0x00000001402F4000-memory.dmp	xmrig
behavioral1/memory/2704-49-0x000000013FD10000-0x0000000140064000-memory.dmp	xmrig
behavioral1/memory/2512-47-0x00000000021B0000-0x0000000002504000-memory.dmp	xmrig
behavioral1/memory/2772-46-0x000000013F910000-0x000000013FC64000-memory.dmp	xmrig
behavioral1/files/0x0007000000016d0b-42.dat	xmrig
behavioral1/files/0x0007000000016d2e-38.dat	xmrig
behavioral1/memory/2868-35-0x000000013F860000-0x000000013FBB4000-memory.dmp	xmrig
behavioral1/memory/2512-29-0x00000000021B0000-0x0000000002504000-memory.dmp	xmrig
behavioral1/memory/2752-86-0x000000013F020000-0x000000013F374000-memory.dmp	xmrig
behavioral1/files/0x0009000000016c58-101.dat	xmrig
behavioral1/files/0x00060000000190d6-112.dat	xmrig
behavioral1/memory/3028-118-0x000000013FED0000-0x0000000140224000-memory.dmp	xmrig
behavioral1/files/0x0009000000018678-91.dat	xmrig
behavioral1/files/0x00060000000190cd-121.dat	xmrig
behavioral1/files/0x00050000000191f3-125.dat	xmrig
behavioral1/files/0x00050000000191f7-130.dat	xmrig
behavioral1/files/0x0005000000019218-135.dat	xmrig
behavioral1/files/0x0005000000019234-145.dat	xmrig
behavioral1/files/0x0005000000019271-161.dat	xmrig
behavioral1/files/0x0005000000019273-165.dat	xmrig
behavioral1/files/0x0005000000019382-175.dat	xmrig
behavioral1/files/0x00050000000193c4-190.dat	xmrig
behavioral1/memory/276-635-0x000000013F270000-0x000000013F5C4000-memory.dmp	xmrig
behavioral1/memory/2860-489-0x000000013FDD0000-0x0000000140124000-memory.dmp	xmrig
behavioral1/memory/2816-327-0x000000013FBE0000-0x000000013FF34000-memory.dmp	xmrig
behavioral1/files/0x00050000000193be-185.dat	xmrig
behavioral1/files/0x0005000000019389-180.dat	xmrig
behavioral1/files/0x0005000000019277-170.dat	xmrig
behavioral1/files/0x000500000001926b-155.dat	xmrig
behavioral1/files/0x000500000001924c-150.dat	xmrig
behavioral1/files/0x0005000000019229-140.dat	xmrig
behavioral1/files/0x0005000000018690-97.dat	xmrig
behavioral1/memory/1104-113-0x000000013F2C0000-0x000000013F614000-memory.dmp	xmrig
behavioral1/files/0x000500000001879b-111.dat	xmrig
behavioral1/memory/2624-96-0x000000013FD10000-0x0000000140064000-memory.dmp	xmrig
behavioral1/memory/2288-3998-0x000000013FFA0000-0x00000001402F4000-memory.dmp	xmrig
behavioral1/memory/3000-3999-0x000000013F0D0000-0x000000013F424000-memory.dmp	xmrig
behavioral1/memory/2868-4000-0x000000013F860000-0x000000013FBB4000-memory.dmp	xmrig
behavioral1/memory/2704-4001-0x000000013FD10000-0x0000000140064000-memory.dmp	xmrig
behavioral1/memory/2772-4002-0x000000013F910000-0x000000013FC64000-memory.dmp	xmrig
behavioral1/memory/2880-4003-0x000000013FA00000-0x000000013FD54000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2288	jlWqUVy.exe
3000	oGvVbvw.exe
2868	qUGBQbi.exe
2704	FuLHjCk.exe
2772	oWeGHAZ.exe
2880	Uyeyvow.exe
2752	mVdhtqd.exe
2624	WHgLRLo.exe
3028	fhCvIhk.exe
2816	WaCWDLK.exe
2860	CKWJBpo.exe
276	WRUmlYW.exe
1104	RdmzyBI.exe
1836	hyNFSGE.exe
1840	rWRgpfX.exe
1888	hKvhAOR.exe
1348	ENmfrss.exe
2128	JPPXCSi.exe
2480	ibOCjpC.exe
1044	ETJdCwG.exe
1420	HghWXnU.exe
1176	TLlHhEB.exe
2472	HZAUyek.exe
2952	gfBLeby.exe
264	OvgcYTV.exe
2456	VfWRatz.exe
2248	WLfrLru.exe
1732	FMhUMtX.exe
1260	OHVKTju.exe
1092	COghbtw.exe
3024	zOUXhCt.exe
1200	nonvwhS.exe
1524	NeWABKx.exe
1552	beOSQUz.exe
2556	VqGKKjD.exe
1208	LvwoFfv.exe
1460	dkAKLBD.exe
1932	xUkiUAD.exe
1680	iPxEnBZ.exe
920	uPfiWxs.exe
540	ewZzxDx.exe
2256	hCKHxxK.exe
2236	psceZHq.exe
2096	BOvFeEo.exe
3020	yKjTHJV.exe
344	jHJNZGA.exe
3064	cXKTdRW.exe
2072	KOjBdxo.exe
548	sarvWse.exe
896	UMoILTv.exe
2148	UpXQjIQ.exe
3016	utXeMZs.exe
1516	gxfsAHk.exe
1628	IkPIhmx.exe
2960	kwryqMk.exe
2668	ZYyNnkL.exe
2796	FtcNbvc.exe
2584	zlKdLFY.exe
3032	qciJXeG.exe
2908	YKGQHEj.exe
2744	WmeHbjt.exe
1020	gxkuzRR.exe
2884	bmvByEb.exe
2732	BbaPLXY.exe

Loads dropped DLL 64 IoCs

pid	Process
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2512-0-0x000000013FDC0000-0x0000000140114000-memory.dmp	upx
behavioral1/files/0x000c000000012263-3.dat	upx
behavioral1/memory/2288-8-0x000000013FFA0000-0x00000001402F4000-memory.dmp	upx
behavioral1/files/0x0008000000016cfe-9.dat	upx
behavioral1/memory/3000-14-0x000000013F0D0000-0x000000013F424000-memory.dmp	upx
behavioral1/files/0x0008000000016d13-27.dat	upx
behavioral1/files/0x0008000000016d3f-39.dat	upx
behavioral1/files/0x00060000000174ac-54.dat	upx
behavioral1/files/0x001500000001866d-65.dat	upx
behavioral1/files/0x0007000000016d24-68.dat	upx
behavioral1/memory/3000-72-0x000000013F0D0000-0x000000013F424000-memory.dmp	upx
behavioral1/files/0x000600000001752f-76.dat	upx
behavioral1/memory/2512-62-0x000000013FDC0000-0x0000000140114000-memory.dmp	upx
behavioral1/memory/2752-59-0x000000013F020000-0x000000013F374000-memory.dmp	upx
behavioral1/memory/276-77-0x000000013F270000-0x000000013F5C4000-memory.dmp	upx
behavioral1/memory/2880-53-0x000000013FA00000-0x000000013FD54000-memory.dmp	upx
behavioral1/files/0x0008000000016d47-50.dat	upx
behavioral1/memory/2860-75-0x000000013FDD0000-0x0000000140124000-memory.dmp	upx
behavioral1/files/0x0007000000016d36-31.dat	upx
behavioral1/memory/2816-73-0x000000013FBE0000-0x000000013FF34000-memory.dmp	upx
behavioral1/memory/2772-85-0x000000013F910000-0x000000013FC64000-memory.dmp	upx
behavioral1/memory/2868-84-0x000000013F860000-0x000000013FBB4000-memory.dmp	upx
behavioral1/memory/3028-69-0x000000013FED0000-0x0000000140224000-memory.dmp	upx
behavioral1/memory/2288-67-0x000000013FFA0000-0x00000001402F4000-memory.dmp	upx
behavioral1/memory/2704-49-0x000000013FD10000-0x0000000140064000-memory.dmp	upx
behavioral1/memory/2772-46-0x000000013F910000-0x000000013FC64000-memory.dmp	upx
behavioral1/files/0x0007000000016d0b-42.dat	upx
behavioral1/files/0x0007000000016d2e-38.dat	upx
behavioral1/memory/2868-35-0x000000013F860000-0x000000013FBB4000-memory.dmp	upx
behavioral1/memory/2512-29-0x00000000021B0000-0x0000000002504000-memory.dmp	upx
behavioral1/memory/2752-86-0x000000013F020000-0x000000013F374000-memory.dmp	upx
behavioral1/files/0x0009000000016c58-101.dat	upx
behavioral1/files/0x00060000000190d6-112.dat	upx
behavioral1/memory/3028-118-0x000000013FED0000-0x0000000140224000-memory.dmp	upx
behavioral1/files/0x0009000000018678-91.dat	upx
behavioral1/files/0x00060000000190cd-121.dat	upx
behavioral1/files/0x00050000000191f3-125.dat	upx
behavioral1/files/0x00050000000191f7-130.dat	upx
behavioral1/files/0x0005000000019218-135.dat	upx
behavioral1/files/0x0005000000019234-145.dat	upx
behavioral1/files/0x0005000000019271-161.dat	upx
behavioral1/files/0x0005000000019273-165.dat	upx
behavioral1/files/0x0005000000019382-175.dat	upx
behavioral1/files/0x00050000000193c4-190.dat	upx
behavioral1/memory/276-635-0x000000013F270000-0x000000013F5C4000-memory.dmp	upx
behavioral1/memory/2860-489-0x000000013FDD0000-0x0000000140124000-memory.dmp	upx
behavioral1/memory/2816-327-0x000000013FBE0000-0x000000013FF34000-memory.dmp	upx
behavioral1/files/0x00050000000193be-185.dat	upx
behavioral1/files/0x0005000000019389-180.dat	upx
behavioral1/files/0x0005000000019277-170.dat	upx
behavioral1/files/0x000500000001926b-155.dat	upx
behavioral1/files/0x000500000001924c-150.dat	upx
behavioral1/files/0x0005000000019229-140.dat	upx
behavioral1/files/0x0005000000018690-97.dat	upx
behavioral1/memory/1104-113-0x000000013F2C0000-0x000000013F614000-memory.dmp	upx
behavioral1/files/0x000500000001879b-111.dat	upx
behavioral1/memory/2624-96-0x000000013FD10000-0x0000000140064000-memory.dmp	upx
behavioral1/memory/2288-3998-0x000000013FFA0000-0x00000001402F4000-memory.dmp	upx
behavioral1/memory/3000-3999-0x000000013F0D0000-0x000000013F424000-memory.dmp	upx
behavioral1/memory/2868-4000-0x000000013F860000-0x000000013FBB4000-memory.dmp	upx
behavioral1/memory/2704-4001-0x000000013FD10000-0x0000000140064000-memory.dmp	upx
behavioral1/memory/2772-4002-0x000000013F910000-0x000000013FC64000-memory.dmp	upx
behavioral1/memory/2880-4003-0x000000013FA00000-0x000000013FD54000-memory.dmp	upx
behavioral1/memory/2624-4004-0x000000013FD10000-0x0000000140064000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zDEDqMk.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\pBalfhD.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\WLfrLru.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\iPxEnBZ.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\frtpkOQ.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\CmXwfOm.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\UgrFRfZ.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\bhgZjzz.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\ewZzxDx.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\UpXQjIQ.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\NPQorEU.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\YZrYWdF.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\iYjsXqp.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\McstoLl.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\HgGUcWq.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\gCEUFBf.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\oWeGHAZ.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\hbpgBLI.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\neqcrna.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\ZnZOrRt.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\ryGZujF.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\ibyVvLd.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\FwpJuyq.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\vdDxJoU.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\mvPBMxl.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\tfNUeRd.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\zRpMDjT.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\LSDiOYe.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\VuirryV.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\PaauUqW.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\HAcNZod.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\VoJvade.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\zicjGXn.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\ENmfrss.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\jTlFiKT.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\djTkEXt.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\vuUSMpk.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\RefwMqG.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\fhtHPMZ.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\iEFaWwX.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\dILXlNW.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\shMgloG.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\UcWYBuR.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\gRWXFbq.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\DejPcOP.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\srMrrXF.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\haHtCgm.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\EZpGCUI.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\FGHtuFm.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\bmvByEb.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\rTccjHD.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\OMRapTV.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\pGNOqia.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\RMpjmkS.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\SeFxVnk.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\AFgyoIN.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\MUXlUva.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\qcBMByJ.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\AcVJjnX.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\XskUeMN.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\TtSnTMY.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\FAhWDnj.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\fHcaibK.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
File created	C:\Windows\System\TNMPdIQ.exe	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2288	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	31
PID 2512 wrote to memory of 2288	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	31
PID 2512 wrote to memory of 2288	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	31
PID 2512 wrote to memory of 3000	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	32
PID 2512 wrote to memory of 3000	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	32
PID 2512 wrote to memory of 3000	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	32
PID 2512 wrote to memory of 2880	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	33
PID 2512 wrote to memory of 2880	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	33
PID 2512 wrote to memory of 2880	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	33
PID 2512 wrote to memory of 2868	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	34
PID 2512 wrote to memory of 2868	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	34
PID 2512 wrote to memory of 2868	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	34
PID 2512 wrote to memory of 3028	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	35
PID 2512 wrote to memory of 3028	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	35
PID 2512 wrote to memory of 3028	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	35
PID 2512 wrote to memory of 2704	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	36
PID 2512 wrote to memory of 2704	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	36
PID 2512 wrote to memory of 2704	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	36
PID 2512 wrote to memory of 2816	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	37
PID 2512 wrote to memory of 2816	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	37
PID 2512 wrote to memory of 2816	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	37
PID 2512 wrote to memory of 2772	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	38
PID 2512 wrote to memory of 2772	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	38
PID 2512 wrote to memory of 2772	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	38
PID 2512 wrote to memory of 2860	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	39
PID 2512 wrote to memory of 2860	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	39
PID 2512 wrote to memory of 2860	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	39
PID 2512 wrote to memory of 2752	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	40
PID 2512 wrote to memory of 2752	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	40
PID 2512 wrote to memory of 2752	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	40
PID 2512 wrote to memory of 276	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	41
PID 2512 wrote to memory of 276	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	41
PID 2512 wrote to memory of 276	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	41
PID 2512 wrote to memory of 2624	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	42
PID 2512 wrote to memory of 2624	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	42
PID 2512 wrote to memory of 2624	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	42
PID 2512 wrote to memory of 1104	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	43
PID 2512 wrote to memory of 1104	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	43
PID 2512 wrote to memory of 1104	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	43
PID 2512 wrote to memory of 1836	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	44
PID 2512 wrote to memory of 1836	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	44
PID 2512 wrote to memory of 1836	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	44
PID 2512 wrote to memory of 1348	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	45
PID 2512 wrote to memory of 1348	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	45
PID 2512 wrote to memory of 1348	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	45
PID 2512 wrote to memory of 1840	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	46
PID 2512 wrote to memory of 1840	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	46
PID 2512 wrote to memory of 1840	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	46
PID 2512 wrote to memory of 2128	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	47
PID 2512 wrote to memory of 2128	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	47
PID 2512 wrote to memory of 2128	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	47
PID 2512 wrote to memory of 1888	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	48
PID 2512 wrote to memory of 1888	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	48
PID 2512 wrote to memory of 1888	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	48
PID 2512 wrote to memory of 2480	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	49
PID 2512 wrote to memory of 2480	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	49
PID 2512 wrote to memory of 2480	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	49
PID 2512 wrote to memory of 1044	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	50
PID 2512 wrote to memory of 1044	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	50
PID 2512 wrote to memory of 1044	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	50
PID 2512 wrote to memory of 1420	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	51
PID 2512 wrote to memory of 1420	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	51
PID 2512 wrote to memory of 1420	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	51
PID 2512 wrote to memory of 1176	2512	JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe	52

