xmrig | d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/12/2024, 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
Size

1.8MB
MD5

14bdca1a01de416abe22a936c530114e
SHA1

8f635d91624735df7c83ded2b3fa31918b075b5b
SHA256

d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96
SHA512

d15fc156fd8311e82b4411dc3d706aaee31ff78d8050751fd7382bcb0b1883bedad54a5a4fbe565111bf0aa778c4e77fcaa1f91480438f6448576e4f8e9e7b41
SSDEEP

49152:EnCbL83y9FdfE0pZ0zCa4wI156uL3pgrCEdMZ:EniLf9FdfE0pZB156utgy

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 57 IoCs

miner

resource	yara_rule
behavioral1/memory/3048-0-0x000000013FDA0000-0x00000001400F4000-memory.dmp	xmrig
behavioral1/files/0x00070000000120fe-3.dat	xmrig
behavioral1/files/0x0008000000016dc7-7.dat	xmrig
behavioral1/files/0x0008000000016dd2-15.dat	xmrig
behavioral1/files/0x0005000000019d8b-130.dat	xmrig
behavioral1/files/0x000500000001a08a-170.dat	xmrig
behavioral1/files/0x000500000001a325-185.dat	xmrig
behavioral1/files/0x000500000001a2e7-180.dat	xmrig
behavioral1/files/0x000500000001a04e-174.dat	xmrig
behavioral1/files/0x000500000001961f-152.dat	xmrig
behavioral1/files/0x0005000000019589-150.dat	xmrig
behavioral1/files/0x000500000001953a-148.dat	xmrig
behavioral1/memory/3056-145-0x000000013F1B0000-0x000000013F504000-memory.dmp	xmrig
behavioral1/memory/2732-138-0x000000013FB00000-0x000000013FE54000-memory.dmp	xmrig
behavioral1/memory/2648-137-0x000000013F190000-0x000000013F4E4000-memory.dmp	xmrig
behavioral1/files/0x0005000000019f4e-134.dat	xmrig
behavioral1/files/0x0005000000019f4a-122.dat	xmrig
behavioral1/memory/1888-117-0x000000013F330000-0x000000013F684000-memory.dmp	xmrig
behavioral1/files/0x0005000000019cbf-114.dat	xmrig
behavioral1/memory/3048-109-0x0000000001F50000-0x00000000022A4000-memory.dmp	xmrig
behavioral1/files/0x0005000000019c50-108.dat	xmrig
behavioral1/files/0x0005000000019c66-105.dat	xmrig
behavioral1/memory/2720-98-0x000000013F680000-0x000000013F9D4000-memory.dmp	xmrig
behavioral1/memory/2864-97-0x000000013FED0000-0x0000000140224000-memory.dmp	xmrig
behavioral1/files/0x0005000000019aec-96.dat	xmrig
behavioral1/files/0x00050000000197c1-95.dat	xmrig
behavioral1/memory/2836-94-0x000000013F9E0000-0x000000013FD34000-memory.dmp	xmrig
behavioral1/files/0x0005000000019aee-90.dat	xmrig
behavioral1/files/0x0005000000019aea-81.dat	xmrig
behavioral1/files/0x0005000000019625-73.dat	xmrig
behavioral1/files/0x0007000000019234-46.dat	xmrig
behavioral1/files/0x00070000000175c6-45.dat	xmrig
behavioral1/files/0x000500000001a061-155.dat	xmrig
behavioral1/files/0x0005000000019c68-129.dat	xmrig
behavioral1/files/0x00090000000175d2-102.dat	xmrig
behavioral1/files/0x0007000000017546-78.dat	xmrig
behavioral1/memory/1260-72-0x000000013FCC0000-0x0000000140014000-memory.dmp	xmrig
behavioral1/files/0x0005000000019624-71.dat	xmrig
behavioral1/files/0x000500000001961b-70.dat	xmrig
behavioral1/files/0x000500000001957c-69.dat	xmrig
behavioral1/files/0x0008000000016ee0-52.dat	xmrig
behavioral1/memory/1724-29-0x000000013F1C0000-0x000000013F514000-memory.dmp	xmrig
behavioral1/memory/2548-42-0x000000013F230000-0x000000013F584000-memory.dmp	xmrig
behavioral1/files/0x00070000000170b5-31.dat	xmrig
behavioral1/memory/2376-20-0x000000013F2A0000-0x000000013F5F4000-memory.dmp	xmrig
behavioral1/memory/3048-1687-0x000000013FDA0000-0x00000001400F4000-memory.dmp	xmrig
behavioral1/memory/2548-4013-0x000000013F230000-0x000000013F584000-memory.dmp	xmrig
behavioral1/memory/1724-4014-0x000000013F1C0000-0x000000013F514000-memory.dmp	xmrig
behavioral1/memory/2376-4015-0x000000013F2A0000-0x000000013F5F4000-memory.dmp	xmrig
behavioral1/memory/1260-4016-0x000000013FCC0000-0x0000000140014000-memory.dmp	xmrig
behavioral1/memory/2864-4017-0x000000013FED0000-0x0000000140224000-memory.dmp	xmrig
behavioral1/memory/2836-4018-0x000000013F9E0000-0x000000013FD34000-memory.dmp	xmrig
behavioral1/memory/2648-4022-0x000000013F190000-0x000000013F4E4000-memory.dmp	xmrig
behavioral1/memory/3056-4021-0x000000013F1B0000-0x000000013F504000-memory.dmp	xmrig
behavioral1/memory/2720-4020-0x000000013F680000-0x000000013F9D4000-memory.dmp	xmrig
behavioral1/memory/2732-4019-0x000000013FB00000-0x000000013FE54000-memory.dmp	xmrig
behavioral1/memory/1888-4023-0x000000013F330000-0x000000013F684000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2548	lTKfexk.exe
2376	bNvUhgt.exe
1724	vHoWJFG.exe
1260	zEGWvrp.exe
2836	PTSDexS.exe
2864	mXUrPad.exe
2720	mTFYFXU.exe
3056	bNyYWZg.exe
1888	VPEmErs.exe
2648	Mcgfuwo.exe
2732	NUbQvaJ.exe
2040	sopkIGN.exe
1488	kePCAqI.exe
2780	vSrCtXH.exe
1244	rPuhiIq.exe
2936	CxSXKoc.exe
2384	wnCkdFz.exe
836	xvIgSet.exe
2636	uemPYvM.exe
2992	hJiwwkO.exe
2684	iEFsRrV.exe
1636	WRdSSqq.exe
2584	QhKRbOx.exe
684	eDFJTIy.exe
1604	zAvwuDP.exe
1544	IyXLxaT.exe
2984	TmxOZoY.exe
3016	cVQhDQb.exe
2372	ixHAqDQ.exe
2608	cYmBcLI.exe
1356	wsOYEXx.exe
900	iUaoEog.exe
1872	uNMNhaO.exe
1884	bcWVwYd.exe
1864	pbYRNaN.exe
1016	eBeSwtR.exe
1772	jkYFihE.exe
2964	AbCRBwq.exe
2512	UVnhxoQ.exe
1540	oLqeDvq.exe
2464	HlPRbAj.exe
1256	jNpQPyD.exe
1816	oYBBgrQ.exe
3064	rqESNcG.exe
916	ZoqNxtb.exe
3052	GOmFmAb.exe
1892	TTxDUtT.exe
2068	JutUZxU.exe
2268	pYnWdhM.exe
852	sdJMaEb.exe
2292	IWkFhwF.exe
1716	LRtjLNq.exe
2560	DhdOWmn.exe
1744	mueANOQ.exe
2768	sMGlKqF.exe
2336	yledMnN.exe
2868	groaczB.exe
2900	lCUIrUb.exe
2692	UhQjzxL.exe
580	EKpVGYx.exe
2824	sxTsEUG.exe
760	eIeZxrh.exe
2860	ykLbkHR.exe
2656	xAHtzyu.exe

Loads dropped DLL 64 IoCs

pid	Process
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3048-0-0x000000013FDA0000-0x00000001400F4000-memory.dmp	upx
behavioral1/files/0x00070000000120fe-3.dat	upx
behavioral1/files/0x0008000000016dc7-7.dat	upx
behavioral1/files/0x0008000000016dd2-15.dat	upx
behavioral1/files/0x0005000000019d8b-130.dat	upx
behavioral1/files/0x000500000001a08a-170.dat	upx
behavioral1/files/0x000500000001a325-185.dat	upx
behavioral1/files/0x000500000001a2e7-180.dat	upx
behavioral1/files/0x000500000001a04e-174.dat	upx
behavioral1/files/0x000500000001961f-152.dat	upx
behavioral1/files/0x0005000000019589-150.dat	upx
behavioral1/files/0x000500000001953a-148.dat	upx
behavioral1/memory/3056-145-0x000000013F1B0000-0x000000013F504000-memory.dmp	upx
behavioral1/memory/2732-138-0x000000013FB00000-0x000000013FE54000-memory.dmp	upx
behavioral1/memory/2648-137-0x000000013F190000-0x000000013F4E4000-memory.dmp	upx
behavioral1/files/0x0005000000019f4e-134.dat	upx
behavioral1/files/0x0005000000019f4a-122.dat	upx
behavioral1/memory/1888-117-0x000000013F330000-0x000000013F684000-memory.dmp	upx
behavioral1/files/0x0005000000019cbf-114.dat	upx
behavioral1/files/0x0005000000019c50-108.dat	upx
behavioral1/files/0x0005000000019c66-105.dat	upx
behavioral1/memory/2720-98-0x000000013F680000-0x000000013F9D4000-memory.dmp	upx
behavioral1/memory/2864-97-0x000000013FED0000-0x0000000140224000-memory.dmp	upx
behavioral1/files/0x0005000000019aec-96.dat	upx
behavioral1/files/0x00050000000197c1-95.dat	upx
behavioral1/memory/2836-94-0x000000013F9E0000-0x000000013FD34000-memory.dmp	upx
behavioral1/files/0x0005000000019aee-90.dat	upx
behavioral1/files/0x0005000000019aea-81.dat	upx
behavioral1/files/0x0005000000019625-73.dat	upx
behavioral1/files/0x0007000000019234-46.dat	upx
behavioral1/files/0x00070000000175c6-45.dat	upx
behavioral1/files/0x000500000001a061-155.dat	upx
behavioral1/files/0x0005000000019c68-129.dat	upx
behavioral1/files/0x00090000000175d2-102.dat	upx
behavioral1/files/0x0007000000017546-78.dat	upx
behavioral1/memory/1260-72-0x000000013FCC0000-0x0000000140014000-memory.dmp	upx
behavioral1/files/0x0005000000019624-71.dat	upx
behavioral1/files/0x000500000001961b-70.dat	upx
behavioral1/files/0x000500000001957c-69.dat	upx
behavioral1/files/0x0008000000016ee0-52.dat	upx
behavioral1/memory/1724-29-0x000000013F1C0000-0x000000013F514000-memory.dmp	upx
behavioral1/memory/2548-42-0x000000013F230000-0x000000013F584000-memory.dmp	upx
behavioral1/files/0x00070000000170b5-31.dat	upx
behavioral1/memory/2376-20-0x000000013F2A0000-0x000000013F5F4000-memory.dmp	upx
behavioral1/memory/3048-1687-0x000000013FDA0000-0x00000001400F4000-memory.dmp	upx
behavioral1/memory/2548-4013-0x000000013F230000-0x000000013F584000-memory.dmp	upx
behavioral1/memory/1724-4014-0x000000013F1C0000-0x000000013F514000-memory.dmp	upx
behavioral1/memory/2376-4015-0x000000013F2A0000-0x000000013F5F4000-memory.dmp	upx
behavioral1/memory/1260-4016-0x000000013FCC0000-0x0000000140014000-memory.dmp	upx
behavioral1/memory/2864-4017-0x000000013FED0000-0x0000000140224000-memory.dmp	upx
behavioral1/memory/2836-4018-0x000000013F9E0000-0x000000013FD34000-memory.dmp	upx
behavioral1/memory/2648-4022-0x000000013F190000-0x000000013F4E4000-memory.dmp	upx
behavioral1/memory/3056-4021-0x000000013F1B0000-0x000000013F504000-memory.dmp	upx
behavioral1/memory/2720-4020-0x000000013F680000-0x000000013F9D4000-memory.dmp	upx
behavioral1/memory/2732-4019-0x000000013FB00000-0x000000013FE54000-memory.dmp	upx
behavioral1/memory/1888-4023-0x000000013F330000-0x000000013F684000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CPrmPyj.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\RkUEhXr.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\AtnwgYk.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\doZSOXk.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\nDlGLDZ.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\zmbluMD.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\lYIsojD.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\UIQtwHF.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\UeXmzar.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\peOpguk.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\YqMPbNt.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\byuWhvJ.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\ySIjbUG.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\kZErYZR.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\FWMrBlQ.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\qAntgjF.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\rMGfffK.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\cwAcrOj.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\amvknKm.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\DqexyGo.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\lUdNmNW.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\fNjPZLt.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\FGIINqZ.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\WWiKIzp.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\DuNVqAI.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\pkkOJBp.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\MiBxUZz.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\tHbPlEq.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\RXasGvy.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\qfocPVY.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\nFMmJMw.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\uMUjlRG.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\wnFXxNj.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\OFUzcok.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\uXDZwYT.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\BQqRUjv.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\bceDsjv.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\dVkeMnM.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\TTxDUtT.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\zPVMhZq.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\FaQlwNV.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\IUWwOiN.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\lhZtXdp.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\rsMDGcE.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\zAvwuDP.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\xAHtzyu.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\vFKEEJb.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\IrFTxmi.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\pyHiJBV.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\xEwEabQ.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\IyXLxaT.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\dOTqNfe.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\TPoUpEg.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\gRmXOZb.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\QmogeZp.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\MOogYSg.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\FExcFpT.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\wfPLfHE.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\QBccULk.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\BxDrbbo.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\kQhoMJI.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\pGCjJyq.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\WsHJmCy.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
File created	C:\Windows\System\SddCJfG.exe	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2548	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	31
PID 3048 wrote to memory of 2548	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	31
PID 3048 wrote to memory of 2548	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	31
PID 3048 wrote to memory of 2376	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	32
PID 3048 wrote to memory of 2376	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	32
PID 3048 wrote to memory of 2376	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	32
PID 3048 wrote to memory of 1724	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	33
PID 3048 wrote to memory of 1724	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	33
PID 3048 wrote to memory of 1724	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	33
PID 3048 wrote to memory of 2720	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	34
PID 3048 wrote to memory of 2720	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	34
PID 3048 wrote to memory of 2720	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	34
PID 3048 wrote to memory of 1260	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	35
PID 3048 wrote to memory of 1260	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	35
PID 3048 wrote to memory of 1260	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	35
PID 3048 wrote to memory of 2732	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	36
PID 3048 wrote to memory of 2732	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	36
PID 3048 wrote to memory of 2732	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	36
PID 3048 wrote to memory of 2836	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	37
PID 3048 wrote to memory of 2836	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	37
PID 3048 wrote to memory of 2836	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	37
PID 3048 wrote to memory of 2780	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	38
PID 3048 wrote to memory of 2780	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	38
PID 3048 wrote to memory of 2780	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	38
PID 3048 wrote to memory of 2864	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	39
PID 3048 wrote to memory of 2864	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	39
PID 3048 wrote to memory of 2864	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	39
PID 3048 wrote to memory of 2636	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	40
PID 3048 wrote to memory of 2636	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	40
PID 3048 wrote to memory of 2636	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	40
PID 3048 wrote to memory of 3056	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	41
PID 3048 wrote to memory of 3056	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	41
PID 3048 wrote to memory of 3056	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	41
PID 3048 wrote to memory of 2992	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	42
PID 3048 wrote to memory of 2992	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	42
PID 3048 wrote to memory of 2992	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	42
PID 3048 wrote to memory of 1888	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	43
PID 3048 wrote to memory of 1888	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	43
PID 3048 wrote to memory of 1888	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	43
PID 3048 wrote to memory of 2684	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	44
PID 3048 wrote to memory of 2684	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	44
PID 3048 wrote to memory of 2684	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	44
PID 3048 wrote to memory of 2648	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	45
PID 3048 wrote to memory of 2648	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	45
PID 3048 wrote to memory of 2648	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	45
PID 3048 wrote to memory of 2584	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	46
PID 3048 wrote to memory of 2584	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	46
PID 3048 wrote to memory of 2584	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	46
PID 3048 wrote to memory of 2040	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	47
PID 3048 wrote to memory of 2040	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	47
PID 3048 wrote to memory of 2040	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	47
PID 3048 wrote to memory of 684	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	48
PID 3048 wrote to memory of 684	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	48
PID 3048 wrote to memory of 684	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	48
PID 3048 wrote to memory of 1488	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	49
PID 3048 wrote to memory of 1488	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	49
PID 3048 wrote to memory of 1488	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	49
PID 3048 wrote to memory of 1604	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	50
PID 3048 wrote to memory of 1604	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	50
PID 3048 wrote to memory of 1604	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	50
PID 3048 wrote to memory of 1244	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	51
PID 3048 wrote to memory of 1244	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	51
PID 3048 wrote to memory of 1244	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	51
PID 3048 wrote to memory of 1544	3048	JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe	52