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dfab1f96cfff30e0b2ac87d3f4fede8a089d839855f75383b2045bcb54575f5c.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\System\jlWqUVy.exe
  C:\Windows\System\jlWqUVy.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\oGvVbvw.exe
  C:\Windows\System\oGvVbvw.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\Uyeyvow.exe
  C:\Windows\System\Uyeyvow.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\qUGBQbi.exe
  C:\Windows\System\qUGBQbi.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\fhCvIhk.exe
  C:\Windows\System\fhCvIhk.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\FuLHjCk.exe
  C:\Windows\System\FuLHjCk.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\WaCWDLK.exe
  C:\Windows\System\WaCWDLK.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\oWeGHAZ.exe
  C:\Windows\System\oWeGHAZ.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\CKWJBpo.exe
  C:\Windows\System\CKWJBpo.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\mVdhtqd.exe
  C:\Windows\System\mVdhtqd.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\WRUmlYW.exe
  C:\Windows\System\WRUmlYW.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\WHgLRLo.exe
  C:\Windows\System\WHgLRLo.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\RdmzyBI.exe
  C:\Windows\System\RdmzyBI.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\hyNFSGE.exe
  C:\Windows\System\hyNFSGE.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\ENmfrss.exe
  C:\Windows\System\ENmfrss.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\rWRgpfX.exe
  C:\Windows\System\rWRgpfX.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\JPPXCSi.exe
  C:\Windows\System\JPPXCSi.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\hKvhAOR.exe
  C:\Windows\System\hKvhAOR.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\ibOCjpC.exe
  C:\Windows\System\ibOCjpC.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\ETJdCwG.exe
  C:\Windows\System\ETJdCwG.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\HghWXnU.exe
  C:\Windows\System\HghWXnU.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\TLlHhEB.exe
  C:\Windows\System\TLlHhEB.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\HZAUyek.exe
  C:\Windows\System\HZAUyek.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\gfBLeby.exe
  C:\Windows\System\gfBLeby.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\OvgcYTV.exe
  C:\Windows\System\OvgcYTV.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\VfWRatz.exe
  C:\Windows\System\VfWRatz.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\WLfrLru.exe
  C:\Windows\System\WLfrLru.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\FMhUMtX.exe
  C:\Windows\System\FMhUMtX.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\OHVKTju.exe
  C:\Windows\System\OHVKTju.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\COghbtw.exe
  C:\Windows\System\COghbtw.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\zOUXhCt.exe
  C:\Windows\System\zOUXhCt.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\nonvwhS.exe
  C:\Windows\System\nonvwhS.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\NeWABKx.exe
  C:\Windows\System\NeWABKx.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\beOSQUz.exe
  C:\Windows\System\beOSQUz.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\VqGKKjD.exe
  C:\Windows\System\VqGKKjD.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\LvwoFfv.exe
  C:\Windows\System\LvwoFfv.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\dkAKLBD.exe
  C:\Windows\System\dkAKLBD.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\xUkiUAD.exe
  C:\Windows\System\xUkiUAD.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\iPxEnBZ.exe
  C:\Windows\System\iPxEnBZ.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\uPfiWxs.exe
  C:\Windows\System\uPfiWxs.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\ewZzxDx.exe
  C:\Windows\System\ewZzxDx.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\hCKHxxK.exe
  C:\Windows\System\hCKHxxK.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\psceZHq.exe
  C:\Windows\System\psceZHq.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\BOvFeEo.exe
  C:\Windows\System\BOvFeEo.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\yKjTHJV.exe
  C:\Windows\System\yKjTHJV.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\jHJNZGA.exe
  C:\Windows\System\jHJNZGA.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\cXKTdRW.exe
  C:\Windows\System\cXKTdRW.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\KOjBdxo.exe
  C:\Windows\System\KOjBdxo.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\sarvWse.exe
  C:\Windows\System\sarvWse.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\UMoILTv.exe
  C:\Windows\System\UMoILTv.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\UpXQjIQ.exe
  C:\Windows\System\UpXQjIQ.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\utXeMZs.exe
  C:\Windows\System\utXeMZs.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\gxfsAHk.exe
  C:\Windows\System\gxfsAHk.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\IkPIhmx.exe
  C:\Windows\System\IkPIhmx.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\kwryqMk.exe
  C:\Windows\System\kwryqMk.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\ZYyNnkL.exe
  C:\Windows\System\ZYyNnkL.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\FtcNbvc.exe
  C:\Windows\System\FtcNbvc.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\zlKdLFY.exe
  C:\Windows\System\zlKdLFY.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\qciJXeG.exe
  C:\Windows\System\qciJXeG.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\YKGQHEj.exe
  C:\Windows\System\YKGQHEj.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\WmeHbjt.exe
  C:\Windows\System\WmeHbjt.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\gxkuzRR.exe
  C:\Windows\System\gxkuzRR.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\bmvByEb.exe
  C:\Windows\System\bmvByEb.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\BbaPLXY.exe
  C:\Windows\System\BbaPLXY.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\pSijqOv.exe
  C:\Windows\System\pSijqOv.exe
  2⤵
  PID:2688
- C:\Windows\System\vZlJTNw.exe
  C:\Windows\System\vZlJTNw.exe
  2⤵
  PID:2596
- C:\Windows\System\zSIyUqL.exe
  C:\Windows\System\zSIyUqL.exe
  2⤵
  PID:2652
- C:\Windows\System\FMRuiVZ.exe
  C:\Windows\System\FMRuiVZ.exe
  2⤵
  PID:2276
- C:\Windows\System\ilcNnHR.exe
  C:\Windows\System\ilcNnHR.exe
  2⤵
  PID:2892
- C:\Windows\System\ApGhloZ.exe
  C:\Windows\System\ApGhloZ.exe
  2⤵
  PID:2620
- C:\Windows\System\vPXFaZp.exe
  C:\Windows\System\vPXFaZp.exe
  2⤵
  PID:2740
- C:\Windows\System\msgtpXX.exe
  C:\Windows\System\msgtpXX.exe
  2⤵
  PID:1388
- C:\Windows\System\provfJx.exe
  C:\Windows\System\provfJx.exe
  2⤵
  PID:1708
- C:\Windows\System\GfLToiV.exe
  C:\Windows\System\GfLToiV.exe
  2⤵
  PID:1016
- C:\Windows\System\udhhyhR.exe
  C:\Windows\System\udhhyhR.exe
  2⤵
  PID:2400
- C:\Windows\System\dSVWiMC.exe
  C:\Windows\System\dSVWiMC.exe
  2⤵
  PID:856
- C:\Windows\System\TkKvjRM.exe
  C:\Windows\System\TkKvjRM.exe
  2⤵
  PID:1192
- C:\Windows\System\MkGXKen.exe
  C:\Windows\System\MkGXKen.exe
  2⤵
  PID:2172
- C:\Windows\System\ftoiETd.exe
  C:\Windows\System\ftoiETd.exe
  2⤵
  PID:2220
- C:\Windows\System\mGkgAXr.exe
  C:\Windows\System\mGkgAXr.exe
  2⤵
  PID:2124
- C:\Windows\System\GHUxtjD.exe
  C:\Windows\System\GHUxtjD.exe
  2⤵
  PID:1944
- C:\Windows\System\tmtefpX.exe
  C:\Windows\System\tmtefpX.exe
  2⤵
  PID:408
- C:\Windows\System\RJZZndM.exe
  C:\Windows\System\RJZZndM.exe
  2⤵
  PID:2548
- C:\Windows\System\EpLdLUv.exe
  C:\Windows\System\EpLdLUv.exe
  2⤵
  PID:336
- C:\Windows\System\mfRApJq.exe
  C:\Windows\System\mfRApJq.exe
  2⤵
  PID:2560
- C:\Windows\System\MxaysCB.exe
  C:\Windows\System\MxaysCB.exe
  2⤵
  PID:1468
- C:\Windows\System\gDzFHxX.exe
  C:\Windows\System\gDzFHxX.exe
  2⤵
  PID:1664
- C:\Windows\System\KBCIEnG.exe
  C:\Windows\System\KBCIEnG.exe
  2⤵
  PID:860
- C:\Windows\System\shMgloG.exe
  C:\Windows\System\shMgloG.exe
  2⤵
  PID:328
- C:\Windows\System\DyQNSjK.exe
  C:\Windows\System\DyQNSjK.exe
  2⤵
  PID:2088
- C:\Windows\System\YEBksNc.exe
  C:\Windows\System\YEBksNc.exe
  2⤵
  PID:732
- C:\Windows\System\dfodjTi.exe
  C:\Windows\System\dfodjTi.exe
  2⤵
  PID:2332
- C:\Windows\System\lfEjnAw.exe
  C:\Windows\System\lfEjnAw.exe
  2⤵
  PID:2428
- C:\Windows\System\olPqqOc.exe
  C:\Windows\System\olPqqOc.exe
  2⤵
  PID:2404
- C:\Windows\System\FFaSsxt.exe
  C:\Windows\System\FFaSsxt.exe
  2⤵
  PID:2412
- C:\Windows\System\yrRXaAT.exe
  C:\Windows\System\yrRXaAT.exe
  2⤵
  PID:1484
- C:\Windows\System\zwRZvBX.exe
  C:\Windows\System\zwRZvBX.exe
  2⤵
  PID:1508
- C:\Windows\System\LMVjhuV.exe
  C:\Windows\System\LMVjhuV.exe
  2⤵
  PID:2700
- C:\Windows\System\RcJSdow.exe
  C:\Windows\System\RcJSdow.exe
  2⤵
  PID:2872
- C:\Windows\System\GsTYniH.exe
  C:\Windows\System\GsTYniH.exe
  2⤵
  PID:2844
- C:\Windows\System\CUhvBZM.exe
  C:\Windows\System\CUhvBZM.exe
  2⤵
  PID:1536
- C:\Windows\System\boYoaAJ.exe
  C:\Windows\System\boYoaAJ.exe
  2⤵
  PID:1568
- C:\Windows\System\kAUVIXH.exe
  C:\Windows\System\kAUVIXH.exe
  2⤵
  PID:2780
- C:\Windows\System\AjKaNjg.exe
  C:\Windows\System\AjKaNjg.exe
  2⤵
  PID:2852
- C:\Windows\System\rRQHGnw.exe
  C:\Windows\System\rRQHGnw.exe
  2⤵
  PID:3044
- C:\Windows\System\oEDTsGS.exe
  C:\Windows\System\oEDTsGS.exe
  2⤵
  PID:2572
- C:\Windows\System\nUIPZFl.exe
  C:\Windows\System\nUIPZFl.exe
  2⤵
  PID:324
- C:\Windows\System\KrmeazG.exe
  C:\Windows\System\KrmeazG.exe
  2⤵
  PID:848
- C:\Windows\System\sUsoaNP.exe
  C:\Windows\System\sUsoaNP.exe
  2⤵
  PID:1924
- C:\Windows\System\vJQeACC.exe
  C:\Windows\System\vJQeACC.exe
  2⤵
  PID:1040
- C:\Windows\System\vELuyms.exe
  C:\Windows\System\vELuyms.exe
  2⤵
  PID:2152
- C:\Windows\System\nKhMbiV.exe
  C:\Windows\System\nKhMbiV.exe
  2⤵
  PID:584
- C:\Windows\System\YQvZCTE.exe
  C:\Windows\System\YQvZCTE.exe
  2⤵
  PID:280
- C:\Windows\System\xhSCUyC.exe
  C:\Windows\System\xhSCUyC.exe
  2⤵
  PID:916
- C:\Windows\System\gxsoLUM.exe
  C:\Windows\System\gxsoLUM.exe
  2⤵
  PID:1304
- C:\Windows\System\iQNClXy.exe
  C:\Windows\System\iQNClXy.exe
  2⤵
  PID:1608
- C:\Windows\System\pcKtlDq.exe
  C:\Windows\System\pcKtlDq.exe
  2⤵
  PID:2300
- C:\Windows\System\MPEiAfK.exe
  C:\Windows\System\MPEiAfK.exe
  2⤵
  PID:1676
- C:\Windows\System\atIxefK.exe
  C:\Windows\System\atIxefK.exe
  2⤵
  PID:2360
- C:\Windows\System\IVZjLfN.exe
  C:\Windows\System\IVZjLfN.exe
  2⤵
  PID:2280
- C:\Windows\System\FamzKIJ.exe
  C:\Windows\System\FamzKIJ.exe
  2⤵
  PID:1412
- C:\Windows\System\nVjAPzw.exe
  C:\Windows\System\nVjAPzw.exe
  2⤵
  PID:2992
- C:\Windows\System\HhrEIFQ.exe
  C:\Windows\System\HhrEIFQ.exe
  2⤵
  PID:2716
- C:\Windows\System\BADjBbN.exe
  C:\Windows\System\BADjBbN.exe
  2⤵
  PID:2896
- C:\Windows\System\CwrdFrp.exe
  C:\Windows\System\CwrdFrp.exe
  2⤵
  PID:2188
- C:\Windows\System\gbRwEuA.exe
  C:\Windows\System\gbRwEuA.exe
  2⤵
  PID:2996
- C:\Windows\System\tfNUeRd.exe
  C:\Windows\System\tfNUeRd.exe
  2⤵
  PID:2592
- C:\Windows\System\faGWYMC.exe
  C:\Windows\System\faGWYMC.exe
  2⤵
  PID:2648
- C:\Windows\System\mZdzJYK.exe
  C:\Windows\System\mZdzJYK.exe
  2⤵
  PID:1948
- C:\Windows\System\gtIWpHz.exe
  C:\Windows\System\gtIWpHz.exe
  2⤵
  PID:2116
- C:\Windows\System\USVjFKC.exe
  C:\Windows\System\USVjFKC.exe
  2⤵
  PID:2216
- C:\Windows\System\QzsTQzb.exe
  C:\Windows\System\QzsTQzb.exe
  2⤵
  PID:2664
- C:\Windows\System\VhAQpgL.exe
  C:\Windows\System\VhAQpgL.exe
  2⤵
  PID:448
- C:\Windows\System\xmavjXg.exe
  C:\Windows\System\xmavjXg.exe
  2⤵
  PID:2272
- C:\Windows\System\SPUAqgC.exe
  C:\Windows\System\SPUAqgC.exe
  2⤵
  PID:604
- C:\Windows\System\YXAlStZ.exe
  C:\Windows\System\YXAlStZ.exe
  2⤵
  PID:1432
- C:\Windows\System\vSuVGWf.exe
  C:\Windows\System\vSuVGWf.exe
  2⤵
  PID:2836
- C:\Windows\System\raKejMm.exe
  C:\Windows\System\raKejMm.exe
  2⤵
  PID:2160
- C:\Windows\System\PpZpSQM.exe
  C:\Windows\System\PpZpSQM.exe
  2⤵
  PID:2384
- C:\Windows\System\kjGFsfn.exe
  C:\Windows\System\kjGFsfn.exe
  2⤵
  PID:2544
- C:\Windows\System\NPQorEU.exe
  C:\Windows\System\NPQorEU.exe
  2⤵
  PID:1892
- C:\Windows\System\RVvNoXR.exe
  C:\Windows\System\RVvNoXR.exe
  2⤵
  PID:1832
- C:\Windows\System\qHNcLKE.exe
  C:\Windows\System\qHNcLKE.exe
  2⤵
  PID:3076
- C:\Windows\System\SfWCCWA.exe
  C:\Windows\System\SfWCCWA.exe
  2⤵
  PID:3092
- C:\Windows\System\WNUGBFe.exe
  C:\Windows\System\WNUGBFe.exe
  2⤵
  PID:3112
- C:\Windows\System\TewNKXk.exe
  C:\Windows\System\TewNKXk.exe
  2⤵
  PID:3132
- C:\Windows\System\trbRxhv.exe
  C:\Windows\System\trbRxhv.exe
  2⤵
  PID:3148
- C:\Windows\System\fNxYFYx.exe
  C:\Windows\System\fNxYFYx.exe
  2⤵
  PID:3172
- C:\Windows\System\tWLAKeU.exe
  C:\Windows\System\tWLAKeU.exe
  2⤵
  PID:3188
- C:\Windows\System\EaTNzhI.exe
  C:\Windows\System\EaTNzhI.exe
  2⤵
  PID:3208
- C:\Windows\System\fHaeetd.exe
  C:\Windows\System\fHaeetd.exe
  2⤵
  PID:3228
- C:\Windows\System\KEaOVKy.exe
  C:\Windows\System\KEaOVKy.exe
  2⤵
  PID:3252
- C:\Windows\System\LhjUSCF.exe
  C:\Windows\System\LhjUSCF.exe
  2⤵
  PID:3280
- C:\Windows\System\fqQKRrp.exe
  C:\Windows\System\fqQKRrp.exe
  2⤵
  PID:3300
- C:\Windows\System\PCtKRyK.exe
  C:\Windows\System\PCtKRyK.exe
  2⤵
  PID:3320
- C:\Windows\System\YNfiUDf.exe
  C:\Windows\System\YNfiUDf.exe
  2⤵
  PID:3340
- C:\Windows\System\YytmXDa.exe
  C:\Windows\System\YytmXDa.exe
  2⤵
  PID:3360
- C:\Windows\System\tyGlOoK.exe
  C:\Windows\System\tyGlOoK.exe
  2⤵
  PID:3376
- C:\Windows\System\DHVtEwv.exe
  C:\Windows\System\DHVtEwv.exe
  2⤵
  PID:3400
- C:\Windows\System\frtpkOQ.exe
  C:\Windows\System\frtpkOQ.exe
  2⤵
  PID:3416
- C:\Windows\System\QURRnpf.exe
  C:\Windows\System\QURRnpf.exe
  2⤵
  PID:3440
- C:\Windows\System\ECGiRLG.exe
  C:\Windows\System\ECGiRLG.exe
  2⤵
  PID:3460
- C:\Windows\System\jmfsbAp.exe
  C:\Windows\System\jmfsbAp.exe
  2⤵
  PID:3480
- C:\Windows\System\PIqZuzN.exe
  C:\Windows\System\PIqZuzN.exe
  2⤵
  PID:3496
- C:\Windows\System\MIQdqvp.exe
  C:\Windows\System\MIQdqvp.exe
  2⤵
  PID:3512
- C:\Windows\System\YLopAhN.exe
  C:\Windows\System\YLopAhN.exe
  2⤵
  PID:3536
- C:\Windows\System\RnjyDin.exe
  C:\Windows\System\RnjyDin.exe
  2⤵
  PID:3560
- C:\Windows\System\nvHvoUV.exe
  C:\Windows\System\nvHvoUV.exe
  2⤵
  PID:3576
- C:\Windows\System\DkYLcYW.exe
  C:\Windows\System\DkYLcYW.exe
  2⤵
  PID:3596
- C:\Windows\System\jTlFiKT.exe
  C:\Windows\System\jTlFiKT.exe
  2⤵
  PID:3616
- C:\Windows\System\CsHColU.exe
  C:\Windows\System\CsHColU.exe
  2⤵
  PID:3632
- C:\Windows\System\fIlLyph.exe
  C:\Windows\System\fIlLyph.exe
  2⤵
  PID:3656
- C:\Windows\System\zqeCnXW.exe
  C:\Windows\System\zqeCnXW.exe
  2⤵
  PID:3676
- C:\Windows\System\udDZtLv.exe
  C:\Windows\System\udDZtLv.exe
  2⤵
  PID:3700
- C:\Windows\System\hbpgBLI.exe
  C:\Windows\System\hbpgBLI.exe
  2⤵
  PID:3720
- C:\Windows\System\GvaxtiF.exe
  C:\Windows\System\GvaxtiF.exe
  2⤵
  PID:3736
- C:\Windows\System\MAHGCoo.exe
  C:\Windows\System\MAHGCoo.exe
  2⤵
  PID:3756
- C:\Windows\System\PgXCEHm.exe
  C:\Windows\System\PgXCEHm.exe
  2⤵
  PID:3776
- C:\Windows\System\VijxbPl.exe
  C:\Windows\System\VijxbPl.exe
  2⤵
  PID:3796
- C:\Windows\System\sqjNnyi.exe
  C:\Windows\System\sqjNnyi.exe
  2⤵
  PID:3816
- C:\Windows\System\nwcgthY.exe
  C:\Windows\System\nwcgthY.exe
  2⤵
  PID:3840
- C:\Windows\System\ERxJMAy.exe
  C:\Windows\System\ERxJMAy.exe
  2⤵
  PID:3860
- C:\Windows\System\zRpMDjT.exe
  C:\Windows\System\zRpMDjT.exe
  2⤵
  PID:3880
- C:\Windows\System\ECayZNn.exe
  C:\Windows\System\ECayZNn.exe
  2⤵
  PID:3896
- C:\Windows\System\NRwsqGP.exe
  C:\Windows\System\NRwsqGP.exe
  2⤵
  PID:3912
- C:\Windows\System\BxOINBj.exe
  C:\Windows\System\BxOINBj.exe
  2⤵
  PID:3932
- C:\Windows\System\wHeylTS.exe
  C:\Windows\System\wHeylTS.exe
  2⤵
  PID:3952
- C:\Windows\System\ZdcacfI.exe
  C:\Windows\System\ZdcacfI.exe
  2⤵
  PID:3976
- C:\Windows\System\KStdSqG.exe
  C:\Windows\System\KStdSqG.exe
  2⤵
  PID:4008
- C:\Windows\System\LYqGTgq.exe
  C:\Windows\System\LYqGTgq.exe
  2⤵
  PID:4028
- C:\Windows\System\SykyWSI.exe
  C:\Windows\System\SykyWSI.exe
  2⤵
  PID:4048
- C:\Windows\System\eOFrtnD.exe
  C:\Windows\System\eOFrtnD.exe
  2⤵
  PID:4068
- C:\Windows\System\nCAvdeL.exe
  C:\Windows\System\nCAvdeL.exe
  2⤵
  PID:4088
- C:\Windows\System\FaLNDCb.exe
  C:\Windows\System\FaLNDCb.exe
  2⤵
  PID:1448
- C:\Windows\System\imnypqF.exe