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d6e3206ec1ae1ae51faaa16cf12236e829ba77c48437979d6eedfd291638ce96.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\System\lTKfexk.exe
  C:\Windows\System\lTKfexk.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\bNvUhgt.exe
  C:\Windows\System\bNvUhgt.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\vHoWJFG.exe
  C:\Windows\System\vHoWJFG.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\mTFYFXU.exe
  C:\Windows\System\mTFYFXU.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\zEGWvrp.exe
  C:\Windows\System\zEGWvrp.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\NUbQvaJ.exe
  C:\Windows\System\NUbQvaJ.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\PTSDexS.exe
  C:\Windows\System\PTSDexS.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\vSrCtXH.exe
  C:\Windows\System\vSrCtXH.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\mXUrPad.exe
  C:\Windows\System\mXUrPad.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\uemPYvM.exe
  C:\Windows\System\uemPYvM.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\bNyYWZg.exe
  C:\Windows\System\bNyYWZg.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\hJiwwkO.exe
  C:\Windows\System\hJiwwkO.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\VPEmErs.exe
  C:\Windows\System\VPEmErs.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\iEFsRrV.exe
  C:\Windows\System\iEFsRrV.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\Mcgfuwo.exe
  C:\Windows\System\Mcgfuwo.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\QhKRbOx.exe
  C:\Windows\System\QhKRbOx.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\sopkIGN.exe
  C:\Windows\System\sopkIGN.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\eDFJTIy.exe
  C:\Windows\System\eDFJTIy.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\kePCAqI.exe
  C:\Windows\System\kePCAqI.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\zAvwuDP.exe
  C:\Windows\System\zAvwuDP.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\rPuhiIq.exe
  C:\Windows\System\rPuhiIq.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\IyXLxaT.exe
  C:\Windows\System\IyXLxaT.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\CxSXKoc.exe
  C:\Windows\System\CxSXKoc.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\TmxOZoY.exe
  C:\Windows\System\TmxOZoY.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\wnCkdFz.exe
  C:\Windows\System\wnCkdFz.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\cVQhDQb.exe
  C:\Windows\System\cVQhDQb.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\xvIgSet.exe
  C:\Windows\System\xvIgSet.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\ixHAqDQ.exe
  C:\Windows\System\ixHAqDQ.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\WRdSSqq.exe
  C:\Windows\System\WRdSSqq.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\cYmBcLI.exe
  C:\Windows\System\cYmBcLI.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\wsOYEXx.exe
  C:\Windows\System\wsOYEXx.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\iUaoEog.exe
  C:\Windows\System\iUaoEog.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\uNMNhaO.exe
  C:\Windows\System\uNMNhaO.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\bcWVwYd.exe
  C:\Windows\System\bcWVwYd.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\pbYRNaN.exe
  C:\Windows\System\pbYRNaN.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\eBeSwtR.exe
  C:\Windows\System\eBeSwtR.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\jkYFihE.exe
  C:\Windows\System\jkYFihE.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\AbCRBwq.exe
  C:\Windows\System\AbCRBwq.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\UVnhxoQ.exe
  C:\Windows\System\UVnhxoQ.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\oLqeDvq.exe
  C:\Windows\System\oLqeDvq.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\HlPRbAj.exe
  C:\Windows\System\HlPRbAj.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\jNpQPyD.exe
  C:\Windows\System\jNpQPyD.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\oYBBgrQ.exe
  C:\Windows\System\oYBBgrQ.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\rqESNcG.exe
  C:\Windows\System\rqESNcG.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\ZoqNxtb.exe
  C:\Windows\System\ZoqNxtb.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\GOmFmAb.exe
  C:\Windows\System\GOmFmAb.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\TTxDUtT.exe
  C:\Windows\System\TTxDUtT.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\JutUZxU.exe
  C:\Windows\System\JutUZxU.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\pYnWdhM.exe
  C:\Windows\System\pYnWdhM.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\sdJMaEb.exe
  C:\Windows\System\sdJMaEb.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\IWkFhwF.exe
  C:\Windows\System\IWkFhwF.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\LRtjLNq.exe
  C:\Windows\System\LRtjLNq.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\DhdOWmn.exe
  C:\Windows\System\DhdOWmn.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\mueANOQ.exe
  C:\Windows\System\mueANOQ.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\sMGlKqF.exe
  C:\Windows\System\sMGlKqF.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\lCUIrUb.exe
  C:\Windows\System\lCUIrUb.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\yledMnN.exe
  C:\Windows\System\yledMnN.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\UhQjzxL.exe
  C:\Windows\System\UhQjzxL.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\groaczB.exe
  C:\Windows\System\groaczB.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\EKpVGYx.exe
  C:\Windows\System\EKpVGYx.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\sxTsEUG.exe
  C:\Windows\System\sxTsEUG.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\eIeZxrh.exe
  C:\Windows\System\eIeZxrh.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\ykLbkHR.exe
  C:\Windows\System\ykLbkHR.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\xAHtzyu.exe
  C:\Windows\System\xAHtzyu.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\HnLYRJG.exe
  C:\Windows\System\HnLYRJG.exe
  2⤵
  PID:2640
- C:\Windows\System\MhLHLxz.exe
  C:\Windows\System\MhLHLxz.exe
  2⤵
  PID:1524
- C:\Windows\System\vVNHJoL.exe
  C:\Windows\System\vVNHJoL.exe
  2⤵
  PID:1140
- C:\Windows\System\qfocPVY.exe
  C:\Windows\System\qfocPVY.exe
  2⤵
  PID:1316
- C:\Windows\System\gcrNkPQ.exe
  C:\Windows\System\gcrNkPQ.exe
  2⤵
  PID:3032
- C:\Windows\System\HqmLMnV.exe
  C:\Windows\System\HqmLMnV.exe
  2⤵
  PID:2496
- C:\Windows\System\PVVmEov.exe
  C:\Windows\System\PVVmEov.exe
  2⤵
  PID:1916
- C:\Windows\System\ScwmctE.exe
  C:\Windows\System\ScwmctE.exe
  2⤵
  PID:1644
- C:\Windows\System\SjFoBcw.exe
  C:\Windows\System\SjFoBcw.exe
  2⤵
  PID:1868
- C:\Windows\System\qXfhYja.exe
  C:\Windows\System\qXfhYja.exe
  2⤵
  PID:776
- C:\Windows\System\sIlMOyM.exe
  C:\Windows\System\sIlMOyM.exe
  2⤵
  PID:1780
- C:\Windows\System\gByXPuX.exe
  C:\Windows\System\gByXPuX.exe
  2⤵
  PID:2524
- C:\Windows\System\iztnXwo.exe
  C:\Windows\System\iztnXwo.exe
  2⤵
  PID:1704
- C:\Windows\System\gNjmFEc.exe
  C:\Windows\System\gNjmFEc.exe
  2⤵
  PID:2204
- C:\Windows\System\cktMdDv.exe
  C:\Windows\System\cktMdDv.exe
  2⤵
  PID:1756
- C:\Windows\System\aizZwpK.exe
  C:\Windows\System\aizZwpK.exe
  2⤵
  PID:2368
- C:\Windows\System\sJJWxlG.exe
  C:\Windows\System\sJJWxlG.exe
  2⤵
  PID:2576
- C:\Windows\System\FWoDvjI.exe
  C:\Windows\System\FWoDvjI.exe
  2⤵
  PID:3044
- C:\Windows\System\HVhUJxy.exe
  C:\Windows\System\HVhUJxy.exe
  2⤵
  PID:1692
- C:\Windows\System\aiWjTWY.exe
  C:\Windows\System\aiWjTWY.exe
  2⤵
  PID:2256
- C:\Windows\System\xZYWZZX.exe
  C:\Windows\System\xZYWZZX.exe
  2⤵
  PID:2020
- C:\Windows\System\fEZvoyu.exe
  C:\Windows\System\fEZvoyu.exe
  2⤵
  PID:2288
- C:\Windows\System\YtIfbQt.exe
  C:\Windows\System\YtIfbQt.exe
  2⤵
  PID:3012
- C:\Windows\System\TwWluwR.exe
  C:\Windows\System\TwWluwR.exe
  2⤵
  PID:2056
- C:\Windows\System\CpGsuiJ.exe
  C:\Windows\System\CpGsuiJ.exe
  2⤵
  PID:2284
- C:\Windows\System\QrBjeWS.exe
  C:\Windows\System\QrBjeWS.exe
  2⤵
  PID:2156
- C:\Windows\System\hiroNKt.exe
  C:\Windows\System\hiroNKt.exe
  2⤵
  PID:1960
- C:\Windows\System\HSSKoZR.exe
  C:\Windows\System\HSSKoZR.exe
  2⤵
  PID:1684
- C:\Windows\System\ldhqAUp.exe
  C:\Windows\System\ldhqAUp.exe
  2⤵
  PID:992
- C:\Windows\System\UvblyEP.exe
  C:\Windows\System\UvblyEP.exe
  2⤵
  PID:672
- C:\Windows\System\pxGKptf.exe
  C:\Windows\System\pxGKptf.exe
  2⤵
  PID:2132
- C:\Windows\System\AMtbOXI.exe
  C:\Windows\System\AMtbOXI.exe
  2⤵
  PID:304
- C:\Windows\System\ZJMWBak.exe
  C:\Windows\System\ZJMWBak.exe
  2⤵
  PID:1360
- C:\Windows\System\RlWwkuU.exe
  C:\Windows\System\RlWwkuU.exe
  2⤵
  PID:3092
- C:\Windows\System\StVeDqc.exe
  C:\Windows\System\StVeDqc.exe
  2⤵
  PID:3112
- C:\Windows\System\KYHSHrg.exe
  C:\Windows\System\KYHSHrg.exe
  2⤵
  PID:3132
- C:\Windows\System\YimKPYF.exe
  C:\Windows\System\YimKPYF.exe
  2⤵
  PID:3156
- C:\Windows\System\WEHYrUy.exe
  C:\Windows\System\WEHYrUy.exe
  2⤵
  PID:3172
- C:\Windows\System\DIfuGCK.exe
  C:\Windows\System\DIfuGCK.exe
  2⤵
  PID:3192
- C:\Windows\System\kmnOpCc.exe
  C:\Windows\System\kmnOpCc.exe
  2⤵
  PID:3216
- C:\Windows\System\COZIRrr.exe
  C:\Windows\System\COZIRrr.exe
  2⤵
  PID:3248
- C:\Windows\System\PhwxbtE.exe
  C:\Windows\System\PhwxbtE.exe
  2⤵
  PID:3268
- C:\Windows\System\YFezQni.exe
  C:\Windows\System\YFezQni.exe
  2⤵
  PID:3284
- C:\Windows\System\YqMPbNt.exe
  C:\Windows\System\YqMPbNt.exe
  2⤵
  PID:3300
- C:\Windows\System\YpTDnXL.exe
  C:\Windows\System\YpTDnXL.exe
  2⤵
  PID:3320
- C:\Windows\System\HNlEdDH.exe
  C:\Windows\System\HNlEdDH.exe
  2⤵
  PID:3336
- C:\Windows\System\gjpEhEm.exe
  C:\Windows\System\gjpEhEm.exe
  2⤵
  PID:3356
- C:\Windows\System\eqLutOg.exe
  C:\Windows\System\eqLutOg.exe
  2⤵
  PID:3376
- C:\Windows\System\tQqYnww.exe
  C:\Windows\System\tQqYnww.exe
  2⤵
  PID:3416
- C:\Windows\System\UgcikIZ.exe
  C:\Windows\System\UgcikIZ.exe
  2⤵
  PID:3440
- C:\Windows\System\lAyEcMB.exe
  C:\Windows\System\lAyEcMB.exe
  2⤵
  PID:3456
- C:\Windows\System\fWGhaAe.exe
  C:\Windows\System\fWGhaAe.exe
  2⤵
  PID:3476
- C:\Windows\System\FpSGhmb.exe
  C:\Windows\System\FpSGhmb.exe
  2⤵
  PID:3496
- C:\Windows\System\hAKLhhb.exe
  C:\Windows\System\hAKLhhb.exe
  2⤵
  PID:3512
- C:\Windows\System\ClJPNoT.exe
  C:\Windows\System\ClJPNoT.exe
  2⤵
  PID:3528
- C:\Windows\System\zkAvDBl.exe
  C:\Windows\System\zkAvDBl.exe
  2⤵
  PID:3556
- C:\Windows\System\qAntgjF.exe
  C:\Windows\System\qAntgjF.exe
  2⤵
  PID:3576
- C:\Windows\System\bBqgyLJ.exe
  C:\Windows\System\bBqgyLJ.exe
  2⤵
  PID:3600
- C:\Windows\System\zMVVYGo.exe
  C:\Windows\System\zMVVYGo.exe
  2⤵
  PID:3616
- C:\Windows\System\fXCATBs.exe
  C:\Windows\System\fXCATBs.exe
  2⤵
  PID:3636
- C:\Windows\System\ElLcgPB.exe
  C:\Windows\System\ElLcgPB.exe
  2⤵
  PID:3652
- C:\Windows\System\dIYzDia.exe
  C:\Windows\System\dIYzDia.exe
  2⤵
  PID:3672
- C:\Windows\System\AwiUOhb.exe
  C:\Windows\System\AwiUOhb.exe
  2⤵
  PID:3692
- C:\Windows\System\nFMmJMw.exe
  C:\Windows\System\nFMmJMw.exe
  2⤵
  PID:3712
- C:\Windows\System\mSCgyBb.exe
  C:\Windows\System\mSCgyBb.exe
  2⤵
  PID:3736
- C:\Windows\System\QqvCuwj.exe
  C:\Windows\System\QqvCuwj.exe
  2⤵
  PID:3752
- C:\Windows\System\JTSgbpe.exe
  C:\Windows\System\JTSgbpe.exe
  2⤵
  PID:3768
- C:\Windows\System\aQQTTHP.exe
  C:\Windows\System\aQQTTHP.exe
  2⤵
  PID:3784
- C:\Windows\System\cVTNDZM.exe
  C:\Windows\System\cVTNDZM.exe
  2⤵
  PID:3808
- C:\Windows\System\piaonQZ.exe
  C:\Windows\System\piaonQZ.exe
  2⤵
  PID:3824
- C:\Windows\System\ZmKkUAz.exe
  C:\Windows\System\ZmKkUAz.exe
  2⤵
  PID:3856
- C:\Windows\System\wXlKQKQ.exe
  C:\Windows\System\wXlKQKQ.exe
  2⤵
  PID:3876
- C:\Windows\System\rqnsONt.exe
  C:\Windows\System\rqnsONt.exe
  2⤵
  PID:3896
- C:\Windows\System\GRjAdkW.exe
  C:\Windows\System\GRjAdkW.exe
  2⤵
  PID:3916
- C:\Windows\System\fHkQKBt.exe
  C:\Windows\System\fHkQKBt.exe
  2⤵
  PID:3936
- C:\Windows\System\cqPKgVE.exe
  C:\Windows\System\cqPKgVE.exe
  2⤵
  PID:3956
- C:\Windows\System\eAaZofp.exe
  C:\Windows\System\eAaZofp.exe
  2⤵
  PID:3976
- C:\Windows\System\KIaTvlK.exe
  C:\Windows\System\KIaTvlK.exe
  2⤵
  PID:4000
- C:\Windows\System\xjINzBV.exe
  C:\Windows\System\xjINzBV.exe
  2⤵
  PID:4020
- C:\Windows\System\bMfftVJ.exe
  C:\Windows\System\bMfftVJ.exe
  2⤵
  PID:4040
- C:\Windows\System\osCHEYX.exe
  C:\Windows\System\osCHEYX.exe
  2⤵
  PID:4056
- C:\Windows\System\OunOQEr.exe
  C:\Windows\System\OunOQEr.exe
  2⤵
  PID:4072
- C:\Windows\System\NUjvKdj.exe
  C:\Windows\System\NUjvKdj.exe
  2⤵
  PID:908
- C:\Windows\System\qfydUVM.exe
  C:\Windows\System\qfydUVM.exe
  2⤵
  PID:1640
- C:\Windows\System\uQmNkQC.exe
  C:\Windows\System\uQmNkQC.exe
  2⤵
  PID:2516
- C:\Windows\System\iRwSNlo.exe
  C:\Windows\System\iRwSNlo.exe
  2⤵
  PID:1876
- C:\Windows\System\ErtDiDV.exe
  C:\Windows\System\ErtDiDV.exe
  2⤵
  PID:1808
- C:\Windows\System\rOFMwDP.exe
  C:\Windows\System\rOFMwDP.exe
  2⤵
  PID:2092
- C:\Windows\System\ZBMeOMf.exe
  C:\Windows\System\ZBMeOMf.exe
  2⤵
  PID:2756
- C:\Windows\System\eJlKije.exe
  C:\Windows\System\eJlKije.exe
  2⤵
  PID:1616
- C:\Windows\System\itFNMDW.exe
  C:\Windows\System\itFNMDW.exe
  2⤵
  PID:896
- C:\Windows\System\oZLKgkq.exe
  C:\Windows\System\oZLKgkq.exe
  2⤵
  PID:2520
- C:\Windows\System\mcBzDZa.exe
  C:\Windows\System\mcBzDZa.exe
  2⤵
  PID:1072
- C:\Windows\System\hAqoXxJ.exe
  C:\Windows\System\hAqoXxJ.exe
  2⤵
  PID:1384
- C:\Windows\System\fMPrIXg.exe
  C:\Windows\System\fMPrIXg.exe
  2⤵
  PID:2008
- C:\Windows\System\xQQjMMm.exe
  C:\Windows\System\xQQjMMm.exe
  2⤵
  PID:572
- C:\Windows\System\gSdOwWp.exe
  C:\Windows\System\gSdOwWp.exe
  2⤵
  PID:2996
- C:\Windows\System\CNaYhng.exe
  C:\Windows\System\CNaYhng.exe
  2⤵
  PID:1368
- C:\Windows\System\xbJtjAs.exe
  C:\Windows\System\xbJtjAs.exe
  2⤵
  PID:3212
- C:\Windows\System\XtiQEhn.exe
  C:\Windows\System\XtiQEhn.exe
  2⤵
  PID:3184
- C:\Windows\System\DRAFOpo.exe
  C:\Windows\System\DRAFOpo.exe
  2⤵
  PID:3100
- C:\Windows\System\ZYnRcZx.exe
  C:\Windows\System\ZYnRcZx.exe
  2⤵
  PID:3296
- C:\Windows\System\GqZVeLE.exe
  C:\Windows\System\GqZVeLE.exe
  2⤵
  PID:3368
- C:\Windows\System\TxczKQg.exe
  C:\Windows\System\TxczKQg.exe
  2⤵
  PID:3312
- C:\Windows\System\ZKYiRPH.exe
  C:\Windows\System\ZKYiRPH.exe
  2⤵
  PID:3276
- C:\Windows\System\SkuSEGE.exe
  C:\Windows\System\SkuSEGE.exe
  2⤵
  PID:3408
- C:\Windows\System\OBPfwae.exe
  C:\Windows\System\OBPfwae.exe
  2⤵
  PID:3464
- C:\Windows\System\KkPrcKY.exe
  C:\Windows\System\KkPrcKY.exe
  2⤵
  PID:3508
- C:\Windows\System\FxHRWEV.exe
  C:\Windows\System\FxHRWEV.exe
  2⤵
  PID:3452
- C:\Windows\System\ollfbuM.exe
  C:\Windows\System\ollfbuM.exe
  2⤵
  PID:3540
- C:\Windows\System\BNTXADo.exe
  C:\Windows\System\BNTXADo.exe
  2⤵
  PID:3584
- C:\Windows\System\KROnCqW.exe
  C:\Windows\System\KROnCqW.exe
  2⤵
  PID:3572
- C:\Windows\System\aqCpPoJ.exe
  C:\Windows\System\aqCpPoJ.exe
  2⤵
  PID:3660
- C:\Windows\System\jgfNHWx.exe
  C:\Windows\System\jgfNHWx.exe
  2⤵
  PID:3704
- C:\Windows\System\kLIPTFS.exe
  C:\Windows\System\kLIPTFS.exe
  2⤵
  PID:3748
- C:\Windows\System\jhCGMPq.exe
  C:\Windows\System\jhCGMPq.exe
  2⤵
  PID:3680
- C:\Windows\System\dSdvpTg.exe
  C:\Windows\System\dSdvpTg.exe
  2⤵
  PID:3728
- C:\Windows\System\ZEMqoRl.exe
  C:\Windows\System\ZEMqoRl.exe
  2⤵
  PID:3792
- C:\Windows\System\bVGoQdh.exe
  C:\Windows\System\bVGoQdh.exe
  2⤵
  PID:3832
- C:\Windows\System\neIUHAU.exe
  C:\Windows\System\neIUHAU.exe
  2⤵
  PID:2572
- C:\Windows\System\XdCJjSp.exe
  C:\Windows\System\XdCJjSp.exe
  2⤵
  PID:3912
- C:\Windows\System\MZwdaqR.exe
  C:\Windows\System\MZwdaqR.exe
  2⤵
  PID:3892
- C:\Windows\System\MVFIDLE.exe
  C:\Windows\System\MVFIDLE.exe
  2⤵
  PID:3924
- C:\Windows\System\bPAaDSj.exe
  C:\Windows\System\bPAaDSj.exe
  2⤵
  PID:3972
- C:\Windows\System\rIKqpRv.exe
  C:\Windows\System\rIKqpRv.exe
  2⤵
  PID:4016
- C:\Windows\System\AqQLPFa.exe
  C:\Windows\System\AqQLPFa.exe
  2⤵
  PID:4064
- C:\Windows\System\SzqVHvs.exe
  C:\Windows\System\SzqVHvs.exe
  2⤵
  PID:2324
- C:\Windows\System\ortkfEZ.exe
  C:\Windows\System\ortkfEZ.exe
  2⤵
  PID:4052
- C:\Windows\System\OjyMmZp.exe
  C:\Windows\System\OjyMmZp.exe
  2⤵
  PID:1848
- C:\Windows\System\SKnHBSM.exe
  C:\Windows\System\SKnHBSM.exe
  2⤵
  PID:1404
- C:\Windows\System\GxnTIYT.exe