  C:\Windows\System\imnypqF.exe
  2⤵
  PID:2408
- C:\Windows\System\lwYOEWS.exe
  C:\Windows\System\lwYOEWS.exe
  2⤵
  PID:680
- C:\Windows\System\CGtVSII.exe
  C:\Windows\System\CGtVSII.exe
  2⤵
  PID:2120
- C:\Windows\System\FyiImKt.exe
  C:\Windows\System\FyiImKt.exe
  2⤵
  PID:2944
- C:\Windows\System\xpJnrnq.exe
  C:\Windows\System\xpJnrnq.exe
  2⤵
  PID:3004
- C:\Windows\System\PGLcriz.exe
  C:\Windows\System\PGLcriz.exe
  2⤵
  PID:3108
- C:\Windows\System\dBnqifo.exe
  C:\Windows\System\dBnqifo.exe
  2⤵
  PID:1716
- C:\Windows\System\llISkNS.exe
  C:\Windows\System\llISkNS.exe
  2⤵
  PID:3124
- C:\Windows\System\VSKLVaA.exe
  C:\Windows\System\VSKLVaA.exe
  2⤵
  PID:3160
- C:\Windows\System\OqvUIKp.exe
  C:\Windows\System\OqvUIKp.exe
  2⤵
  PID:3220
- C:\Windows\System\YjHsepJ.exe
  C:\Windows\System\YjHsepJ.exe
  2⤵
  PID:3272
- C:\Windows\System\mUhLTgF.exe
  C:\Windows\System\mUhLTgF.exe
  2⤵
  PID:3244
- C:\Windows\System\UcvJumZ.exe
  C:\Windows\System\UcvJumZ.exe
  2⤵
  PID:3316
- C:\Windows\System\DsRNojA.exe
  C:\Windows\System\DsRNojA.exe
  2⤵
  PID:3236
- C:\Windows\System\NbNHSID.exe
  C:\Windows\System\NbNHSID.exe
  2⤵
  PID:3356
- C:\Windows\System\OauGfsW.exe
  C:\Windows\System\OauGfsW.exe
  2⤵
  PID:1936
- C:\Windows\System\CmXwfOm.exe
  C:\Windows\System\CmXwfOm.exe
  2⤵
  PID:3424
- C:\Windows\System\NcjvkJW.exe
  C:\Windows\System\NcjvkJW.exe
  2⤵
  PID:3372
- C:\Windows\System\WmQWZhS.exe
  C:\Windows\System\WmQWZhS.exe
  2⤵
  PID:3476
- C:\Windows\System\EFMnowx.exe
  C:\Windows\System\EFMnowx.exe
  2⤵
  PID:3452
- C:\Windows\System\lulWdtp.exe
  C:\Windows\System\lulWdtp.exe
  2⤵
  PID:3488
- C:\Windows\System\OzwahDq.exe
  C:\Windows\System\OzwahDq.exe
  2⤵
  PID:3528
- C:\Windows\System\wEjTZla.exe
  C:\Windows\System\wEjTZla.exe
  2⤵
  PID:3624
- C:\Windows\System\LCeWTlx.exe
  C:\Windows\System\LCeWTlx.exe
  2⤵
  PID:1844
- C:\Windows\System\LwPTMpw.exe
  C:\Windows\System\LwPTMpw.exe
  2⤵
  PID:1544
- C:\Windows\System\RtODuHK.exe
  C:\Windows\System\RtODuHK.exe
  2⤵
  PID:3712
- C:\Windows\System\NnhiKNR.exe
  C:\Windows\System\NnhiKNR.exe
  2⤵
  PID:3792
- C:\Windows\System\CvJxjHP.exe
  C:\Windows\System\CvJxjHP.exe
  2⤵
  PID:3640
- C:\Windows\System\IErQcIv.exe
  C:\Windows\System\IErQcIv.exe
  2⤵
  PID:3728
- C:\Windows\System\MUXlUva.exe
  C:\Windows\System\MUXlUva.exe
  2⤵
  PID:3832
- C:\Windows\System\UzkZfma.exe
  C:\Windows\System\UzkZfma.exe
  2⤵
  PID:3872
- C:\Windows\System\bphWQGw.exe
  C:\Windows\System\bphWQGw.exe
  2⤵
  PID:3944
- C:\Windows\System\pBiwdPu.exe
  C:\Windows\System\pBiwdPu.exe
  2⤵
  PID:3960
- C:\Windows\System\QDhMiAK.exe
  C:\Windows\System\QDhMiAK.exe
  2⤵
  PID:3856
- C:\Windows\System\nShhDUy.exe
  C:\Windows\System\nShhDUy.exe
  2⤵
  PID:3972
- C:\Windows\System\QUUrUPg.exe
  C:\Windows\System\QUUrUPg.exe
  2⤵
  PID:4004
- C:\Windows\System\lpjOiFa.exe
  C:\Windows\System\lpjOiFa.exe
  2⤵
  PID:1940
- C:\Windows\System\rZzPmEl.exe
  C:\Windows\System\rZzPmEl.exe
  2⤵
  PID:4016
- C:\Windows\System\WVYCLqC.exe
  C:\Windows\System\WVYCLqC.exe
  2⤵
  PID:4024
- C:\Windows\System\EXetzYb.exe
  C:\Windows\System\EXetzYb.exe
  2⤵
  PID:4084
- C:\Windows\System\OCrXrsr.exe
  C:\Windows\System\OCrXrsr.exe
  2⤵
  PID:2824
- C:\Windows\System\qCMrxlC.exe
  C:\Windows\System\qCMrxlC.exe
  2⤵
  PID:3052
- C:\Windows\System\SQficnQ.exe
  C:\Windows\System\SQficnQ.exe
  2⤵
  PID:1548
- C:\Windows\System\kbzpORi.exe
  C:\Windows\System\kbzpORi.exe
  2⤵
  PID:844
- C:\Windows\System\jOTRmdi.exe
  C:\Windows\System\jOTRmdi.exe
  2⤵
  PID:2696
- C:\Windows\System\qBYrywK.exe
  C:\Windows\System\qBYrywK.exe
  2⤵
  PID:3100
- C:\Windows\System\Sagfkdu.exe
  C:\Windows\System\Sagfkdu.exe
  2⤵
  PID:1428
- C:\Windows\System\neqcrna.exe
  C:\Windows\System\neqcrna.exe
  2⤵
  PID:3168
- C:\Windows\System\WPkNWwy.exe
  C:\Windows\System\WPkNWwy.exe
  2⤵
  PID:3292
- C:\Windows\System\CLpPbJf.exe
  C:\Windows\System\CLpPbJf.exe
  2⤵
  PID:1916
- C:\Windows\System\qpfVRWi.exe
  C:\Windows\System\qpfVRWi.exe
  2⤵
  PID:1880
- C:\Windows\System\LKWPuys.exe
  C:\Windows\System\LKWPuys.exe
  2⤵
  PID:3392
- C:\Windows\System\DHHaZfO.exe
  C:\Windows\System\DHHaZfO.exe
  2⤵
  PID:1768
- C:\Windows\System\ZnZOrRt.exe
  C:\Windows\System\ZnZOrRt.exe
  2⤵
  PID:3204
- C:\Windows\System\AcZFjdj.exe
  C:\Windows\System\AcZFjdj.exe
  2⤵
  PID:3588
- C:\Windows\System\kmTGrVn.exe
  C:\Windows\System\kmTGrVn.exe
  2⤵
  PID:3524
- C:\Windows\System\vpPNwoo.exe
  C:\Windows\System\vpPNwoo.exe
  2⤵
  PID:3436
- C:\Windows\System\xkFQgQK.exe
  C:\Windows\System\xkFQgQK.exe
  2⤵
  PID:3608
- C:\Windows\System\XRZaLna.exe
  C:\Windows\System\XRZaLna.exe
  2⤵
  PID:3784
- C:\Windows\System\xXvjiLd.exe
  C:\Windows\System\xXvjiLd.exe
  2⤵
  PID:3716
- C:\Windows\System\TIPFftx.exe
  C:\Windows\System\TIPFftx.exe
  2⤵
  PID:3764
- C:\Windows\System\iLaeBRx.exe
  C:\Windows\System\iLaeBRx.exe
  2⤵
  PID:3868
- C:\Windows\System\ezgPutn.exe
  C:\Windows\System\ezgPutn.exe
  2⤵
  PID:3876
- C:\Windows\System\czTKUND.exe
  C:\Windows\System\czTKUND.exe
  2⤵
  PID:1868
- C:\Windows\System\NsUXQfk.exe
  C:\Windows\System\NsUXQfk.exe
  2⤵
  PID:3612
- C:\Windows\System\ykbeNhI.exe
  C:\Windows\System\ykbeNhI.exe
  2⤵
  PID:3836
- C:\Windows\System\XThQqTZ.exe
  C:\Windows\System\XThQqTZ.exe
  2⤵
  PID:4044
- C:\Windows\System\NYHhLSl.exe
  C:\Windows\System\NYHhLSl.exe
  2⤵
  PID:2488
- C:\Windows\System\zGrxBqr.exe
  C:\Windows\System\zGrxBqr.exe
  2⤵
  PID:3940
- C:\Windows\System\YZrYWdF.exe
  C:\Windows\System\YZrYWdF.exe
  2⤵
  PID:3992
- C:\Windows\System\tqJrAVz.exe
  C:\Windows\System\tqJrAVz.exe
  2⤵
  PID:812
- C:\Windows\System\stLJFlv.exe
  C:\Windows\System\stLJFlv.exe
  2⤵
  PID:3156
- C:\Windows\System\MwyijSX.exe
  C:\Windows\System\MwyijSX.exe
  2⤵
  PID:3088
- C:\Windows\System\LAcycWR.exe
  C:\Windows\System\LAcycWR.exe
  2⤵
  PID:3544
- C:\Windows\System\dcZwAVZ.exe
  C:\Windows\System\dcZwAVZ.exe
  2⤵
  PID:3592
- C:\Windows\System\SOiImen.exe
  C:\Windows\System\SOiImen.exe
  2⤵
  PID:3336
- C:\Windows\System\FshvXyY.exe
  C:\Windows\System\FshvXyY.exe
  2⤵
  PID:3752
- C:\Windows\System\mejqFud.exe
  C:\Windows\System\mejqFud.exe
  2⤵
  PID:4040
- C:\Windows\System\fDJcFTx.exe
  C:\Windows\System\fDJcFTx.exe
  2⤵
  PID:3652
- C:\Windows\System\aUywEfU.exe
  C:\Windows\System\aUywEfU.exe
  2⤵
  PID:3264
- C:\Windows\System\ZpKkvTJ.exe
  C:\Windows\System\ZpKkvTJ.exe
  2⤵
  PID:1580
- C:\Windows\System\DOqCkql.exe
  C:\Windows\System\DOqCkql.exe
  2⤵
  PID:2600
- C:\Windows\System\IbWVwHh.exe
  C:\Windows\System\IbWVwHh.exe
  2⤵
  PID:320
- C:\Windows\System\GXtNKpc.exe
  C:\Windows\System\GXtNKpc.exe
  2⤵
  PID:3948
- C:\Windows\System\vElGeuj.exe
  C:\Windows\System\vElGeuj.exe
  2⤵
  PID:2916
- C:\Windows\System\grsTYzy.exe
  C:\Windows\System\grsTYzy.exe
  2⤵
  PID:668
- C:\Windows\System\gNXidQy.exe
  C:\Windows\System\gNXidQy.exe
  2⤵
  PID:3368
- C:\Windows\System\MzCmxfQ.exe
  C:\Windows\System\MzCmxfQ.exe
  2⤵
  PID:1336
- C:\Windows\System\QvXhvzO.exe
  C:\Windows\System\QvXhvzO.exe
  2⤵
  PID:3968
- C:\Windows\System\WEBbcIz.exe
  C:\Windows\System\WEBbcIz.exe
  2⤵
  PID:2616
- C:\Windows\System\jECNkaD.exe
  C:\Windows\System\jECNkaD.exe
  2⤵
  PID:1504
- C:\Windows\System\hlVYZKV.exe
  C:\Windows\System\hlVYZKV.exe
  2⤵
  PID:3584
- C:\Windows\System\jriqqBS.exe
  C:\Windows\System\jriqqBS.exe
  2⤵
  PID:764
- C:\Windows\System\DFjmfmT.exe
  C:\Windows\System\DFjmfmT.exe
  2⤵
  PID:3288
- C:\Windows\System\CtcVVEO.exe
  C:\Windows\System\CtcVVEO.exe
  2⤵
  PID:3644
- C:\Windows\System\ecTbboW.exe
  C:\Windows\System\ecTbboW.exe
  2⤵
  PID:2336
- C:\Windows\System\FBsVJUf.exe
  C:\Windows\System\FBsVJUf.exe
  2⤵
  PID:2748
- C:\Windows\System\csdgbps.exe
  C:\Windows\System\csdgbps.exe
  2⤵
  PID:2268
- C:\Windows\System\zDEDqMk.exe
  C:\Windows\System\zDEDqMk.exe
  2⤵
  PID:1416
- C:\Windows\System\owxLxhM.exe
  C:\Windows\System\owxLxhM.exe
  2⤵
  PID:3548
- C:\Windows\System\RNSCTRC.exe
  C:\Windows\System\RNSCTRC.exe
  2⤵
  PID:2388
- C:\Windows\System\srMrrXF.exe
  C:\Windows\System\srMrrXF.exe
  2⤵
  PID:3824
- C:\Windows\System\whQRbUg.exe
  C:\Windows\System\whQRbUg.exe
  2⤵
  PID:1876
- C:\Windows\System\erherJg.exe
  C:\Windows\System\erherJg.exe
  2⤵
  PID:3084
- C:\Windows\System\sAitoiD.exe
  C:\Windows\System\sAitoiD.exe
  2⤵
  PID:1684
- C:\Windows\System\pEfckRa.exe
  C:\Windows\System\pEfckRa.exe
  2⤵
  PID:1488
- C:\Windows\System\EfeTUuf.exe
  C:\Windows\System\EfeTUuf.exe
  2⤵
  PID:4056
- C:\Windows\System\WdGEErn.exe
  C:\Windows\System\WdGEErn.exe
  2⤵
  PID:3388
- C:\Windows\System\rqgiTAC.exe
  C:\Windows\System\rqgiTAC.exe
  2⤵
  PID:4112
- C:\Windows\System\frNfPdG.exe
  C:\Windows\System\frNfPdG.exe
  2⤵
  PID:4128
- C:\Windows\System\gUQTbWW.exe
  C:\Windows\System\gUQTbWW.exe
  2⤵
  PID:4152
- C:\Windows\System\ImyHWtC.exe
  C:\Windows\System\ImyHWtC.exe
  2⤵
  PID:4172
- C:\Windows\System\pRHpBEL.exe
  C:\Windows\System\pRHpBEL.exe
  2⤵
  PID:4188
- C:\Windows\System\faQGbdY.exe
  C:\Windows\System\faQGbdY.exe
  2⤵
  PID:4204
- C:\Windows\System\LmEjTBd.exe
  C:\Windows\System\LmEjTBd.exe
  2⤵
  PID:4224
- C:\Windows\System\ZBnZUAY.exe
  C:\Windows\System\ZBnZUAY.exe
  2⤵
  PID:4244
- C:\Windows\System\ygEIcoT.exe
  C:\Windows\System\ygEIcoT.exe
  2⤵
  PID:4260
- C:\Windows\System\EtCUkMo.exe
  C:\Windows\System\EtCUkMo.exe
  2⤵
  PID:4280
- C:\Windows\System\ptnaCMm.exe
  C:\Windows\System\ptnaCMm.exe
  2⤵
  PID:4296
- C:\Windows\System\ozrawTe.exe
  C:\Windows\System\ozrawTe.exe
  2⤵
  PID:4312
- C:\Windows\System\HcbeOzP.exe
  C:\Windows\System\HcbeOzP.exe
  2⤵
  PID:4328
- C:\Windows\System\fKKWOlb.exe
  C:\Windows\System\fKKWOlb.exe
  2⤵
  PID:4344
- C:\Windows\System\hkYVODj.exe
  C:\Windows\System\hkYVODj.exe
  2⤵
  PID:4360
- C:\Windows\System\ixVwjqb.exe
  C:\Windows\System\ixVwjqb.exe
  2⤵
  PID:4412
- C:\Windows\System\WFxnOox.exe
  C:\Windows\System\WFxnOox.exe
  2⤵
  PID:4432
- C:\Windows\System\zVFCYKm.exe
  C:\Windows\System\zVFCYKm.exe
  2⤵
  PID:4448
- C:\Windows\System\JiUuEtI.exe
  C:\Windows\System\JiUuEtI.exe
  2⤵
  PID:4472
- C:\Windows\System\oMJBgOf.exe
  C:\Windows\System\oMJBgOf.exe
  2⤵
  PID:4492
- C:\Windows\System\JODhCgf.exe
  C:\Windows\System\JODhCgf.exe
  2⤵
  PID:4520
- C:\Windows\System\JriBGdb.exe
  C:\Windows\System\JriBGdb.exe
  2⤵
  PID:4536
- C:\Windows\System\iufNNUD.exe
  C:\Windows\System\iufNNUD.exe
  2⤵
  PID:4560
- C:\Windows\System\IRHOAfS.exe
  C:\Windows\System\IRHOAfS.exe
  2⤵
  PID:4576
- C:\Windows\System\MONuBjX.exe
  C:\Windows\System\MONuBjX.exe
  2⤵
  PID:4592
- C:\Windows\System\GWaVJmM.exe
  C:\Windows\System\GWaVJmM.exe
  2⤵
  PID:4608
- C:\Windows\System\lVjknjM.exe
  C:\Windows\System\lVjknjM.exe
  2⤵
  PID:4632
- C:\Windows\System\AypopHf.exe
  C:\Windows\System\AypopHf.exe
  2⤵
  PID:4648
- C:\Windows\System\QKcHwlm.exe
  C:\Windows\System\QKcHwlm.exe
  2⤵
  PID:4664
- C:\Windows\System\ItlQGyk.exe
  C:\Windows\System\ItlQGyk.exe
  2⤵
  PID:4684
- C:\Windows\System\ryxnGMW.exe
  C:\Windows\System\ryxnGMW.exe
  2⤵
  PID:4700
- C:\Windows\System\tvwprwb.exe
  C:\Windows\System\tvwprwb.exe
  2⤵
  PID:4716
- C:\Windows\System\NCCftbV.exe
  C:\Windows\System\NCCftbV.exe
  2⤵
  PID:4744
- C:\Windows\System\ldqJsBm.exe
  C:\Windows\System\ldqJsBm.exe
  2⤵
  PID:4764
- C:\Windows\System\JRiMYvO.exe
  C:\Windows\System\JRiMYvO.exe
  2⤵
  PID:4780
- C:\Windows\System\rqMUMti.exe
  C:\Windows\System\rqMUMti.exe
  2⤵
  PID:4796
- C:\Windows\System\kxypbeA.exe
  C:\Windows\System\kxypbeA.exe
  2⤵
  PID:4816
- C:\Windows\System\fqgMFIi.exe
  C:\Windows\System\fqgMFIi.exe
  2⤵
  PID:4836
- C:\Windows\System\XQXuKkH.exe
  C:\Windows\System\XQXuKkH.exe
  2⤵
  PID:4860
- C:\Windows\System\IQzKlhF.exe
  C:\Windows\System\IQzKlhF.exe
  2⤵
  PID:4892
- C:\Windows\System\kkpOLXf.exe
  C:\Windows\System\kkpOLXf.exe
  2⤵
  PID:4908
- C:\Windows\System\nXqejpX.exe
  C:\Windows\System\nXqejpX.exe
  2⤵
  PID:4928
- C:\Windows\System\ghrtSzf.exe
  C:\Windows\System\ghrtSzf.exe
  2⤵
  PID:4944
- C:\Windows\System\jpppVrs.exe
  C:\Windows\System\jpppVrs.exe
  2⤵
  PID:4964
- C:\Windows\System\aSeUtMx.exe
  C:\Windows\System\aSeUtMx.exe
  2⤵
  PID:5000
- C:\Windows\System\qRkTEqO.exe
  C:\Windows\System\qRkTEqO.exe
  2⤵
  PID:5016
- C:\Windows\System\OZqklxy.exe
  C:\Windows\System\OZqklxy.exe
  2⤵
  PID:5032
- C:\Windows\System\kXorwlO.exe
  C:\Windows\System\kXorwlO.exe
  2⤵
  PID:5048
- C:\Windows\System\WxNUtSn.exe
  C:\Windows\System\WxNUtSn.exe
  2⤵
  PID:5068
- C:\Windows\System\brZVWQF.exe
  C:\Windows\System\brZVWQF.exe
  2⤵
  PID:5084
- C:\Windows\System\BhAooid.exe
  C:\Windows\System\BhAooid.exe
  2⤵
  PID:5100
- C:\Windows\System\uoejZgA.exe
  C:\Windows\System\uoejZgA.exe
  2⤵
  PID:3456
- C:\Windows\System\KlMUZLg.exe
  C:\Windows\System\KlMUZLg.exe
  2⤵
  PID:4108
- C:\Windows\System\Esgrqgl.exe
  C:\Windows\System\Esgrqgl.exe
  2⤵
  PID:4136
- C:\Windows\System\wOxCVGl.exe
  C:\Windows\System\wOxCVGl.exe
  2⤵
  PID:4180
- C:\Windows\System\yChgEwb.exe
  C:\Windows\System\yChgEwb.exe
  2⤵
  PID:4252
- C:\Windows\System\LMKaJqZ.exe
  C:\Windows\System\LMKaJqZ.exe
  2⤵
  PID:4124
- C:\Windows\System\SRYmDEe.exe
  C:\Windows\System\SRYmDEe.exe
  2⤵
  PID:4292
- C:\Windows\System\VkMjYPg.exe
  C:\Windows\System\VkMjYPg.exe
  2⤵
  PID:4356
- C:\Windows\System\ZgmZuZt.exe
  C:\Windows\System\ZgmZuZt.exe
  2⤵
  PID:4368
- C:\Windows\System\PSfRBqa.exe
  C:\Windows\System\PSfRBqa.exe
  2⤵
  PID:4376
- C:\Windows\System\HsuvkdM.exe
  C:\Windows\System\HsuvkdM.exe
  2⤵
  PID:4276
- C:\Windows\System\aHLXXwi.exe
  C:\Windows\System\aHLXXwi.exe
  2⤵
  PID:4400
- C:\Windows\System\mlGGgOC.exe
  C:\Windows\System\mlGGgOC.exe
  2⤵
  PID:4468
- C:\Windows\System\jayDFsc.exe
  C:\Windows\System\jayDFsc.exe
  2⤵
  PID:4512
- C:\Windows\System\tuvkmRv.exe
  C:\Windows\System\tuvkmRv.exe
  2⤵
  PID:4548
- C:\Windows\System\hQJjfIg.exe
  C:\Windows\System\hQJjfIg.exe
  2⤵
  PID:4568
- C:\Windows\System\BaJvPuy.exe
  C:\Windows\System\BaJvPuy.exe
  2⤵
  PID:4620
- C:\Windows\System\xzdIeah.exe
  C:\Windows\System\xzdIeah.exe
  2⤵
  PID:4696
- C:\Windows\System\XzqkpJW.exe
  C:\Windows\System\XzqkpJW.exe
  2⤵
  PID:4736
- C:\Windows\System\ovsSVfj.exe
  C:\Windows\System\ovsSVfj.exe
  2⤵
  PID:4776
- C:\Windows\System\SLcaTAC.exe
  C:\Windows\System\SLcaTAC.exe
  2⤵
  PID:4788
- C:\Windows\System\MsidwKa.exe
  C:\Windows\System\MsidwKa.exe
  2⤵
  PID:4804
- C:\Windows\System\fURwsmW.exe
  C:\Windows\System\fURwsmW.exe
  2⤵
  PID:4844
- C:\Windows\System\GEFKlMW.exe
  C:\Windows\System\GEFKlMW.exe
  2⤵
  PID:4792
- C:\Windows\System\FNwjsJi.exe
  C:\Windows\System\FNwjsJi.exe
  2⤵
  PID:4832
- C:\Windows\System\EAUMMNd.exe
  C:\Windows\System\EAUMMNd.exe
  2⤵
  PID:4880
- C:\Windows\System\djTkEXt.exe
  C:\Windows\System\djTkEXt.exe
  2⤵
  PID:4920
- C:\Windows\System\tcEeRhk.exe
  C:\Windows\System\tcEeRhk.exe
  2⤵
  PID:4972
- C:\Windows\System\bSzYlaW.exe
  C:\Windows\System\bSzYlaW.exe
  2⤵
  PID:4992
- C:\Windows\System\cEcwFPr.exe
  C:\Windows\System\cEcwFPr.exe
  2⤵
  PID:4960
- C:\Windows\System\yXiMSlc.exe
  C:\Windows\System\yXiMSlc.exe
  2⤵
  PID:5056
- C:\Windows\System\OLfZgdY.exe
  C:\Windows\System\OLfZgdY.exe
  2⤵
  PID:4104
- C:\Windows\System\tnyFYKf.exe
  C:\Windows\System\tnyFYKf.exe
  2⤵
  PID:4120
- C:\Windows\System\jQQsnLe.exe
  C:\Windows\System\jQQsnLe.exe
  2⤵
  PID:4352
- C:\Windows\System\UcWYBuR.exe
  C:\Windows\System\UcWYBuR.exe
  2⤵
  PID:2784
- C:\Windows\System\Govfvfc.exe
  C:\Windows\System\Govfvfc.exe
  2⤵
  PID:2092
- C:\Windows\System\adrGTEC.exe
  C:\Windows\System\adrGTEC.exe
  2⤵
  PID:5116
- C:\Windows\System\wUKwtDh.exe
  C:\Windows\System\wUKwtDh.exe
  2⤵
  PID:5080
- C:\Windows\System\tyTRifu.exe
  C:\Windows\System\tyTRifu.exe
  2⤵
  PID:4388
- C:\Windows\System\EnlkSuf.exe
  C:\Windows\System\EnlkSuf.exe
  2⤵
  PID:4200
- C:\Windows\System\uXxaoEU.exe
  C:\Windows\System\uXxaoEU.exe
  2⤵
  PID:4444
- C:\Windows\System\NtIGAXi.exe
  C:\Windows\System\NtIGAXi.exe
  2⤵
  PID:4628
- C:\Windows\System\bUuCVzt.exe
  C:\Windows\System\bUuCVzt.exe
  2⤵
  PID:4660
- C:\Windows\System\RcADSxv.exe
  C:\Windows\System\RcADSxv.exe
  2⤵
  PID:4772
- C:\Windows\System\ruVhKjl.exe
  C:\Windows\System\ruVhKjl.exe
  2⤵
  PID:4724
- C:\Windows\System\MnAYENM.exe
  C:\Windows\System\MnAYENM.exe
  2⤵
  PID:4940
- C:\Windows\System\mMAhLJW.exe
  C:\Windows\System\mMAhLJW.exe
  2⤵
  PID:4956
- C:\Windows\System\pfvUlbC.exe
  C:\Windows\System\pfvUlbC.exe
  2⤵
  PID:4324
- C:\Windows\System\OYcNDhg.exe
  C:\Windows\System\OYcNDhg.exe
  2⤵