  C:\Windows\System\GxnTIYT.exe
  2⤵
  PID:2348
- C:\Windows\System\YIyhmlK.exe
  C:\Windows\System\YIyhmlK.exe
  2⤵
  PID:272
- C:\Windows\System\qmiqtpC.exe
  C:\Windows\System\qmiqtpC.exe
  2⤵
  PID:2680
- C:\Windows\System\ohwCxEo.exe
  C:\Windows\System\ohwCxEo.exe
  2⤵
  PID:2960
- C:\Windows\System\zYMBvbH.exe
  C:\Windows\System\zYMBvbH.exe
  2⤵
  PID:1520
- C:\Windows\System\AiOsMBc.exe
  C:\Windows\System\AiOsMBc.exe
  2⤵
  PID:3124
- C:\Windows\System\orMEqfb.exe
  C:\Windows\System\orMEqfb.exe
  2⤵
  PID:3256
- C:\Windows\System\vXDUmUs.exe
  C:\Windows\System\vXDUmUs.exe
  2⤵
  PID:3260
- C:\Windows\System\dtSKbmo.exe
  C:\Windows\System\dtSKbmo.exe
  2⤵
  PID:2816
- C:\Windows\System\AtnwgYk.exe
  C:\Windows\System\AtnwgYk.exe
  2⤵
  PID:3316
- C:\Windows\System\VBCQZQL.exe
  C:\Windows\System\VBCQZQL.exe
  2⤵
  PID:3204
- C:\Windows\System\umPHYOQ.exe
  C:\Windows\System\umPHYOQ.exe
  2⤵
  PID:3504
- C:\Windows\System\CEYEUED.exe
  C:\Windows\System\CEYEUED.exe
  2⤵
  PID:3564
- C:\Windows\System\muYSyUy.exe
  C:\Windows\System\muYSyUy.exe
  2⤵
  PID:3816
- C:\Windows\System\FtZwCYD.exe
  C:\Windows\System\FtZwCYD.exe
  2⤵
  PID:3840
- C:\Windows\System\umqCSHc.exe
  C:\Windows\System\umqCSHc.exe
  2⤵
  PID:2532
- C:\Windows\System\JbIQUIl.exe
  C:\Windows\System\JbIQUIl.exe
  2⤵
  PID:3352
- C:\Windows\System\qloFCIk.exe
  C:\Windows\System\qloFCIk.exe
  2⤵
  PID:3432
- C:\Windows\System\prYYkUe.exe
  C:\Windows\System\prYYkUe.exe
  2⤵
  PID:3488
- C:\Windows\System\uMUjlRG.exe
  C:\Windows\System\uMUjlRG.exe
  2⤵
  PID:3552
- C:\Windows\System\gjXifDc.exe
  C:\Windows\System\gjXifDc.exe
  2⤵
  PID:3568
- C:\Windows\System\doZSOXk.exe
  C:\Windows\System\doZSOXk.exe
  2⤵
  PID:3724
- C:\Windows\System\pEErUuU.exe
  C:\Windows\System\pEErUuU.exe
  2⤵
  PID:3800
- C:\Windows\System\GrMOeFo.exe
  C:\Windows\System\GrMOeFo.exe
  2⤵
  PID:3632
- C:\Windows\System\PPgvFPi.exe
  C:\Windows\System\PPgvFPi.exe
  2⤵
  PID:336
- C:\Windows\System\WOiOTnS.exe
  C:\Windows\System\WOiOTnS.exe
  2⤵
  PID:3868
- C:\Windows\System\aEYCqgI.exe
  C:\Windows\System\aEYCqgI.exe
  2⤵
  PID:3988
- C:\Windows\System\SbXuWuE.exe
  C:\Windows\System\SbXuWuE.exe
  2⤵
  PID:1680
- C:\Windows\System\plyTqJR.exe
  C:\Windows\System\plyTqJR.exe
  2⤵
  PID:4088
- C:\Windows\System\VPaYrwN.exe
  C:\Windows\System\VPaYrwN.exe
  2⤵
  PID:1800
- C:\Windows\System\FCsBFvS.exe
  C:\Windows\System\FCsBFvS.exe
  2⤵
  PID:2400
- C:\Windows\System\KempfdG.exe
  C:\Windows\System\KempfdG.exe
  2⤵
  PID:1652
- C:\Windows\System\EZOgDNd.exe
  C:\Windows\System\EZOgDNd.exe
  2⤵
  PID:1516
- C:\Windows\System\Ucbetwa.exe
  C:\Windows\System\Ucbetwa.exe
  2⤵
  PID:3624
- C:\Windows\System\NsOxVcl.exe
  C:\Windows\System\NsOxVcl.exe
  2⤵
  PID:2872
- C:\Windows\System\EBUSomY.exe
  C:\Windows\System\EBUSomY.exe
  2⤵
  PID:3364
- C:\Windows\System\SeowExm.exe
  C:\Windows\System\SeowExm.exe
  2⤵
  PID:3520
- C:\Windows\System\gAoFpUB.exe
  C:\Windows\System\gAoFpUB.exe
  2⤵
  PID:3744
- C:\Windows\System\AwlHEHa.exe
  C:\Windows\System\AwlHEHa.exe
  2⤵
  PID:2700
- C:\Windows\System\HUXpKtg.exe
  C:\Windows\System\HUXpKtg.exe
  2⤵
  PID:4008
- C:\Windows\System\HOrzmKv.exe
  C:\Windows\System\HOrzmKv.exe
  2⤵
  PID:1968
- C:\Windows\System\UdvnIbG.exe
  C:\Windows\System\UdvnIbG.exe
  2⤵
  PID:3144
- C:\Windows\System\hyUtxOY.exe
  C:\Windows\System\hyUtxOY.exe
  2⤵
  PID:3120
- C:\Windows\System\pDPtzlg.exe
  C:\Windows\System\pDPtzlg.exe
  2⤵
  PID:2976
- C:\Windows\System\OUeeCiO.exe
  C:\Windows\System\OUeeCiO.exe
  2⤵
  PID:3224
- C:\Windows\System\wpgocYJ.exe
  C:\Windows\System\wpgocYJ.exe
  2⤵
  PID:2196
- C:\Windows\System\PGDduTV.exe
  C:\Windows\System\PGDduTV.exe
  2⤵
  PID:2852
- C:\Windows\System\UUxunyr.exe
  C:\Windows\System\UUxunyr.exe
  2⤵
  PID:2624
- C:\Windows\System\SPRUvRp.exe
  C:\Windows\System\SPRUvRp.exe
  2⤵
  PID:3820
- C:\Windows\System\cfLfICS.exe
  C:\Windows\System\cfLfICS.exe
  2⤵
  PID:3628
- C:\Windows\System\fPFpRjT.exe
  C:\Windows\System\fPFpRjT.exe
  2⤵
  PID:3612
- C:\Windows\System\aCUzFFb.exe
  C:\Windows\System\aCUzFFb.exe
  2⤵
  PID:2796
- C:\Windows\System\euFplDr.exe
  C:\Windows\System\euFplDr.exe
  2⤵
  PID:3852
- C:\Windows\System\yUHdXWh.exe
  C:\Windows\System\yUHdXWh.exe
  2⤵
  PID:3720
- C:\Windows\System\xguEdWQ.exe
  C:\Windows\System\xguEdWQ.exe
  2⤵
  PID:4032
- C:\Windows\System\AleojMi.exe
  C:\Windows\System\AleojMi.exe
  2⤵
  PID:3280
- C:\Windows\System\gxJRgda.exe
  C:\Windows\System\gxJRgda.exe
  2⤵
  PID:2080
- C:\Windows\System\fNjPZLt.exe
  C:\Windows\System\fNjPZLt.exe
  2⤵
  PID:2748
- C:\Windows\System\dUGRDpi.exe
  C:\Windows\System\dUGRDpi.exe
  2⤵
  PID:3844
- C:\Windows\System\YixLCoa.exe
  C:\Windows\System\YixLCoa.exe
  2⤵
  PID:1928
- C:\Windows\System\JbXEjBI.exe
  C:\Windows\System\JbXEjBI.exe
  2⤵
  PID:4092
- C:\Windows\System\fxpIWjX.exe
  C:\Windows\System\fxpIWjX.exe
  2⤵
  PID:444
- C:\Windows\System\zpIeRiN.exe
  C:\Windows\System\zpIeRiN.exe
  2⤵
  PID:3848
- C:\Windows\System\jnOFRBD.exe
  C:\Windows\System\jnOFRBD.exe
  2⤵
  PID:3592
- C:\Windows\System\avjfzii.exe
  C:\Windows\System\avjfzii.exe
  2⤵
  PID:3332
- C:\Windows\System\NypfsMc.exe
  C:\Windows\System\NypfsMc.exe
  2⤵
  PID:952
- C:\Windows\System\fXishHh.exe
  C:\Windows\System\fXishHh.exe
  2⤵
  PID:3644
- C:\Windows\System\ExQOCNi.exe
  C:\Windows\System\ExQOCNi.exe
  2⤵
  PID:3328
- C:\Windows\System\VtEmNju.exe
  C:\Windows\System\VtEmNju.exe
  2⤵
  PID:3888
- C:\Windows\System\vRSXZeD.exe
  C:\Windows\System\vRSXZeD.exe
  2⤵
  PID:4104
- C:\Windows\System\OquDIVI.exe
  C:\Windows\System\OquDIVI.exe
  2⤵
  PID:4120
- C:\Windows\System\UlCBIOA.exe
  C:\Windows\System\UlCBIOA.exe
  2⤵
  PID:4136
- C:\Windows\System\KcwtdBM.exe
  C:\Windows\System\KcwtdBM.exe
  2⤵
  PID:4152
- C:\Windows\System\wfgdPXF.exe
  C:\Windows\System\wfgdPXF.exe
  2⤵
  PID:4168
- C:\Windows\System\ydeMXcs.exe
  C:\Windows\System\ydeMXcs.exe
  2⤵
  PID:4184
- C:\Windows\System\eGWvzzG.exe
  C:\Windows\System\eGWvzzG.exe
  2⤵
  PID:4200
- C:\Windows\System\oKaSXrI.exe
  C:\Windows\System\oKaSXrI.exe
  2⤵
  PID:4216
- C:\Windows\System\wITRkRE.exe
  C:\Windows\System\wITRkRE.exe
  2⤵
  PID:4232
- C:\Windows\System\PFhrmvv.exe
  C:\Windows\System\PFhrmvv.exe
  2⤵
  PID:4248
- C:\Windows\System\NBkbEMu.exe
  C:\Windows\System\NBkbEMu.exe
  2⤵
  PID:4264
- C:\Windows\System\xiZpSZR.exe
  C:\Windows\System\xiZpSZR.exe
  2⤵
  PID:4280
- C:\Windows\System\nmkWcwP.exe
  C:\Windows\System\nmkWcwP.exe
  2⤵
  PID:4296
- C:\Windows\System\TyJNADc.exe
  C:\Windows\System\TyJNADc.exe
  2⤵
  PID:4312
- C:\Windows\System\vFKEEJb.exe
  C:\Windows\System\vFKEEJb.exe
  2⤵
  PID:4328
- C:\Windows\System\ZpmkQys.exe
  C:\Windows\System\ZpmkQys.exe
  2⤵
  PID:4344
- C:\Windows\System\FGIINqZ.exe
  C:\Windows\System\FGIINqZ.exe
  2⤵
  PID:4360
- C:\Windows\System\VglEFwN.exe
  C:\Windows\System\VglEFwN.exe
  2⤵
  PID:4376
- C:\Windows\System\dxokTec.exe
  C:\Windows\System\dxokTec.exe
  2⤵
  PID:4392
- C:\Windows\System\WeJGiFa.exe
  C:\Windows\System\WeJGiFa.exe
  2⤵
  PID:4408
- C:\Windows\System\xdygwaW.exe
  C:\Windows\System\xdygwaW.exe
  2⤵
  PID:4424
- C:\Windows\System\xcvZuRw.exe
  C:\Windows\System\xcvZuRw.exe
  2⤵
  PID:4440
- C:\Windows\System\kIVbtMd.exe
  C:\Windows\System\kIVbtMd.exe
  2⤵
  PID:4456
- C:\Windows\System\EoaCPHe.exe
  C:\Windows\System\EoaCPHe.exe
  2⤵
  PID:4472
- C:\Windows\System\cPQSORq.exe
  C:\Windows\System\cPQSORq.exe
  2⤵
  PID:4488
- C:\Windows\System\VEZfZPD.exe
  C:\Windows\System\VEZfZPD.exe
  2⤵
  PID:4504
- C:\Windows\System\IrFTxmi.exe
  C:\Windows\System\IrFTxmi.exe
  2⤵
  PID:4520
- C:\Windows\System\MfCBEzY.exe
  C:\Windows\System\MfCBEzY.exe
  2⤵
  PID:4536
- C:\Windows\System\iVJPsyA.exe
  C:\Windows\System\iVJPsyA.exe
  2⤵
  PID:4552
- C:\Windows\System\tnjiZyz.exe
  C:\Windows\System\tnjiZyz.exe
  2⤵
  PID:4568
- C:\Windows\System\otWmSDm.exe
  C:\Windows\System\otWmSDm.exe
  2⤵
  PID:4728
- C:\Windows\System\rPBOFCP.exe
  C:\Windows\System\rPBOFCP.exe
  2⤵
  PID:4764
- C:\Windows\System\kLsRsWN.exe
  C:\Windows\System\kLsRsWN.exe
  2⤵
  PID:4780
- C:\Windows\System\wsEfqeh.exe
  C:\Windows\System\wsEfqeh.exe
  2⤵
  PID:4800
- C:\Windows\System\rEYhoSq.exe
  C:\Windows\System\rEYhoSq.exe
  2⤵
  PID:4828
- C:\Windows\System\bXOsEIG.exe
  C:\Windows\System\bXOsEIG.exe
  2⤵
  PID:4848
- C:\Windows\System\bvRpqQI.exe
  C:\Windows\System\bvRpqQI.exe
  2⤵
  PID:4864
- C:\Windows\System\PLXCBWe.exe
  C:\Windows\System\PLXCBWe.exe
  2⤵
  PID:4880
- C:\Windows\System\EczBOYI.exe
  C:\Windows\System\EczBOYI.exe
  2⤵
  PID:4900
- C:\Windows\System\AyDYvFb.exe
  C:\Windows\System\AyDYvFb.exe
  2⤵
  PID:4920
- C:\Windows\System\epKKXIv.exe
  C:\Windows\System\epKKXIv.exe
  2⤵
  PID:4940
- C:\Windows\System\BhmgMno.exe
  C:\Windows\System\BhmgMno.exe
  2⤵
  PID:4996
- C:\Windows\System\gnXYgAO.exe
  C:\Windows\System\gnXYgAO.exe
  2⤵
  PID:5012
- C:\Windows\System\WWiKIzp.exe
  C:\Windows\System\WWiKIzp.exe
  2⤵
  PID:5032
- C:\Windows\System\tqhKyqF.exe
  C:\Windows\System\tqhKyqF.exe
  2⤵
  PID:5048
- C:\Windows\System\YYcUGdc.exe
  C:\Windows\System\YYcUGdc.exe
  2⤵
  PID:5068
- C:\Windows\System\bCtYBRs.exe
  C:\Windows\System\bCtYBRs.exe
  2⤵
  PID:5084
- C:\Windows\System\BZZhoRo.exe
  C:\Windows\System\BZZhoRo.exe
  2⤵
  PID:5104
- C:\Windows\System\oqusBCA.exe
  C:\Windows\System\oqusBCA.exe
  2⤵
  PID:2192
- C:\Windows\System\TaBaFWD.exe
  C:\Windows\System\TaBaFWD.exe
  2⤵
  PID:1956
- C:\Windows\System\eBnMMjE.exe
  C:\Windows\System\eBnMMjE.exe
  2⤵
  PID:4112
- C:\Windows\System\KGdrZSS.exe
  C:\Windows\System\KGdrZSS.exe
  2⤵
  PID:1712
- C:\Windows\System\wZsPdsP.exe
  C:\Windows\System\wZsPdsP.exe
  2⤵
  PID:4144
- C:\Windows\System\pYAtdzK.exe
  C:\Windows\System\pYAtdzK.exe
  2⤵
  PID:4208
- C:\Windows\System\MQUNDAa.exe
  C:\Windows\System\MQUNDAa.exe
  2⤵
  PID:4256
- C:\Windows\System\UhLfdbh.exe
  C:\Windows\System\UhLfdbh.exe
  2⤵
  PID:4288
- C:\Windows\System\pfMJyPS.exe
  C:\Windows\System\pfMJyPS.exe
  2⤵
  PID:4276
- C:\Windows\System\EysUmDW.exe
  C:\Windows\System\EysUmDW.exe
  2⤵
  PID:1612
- C:\Windows\System\echsCjQ.exe
  C:\Windows\System\echsCjQ.exe
  2⤵
  PID:4340
- C:\Windows\System\UpboqVO.exe
  C:\Windows\System\UpboqVO.exe
  2⤵
  PID:4400
- C:\Windows\System\ISGXQOe.exe
  C:\Windows\System\ISGXQOe.exe
  2⤵
  PID:4452
- C:\Windows\System\vQBYBYO.exe
  C:\Windows\System\vQBYBYO.exe
  2⤵
  PID:4464
- C:\Windows\System\wEOFCaF.exe
  C:\Windows\System\wEOFCaF.exe
  2⤵
  PID:2616
- C:\Windows\System\gAqxFrZ.exe
  C:\Windows\System\gAqxFrZ.exe
  2⤵
  PID:2304
- C:\Windows\System\woqTuhT.exe
  C:\Windows\System\woqTuhT.exe
  2⤵
  PID:4560
- C:\Windows\System\cXRZBfh.exe
  C:\Windows\System\cXRZBfh.exe
  2⤵
  PID:2896
- C:\Windows\System\zHlsyjN.exe
  C:\Windows\System\zHlsyjN.exe
  2⤵
  PID:236
- C:\Windows\System\FvmVPva.exe
  C:\Windows\System\FvmVPva.exe
  2⤵
  PID:2628
- C:\Windows\System\eyCNEOc.exe
  C:\Windows\System\eyCNEOc.exe
  2⤵
  PID:4596
- C:\Windows\System\qKGCJlm.exe
  C:\Windows\System\qKGCJlm.exe
  2⤵
  PID:4624
- C:\Windows\System\mrGRRAE.exe
  C:\Windows\System\mrGRRAE.exe
  2⤵
  PID:2668
- C:\Windows\System\nHqIpya.exe
  C:\Windows\System\nHqIpya.exe
  2⤵
  PID:4636
- C:\Windows\System\dOTyDBk.exe
  C:\Windows\System\dOTyDBk.exe
  2⤵
  PID:4644
- C:\Windows\System\dOTqNfe.exe
  C:\Windows\System\dOTqNfe.exe
  2⤵
  PID:4660
- C:\Windows\System\aBudXXW.exe
  C:\Windows\System\aBudXXW.exe
  2⤵
  PID:4676
- C:\Windows\System\SVOzNEi.exe
  C:\Windows\System\SVOzNEi.exe
  2⤵
  PID:4688
- C:\Windows\System\hkedYze.exe
  C:\Windows\System\hkedYze.exe
  2⤵
  PID:4708
- C:\Windows\System\rROHyoj.exe
  C:\Windows\System\rROHyoj.exe
  2⤵
  PID:4720
- C:\Windows\System\FxyJBdh.exe
  C:\Windows\System\FxyJBdh.exe
  2⤵
  PID:4740
- C:\Windows\System\GyfNPeT.exe
  C:\Windows\System\GyfNPeT.exe
  2⤵
  PID:4760
- C:\Windows\System\EsDHJGh.exe
  C:\Windows\System\EsDHJGh.exe
  2⤵
  PID:4836
- C:\Windows\System\hGYvtWN.exe
  C:\Windows\System\hGYvtWN.exe
  2⤵
  PID:4872
- C:\Windows\System\jjzeBcW.exe
  C:\Windows\System\jjzeBcW.exe
  2⤵
  PID:4824
- C:\Windows\System\QxHTLBx.exe
  C:\Windows\System\QxHTLBx.exe
  2⤵
  PID:4888
- C:\Windows\System\pOsKMmW.exe
  C:\Windows\System\pOsKMmW.exe
  2⤵
  PID:4928
- C:\Windows\System\LkWSjcp.exe
  C:\Windows\System\LkWSjcp.exe
  2⤵
  PID:4948
- C:\Windows\System\XfUHJxf.exe
  C:\Windows\System\XfUHJxf.exe
  2⤵
  PID:4964
- C:\Windows\System\oSogLNa.exe
  C:\Windows\System\oSogLNa.exe
  2⤵
  PID:4980
- C:\Windows\System\BrBFSxE.exe
  C:\Windows\System\BrBFSxE.exe
  2⤵
  PID:2908
- C:\Windows\System\zkcxAgf.exe
  C:\Windows\System\zkcxAgf.exe
  2⤵
  PID:5064
- C:\Windows\System\tQbfgko.exe
  C:\Windows\System\tQbfgko.exe
  2⤵
  PID:5100
- C:\Windows\System\YxhWVQx.exe
  C:\Windows\System\YxhWVQx.exe
  2⤵
  PID:5092
- C:\Windows\System\popnecO.exe
  C:\Windows\System\popnecO.exe
  2⤵
  PID:1060
- C:\Windows\System\hKQEFhz.exe
  C:\Windows\System\hKQEFhz.exe
  2⤵
  PID:4192
- C:\Windows\System\JzeYvod.exe
  C:\Windows\System\JzeYvod.exe
  2⤵
  PID:4240
- C:\Windows\System\djQnNow.exe
  C:\Windows\System\djQnNow.exe
  2⤵
  PID:4308
- C:\Windows\System\Lmoeoyu.exe
  C:\Windows\System\Lmoeoyu.exe
  2⤵
  PID:2320
- C:\Windows\System\BGNTaiT.exe
  C:\Windows\System\BGNTaiT.exe
  2⤵
  PID:4564
- C:\Windows\System\dhNCvZy.exe
  C:\Windows\System\dhNCvZy.exe
  2⤵
  PID:4608
- C:\Windows\System\uACHCJD.exe
  C:\Windows\System\uACHCJD.exe
  2⤵
  PID:4652
- C:\Windows\System\vMIHzee.exe
  C:\Windows\System\vMIHzee.exe
  2⤵
  PID:4684
- C:\Windows\System\xEbQehA.exe
  C:\Windows\System\xEbQehA.exe
  2⤵
  PID:1812
- C:\Windows\System\CzsODIT.exe
  C:\Windows\System\CzsODIT.exe
  2⤵
  PID:4796
- C:\Windows\System\DuNVqAI.exe
  C:\Windows\System\DuNVqAI.exe
  2⤵
  PID:4100
- C:\Windows\System\pZbmKKl.exe
  C:\Windows\System\pZbmKKl.exe
  2⤵
  PID:4936
- C:\Windows\System\whXGwzE.exe
  C:\Windows\System\whXGwzE.exe
  2⤵
  PID:4320
- C:\Windows\System\nbMWRUL.exe
  C:\Windows\System\nbMWRUL.exe
  2⤵
  PID:4368
- C:\Windows\System\tRCFWfU.exe
  C:\Windows\System\tRCFWfU.exe
  2⤵
  PID:4180
- C:\Windows\System\TIexcJc.exe
  C:\Windows\System\TIexcJc.exe
  2⤵
  PID:5004
- C:\Windows\System\wejFbJu.exe
  C:\Windows\System\wejFbJu.exe
  2⤵
  PID:4960
- C:\Windows\System\ZhLvrVJ.exe
  C:\Windows\System\ZhLvrVJ.exe
  2⤵
  PID:4952
- C:\Windows\System\wfPLfHE.exe
  C:\Windows\System\wfPLfHE.exe
  2⤵
  PID:4896
- C:\Windows\System\VcpMjfQ.exe
  C:\Windows\System\VcpMjfQ.exe
  2⤵
  PID:5056
- C:\Windows\System\mqgnwyp.exe
  C:\Windows\System\mqgnwyp.exe
  2⤵
  PID:2952
- C:\Windows\System\XVDyWVh.exe
  C:\Windows\System\XVDyWVh.exe
  2⤵
  PID:4696
- C:\Windows\System\nrEGfyz.exe
  C:\Windows\System\nrEGfyz.exe
  2⤵
  PID:2356
- C:\Windows\System\SczWdWQ.exe
  C:\Windows\System\SczWdWQ.exe
  2⤵
  PID:4604
- C:\Windows\System\oQXzMTw.exe
  C:\Windows\System\oQXzMTw.exe
  2⤵
  PID:1172
- C:\Windows\System\dxJXvHB.exe
  C:\Windows\System\dxJXvHB.exe
  2⤵
  PID:4532
- C:\Windows\System\kyjFtFx.exe
  C:\Windows\System\kyjFtFx.exe
  2⤵
  PID:1904
- C:\Windows\System\BxfGOGv.exe
  C:\Windows\System\BxfGOGv.exe
  2⤵
  PID:2760
- C:\Windows\System\WhhheXe.exe
  C:\Windows\System\WhhheXe.exe
  2⤵
  PID:2956
- C:\Windows\System\NNEcbmK.exe
  C:\Windows\System\NNEcbmK.exe
  2⤵
  PID:4628
- C:\Windows\System\MYKbRjH.exe
  C:\Windows\System\MYKbRjH.exe
  2⤵
  PID:4856
- C:\Windows\System\jlZGnxQ.exe
  C:\Windows\System\jlZGnxQ.exe
  2⤵
  PID:4228
- C:\Windows\System\aOfNxiZ.exe
  C:\Windows\System\aOfNxiZ.exe
  2⤵
  PID:4272
- C:\Windows\System\htFYIoW.exe
  C:\Windows\System\htFYIoW.exe
  2⤵
  PID:5024
- C:\Windows\System\ERhQoDI.exe
  C:\Windows\System\ERhQoDI.exe
  2⤵
  PID:4372
- C:\Windows\System\IASocqR.exe
  C:\Windows\System\IASocqR.exe
  2⤵
  PID:4988
- C:\Windows\System\nSWiddt.exe
  C:\Windows\System\nSWiddt.exe
  2⤵
  PID:4584
- C:\Windows\System\dVMblBL.exe
  C:\Windows\System\dVMblBL.exe
  2⤵
  PID:2744
- C:\Windows\System\euzmmLW.exe
  C:\Windows\System\euzmmLW.exe
  2⤵
  PID:2100
- C:\Windows\System\ooygFKg.exe
  C:\Windows\System\ooygFKg.exe
  2⤵
  PID:4580
- C:\Windows\System\AHakslV.exe
  C:\Windows\System\AHakslV.exe
  2⤵
  PID:2396
- C:\Windows\System\QroLOSp.exe
  C:\Windows\System\QroLOSp.exe
  2⤵
  PID:4908
- C:\Windows\System\mHDJFlD.exe
  C:\Windows\System\mHDJFlD.exe
  2⤵
  PID:2344
- C:\Windows\System\IIKMGuy.exe
  C:\Windows\System\IIKMGuy.exe
  2⤵
  PID:4672
- C:\Windows\System\YGnvyvF.exe
  C:\Windows\System\YGnvyvF.exe
  2⤵
  PID:5136
- C:\Windows\System\qVHMuEQ.exe
  C:\Windows\System\qVHMuEQ.exe
  2⤵
  PID:5152
- C:\Windows\System\HlmvFhh.exe
  C:\Windows\System\HlmvFhh.exe
  2⤵
  PID:5168
- C:\Windows\System\PJRfuHx.exe
  C:\Windows\System\PJRfuHx.exe
  2⤵
  PID:5184
- C:\Windows\System\ituqbzM.exe
  C:\Windows\System\ituqbzM.exe
  2⤵
  PID:5204
- C:\Windows\System\fiAQRRB.exe
  C:\Windows\System\fiAQRRB.exe
  2⤵
  PID:5220
- C:\Windows\System\oYeOQKZ.exe
  C:\Windows\System\oYeOQKZ.exe
  2⤵
  PID:5236
- C:\Windows\System\qiBzNpu.exe
  C:\Windows\System\qiBzNpu.exe
  2⤵
  PID:5252
- C:\Windows\System\PzRyPwC.exe
  C:\Windows\System\PzRyPwC.exe
  2⤵
  PID:5268
- C:\Windows\System\oZlCDRd.exe
  C:\Windows\System\oZlCDRd.exe
  2⤵
  PID:5284
- C:\Windows\System\UFkohbh.exe
  C:\Windows\System\UFkohbh.exe
  2⤵
  PID:5300
- C:\Windows\System\tGUvjNW.exe
  C:\Windows\System\tGUvjNW.exe
  2⤵
  PID:5316
- C:\Windows\System\HYscMZc.exe
  C:\Windows\System\HYscMZc.exe
  2⤵
  PID:5332
- C:\Windows\System\OZGqBqo.exe
  C:\Windows\System\OZGqBqo.exe
  2⤵
  PID:5348
- C:\Windows\System\MVQyhja.exe
  C:\Windows\System\MVQyhja.exe
  2⤵
  PID:5364
- C:\Windows\System\prOBunE.exe
  C:\Windows\System\prOBunE.exe
  2⤵
  PID:5380
- C:\Windows\System\FeYphNX.exe
  C:\Windows\System\FeYphNX.exe
  2⤵
  PID:5396
- C:\Windows\System\lxWMQpD.exe
  C:\Windows\System\lxWMQpD.exe
  2⤵
  PID:5412
- C:\Windows\System\WIApnGs.exe
  C:\Windows\System\WIApnGs.exe
  2⤵
  PID:5428
- C:\Windows\System\RVWaSDw.exe
  C:\Windows\System\RVWaSDw.exe
  2⤵
  PID:5444
- C:\Windows\System\GeoHqbk.exe
  C:\Windows\System\GeoHqbk.exe
  2⤵
  PID:5460
- C:\Windows\System\yDwWqVO.exe
  C:\Windows\System\yDwWqVO.exe
  2⤵
  PID:5476
- C:\Windows\System\vykHTmE.exe
  C:\Windows\System\vykHTmE.exe
  2⤵
  PID:5492
- C:\Windows\System\IWLrIlI.exe
  C:\Windows\System\IWLrIlI.exe
  2⤵
  PID:5508
- C:\Windows\System\vqaFhfC.exe
  C:\Windows\System\vqaFhfC.exe
  2⤵
  PID:5524
- C:\Windows\System\CZSsCOA.exe
  C:\Windows\System\CZSsCOA.exe
  2⤵
  PID:5540
- C:\Windows\System\TRtHOYC.exe
  C:\Windows\System\TRtHOYC.exe
  2⤵
  PID:5556
- C:\Windows\System\fvFUmTn.exe
  C:\Windows\System\fvFUmTn.exe
  2⤵
  PID:5572
- C:\Windows\System\UxennON.exe
  C:\Windows\System\UxennON.exe
  2⤵
  PID:5588
- C:\Windows\System\OUPJLHG.exe
  C:\Windows\System\OUPJLHG.exe
  2⤵
  PID:5604
- C:\Windows\System\nExCwDJ.exe
  C:\Windows\System\nExCwDJ.exe
  2⤵
  PID:5620
- C:\Windows\System\IlYGhLy.exe
  C:\Windows\System\IlYGhLy.exe
  2⤵
  PID:5636
- C:\Windows\System\rMGfffK.exe
  C:\Windows\System\rMGfffK.exe
  2⤵
  PID:5652
- C:\Windows\System\cPKibyJ.exe
  C:\Windows\System\cPKibyJ.exe
  2⤵
  PID:5668
- C:\Windows\System\HJCdkCk.exe
  C:\Windows\System\HJCdkCk.exe
  2⤵
  PID:5684
- C:\Windows\System\ZAfrsNi.exe
  C:\Windows\System\ZAfrsNi.exe
  2⤵
  PID:5700
- C:\Windows\System\GPditby.exe
  C:\Windows\System\GPditby.exe
  2⤵
  PID:5716
- C:\Windows\System\Ddrqoqy.exe
  C:\Windows\System\Ddrqoqy.exe
  2⤵
  PID:5732
- C:\Windows\System\tyDNPRZ.exe
  C:\Windows\System\tyDNPRZ.exe
  2⤵
  PID:5748
- C:\Windows\System\ozbhpne.exe
  C:\Windows\System\ozbhpne.exe
  2⤵
  PID:5764
- C:\Windows\System\ubSQFyj.exe
  C:\Windows\System\ubSQFyj.exe
  2⤵
  PID:5780
- C:\Windows\System\LyMksNv.exe
  C:\Windows\System\LyMksNv.exe
  2⤵
  PID:5796
- C:\Windows\System\vNbmlHm.exe
  C:\Windows\System\vNbmlHm.exe
  2⤵
  PID:5812
- C:\Windows\System\cEnZHHe.exe
  C:\Windows\System\cEnZHHe.exe
  2⤵
  PID:5828
- C:\Windows\System\pMNNrhk.exe
  C:\Windows\System\pMNNrhk.exe
  2⤵
  PID:5844
- C:\Windows\System\vvzsCrg.exe
  C:\Windows\System\vvzsCrg.exe
  2⤵
  PID:5860
- C:\Windows\System\tJKaRTw.exe
  C:\Windows\System\tJKaRTw.exe
  2⤵
  PID:5876
- C:\Windows\System\gHmZHzG.exe
  C:\Windows\System\gHmZHzG.exe
  2⤵
  PID:5892
- C:\Windows\System\gTsBgMG.exe
  C:\Windows\System\gTsBgMG.exe
  2⤵
  PID:5908
- C:\Windows\System\hmullse.exe
  C:\Windows\System\hmullse.exe
  2⤵
  PID:5924
- C:\Windows\System\suFuyqr.exe
  C:\Windows\System\suFuyqr.exe
  2⤵
  PID:5940
- C:\Windows\System\bRxVdUm.exe
  C:\Windows\System\bRxVdUm.exe
  2⤵
  PID:5956
- C:\Windows\System\HnmGDLN.exe
  C:\Windows\System\HnmGDLN.exe
  2⤵
  PID:5972
- C:\Windows\System\rcxlFZY.exe
  C:\Windows\System\rcxlFZY.exe
  2⤵
  PID:5992
- C:\Windows\System\RMaVRby.exe
  C:\Windows\System\RMaVRby.exe
  2⤵
  PID:6008
- C:\Windows\System\TrNCvmU.exe
  C:\Windows\System\TrNCvmU.exe
  2⤵
  PID:6024
- C:\Windows\System\nDlGLDZ.exe
  C:\Windows\System\nDlGLDZ.exe
  2⤵
  PID:6040
- C:\Windows\System\pASwVFY.exe
  C:\Windows\System\pASwVFY.exe
  2⤵
  PID:6056
- C:\Windows\System\zmbluMD.exe
  C:\Windows\System\zmbluMD.exe
  2⤵
  PID:6072
- C:\Windows\System\SAAyLhT.exe
  C:\Windows\System\SAAyLhT.exe
  2⤵
  PID:6088
- C:\Windows\System\lYIsojD.exe
  C:\Windows\System\lYIsojD.exe
  2⤵
  PID:6104
- C:\Windows\System\xVQzRDK.exe
  C:\Windows\System\xVQzRDK.exe
  2⤵
  PID:6120
- C:\Windows\System\mISwstP.exe
  C:\Windows\System\mISwstP.exe
  2⤵
  PID:6136
- C:\Windows\System\iCprLVp.exe
  C:\Windows\System\iCprLVp.exe
  2⤵
  PID:5112
- C:\Windows\System\cDwYDrc.exe
  C:\Windows\System\cDwYDrc.exe
  2⤵
  PID:5116
- C:\Windows\System\IKYtKPv.exe
  C:\Windows\System\IKYtKPv.exe
  2⤵
  PID:5164
- C:\Windows\System\qoSoCtO.exe
  C:\Windows\System\qoSoCtO.exe
  2⤵
  PID:2036
- C:\Windows\System\KgVQMLr.exe
  C:\Windows\System\KgVQMLr.exe
  2⤵
  PID:4704
- C:\Windows\System\UATKGdv.exe
  C:\Windows\System\UATKGdv.exe
  2⤵
  PID:4436
- C:\Windows\System\ZKXujeC.exe
  C:\Windows\System\ZKXujeC.exe
  2⤵
  PID:4576
- C:\Windows\System\ndCNgaH.exe
  C:\Windows\System\ndCNgaH.exe
  2⤵
  PID:5040
- C:\Windows\System\qpnleip.exe
  C:\Windows\System\qpnleip.exe
  2⤵
  PID:5008
- C:\Windows\System\tajMfKO.exe
  C:\Windows\System\tajMfKO.exe
  2⤵
  PID:4788
- C:\Windows\System\PQDzasK.exe
  C:\Windows\System\PQDzasK.exe
  2⤵
  PID:4656
- C:\Windows\System\ocIfwwK.exe
  C:\Windows\System\ocIfwwK.exe
  2⤵
  PID:5228
- C:\Windows\System\FbtTEdl.exe
  C:\Windows\System\FbtTEdl.exe
  2⤵
  PID:5244
- C:\Windows\System\yIKKlUN.exe
  C:\Windows\System\yIKKlUN.exe
  2⤵
  PID:5328
- C:\Windows\System\ywNFTgc.exe
  C:\Windows\System\ywNFTgc.exe
  2⤵
  PID:2392
- C:\Windows\System\ZrJuuhd.exe
  C:\Windows\System\ZrJuuhd.exe
  2⤵
  PID:5392
- C:\Windows\System\HUzvYXy.exe
  C:\Windows\System\HUzvYXy.exe
  2⤵
  PID:5456
- C:\Windows\System\EjFxFmD.exe
  C:\Windows\System\EjFxFmD.exe
  2⤵
  PID:5484
- C:\Windows\System\XikBgED.exe
  C:\Windows\System\XikBgED.exe
  2⤵
  PID:5548
- C:\Windows\System\imPNRXk.exe
  C:\Windows\System\imPNRXk.exe
  2⤵
  PID:5532
- C:\Windows\System\VBKsZWV.exe
  C:\Windows\System\VBKsZWV.exe
  2⤵
  PID:1944
- C:\Windows\System\bVwTrLz.exe
  C:\Windows\System\bVwTrLz.exe
  2⤵
  PID:5468
- C:\Windows\System\QBccULk.exe
  C:\Windows\System\QBccULk.exe
  2⤵
  PID:5612
- C:\Windows\System\WGFqMwY.exe
  C:\Windows\System\WGFqMwY.exe
  2⤵
  PID:5648
- C:\Windows\System\wFyWRJY.exe
  C:\Windows\System\wFyWRJY.exe
  2⤵
  PID:5376
- C:\Windows\System\NwKbqLL.exe
  C:\Windows\System\NwKbqLL.exe
  2⤵
  PID:5340
- C:\Windows\System\WqCzOmn.exe
  C:\Windows\System\WqCzOmn.exe
  2⤵
  PID:5568
- C:\Windows\System\PrHkyke.exe
  C:\Windows\System\PrHkyke.exe
  2⤵
  PID:5740
- C:\Windows\System\kEbbYdQ.exe
  C:\Windows\System\kEbbYdQ.exe
  2⤵
  PID:5804
- C:\Windows\System\XuVjVwr.exe
  C:\Windows\System\XuVjVwr.exe
  2⤵
  PID:5840
- C:\Windows\System\CTDjybw.exe
  C:\Windows\System\CTDjybw.exe
  2⤵
  PID:5872
- C:\Windows\System\fFPVAqd.exe
  C:\Windows\System\fFPVAqd.exe
  2⤵
  PID:5932
- C:\Windows\System\NqtwKhk.exe
  C:\Windows\System\NqtwKhk.exe
  2⤵
  PID:5964
- C:\Windows\System\fNmnRTB.exe
  C:\Windows\System\fNmnRTB.exe
  2⤵
  PID:5728
- C:\Windows\System\LgODpbx.exe
  C:\Windows\System\LgODpbx.exe
  2⤵
  PID:5628
- C:\Windows\System\rMemzex.exe
  C:\Windows\System\rMemzex.exe
  2⤵
  PID:5632
- C:\Windows\System\ASncqhc.exe
  C:\Windows\System\ASncqhc.exe
  2⤵
  PID:6128
- C:\Windows\System\fJvJYEX.exe
  C:\Windows\System\fJvJYEX.exe
  2⤵
  PID:4916
- C:\Windows\System\mQZgsSi.exe
  C:\Windows\System\mQZgsSi.exe
  2⤵
  PID:5884
- C:\Windows\System\OoIybPN.exe
  C:\Windows\System\OoIybPN.exe
  2⤵
  PID:5664
- C:\Windows\System\JRFDkpm.exe
  C:\Windows\System\JRFDkpm.exe
  2⤵
  PID:5820
- C:\Windows\System\WPBPduN.exe
  C:\Windows\System\WPBPduN.exe
  2⤵
  PID:5132
- C:\Windows\System\uusLALe.exe
  C:\Windows\System\uusLALe.exe
  2⤵
  PID:5984
- C:\Windows\System\eSdnoCK.exe
  C:\Windows\System\eSdnoCK.exe
  2⤵
  PID:6052
- C:\Windows\System\zTFKQBC.exe
  C:\Windows\System\zTFKQBC.exe
  2⤵
  PID:4356
- C:\Windows\System\lQWgbyq.exe
  C:\Windows\System\lQWgbyq.exe
  2⤵
  PID:4420
- C:\Windows\System\BIbAjSq.exe
  C:\Windows\System\BIbAjSq.exe
  2⤵
  PID:5180
- C:\Windows\System\eZKmbaH.exe
  C:\Windows\System\eZKmbaH.exe
  2⤵
  PID:4116
- C:\Windows\System\uBphkmf.exe
  C:\Windows\System\uBphkmf.exe
  2⤵
  PID:4600
- C:\Windows\System\rysMFBp.exe
  C:\Windows\System\rysMFBp.exe
  2⤵
  PID:5360
- C:\Windows\System\hYzYkET.exe
  C:\Windows\System\hYzYkET.exe
  2⤵
  PID:5148
- C:\Windows\System\ilczKsv.exe
  C:\Windows\System\ilczKsv.exe
  2⤵
  PID:5296
- C:\Windows\System\PQzTdaf.exe
  C:\Windows\System\PQzTdaf.exe
  2⤵
  PID:5212
- C:\Windows\System\aNAVAmD.exe
  C:\Windows\System\aNAVAmD.exe
  2⤵
  PID:5312
- C:\Windows\System\RBAeoKx.exe
  C:\Windows\System\RBAeoKx.exe
  2⤵
  PID:5372
- C:\Windows\System\iyhyFDs.exe
  C:\Windows\System\iyhyFDs.exe
  2⤵
  PID:2152
- C:\Windows\System\kHHCzrR.exe
  C:\Windows\System\kHHCzrR.exe
  2⤵
  PID:5520
- C:\Windows\System\AKxtnRR.exe
  C:\Windows\System\AKxtnRR.exe
  2⤵
  PID:5536
- C:\Windows\System\kioZVAG.exe
  C:\Windows\System\kioZVAG.exe
  2⤵
  PID:5280
- C:\Windows\System\GNQsWoG.exe
  C:\Windows\System\GNQsWoG.exe
  2⤵
  PID:6064
- C:\Windows\System\xOHPQly.exe
  C:\Windows\System\xOHPQly.exe
  2⤵
  PID:5776
- C:\Windows\System\ZWvtIfa.exe
  C:\Windows\System\ZWvtIfa.exe
  2⤵
  PID:5916
- C:\Windows\System\wNpLzhO.exe
  C:\Windows\System\wNpLzhO.exe
  2⤵
  PID:6020
- C:\Windows\System\inTvWEv.exe
  C:\Windows\System\inTvWEv.exe
  2⤵
  PID:4860
- C:\Windows\System\asbQXvG.exe
  C:\Windows\System\asbQXvG.exe
  2⤵
  PID:4992
- C:\Windows\System\MjDMhnq.exe
  C:\Windows\System\MjDMhnq.exe
  2⤵
  PID:5600
- C:\Windows\System\VyZerdw.exe
  C:\Windows\System\VyZerdw.exe
  2⤵
  PID:5692
- C:\Windows\System\vQCSvaI.exe
  C:\Windows\System\vQCSvaI.exe
  2⤵
  PID:6132
- C:\Windows\System\ddUhHzN.exe
  C:\Windows\System\ddUhHzN.exe
  2⤵
  PID:6152
- C:\Windows\System\UEOHBgj.exe
  C:\Windows\System\UEOHBgj.exe
  2⤵
  PID:6168
- C:\Windows\System\xTXgUuG.exe
  C:\Windows\System\xTXgUuG.exe
  2⤵
  PID:6184
- C:\Windows\System\yIkMbfN.exe
  C:\Windows\System\yIkMbfN.exe
  2⤵
  PID:6200
- C:\Windows\System\tYdAQpB.exe
  C:\Windows\System\tYdAQpB.exe
  2⤵
  PID:6216
- C:\Windows\System\fnrBLEJ.exe
  C:\Windows\System\fnrBLEJ.exe
  2⤵
  PID:6232
- C:\Windows\System\UiRlthI.exe
  C:\Windows\System\UiRlthI.exe
  2⤵
  PID:6248
- C:\Windows\System\lDhmnyJ.exe
  C:\Windows\System\lDhmnyJ.exe
  2⤵
  PID:6264
- C:\Windows\System\LvIKoAr.exe
  C:\Windows\System\LvIKoAr.exe
  2⤵
  PID:6280
- C:\Windows\System\zlnrAuP.exe
  C:\Windows\System\zlnrAuP.exe
  2⤵
  PID:6296
- C:\Windows\System\viBbzCN.exe
  C:\Windows\System\viBbzCN.exe
  2⤵
  PID:6312
- C:\Windows\System\fLwuBEw.exe
  C:\Windows\System\fLwuBEw.exe
  2⤵
  PID:6328
- C:\Windows\System\oMrdZth.exe
  C:\Windows\System\oMrdZth.exe
  2⤵
  PID:6344
- C:\Windows\System\jZUrHPi.exe
  C:\Windows\System\jZUrHPi.exe
  2⤵
  PID:6360
- C:\Windows\System\zPVMhZq.exe
  C:\Windows\System\zPVMhZq.exe
  2⤵
  PID:6376
- C:\Windows\System\eVGKlyJ.exe
  C:\Windows\System\eVGKlyJ.exe
  2⤵
  PID:6392
- C:\Windows\System\hSmJCle.exe
  C:\Windows\System\hSmJCle.exe
  2⤵
  PID:6408
- C:\Windows\System\SNQFiBg.exe
  C:\Windows\System\SNQFiBg.exe
  2⤵
  PID:6424
- C:\Windows\System\WBhklYN.exe
  C:\Windows\System\WBhklYN.exe
  2⤵
  PID:6440
- C:\Windows\System\BIhtLnE.exe
  C:\Windows\System\BIhtLnE.exe
  2⤵
  PID:6456
- C:\Windows\System\PZoujoq.exe
  C:\Windows\System\PZoujoq.exe
  2⤵
  PID:6472
- C:\Windows\System\fVjYyXJ.exe
  C:\Windows\System\fVjYyXJ.exe
  2⤵
  PID:6488
- C:\Windows\System\EqeLnzA.exe
  C:\Windows\System\EqeLnzA.exe
  2⤵
  PID:6504
- C:\Windows\System\ZgJuWfb.exe
  C:\Windows\System\ZgJuWfb.exe
  2⤵
  PID:6520
- C:\Windows\System\lzEmBWU.exe
  C:\Windows\System\lzEmBWU.exe
  2⤵
  PID:6536
- C:\Windows\System\csnsgdz.exe
  C:\Windows\System\csnsgdz.exe
  2⤵
  PID:6552
- C:\Windows\System\fcFAHHn.exe
  C:\Windows\System\fcFAHHn.exe
  2⤵
  PID:6568
- C:\Windows\System\nXOwnuh.exe
  C:\Windows\System\nXOwnuh.exe
  2⤵
  PID:6584
- C:\Windows\System\FORfPaP.exe
  C:\Windows\System\FORfPaP.exe
  2⤵
  PID:6600
- C:\Windows\System\bgrzpHv.exe
  C:\Windows\System\bgrzpHv.exe
  2⤵
  PID:6616
- C:\Windows\System\OsnWYiv.exe
  C:\Windows\System\OsnWYiv.exe
  2⤵
  PID:6632
- C:\Windows\System\WQBBGkg.exe
  C:\Windows\System\WQBBGkg.exe
  2⤵
  PID:6648
- C:\Windows\System\kqkoDVy.exe
  C:\Windows\System\kqkoDVy.exe
  2⤵
  PID:6664
- C:\Windows\System\HWdEMab.exe
  C:\Windows\System\HWdEMab.exe
  2⤵
  PID:6680
- C:\Windows\System\BcVdyXO.exe
  C:\Windows\System\BcVdyXO.exe
  2⤵
  PID:6696
- C:\Windows\System\zkrqNhE.exe
  C:\Windows\System\zkrqNhE.exe
  2⤵
  PID:6712
- C:\Windows\System\SsyyMJT.exe
  C:\Windows\System\SsyyMJT.exe
  2⤵
  PID:6728
- C:\Windows\System\zpBmQbW.exe
  C:\Windows\System\zpBmQbW.exe
  2⤵
  PID:6744
- C:\Windows\System\mXIMXvz.exe
  C:\Windows\System\mXIMXvz.exe
  2⤵
  PID:6764
- C:\Windows\System\LfrhUMs.exe
  C:\Windows\System\LfrhUMs.exe
  2⤵
  PID:6780
- C:\Windows\System\XDxDTzH.exe
  C:\Windows\System\XDxDTzH.exe
  2⤵
  PID:6796
- C:\Windows\System\gdolcAt.exe
  C:\Windows\System\gdolcAt.exe
  2⤵
  PID:6812
- C:\Windows\System\EqkErOA.exe
  C:\Windows\System\EqkErOA.exe
  2⤵
  PID:6828
- C:\Windows\System\QkkisAq.exe
  C:\Windows\System\QkkisAq.exe
  2⤵
  PID:6844
- C:\Windows\System\CQbeLLN.exe
  C:\Windows\System\CQbeLLN.exe
  2⤵
  PID:6860
- C:\Windows\System\PsWidvo.exe
  C:\Windows\System\PsWidvo.exe
  2⤵
  PID:6876
- C:\Windows\System\DBVLLyG.exe
  C:\Windows\System\DBVLLyG.exe
  2⤵
  PID:6892
- C:\Windows\System\GACwQoi.exe
  C:\Windows\System\GACwQoi.exe
  2⤵
  PID:6916
- C:\Windows\System\QwXQoRb.exe
  C:\Windows\System\QwXQoRb.exe
  2⤵
  PID:6932
- C:\Windows\System\tuZtDrb.exe
  C:\Windows\System\tuZtDrb.exe
  2⤵
  PID:6948
- C:\Windows\System\vALSmIi.exe
  C:\Windows\System\vALSmIi.exe
  2⤵
  PID:6964
- C:\Windows\System\PpRSsfV.exe
  C:\Windows\System\PpRSsfV.exe
  2⤵
  PID:6980
- C:\Windows\System\UXOqqXn.exe
  C:\Windows\System\UXOqqXn.exe
  2⤵
  PID:6996
- C:\Windows\System\lkIHnkY.exe
  C:\Windows\System\lkIHnkY.exe
  2⤵
  PID:7016
- C:\Windows\System\qZGUOkd.exe
  C:\Windows\System\qZGUOkd.exe
  2⤵
  PID:7032
- C:\Windows\System\IRAxvCK.exe
  C:\Windows\System\IRAxvCK.exe
  2⤵
  PID:7048
- C:\Windows\System\ZGwYMdc.exe
  C:\Windows\System\ZGwYMdc.exe
  2⤵
  PID:7064
- C:\Windows\System\bvFbpBq.exe
  C:\Windows\System\bvFbpBq.exe
  2⤵
  PID:7080
- C:\Windows\System\XXsGgDi.exe
  C:\Windows\System\XXsGgDi.exe
  2⤵
  PID:7100
- C:\Windows\System\DItdqED.exe
  C:\Windows\System\DItdqED.exe
  2⤵
  PID:7116
- C:\Windows\System\dLxlEag.exe
  C:\Windows\System\dLxlEag.exe
  2⤵
  PID:7132
- C:\Windows\System\BxDrbbo.exe
  C:\Windows\System\BxDrbbo.exe
  2⤵
  PID:7148
- C:\Windows\System\VSlRwFn.exe
  C:\Windows\System\VSlRwFn.exe
  2⤵
  PID:7164
- C:\Windows\System\kQhoMJI.exe
  C:\Windows\System\kQhoMJI.exe
  2⤵
  PID:1788
- C:\Windows\System\JQoJqrP.exe
  C:\Windows\System\JQoJqrP.exe
  2⤵
  PID:6196
- C:\Windows\System\PcuVkCd.exe
  C:\Windows\System\PcuVkCd.exe
  2⤵
  PID:6112
- C:\Windows\System\tXmoAXG.exe
  C:\Windows\System\tXmoAXG.exe
  2⤵
  PID:5708
- C:\Windows\System\WlYKUnf.exe
  C:\Windows\System\WlYKUnf.exe
  2⤵
  PID:6096
- C:\Windows\System\XuCrqmn.exe
  C:\Windows\System\XuCrqmn.exe
  2⤵
  PID:6228
- C:\Windows\System\ymwZpvM.exe
  C:\Windows\System\ymwZpvM.exe
  2⤵
  PID:6288
- C:\Windows\System\MNHYWMk.exe
  C:\Windows\System\MNHYWMk.exe
  2⤵
  PID:2596
- C:\Windows\System\mzELbvm.exe
  C:\Windows\System\mzELbvm.exe
  2⤵
  PID:6388
- C:\Windows\System\BUgtLwJ.exe
  C:\Windows\System\BUgtLwJ.exe
  2⤵
  PID:6452
- C:\Windows\System\LNYMPlL.exe
  C:\Windows\System\LNYMPlL.exe
  2⤵
  PID:6512
- C:\Windows\System\UWsLOYR.exe
  C:\Windows\System\UWsLOYR.exe
  2⤵
  PID:6580
- C:\Windows\System\VBZVvOH.exe
  C:\Windows\System\VBZVvOH.exe
  2⤵
  PID:1760
- C:\Windows\System\wJbZQtu.exe
  C:\Windows\System\wJbZQtu.exe
  2⤵
  PID:6704
- C:\Windows\System\HaFpEYJ.exe
  C:\Windows\System\HaFpEYJ.exe
  2⤵
  PID:6740
- C:\Windows\System\zVKEOsi.exe