  PID:4812
- C:\Windows\System\pyocmgQ.exe
  C:\Windows\System\pyocmgQ.exe
  2⤵
  PID:4888
- C:\Windows\System\utDOPzC.exe
  C:\Windows\System\utDOPzC.exe
  2⤵
  PID:4988
- C:\Windows\System\nuBoDra.exe
  C:\Windows\System\nuBoDra.exe
  2⤵
  PID:5024
- C:\Windows\System\kToENTs.exe
  C:\Windows\System\kToENTs.exe
  2⤵
  PID:4288
- C:\Windows\System\oTEBuBB.exe
  C:\Windows\System\oTEBuBB.exe
  2⤵
  PID:4504
- C:\Windows\System\ksvXgCD.exe
  C:\Windows\System\ksvXgCD.exe
  2⤵
  PID:4396
- C:\Windows\System\KgfrgDD.exe
  C:\Windows\System\KgfrgDD.exe
  2⤵
  PID:5040
- C:\Windows\System\vvJdtJQ.exe
  C:\Windows\System\vvJdtJQ.exe
  2⤵
  PID:4556
- C:\Windows\System\qGeNCXU.exe
  C:\Windows\System\qGeNCXU.exe
  2⤵
  PID:4900
- C:\Windows\System\WlvGWUf.exe
  C:\Windows\System\WlvGWUf.exe
  2⤵
  PID:5092
- C:\Windows\System\aoPeZzl.exe
  C:\Windows\System\aoPeZzl.exe
  2⤵
  PID:4828
- C:\Windows\System\qqAldNU.exe
  C:\Windows\System\qqAldNU.exe
  2⤵
  PID:4692
- C:\Windows\System\oeUBCUR.exe
  C:\Windows\System\oeUBCUR.exe
  2⤵
  PID:4340
- C:\Windows\System\gRhubFj.exe
  C:\Windows\System\gRhubFj.exe
  2⤵
  PID:4640
- C:\Windows\System\GczjYQu.exe
  C:\Windows\System\GczjYQu.exe
  2⤵
  PID:4144
- C:\Windows\System\IFYnlju.exe
  C:\Windows\System\IFYnlju.exe
  2⤵
  PID:4336
- C:\Windows\System\wmKtDOF.exe
  C:\Windows\System\wmKtDOF.exe
  2⤵
  PID:5044
- C:\Windows\System\ybkZZzk.exe
  C:\Windows\System\ybkZZzk.exe
  2⤵
  PID:4528
- C:\Windows\System\zlwXfHr.exe
  C:\Windows\System\zlwXfHr.exe
  2⤵
  PID:4552
- C:\Windows\System\cLtMzsv.exe
  C:\Windows\System\cLtMzsv.exe
  2⤵
  PID:5108
- C:\Windows\System\xlatMXO.exe
  C:\Windows\System\xlatMXO.exe
  2⤵
  PID:4196
- C:\Windows\System\hxmqyPC.exe
  C:\Windows\System\hxmqyPC.exe
  2⤵
  PID:4876
- C:\Windows\System\lSENOKW.exe
  C:\Windows\System\lSENOKW.exe
  2⤵
  PID:4272
- C:\Windows\System\ZChJxXi.exe
  C:\Windows\System\ZChJxXi.exe
  2⤵
  PID:4852
- C:\Windows\System\mdyDJJy.exe
  C:\Windows\System\mdyDJJy.exe
  2⤵
  PID:4480
- C:\Windows\System\ArGzNqL.exe
  C:\Windows\System\ArGzNqL.exe
  2⤵
  PID:4848
- C:\Windows\System\VUCTFZx.exe
  C:\Windows\System\VUCTFZx.exe
  2⤵
  PID:4440
- C:\Windows\System\aHqVRpf.exe
  C:\Windows\System\aHqVRpf.exe
  2⤵
  PID:5140
- C:\Windows\System\qMcjRYg.exe
  C:\Windows\System\qMcjRYg.exe
  2⤵
  PID:5160
- C:\Windows\System\FOUvQDk.exe
  C:\Windows\System\FOUvQDk.exe
  2⤵
  PID:5180
- C:\Windows\System\ROevBDQ.exe
  C:\Windows\System\ROevBDQ.exe
  2⤵
  PID:5196
- C:\Windows\System\AfWKAuu.exe
  C:\Windows\System\AfWKAuu.exe
  2⤵
  PID:5212
- C:\Windows\System\XuEIHjK.exe
  C:\Windows\System\XuEIHjK.exe
  2⤵
  PID:5228
- C:\Windows\System\qotVsyy.exe
  C:\Windows\System\qotVsyy.exe
  2⤵
  PID:5248
- C:\Windows\System\XdOkVcm.exe
  C:\Windows\System\XdOkVcm.exe
  2⤵
  PID:5264
- C:\Windows\System\OYibwHq.exe
  C:\Windows\System\OYibwHq.exe
  2⤵
  PID:5284
- C:\Windows\System\uykyVhE.exe
  C:\Windows\System\uykyVhE.exe
  2⤵
  PID:5304
- C:\Windows\System\YTqeXit.exe
  C:\Windows\System\YTqeXit.exe
  2⤵
  PID:5324
- C:\Windows\System\PesmGVJ.exe
  C:\Windows\System\PesmGVJ.exe
  2⤵
  PID:5344
- C:\Windows\System\gYISPca.exe
  C:\Windows\System\gYISPca.exe
  2⤵
  PID:5364
- C:\Windows\System\WoLsQiU.exe
  C:\Windows\System\WoLsQiU.exe
  2⤵
  PID:5392
- C:\Windows\System\ljhZEJV.exe
  C:\Windows\System\ljhZEJV.exe
  2⤵
  PID:5408
- C:\Windows\System\xhzgTrF.exe
  C:\Windows\System\xhzgTrF.exe
  2⤵
  PID:5424
- C:\Windows\System\GxsFcHQ.exe
  C:\Windows\System\GxsFcHQ.exe
  2⤵
  PID:5444
- C:\Windows\System\KePaCwD.exe
  C:\Windows\System\KePaCwD.exe
  2⤵
  PID:5464
- C:\Windows\System\VBiPDDW.exe
  C:\Windows\System\VBiPDDW.exe
  2⤵
  PID:5480
- C:\Windows\System\bbjgMGu.exe
  C:\Windows\System\bbjgMGu.exe
  2⤵
  PID:5500
- C:\Windows\System\PGQfyEr.exe
  C:\Windows\System\PGQfyEr.exe
  2⤵
  PID:5516
- C:\Windows\System\JzTSvFC.exe
  C:\Windows\System\JzTSvFC.exe
  2⤵
  PID:5568
- C:\Windows\System\usiHqzt.exe
  C:\Windows\System\usiHqzt.exe
  2⤵
  PID:5588
- C:\Windows\System\TIeLNxi.exe
  C:\Windows\System\TIeLNxi.exe
  2⤵
  PID:5608
- C:\Windows\System\rvwqzKo.exe
  C:\Windows\System\rvwqzKo.exe
  2⤵
  PID:5628
- C:\Windows\System\fBkJHlI.exe
  C:\Windows\System\fBkJHlI.exe
  2⤵
  PID:5644
- C:\Windows\System\lwemnKR.exe
  C:\Windows\System\lwemnKR.exe
  2⤵
  PID:5660
- C:\Windows\System\iYjsXqp.exe
  C:\Windows\System\iYjsXqp.exe
  2⤵
  PID:5692
- C:\Windows\System\sRjpeLN.exe
  C:\Windows\System\sRjpeLN.exe
  2⤵
  PID:5712
- C:\Windows\System\TYKPYLO.exe
  C:\Windows\System\TYKPYLO.exe
  2⤵
  PID:5728
- C:\Windows\System\pqobREI.exe
  C:\Windows\System\pqobREI.exe
  2⤵
  PID:5752
- C:\Windows\System\NHwYmpc.exe
  C:\Windows\System\NHwYmpc.exe
  2⤵
  PID:5768
- C:\Windows\System\UgrFRfZ.exe
  C:\Windows\System\UgrFRfZ.exe
  2⤵
  PID:5788
- C:\Windows\System\PafoQvF.exe
  C:\Windows\System\PafoQvF.exe
  2⤵
  PID:5804
- C:\Windows\System\cAAzBFn.exe
  C:\Windows\System\cAAzBFn.exe
  2⤵
  PID:5820
- C:\Windows\System\tmEsvsv.exe
  C:\Windows\System\tmEsvsv.exe
  2⤵
  PID:5836
- C:\Windows\System\BjKEhNW.exe
  C:\Windows\System\BjKEhNW.exe
  2⤵
  PID:5856
- C:\Windows\System\LXphwAP.exe
  C:\Windows\System\LXphwAP.exe
  2⤵
  PID:5880
- C:\Windows\System\xXFPGyj.exe
  C:\Windows\System\xXFPGyj.exe
  2⤵
  PID:5912
- C:\Windows\System\ZNWoLxZ.exe
  C:\Windows\System\ZNWoLxZ.exe
  2⤵
  PID:5928
- C:\Windows\System\YFmAmNV.exe
  C:\Windows\System\YFmAmNV.exe
  2⤵
  PID:5944
- C:\Windows\System\HhscyIG.exe
  C:\Windows\System\HhscyIG.exe
  2⤵
  PID:5964
- C:\Windows\System\ZiZFpak.exe
  C:\Windows\System\ZiZFpak.exe
  2⤵
  PID:5980
- C:\Windows\System\cmHYTgt.exe
  C:\Windows\System\cmHYTgt.exe
  2⤵
  PID:6008
- C:\Windows\System\UKwSoew.exe
  C:\Windows\System\UKwSoew.exe
  2⤵
  PID:6028
- C:\Windows\System\vfJQeBC.exe
  C:\Windows\System\vfJQeBC.exe
  2⤵
  PID:6044
- C:\Windows\System\AojtESH.exe
  C:\Windows\System\AojtESH.exe
  2⤵
  PID:6068
- C:\Windows\System\XLDdhkM.exe
  C:\Windows\System\XLDdhkM.exe
  2⤵
  PID:6088
- C:\Windows\System\XlsLCGd.exe
  C:\Windows\System\XlsLCGd.exe
  2⤵
  PID:6104
- C:\Windows\System\NVvGLqe.exe
  C:\Windows\System\NVvGLqe.exe
  2⤵
  PID:6132
- C:\Windows\System\aUYgcEx.exe
  C:\Windows\System\aUYgcEx.exe
  2⤵
  PID:4148
- C:\Windows\System\mpbdpjI.exe
  C:\Windows\System\mpbdpjI.exe
  2⤵
  PID:5156
- C:\Windows\System\nqnqtFd.exe
  C:\Windows\System\nqnqtFd.exe
  2⤵
  PID:5224
- C:\Windows\System\boeXhHj.exe
  C:\Windows\System\boeXhHj.exe
  2⤵
  PID:5300
- C:\Windows\System\PULomug.exe
  C:\Windows\System\PULomug.exe
  2⤵
  PID:5172
- C:\Windows\System\ydZNMvZ.exe
  C:\Windows\System\ydZNMvZ.exe
  2⤵
  PID:5380
- C:\Windows\System\UjycTsW.exe
  C:\Windows\System\UjycTsW.exe
  2⤵
  PID:5452
- C:\Windows\System\uSyTRdF.exe
  C:\Windows\System\uSyTRdF.exe
  2⤵
  PID:5276
- C:\Windows\System\yxOIlZD.exe
  C:\Windows\System\yxOIlZD.exe
  2⤵
  PID:4212
- C:\Windows\System\dSgfSyS.exe
  C:\Windows\System\dSgfSyS.exe
  2⤵
  PID:5128
- C:\Windows\System\aIOvGgr.exe
  C:\Windows\System\aIOvGgr.exe
  2⤵
  PID:5488
- C:\Windows\System\DFTuUPh.exe
  C:\Windows\System\DFTuUPh.exe
  2⤵
  PID:5556
- C:\Windows\System\AMRyMoV.exe
  C:\Windows\System\AMRyMoV.exe
  2⤵
  PID:5440
- C:\Windows\System\KtISawU.exe
  C:\Windows\System\KtISawU.exe
  2⤵
  PID:5400
- C:\Windows\System\RgVLOhv.exe
  C:\Windows\System\RgVLOhv.exe
  2⤵
  PID:5240
- C:\Windows\System\jRjHFkr.exe
  C:\Windows\System\jRjHFkr.exe
  2⤵
  PID:5512
- C:\Windows\System\JGDAGIJ.exe
  C:\Windows\System\JGDAGIJ.exe
  2⤵
  PID:5624
- C:\Windows\System\svXDrSG.exe
  C:\Windows\System\svXDrSG.exe
  2⤵
  PID:5616
- C:\Windows\System\wAKeXpm.exe
  C:\Windows\System\wAKeXpm.exe
  2⤵
  PID:5684
- C:\Windows\System\ZSuleLs.exe
  C:\Windows\System\ZSuleLs.exe
  2⤵
  PID:5704
- C:\Windows\System\gvoSEoJ.exe
  C:\Windows\System\gvoSEoJ.exe
  2⤵
  PID:5760
- C:\Windows\System\vouShfd.exe
  C:\Windows\System\vouShfd.exe
  2⤵
  PID:5828
- C:\Windows\System\azQkOYx.exe
  C:\Windows\System\azQkOYx.exe
  2⤵
  PID:5748
- C:\Windows\System\CLGXQEj.exe
  C:\Windows\System\CLGXQEj.exe
  2⤵
  PID:5784
- C:\Windows\System\WnaBVdg.exe
  C:\Windows\System\WnaBVdg.exe
  2⤵
  PID:5864
- C:\Windows\System\OnmCgeq.exe
  C:\Windows\System\OnmCgeq.exe
  2⤵
  PID:5920
- C:\Windows\System\XbmmKfK.exe
  C:\Windows\System\XbmmKfK.exe
  2⤵
  PID:5956
- C:\Windows\System\dBxFgNb.exe
  C:\Windows\System\dBxFgNb.exe
  2⤵
  PID:5904
- C:\Windows\System\tdKOdgY.exe
  C:\Windows\System\tdKOdgY.exe
  2⤵
  PID:5960
- C:\Windows\System\bagwHyy.exe
  C:\Windows\System\bagwHyy.exe
  2⤵
  PID:6036
- C:\Windows\System\UragEoc.exe
  C:\Windows\System\UragEoc.exe
  2⤵
  PID:6084
- C:\Windows\System\zmPHsIx.exe
  C:\Windows\System\zmPHsIx.exe
  2⤵
  PID:6060
- C:\Windows\System\WNjAfoQ.exe
  C:\Windows\System\WNjAfoQ.exe
  2⤵
  PID:6128
- C:\Windows\System\LSDiOYe.exe
  C:\Windows\System\LSDiOYe.exe
  2⤵
  PID:4168
- C:\Windows\System\LhJCXBT.exe
  C:\Windows\System\LhJCXBT.exe
  2⤵
  PID:5296
- C:\Windows\System\tPUdehp.exe
  C:\Windows\System\tPUdehp.exe
  2⤵
  PID:5188
- C:\Windows\System\bLlxfZT.exe
  C:\Windows\System\bLlxfZT.exe
  2⤵
  PID:5340
- C:\Windows\System\BwWUhOo.exe
  C:\Windows\System\BwWUhOo.exe
  2⤵
  PID:5388
- C:\Windows\System\XogFcxk.exe
  C:\Windows\System\XogFcxk.exe
  2⤵
  PID:5320
- C:\Windows\System\NQqxaLq.exe
  C:\Windows\System\NQqxaLq.exe
  2⤵
  PID:5532
- C:\Windows\System\OGPQDjw.exe
  C:\Windows\System\OGPQDjw.exe
  2⤵
  PID:5548
- C:\Windows\System\rvCTJSU.exe
  C:\Windows\System\rvCTJSU.exe
  2⤵
  PID:5552
- C:\Windows\System\kfkiHhK.exe
  C:\Windows\System\kfkiHhK.exe
  2⤵
  PID:5560
- C:\Windows\System\LUaxKWh.exe
  C:\Windows\System\LUaxKWh.exe
  2⤵
  PID:5580
- C:\Windows\System\PLZkGDF.exe
  C:\Windows\System\PLZkGDF.exe
  2⤵
  PID:5640
- C:\Windows\System\aySMUDx.exe
  C:\Windows\System\aySMUDx.exe
  2⤵
  PID:5700
- C:\Windows\System\QlpVVDo.exe
  C:\Windows\System\QlpVVDo.exe
  2⤵
  PID:5892
- C:\Windows\System\colApuV.exe
  C:\Windows\System\colApuV.exe
  2⤵
  PID:5708
- C:\Windows\System\rECWWzg.exe
  C:\Windows\System\rECWWzg.exe
  2⤵
  PID:6000
- C:\Windows\System\nhFbqOu.exe
  C:\Windows\System\nhFbqOu.exe
  2⤵
  PID:6004
- C:\Windows\System\mHaZuax.exe
  C:\Windows\System\mHaZuax.exe
  2⤵
  PID:6056
- C:\Windows\System\xtYUBzz.exe
  C:\Windows\System\xtYUBzz.exe
  2⤵
  PID:5852
- C:\Windows\System\XrcsrqL.exe
  C:\Windows\System\XrcsrqL.exe
  2⤵
  PID:5220
- C:\Windows\System\XERWPRb.exe
  C:\Windows\System\XERWPRb.exe
  2⤵
  PID:5952
- C:\Windows\System\vmrJAkp.exe
  C:\Windows\System\vmrJAkp.exe
  2⤵
  PID:5272
- C:\Windows\System\dxkyXjw.exe
  C:\Windows\System\dxkyXjw.exe
  2⤵
  PID:4604
- C:\Windows\System\zQZpkAJ.exe
  C:\Windows\System\zQZpkAJ.exe
  2⤵
  PID:5524
- C:\Windows\System\paMmDWR.exe
  C:\Windows\System\paMmDWR.exe
  2⤵
  PID:5652
- C:\Windows\System\OiRdiyU.exe
  C:\Windows\System\OiRdiyU.exe
  2⤵
  PID:5936
- C:\Windows\System\cIRkSuB.exe
  C:\Windows\System\cIRkSuB.exe
  2⤵
  PID:5900
- C:\Windows\System\ZRWojyw.exe
  C:\Windows\System\ZRWojyw.exe
  2⤵
  PID:5872
- C:\Windows\System\OSJyLTv.exe
  C:\Windows\System\OSJyLTv.exe
  2⤵
  PID:6124
- C:\Windows\System\zWYllkw.exe
  C:\Windows\System\zWYllkw.exe
  2⤵
  PID:6100
- C:\Windows\System\eOarJWR.exe
  C:\Windows\System\eOarJWR.exe
  2⤵
  PID:5544
- C:\Windows\System\lsUUIiv.exe
  C:\Windows\System\lsUUIiv.exe
  2⤵
  PID:5236
- C:\Windows\System\WOEfTjh.exe
  C:\Windows\System\WOEfTjh.exe
  2⤵
  PID:5800
- C:\Windows\System\zUlWwdr.exe
  C:\Windows\System\zUlWwdr.exe
  2⤵
  PID:5656
- C:\Windows\System\nGcjeHU.exe
  C:\Windows\System\nGcjeHU.exe
  2⤵
  PID:5680
- C:\Windows\System\scDmMqo.exe
  C:\Windows\System\scDmMqo.exe
  2⤵
  PID:5376
- C:\Windows\System\zBJqEFP.exe
  C:\Windows\System\zBJqEFP.exe
  2⤵
  PID:6160
- C:\Windows\System\wVfPdpX.exe
  C:\Windows\System\wVfPdpX.exe
  2⤵
  PID:6208
- C:\Windows\System\SoiySvK.exe
  C:\Windows\System\SoiySvK.exe
  2⤵
  PID:6228
- C:\Windows\System\YBATKuk.exe
  C:\Windows\System\YBATKuk.exe
  2⤵
  PID:6248
- C:\Windows\System\QNkgCvZ.exe
  C:\Windows\System\QNkgCvZ.exe
  2⤵
  PID:6264
- C:\Windows\System\sulqzLs.exe
  C:\Windows\System\sulqzLs.exe
  2⤵
  PID:6284
- C:\Windows\System\hWunSrF.exe
  C:\Windows\System\hWunSrF.exe
  2⤵
  PID:6300
- C:\Windows\System\PINYoXh.exe
  C:\Windows\System\PINYoXh.exe
  2⤵
  PID:6320
- C:\Windows\System\XSDaOiP.exe
  C:\Windows\System\XSDaOiP.exe
  2⤵
  PID:6336
- C:\Windows\System\rINkdqM.exe
  C:\Windows\System\rINkdqM.exe
  2⤵
  PID:6352
- C:\Windows\System\UcdHHij.exe
  C:\Windows\System\UcdHHij.exe
  2⤵
  PID:6376
- C:\Windows\System\fHcaibK.exe
  C:\Windows\System\fHcaibK.exe
  2⤵
  PID:6396
- C:\Windows\System\yzsyyev.exe
  C:\Windows\System\yzsyyev.exe
  2⤵
  PID:6420
- C:\Windows\System\ZfLTOaD.exe
  C:\Windows\System\ZfLTOaD.exe
  2⤵
  PID:6444
- C:\Windows\System\kquldVZ.exe
  C:\Windows\System\kquldVZ.exe
  2⤵
  PID:6460
- C:\Windows\System\hEvbtWB.exe
  C:\Windows\System\hEvbtWB.exe
  2⤵
  PID:6476
- C:\Windows\System\gkETwFM.exe
  C:\Windows\System\gkETwFM.exe
  2⤵
  PID:6496
- C:\Windows\System\EZFIFVV.exe
  C:\Windows\System\EZFIFVV.exe
  2⤵
  PID:6512
- C:\Windows\System\aOMvHzJ.exe
  C:\Windows\System\aOMvHzJ.exe
  2⤵
  PID:6528
- C:\Windows\System\dUTGWST.exe
  C:\Windows\System\dUTGWST.exe
  2⤵
  PID:6560
- C:\Windows\System\EuwVXMN.exe
  C:\Windows\System\EuwVXMN.exe
  2⤵
  PID:6576
- C:\Windows\System\YbtkHom.exe
  C:\Windows\System\YbtkHom.exe
  2⤵
  PID:6596
- C:\Windows\System\xLZhPHu.exe
  C:\Windows\System\xLZhPHu.exe
  2⤵
  PID:6612
- C:\Windows\System\YZESTwc.exe
  C:\Windows\System\YZESTwc.exe
  2⤵
  PID:6628
- C:\Windows\System\OkreTRL.exe
  C:\Windows\System\OkreTRL.exe
  2⤵
  PID:6648
- C:\Windows\System\mHoktOu.exe
  C:\Windows\System\mHoktOu.exe
  2⤵
  PID:6668
- C:\Windows\System\GBaLnmB.exe
  C:\Windows\System\GBaLnmB.exe
  2⤵
  PID:6684
- C:\Windows\System\ktvPDLy.exe
  C:\Windows\System\ktvPDLy.exe
  2⤵
  PID:6700
- C:\Windows\System\ygkEIKI.exe
  C:\Windows\System\ygkEIKI.exe
  2⤵
  PID:6716
- C:\Windows\System\biwPopw.exe
  C:\Windows\System\biwPopw.exe
  2⤵
  PID:6732
- C:\Windows\System\xDbOBMt.exe
  C:\Windows\System\xDbOBMt.exe
  2⤵
  PID:6752
- C:\Windows\System\zEhmFrX.exe
  C:\Windows\System\zEhmFrX.exe
  2⤵
  PID:6776
- C:\Windows\System\YxhnNOW.exe
  C:\Windows\System\YxhnNOW.exe
  2⤵
  PID:6792
- C:\Windows\System\aoVgiMW.exe
  C:\Windows\System\aoVgiMW.exe
  2⤵
  PID:6808
- C:\Windows\System\DSYxNqH.exe
  C:\Windows\System\DSYxNqH.exe
  2⤵
  PID:6824
- C:\Windows\System\MFaUynf.exe
  C:\Windows\System\MFaUynf.exe
  2⤵
  PID:6840
- C:\Windows\System\PhkulDV.exe
  C:\Windows\System\PhkulDV.exe
  2⤵
  PID:6904
- C:\Windows\System\VGuUnek.exe
  C:\Windows\System\VGuUnek.exe
  2⤵
  PID:6920
- C:\Windows\System\blcIUfx.exe
  C:\Windows\System\blcIUfx.exe
  2⤵
  PID:6936
- C:\Windows\System\AGPIcNk.exe
  C:\Windows\System\AGPIcNk.exe
  2⤵
  PID:6960
- C:\Windows\System\haHtCgm.exe
  C:\Windows\System\haHtCgm.exe
  2⤵
  PID:6976
- C:\Windows\System\MEvwLsY.exe
  C:\Windows\System\MEvwLsY.exe
  2⤵
  PID:7004
- C:\Windows\System\txLrjaC.exe
  C:\Windows\System\txLrjaC.exe
  2⤵
  PID:7020
- C:\Windows\System\LpujbAa.exe
  C:\Windows\System\LpujbAa.exe
  2⤵
  PID:7036
- C:\Windows\System\JWqmSYM.exe
  C:\Windows\System\JWqmSYM.exe
  2⤵
  PID:7056
- C:\Windows\System\rTccjHD.exe
  C:\Windows\System\rTccjHD.exe
  2⤵
  PID:7076
- C:\Windows\System\xUkIRFb.exe
  C:\Windows\System\xUkIRFb.exe
  2⤵
  PID:7096
- C:\Windows\System\UqDthjA.exe
  C:\Windows\System\UqDthjA.exe
  2⤵
  PID:7112
- C:\Windows\System\DQyJRty.exe
  C:\Windows\System\DQyJRty.exe
  2⤵
  PID:7132
- C:\Windows\System\ZVZlvri.exe
  C:\Windows\System\ZVZlvri.exe
  2⤵
  PID:7152
- C:\Windows\System\ikothHF.exe
  C:\Windows\System\ikothHF.exe
  2⤵
  PID:5316
- C:\Windows\System\HTsnLNu.exe
  C:\Windows\System\HTsnLNu.exe
  2⤵
  PID:5636
- C:\Windows\System\pMwPtQz.exe
  C:\Windows\System\pMwPtQz.exe
  2⤵
  PID:5848
- C:\Windows\System\xGAinps.exe
  C:\Windows\System\xGAinps.exe
  2⤵
  PID:5812
- C:\Windows\System\vuUSMpk.exe
  C:\Windows\System\vuUSMpk.exe
  2⤵
  PID:5596
- C:\Windows\System\SdeaIOs.exe
  C:\Windows\System\SdeaIOs.exe
  2⤵
  PID:5776
- C:\Windows\System\JylcVlS.exe
  C:\Windows\System\JylcVlS.exe
  2⤵
  PID:6168
- C:\Windows\System\iikWJOl.exe
  C:\Windows\System\iikWJOl.exe
  2⤵
  PID:6196
- C:\Windows\System\JXyLplq.exe
  C:\Windows\System\JXyLplq.exe
  2⤵
  PID:6260
- C:\Windows\System\WwnOjmx.exe
  C:\Windows\System\WwnOjmx.exe
  2⤵
  PID:6328
- C:\Windows\System\UwYlScY.exe
  C:\Windows\System\UwYlScY.exe
  2⤵
  PID:6384
- C:\Windows\System\sqlsPwq.exe