  C:\Windows\System\zVKEOsi.exe
  2⤵
  PID:5488
- C:\Windows\System\UIQtwHF.exe
  C:\Windows\System\UIQtwHF.exe
  2⤵
  PID:5836
- C:\Windows\System\bqxSGUa.exe
  C:\Windows\System\bqxSGUa.exe
  2⤵
  PID:6496
- C:\Windows\System\jJTzMdb.exe
  C:\Windows\System\jJTzMdb.exe
  2⤵
  PID:6208
- C:\Windows\System\ZDHrECt.exe
  C:\Windows\System\ZDHrECt.exe
  2⤵
  PID:6340
- C:\Windows\System\VBmWxFo.exe
  C:\Windows\System\VBmWxFo.exe
  2⤵
  PID:5920
- C:\Windows\System\UUnjNdJ.exe
  C:\Windows\System\UUnjNdJ.exe
  2⤵
  PID:6148
- C:\Windows\System\HvmYhsy.exe
  C:\Windows\System\HvmYhsy.exe
  2⤵
  PID:6628
- C:\Windows\System\lnpNEHW.exe
  C:\Windows\System\lnpNEHW.exe
  2⤵
  PID:6564
- C:\Windows\System\GevJfhO.exe
  C:\Windows\System\GevJfhO.exe
  2⤵
  PID:6560
- C:\Windows\System\AgtskkN.exe
  C:\Windows\System\AgtskkN.exe
  2⤵
  PID:6468
- C:\Windows\System\UlRPbEU.exe
  C:\Windows\System\UlRPbEU.exe
  2⤵
  PID:6272
- C:\Windows\System\wfJJbqM.exe
  C:\Windows\System\wfJJbqM.exe
  2⤵
  PID:6176
- C:\Windows\System\RYTVxOF.exe
  C:\Windows\System\RYTVxOF.exe
  2⤵
  PID:6772
- C:\Windows\System\DzxboFR.exe
  C:\Windows\System\DzxboFR.exe
  2⤵
  PID:6840
- C:\Windows\System\lBTxcvh.exe
  C:\Windows\System\lBTxcvh.exe
  2⤵
  PID:6884
- C:\Windows\System\fBfdrmi.exe
  C:\Windows\System\fBfdrmi.exe
  2⤵
  PID:6820
- C:\Windows\System\EwAIaZh.exe
  C:\Windows\System\EwAIaZh.exe
  2⤵
  PID:6960
- C:\Windows\System\FULLHVn.exe
  C:\Windows\System\FULLHVn.exe
  2⤵
  PID:7088
- C:\Windows\System\BQqRUjv.exe
  C:\Windows\System\BQqRUjv.exe
  2⤵
  PID:6904
- C:\Windows\System\GDKtzTF.exe
  C:\Windows\System\GDKtzTF.exe
  2⤵
  PID:6792
- C:\Windows\System\JaPGGks.exe
  C:\Windows\System\JaPGGks.exe
  2⤵
  PID:6944
- C:\Windows\System\AnvLoMK.exe
  C:\Windows\System\AnvLoMK.exe
  2⤵
  PID:7044
- C:\Windows\System\pRswRzL.exe
  C:\Windows\System\pRswRzL.exe
  2⤵
  PID:7112
- C:\Windows\System\qgXqkFq.exe
  C:\Windows\System\qgXqkFq.exe
  2⤵
  PID:5760
- C:\Windows\System\ypVVAXI.exe
  C:\Windows\System\ypVVAXI.exe
  2⤵
  PID:6192
- C:\Windows\System\zyibFcf.exe
  C:\Windows\System\zyibFcf.exe
  2⤵
  PID:5200
- C:\Windows\System\NlRPhZZ.exe
  C:\Windows\System\NlRPhZZ.exe
  2⤵
  PID:6672
- C:\Windows\System\kXDClaO.exe
  C:\Windows\System\kXDClaO.exe
  2⤵
  PID:6404
- C:\Windows\System\Opjonrh.exe
  C:\Windows\System\Opjonrh.exe
  2⤵
  PID:6724
- C:\Windows\System\tqtldiR.exe
  C:\Windows\System\tqtldiR.exe
  2⤵
  PID:6532
- C:\Windows\System\TjuksIn.exe
  C:\Windows\System\TjuksIn.exe
  2⤵
  PID:6924
- C:\Windows\System\fiekLDn.exe
  C:\Windows\System\fiekLDn.exe
  2⤵
  PID:6836
- C:\Windows\System\NqQPKSi.exe
  C:\Windows\System\NqQPKSi.exe
  2⤵
  PID:6776
- C:\Windows\System\hHMIaQT.exe
  C:\Windows\System\hHMIaQT.exe
  2⤵
  PID:6756
- C:\Windows\System\pIWaias.exe
  C:\Windows\System\pIWaias.exe
  2⤵
  PID:6688
- C:\Windows\System\zBRRXqK.exe
  C:\Windows\System\zBRRXqK.exe
  2⤵
  PID:5644
- C:\Windows\System\OXjteof.exe
  C:\Windows\System\OXjteof.exe
  2⤵
  PID:6644
- C:\Windows\System\bWsMDlb.exe
  C:\Windows\System\bWsMDlb.exe
  2⤵
  PID:6484
- C:\Windows\System\qHzpVKj.exe
  C:\Windows\System\qHzpVKj.exe
  2⤵
  PID:6416
- C:\Windows\System\iInYUny.exe
  C:\Windows\System\iInYUny.exe
  2⤵
  PID:7140
- C:\Windows\System\wkLGsOk.exe
  C:\Windows\System\wkLGsOk.exe
  2⤵
  PID:7144
- C:\Windows\System\tBjoPMm.exe
  C:\Windows\System\tBjoPMm.exe
  2⤵
  PID:7008
- C:\Windows\System\IdPmyxw.exe
  C:\Windows\System\IdPmyxw.exe
  2⤵
  PID:7160
- C:\Windows\System\HYUsbdK.exe
  C:\Windows\System\HYUsbdK.exe
  2⤵
  PID:4468
- C:\Windows\System\dMFzVYW.exe
  C:\Windows\System\dMFzVYW.exe
  2⤵
  PID:6304
- C:\Windows\System\fuDEeUt.exe
  C:\Windows\System\fuDEeUt.exe
  2⤵
  PID:6752
- C:\Windows\System\yNlFnDp.exe
  C:\Windows\System\yNlFnDp.exe
  2⤵
  PID:6528
- C:\Windows\System\TnhtqOv.exe
  C:\Windows\System\TnhtqOv.exe
  2⤵
  PID:7076
- C:\Windows\System\SwMZvHW.exe
  C:\Windows\System\SwMZvHW.exe
  2⤵
  PID:6368
- C:\Windows\System\CGlLrTs.exe
  C:\Windows\System\CGlLrTs.exe
  2⤵
  PID:6788
- C:\Windows\System\xTlVVhh.exe
  C:\Windows\System\xTlVVhh.exe
  2⤵
  PID:5756
- C:\Windows\System\pZNAqQR.exe
  C:\Windows\System\pZNAqQR.exe
  2⤵
  PID:6384
- C:\Windows\System\uglKUrg.exe
  C:\Windows\System\uglKUrg.exe
  2⤵
  PID:6116
- C:\Windows\System\DJzQIee.exe
  C:\Windows\System\DJzQIee.exe
  2⤵
  PID:6324
- C:\Windows\System\yTLZxBf.exe
  C:\Windows\System\yTLZxBf.exe
  2⤵
  PID:6372
- C:\Windows\System\rEAQaha.exe
  C:\Windows\System\rEAQaha.exe
  2⤵
  PID:5980
- C:\Windows\System\FaQlwNV.exe
  C:\Windows\System\FaQlwNV.exe
  2⤵
  PID:6872
- C:\Windows\System\zUWqQcD.exe
  C:\Windows\System\zUWqQcD.exe
  2⤵
  PID:7184
- C:\Windows\System\mOVumbQ.exe
  C:\Windows\System\mOVumbQ.exe
  2⤵
  PID:7200
- C:\Windows\System\qbozASo.exe
  C:\Windows\System\qbozASo.exe
  2⤵
  PID:7216
- C:\Windows\System\spnbXhV.exe
  C:\Windows\System\spnbXhV.exe
  2⤵
  PID:7232
- C:\Windows\System\mpDSXjU.exe
  C:\Windows\System\mpDSXjU.exe
  2⤵
  PID:7248
- C:\Windows\System\sEwOYmD.exe
  C:\Windows\System\sEwOYmD.exe
  2⤵
  PID:7264
- C:\Windows\System\BeHJACX.exe
  C:\Windows\System\BeHJACX.exe
  2⤵
  PID:7280
- C:\Windows\System\QfSMFuW.exe
  C:\Windows\System\QfSMFuW.exe
  2⤵
  PID:7296
- C:\Windows\System\csNdVbi.exe
  C:\Windows\System\csNdVbi.exe
  2⤵
  PID:7312
- C:\Windows\System\bceDsjv.exe
  C:\Windows\System\bceDsjv.exe
  2⤵
  PID:7328
- C:\Windows\System\dDcGGAB.exe
  C:\Windows\System\dDcGGAB.exe
  2⤵
  PID:7344
- C:\Windows\System\uHBbisv.exe
  C:\Windows\System\uHBbisv.exe
  2⤵
  PID:7360
- C:\Windows\System\oEctUva.exe
  C:\Windows\System\oEctUva.exe
  2⤵
  PID:7376
- C:\Windows\System\PErniIu.exe
  C:\Windows\System\PErniIu.exe
  2⤵
  PID:7392
- C:\Windows\System\lQoPeFi.exe
  C:\Windows\System\lQoPeFi.exe
  2⤵
  PID:7408
- C:\Windows\System\mooNhcj.exe
  C:\Windows\System\mooNhcj.exe
  2⤵
  PID:7424
- C:\Windows\System\ioBuiqo.exe
  C:\Windows\System\ioBuiqo.exe
  2⤵
  PID:7440
- C:\Windows\System\CPrmPyj.exe
  C:\Windows\System\CPrmPyj.exe
  2⤵
  PID:7456
- C:\Windows\System\GpCJxiS.exe
  C:\Windows\System\GpCJxiS.exe
  2⤵
  PID:7472
- C:\Windows\System\PeGmFRg.exe
  C:\Windows\System\PeGmFRg.exe
  2⤵
  PID:7488
- C:\Windows\System\MXgALVo.exe
  C:\Windows\System\MXgALVo.exe
  2⤵
  PID:7504
- C:\Windows\System\uwQfBLC.exe
  C:\Windows\System\uwQfBLC.exe
  2⤵
  PID:7520
- C:\Windows\System\idnlEJH.exe
  C:\Windows\System\idnlEJH.exe
  2⤵
  PID:7536
- C:\Windows\System\oQXRyQr.exe
  C:\Windows\System\oQXRyQr.exe
  2⤵
  PID:7552
- C:\Windows\System\CVPNedI.exe
  C:\Windows\System\CVPNedI.exe
  2⤵
  PID:7568
- C:\Windows\System\yuXvgNO.exe
  C:\Windows\System\yuXvgNO.exe
  2⤵
  PID:7584
- C:\Windows\System\bgxVTgs.exe
  C:\Windows\System\bgxVTgs.exe
  2⤵
  PID:7600
- C:\Windows\System\EihgZqv.exe
  C:\Windows\System\EihgZqv.exe
  2⤵
  PID:7616
- C:\Windows\System\iiIwqwe.exe
  C:\Windows\System\iiIwqwe.exe
  2⤵
  PID:7644
- C:\Windows\System\TPoUpEg.exe
  C:\Windows\System\TPoUpEg.exe
  2⤵
  PID:7660
- C:\Windows\System\EAqktJu.exe
  C:\Windows\System\EAqktJu.exe
  2⤵
  PID:7676
- C:\Windows\System\QPuFNZp.exe
  C:\Windows\System\QPuFNZp.exe
  2⤵
  PID:7692
- C:\Windows\System\InpmlaX.exe
  C:\Windows\System\InpmlaX.exe
  2⤵
  PID:7708
- C:\Windows\System\RqRaHDU.exe
  C:\Windows\System\RqRaHDU.exe
  2⤵
  PID:7724
- C:\Windows\System\cGkrLSb.exe
  C:\Windows\System\cGkrLSb.exe
  2⤵
  PID:7740
- C:\Windows\System\ptQdZOT.exe
  C:\Windows\System\ptQdZOT.exe
  2⤵
  PID:7756
- C:\Windows\System\bxKcxwa.exe
  C:\Windows\System\bxKcxwa.exe
  2⤵
  PID:7772
- C:\Windows\System\gNnUVlZ.exe
  C:\Windows\System\gNnUVlZ.exe
  2⤵
  PID:7788
- C:\Windows\System\bgSFHpa.exe
  C:\Windows\System\bgSFHpa.exe
  2⤵
  PID:7804
- C:\Windows\System\btlPNTk.exe
  C:\Windows\System\btlPNTk.exe
  2⤵
  PID:7820
- C:\Windows\System\sYHvaYL.exe
  C:\Windows\System\sYHvaYL.exe
  2⤵
  PID:7836
- C:\Windows\System\RCrhyDf.exe
  C:\Windows\System\RCrhyDf.exe
  2⤵
  PID:7852
- C:\Windows\System\HlAXOzm.exe
  C:\Windows\System\HlAXOzm.exe
  2⤵
  PID:7868
- C:\Windows\System\ZOqjBMr.exe
  C:\Windows\System\ZOqjBMr.exe
  2⤵
  PID:7884
- C:\Windows\System\ESlnkhR.exe
  C:\Windows\System\ESlnkhR.exe
  2⤵
  PID:7900
- C:\Windows\System\QJMmBBp.exe
  C:\Windows\System\QJMmBBp.exe
  2⤵
  PID:7916
- C:\Windows\System\ZTQZyox.exe
  C:\Windows\System\ZTQZyox.exe
  2⤵
  PID:7932
- C:\Windows\System\HIbpqhU.exe
  C:\Windows\System\HIbpqhU.exe
  2⤵
  PID:7948
- C:\Windows\System\iJjeMYQ.exe
  C:\Windows\System\iJjeMYQ.exe
  2⤵
  PID:7964
- C:\Windows\System\EORyofM.exe
  C:\Windows\System\EORyofM.exe
  2⤵
  PID:7980
- C:\Windows\System\byuWhvJ.exe
  C:\Windows\System\byuWhvJ.exe
  2⤵
  PID:8000
- C:\Windows\System\bGqbDLl.exe
  C:\Windows\System\bGqbDLl.exe
  2⤵
  PID:8016
- C:\Windows\System\TQgjNMW.exe
  C:\Windows\System\TQgjNMW.exe
  2⤵
  PID:8032
- C:\Windows\System\QgtiWwr.exe
  C:\Windows\System\QgtiWwr.exe
  2⤵
  PID:8048
- C:\Windows\System\QToChiI.exe
  C:\Windows\System\QToChiI.exe
  2⤵
  PID:8064
- C:\Windows\System\IMaKNvh.exe
  C:\Windows\System\IMaKNvh.exe
  2⤵
  PID:8080
- C:\Windows\System\ApFNzzh.exe
  C:\Windows\System\ApFNzzh.exe
  2⤵
  PID:8096
- C:\Windows\System\lnfduzq.exe
  C:\Windows\System\lnfduzq.exe
  2⤵
  PID:8112
- C:\Windows\System\iJfLfMg.exe
  C:\Windows\System\iJfLfMg.exe
  2⤵
  PID:8128
- C:\Windows\System\vFEuHwM.exe
  C:\Windows\System\vFEuHwM.exe
  2⤵
  PID:8144
- C:\Windows\System\qwDGkTY.exe
  C:\Windows\System\qwDGkTY.exe
  2⤵
  PID:8160
- C:\Windows\System\aSgrtgZ.exe
  C:\Windows\System\aSgrtgZ.exe
  2⤵
  PID:8176
- C:\Windows\System\telechJ.exe
  C:\Windows\System\telechJ.exe
  2⤵
  PID:7176
- C:\Windows\System\GKHsRKB.exe
  C:\Windows\System\GKHsRKB.exe
  2⤵
  PID:6988
- C:\Windows\System\WmmLYAJ.exe
  C:\Windows\System\WmmLYAJ.exe
  2⤵
  PID:7276
- C:\Windows\System\XeFJTDE.exe
  C:\Windows\System\XeFJTDE.exe
  2⤵
  PID:7372
- C:\Windows\System\JjBWFsf.exe
  C:\Windows\System\JjBWFsf.exe
  2⤵
  PID:7432
- C:\Windows\System\XfroLMr.exe
  C:\Windows\System\XfroLMr.exe
  2⤵
  PID:7496
- C:\Windows\System\TeKQjkB.exe
  C:\Windows\System\TeKQjkB.exe
  2⤵
  PID:6500
- C:\Windows\System\xdUWind.exe
  C:\Windows\System\xdUWind.exe
  2⤵
  PID:7624
- C:\Windows\System\VIDMfZO.exe
  C:\Windows\System\VIDMfZO.exe
  2⤵
  PID:6000
- C:\Windows\System\PinIOQg.exe
  C:\Windows\System\PinIOQg.exe
  2⤵
  PID:7192
- C:\Windows\System\HcOMvOC.exe
  C:\Windows\System\HcOMvOC.exe
  2⤵
  PID:7384
- C:\Windows\System\mAtcwrg.exe
  C:\Windows\System\mAtcwrg.exe
  2⤵
  PID:7576
- C:\Windows\System\JSmMyxB.exe
  C:\Windows\System\JSmMyxB.exe
  2⤵
  PID:7228
- C:\Windows\System\zUFDRaB.exe
  C:\Windows\System\zUFDRaB.exe
  2⤵
  PID:7292
- C:\Windows\System\LwKpgod.exe
  C:\Windows\System\LwKpgod.exe
  2⤵
  PID:7388
- C:\Windows\System\rPJdKpb.exe
  C:\Windows\System\rPJdKpb.exe
  2⤵
  PID:7452
- C:\Windows\System\XZTHMdw.exe
  C:\Windows\System\XZTHMdw.exe
  2⤵
  PID:7544
- C:\Windows\System\IxVizFa.exe
  C:\Windows\System\IxVizFa.exe
  2⤵
  PID:7612
- C:\Windows\System\iNeKGII.exe
  C:\Windows\System\iNeKGII.exe
  2⤵
  PID:7640
- C:\Windows\System\zIMfrhH.exe
  C:\Windows\System\zIMfrhH.exe
  2⤵
  PID:7700
- C:\Windows\System\BUBXmjz.exe
  C:\Windows\System\BUBXmjz.exe
  2⤵
  PID:7652
- C:\Windows\System\dniqktv.exe
  C:\Windows\System\dniqktv.exe
  2⤵
  PID:7768
- C:\Windows\System\XETyBIM.exe
  C:\Windows\System\XETyBIM.exe
  2⤵
  PID:7832
- C:\Windows\System\xBiQtMz.exe
  C:\Windows\System\xBiQtMz.exe
  2⤵
  PID:7924
- C:\Windows\System\pGCjJyq.exe
  C:\Windows\System\pGCjJyq.exe
  2⤵
  PID:7960
- C:\Windows\System\rYpvolP.exe
  C:\Windows\System\rYpvolP.exe
  2⤵
  PID:7720
- C:\Windows\System\jjpHblF.exe
  C:\Windows\System\jjpHblF.exe
  2⤵
  PID:7748
- C:\Windows\System\BMLeZyq.exe
  C:\Windows\System\BMLeZyq.exe
  2⤵
  PID:7816
- C:\Windows\System\wnFXxNj.exe
  C:\Windows\System\wnFXxNj.exe
  2⤵
  PID:8060
- C:\Windows\System\jlperxp.exe
  C:\Windows\System\jlperxp.exe
  2⤵
  PID:7876
- C:\Windows\System\yhMjfOs.exe
  C:\Windows\System\yhMjfOs.exe
  2⤵
  PID:7940
- C:\Windows\System\tsBIoRU.exe
  C:\Windows\System\tsBIoRU.exe
  2⤵
  PID:8008
- C:\Windows\System\Fpcwzsh.exe
  C:\Windows\System\Fpcwzsh.exe
  2⤵
  PID:8152
- C:\Windows\System\NhTLPFU.exe
  C:\Windows\System\NhTLPFU.exe
  2⤵
  PID:8188
- C:\Windows\System\imxIgMa.exe
  C:\Windows\System\imxIgMa.exe
  2⤵
  PID:7368
- C:\Windows\System\MrZOWIE.exe
  C:\Windows\System\MrZOWIE.exe
  2⤵
  PID:8168
- C:\Windows\System\VPScuaI.exe
  C:\Windows\System\VPScuaI.exe
  2⤵
  PID:7308
- C:\Windows\System\pyHiJBV.exe
  C:\Windows\System\pyHiJBV.exe
  2⤵
  PID:6708
- C:\Windows\System\jMDItDp.exe
  C:\Windows\System\jMDItDp.exe
  2⤵
  PID:7040
- C:\Windows\System\SVGIsfX.exe
  C:\Windows\System\SVGIsfX.exe
  2⤵
  PID:7500
- C:\Windows\System\ZuKogai.exe
  C:\Windows\System\ZuKogai.exe
  2⤵
  PID:7196
- C:\Windows\System\gQyMEJD.exe
  C:\Windows\System\gQyMEJD.exe
  2⤵
  PID:7516
- C:\Windows\System\mzrJIvj.exe
  C:\Windows\System\mzrJIvj.exe
  2⤵
  PID:7448
- C:\Windows\System\rUjMKbX.exe
  C:\Windows\System\rUjMKbX.exe
  2⤵
  PID:7988
- C:\Windows\System\YaxEcFu.exe
  C:\Windows\System\YaxEcFu.exe
  2⤵
  PID:7956
- C:\Windows\System\ogblgNg.exe
  C:\Windows\System\ogblgNg.exe
  2⤵
  PID:8056
- C:\Windows\System\onuDGTR.exe
  C:\Windows\System\onuDGTR.exe
  2⤵
  PID:7908
- C:\Windows\System\DpLhxoT.exe
  C:\Windows\System\DpLhxoT.exe
  2⤵
  PID:7896
- C:\Windows\System\iWknFbi.exe
  C:\Windows\System\iWknFbi.exe
  2⤵
  PID:7764
- C:\Windows\System\QoJJtNJ.exe
  C:\Windows\System\QoJJtNJ.exe
  2⤵
  PID:7784
- C:\Windows\System\IwZoQBF.exe
  C:\Windows\System\IwZoQBF.exe
  2⤵
  PID:7976
- C:\Windows\System\icazXbV.exe
  C:\Windows\System\icazXbV.exe
  2⤵
  PID:8076
- C:\Windows\System\oTiuNxY.exe
  C:\Windows\System\oTiuNxY.exe
  2⤵
  PID:7304
- C:\Windows\System\WmpebvY.exe
  C:\Windows\System\WmpebvY.exe
  2⤵
  PID:7028
- C:\Windows\System\mrNUICi.exe
  C:\Windows\System\mrNUICi.exe
  2⤵
  PID:6940
- C:\Windows\System\fovbrAz.exe
  C:\Windows\System\fovbrAz.exe
  2⤵
  PID:7828
- C:\Windows\System\IUHUMkE.exe
  C:\Windows\System\IUHUMkE.exe
  2⤵
  PID:7672
- C:\Windows\System\kQwMlRq.exe
  C:\Windows\System\kQwMlRq.exe
  2⤵
  PID:7844
- C:\Windows\System\RPVWhjZ.exe
  C:\Windows\System\RPVWhjZ.exe
  2⤵
  PID:7528
- C:\Windows\System\UjmHPnh.exe
  C:\Windows\System\UjmHPnh.exe
  2⤵
  PID:5388
- C:\Windows\System\kTWhaVa.exe
  C:\Windows\System\kTWhaVa.exe
  2⤵
  PID:7892
- C:\Windows\System\NQwpgpZ.exe
  C:\Windows\System\NQwpgpZ.exe
  2⤵
  PID:7656
- C:\Windows\System\HDzCMvX.exe
  C:\Windows\System\HDzCMvX.exe
  2⤵
  PID:7800
- C:\Windows\System\jYOFnvb.exe
  C:\Windows\System\jYOFnvb.exe
  2⤵
  PID:7356
- C:\Windows\System\JupoOiO.exe
  C:\Windows\System\JupoOiO.exe
  2⤵
  PID:8108
- C:\Windows\System\ieuFjtj.exe
  C:\Windows\System\ieuFjtj.exe
  2⤵
  PID:7668
- C:\Windows\System\mavKSEu.exe
  C:\Windows\System\mavKSEu.exe
  2⤵
  PID:8140
- C:\Windows\System\DjdOMRM.exe
  C:\Windows\System\DjdOMRM.exe
  2⤵
  PID:8196
- C:\Windows\System\cqMwIKi.exe
  C:\Windows\System\cqMwIKi.exe
  2⤵
  PID:8212
- C:\Windows\System\jEIAwTY.exe
  C:\Windows\System\jEIAwTY.exe
  2⤵
  PID:8228
- C:\Windows\System\vzlnPWm.exe
  C:\Windows\System\vzlnPWm.exe
  2⤵
  PID:8244
- C:\Windows\System\fsyNbtD.exe
  C:\Windows\System\fsyNbtD.exe
  2⤵
  PID:8260
- C:\Windows\System\pSTPKzr.exe
  C:\Windows\System\pSTPKzr.exe
  2⤵
  PID:8276
- C:\Windows\System\dVkeMnM.exe
  C:\Windows\System\dVkeMnM.exe
  2⤵
  PID:8292
- C:\Windows\System\WSVmnet.exe
  C:\Windows\System\WSVmnet.exe
  2⤵
  PID:8308
- C:\Windows\System\UxfehuT.exe
  C:\Windows\System\UxfehuT.exe
  2⤵
  PID:8324
- C:\Windows\System\WDBwOvB.exe
  C:\Windows\System\WDBwOvB.exe
  2⤵
  PID:8340
- C:\Windows\System\tHHhLJj.exe
  C:\Windows\System\tHHhLJj.exe
  2⤵
  PID:8356
- C:\Windows\System\AJrRIvt.exe
  C:\Windows\System\AJrRIvt.exe
  2⤵
  PID:8372
- C:\Windows\System\AAsOtCv.exe
  C:\Windows\System\AAsOtCv.exe
  2⤵
  PID:8388
- C:\Windows\System\IuBXLTT.exe
  C:\Windows\System\IuBXLTT.exe
  2⤵
  PID:8404
- C:\Windows\System\pjilqBe.exe
  C:\Windows\System\pjilqBe.exe
  2⤵
  PID:8420
- C:\Windows\System\ulVpRev.exe
  C:\Windows\System\ulVpRev.exe
  2⤵
  PID:8436
- C:\Windows\System\uiJhoWu.exe
  C:\Windows\System\uiJhoWu.exe
  2⤵
  PID:8452
- C:\Windows\System\MOdxerw.exe
  C:\Windows\System\MOdxerw.exe
  2⤵
  PID:8468
- C:\Windows\System\BCcVpJJ.exe
  C:\Windows\System\BCcVpJJ.exe
  2⤵
  PID:8484
- C:\Windows\System\WVudlKK.exe
  C:\Windows\System\WVudlKK.exe
  2⤵
  PID:8500
- C:\Windows\System\UhKAAtw.exe
  C:\Windows\System\UhKAAtw.exe
  2⤵
  PID:8516
- C:\Windows\System\WvFOydW.exe
  C:\Windows\System\WvFOydW.exe
  2⤵
  PID:8536
- C:\Windows\System\EAzGVAV.exe
  C:\Windows\System\EAzGVAV.exe
  2⤵
  PID:8552
- C:\Windows\System\iMREead.exe
  C:\Windows\System\iMREead.exe
  2⤵
  PID:8568
- C:\Windows\System\UOzTDJT.exe
  C:\Windows\System\UOzTDJT.exe
  2⤵
  PID:8584
- C:\Windows\System\WsHJmCy.exe
  C:\Windows\System\WsHJmCy.exe
  2⤵
  PID:8600
- C:\Windows\System\MlaibEn.exe
  C:\Windows\System\MlaibEn.exe
  2⤵
  PID:8624
- C:\Windows\System\BYInNzQ.exe
  C:\Windows\System\BYInNzQ.exe
  2⤵
  PID:8696
- C:\Windows\System\RCUfBKI.exe
  C:\Windows\System\RCUfBKI.exe
  2⤵
  PID:8712
- C:\Windows\System\lTOdRpA.exe
  C:\Windows\System\lTOdRpA.exe
  2⤵
  PID:8728
- C:\Windows\System\pzcmFPR.exe
  C:\Windows\System\pzcmFPR.exe
  2⤵
  PID:8792
- C:\Windows\System\oPzZiTV.exe
  C:\Windows\System\oPzZiTV.exe
  2⤵
  PID:8808
- C:\Windows\System\dwFzVzV.exe
  C:\Windows\System\dwFzVzV.exe
  2⤵
  PID:8828
- C:\Windows\System\aSGchLZ.exe
  C:\Windows\System\aSGchLZ.exe
  2⤵
  PID:8844
- C:\Windows\System\dxzywsi.exe
  C:\Windows\System\dxzywsi.exe
  2⤵
  PID:8860
- C:\Windows\System\GDoONRR.exe
  C:\Windows\System\GDoONRR.exe
  2⤵
  PID:8876
- C:\Windows\System\snHnPVI.exe
  C:\Windows\System\snHnPVI.exe
  2⤵
  PID:8892
- C:\Windows\System\dgakqMX.exe
  C:\Windows\System\dgakqMX.exe
  2⤵
  PID:8908
- C:\Windows\System\TYjiYak.exe
  C:\Windows\System\TYjiYak.exe
  2⤵
  PID:8924
- C:\Windows\System\KEtruCe.exe
  C:\Windows\System\KEtruCe.exe
  2⤵
  PID:8940
- C:\Windows\System\wCXYzsl.exe
  C:\Windows\System\wCXYzsl.exe
  2⤵
  PID:8956
- C:\Windows\System\NajgQXZ.exe
  C:\Windows\System\NajgQXZ.exe
  2⤵
  PID:8972
- C:\Windows\System\ogqJxOE.exe
  C:\Windows\System\ogqJxOE.exe
  2⤵
  PID:8988
- C:\Windows\System\SbzYxXG.exe
  C:\Windows\System\SbzYxXG.exe
  2⤵
  PID:9004
- C:\Windows\System\TDgImXJ.exe
  C:\Windows\System\TDgImXJ.exe
  2⤵
  PID:9020
- C:\Windows\System\OFUzcok.exe
  C:\Windows\System\OFUzcok.exe
  2⤵
  PID:9036
- C:\Windows\System\JMgOMgU.exe
  C:\Windows\System\JMgOMgU.exe
  2⤵
  PID:9052
- C:\Windows\System\SIllmVS.exe
  C:\Windows\System\SIllmVS.exe
  2⤵
  PID:9068
- C:\Windows\System\DqexyGo.exe
  C:\Windows\System\DqexyGo.exe
  2⤵
  PID:9084
- C:\Windows\System\GGPtAEm.exe
  C:\Windows\System\GGPtAEm.exe
  2⤵
  PID:9100
- C:\Windows\System\JcihaXK.exe
  C:\Windows\System\JcihaXK.exe
  2⤵
  PID:9116
- C:\Windows\System\nuKSUaX.exe
  C:\Windows\System\nuKSUaX.exe
  2⤵
  PID:9132
- C:\Windows\System\GnOardc.exe
  C:\Windows\System\GnOardc.exe
  2⤵
  PID:9148
- C:\Windows\System\OFqbXsF.exe
  C:\Windows\System\OFqbXsF.exe
  2⤵
  PID:9164
- C:\Windows\System\LcKIZlQ.exe
  C:\Windows\System\LcKIZlQ.exe
  2⤵
  PID:9180
- C:\Windows\System\kWICacl.exe
  C:\Windows\System\kWICacl.exe
  2⤵
  PID:9196
- C:\Windows\System\pkkOJBp.exe
  C:\Windows\System\pkkOJBp.exe
  2⤵
  PID:9212
- C:\Windows\System\SjzOYTt.exe
  C:\Windows\System\SjzOYTt.exe
  2⤵
  PID:8204
- C:\Windows\System\HGeogyx.exe
  C:\Windows\System\HGeogyx.exe
  2⤵
  PID:6760
- C:\Windows\System\vLfCcET.exe
  C:\Windows\System\vLfCcET.exe
  2⤵
  PID:7560
- C:\Windows\System\BDOxrmB.exe
  C:\Windows\System\BDOxrmB.exe
  2⤵
  PID:8220
- C:\Windows\System\QtVAoyE.exe
  C:\Windows\System\QtVAoyE.exe
  2⤵
  PID:8336
- C:\Windows\System\BGMGRCS.exe
  C:\Windows\System\BGMGRCS.exe
  2⤵
  PID:8368
- C:\Windows\System\HMWpAgr.exe
  C:\Windows\System\HMWpAgr.exe
  2⤵
  PID:8284
- C:\Windows\System\FExcFpT.exe
  C:\Windows\System\FExcFpT.exe
  2⤵
  PID:8252
- C:\Windows\System\gaZCxQo.exe
  C:\Windows\System\gaZCxQo.exe
  2⤵
  PID:8380
- C:\Windows\System\EubbluN.exe
  C:\Windows\System\EubbluN.exe
  2⤵
  PID:8432
- C:\Windows\System\xQzrszK.exe
  C:\Windows\System\xQzrszK.exe
  2⤵
  PID:8460
- C:\Windows\System\dNhgTyc.exe
  C:\Windows\System\dNhgTyc.exe
  2⤵
  PID:8512
- C:\Windows\System\OcXIOeu.exe
  C:\Windows\System\OcXIOeu.exe
  2⤵
  PID:8448
- C:\Windows\System\lUdNmNW.exe
  C:\Windows\System\lUdNmNW.exe
  2⤵
  PID:8564
- C:\Windows\System\WCezBFg.exe
  C:\Windows\System\WCezBFg.exe
  2⤵
  PID:8580
- C:\Windows\System\ohZhSqw.exe
  C:\Windows\System\ohZhSqw.exe
  2⤵
  PID:8616
- C:\Windows\System\sFDkTGI.exe
  C:\Windows\System\sFDkTGI.exe
  2⤵
  PID:8644
- C:\Windows\System\vsWzHsx.exe
  C:\Windows\System\vsWzHsx.exe
  2⤵
  PID:8660
- C:\Windows\System\rtbTINz.exe
  C:\Windows\System\rtbTINz.exe
  2⤵
  PID:8680
- C:\Windows\System\SPSrezi.exe
  C:\Windows\System\SPSrezi.exe
  2⤵
  PID:8720
- C:\Windows\System\nPXxTzU.exe
  C:\Windows\System\nPXxTzU.exe
  2⤵
  PID:8788
- C:\Windows\System\IhOdGyU.exe
  C:\Windows\System\IhOdGyU.exe
  2⤵
  PID:8744
- C:\Windows\System\uaRorQx.exe
  C:\Windows\System\uaRorQx.exe
  2⤵
  PID:8756
- C:\Windows\System\IUWwOiN.exe
  C:\Windows\System\IUWwOiN.exe
  2⤵
  PID:8776
- C:\Windows\System\QysmYDE.exe
  C:\Windows\System\QysmYDE.exe
  2⤵
  PID:8800
- C:\Windows\System\wXXvdpH.exe
  C:\Windows\System\wXXvdpH.exe
  2⤵
  PID:8836
- C:\Windows\System\CSoeRJK.exe
  C:\Windows\System\CSoeRJK.exe
  2⤵
  PID:8872
- C:\Windows\System\riMXhNI.exe
  C:\Windows\System\riMXhNI.exe
  2⤵
  PID:8884
- C:\Windows\System\lYPJIes.exe
  C:\Windows\System\lYPJIes.exe
  2⤵
  PID:8852
- C:\Windows\System\EMByshw.exe
  C:\Windows\System\EMByshw.exe
  2⤵
  PID:8952
- C:\Windows\System\lfSzVOF.exe
  C:\Windows\System\lfSzVOF.exe
  2⤵
  PID:8980
- C:\Windows\System\AgPcSOz.exe
  C:\Windows\System\AgPcSOz.exe
  2⤵
  PID:9060
- C:\Windows\System\tLapVPc.exe
  C:\Windows\System\tLapVPc.exe
  2⤵
  PID:9092
- C:\Windows\System\UPdmXCR.exe
  C:\Windows\System\UPdmXCR.exe
  2⤵
  PID:9016
- C:\Windows\System\WPEvkCt.exe
  C:\Windows\System\WPEvkCt.exe
  2⤵
  PID:9112
- C:\Windows\System\hvJWdTP.exe
  C:\Windows\System\hvJWdTP.exe
  2⤵
  PID:9160
- C:\Windows\System\XEkkgnh.exe
  C:\Windows\System\XEkkgnh.exe
  2⤵
  PID:8208
- C:\Windows\System\vZoBAfD.exe
  C:\Windows\System\vZoBAfD.exe
  2⤵
  PID:7244
- C:\Windows\System\zePuPpX.exe
  C:\Windows\System\zePuPpX.exe
  2⤵
  PID:8352
- C:\Windows\System\hxRVVoR.exe
  C:\Windows\System\hxRVVoR.exe
  2⤵
  PID:9140
- C:\Windows\System\Icgaufd.exe
  C:\Windows\System\Icgaufd.exe
  2⤵
  PID:8400
- C:\Windows\System\ebNtWTv.exe
  C:\Windows\System\ebNtWTv.exe
  2⤵
  PID:8316
- C:\Windows\System\zaoRXxM.exe
  C:\Windows\System\zaoRXxM.exe
  2⤵
  PID:8300
- C:\Windows\System\DbhwUqu.exe
  C:\Windows\System\DbhwUqu.exe
  2⤵
  PID:8496
- C:\Windows\System\AWOFANK.exe
  C:\Windows\System\AWOFANK.exe
  2⤵
  PID:8596
- C:\Windows\System\pDsyRYH.exe
  C:\Windows\System\pDsyRYH.exe
  2⤵
  PID:8640
- C:\Windows\System\qDdHiSZ.exe
  C:\Windows\System\qDdHiSZ.exe
  2⤵
  PID:8656
- C:\Windows\System\nsLmZoB.exe
  C:\Windows\System\nsLmZoB.exe
  2⤵
  PID:8724
- C:\Windows\System\XwPMnSA.exe
  C:\Windows\System\XwPMnSA.exe
  2⤵
  PID:8648
- C:\Windows\System\RSrZVXk.exe
  C:\Windows\System\RSrZVXk.exe
  2⤵
  PID:8784
- C:\Windows\System\XnESYlY.exe
  C:\Windows\System\XnESYlY.exe
  2⤵
  PID:8840
- C:\Windows\System\HTKajaC.exe
  C:\Windows\System\HTKajaC.exe
  2⤵
  PID:9000
- C:\Windows\System\VIADUTX.exe
  C:\Windows\System\VIADUTX.exe
  2⤵
  PID:8900
- C:\Windows\System\fUiwswx.exe
  C:\Windows\System\fUiwswx.exe
  2⤵
  PID:9044
- C:\Windows\System\BviybFi.exe
  C:\Windows\System\BviybFi.exe
  2⤵
  PID:8948
- C:\Windows\System\fUjZKOp.exe
  C:\Windows\System\fUjZKOp.exe
  2⤵
  PID:9124
- C:\Windows\System\UCiMmSk.exe
  C:\Windows\System\UCiMmSk.exe
  2⤵
  PID:7608
- C:\Windows\System\GUAHnIA.exe
  C:\Windows\System\GUAHnIA.exe
  2⤵
  PID:8224
- C:\Windows\System\TRyxEBZ.exe
  C:\Windows\System\TRyxEBZ.exe
  2⤵
  PID:8576
- C:\Windows\System\SrGRtKs.exe
  C:\Windows\System\SrGRtKs.exe
  2⤵
  PID:7320
- C:\Windows\System\vGFYsvY.exe
  C:\Windows\System\vGFYsvY.exe
  2⤵
  PID:8464
- C:\Windows\System\IoPAirA.exe
  C:\Windows\System\IoPAirA.exe
  2⤵
  PID:8692
- C:\Windows\System\XAIyOkx.exe
  C:\Windows\System\XAIyOkx.exe
  2⤵
  PID:8820
- C:\Windows\System\ZgdBgRf.exe
  C:\Windows\System\ZgdBgRf.exe
  2⤵
  PID:8736
- C:\Windows\System\BVpyBcK.exe
  C:\Windows\System\BVpyBcK.exe
  2⤵
  PID:9032
- C:\Windows\System\umqpbyY.exe
  C:\Windows\System\umqpbyY.exe
  2⤵
  PID:9204
- C:\Windows\System\KqiPOcN.exe
  C:\Windows\System\KqiPOcN.exe
  2⤵
  PID:8524
- C:\Windows\System\LhApqBK.exe
  C:\Windows\System\LhApqBK.exe
  2⤵
  PID:8888
- C:\Windows\System\hUodrUQ.exe
  C:\Windows\System\hUodrUQ.exe
  2⤵
  PID:8760
- C:\Windows\System\fGSkNxb.exe
  C:\Windows\System\fGSkNxb.exe
  2⤵
  PID:9080
- C:\Windows\System\QlWjrNr.exe
  C:\Windows\System\QlWjrNr.exe
  2⤵
  PID:9188
- C:\Windows\System\LpIqrXr.exe
  C:\Windows\System\LpIqrXr.exe
  2⤵
  PID:9232
- C:\Windows\System\QQLuiTi.exe
  C:\Windows\System\QQLuiTi.exe
  2⤵
  PID:9248
- C:\Windows\System\xHUaQdq.exe
  C:\Windows\System\xHUaQdq.exe
  2⤵
  PID:9264
- C:\Windows\System\aVdYVGX.exe
  C:\Windows\System\aVdYVGX.exe
  2⤵
  PID:9280
- C:\Windows\System\oMyJhcJ.exe
  C:\Windows\System\oMyJhcJ.exe
  2⤵
  PID:9296
- C:\Windows\System\nWKZzkq.exe
  C:\Windows\System\nWKZzkq.exe
  2⤵
  PID:9312
- C:\Windows\System\UoRdFwe.exe
  C:\Windows\System\UoRdFwe.exe
  2⤵
  PID:9328
- C:\Windows\System\KYNvjZX.exe
  C:\Windows\System\KYNvjZX.exe
  2⤵
  PID:9344
- C:\Windows\System\nBitkBD.exe
  C:\Windows\System\nBitkBD.exe
  2⤵
  PID:9360
- C:\Windows\System\eGxDEIf.exe
  C:\Windows\System\eGxDEIf.exe
  2⤵
  PID:9376
- C:\Windows\System\qbzhvTD.exe
  C:\Windows\System\qbzhvTD.exe
  2⤵
  PID:9392
- C:\Windows\System\qFwZiMK.exe
  C:\Windows\System\qFwZiMK.exe
  2⤵
  PID:9408
- C:\Windows\System\BYJyWoR.exe
  C:\Windows\System\BYJyWoR.exe
  2⤵
  PID:9424
- C:\Windows\System\JgEEUly.exe
  C:\Windows\System\JgEEUly.exe
  2⤵
  PID:9440
- C:\Windows\System\SsqdCGX.exe
  C:\Windows\System\SsqdCGX.exe
  2⤵
  PID:9456
- C:\Windows\System\jGHifLg.exe
  C:\Windows\System\jGHifLg.exe
  2⤵
  PID:9472
- C:\Windows\System\NiSwMQr.exe
  C:\Windows\System\NiSwMQr.exe
  2⤵
  PID:9488
- C:\Windows\System\toHjxAE.exe
  C:\Windows\System\toHjxAE.exe
  2⤵
  PID:9504
- C:\Windows\System\JigkMit.exe
  C:\Windows\System\JigkMit.exe
  2⤵
  PID:9520
- C:\Windows\System\iPijySY.exe
  C:\Windows\System\iPijySY.exe
  2⤵
  PID:9536
- C:\Windows\System\oegdpCc.exe
  C:\Windows\System\oegdpCc.exe
  2⤵
  PID:9552
- C:\Windows\System\jZOufGz.exe
  C:\Windows\System\jZOufGz.exe
  2⤵
  PID:9568
- C:\Windows\System\rVaHHMN.exe
  C:\Windows\System\rVaHHMN.exe
  2⤵
  PID:9584
- C:\Windows\System\MfdGKjY.exe
  C:\Windows\System\MfdGKjY.exe
  2⤵
  PID:9600
- C:\Windows\System\svOiBRv.exe
  C:\Windows\System\svOiBRv.exe
  2⤵
  PID:9616
- C:\Windows\System\ABUdAUp.exe
  C:\Windows\System\ABUdAUp.exe
  2⤵
  PID:9632
- C:\Windows\System\xQWNoiO.exe
  C:\Windows\System\xQWNoiO.exe
  2⤵
  PID:9648
- C:\Windows\System\uvnRwrw.exe
  C:\Windows\System\uvnRwrw.exe
  2⤵
  PID:9664
- C:\Windows\System\tJvrvAS.exe
  C:\Windows\System\tJvrvAS.exe
  2⤵
  PID:9680
- C:\Windows\System\bhmzbMU.exe
  C:\Windows\System\bhmzbMU.exe
  2⤵
  PID:9696
- C:\Windows\System\QDYurZj.exe
  C:\Windows\System\QDYurZj.exe
  2⤵
  PID:9712
- C:\Windows\System\aAgBqrR.exe
  C:\Windows\System\aAgBqrR.exe
  2⤵
  PID:9728
- C:\Windows\System\jWMwFgF.exe
  C:\Windows\System\jWMwFgF.exe
  2⤵
  PID:9744
- C:\Windows\System\fXfEBkt.exe
  C:\Windows\System\fXfEBkt.exe
  2⤵
  PID:9760
- C:\Windows\System\kOYDXGn.exe
  C:\Windows\System\kOYDXGn.exe
  2⤵
  PID:9776
- C:\Windows\System\IZktMjT.exe
  C:\Windows\System\IZktMjT.exe
  2⤵
  PID:9792
- C:\Windows\System\SBlpbYm.exe
  C:\Windows\System\SBlpbYm.exe
  2⤵
  PID:9808
- C:\Windows\System\mMBfbMj.exe
  C:\Windows\System\mMBfbMj.exe
  2⤵
  PID:9824
- C:\Windows\System\NbgWqVH.exe
  C:\Windows\System\NbgWqVH.exe
  2⤵
  PID:9840
- C:\Windows\System\jZSroer.exe
  C:\Windows\System\jZSroer.exe
  2⤵
  PID:9856
- C:\Windows\System\tLKRDFO.exe
  C:\Windows\System\tLKRDFO.exe
  2⤵
  PID:9872
- C:\Windows\System\BwRSZsz.exe
  C:\Windows\System\BwRSZsz.exe
  2⤵
  PID:9888
- C:\Windows\System\fWsnIsP.exe
  C:\Windows\System\fWsnIsP.exe
  2⤵
  PID:9904
- C:\Windows\System\fUMBvux.exe
  C:\Windows\System\fUMBvux.exe
  2⤵
  PID:9920
- C:\Windows\System\gRmXOZb.exe
  C:\Windows\System\gRmXOZb.exe
  2⤵
  PID:9936
- C:\Windows\System\jHjhVBl.exe
  C:\Windows\System\jHjhVBl.exe
  2⤵
  PID:9952
- C:\Windows\System\RkUEhXr.exe
  C:\Windows\System\RkUEhXr.exe
  2⤵
  PID:9968
- C:\Windows\System\FwAdriu.exe
  C:\Windows\System\FwAdriu.exe
  2⤵
  PID:9984
- C:\Windows\System\JWzWvFT.exe
  C:\Windows\System\JWzWvFT.exe
  2⤵
  PID:10000
- C:\Windows\System\jdLSChu.exe
  C:\Windows\System\jdLSChu.exe
  2⤵
  PID:10016
- C:\Windows\System\ySIjbUG.exe
  C:\Windows\System\ySIjbUG.exe
  2⤵
  PID:10032
- C:\Windows\System\OYWRZFS.exe
  C:\Windows\System\OYWRZFS.exe
  2⤵
  PID:10048
- C:\Windows\System\vuIzLzn.exe
  C:\Windows\System\vuIzLzn.exe
  2⤵
  PID:10064
- C:\Windows\System\ybXtVDY.exe
  C:\Windows\System\ybXtVDY.exe
  2⤵
  PID:10080
- C:\Windows\System\IZoGPnq.exe
  C:\Windows\System\IZoGPnq.exe
  2⤵
  PID:10096
- C:\Windows\System\zcGIkpU.exe
  C:\Windows\System\zcGIkpU.exe
  2⤵
  PID:10112
- C:\Windows\System\MAeXgnj.exe
  C:\Windows\System\MAeXgnj.exe
  2⤵
  PID:10128
- C:\Windows\System\lOxSxdw.exe
  C:\Windows\System\lOxSxdw.exe
  2⤵
  PID:10144
- C:\Windows\System\uXDZwYT.exe
  C:\Windows\System\uXDZwYT.exe
  2⤵
  PID:10160
- C:\Windows\System\XRFSLuV.exe
  C:\Windows\System\XRFSLuV.exe
  2⤵
  PID:10176
- C:\Windows\System\uVHssQr.exe
  C:\Windows\System\uVHssQr.exe
  2⤵
  PID:10192
- C:\Windows\System\dPwPLgi.exe
  C:\Windows\System\dPwPLgi.exe
  2⤵
  PID:10208
- C:\Windows\System\TjYYIrK.exe
  C:\Windows\System\TjYYIrK.exe
  2⤵
  PID:10224
- C:\Windows\System\dXRkihH.exe
  C:\Windows\System\dXRkihH.exe
  2⤵
  PID:9208
- C:\Windows\System\aTruqXg.exe
  C:\Windows\System\aTruqXg.exe
  2⤵
  PID:8740
- C:\Windows\System\RZDpBdk.exe
  C:\Windows\System\RZDpBdk.exe
  2⤵
  PID:9172
- C:\Windows\System\TWCIaJv.exe
  C:\Windows\System\TWCIaJv.exe
  2⤵
  PID:9224
- C:\Windows\System\pOfjQvl.exe
  C:\Windows\System\pOfjQvl.exe
  2⤵
  PID:9336
- C:\Windows\System\gpdyeSm.exe
  C:\Windows\System\gpdyeSm.exe
  2⤵
  PID:8364
- C:\Windows\System\SQBsQQD.exe
  C:\Windows\System\SQBsQQD.exe
  2⤵
  PID:9288
- C:\Windows\System\SrpuEej.exe
  C:\Windows\System\SrpuEej.exe
  2⤵
  PID:9400
- C:\Windows\System\jlFeDVd.exe
  C:\Windows\System\jlFeDVd.exe
  2⤵
  PID:9436
- C:\Windows\System\UeXmzar.exe
  C:\Windows\System\UeXmzar.exe
  2⤵
  PID:9352
- C:\Windows\System\ZNCNPCt.exe
  C:\Windows\System\ZNCNPCt.exe
  2⤵
  PID:9448
- C:\Windows\System\aUytQqw.exe
  C:\Windows\System\aUytQqw.exe
  2⤵
  PID:9528
- C:\Windows\System\Disdkaz.exe
  C:\Windows\System\Disdkaz.exe
  2⤵
  PID:9548
- C:\Windows\System\QPVhURI.exe
  C:\Windows\System\QPVhURI.exe
  2⤵
  PID:9544
- C:\Windows\System\SuJRFyv.exe
  C:\Windows\System\SuJRFyv.exe
  2⤵
  PID:9624
- C:\Windows\System\vKeTHMw.exe
  C:\Windows\System\vKeTHMw.exe
  2⤵
  PID:9628
- C:\Windows\System\VoybOBd.exe
  C:\Windows\System\VoybOBd.exe
  2⤵
  PID:9656
- C:\Windows\System\JRZlfTu.exe
  C:\Windows\System\JRZlfTu.exe
  2⤵
  PID:9688
- C:\Windows\System\GsZWlQL.exe
  C:\Windows\System\GsZWlQL.exe
  2⤵
  PID:9704
- C:\Windows\System\uXfxhuW.exe
  C:\Windows\System\uXfxhuW.exe
  2⤵
  PID:9740
- C:\Windows\System\EtoSnWz.exe
  C:\Windows\System\EtoSnWz.exe
  2⤵
  PID:9788
- C:\Windows\System\NIdqPDr.exe
  C:\Windows\System\NIdqPDr.exe
  2⤵
  PID:9800
- C:\Windows\System\IOLsijN.exe
  C:\Windows\System\IOLsijN.exe
  2⤵
  PID:9852
- C:\Windows\System\cBOlbRj.exe
  C:\Windows\System\cBOlbRj.exe
  2⤵
  PID:9880
- C:\Windows\System\wSKEhos.exe
  C:\Windows\System\wSKEhos.exe
  2⤵
  PID:9948
- C:\Windows\System\SddCJfG.exe
  C:\Windows\System\SddCJfG.exe
  2⤵
  PID:9960
- C:\Windows\System\MQvAUWy.exe
  C:\Windows\System\MQvAUWy.exe
  2⤵
  PID:9964
- C:\Windows\System\XbcjNJj.exe
  C:\Windows\System\XbcjNJj.exe
  2⤵
  PID:10040
- C:\Windows\System\peOpguk.exe
  C:\Windows\System\peOpguk.exe
  2⤵
  PID:10028
- C:\Windows\System\HeTMcJh.exe
  C:\Windows\System\HeTMcJh.exe
  2⤵
  PID:10076
- C:\Windows\System\bLnHoXB.exe
  C:\Windows\System\bLnHoXB.exe
  2⤵
  PID:10088
- C:\Windows\System\jhTJPeA.exe
  C:\Windows\System\jhTJPeA.exe
  2⤵
  PID:10168
- C:\Windows\System\eDHgfeH.exe
  C:\Windows\System\eDHgfeH.exe
  2⤵
  PID:10236
- C:\Windows\System\YLutOdY.exe
  C:\Windows\System\YLutOdY.exe
  2⤵
  PID:10092
- C:\Windows\System\qpMVUck.exe
  C:\Windows\System\qpMVUck.exe
  2⤵
  PID:9272
- C:\Windows\System\asusiis.exe
  C:\Windows\System\asusiis.exe
  2⤵
  PID:10188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CxSXKoc.exe