  C:\Windows\System\sqlsPwq.exe
  2⤵
  PID:6412
- C:\Windows\System\oQVJSVK.exe
  C:\Windows\System\oQVJSVK.exe
  2⤵
  PID:6312
- C:\Windows\System\MHTfrbR.exe
  C:\Windows\System\MHTfrbR.exe
  2⤵
  PID:6484
- C:\Windows\System\VuirryV.exe
  C:\Windows\System\VuirryV.exe
  2⤵
  PID:6520
- C:\Windows\System\jSIyzqu.exe
  C:\Windows\System\jSIyzqu.exe
  2⤵
  PID:6508
- C:\Windows\System\xquckTB.exe
  C:\Windows\System\xquckTB.exe
  2⤵
  PID:6440
- C:\Windows\System\DGsAPiB.exe
  C:\Windows\System\DGsAPiB.exe
  2⤵
  PID:6572
- C:\Windows\System\ZCppQgy.exe
  C:\Windows\System\ZCppQgy.exe
  2⤵
  PID:6640
- C:\Windows\System\TuqkfaB.exe
  C:\Windows\System\TuqkfaB.exe
  2⤵
  PID:6712
- C:\Windows\System\EbMRrmZ.exe
  C:\Windows\System\EbMRrmZ.exe
  2⤵
  PID:6588
- C:\Windows\System\tmYbcGk.exe
  C:\Windows\System\tmYbcGk.exe
  2⤵
  PID:6788
- C:\Windows\System\GJdgVOO.exe
  C:\Windows\System\GJdgVOO.exe
  2⤵
  PID:6864
- C:\Windows\System\wLiBJDc.exe
  C:\Windows\System\wLiBJDc.exe
  2⤵
  PID:6880
- C:\Windows\System\RejyeAa.exe
  C:\Windows\System\RejyeAa.exe
  2⤵
  PID:6760
- C:\Windows\System\FkXOeJX.exe
  C:\Windows\System\FkXOeJX.exe
  2⤵
  PID:6804
- C:\Windows\System\clOkvXy.exe
  C:\Windows\System\clOkvXy.exe
  2⤵
  PID:6624
- C:\Windows\System\ItWCspb.exe
  C:\Windows\System\ItWCspb.exe
  2⤵
  PID:6692
- C:\Windows\System\FvAlLWT.exe
  C:\Windows\System\FvAlLWT.exe
  2⤵
  PID:6728
- C:\Windows\System\iAWoPNg.exe
  C:\Windows\System\iAWoPNg.exe
  2⤵
  PID:6836
- C:\Windows\System\GAEBKVH.exe
  C:\Windows\System\GAEBKVH.exe
  2⤵
  PID:7124
- C:\Windows\System\CmDwtiA.exe
  C:\Windows\System\CmDwtiA.exe
  2⤵
  PID:6988
- C:\Windows\System\ZxmHAvw.exe
  C:\Windows\System\ZxmHAvw.exe
  2⤵
  PID:6152
- C:\Windows\System\BhHYzDi.exe
  C:\Windows\System\BhHYzDi.exe
  2⤵
  PID:5564
- C:\Windows\System\eQDMjGS.exe
  C:\Windows\System\eQDMjGS.exe
  2⤵
  PID:6204
- C:\Windows\System\lMXAskP.exe
  C:\Windows\System\lMXAskP.exe
  2⤵
  PID:6224
- C:\Windows\System\ehTqJER.exe
  C:\Windows\System\ehTqJER.exe
  2⤵
  PID:7000
- C:\Windows\System\WoJzKcP.exe
  C:\Windows\System\WoJzKcP.exe
  2⤵
  PID:7104
- C:\Windows\System\aqoVbCx.exe
  C:\Windows\System\aqoVbCx.exe
  2⤵
  PID:7068
- C:\Windows\System\jiKHgoi.exe
  C:\Windows\System\jiKHgoi.exe
  2⤵
  PID:5620
- C:\Windows\System\JrZXfAT.exe
  C:\Windows\System\JrZXfAT.exe
  2⤵
  PID:6180
- C:\Windows\System\zlpjFst.exe
  C:\Windows\System\zlpjFst.exe
  2⤵
  PID:6332
- C:\Windows\System\occuwJY.exe
  C:\Windows\System\occuwJY.exe
  2⤵
  PID:6316
- C:\Windows\System\AyxVkzQ.exe
  C:\Windows\System\AyxVkzQ.exe
  2⤵
  PID:6276
- C:\Windows\System\TQdYSxk.exe
  C:\Windows\System\TQdYSxk.exe
  2⤵
  PID:6492
- C:\Windows\System\qcBMByJ.exe
  C:\Windows\System\qcBMByJ.exe
  2⤵
  PID:6456
- C:\Windows\System\duVLsAs.exe
  C:\Windows\System\duVLsAs.exe
  2⤵
  PID:6744
- C:\Windows\System\NWyrxEu.exe
  C:\Windows\System\NWyrxEu.exe
  2⤵
  PID:6432
- C:\Windows\System\fPaBChh.exe
  C:\Windows\System\fPaBChh.exe
  2⤵
  PID:6876
- C:\Windows\System\nQvWpSe.exe
  C:\Windows\System\nQvWpSe.exe
  2⤵
  PID:6584
- C:\Windows\System\OirVRht.exe
  C:\Windows\System\OirVRht.exe
  2⤵
  PID:6892
- C:\Windows\System\TemkGyR.exe
  C:\Windows\System\TemkGyR.exe
  2⤵
  PID:6932
- C:\Windows\System\pqhVVrJ.exe
  C:\Windows\System\pqhVVrJ.exe
  2⤵
  PID:7044
- C:\Windows\System\EcZgcFJ.exe
  C:\Windows\System\EcZgcFJ.exe
  2⤵
  PID:7160
- C:\Windows\System\kvVDrsU.exe
  C:\Windows\System\kvVDrsU.exe
  2⤵
  PID:7032
- C:\Windows\System\qBlXRuP.exe
  C:\Windows\System\qBlXRuP.exe
  2⤵
  PID:6996
- C:\Windows\System\IQSOzyS.exe
  C:\Windows\System\IQSOzyS.exe
  2⤵
  PID:5136
- C:\Windows\System\EzAmePP.exe
  C:\Windows\System\EzAmePP.exe
  2⤵
  PID:6956
- C:\Windows\System\COzQPPo.exe
  C:\Windows\System\COzQPPo.exe
  2⤵
  PID:6016
- C:\Windows\System\eMdciqm.exe
  C:\Windows\System\eMdciqm.exe
  2⤵
  PID:6296
- C:\Windows\System\zfnpVNa.exe
  C:\Windows\System\zfnpVNa.exe
  2⤵
  PID:6544
- C:\Windows\System\QnWhvAc.exe
  C:\Windows\System\QnWhvAc.exe
  2⤵
  PID:6364
- C:\Windows\System\zENSruy.exe
  C:\Windows\System\zENSruy.exe
  2⤵
  PID:6748
- C:\Windows\System\ObXYoni.exe
  C:\Windows\System\ObXYoni.exe
  2⤵
  PID:6192
- C:\Windows\System\yBJSBMw.exe
  C:\Windows\System\yBJSBMw.exe
  2⤵
  PID:6428
- C:\Windows\System\PLJadsT.exe
  C:\Windows\System\PLJadsT.exe
  2⤵
  PID:6800
- C:\Windows\System\cedbvHr.exe
  C:\Windows\System\cedbvHr.exe
  2⤵
  PID:6860
- C:\Windows\System\JPtlbqh.exe
  C:\Windows\System\JPtlbqh.exe
  2⤵
  PID:6948
- C:\Windows\System\rAxOmjf.exe
  C:\Windows\System\rAxOmjf.exe
  2⤵
  PID:7084
- C:\Windows\System\JwOQdOq.exe
  C:\Windows\System\JwOQdOq.exe
  2⤵
  PID:6832
- C:\Windows\System\ujvMNhi.exe
  C:\Windows\System\ujvMNhi.exe
  2⤵
  PID:6676
- C:\Windows\System\pkQPaht.exe
  C:\Windows\System\pkQPaht.exe
  2⤵
  PID:7064
- C:\Windows\System\rmVreKi.exe
  C:\Windows\System\rmVreKi.exe
  2⤵
  PID:6540
- C:\Windows\System\zFkFRZw.exe
  C:\Windows\System\zFkFRZw.exe
  2⤵
  PID:6472
- C:\Windows\System\uOAivpK.exe
  C:\Windows\System\uOAivpK.exe
  2⤵
  PID:6856
- C:\Windows\System\mWnrsCM.exe
  C:\Windows\System\mWnrsCM.exe
  2⤵
  PID:6724
- C:\Windows\System\qMLIxGw.exe
  C:\Windows\System\qMLIxGw.exe
  2⤵
  PID:6972
- C:\Windows\System\SQjELEM.exe
  C:\Windows\System\SQjELEM.exe
  2⤵
  PID:5744
- C:\Windows\System\IQynqNH.exe
  C:\Windows\System\IQynqNH.exe
  2⤵
  PID:6784
- C:\Windows\System\xZFsnYw.exe
  C:\Windows\System\xZFsnYw.exe
  2⤵
  PID:6348
- C:\Windows\System\PaauUqW.exe
  C:\Windows\System\PaauUqW.exe
  2⤵
  PID:7184
- C:\Windows\System\eseuvYq.exe
  C:\Windows\System\eseuvYq.exe
  2⤵
  PID:7208
- C:\Windows\System\SmOiLCk.exe
  C:\Windows\System\SmOiLCk.exe
  2⤵
  PID:7224
- C:\Windows\System\IuejGKn.exe
  C:\Windows\System\IuejGKn.exe
  2⤵
  PID:7240
- C:\Windows\System\NcnFAcx.exe
  C:\Windows\System\NcnFAcx.exe
  2⤵
  PID:7256
- C:\Windows\System\fsUgeuw.exe
  C:\Windows\System\fsUgeuw.exe
  2⤵
  PID:7284
- C:\Windows\System\aItvsRi.exe
  C:\Windows\System\aItvsRi.exe
  2⤵
  PID:7300
- C:\Windows\System\QYqKzVe.exe
  C:\Windows\System\QYqKzVe.exe
  2⤵
  PID:7320
- C:\Windows\System\QDSRmaX.exe
  C:\Windows\System\QDSRmaX.exe
  2⤵
  PID:7336
- C:\Windows\System\dylXdiZ.exe
  C:\Windows\System\dylXdiZ.exe
  2⤵
  PID:7356
- C:\Windows\System\AivmVMy.exe
  C:\Windows\System\AivmVMy.exe
  2⤵
  PID:7376
- C:\Windows\System\TNMPdIQ.exe
  C:\Windows\System\TNMPdIQ.exe
  2⤵
  PID:7404
- C:\Windows\System\mYoggNR.exe
  C:\Windows\System\mYoggNR.exe
  2⤵
  PID:7420
- C:\Windows\System\xPFkeRZ.exe
  C:\Windows\System\xPFkeRZ.exe
  2⤵
  PID:7436
- C:\Windows\System\tZqVzga.exe
  C:\Windows\System\tZqVzga.exe
  2⤵
  PID:7452
- C:\Windows\System\jxlretZ.exe
  C:\Windows\System\jxlretZ.exe
  2⤵
  PID:7488
- C:\Windows\System\TtkuCgu.exe
  C:\Windows\System\TtkuCgu.exe
  2⤵
  PID:7508
- C:\Windows\System\KPhsvJt.exe
  C:\Windows\System\KPhsvJt.exe
  2⤵
  PID:7524
- C:\Windows\System\WhqmERl.exe
  C:\Windows\System\WhqmERl.exe
  2⤵
  PID:7548
- C:\Windows\System\kxfJUyf.exe
  C:\Windows\System\kxfJUyf.exe
  2⤵
  PID:7568
- C:\Windows\System\tAnoSjk.exe
  C:\Windows\System\tAnoSjk.exe
  2⤵
  PID:7588
- C:\Windows\System\vKLmuVo.exe
  C:\Windows\System\vKLmuVo.exe
  2⤵
  PID:7604
- C:\Windows\System\flftFGm.exe
  C:\Windows\System\flftFGm.exe
  2⤵
  PID:7620
- C:\Windows\System\bMVyXPE.exe
  C:\Windows\System\bMVyXPE.exe
  2⤵
  PID:7644
- C:\Windows\System\zfBLErz.exe
  C:\Windows\System\zfBLErz.exe
  2⤵
  PID:7664
- C:\Windows\System\rDAdjNX.exe
  C:\Windows\System\rDAdjNX.exe
  2⤵
  PID:7688
- C:\Windows\System\pykPtwG.exe
  C:\Windows\System\pykPtwG.exe
  2⤵
  PID:7704
- C:\Windows\System\rwcOzUd.exe
  C:\Windows\System\rwcOzUd.exe
  2⤵
  PID:7720
- C:\Windows\System\yekwPCM.exe
  C:\Windows\System\yekwPCM.exe
  2⤵
  PID:7736
- C:\Windows\System\sOuttOV.exe
  C:\Windows\System\sOuttOV.exe
  2⤵
  PID:7760
- C:\Windows\System\aUgKlhG.exe
  C:\Windows\System\aUgKlhG.exe
  2⤵
  PID:7780
- C:\Windows\System\mvrtiMY.exe
  C:\Windows\System\mvrtiMY.exe
  2⤵
  PID:7816
- C:\Windows\System\PmZthFh.exe
  C:\Windows\System\PmZthFh.exe
  2⤵
  PID:7832
- C:\Windows\System\UMSRuoR.exe
  C:\Windows\System\UMSRuoR.exe
  2⤵
  PID:7848
- C:\Windows\System\BVBHebf.exe
  C:\Windows\System\BVBHebf.exe
  2⤵
  PID:7868
- C:\Windows\System\SipuJAa.exe
  C:\Windows\System\SipuJAa.exe
  2⤵
  PID:7896
- C:\Windows\System\cgzYYiq.exe
  C:\Windows\System\cgzYYiq.exe
  2⤵
  PID:7916
- C:\Windows\System\TprAklc.exe
  C:\Windows\System\TprAklc.exe
  2⤵
  PID:7936
- C:\Windows\System\wUCXrCt.exe
  C:\Windows\System\wUCXrCt.exe
  2⤵
  PID:7952
- C:\Windows\System\QaHuRow.exe
  C:\Windows\System\QaHuRow.exe
  2⤵
  PID:7976
- C:\Windows\System\LqAJXfA.exe
  C:\Windows\System\LqAJXfA.exe
  2⤵
  PID:7992
- C:\Windows\System\flJuMpI.exe
  C:\Windows\System\flJuMpI.exe
  2⤵
  PID:8008
- C:\Windows\System\OMRapTV.exe
  C:\Windows\System\OMRapTV.exe
  2⤵
  PID:8024
- C:\Windows\System\myDVhLJ.exe
  C:\Windows\System\myDVhLJ.exe
  2⤵
  PID:8040
- C:\Windows\System\BTYdHcu.exe
  C:\Windows\System\BTYdHcu.exe
  2⤵
  PID:8060
- C:\Windows\System\fnttPCu.exe
  C:\Windows\System\fnttPCu.exe
  2⤵
  PID:8080
- C:\Windows\System\BFWJrLh.exe
  C:\Windows\System\BFWJrLh.exe
  2⤵
  PID:8096
- C:\Windows\System\bwdICPo.exe
  C:\Windows\System\bwdICPo.exe
  2⤵
  PID:8112
- C:\Windows\System\CtFsxto.exe
  C:\Windows\System\CtFsxto.exe
  2⤵
  PID:8132
- C:\Windows\System\FzUCeWs.exe
  C:\Windows\System\FzUCeWs.exe
  2⤵
  PID:8148
- C:\Windows\System\WeRMnSN.exe
  C:\Windows\System\WeRMnSN.exe
  2⤵
  PID:8164
- C:\Windows\System\ycItyRR.exe
  C:\Windows\System\ycItyRR.exe
  2⤵
  PID:8184
- C:\Windows\System\MXUDazK.exe
  C:\Windows\System\MXUDazK.exe
  2⤵
  PID:6120
- C:\Windows\System\IRCaMrh.exe
  C:\Windows\System\IRCaMrh.exe
  2⤵
  PID:7016
- C:\Windows\System\HAcNZod.exe
  C:\Windows\System\HAcNZod.exe
  2⤵
  PID:7176
- C:\Windows\System\KhoLwwa.exe
  C:\Windows\System\KhoLwwa.exe
  2⤵
  PID:5976
- C:\Windows\System\ZDdDrLr.exe
  C:\Windows\System\ZDdDrLr.exe
  2⤵
  PID:7196
- C:\Windows\System\GaLdPPK.exe
  C:\Windows\System\GaLdPPK.exe
  2⤵
  PID:7216
- C:\Windows\System\jaxXsPZ.exe
  C:\Windows\System\jaxXsPZ.exe
  2⤵
  PID:7252
- C:\Windows\System\VtrYgyr.exe
  C:\Windows\System\VtrYgyr.exe
  2⤵
  PID:7292
- C:\Windows\System\qUMogNm.exe
  C:\Windows\System\qUMogNm.exe
  2⤵
  PID:7276
- C:\Windows\System\McstoLl.exe
  C:\Windows\System\McstoLl.exe
  2⤵
  PID:7352
- C:\Windows\System\oiIETrZ.exe
  C:\Windows\System\oiIETrZ.exe
  2⤵
  PID:7280
- C:\Windows\System\uPGPofn.exe
  C:\Windows\System\uPGPofn.exe
  2⤵
  PID:7400
- C:\Windows\System\gRWXFbq.exe
  C:\Windows\System\gRWXFbq.exe
  2⤵
  PID:7444
- C:\Windows\System\zurveVH.exe
  C:\Windows\System\zurveVH.exe
  2⤵
  PID:7468
- C:\Windows\System\yweOrtV.exe
  C:\Windows\System\yweOrtV.exe
  2⤵
  PID:7484
- C:\Windows\System\paYbcWE.exe
  C:\Windows\System\paYbcWE.exe
  2⤵
  PID:7584
- C:\Windows\System\ibxnjIO.exe
  C:\Windows\System\ibxnjIO.exe
  2⤵
  PID:7628
- C:\Windows\System\XMomNqq.exe
  C:\Windows\System\XMomNqq.exe
  2⤵
  PID:7520
- C:\Windows\System\bTeopTd.exe
  C:\Windows\System\bTeopTd.exe
  2⤵
  PID:7556
- C:\Windows\System\rUSCdIh.exe
  C:\Windows\System\rUSCdIh.exe
  2⤵
  PID:7656
- C:\Windows\System\aqpDblm.exe
  C:\Windows\System\aqpDblm.exe
  2⤵
  PID:7732
- C:\Windows\System\mFgavdi.exe
  C:\Windows\System\mFgavdi.exe
  2⤵
  PID:7684
- C:\Windows\System\UypEEWx.exe
  C:\Windows\System\UypEEWx.exe
  2⤵
  PID:7772
- C:\Windows\System\UUomBAJ.exe
  C:\Windows\System\UUomBAJ.exe
  2⤵
  PID:7756
- C:\Windows\System\NiCckEj.exe
  C:\Windows\System\NiCckEj.exe
  2⤵
  PID:7800
- C:\Windows\System\QcEDrNc.exe
  C:\Windows\System\QcEDrNc.exe
  2⤵
  PID:7792
- C:\Windows\System\ymSOvCN.exe
  C:\Windows\System\ymSOvCN.exe
  2⤵
  PID:7856
- C:\Windows\System\HnbWgLk.exe
  C:\Windows\System\HnbWgLk.exe
  2⤵
  PID:7860
- C:\Windows\System\sdnqVuC.exe
  C:\Windows\System\sdnqVuC.exe
  2⤵
  PID:7904
- C:\Windows\System\oaVZJjM.exe
  C:\Windows\System\oaVZJjM.exe
  2⤵
  PID:7944
- C:\Windows\System\aUoUeNn.exe
  C:\Windows\System\aUoUeNn.exe
  2⤵
  PID:7988
- C:\Windows\System\EeqkavY.exe
  C:\Windows\System\EeqkavY.exe
  2⤵
  PID:8056
- C:\Windows\System\NXhEWlP.exe
  C:\Windows\System\NXhEWlP.exe
  2⤵
  PID:8124
- C:\Windows\System\MzpGzuP.exe
  C:\Windows\System\MzpGzuP.exe
  2⤵
  PID:7960
- C:\Windows\System\uxtQOYU.exe
  C:\Windows\System\uxtQOYU.exe
  2⤵
  PID:7968
- C:\Windows\System\eYTsIrN.exe
  C:\Windows\System\eYTsIrN.exe
  2⤵
  PID:8004
- C:\Windows\System\ledWzyu.exe
  C:\Windows\System\ledWzyu.exe
  2⤵
  PID:8076
- C:\Windows\System\kgudIwJ.exe
  C:\Windows\System\kgudIwJ.exe
  2⤵
  PID:7172
- C:\Windows\System\Cwtwsoa.exe
  C:\Windows\System\Cwtwsoa.exe
  2⤵
  PID:8176
- C:\Windows\System\DCBXRQm.exe
  C:\Windows\System\DCBXRQm.exe
  2⤵
  PID:5360
- C:\Windows\System\eMKRnEc.exe
  C:\Windows\System\eMKRnEc.exe
  2⤵
  PID:7248
- C:\Windows\System\KjaNLOE.exe
  C:\Windows\System\KjaNLOE.exe
  2⤵
  PID:7388
- C:\Windows\System\ZmZZSkQ.exe
  C:\Windows\System\ZmZZSkQ.exe
  2⤵
  PID:7432
- C:\Windows\System\jOQwzFc.exe
  C:\Windows\System\jOQwzFc.exe
  2⤵
  PID:7480
- C:\Windows\System\KcPAcCQ.exe
  C:\Windows\System\KcPAcCQ.exe
  2⤵
  PID:7640
- C:\Windows\System\FxMSGAw.exe
  C:\Windows\System\FxMSGAw.exe
  2⤵
  PID:7768
- C:\Windows\System\WbYthSP.exe
  C:\Windows\System\WbYthSP.exe
  2⤵
  PID:7824
- C:\Windows\System\inWBSQo.exe
  C:\Windows\System\inWBSQo.exe
  2⤵
  PID:7984
- C:\Windows\System\svsRoku.exe
  C:\Windows\System\svsRoku.exe
  2⤵
  PID:7776
- C:\Windows\System\VoJvade.exe
  C:\Windows\System\VoJvade.exe
  2⤵
  PID:7264
- C:\Windows\System\yuBZCTb.exe
  C:\Windows\System\yuBZCTb.exe
  2⤵
  PID:7344
- C:\Windows\System\JZiQWPz.exe
  C:\Windows\System\JZiQWPz.exe
  2⤵
  PID:7496
- C:\Windows\System\VXLLJJw.exe
  C:\Windows\System\VXLLJJw.exe
  2⤵
  PID:7504
- C:\Windows\System\GgbwiGe.exe
  C:\Windows\System\GgbwiGe.exe
  2⤵
  PID:8144
- C:\Windows\System\NNOwpPt.exe
  C:\Windows\System\NNOwpPt.exe
  2⤵
  PID:7812
- C:\Windows\System\nEMQffU.exe
  C:\Windows\System\nEMQffU.exe
  2⤵
  PID:8052
- C:\Windows\System\YjsGBtu.exe
  C:\Windows\System\YjsGBtu.exe
  2⤵
  PID:7632
- C:\Windows\System\hGlQAlK.exe
  C:\Windows\System\hGlQAlK.exe
  2⤵
  PID:7660
- C:\Windows\System\sfOtTaI.exe
  C:\Windows\System\sfOtTaI.exe
  2⤵
  PID:8092
- C:\Windows\System\uLbXEVs.exe
  C:\Windows\System\uLbXEVs.exe
  2⤵
  PID:8108
- C:\Windows\System\AcVJjnX.exe
  C:\Windows\System\AcVJjnX.exe
  2⤵
  PID:6080
- C:\Windows\System\wkxBLLd.exe
  C:\Windows\System\wkxBLLd.exe
  2⤵
  PID:6636
- C:\Windows\System\HgGUcWq.exe
  C:\Windows\System\HgGUcWq.exe
  2⤵
  PID:7716
- C:\Windows\System\BfduAba.exe
  C:\Windows\System\BfduAba.exe
  2⤵
  PID:7680
- C:\Windows\System\fHpWySq.exe
  C:\Windows\System\fHpWySq.exe
  2⤵
  PID:7204
- C:\Windows\System\eQeDwVj.exe
  C:\Windows\System\eQeDwVj.exe
  2⤵
  PID:7500
- C:\Windows\System\iCKhsiV.exe
  C:\Windows\System\iCKhsiV.exe
  2⤵
  PID:7460
- C:\Windows\System\rpprPwZ.exe
  C:\Windows\System\rpprPwZ.exe
  2⤵
  PID:8048
- C:\Windows\System\qAJqKEn.exe
  C:\Windows\System\qAJqKEn.exe
  2⤵
  PID:8120
- C:\Windows\System\udQQnDt.exe
  C:\Windows\System\udQQnDt.exe
  2⤵
  PID:7600
- C:\Windows\System\zclYTpW.exe
  C:\Windows\System\zclYTpW.exe
  2⤵
  PID:7728
- C:\Windows\System\lClvIdW.exe
  C:\Windows\System\lClvIdW.exe
  2⤵
  PID:6308
- C:\Windows\System\vIyPFjw.exe
  C:\Windows\System\vIyPFjw.exe
  2⤵
  PID:7368
- C:\Windows\System\hCEludN.exe
  C:\Windows\System\hCEludN.exe
  2⤵
  PID:7536
- C:\Windows\System\VBoaswf.exe
  C:\Windows\System\VBoaswf.exe
  2⤵
  PID:7932
- C:\Windows\System\WYvUCeY.exe
  C:\Windows\System\WYvUCeY.exe
  2⤵
  PID:7676
- C:\Windows\System\oaPsuMv.exe
  C:\Windows\System\oaPsuMv.exe
  2⤵
  PID:7120
- C:\Windows\System\iRBpwwR.exe
  C:\Windows\System\iRBpwwR.exe
  2⤵
  PID:8160
- C:\Windows\System\VWryYYs.exe
  C:\Windows\System\VWryYYs.exe
  2⤵
  PID:8072
- C:\Windows\System\sEMphvC.exe
  C:\Windows\System\sEMphvC.exe
  2⤵
  PID:7540
- C:\Windows\System\pGNOqia.exe
  C:\Windows\System\pGNOqia.exe
  2⤵
  PID:8200
- C:\Windows\System\zicjGXn.exe
  C:\Windows\System\zicjGXn.exe
  2⤵
  PID:8216
- C:\Windows\System\BziDmzJ.exe
  C:\Windows\System\BziDmzJ.exe
  2⤵
  PID:8232
- C:\Windows\System\pKfOkHr.exe
  C:\Windows\System\pKfOkHr.exe
  2⤵
  PID:8248
- C:\Windows\System\csvdJxH.exe
  C:\Windows\System\csvdJxH.exe
  2⤵
  PID:8264
- C:\Windows\System\IsabkbE.exe
  C:\Windows\System\IsabkbE.exe
  2⤵
  PID:8280
- C:\Windows\System\LwqiEFG.exe
  C:\Windows\System\LwqiEFG.exe
  2⤵
  PID:8296
- C:\Windows\System\VVtepAt.exe
  C:\Windows\System\VVtepAt.exe
  2⤵
  PID:8312
- C:\Windows\System\pZOuHUd.exe
  C:\Windows\System\pZOuHUd.exe
  2⤵
  PID:8328
- C:\Windows\System\ukzHYuJ.exe
  C:\Windows\System\ukzHYuJ.exe
  2⤵
  PID:8348
- C:\Windows\System\bIZRbSZ.exe
  C:\Windows\System\bIZRbSZ.exe
  2⤵
  PID:8364
- C:\Windows\System\ibyVvLd.exe
  C:\Windows\System\ibyVvLd.exe
  2⤵
  PID:8380
- C:\Windows\System\UTdYlQw.exe
  C:\Windows\System\UTdYlQw.exe
  2⤵
  PID:8396
- C:\Windows\System\kpzFLrs.exe
  C:\Windows\System\kpzFLrs.exe
  2⤵
  PID:8412
- C:\Windows\System\BiLmFBu.exe
  C:\Windows\System\BiLmFBu.exe
  2⤵
  PID:8428
- C:\Windows\System\NJqwErU.exe
  C:\Windows\System\NJqwErU.exe
  2⤵
  PID:8444
- C:\Windows\System\CjpWGRu.exe
  C:\Windows\System\CjpWGRu.exe
  2⤵
  PID:8460
- C:\Windows\System\jSYZCkg.exe
  C:\Windows\System\jSYZCkg.exe
  2⤵
  PID:8476
- C:\Windows\System\FNcwXdZ.exe
  C:\Windows\System\FNcwXdZ.exe
  2⤵
  PID:8492
- C:\Windows\System\ovaiRvX.exe
  C:\Windows\System\ovaiRvX.exe
  2⤵
  PID:8508
- C:\Windows\System\FwpJuyq.exe
  C:\Windows\System\FwpJuyq.exe
  2⤵
  PID:8524
- C:\Windows\System\zXHqIJU.exe
  C:\Windows\System\zXHqIJU.exe
  2⤵
  PID:8540
- C:\Windows\System\RsiEbJN.exe
  C:\Windows\System\RsiEbJN.exe
  2⤵
  PID:8556
- C:\Windows\System\gRQjGCX.exe
  C:\Windows\System\gRQjGCX.exe
  2⤵
  PID:8572
- C:\Windows\System\rruQKKZ.exe
  C:\Windows\System\rruQKKZ.exe
  2⤵
  PID:8588
- C:\Windows\System\SLmiOPt.exe
  C:\Windows\System\SLmiOPt.exe
  2⤵
  PID:8604
- C:\Windows\System\xZUHfWT.exe
  C:\Windows\System\xZUHfWT.exe
  2⤵
  PID:8620
- C:\Windows\System\vcmNqPn.exe
  C:\Windows\System\vcmNqPn.exe
  2⤵
  PID:8636
- C:\Windows\System\QRyyYbA.exe
  C:\Windows\System\QRyyYbA.exe
  2⤵
  PID:8652
- C:\Windows\System\IiDRWGs.exe
  C:\Windows\System\IiDRWGs.exe
  2⤵
  PID:8676
- C:\Windows\System\nMXnBuZ.exe
  C:\Windows\System\nMXnBuZ.exe
  2⤵
  PID:8692
- C:\Windows\System\jFhOTjG.exe
  C:\Windows\System\jFhOTjG.exe
  2⤵
  PID:8712
- C:\Windows\System\JeDnyIa.exe
  C:\Windows\System\JeDnyIa.exe
  2⤵
  PID:8732
- C:\Windows\System\KOHKdHO.exe
  C:\Windows\System\KOHKdHO.exe
  2⤵
  PID:8748
- C:\Windows\System\sUeMdDI.exe
  C:\Windows\System\sUeMdDI.exe
  2⤵
  PID:8764
- C:\Windows\System\VXECEfY.exe
  C:\Windows\System\VXECEfY.exe
  2⤵
  PID:8780
- C:\Windows\System\eGaxUje.exe
  C:\Windows\System\eGaxUje.exe
  2⤵
  PID:8796
- C:\Windows\System\bUkwPNk.exe
  C:\Windows\System\bUkwPNk.exe
  2⤵
  PID:8812
- C:\Windows\System\YBENFIf.exe
  C:\Windows\System\YBENFIf.exe
  2⤵
  PID:8832
- C:\Windows\System\CbTBMSL.exe
  C:\Windows\System\CbTBMSL.exe
  2⤵
  PID:8856
- C:\Windows\System\pcJcuBT.exe
  C:\Windows\System\pcJcuBT.exe
  2⤵
  PID:8876
- C:\Windows\System\yzQnqAc.exe
  C:\Windows\System\yzQnqAc.exe
  2⤵
  PID:8896
- C:\Windows\System\MljzKQE.exe
  C:\Windows\System\MljzKQE.exe
  2⤵
  PID:8916
- C:\Windows\System\VcGlQmi.exe
  C:\Windows\System\VcGlQmi.exe
  2⤵
  PID:8932
- C:\Windows\System\uZqVBZF.exe
  C:\Windows\System\uZqVBZF.exe
  2⤵
  PID:8948
- C:\Windows\System\EdIByWn.exe
  C:\Windows\System\EdIByWn.exe
  2⤵
  PID:8964
- C:\Windows\System\EFrbifc.exe
  C:\Windows\System\EFrbifc.exe
  2⤵
  PID:8980
- C:\Windows\System\MhMiekT.exe
  C:\Windows\System\MhMiekT.exe
  2⤵
  PID:8996
- C:\Windows\System\WkJjVEJ.exe
  C:\Windows\System\WkJjVEJ.exe
  2⤵
  PID:9012
- C:\Windows\System\nXGEpEo.exe
  C:\Windows\System\nXGEpEo.exe
  2⤵
  PID:9040
- C:\Windows\System\CVrRuix.exe
  C:\Windows\System\CVrRuix.exe
  2⤵
  PID:9076
- C:\Windows\System\eveDXJf.exe
  C:\Windows\System\eveDXJf.exe
  2⤵
  PID:9112
- C:\Windows\System\KHlRefI.exe
  C:\Windows\System\KHlRefI.exe
  2⤵
  PID:8336
- C:\Windows\System\rrTgXGH.exe
  C:\Windows\System\rrTgXGH.exe
  2⤵
  PID:8788
- C:\Windows\System\eOOQzgu.exe
  C:\Windows\System\eOOQzgu.exe
  2⤵
  PID:8840
- C:\Windows\System\TXSTanB.exe
  C:\Windows\System\TXSTanB.exe
  2⤵
  PID:8884
- C:\Windows\System\gFXjmMO.exe
  C:\Windows\System\gFXjmMO.exe
  2⤵
  PID:8928
- C:\Windows\System\VDVyqYv.exe
  C:\Windows\System\VDVyqYv.exe
  2⤵
  PID:8912
- C:\Windows\System\QcCjHXC.exe
  C:\Windows\System\QcCjHXC.exe
  2⤵
  PID:8972
- C:\Windows\System\qPoCVGU.exe
  C:\Windows\System\qPoCVGU.exe
  2⤵
  PID:9032
- C:\Windows\System\gCEUFBf.exe
  C:\Windows\System\gCEUFBf.exe
  2⤵
  PID:9008
- C:\Windows\System\JxaIJuG.exe
  C:\Windows\System\JxaIJuG.exe
  2⤵
  PID:9064
- C:\Windows\System\ftIlCYd.exe
  C:\Windows\System\ftIlCYd.exe
  2⤵
  PID:9088
- C:\Windows\System\supxJIY.exe
  C:\Windows\System\supxJIY.exe
  2⤵
  PID:9108
- C:\Windows\System\EJeLjAL.exe
  C:\Windows\System\EJeLjAL.exe
  2⤵
  PID:9132
- C:\Windows\System\CbBQbhC.exe
  C:\Windows\System\CbBQbhC.exe
  2⤵
  PID:9148
- C:\Windows\System\oAcvSSJ.exe
  C:\Windows\System\oAcvSSJ.exe
  2⤵
  PID:9180
- C:\Windows\System\bLnehjL.exe
  C:\Windows\System\bLnehjL.exe
  2⤵
  PID:9204
- C:\Windows\System\BlubEmi.exe
  C:\Windows\System\BlubEmi.exe
  2⤵
  PID:9212
- C:\Windows\System\XQheVwF.exe
  C:\Windows\System\XQheVwF.exe
  2⤵
  PID:6768
- C:\Windows\System\gJsLdYZ.exe
  C:\Windows\System\gJsLdYZ.exe
  2⤵
  PID:8196
- C:\Windows\System\gaRHTOj.exe
  C:\Windows\System\gaRHTOj.exe
  2⤵
  PID:8256
- C:\Windows\System\mYgphML.exe
  C:\Windows\System\mYgphML.exe
  2⤵
  PID:8360
- C:\Windows\System\jXbWfDA.exe
  C:\Windows\System\jXbWfDA.exe
  2⤵
  PID:8424
- C:\Windows\System\iHyWxhw.exe
  C:\Windows\System\iHyWxhw.exe
  2⤵
  PID:8584
- C:\Windows\System\QGUPIvA.exe
  C:\Windows\System\QGUPIvA.exe
  2⤵
  PID:8648
- C:\Windows\System\PnUvujY.exe
  C:\Windows\System\PnUvujY.exe
  2⤵
  PID:8276
- C:\Windows\System\gxfaIJn.exe
  C:\Windows\System\gxfaIJn.exe
  2⤵
  PID:8628
- C:\Windows\System\bmmHyiU.exe
  C:\Windows\System\bmmHyiU.exe
  2⤵
  PID:8704
- C:\Windows\System\jIACRdF.exe
  C:\Windows\System\jIACRdF.exe
  2⤵
  PID:8408
- C:\Windows\System\fUQlgAO.exe
  C:\Windows\System\fUQlgAO.exe
  2⤵
  PID:8596
- C:\Windows\System\OYafGjD.exe
  C:\Windows\System\OYafGjD.exe
  2⤵
  PID:8684
- C:\Windows\System\diuhWUL.exe
  C:\Windows\System\diuhWUL.exe
  2⤵
  PID:8772
- C:\Windows\System\JtsvcUM.exe
  C:\Windows\System\JtsvcUM.exe
  2⤵
  PID:8776
- C:\Windows\System\EcRkvPV.exe
  C:\Windows\System\EcRkvPV.exe
  2⤵
  PID:8828
- C:\Windows\System\qCdNDKD.exe
  C:\Windows\System\qCdNDKD.exe
  2⤵
  PID:9060
- C:\Windows\System\UafAnCW.exe
  C:\Windows\System\UafAnCW.exe
  2⤵
  PID:8864
- C:\Windows\System\qQacqnU.exe
  C:\Windows\System\qQacqnU.exe
  2⤵
  PID:8960
- C:\Windows\System\CfDxQqt.exe
  C:\Windows\System\CfDxQqt.exe
  2⤵
  PID:9120
- C:\Windows\System\ORfxGhj.exe
  C:\Windows\System\ORfxGhj.exe
  2⤵
  PID:9004
- C:\Windows\System\mVdeuHB.exe
  C:\Windows\System\mVdeuHB.exe
  2⤵
  PID:9200
- C:\Windows\System\ChzedBE.exe
  C:\Windows\System\ChzedBE.exe
  2⤵
  PID:8240
- C:\Windows\System\hgJBWxL.exe
  C:\Windows\System\hgJBWxL.exe
  2⤵
  PID:8324
- C:\Windows\System\MMFVxYT.exe
  C:\Windows\System\MMFVxYT.exe
  2⤵
  PID:8212
- C:\Windows\System\nvaQNaB.exe
  C:\Windows\System\nvaQNaB.exe
  2⤵
  PID:8292
- C:\Windows\System\aDuVXlk.exe
  C:\Windows\System\aDuVXlk.exe
  2⤵
  PID:8700
- C:\Windows\System\TygPHib.exe
  C:\Windows\System\TygPHib.exe
  2⤵
  PID:8536
- C:\Windows\System\yydEAxv.exe
  C:\Windows\System\yydEAxv.exe
  2⤵
  PID:8728
- C:\Windows\System\wXlOutq.exe
  C:\Windows\System\wXlOutq.exe
  2⤵
  PID:8304
- C:\Windows\System\MTbrPXD.exe
  C:\Windows\System\MTbrPXD.exe
  2⤵
  PID:8440
- C:\Windows\System\fUpnwui.exe
  C:\Windows\System\fUpnwui.exe
  2⤵
  PID:8924
- C:\Windows\System\lcrNrfh.exe
  C:\Windows\System\lcrNrfh.exe
  2⤵
  PID:8720
- C:\Windows\System\hTCmDhI.exe
  C:\Windows\System\hTCmDhI.exe
  2⤵
  PID:9144
- C:\Windows\System\pjMwgkO.exe
  C:\Windows\System\pjMwgkO.exe
  2⤵
  PID:7476
- C:\Windows\System\OiMEagP.exe
  C:\Windows\System\OiMEagP.exe
  2⤵
  PID:8388
- C:\Windows\System\LrkmKno.exe
  C:\Windows\System\LrkmKno.exe
  2⤵
  PID:8520
- C:\Windows\System\FYHzQUT.exe
  C:\Windows\System\FYHzQUT.exe
  2⤵
  PID:8244
- C:\Windows\System\rNQjVxa.exe
  C:\Windows\System\rNQjVxa.exe
  2⤵
  PID:8376
- C:\Windows\System\vdDxJoU.exe
  C:\Windows\System\vdDxJoU.exe
  2⤵
  PID:9100
- C:\Windows\System\pvZHZMA.exe
  C:\Windows\System\pvZHZMA.exe
  2⤵
  PID:8988
- C:\Windows\System\nRAOhEB.exe
  C:\Windows\System\nRAOhEB.exe
  2⤵
  PID:8744
- C:\Windows\System\ppinbkw.exe
  C:\Windows\System\ppinbkw.exe
  2⤵
  PID:9160
- C:\Windows\System\GlqZzYl.exe
  C:\Windows\System\GlqZzYl.exe
  2⤵
  PID:9168
- C:\Windows\System\TsLIHnu.exe
  C:\Windows\System\TsLIHnu.exe
  2⤵
  PID:8516
- C:\Windows\System\bgdATVR.exe
  C:\Windows\System\bgdATVR.exe
  2⤵
  PID:8644
- C:\Windows\System\lseCQWH.exe
  C:\Windows\System\lseCQWH.exe
  2⤵
  PID:8404
- C:\Windows\System\NAtLUCE.exe
  C:\Windows\System\NAtLUCE.exe
  2⤵
  PID:8940
- C:\Windows\System\tjctFIO.exe
  C:\Windows\System\tjctFIO.exe
  2⤵
  PID:8344
- C:\Windows\System\wZXQUzY.exe
  C:\Windows\System\wZXQUzY.exe
  2⤵
  PID:8580
- C:\Windows\System\xwEdkvU.exe
  C:\Windows\System\xwEdkvU.exe
  2⤵
  PID:9104
- C:\Windows\System\vPOceXB.exe
  C:\Windows\System\vPOceXB.exe
  2⤵
  PID:9020
- C:\Windows\System\BPdVekq.exe
  C:\Windows\System\BPdVekq.exe
  2⤵
  PID:8456
- C:\Windows\System\nwCBWdh.exe
  C:\Windows\System\nwCBWdh.exe
  2⤵
  PID:8208
- C:\Windows\System\cSCLSzC.exe
  C:\Windows\System\cSCLSzC.exe
  2⤵
  PID:9228
- C:\Windows\System\XskUeMN.exe
  C:\Windows\System\XskUeMN.exe
  2⤵
  PID:9244
- C:\Windows\System\xVldpTA.exe
  C:\Windows\System\xVldpTA.exe
  2⤵
  PID:9264
- C:\Windows\System\JkZYCAs.exe
  C:\Windows\System\JkZYCAs.exe
  2⤵
  PID:9300
- C:\Windows\System\VEBSlfG.exe
  C:\Windows\System\VEBSlfG.exe
  2⤵
  PID:9316
- C:\Windows\System\hxSWIoD.exe
  C:\Windows\System\hxSWIoD.exe
  2⤵
  PID:9336
- C:\Windows\System\kTNUlzW.exe
  C:\Windows\System\kTNUlzW.exe
  2⤵
  PID:9352
- C:\Windows\System\RatFZcd.exe
  C:\Windows\System\RatFZcd.exe
  2⤵
  PID:9368
- C:\Windows\System\MKoJnzy.exe
  C:\Windows\System\MKoJnzy.exe
  2⤵
  PID:9384
- C:\Windows\System\YcFIVDr.exe
  C:\Windows\System\YcFIVDr.exe
  2⤵
  PID:9408
- C:\Windows\System\sBLagzr.exe
  C:\Windows\System\sBLagzr.exe
  2⤵
  PID:9428
- C:\Windows\System\BxSorMG.exe
  C:\Windows\System\BxSorMG.exe
  2⤵
  PID:9464
- C:\Windows\System\cgLbNjc.exe
  C:\Windows\System\cgLbNjc.exe
  2⤵
  PID:9480
- C:\Windows\System\sgZSzym.exe
  C:\Windows\System\sgZSzym.exe
  2⤵
  PID:9496
- C:\Windows\System\HYHMjpF.exe
  C:\Windows\System\HYHMjpF.exe
  2⤵
  PID:9516
- C:\Windows\System\uGMAXLM.exe
  C:\Windows\System\uGMAXLM.exe
  2⤵
  PID:9536
- C:\Windows\System\pweRRIB.exe
  C:\Windows\System\pweRRIB.exe
  2⤵
  PID:9556
- C:\Windows\System\qardZyr.exe
  C:\Windows\System\qardZyr.exe
  2⤵
  PID:9572
- C:\Windows\System\KVqIoHv.exe
  C:\Windows\System\KVqIoHv.exe
  2⤵
  PID:9596
- C:\Windows\System\MhOoowU.exe
  C:\Windows\System\MhOoowU.exe
  2⤵
  PID:9616
- C:\Windows\System\abFWKGW.exe
  C:\Windows\System\abFWKGW.exe
  2⤵
  PID:9632
- C:\Windows\System\nFcGeuG.exe
  C:\Windows\System\nFcGeuG.exe
  2⤵
  PID:9656
- C:\Windows\System\jQIqeWw.exe
  C:\Windows\System\jQIqeWw.exe
  2⤵
  PID:9684
- C:\Windows\System\DAWZRDB.exe
  C:\Windows\System\DAWZRDB.exe
  2⤵
  PID:9704
- C:\Windows\System\SlPJQSr.exe
  C:\Windows\System\SlPJQSr.exe
  2⤵
  PID:9724
- C:\Windows\System\DPFelgS.exe
  C:\Windows\System\DPFelgS.exe
  2⤵
  PID:9740
- C:\Windows\System\HKVVtQK.exe
  C:\Windows\System\HKVVtQK.exe
  2⤵
  PID:9756
- C:\Windows\System\uPHgFgA.exe
  C:\Windows\System\uPHgFgA.exe
  2⤵
  PID:9776
- C:\Windows\System\lUFzVmN.exe
  C:\Windows\System\lUFzVmN.exe
  2⤵
  PID:9804
- C:\Windows\System\tnUsadB.exe
  C:\Windows\System\tnUsadB.exe
  2⤵
  PID:9820
- C:\Windows\System\ByXprDo.exe
  C:\Windows\System\ByXprDo.exe
  2⤵
  PID:9844
- C:\Windows\System\QGwnYao.exe
  C:\Windows\System\QGwnYao.exe
  2⤵
  PID:9860
- C:\Windows\System\kUJneoe.exe
  C:\Windows\System\kUJneoe.exe
  2⤵
  PID:9876
- C:\Windows\System\xerLkUU.exe
  C:\Windows\System\xerLkUU.exe
  2⤵
  PID:9896
- C:\Windows\System\VjdnHIH.exe
  C:\Windows\System\VjdnHIH.exe
  2⤵
  PID:9916
- C:\Windows\System\CdORnuj.exe
  C:\Windows\System\CdORnuj.exe
  2⤵
  PID:9944
- C:\Windows\System\VdpdCeO.exe
  C:\Windows\System\VdpdCeO.exe
  2⤵
  PID:9964
- C:\Windows\System\SzHkvAf.exe
  C:\Windows\System\SzHkvAf.exe
  2⤵
  PID:9984
- C:\Windows\System\OloLtDT.exe
  C:\Windows\System\OloLtDT.exe
  2⤵
  PID:10000
- C:\Windows\System\NzbEryI.exe
  C:\Windows\System\NzbEryI.exe
  2⤵
  PID:10016
- C:\Windows\System\WWWIHbc.exe
  C:\Windows\System\WWWIHbc.exe
  2⤵
  PID:10036
- C:\Windows\System\KIEspRN.exe
  C:\Windows\System\KIEspRN.exe
  2⤵
  PID:10060
- C:\Windows\System\cdfwmgX.exe
  C:\Windows\System\cdfwmgX.exe
  2⤵
  PID:10080
- C:\Windows\System\OgUPqXy.exe
  C:\Windows\System\OgUPqXy.exe
  2⤵
  PID:10100
- C:\Windows\System\BPDwvkZ.exe
  C:\Windows\System\BPDwvkZ.exe
  2⤵
  PID:10116
- C:\Windows\System\RcOapNH.exe
  C:\Windows\System\RcOapNH.exe
  2⤵
  PID:10140
- C:\Windows\System\vufYuYb.exe
  C:\Windows\System\vufYuYb.exe
  2⤵
  PID:10160
- C:\Windows\System\MoFABnf.exe
  C:\Windows\System\MoFABnf.exe
  2⤵
  PID:10184
- C:\Windows\System\nszVbME.exe
  C:\Windows\System\nszVbME.exe
  2⤵
  PID:10200
- C:\Windows\System\rUgtmgF.exe
  C:\Windows\System\rUgtmgF.exe
  2⤵
  PID:10224
- C:\Windows\System\vCpKOZW.exe
  C:\Windows\System\vCpKOZW.exe
  2⤵
  PID:9220
- C:\Windows\System\yweNBuA.exe
  C:\Windows\System\yweNBuA.exe
  2⤵
  PID:9260
- C:\Windows\System\TNetSih.exe
  C:\Windows\System\TNetSih.exe
  2⤵
  PID:9236
- C:\Windows\System\AiSlobE.exe
  C:\Windows\System\AiSlobE.exe
  2⤵
  PID:8632
- C:\Windows\System\WsnQPOO.exe
  C:\Windows\System\WsnQPOO.exe
  2⤵
  PID:9296
- C:\Windows\System\dMCUUet.exe
  C:\Windows\System\dMCUUet.exe
  2⤵
  PID:9348
- C:\Windows\System\LUjVTww.exe
  C:\Windows\System\LUjVTww.exe
  2⤵
  PID:9420
- C:\Windows\System\PolVWBK.exe
  C:\Windows\System\PolVWBK.exe
  2⤵
  PID:8488
- C:\Windows\System\UPwZfMJ.exe
  C:\Windows\System\UPwZfMJ.exe
  2⤵
  PID:9452
- C:\Windows\System\hkQsOgs.exe
  C:\Windows\System\hkQsOgs.exe
  2⤵
  PID:9504
- C:\Windows\System\pnpNlqX.exe
  C:\Windows\System\pnpNlqX.exe
  2⤵
  PID:9524
- C:\Windows\System\Livvslj.exe
  C:\Windows\System\Livvslj.exe
  2⤵
  PID:9580
- C:\Windows\System\ztykQBw.exe
  C:\Windows\System\ztykQBw.exe
  2⤵
  PID:9624
- C:\Windows\System\sFsgQav.exe
  C:\Windows\System\sFsgQav.exe
  2⤵
  PID:9664
- C:\Windows\System\aeDgfsa.exe
  C:\Windows\System\aeDgfsa.exe
  2⤵
  PID:9644
- C:\Windows\System\IiNsTup.exe
  C:\Windows\System\IiNsTup.exe
  2⤵
  PID:9696
- C:\Windows\System\HGaUlGx.exe
  C:\Windows\System\HGaUlGx.exe
  2⤵
  PID:9720
- C:\Windows\System\tBjzmJG.exe
  C:\Windows\System\tBjzmJG.exe
  2⤵
  PID:9736
- C:\Windows\System\LboZfto.exe
  C:\Windows\System\LboZfto.exe
  2⤵
  PID:9784
- C:\Windows\System\bOFyQWc.exe
  C:\Windows\System\bOFyQWc.exe
  2⤵
  PID:9828
- C:\Windows\System\hRyUpqx.exe
  C:\Windows\System\hRyUpqx.exe
  2⤵
  PID:9904
- C:\Windows\System\GMnUTYB.exe
  C:\Windows\System\GMnUTYB.exe
  2⤵
  PID:9892
- C:\Windows\System\HRxoJMe.exe
  C:\Windows\System\HRxoJMe.exe
  2⤵
  PID:9924
- C:\Windows\System\fOptPAX.exe
  C:\Windows\System\fOptPAX.exe
  2⤵
  PID:9956
- C:\Windows\System\ZiLHblt.exe
  C:\Windows\System\ZiLHblt.exe
  2⤵
  PID:9980
- C:\Windows\System\xnIcmce.exe
  C:\Windows\System\xnIcmce.exe
  2⤵
  PID:10028
- C:\Windows\System\VigkVaJ.exe
  C:\Windows\System\VigkVaJ.exe
  2⤵
  PID:10048
- C:\Windows\System\QZvlQOo.exe
  C:\Windows\System\QZvlQOo.exe
  2⤵
  PID:10108
- C:\Windows\System\qEKOIAh.exe
  C:\Windows\System\qEKOIAh.exe
  2⤵
  PID:10128
- C:\Windows\System\HqpcIDs.exe
  C:\Windows\System\HqpcIDs.exe
  2⤵
  PID:10152
- C:\Windows\System\NgBvoBk.exe
  C:\Windows\System\NgBvoBk.exe
  2⤵
  PID:10176
- C:\Windows\System\zwCXsGj.exe
  C:\Windows\System\zwCXsGj.exe
  2⤵
  PID:10212
- C:\Windows\System\xeKkLru.exe
  C:\Windows\System\xeKkLru.exe
  2⤵
  PID:9256
- C:\Windows\System\MHpxqeq.exe
  C:\Windows\System\MHpxqeq.exe
  2⤵
  PID:9284
- C:\Windows\System\rYwoRhH.exe
  C:\Windows\System\rYwoRhH.exe
  2⤵
  PID:9416
- C:\Windows\System\fLLxHyF.exe
  C:\Windows\System\fLLxHyF.exe
  2⤵
  PID:9328
- C:\Windows\System\ErfwceM.exe
  C:\Windows\System\ErfwceM.exe
  2⤵
  PID:9364
- C:\Windows\System\yubVrXD.exe
  C:\Windows\System\yubVrXD.exe
  2⤵
  PID:9444
- C:\Windows\System\VYiZhgU.exe
  C:\Windows\System\VYiZhgU.exe
  2⤵
  PID:9512
- C:\Windows\System\lEZgIyt.exe
  C:\Windows\System\lEZgIyt.exe
  2⤵
  PID:9592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\COghbtw.exe