Filesize
1.8MB

MD5
5fe7cb7223c1405c25ff7fb20acb8145

SHA1
a6797ce4e1aa87ef17bc063b176ce4afa3877638

SHA256
ae43a3e2a4dd332a71087cd1e9e83464843db16fdc13fa1efd981c82da7afcb1

SHA512
1b52988a310c0f2b62eeab1ac17343e76b521ba2adaaebf868dc2df81778311d942143e3cbee6a014d1fc8d4c55cac8ba771839b1806f67a510894894e698a42

Download Submit
C:\Windows\system\Mcgfuwo.exe

Filesize
1.8MB

MD5
c67daab7b0e51b4519d5f42114dbdaf6

SHA1
c94ba6e978adbe2b95038a1edfe9ba53f696b96c

SHA256
81a117f674b7b7c427a204107ad490875b9c54037b389fa85804ff5c53f1170c

SHA512
192f1318192d30d99291f4d78b5de8c4818c5dc26e56873880331f9732d3dd7545211cc19fe532afc96fef231e4555c9086cb74a74e065d73d73c4740233697e

Download Submit
C:\Windows\system\NUbQvaJ.exe

Filesize
1.8MB

MD5
205f7765d8983eea81c4faef63357275

SHA1
ad6b4cab346346fbec14f6fc33dc787dc6df1cb0

SHA256
f1d9728e77b8f0676859b9b72449bf7050ef201c73d8070d691f5d01419adb31

SHA512
2c4c1832479a982383f51dc12a3a4888366404e4d57add15c0c7b14b129e69bc30e3c4046836bb3a99933d22fd0503eb2b252711264bd303ff2aeb563d7bab33