Filesize
2.6MB

MD5
d1277664cb528db35553e70bbaf8038a

SHA1
9d44b8ed9b1b44ee3035cbd4b8b7c2480ae7430d

SHA256
b3d08291ace14d615095aa958c34b23400c5e80b7a17a5af66089ba892c00018

SHA512
8b63b30eda10ee6df72644c1ce66a728ccb5d3f4df71e55fcc291af365dc64d8bb8abe81353f78c7143dbd6151e5c6e66861fc028ef4f676240909c5a28488d0

Download Submit
C:\Windows\system\ETJdCwG.exe

Filesize
2.6MB

MD5
f5897b21b0e5875c3d94419c0208193d

SHA1
ebc1fc0880d8a1f8fc8b75de17879360935ce000

SHA256
0a978ccd9da3985c74b4cb4adbba9a9de1d9e9f58aebcb348bc33a7aaf3490e8

SHA512
0fe5f0453e8a3fa8c70d4545589b3142e07c9c82fb245624068567a39f27f51844a207a0a614dd5fbbc76667a07f54d5a448dc2fad836371b08dcb0e957c2f6c

Download Submit
C:\Windows\system\FMhUMtX.exe

Filesize
2.6MB

MD5
d0a129963b5d48d30df5c521021c9858

SHA1
18b546262eefeb5d045c82e0ae30761aae9cf2b7

SHA256
0a0aeed3c597db909399ed1f2058fb9488f49627928b1fa3cda11a88b2749d26

SHA512
759c0de212a42daded887c824d93f3583e460d0fd4a2baa8d998ed0e014958d4480b5b78b93b2f51fdb4e19e9d0f33324554d704a96c879506600153ca398d4b

Download Submit
C:\Windows\system\FuLHjCk.exe

Filesize
2.6MB

MD5
ae704c496503885172bdbb42583d462b

SHA1
37da3c2db2154a292d79c1706ab5ed92c62dee46

SHA256
dbb2230bb15aecf4b2b87a6c11fd8364f08fade0498d4dde3280dc5363857374

SHA512
43e555383ba4f18d8b5a96cb2850edfef3e958457e5ddbb5417da0b7c030dbd893883a1ae3a0cce736829127773652034d3316f29de19d2458ffa1717a95d850