Download Submit
C:\Windows\system\PTSDexS.exe

Filesize
1.8MB

MD5
5be455d4d6e6d159c0ad7b9b1178259f

SHA1
c9fca802d20b52f3a4c07cde89f762598debef35

SHA256
751cc54e3bded1b9605907795b364522fa6145a8c3037ab955f887d48dec3f64

SHA512
8806a675e76495b25f0c373c2befbcc96420883be9bdb74830ceda38042010b5aadb6370f20c20b7bf11e4d3e6211f6770f2333dd7dd369afa2b27ecf4c137df

Download Submit
C:\Windows\system\VPEmErs.exe

Filesize
1.8MB

MD5
a9fffd771c05a0e3a53906ea18583026

SHA1
a6034534fbbe27430b83770e7e211bfbc1264706

SHA256
0bafdb087a29e13847cf7a5b8f97d216839d1ae9925c3444e149fe7ce6fd5ab5

SHA512
406308f1be827602ac3c155adbebaf564c623edfaa88760223b3ee863589a879d398bf6e9be87ff4da0da868e0626343df6b9928bce6b1a27b43f47c7881f305

Download Submit
C:\Windows\system\WRdSSqq.exe

Filesize
1.8MB

MD5
612bed19b039006a6e7f482158ed4ee5

SHA1
d14b5058f62c43305985564a49c112ed55cbb90d

SHA256
03f2e3f44d8db4b4f122d662ab825b5b2c81780718b1e7f3dae44f85441bc1cd

SHA512
0a4f3e50302cd37ceb94c1884ad20a1e2d9c85e6cd1568c6c4cc7e0d5c9a4a591397cc3aceee3fbba008f62fe9e7c3f77a20615296cbb422a6ce0b421d62b7c7

Download Submit
C:\Windows\system\bNyYWZg.exe

Filesize
1.8MB

MD5
b94e8f9448600c3c71120d9e6f62815c

SHA1
40620710e29af2af1656e9f5466b83e7805c5e2e

SHA256
d5ac316df7aa1192efd7a50b7417ea446294710b952c3754dca4b0c8a7062496

SHA512
96f507230641fdf68a4c075b2aed7bf7704ca6e228a907643c0e99ae9ae5458dd04414498b075bbd79fa82f9c75cb27f373cecb3a613b4b76c2f5274ba26767c

Download Submit
C:\Windows\system\hJiwwkO.exe

Filesize
1.8MB

MD5
2c4421fd2e3496b3a7ddc0719bf6e741

SHA1
f2491fbdaae01a68dc43eeedffcc934707671bc2

SHA256
68c20f166c6d1a44ba890e4fd3231ff1dc5d70434da249162320ea8e8710b4a4

SHA512
b771f79de73502f17d5fed8ce9dd00222b246297c7189e695527b01044bd6b4f0af603ea44caffbe7187e7e52e2c07a41c1c11ca29f1440a070a8fbacf7c8973

Download Submit
C:\Windows\system\iEFsRrV.exe

Filesize
1.8MB

MD5
2405ce9fcde7c190da429380885dad65

SHA1
d5d4319b02f6a130c959bd3bdc96f63e895fb485

SHA256
9fedfcd4482033cbc151227e32828e6b39e642a2a64d1f6bec8846847dc24a86

SHA512
db6fc0f67e69ce3769169e3cabb122d6dd45f42727bbe94d9d576b5fae9852e4a8088cf2c5943b0344d1d680647af0e803d15945afed98233699d276c8049d4c

Download Submit
C:\Windows\system\iUaoEog.exe

Filesize
1.8MB

MD5
b3e6cf96ea0536f4156339405cf671a2

SHA1
127b4b365ba3c702cc693f1f4e3aaf97a36dddf1

SHA256
3b0fc1e4a218a8a97fba7069f2918bf73cab025f9932249e4c01c8b1ab08de5a

SHA512
3f80e68d248ab3b98c3403910b3dae1461f4f0bc47d1d69bada2506749ae55c58a84fe324bd8897c42f490083ecd78e604265f4940820151b8680ae7d185da7a

Download Submit
C:\Windows\system\ixHAqDQ.exe

Filesize
1.8MB

MD5
f62058cfcf106ddd00c8c644e20d17bf

SHA1
bcc7f4a763d1102f5cccef32c17bd4391febc3f5

SHA256
ec46edd7d50993cc6990267bee77b58966428d5b873b21b709a25dcf4c67b4a2

SHA512
39743f54fae0e9700254138e0e27c6cb5f0ea78987d6f9e6f1307bfa53d998b5d6ad70d75cdd692d7139042d54d00ada6151123c5b20c542f2e402bc6ae2905a

Download Submit
C:\Windows\system\kePCAqI.exe

Filesize
1.8MB

MD5
7c97a45e8ec154a3539499739efe4ebb

SHA1
550f87280377166b79f8f5808e4253b4df6f40bc

SHA256
c1170365eafb7297542c04c3789eccbc49bcd16d93a8d02094d04f45070906bf

SHA512
a7e8e6b88b136cf2961f1742deee63e7af4e9ee75c227810575cd6e7d72a2b244da633e718a16d23c510c8b9e7199518168b42e5fdafbe1447861243680660d2

Download Submit
C:\Windows\system\mTFYFXU.exe

Filesize
1.8MB

MD5
22974e468cae65540ebdcd016de28436

SHA1
9fa771d3eb667328e2eab5b6ddff3a92b7184c2d

SHA256
f6b170b7195ca200546beffcabb269c2d8943e8dfbb094d2752d261f7a0f073a

SHA512
b7c99776c8dac3659e42b4a5898e83898a897417035a63401bca2874c5582c3cc42b0e0228fef3babb08998a809fe2e6895638e19054ff31697fcb5ea6a17db1

Download Submit
C:\Windows\system\mXUrPad.exe

Filesize
1.8MB

MD5
37912eaea1e29175d1282b5724b61f16

SHA1
bded28e7912263607e6d240967362606675430d5

SHA256
6c6fe61876de9dcf449f2280ae8c6dbebe4de9e59905bbe62e2b900c173b7d1e

SHA512
bd59e3a8213784f6c4d7332947f31b0ad9ec563c213d25167379b44b36eb401038576ebc7420a63d89b83dcfd8eeabda8e1ab1140ff729e7c7626e33251b318f

Download Submit
C:\Windows\system\rPuhiIq.exe

Filesize
1.8MB

MD5
4da9daacea6e6e657dd47440ea603100

SHA1
f9e0d172ea1fab06915188ffe512762acd0c8c2c

SHA256
40efc1642aea126ccd98340cd4cc35179a1dc312aad134a47581f885349806a4

SHA512
625ec2f941ec5512d9bcacaba5b9094498fa42c0603a53a15e84110a62a636663c7141ff0b8becb6bb647663f5f0f83e5ca2c2973c6e1214a2ba32dd383e9d40

Download Submit
C:\Windows\system\sopkIGN.exe

Filesize
1.8MB

MD5
d38bc3674e50e895887655e6b564b411

SHA1
6e8e12266cb902cd18e2934a6fdccaadc62f4382

SHA256
a8c2bac924806e13b21e51dec8f859dccf55301a0312df8efe8563fd0bcd20db

SHA512
0a6f94de6cf6e6aece1f33a3410745acdf03e8a5305f526236ffda0cc1ef1667b120f408add78513ebb51854b250260a3c5a19847e1c123447a23067eb55cb01

Download Submit
C:\Windows\system\uemPYvM.exe

Filesize
1.8MB

MD5
bad6805a652fc754d31b4f7978d384e8

SHA1
5ca91099f437bd9a73e32108179e44278a5b63c4

SHA256
ba8927e82817957214a48c0bcad9c53d13953baf7a49e6cca84221df1d093816

SHA512
e784a58da08019bdfe04c630d1d756db863375b49326a75ec719ddfae4bd99ea467668819576513861d97ef262792945c6e7c6410b07fa6be848ea01df2364f1

Download Submit
C:\Windows\system\vHoWJFG.exe

Filesize
1.8MB

MD5
a16a5dc75d4c1efedb4e01e273193e61

SHA1
bcc4e534fffa2c7d2e8a6569f5999372fc1936a8

SHA256
cdf4933afe436a87583e976815c39f5bff84a8f996c269559b9ca5c6a858cf7b

SHA512
ec1a3c224fbda95fcfd8128ca864f377d3461a1600886324f75b8f1d05a4d9ba23a45f2b6f1d6c4f995c71446f137aa099dc4cf2d6475e573247bc79213ede1a

Download Submit
C:\Windows\system\vSrCtXH.exe

Filesize
1.8MB

MD5
0bc346d7e7d2240c6f6c701eeebb1554

SHA1
8b7fe1562eb9500cfb65acf332d4dabde9344f01

SHA256
61ccf03272cca318fb095d17a843c85a1be8f2a2bf5b24d939dac891840a60c0

SHA512
73f2b7ce985c8c6d16aebcd4c95757c8222303ceec114b003115a382b7b22316db8b508461594aea33278fc6daf427ece3fb211b6005ba1b20d39dca56d61b19

Download Submit
C:\Windows\system\wnCkdFz.exe

Filesize
1.8MB

MD5
7760d9085bc56d74a0ad3895bb370d62

SHA1
d128cac67a71e2b68fee9ad13afcd6e238c4801b

SHA256
77081a840cab252311e32e493b6b61fc94a305c7b02811b5ab3a30fb90eed984

SHA512
0043163d8c2fe5941e829253f471b0267951d42f26b54d5f546223f3b7ca484e4b26d14e8189538320c3456f0369feb31a0caaaadfa3a6051759cecf677dbffe

Download Submit
C:\Windows\system\wsOYEXx.exe

Filesize
1.8MB

MD5
60a08f459958959181c9bffcf61f58ea

SHA1
450b3ff581553ec07c83b0bd63065304074e6af8

SHA256
898956e6190d7d0ddab82c16363c600ad0922e37b2cbe49ad7ae4fa36f6e1c45

SHA512
f756cfbdef77f996fc447bc7860254268cd328078981f929bb82fc96cf0e88f36131dfc3fdd4b8002e1d9638ae6355fa17f4a6c6f99a4f06ba33f8c5fdb75d32

Download Submit
C:\Windows\system\xvIgSet.exe

Filesize
1.8MB

MD5
8e90314439f4e5840821804a1d2055e3

SHA1
b89eb83b126d5682c70eb60e1abfd83cc560e94e

SHA256
4af5ec10905e69dbbf0e9142433081b8f0dd3d593a9dc9251f8f9758a6e35e48

SHA512
91786251f1ea1b39ca84b38659ad172d334bfb2cf56c2f903bc8025226ce75bd51e7e9e33f0d620131ebe1fd5587ae2a7904c37fdecfde2ea4ddc92a3ea0583a

Download Submit
C:\Windows\system\zEGWvrp.exe

Filesize
1.8MB

MD5
1649398e0c991b6284116134a3bfdaeb

SHA1
c1057859fff8ebc0dd745a1a0bfecc8c4a55a20c

SHA256
b02ea753dd01c0f03ce33613f753f71f8ad63bf57e987662a8c1648e3f73a19c

SHA512
29356df151d3b3a51ecad1ebeccac8fbe01295315ef8484bcbdc8eb89ae9e15f668a17ccf2f0d7c449a028a1b3015baba15ec5568381aa680f1feffeed6ff2a9

Download Submit
\Windows\system\IyXLxaT.exe

Filesize
1.8MB

MD5
6e6bf8c81d2cf770835be2d312eddbac

SHA1
01fafc0f6a98000a4d0141694d9fff225e47d6c6

SHA256
e081c146bf5dc10ee8fdec523e10e6a771bf13a3ce529c374a8a69f3ab5f57ca

SHA512
81563f7c42ba5fd83c4d1f7bd9b0e8dfc3cffe5019f0c36354366eeb542133b3f79b527212a592f85b5eecf4f1572a0d9cfa914a22e028133b4d41b28ad68fdd

Download Submit
\Windows\system\QhKRbOx.exe

Filesize
1.8MB

MD5
cb43c219cdd58a2fa330dc809b3fe29c

SHA1
4b411bb34f613568dca7cd083d2bd60ffea818e4

SHA256
24b6ce234ed9e0ab801f8e691e83bcd55773297792c1ea6f3980b0ec53580d45

SHA512
85ac22958eb368276137a4955921c5432e53b802a5e35659f6bf107d5341b0d9a62af540fd8a6c400b6015eb70e02e9a7442237cf6b06c91b973d5d71d2eaa57

Download Submit
\Windows\system\TmxOZoY.exe

Filesize
1.8MB

MD5
6106247a0e43069a099bbbda8ad21579

SHA1
774c83d4071dbb26d217a015cac747c7f3bb6daa

SHA256
5d107d6d90cc284561da3990e8555caccd247c018ce5f3624755e298e65341f1

SHA512
fb82a895d671568a793a66a07159db5682b2a0ee7fcbc4c0acb558301fb2c9afb78f030f7213a69e37400f6748d398d1716593a7288996e85acb0c4c4268cea9

Download Submit
\Windows\system\bNvUhgt.exe

Filesize
1.8MB

MD5
d22c8335555a1184f1ff3f5506e69b04

SHA1
fa655d96105d8515e1ca4ca0b44d385cafbbf879

SHA256
94fcbf8d403127d6f2f1fdd51932a6f03830ea750d02fb4b10785cb258d395f9

SHA512
b3c276b01d1d6a2f4b6760f18bb37eafa3755acc6d54ca842bea24f53a3cee56dc6d0bba674521b17b1dcfee2f817cca01a7c005f90f45945298dd6e25771174

Download Submit
\Windows\system\cVQhDQb.exe

Filesize
1.8MB

MD5
e3500c2b38dc71fdc82e41a7e814763d

SHA1
a2e6619fbe932b5cc158ae259893c9d7086dd93d

SHA256
a9d1fd143c63ba171a51664435aa47d7a6b56cf5e38e685b207445de508ed716

SHA512
37c7c1297fa02a018cfcfafb2404b8177f495337e2a74a29afa09bb3c39fd82b6d77b38a2740501e845250f1426ffaf6e721749b9a08e34c0300b2a9ce1e9340

Download Submit
\Windows\system\cYmBcLI.exe

Filesize
1.8MB

MD5
b7c6757e4cf909f72fc06e0ecc381e6f

SHA1
b58cd0dd87996a02d1474c30f6dfcdfdd88adb8d

SHA256
8950bae9210f08d7807b294f631b7751eb3b3ff46313af6e1652427e2765a664

SHA512
55083f833e4ad5521736d0b5795a50d9e936fa9d974d0a3bae2b1879367df39846ba73b78b8091fd7efbaf1f8c655767d20e67e5068685c940bc6b08bf0b3bb1

Download Submit
\Windows\system\eDFJTIy.exe

Filesize
1.8MB

MD5
3f7cb7ecf5277e4fd2f160df5155eb0b

SHA1
9ba2d9286f846490c99e2adfc7beabac9954b931

SHA256
b281931748aa2b962ad6a58a07c80eb8f542c8948a14d754e67633a342e39f79

SHA512
f87f6a716714d9ee69143081535a2f1b12b08f72baf1571078d0cc2c24164e606797937527d71b1b9052d1c8b44238cc291eaa49e87a2dd783b7738531983ea8

Download Submit
\Windows\system\lTKfexk.exe

Filesize
1.8MB

MD5
c632b57dc7a62bb61a4631fd3e4c5cc8

SHA1
7e4541125ffa1b33b6165a2e193239cb5c7337a8

SHA256
59aca85c50176e79c631e51403e1dfd62f298ff04f22ea756a6ee2aa408b2af6

SHA512
49be159992a1dbd7ce93bc133280e833b19022d4d32f38398476d3d80fe685a7784a74a9b6ab8dec9e6164fbf1b05c7f6f6bd41f26b2560097b72c9676e9eef5

Download Submit
\Windows\system\zAvwuDP.exe

Filesize
1.8MB

MD5
c8439f0dff133b526f00ef45b21f2f59

SHA1
dfd47027f4fbb27beaaac1545385df5faa03244f

SHA256
daf6aa8d5d4db7b9658679b3338a68c6e1d1e458f75e921702ee3227cbd8980c

SHA512
851b5a0050dee684e15ce138fbf465012d9ea91fb6fadca298b5b2bc6c6b4d89225265ac83f3eff7998ea2d883c8d8847a487e6d82ea488fb9a06bcc9bdb41df

Download Submit
memory/1260-4016-0x000000013FCC0000-0x0000000140014000-memory.dmp

Filesize
3.3MB

Download
memory/1260-72-0x000000013FCC0000-0x0000000140014000-memory.dmp

Filesize
3.3MB

Download
memory/1724-4014-0x000000013F1C0000-0x000000013F514000-memory.dmp

Filesize
3.3MB

Download
memory/1724-29-0x000000013F1C0000-0x000000013F514000-memory.dmp

Filesize
3.3MB

Download
memory/1888-117-0x000000013F330000-0x000000013F684000-memory.dmp

Filesize
3.3MB

Download
memory/1888-4023-0x000000013F330000-0x000000013F684000-memory.dmp

Filesize
3.3MB

Download
memory/2376-20-0x000000013F2A0000-0x000000013F5F4000-memory.dmp

Filesize
3.3MB

Download
memory/2376-4015-0x000000013F2A0000-0x000000013F5F4000-memory.dmp

Filesize
3.3MB

Download
memory/2548-4013-0x000000013F230000-0x000000013F584000-memory.dmp

Filesize
3.3MB

Download
memory/2548-42-0x000000013F230000-0x000000013F584000-memory.dmp

Filesize
3.3MB

Download
memory/2648-4022-0x000000013F190000-0x000000013F4E4000-memory.dmp

Filesize
3.3MB

Download
memory/2648-137-0x000000013F190000-0x000000013F4E4000-memory.dmp

Filesize
3.3MB

Download
memory/2720-98-0x000000013F680000-0x000000013F9D4000-memory.dmp

Filesize
3.3MB

Download
memory/2720-4020-0x000000013F680000-0x000000013F9D4000-memory.dmp

Filesize
3.3MB

Download
memory/2732-138-0x000000013FB00000-0x000000013FE54000-memory.dmp

Filesize
3.3MB

Download
memory/2732-4019-0x000000013FB00000-0x000000013FE54000-memory.dmp

Filesize
3.3MB

Download
memory/2836-4018-0x000000013F9E0000-0x000000013FD34000-memory.dmp

Filesize
3.3MB

Download
memory/2836-94-0x000000013F9E0000-0x000000013FD34000-memory.dmp

Filesize
3.3MB

Download
memory/2864-4017-0x000000013FED0000-0x0000000140224000-memory.dmp

Filesize
3.3MB

Download
memory/2864-97-0x000000013FED0000-0x0000000140224000-memory.dmp

Filesize
3.3MB

Download
memory/3048-146-0x000000013F600000-0x000000013F954000-memory.dmp

Filesize
3.3MB

Download
memory/3048-4011-0x000000013F1B0000-0x000000013F504000-memory.dmp

Filesize
3.3MB

Download
memory/3048-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/3048-61-0x0000000001F50000-0x00000000022A4000-memory.dmp

Filesize
3.3MB

Download
memory/3048-35-0x000000013F9E0000-0x000000013FD34000-memory.dmp

Filesize
3.3MB

Download
memory/3048-143-0x000000013F190000-0x000000013F4E4000-memory.dmp

Filesize
3.3MB

Download
memory/3048-0-0x000000013FDA0000-0x00000001400F4000-memory.dmp

Filesize
3.3MB

Download
memory/3048-17-0x000000013F230000-0x000000013F584000-memory.dmp

Filesize
3.3MB

Download
memory/3048-1687-0x000000013FDA0000-0x00000001400F4000-memory.dmp

Filesize
3.3MB

Download
memory/3048-1874-0x0000000001F50000-0x00000000022A4000-memory.dmp

Filesize
3.3MB

Download
memory/3048-2094-0x0000000001F50000-0x00000000022A4000-memory.dmp

Filesize
3.3MB

Download
memory/3048-144-0x000000013F190000-0x000000013F4E4000-memory.dmp

Filesize
3.3MB

Download
memory/3048-4012-0x0000000001F50000-0x00000000022A4000-memory.dmp

Filesize
3.3MB

Download
memory/3048-142-0x000000013F1B0000-0x000000013F504000-memory.dmp

Filesize
3.3MB

Download
memory/3048-147-0x0000000001F50000-0x00000000022A4000-memory.dmp

Filesize
3.3MB

Download
memory/3048-141-0x000000013FA30000-0x000000013FD84000-memory.dmp

Filesize
3.3MB

Download
memory/3048-48-0x000000013F680000-0x000000013F9D4000-memory.dmp

Filesize
3.3MB

Download
memory/3048-140-0x000000013F480000-0x000000013F7D4000-memory.dmp

Filesize
3.3MB

Download
memory/3048-139-0x000000013F820000-0x000000013FB74000-memory.dmp

Filesize
3.3MB

Download
memory/3048-89-0x0000000001F50000-0x00000000022A4000-memory.dmp

Filesize
3.3MB

Download
memory/3048-109-0x0000000001F50000-0x00000000022A4000-memory.dmp

Filesize
3.3MB

Download
memory/3048-113-0x000000013F330000-0x000000013F684000-memory.dmp

Filesize
3.3MB

Download
memory/3056-4021-0x000000013F1B0000-0x000000013F504000-memory.dmp

Filesize
3.3MB

Download
memory/3056-145-0x000000013F1B0000-0x000000013F504000-memory.dmp

Filesize
3.3MB

Download