Download Submit
C:\Windows\system\HZAUyek.exe

Filesize
2.6MB

MD5
f944c07f90db108dfbcb67538fdd8f71

SHA1
6102d1a016b346bc71f7b1c2dd537c04339ee540

SHA256
f8e412cb1e2babce9b8faef6b95946cf8ffccd0558c7f3a1c17637344e0e9140

SHA512
b6855e2f50a393dd6229ed3a14ce393c4faa85dd0b9edcf9bd06523facb3ad6c4b24a48ea2947c45932b572d34aecfad72fc87716b7d72fc9fb6e5530a836714

Download Submit
C:\Windows\system\HghWXnU.exe

Filesize
2.6MB

MD5
4da5fa81138cec56466d32368bdbccf2

SHA1
ccdaaa80d1c8e0595ba498bc3279eb4f670aa12c

SHA256
6cff0306128fc9d1d3a70bde9cb50a8dbb408baac5e6272ef218dceb38160b69

SHA512
9b20f49d66a3d6eb44a0569697b1dbfb5e0dbafc33cee446fd448550359ca61fe39e5305951f645b0143c46452f590dd4ebd4cc98118f81e5bdad29fcfa2b3d0

Download Submit
C:\Windows\system\JPPXCSi.exe

Filesize
2.6MB

MD5
0dc6a7e99c895a4192b1ead3447dc274

SHA1
dd19937d35385e0e75faade19ca89ac51b29b54c

SHA256
be02b75b7628e12dc80f48045fb2b540bee7467d1e135898913f21788fbaa7d6

SHA512
02ea394d9ede7347363cf2a6ed959bccf7106fbec2af1d1fd0b6a82e2a367dc42083a82fd35df52c682267be30de20d87a49203924b019bdb7d00945edf04b4b

Download Submit
C:\Windows\system\OHVKTju.exe

Filesize
2.6MB

MD5
a849b4ed42f281c56f7acdf52f133ea7

SHA1
2d2c33cd185a0d2a5e33e7a464e6e3f036a73a46

SHA256
eb7e5b756b6ee627c44c1288b9a07ec663172a996b56038a6916562a4e1d5687

SHA512
5f0f343acee6f20d3d511416a9343dfa85951a6e054941b80a4d445910eeab76233f3ae489f611d5e811c64812c4f4baf89511579f6c47efafadbfab9a2c6574

Download Submit
C:\Windows\system\OvgcYTV.exe

Filesize
2.6MB

MD5
920fd1db32d44f51d175449063e3ae15

SHA1
f5ec6e5bbfd0637fe895474937e445d1ba6ac685

SHA256
7a49da573857662ae1ccb1b528b89b999cacf293ba2b57efb38f657f7c05822b

SHA512
c78be47a46557f2e43ccfe06bedd0b6384bc9735d22e5280cfb280a1ea865d7fb78739a571dce72adf34f537d01c5038104b7c73dfff2ae7f7ea36a488a29e70

Download Submit
C:\Windows\system\RdmzyBI.exe

Filesize
2.6MB

MD5
2ab103c161f4efcc640a5f44e3d34aa5

SHA1
69193e20c12753babfd356d8a6c606fbeeb83728

SHA256
3869d0f0011ab3bc0d93f0d80c6252809b40ff7f600aee3ae8b0b57e8870429b

SHA512
07216b61062576dbcd6b85d441355f9a5d9bef44214893a6f570d7578229170ccd2eb47dcfe35bb77004219d8141410bfa2067e66be1c9def558e5207001f525

Download Submit
C:\Windows\system\TLlHhEB.exe

Filesize
2.6MB

MD5
f19c72251940a4a584ccc61dd0e382dd

SHA1
80c204e2b51aa62a7fb6b1dc9b7b25023df29537

SHA256
876f77670db8d27cd6f8acc9254d4fdcbadc733c7491619fdd61f0c9f3fb97a0

SHA512
1ceb8db80d37fd35da4742b08feb87770936940ae01daa41775750c4c0c08783637a7f0e96d068c604085b2ad6dfac10b8118f2ae562d6764ad7310ee5927503

Download Submit
C:\Windows\system\Uyeyvow.exe

Filesize
2.6MB

MD5
f136b3d5552cda60a275700ee7f06f41

SHA1
fe610b5b3080d909ed93e44b9551b1dd2bbe617c

SHA256
ea4e99c5f70ed17d0555be925de2b8d11e23f23dc3a4ae2cb5c43b854a0b4da6

SHA512
71fa92bba91e9df69540794f390b8a3fa13b5f7f67443c3d3fe7a93bf88d831d5ed7a46adcaf899c397a938782c1d854dc521f379f05af55a238b53013a01b1c

Download Submit
C:\Windows\system\VfWRatz.exe

Filesize
2.6MB

MD5
60c4d5e2b18642a4f06a11be75e290e6

SHA1
b431118d20d21c129afbb1b6635d2e50b7579e2a

SHA256
1728d8a1af6428d7209c03f39a1eafe9fa74532075efe125104423e068a6b763

SHA512
1ba03820fa4573d4bb7072dab3ed2998802e4ae5cb9e8afc204d0d5a95605435ba165e6d6fda83de18e5fffc1b801e6207298566573166971d1d3ebc3bdeb87e

Download Submit
C:\Windows\system\WHgLRLo.exe

Filesize
2.6MB

MD5
8ac4d93f8b278c33e18dc7fb2fa864e8

SHA1
8b01f4a72d59db3a3b9006db9010e6602bc1d060

SHA256
0c1cc4329b075fa209b9e63fc725e4d261ddc843d999bf2dd4a67de180b11f32

SHA512
42a6e9ced346bcd0a33d8672b040c4c04f01d71f5ab8dd6ce113de7277201a94185c1f2f7ffb8e136621127a7bca6c99f98c75771bff371ca7d3b1ff137de950

Download Submit
C:\Windows\system\WLfrLru.exe

Filesize
2.6MB

MD5
529a291a946cb364d7de8d5e1397e4c8

SHA1
7e7458a136290ec21fc621b789509e076d449e06

SHA256
f76b164afbd5720eec5c1cc6c4041b0c12d6e01350fd3b703e49fab0a842f1fc

SHA512
36c5b61f87aac615cf8768890c0eb396ebb2677dcd85c9e5f371606082a471432463f16d2ce4e90ec18953475a89175d8e48c64a1468e68310860b49d1873a0c

Download Submit
C:\Windows\system\WRUmlYW.exe

Filesize
2.6MB

MD5
98c97ccce4f37ea00b64b8ea8d32c0fe

SHA1
5c7dd905575afc810324ab4d3e15dae990176852

SHA256
5ce5a3b86eb8cb42d0721e6afe49968ffdae5ed25a43ac0cf901b27c4c9fb6db

SHA512
5e17e63fd7d6a52c9ae90915ebc304f68f60236d4b7a08a9f79300eec2f854b33d025cec00a3dfb2c6b6d5d7b23c4116bfa080d50812e1ec9a7b69a0cab2bdfd

Download Submit
C:\Windows\system\fhCvIhk.exe

Filesize
2.6MB

MD5
943ac5a8273d558c630f2bad472fb1e1

SHA1
eec8529c257b1e701f3ef37ca2a0b0828527e891

SHA256
ed51a62b9e2e8fe67f11ea995594256ae915303260d8b7d91e26496c91e288c7

SHA512
fa10ec649d232bc68eee7f4a5cae54bfb170f9c51751b68fb98b69d7c097f57976cfce5017e55e6aed74ae488acf13096f63972a57b03fc18d772c9fd3bfc128

Download Submit
C:\Windows\system\gfBLeby.exe

Filesize
2.6MB

MD5
58b3112ca8b3c009f6b0422ea7022082

SHA1
d6f5e60035eed2b9b25123525776696c17265d23

SHA256
9098ecc6520f216535bc035ef6011b74b2cde92bb65e6b48a3fa115a08798a10

SHA512
32c8eb6fc689971a2a43151040c29153269d01d97f98edc2ea76dae0081a99eecc1e43ddd84e3539b92322bfaa0201ae054ffc0939d7d95a1a674c18a086d5ec

Download Submit
C:\Windows\system\hKvhAOR.exe

Filesize
2.6MB

MD5
40746de57c41b59191f13c83627e4064

SHA1
a6e91e2ed68b3cabe494b8f085ef29f7a54721e3

SHA256
9e2ac8ae87b663dbe3a24b151e09bbd8126860d827587c5da1d365d6ddeab37f

SHA512
d3f475429e429f54de04b1f49bfb6699038609a0900ccf3c82024b736fb71414a9cbb0e7d680a976104ae777d38037cb148b633b3af8bdf86c2cf7c438e41502

Download Submit
C:\Windows\system\hyNFSGE.exe

Filesize
2.6MB

MD5
92335c2d9aa8a84cc82829edd1f66332

SHA1
3889f393dcace16d66335cb7773cdd4c64bb6311

SHA256
1d22791d2ce93318f83829c909126cba05e87ebec75931ae6421a4c7f3d5783b

SHA512
bd2e5cfe5901b239da52d59be6cc7c5ff9857d09dea492099ada6af872f11b7c44a7a9a2d7a81b63e012c817bb765e53a5df9650c4dd51a593c1817dd0f2718a

Download Submit
C:\Windows\system\ibOCjpC.exe

Filesize
2.6MB

MD5
ca248bcaa801628981485a527e943362

SHA1
25e17e00446a6a87110bd12bd1d4ae041a47eb1c

SHA256
01daa1c6b25c77749cdc5417e5d587e7419cf2b8ba60c7504623240aeaae697c

SHA512
43711c8337956a5de1689c6117bc9aed76108ebc75fae00c77210808f9188d0ba4f757535336d4601fbb7751df159387ddc84d62ec87615168c0a1caf7ef8c55

Download Submit
C:\Windows\system\nonvwhS.exe

Filesize
2.6MB

MD5
083ea09192cff24229e30006e0529034

SHA1
849d386b4859d57557a47bf7bdaddd2bd7e2562c

SHA256
79b578b60e28beb22069e3e7836cf6879b2279a526ac22719fe1e453e287c626

SHA512
90e21fa95338e66ffea640f0a6e5ba7f091f4530155a789c2e28cca33f7bfee08ac6e36dff0e0b751e3dc2aea3ffc5f73cc3993db020c995ca4697910e0ec8ad

Download Submit
C:\Windows\system\oWeGHAZ.exe

Filesize
2.6MB

MD5
86c891672ad2e776d5baac8d9d1e0168

SHA1
f02f14b20b0464bf54bdebbbd454e87272369c89

SHA256
b3108532d04dc197f7531969a3f4484f1737e4445f7a3303a8587c3abbffc29e

SHA512
f67339bf132d9416011431b4695fbd910f57224633f8ee68db18a399048d3c7d7900ce649e7a1096c5b19f1e34ef43e6bbc6dd25ed73f295949a976078008559

Download Submit
C:\Windows\system\qUGBQbi.exe

Filesize
2.6MB

MD5
3ff8f4f2b21b78f1ed10a6dcdaad7f92

SHA1
ab503166afff5a3de0c60a38206b15962412a001

SHA256
0287e9ab64f39a3d61e79018b6ec5e608a46344780732920ac07a71b8d4a423c

SHA512
432aa1a0f32752bddfc02c82d5ccbcb26f20f50e9454f542324f0c7d0bdfe0121cbfde25cc67250071b56cfe0597801ec526ec6e7e61a636a69373d1aff0dddd

Download Submit
C:\Windows\system\rWRgpfX.exe

Filesize
2.6MB

MD5
8213b7b472bf656b679d7f632e1c99b6

SHA1
943cd18090f45bc9f56423b045f15c48e13dc1a4

SHA256
f4944ee3bd03b0c2a963f729737294696a65a268dea56ea8ca071a103379a0f1

SHA512
2a0d04ee5a86a9afef4672d0a89d7d8feb7fc43a4c5918ffb98df14dca55de145612090db331bd517915ff74e0fb240712f4c153bb2c70e21eb8294362d0acab

Download Submit
C:\Windows\system\zOUXhCt.exe

Filesize
2.6MB

MD5
477df9c2c780613f959ce507fbd3a366

SHA1
e25b689c82483a16242a3ee9dd5054759420735c

SHA256
c9aaa8fffeeb7fff3a0f9ca5a338590fbdafba5bed02bfb2b6877dd473ca4af4

SHA512
4de98bfdb2566f52c2a4ba4d027beee0b1b1482830a3413364168e87b1d83e15c670359a58d8a40f8333f69b00bc93cc4ae43e259b69e99a47d4a42cbd2e83a2

Download Submit
\Windows\system\CKWJBpo.exe

Filesize
2.6MB

MD5
33599535658cb0dfdcd568323c8a014e

SHA1
8eb606a95810d6cd377b532644d6b975509ae600

SHA256
1c5bcb22aba26065fb6cf16a210cec48aba28ec4463fd8b7e41190bb05b585d0

SHA512
ec300b018ab0e0c1222309d32aaa929f8be9260b4dc30e35dff7fa127563a3736c58e4c1aa1e6b711729534cb247bd83f35581ccf1e33a15d1785d5130b4be29

Download Submit
\Windows\system\ENmfrss.exe

Filesize
2.6MB

MD5
6df770e1263aebca467293eba62afd2c

SHA1
d1364d20b57197869aa89407e77dd9cf25de4c2e

SHA256
4ca543862c300e25ed4f1274fd733b1bc80f0fd745c40edd21e0e5ab471326d9

SHA512
030c26260f8e22505b7c94946b5369e9c4dc990cc27c8b7758a50170e35c4b3149e34304d42c1c1642d745c814816b0826f7898c49331609250ef6eb3cdbb9e9

Download Submit
\Windows\system\WaCWDLK.exe

Filesize
2.6MB

MD5
b8feab47c869d299291e230602836bb3

SHA1
7bc9dc773ce511e0befb4a403c764dc80d8a9c69

SHA256
90fc916ad388a3106b4839a30de799efdcde6f5d99ea410147b92f107bc2685b

SHA512
6a8fddaddcf18a6d04fe44498b71a3f80670cd42b504063c5aca679a1829cfabb7d573827675d4aa0241ff68ed5fcd3b9508f6d4c892a96466c2346a7b522bc6

Download Submit
\Windows\system\jlWqUVy.exe

Filesize
2.6MB

MD5
9458a291d09f033f628a8c258aa27c52

SHA1
08db7ae655fae2efb87033c7792cd02e9119edfd

SHA256
5d1eeed11f860338205c3d9a2a871e2cc2ac16ca4206d8f661a26d12f3edc8f4

SHA512
4558ac0bba67e25791f3e65b6518ec73d4cd976ce9ff64c699a9356740c18d41e9d8942ddfd8fc98394f5b76231c9b25db921fbbf3312c68e219dd719e77c76b

Download Submit
\Windows\system\mVdhtqd.exe

Filesize
2.6MB

MD5
88d4527f8f765880ba0e98bb7bf886f8

SHA1
cb1e8009589b56ca8eb15eb582bad11e09f40942

SHA256
333f016a5d46202d011481930e5e47bfdd1f346209adf148450fa1ab5c84399c

SHA512
02f56e2c3a2508015a1740dbf22b1d489726b849a0453cd67a46eec206c7af21e59531427b1c8e8dd4f58b9ef063bc60e0dc6999fc2b82a5ef3a4b3a836c04d8

Download Submit
\Windows\system\oGvVbvw.exe

Filesize
2.6MB

MD5
9b11eca35f3799078c2d60e8327463fd

SHA1
09327cad7bab574ab8ad1b4e3650527537a797df

SHA256
4b9b5c1990f193108fcf887cd4e3073341a663c5bd8e95cf39203d85bb3ca191

SHA512
b49ac48eb00e86861e934a18aff527e50e0f3fcfe5965c9eddfb62603b255fdf23c8fc56d6c07ed452f80376d1ed1869631dccff54b1ced999663f8afd2e152f

Download Submit
memory/276-635-0x000000013F270000-0x000000013F5C4000-memory.dmp

Filesize
3.3MB

Download
memory/276-77-0x000000013F270000-0x000000013F5C4000-memory.dmp

Filesize
3.3MB

Download
memory/276-4008-0x000000013F270000-0x000000013F5C4000-memory.dmp

Filesize
3.3MB

Download
memory/1104-113-0x000000013F2C0000-0x000000013F614000-memory.dmp

Filesize
3.3MB

Download
memory/1104-4010-0x000000013F2C0000-0x000000013F614000-memory.dmp

Filesize
3.3MB

Download
memory/2288-8-0x000000013FFA0000-0x00000001402F4000-memory.dmp

Filesize
3.3MB

Download
memory/2288-3998-0x000000013FFA0000-0x00000001402F4000-memory.dmp

Filesize
3.3MB

Download
memory/2288-67-0x000000013FFA0000-0x00000001402F4000-memory.dmp

Filesize
3.3MB

Download
memory/2512-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2512-62-0x000000013FDC0000-0x0000000140114000-memory.dmp

Filesize
3.3MB

Download
memory/2512-117-0x00000000021B0000-0x0000000002504000-memory.dmp

Filesize
3.3MB

Download
memory/2512-71-0x000000013F0D0000-0x000000013F424000-memory.dmp

Filesize
3.3MB

Download
memory/2512-40-0x000000013F910000-0x000000013FC64000-memory.dmp

Filesize
3.3MB

Download
memory/2512-21-0x000000013FA00000-0x000000013FD54000-memory.dmp

Filesize
3.3MB

Download
memory/2512-29-0x00000000021B0000-0x0000000002504000-memory.dmp

Filesize
3.3MB

Download
memory/2512-115-0x00000000021B0000-0x0000000002504000-memory.dmp

Filesize
3.3MB

Download
memory/2512-66-0x00000000021B0000-0x0000000002504000-memory.dmp

Filesize
3.3MB

Download
memory/2512-47-0x00000000021B0000-0x0000000002504000-memory.dmp

Filesize
3.3MB

Download
memory/2512-2073-0x00000000021B0000-0x0000000002504000-memory.dmp

Filesize
3.3MB

Download
memory/2512-48-0x00000000021B0000-0x0000000002504000-memory.dmp

Filesize
3.3MB

Download
memory/2512-0-0x000000013FDC0000-0x0000000140114000-memory.dmp

Filesize
3.3MB

Download
memory/2512-12-0x000000013F0D0000-0x000000013F424000-memory.dmp

Filesize
3.3MB

Download
memory/2624-4004-0x000000013FD10000-0x0000000140064000-memory.dmp

Filesize
3.3MB

Download
memory/2624-96-0x000000013FD10000-0x0000000140064000-memory.dmp

Filesize
3.3MB

Download
memory/2704-49-0x000000013FD10000-0x0000000140064000-memory.dmp

Filesize
3.3MB

Download
memory/2704-4001-0x000000013FD10000-0x0000000140064000-memory.dmp

Filesize
3.3MB

Download
memory/2752-4005-0x000000013F020000-0x000000013F374000-memory.dmp

Filesize
3.3MB

Download
memory/2752-59-0x000000013F020000-0x000000013F374000-memory.dmp

Filesize
3.3MB

Download
memory/2752-86-0x000000013F020000-0x000000013F374000-memory.dmp

Filesize
3.3MB

Download
memory/2772-4002-0x000000013F910000-0x000000013FC64000-memory.dmp

Filesize
3.3MB

Download
memory/2772-46-0x000000013F910000-0x000000013FC64000-memory.dmp

Filesize
3.3MB

Download
memory/2772-85-0x000000013F910000-0x000000013FC64000-memory.dmp

Filesize
3.3MB

Download
memory/2816-327-0x000000013FBE0000-0x000000013FF34000-memory.dmp

Filesize
3.3MB

Download
memory/2816-73-0x000000013FBE0000-0x000000013FF34000-memory.dmp

Filesize
3.3MB

Download
memory/2816-4009-0x000000013FBE0000-0x000000013FF34000-memory.dmp

Filesize
3.3MB

Download
memory/2860-75-0x000000013FDD0000-0x0000000140124000-memory.dmp

Filesize
3.3MB

Download
memory/2860-489-0x000000013FDD0000-0x0000000140124000-memory.dmp

Filesize
3.3MB

Download
memory/2860-4006-0x000000013FDD0000-0x0000000140124000-memory.dmp

Filesize
3.3MB

Download
memory/2868-35-0x000000013F860000-0x000000013FBB4000-memory.dmp

Filesize
3.3MB

Download
memory/2868-4000-0x000000013F860000-0x000000013FBB4000-memory.dmp

Filesize
3.3MB

Download
memory/2868-84-0x000000013F860000-0x000000013FBB4000-memory.dmp

Filesize
3.3MB

Download
memory/2880-4003-0x000000013FA00000-0x000000013FD54000-memory.dmp

Filesize
3.3MB

Download
memory/2880-53-0x000000013FA00000-0x000000013FD54000-memory.dmp

Filesize
3.3MB

Download
memory/3000-3999-0x000000013F0D0000-0x000000013F424000-memory.dmp

Filesize
3.3MB

Download
memory/3000-14-0x000000013F0D0000-0x000000013F424000-memory.dmp

Filesize
3.3MB

Download
memory/3000-72-0x000000013F0D0000-0x000000013F424000-memory.dmp

Filesize
3.3MB

Download
memory/3028-69-0x000000013FED0000-0x0000000140224000-memory.dmp

Filesize
3.3MB

Download
memory/3028-118-0x000000013FED0000-0x0000000140224000-memory.dmp

Filesize
3.3MB

Download
memory/3028-4007-0x000000013FED0000-0x0000000140224000-memory.dmp

Filesize
3.3MB

Download